WO2022237741A1 - 一种通信方法及装置 - Google Patents

一种通信方法及装置 Download PDF

Info

Publication number
WO2022237741A1
WO2022237741A1 PCT/CN2022/091806 CN2022091806W WO2022237741A1 WO 2022237741 A1 WO2022237741 A1 WO 2022237741A1 CN 2022091806 W CN2022091806 W CN 2022091806W WO 2022237741 A1 WO2022237741 A1 WO 2022237741A1
Authority
WO
WIPO (PCT)
Prior art keywords
service
network element
request message
client authentication
network
Prior art date
Application number
PCT/CN2022/091806
Other languages
English (en)
French (fr)
Inventor
吴义壮
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP22806704.7A priority Critical patent/EP4325918A1/en
Priority to BR112023023383A priority patent/BR112023023383A2/pt
Priority to KR1020237042282A priority patent/KR20240005900A/ko
Publication of WO2022237741A1 publication Critical patent/WO2022237741A1/zh
Priority to US18/504,954 priority patent/US20240073212A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0884—Network architectures or network communication protocols for network security for authentication of entities by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/56—Provisioning of proxy services
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H04W12/082—Access security using revocation of authorisation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H04W12/084—Access security using delegated authorisation, e.g. open authorisation [OAuth] protocol
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/068—Network architectures or network communication protocols for network security for supporting key management in a packet data network using time-dependent keys, e.g. periodically changing keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/108—Source integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/61—Time-dependent

Definitions

  • the embodiments of the present application relate to the field of wireless communication, and in particular, to a communication method and device.
  • FIG. 1 shows an enhanced service architecture.
  • indirect communication in addition to direct communication between network elements (referred to as direct communication), indirect communication can also be used (referred to as indirect communication, also known as indirect communication).
  • SCP service communication proxy
  • two parties of communication are called service consumer (consumer) and service provider (producer) respectively.
  • a consumer refers to a service requester or a service caller
  • a provider refers to a service provider.
  • the service consumer is also called the service consumption network element
  • the service provider is also called the service providing network element.
  • an authentication scheme based on client credentials assertion is introduced.
  • the consumer's inclusion of the CCA in the service request enables the receiving endpoint to authenticate the consumer.
  • the consumer that is, the authenticated party
  • the receiving end point that is, the authenticator
  • the existing standards do not define how to generate the correct CCA in different indirect communication scenarios, so as to prevent the problem that service consumption network elements may fail to request services.
  • Embodiments of the present application provide a communication method and device, which are used to improve the situation that a service consumption network element fails to request a service.
  • the embodiment of the present application provides a communication method, the method includes:
  • the service consuming network element sends a first service request message to the service communication agent, the first service request message is used to request a first service from the service providing network element, the first service request message includes a first customer authentication credential, the The first client authentication credential is used to authenticate the service consuming network element, the first client authentication credential includes a first network function type and a second network function type, and the first network function type is the service providing network element A network function type, the second network function type is a network function type of a network element providing a second service; wherein, the second service is associated with the first service; the service consuming network element communicates from the service A proxy receives a response message to the first service request message.
  • the service consumption network element in the scenario where the service consumption network element requests the first service from the service transmission network element through the service communication agent, the service consumption network element carries and includes the first network function in the first service request message sent to the service communication agent.
  • the customer authentication credentials of the type and the second network function type can further ensure that when the service communication agent requests the second service, the network element providing the second service successfully authenticates the service consuming network element, and then also requests the first service for the service consuming network element It provides protection and solves the problem that service consumption network elements fail to request services due to customer authentication certificate authentication failures in indirect communication scenarios.
  • the second service is used to provide an access token corresponding to the first service, and the access token corresponding to the first service is used to indicate that the service consuming network element has access to the Permissions for the first service.
  • the service consuming network element determines that there is no available access token corresponding to the first service.
  • the above-mentioned design enables the service consumption network element to generate the first client authentication certificate on demand, preventing the first client authentication certificate from being abused.
  • the service consuming network element may carry parameters for obtaining the access token corresponding to the first service in the first service request message .
  • the service consuming network element determines that there is no available access token corresponding to the first service may include the following situation: the service consuming network element determines that no access token corresponding to the first service is stored. an access token; or, the service consuming network element determines that the stored access token corresponding to the first service has expired.
  • the service consuming network element deletes the expired access token.
  • the storage space can be released in time and the storage burden of the system can be reduced.
  • the second service is used to provide information of the service providing network element.
  • the service consuming network element determines that the first service request message will trigger the service communication agent to request the second service.
  • the service consuming network element determines that the first service request message will trigger the service communication agent to request the second service
  • the service consuming network element according to one or more of the following item, it is determined that the first service request message will trigger the service communication agent to request the second service: the context of the first terminal device is not stored, and the first terminal device is associated with the first service; or, the context of the first terminal device is not stored; storing the context of the first service; or, the service providing network element belongs to the first slice and does not store the context corresponding to the first slice; or, the service consuming network element communicates with the service for the first time Agent communication.
  • the service consuming network element may carry parameters for discovering the service providing network element in the first service request message.
  • the service consuming network element determines to use the indirect communication mode of mode D to request the first service.
  • the first service request message when the service consumption network element uses mode D to communicate with the service communication agent through standard agreement agreement or through pre-configuration information configuration, the first service request message always carries the first network function type and the second network function type client authentication credentials. Or when the service consumption network element uses mode D to communicate with the service communication agent, when it is judged that the first service request message will trigger the service communication agent to request the second service, the first service request message carries the first network function type and the second Client Authentication Credentials for Network Capabilities Type.
  • the service consumption network element sends a second service request message to the service communication agent, the second service request message is used to request the first service, and the second service request message including a second client authentication credential, the second client authentication credential includes the first network function type, and the second client authentication credential is used to authenticate the service consumption network element; the service consumption network element obtains from the service The communications agent receives a response message to the second service request message, the response message to the second service request message including indication information.
  • the service consumption network element sends the first service request message to the service communication agent, the service consumption network element sends the first service request message to the service communication agent according to the indication information.
  • the service consuming network element can send the first service request message to the service communication agent according to the indication information.
  • the indication information includes a third client authentication credential, and the third client authentication credential includes the second network function type; wherein the third client authentication credential is used to authenticate the provided The network element of the second service; when the service consuming network element sends the first service request message to the service communication agent according to the indication information, according to the third customer authentication credential, the When the authentication of the network element providing the second service succeeds, the service consuming network element sends the first service request message to the service communication agent.
  • the service consuming network element can authenticate the network element providing the second service according to the third client authentication certificate, and when the authentication is successful, send the first service request message according to the second network function type included in the third client authentication certificate.
  • the network element providing the second service is a network storage function network element.
  • the first customer authentication credential further includes one or more of the following: the identifier of the service consuming network element or valid time information, where the valid time information is used to represent the first The valid time of a client authentication credential.
  • the present application provides a communication method.
  • the method includes: a first network element receives a first service request message from a service communication agent, and the first service request message is used to request a first service request from the first network element.
  • the first service request message includes a first client authentication credential, and the first client authentication credential is used to authenticate a service consumption network element, where the first client authentication credential includes multiple network function types; the first client authentication credential includes a plurality of network function types;
  • a network element authenticates the service consuming network element according to the first client authentication credential, wherein the first network element authenticates the service consuming network element according to the first client authentication credential, including: the first A network element judges whether its own network function type matches one or more of the multiple network function types; the first network element sends the first service request to the service communication agent according to the authentication result The response message for the message.
  • the first network element judges whether its own network function type matches one or more of the multiple network function types, and obtains the authentication result. Therefore, the above method can realize whether the authentication of the service consumption network element is successful when the customer authentication certificate includes multiple network function types, and further can realize that the network elements with different network function types can use the same customer authentication certificate to realize the authentication of the service consumption network. Yuan authentication.
  • the first network element when the authentication result is that the authentication is successful, sends a response message for the first service request message to the service communication agent, and the first network element for the first The response message of the service request message is used to provide the first service; or, when the authentication result is an authentication failure, the first network element sends a response to the first service request message to the service communication agent message, the response message to the first service request message indicates that the request for the first service fails.
  • the multiple network function types include a first network function type and a second network function type
  • the first network function type is a network function type of the first network element
  • the second network function type is a network function type of the first network element.
  • the second network function type is a network function type of a network element providing a second service, and the second service is associated with the first service.
  • network elements with two different types of network functions can use the same customer authentication credential to authenticate service consumption network elements.
  • the second service is used to provide an access token corresponding to the first service, where the access token corresponding to the first service is used to indicate that the service consuming network element has access to The authority of the first service; or, the second service is used to provide the information of the first network element.
  • the network element providing the second service is a network storage function network element.
  • the first service is used to provide an access token corresponding to the second service, where the access token corresponding to the second service is used to indicate that the service consuming network element has access to The authority of the second service; or, the first service is used to provide the information of the second service network element.
  • network elements with two different types of network functions can use the same customer authentication credential to authenticate service consumption network elements.
  • the first network element is a network storage function network element.
  • the first network element receives a second service request message from the service communication agent, and the second service request message is used to request the first network element for the first service, the second service request message includes a second client authentication credential, and the second client authentication credential includes a third network function type; when the third network function type is different from the network function type of the first network element If they match, the first network element sends a response message to the service communication agent to the second service request message, where the response message to the second service request message includes indication information, where the The indication information is used to trigger the first service request message.
  • the first network element may carry indication information in the response message to the second service request message, and the indication information may The first service request message is triggered, and then the customer authentication credential including the network function type matching the network function type of the first network element is obtained, so that the first network element successfully authenticates the service consumption network element.
  • the indication information includes a third client authentication credential for authenticating the first network element, where the third client authentication credential includes a network function type of the first network element.
  • the first client authentication credential in the first service request message to carry the network function type matching the network function type of the first network element by indicating that the information carries the network function type of the first network element, so as to realize The service consumer network element is authenticated successfully.
  • the first client authentication credential further includes the identifier of the service consuming network element and valid time information of the first client authentication credential; the valid time information of the first client authentication credential is used To represent the valid time of the first client authentication credential; the first network element authenticates the service consumption network element according to the first client authentication credential, and also includes one or more of the following: the first network element Verifying whether the signature of the first client authentication certificate passes, verifying whether the first client authentication certificate has expired according to the valid time information included in the first client authentication certificate, or verifying the Whether the identifier of the service consuming network element is the same as the identifier of the network element in the certificate used to sign the first client authentication certificate.
  • the present application provides a communication method, the method includes: a service consuming network element sends a first service request message to a service communication agent, and the first service request message is used to request a first service from a service providing network element,
  • the first service request message includes a fourth client authentication credential and a fifth client authentication credential, the fourth client authentication credential is used by the service providing network element to authenticate the service consuming network element, and the fifth client authentication credential
  • the network element used to provide the second service authenticates the service consuming network element, the fourth client authentication credential includes the first network function type, the fifth client authentication credential includes the second network function type, and the first network
  • the function type is the network function type of the network element providing the service, and the second network function type is the network function type of the network element providing the second service, wherein the second service is associated with the first service ;
  • the service consuming network element receives a response message to the first service request message from the service communication agent.
  • the service consumption network element sends the first service request message to the service communication agent, wherein the first service request message includes the fourth client authentication credential and the fifth client authentication credential, and the fourth client authentication credential includes the first network function Type, the fifth customer authentication credential includes the second network function type, which can enable the network element providing the second service to successfully authenticate the service consumption network element, and then also provide guarantee for the service consumption network element to request the first service, and solve the problem of indirect communication
  • the service consumption network element fails to request the service.
  • the fourth client authentication credential further includes the identifier of the service consuming network element, valid time information of the fourth client authentication credential, and the valid time information of the fourth client authentication credential is used To characterize the valid time of the fourth customer authentication credential;
  • the fifth customer authentication credential also includes the identifier of the service consumption network element, the valid time information of the fifth customer authentication credential, and the fifth customer authentication credential The valid time information of is used to characterize the valid time of the fifth client authentication certificate.
  • the valid time of the fifth client authentication credential is shorter than the valid time of the fourth client authentication credential.
  • Adopting the above design can reduce the risk of the fifth client authentication credential being used maliciously by the service communication agent, thereby ensuring the security of the communication process.
  • the validity time of the fourth customer authentication credential is associated with a first duration
  • the first duration is the transmission delay between the service consumption network element and the service communication agent and the service
  • the transmission delay between the communication agent and the network element providing the second service is determined.
  • the above configuration rules for the valid time of the fourth client authentication certificate and the valid time of the fifth client authentication certificate can ensure that the fourth client authentication certificate and the fifth client authentication certificate are not maliciously used by the service communication agent, thereby ensuring the security of the communication process sex.
  • the second service is used to provide an access token corresponding to the first service, and the access token corresponding to the first service is used to indicate that the service consuming network element has access to the Permissions for the first service.
  • the service consuming network element determines that there is no available access token corresponding to the first service.
  • the service consuming network element may carry parameters for obtaining the access token corresponding to the first service in the first service request message .
  • the above-mentioned design enables the service consumption network element to generate the first client authentication certificate on demand, preventing the first client authentication certificate from being abused.
  • the service consuming network element determines that there is no available access token corresponding to the first service may include the following situation: the service consuming network element determines that no access token corresponding to the first service is stored. an access token; or, the service consuming network element determines that the stored access token corresponding to the first service has expired.
  • the service consuming network element deletes the expired access token.
  • the storage space can be released in time and the storage burden of the system can be reduced.
  • the second service is used to provide information of the service providing network element.
  • the service consuming network element determines that the first service request message will trigger the service communication agent to request the second service.
  • the service consuming network element determines that the first service request message will trigger the service communication agent to request the second service
  • the service consuming network element according to one or more of the following item, it is determined that the first service request message will trigger the service communication agent to request the second service: the context of the first terminal device is not stored, and the first terminal device is associated with the first service; or, the context of the first terminal device is not stored; storing the context of the first service; or, the service providing network element belongs to the first slice and does not store the context corresponding to the first slice; or, the service consuming network element communicates with the service for the first time Agent communication.
  • the service consuming network element may carry parameters for discovering the service providing network element in the first service request message.
  • the service consuming network element determines to use the indirect communication mode of mode D to request the first service.
  • the first service request message when the service consumption network element uses mode D to communicate with the service communication agent through standard agreement agreement or through pre-configuration information configuration, the first service request message always carries the first network function type and the second network function type client authentication credentials. Or when the service consumption network element uses mode D to communicate with the service communication agent, when it is judged that the first service request message will trigger the service communication agent to request the second service, the first service request message carries the first network function type and the second Client Authentication Credentials for Network Capabilities Type.
  • the service consumption network element sends a second service request message to the service communication agent, the second service request message is used to request the first service, and the second service request message including a second client authentication credential, the second client authentication credential includes the first network function type, and the second client authentication credential is used to authenticate the service consumption network element; the service consumption network element obtains from the service The communications agent receives a response message to the second service request message, the response message to the second service request message including indication information.
  • the service consuming network element sends the first service request message to the service communication agent, the service consuming network element sends the first service request message to the service communication agent according to the indication information.
  • the service consuming network element can send the first service request message to the service communication agent according to the indication information.
  • the indication information includes a third client authentication credential, and the third client authentication credential includes the second network function type; wherein the third client authentication credential is used to authenticate the provided The network element of the second service; when the service consuming network element sends the first service request message to the service communication agent according to the indication information, according to the third customer authentication credential, the When the authentication of the network element providing the second service succeeds, the service consuming network element sends the first service request message to the service communication agent.
  • the service consuming network element can authenticate the network element providing the second service according to the third client authentication certificate, and when the authentication is successful, send the first service request message according to the second network function type included in the third client authentication certificate.
  • the network element providing the second service is a network storage function network element.
  • the present application provides a communication method.
  • the method includes: the service communication agent receives a first service request message from a service consumption network element, and the first service request message is used to request a first service from a service provision network element.
  • the first service request message includes a fourth client authentication credential and a fifth client authentication credential
  • the fourth client authentication credential is used by the service providing network element to authenticate the service consuming network element
  • the fifth client The authentication credential is used by the first network element to authenticate the service consuming network element, wherein the fourth client authentication credential includes a first network function type
  • the fifth client authentication credential includes a second network function type
  • the first The network function type is the network function type of the service providing network element
  • the second network function type is the network function type of the first network element; in response to the first service request message, the service communication agent sends The first network element sends a second service request message, where the second service request message is used to request a second service, and the second service request message includes the fifth client authentication cred
  • the service consumption network element sends the first service request message to the service communication agent, wherein the first service request message includes the fourth client authentication credential and the fifth client authentication credential, and the fourth client authentication credential includes the first network function Type, the fifth client authentication credential includes the second network function type, the service communication agent requests the second service to carry the fifth client authentication credential, which can make the network element providing the second service successfully authenticate the service consumption network element, and the service communication agent requests the second service to carry the fifth client authentication credential.
  • a service carries the fourth customer authentication certificate, which can enable the service provider network element to successfully authenticate the service consumption network element, thereby providing a guarantee for the service consumption network element to request the first service, and solving the problem of failure to authenticate the customer authentication certificate in the indirect communication scenario. , leading to the problem that the service consumption network element fails to request the service.
  • the service communication agent determines, according to the first service request message, that the second service needs to be requested from the first network element; determined to carry the fifth client authentication credential in the second service request message.
  • the service communication agent can parse the first service request message, and select the fifth client authentication credential from the fourth client authentication credential and the fifth client authentication credential to add to the second service request message according to the network function type of the first network element .
  • the service communication agent determines to carry the fourth customer authentication credential in the third service request message according to the network function type of the service providing network element.
  • the service communication agent can parse the first service request message, and select the fourth client authentication credential from the fourth client authentication credential and the fifth client authentication credential to add to the second service request message according to the network function type of the service providing network element .
  • the service communication agent before the service communication agent receives the first service request message from the service consuming network element, the service communication agent receives the fourth service request message from the service consuming network element, The fourth service request message is used to request the first service, the third service request message includes a sixth client authentication credential, and the sixth client authentication credential includes a third network function type; the service communication agent sends The first network element sends a fifth service request message, the fifth service request message is used to request the second service, and the fifth service request message includes the sixth client authentication credential; the service communication agent receiving a response message from the first network element to the fifth service request message, where the response message to the fifth service request message includes indication information; the service communication agent sends the message to the The service consuming network element sends a response message to the fourth service request message.
  • the service communication agent can send a response message to the service consuming network element to the service consumption network element according to the indication information, so as to obtain a customer authentication credential that matches the network function type of the first network, so that the first network element The service consumer network element is authenticated successfully.
  • the indication information includes a seventh client authentication credential, and the seventh client authentication credential includes the network function type of the first network element; the response message to the fourth service request message further Including said seventh client authentication credential.
  • the indication information can trigger the service consumption network element to send the first service request message, and include the customer authentication credential matching the network function type of the first network in the first service request message.
  • the second service is used to provide an access token corresponding to the first service, and the access token corresponding to the first service is used to indicate that the service consuming network element has access to the Permissions for the first service.
  • the service communication agent determines that no available access token corresponding to the first service is stored and the first service request message does not include the access token corresponding to the first service.
  • the second service is used to provide information of the service providing network element.
  • the service communication agent determines that the information of the service providing network element is not stored and the first service request message does not include the information of the service providing network element.
  • the fourth client authentication credential further includes the identifier of the service consuming network element, valid time information of the fourth client authentication credential, and the valid time information of the fourth client authentication credential is used To characterize the valid time of the fourth customer authentication credential;
  • the fifth customer authentication credential also includes the identifier of the service consumption network element, the valid time information of the fifth customer authentication credential, and the fifth customer authentication credential The valid time information of is used to characterize the valid time of the fifth client authentication certificate.
  • the valid time of the fifth client authentication credential is shorter than the valid time of the fourth client authentication credential.
  • Adopting the above design can reduce the risk of the fifth client authentication credential being used maliciously by the service communication agent, thereby ensuring the security of the communication process.
  • the validity time of the fourth customer authentication credential is associated with a first duration
  • the first duration is the transmission delay between the service consumption network element and the service communication agent and the service
  • the transmission delay between the communication agent and the network element providing the second service is determined.
  • the above configuration rules for the valid time of the fourth client authentication certificate and the valid time of the fifth client authentication certificate can ensure that the fourth client authentication certificate and the fifth client authentication certificate are not maliciously used by the service communication agent, thereby ensuring the security of the communication process sex.
  • the network element providing the second service is a network storage function network element.
  • the present application provides a communication method, the method includes: a first network element receives a first service request message from a service communication agent, and the first service request message is used to request the first network element
  • the first service, the first service request message includes multiple client authentication credentials; each client authentication credential includes a network function type; the first network element authenticates the service consumption network element according to the multiple client authentication credentials ;
  • the first network element judges whether there are one or more customers in the authentication of the plurality of client authentication credentials
  • the authentication certificate successfully authenticates the service consuming network element; the first network element sends a response message to the service communication agent according to the authentication result to the first service request message.
  • the first network element judges that there are one or more customer authentication certificates to successfully authenticate the service consumption network element, and obtains an authentication result. Therefore, the above method can realize judging whether the authentication of the service consumption network element is successful when there are multiple client authentication credentials.
  • the first network element when the authentication result indicates that there are one or more customer authentication certificates and the service consumption network element is successfully authenticated, the first network element sends a message for the first service to the service communication agent.
  • a response message to a request message the response message to the first service request message is used to provide the first service; or, when the authentication result indicates that any one of the plurality of client authentication credentials is a pair of client authentication credentials
  • the first network element sends a response message to the service communication agent to the first service request message, and the response message to the first service request message indicates to request the The first service fails.
  • the multiple client authentication credentials include a fourth client authentication credential and a fifth client authentication credential
  • the fourth client authentication credential includes the first network function type
  • the fifth client authentication credential includes The second network function type
  • the first network function type is the network function type of the first network element
  • the second network function type is the network function type of the network element providing the second service
  • the second service associated with the first service includes a fourth client authentication credential and a fifth client authentication credential.
  • the second service is used to provide an access token corresponding to the first service, where the access token corresponding to the first service is used to indicate that the service consuming network element has access to The authority of the first service; or, the second service is used to provide the information of the first network element.
  • the network element providing the second service is a network storage function network element.
  • the first service is used to provide an access token corresponding to the second service, where the access token corresponding to the second service is used to indicate that the service consuming network element has access to The authority of the second service; or, the first service is used to provide the information of the second service network element.
  • the first network element is a network storage function network element.
  • the first network element receives a second service request message from the service communication agent, and the second service request message is used to request the first network element for the first service, the second service request message includes a sixth client authentication credential, and the sixth client authentication credential includes a third network function type; when the third network function type is different from the network function type of the first network element If they match, the first network element sends a response message to the third service request message to the service communication agent, where the response message to the third service request message includes indication information, where the The indication information is used to trigger the first service request message.
  • the first network element may carry indication information in the response message to the third service request message, and the indication information may The first service request message is triggered, and then the customer authentication credential including the network function type matching the network function type of the first network element is obtained, so that the first network element successfully authenticates the service consumption network element.
  • the indication information includes a seventh client authentication credential used to authenticate the first network element, and the seventh client authentication credential includes a network function type of the first network element.
  • the first client authentication credential in the first service request message can be triggered to carry the network function type matching the network function type of the first network element by indicating that the information carries the network function type of the first network element. Credentials to achieve successful authentication of service consumption network elements.
  • the present application provides a communication method, the method is applied to a scenario where a service consuming network element requests a first service from a service providing network element through a service communication agent, and the method includes: the service communication agent sends the service The consuming network element sends a client authentication credential request message; the client authentication credential request message is used to request a first client authentication credential, and the first client authentication credential is used to provide a second service network element to authenticate the service consuming network element, so The second service is associated with the first service; the service communication agent receives a response message from the service consuming network element for the client authentication credential request message, and a response message for the client authentication credential request message including the first client authentication credential, the first client authentication credential including a first network function type and a second network function type, or the first client authentication credential including a second network function type, the first network function
  • the type is a network function type of the service providing network element
  • the second network function type is a network function type of the network element providing
  • the service communication agent can request the customer authentication certificate, thereby ensuring that the service communication agent requests the second service, and the service consuming network element requests the first service.
  • the service communication agent before the service communication agent sends a customer authentication credential request message to the service consumption network element, the service communication agent receives the first service request message from the service consumption network element, The first service request message is used to request the first service, the first service request message includes a second client authentication credential, and the second client authentication credential includes the first network function type; the service communication The agent sends a second service request message to the first network element, the second service request message is used to request the second service, and the second service request message includes the second customer authentication credential; the service communication agent receiving a response message from the first network element to the second service request message, where the response message to the second service request message includes indication information; when the service communication agent sends the service consumption network element When sending a client authentication credential request message, the service communication agent sends the client authentication credential request message to the service consuming network element according to the indication information.
  • the first network element may carry indication information in the response message to the second service request message, and the indication information may A client authentication credential request message is triggered, and then a client authentication credential including a network function type matching the network function type of the first network element is obtained, so that the first network element successfully authenticates the service consumption network element.
  • the indication information includes a third client authentication credential, and the third client authentication credential includes the network function type of the first network element; the client authentication credential request message includes the third Client Authentication Credentials.
  • the first client authentication credential in the first service request message can be triggered to carry the network function type matching the network function type of the first network element by indicating that the information carries the network function type of the first network element. Credentials to achieve successful authentication of service consumption network elements.
  • the first client authentication credential includes the second network function type; the service communication agent sends a third service request message to the first network element, and the third service request message For requesting the second service, the third service request message includes the first client authentication credential; the service communication agent receives a response message from the first network element to the third service request message; The service communication agent sends a fourth service request message to the service providing network element according to the response message to the third service request message, the fourth service request message is used to request the first service, and the fourth service request message
  • the second client authentication credential is included.
  • the service communication agent parses the response message for the client authentication credential, carries the first client authentication credential in the third service request message according to the network function type of the first network element, and carries the first client authentication credential in the third service request message according to the network function type of the service providing network element. 4.
  • the second client authentication credential is carried in the service request message.
  • the first client authentication credential includes the first network function type and the second network function type;
  • the service communication agent sends a third service request message to the first network element , the third service request message is used to request the second service, the third service request message includes the first client authentication credential;
  • the service communication agent receives from the first network element the 3.
  • the service communication agent sends a fourth service request message to the service providing network element according to the response message to the third service request message, and the fourth service request message is used to request the first service , the fourth service request message includes the first client authentication credential, or, the fourth service request message includes the second client authentication credential.
  • the service communication agent parses the response message for the client authentication credential, carries the first client authentication credential in the third service request message according to the network function type of the first network element, and carries the first client authentication credential in the third service request message according to the network function type of the service providing network element. 4.
  • the service request message carries the first client authentication credential or the second client authentication credential.
  • the second service is used to provide an access token corresponding to the first service, and the access token corresponding to the first service is used to indicate that the service consuming network element has access to the Permissions for the first service.
  • the service communication agent determines that the first access token is not stored and the first service request message does not include the first access token.
  • the second service is used to provide information of the service providing network element.
  • the service communication agent determines that the information of the service providing network element is not stored and the first service request message does not include the information of the service providing network element.
  • the network element providing the second service is a network storage function network element.
  • the present application provides a communication device, which includes a transceiver unit and a processing unit, and the processing unit invokes the transceiver unit to perform: sending a first service request message to a service communication agent, and the first service request message Used to request a first service from a service providing network element, the first service request message includes a first client authentication credential, the first client authentication credential is used to authenticate the device, and the first client authentication credential includes a first A network function type and a second network function type, the first network function type is the network function type of the service providing network element, and the second network function type is the network function type of the network element providing the second service; wherein , the second service is associated with the first service; and a response message to the first service request message is received from the service communication agent.
  • the second service is used to provide an access token corresponding to the first service, and the access token corresponding to the first service is used to indicate that the device has access to the first service permission.
  • the processing unit is configured to determine that there is no available access token corresponding to the first service.
  • the processing unit is configured to not store the access token corresponding to the first service when it is determined that there is no available access token corresponding to the first service; or, determine to store The access token corresponding to the first service has expired.
  • the processing unit when the stored access token corresponding to the first service has expired, the processing unit is configured to delete the expired access token.
  • the second service is used to provide information of the service providing network element.
  • the processing unit is configured to determine that the first service request message will trigger the service communication agent to request the second service.
  • the processing unit when it is determined that the first service request message will trigger the service communication agent to request the second service, the processing unit is configured to determine the The first service request message will trigger the service communication agent to request the second service: the context of the first terminal device is not stored, and the first terminal device is associated with the first service; or, the first terminal device is not stored The context of the service; or, the service providing network element belongs to the first slice and does not store the context corresponding to the first slice; or, the device communicates with the service communication agent for the first time.
  • the processing unit is configured to determine that the indirect communication mode using mode D requests the first service.
  • the transceiver unit is configured to: send a second service request message to the service communication agent, the second service request message is used to request the first service, and the second service request The message includes a second client authentication credential, the second client authentication credential including the first network function type, the second client authentication credential used to authenticate the device; receiving from the service communication agent for the second A response message to the service request message, the response message to the second service request message includes indication information.
  • the processing unit is configured to send the first service request message to the service communication agent according to the indication information.
  • the indication information includes a third client authentication credential
  • the third client authentication credential includes the second network function type
  • the third client authentication credential is used to authenticate the provided The network element of the second service
  • the transceiving unit is configured to: when sending the first service request message to the service communication agent according to the indication information, according to the third customer authentication credential If the authentication of the network element providing the second service succeeds, sending the first service request message to the service communication agent.
  • the network element providing the second service is a network storage function network element.
  • the first client authentication credential further includes one or more of the following: the identification of the device or valid time information, wherein the valid time information is used to represent the Validity time of the credential.
  • the present application provides a communication device, which includes a transceiver unit and a processing unit, the transceiver unit is configured to receive a first service request message from a service communication agent, and the first service request message is used to send a message to the service communication agent.
  • the device requests a first service, the first service request message includes a first client authentication credential, and the first client authentication credential is used to authenticate a service consumption network element, wherein the first client authentication credential includes a plurality of network functions Type; the processing unit is configured to authenticate the service consuming network element according to the first client authentication credential, wherein when the service consuming network element is authenticated according to the first client authentication credential, the processing The unit judges whether its own network function type matches one or more of the plurality of network function types; the processing unit invokes the transceiver unit to send an A response message to a request message.
  • the transceiving unit when the authentication result is that the authentication is successful, the transceiving unit is configured to send a response message to the service communication agent for the first service request message, and the response message for the second service request message is: A response message of a service request message is used to provide the first service; or, when the authentication result is an authentication failure, the transceiving unit is configured to send the first service request message to the service communication agent A response message for the first service request message indicates that the request for the first service fails.
  • the multiple network function types include a first network function type and a second network function type
  • the first network function type is the network function type of the device
  • the second network function type The type is a network function type of a network element providing a second service
  • the second service is associated with the first service.
  • the second service is used to provide an access token corresponding to the first service, where the access token corresponding to the first service is used to indicate that the service consuming network element has access to The permission of the first service; or, the second service is used to provide the information of the device.
  • the network element providing the second service is a network storage function network element.
  • the first service is used to provide an access token corresponding to the second service, where the access token corresponding to the second service is used to indicate that the service consuming network element has access to The authority of the second service; or, the first service is used to provide the information of the second service network element.
  • the device is a network element with a network storage function.
  • the transceiving unit is configured to receive a second service request message from the service communication agent, where the second service request message is used to request the first service from the device,
  • the second service request message includes a second client authentication credential, the second client authentication credential includes a third network function type;
  • the transceiver unit is configured to send a response message to the second service request message to the service communication agent, the The response message to the second service request message includes indication information, where the indication information is used to trigger the first service request message.
  • the indication information includes a third client authentication credential used to authenticate the device, and the third client authentication credential includes a network function type of the device.
  • the first client authentication credential further includes the identifier of the service consuming network element and valid time information of the first client authentication credential; the valid time information of the first client authentication credential is used To characterize the valid time of the first client authentication credential; the processing unit, configured to authenticate the service consumption network element according to the first client authentication credential, further includes one or more of the following: verifying the first client authentication credential Whether the signature of a client authentication credential is passed, verifying whether the first client authentication credential is expired or verifying whether the service consumption network element in the first client authentication credential is valid according to the valid time information included in the first client authentication credential Whether the identifier is the same as the identifier of the network element in the certificate used to sign the first client authentication certificate.
  • the present application provides a communication device, which includes a transceiver unit and a processing unit: the processing unit invokes the transceiver unit to perform: sending a first service request message to a service communication agent, and the first service request message Used to request a first service from a service providing network element, the first service request message includes a fourth client authentication credential and a fifth client authentication credential, and the fourth client authentication credential is used by the service providing network element to authenticate the The service consumption network element, the fifth customer authentication credential is used to authenticate the service consumption network element by the network element providing the second service, the fourth customer authentication credential includes the first network function type, and the fifth customer authentication credential Including a second network function type, the first network function type is the network function type of the service providing network element, and the second network function type is the network function type of the network element providing the second service, wherein, The second service is associated with the first service; receiving a response message from the service communication agent to the first service request message.
  • the fourth client authentication credential further includes the identifier of the service consuming network element, valid time information of the fourth client authentication credential, and the valid time information of the fourth client authentication credential is used To characterize the valid time of the fourth customer authentication credential;
  • the fifth customer authentication credential also includes the identifier of the service consumption network element, the valid time information of the fifth customer authentication credential, and the fifth customer authentication credential The valid time information of is used to characterize the valid time of the fifth client authentication certificate.
  • the valid time of the fifth client authentication credential is shorter than the valid time of the fourth client authentication credential.
  • the validity time of the fourth customer authentication credential is associated with a first duration
  • the first duration is the transmission delay between the service consumption network element and the service communication agent and the service
  • the transmission delay between the communication agent and the network element providing the second service is determined.
  • the second service is used to provide an access token corresponding to the first service, and the access token corresponding to the first service is used to indicate that the device has access to the first service permission.
  • the processing unit is configured to determine that there is no available access token corresponding to the first service.
  • the processing unit is configured to not store the access token corresponding to the first service when it is determined that there is no available access token corresponding to the first service; or, determine to store The access token corresponding to the first service has expired.
  • the processing unit when the stored access token corresponding to the first service has expired, the processing unit is configured to delete the expired access token.
  • the second service is used to provide information of the service providing network element.
  • the processing unit is configured to determine that the first service request message will trigger the service communication agent to request the second service.
  • the processing unit when it is determined that the first service request message will trigger the service communication agent to request the second service, the processing unit is configured to determine the The first service request message will trigger the service communication agent to request the second service: the context of the first terminal device is not stored, and the first terminal device is associated with the first service; or, the first terminal device is not stored The context of the service; or, the service providing network element belongs to the first slice and does not store the context corresponding to the first slice; or, the device communicates with the service communication agent for the first time.
  • the processing unit is configured to determine that the indirect communication mode using mode D requests the first service.
  • the transceiver unit is configured to: send a second service request message to the service communication agent, the second service request message is used to request the first service, and the second service request The message includes a second client authentication credential, the second client authentication credential including the first network function type, the second client authentication credential used to authenticate the device; receiving from the service communication agent for the second A response message to the service request message, the response message to the second service request message includes indication information.
  • the processing unit is configured to send the first service request message to the service communication agent according to the indication information.
  • the indication information includes a third client authentication credential
  • the third client authentication credential includes the second network function type
  • the third client authentication credential is used to authenticate the provided The network element of the second service
  • the transceiving unit is configured to: when sending the first service request message to the service communication agent according to the indication information, according to the third customer authentication credential If the authentication of the network element providing the second service succeeds, sending the first service request message to the service communication agent.
  • the network element providing the second service is a network storage function network element.
  • the first client authentication credential further includes one or more of the following: the identification of the device or valid time information, wherein the valid time information is used to represent the Validity time of the credential.
  • the present application provides a communication device, the device includes a transceiver unit and a processing unit, and the processing unit invokes the transceiver unit to perform: receiving a first service request message from a service consuming network element, the second A service request message is used to request a first service from a service providing network element, the first service request message includes a fourth client authentication credential and a fifth client authentication credential, and the fourth client authentication credential is used by the service providing network element
  • the element authenticates the service consumption network element, and the fifth client authentication credential is used by the first network element to authenticate the service consumption network element, wherein the fourth client authentication credential includes the first network function type, and the fifth client authentication credential is used to authenticate the service consumption network element.
  • the customer authentication credential includes a second network function type, the first network function type is the network function type of the service providing network element, and the second network function type is the network function type of the first network element; in response to The first service request message sends a second service request message to the first network element, the second service request message is used to request a second service, and the second service request message includes the fifth client authentication Credentials; receiving a response message from the first network element to the second service request message; sending a third service request message to the service providing network element according to the response message to the second service request message , the third service request message is used to request the first service from the service providing network element, and the third service request message includes the fourth customer authentication credential.
  • the processing unit is configured to determine, according to the first service request message, that the second service needs to be requested from the first network element; according to the network function of the first network element type, determine to carry the fifth client authentication credential in the second service request message.
  • the processing unit is configured to determine to carry the fourth client authentication credential in the third service request message according to the network function type of the service providing network element.
  • the transceiving unit before receiving the first service request message from the service consuming network element, is configured to receive a fourth service request message from the service consuming network element, the The fourth service request message is used to request the first service, the third service request message includes a sixth client authentication credential, and the sixth client authentication credential includes a third network function type; to the first network element Sending a fifth service request message, where the fifth service request message is used to request the second service, where the fifth service request message includes the sixth client authentication credential; receiving a request from the first network element for A response message to the fifth service request message, where the response message to the fifth service request message includes indication information; sending a response message to the fourth service request message to the service consuming network element according to the indication information .
  • the indication information includes a seventh client authentication credential, and the seventh client authentication credential includes the network function type of the first network element; the response message to the fourth service request message further Including said seventh client authentication credential.
  • the second service is used to provide an access token corresponding to the first service, and the access token corresponding to the first service is used to indicate that the service consuming network element has access to the Permissions for the first service.
  • the processing unit is configured to determine that no available access token corresponding to the first service is stored and the first service request message does not include the access token corresponding to the first service .
  • the second service is used to provide information of the service providing network element.
  • the processing unit is configured to determine that the information of the service providing network element is not stored and the first service request message does not include the information of the service providing network element.
  • the fourth client authentication credential further includes the identifier of the service consuming network element, valid time information of the fourth client authentication credential, and the valid time information of the fourth client authentication credential is used To characterize the valid time of the fourth customer authentication credential;
  • the fifth customer authentication credential also includes the identifier of the service consumption network element, the valid time information of the fifth customer authentication credential, and the fifth customer authentication credential The valid time information of is used to characterize the valid time of the fifth client authentication certificate.
  • the valid time of the fifth client authentication credential is shorter than the valid time of the fourth client authentication credential.
  • the validity time of the fourth customer authentication credential is associated with a first duration
  • the first duration is the transmission delay between the service consumption network element and the service communication agent and the service
  • the transmission delay between the communication agent and the network element providing the second service is determined.
  • the network element providing the second service is a network storage function network element.
  • the present application provides a communication device, the device includes a transceiver unit and a processing unit, and the processing unit invokes the transceiver unit to perform: receiving a first service request message from a service communication agent, the second A service request message is used to request a first service from the first network element, the first service request message includes a plurality of client authentication credentials; each client authentication credential includes a network function type; the first network element according to The multiple customer authentication credentials authenticate the service consumption network element; where the first network element authenticates the service consumption network element according to the multiple customer authentication credentials, comprising: the first network element judging the Whether there is one or more customer authentication credentials in multiple customer authentication credentials authentication, and the service consumption network element is successfully authenticated; the first network element sends a response to the first service request message to the service communication agent according to the authentication result information.
  • the first network element when the authentication result indicates that there are one or more customer authentication certificates and the service consumption network element is successfully authenticated, the first network element sends a message for the first service to the service communication agent.
  • a response message to a request message the response message to the first service request message is used to provide the first service; or, when the authentication result indicates that any one of the plurality of client authentication credentials is a pair of client authentication credentials
  • the first network element sends a response message to the service communication agent to the first service request message, and the response message to the first service request message indicates to request the The first service fails.
  • the multiple client authentication credentials include a fourth client authentication credential and a fifth client authentication credential
  • the fourth client authentication credential includes the first network function type
  • the fifth client authentication credential includes The second network function type
  • the first network function type is the network function type of the first network element
  • the second network function type is the network function type of the network element providing the second service
  • the second service associated with the first service includes a fourth client authentication credential and a fifth client authentication credential.
  • the second service is used to provide an access token corresponding to the first service, where the access token corresponding to the first service is used to indicate that the service consuming network element has access to The authority of the first service; or, the second service is used to provide the information of the first network element.
  • the network element providing the second service is a network storage function network element.
  • the first service is used to provide an access token corresponding to the second service, where the access token corresponding to the second service is used to indicate that the service consuming network element has access to The authority of the second service; or, the first service is used to provide the information of the second service network element.
  • the first network element is a network storage function network element.
  • the transceiver unit is configured to receive a second service request message from the service communication agent, and the second service request message is used to request the first network element for the first service, the second service request message includes a sixth client authentication credential, the sixth client authentication credential includes a third network function type;
  • the transceiver unit is configured to send a response message to the service communication agent for the second service request message,
  • the response message to the second service request message includes indication information, where the indication information is used to trigger the first service request message.
  • the indication information includes a seventh client authentication credential used to authenticate the first network element, and the seventh client authentication credential includes a network function type of the first network element.
  • the present application provides a communication device, the device includes a transceiver unit and a processing unit, a service consuming network element requests a first service from a service providing network element through the device, and the processing unit invokes the transceiver unit to execute : sending a client authentication credential request message to the service consuming network element; the client authentication credential request message is used to request a first client authentication credential, and the first client authentication credential is used to provide a second service network element to authenticate the service A consuming network element, the second service is associated with the first service; receiving a response message from the service consuming network element to the client authentication credential request message, and a response message to the client authentication credential request message including the first client authentication credential, the first client authentication credential including a first network function type and a second network function type, or the first client authentication credential including a second network function type, the first network function
  • the type is a network function type of the service providing network element
  • the second network function type is a network
  • the transceiving unit before sending a client authentication credential request message to the service consuming network element, is configured to receive a first service request message from the service consuming network element, and the first a service request message for requesting the first service, the first service request message including a second client authentication credential, the second client authentication credential including the first network function type; providing the first service to the The network element of the second service sends a second service request message, the second service request message is used to request the second service, and the second service request message includes the second customer authentication credential; A response message of the network element of the second service to the second service request message, where the response message to the second service request message includes indication information; when sending a client authentication credential request message to the service consuming network element , sending the client authentication credential request message to the service consuming network element according to the indication information.
  • the indication information includes a third client authentication credential, and the third client authentication credential includes the network function type of the first network element; the client authentication credential request message includes the third Client Authentication Credentials.
  • the first client authentication credential includes the second network function type; the service communication agent sends a third service request message to the first network element, and the third service request message For requesting the second service, the third service request message includes the first client authentication credential; the service communication agent receives a response message from the first network element to the third service request message; The service communication agent sends a fourth service request message to the service providing network element according to the response message to the third service request message, the fourth service request message is used to request the first service, and the fourth service request message
  • the second client authentication credential is included.
  • the first client authentication credential includes the first network function type and the second network function type;
  • the transceiver unit is configured to send a third service request to the first network element message, the third service request message is used to request the second service, the third service request message includes the first client authentication credential; receiving the third service request message from the first network element A response message for the third service request message; send a fourth service request message to the service providing network element according to the response message to the third service request message, the fourth service request message is used to request the first service, and the fourth service request message includes The first client authentication credential, or, the fourth service request message includes the second client authentication credential.
  • the second service is used to provide an access token corresponding to the first service, and the access token corresponding to the first service is used to indicate that the service consuming network element has access to the Permissions for the first service.
  • the processing unit before sending a client authentication credential request message to the service consuming network element, the processing unit is configured to determine that the first access token is not stored and the first service request message does not include The first access token.
  • the second service is used to provide information of the service providing network element.
  • the processing unit before sending a customer authentication credential request message to the service consuming network element, is configured to determine that the information of the service providing network element is not stored and the first service request message is not It includes the information of the service providing network element.
  • the network element providing the second service is a network storage function network element.
  • the present application further provides a communication device.
  • the device can perform the method design described above.
  • the apparatus may be a chip or a circuit capable of performing the function corresponding to the above method, or a device including the chip or circuit.
  • the apparatus includes: a memory, configured to store computer executable program codes; and a processor, and the processor is coupled to the memory.
  • the program code stored in the memory includes instructions, and when the processor executes the instructions, the device or the device installed with the device is made to execute the method in any possible design of the first aspect to the sixth aspect above.
  • the device may further include a communication interface, which may be a transceiver, or, if the device is a chip or a circuit, the communication interface may be an input/output interface of the chip, such as an input/output pin.
  • a communication interface which may be a transceiver, or, if the device is a chip or a circuit, the communication interface may be an input/output interface of the chip, such as an input/output pin.
  • the device includes corresponding functional units for respectively implementing the steps in the above methods.
  • the functions may be implemented by hardware, or may be implemented by executing corresponding software through hardware.
  • Hardware or software includes one or more units corresponding to the functions described above.
  • the embodiment of the present application provides a computer-readable storage medium, the computer-readable storage medium stores a computer program, and when the computer program is run on the device, the first aspect to the sixth aspect are executed. Any one of the possible design methods.
  • the embodiment of the present application provides a computer program product, the computer program product includes a computer program, and when the computer program is run on the device, any possible method in the design.
  • the present application provides a communication chip, in which instructions are stored, and when it runs on a communication device, the communication chip executes any one of the possible designs of the first aspect to the sixth aspect above. Methods.
  • FIG. 1 is a schematic structural diagram of a mobile communication system applied in an embodiment of the present application
  • FIG. 2 is a schematic diagram of an indirect communication mode of mode C in an embodiment of the present application
  • FIG. 3 is a schematic diagram of an indirect communication mode of mode D in an embodiment of the present application.
  • FIG. 4 is a schematic diagram of the direct interaction between the NF service consumer and the NRF in the indirect communication mode of mode C in the embodiment of the present application;
  • FIG. 5 is a schematic diagram of the interaction between the NF service consumer and the NRF through the SCP in the indirect communication mode of the mode C in the embodiment of the present application;
  • FIG. 6 is one of the schematic diagrams of the interaction between the NF service consumer and the NRF through the SCP in the indirect communication mode of the mode D in the embodiment of the present application;
  • FIG. 7 is the second schematic diagram of the interaction between the NF service consumer and the NRF through the SCP in the indirect communication mode of the mode D in the embodiment of the present application;
  • FIG. 8 is one of the overview flow charts of a communication method in an embodiment of the present application.
  • FIG. 9 is a specific process of sending the first service request message to the service communication agent by the service consumption network element according to the indication information in the embodiment of the present application;
  • FIG. 10 is the second overview flowchart of a communication method in the embodiment of the present application.
  • FIG. 11 is the third overview flowchart of a communication method in the embodiment of the present application.
  • FIG. 12 is the fourth overview flowchart of a communication method in the embodiment of the present application.
  • FIG. 13 is one of the flow charts for the NF service consumer to obtain the first service when it is determined that the first service needs to be requested and there is no available access token corresponding to the first service in an embodiment of the present application;
  • FIG. 14 is the second flow chart of the NF service consumer obtaining the first service when it is determined that the first service needs to be requested and there is no available access token corresponding to the first service in the embodiment of the present application;
  • FIG. 15 is the third flowchart of the NF service consumer obtaining the first service when it is determined that the first service needs to be requested and there is no available access token corresponding to the first service in the embodiment of the present application;
  • FIG. 16 is a flow chart of the NF service consumer obtaining the first service when it is determined that the first service needs to be requested and there is an available access token corresponding to the first service in an embodiment of the present application;
  • FIG. 17 is one of the flow charts for the NF service consumer to obtain the first service when the first service needs to be requested and the request for the first service triggers the SCP to request the parameters of the NF service producer in the embodiment of the present application;
  • Fig. 18 is the second flowchart of obtaining the first service by the NF service consumer when the first service needs to be requested and the request for the first service triggers the SCP to request the parameters of the NF service producer in the embodiment of the present application;
  • FIG. 19 is a flow chart of the NF service consumer sending a service request message to the SCP to obtain the first service according to the indication information in the embodiment of the present application;
  • Fig. 20 is a flow chart of the NF service consumer obtaining the first service when the SCP actively requests the client authentication certificate in an embodiment of the present application;
  • FIG. 21 is one of the structural schematic diagrams of a communication device in the embodiment of the present application.
  • FIG. 22 is the second structural schematic diagram of a communication device in the embodiment of the present application.
  • At least one item (piece) of a, b, or c can represent: a, b, c, a-b, a-c, b-c, or a-b-c, where a, b, c can be single or multiple .
  • WCDMA Wideband Code Division Multiple Access
  • general packet radio service general packet radio service, GPRS
  • long term evolution Long Term Evolution
  • LTE long term evolution
  • LTE frequency division duplex frequency division duplex, FDD
  • LTE time division duplex time division duplex
  • TDD time division duplex
  • UMTS universal mobile telecommunications system
  • WiMAX global interconnected microwave access Access
  • the enhanced service architecture may specifically include but not limited to the following devices:
  • Session management network element mainly used for session management, Internet Protocol (IP) address allocation and management of terminal equipment, selection of termination points that can manage user equipment plane functions, policy control, or charging function interfaces, and Downlink data notification, etc.
  • IP Internet Protocol
  • the session management network element can be a session management function (session management function, SMF) network element.
  • SMF session management function
  • the session management function network element can still be an SMF network element, or have other names. Applications are not limited to this.
  • Nsmf is a service-based interface provided by SMF. SMF can communicate with other network functions through Nsmf.
  • Access management network element mainly used for mobility management and access management, etc., and can be used to implement functions other than session management in the mobility management entity (mobility management entity, MME) function, for example, lawful interception , or access authorization (or authentication) and other functions.
  • the access management network element can be an access and mobility management function (AMF) network element.
  • AMF access and mobility management function
  • the access management network element can still be an AMF network element, or have Other titles are not limited in this application.
  • Namf is a service-based interface provided by AMF. AMF can communicate with other network functions through Namf.
  • Authentication service network element mainly used for user authentication, etc.
  • the authentication service network element may be an authentication server function (authentication server function, AUSF) network element.
  • the authentication service network element may still be an AUSF network element, or have other names. This application There is no limit to this.
  • Nausf is a service-based interface provided by AUSF. AUSF can communicate with other network functions through Nausf.
  • Network open network element used to securely open the services and capabilities provided by the 3rd generation partnership project (3rd generation partnership project, 3GPP) network function to the outside.
  • network exposure function network elements can be network exposure function (NEF) network elements.
  • NEF network exposure function
  • future communications such as 6G communications
  • network exposure function network elements can still be NEF network elements, or have other names. Applications are not limited to this. Among them, Nnef is a service-based interface provided by NEF, and NEF can communicate with other network functions through Nnef.
  • Network storage network element used to provide service registration, discovery and authorization, and maintain available network function (network function, NF) instance information, which can realize on-demand configuration of network functions and services and interconnection between NFs.
  • the service registration refers to that the NF network element needs to register with the network storage network element before providing the service.
  • Service discovery means that when an NF network element needs other NF network elements to provide services for it, it needs to perform service discovery through the network storage network element first, so as to find the desired NF network element that provides services for it. For example, when the NF network element 1 needs the NF network element 2 to provide services for it, it needs to first perform service discovery through the network storage network element to discover the NF network element 2.
  • Service authorization means that when an NF network element needs other NF network elements to provide services, it needs to first obtain authorization information through network storage network elements, so as to further use the authorization information to obtain services provided by other NF network elements. For example, before NF network element 1 requests services from NF network element 2, NF network element 1 first requests the authorization information for accessing NF network element 2 from the network storage network element, and NF network element 1 uses the obtained authorization information to send NF network element 2 Request service.
  • the network storage network element can be a network storage function (network repository function, NRF) network element.
  • NRF network repository function
  • the network storage function network element can still be an NRF network element, or have other names. Applications are not limited to this.
  • Nnrf is a service-based interface provided by NRF. NRF can communicate with other network functions through Nnrf.
  • Policy control network element a unified policy framework for guiding network behavior, providing policy rule information, etc. for control plane functional network elements (such as AMF, SMF, etc.).
  • the policy control network element can be a policy control function (policy control function, PCF) network element.
  • policy control function network element can still be an NEF network element, or have other names. Applications are not limited to this. Among them, Npcf is a service-based interface provided by PCF, and PCF can communicate with other network functions through Npcf.
  • Data management network element used to process user identification, access authentication, registration, or mobility management.
  • the data management network element can be a unified data management (unified data management, UDM) network element.
  • UDM unified data management
  • the data management network element can still be a UDM network element, or have other names. This application There is no limit to this.
  • Nudm is a service-based interface provided by UDM, and UDM can communicate with other network functions through Nudm.
  • Application network element It is used to route the data affected by the application, access the open function of the network, or interact with the policy framework for policy control, etc.
  • the application network element can be an application function (application function, AF) network element.
  • the application network element can still be an AF network element, or have other names, which are not limited in this application .
  • Naf is a service-based interface provided by AF. AF can communicate with other network functions through Naf.
  • UE User equipment
  • MS mobile stations
  • terminal terminal
  • UE user equipment
  • soft terminals etc., such as water meters, electricity meters, sensors, etc.
  • (wireless) access network radio access network, (R) AN) network element: used to provide network access functions for authorized user equipment in a specific area, and can use different quality network elements according to the level of user equipment and service requirements, etc. transport tunnel.
  • RAN can manage wireless resources, provide access services for terminal equipment, and then complete the forwarding of control signals and user equipment data between the terminal and the core network.
  • RAN can also be understood as a base station in a traditional network.
  • User plane function (UPF) network element used for packet routing and forwarding, or quality of service (QoS) processing of user plane data, etc.
  • the user plane network element may be a user plane function (UPF) network element.
  • the user plane network element may still be a UPF network element, or have other names. This application There is no limit to this.
  • Data network (data network, DN) network element used to provide a network for transmitting data, for example, Internet network, etc.
  • the DN network element may be data network authentication, authorization, and accounting (data network authentication, authorization, accounting), or an application server (application function), etc.
  • SCP used to complete the routing and forwarding of service interface messages. It can also be understood as: the SCP can provide routing and forwarding services for the sender of the service interface signaling. For example, when the AMF requests the SMF to establish a session, the AMF sends a session establishment request message to the SCP, and the SCP sends the session establishment request message to the SMF, and the SMF determines whether to respond to the session establishment request message. If the SMF sends the session establishment request message to the SCP In response to the message, the SCP sends the session establishment response message to the AMF. If the SMF sends a session establishment rejection message to the SCP, the SCP sends the session establishment rejection message to the AMF. Wherein, the message exchanged between the AMF and the SMF may pass through a one-hop SCP or a multi-hop SCP.
  • the above function or network element may be a network element in a hardware device, or a software function running on dedicated hardware, or a virtualization function instantiated on a platform (for example, a cloud platform).
  • a platform for example, a cloud platform.
  • the consumer, service consumption network element, and NF service consumer in the following content refer to the same type of network element, and the provider, service providing network element, and NF service producer refer to the same type of network element.
  • the policy of the local operator indicates that the NF service consumer needs to carry the CCA when sending the service request message to the SCP.
  • the local operator's policy may be to configure the NF service consumer to generate a CCA when using indirect communication, so as to authenticate the NF service consumer through the CCA.
  • the consumer directly communicates with the NRF to execute a service discovery process to select a corresponding service providing network element, and the service discovery process does not require the SCP network element to participate.
  • Step 201 the consumer sends a producer discovery message to the NRF.
  • Step 202 NRF sends information of available producers to the consumer.
  • the Consumer may select a target producer according to the acquired information of available producers.
  • Available producer information may include NF set Id or the identity of a specific NF instance.
  • the target producer can be any NF instance corresponding to the NF set Id (that is, any producer in the producer set) or a specific NF instance in the NF instances corresponding to a specific NF Set Id (that is, a specific producer) or a specific NF instance (ie specific producer).
  • the SCP may be responsible for selecting the target producer, see step 204 below for details.
  • Step 203 the consumer sends a service request message to the SCP, which is used to request a specific service from the target producer through the SCP.
  • Step 204 The SCP interacts with the NRF to acquire parameters for selecting a target producer.
  • the parameters obtained by the SCP may include but not limited to the location or capacity of the NF instance.
  • step 204 is an optional step.
  • the service request message includes information of available producers, for example, the information of available producers includes NF set Id, that is, the information of available producers points to a set of NF instances .
  • the SCP needs to select an NF instance from the group of NF instances as the target producer.
  • the SCP can select the target producer according to the parameters obtained from the NRF. For example, the SCP can determine the target producer from a group of NF instances according to the acquired NF instance locations.
  • Step 205 the SCP sends a service request message to the target producer, for requesting the specific service from the target producer.
  • Step 206 The target producer sends a service request response message for providing the specific service to the SCP.
  • Step 207 the SCP sends a service request response message for providing the specific service to the consumer.
  • the consumer does not directly communicate with the NRF, and the SCP network element communicates with the NRF on behalf of the consumer to execute the service discovery process to select the corresponding service provider network element.
  • Step 301 the consumer sends a service request message to the SCP; it is used to request a specific service from the target producer through the SCP.
  • the service request message includes parameters used for target producer discovery and selection.
  • Step 302 the SCP obtains the information of available producers by interacting with the NRF.
  • the SCP may obtain the information of available producers according to the parameters used for the discovery and selection of the target producer in the service request message in step 301 and determine the target producer from the information of the available producers.
  • Step 303 the SCP sends a service request message to the target producer, for requesting a specific service from the target producer.
  • Step 304 The target producer sends a service request response message for providing the specific service to the SCP.
  • Step 305 the SCP sends a service request response message for providing the specific service to the consumer.
  • the service request message received by the SCP from the consumer and the service request message sent by the SCP to the target producer may be the same or different.
  • the SCP may modify the service request message received from the consumer (for example, add, delete or modify part of the information) to generate a service request message to be sent to the target producer.
  • the service request response message received by the SCP from the target producer may be the same as or different from the service request response message sent by the SCP to the consumer.
  • the SCP can modify the service request response message received from the target producer accordingly to generate the service request response message sent to the consumer.
  • CCA Client credentials assertion
  • the CCA may be, for example, a token signed by the authenticated party, and is used by the authenticator to authenticate/verify the authenticated party, that is, to determine the identity of the authenticated party.
  • the CCA is a token signed by the NF service consumer.
  • the receiver of the message that is, the authenticator, such as NRF or NF service producer
  • the CCA may be included in a message header or a message body of a hypertext transfer protocol (hypertext transfer protocol, HTTP) message.
  • HTTP hypertext transfer protocol
  • the CCA may include three parts: a message header (head), a payload (payload) and a signature (signature).
  • the payload includes claims.
  • the claims include NF instance ID of NF service consumer, timestamp, expiration time and NF type of expected audience.
  • the time stamp is used to indicate the issuance time of the CCA
  • the expiration time is used to indicate that the CCA is considered to have expired after this time.
  • the NF type of the expected audience is the NF type of the network element that authenticates the NF service consumer.
  • the message header and payload are signed by the NF service consumer using the private key of the NF service consumer certificate.
  • the message header includes certificate information, that is, information related to the NF service consumer certificate, for example, the certificate information includes the certificate or certificate chain located to the public key, or the certificate information includes the uniform resource location of the certificate or certificate chain located to the public key character (uniform resource locator, URL).
  • the authenticator When the authenticator (such as NRF or NF service producer) receives the message including CCA, the authenticator authenticates the NF service consumer according to the CCA.
  • the specific authentication process is as follows:
  • the authenticator verifies whether the NF type of the expected audience matches its own NF type, for example, may include judging whether the authenticator verifies whether the NF type of the expected audience is the same as its own NF type. For example, when the NF type of the expected audience is AMF, the authenticator verifies whether its own NF type is AMF. Verifying whether the NF instance ID of the NF service consumer in the CCA matches the NF instance ID in the certificate used to sign the CCA, for example, may include judging the NF instance ID of the NF service consumer in the CCA and the NF instance in the certificate used to sign the CCA Whether the ID is the same.
  • the authenticator may also use other procedures to verify the CCA, which is not limited in this application.
  • Access tokens are used to characterize/indicate that a consumer has permission to obtain a service.
  • the provider will provide the corresponding service to the consumer only when the access token is verified.
  • the NRF receives an access token request message from the NF service consumer or SCP, the NRF performs an authorization check, and if it is determined that the authorization is passed, the NRF generates an access token including claims.
  • the access token is divided into two types: the access token based on the NF type of NF service producer (referred to as type A) and the access token based on the NF service producer instance or NF service producer service instance (referred to as type B).
  • an instance is defined from a function, and an instance may be an NF service consumer instance or an NF service producer instance.
  • Instances are defined from services, and instances can also be called service instances.
  • a service instance can be a service instance that provides service A or a service instance that provides service B.
  • the requested access token is used to instruct the NF service consumer to access any NF service producer corresponding to the NF type to obtain service permissions, or the requested access token is used to instruct the NF service consumer to access The service authority of any NF service Producer corresponding to the NF type.
  • the access token request message includes the NF instance ID of the NF service consumer, the desired service name, the NF type of the NF service consumer, and the NF type of the desired NF service producer.
  • the access token request message may also include a single network slice selection assistance information (single network slice selection assistance information, S-NSSAI) list or network slice instance identifier (network slice instance identifier, NSI ID) of the expected NF service producer instance ) list, the NF Set ID of the expected NF service producer instance, the S-NSSAI list of the NF service consumer, etc.
  • S-NSSAI single network slice selection assistance information
  • NSI ID network slice instance identifier
  • the claims in the access token generated by NRF include the NF instance ID of the NRF, the NF instance ID of the NF service consumer, the NF type of the NF service producer, the expected service name, and the valid time of the access token.
  • claims can also include additional scopes (for example, requested resources and requested operations on resources), the S-NSSAI list or NSI ID list of the desired NF service producer instance, and the NF Set of the desired NF service producer instance ID.
  • the access token request message includes the NF instance ID of the NF service consumer, the desired service name, and the requested NF service producer instance ID(s).
  • the claims in the access token generated by NRF include the NF instance ID of the NRF, the NF instance ID of the NF service consumer, the NF instance ID(s) of the NF service producer, the desired service name, and the valid time of the access token.
  • claims may also include additional scopes (for example, requested resources and requested operations on resources) and the like.
  • the valid time of CCA is shorter than that of access token.
  • the NRF performs integrity protection on the access token, for example, uses a key shared with the NF service producer to perform integrity protection on the claims, such as generating a message authentication code (message authentication code, MAC) or Sign the claims with the private key of the NRF certificate.
  • a key shared with the NF service producer to perform integrity protection on the claims, such as generating a message authentication code (message authentication code, MAC) or Sign the claims with the private key of the NRF certificate.
  • a provider e.g. NF service producer
  • the provider performs integrity verification, e.g., verifying the MAC of the access token using a key shared with NRF or verifying access using the public key of the NRF certificate The signature of the token. If the integrity verification is successful, further verify the claims in the access token.
  • the provider verifies whether it matches the service operation requested by the service request message
  • the provider verifies the validity time in the access token according to the current data/time to check whether the access token has expired, or the provider verifies the validity time in the access token according to the current data/time to check whether the access token is within the validity period.
  • the provider verifies the expiration time in the access token according to the current data/time to check whether the access token is expired, or the provider verifies the valid time in the access token according to the current data/time to check whether the access token is within the validity period .
  • the NF service consumer directly interacts with NRF, as shown in Figure 4.
  • Step 401 The NF service consumer determines that there is no available NF service Producer information, and the NF service consumer initiates a discovery (discovery) process of the NF service producer.
  • the discovery process is used to discover available NF service producers.
  • step 402 and step 403 are access tokens of type B, it is necessary to initiate the discovery process prior to step 402, and determine the identifier of a specific NF service producer instance or the identifier of an NF service producer service instance.
  • the discovery process of the NF service producer may be initiated before step 402 and step 403 (that is, step 401), or, after step 402 and step 403 Initiate the discovery process of the NF service producer (ie step 404).
  • the NF service consumer only needs to initiate a discovery process of the NF service producer once.
  • Step 402 The NF service consumer sends an access token request message (for example, Nnrf_AccessToken_Get_Request) to the NRF.
  • an access token request message for example, Nnrf_AccessToken_Get_Request
  • Nnrf_AccessToken_Get_Request for example, Nnrf_AccessToken_Get_Request
  • Step 403 NRF sends an access token response message (for example, Nnrf_AccessToken_Get_Response) to the NF service consumer, and the access token response message includes the access token generated by NRF.
  • an access token response message for example, Nnrf_AccessToken_Get_Response
  • the NRF receives the access token request message from the NF service consumer, and the NRF performs an authorization check, that is, verifies whether the NF service consumer is authorized to obtain the requested service. If the authorization is passed, NRF generates an access token and performs integrity protection on the access token.
  • Step 404 The NF service consumer determines that there is no available producer information (that is, step 401 is not performed), and the NF service consumer initiates a producer discovery process.
  • step 404 is an optional step, and only one step may be executed in step 401 and step 404 .
  • Step 405 The NF service consumer sends a service request message (for example, Service Request) to the SCP, and the service request message includes access token and CCA.
  • a service request message for example, Service Request
  • the service request message includes access token and CCA.
  • the CCA is used for the NF service producer to authenticate the NF service consumer.
  • the claims in the CCA include the NF instance ID of the NF service consumer, the timestamp and expiration time, and the NF type of the expected audience.
  • the receiving endpoint of the service request message is the NF service producer
  • the NF type of the expected audience is the NF type of the NF service producer.
  • the CCA please refer to the relevant content above, and details will not be repeated here.
  • the AMF when the AMF requests the SMF to establish a session through the SCP, the AMF sends a session establishment request message to the SCP, and the session establishment request message includes an access token and a CCA.
  • the CCA at this time includes the NF instance ID of AMF, timestamp and expiration time, and the NF type of the expected audience is SMF.
  • Step 406 the SCP sends a service request message to the NF service producer.
  • the SCP implements application programming interface (Application Programming interface, API) modification, and sends the received service request message to the NF service producer.
  • API Application Programming interface
  • the SCP sends the service request message to the specific NF service producer instance or the NF service producer service instance. If the service request message includes NF set Id, SCP can select one NF instance to send the service request message to it.
  • Step 407 The NF service producer receives the service request message from the SCP. NF service producer verifies CCA and access token.
  • the NF service producer performs integrity verification on the access token. If the integrity verification is successful, it further verifies the claims in the access token. For details, see the relevant content of the claims verification in the access token above.
  • the NF service producer also needs to verify the NF service consumer according to the CCA. For the specific process of verifying the CCA, refer to the relevant description about the CCA verification mentioned above.
  • Step 408 The NF service producer determines that the access token and the CCA verification are successful, and then the NF service producer sends a service response message (for example, Service Response) to the SCP.
  • a service response message for example, Service Response
  • Step 409 the SCP sends a service response message to the NF service consumer.
  • the SCP receives the service response message from the NF service producer to perform API modification, and sends the service response message to the NF service consumer.
  • Scenario 2 Indirect process without agent discovery (mode C): NF service consumer interacts with NRF through SCP, as shown in Figure 5.
  • Step 501 The NF service consumer determines that there is no available NF service Producer information, and the NF service consumer initiates a discovery process of the NF service producer.
  • the discovery process is used to discover available NF service producers.
  • step 502 and step 503 it is necessary to initiate the discovery process prior to step 502, and determine the identifier of a specific NF service producer instance or the identifier of an NF service producer service instance.
  • the discovery process of the NF service producer may be initiated before step 502 and step 503 (that is, step 501), or, after step 502 and step 503 Initiate the discovery process of the NF service producer (ie step 504).
  • NF service producer only needs to initiate a discovery process once.
  • Step 502 The NF service consumer sends an access token request message to the SCP.
  • the access token request message can also include CCA*, which is used for NRF authentication of NF service consumer.
  • CCA* is used for NRF authentication of NF service consumer.
  • the claims in CCA* include the NF instance ID of the NF service consumer, the timestamp and expiration time, and the NF type of the expected audience.
  • the receiving endpoint of the access token request message is the NF service producer, and the NF type of the expected audience here is NFR.
  • Step 503 The SCP sends the access token request message received in step 501 to the NRF.
  • Step 504 NRF determines that the CCA* verification is successful, and generates an access token.
  • NRF certifies NF service consumers according to CCA*. If the authentication is passed, NRF further performs the authorization check. If the authorization is passed, NRF generates an access token and performs integrity protection on the access token.
  • Step 505 the NRF sends an access token response message to the SCP, and the access token response message includes the access token generated by the NRF.
  • Step 506 the SCP sends an access token response message to the NRF, and the access token response message includes the access token generated by the NRF.
  • steps 507 to 511 For specific content of steps 507 to 511, reference may be made to steps 505 to 509 in the embodiment shown in FIG. 5 .
  • Scenario 3 Communication authorization under the process of agent discovery (mode D): NF service consumer interacts with NRF through SCP, as shown in Figure 6.
  • Step 601 The NF service consumer sends a service request message to the SCP.
  • the service request message includes CCA and access token. Among them, neither CCA nor access token has expired.
  • the claims in CCA include the NF instance ID of the NF service consumer, the timestamp and expiration time, and the NF type of the expected audience.
  • the receiving endpoint of the service request message is the NF service producer, and the NF type of the expected audience here is the NF type of the NF service producer.
  • Step 602 the SCP sends a service request message to the NF service producer, and the service request message includes CCA and access token.
  • steps 603 to 605 For specific content of steps 603 to 605, reference may be made to steps 509 to 511 in the embodiment shown in FIG. 5 .
  • Scenario 4 Communication authorization under the process of agent discovery (mode D): NF service consumer interacts with NRF through SCP, as shown in Figure 7.
  • Step 701 The NF service consumer sends a service request message to the SCP, and the service request message includes CCA.
  • the claims in CCA include NF instance ID of NF service consumer, timestamp, expiration time and NF type of expected audience.
  • the receiving endpoint of the service request is the NF service producer, and the NF type of the expected audience here is the NF type of the NF service Producer.
  • Step 702 the SCP sends an access token request message to the NRF.
  • the SCP can determine whether to initiate an access token request process to the NRF according to the service request message. For example, if the SCP determines that the received service request message does not include an access token and there is no local access token corresponding to the service request message, then the SCP sends an access token request message to the NRF.
  • the access token request message includes the CCA in step 701.
  • Step 703 The NRF determines that the verification of the CCA fails.
  • the NF type of the expected audience in the CCA is the NF type of the NF service producer. Since the NF type in the CCA is inconsistent with the NF type in the NRF, the NRF determines that the CCA verification fails.
  • Step 704 The NRF sends an access token response message to the SCP, and the access token response message does not include the access token.
  • the NF service consumer fails to request services from the NF service producer.
  • the embodiment of the present application provides the following several embodiments to solve the problem that the receiving endpoint of the service request (the other The service provider) fails to authenticate the NF service consumer, causing the SCP to fail to request the other service, which in turn causes the NF service consumer to fail to request the service.
  • the embodiment of the present application involves at least two types of network functions.
  • the first network function type is different from the second network function type.
  • the type of network function refers to the general designation of network functions that provide a set of functional behaviors or provide a set of services in the network.
  • the network function types in a 5G network can include AMF type or SMF type, etc., where AMF type functional network elements can provide services related to access and mobility management, and SMF type functional network elements can provide services related to PDU session management. Serve.
  • the embodiment of the present application also involves at least two services. Wherein, the first service is different from the second service, and the first service is associated with the second service.
  • the first service may be to request session establishment, and the second service may be to request an access token corresponding to the first service.
  • the first service may be a request for establishing a session, and the second service may be a request for information of a network element providing the first service.
  • the AMF when the AMF requests the SMF to establish a session, the AMF sends a session establishment request message to the SCP.
  • the SCP Before the SCP sends the session establishment request to the SMF, if the SCP needs to first obtain the access token (hereinafter referred to as access token 1), after the SCP obtains the access token 1 from the NRF, the SCP sends the session establishment request message to the SMF, and the session establishment request message at this time includes the access token 1.
  • access token 1 the access token 1
  • the SCP sends the session establishment request message to the SMF, and the session establishment request message at this time includes the access token 1.
  • the first service here refers to the request for session establishment
  • the second service refers to the request for the access token corresponding to the first service
  • the SCP requests the access token corresponding to the first service from the NRF before the SCP sends the session establishment request message to the SMF, that is The SCP initiates the request for the second service before initiating the request for the first service.
  • the SCP initiates the request for the second service after initiating the request for the first service, which is not limited in this embodiment of the present application. If there is no special description, the following description will be made only by taking the SCP as an example for initiating the request for the second service before initiating the request for the first service.
  • the association of the first service with the second service may, for example, be that initiating a request for the first service may trigger a request for the second service.
  • the second service is used to provide an access token corresponding to the first service
  • the access token corresponding to the first service is used to represent/indicate that the service consuming network element has the right to acquire the first service. Since the service consuming network element requests the first service, and the access token corresponding to the first service provided by the second service is used to represent/indicate that the service consuming network element has the authority to obtain the first service, therefore, the first service and the second service associated.
  • the NF service consumer's request for the first service may trigger the SCP to request the access token corresponding to the first service.
  • the access token corresponding to the first service is used to represent/indicate that the NF service consumer has the right to obtain the first service or to access the first service.
  • the second service is used to provide information of the service providing network element. Since the service consuming network element requests the first service, the service providing network element indicated by the information of the service providing network element provided by the second service can provide the first service, therefore, the first service is associated with the second service.
  • the NF service consumer's request for the first service may trigger the SCP to request the information of the NF service producer.
  • the NF service producer provides the first service for the NF service consumer.
  • initiating a request for a first service may also trigger a request for multiple second services.
  • the NF service consumer's request for the first service may trigger the SCP to request the information of the NF service producer, and trigger the SCP to request the access token corresponding to the first service.
  • the NF service producer provides the first service for the NF service consumer, and the access token corresponding to the first service is used to represent/indicate that the service consumer network element has the right to obtain the first service.
  • the SCP may request the access token corresponding to the first service from NRF1, and request the information of the NF service producer from NRF1. At this time, NRF1 provides two second services.
  • the SCP may request the access token corresponding to the first service from NRF1, and request the information of the NF service producer from NRF2.
  • NRF1 is different from NRF2
  • the second service provided by NRF1 is different from the second service provided by NRF2.
  • the network element providing the second service is an example of a network storage function network element for illustration, and the network element providing the second service may be another type of network element, which is not limited in this embodiment of the present application.
  • An embodiment of the present application provides a communication method.
  • a service consumption network element sends a service request message to a service communication agent.
  • the service request message includes a first client authentication credential.
  • the first client authentication credential may include at least two different network function types, Furthermore, it can be realized that different network elements can successfully authenticate service consumption network elements according to the first customer authentication certificate.
  • FIG. 8 is taken as an example for description.
  • Step 801 The service consuming network element sends a first service request message to the service communication agent, the first service request message is used to request a first service from the service providing network element, and the first service request message includes a first customer authentication credential.
  • the first client authentication credential is used to authenticate the service consuming network element.
  • the first customer authentication credential includes a first network function type and a second network function type, the first network function type is the network function type of the network element providing the first service, that is, the network function type of the service providing network element, and the second network function
  • the type is the network function type of the network element providing the second service, and the second service is associated with the first service.
  • the network function type of the network element providing the second service may be the network function type of the network storage function network element.
  • the first client authentication credential includes two types of network functions. Therefore, the existing CCA is only used for the receiving end point of the service request to authenticate the service consumption network element, that is, to authenticate the identity of the service consumption network element.
  • the first client authentication credential can be used for network elements of two types of network functions to authenticate service consumption network elements, that is, the receiving endpoint of the service request and the receiving endpoint of the request message triggered by the service request are connected to the service consumption network. element for identity authentication.
  • the first client authentication credential also includes one or more of the identifier of the service consuming network element and the valid time information of the first client authentication credential.
  • the valid time information of the first client authentication credential is used to indicate the valid time of the first client authentication credential
  • the valid time information of the first client authentication credential may include a time stamp and an expiration time of the first client authentication credential. These contents have the same meaning as the corresponding concepts in the existing CCA, and will not be repeated here.
  • the time stamp indicates time A
  • the expiration time indicates time B
  • the first client authentication credential is valid within a period of time determined by time A and time B.
  • the valid time information of the first client authentication credential may include a time stamp and the valid duration of the first client authentication credential.
  • the time stamp here has the same meaning as the corresponding concept in the existing CCA, and the valid duration may refer to a period of time after the time stamp.
  • the time stamp indicates time A
  • the validity period indicates time period C (for example, 5 minutes)
  • the first customer authentication credential is valid within time period C after time A.
  • the valid time information of the first customer authentication credential is associated with the first duration
  • the first duration is the transmission delay between the service consuming network element and the service communication agent, the transmission delay between the service communication agent and the network element providing the second service, and
  • the transmission delay between the service communication agent and the service providing network element is determined.
  • the transmission delay between the service consuming network element and the service communication agent is recorded as T 1
  • the transmission delay between the service communication agent and the network element providing the second service is recorded as T 2
  • the transmission delay between the service communication agent and the service providing network element The transmission delay is denoted as T 3 .
  • the expiration time of the first client authentication credential may be determined by a timestamp, a first duration, and a preset duration.
  • the preset duration here can be preset or determined through dynamic adjustment. It should be noted that if the preset duration is set too long, the effective time of the CCA may be very long, and the CCA may have a risk of being reused.
  • the above configuration rules for valid time information of the first client authentication certificate can ensure that the first client authentication certificate is not maliciously used by the service communication agent, thereby ensuring the security of the communication process.
  • the service consuming network element before the service consuming network element sends the first service request message to the service communication agent, the service consuming network element also needs to determine whether the first customer authentication credential is locally stored, and if the available customer authentication credential is stored (for example, save a non-expired client authentication certificate), then use the non-expired client authentication certificate as the first client certificate. If no available client authentication credential is stored (for example, the client authentication credential has expired or the client authentication credential is not stored), the service consuming network element generates the first client authentication credential. In addition, when there is an expired client authentication certificate, the service consumption network element can delete the expired client authentication certificate. Therefore, the service consumption network element can release the storage space and reduce the storage burden of the system by deleting the expired customer authentication certificate.
  • Scenario 1 When the first service needs to be requested and there is no available access token corresponding to the first service, the service consumption network element sends the first service request message to the service communication agent.
  • the service consuming network element determines that the first service needs to be requested and there is no available access token corresponding to the first service, and the service consuming network element sends the first service request message to the service communication agent.
  • the service consuming network element determining that there is no available access token corresponding to the first service includes: the service consuming network element determining that the access token corresponding to the first service is not stored or the service consuming network element determining that the stored first The access token for the service has expired. Further, when the stored access token corresponding to the first service has expired, the service consuming network element may delete the expired access token corresponding to the first service.
  • the access token can be stored in the public storage space of the NF service consumer (for example, the access token is stored in the context of the node level).
  • the NF service consumer may receive the service request message of the UE, and determine that the first service needs to be requested according to the service request message.
  • the NF service consumer acquires UE-related information (such as UE context information) according to the UE identifier. Further, the NF service consumer checks whether the public storage space includes an access token corresponding to the first service.
  • the access token corresponding to the first service is included and the access token has not expired, use the access token; if the access token corresponding to the first service is not included, it is determined that there is no available access token; or if the access corresponding to the first service is included token but the access token has expired, it is determined that there is no available access token, and further optional, the NF service consumer deletes the access token.
  • the related information of the UE may be stored in the public storage space of the NF service consumer, or the related information of the UE obtained by the NF service consumer from other network elements according to the identifier of the UE.
  • the service consuming network element determines that there is an available access token corresponding to the first service, the first service request message sent by the service consuming network element to the service communication agent may not need to include the second network function type , only including the first network function type.
  • Scenario 2 When the first service needs to be requested and the request for the first service triggers the service communication agent to request the information of the service providing network element, the service consuming network element sends the first service request message to the service communication agent.
  • the service consuming network element determines that the first service needs to be requested and the request for the first service triggers the service communication agent to request information of the service providing network element, and the service consuming network element sends the first service request message to the service communication agent.
  • the service consuming network element may determine that requesting the first service will trigger the service communication agent to request information from the service providing network element.
  • the service consuming network element receives a first message associated with the first terminal device, and the service consuming network element determines that the first service needs to be requested according to the first message. Further, the service consuming network element determines to request the first service trigger service communication agent to request the information of the service providing network element according to one or more of the following items.
  • Case 1 The context of the first terminal device is not stored.
  • the NF service consumer may receive a service request message from the UE, and determine according to the service request message that it needs to request the first service.
  • the NF service consumer obtains the context information of the UE according to the UE identifier. If the UE context information cannot be obtained, that is, the UE is a new UE, and the NF service consumer has not been triggered to request a service from the NF service producer.
  • a service triggers the SCP to request information from the NF service producer.
  • the context information of the UE may be stored in the NF service consumer, or the NF service consumer obtains the context information of the UE from other network elements according to the identifier of the UE.
  • Case 2 The context of the first service is not stored.
  • the NF service consumer may receive a service request message from the UE, and determine according to the service request message that it needs to request the first service.
  • the NF service consumer obtains the context information of the UE according to the UE identity, and determines that the context of the first service is not included according to the UE context information, that is, the UE has not triggered the NF service consumer to request the first service from the NF service producer, then the NF service consumer determines the request
  • the first service triggers the SCP to request the information of the NF service producer.
  • the context information of the UE may be stored in the NF service consumer, or the NF service consumer obtains the context information of the UE from other network elements according to the identifier of the UE.
  • Case 3 The first slice belongs to the service providing network element and the context of the first slice is not stored
  • the NF service consumer may receive the service request message of the UE, determine according to the service request message that the first service needs to be requested and needs to request the first service to the service providing network element in the first slice.
  • the NF service consumer obtains the context information of the UE according to the UE identifier, and determines the context that does not include the first slice according to the UE context information, that is, the UE has not triggered the NF service consumer to request the first service from the NF service producer in the first slice , the NF service consumer determines to request the first service and triggers the SCP to request information from the NF service producer.
  • the context information of the UE may be stored in the NF service consumer, or the NF service consumer obtains the context information of the UE from other network elements according to the identifier of the UE.
  • the service consuming network element can request services from the service providing network element through multiple service communication agents.
  • the service consumption network element determines that the first service request message triggers the service communication agent to request the second service.
  • the NF service consumer receives a service request response message, which contains a binding indication, and the binding indication is used for subsequent related service messages.
  • the first service request message carries binding information, and the binding information can be used by the SCP to route the first service request to a specific NF service producer. At this time, the SCP does not need to initiate the NF service producer discovery process.
  • Scenario 3 The first service needs to be requested and the service consumption network element communicates with the service communication agent in the indirect communication mode of mode D, and the service consumption network element sends the first service request message to the service communication agent.
  • the first service request message when the service consumption network element uses mode D to communicate with the service communication agent through standard agreement agreement or through pre-configuration information configuration, the first service request message always carries the first network function type and the second network function type client authentication credentials.
  • Scenario 4 Before the service consumption network element sends the first service request message to the service communication agent, the service consumption network element obtains the instruction information, and the service consumption network element sends the first service request message to the service communication agent according to the instruction information.
  • Step 901 Before the service consumption network element sends the first service request message to the service communication agent, the service consumption network element sends a second service request message to the service communication agent, the second service request message is used to request the first service, and the second service The request message includes a second client authentication credential, the second client authentication credential includes the first network function type, and the second client authentication credential is used for the service providing network element to authenticate the service consuming network element.
  • the second client authentication credential does not include the second network function type.
  • Step 902 The service communication agent sends a third service request message to the network element with the network storage function, the third service request message is used to request the second service, and the third service request message includes the second customer authentication credential.
  • the network storage function network element is used to provide the second service.
  • the service communication agent determines to request the first service and triggers the request for the second service may include but not limited to the following scenarios:
  • Scenario A When no available access token corresponding to the first service is stored and the second service request message does not include the access token corresponding to the first service, the service communication agent sends a third service request to the network storage function network element message, the third service request message is used to request the access token corresponding to the first service.
  • the service communication agent determines that no available access token corresponding to the first service is stored and the second service request message does not include the access token corresponding to the first service, and the service communication agent sends a third service request message to the network storage function network element.
  • the service communication agent may determine that the access token corresponding to the first service is needed according to the received second service request message, for example, the service communication agent may determine that the second An access token corresponding to a service. Further, the service communication agent queries whether the access token corresponding to the first service is stored, and if the stored access token corresponding to the first service is not stored or has expired, and the access token is not included in the second service request message, then The parameters required to request the access token corresponding to the first service may be determined according to the type of the service request message, that is, the parameters in the claim, for example, the name of the desired service, the NF instance ID of the consumer, and the like. In addition, when the stored access token corresponding to the first service has expired, the service communication agent may delete the expired access token.
  • Scenario B In the case that the information of the available service providing network element is not stored and the second service request message does not include the information of the service providing network element, the service communication agent sends the third service request message to the network storage functional network element, and the third The service request message is used to request the information of the network element providing the service.
  • the service communication agent determines that the information of the available service providing network element is not stored and the second service request message does not include the information of the service providing network element, and sends the third service request message to the network storage function network element.
  • the service communication agent may determine according to the type of the second service request message and/or the indication information in the second service request message.
  • the service communication agent After the service communication agent receives the second service request message, the service communication agent analyzes the second service request message, and then can determine who is the receiver of the message, and whether it needs to discover the receiver of the message (ie, the service providing network element). Wherein, the service communication agent judges whether to discover the service provider network element, which is similar to the logic of how the service consumption network element determines whether to discover the service provider in the direct communication. For example, if the SCP receives a request message that is a session establishment request, the SCP determines that the message needs to be forwarded to the SMF, and the SCP will determine whether there is qualified SMF instance information locally according to the parameters in the message.
  • Step 903 The network storage function network element determines that the authentication of the service consumption network element fails according to the second customer authentication certificate.
  • the network storage function network element determines that the authentication of the service consumption network element fails according to the second customer authentication credential, including: the network storage function network element determining the first network function type and the network function type of the network storage function network element Mismatch. or,
  • the network storage function network element determines that the authentication of the service consumption network element fails according to the second customer authentication certificate, including: the network storage function network element verifies that the signature of the second customer authentication certificate passes, according to the time stamp included in the second customer authentication certificate and/or the first
  • the expiration time of the second client authentication credential verifies that the second client authentication credential has not expired, verifies that the identifier of the service consuming network element in the second client authentication credential is the same as the identifier of the network element in the certificate used to sign the second client authentication credential, and verifies
  • the first network function type does not match the network function type of the network element with the network storage function.
  • Step 904 In the case that the first network function type does not match the network function type of the network storage function network element, the network storage function network element sends a response message for the third service request message to the service communication agent.
  • the response message to the third service request message includes a cause value and/or first indication information.
  • the cause value and/or the first indication information indicate that the second client authentication credential does not include the second network function type, or indicate that the first network function type included in the second client authentication credential is different from the network function type of the network storage function network element. Type mismatch, or indicating that the correct network capability type is missing in the second client authentication credential, etc.
  • the first indication information may be a third client authentication credential.
  • the third client authentication credential includes the identifier of the network element with network storage function, the time stamp of the third client authentication credential, the expiration time of the third client authentication credential, and the network function type of the service consumption network element.
  • the third client authentication credential may also include the network function type of the network storage function network element, to instruct the service consumption network element to generate the client authentication credential including the network function type of the network storage function network element.
  • the response message to the third service request message may also indicate that the second service request fails.
  • Step 905 The service communication agent sends a response message to the second service request message to the service consuming network element according to the response message to the third service request message, and the response message to the second service request message includes the second indication information.
  • the second indication information is used to trigger the service consuming network element to send the first service request message in step 801 in the embodiment of FIG. service request message of network function type).
  • the second indication information is used to indicate that the second customer authentication certificate does not include the network function type of the network storage function network element (that is, the above-mentioned second network function type), or indicate that the second customer authentication
  • the first network function type included in the credential does not match the network function type of the network storage function network element, or indicates that the correct network function type is missing in the second client authentication credential.
  • the above-mentioned second indication information may be the same as the first indication information, or information obtained after the service communication agent processes the first indication information. This embodiment of the present application does not limit it.
  • the service communication agent may also generate the second indication information according to the response message to the third service request message, and the second indication information may trigger the service consumption network element to re-initiate the service request message requesting the first service And carry the customer authentication credential including the network function type of the network storage function network element and the network function type of the service providing network element when re-initiating the request for the first service (that is, execute the above step 801).
  • Step 906 The service consuming network element sends the first service request message to the service communication agent according to the second indication information.
  • the service consumption network element may authenticate the network storage function according to the third client authentication credential
  • the service consumption network element sends the first service request message to the service communication agent, wherein the service consumption network element determines that the second network function type is the network function type of the network storage function network element (Wherein, the network storage function network element is used to provide the second service, and the network function type of the network storage function network element is the network function type of the network element providing the second service).
  • Step 802 The service communication agent receives the first service request message from the service consuming network element, and the service communication agent sends a fourth service request message to the network storage functional network element.
  • the fourth service request message is used to request the second service, and the fourth service request message is used to request the second service.
  • the service request message includes first client authentication credentials.
  • the service communication agent determines to request the first service and triggers the request for the second service may refer to the above step 902, and the repetition will not be repeated.
  • Step 803 The network storage function network element receives the fourth service request message from the service communication agent, and the network storage function network element authenticates the service consumption network element according to the first customer authentication certificate.
  • the network storage function network element determines that there is a network function type identical to that of the network storage function network element in the first network function type and the second network function type, and then the network storage function network element determines that the authentication of the service consumption network element is successful.
  • the second network function type is the same as the network function type of the network storage function network element.
  • the network storage function network element verifies that the signature of the first client authentication certificate passes, verifies that the first client authentication certificate has not expired according to the time stamp included in the first client authentication certificate and/or the expiration time of the first client authentication certificate, and verifies that the first client authentication certificate
  • the identifier of the service consumption network element in a client authentication certificate is the same as the identifier of the network element in the certificate used to sign the first client authentication certificate, verifying that the second network function type and If the network function type of the network storage function network element matches, the network storage function network element determines that the authentication of the service consumption network element is successful.
  • Step 804 When the authentication of the service consuming network element succeeds, the network storage functional network element sends a response message to the service communication agent for the fourth service request message.
  • the network storage function network element performs an authorization check after the service consumption network element is successfully authenticated, and if the authorization is determined to pass, the network The storage function network element generates an access token corresponding to the first service.
  • the network storage function network element sends a response message to the fourth service request message to the service communication agent.
  • the response message to the fourth service request message includes the access token corresponding to the first service.
  • the network storage function network element sends a response message to the service communication agent to the service communication agent after the service consumption network element is successfully authenticated, and the network element for the first 4.
  • the response message of the service request message includes the information of the service providing network element.
  • Step 805 The service communication agent receives a response message to the fourth service request message from the network storage function network element, and the service communication agent sends a fifth service request message to the service providing network element according to the response message to the fourth service request message,
  • the fifth service request message is used to request the first service, and the fifth service request message includes the first client authentication credential.
  • the fifth service request message also includes the access token corresponding to the first service.
  • the service communication agent when the response message to the fourth service request message includes the access token corresponding to the first service, the service communication agent sends a fifth service request message to the service providing network element, and the fifth service request message is used to request the first service, the fifth service request message includes the first client authentication credential and the access token corresponding to the first service.
  • the service communication agent when the response message to the fourth service request message includes the information of the service providing network element, the service communication agent sends the fifth service request message to the service providing network element indicated by the information of the service providing network element, and the fifth service request The message is used to request the first service, and the fifth service request message includes the first client authentication credential and the access token corresponding to the first service.
  • the access token corresponding to the first service may be stored by the service communication agent or carried in the first request message.
  • the service communication agent uses the first client authentication credential to request the access token corresponding to the first service and the information of the service providing network element from the network storage function network element. That is, by executing steps 802 to 804 twice, the service communication agent can initiate two service request messages for the second service, once for requesting the access token corresponding to the first service, and once for requesting the service providing network element Information. Then at this time, the access token corresponding to the first service in step 805 may be obtained by the service communication agent from the network storage function network through steps 802-804.
  • Step 806 The service providing network element receives the fifth service request message from the service communication agent, and the service providing network element authenticates the service consuming network element according to the first customer authentication certificate.
  • the network element providing the service needs to verify the access token corresponding to the first service.
  • the verification process of the access token please refer to the verification process of the access token above, which will not be repeated here.
  • the service providing network element authenticates the service consuming network element according to the first customer authentication certificate, including: the service providing network element judges whether its own network function type matches one or more of the first network function type and the second network function type .
  • the service providing network element authenticates the service consuming network element according to the first customer authentication certificate, and further includes: the service providing network element verifies whether the signature of the first customer authentication certificate passes, according to the time stamp included in the first customer authentication certificate and / or the expiration time of the first client authentication certificate to verify whether the first client authentication certificate has not expired and to verify the identity of the service consumption network element in the first client authentication certificate and the identity of the network element in the certificate used to sign the first client authentication certificate Identifiers are the same.
  • the network storage function network element and the service providing network element authenticate the service consumption network element according to the first customer authentication certificate with the same authentication idea, and the corresponding content can be referred to each other, and will not be repeated here.
  • Step 807 When the service consuming network element is successfully authenticated, the service providing network element sends a response message to the service communication agent for the fifth service request message.
  • the response message to the fifth service request message is used to indicate that the first service is provided or that the fifth service request is successful.
  • the response message to the fifth service request message indicates that the request for the first service fails.
  • Step 808 The service communication agent sends a response message to the first service request message to the service consuming network element.
  • the response message to the fifth service request message is used to indicate that the first service is provided or that the fifth service request is successful
  • the response message to the first service request message is used to indicate that the first service is provided or that the first service request is successful.
  • the response message to the fifth service request message indicates that the first service request fails
  • the response message to the first service request message indicates that the first service request fails.
  • the service communication agent may modify the information in the message header of the response message to the fifth service request message, but the content of the response message to the fifth service request message remains basically unchanged, and the service communication agent mainly plays the role of The role of message routing.
  • the service consuming network element in the scenario where the service consuming network element requests the first service from the service passing network element through the service communication agent, the service consuming network element carries and includes the first network information in the first service request message sent to the service communication agent.
  • the function type and the customer authentication certificate of the second network function type can further ensure that when the service communication agent requests the second service, the network element providing the second service successfully authenticates the service consumption network element, and then also requests the first service consumption network element.
  • the service provides guarantee and solves the problem that the service consumption network element fails to request the service due to the failure of the customer authentication certificate authentication in the indirect communication scenario.
  • the embodiment of the present application provides a communication method.
  • the service consumption network element sends a service request message to the service communication agent.
  • the service request message includes the fourth client authentication certificate and the fifth client authentication certificate, and the fourth client authentication certificate and the fifth client authentication certificate.
  • the credentials include different types of network functions, and the service communication agent sends corresponding customer authentication credentials to different network elements, so that different network elements can authenticate service consumption network elements according to different customer authentication credentials. The following will be described by taking the embodiment shown in FIG. 10 as an example.
  • An embodiment of the present application provides a communication method, as shown in FIG. 10 , the method includes:
  • Step 1001 The service consumption network element sends a first service request message to the service communication agent, the first service request message is used to request the first service, and the first service request message includes the fourth client authentication credential and the fifth client authentication credential.
  • the fourth customer authentication credential is used for the service providing network element authentication service consumption network element
  • the fifth customer authentication credential is used for the network element providing the second service authentication service consumption network element
  • the fourth customer authentication credential includes the first network function type
  • the fifth customer authentication credential includes a second network function type
  • the first network function type is the network function type of the service providing network element
  • the second network function type is the network function type of the network element providing the second service, the second service and First service association.
  • the fourth client authentication credential also includes one or more of the identifier of the service consumption network element and the validity time information of the fourth client authentication credential, and the validity time information of the fourth client authentication credential indicates the expiration time of the fourth client authentication credential,
  • the valid time information of the fourth client authentication credential includes a time stamp, the expiration time of the fourth client authentication credential.
  • the valid time information of the fourth client authentication credential may include a time stamp of the fourth client authentication credential and a valid duration of the fourth client authentication credential.
  • the fifth client authentication credential also includes one or more of the identifier of the service consuming network element and valid time information of the fifth client authentication credential, and the valid time information of the fifth client authentication credential indicates the valid time of the fifth client authentication credential.
  • the valid time information of the fifth client authentication certificate includes the timestamp of the fifth client authentication certificate and the expiration time of the fifth client authentication certificate.
  • the valid time information of the fifth client authentication credential may include a time stamp of the fifth client authentication credential and a valid duration of the fifth client authentication credential.
  • the validity time of the fifth client authentication credential is shorter than the validity time of the fourth client authentication credential.
  • the valid time of the fifth customer authentication credential is associated with the first duration
  • the first duration is the transmission between the service consumption network element and the service communication agent.
  • the above-mentioned transmission delay may be an average value of transmission delay or slightly greater than the average value of transmission delay.
  • the first duration T 1 +T 2 .
  • the expiration time of the first client authentication credential may be determined by a timestamp, a first duration, and a preset duration.
  • the preset duration here can be determined according to experience values.
  • the validity time of the fifth client authentication credential is longer than the validity time of the fourth client authentication credential.
  • the above configuration rules for the valid time of the fourth client authentication certificate and the valid time of the fifth client authentication certificate can ensure that the fourth client authentication certificate and the fifth client authentication certificate are not maliciously used by the service communication agent, thereby ensuring the security of the communication process sex.
  • the service consuming network element before the service consuming network element sends the first service request message to the service communication agent, the service consuming network element also needs to determine whether the available customer authentication credential is stored locally. unexpired client authentication credential), then use the available client authentication credential as the fourth client authentication credential. If no available client authentication credential is stored (for example, the saved client authentication credential has expired or the client authentication credential is not stored), the service consuming network element generates the fourth client authentication credential. In addition, when there is an expired client authentication certificate, the service consumption network element can delete the expired client authentication certificate. Therefore, the service consumption network element can release the storage space and reduce the storage burden of the system by deleting the expired customer authentication certificate. The same applies to the fifth customer authentication certificate, and will not be repeated here.
  • the network function type of the network element providing the second service may be the network function type of the network storage function network element.
  • Step 1002 The service communication agent receives the first service request message from the service consumption network element, and the service communication agent sends the second service request message to the network storage function network element, the second service request message is used to request the second service, and the second The service request message includes fifth client authentication credentials.
  • the service communication agent determines to request the first service and triggers the request for the second service may refer to the above step 902, and the repetition will not be repeated.
  • the service communication agent determines to request the first service and triggers the request for the second service
  • the service communication agent sends a second service request message to the network storage function network element according to the network function type of the network storage function network element, and the second service request message includes The fifth client authentication credential.
  • the service communication agent determines that it needs to request the access token corresponding to the first service from the network storage function network element, and selects the fourth client authentication certificate and the fifth client authentication certificate according to the network function type of the network storage function network element. Five client authentication credentials are added to the second service request message. Or, the service communication agent determines that it is necessary to request the information of the service provision network element from the network storage function network element, and then selects the fifth customer authentication certificate from the fourth customer authentication certificate and the fifth customer authentication certificate according to the network function type of the network storage function network element. Credentials are added to the second service request message.
  • Step 1003 The network storage function network element receives the second service request message from the service communication agent, and the network storage function network element authenticates the service consumption network element according to the fifth customer authentication certificate.
  • the network element with the network storage function determines that the authentication of the service consumption network element is successful. Specifically, the network storage function network element verifies that the signature of the fifth client authentication certificate passes, verifies that the fifth client authentication certificate has not expired according to the timestamp included in the fifth client authentication certificate and/or the expiration time of the fifth client authentication certificate, and verifies that the fifth client authentication certificate
  • the identifier of the service consumption network element in the fifth client authentication certificate is the same as the identifier of the network element in the certificate used to sign the fifth client authentication certificate, verify that the second network function type matches the network function type of the network storage function network element, then The network element with the network storage function determines that the authentication of the service consumption network element is successful.
  • Step 1004 The network storage function network element sends a response message to the second service request message to the service communication agent.
  • the network storage function network element performs an authorization check after the service consumption network element is successfully authenticated, and the network storage function network element determines that the authorization is passed, then the network The storage function network element generates an access token corresponding to the first service.
  • the network storage function network element sends a response message to the second service request message to the service communication agent.
  • the response message to the second service request message includes the access token corresponding to the first service.
  • the network storage functional network element sends a response message to the service communication agent for the second service request message after the service consumption network element is successfully authenticated, and for the second service request message
  • the response message of the second service request message includes the information of the service providing network element.
  • the network storage function network element when the network storage function network element fails to authenticate the service consumption network element, the network storage function network element sends a response message to the second service request message to the service communication agent, which is used to indicate that the request for the second service fails.
  • Step 1005 The service communication agent receives a response message from the network storage function network element for the second service request message, and the service communication agent sends a third service request message to the service providing network element according to the response message to the second service request message,
  • the third service request message is used to request the first service, and the third service request message includes the fourth client authentication credential.
  • the third service request message also includes the access token corresponding to the first service.
  • the service communication agent determines that the service consuming network element requests the first service, and selects the fourth customer authentication certificate from the fourth customer authentication certificate and the fifth customer authentication certificate according to the type of the service providing network element to add to the third service request message .
  • the service communication agent when the response message to the second service request message includes the access token corresponding to the first service, the service communication agent sends a third service request message to the service providing network element, and the third service request message is used to request the first service, the third service request message includes the fourth client authentication credential and the access token corresponding to the first service.
  • the service communication agent sends the third service request message to the service providing network element indicated by the information of the service providing network element, and the third service request message is used for The first service is requested, and the third service request message includes the fourth client authentication credential and the access token corresponding to the first service.
  • the access token corresponding to the first service may be stored by the service communication agent or carried in the first service request message.
  • Step 1006 The service providing network element receives the third service request message from the service communication agent, and the service providing network element authenticates the service consuming network element according to the fourth customer authentication certificate.
  • the network element providing the service needs to verify the access token corresponding to the first service.
  • the verification process of the access token please refer to the verification process of the access token above, which will not be repeated here.
  • the service providing network element determines that the service consuming network element is authenticated successfully. Specifically, the service providing network element verifies that the signature of the fourth client authentication certificate is passed, verifies that the fourth client authentication certificate has not expired according to the time stamp included in the fourth client authentication certificate and/or the expiration time of the fourth client authentication certificate, The identity of the service consuming network element in the customer authentication certificate is the same as the identity of the network element in the certificate used to sign the fourth customer authentication certificate, verify that the first network function type matches the network function type of the service providing network element, then the service providing The network element determines that the authentication of the service consumption network element succeeds.
  • Step 1007 The service providing network element sends a response message to the third service request message to the service communication agent.
  • the response message to the third service request message is used to indicate that the first service is provided or that the third service request is successful. Or, when the authentication of the service consuming network element fails and/or the authentication of the access token corresponding to the first service fails, the response message to the third service request message indicates that the first service request fails.
  • Step 1008 The service communication agent sends a response message to the first service request message to the service consuming network element.
  • the response message to the third service request message is used to indicate that the first service is provided or that the third service request is successful
  • the response message to the first service request message is used to indicate that the first service is provided or that the first The service request was successful.
  • the response message to the third service request message indicates that the first service request fails
  • the response message to the first service request message indicates that the first service request fails.
  • the service communication agent may modify the information in the message header of the response message to the third service request message, but the content of the response message to the third service request message remains basically unchanged, and the service communication agent mainly plays the role of The role of message routing.
  • the service consumption network element sends the first service request message to the service communication agent, wherein the first service request message includes the fourth client authentication credential and the fifth client authentication credential, and the fourth client authentication credential includes the first network function type, the fifth client authentication credential includes the second network function type, thereby ensuring that when the service communication agent requests the second service, the network element providing the second service successfully authenticates the service consuming network element, and then also requests the service consuming network element for the second service A service provides protection.
  • the embodiment of the present application provides a communication method.
  • the service consumption network element sends a service request message to the service communication agent.
  • the service request message includes the fourth client authentication certificate and the fifth client authentication certificate, and the fourth client authentication certificate and the fifth client authentication certificate.
  • the certificates respectively include different network function types.
  • the network storage function network element or service provider network element
  • receives the fourth customer authentication certificate and the fifth customer authentication certificate it determines that the service consumption network element has successfully authenticated according to the fourth customer authentication certificate.
  • it can be determined that the authentication of the service consuming network element is successful by determining that the authentication of the service consuming network element is successful according to the fifth customer authentication certificate. The following will be described by taking the embodiment shown in FIG. 11 as an example.
  • the embodiment of this application provides a communication method, as shown in Figure 11, the method includes:
  • Step 1101 The service consumption network element sends a first service request message to the service communication agent, the first service request message is used to request the first service, and the first service request message includes the fourth client authentication credential and the fifth client authentication credential.
  • step 1001 in FIG. 10 For details, reference may be made to step 1001 in FIG. 10 , and repeated descriptions will not be repeated.
  • Step 1102 The service communication agent receives the first service request message from the service consuming network element, and the service communication agent sends a second service request message to the network storage functional network element, the second service request message is used to request the second service, and the second The service request message includes a fourth client authentication credential and a fifth client authentication credential.
  • the service communication agent determines to request the first service and triggers the request for the second service may refer to the above step 902, and the repetition will not be repeated.
  • Step 1103 The network storage function network element receives the second service request message from the service communication agent, and the network storage function network element authenticates the service consumption network element according to the fourth customer authentication credential and the fifth customer authentication credential.
  • the network storage functional network element successfully authenticates the service consumption network element according to one or more of the fourth customer authentication certificate and the fifth customer authentication certificate, and then the network storage function network element determines that the service consumption network element is successfully authenticated.
  • the network storage function network element determines that the authentication of the service consumption network element is successful according to the fifth customer authentication certificate. Specifically, the network storage function network element verifies that the signature of the fifth client authentication certificate passes, verifies that the fifth client authentication certificate has not expired according to the timestamp included in the fifth client authentication certificate and/or the expiration time of the fifth client authentication certificate, and verifies that the fifth client authentication certificate
  • the identifier of the service consumption network element in the fifth client authentication certificate is the same as the identifier of the network element in the certificate used to sign the fifth client authentication certificate, verify that the second network function type matches the network function type of the network storage function network element, then The network element with the network storage function determines that the authentication of the service consumption network element is successful.
  • the network element with the network storage function determines that the authentication of the service consumption network element fails according to the fourth customer authentication certificate. Specifically, the network storage function network element verifies that the signature of the fourth client authentication certificate passes, verifies that the fourth client authentication certificate has not expired according to the time stamp included in the fourth client authentication certificate and/or the expiration time of the fourth client authentication certificate, and verifies that the fourth client authentication certificate
  • the identification of the service consumption network element in the fourth customer authentication certificate is the same as the identification of the network element in the certificate used to sign the fourth customer authentication certificate, verify that the first network function type does not match the network function type of the network storage function network element, Then the network storage function network element determines that the authentication of the service consumption network element fails.
  • the network storage function network element determines that the service consumption certification is successful.
  • Step 1104 When the authentication of the service consuming network element succeeds, the network storage functional network element sends a response message to the service communication agent for the second service request message.
  • the network storage function network element performs an authorization check after the service consumption network element is successfully authenticated, and the network storage function network element determines that the authorization is passed, then the network The storage function network element generates an access token corresponding to the first service.
  • the network storage function network element sends a response message to the second service request message to the service communication agent.
  • the response message to the second service request message includes the access token corresponding to the first service.
  • the network storage functional network element sends a response message to the service communication agent for the second service request message after the service consumption network element is successfully authenticated, and for the second service request message
  • the response message of the second service request message includes the information of the service providing network element.
  • Step 1105 The service communication agent receives a response message from the network storage function network element for the second service request message, and the service communication agent sends a third service request message to the service providing network element according to the response message to the second service request message,
  • the third service request message is used to request the first service, and the third service request message includes the fourth client authentication credential and the fifth client authentication credential.
  • the third service request message also includes the access token corresponding to the first service.
  • the service communication agent when the response message to the second service request message includes the access token corresponding to the first service, the service communication agent sends a third service request message to the service providing network element, and the third service request message is used to request the first service, the third service request message includes the fourth client authentication credential and the access token corresponding to the first service.
  • the service communication agent when the response message to the second service request message includes the information of the service providing network element, the service communication agent sends a third service request message to the service providing network element indicated by the information of the service providing network element, and the third service request The message is used to request the first service, and the third service request message includes the fourth client authentication credential and the access token corresponding to the first service.
  • the access token corresponding to the first service may be stored by the service communication agent or carried in the first service request message.
  • Step 1106 The service providing network element receives the third service request message from the service communication agent, and the service providing network element verifies the fourth client authentication credential and the fifth client authentication credential.
  • the network element providing the service needs to verify the access token corresponding to the first service.
  • the verification process of the access token please refer to the verification process of the access token above, which will not be repeated here.
  • the service providing network element successfully authenticates the service consuming network element according to one or more of the fourth customer authentication certificate and the fifth customer authentication certificate, and then the service providing network element determines that the service consuming network element is successfully authenticated.
  • the service providing network element determines that the authentication of the service consuming network element is successful according to the fourth customer authentication certificate. Specifically, the service providing network element verifies that the signature of the fourth client authentication certificate is passed, verifies that the fourth client authentication certificate has not expired according to the time stamp included in the fourth client authentication certificate and/or the expiration time of the fourth client authentication certificate, The identity of the service consuming network element in the customer authentication certificate is the same as the identity of the network element in the certificate used to sign the fourth customer authentication certificate, verify that the first network function type matches the network function type of the service providing network element, then the service providing The network element determines that the authentication of the service consumption network element succeeds.
  • the service providing network element determines that the authentication of the service consuming network element fails according to the fifth customer authentication certificate. Specifically, the service providing network element verifies that the signature of the fifth client authentication certificate is passed, verifies that the fifth client authentication certificate has not expired according to the timestamp included in the fifth client authentication certificate and/or the expiration time of the fifth client authentication certificate, and verifies that The identity of the service consuming network element in the customer authentication certificate is the same as the identity of the network element in the certificate used to sign the fifth customer authentication certificate, and it is verified that the second network function type does not match the network function type of the service providing network element, then the service The authentication of the NE that provides the NE confirmation service and consumes the NE fails.
  • Step 1107 The service providing network element sends a response message to the third service request message to the service communication agent.
  • Step 1108 the service communication agent sends a response message to the first service request message to the service consuming network element.
  • step 1107 and step 1108 are the same as step 1007 and step 1008 in the embodiment of FIG. 10 respectively, and will not be repeated here.
  • the service communication agent does not need to carry different CCAs in the service request message according to different objects requesting services, which simplifies the processing logic of the service communication agent.
  • the service communication agent receives the service request from the service consuming network element, whether it requests the second service from the network storage function network element or the first service from the service providing network element, it carries two CCAs at the same time. Therefore, it is always possible to ensure that the network storage function network element and the service provider network element authenticate the service consumption network element successfully, thereby avoiding the problem that the service consumption network element fails to request a service.
  • the embodiment of the present application provides a communication method.
  • the service communication agent fails to request the second service
  • the service communication agent can actively request the customer authentication certificate from the service consumption network element to ensure that the service communication agent can obtain the second service, thereby guaranteeing the service Consuming network elements obtains the first service.
  • the embodiment of this application provides a communication method, as shown in Figure 12, the method includes:
  • Step 1201 The service consumption network element sends a service request message 1 to the service communication agent.
  • the service request message 1 is used to request the first service.
  • the service request message 1 includes the client authentication credential A, and the client authentication credential A includes the first network function type.
  • the authentication credential A is used for the service provider network element to authenticate the service consumption network element.
  • the first network function type is the network function type of the service providing network element.
  • the client authentication credential A does not include the second network function type.
  • the second network function type is a network function type of a network element providing the second service, and the second service is associated with the first service.
  • Step 1202 The service communication agent sends a service request message 2 to the network element with the network storage function, the service request message 2 is used to request the second service, and the service request message 2 includes the customer authentication credential A.
  • the network storage function network element is used to provide the second service.
  • Step 1203 The network storage function network element determines that the authentication of the service consumption network element fails according to the customer authentication certificate A.
  • Step 1204 The network storage function network element sends a response message to the service request message 2 to the service communication agent.
  • steps 1201 to 1204 are the same as steps 901 to 904 in the embodiment of FIG. 9 , and will not be described again.
  • Step 1205 The service communication agent sends a client authentication credential request message to the service consuming network element according to the response message to the service request message 2.
  • the client authentication credential request message may indicate that the first service request failed.
  • the client authentication credential request message may also include indication information.
  • the indication information may include customer authentication credentials B and/or a reason value.
  • the service communication agent can avoid maliciously triggering the service consumption network element to request the client authentication credential.
  • the service communication agent may also generate indication information according to the response message to the service request message 2, the indication information may not include the customer authentication credential B or the reason value, and the indication information may indicate that the service consumption network element requests customer authentication Credentials and carry the client authentication credentials including the network function type of the network storage function network element when requesting the client authentication credentials.
  • Step 1206 The service consumption network element sends a response message to the client authentication credential request message to the service communication agent according to the indication information.
  • the service consumption network element can verify the client authentication credential B, and when the client authentication credential B is verified successfully , the service consumption network element sends a response message to the client authentication credential request message to the service communication agent, the response message to the client authentication credential request message includes the client authentication credential C, and the client authentication credential C includes the first network function type and the second network function type, or the customer authentication credential C includes the second network function type, the first network function type is the network function type of the service providing network element, and the second network function type is the network function type of the network element providing the second service.
  • Step 1207 The service communication agent receives a response message from the service consuming network element for the client authentication credential request message, and the service communication agent sends a service request message 3 to the network storage function network element.
  • the service request message 3 is used to request the second service,
  • the service request message 3 includes the client authentication credential C.
  • the service communication agent when the available access token corresponding to the first service is not stored and the first service request message does not include the access token corresponding to the first service, the service communication agent sends the service request message to the network storage function network element 3.
  • the service request message 3 is used to request the access token corresponding to the first service.
  • the service communication agent sends a service request message 3 to the network storage function network element, and the service request message 3 is used for The request service provides network element information.
  • Step 1208 The network storage function network element receives the service request message 3 from the service communication agent, and the network storage function network element authenticates the service consumption network element according to the customer authentication certificate C.
  • the network storage function network element determines that there is a network function type that matches the network function type of the network storage function network element in the first network function type and the second network function type network function type, the network storage function network element determines that the verification of the customer authentication certificate C is successful.
  • the second network function type matches the network function type of the network storage function network element.
  • the network element of the network storage function verifies that the signature of the customer authentication credential C passes, verifies that the customer authentication credential C has not expired according to the time stamp included in the customer authentication credential C and/or the expiration time of the customer authentication credential C, and verifies that the client authentication credential C is not expired.
  • the identity of the service consumption network element is the same as the identity of the network element in the certificate used to sign the customer authentication credential C, verify that the second network function type in the first network function type and the second network function type and the network storage function network element If the network function type matches, the network storage function network element determines that the authentication of the service consumption network element is successful.
  • the network storage function network element verifies the signature of the client authentication credential C, and verifies the client authentication credential C according to the timestamp included in the client authentication credential C and/or the expiration time of the client authentication credential C Not expired, verify that the identity of the service consumption network element in the customer authentication certificate C is the same as the identity of the network element in the certificate used to sign the customer authentication certificate C, verify that the second network function type is the same as the network function type of the network storage function network element match, the network storage function network element determines that the authentication of the service consumption network element is successful.
  • Step 1209 When the authentication of the service consumption network element succeeds, the network storage function network element sends a response message to the service request message 3 to the service communication agent.
  • the network storage function network element performs an authorization check and determines that the authorization is passed, then the network storage function network element The functional network element generates an access token corresponding to the first service.
  • the network storage function network element sends a response message to the service request message 3 to the service communication agent.
  • the response message to the service request message 3 includes the access token corresponding to the first service.
  • the network storage functional network element sends a response message to the service communication agent to the service communication agent after the service consumption network element is successfully authenticated, and the service request message
  • the response message of 3 includes the information of the service providing network element.
  • Step 1210 The service communication agent receives the response message to the service request message 3 from the network storage function network element, and the service communication agent sends the service request message 4 to the service providing network element according to the response message to the service request message 3, and the service request message 4 is used to request the first service, and the service request message 4 includes client authentication credential A or client authentication credential C.
  • the service request message 4 also includes an access token corresponding to the first service.
  • the service communication agent sends the service request message 4 to the service providing network element, the service request message 4 is used to request the first service, and the service The request message 4 includes the first client authentication credential and the access token corresponding to the first service.
  • the service communication agent when the response message to the service request message 3 includes the information of the service providing network element, the service communication agent sends the service request message 4 to the service providing network element indicated by the information of the service providing network element, and the service request message 4 is used for To request the first service, the service request message 4 includes the first client authentication credential and the access token corresponding to the first service.
  • the access token corresponding to the first service may be stored by the service communication agent or carried in the service request message 1 .
  • Step 1211 The service providing network element receives the service request message 4 from the service communication agent, and the service providing network element authenticates the NF service consumer according to the customer authentication credential A or the customer authentication credential C.
  • the network element providing the service needs to verify the access token corresponding to the first service.
  • the verification process of the access token please refer to the verification process of the access token above, which will not be repeated here.
  • the service providing network element determines that there is a network function type matching the network function type of the service providing network element in the first network function type and the second network function type, then the service providing network element According to the customer authentication certificate C, it is determined that the authentication of the service consumption network element is successful. Wherein, the first network function type matches the network function type of the service providing network element.
  • the service provider network element verifies that the signature of the customer authentication credential C passes, verifies that the customer authentication credential C has not expired according to the time stamp included in the customer authentication credential C and/or the expiration time of the customer authentication credential C, and verifies that the The identity of the service consuming network element is the same as the identity of the network element in the certificate used to sign the customer authentication credential C, and verify that the first network function type in the first network function type and the second network function type are consistent with the service providing network element's network If the function type matches, the service providing network element determines that the service consuming network element is authenticated successfully.
  • the service provider network element verifies that the signature of the customer authentication certificate A passes, and verifies that the customer authentication certificate A has not expired according to the time stamp included in the customer authentication certificate A and/or the expiration time of the customer authentication certificate A , verifying that the identity of the service consuming network element in the customer authentication certificate A is the same as the identity of the network element in the certificate used to sign the customer authentication certificate A, and verifying that the first network function type matches the network function type of the service providing network element, then The service providing network element determines that the service consuming network element is authenticated successfully.
  • Step 1212 The service providing network element sends a response message to the service request message 4 to the service communication agent.
  • the response message to the service request message 4 is used to indicate that the first service is provided or that the service request 4 is successful. Or, when the authentication of the service consuming network element fails and/or the authentication of the access token corresponding to the first service fails, the response message to the service request message 4 indicates that the first service request fails.
  • Step 1213 The service communication agent sends a response message to the service request message 1 to the service consuming network element.
  • the response message to the service request message 1 is used to indicate that the first service is provided or that the service request 1 is successful.
  • the response message to the service request message 1 indicates that the first service request fails.
  • the service communication agent sends a client authentication credential request message to the service consuming network element, thereby ensuring that when the service communication agent requests the second service, the network element that provides the second service successfully authenticates the service consuming network element, thereby also providing The service consumption network element requests the first service to provide guarantee.
  • Embodiment 1 In combination with the embodiment shown in FIG. 8, when it is determined that the first service needs to be requested and there is no available access token corresponding to the first service, the NF service consumer can adopt but not limited to the following embodiments to obtain the first service, such as Figure 13 shows.
  • Step 1301 The NF service consumer determines to request the first service and there is no available access token corresponding to the first service, the NF service consumer obtains the CCA, and the access token corresponding to the first service indicates/indicates that the NF service consumer has the authority to obtain the first service or access to the first service.
  • the NF service consumer may also determine that the current indirect communication mode is mode D before step 1301 .
  • the NF service consumer After the NF service consumer determines to request the first service, the NF service consumer checks whether the access token corresponding to the first service is locally stored. The NF service consumer determines that there is no available access token corresponding to the first service means that the NF service consumer determines that the access token corresponding to the first service is not stored or the stored access token corresponding to the first service has expired. Further, when the NF service consumer determines that the stored access token corresponding to the first service has expired, the NF service consumer deletes the expired access token corresponding to the first service.
  • the NF service consumer may receive a service request message from the UE, and determine according to the service request message that it needs to request the first service.
  • the NF service consumer acquires UE-related information (such as UE context information) according to the UE identifier. Further, the NF service consumer checks whether the public storage space includes an access token corresponding to the first service. If the access token corresponding to the first service is included and the access token has not expired, use the access token; if the access token corresponding to the first service is not included, it is determined that there is no available access token; or if the access corresponding to the first service is included token but the access token has expired, it is determined that there is no available access token, and further optional, the NF service consumer deletes the access token.
  • the related information of the UE may be stored in the public storage space of the NF service consumer, or the related information of the UE obtained by the NF service consumer from other network elements according to the identifier of the UE.
  • the NF service consumer also needs to determine whether an available CCA is stored locally, and if an available CCA is stored (for example, the CCA has not expired), the CCA is used. If no available CCA is stored (for example, the CCA has expired or the CCA is not stored), the NF service consumer generates the CCA. In addition, when the CCA has expired, the NF service consumer deletes the expired CCA.
  • the CCA includes a first NF type and a second NF type, wherein the first NF type is the NF type of the NF service producer expecting to provide the first service, and the second NF type is the NF type of the NRF expecting to provide the access token.
  • the CCA also includes the identifier, time stamp, and expiration time of the NF instance of the NF service consumer.
  • Step 1302 The NF service Consumer sends a first service request message to the SCP, and the first service request message includes the CCA in step 1301 and parameters for obtaining an access token.
  • the first service request message is used to request a first service.
  • the parameters used to obtain the access token can be the same as those used to discover the NF service producer, or all or part of them can be different.
  • the parameters used to obtain the access token and the parameters used to discover the NF service producer can be indicated by the same information element or indicated by different information elements. Exemplarily, if both are the same, the same information element may be used for indication.
  • the first service request message also includes parameters for discovering the NF service producer. If some of them are different, the first service request message also includes the remaining parameters for discovering the NF service producer.
  • the parameters used to obtain the access token may include the expected service name, the NF type of the NF service consumer and the NF type of the expected NF service producer, the S-NSSAI list or NSI ID list of the expected NF service producer instance, the expected The NF Set ID of the NF service producer instance, the S-NSSAI list of the NF service consumer, etc.
  • the parameters used to discover the NF service producer may include the NF type of the expected NF service producer, the S-NSSAI list or the NSI ID list of the expected NF service producer instance.
  • the parameters used to obtain the access token can be partly the same as the parameters used to discover the NF service producer.
  • Step 1303 the SCP sends an access token request message to the NRF, and the access token request message includes CCA and parameters for obtaining the access token.
  • the SCP determines that the first service request message does not include the access token corresponding to the first service and the access token corresponding to the first service is not stored locally or the SCP determines that the first service request message does not include the first The access token corresponding to the service and the stored access token corresponding to the first service expire. If it is judged that the stored access token corresponding to the first service has expired, the SCP deletes the expired access token corresponding to the first service.
  • the SCP needs to initiate the discovery process of the NF service Producer before step 1303 . Otherwise, the SCP can initiate the discovery process of the NF service Producer after obtaining the access token corresponding to the first service. Or, when the information of the NF service Producer is stored locally, the SCP may not initiate the discovery process of the NF service Producer.
  • the access token request message may be NNrf_AccessToken_Get_Request or other messages, which is not limited in this embodiment of the present application.
  • Step 1304 NRF receives the access token request message, and NRF authenticates the NF service Consumer according to the CCA.
  • NRF successfully authenticates the NF service Consumer according to the CCA, NRF performs an authorization check, determines that the authorization is passed, and generates an access token corresponding to the first service.
  • the NRF verifies the signature of the CCA, verifies whether the CCA has expired according to the timestamp and/or the expiration time of the CCA, and verifies whether the NF instance ID of the NF service consumer in the CCA matches the NF instance ID in the certificate used to sign the CCA.
  • NRF also needs to verify whether the first NF type and the second NF type included in the CCA have the same NF type as the NRF's NF type. When NRF determines that the second NF type is the same as the NRF's NF type match, the NRF determines that the authentication of the NF service Consumer is successful.
  • Step 1305 the NRF sends an access token response message to the SCP, and the access token response message includes the access token corresponding to the first service.
  • Step 1306 the SCP sends a second service request message to the NF service producer.
  • the second service request message includes the access token and CCA corresponding to the first service.
  • Step 1307 The NF service producer receives the second service request message from the SCP.
  • the NF service producer authenticates the NF service consumer according to CCA.
  • the NF service producer performs integrity verification on the access token corresponding to the first service. If the integrity verification is successful, it further verifies the claims in the access token corresponding to the first service. For details, see the relevant content of the claims verification in the access token above.
  • the NF service producer also needs to authenticate the NF service consumer according to CCA.
  • the NF service producer verifies the signature of the CCA, verifies whether the CCA has expired according to the timestamp and/or the expiration time of the CCA, and verifies whether the NF instance ID of the NF service consumer in the CCA matches the NF instance ID in the certificate used to sign the CCA , in addition to the successful verification of the above verification content, the NF service producer also needs to verify whether the first NF type and the second NF type included in the CCA have an NF type that matches the NF type of the NF service producer. When the NF service producer determines that the first If the NF type matches the NF type of the NF service producer, the NF service producer determines that the authentication of the NF service consumer is successful.
  • the order of verifying the access token and CCA above can also be to verify the CCA first, and then verify the access token after the verification is successful, which is not limited here.
  • the NF service producer also checks whether the NF instance Id of the NF service consumer in the CCA is the same as the NF instance Id of the NF service consumer included in the access token, and if they are the same, provide the requested service for the NF service consumer.
  • Step 1308 The NF service producer determines that the verification of the first acess token is successful and the verification of the NF service consumer is successful, then the NF service producer sends a response message to the SCP for the second service request message.
  • the response message to the second service request message is used to indicate that the first service is provided or that the second service request is successful.
  • the response message to the second service request message indicates that the first service request fails.
  • Step 1309 The SCP receives a response message from the NF service producer for the second service request message, and sends a response message to the NF service consumer for the first service request message.
  • the response message to the second service request message may include the access token corresponding to the first service.
  • the NF service Consumer stores the access token corresponding to the first service, which is used to subsequently initiate a request for the first service.
  • the NF service consumer determines whether to store an available CCA, and if the available CCA is stored, the CCA will be used; CCA. It can be understood that at this time, the CCA may not include the second NF type. However, if the NF service consumer determines that the current indirect communication mode is mode D before step 1301, the first service request message needs to carry the first NF type and the second NF type.
  • the CCA includes the first NF type and the second NF type, thereby ensuring that the NRF and the NF service producer successfully authenticate the NF service consumer according to the CCA, thereby ensuring that the NF service consumer obtains the first service.
  • Embodiment 2 In combination with the embodiment shown in FIG. 10 , when it is determined that the first service needs to be requested and there is no available access token corresponding to the first service, the NF service consumer can adopt but not limited to the following embodiments to obtain the first service, such as Figure 14 shows.
  • Step 1401 The NF service consumer determines to request the first service and there is no available access token corresponding to the first service, the NF service consumer obtains CCA1 and CCA2, and the access token corresponding to the first service indicates/indicates that the NF service consumer has the ability to obtain the first service permissions or permissions to access the first service.
  • the NF service consumer may also determine that the current indirect communication mode is mode D before step 1401 .
  • the NF service consumer determines that the first service is requested and there is no available access token corresponding to the first service. The details can be described in step 1301 in FIG. 13 , and the repetition will not be repeated.
  • the NF service consumer needs to determine whether the available CCA1 and CCA2 are stored locally. If a CCA1 is stored available (e.g., the CCA1 has not expired), then that CCA1 is used. If no available CCA1 is stored (for example, CCA1 has expired), the NF service consumer generates CCA1. If an available CCA2 is stored (for example, the CCA2 is not expired or the CCA2 is not stored), then the CCA2 is used. If no available CCA2 is stored (for example, CCA2 has expired or CCA2 is not stored), the NF service consumer generates CCA2. Wherein, when CCA1 or CCA2 expires, the NF service consumer deletes the expired CCA.
  • CCA1 includes the first NF type
  • CCA2 includes the second NF type
  • the first NF type is the NF type of the NF service producer expected to provide the first service
  • the second NF type is the NF type of the NRF expected to provide the access token .
  • CCA1 also includes the identifier of the NF instance of the NF service consumer, the time stamp, and the expiration time of CCA1.
  • CCA2 also includes the identification of the NF instance of the NF service consumer, the timestamp, and the expiration time of CCA2.
  • Step 1402 The NF service Consumer sends a first service request message to the SCP, and the first service request message includes CCA1 and CCA2 in step 1401 and parameters for obtaining an access token.
  • the first service request message is used to request a first service.
  • step 1402 in Embodiment 1 Regarding the parameters used to obtain the access token and the parameters used to discover the NF service producer, reference can be made to step 1402 in Embodiment 1, and repeated descriptions will not be repeated.
  • Step 1403 the SCP sends an access token request message to the NRF, and the access token request message includes CCA2 and parameters for obtaining the access token.
  • the SCP determines that the first service request message does not include the access token corresponding to the first service and the access token corresponding to the first service is not stored locally or the SCP determines that the first service request message does not include the first The access token corresponding to the service and the stored access token corresponding to the first service expire. If it is judged that the stored access token corresponding to the first service has expired, the SCP deletes the expired access token corresponding to the first service.
  • the SCP Since the SCP needs to send an access token request message to the NRF, the SCP selects CCA2 and adds it to the access token request message.
  • the SCP needs to initiate the discovery process of the NF service producer before step 1403 . Otherwise, the SCP can initiate the discovery process of the NF service producer after obtaining the access token corresponding to the first service. Or, when the information of the NF service Producer is stored locally, the SCP may not initiate the discovery process of the NF service Producer.
  • the access token request message may be NNrf_AccessToken_Get_Request or other messages, which is not limited in this embodiment of the present application.
  • Step 1404 NRF receives the access token request message, and NRF authenticates the NF service consumer according to CCA2.
  • NRF successfully authenticates the NF service Consumer according to CCA2, NRF performs an authorization check, confirms that the authorization is passed, and generates an access token corresponding to the first service.
  • NRF verifies the signature of CCA2, verifies whether CCA2 has expired according to the timestamp and/or the expiration time of CCA2, and verifies whether the NF instance ID of the NF service consumer in CCA2 matches the NF instance ID in the certificate used to sign CCA2.
  • NRF also needs to verify whether the second NF type included in CCA2 is the same as the NF type of NRF. Since the second NF type matches the NF type of the NRF, the NRF determines that the CCA2 verification is successful.
  • Step 1405 the NRF sends an access token response message to the SCP, and the access token response message includes the access token corresponding to the first service.
  • Step 1406 the SCP sends a second service request message to the NF service producer.
  • the second service request message includes the access token and CCA1 corresponding to the first service.
  • the SCP Since the SCP needs to send the second service request message to the NF service producer, the SCP selects CCA1 and adds it to the second service request message.
  • Step 1407 The NF service producer receives the second service request message from the SCP, and the NF service producer verifies CCA1 and the access token corresponding to the first service.
  • the NF service producer performs integrity verification on the access token corresponding to the first service. If the integrity verification is successful, it further verifies the claims in the access token corresponding to the first service. For details, see the relevant content of the claims verification in the access token above.
  • the NF service producer also needs to authenticate the NF service consumer according to CCA1. Among them, the NF service producer verifies the signature of CCA1, verifies whether CCA1 has expired according to the timestamp and/or the expiration time of CCA1, and verifies whether the NF instance ID of the NF service consumer in CCA1 matches the NF instance ID in the certificate used to sign CCA1 . In addition to the successful verification of the above verification contents, the NF service consumer also needs to verify whether the first NF type included in CCA1 matches the NF type of the NF service producer. Since the first NF type matches the NF type of the NF service producer, it is determined that the authentication of the NF service consumer is successful.
  • the order of verifying the access token and CCA1 above can also be to verify CCA1 first, and then verify the access token after the verification is successful, which is not limited here.
  • the NF service producer After both the access token and CCA1 are successfully verified, the NF service producer also checks whether the NF instance Id of the NF service consumer in CCA1 is the same as the NF instance Id of the NF service consumer contained in the access token, and if they are the same, provide a request for the NF service consumer services.
  • Step 1408 The NF service producer determines the first acess token and the NF service consumer authenticates successfully, then the NF service producer sends a response message to the SCP for the second service request message.
  • the response message to the second service request message is used to indicate that the first service is provided or that the second service request is successful.
  • the response message to the second service request message indicates that the first service request fails.
  • Step 1409 The SCP receives a response message from the NF service producer for the second service request message, and sends a response message to the NF service consumer for the first service request message.
  • the response message to the first service request message may include an access token corresponding to the first service.
  • the NF service Consumer stores the access token corresponding to the first service, which is used to subsequently initiate a request for the first service.
  • the NF service consumer determines whether to store an available CCA1, if it stores an available CCA1, it uses the CCA1, and if it does not store an available CCA1, it generates CCA1. It is understandable that at this time, the NF service consumer does not need to judge whether to store the available CCA2, even if the available CCA2 is not stored, it does not need to generate CCA2, and does not need to obtain the access token corresponding to the first service through SCP, the first service request The message may not include CCA2. However, if the NF service consumer determines that the current indirect communication mode is mode D before step 1401, then the first service request message needs to carry CCA1 and CCA2.
  • CCA1 includes the first NF type
  • CCA2 includes the second NF type, thereby ensuring that the NRF successfully authenticates the NF service consumer according to CCA2, and the NF service producer successfully authenticates the NF service consumer according to CCA1, thereby ensuring that the NF service consumer obtains First service.
  • Embodiment 3 In combination with the embodiment shown in FIG. 11 , when it is determined that the first service needs to be requested and there is no available access token corresponding to the first service, the NF service consumer can adopt but not limited to the following embodiments to obtain the first service, such as Figure 15 shows.
  • Step 1501 and step 1502 may refer to the repetition of step 1401 and step 1402 in FIG. 14 and will not be repeated here.
  • Step 1503 the SCP sends an access token request message to the NRF, and the access token request message includes CCA2 and CCA1 and parameters for obtaining the access token.
  • the SCP determines that the first service request message does not include the access token corresponding to the first service and the access token corresponding to the first service is not stored locally or the SCP determines that the first service request message does not include the first The access token corresponding to the service and the stored access token corresponding to the first service expire. If it is judged that the stored access token corresponding to the first service has expired, the SCP deletes the expired access token corresponding to the first service.
  • the SCP needs to initiate the discovery process of the NF service producer before step 1503 . Otherwise, the SCP can initiate the discovery process of the NF service producer after obtaining the access token corresponding to the first service. Or, when the information of the NF service producer is locally stored, the SCP may not initiate the discovery process of the NF service producer.
  • the access token request message may be NNrf_AccessToken_Get_Request or other messages, which is not limited in this embodiment of the present application.
  • Step 1504 NRF receives the access token request message, and NRF authenticates the NF service consumer according to CCA1 and CCA2.
  • NRF successfully authenticates the NF service consumer according to CCA1 or successfully authenticates the NF service consumer according to CCA2, NRF performs an authorization check, determines that the authorization is passed, and generates an access token corresponding to the first service.
  • NRF authenticates the NF service consumer according to CCA1 and CCA2. At this time, it is not necessary for NRF to determine the success of the NF service consumer authentication according to CCA1 and the success of the NF service consumer authentication according to CCA2. When the NF service consumer authentication is determined according to CCA1 or the NF service consumer authentication is determined according to CCA2 When successful, the NRF determines that the authentication of the NF service consumer is successful.
  • NRF verifies the signature of CCA1, verifies whether CCA1 is expired according to the timestamp and/or the expiration time of CCA1, and verifies whether the NF instance ID of the NF service consumer in CCA1 matches the NF instance ID in the certificate used to sign CCA1.
  • NRF also needs to verify whether the first NF type included in CCA1 matches the NF type of NRF. Since the first NF type does not match the NF type of NRF, NRF determines that the authentication of the NF service consumer fails .
  • NRF verifies the signature of CCA2, verifies whether CCA2 has expired according to the timestamp and/or the expiration time of CCA2, and verifies whether the NF instance ID of the NF service consumer in CCA2 matches the NF instance ID in the certificate used to sign CCA2.
  • NRF also needs to verify whether the second NF type included in CCA2 matches the NF type of NRF. Since the second NF type matches the NF type of NRF, NRF determines that the authentication of the NF service consumer is successful.
  • Step 1505 the NRF sends an access token response message to the SCP, and the access token response message includes the access token corresponding to the first service.
  • Step 1506 the SCP sends a second service request message to the NF service producer.
  • the second service request message includes the access token, CCA1 and CCA2 corresponding to the first service.
  • Step 1507 The NF service producer receives the second service request message from the SCP. NF service producer verifies CCA1, CCA2 and access token.
  • the NF service producer performs integrity verification on the access token corresponding to the first service. If the integrity verification is successful, it further verifies the claims in the access token corresponding to the first service. For details, see the relevant content of the claims verification in the access token above.
  • the NF service producer authenticates the NF service consumer according to CCA1 and CCA2. At this time, it is not necessary for the NF service producer to determine the success of the NF service consumer authentication according to CCA1 and the success of the NF service consumer authentication according to CCA2. The NF service producer determines the success of the NF service consumer authentication according to CCA1 or according to When CCA2 determines that the authentication of the NF service consumer is successful, the NF service producer determines that the authentication of the NF service consumer is successful.
  • the NF service producer verifies the signature of CCA1, verifies whether CCA1 is expired according to the timestamp and/or the expiration time of CCA1, and verifies whether the NF instance ID of the NF service consumer in CCA1 matches the NF instance ID in the certificate used to sign CCA .
  • the NF service producer also needs to verify whether the first NF type included in CCA1 matches the NF type of the NF service producer. If the first NF type matches the NF type of the NF service producer, then the NF service producer Confirm that the authentication of the NF service consumer is successful.
  • the NF service producer verifies the signature of CCA2, verifies whether CCA2 has expired according to the timestamp and/or the expiration time of CCA2, and verifies whether the NF instance ID of the NF service consumer in CCA2 matches the NF instance ID in the certificate used to sign CCA2 .
  • the NF service producer In addition to the successful verification of the above verification content, the NF service producer also needs to verify whether the second NF type included in CCA2 matches the NF type of the NF service producer, because the second NF type is the NF that expects to provide the access token corresponding to the first service If the NF type of the service producer and the second NF type do not match the NF type of the NF service producer, the NF service producer determines that the authentication of the NF service consumer fails.
  • Step 1508 The NF service producer determines that the verification of the first acess token is successful and the verification of the NF service consumer is successful, then the NF service producer sends a response message to the SCP for the second service request message.
  • the response message to the second service request message is used to indicate that the first service is provided or that the second service request is successful.
  • the response message to the second service request message indicates that the first service request fails.
  • Step 1509 The SCP receives the response message to the second service request message from the NF service producer, and sends a response message to the NF service consumer to the first service request message.
  • the response message to the second service request message may include the access token corresponding to the first service.
  • the NF service consumer stores the access token corresponding to the first service, which is used to subsequently initiate a request for the first service.
  • CCA1 includes the first NF type
  • CCA2 includes the second NF type, thereby ensuring that the NRF successfully authenticates the NF service consumer according to CCA1, and the NF service producer successfully authenticates the NF service consumer according to CCA2, thereby ensuring the acquisition of the NF service consumer.
  • Embodiment 4 When it is determined that the first service needs to be requested and there is an available access token corresponding to the first service, the NF service consumer can adopt but not limited to the following embodiment to obtain the first service, as shown in FIG. 16 .
  • Step 1601 The NF service consumer determines to request the first service and there is an available access token corresponding to the first service, the NF service consumer obtains the CCA, and the access token corresponding to the first service indicates/indicates that the NF service consumer has the right to obtain the first service or Permission to access the first service.
  • the NF service consumer determines that there is an available access token corresponding to the first service, the NF service consumer can further determine whether to store an available CCA. If an available CCA is stored, the CCA will be used. If no available CCA is stored, a CCA will be generated. . It can be understood that at this time, the CCA generated by the NF service consumer may not need to include the second NF type.
  • the CCA includes the identifier of the NF instance of the NF service consumer, the time stamp, the expiration time and the first NF type, wherein the first NF type is the NF type of the NF service producer expected to provide the first service.
  • Step 1602 The NF service Consumer sends a first service request message to the SCP, and the first service request message includes the CCA in step 1601 and the access token corresponding to the first service.
  • Step 1603 the SCP sends a second service request message to the NF service producer.
  • the second service request message includes the access token and CCA corresponding to the first service.
  • the SCP Before the SCP sends the second service request message to the NF service producer, the SCP determines that the first service request message includes the access token corresponding to the first service or locally stores the access token corresponding to the first service.
  • Step 1604 The NF service producer receives the second service request message from the SCP.
  • the NF service producer authenticates the NF service consumer according to CCA.
  • the NF service consumer performs integrity verification on the access token corresponding to the first service. If the integrity verification is successful, it further verifies the claims in the access token corresponding to the first service. For details, see the relevant content of the claims verification in the above access token .
  • the NF service producer also needs to authenticate the NF service consumer according to the CCA. For details, please refer to the existing CCA verification process.
  • the NF service producer verifies the signature of the CCA, verifies whether the CCA is expired according to the timestamp and/or the expiration time of the CCA, and verifies whether the NF instance ID of the NF service consumer in the CCA matches the NF instance ID in the certificate used to sign the CCA.
  • the NF service producer also needs to verify whether the first NF type included in CCA1 matches the NF type of the NF service producer. If the first NF type matches the NF type of the NF service producer, then the NF service producer Confirm that the authentication of the NF service consumer is successful.
  • Step 1605 The NF service producer determines that the verification of the first acess token is successful and the verification of the NF service consumer is successful, then the NF service producer sends a response message to the SCP for the second service request message.
  • the response message to the second service request message is used to indicate that the first service is provided or that the second service request is successful.
  • the response message to the second service request message indicates that the first service request fails.
  • Step 1606 The SCP receives a response message to the second service request message from the NF service producer, and sends a response message to the NF service consumer to the first service request message.
  • the NF service consumer can only carry the first NF type to obtain the first service.
  • Embodiment 5 In combination with the embodiment shown in FIG. 8 , when the first service needs to be requested and the request for the first service triggers the SCP to request the parameters of the NF service producer (triggers the SCP to initiate the discovery process of the NF service producer), the NF service consumer can use but The following embodiments are not limited to obtaining the first service, as shown in FIG. 17 .
  • Step 1701 The NF service consumer determines to trigger the SCP to initiate the discovery process of the NF service producer, and the NF service consumer obtains the CCA.
  • the NF service consumer may also determine that the current indirect communication mode is mode D before step 1701 .
  • the NF service consumer may determine to trigger the SCP to initiate the discovery process of the NF service producer according to one or more of the following:
  • Case 1 The UE's context is not stored.
  • the NF service consumer determines that it needs to request the first service according to the service request message of the UE.
  • Case 2 The context of the first service is not stored.
  • the first slice belongs to the service providing network element and does not store the context of the first slice.
  • the NF service consumer determines that it needs to request the service providing network element in the first slice according to the service request message of the UE.
  • First service First service.
  • the NF service consumer Before the NF service consumer generates the CCA, the NF service consumer first needs to determine whether the available CCA is stored locally, and if the available CCA is stored (for example, the CCA is not expired), the CCA is used. If no available CCA is stored (for example, the CCA has expired or the CCA is not stored), the NF service consumer generates the CCA. When the CCA expires, the NF service consumer deletes the expired CCA.
  • CCA includes the first NF type and the second NF type, wherein, the first NF type is the NF type of the NF service producer expected to provide the first service, and the second NF type is the NF of the NRF expected to provide the information of the NF service producer type.
  • the CCA also includes the identifier, time stamp, and expiration time of the NF instance of the NF service consumer.
  • Step 1702 The NF service Consumer sends a first service request message to the SCP.
  • the first service request message includes the CCA in step 1701 and parameters for discovering the NF service producer.
  • the first service request message is used to request the first service.
  • the parameters used to discover the NF service producer may include the NF type of the expected NF service producer, the S-NSSAI list or the NSI ID list of the expected NF service producer instance, and the like.
  • Step 1703 the SCP sends a discovery request message to the NRF, the discovery request message includes the CCA and parameters for discovering the NF service producer.
  • the SCP determines that the first service request message does not include the information of the NF service producer and the information of the NF service producer is not locally stored.
  • the first service request message also includes the access token corresponding to the first service, or the SCP locally stores the access token corresponding to the first service.
  • Step 1704 The NRF receives the discovery request message, and the NRF authenticates the NF service consumer according to the CCA.
  • the NRF verifies the signature of the CCA, verifies whether the CCA has expired according to the timestamp and/or the expiration time of the CCA, and verifies whether the NF instance ID of the NF service consumer in the CCA matches the NF instance ID in the certificate used to sign the CCA.
  • NRF also needs to verify whether there is an NF type that matches the NF type of NRF in the first NF type and second NF type included in CCA. match, the NRF determines that the authentication of the NF service consumer is successful.
  • Step 1705 the NRF sends a discovery response message to the SCP, and the discovery response message includes the parameters of the NF service producer.
  • the NRF sends a discovery response message to the SCP, and the discovery response message includes the parameters of the NF service producer.
  • Step 1706 the SCP sends a second service request message to the NF service producer.
  • the second service request message includes the access token and CCA corresponding to the first service.
  • the SCP sends the second service request message to the NF service producer indicated by the parameter of the NF service producer in the discovery response message.
  • Step 1707 The NF service producer receives the second service request message from the SCP.
  • the NF service producer authenticates the NF service consumer according to CCA.
  • the NF service producer performs integrity verification on the access token corresponding to the first service. If the integrity verification is successful, it further verifies the claims in the access token corresponding to the first service. For details, see the relevant content of the claims verification in the access token above.
  • the NF service producer also needs to authenticate the NF service consumer according to CCA.
  • the NF service producer verifies the signature of the CCA, verifies whether the CCA has expired according to the timestamp and/or the expiration time of the CCA, and verifies whether the NF instance ID of the NF service consumer in the CCA matches the NF instance ID in the certificate used to sign the CCA , in addition to the successful verification of the above verification content, the NF service producer also needs to verify whether the first NF type and the second NF type included in the CCA have an NF type that matches the NF type of the NF service producer. When the NF service producer determines that the first If the NF type matches the NF type of the NF service producer, the NF service producer determines that the authentication of the NF service consumer is successful.
  • Step 1708 The NF service producer determines that the verification of the first acess token is successful and the verification of the NF service consumer is successful, then the NF service producer sends a response message to the SCP for the second service request message.
  • the response message to the second service request message is used to indicate that the first service is provided or that the second service request is successful.
  • the response message to the second service request message indicates that the first service request fails.
  • Step 1709 The SCP receives the response message to the second service request message from the NF service producer, and sends the response message to the NF service consumer to the first service request message.
  • the CCA includes the first NF type and the second NF type, thereby ensuring that the NRF and the NF service producer successfully authenticate the NF service consumer according to the CCA, thereby ensuring that the NF service consumer obtains the first service.
  • Embodiment 6 In combination with the embodiment shown in FIG. 10 , when the first service needs to be requested and the request for the first service triggers the SCP to request the parameters of the NF service producer (triggers the SCP to initiate the discovery process of the NF service producer), the NF service consumer can use but The following embodiments are not limited to obtaining the first service, as shown in FIG. 18 .
  • Step 1801 The NF service consumer determines to trigger the SCP to execute the discovery process of the NF service producer, and the NF service consumer acquires CCA1 and CCA2.
  • the NF service consumer may also determine that the current indirect communication mode is mode D before step 1801 .
  • the NF service consumer determines to trigger the SCP to execute the discovery process of the NF service producer, and reference may be made to the related description in step 1701 of the above-mentioned embodiment 5.
  • the NF service consumer needs to first determine whether the available CCA1 and CCA2 are stored locally. If an available CCA1 is stored (for example, the CCA1 is still within the expiration time), the CCA1 is used. If no available CCA1 is stored (for example, CCA1 has expired or CCA1 is not stored), the NF service consumer generates CCA1. If a CCA2 is available for storage (eg, the CCA2 has not expired), then that CCA2 is used. If no available CCA2 is stored (for example, CCA2 has expired or CCA2 is not stored), the NF service consumer generates CCA2. Wherein, if CCA1 or CCA2 expires, the NF service consumer deletes the expired CCA.
  • CCA1 includes the first NF type
  • CCA2 includes the second NF type
  • the first NF type is the NF type of the NF service producer expecting to provide the first service
  • the second NF type is the NRF expecting to provide the information of the NF service producer The NF type.
  • CCA1 also includes the identifier of the NF instance of the NF service consumer, the time stamp, and the expiration time of CCA1.
  • CCA2 also includes the identification of the NF instance of the NF service consumer, the timestamp, and the expiration time of CCA2.
  • Step 1802 The NF service Consumer sends a first service request message to the SCP, the first service request message includes CCA1 and CCA2 in step 1801 and parameters for discovering the NF service producer.
  • the first service request message is used to request a first service.
  • Step 1803 the SCP sends a discovery request message to the NRF, the discovery request message includes CCA2 and parameters for discovering the NF service producer.
  • the SCP determines that the first service request message does not include the information of the NF service producer and the information of the NF service producer is not locally stored.
  • the first service request message also includes the access token corresponding to the first service, or the SCP locally stores the access token corresponding to the first service.
  • the SCP Since the SCP needs to send a discovery request message to the NRF, the SCP selects CCA2 and adds it to the discovery request message.
  • Step 1804 NRF receives the discovery request message, and NRF authenticates the NF service consumer according to CCA2.
  • NRF verifies the signature of CCA2, verifies whether CCA2 has expired according to the timestamp and/or the expiration time of CCA2, and verifies whether the NF instance ID of the NF service consumer in CCA2 matches the NF instance ID in the certificate used to sign CCA2.
  • NRF also needs to verify whether the second NF type included in CCA2 matches the NF type of NRF. Since the second NF type matches the NF type of the NRF, the NRF determines that the authentication of the NF service consumer is successful.
  • Step 1805 the NRF sends a discovery response message to the SCP, and the discovery response message includes the information of the NF service producer.
  • the NRF sends a discovery response message to the SCP, and the discovery response message includes the parameters of the NF service producer.
  • Step 1806 the SCP sends a second service request message to the NF service producer.
  • the second service request message includes the access token and CCA1 corresponding to the first service.
  • the SCP sends the second service request message to the NF service producer indicated by the parameter of the NF service producer in the discovery response message.
  • the SCP Since the SCP needs to send the second service request message to the NF service producer, the SCP selects CCA1 and adds it to the second service request message.
  • Step 1807 The NF service producer receives the second service request message from the SCP.
  • the NF service producer authenticates the NF service consumer according to CCA1.
  • the NF service producer performs integrity verification on the access token corresponding to the first service. If the integrity verification is successful, it further verifies the claims in the access token corresponding to the first service. For details, see the relevant content of the claims verification in the access token above.
  • the NF service producer also needs to authenticate the NF service consumer according to CCA1.
  • the NF service producer verifies the signature of CCA1, verifies whether CCA1 is expired according to the timestamp and/or the expiration time of CCA1, and verifies whether the NF instance ID of the NF service consumer in CCA1 matches the NF instance ID in the certificate used to sign CCA .
  • the NF service consumer also needs to verify whether the first NF type included in CCA1 matches the NF type of the NF service producer. Since the first NF type matches the NF type of the NF service producer, the NF service producer determines that the authentication of the NF service consumer is successful.
  • Step 1808 The NF service producer determines that the verification of the first acess token is successful and the verification of the NF service consumer is successful, then the NF service producer sends a response message to the SCP for the second service request message.
  • the response message to the second service request message is used to indicate that the first service is provided or that the second service request is successful.
  • the response message to the second service request message indicates that the first service request fails.
  • Step 1809 The SCP receives a response message from the NF service producer for the second service request message, and sends a response message to the NF service consumer for the first service request message.
  • the NF service consumer determines whether to store an available CCA1, if it stores an available CCA1, then use the CCA1, if it does not store an available CCA1, then Generate CCA1. It can be understood that at this time, the NF service consumer does not need to judge whether to store the available CCA2, even if the available CCA2 is not stored, it does not need to generate the CCA2, and the first service request message may not include the CCA2. However, if the NF service consumer determines that the current indirect communication mode is mode D before step 1801, then the first service request message needs to carry CCA1 and CCA2.
  • CCA1 includes the first NF type
  • CCA2 includes the second NF type, thereby ensuring that the NRF successfully authenticates the NF service consumer according to CCA1, and the NF service producer successfully authenticates the NF service consumer according to CCA2, thereby ensuring the acquisition of the NF service consumer.
  • Embodiment 7 In combination with the embodiments shown in FIG. 8 and FIG. 10 , the NF service consumer obtains the indication information, and the NF service consumer sends a service request message to the SCP according to the indication information, and the NF service consumer may adopt but not limited to the following embodiments to acquire the first service , as shown in Figure 19.
  • Step 1901 The NF service consumer acquires CCA1.
  • the NF service consumer may also determine that the current indirect communication mode is mode D before step 1901 .
  • the NF service consumer determines to request the first service, and the NF service consumer acquires CCA1. Before the NF service consumer generates CCA1, the NF service consumer needs to first determine whether the available CCA1 is stored locally. If an available CCA1 is stored (eg, the CCA1 has not expired), the CCA1 is used. If no available CCA1 is stored (for example, CCA1 has expired, or CCA1 is not stored), the NF service consumer generates CCA1. In addition, if the CCA1 has expired, the NF service consumer deletes the expired CCA1.
  • CCA1 includes the identifier of the NF instance of the NF service consumer, the time stamp, the expiration time of CCA1, the first NF type, and the first NF type is the NF type of the NF service producer expected to provide the first service.
  • Step 1902 The NF service consumer sends a first service request message to the SCP, and the first service request message includes CCA1 in step 1901.
  • the first service request message is used to request a first service.
  • Step 1903 the SCP sends a second service request message to the NRF, the second service request message includes CCA1, and the second service request message is used to request a second service.
  • Step 1904 NRF receives the second service request message, and NRF fails to authenticate the NF service consumer according to CCA1.
  • NRF verifies the signature of CCA1, verifies whether CCA1 is expired according to the timestamp and/or the expiration time of CCA1, and verifies whether the NF instance ID of the NF service consumer in CCA1 matches the NF instance ID in the certificate used to sign CCA1.
  • NRF also needs to verify whether the first NF type included in CCA1 matches the NF type of NRF. Since the first NF type does not match the NF type of NRF, NRF determines that the NF service consumer authentication fails .
  • Step 1905 the NRF sends a response message to the SCP to the second service request message.
  • the response message to the second service request message includes CCA2.
  • CCA2 includes the identification of the NF instance of the NRF, the timestamp and the expiration time, the NF type of the NF service consumer and the NF type of the NRF.
  • Step 1906 the SCP sends a response message to the first service request message to the NF service consumer.
  • a response message to the first service request message includes CCA2.
  • Step 1907 The NF service consumer sends a third service request message to the SCP, where the third service request message includes CCA3 and CCA4, or the third service request message includes CCA5.
  • the CCA3 includes the identifier of the NF instance of the NF service consumer, the timestamp, the expiration time of the CCA3, and the first NFtype.
  • CCA4 includes the identifier of the NF instance of the NF service consumer, the time stamp, the expiration time of CCA4, and the second NFtype.
  • CCA5 includes the identifier of the NF instance of the NF service consumer, the timestamp, the expiration time of CCA5, the first NF type, and the second NF type.
  • the first NF type is the NF type of the NF service producer expecting to provide the first service
  • the second NF type is the NF type of the NF service producer expecting to provide the second service.
  • the NF service consumer authenticates the NRF according to the CCA2, and determines that the NRF authentication is successful, and generates CCA3 and CCA4, or CCA5 according to the NF type of the NRF in the CCA2.
  • Step 1908 The SCP sends a fourth service request message to the NRF, the fourth service request message includes CCA4 or CCA5, and the fourth service request message is used to request the second service.
  • Step 1909 The NRF receives the fourth service request message, and the NRF authenticates the NF service consumer according to the CCA in the fourth service request message.
  • the NRF successfully authenticates the NF service consumer according to the CCA4.
  • NRF verifies the signature of CCA4, verifies whether CCA4 is expired according to the timestamp and/or the expiration time of CCA4, and verifies whether the NF instance ID of the NF service consumer in CCA4 matches the NF instance ID in the certificate used to sign CCA4.
  • NRF also needs to verify whether the second NF type included in CCA4 matches the NF type of NRF. Since the second NF type matches the NF type of NRF, NRF determines that the authentication of the NF service consumer is successful.
  • the NRF successfully authenticates the NF service consumer according to the CCA5.
  • NRF verifies the signature of CCA5, verifies whether CCA5 is expired according to the timestamp and/or the expiration time of CCA5, and verifies whether the NF instance ID of the NF service consumer in CCA5 matches the NF instance ID in the certificate used to sign CCA5.
  • NRF also needs to verify whether there is an NF type that matches the NF type of NRF in the first NF type and the second NF type included in CCA5. Since the second NF type matches the NF type of NRF, then The NRF determines that the authentication of the NF service consumer is successful.
  • Step 1910 the NRF sends a response message to the SCP to the fourth service request message.
  • Step 1911 the SCP sends a fifth service request message to the NF service producer.
  • the fifth service request message includes CCA3 and the access token corresponding to the first service, or, the fifth service request message includes CCA5 and the access token corresponding to the first service.
  • Step 1912 The NF service producer receives the fifth service request message from the SCP.
  • the NF service producer authenticates the NF service consumer according to the CCA in the fifth service request message.
  • the NF service producer performs integrity verification on the access token corresponding to the first service. If the integrity verification is successful, it further verifies the claims in the access token corresponding to the first service. For details, see the relevant content of the claims verification in the access token above.
  • the NF service producer also needs to authenticate the NF service consumer according to CCA3. Among them, the NF service producer verifies the signature of CCA3, verifies whether CCA3 has expired according to the timestamp and/or the expiration time of CCA3, and verifies whether the NF instance ID of the NF service consumer in CCA3 matches the NF instance ID in the certificate used to sign CCA . In addition to the successful verification of the above verification content, the NF service consumer also needs to verify whether the first NF type included in CCA3 matches the NF type of the NF service producer. Since the first NF type matches the NF type of the NF service producer, it is determined that the NF The service consumer authentication is successful.
  • the NF service producer also needs to authenticate the NF service consumer according to CCA5. Among them, the NF service producer verifies the signature of CCA5, verifies whether CCA5 is expired according to the timestamp and/or the expiration time of CCA5, and verifies whether the NF instance ID of the NF service consumer in CCA5 matches the NF instance ID in the certificate used to sign CCA . In addition to the successful verification of the above verification content, the NF service consumer also needs to verify whether the first NF type and the second NF type included in CCA5 include the NF type that matches the NF type of the NF service producer. Since the first NF type and the NF service If the NF type of the producer matches, it is determined that the CCA5 authentication is successful.
  • Step 1913 The NF service producer determines the first acess token and the NF service consumer is authenticated successfully, and the NF service producer sends a response message to the SCP for the fifth service request message.
  • the response message to the fifth service request message is used to indicate the first service or indicate that the fifth service request is successful.
  • the response message to the fifth service request message indicates that the first service request fails.
  • Step 1914 the SCP receives the response message to the fifth service request message from the NF service producer, and sends the response message to the third service request message to the NF service consumer.
  • the SCP sends instruction information to the NF service consumer, and the NF service consumer sends a service request message according to the instruction information to carry CCA3 (the first NF type) and CCA4 (the second NF type), or CCA5 (the first NF type and the second NF type).
  • CCA3 the first NF type
  • CCA4 the second NF type
  • CCA5 the first NF type and the second NF type
  • Embodiment 8 In combination with the embodiment shown in Figure 12, the SCP actively requests the client authentication credential, sends a client authentication credential request message, and the NF service consumer responds to the client authentication credential request message, and the NF service consumer can use but not limited to the following embodiments to obtain the first service, as shown in Figure 20.
  • Step 2006 the SCP sends a CCA request message to the NF service consumer.
  • the CCA request message includes CCA2.
  • Step 2007 The NF service consumer sends a response message to the CCA request message to the SCP, the response message to the CCA request message includes CCA3, or the response message to the CCA request message includes CCA4.
  • the CCA3 includes the identifier of the NF instance of the NF service consumer, the timestamp, the expiration time of the CCA3, and the second NFtype.
  • CCA4 includes the identifier of the NF instance of the NF service consumer, the timestamp, the expiration time of CCA4, the first NF type, and the second NF type.
  • the first NF type is the NF type of the NF service producer expecting to provide the first service
  • the second NF type is the NF type of the NF service producer expecting to provide the second service.
  • the NF service consumer authenticates the NRF according to the CCA2, and determines that the NRF authentication is successful, and generates CCA3 or CCA4 according to the NF type of the NRF in the CCA2.
  • Step 2008 the SCP sends a third service request message to the NRF, the third service request message includes CCA3 or CCA4, and the third service request message is used to request the second service.
  • Step 2009 The NRF receives the third service request message, and the NRF authenticates the NF service consumer according to the CCA in the third service request message.
  • the NRF successfully authenticates the NF service consumer according to the CCA3.
  • NRF verifies the signature of CCA3, verifies whether CCA3 has expired according to the timestamp and/or the expiration time of CCA3, and verifies whether the NF instance ID of the NF service consumer in CCA3 matches the NF instance ID in the certificate used to sign CCA3.
  • NRF also needs to verify whether the second NF type included in CCA3 matches the NF type of NRF. Since the second NF type matches the NF type of NRF, NRF determines that the authentication of the NF service consumer is successful.
  • the NRF successfully authenticates the NF service consumer according to the CCA4.
  • NRF verifies the signature of CCA4, verifies whether CCA4 is expired according to the timestamp and/or the expiration time of CCA4, and verifies whether the NF instance ID of the NF service consumer in CCA4 matches the NF instance ID in the certificate used to sign CCA4.
  • NRF also needs to verify whether there is an NF type that matches the NF type of NRF in the first NF type and the second NF type included in CCA4. Since the second NF type matches the NF type of NRF, then The NRF determines that the authentication of the NF service consumer is successful.
  • Step 2010 the NRF sends a response message to the SCP to the third service request message.
  • Step 2011 the SCP sends a fourth service request message to the NF service producer.
  • the fourth service request message includes CCA3 and the access token corresponding to the first service, or, the fourth service request message includes CCA4 and the access token corresponding to the first service.
  • Step 2012 The NF service producer receives the fourth service request message from the SCP.
  • the NF service producer authenticates the NF service consumer according to the CCA in the fourth service request message.
  • the NF service producer performs integrity verification on the access token corresponding to the first service. If the integrity verification is successful, it further verifies the claims in the access token corresponding to the first service. For details, see the relevant content of the claims verification in the access token above.
  • the NF service producer also needs to authenticate the NF service consumer according to CCA3. Among them, the NF service producer verifies the signature of CCA3, verifies whether CCA3 has expired according to the timestamp and/or the expiration time of CCA3, and verifies whether the NF instance ID of the NF service consumer in CCA3 matches the NF instance ID in the certificate used to sign CCA . In addition to the successful verification of the above verification content, the NF service consumer also needs to verify whether the first NF type included in CCA3 matches the NF type of the NF service producer. Since the first NF type matches the NF type of the NF service producer, it is determined that the NF The service consumer authentication is successful.
  • the NF service producer also needs to authenticate the NF service consumer according to CCA4. Among them, the NF service producer verifies the signature of CCA4, verifies whether CCA4 has expired according to the timestamp and/or the expiration time of CCA4, and verifies whether the NF instance ID of the NF service consumer in CCA4 matches the NF instance ID in the certificate used to sign CCA . In addition to the successful verification of the above verification content, the NF service consumer also needs to verify whether the first NF type and the second NF type included in CCA4 include the NF type that matches the NF type of the NF service producer. If the NF type of the producer matches, it is determined that the CCA4 authentication is successful.
  • Step 2013 The NF service producer determines the first acess token and the NF service consumer is authenticated successfully, and the NF service producer sends a response message to the SCP for the fourth service request message.
  • the response message to the fourth service request message is used to indicate that the first service is provided or that the fourth service request is successful.
  • the response message to the fourth service request message indicates that the first service request fails.
  • Step 2014 The SCP receives a response message from the NF service producer for the fourth service request message, and sends a response message to the NF service consumer for the first service request message.
  • the SCP sends a client authentication credential request message to the NF service consumer.
  • the client authentication credential request message includes instruction information, and the NF service consumer responds to the client authentication credential request message according to the instruction information.
  • the response message to the client authentication credential request message carries CCA3 (second NF type) or CCA4 (first NF type and second NF type) to ensure that the NF service consumer obtains the first service.
  • Fig. 21 shows a possible exemplary block diagram of an apparatus involved in the embodiment of the present application.
  • the apparatus 2100 includes: a transceiver module 2110 and a processing module 2120, and the transceiver module 2110 may include a receiving unit and a sending unit.
  • the processing module 2120 is used to control and manage the actions of the device 2100 .
  • the transceiver module 2110 is used to support the communication between the apparatus 2100 and other network entities.
  • the device 2100 may further include a storage unit for storing program codes and data of the device 2100 .
  • each module in the apparatus 2100 may be implemented by software.
  • the processing module 2120 may be a processor or a controller, such as a general-purpose central processing unit (central processing unit, CPU), a general-purpose processor, digital signal processing (digital signal processing, DSP), an application-specific integrated circuit (application specific integrated circuits, ASIC), field programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It can realize or execute various exemplary logical blocks, modules and circuits described in conjunction with the disclosed content of the embodiments of the present application.
  • the processor may also be a combination of computing functions, for example, a combination of one or more microprocessors, a combination of DSP and a microprocessor, and so on.
  • the transceiver module 2110 may be a communication interface, a transceiver or a transceiver circuit, etc., wherein the communication interface is collectively referred to as, in a specific implementation, the communication interface may include multiple interfaces, and the storage unit may be a memory.
  • the processing module 2120 in the device 2100 can support the device 2100 to execute the actions of the service consumption network element in the above method examples, for example, it can support the device 2100 to execute, Step 1401 in FIG. 14 , step 1501 in FIG. 15 , step 1601 in FIG. 16 , step 1701 in FIG. 17 , step 1801 in FIG. 18 , step 1901 in FIG. 19 , and step 2001 in FIG. 20 .
  • the transceiver module 2110 can support the communication between the device 2100 and the service communication agent (such as SCP), for example, the transceiver module 2110 can support the device 2100 to execute steps 801, 808 in FIG. 8, steps 901 and 905 in FIG. 9, Step 906, step 1001 in Fig. 10, step 1008, step 1101 in Fig. 11, step 1108, step 1201 in Fig. 12, step 1205, step 1206, step 1213, step 1302 in Fig. 13, step 1309, Fig. Step 1402 in Fig. 14, step 1409, step 1502 in Fig. 15, step 1509, step 1602 in Fig. 16, step 1606, step 1702 in Fig. 17, step 1709, step 1802 in Fig. 18, step 1809, Fig. Step 1902, step 1906, step 1907, and step 1914 in FIG. 19, step 2002, step 2006, step 2007, and step 2014 in FIG.
  • the service communication agent such as SCP
  • the device 2100 includes:
  • the transceiver module 2110 sends the first service request message to the service communication agent, and the service consumption network element receives a response message to the first service request message from the service communication agent.
  • the first service request message is used to request the first service from the service providing network element
  • the first service request message includes the first customer authentication credential
  • the first customer authentication credential is used to authenticate the service consumption network element
  • the first customer authentication credential includes The first network function type and the second network function type
  • the first network function type is the network function type of the service providing network element
  • the second network function type is the network function type of the network element providing the second service; wherein, the second service Associated with the first service.
  • the second service is used to provide an access token corresponding to the first service, and the access token corresponding to the first service is used to indicate that the service consuming network element has the ability to obtain the Permissions for the first service described above.
  • the processing module 2120 is configured to: the service consuming network element determines that there is no available access token corresponding to the first service.
  • the processing module 2120 is configured to: determine that the access token corresponding to the first service is not stored; or determine that the stored access token corresponding to the first service has expired.
  • the second service is used to provide information of the service providing network element.
  • the processing module 2120 is configured to: determine that the first service request message will trigger the service communication agent to request the second service.
  • the processing module 2120 is configured to: determine that the first service request message will trigger the service communication agent to request the second service according to one or more of the following: The context of a terminal device, the first terminal device is associated with the first service; or, the context of the first service is not stored; or, the service providing network element belongs to the first slice and does not store the The context corresponding to the first slice; or, the service consumption network element communicates with the service communication agent for the first time.
  • the processing module 2120 is configured to: determine that an indirect communication mode using mode D is used to request the first service.
  • the transceiver module 2110 is configured to: send a second service request message to the service communication agent, where the second service request message is used to request the first service, and the second The service request message includes a second client authentication credential, the second client authentication credential includes the first network function type, and the second client authentication credential is used to authenticate the service consumption network element; received from the service communication agent For the response message to the second service request message, the response message to the second service request message includes indication information; the processing module 2120 is configured to: according to the indication information, transmit the sending and receiving module 2110 to The service communication agent sends the first service request message.
  • the device 2100 may correspond to the service consumption network element in the foregoing method embodiments, for example, the method in FIG.
  • the corresponding steps of the method for serving the consuming network element in the embodiment can also achieve the beneficial effects of the foregoing method embodiments, and for the sake of brevity, details are not described here.
  • the processing module 2120 in the device 2100 can support the device 2100 to perform the actions of the network storage function network element or the service provision network element in each method example above.
  • the supporting device 2100 may execute step 803 in FIG. 8, step 903 in FIG. 9, step 1003 in FIG. 10, step 1103 in FIG. Step 1203 in Figure 12, step 1208, step 1304 in Figure 13, step 1404 in Figure 14, step 1504 in Figure 15, step 1704 in Figure 17, step 1804 in Figure 18, step 1904 in Figure 19 , step 1909, step 2004 in FIG. 20, step 2009.
  • the transceiver module 2110 can support the communication between the device 2100 and the service communication agent (such as SCP), for example, the transceiver module 2110 can support the device 2100 to execute step 802, step 804, step 808 in FIG. 8, step 902 in FIG. 9, Step 904, step 1002 in Fig.
  • step 1004 step 1102 in Fig. 11, step 1104, step 1202 in Fig. 12, step 1204, step 1207, step 1209, step 1303 in Fig. 13, step 1305, Fig. Step 1403 in Fig. 14, step 1405, step 1503 in Fig. 15, step 1505, step 1703 in Fig. 17, step 1705, step 1803 in Fig. 18, step 1805, step 1903 in Fig. 19, step 1905, step 1908, step 1910, step 2003, step 2005, step 2008, and step 2010 in FIG.
  • the supporting device 2100 may execute step 803 in FIG. 8, step 1006 in FIG. 10, step 1106 in FIG. 11, step 1211 in FIG. Step 1307 in FIG. 14, step 1407 in FIG. 14, step 1507 in FIG. 15, step 1604 in FIG. 16, step 1707 in FIG. 17, step 1807 in FIG. 18, step 1912 in FIG. Step 2012.
  • the transceiver module 2110 can support the communication between the device 2100 and the service communication agent (such as SCP), for example, the transceiver module 2110 can support the device 2100 to execute step 805, step 807, step 808 in FIG. 8, step 1005 in FIG. 10, Step 1007, step 1105 among Fig. 11, step 1107, step 1210 among Fig.
  • step 1212 step 1306 among Fig. 13, step 1308, step 1406 among Fig. 14, step 1408, step 1506 among Fig. 15, Step 1508, step 1603 in Figure 16, step 1605, step 1706 in Figure 17, step 1708, step 1806 in Figure 18, step 1808, step 1911 in Figure 19, step 1913, step 2011 in Figure 20, Step 2013.
  • the device 2100 includes:
  • the transceiver module 2110 is configured to: receive a first service request message from a service communication agent, the first service request message is used to request a first service from the first network element, and the first service request message includes a first client authentication Credentials, the first client authentication credential is used to authenticate service consumption network elements, wherein the first client authentication credential includes multiple network function types;
  • the processing module 2120 is configured to authenticate the service consuming network element according to the first client authentication credential; when authenticating the service consuming network element according to the first client authentication credential, determine its own network function type Whether it matches one or more of the plurality of network function types; sending a response message to the first service request message to the service communication agent through the transceiving module 2110 according to the authentication result.
  • the multiple network function types include a first network function type and a second network function type
  • the first network function type is a network function type of the first network element
  • the second network function type is a network function type of the first network element.
  • the second network function type is a network function type of a network element providing a second service, and the second service is associated with the first service.
  • the second service is used to provide an access token corresponding to the first service, where the access token corresponding to the first service is used to indicate that the service consuming network element has access to The permission of the first service; or, the second service is used to provide the information of the first device.
  • the first service is used to provide an access token corresponding to the second service, where the access token corresponding to the second service is used to indicate that the service consuming network element has access to The authority of the second service; or, the first service is used to provide the information of the second service network element.
  • the transceiving module 2110 is configured to receive a second service request message from the service communication agent, and the second service request message is used to request the first network element for the first
  • the second service request message includes a second client authentication credential
  • the second client authentication credential includes a third network function type; where the third network function type and the network function type of the first network element If it does not match, sending a response message to the service communication agent for the second service request message, the response message for the second service request message includes indication information, where the indication information is used for Trigger the first service request message.
  • the apparatus 2100 may correspond to the method of the first network element (for example, network storage function network element or service provision network element) in the foregoing method embodiments, for example, the method in FIG. 8 , and the apparatus
  • the operations and/or functions of the various modules in 2100 are to implement the corresponding steps of the method of the network storage function network element in the foregoing method embodiments, or the method in FIG. 8 , and the operations and/or functions of the various modules in the device 2100
  • the functions are respectively to realize the corresponding steps of the method of the service providing network element in the foregoing method embodiments, so the beneficial effects of the foregoing method embodiments can also be realized, and for the sake of brevity, details are not described here.
  • the processing module 2120 in the embodiment of the present application is a processor, and the transceiver module 2110 is a transceiver
  • the device 2100 involved in the embodiment of the present application may be the device 2200 shown in FIG. 22 .
  • Fig. 22 shows a schematic structural diagram of a communication device 2200 according to an embodiment of the present application.
  • the apparatus 2200 includes: a processor 2201 .
  • the device 2200 is a service consumption network element or a chip in a service consumption network element
  • the processor 2201 when the processor 2201 is used to invoke the interface to perform the following actions: send a first service request message to the service communication agent , the service consuming network element receives a response message to the first service request message from the service communication agent.
  • the first service request message is used to request the first service from the service providing network element
  • the first service request message includes the first customer authentication credential
  • the first customer authentication credential is used to authenticate the service consumption network element
  • the first customer authentication credential includes The first network function type and the second network function type
  • the first network function type is the network function type of the service providing network element
  • the second network function type is the network function type of the network element providing the second service; wherein, the second service Associated with the first service.
  • apparatus 2200 may also be used to perform other steps and/or operations on the side of the service consumption network element in the foregoing embodiments, and details are not described here for brevity.
  • the processor 2201 when the device 2200 is the first network element or a chip in the first network element, in a possible implementation, when the processor 2201 is used to call the interface to perform the following actions: receive the first service request message from the service communication agent , the first service request message is used to request a first service from the first network element, the first service request message includes a first client authentication credential, and the first client authentication credential is used to authenticate a service consumption network element , wherein, the first client authentication credential includes multiple network function types; according to the first client authentication credential, authenticate the service consumption network element; according to the first client authentication credential, authenticate the service consumption network judge whether its own network function type matches one or more of the plurality of network function types; and send a response message to the service communication agent to the service communication agent according to the authentication result.
  • apparatus 2200 may also be used to perform other steps and/or operations on the first network element side in the foregoing embodiments, and details are not described here for brevity.
  • the processor 2201 may call an interface to perform the above sending and receiving actions, where the called interface may be a logical interface or a physical interface, which is not limited thereto.
  • the physical interface can be implemented through a transceiver.
  • the apparatus 2200 further includes a transceiver 2203 .
  • the apparatus 2200 further includes a memory 2202, and the memory 2202 may store the program codes in the foregoing method embodiments, so as to be called by the processor 2201.
  • the device 2200 includes a processor 2201, a memory 2202, and a transceiver 2203
  • the processor 2201, the memory 2202, and the transceiver 2203 communicate with each other through an internal connection path to transmit control and/or data signals.
  • the processor 2201, the memory 2202, and the transceiver 2203 may be implemented by a chip, and the processor 2201, the memory 2202, and the transceiver 2203 may be implemented in the same chip, or may be implemented in different chips respectively, Or a combination of any two of these functions can be implemented in one chip.
  • the memory 2202 may store program codes, and the processor 2201 calls the program codes stored in the memory 2202 to implement corresponding functions of the apparatus 2200 .
  • a processor may be an integrated circuit chip with signal processing capabilities.
  • each step of the above-mentioned method embodiments may be completed by an integrated logic circuit of hardware in a processor or instructions in the form of software.
  • the above-mentioned processor can be a general-purpose processor, a digital signal processor (digital signal processor, DSP), an application specific integrated circuit (application specific integrated circuit, ASIC), an off-the-shelf programmable gate array (field programmable gate array, FPGA) or other available Programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, system on chip (system on chip, SoC), central processor unit (central processor unit, CPU), or network processor (network processor, NP), can also be a digital signal processing circuit (digital signal processor, DSP), can also be a microcontroller (micro controller unit, MCU), can also be a programmable controller (programmable logic device, PLD) or other Integrated chip.
  • DSP digital signal processor
  • ASIC application specific integrated circuit
  • FPGA off-the-shelf programmable gate array
  • FPGA field programmable gate array
  • Programmable logic devices discrete gate or transistor logic devices, discrete hardware components, system on chip (system on chip, SoC), central processor unit
  • a general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like.
  • the steps of the method disclosed in connection with the embodiments of the present application may be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in a mature storage medium in the field such as random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, register.
  • the storage medium is located in the memory, and the processor reads the information in the memory, and completes the steps of the above method in combination with its hardware.
  • the memory in the embodiments of the present application may be a volatile memory or a nonvolatile memory, or may include both volatile and nonvolatile memories.
  • the non-volatile memory can be read-only memory (read-only memory, ROM), programmable read-only memory (programmable ROM, PROM), erasable programmable read-only memory (erasable PROM, EPROM), electrically programmable Erases programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • Volatile memory can be random access memory (RAM), which acts as external cache memory.
  • RAM random access memory
  • SRAM static random access memory
  • DRAM dynamic random access memory
  • DRAM synchronous dynamic random access memory
  • SDRAM double data rate synchronous dynamic random access memory
  • ESDRAM enhanced synchronous dynamic random access memory
  • SLDRAM direct memory bus random access memory
  • direct rambus RAM direct rambus RAM
  • sequence numbers of the above-mentioned processes do not mean the order of execution, and the order of execution of the processes should be determined by their functions and internal logic.
  • the various numerical numbers or serial numbers involved in the above-mentioned various processes are only for convenience of description, and shall not constitute any limitation to the implementation process of the embodiment of the present application.
  • the above is an example of the three elements of A, B and C to illustrate the optional items of the project.
  • the expression includes at least one of the following: A, B, ..., and X"
  • the applicable entries for this item can also be obtained according to the aforementioned rules.
  • the disclosed systems, devices and methods may be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit.
  • the functions described above are realized in the form of software function units and sold or used as independent products, they can be stored in a computer-readable storage medium.
  • the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage medium includes: U disk, mobile hard disk, read-only memory ROM, random access memory RAM, magnetic disk or optical disk, and other media capable of storing program codes.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • General Engineering & Computer Science (AREA)
  • Computing Systems (AREA)
  • Computer Hardware Design (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Telephonic Communication Services (AREA)
  • Signal Processing For Digital Recording And Reproducing (AREA)
  • Storage Device Security (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

一种通信方法及装置，该方法可用于间接通信场景下，包括：服务消费网元向服务通信代理发送第一服务请求消息，服务消费网元从服务通信代理接收针对第一服务请求消息的响应消息。其中，第一服务请求消息用于向服务提供网元请求第一服务，第一服务请求消息包括第一客户认证凭证，第一客户认证凭证包括第一网络功能类型和第二网络功能类型，第一网络功能类型为服务提供网元的网络功能类型，第二网络功能类型为提供第二服务的网元的网络功能类型，第二服务与第一服务关联。采用上述方法可以保证在服务消费网元通过服务通信代理向服务提供网元请求服务的情况下，避免因为CCA中仅含有服务提供网元的网络功能类型，而导致服务请求失败的问题。

Description

一种通信方法及装置
相关申请的交叉引用
本申请要求在2021年05月09日提交中国专利局、申请号为202110502638.5、申请名称为“一种通信方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请实施例涉及无线通信领域，尤其涉及一种通信方法及装置。
背景技术
如图1所示为一种增强的服务化架构。在增强的服务化架构中，网元之间除了可以使用直接方式进行通信(简称直接通信)，也可以使用间接方式进行通信(简称间接通信，又可以称为非直接通信)，在间接通信过程中，通信的两个网元之间可以通过服务通信代理(service communication proxy，SCP)进行消息的交互。其中，在直接通信和间接通信中，通信的双方分别称为服务消费者(consumer)和服务提供者(producer)。其中，消费者是指服务的请求者或服务的调用者，提供者是指服务的提供者。服务消费者又称为服务消费网元，服务提供者又称服务提供网元。
在间接通信场景下，引入了基于客户认证凭证(client credentials assertion，CCA)的认证方案。消费者在服务请求中包含CCA使得接收端点能够认证消费者。在不同的间接通信场景下，消费者需要(即被认证方)生成正确的CCA，才能使得接收端点(即认证方)准确的认证消费者，以便在认证成功的情况下，向消费者提供消费者请求的服务。然而，现有的标准并没有定义在不同的间接通信场景下，如何生成正确的CCA，从而防止服务消费网元请求服务可能失败的问题。
发明内容
本申请实施例提供一种通信方法及装置，用以改善服务消费网元请求服务失败的情况。
第一方面，本申请实施例提供一种通信方法，该方法包括：
服务消费网元向服务通信代理发送第一服务请求消息，所述第一服务请求消息用于向服务提供网元请求第一服务，所述第一服务请求消息包括第一客户认证凭证，所述第一客户认证凭证用于认证所述服务消费网元，所述第一客户认证凭证包括第一网络功能类型和第二网络功能类型，所述第一网络功能类型为所述服务提供网元的网络功能类型，所述第二网络功能类型为提供第二服务的网元的网络功能类型；其中，所述第二服务与所述第一服务关联；所述服务消费网元从所述服务通信代理接收针对所述第一服务请求消息的响应消息。
采用上述方法，在服务消费网元通过服务通信代理向服务通过网元请求第一服务的场景下，服务消费网元在向服务通信代理发送的第一服务请求消息中携带同时包含第一网络功能类型和第二网络功能类型的客户认证凭证，进而可以保证服务通信代理请求第二服务 时，提供第二服务的网元对服务消费网元认证成功，进而也为服务消费网元请求第一服务提供了保障，解决了间接通信场景下，因为客户认证凭证认证失败，导致服务消费网元请求服务失败的问题。
在一种可能的设计中，所述第二服务用于提供所述第一服务对应的访问令牌，所述第一服务对应的访问令牌用于表征所述服务消费网元具有获取所述第一服务的权限。
在一种可能的设计中，所述服务消费网元确定不存在所述第一服务对应的可用的访问令牌。
采用上述设计使得服务消费网元能够按需生成第一客户认证凭证，防止第一客户认证凭证被滥用。
此外，服务消费网元在确定不存在所述第一服务对应的可用的访问令牌之后，服务消费网元可以在第一服务请求消息中携带用于获取第一服务对应的访问令牌的参数。
在一种可能的设计中，所述服务消费网元确定不存在所述第一服务对应的可用的访问令牌可以包括以下情况：所述服务消费网元确定未存储所述第一服务对应的访问令牌；或，所述服务消费网元确定存储的所述第一服务对应的访问令牌已过期。
在一种可能的设计中，在存储的所述第一服务对应的访问令牌已过期的情况下，所述服务消费网元删除所述已过期的访问令牌。
采用上述设计可以实现及时释放存储空间，减轻系统的存储负担。
在一种可能的设计中，所述第二服务用于提供所述服务提供网元的信息。
在一种可能的设计中，所述服务消费网元确定所述第一服务请求消息会触发所述服务通信代理请求所述第二服务。
在一种可能的设计中，在所述服务消费网元确定所述第一服务请求消息会触发所述服务通信代理请求所述第二服务时，所述服务消费网元根据以下一项或多项，确定所述第一服务请求消息会触发所述服务通信代理请求所述第二服务：未存储第一终端设备的上下文，所述第一终端设备与所述第一服务关联；或者，未存储所述第一服务的上下文；或者，所述服务提供网元归属于第一切片且未存储所述第一切片对应的上下文；或者，所述服务消费网元首次与所述服务通信代理通信。
此外，服务消费网元在确定第一服务请求消息会触发服务通信代理请求第二服务之后，服务消费网元可以在第一服务请求消息中携带用于发现服务提供网元的参数。
在一种可能的设计中，所述服务消费网元确定使用模式D的间接通信模式请求所述第一服务。
示例性地，可以通过标准协议约定或者通过预配置信息配置服务消费网元使用模式D与服务通信代理进行通信时，第一服务请求消息总是携带包括第一网络功能类型和第二网络功能类型的客户认证凭证。或者在服务消费网元使用模式D与服务通信代理进行通信时，在判断第一服务请求消息会触发服务通信代理请求第二服务时，第一服务请求消息携带包括第一网络功能类型和第二网络功能类型的客户认证凭证。
在一种可能的设计中，所述服务消费网元向所述服务通信代理发送第二服务请求消息，所述第二服务请求消息用于请求所述第一服务，所述第二服务请求消息包括第二客户认证凭证，所述第二客户认证凭证包括所述第一网络功能类型，所述第二客户认证凭证用于认证所述服务消费网元；所述服务消费网元从所述服务通信代理接收针对所述第二服务请求消息的响应消息，所述针对所述第二服务请求消息的响应消息包括指示信息。在所述服务 消费网元向所述服务通信代理发送第一服务请求消息时，所述服务消费网元根据所述指示信息，向所述服务通信代理发送所述第一服务请求消息。
采用上述设计，服务消费网元可以根据指示信息向服务通信代理发送第一服务请求消息。
在一种可能的设计中，所述指示信息包括第三客户认证凭证，所述第三客户认证凭证包括所述第二网络功能类型；其中，所述第三客户认证凭证用于认证所述提供所述第二服务的网元；在所述服务消费网元根据所述指示信息，向所述服务通信代理发送所述第一服务请求消息时，在根据所述第三客户认证凭证对所述提供所述第二服务的网元认证成功的情况下，所述服务消费网元向所述服务通信代理发送所述第一服务请求消息。
采用上述设计，服务消费网元可以根据第三客户认证凭证认证提供第二服务的网元，并在认证成功时，根据第三客户认证凭证包括的第二网络功能类型发送第一服务请求消息。
在一种可能的设计中，所述提供所述第二服务的网元为网络存储功能网元。
在一种可能的设计中，所述第一客户认证凭证还包括以下一项或者多项：所述服务消费网元的标识或者有效时间信息，其中，所述有效时间信息用于表征所述第一客户认证凭证的有效时间。
第二方面，本申请提供一种通信方法，该方法包括：第一网元从服务通信代理接收第一服务请求消息，所述第一服务请求消息用于向所述第一网元请求第一服务，所述第一服务请求消息包括第一客户认证凭证，所述第一客户认证凭证用于认证服务消费网元，其中，所述第一客户认证凭证包括多个网络功能类型；所述第一网元根据所述第一客户认证凭证，认证所述服务消费网元，其中，所述第一网元根据所述第一客户认证凭证，认证所述服务消费网元，包括：所述第一网元判断自身的网络功能类型是否与所述多个网络功能类型中的一个或者多个相匹配；所述第一网元根据认证结果向所述服务通信代理发送针对所述第一服务请求消息的响应消息。
采用上述方法，在第一客户认证凭证包括多个网络功能类型时，第一网元判断自身的网络功能类型是否与多个网络功能类型中的一个或多个相匹配，获得认证结果。因此，上述方法能够实现在客户认证凭证包括多个网络功能类型时判断是否对服务消费网元认证成功，进而能够实现具有不同网络功能类型的网元可以采用同一个客户认证凭证实现对服务消费网元的认证。
在一种可能的设计中，在所述认证结果为认证成功时，所述第一网元向所述服务通信代理发送针对所述第一服务请求消息的响应消息，所述针对所述第一服务请求消息的响应消息用于提供所述第一服务；或者，在所述认证结果为认证失败时，所述第一网元向所述服务通信代理发送针对所述第一服务请求消息的响应消息，所述针对所述第一服务请求消息的响应消息指示请求所述第一服务失败。
在一种可能的设计中，所述多个网络功能类型包括第一网络功能类型和第二网络功能类型，所述第一网络功能类型为所述第一网元的网络功能类型，所述第二网络功能类型为提供第二服务的网元的网络功能类型，所述第二服务与所述第一服务关联。
采用上述设计，可以实现具有两种不同网络功能类型的网元采用同一个客户认证凭证实现对服务消费网元的认证。
在一种可能的设计中，所述第二服务用于提供所述第一服务对应的访问令牌，其中，所述第一服务对应的访问令牌用于表征所述服务消费网元具有获取所述第一服务的权限； 或者，所述第二服务用于提供所述第一网元的信息。
在一种可能的设计中，所述提供所述第二服务的网元为网络存储功能网元。
在一种可能的设计中，所述第一服务用于提供所述第二服务对应的访问令牌，其中，所述第二服务对应的访问令牌用于表征所述服务消费网元具有获取所述第二服务的权限；或者，所述第一服务用于提供所述第二服务网元的信息。
采用上述设计，可以实现具有两种不同网络功能类型的网元采用同一个客户认证凭证实现对服务消费网元的认证。
在一种可能的设计中，所述第一网元为网络存储功能网元。
在一种可能的设计中，所述第一网元接收来自于所述服务通信代理的第二服务请求消息，所述第二服务请求消息用于向所述第一网元请求所述第一服务，所述第二服务请求消息包括第二客户认证凭证，所述第二客户认证凭证包括第三网络功能类型；在所述第三网络功能类型与所述第一网元的网络功能类型不匹配的情况下，所述第一网元向所述服务通信代理发送针对所述第二服务请求消息的响应消息，所述针对所述第二服务请求消息的响应消息包括指示信息，其中，所述指示信息用于触发所述第一服务请求消息。
采用上述设计，当客户认证凭证中的网络功能类型与第一网元的网络功能类型不匹配时，第一网元可以在针对第二服务请求消息的响应消息中携带指示信息，该指示信息可以触发第一服务请求消息，进而获得包括与第一网元的网络功能类型匹配的网络功能类型的客户认证凭证，实现第一网元对服务消费网元认证成功。
在一种可能的设计中，所述指示信息包括用于认证所述第一网元的第三客户认证凭证，所述第三客户认证凭证包括所述第一网元的网络功能类型。
采用上述设计，可以通过指示信息中携带第一网元的网络功能类型进而触发第一服务请求消息中的第一客户认证凭证携带与第一网元的网络功能类型匹配的网络功能类型，以实现对服务消费网元认证成功。
在一种可能的设计中，所述第一客户认证凭证还包括所述服务消费网元的标识和所述第一客户认证凭证的有效时间信息；所述第一客户认证凭证的有效时间信息用于表征所述第一客户认证凭证的有效时间；所述第一网元根据所述第一客户认证凭证，认证所述服务消费网元，还包括以下一项或者多项：所述第一网元验证所述第一客户认证凭证的签名是否通过、根据所述第一客户认证凭证包括的有效时间信息验证所述第一客户认证凭证是否过期或者验证所述第一客户认证凭证中的所述服务消费网元的标识与用于签名所述第一客户认证凭证的证书中的网元的标识是否相同。
第三方面，本申请提供一种通信方法，该方法包括：服务消费网元向服务通信代理发送第一服务请求消息，所述第一服务请求消息用于向服务提供网元请求第一服务，所述第一服务请求消息包括第四客户认证凭证和第五客户认证凭证，所述第四客户认证凭证用于所述服务提供网元认证所述服务消费网元，所述第五客户认证凭证用于提供第二服务的网元认证所述服务消费网元，所述第四客户认证凭证包括第一网络功能类型，所述第五客户认证凭证包括第二网络功能类型，所述第一网络功能类型为所述服务提供网元的网络功能类型，所述第二网络功能类型为所述提供第二服务的网元的网络功能类型，其中，所述第二服务与所述第一服务关联；所述服务消费网元接收来自于所述服务通信代理的针对所述第一服务请求消息的响应消息。
采用上述实施例，服务消费网元向服务通信代理发送第一服务请求消息，其中，第一 服务请求消息包括第四客户认证凭证和第五客户认证凭证，第四客户认证凭证包括第一网络功能类型，第五客户认证凭证包括第二网络功能类型，能够使提供第二服务的网元对服务消费网元认证成功，进而也为服务消费网元请求第一服务提供了保障，解决了间接通信场景下，因为客户认证凭证认证失败，导致服务消费网元请求服务失败的问题。
在一种可能的设计中，所述第四客户认证凭证还包括所述服务消费网元的标识，所述第四客户认证凭证的有效时间信息，所述第四客户认证凭证的有效时间信息用于表征所述第四客户认证凭证的有效时间；所述第五客户认证凭证还包括所述服务消费网元的标识，所述第五客户认证凭证的有效时间信息，所述第五客户认证凭证的有效时间信息用于表征所述第五客户认证凭证的有效时间。
在一种可能的设计中，所述第五客户认证凭证的有效时间比所述第四客户认证凭证的有效时间短。
采用上述设计可以降低第五客户认证凭证被服务通信代理恶意使用的风险，进而保证通信过程的安全性。
在一种可能的设计中，所述第四客户认证凭证的有效时间与第一时长关联，所述第一时长是所述服务消费网元与所述服务通信代理的传输时延以及所述服务通信代理与所述提供第二服务的网元的传输时延确定的。
上述针对第四客户认证凭证的有效时间和第五客户认证凭证的有效时间的配置规则可以尽量保证第四客户认证凭证和第五客户认证凭证不被服务通信代理恶意使用，进而保证通信过程的安全性。
在一种可能的设计中，所述第二服务用于提供所述第一服务对应的访问令牌，所述第一服务对应的访问令牌用于表征所述服务消费网元具有获取所述第一服务的权限。
在一种可能的设计中，所述服务消费网元确定不存在所述第一服务对应的可用的访问令牌。
此外，服务消费网元在确定不存在所述第一服务对应的可用的访问令牌之后，服务消费网元可以在第一服务请求消息中携带用于获取第一服务对应的访问令牌的参数。
采用上述设计使得服务消费网元能够按需生成第一客户认证凭证，防止第一客户认证凭证被滥用。
在一种可能的设计中，所述服务消费网元确定不存在所述第一服务对应的可用的访问令牌可以包括以下情况：所述服务消费网元确定未存储所述第一服务对应的访问令牌；或，所述服务消费网元确定存储的所述第一服务对应的访问令牌已过期。
在一种可能的设计中，在存储的所述第一服务对应的访问令牌已过期的情况下，所述服务消费网元删除所述已过期的访问令牌。
采用上述设计可以实现及时释放存储空间，减轻系统的存储负担。
在一种可能的设计中，所述第二服务用于提供所述服务提供网元的信息。
在一种可能的设计中，所述服务消费网元确定所述第一服务请求消息会触发所述服务通信代理请求所述第二服务。
在一种可能的设计中，在所述服务消费网元确定所述第一服务请求消息会触发所述服务通信代理请求所述第二服务时，所述服务消费网元根据以下一项或多项，确定所述第一服务请求消息会触发所述服务通信代理请求所述第二服务：未存储第一终端设备的上下文，所述第一终端设备与所述第一服务关联；或者，未存储所述第一服务的上下文；或者，所 述服务提供网元归属于第一切片且未存储所述第一切片对应的上下文；或者，所述服务消费网元首次与所述服务通信代理通信。
此外，服务消费网元在确定第一服务请求消息会触发服务通信代理请求第二服务之后，服务消费网元可以在第一服务请求消息中携带用于发现服务提供网元的参数。
在一种可能的设计中，所述服务消费网元确定使用模式D的间接通信模式请求所述第一服务。
示例性地，可以通过标准协议约定或者通过预配置信息配置服务消费网元使用模式D与服务通信代理进行通信时，第一服务请求消息总是携带包括第一网络功能类型和第二网络功能类型的客户认证凭证。或者在服务消费网元使用模式D与服务通信代理进行通信时，在判断第一服务请求消息会触发服务通信代理请求第二服务时，第一服务请求消息携带包括第一网络功能类型和第二网络功能类型的客户认证凭证。
在一种可能的设计中，所述服务消费网元向所述服务通信代理发送第二服务请求消息，所述第二服务请求消息用于请求所述第一服务，所述第二服务请求消息包括第二客户认证凭证，所述第二客户认证凭证包括所述第一网络功能类型，所述第二客户认证凭证用于认证所述服务消费网元；所述服务消费网元从所述服务通信代理接收针对所述第二服务请求消息的响应消息，所述针对所述第二服务请求消息的响应消息包括指示信息。在所述服务消费网元向所述服务通信代理发送第一服务请求消息时，所述服务消费网元根据所述指示信息，向所述服务通信代理发送所述第一服务请求消息。
采用上述设计，服务消费网元可以根据指示信息向服务通信代理发送第一服务请求消息。
在一种可能的设计中，所述指示信息包括第三客户认证凭证，所述第三客户认证凭证包括所述第二网络功能类型；其中，所述第三客户认证凭证用于认证所述提供所述第二服务的网元；在所述服务消费网元根据所述指示信息，向所述服务通信代理发送所述第一服务请求消息时，在根据所述第三客户认证凭证对所述提供所述第二服务的网元认证成功的情况下，所述服务消费网元向所述服务通信代理发送所述第一服务请求消息。
采用上述设计，服务消费网元可以根据第三客户认证凭证认证提供第二服务的网元，并在认证成功时，根据第三客户认证凭证包括的第二网络功能类型发送第一服务请求消息。
在一种可能的设计中，所述提供所述第二服务的网元为网络存储功能网元。
第四方面，本申请提供一种通信方法，该方法包括：服务通信代理接收来自于服务消费网元的第一服务请求消息，所述第一服务请求消息用于向服务提供网元请求第一服务，所述第一服务请求消息包括第四客户认证凭证和第五客户认证凭证，所述第四客户认证凭证用于所述服务提供网元认证所述服务消费网元，所述第五客户认证凭证用于第一网元认证所述服务消费网元，其中，所述第四客户认证凭证包括第一网络功能类型，所述第五客户认证凭证包括第二网络功能类型，所述第一网络功能类型为所述服务提供网元的网络功能类型，所述第二网络功能类型为所述第一网元的网络功能类型；响应于所述第一服务请求消息，所述服务通信代理向所述第一网元发送第二服务请求消息，所述第二服务请求消息用于请求第二服务，所述第二服务请求消息包括所述第五客户认证凭证；所述服务通信代理接收来自于所述第一网元的针对所述第二服务请求消息的响应消息；所述服务通信代理根据针对所述第二服务请求消息的响应消息，向所述服务提供网元发送第三服务请求消息，所述第三服务请求消息用于向所述服务提供网元请求所述第一服务，所述第三服务 请求消息包括所述第四客户认证凭证。
采用上述实施例，服务消费网元向服务通信代理发送第一服务请求消息，其中，第一服务请求消息包括第四客户认证凭证和第五客户认证凭证，第四客户认证凭证包括第一网络功能类型，第五客户认证凭证包括第二网络功能类型，服务通信代理请求第二服务携带第五客户认证凭证，能够使提供第二服务的网元对服务消费网元认证成功，服务通信代理请求第一服务携带第四客户认证凭证，能够使服务提供网元对服务消费网元认证成功，进而为服务消费网元请求第一服务提供了保障，解决了间接通信场景下，因为客户认证凭证认证失败，导致服务消费网元请求服务失败的问题。
在一种可能的设计中，所述服务通信代理根据所述第一服务请求消息，确定需要向所述第一网元请求所述第二服务；所述服务通信代理根据所述第一网元的网络功能类型，确定在所述第二服务请求消息中携带所述第五客户认证凭证。
采用上述设计，服务通信代理可以解析第一服务请求消息，并根据第一网元的网络功能类型从第四客户认证凭证和第五客户认证凭证中选择第五客户认证凭证加入第二服务请求消息。
在一种可能的设计中，所述服务通信代理根据所述服务提供网元的网络功能类型，确定在所述第三服务请求消息中携带所述第四客户认证凭证。
采用上述设计，服务通信代理可以解析第一服务请求消息，并根据服务提供网元的网络功能类型从第四客户认证凭证和第五客户认证凭证中选择第四客户认证凭证加入第二服务请求消息。
在一种可能的设计中，在服务通信代理接收来自于所述服务消费网元的第一服务请求消息之前，所述服务通信代理接收来自于所述服务消费网元的第四服务请求消息，所述第四服务请求消息用于请求所述第一服务，所述第三服务请求消息包括第六客户认证凭证，所述第六客户认证凭证包括第三网络功能类型；所述服务通信代理向所述第一网元发送第五服务请求消息，所述第五服务请求消息用于请求所述第二服务，所述第五服务请求消息包括所述第六客户认证凭证；所述服务通信代理接收来自于所述第一网元的针对所述第五服务请求消息的响应消息，针对所述第五服务请求消息的响应消息包括指示信息；所述服务通信代理根据所述指示信息向所述服务消费网元发送针对所述第四服务请求消息的响应消息。
采用上述设计，服务通信代理可以根据指示信息向服务消费网元发送针对第四服务请求消息的响应消息，以获得包括与第一网络的网络功能类型相匹配的客户认证凭证，使第一网元对服务消费网元认证成功。
在一种可能的设计中，所述指示信息包括第七客户认证凭证，所述第七客户认证凭证包括所述第一网元的网络功能类型；针对所述第四服务请求消息的响应消息还包括所述第七客户认证凭证。
采用上述设计，指示信息可以触发服务消费网元发送第一服务请求消息，并在第一服务请求消息中包括与第一网络的网络功能类型相匹配的客户认证凭证。
在一种可能的设计中，所述第二服务用于提供所述第一服务对应的访问令牌，所述第一服务对应的访问令牌用于表征所述服务消费网元具有获取所述第一服务的权限。
在一种可能的设计中，所述服务通信代理确定未存储所述第一服务对应的可用的访问令牌且所述第一服务请求消息不包括所述第一服务对应的访问令牌。
在一种可能的设计中，所述第二服务用于提供所述服务提供网元的信息。
在一种可能的设计中，所述服务通信代理确定未存储所述服务提供网元的信息且所述第一服务请求消息不包括所述服务提供网元的信息。
在一种可能的设计中，所述第四客户认证凭证还包括所述服务消费网元的标识，所述第四客户认证凭证的有效时间信息，所述第四客户认证凭证的有效时间信息用于表征所述第四客户认证凭证的有效时间；所述第五客户认证凭证还包括所述服务消费网元的标识，所述第五客户认证凭证的有效时间信息，所述第五客户认证凭证的有效时间信息用于表征所述第五客户认证凭证的有效时间。
在一种可能的设计中，所述第五客户认证凭证的有效时间比所述第四客户认证凭证的有效时间短。
采用上述设计可以降低第五客户认证凭证被服务通信代理恶意使用的风险，进而保证通信过程的安全性。
在一种可能的设计中，所述第四客户认证凭证的有效时间与第一时长关联，所述第一时长是所述服务消费网元与所述服务通信代理的传输时延以及所述服务通信代理与所述提供第二服务的网元的传输时延确定的。
上述针对第四客户认证凭证的有效时间和第五客户认证凭证的有效时间的配置规则可以尽量保证第四客户认证凭证和第五客户认证凭证不被服务通信代理恶意使用，进而保证通信过程的安全性。
在一种可能的设计中，所述提供所述第二服务的网元为网络存储功能网元。
第五方面，本申请提供一种通信方法，该方法包括：第一网元接收来自于服务通信代理的第一服务请求消息，所述第一服务请求消息用于向所述第一网元请求第一服务，所述第一服务请求消息包括多个客户认证凭证；每个客户认证凭证包括一个网络功能类型；所述第一网元根据所述多个客户认证凭证认证所述服务消费网元；其中，在所述第一网元根据所述多个客户认证凭证认证所述服务消费网元时，所述第一网元判断所述多个客户认证凭证认证中是否存在一个或者多个客户认证凭证对服务消费网元认证成功；所述第一网元根据认证结果向所述服务通信代理发送针对所述第一服务请求消息的响应消息。
采用上述方法，在第一服务请求消息包括多个客户认证凭证时，第一网元判断存在一个或者多个客户认证凭证对服务消费网元认证成功，获得认证结果。因此，上述方法能够实现在存在多个客户认证凭证时判断是否对服务消费网元认证成功。
在一种可能的设计中，在所述认证结果指示存在一个或者多个客户认证凭证对服务消费网元认证成功时，所述第一网元向所述服务通信代理发送针对所述第一服务请求消息的响应消息，所述针对所述第一服务请求消息的响应消息用于提供所述第一服务；或者，在所述认证结果指示所述多个客户认证凭证中任意一个客户认证凭证对服务消费网元认证失败时，所述第一网元向所述服务通信代理发送针对所述第一服务请求消息的响应消息，所述针对所述第一服务请求消息的响应消息指示请求所述第一服务失败。
采用上述设计，当存在一个或者多个客户认证凭证对服务消费网元认证成功则确定对服务消费网元认证成功，当多个客户认证凭证中任意一个客户认证凭证对服务消费网元认证失败，即全部客户认证凭证均对服务消费网元认证失败，则确定对服务消费网元认证失败。
在一种可能的设计中，所述多个客户认证凭证包括第四客户认证凭证和第五客户认证 凭证，所述第四客户认证凭证包括第一网络功能类型，所述第五客户认证凭证包括第二网络功能类型，所述第一网络功能类型为所述第一网元的网络功能类型，所述第二网络功能类型为提供第二服务的网元的网络功能类型，所述第二服务与所述第一服务关联。
在一种可能的设计中，所述第二服务用于提供所述第一服务对应的访问令牌，其中，所述第一服务对应的访问令牌用于表征所述服务消费网元具有获取所述第一服务的权限；或者，所述第二服务用于提供所述第一网元的信息。
在一种可能的设计中，所述提供所述第二服务的网元为网络存储功能网元。
在一种可能的设计中，所述第一服务用于提供所述第二服务对应的访问令牌，其中，所述第二服务对应的访问令牌用于表征所述服务消费网元具有获取所述第二服务的权限；或者，所述第一服务用于提供所述第二服务网元的信息。
在一种可能的设计中，所述第一网元为网络存储功能网元。
在一种可能的设计中，所述第一网元接收来自于所述服务通信代理的第二服务请求消息，所述第二服务请求消息用于向所述第一网元请求所述第一服务，所述第二服务请求消息包括第六客户认证凭证，所述第六客户认证凭证包括第三网络功能类型；在所述第三网络功能类型与所述第一网元的网络功能类型不匹配的情况下，所述第一网元向所述服务通信代理发送针对所述第三服务请求消息的响应消息，所述针对所述第三服务请求消息的响应消息包括指示信息，其中，所述指示信息用于触发所述第一服务请求消息。
采用上述设计，当客户认证凭证中的网络功能类型与第一网元的网络功能类型不匹配时，第一网元可以在针对第三服务请求消息的响应消息中携带指示信息，该指示信息可以触发第一服务请求消息，进而获得包括与第一网元的网络功能类型匹配的网络功能类型的客户认证凭证，实现第一网元对服务消费网元认证成功。
在一种可能的设计中，所述指示信息包括用于认证所述第一网元的第七客户认证凭证，所述第七客户认证凭证包括所述第一网元的网络功能类型。
采用上述设计，可以通过指示信息中携带第一网元的网络功能类型进而触发第一服务请求消息中的第一客户认证凭证携带与第一网元的网络功能类型匹配的网络功能类型的客户认证凭证，以实现对服务消费网元认证成功。
第六方面，本申请提供一种通信方法，所述方法应用于服务消费网元通过服务通信代理向服务提供网元请求第一服务的场景，该方法包括：所述服务通信代理向所述服务消费网元发送客户认证凭证请求消息；所述客户认证凭证请求消息用于请求第一客户认证凭证，所述第一客户认证凭证用于提供第二服务网元认证所述服务消费网元，所述第二服务与所述第一服务关联；所述服务通信代理接收来自于所述服务消费网元的针对所述客户认证凭证请求消息的响应消息，针对所述客户认证凭证请求消息的响应消息包括所述第一客户认证凭证，所述第一客户认证凭证包括第一网络功能类型和第二网络功能类型，或者所述第一客户认证凭证包括第二网络功能类型，所述第一网络功能类型为所述服务提供网元的网络功能类型，所述第二网络功能类型为所述提供所述第二服务的网元的网络功能类型。
采用上述设计，服务通信代理可以请求客户认证凭证，进而保障服务通信代理请求第二服务，以及服务消费网元请求第一服务。
在一种可能的设计中，在所述服务通信代理向所述服务消费网元发送客户认证凭证请求消息之前，所述服务通信代理接收来自于所述服务消费网元的第一服务请求消息，所述第一服务请求消息用于请求所述第一服务，所述第一服务请求消息包括第二客户认证凭证， 所述第二客户认证凭证包括所述第一网络功能类型；所述服务通信代理向第一网元发送第二服务请求消息，所述第二服务请求消息用于请求所述第二服务，所述第二服务请求消息包括所述第二客户认证凭证；所述服务通信代理接收来自于所述第一网元的针对所述第二服务请求消息的响应消息，针对所述第二服务请求消息的响应消息包括指示信息；在所述服务通信代理向所述服务消费网元发送客户认证凭证请求消息时，所述服务通信代理根据所述指示信息向所述服务消费网元发送所述客户认证凭证请求消息。
采用上述设计，当客户认证凭证中的网络功能类型与第一网元的网络功能类型不匹配时，第一网元可以在针对第二服务请求消息的响应消息中携带指示信息，该指示信息可以触发客户认证凭证请求消息，进而获得包括与第一网元的网络功能类型匹配的网络功能类型的客户认证凭证，实现第一网元对服务消费网元认证成功。
在一种可能的设计中，所述指示信息包括第三客户认证凭证，所述第三客户认证凭证包括所述第一网元的网络功能类型；所述客户认证凭证请求消息包括所述第三客户认证凭证。
采用上述设计，可以通过指示信息中携带第一网元的网络功能类型进而触发第一服务请求消息中的第一客户认证凭证携带与第一网元的网络功能类型匹配的网络功能类型的客户认证凭证，以实现对服务消费网元认证成功。
在一种可能的设计中，所述第一客户认证凭证包括所述第二网络功能类型；所述服务通信代理向所述第一网元发送第三服务请求消息，所述第三服务请求消息用于请求所述第二服务，所述第三服务请求消息包括所述第一客户认证凭证；所述服务通信代理接收来自于所述第一网元的针对第三服务请求消息的响应消息；所述服务通信代理根据针对第三服务请求消息的响应消息向服务提供网元发送第四服务请求消息，所述第四服务请求消息用于请求所述第一服务，所述第四服务请求消息包括所述第二客户认证凭证。
采用上述设计，服务通信代理解析针对客户认证凭证的响应消息，根据第一网元的网络功能类型在第三服务请求消息中携带第一客户认证凭证，根据服务提供网元的网络功能类型在第四服务请求消息中携带第二客户认证凭证。
在一种可能的设计中，所述第一客户认证凭证包括所述第一网络功能类型和所述第二网络功能类型；所述服务通信代理向所述第一网元发送第三服务请求消息，所述第三服务请求消息用于请求所述第二服务，所述第三服务请求消息包括所述第一客户认证凭证；所述服务通信代理接收来自于所述第一网元的针对第三服务请求消息的响应消息；所述服务通信代理根据针对第三服务请求消息的响应消息向服务提供网元发送第四服务请求消息，所述第四服务请求消息用于请求所述第一服务，所述第四服务请求消息包括所述第一客户认证凭证，或者，所述第四服务请求消息包括所述第二客户认证凭证。
采用上述设计，服务通信代理解析针对客户认证凭证的响应消息，根据第一网元的网络功能类型在第三服务请求消息中携带第一客户认证凭证，根据服务提供网元的网络功能类型在第四服务请求消息中携带第一客户认证凭证或第二客户认证凭证。
在一种可能的设计中，所述第二服务用于提供所述第一服务对应的访问令牌，所述第一服务对应的访问令牌用于表征所述服务消费网元具有获取所述第一服务的权限。
在一种可能的设计中，所述服务通信代理确定未存储所述第一访问令牌且所述第一服务请求消息不包括所述第一访问令牌。
在一种可能的设计中，所述第二服务用于提供所述服务提供网元的信息。
在一种可能的设计中，所述服务通信代理确定未存储所述服务提供网元的信息且所述第一服务请求消息不包括所述服务提供网元的信息。
在一种可能的设计中，所述提供所述第二服务的网元为网络存储功能网元。
第七方面，本申请提供一种通信装置，该装置包括收发单元和处理单元，所述处理单元调用所述收发单元执行：向服务通信代理发送第一服务请求消息，所述第一服务请求消息用于向服务提供网元请求第一服务，所述第一服务请求消息包括第一客户认证凭证，所述第一客户认证凭证用于认证所述装置，所述第一客户认证凭证包括第一网络功能类型和第二网络功能类型，所述第一网络功能类型为所述服务提供网元的网络功能类型，所述第二网络功能类型为提供第二服务的网元的网络功能类型；其中，所述第二服务与所述第一服务关联；从所述服务通信代理接收针对所述第一服务请求消息的响应消息。
在一种可能的设计中，所述第二服务用于提供所述第一服务对应的访问令牌，所述第一服务对应的访问令牌用于表征所述装置具有获取所述第一服务的权限。
在一种可能的设计中，所述处理单元，用于确定不存在所述第一服务对应的可用的访问令牌。
在一种可能的设计中，所述处理单元，用于在确定不存在所述第一服务对应的可用的访问令牌时，未存储所述第一服务对应的访问令牌；或，确定存储的所述第一服务对应的访问令牌已过期。
在一种可能的设计中，在存储的所述第一服务对应的访问令牌已过期的情况下，所述处理单元，用于删除所述已过期的访问令牌。
在一种可能的设计中，所述第二服务用于提供所述服务提供网元的信息。
在一种可能的设计中，所述处理单元，用于确定所述第一服务请求消息会触发所述服务通信代理请求所述第二服务。
在一种可能的设计中，在确定所述第一服务请求消息会触发所述服务通信代理请求所述第二服务时，所述处理单元，用于根据以下一项或多项，确定所述第一服务请求消息会触发所述服务通信代理请求所述第二服务：未存储第一终端设备的上下文，所述第一终端设备与所述第一服务关联；或者，未存储所述第一服务的上下文；或者，所述服务提供网元归属于第一切片且未存储所述第一切片对应的上下文；或者，所述装置首次与所述服务通信代理通信。
在一种可能的设计中，所述处理单元，用于确定使用模式D的间接通信模式请求所述第一服务。
在一种可能的设计中，所述收发单元用于：向所述服务通信代理发送第二服务请求消息，所述第二服务请求消息用于请求所述第一服务，所述第二服务请求消息包括第二客户认证凭证，所述第二客户认证凭证包括所述第一网络功能类型，所述第二客户认证凭证用于认证所述装置；从所述服务通信代理接收针对所述第二服务请求消息的响应消息，所述针对所述第二服务请求消息的响应消息包括指示信息。在向所述服务通信代理发送第一服务请求消息时，所述处理单元，用于根据所述指示信息，向所述服务通信代理发送所述第一服务请求消息。
在一种可能的设计中，所述指示信息包括第三客户认证凭证，所述第三客户认证凭证包括所述第二网络功能类型；其中，所述第三客户认证凭证用于认证所述提供所述第二服务的网元；所述收发单元用于：在根据所述指示信息，向所述服务通信代理发送所述第一 服务请求消息时，在根据所述第三客户认证凭证对所述提供所述第二服务的网元认证成功的情况下，向所述服务通信代理发送所述第一服务请求消息。
在一种可能的设计中，所述提供所述第二服务的网元为网络存储功能网元。
在一种可能的设计中，所述第一客户认证凭证还包括以下一项或者多项：所述装置的标识或者有效时间信息，其中，所述有效时间信息用于表征所述第一客户认证凭证的有效时间。
第八方面，本申请提供一种通信装置，该装置包括收发单元和处理单元，所述收发单元，用于从服务通信代理接收第一服务请求消息，所述第一服务请求消息用于向所述装置请求第一服务，所述第一服务请求消息包括第一客户认证凭证，所述第一客户认证凭证用于认证服务消费网元，其中，所述第一客户认证凭证包括多个网络功能类型；所述处理单元，用于根据所述第一客户认证凭证，认证所述服务消费网元，其中，在根据所述第一客户认证凭证，认证所述服务消费网元时，所述处理单元判断自身的网络功能类型是否与所述多个网络功能类型中的一个或者多个相匹配；所述处理单元调用所述收发单元根据认证结果向所述服务通信代理发送针对所述第一服务请求消息的响应消息。
在一种可能的设计中，在所述认证结果为认证成功时，所述收发单元，用于向所述服务通信代理发送针对所述第一服务请求消息的响应消息，所述针对所述第一服务请求消息的响应消息用于提供所述第一服务；或者，在所述认证结果为认证失败时，所述收发单元，用于向所述服务通信代理发送针对所述第一服务请求消息的响应消息，所述针对所述第一服务请求消息的响应消息指示请求所述第一服务失败。
在一种可能的设计中，所述多个网络功能类型包括第一网络功能类型和第二网络功能类型，所述第一网络功能类型为所述装置的网络功能类型，所述第二网络功能类型为提供第二服务的网元的网络功能类型，所述第二服务与所述第一服务关联。
在一种可能的设计中，所述第二服务用于提供所述第一服务对应的访问令牌，其中，所述第一服务对应的访问令牌用于表征所述服务消费网元具有获取所述第一服务的权限；或者，所述第二服务用于提供所述装置的信息。
在一种可能的设计中，所述提供所述第二服务的网元为网络存储功能网元。
在一种可能的设计中，所述第一服务用于提供所述第二服务对应的访问令牌，其中，所述第二服务对应的访问令牌用于表征所述服务消费网元具有获取所述第二服务的权限；或者，所述第一服务用于提供所述第二服务网元的信息。
在一种可能的设计中，所述装置为网络存储功能网元。
在一种可能的设计中，所述收发单元，用于接收来自于所述服务通信代理的第二服务请求消息，所述第二服务请求消息用于向所述装置请求所述第一服务，所述第二服务请求消息包括第二客户认证凭证，所述第二客户认证凭证包括第三网络功能类型；
在所述第三网络功能类型与所述装置的网络功能类型不匹配的情况下，所述收发单元，用于向所述服务通信代理发送针对所述第二服务请求消息的响应消息，所述针对所述第二服务请求消息的响应消息包括指示信息，其中，所述指示信息用于触发所述第一服务请求消息。
在一种可能的设计中，所述指示信息包括用于认证所述装置的第三客户认证凭证，所述第三客户认证凭证包括所述装置的网络功能类型。
在一种可能的设计中，所述第一客户认证凭证还包括所述服务消费网元的标识和所述 第一客户认证凭证的有效时间信息；所述第一客户认证凭证的有效时间信息用于表征所述第一客户认证凭证的有效时间；所述处理单元，用于根据所述第一客户认证凭证，认证所述服务消费网元，还包括以下一项或者多项：验证所述第一客户认证凭证的签名是否通过、根据所述第一客户认证凭证包括的有效时间信息验证所述第一客户认证凭证是否过期或者验证所述第一客户认证凭证中的所述服务消费网元的标识与用于签名所述第一客户认证凭证的证书中的网元的标识是否相同。
第九方面，本申请提供一种通信装置，该装置包括收发单元和处理单元：所述处理单元调用所述收发单元执行：向服务通信代理发送第一服务请求消息，所述第一服务请求消息用于向服务提供网元请求第一服务，所述第一服务请求消息包括第四客户认证凭证和第五客户认证凭证，所述第四客户认证凭证用于所述服务提供网元认证所述服务消费网元，所述第五客户认证凭证用于提供第二服务的网元认证所述服务消费网元，所述第四客户认证凭证包括第一网络功能类型，所述第五客户认证凭证包括第二网络功能类型，所述第一网络功能类型为所述服务提供网元的网络功能类型，所述第二网络功能类型为所述提供第二服务的网元的网络功能类型，其中，所述第二服务与所述第一服务关联；接收来自于所述服务通信代理的针对所述第一服务请求消息的响应消息。
在一种可能的设计中，所述第四客户认证凭证还包括所述服务消费网元的标识，所述第四客户认证凭证的有效时间信息，所述第四客户认证凭证的有效时间信息用于表征所述第四客户认证凭证的有效时间；所述第五客户认证凭证还包括所述服务消费网元的标识，所述第五客户认证凭证的有效时间信息，所述第五客户认证凭证的有效时间信息用于表征所述第五客户认证凭证的有效时间。
在一种可能的设计中，所述第五客户认证凭证的有效时间比所述第四客户认证凭证的有效时间短。
在一种可能的设计中，所述第四客户认证凭证的有效时间与第一时长关联，所述第一时长是所述服务消费网元与所述服务通信代理的传输时延以及所述服务通信代理与所述提供第二服务的网元的传输时延确定的。
在一种可能的设计中，所述第二服务用于提供所述第一服务对应的访问令牌，所述第一服务对应的访问令牌用于表征所述装置具有获取所述第一服务的权限。
在一种可能的设计中，所述处理单元，用于确定不存在所述第一服务对应的可用的访问令牌。
在一种可能的设计中，所述处理单元，用于在确定不存在所述第一服务对应的可用的访问令牌时，未存储所述第一服务对应的访问令牌；或，确定存储的所述第一服务对应的访问令牌已过期。
在一种可能的设计中，在存储的所述第一服务对应的访问令牌已过期的情况下，所述处理单元，用于删除所述已过期的访问令牌。
在一种可能的设计中，所述第二服务用于提供所述服务提供网元的信息。
在一种可能的设计中，所述处理单元，用于确定所述第一服务请求消息会触发所述服务通信代理请求所述第二服务。
在一种可能的设计中，在确定所述第一服务请求消息会触发所述服务通信代理请求所述第二服务时，所述处理单元，用于根据以下一项或多项，确定所述第一服务请求消息会触发所述服务通信代理请求所述第二服务：未存储第一终端设备的上下文，所述第一终端 设备与所述第一服务关联；或者，未存储所述第一服务的上下文；或者，所述服务提供网元归属于第一切片且未存储所述第一切片对应的上下文；或者，所述装置首次与所述服务通信代理通信。
在一种可能的设计中，所述处理单元，用于确定使用模式D的间接通信模式请求所述第一服务。
在一种可能的设计中，所述收发单元用于：向所述服务通信代理发送第二服务请求消息，所述第二服务请求消息用于请求所述第一服务，所述第二服务请求消息包括第二客户认证凭证，所述第二客户认证凭证包括所述第一网络功能类型，所述第二客户认证凭证用于认证所述装置；从所述服务通信代理接收针对所述第二服务请求消息的响应消息，所述针对所述第二服务请求消息的响应消息包括指示信息。在向所述服务通信代理发送第一服务请求消息时，所述处理单元，用于根据所述指示信息，向所述服务通信代理发送所述第一服务请求消息。
在一种可能的设计中，所述指示信息包括第三客户认证凭证，所述第三客户认证凭证包括所述第二网络功能类型；其中，所述第三客户认证凭证用于认证所述提供所述第二服务的网元；所述收发单元用于：在根据所述指示信息，向所述服务通信代理发送所述第一服务请求消息时，在根据所述第三客户认证凭证对所述提供所述第二服务的网元认证成功的情况下，向所述服务通信代理发送所述第一服务请求消息。
在一种可能的设计中，所述提供所述第二服务的网元为网络存储功能网元。
在一种可能的设计中，所述第一客户认证凭证还包括以下一项或者多项：所述装置的标识或者有效时间信息，其中，所述有效时间信息用于表征所述第一客户认证凭证的有效时间。
第十方面，本申请提供一种通信装置，所述装置包括收发单元和处理单元，所述处理单元调用所述收发单元执行：接收来自于服务消费网元的第一服务请求消息，所述第一服务请求消息用于向服务提供网元请求第一服务，所述第一服务请求消息包括第四客户认证凭证和第五客户认证凭证，所述第四客户认证凭证用于所述服务提供网元认证所述服务消费网元，所述第五客户认证凭证用于第一网元认证所述服务消费网元，其中，所述第四客户认证凭证包括第一网络功能类型，所述第五客户认证凭证包括第二网络功能类型，所述第一网络功能类型为所述服务提供网元的网络功能类型，所述第二网络功能类型为所述第一网元的网络功能类型；响应于所述第一服务请求消息，向所述第一网元发送第二服务请求消息，所述第二服务请求消息用于请求第二服务，所述第二服务请求消息包括所述第五客户认证凭证；接收来自于所述第一网元的针对所述第二服务请求消息的响应消息；根据针对所述第二服务请求消息的响应消息，向所述服务提供网元发送第三服务请求消息，所述第三服务请求消息用于向所述服务提供网元请求所述第一服务，所述第三服务请求消息包括所述第四客户认证凭证。
在一种可能的设计中，所述处理单元，用于根据所述第一服务请求消息，确定需要向所述第一网元请求所述第二服务；根据所述第一网元的网络功能类型，确定在所述第二服务请求消息中携带所述第五客户认证凭证。
在一种可能的设计中，所述处理单元，用于根据所述服务提供网元的网络功能类型，确定在所述第三服务请求消息中携带所述第四客户认证凭证。
在一种可能的设计中，在接收来自于所述服务消费网元的第一服务请求消息之前，所 述收发单元，用于接收来自于所述服务消费网元的第四服务请求消息，所述第四服务请求消息用于请求所述第一服务，所述第三服务请求消息包括第六客户认证凭证，所述第六客户认证凭证包括第三网络功能类型；向所述第一网元发送第五服务请求消息，所述第五服务请求消息用于请求所述第二服务，所述第五服务请求消息包括所述第六客户认证凭证；接收来自于所述第一网元的针对所述第五服务请求消息的响应消息，针对所述第五服务请求消息的响应消息包括指示信息；根据所述指示信息向所述服务消费网元发送针对所述第四服务请求消息的响应消息。
在一种可能的设计中，所述指示信息包括第七客户认证凭证，所述第七客户认证凭证包括所述第一网元的网络功能类型；针对所述第四服务请求消息的响应消息还包括所述第七客户认证凭证。
在一种可能的设计中，所述第二服务用于提供所述第一服务对应的访问令牌，所述第一服务对应的访问令牌用于表征所述服务消费网元具有获取所述第一服务的权限。
在一种可能的设计中，所述处理单元，用于确定未存储所述第一服务对应的可用的访问令牌且所述第一服务请求消息不包括所述第一服务对应的访问令牌。
在一种可能的设计中，所述第二服务用于提供所述服务提供网元的信息。
在一种可能的设计中，所述处理单元，用于确定未存储所述服务提供网元的信息且所述第一服务请求消息不包括所述服务提供网元的信息。
在一种可能的设计中，所述第四客户认证凭证还包括所述服务消费网元的标识，所述第四客户认证凭证的有效时间信息，所述第四客户认证凭证的有效时间信息用于表征所述第四客户认证凭证的有效时间；所述第五客户认证凭证还包括所述服务消费网元的标识，所述第五客户认证凭证的有效时间信息，所述第五客户认证凭证的有效时间信息用于表征所述第五客户认证凭证的有效时间。
在一种可能的设计中，所述第五客户认证凭证的有效时间比所述第四客户认证凭证的有效时间短。
在一种可能的设计中，所述第四客户认证凭证的有效时间与第一时长关联，所述第一时长是所述服务消费网元与所述服务通信代理的传输时延以及所述服务通信代理与所述提供第二服务的网元的传输时延确定的。
在一种可能的设计中，所述提供所述第二服务的网元为网络存储功能网元。
第十一方面，本申请提供一种通信装置，所述装置包括收发单元和处理单元，所述处理单元调用所述收发单元执行：接收来自于服务通信代理的第一服务请求消息，所述第一服务请求消息用于向所述第一网元请求第一服务，所述第一服务请求消息包括多个客户认证凭证；每个客户认证凭证包括一个网络功能类型；所述第一网元根据所述多个客户认证凭证认证所述服务消费网元；其中，所述第一网元根据所述多个客户认证凭证认证所述服务消费网元，包括：所述第一网元判断所述多个客户认证凭证认证中是否存在一个或者多个客户认证凭证对服务消费网元认证成功；所述第一网元根据认证结果向所述服务通信代理发送针对所述第一服务请求消息的响应消息。
在一种可能的设计中，在所述认证结果指示存在一个或者多个客户认证凭证对服务消费网元认证成功时，所述第一网元向所述服务通信代理发送针对所述第一服务请求消息的响应消息，所述针对所述第一服务请求消息的响应消息用于提供所述第一服务；或者，在所述认证结果指示所述多个客户认证凭证中任意一个客户认证凭证对服务消费网元认证 失败时，所述第一网元向所述服务通信代理发送针对所述第一服务请求消息的响应消息，所述针对所述第一服务请求消息的响应消息指示请求所述第一服务失败。
在一种可能的设计中，所述多个客户认证凭证包括第四客户认证凭证和第五客户认证凭证，所述第四客户认证凭证包括第一网络功能类型，所述第五客户认证凭证包括第二网络功能类型，所述第一网络功能类型为所述第一网元的网络功能类型，所述第二网络功能类型为提供第二服务的网元的网络功能类型，所述第二服务与所述第一服务关联。
在一种可能的设计中，所述第二服务用于提供所述第一服务对应的访问令牌，其中，所述第一服务对应的访问令牌用于表征所述服务消费网元具有获取所述第一服务的权限；或者，所述第二服务用于提供所述第一网元的信息。
在一种可能的设计中，所述提供所述第二服务的网元为网络存储功能网元。
在一种可能的设计中，所述第一服务用于提供所述第二服务对应的访问令牌，其中，所述第二服务对应的访问令牌用于表征所述服务消费网元具有获取所述第二服务的权限；或者，所述第一服务用于提供所述第二服务网元的信息。
在一种可能的设计中，所述第一网元为网络存储功能网元。
在一种可能的设计中，所述收发单元用于接收来自于所述服务通信代理的第二服务请求消息，所述第二服务请求消息用于向所述第一网元请求所述第一服务，所述第二服务请求消息包括第六客户认证凭证，所述第六客户认证凭证包括第三网络功能类型；
在所述第三网络功能类型与所述第一网元的网络功能类型不匹配的情况下，所述收发单元用于向所述服务通信代理发送针对所述第二服务请求消息的响应消息，所述针对所述第二服务请求消息的响应消息包括指示信息，其中，所述指示信息用于触发所述第一服务请求消息。
在一种可能的设计中，所述指示信息包括用于认证所述第一网元的第七客户认证凭证，所述第七客户认证凭证包括所述第一网元的网络功能类型。
第十二方面，本申请提供一种通信装置，该装置包括收发单元和处理单元，服务消费网元通过所述装置向服务提供网元请求第一服务，所述处理单元调用所述收发单元执行：向所述服务消费网元发送客户认证凭证请求消息；所述客户认证凭证请求消息用于请求第一客户认证凭证，所述第一客户认证凭证用于提供第二服务网元认证所述服务消费网元，所述第二服务与所述第一服务关联；接收来自于所述服务消费网元的针对所述客户认证凭证请求消息的响应消息，针对所述客户认证凭证请求消息的响应消息包括所述第一客户认证凭证，所述第一客户认证凭证包括第一网络功能类型和第二网络功能类型，或者所述第一客户认证凭证包括第二网络功能类型，所述第一网络功能类型为所述服务提供网元的网络功能类型，所述第二网络功能类型为所述提供所述第二服务的网元的网络功能类型。
在一种可能的设计中，在向所述服务消费网元发送客户认证凭证请求消息之前，所述收发单元，用于接收来自于所述服务消费网元的第一服务请求消息，所述第一服务请求消息用于请求所述第一服务，所述第一服务请求消息包括第二客户认证凭证，所述第二客户认证凭证包括所述第一网络功能类型；向所述提供所述第二服务的网元发送第二服务请求消息，所述第二服务请求消息用于请求所述第二服务，所述第二服务请求消息包括所述第二客户认证凭证；接收来自于所述提供所述第二服务的网元的针对所述第二服务请求消息的响应消息，针对所述第二服务请求消息的响应消息包括指示信息；在向所述服务消费网元发送客户认证凭证请求消息时，根据所述指示信息向所述服务消费网元发送所述客户认 证凭证请求消息。
在一种可能的设计中，所述指示信息包括第三客户认证凭证，所述第三客户认证凭证包括所述第一网元的网络功能类型；所述客户认证凭证请求消息包括所述第三客户认证凭证。
在一种可能的设计中，所述第一客户认证凭证包括所述第二网络功能类型；所述服务通信代理向所述第一网元发送第三服务请求消息，所述第三服务请求消息用于请求所述第二服务，所述第三服务请求消息包括所述第一客户认证凭证；所述服务通信代理接收来自于所述第一网元的针对第三服务请求消息的响应消息；所述服务通信代理根据针对第三服务请求消息的响应消息向服务提供网元发送第四服务请求消息，所述第四服务请求消息用于请求所述第一服务，所述第四服务请求消息包括所述第二客户认证凭证。
在一种可能的设计中，所述第一客户认证凭证包括所述第一网络功能类型和所述第二网络功能类型；所述收发单元用于向所述第一网元发送第三服务请求消息，所述第三服务请求消息用于请求所述第二服务，所述第三服务请求消息包括所述第一客户认证凭证；接收来自于所述第一网元的针对第三服务请求消息的响应消息；根据针对第三服务请求消息的响应消息向服务提供网元发送第四服务请求消息，所述第四服务请求消息用于请求所述第一服务，所述第四服务请求消息包括所述第一客户认证凭证，或者，所述第四服务请求消息包括所述第二客户认证凭证。
在一种可能的设计中，所述第二服务用于提供所述第一服务对应的访问令牌，所述第一服务对应的访问令牌用于表征所述服务消费网元具有获取所述第一服务的权限。
在一种可能的设计中，在向所述服务消费网元发送客户认证凭证请求消息之前，所述处理单元用于确定未存储所述第一访问令牌且所述第一服务请求消息不包括所述第一访问令牌。
在一种可能的设计中，所述第二服务用于提供所述服务提供网元的信息。
在一种可能的设计中，在向所述服务消费网元发送客户认证凭证请求消息之前，所述处理单元用于确定未存储所述服务提供网元的信息且所述第一服务请求消息不包括所述服务提供网元的信息。
在一种可能的设计中，所述提供所述第二服务的网元为网络存储功能网元。
第十三方面，本申请还提供一种通信装置。该装置可以执行上述方法设计。该装置可以是能够执行上述方法对应的功能的芯片或电路，或者是包括该芯片或电路的设备。
在一种可能的实现方式中，该装置包括：存储器，用于存储计算机可执行程序代码；以及处理器，处理器与存储器耦合。其中存储器所存储的程序代码包括指令，当处理器执行所述指令时，使该装置或者安装有该装置的设备执行上述第一方面至第六方面的任意一种可能的设计中的方法。
其中，该装置还可以包括通信接口，该通信接口可以是收发器，或者，如果该装置为芯片或电路，则通信接口可以是该芯片的输入/输出接口，例如输入/输出管脚等。
在一种可能的设计中，该装置包括相应的功能单元，分别用于实现以上方法中的步骤。功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。硬件或软件包括一个或多个与上述功能相对应的单元。
第十四方面，本申请实施例提供一种计算机可读存储介质，所述计算机可读存储介质存储有计算机程序，当所述计算机程序在装置上运行时，执行如第一方面至第六方面的任 意一种可能的设计中的方法。
第十五方面，本申请实施例提供一种计算机程序产品，所述计算机程序产品包括计算机程序，当所述计算机程序在装置上运行时，执行如第一方面至第六方面的任意一种可能的设计中的方法。
第十六方面，本申请提供了一种通信芯片，其中存储有指令，当其在通信设备上运行时，使得所述通信芯片执行上述第一方面至第六方面的任意一种可能的设计中的方法。
附图说明
图1为本申请的实施例应用的移动通信系统的架构示意图；
图2为本申请的实施例中模式C的间接通信模式的示意图；
图3为本申请的实施例中模式D的间接通信模式的示意图；
图4为本申请的实施例中在模式C的间接通信模式下NF服务consumer直接与NRF交互的示意图；
图5为本申请的实施例中在模式C的间接通信模式下NF服务consumer通过SCP与NRF交互的示意图；
图6为本申请的实施例中在模式D的间接通信模式下NF服务consumer通过SCP与NRF交互的示意图之一；
图7为本申请的实施例中在模式D的间接通信模式下NF服务consumer通过SCP与NRF交互的示意图之二；
图8为本申请的实施例中一种通信方法的概述流程图之一；
图9为本申请的实施例中服务消费网元根据指示信息向服务通信代理发送第一服务请求消息的具体过程；
图10为本申请的实施例中一种通信方法的概述流程图之二；
图11为本申请的实施例中一种通信方法的概述流程图之三；
图12为本申请的实施例中一种通信方法的概述流程图之四；
图13为本申请的实施例中在确定需要请求第一服务且不存在第一服务对应的可用的access token时NF服务consumer获取第一服务的流程图之一；
图14为本申请的实施例中在确定需要请求第一服务且不存在第一服务对应的可用的access token时NF服务consumer获取第一服务的流程图之二；
图15为本申请的实施例中在确定需要请求第一服务且不存在第一服务对应的可用的access token时NF服务consumer获取第一服务的流程图之三；
图16为本申请的实施例中在确定需要请求第一服务且存在第一服务对应的可用的access token时NF服务consumer获取第一服务的流程图；
图17为本申请的实施例中在需要请求第一服务且请求第一服务触发SCP请求NF服务producer的参数时NF服务consumer获取第一服务的流程图之一；
图18为本申请的实施例中在需要请求第一服务且请求第一服务触发SCP请求NF服务producer的参数时NF服务consumer获取第一服务的流程图之二；
图19为本申请的实施例中NF服务consumer根据指示信息向SCP发送服务请求消息获取第一服务的流程图；
图20为本申请的实施例中在SCP主动请求客户认证凭证时NF服务consumer获取第 一服务的流程图；
图21为本申请实施例中一种通信装置的结构示意图之一；
图22为本申请实施例中一种通信装置的结构示意图之二。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述。显然，所描述的实施例仅仅是本申请一部分实施例，而不是全部的实施例。本申请的说明书和权利要求书及上述附图中的术语“第一”、第二”以及相应术语标号等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的术语在适当情况下可以互换，这仅仅是描述本申请的实施例中对相同属性的对象在描述时所采用的区分方式。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，以便包含一系列单元的过程、方法、系统、产品或设备不必限于那些单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它单元。
在本申请的描述中，除非另有说明，“/”表示或的意思，例如，A/B可以表示A或B；本申请中的“和/或”仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，在本申请的描述中，“至少一项”是指一项或者多项，“多项”是指两项或两项以上。“以下至少一项(个)”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a,b,或c中的至少一项(个)，可以表示：a,b,c,a-b,a-c,b-c,或a-b-c，其中a,b,c可以是单个，也可以是多个。
本申请实施例的技术方案可以应用于各种通信系统，例如：宽带码分多址(Wideband Code Division Multiple Access，WCDMA)系统，通用分组无线业务(general packet radio service，GPRS)，长期演进(Long Term Evolution，LTE)系统，LTE频分双工(frequency division duplex，FDD)系统，LTE时分双工(time division duplex，TDD)，通用移动通信系统(universal mobile telecommunication system，UMTS)，全球互联微波接入(worldwide interoperability for microwave access，WiMAX)通信系统，第五代(5th generation，5G)系统或未来的第六代通信系统等。
为了便于理解本申请实施例，以图1所示的增强的服务化架构为例对本申请使用的应用场景进行说明。具体的，增强的服务化架构具体可以包括但不限于以下设备：
1、会话管理网元：主要用于会话管理、终端设备的网络互连协议(internet protocol，IP)地址分配和管理、选择可管理用户设备平面功能、策略控制、或收费功能接口的终结点以及下行数据通知等。在5G通信中，会话管理网元可以是会话管理功能(session management function，SMF)网元，在未来通信如6G通信中，会话管理功能网元仍可以是SMF网元，或者有其它名称，本申请对此不作限定。Nsmf是SMF提供的基于服务的接口，SMF可以通过Nsmf与其他的网络功能通信。
2、接入管理网元：主要用于移动性管理和接入管理等，可以用于实现移动性管理实体(mobility management entity，MME)功能中除会话管理之外的其它功能，例如，合法监听、或接入授权(或鉴权)等功能。在5G通信中，接入管理网元可以是接入管理功能(access and mobility management function，AMF)网元，在未来通信如6G通信中，接入管理网元仍可以是AMF网元，或者有其它名称，本申请对此不作限定。Namf是AMF提 供的基于服务的接口，AMF可以通过Namf与其他的网络功能通信。
3、认证服务网元：主要用于用户鉴权等。在5G通信中，认证服务网元可以是认证服务功能(authentication server function，AUSF)网元，在未来通信如6G通信中，认证服务网元仍可以是AUSF网元，或者有其它名称，本申请对此不作限定。Nausf是AUSF提供的基于服务的接口，AUSF可以通过Nausf与其他的网络功能通信。
4、网络开放网元：用于安全地向外部开放由第三代合作伙伴计划(3rd generation partnership project，3GPP)网络功能提供的业务和能力等。在5G通信中，网络开放网元可以是网络开放功能(network exposure function，NEF)网元，在未来通信如6G通信中，网络开放功能网元仍可以是NEF网元，或者有其它名称，本申请对此不作限定。其中Nnef是NEF提供的基于服务的接口，NEF可以通过Nnef与其他的网络功能通信。
5、网络存储网元：用于提供服务注册、发现和授权，并维护可用的网络功能(network function，NF)实例信息，可以实现网络功能和服务的按需配置以及NF之间的互连。其中，服务注册是指，NF网元需要在网络存储网元进行注册登记后才能提供服务。服务发现是指，NF网元需要其他NF网元为其提供服务时，需先通过网络存储网元执行服务发现，以发现所期望的为其提供服务的NF网元。例如，NF网元1需要NF网元2为其提供服务时，需先通过网络存储网元进行服务发现，以发现NF网元2。服务授权是指，NF网元需要其他NF网元提供服务时，需先通过网络存储网元获取授权信息，从而进一步使用授权信息获取其他NF网元提供的服务。例如，NF网元1向NF网元2请求服务之前，NF网元1首先向网络存储网元请求接入NF网元2的授权信息，NF网元1使用获取的授权信息向NF网元2请求服务。在5G通信中，网络存储网元可以是网络存储功能(network repository function，NRF)网元，在未来通信如6G通信中，网络存储功能网元仍可以是NRF网元，或者有其它名称，本申请对此不作限定。Nnrf是NRF提供的基于服务的接口，NRF可以通过Nnrf与其他的网络功能通信。
6、策略控制网元：用于指导网络行为的统一策略框架，为控制平面功能网元(例如AMF，SMF等)提供策略规则信息等。在5G通信中，策略控制网元可以是策略控制功能(policy control function，PCF)网元，在未来通信如6G通信中，策略控制功能网元仍可以是NEF网元，或者有其它名称，本申请对此不作限定。其中Npcf是PCF提供的基于服务的接口，PCF可以通过Npcf与其他的网络功能通信。
[根据细则91更正 31.05.2022]　
7、数据管理网元：用于处理用户标识、接入鉴权、注册、或移动性管理等。在5G通信中，数据管理网元可以是统一数据管理(unified data management，UDM)网元，在未来通信如6G通信中，数据管理网元仍可以是UDM网元，或者有其它名称，本申请对此不作限定。其中Nudm是UDM提供的基于服务的接口，UDM可以通过Nudm与其他的网络功能通信。
8、应用网元：用于进行应用影响的数据路由，接入网络开放功能，或与策略框架交互进行策略控制等。在5G通信中，应用网元可以是应用功能(application function，AF)网元，在未来通信如6G通信中，应用网元仍可以是AF网元，或者有其它名称，本申请对此不作限定。Naf是AF提供的基于服务的接口，AF可以通过Naf与其他的网络功能通信。
9、用户设备(user equipment，UE)。可以包括各种具有无线通信功能的手持设备、车载设备、可穿戴设备、计算设备或连接到无线调制解调器的其它处理设备，以及各种形式 的终端，移动台(mobile station，MS)，终端(terminal)，用户设备(user equipment，UE)，软终端等等，例如水表、电表、传感器等。
10、(无线)接入网(radio access network，(R)AN)网元：用于为特定区域的授权用户设备提供入网功能，并能够根据用户设备的级别，业务的需求等使用不同质量的传输隧道。
RAN能够管理无线资源，为终端设备提供接入服务，进而完成控制信号和用户设备数据在终端和核心网之间的转发，RAN也可以理解为传统网络中的基站。
11、用户面网元(user plane function，UPF)网元：用于分组路由和转发、或用户面数据的服务质量(quality of service，QoS)处理等。在5G通信中，用户面网元可以是用户面功能(user plane function，UPF)网元，在未来通信如6G通信中，用户面网元仍可以是UPF网元，或者有其它名称，本申请对此不作限定。
12、数据网络(data network，DN)网元：用于提供传输数据的网络，例如，Internet网络等。其中，DN网元可以是数据网络鉴权、授权和计费(data network authentication、authorization、accounting)，也可以是应用服务器(application function)等。
13、SCP：用于完成服务化接口消息的路由和转发。也可以理解为：SCP可为服务化接口信令的发送方提供路由和转发服务。例如，在AMF向SMF请求建立会话的情况下，AMF向SCP发送会话建立请求消息，由SCP将会话建立请求消息发送至SMF，SMF确定是否响应该会话建立请求消息，若SMF向SCP发送会话建立响应消息，SCP将会话建立响应消息发送至AMF。若SMF向SCP发送会话建立拒绝消息，SCP将会话建立拒绝消息发送至AMF。其中，AMF与SMF之间交互的消息可以经过一跳SCP或者多跳SCP。
可以理解的是,上述功能或网元既可以是硬件设备中的网络元件,也可以是在专用硬件上运行软件功能，或者是平台(例如,云平台)上实例化的虚拟化功能。本申请实施例的应用场景并不限于此，任何能够实现上述各个网络功能的网络架构都适用于本申请实施例。
需要说明的是，下述内容中的消费者、服务消费网元、NF服务consumer是同一种类型网元，提供者、服务提供网元、和NF服务producer是指同一种类型的网元。本申请下述各实施例均假设本地运营商的策略指示NF服务consumer向SCP发送服务请求消息需要携带CCA。例如，本地运营商策略可以为配置该NF服务consumer在使用间接通信时生成CCA，用以通过CCA认证NF服务consumer。
基于上述增强的服务化架构，以下对间接通信流程的几种模式进行简要说明。
其一，无需代理发现的间接通信(indirect communication without delegated discovery)(简称模式C)：
消费者直接与NRF进行通信，以执行服务发现流程来选择对应的服务提供网元，所述服务发现流程无需SCP网元参与。
以下结合图2对上述模式C进行说明。
步骤201：consumer向NRF发送producer发现消息。
步骤202：NRF向consumer发送可用的producer的信息。
在一些实施例中，Consumer可以根据获取到的可用的producer的信息选择目标producer。可用的producer的信息可以包括NF set Id或特定的NF实例的标识等。具体的，目标producer可以是NF set Id对应的任意NF实例(即producer集合中的任意一个producer) 或一个特定NF Set Id对应的NF实例中的一个特定的NF实例(即特定producer)或一个特定的NF实例(即特定producer)。
在一些实施例中，SCP可以负责选择目标producer，详见下述步骤204。
步骤203：consumer向SCP发送服务请求消息，用于通过SCP向目标producer请求特定的服务。
步骤204：SCP通过与NRF交互获取用于选择目标producer的参数。
例如，SCP获取的参数可以包括但不限于NF实例的位置或容量等。
需要说明的是，步骤204为可选的步骤，示例性地，服务请求消息包括可用的producer的信息，例如，可用的producer的信息包括NF set Id，即可用的producer的信息指向一组NF实例，SCP需要从该组NF实例中选择一个NF实例作为目标producer，具体的，SCP可以根据从NRF获取的参数选择目标producer。例如，SCP可以根据获取的NF实例的位置从一组NF实例中确定目标producer。
步骤205：SCP向目标producer发送服务请求消息，用于向目标producer请求所述特定的服务。
步骤206：目标producer向SCP发送用于提供所述特定的服务的服务请求响应消息。
步骤207：SCP向consumer发送用于提供所述特定的服务的服务请求响应消息。
其二，需要代理发现的非直接通信(indirect communication with delegated discovery)(简称模式D)：
消费者不直接与NRF进行通信，由SCP网元代理消费者与NRF进行通信，以执行服务发现流程来选择对应的服务提供网元。
以下结合图3对上述模式D进行说明。
步骤301：consumer向SCP发送服务请求消息；用于通过SCP向目标producer请求特定的服务。
其中，服务请求消息包括用于目标producer发现和选择的参数。
步骤302：SCP通过与NRF交互获取可用的producer的信息。
其中，SCP可以根据步骤301中的服务请求消息中用于目标producer发现和选择的参数获取可用的producer的信息并从可用的producer的信息中确定目标producer。
步骤303：SCP向目标producer发送服务请求消息，用于向目标producer请求特定的服务。
步骤304：目标producer向SCP发送用于提供所述特定的服务的服务请求响应消息。
步骤305：SCP向consumer发送用于提供所述特定的服务的服务请求响应消息。
需要说明的是，在本申请各个实施例中，SCP从consumer接收到的服务请求消息与SCP向目标producer发送服务请求消息，可以是相同的，也可以是不相同的。例如，SCP可以对从consumer接收到的服务请求消息进行相应的修改(例如，增加、删除或者修改部分信息)，以生成向目标producer发送服务请求消息。同样地，SCP从目标producer接收到的服务请求响应消息与SCP向consumer发送的服务请求响应消息也可以是相同的，也可以是不相同的。例如，SCP可以对从目标producer接收到的服务请求响应消息进行相应的修改，以生成向consumer发送的服务请求响应消息。
进一步地，给予上述图2和图3所示的间接通信流程，当consumer通过SCP与producer通信时，producer还需要认证发起服务请求的consumer。同理，当consumer通过SCP与 NRF通信时，NRF也需要认证发起服务请求的consumer。
针对上述间接通信场景下的认证需求，以下本申请实施例中涉及的验证信息进行说明。
一、客户认证凭证(client credentials assertion，CCA)
CCA例如可以是被认证方签名的令牌(token)，用于认证方认证/验证被认证方的，即确定被认证方的身份。
示例性地，CCA是一个NF服务consumer签名的令牌，通过在消息中包括CCA使得消息的接收端(即认证方，例如NRF或NF服务producer)认证NF服务consumer。例如，CCA可以包含在超文本传输协议(hypertext transfer protocol,HTTP)消息的消息头或消息体中。
其中，CCA可以包括消息头(head)、载荷(payload)和签名(signature)三部分。
载荷包括声明(claims)，示例性地，声明包括NF服务consumer的NF实例ID、时间戳(timestamp)、过期时间和期望的受众的NF type。其中，时间戳用于表明CCA的发布时间，过期时间用于指示在该时间之后CCA被认为已过期。期望的受众的NF type为认证NF服务consumer的网元的NF type。
消息头和载荷被NF服务consumer使用NF服务consumer证书的私钥进行签名。消息头包括证书信息，即NF服务consumer证书的相关信息，例如，该证书信息包括定位到公钥的证书或证书链，或者，该证书信息包括定位到公钥的证书或证书链的统一资源定位符(uniform resource locator,URL)。
当认证方(例如NRF或NF服务producer)接收到包括CCA的消息时，认证方根据CCA认证NF服务consumer。具体的认证过程如下：
验证CCA的签名，若签名验证通过，则根据时间戳和/或CCA的过期时间验证CCA是否过期。若CCA未过期，则进一步认证方验证期望的受众的NF type是否与自己的NF type匹配。若匹配，验证CCA中的NF服务consumer的NF实例ID与用于签名CCA的证书中的NF实例ID是否匹配，若匹配，则所有验证均通过，则认证方确定NF服务consumer认证成功。需要说明的是，本申请对于上述验证的顺序并不限定。
其中，认证方验证期望的受众的NF type是否与自己的NF type匹配例如可以包括判断认证方验证期望的受众的NF type是否与自己的NF type相同。例如，当期望的受众的NF type为AMF时，认证方验证自己的NF type是否为AMF。验证CCA中的NF服务consumer的NF实例ID与用于签名CCA的证书中的NF实例ID是否匹配例如可以包括判断CCA中的NF服务consumer的NF实例ID与用于签名CCA的证书中的NF实例ID是否相同。
可以理解的是，上述认证过程仅为举例，认证方还可以采用其他顺序验证CCA，本申请对此不做限定。
二、访问令牌(access token)
访问令牌用于表征/指示消费者具有获取服务的权限。提供者在访问令牌验证通过的情况下，才会为消费者提供相应的服务。
示例性地，NRF接收到来自于NF服务consumer或者SCP的access token请求消息，NRF执行授权检查，确定授权通过，则NRF生成一个包括claims的access token。
其中，access token分为两种类型：基于NF服务producer的NF type(简称类型A)的access token和基于NF服务producer实例或NF服务producer服务实例(简称类型B)的access token。
其中，从功能来定义实例，一个实例可以是NF服务consumer实例或者NF服务producer实例。从服务来定义实例，实例又可称为服务实例，例如，一个服务实例可以是提供服务A的服务实例或者提供服务B的服务实例。
若NF服务consumer请求类型A的access token，即请求的access token用于指示NF服务consumer接入NF type对应的任一NF服务producer获取服务的权限，或者请求的access token用于指示NF服务consumer访问NF type对应的任一NF服务Producer的服务的权限。access token请求消息包括NF服务consumer的NF实例ID、期望的服务名称、NF服务consumer的NF type和期望的NF服务producer的NF type。可选的，access token请求消息还可以包括期望的NF服务producer实例的单网络切片选择辅助信息(single network slice selection assistance information，S-NSSAI)列表或网络切片实例标识(network slice instance identifier，NSI ID)列表、期望的NF服务producer实例的NF Set ID、NF服务consumer的S-NSSAI列表等。
相应的，NRF生成的access token中的claims包括NRF的NF实例ID，NF服务consumer的NF实例ID，NF服务producer的NF type，期望的服务名称，access token的有效时间。可选的，claims还可以包括附加范围(例如，请求的资源和请求的针对资源的操作)、期望的NF服务producer实例的S-NSSAI列表或NSI ID列表、期望的NF服务producer实例的NF Set ID。
若NF服务consumer请求类型B的access token，即请求的access token用于授权接入特定NF服务producer实例或NF服务producer服务实例获取服务。access token请求消息包括NF服务consumer的NF实例ID、期望的服务名称、请求的NF服务producer实例ID(s)。
相应的，NRF生成的access token中的claims包括NRF的NF实例ID，NF服务consumer的NF实例ID，NF服务producer的NF实例ID(s)，期望的服务名称，access token的有效时间。可选的，claims还可以包括附加范围(例如，请求的资源和请求的针对资源的操作)等。
此外，一般地，CCA的有效时间比access token的有效时间短。
进一步地，在NRF生成access token之后，NRF对access token进行完整性保护，例如，使用与NF服务producer共享的密钥对claims进行完整性保护，例如生成消息验证码(message authentication code，MAC)或使用NRF证书的私钥对claims进行签名。
当提供者(例如NF服务producer)接收到包括access token的服务请求消息时，提供者执行完整性验证，例如，使用与NRF共享的密钥验证access token的MAC或使用NRF证书的公钥验证access token的签名。若完整性验证成功，则进一步验证access token中的claims。
针对类型A的access token中的claims，提供者具体验证以下内容：
(1)提供者验证claims中的请求的NF服务producer的NF type是否与自己的NF type匹配；
(2)如果claims中包括期望的NF服务producer实例的S-NSSAI列表或NSI ID列表，则提供者验证自己是否能够服务对应的切片；
(3)如果claims中包括期望的NF服务producer实例的NF Set Id，提供者验证claims中的NF set Id是否与自己的NF Set Id匹配；
(4)如果claims中包括期望的服务名称，则提供者验证是否匹配服务请求消息请求的服务操作；
(5)如果claims中包括附加范围信息，则提供者验证附加范围信息与服务请求消息请求的服务操作是否匹配；
(6)提供者根据当前数据/时间验证access token中的有效时间来检查access token是否过期，或者提供者根据当前数据/时间验证access token中的有效时间来检查access token是否在有效期内。
针对类型B的access token中的claims，提供者具体验证以下内容：
(1)提供者验证claims中的请求的NF服务producer的NF实例ID(s)中是否包括与自己的ID；
(2)如果claims中包括期望的服务名称，则提供者验证是否匹配服务请求消息请求的服务操作；
(3)如果claims中包括附加范围信息，则提供者验证附加范围信息与服务请求消息请求的服务操作是否匹配；
(4)提供者根据当前数据/时间验证访问令牌中的到期时间来检查访问令牌是否过期，或者提供者根据当前数据/时间验证access token中的有效时间来检查access token是否在有效期内。
以下结合上述CCA和access token验证过程对间接通信场景进行进一步说明：
场景1：无需代理发现的间接流程(模式C)
NF服务consumer直接与NRF交互，如图4所示。
步骤401：NF服务consumer确定不存在可用的NF服务Producer的信息，NF服务consumer发起NF服务producer的发现(discovery)流程。
其中，该发现流程用于发现可用的NF服务producer。
示例性地，若步骤402和步骤403请求的是类型B的access token，则需要先于步骤402发起该发现过程，并确定特定NF服务producer实例的标识或NF服务producer服务实例的标识。
示例性地，若步骤402和步骤403请求的是类型A的access token，则可以在步骤402和步骤403之前发起NF服务producer的发现流程(即步骤401)，或者，在步骤402和步骤403之后发起NF服务producer的发现流程(即步骤404)。
可以理解的是，NF服务consumer只需发起一次NF服务producer的发现流程。
步骤402：NF服务consumer向NRF发送access token请求消息(例如，Nnrf_AccessToken_Get_Request)。由上述内容可知，access token分为两种类型，针对不同类型access token，access token请求消息包括的具体内容不同，详见上述关于access token的相关描述。
步骤403：NRF向NF服务consumer发送access token响应消息(例如，Nnrf_AccessToken_Get_Response)，access token响应消息包括NRF生成的access token。
具体的，NRF接收来自于NF服务consumer的access token请求消息，NRF执行授权检查，即验证NF服务consumer是否被授权获取请求的服务。若授权通过，则NRF生成access token，并对access token进行完整性保护。
步骤404：NF服务consumer确定不存在可用的producer信息(即未执行步骤401)，NF服务consumer发起producer发现流程。
其中，步骤404为可选的步骤，在步骤401和步骤404中可以仅一个步骤被执行。
步骤405：NF服务consumer向SCP发送服务请求消息(例如，Service Request)，服务请求消息包括access token和CCA。
CCA用于NF服务producer认证NF服务consumer。具体的，CCA中的claims包括NF服务consumer的NF实例ID，时间戳和过期时间，期望的受众的NF type。根据CCA的定义，服务请求消息的接收端点为NF服务producer，则这里的期望的受众的NF type为NF服务producer的NF type。关于CCA可以参见上述相关内容，此处不再赘述。
例如，在AMF通过SCP向SMF请求建立会话的情况下，AMF向SCP发送会话建立请求消息，会话建立请求消息包括access token和CCA。此时的CCA包括AMF的NF实例ID，时间戳和过期时间，期望的受众的NF type为SMF。
步骤406：SCP向NF服务producer发送服务请求消息。
示例性地，SCP执行应用编程接口(Application Programming interface，API)修改，并将接收到的服务请求消息发送至NF服务producer。
其中，若服务请求消息包括特定NF服务producer实例的标识或NF服务producer服务实例的标识，SCP将服务请求消息发送至特定NF服务producer实例或NF服务producer服务实例。若服务请求消息包括NF set Id，SCP可以从中选择一个NF实例向其发送服务请求消息。
步骤407：NF服务producer接收来自于SCP的服务请求消息。NF服务producer验证CCA和access token。
NF服务producer对access token执行完整性验证，若完整性验证成功，则进一步验证access token中的claims，详见上述access token中的claims验证的相关内容。NF服务producer还需要根据CCA验证NF服务consumer，其中，验证CCA的具体过程可以参考上述关于CCA验证的相关描述。
步骤408：NF服务producer确定acess token和CCA验证成功，则NF服务producer向SCP发送服务响应消息(例如，Service Response)。
步骤409：SCP向NF服务consumer发送服务响应消息。
示例性地，SCP接收来自于NF服务producer的服务响应消息执行API修改，并向NF服务consumer发送服务响应消息。
场景2：无需代理发现的间接流程(模式C):NF服务consumer通过SCP与NRF交互，如图5所示。
步骤501：NF服务consumer确定不存在可用的NF服务Producer的信息，NF服务consumer发起NF服务producer的发现流程。
其中，该发现流程用于发现可用的NF服务producer。
示例性地，若步骤502和步骤503请求的是类型B的access token，则需要先于步骤502发起该发现过程，并确定特定NF服务producer实例的标识或NF服务producer服务实例的标识。
示例性地，若步骤502和步骤503请求的是类型A的access token，则可以在步骤502 和步骤503之前发起NF服务producer的发现流程(即步骤501)，或者，在步骤502和步骤503之后发起NF服务producer的发现流程(即步骤504)。
可以理解的是，NF服务producer只需发起一次发现流程。
步骤502：NF服务consumer向SCP发送access token请求消息。
access token请求消息包括的具体参数可以根据请求的access token的类型确定，具体可参考上述access token的相关描述。此外，access token请求消息还可以包括CCA*，CCA*用于NRF认证NF服务consumer。具体的，CCA*中的claims包括NF服务consumer的NF实例ID，时间戳和过期时间，期望的受众的NF type。根据CCA的定义，access token请求消息的接收端点为NF服务producer，则这里的期望的受众的NF type为NFR。
步骤503：SCP向NRF发送步骤501中接收到的access token请求消息。
步骤504：NRF确定CCA*验证成功，生成access token。
具体的，NRF根据CCA*认证NF服务consumer。若认证通过，NRF进一步执行授权检查，若授权通过，则NRF生成access token，并对access token进行完整性保护。
步骤505：NRF向SCP发送access token响应消息，access token响应消息包括NRF生成的access token。
步骤506：SCP向NRF发送access token响应消息，access token响应消息包括NRF生成的access token。
步骤507～步骤511的具体内容可以参考图5所示实施例中的步骤505～步骤509。
场景3：代理发现的流程下的通信授权(模式D):NF服务consumer通过SCP与NRF交互，如图6所示。
步骤601：NF服务consumer向SCP发送服务请求消息。服务请求消息包括CCA和access token。其中，CCA和access token均未过期。CCA中的claims包括NF服务consumer的NF实例ID，时间戳和过期时间，期望的受众的NF type。根据CCA的定义，服务请求消息的接收端点为NF服务producer，则这里的期望的受众的NF type为NF服务producer的NF type。
步骤602：SCP向NF服务producer发送服务请求消息，服务请求消息包括CCA和access token。
[根据细则91更正 31.05.2022]　
步骤603～步骤605的具体内容可以参考图5所示实施例中的步骤509～步骤511。
场景4：代理发现的流程下的通信授权(模式D):NF服务consumer通过SCP与NRF交互，如图7所示。
步骤701：NF服务consumer向SCP发送服务请求消息,服务请求消息包括CCA。CCA中的claims包括NF服务consumer的NF实例ID、时间戳、过期时间和期望的受众的NF type。服务请求的接收端点为NF服务producer，则这里的期望的受众的NF type为NF服务Producer的NF type。
步骤702：SCP向NRF发送access token请求消息。
示例性地，SCP可以根据服务请求消息判断是否向NRF发起access token请求流程。例如，SCP确定接收到的服务请求消息不包括access token且本地没有与服务请求消息对应的access token，则SCP向NRF发送access token请求消息。
其中，access token请求消息包括步骤701中的CCA。
步骤703：NRF确定验证CCA失败。
其中，CCA中期望的受众的NF type为NF服务producer的NF type，由于CCA中的NF type与NRF的NF type不一致，NRF确定CCA验证失败。
步骤704：NRF向SCP发送access token响应消息，access token响应消息不包括access token。
因此，由于SCP获取access token失败，进而导致NF服务consumer向NF服务producer请求服务失败。
基于模式D的间接通信场景，本申请实施例提供以下几种实施例，用于解决在NF服务consumer直接向SCP发送服务请求消息触发SCP发起请求其他服务时，由于服务请求的接收端点(该其他服务的提供者)认证NF服务consumer失败，导致SCP请求该其他服务失败，进而导致NF服务consumer请求服务失败的问题。
首先对下述各个实施例中涉及的技术概念进行说明：
1、本申请实施例涉及至少两种网络功能类型。其中，第一网络功能类型与第二网络功能类型不同。网络功能类型是指网络中提供一组功能行为或提供一组服务的网络功能的统称。例如，5G网络中的网络功能类型可以包含AMF类型或者SMF类型等，其中AMF类型的功能网元可以提供接入和移动性管理相关的服务，SMF类型的功能网元可以提供PDU会话管理相关的服务。
2、本申请实施例还涉及至少两种服务。其中，第一服务与第二服务不同，第一服务与第二服务关联。
示例性地，第一服务可以是请求会话建立，第二服务可以是请求与第一服务对应的access token。或者，第一服务可以是请求会话建立，第二服务可以是请求提供第一服务的网元的信息。
例如，基于模式D的间接通信场景，在AMF向SMF请求建立会话时，AMF向SCP发送会话建立请求消息，在SCP向SMF发送会话建立请求之前，若SCP需要首先从NRF获取会话建立请求对应的access token(以下记为access token 1)，则在SCP从NRF获取access token 1之后，SCP将会话建立请求消息发送至SMF，此时的会话建立请求消息包括access token 1。这里的第一服务是指请求会话建立，第二服务是指请求第一服务对应的access token，且SCP向NRF请求第一服务对应的access token发生在SCP向SMF发送会话建立请求消息之前，即SCP发起请求第二服务在发起请求第一服务之前。此外，在一些场景下，SCP发起请求第二服务还可能在发起请求第一服务之后，本申请实施例对此不做限定。如无特殊说明，以下仅以SCP发起请求第二服务在发起请求第一服务之前为例进行说明。
第一服务与第二服务关联例如可以是发起请求第一服务可能触发请求第二服务。
在一示例中，第二服务用于提供第一服务对应的访问令牌，第一服务对应的访问令牌用于表征/指示服务消费网元具有获取第一服务的权限。由于服务消费网元请求第一服务，且第二服务提供的第一服务对应的访问令牌用于表征/指示服务消费网元具有获取第一服务的权限，因此，第一服务与第二服务关联。示例性地，NF服务consumer请求第一服务可能触发SCP请求第一服务对应的access token。第一服务对应的access token用于表征/ 指示NF服务consumer具有获取第一服务的权限或访问第一服务的权限。
在另一示例中，第二服务用于提供服务提供网元的信息。由于服务消费网元请求第一服务，第二服务提供的服务提供网元的信息指示的服务提供网元可以提供第一服务，因此，第一服务与第二服务关联。示例性地，NF服务consumer请求第一服务可能触发SCP请求NF服务producer的信息。NF服务producer为NF服务consumer提供第一服务。
此外，发起请求第一服务还可能触发请求多个第二服务。示例性地，NF服务consumer请求第一服务可能触发SCP请求NF服务producer的信息，以及触发SCP请求第一服务对应的access token。NF服务producer为NF服务consumer提供第一服务，第一服务对应的access token用于表征/指示服务消费网元具有获取第一服务的权限。具体的，SCP可以向NRF1请求第一服务对应的access token，并向NRF1请求NF服务producer的信息。此时NRF1提供两种第二服务。或者，SCP可以向NRF1请求第一服务对应的access token，并向NRF2请求NF服务producer的信息。此时，NRF1与NRF2不同，NRF1提供的第二服务与NRF2提供的第二服务不同。
可以理解的是，上述第一服务和第二服务仅为举例，不作为本申请实施例的限定。
以下仅以提供第二服务的网元为网络存储功能网元为例进行说明，提供第二服务的网元还可能是其他类型的网元，本申请实施例对此不做限定。
本申请实施例提供一种通信方法，服务消费网元向服务通信代理发送服务请求消息，该服务请求消息包括第一客户认证凭证，第一客户认证凭证可以包括至少两种不同的网络功能类型，进而可以实现不同网元都可以根据第一客户认证凭证，成功的认证服务消费网元。以下以图8所示的实施例为例进行说明。
步骤801：服务消费网元向服务通信代理发送第一服务请求消息，第一服务请求消息用于向服务提供网元请求第一服务，第一服务请求消息包括第一客户认证凭证。
第一客户认证凭证用于认证服务消费网元。第一客户认证凭证包括第一网络功能类型和第二网络功能类型，第一网络功能类型为提供第一服务的网元的网络功能类型，即服务提供网元的网络功能类型，第二网络功能类型为提供第二服务的网元的网络功能类型，第二服务与第一服务关联。提供第二服务的网元的网络功能类型可以为网络存储功能网元的网络功能类型。
相较于现有的CCA，第一客户认证凭证包括两种网络功能类型，因此，现有CCA仅用于服务请求的接收端点对服务消费网元进行认证，即认证服务消费网元的身份。而本申请实施例中第一客户认证凭证可以用于两种网络功能类型的网元对服务消费网元进行认证，即服务请求的接收端点以及服务请求触发的请求消息的接收端点对服务消费网元进行身份认证。此外，第一客户认证凭证还包括服务消费网元的标识和第一客户认证凭证的有效时间信息中的一项或多项。第一客户认证凭证的有效时间信息用于指示第一客户认证凭证的有效时间，例如，第一客户认证凭证的有效时间信息可以包括时间戳和第一客户认证凭证的过期时间。这些内容与现有CCA中对应概念的含义相同，此处不再赘述。例如，时间戳指示时刻A，过期时间指示时刻B，则第一客户认证凭证在时刻A和时刻B确定的一段时间内有效。或者，第一客户认证凭证的有效时间信息可以包括时间戳和第一客户认证凭证的有效时长。这里的时间戳与现有CCA中对应概念的含义相同，有效时长可以是指时间戳后一段时间。例如，时间戳指示时刻A，有效时长指示时间段C(例如5分钟)，则第一客户认证凭证在时刻A之后的时间段C内有效。
其中，第一客户认证凭证的有效时间信息与第一时长关联，第一时长是服务消费网元与服务通信代理的传输时延、服务通信代理与提供第二服务的网元的传输时延以及服务通信代理与服务提供网元(即提供第一服务的网元)的传输时延确定的。
示例性地，服务消费网元与服务通信代理的传输时延记为T 1，服务通信代理与提供第二服务的网元的传输时延记为T 2，服务通信代理与服务提供网元的传输时延记为T 3。上述传输时延可以为两个网元之间的传输时延的平均值或略大于传输时延的平均值。若服务通信代理请求第二服务早于请求第一服务，第一时长＝T 1+2T 2+T 3。此时，第一客户认证凭证的有效时长可以为第一时长与预设时长之和。或者，第一客户认证凭证的过期时间可以由时间戳、第一时长和预设时长确定。这里的预设时长可以预先设定或者动态调整确定。需要说明的是，预设时长如果设置过长，则可能会导致CCA的有效时间很长，则CCA有可能存在被重复使用的风险。
上述针对第一客户认证凭证的有效时间信息的配置规则可以尽量保证第一客户认证凭证不被服务通信代理恶意使用，进而保证通信过程的安全性。
可以理解的是，在服务消费网元向服务通信代理发送第一服务请求消息之前，服务消费网元还需要判断本地是否存储可用的第一客户认证凭证，若存储可用的客户认证凭证(例如，保存有未过期的客户认证凭证)，则使用该未过期的客户认证凭证作为第一客户凭证。若未存储可用的客户认证凭证(例如，客户认证凭证已过期或未存储客户认证凭证)，则服务消费网元生成该第一客户认证凭证。此外，当存在已过期的客户认证凭证时，服务消费网元可以删除已过期的客户认证凭证。因此，服务消费网元可以通过删除已过期的客户认证凭证，释放存储空间，减轻系统的存储负担。
以下说明触发服务消费网元向服务通信代理发送第一服务请求消息的几种可能的场景。
场景1：在需要请求第一服务且不存在第一服务对应的可用的访问令牌的情况下，服务消费网元向服务通信代理发送第一服务请求消息。
示例性地，服务消费网元确定需要请求第一服务且不存在第一服务对应的可用的访问令牌，服务消费网元向服务通信代理发送第一服务请求消息。
在一些实施例中，服务消费网元确定不存在第一服务对应的可用的访问令牌包括：服务消费网元确定未存储第一服务对应的访问令牌或服务消费网元确定存储的第一服务对应的访问令牌已过期。进一步地，在存储的第一服务对应的访问令牌已过期的情况下，服务消费网元可以删除已过期的第一服务对应的访问令牌。
示例性地，access token可以存储在NF服务consumer的公共存储空间(例如，access token存储在节点级别的上下文中)。NF服务consumer可以接收UE的服务请求消息，根据该服务请求消息确定需要请求第一服务。NF服务consumer根据UE的标识获取UE的相关信息(例如UE的上下文信息)，进一步地，NF服务consumer检查公共存储空间是否包括与第一服务对应的access token。若包括第一服务对应的access token且该access token未过期，则使用该access token；若不包括第一服务对应的access token则确定不存在可用的access token；或若包括第一服务对应的access token但该access token已过期，确定不存在可用的access token，进一步可选的，NF服务consumer删除该access token。其中，UE的相关信息可以存储在NF服务consumer的公共存储空间，或者，NF服务consumer根据UE的标识从其他网元获取的UE的相关信息。
可以理解的是，若服务消费网元确定存在可用的第一服务对应的访问令牌，则此时服务消费网元向服务通信代理发送的第一服务请求消息可以不需要包括第二网络功能类型，仅包括第一网络功能类型即可。
场景2：在需要请求第一服务且请求第一服务触发服务通信代理请求服务提供网元的信息的情况下，服务消费网元向服务通信代理发送第一服务请求消息。
示例性地，服务消费网元确定需要请求第一服务且请求第一服务触发服务通信代理请求服务提供网元的信息，服务消费网元向服务通信代理发送第一服务请求消息。
其中，在出现以下一种或多种情况时，服务消费网元可以确定请求第一服务会触发服务通信代理请求服务提供网元的信息。示例性地，服务消费网元接收与第一终端设备关联的第一消息，服务消费网元根据第一消息确定需要请求第一服务。进一步地，服务消费网元根据以下一项或多项，确定请求第一服务触发服务通信代理请求服务提供网元的信息。
情况1：未存储第一终端设备的上下文。
示例性地，NF服务consumer可以接收UE的服务请求消息，根据该服务请求消息确定需要请求第一服务。NF服务consumer根据UE的标识获取UE的上下文信息，若未能获取UE的上下文信息，即该UE为新的UE，未触发过NF服务consumer向NF服务producer请求服务，则NF服务consumer确定请求第一服务触发SCP请求NF服务producer的信息。其中，UE的上下文信息可以存储在NF服务consumer，或者，NF服务consumer根据UE的标识从其他网元获取的UE的上下文信息。
情况2：未存储第一服务的上下文。
示例性地，NF服务consumer可以接收UE的服务请求消息，根据该服务请求消息确定需要请求第一服务。NF服务consumer根据UE的标识获取UE的上下文信息，根据UE的上下文信息确定未包括第一服务的上下文，即UE未触发过NF服务consumer向NF服务producer请求第一服务，则NF服务consumer确定请求第一服务触发SCP请求NF服务producer的信息。其中，UE的上下文信息可以存储在NF服务consumer，或者，NF服务consumer根据UE的标识从其他网元获取的UE的上下文信息。
情况3：第一切片归属于服务提供网元且未存储第一切片的上下文；
示例性地，NF服务consumer可以接收UE的服务请求消息，根据该服务请求消息确定需要请求第一服务且需要向第一切片中服务提供网元请求第一服务。NF服务consumer根据UE的标识获取UE的上下文信息，根据UE的上下文信息确定未包括第一切片的上下文，即UE未触发过NF服务consumer向第一切片中的NF服务producer请求第一服务，则NF服务consumer确定请求第一服务触发SCP请求NF服务producer的信息。其中，UE的上下文信息可以存储在NF服务consumer，或者，NF服务consumer根据UE的标识从其他网元获取的UE的上下文信息。
情况4：服务消费网元首次与服务通信代理通信。
可以理解的是，服务消费网元可以通过多个服务通信代理向服务提供网元请求服务，若服务消费网元确定向新的服务通信代理发送第一服务请求消息，即服务消费网元首次与该服务通信代理进行通信，则服务消费网元确定第一服务请求消息触发服务通信代理请求第二服务。
此外，NF服务consumer接收服务请求响应消息，该消息中包含绑定指示，该绑定指示用于后续的相关服务消息。这种场景下，若NF服务consumer发起请求第一服务时，第 一服务请求消息携带绑定信息，绑定信息可以用于SCP将第一服务请求路由特定的NF服务producer。此时SCP无需发起NF服务producer发现流程。
场景3：在需要请求第一服务且服务消费网元使用模式D的间接通信模式与服务通信代理进行通信，服务消费网元向服务通信代理发送第一服务请求消息。
示例性地，可以通过标准协议约定或者通过预配置信息配置服务消费网元使用模式D与服务通信代理进行通信时，第一服务请求消息总是携带包括第一网络功能类型和第二网络功能类型的客户认证凭证。
场景4：在服务消费网元向服务通信代理发送第一服务请求消息之前，服务消费网元获取指示信息，服务消费网元根据指示信息向服务通信代理发送第一服务请求消息。
如图9所示，以下对图8步骤801中场景4下服务消费网元根据指示信息向服务通信代理发送第一服务请求消息的具体过程进行说明。
步骤901：在服务消费网元向服务通信代理发送第一服务请求消息之前，服务消费网元向服务通信代理发送第二服务请求消息，第二服务请求消息用于请求第一服务，第二服务请求消息包括第二客户认证凭证，第二客户认证凭证包括第一网络功能类型，第二客户认证凭证用于服务提供网元认证服务消费网元。
需要说明的是，此时第二客户认证凭证不包括第二网络功能类型。
步骤902：服务通信代理向网络存储功能网元发送第三服务请求消息，第三服务请求消息用于请求第二服务，第三服务请求消息包括第二客户认证凭证。网络存储功能网元用于提供第二服务。
服务通信代理确定请求第一服务触发请求第二服务可以包括但不限于以下场景：
场景A：在未存储第一服务对应的可用的访问令牌且第二服务请求消息未包括第一服务对应的访问令牌的情况下，服务通信代理向网络存储功能网元发送第三服务请求消息，第三服务请求消息用于请求第一服务对应的访问令牌。服务通信代理确定未存储可用的第一服务对应的访问令牌且第二服务请求消息未包括第一服务对应的访问令牌，服务通信代理向网络存储功能网元发送第三服务请求消息。
示例性地，服务通信代理根据接收到的第二服务请求消息，可以确定需要第一服务对应的访问令牌，例如，服务通信代理可以根据服务请求消息的类型或服务请求的访问范围确定需要第一服务对应的访问令牌。进一步地，服务通信代理查询是否存储第一服务对应的访问令牌，若未存储或存储的第一服务对应的访问令牌已过期，且第二服务请求消息中未包括该访问令牌，则可以根据服务请求消息的类型确定请求第一服务对应的访问令牌所需要的参数，即claim中的参数，例如，期望的服务的名称、consumer的NF instance ID等。此外，当存储的第一服务对应的访问令牌已过期，服务通信代理可以删除该过期的访问令牌。
场景B：在未存储可用的服务提供网元的信息且第二服务请求消息未包括服务提供网元的信息的情况下，服务通信代理向网络存储功能网元发送第三服务请求消息，第三服务请求消息用于请求服务提供网元的信息。服务通信代理确定未存储可用的服务提供网元的信息且第二服务请求消息未包括服务提供网元的信息，向网络存储功能网元发送第三服务请求消息。示例性地，服务通信代理可以根据第二服务请求消息的类型和/或第二服务请求消息中的指示信息确定。
服务通信代理在接收到第二服务请求消息之后，服务通信代理解析第二服务请求消息， 进而可以确定消息的接收者是谁，是否需要发现消息的接收者(即服务提供网元)。其中，服务通信代理判断是否需要发现服务提供网元，与在直接通信中服务消费网元如何确定是否需要发现服务提供者的逻辑类似。例如，SCP接收到的是请求消息是会话建立请求，SCP确定需要将该消息转发给SMF，SCP会根据该消息中的参数确定本地是否有符合条件的SMF实例信息。
步骤903：网络存储功能网元根据第二客户认证凭证确定服务消费网元认证失败。
示例性地，网络存储功能网元根据第二客户认证凭证确定服务消费网元认证失败，包括：所述网络存储功能网元确定所述第一网络功能类型与网络存储功能网元的网络功能类型不匹配。或者，
网络存储功能网元根据第二客户认证凭证确定服务消费网元认证失败，包括：网络存储功能网元验证第二客户认证凭证的签名通过、根据第二客户认证凭证包括的时间戳和/或第二客户认证凭证的过期时间验证第二客户认证凭证未过期、验证第二客户认证凭证中的服务消费网元的标识与用于签名第二客户认证凭证的证书中的网元的标识相同以及验证第一网络功能类型与网络存储功能网元的网络功能类型不匹配。
步骤904：在第一网络功能类型与网络存储功能网元的网络功能类型不匹配的情况下，网络存储功能网元向服务通信代理发送针对第三服务请求消息的响应消息。针对第三服务请求消息的响应消息包括原因值和/或第一指示信息。
其中，原因值和/或第一指示信息指示第二客户认证凭证中不包括第二网络功能类型，或者指示第二客户认证凭证中包括的第一网络功能类型与网络存储功能网元的网络功能类型不匹配，或者指示第二客户认证凭证中缺少正确的网络功能类型等。
可选的，所述第一指示信息可以是第三客户认证凭证。该第三客户认证凭证包括网络存储功能网元的标识、第三客户认证凭证的时间戳、第三客户认证凭证的过期时间、服务消费网元的网络功能类型。可选的，第三客户认证凭证还可以包括网络存储功能网元的网络功能类型，用以指示服务消费网元生成包括网络存储功能网元的网络功能类型的客户认证凭证。
由于步骤903可知，网络存储功能网元对服务消费网元认证失败，则针对第三服务请求消息的响应消息还可以指示第二服务请求失败。
步骤905：服务通信代理根据针对第三服务请求消息的响应消息向服务消费网元发送针对第二服务请求消息的响应消息，所述针对第二服务请求消息的响应消息中包括第二指示信息。
其中，所述第二指示信息用于触发所述服务消费网元发送图8实施例中步骤801的第一服务请求消息(即同时携带服务提供网元的网络功能类型和网络存储功能网元的网络功能类型的服务请求消息)。
一种可能的实现方式中，所述第二指示信息用于指示第二客户认证凭证中不包括网络存储功能网元的网络功能类型(即上述第二网络功能类型)，或者指示第二客户认证凭证中包括的第一网络功能类型与网络存储功能网元的网络功能类型不匹配，或者指示第二客户认证凭证中缺少正确的网络功能类型等。
具体实现中，上述第二指示信息可以与所述第一指示信息相同，或者是由服务通信代理对所述第一指示信息处理之后得到的信息。本申请实施例对此不做限定。
在一些实施例中，服务通信代理还可以根据针对第三服务请求消息的响应消息生成所 述第二指示信息，该第二指示信息可以触发服务消费网元重新发起请求第一服务的服务请求消息并在重新发起请求第一服务时携带包括网络存储功能网元的网络功能类型和服务提供网元的网络功能类型的客户认证凭证(即执行上述步骤801)。
步骤906：服务消费网元根据所述第二指示信息，向服务通信代理发送第一服务请求消息。
在一些实施例中，在第二指示信息包括第三客户认证凭证且第三客户认证凭证包括网络存储功能网元的网络功能类型时，服务消费网元可以根据第三客户认证凭证认证网络存储功能网元，在网络存储功能网元认证成功时，服务消费网元向服务通信代理发送第一服务请求消息，其中，服务消费网元确定第二网络功能类型为网络存储功能网元的网络功能类型(其中，网络存储功能网元用于提供第二服务，网络存储功能网元的网络功能类型为提供第二服务的网元的网络功能类型)。
步骤802：服务通信代理接收来自于服务消费网元的第一服务请求消息，服务通信代理向网络存储功能网元发送第四服务请求消息，第四服务请求消息用于请求第二服务，第四服务请求消息包括第一客户认证凭证。
服务通信代理确定请求第一服务触发请求第二服务可以参考上述步骤902，重复之处不再赘述。
步骤803：网络存储功能网元接收来自于服务通信代理的第四服务请求消息，网络存储功能网元根据第一客户认证凭证认证服务消费网元。
网络存储功能网元确定在第一网络功能类型和第二网络功能类型中存在与网络存储功能网元的网络功能类型相同的网络功能类型，则网络存储功能网元确定服务消费网元认证成功。其中，第二网络功能类型与网络存储功能网元的网络功能类型相同。
具体的，网络存储功能网元验证第一客户认证凭证的签名通过、根据第一客户认证凭证包括的时间戳和/或第一客户认证凭证的过期时间验证第一客户认证凭证未过期、验证第一客户认证凭证中的服务消费网元的标识与用于签名第一客户认证凭证的证书中的网元的标识相同、验证第一网络功能类型和第二网络功能类型中第二网络功能类型与网络存储功能网元的网络功能类型匹配，则网络存储功能网元确定服务消费网元认证成功。
步骤804：在服务消费网元认证成功时，网络存储功能网元向服务通信代理发送针对第四服务请求消息的响应消息。
示例性地，若第四服务请求消息请求第一服务对应的访问令牌，则网络存储功能网元在服务消费网元认证成功后，网络存储功能网元执行授权检查，确定授权通过，则网络存储功能网元生成第一服务对应的访问令牌。网络存储功能网元向服务通信代理发送针对第四服务请求消息的响应消息。针对第四服务请求消息的响应消息包括第一服务对应的访问令牌。
示例性地，若第四服务请求消息请求服务提供网元的信息，则网络存储功能网元在服务消费网元认证成功后，向服务通信代理发送针对第四服务请求消息的响应消息，针对第四服务请求消息的响应消息包括服务提供网元的信息。
步骤805：服务通信代理接收来自于网络存储功能网元的针对第四服务请求消息的响应消息，服务通信代理根据针对第四服务请求消息的响应消息向服务提供网元发送第五服务请求消息，第五服务请求消息用于请求第一服务，第五服务请求消息包括第一客户认证 凭证。
可以理解的是，第五服务请求消息还包括第一服务对应的访问令牌。
示例性地，在针对第四服务请求消息的响应消息包括第一服务对应的访问令牌时，服务通信代理向服务提供网元发送第五服务请求消息，第五服务请求消息用于请求第一服务，第五服务请求消息包括第一客户认证凭证和第一服务对应的访问令牌。
示例性地，在针对第四服务请求消息的响应消息包括服务提供网元的信息时，服务通信代理向服务提供网元的信息指示的服务提供网元发送第五服务请求消息，第五服务请求消息用于请求第一服务，第五服务请求消息包括第一客户认证凭证和第一服务对应的访问令牌。此时的第一服务对应的访问令牌可以是服务通信代理存储的或第一请求消息中携带的。
或者另一种实现方式中，服务通信代理使用所述第一客户认证凭证向网络存储功能网元请求所述第一服务对应的访问令牌和所述服务提供网元的信息。即通过执行两次步骤802-步骤804，服务通信代理可以发起两次针对第二服务的服务请求消息，一次用于请求第一服务对应的访问令牌，一次用于请求所述服务提供网元的信息。则此时，步骤805中的第一服务对应的访问令牌，可以是服务通信代理通过步骤802-步骤804从网络存储功能网络获取的。
步骤806：服务提供网元接收来自于服务通信代理的第五服务请求消息，服务提供网元根据第一客户认证凭证认证服务消费网元。
可以理解的是，服务提供网元还需验证第一服务对应的访问令牌，具体可以参考上述关于access token的验证过程，此处不再赘述。
服务提供网元根据第一客户认证凭证认证服务消费网元，包括：服务提供网元判断自身的网络功能类型是否与所述第一网络功能类型和第二网络功能类型中一个或者多个相匹配。
具体的，所述服务提供网元根据第一客户认证凭证认证服务消费网元，还包括：服务提供网元验证第一客户认证凭证的签名是否通过、根据第一客户认证凭证包括的时间戳和/或第一客户认证凭证的过期时间验证第一客户认证凭证是否未过期以及验证第一客户认证凭证中的服务消费网元的标识与用于签名第一客户认证凭证的证书中的网元的标识是否相同。
其中，网络存储功能网元和服务提供网元根据第一客户认证凭证认证服务消费网元的认证思路相同，相应内容可以互相参考，不再赘述。
步骤807：在服务消费网元认证成功时，服务提供网元向服务通信代理发送针对第五服务请求消息的响应消息。
例如，在对服务消费网元认证成功且第一服务对应的访问令牌验证成功时，针对第五服务请求消息的响应消息用于指示提供第一服务或者指示第五服务请求成功。或者，在服务消费网元认证失败和/或第一服务对应的访问令牌验证失败时，针对第五服务请求消息的响应消息指示请求第一服务失败。
步骤808：服务通信代理向服务消费网元发送针对第一服务请求消息的响应消息。
当针对第五服务请求消息的响应消息用于指示提供第一服务或者指示第五服务请求成功时，针对第一服务请求消息的响应消息用于指示提供第一服务或者指示第一服务请求成功。或者，当针对第五服务请求消息的响应消息指示第一服务请求失败时，针对第一服 务请求消息的响应消息指示第一服务请求失败。示例性地，服务通信代理可能会修改一下针对第五服务请求消息的响应消息的消息头中的信息，但针对第五服务请求消息的响应消息的内容基本不变，服务通信代理主要是起到消息路由的作用。
采用上述实施例，在服务消费网元通过服务通信代理向服务通过网元请求第一服务的场景下，服务消费网元在向服务通信代理发送的第一服务请求消息中携带同时包含第一网络功能类型和第二网络功能类型的客户认证凭证，进而可以保证服务通信代理请求第二服务时，提供第二服务的网元对服务消费网元认证成功，进而也为服务消费网元请求第一服务提供了保障，解决了间接通信场景下，因为客户认证凭证认证失败，导致服务消费网元请求服务失败的问题。
本申请实施例提供一种通信方法，服务消费网元向服务通信代理发送服务请求消息，该服务请求消息包括第四客户认证凭证和第五客户认证凭证，第四客户认证凭证和第五客户认证凭证分别包括不同的网络功能类型，服务通信代理向不同网元发送对应的客户认证凭证，进而可以实现不同网元根据不同客户认证凭证认证服务消费网元。以下以图10所示的实施例为例进行说明。
本申请实施例提供一种通信方法，如图10所示，该方法包括：
步骤1001：服务消费网元向服务通信代理发送第一服务请求消息，第一服务请求消息用于请求第一服务，第一服务请求消息包括第四客户认证凭证和第五客户认证凭证。
其中，第四客户认证凭证用于服务提供网元认证服务消费网元，第五客户认证凭证用于提供第二服务的网元认证服务消费网元，第四客户认证凭证包括第一网络功能类型，第五客户认证凭证包括第二网络功能类型，第一网络功能类型为服务提供网元的网络功能类型，第二网络功能类型为提供第二服务的网元的网络功能类型，第二服务与第一服务关联。
第四客户认证凭证还包括服务消费网元的标识和第四客户认证凭证的有效时间信息中的一项或多项，第四客户认证凭证的有效时间信息指示第四客户认证凭证的过期时间，例如，第四客户认证凭证的有效时间信息包括时间戳，第四客户认证凭证的过期时间。或者，第四客户认证凭证的有效时间信息可以包括第四客户认证凭证的时间戳和第四客户认证凭证的有效时长。第五客户认证凭证还包括服务消费网元的标识和第五客户认证凭证的有效时间信息中的一项或多项，第五客户认证凭证的有效时间信息指示第五客户认证凭证的有效时间。例如，第五客户认证凭证的有效时间信息包括第五客户认证凭证的时间戳，第五客户认证凭证的过期时间。或者，第五客户认证凭证的有效时间信息可以包括第五客户认证凭证的时间戳和第五客户认证凭证的有效时长。
在服务通信代理请求第二服务早于请求第一服务的情况下，第五客户认证凭证的有效时间比第四客户认证凭证的有效时间短。示例性地，在服务通信代理请求第二服务早于请求第一服务的情况下，第五客户认证凭证的有效时间与第一时长关联，第一时长是服务消费网元与服务通信代理的传输时延以及服务通信代理与提供第二服务的网元的传输时延确定的。例如，服务消费网元与服务通信代理的传输时延记为T 1，服务通信代理与提供第二服务的网元的传输时延记为T 2。上述传输时延可以为传输时延的平均值或略大于传输时延的平均值。第一时长＝T 1+T 2。例如，第一客户认证凭证的过期时间可以由时间戳、第一时长和预设时长确定。这里的预设时长可以根据经验值确定。
在服务通信代理请求第二服务晚于请求第一服务的情况下，第五客户认证凭证的有效 时间比第四客户认证凭证的有效时间长。
上述针对第四客户认证凭证的有效时间和第五客户认证凭证的有效时间的配置规则可以尽量保证第四客户认证凭证和第五客户认证凭证不被服务通信代理恶意使用，进而保证通信过程的安全性。
可以理解的是，在服务消费网元向服务通信代理发送第一服务请求消息之前，服务消费网元还需要判断本地是否存储可用的客户认证凭证，若存储可用的客户认证凭证(例如，保存有未过期的客户认证凭证)，则使用该可用的客户认证凭证作为第四客户认证凭证。若未存储可用的客户认证凭证(例如，保存的客户认证凭证已过期或未存储客户认证凭证)，则服务消费网元生成该第四客户认证凭证。此外，当存在已过期的客户认证凭证时，服务消费网元可以删除已过期的客户认证凭证。因此，服务消费网元可以通过删除已过期的客户认证凭证，释放存储空间，减轻系统的存储负担。同理，适用于第五客户认证凭证，此处不再赘述。
其中，提供第二服务的网元的网络功能类型可以为网络存储功能网元的网络功能类型。
其中，触发服务消费网元向服务通信代理发送第一服务请求消息的几种场景可以具体参考图8所示实施例的相关内容，重复之处不再赘述。
步骤1002：服务通信代理接收来自于服务消费网元的第一服务请求消息，服务通信代理向网络存储功能网元发送第二服务请求消息，第二服务请求消息用于请求第二服务，第二服务请求消息包括第五客户认证凭证。
服务通信代理确定请求第一服务触发请求第二服务可以参考上述步骤902，重复之处不再赘述。
其中，在服务通信代理确定请求第一服务触发请求第二服务之后，服务通信代理根据网络存储功能网元的网络功能类型向网络存储功能网元发送第二服务请求消息，第二服务请求消息包括第五客户认证凭证。
示例性地，服务通信代理确定需要向网络存储功能网元请求第一服务对应的访问令牌，根据网络存储功能网元的网络功能类型从第四客户认证凭证和第五客户认证凭证中选择第五客户认证凭证添加至第二服务请求消息。或者，服务通信代理确定需要向网络存储功能网元请求服务提供网元的信息，则根据网络存储功能网元的网络功能类型从第四客户认证凭证和第五客户认证凭证中选择第五客户认证凭证添加至第二服务请求消息。
步骤1003：网络存储功能网元接收来自于服务通信代理的第二服务请求消息，网络存储功能网元根据第五客户认证凭证认证服务消费网元。
网络存储功能网元确定服务消费网元认证成功。具体的，网络存储功能网元验证第五客户认证凭证的签名通过、根据第五客户认证凭证包括的时间戳和/或第五客户认证凭证的过期时间验证第五客户认证凭证未过期、验证第五客户认证凭证中的服务消费网元的标识与用于签名第五客户认证凭证的证书中的网元的标识相同、验证第二网络功能类型与网络存储功能网元的网络功能类型匹配，则网络存储功能网元确定服务消费网元认证成功。
步骤1004：网络存储功能网元向服务通信代理发送针对第二服务请求消息的响应消息。
示例性地，若第二服务请求消息请求第一服务对应的访问令牌，则网络存储功能网元在服务消费网元认证成功后，网络存储功能网元执行授权检查，确定授权通过，则网络存储功能网元生成第一服务对应的访问令牌。网络存储功能网元向服务通信代理发送针对第二服务请求消息的响应消息。针对第二服务请求消息的响应消息包括第一服务对应的访问 令牌。
示例性地，若第二服务请求消息请求服务提供网元的信息，则网络存储功能网元在服务消费网元认证成功后，向服务通信代理发送针对第二服务请求消息的响应消息，针对第二服务请求消息的响应消息包括服务提供网元的信息。
可选的，网络存储功能网元在服务消费网元认证失败的情况下，网络存储功能网元向服务通信代理发送针对第二服务请求消息的响应消息，用于指示请求所述第二服务失败。
步骤1005：服务通信代理接收来自于网络存储功能网元的针对第二服务请求消息的响应消息，服务通信代理根据针对第二服务请求消息的响应消息向服务提供网元发送第三服务请求消息，第三服务请求消息用于请求第一服务，第三服务请求消息包括第四客户认证凭证。
可以理解的是，第三服务请求消息还包括第一服务对应的访问令牌。
示例性地，服务通信代理确定服务消费网元请求第一服务，根据服务提供网元的类型从第四客户认证凭证和第五客户认证凭证中选择第四客户认证凭证添加至第三服务请求消息。
示例性地，在针对第二服务请求消息的响应消息包括第一服务对应的访问令牌时，服务通信代理向服务提供网元发送第三服务请求消息，第三服务请求消息用于请求第一服务，第三服务请求消息包括第四客户认证凭证和第一服务对应的访问令牌。或者在针对第二服务请求消息的响应消息包括服务提供网元的信息时，服务通信代理向服务提供网元的信息指示的服务提供网元发送第三服务请求消息，第三服务请求消息用于请求第一服务，第三服务请求消息包括第四客户认证凭证和第一服务对应的访问令牌。此时的第一服务对应的访问令牌可以是服务通信代理已存储的或第一服务请求消息携带的。
步骤1006：服务提供网元接收来自于服务通信代理的第三服务请求消息，服务提供网元根据第四客户认证凭证认证服务消费网元。
可以理解的是，服务提供网元还需验证第一服务对应的访问令牌，具体可以参考上述关于access token的验证过程，此处不再赘述。
服务提供网元确定服务消费网元认证成功。具体的，服务提供网元验证第四客户认证凭证的签名通过、根据第四客户认证凭证包括的时间戳和/或第四客户认证凭证的过期时间验证第四客户认证凭证未过期、验证第四客户认证凭证中的服务消费网元的标识与用于签名第四客户认证凭证的证书中的网元的标识相同、验证第一网络功能类型与服务提供网元的网络功能类型匹配，则服务提供网元确定服务消费网元认证成功。
步骤1007：服务提供网元向服务通信代理发送针对第三服务请求消息的响应消息。
在服务消费网元认证成功且第一服务对应的访问令牌验证成功时，针对第三服务请求消息的响应消息用于指示提供第一服务或者指示所述第三服务请求成功。或者，在服务消费网元认证失败和/或第一服务对应的访问令牌验证失败时，针对第三服务请求消息的响应消息指示第一服务请求失败。
步骤1008：服务通信代理向服务消费网元发送针对第一服务请求消息的响应消息。
当针对第三服务请求消息的响应消息用于指示提供第一服务或者指示所述第三服务请求成功时，针对第一服务请求消息的响应消息用于指示提供第一服务或者指示所述第一服务请求成功。或者，当针对第三服务请求消息的响应消息指示第一服务请求失败时，针对第一服务请求消息的响应消息指示第一服务请求失败。示例性地，服务通信代理可能会 修改一下针对第三服务请求消息的响应消息的消息头中的信息，但针对第三服务请求消息的响应消息的内容基本不变，服务通信代理主要是起到消息路由的作用。
采用上述实施例，服务消费网元向服务通信代理发送第一服务请求消息，其中，第一服务请求消息包括第四客户认证凭证和第五客户认证凭证，第四客户认证凭证包括第一网络功能类型，第五客户认证凭证包括第二网络功能类型，进而可以保证服务通信代理请求第二服务时，提供第二服务的网元对服务消费网元认证成功，进而也为服务消费网元请求第一服务提供了保障。
本申请实施例提供一种通信方法，服务消费网元向服务通信代理发送服务请求消息，该服务请求消息包括第四客户认证凭证和第五客户认证凭证，第四客户认证凭证和第五客户认证凭证分别包括不同的网络功能类型，网络存储功能网元(或服务提供网元)在接收到第四客户认证凭证和第五客户认证凭证时，根据第四客户认证凭证确定服务消费网元认证成功或根据第五客户认证凭证确定服务消费网元认证成功，即可确定对服务消费网元认证成功。以下以图11所示的实施例为例进行说明。
本申请实施例提供一种通信方法，如图11所示，该方法包括：
步骤1101：服务消费网元向服务通信代理发送第一服务请求消息，第一服务请求消息用于请求第一服务，第一服务请求消息包括第四客户认证凭证和第五客户认证凭证。
具体可以参考图10中的步骤1001，重复之处不再赘述。
步骤1102：服务通信代理接收来自于服务消费网元的第一服务请求消息，服务通信代理向网络存储功能网元发送第二服务请求消息，第二服务请求消息用于请求第二服务，第二服务请求消息包括第四客户认证凭证和第五客户认证凭证。
服务通信代理确定请求第一服务触发请求第二服务可以参考上述步骤902，重复之处不再赘述。
步骤1103：网络存储功能网元接收来自于服务通信代理的第二服务请求消息，网络存储功能网元根据第四客户认证凭证和第五客户认证凭证认证服务消费网元。
网络存储功能网元根据第四客户认证凭证和第五客户认证凭证中的一个或多个客户认证凭证对服务消费网元认证成功，则网络存储功能网元确定服务消费网元认证成功。
网络存储功能网元根据第五客户认证凭证确定服务消费网元认证成功。具体的，网络存储功能网元验证第五客户认证凭证的签名通过、根据第五客户认证凭证包括的时间戳和/或第五客户认证凭证的过期时间验证第五客户认证凭证未过期、验证第五客户认证凭证中的服务消费网元的标识与用于签名第五客户认证凭证的证书中的网元的标识相同、验证第二网络功能类型与网络存储功能网元的网络功能类型匹配，则网络存储功能网元确定服务消费网元认证成功。
网络存储功能网元根据第四客户认证凭证确定服务消费网元认证失败。具体的，网络存储功能网元验证第四客户认证凭证的签名通过、根据第四客户认证凭证包括的时间戳和/或第四客户认证凭证的过期时间验证第四客户认证凭证未过期、验证第四客户认证凭证中的服务消费网元的标识与用于签名第四客户认证凭证的证书中的网元的标识相同、验证第一网络功能类型与网络存储功能网元的网络功能类型不匹配，则网络存储功能网元确定服务消费网元认证失败。
由上可知，网络存储功能网元根据第五客户认证凭证对服务消费网元认证成功，根据第四客户认证凭证对服务消费网元认证失败，则网络存储功能网元确定服务消费认证成功。
步骤1104：在服务消费网元认证成功时，网络存储功能网元向服务通信代理发送针对第二服务请求消息的响应消息。
示例性地，若第二服务请求消息请求第一服务对应的访问令牌，则网络存储功能网元在服务消费网元认证成功后，网络存储功能网元执行授权检查，确定授权通过，则网络存储功能网元生成第一服务对应的访问令牌。网络存储功能网元向服务通信代理发送针对第二服务请求消息的响应消息。针对第二服务请求消息的响应消息包括第一服务对应的访问令牌。
示例性地，若第二服务请求消息请求服务提供网元的信息，则网络存储功能网元在服务消费网元认证成功后，向服务通信代理发送针对第二服务请求消息的响应消息，针对第二服务请求消息的响应消息包括服务提供网元的信息。
步骤1105：服务通信代理接收来自于网络存储功能网元的针对第二服务请求消息的响应消息，服务通信代理根据针对第二服务请求消息的响应消息向服务提供网元发送第三服务请求消息，第三服务请求消息用于请求第一服务，第三服务请求消息包括第四客户认证凭证和第五客户认证凭证。
可以理解的是，第三服务请求消息还包括第一服务对应的访问令牌。
示例性地，在针对第二服务请求消息的响应消息包括第一服务对应的访问令牌时，服务通信代理向服务提供网元发送第三服务请求消息，第三服务请求消息用于请求第一服务，第三服务请求消息包括第四客户认证凭证和第一服务对应的访问令牌。
示例性地，在针对第二服务请求消息的响应消息包括服务提供网元的信息时，服务通信代理向服务提供网元的信息指示的服务提供网元发送第三服务请求消息，第三服务请求消息用于请求第一服务，第三服务请求消息包括第四客户认证凭证和第一服务对应的访问令牌。此时的第一服务对应的访问令牌可以是服务通信代理已存储的或第一服务请求消息携带的。
步骤1106：服务提供网元接收来自于服务通信代理的第三服务请求消息，服务提供网元验证第四客户认证凭证和第五客户认证凭证。
可以理解的是，服务提供网元还需验证第一服务对应的访问令牌，具体可以参考上述关于access token的验证过程，此处不再赘述。
服务提供网元根据第四客户认证凭证和第五客户认证凭证中的一个或多个客户认证凭证对服务消费网元认证成功，则服务提供网元确定服务消费网元认证成功。
服务提供网元根据第四客户认证凭证确定服务消费网元认证成功。具体的，服务提供网元验证第四客户认证凭证的签名通过、根据第四客户认证凭证包括的时间戳和/或第四客户认证凭证的过期时间验证第四客户认证凭证未过期、验证第四客户认证凭证中的服务消费网元的标识与用于签名第四客户认证凭证的证书中的网元的标识相同、验证第一网络功能类型与服务提供网元的网络功能类型匹配，则服务提供网元确定服务消费网元认证成功。
服务提供网元根据第五客户认证凭证确定服务消费网元认证失败。具体的，服务提供网元验证第五客户认证凭证的签名通过、根据第五客户认证凭证包括的时间戳和/或第五客户认证凭证的过期时间验证第五客户认证凭证未过期、验证第五客户认证凭证中的服务消费网元的标识与用于签名第五客户认证凭证的证书中的网元的标识相同、验证第二网络功能类型与服务提供网元的网络功能类型不匹配，则服务提供网元确定服务消费网元认证失败。
由上可知，服务提供网元根据第四客户认证凭证对服务消费网元认证成功，根据第五客户认证凭证对服务消费网元认证失败，则服务提供网元确定服务消费认证成功。
步骤1107：服务提供网元向服务通信代理发送针对第三服务请求消息的响应消息。
步骤1108：服务通信代理向服务消费网元发送针对第一服务请求消息的响应消息。
其中步骤1107与步骤1108分别图10实施例中步骤1007以及步骤1008相同，不再赘述。
相比图10的实施例，图11的实施例中服务通信代理不需要根据请求服务的对象不同，在服务请求消息中携带不同的CCA，简化了服务通信代理的处理逻辑。此外，因为服务通信代理在接收到服务消费网元的服务请求之后，不管是向网络存储功能网元请求第二服务还是向服务提供网元请求第一服务，都是同时携带了两个CCA，因此总能够保证网络存储功能网元和服务提供网元认证服务消费网元成功，从而避免了服务消费网元请求服务失败的问题。
本申请实施例提供一种通信方法，在服务通信代理请求第二服务失败时，服务通信代理可以主动向服务消费网元请求客户认证凭证，以保障服务通信代理能够获取第二服务，进而保障服务消费网元获取第一服务。
本申请实施例提供一种通信方法，如图12所示，该方法包括：
步骤1201：服务消费网元向服务通信代理发送服务请求消息1，服务请求消息1用于请求第一服务，服务请求消息1包括客户认证凭证A，客户认证凭证A包括第一网络功能类型，客户认证凭证A用于服务提供网元认证服务消费网元。第一网络功能类型为服务提供网元的网络功能类型。
需要说明的是，此时客户认证凭证A不包括第二网络功能类型。其中，第二网络功能类型为提供第二服务的网元的网络功能类型，第二服务与第一服务关联。
步骤1202：服务通信代理向网络存储功能网元发送服务请求消息2，服务请求消息2用于请求第二服务，服务请求消息2包括客户认证凭证A。网络存储功能网元用于提供第二服务。
步骤1203：网络存储功能网元根据客户认证凭证A确定服务消费网元认证失败。
步骤1204：网络存储功能网元向服务通信代理发送针对服务请求消息2的响应消息。
上述步骤1201至步骤1204分别参考图9实施例中步骤901至904相同，不再赘述。
步骤1205：服务通信代理根据针对服务请求消息2的响应消息向服务消费网元发送客户认证凭证请求消息。
客户认证凭证请求消息可以指示第一服务请求失败。客户认证凭证请求消息还可以包括指示信息。
在一些实施例中，该指示信息可以包括客户认证凭证B和/或原因值。其中，当指示信息包括客户认证凭证B时，可以避免服务通信代理恶意触发服务消费网元请求客户认证凭证。
在一些实施例中，服务通信代理还可以根据针对服务请求消息2的响应消息生成指示信息，指示信息也可以不包括客户认证凭证B或原因值，该指示信息可以指示服务消费网元请求客户认证凭证并在请求客户认证凭证时携带包括网络存储功能网元的网络功能类型的客户认证凭证。
步骤1206：服务消费网元根据指示信息，向服务通信代理发送针对客户认证凭证请求消息的响应消息。
在一些实施例中，在指示信息包括客户认证凭证B且客户认证凭证B包括网络存储功能网元的网络功能类型时，服务消费网元可以验证客户认证凭证B，在客户认证凭证B验证成功时，服务消费网元向服务通信代理发送针对客户认证凭证请求消息的响应消息，针对客户认证凭证请求消息的响应消息包括客户认证凭证C，客户认证凭证C包括第一网络功能类型和第二网络功能类型，或者客户认证凭证C包括第二网络功能类型，第一网络功能类型为服务提供网元的网络功能类型，第二网络功能类型为提供第二服务的网元的网络功能类型。
步骤1207：服务通信代理接收来自于服务消费网元的针对客户认证凭证请求消息的响应消息，服务通信代理向网络存储功能网元发送服务请求消息3，服务请求消息3用于请求第二服务，服务请求消息3包括客户认证凭证C。
示例性地，在未存储可用的第一服务对应的访问令牌且第一服务请求消息未包括第一服务对应的访问令牌的情况下，服务通信代理向网络存储功能网元发送服务请求消息3，服务请求消息3用于请求第一服务对应的访问令牌。
或者，在未存储服务提供网元的信息且第一服务请求消息未包括服务提供网元的信息的情况下，服务通信代理向网络存储功能网元发送服务请求消息3，服务请求消息3用于请求服务提供网元的信息。
步骤1208：网络存储功能网元接收来自于服务通信代理的服务请求消息3，网络存储功能网元根据客户认证凭证C认证服务消费网元。
若客户认证凭证C包括第一网络功能类型和第二网络功能类型，网络存储功能网元确定在第一网络功能类型和第二网络功能类型中存在与网络存储功能网元的网络功能类型匹配的网络功能类型，则网络存储功能网元确定客户认证凭证C验证成功。其中，第二网络功能类型与网络存储功能网元的网络功能类型匹配。具体的，网络存储功能网元验证客户认证凭证C的签名通过、根据客户认证凭证C包括的时间戳和/或客户认证凭证C的过期时间验证客户认证凭证C未过期、验证客户认证凭证C中的服务消费网元的标识与用于签名客户认证凭证C的证书中的网元的标识相同、验证第一网络功能类型和第二网络功能类型中的第二网络功能类型与网络存储功能网元的网络功能类型匹配，则网络存储功能网元确定服务消费网元认证成功。
若客户认证凭证C包括第二网络功能类型，网络存储功能网元验证客户认证凭证C的签名通过、根据客户认证凭证C包括的时间戳和/或客户认证凭证C的过期时间验证客户认证凭证C未过期、验证客户认证凭证C中的服务消费网元的标识与用于签名客户认证凭证C的证书中的网元的标识相同、验证第二网络功能类型与网络存储功能网元的网络功能类型匹配，则网络存储功能网元确定服务消费网元认证成功。
步骤1209：在服务消费网元认证成功时，网络存储功能网元向服务通信代理发送针对服务请求消息3的响应消息。
示例性地，若服务请求消息请求3第一服务对应的访问令牌，则网络存储功能网元在服务消费网元认证成功后，网络存储功能网元执行授权检查，确定授权通过，则网络存储功能网元生成第一服务对应的访问令牌。网络存储功能网元向服务通信代理发送针对服务请求消息3的响应消息。针对服务请求消息3的响应消息包括第一服务对应的访问令牌。
示例性地，若服务请求消息3请求服务提供网元的信息，则网络存储功能网元在服务消费网元认证成功后，向服务通信代理发送针对服务请求消息3的响应消息，针对服务请求消息3的响应消息包括服务提供网元的信息。
步骤1210：服务通信代理接收来自于网络存储功能网元的针对服务请求消息3的响应消息，服务通信代理根据针对服务请求消息3的响应消息向服务提供网元发送服务请求消息4，服务请求消息4用于请求第一服务，服务请求消息4包括客户认证凭证A或客户认证凭证C。
可以理解的是，服务请求消息4还包括第一服务对应的访问令牌。
示例性地，在针对服务请求消息3的响应消息包括第一服务对应的访问令牌时，服务通信代理向服务提供网元发送服务请求消息4，服务请求消息4用于请求第一服务，服务请求消息4包括第一客户认证凭证和第一服务对应的访问令牌。
示例性地，在针对服务请求消息3的响应消息包括服务提供网元的信息时，服务通信代理向服务提供网元的信息指示的服务提供网元发送服务请求消息4，服务请求消息4用于请求第一服务，服务请求消息4包括第一客户认证凭证和第一服务对应的访问令牌。此时的第一服务对应的访问令牌可以是服务通信代理已存储的或服务请求消息1携带的。
步骤1211：服务提供网元接收来自于服务通信代理的服务请求消息4，服务提供网元根据客户认证凭证A或客户认证凭证C认证NF服务consumer。
可以理解的是，服务提供网元还需验证第一服务对应的访问令牌，具体可以参考上述关于access token的验证过程，此处不再赘述。
若服务请求消息4包括客户认证凭证C，服务提供网元确定在第一网络功能类型和第二网络功能类型中存在与服务提供网元的网络功能类型匹配的网络功能类型，则服务提供网元根据客户认证凭证C确定服务消费网元认证成功。其中，第一网络功能类型与服务提供网元的网络功能类型匹配。具体的，服务提供网元验证客户认证凭证C的签名通过、根据客户认证凭证C包括的时间戳和/或客户认证凭证C的过期时间验证客户认证凭证C未过期、验证客户认证凭证C中的服务消费网元的标识与用于签名客户认证凭证C的证书中的网元的标识相同、验证第一网络功能类型和第二网络功能类型中的第一网络功能类型与服务提供网元的网络功能类型匹配，则服务提供网元确定服务消费网元认证成功。
若服务请求消息4包括客户认证凭证A，服务提供网元验证客户认证凭证A的签名通过、根据客户认证凭证A包括的时间戳和/或客户认证凭证A的过期时间验证客户认证凭证A未过期、验证客户认证凭证A中的服务消费网元的标识与用于签名客户认证凭证A的证书中的网元的标识相同、验证第一网络功能类型与服务提供网元的网络功能类型匹配，则服务提供网元确定服务消费网元认证成功。
步骤1212：服务提供网元向服务通信代理发送针对服务请求消息4的响应消息。
在服务消费网元认证成功且第一服务对应的访问令牌验证成功时，针对服务请求消息4的响应消息用于指示提供第一服务或者指示所述服务请求4成功。或者，在服务消费网元认证失败和/或第一服务对应的访问令牌验证失败时，针对服务请求消息4的响应消息指示第一服务请求失败。
步骤1213：服务通信代理向服务消费网元发送针对服务请求消息1的响应消息。
当针对服务请求消息4的响应消息用于指示提供第一服务或者指示所述服务请求4成功时，针对服务请求消息1的响应消息用于指示提供第一服务或者指示服务请求1成功。 或者，当针对服务请求消息4的响应消息指示第一服务请求失败时，针对服务请求消息1的响应消息指示第一服务请求失败。
采用上述实施例，服务通信代理向服务消费网元发送客户认证凭证请求消息，进而可以保证服务通信代理请求第二服务时，提供第二服务的网元对服务消费网元认证成功，进而也为服务消费网元请求第一服务提供了保障。
[根据细则91更正 31.05.2022]　
以下结合具体实施例1至实施例8对上述图8至图12所示的实施例进行举例说明。
实施例1：结合图8所示实施例，在确定需要请求第一服务且不存在可用的第一服务对应的access token时，NF服务consumer可以采用但不限于以下实施例获取第一服务，如图13所示。
步骤1301：NF服务consumer确定请求第一服务且不存在第一服务对应的可用的access token，NF服务consumer获取CCA，第一服务对应的access token表征/指示NF服务consumer具有获取第一服务的权限或访问第一服务的权限。
可以理解的是，NF服务consumer还可以在步骤1301之前确定当前间接通信模式为模式D。
在NF服务consumer确定请求第一服务之后，NF服务consumer检查本地是否存储第一服务对应的access token。NF服务consumer确定不存在第一服务对应的可用的access token是指NF服务consumer确定未存储第一服务对应的access token或存储的第一服务对应的access token已过期。进一步地，当NF服务consumer确定存储的第一服务对应的access token已过期时，NF服务consumer删除已过期的第一服务对应的access token。
示例性地，NF服务consumer可以接收UE的服务请求消息，根据该服务请求消息确定需要请求第一服务。NF服务consumer根据UE的标识获取UE的相关信息(例如UE的上下文信息)，进一步地，NF服务consumer检查公共存储空间是否包括与第一服务对应的access token。若包括第一服务对应的access token且该access token未过期，则使用该access token；若不包括第一服务对应的access token则确定不存在可用的access token；或若包括第一服务对应的access token但该access token已过期，确定不存在可用的access token，进一步可选的，NF服务consumer删除该access token。其中，UE的相关信息可以存储在NF服务consumer的公共存储空间，或者，NF服务consumer根据UE的标识从其他网元获取的UE的相关信息。
此外，NF服务consumer还需要判断本地是否存储可用的CCA，若存储可用的CCA(例如，CCA未过期)，则使用该CCA。若未存储可用的CCA(例如，CCA已过期或未存储CCA)，则NF服务consumer生成CCA。此外，当CCA已过期时，NF服务consumer删除已过期的CCA。
其中，CCA包括第一NF type和第二NF type，其中，第一NF type为期望提供第一服务的NF服务producer的NF type，第二NF type为期望提供access token的NRF的NF type。
此外，该CCA还包括NF服务consumer的NF实例的标识，时间戳，过期时间。
步骤1302：NF服务Consumer向SCP发送第一服务请求消息，第一服务请求消息包括步骤1301中的CCA和用于获取access token的参数。第一服务请求消息用于请求第一服务。
用于获取access token的参数可以与用于发现NF服务producer的参数相同，也可以全部不同或部分不同。用于获取access token的参数可以与用于发现NF服务producer的参数 可以使用同一个信元指示或者使用不同的信元指示。示例性地，若两者全部相同，可以使用同一个信元指示。若两者全部不同，则第一服务请求消息中还包含用于发现NF服务producer的参数。若部分不同，则第一服务请求消息中还包括剩余的用于发现NF服务producer的参数。
例如，用于获取access token的参数可以包括期望的服务名称、NF服务consumer的NF type和期望的NF服务producer的NF type，期望的NF服务producer实例的S-NSSAI列表或NSI ID列表、期望的NF服务producer实例的NF Set ID、NF服务consumer的S-NSSAI列表等。用于发现NF服务producer的参数可以包括期望的NF服务producer的NF type，期望的NF服务producer实例的S-NSSAI列表或NSI ID列表。此时，用于获取access token的参数可以与用于发现NF服务producer的参数部分相同。
步骤1303：SCP向NRF发送access token请求消息,access token请求消息包括CCA和用于获取access token的参数。
在SCP向NRF发送access token请求消息之前，SCP确定第一服务请求消息不包括第一服务对应的access token且本地未存储第一服务对应的access token或SCP确定第一服务请求消息不包括第一服务对应的access token且存储的第一服务对应的access token过期。若判断存储的第一服务对应的access token过期，SCP删除过期的第一服务对应的access token。
此外，可以理解的是，若第一服务对应的access token为类型B的access token，则SCP还需在步骤1303之前发起NF服务Producer的发现流程。否则，SCP可以在获取第一服务对应的access token之后发起NF服务Producer的发现流程。或者，当本地存储有NF服务Producer的信息时，SCP可以不发起NF服务Producer的发现流程。
其中，access token请求消息可以为NNrf_AccessToken_Get_Request或者其他消息，本申请实施例对此不做限定。
步骤1304：NRF接收access token请求消息，NRF根据CCA认证NF服务Consumer。
NRF根据CCA对NF服务Consumer认证成功，NRF执行授权检查，确定授权通过，生成第一服务对应的access token。
其中，NRF验证CCA的签名，根据时间戳和/或CCA的过期时间验证CCA是否过期，验证CCA中的NF服务consumer的NF实例ID与用于签名CCA的证书中的NF实例ID是否匹配。除上述验证内容均验证成功之外，NRF还需要验证CCA包括的第一NF type和第二NF type是否存在与NRF的NF type相同的NF type，当NRF确定第二NF type与NRF的NF type匹配，则NRF确定NF服务Consumer认证成功。
步骤1305：NRF向SCP发送access token响应消息，access token响应消息包括第一服务对应的access token。
步骤1306：SCP向NF服务producer发送第二服务请求消息。第二服务请求消息包括第一服务对应的access token和CCA。
步骤1307：NF服务producer接收来自于SCP的第二服务请求消息。NF服务producer根据CCA认证NF服务Consumer。
NF服务producer对第一服务对应的access token执行完整性验证，若完整性验证成功，则进一步验证第一服务对应的access token中的claims，详见上述access token中的claims验证的相关内容。
NF服务producer还需要根据CCA认证NF服务consumer。其中，NF服务producer验证CCA的签名，根据时间戳和/或CCA的过期时间验证CCA是否过期，验证CCA中的NF服务consumer的NF实例ID与用于签名CCA的证书中的NF实例ID是否匹配，除上述验证内容均验证成功之外，NF服务producer还需要验证CCA包括的第一NF type和第二NF type是否存在与NF服务producer的NF type匹配的NF type，当NF服务producer确定第一NF type与NF服务producer的NF type匹配，则NF服务producer确定NF服务consumer认证成功。
上述验证access token和CCA顺序也可以为先验证CCA，验证成功之后再验证access token，此处不做限定。
此外NF服务producer还检查CCA中的NF服务consumer的NF实例Id与access token中包含NF服务consumer的NF实例Id是否相同，若相同，则为NF服务consumer提供请求的服务。
步骤1308：NF服务producer确定第一acess token验证成功且NF服务consumer认证成功，则NF服务producer向SCP发送针对第二服务请求消息的响应消息。针对第二服务请求消息的响应消息用于指示提供第一服务或者指示所述第二服务请求成功。
可以理解的是，若第一access token验证失败和/或NF服务consumer认证失败，针对第二服务请求消息的响应消息指示第一服务请求失败。
步骤1309：SCP接收来自于NF服务producer的针对第二服务请求消息的响应消息，并向NF服务consumer发送针对第一服务请求消息的响应消息。
针对第二服务请求消息的响应消息可以包括第一服务对应的access token。NF服务Consumer存储第一服务对应的access token，用于后续发起请求第一服务。
此外，若NF服务consumer确定存在可用的第一服务对应的access token，则NF服务consumer可以判断是否存储可用的CCA，若存储可用的CCA，则使用该CCA，若未存储可用的CCA，则生成CCA。可以理解的是，此时CCA可以不包括第二NF type。但是，若NF服务consumer在步骤1301之前确定当前间接通信模式为模式D，则第一服务请求消息需要携带第一NF type和第二NF type。
采用上述实施例CCA包括第一NF type和第二NF type，进而可以保证NRF和NF服务producer根据CCA对NF服务consumer认证成功，进而保障了NF服务consumer获取第一服务。
实施例2：结合图10所示实施例，在确定需要请求第一服务且不存在可用的第一服务对应的access token时，NF服务consumer可以采用但不限于以下实施例获取第一服务，如图14所示。
步骤1401：NF服务consumer确定请求第一服务且不存在可用的第一服务对应的access token，NF服务consumer获取CCA1和CCA2，第一服务对应的access token表征/指示NF服务consumer具有获取第一服务的权限或访问第一服务的权限。
可以理解的是，NF服务consumer还可以在步骤1401之前确定当前间接通信模式为模式D。NF服务consumer确定请求第一服务且不存在可用的第一服务对应的access token具体可以图13中的步骤1301中的相关描述，重复之处不再赘述。
此外，NF服务consumer需要判断本地是否存储可用的CCA1和CCA2。若存储可用 的CCA1(例如，CCA1未过期)，则使用该CCA1。若未存储可用的CCA1(例如，CCA1已过期)，则NF服务consumer生成CCA1。若存储可用的CCA2(例如，CCA2未过期或未存储CCA2)，则使用该CCA2。若未存储可用的CCA2(例如，CCA2已过期或未存储CCA2)，则NF服务consumer生成CCA2。其中，当CCA1或CCA2过期时，NF服务consumer删除过期的CCA。
其中，CCA1包括第一NF type，CCA2包括第二NF type，其中，第一NF type为期望提供第一服务的NF服务producer的NF type，第二NF type为期望提供access token的NRF的NF type。
此外，CCA1还包括NF服务consumer的NF实例的标识，时间戳，CCA1的过期时间。CCA2还包括NF服务consumer的NF实例的标识，时间戳，CCA2的过期时间。
步骤1402：NF服务Consumer向SCP发送第一服务请求消息，第一服务请求消息包括步骤1401中CCA1和CCA2和用于获取access token的参数。第一服务请求消息用于请求第一服务。
关于用于获取access token的参数可以与用于发现NF服务producer的参数可以参考实施例1中的步骤1402，重复之处不再赘述。
步骤1403：SCP向NRF发送access token请求消息,access token请求消息包括CCA2和用于获取access token的参数。
在SCP向NRF发送access token请求消息之前，SCP确定第一服务请求消息不包括第一服务对应的access token且本地未存储第一服务对应的access token或SCP确定第一服务请求消息不包括第一服务对应的access token且存储的第一服务对应的access token过期。若判断存储的第一服务对应的access token过期，SCP删除过期的第一服务对应的access token。
由于SCP需要向NRF发送access token请求消息，因此，SCP选择CCA2添加至access token请求消息中。
此外，可以理解的是，若第一服务对应的access token为类型B的access token，则SCP还需在步骤1403之前发起NF服务producer的发现流程。否则，SCP可以在获取第一服务对应的access token之后发起NF服务producer的发现流程。或者，当本地存储有NF服务Producer的信息时，SCP可以不发起NF服务Producer的发现流程。
示例性地，access token请求消息可以为NNrf_AccessToken_Get_Request或者其他消息，本申请实施例对此不做限定。
步骤1404：NRF接收access token请求消息，NRF根据CCA2认证NF服务consumer。
NRF根据CCA2对NF服务Consumer认证成功，NRF执行授权检查，确定授权通过，生成第一服务对应的access token。
其中，NRF验证CCA2的签名，根据时间戳和/或CCA2的过期时间验证CCA2是否过期，验证CCA2中的NF服务consumer的NF实例ID与用于签名CCA2的证书中的NF实例ID是否匹配。除上述验证内容均验证成功之外，NRF还需要验证CCA2包括的第二NF type是否与NRF的NF type相同。由于第二NF type与NRF的NF type匹配，则NRF确定CCA2验证成功。
步骤1405：NRF向SCP发送access token响应消息，access token响应消息包括第一服务对应的access token。
步骤1406：SCP向NF服务producer发送第二服务请求消息。第二服务请求消息包括第一服务对应的access token和CCA1。
由于SCP需要向NF服务producer发送第二服务请求消息，因此，SCP选择CCA1添加至第二服务请求消息中。
步骤1407：NF服务producer接收来自于SCP的第二服务请求消息，NF服务producer验证CCA1和第一服务对应的access token。
NF服务producer对第一服务对应的access token执行完整性验证，若完整性验证成功，则进一步验证第一服务对应的access token中的claims，详见上述access token中的claims验证的相关内容。
NF服务producer还需要根据CCA1认证NF服务consumer。其中，NF服务producer验证CCA1的签名，根据时间戳和/或CCA1的过期时间验证CCA1是否过期，验证CCA1中的NF服务consumer的NF实例ID与用于签名CCA1的证书中的NF实例ID是否匹配。除上述验证内容均验证成功之外，NF服务consumer还需要验证CCA1包括的第一NF type是否与NF服务producer的NF type匹配。由于第一NF type与NF服务producer的NF type匹配，则确定NF服务consumer认证成功。
上述验证access token和CCA1顺序也可以为先验证CCA1，验证成功之后再验证access token，此处不做限定。
在access token和CCA1都验证成功之后，NF服务producer还检查CCA1中的NF服务consumer的NF实例Id与access token中包含NF服务consumer的NF实例Id是否相同，若相同，则为NF服务consumer提供请求的服务。
步骤1408：NF服务producer确定第一acess token且NF服务consumer认证成功，则NF服务producer向SCP发送针对第二服务请求消息的响应消息。针对第二服务请求消息的响应消息用于指示提供第一服务或者指示所述第二服务请求成功。
可以理解的是，若第一access token验证失败和/或NF服务consumer认证失败，针对第二服务请求消息的响应消息指示第一服务请求失败。
步骤1409：SCP接收来自于NF服务producer的针对第二服务请求消息的响应消息，并向NF服务consumer发送针对第一服务请求消息的响应消息。
针对第一服务请求消息的响应消息可以包括第一服务对应的access token。NF服务Consumer存储第一服务对应的access token，用于后续发起请求第一服务。
此外，若NF服务consumer确定存在可用的第一服务对应的access token，则NF服务consumer可以判断是否存储可用的CCA1，若存储可用的CCA1，则使用该CCA1，若未存储可用的CCA1，则生成CCA1。可以理解的是，此时NF服务consumer不需要判断是否存储可用的CCA2，即使未存储可用的CCA2，也不需要生成CCA2，也不需要通过SCP获取第一服务对应的access token，第一服务请求消息可以不包括CCA2。但是，若NF服务consumer在步骤1401之前确定当前间接通信模式为模式D，则第一服务请求消息需要携带CCA1和CCA2。
采用上述实施例CCA1包括第一NF type，CCA2包括第二NF type，进而可以保证NRF根据CCA2对NF服务consumer认证成功，NF服务producer根据CCA1对NF服务consumer认证成功，进而保障了NF服务consumer获取第一服务。
实施例3：结合图11所示实施例，在确定需要请求第一服务且不存在可用的第一服务 对应的access token时，NF服务consumer可以采用但不限于以下实施例获取第一服务，如图15所示。
步骤1501和步骤1502可以参考图14中的步骤1401和步骤1402重复之处不再赘述。
步骤1503：SCP向NRF发送access token请求消息,access token请求消息包括CCA2和CCA1和用于获取access token的参数。
在SCP向NRF发送access token请求消息之前，SCP确定第一服务请求消息不包括第一服务对应的access token且本地未存储第一服务对应的access token或SCP确定第一服务请求消息不包括第一服务对应的access token且存储的第一服务对应的access token过期。若判断存储的第一服务对应的access token过期，SCP删除过期的第一服务对应的access token。
此外，可以理解的是，若第一服务对应的access token为类型B的access token，则SCP还需在步骤1503之前发起NF服务producer的发现流程。否则，SCP可以在获取第一服务对应的access token之后发起NF服务producer的发现流程。或者，当本地存储有NF服务Producer的信息时，SCP可以不发起NF服务producer的发现流程。
示例性地，access token请求消息可以为NNrf_AccessToken_Get_Request或者其他消息，本申请实施例对此不做限定。
步骤1504：NRF接收access token请求消息，NRF根据CCA1和CCA2认证NF服务consumer。
NRF根据CCA1对NF服务consumer认证成功或根据CCA2对NF服务consumer认证成功，NRF执行授权检查，确定授权通过，生成第一服务对应的access token。
NRF根据CCA1和CCA2认证NF服务consumer，此时不需要NRF根据CCA1确定NF服务consumer认证成功且根据CCA2确定NF服务consumer认证成功，当根据CCA1确定NF服务consumer认证成功或根据CCA2确定NF服务consumer认证成功时，则NRF确定NF服务consumer认证成功。
其中，NRF验证CCA1的签名，根据时间戳和/或CCA1的过期时间验证CCA1是否过期，验证CCA1中的NF服务consumer的NF实例ID与用于签名CCA1的证书中的NF实例ID是否匹配。除上述验证内容均验证成功之外，NRF还需要验证CCA1包括的第一NF type是否与NRF的NF type匹配，由于第一NF type与NRF的NF type不匹配，则NRF确定NF服务consumer认证失败。
NRF验证CCA2的签名，根据时间戳和/或CCA2的过期时间验证CCA2是否过期，验证CCA2中的NF服务consumer的NF实例ID与用于签名CCA2的证书中的NF实例ID是否匹配。除上述验证内容均验证成功之外，NRF还需要验证CCA2包括的第二NF type是否与NRF的NF type匹配，由于第二NF type与NRF的NF type匹配，则NRF确定NF服务consumer认证成功。
步骤1505：NRF向SCP发送access token响应消息，access token响应消息包括第一服务对应的access token。
步骤1506：SCP向NF服务producer发送第二服务请求消息。第二服务请求消息包括第一服务对应的access token、CCA1和CCA2。
步骤1507：NF服务producer接收来自于SCP的第二服务请求消息。NF服务producer验证CCA1、CCA2和access token。
NF服务producer对第一服务对应的access token执行完整性验证，若完整性验证成功，则进一步验证第一服务对应的access token中的claims，详见上述access token中的claims验证的相关内容。
NF服务producer根据CCA1和CCA2认证NF服务consumer，此时不需要NF服务producer根据CCA1确定NF服务consumer认证成功且根据CCA2确定NF服务consumer认证成功，NF服务producer根据CCA1确定NF服务consumer认证成功或根据CCA2确定NF服务consumer认证成功时，则NF服务producer确定NF服务consumer认证成功。
其中，NF服务producer验证CCA1的签名，根据时间戳和/或CCA1的过期时间验证CCA1是否过期，验证CCA1中的NF服务consumer的NF实例ID与用于签名CCA的证书中的NF实例ID是否匹配。除上述验证内容均验证成功之外，NF服务producer还需要验证CCA1包括的第一NF type是否与NF服务producer的NF type匹配，第一NF type与NF服务producer的NF type匹配，则NF服务producer确定NF服务consumer认证成功。
其中，NF服务producer验证CCA2的签名，根据时间戳和/或CCA2的过期时间验证CCA2是否过期，验证CCA2中的NF服务consumer的NF实例ID与用于签名CCA2的证书中的NF实例ID是否匹配。除上述验证内容均验证成功之外，NF服务producer还需要验证CCA2包括的第二NF type是否与NF服务producer的NF type匹配，由于第二NF type为期望提供第一服务对应的access token的NF服务producer的NF type，第二NF type与NF服务producer的NF type不匹配，则NF服务producer确定NF服务consumer认证失败。
步骤1508：NF服务producer确定第一acess token验证成功且NF服务consumer认证成功，则NF服务producer向SCP发送针对第二服务请求消息的响应消息。针对第二服务请求消息的响应消息用于指示提供第一服务或者指示所述第二服务请求成功。
可以理解的是，若第一access token验证失败和/或NF服务consumer认证失败，针对第二服务请求消息的响应消息指示第一服务请求失败。
步骤1509：SCP接收来自于NF服务producer的针对第二服务请求消息的响应消息，并向NF服务consumer发送针对第一服务请求消息的响应消息。
针对第二服务请求消息的响应消息可以包括第一服务对应的access token。NF服务consumer存储第一服务对应的access token，用于后续发起请求第一服务。
采用上述实施例CCA1包括第一NF type，CCA2包括第二NF type，进而可以保证NRF根据CCA1对NF服务consumer认证成功，NF服务producer根据CCA2对NF服务consumer认证成功，进而保障了NF服务consumer获取第一服务。
实施例4：在确定需要请求第一服务且存在第一服务对应的可用的access token时，NF服务consumer可以采用但不限于以下实施例获取第一服务，如图16所示。
步骤1601：NF服务consumer确定请求第一服务且存在第一服务对应的可用的access token，NF服务consumer获取CCA，第一服务对应的access token表征/指示NF服务consumer具有获取第一服务的权限或访问第一服务的权限。
若NF服务consumer确定存在可用的第一服务对应的access token，则NF服务consumer可以进一步判断是否存储可用的CCA，若存储可用的CCA，则使用该CCA，若未存储可 用的CCA，则生成CCA。可以理解的是，此时NF服务consumer生成的CCA可以不需要包括第二NF type。
其中，CCA包括NF服务consumer的NF实例的标识，时间戳，过期时间和第一NF type，其中，第一NF type为期望提供第一服务的NF服务producer的NF type。
步骤1602：NF服务Consumer向SCP发送第一服务请求消息，第一服务请求消息包括步骤1601中的CCA和第一服务对应的access token。
步骤1603：SCP向NF服务producer发送第二服务请求消息。第二服务请求消息包括第一服务对应的access token和CCA。
在SCP向NF服务producer发送第二服务请求消息之前，SCP确定第一服务请求消息包括第一服务对应的access token或本地存储第一服务对应的access token。
步骤1604：NF服务producer接收来自于SCP的第二服务请求消息。NF服务producer根据CCA认证NF服务consumer。
其中，NF服务consumer对第一服务对应的access token执行完整性验证，若完整性验证成功，则进一步验证第一服务对应的access token中的claims，详见上述access token中的claims验证的相关内容。NF服务producer还需要根据CCA认证NF服务consumer，具体可以参考现有CCA验证过程。
NF服务producer验证CCA的签名，根据时间戳和/或CCA的过期时间验证CCA是否过期，验证CCA中的NF服务consumer的NF实例ID与用于签名CCA的证书中的NF实例ID是否匹配。除上述验证内容均验证成功之外，NF服务producer还需要验证CCA1包括的第一NF type是否与NF服务producer的NF type匹配，第一NF type与NF服务producer的NF type匹配，则NF服务producer确定NF服务consumer认证成功。
步骤1605：NF服务producer确定第一acess token验证成功且NF服务consumer认证成功，则NF服务producer向SCP发送针对第二服务请求消息的响应消息。
针对第二服务请求消息的响应消息用于指示提供第一服务或者指示所述第二服务请求成功。
可以理解的是，若第一access token验证失败和/或NF服务consumer认证失败，针对第二服务请求消息的响应消息指示第一服务请求失败。
步骤1606：SCP接收来自于NF服务producer的针对第二服务请求消息的响应消息，并向NF服务consumer发送针对第一服务请求消息的响应消息。
采用上述实施例通过判断存储可用的CCA，NF服务consumer可以仅携带第一NF type获取第一服务。
实施例5：结合图8所示实施例，在需要请求第一服务且请求第一服务触发SCP请求NF服务producer的参数(触发SCP发起NF服务producer的发现流程)时，NF服务consumer可以采用但不限于以下实施例获取第一服务，如图17所示。
步骤1701：NF服务consumer确定触发SCP发起NF服务producer的发现流程，NF服务consumer获取CCA。
可以理解的是，NF服务consumer还可以在步骤1701之前确定当前间接通信模式为模式D。
示例性地，NF服务consumer可以根据以下一项或多项确定触发SCP发起NF服务 producer的发现流程：
情况1：未存储UE的上下文。示例性地，NF服务consumer根据UE的服务请求消息确定需要请求第一服务。
情况2：未存储第一服务的上下文。
情况3：第一切片归属于服务提供网元且未存储第一切片的上下文，示例性地，NF服务consumer根据UE的服务请求消息确定需要向第一切片中的服务提供网元请求第一服务。
情况4：服务消费网元首次与服务通信代理通信。
在NF服务consumer生成CCA之前，NF服务consumer需要首先判断本地是否存储可用的CCA，若存储可用的CCA(例如，CCA未过期)，则使用该CCA。若未存储可用的CCA(例如，CCA已过期或未存储CCA)，则NF服务consumer生成CCA。当CCA过期时，NF服务consumer删除过期的CCA。
其中，CCA包括第一NF type和第二NF type，其中，第一NF type为期望提供第一服务的NF服务producer的NF type，第二NF type为期望提供NF服务producer的信息的NRF的NF type。
此外，该CCA还包括NF服务consumer的NF实例的标识，时间戳，过期时间。
步骤1702：NF服务Consumer向SCP发送第一服务请求消息，第一服务请求消息包括步骤1701中的CCA和用于发现NF服务producer的参数，第一服务请求消息用于请求第一服务。
示例性地，用于发现NF服务producer的参数可以包括期望的NF服务producer的NF type，期望的NF服务producer实例的S-NSSAI列表或NSI ID列表等。
步骤1703：SCP向NRF发送发现请求消息,发现请求消息包括CCA和用于发现NF服务producer的参数。
在SCP向NRF发送发现请求消息之前，SCP确定第一服务请求消息未包括NF服务producer的信息且本地未存储NF服务producer的信息。
这里假设定第一服务请求消息还包括第一服务对应的access token，或者SCP本地存储第一服务对应的access token。
步骤1704：NRF接收发现请求消息，NRF根据CCA认证NF服务consumer。
其中，NRF验证CCA的签名，根据时间戳和/或CCA的过期时间验证CCA是否过期，验证CCA中的NF服务consumer的NF实例ID与用于签名CCA的证书中的NF实例ID是否匹配。除上述验证内容均验证成功之外，NRF还需要验证CCA包括的第一NF type和第二NF type是否存在与NRF的NF type匹配的NF type，当NRF确定第二NF type与NRF的NF type匹配，则NRF确定NF服务consumer认证成功。
步骤1705：NRF向SCP发送发现响应消息，发现响应消息包括NF服务producer的参数。
在NF服务consumer认证成功的情况下，NRF向SCP发送发现响应消息，发现响应消息包括NF服务producer的参数。
步骤1706：SCP向NF服务producer发送第二服务请求消息。第二服务请求消息包括第一服务对应的access token和CCA。
其中，SCP向发现响应消息中NF服务producer的参数指示的NF服务producer发送第二服务请求消息。
步骤1707：NF服务producer接收来自于SCP的第二服务请求消息。NF服务producer根据CCA认证NF服务consumer。
NF服务producer对第一服务对应的access token执行完整性验证，若完整性验证成功，则进一步验证第一服务对应的access token中的claims，详见上述access token中的claims验证的相关内容。NF服务producer还需要根据CCA认证NF服务consumer。
其中，NF服务producer验证CCA的签名，根据时间戳和/或CCA的过期时间验证CCA是否过期，验证CCA中的NF服务consumer的NF实例ID与用于签名CCA的证书中的NF实例ID是否匹配，除上述验证内容均验证成功之外，NF服务producer还需要验证CCA包括的第一NF type和第二NF type是否存在与NF服务producer的NF type匹配的NF type，当NF服务producer确定第一NF type与NF服务producer的NF type匹配，则NF服务producer确定NF服务consumer认证成功。
步骤1708：NF服务producer确定第一acess token验证成功且NF服务consumer认证成功，则NF服务producer向SCP发送针对第二服务请求消息的响应消息。针对第二服务请求消息的响应消息用于指示提供第一服务或者指示所述第二服务请求成功。
可以理解的是，若第一access token验证失败和/或NF服务consumer认证失败，针对第二服务请求消息的响应消息指示第一服务请求失败。
步骤1709：SCP接收来自于NF服务producer的针对第二服务请求消息的响应消息，并向NF服务consumer发送针对第一服务请求消息的响应消息。
采用上述实施例CCA包括第一NF type和第二NF type，进而可以保证NRF和NF服务producer根据CCA对NF服务consumer认证成功，进而保障了NF服务consumer获取第一服务。
实施例6：结合图10所示实施例，在需要请求第一服务且请求第一服务触发SCP请求NF服务producer的参数(触发SCP发起NF服务producer的发现流程)时，NF服务consumer可以采用但不限于以下实施例获取第一服务，如图18所示。
步骤1801：NF服务consumer确定触发SCP执行NF服务producer的发现流程，NF服务consumer获取CCA1和CCA2。
可以理解的是，NF服务consumer还可以在步骤1801之前确定当前间接通信模式为模式D。
示例性地，NF服务consumer确定触发SCP执行NF服务producer的发现流程可以参考上述实施例5的步骤1701中的相关描述。
此外，在NF服务consumer生成CCA1和CCA2之前，NF服务consumer需要首先判断本地是否存储可用的CCA1和CCA2。若存储可用的CCA1(例如，CCA1还在过期时间内)，则使用该CCA1。若未存储可用的CCA1(例如，CCA1已过期或未存储CCA1)，则NF服务consumer生成CCA1。若存储可用的CCA2(例如，CCA2未过期)，则使用该CCA2。若未存储可用的CCA2(例如，CCA2已过期或未存储CCA2)，则NF服务consumer生成CCA2。其中，若CCA1或CCA2过期，NF服务consumer删除过期的CCA。
其中，CCA1包括第一NF type，CCA2包括第二NF type，其中，第一NF type为期望提供第一服务的NF服务producer的NF type，第二NF type为期望提供NF服务producer的信息的NRF的NF type。
此外，CCA1还包括NF服务consumer的NF实例的标识，时间戳，CCA1的过期时间。CCA2还包括NF服务consumer的NF实例的标识，时间戳，CCA2的过期时间。
步骤1802：NF服务Consumer向SCP发送第一服务请求消息，第一服务请求消息包括步骤1801中CCA1和CCA2和用于发现NF服务producer的参数。第一服务请求消息用于请求第一服务。
步骤1803：SCP向NRF发送发现请求消息,发现请求消息包括CCA2和用于发现NF服务producer的参数。
在SCP向NRF发送发现请求消息之前，SCP确定第一服务请求消息未包括NF服务producer的信息且本地未存储NF服务producer的信息。
这里假设定第一服务请求消息还包括第一服务对应的access token，或者SCP本地存储第一服务对应的access token。
由于SCP需要向NRF发送发现请求消息，因此，SCP选择CCA2添加至发现请求消息中。
步骤1804：NRF接收发现请求消息，NRF根据CCA2认证NF服务consumer。
其中，NRF验证CCA2的签名，根据时间戳和/或CCA2的过期时间验证CCA2是否过期，验证CCA2中的NF服务consumer的NF实例ID与用于签名CCA2的证书中的NF实例ID是否匹配。除上述验证内容均验证成功之外，NRF还需要验证CCA2包括的第二NF type是否与NRF的NF type匹配。由于第二NF type与NRF的NF type匹配，则NRF确定NF服务consumer认证成功。
步骤1805：NRF向SCP发送发现响应消息，发现响应消息包括NF服务producer的信息。
在NF服务consumer认证成功的情况下，NRF向SCP发送发现响应消息，发现响应消息包括NF服务producer的参数。
步骤1806：SCP向NF服务producer发送第二服务请求消息。第二服务请求消息包括第一服务对应的access token和CCA1。
其中，SCP向发现响应消息中NF服务producer的参数指示的NF服务producer发送第二服务请求消息。
由于SCP需要向NF服务producer发送第二服务请求消息，因此，SCP选择CCA1添加至第二服务请求消息中。
步骤1807：NF服务producer接收来自于SCP的第二服务请求消息。NF服务producer根据CCA1认证NF服务consumer。
NF服务producer对第一服务对应的access token执行完整性验证，若完整性验证成功，则进一步验证第一服务对应的access token中的claims，详见上述access token中的claims验证的相关内容。NF服务producer还需要根据CCA1认证NF服务consumer。
其中，NF服务producer验证CCA1的签名，根据时间戳和/或CCA1的过期时间验证CCA1是否过期，验证CCA1中的NF服务consumer的NF实例ID与用于签名CCA的证书中的NF实例ID是否匹配。除上述验证内容均验证成功之外，NF服务consumer还需要验证CCA1包括的第一NF type是否与NF服务producer的NF type匹配。由于第一NF type与NF服务producer的NF type匹配，则NF服务producer确定NF服务consumer认证成功。
步骤1808：NF服务producer确定第一acess token验证成功且NF服务consumer认证成功，则NF服务producer向SCP发送针对第二服务请求消息的响应消息。针对第二服务请求消息的响应消息用于指示提供第一服务或者指示所述第二服务请求成功。
可以理解的是，若第一access token验证失败和/或NF服务consumer认证失败，针对第二服务请求消息的响应消息指示第一服务请求失败。
步骤1809：SCP接收来自于NF服务producer的针对第二服务请求消息的响应消息，并向NF服务consumer发送针对第一服务请求消息的响应消息。
此外，若NF服务consumer确定不需要触发SCP执行NF服务producer的发现流程，则NF服务consumer可以判断是否存储可用的CCA1，若存储可用的CCA1，则使用该CCA1，若未存储可用的CCA1，则生成CCA1。可以理解的是，此时NF服务consumer不需要判断是否存储可用的CCA2，即使未存储可用的CCA2，也不需要生成CCA2，第一服务请求消息可以不包括CCA2。但是，若NF服务consumer在步骤1801之前确定当前间接通信模式为模式D，则第一服务请求消息需要携带CCA1和CCA2。
采用上述实施例CCA1包括第一NF type，CCA2包括第二NF type，进而可以保证NRF根据CCA1对NF服务consumer认证成功，NF服务producer根据CCA2对NF服务consumer认证成功，进而保障了NF服务consumer获取第一服务。
实施例7：结合图8和图10所示实施例，NF服务consumer获取指示信息，NF服务consumer根据指示信息向SCP发送服务请求消息，NF服务consumer可以采用但不限于以下实施例获取第一服务，如图19所示。
步骤1901：NF服务consumer获取CCA1。
可以理解的是，NF服务consumer还可以在步骤1901之前确定当前间接通信模式为模式D。
NF服务consumer确定请求第一服务，NF服务consumer获取CCA1。在NF服务consumer生成CCA1之前，NF服务consumer需要首先判断本地是否存储可用的CCA1。若存储可用的CCA1(例如，CCA1未过期)，则使用该CCA1。若未存储可用的CCA1(例如，CCA1已过期，或者，未存储CCA1)，则NF服务consumer生成CCA1。此外，若CCA1已过期，则NF服务consumer删除过期的CCA1。
其中，CCA1包括NF服务consumer的NF实例的标识，时间戳，CCA1的过期时间，第一NFtype，第一NF type为期望提供第一服务的NF服务producer的NF type。
步骤1902：NF服务consumer向SCP发送第一服务请求消息，第一服务请求消息包括步骤1901中CCA1。第一服务请求消息用于请求第一服务。
步骤1903：SCP向NRF发送第二服务请求消息，第二服务请求消息包括CCA1，第二服务请求消息用于请求第二服务。
步骤1904：NRF接收第二服务请求消息，NRF根据CCA1认证NF服务consumer失败。
其中，NRF验证CCA1的签名，根据时间戳和/或CCA1的过期时间验证CCA1是否过期，验证CCA1中的NF服务consumer的NF实例ID与用于签名CCA1的证书中的NF实例ID是否匹配。除上述验证内容均验证成功之外，NRF还需要验证CCA1包括的第一NF type是否与NRF的NF type匹配，由于第一NF type与NRF的NF type不匹配，则NRF 确定NF服务consumer认证失败。
步骤1905：NRF向SCP发送针对第二服务请求消息的响应消息。针对第二服务请求消息的响应消息包括CCA2。其中，CCA2包括NRF的NF实例的标识，时间戳和过期时间，NF服务consumer的NF type和NRF的NF type。
步骤1906：SCP向NF服务consumer发送针对所述第一服务请求消息的响应消息。针对所述第一服务请求消息的响应消息包括CCA2。
步骤1907：NF服务consumer向SCP发送第三服务请求消息，第三服务请求消息包括CCA3和CCA4，或者第三服务请求消息包括CCA5。
CCA3包括NF服务consumer的NF实例的标识，时间戳，CCA3的过期时间，第一NFtype。
CCA4包括NF服务consumer的NF实例的标识，时间戳，CCA4的过期时间，第二NFtype。
CCA5包括NF服务consumer的NF实例的标识，时间戳，CCA5的过期时间，第一NFtype，第二NF type。
其中，第一NF type为期望提供第一服务的NF服务producer的NF type，第二NF type为期望提供第二服务的NF服务producer的NF type。
示例性地，NF服务consumer根据CCA2认证NRF，确定NRF认证成功，则根据CCA2中的NRF的NF type生成CCA3和CCA4，或者CCA5。
步骤1908：SCP向NRF发送第四服务请求消息，第四服务请求消息包括CCA4或CCA5，第四服务请求消息用于请求第二服务。
步骤1909：NRF接收第四服务请求消息，NRF根据第四服务请求消息中的CCA认证NF服务consumer。
示例性地，若第四服务请求消息包括CCA4，NRF根据CCA4对NF服务consumer认证成功。其中，NRF验证CCA4的签名，根据时间戳和/或CCA4的过期时间验证CCA4是否过期，验证CCA4中的NF服务consumer的NF实例ID与用于签名CCA4的证书中的NF实例ID是否匹配。除上述验证内容均验证成功之外，NRF还需要验证CCA4包括的第二NF type是否与NRF的NF type匹配，由于第二NF type与NRF的NF type匹配，则NRF确定NF服务consumer认证成功。
示例性地，若第四服务请求消息包括CCA5，NRF根据CCA5对NF服务consumer认证成功。其中，NRF验证CCA5的签名，根据时间戳和/或CCA5的过期时间验证CCA5是否过期，验证CCA5中的NF服务consumer的NF实例ID与用于签名CCA5的证书中的NF实例ID是否匹配。除上述验证内容均验证成功之外，NRF还需要验证CCA5包括的第一NFtype和第二NF type是否存在与NRF的NF type匹配的NF type，由于第二NF type与NRF的NF type匹配，则NRF确定NF服务consumer认证成功。
步骤1910：NRF向SCP发送针对第四服务请求消息的响应消息。
步骤1911：SCP向NF服务producer发送第五服务请求消息。第五服务请求消息包括CCA3和第一服务对应的access token，或者，第五服务请求消息包括CCA5和第一服务对应的access token。
步骤1912：NF服务producer接收来自于SCP的第五服务请求消息。NF服务producer根据第五服务请求消息中的CCA认证NF服务consumer。
NF服务producer对第一服务对应的access token执行完整性验证，若完整性验证成功，则进一步验证第一服务对应的access token中的claims，详见上述access token中的claims验证的相关内容。
若第五服务请求消息包括CCA3，NF服务producer还需要根据CCA3认证NF服务consumer。其中，NF服务producer验证CCA3的签名，根据时间戳和/或CCA3的过期时间验证CCA3是否过期，验证CCA3中的NF服务consumer的NF实例ID与用于签名CCA的证书中的NF实例ID是否匹配。除上述验证内容均验证成功之外，NF服务consumer还需要验证CCA3包括的第一NF type是否与NF服务producer的NF type匹配，由于第一NF type与NF服务producer的NF type匹配，则确定NF服务consumer认证成功。
若第五服务请求消息包括CCA5，NF服务producer还需要根据CCA5认证NF服务consumer。其中，NF服务producer验证CCA5的签名，根据时间戳和/或CCA5的过期时间验证CCA5是否过期，验证CCA5中的NF服务consumer的NF实例ID与用于签名CCA的证书中的NF实例ID是否匹配。除上述验证内容均验证成功之外，NF服务consumer还需要验证CCA5包括的第一NF type和第二NF type是否包括与NF服务producer的NF type匹配的NF type，由于第一NF type与NF服务producer的NF type匹配，则确定CCA5认证成功。
步骤1913：NF服务producer确定第一acess token且NF服务consumer认证成功，NF服务producer向SCP发送针对第五服务请求消息的响应消息。针对第五服务请求消息的响应消息用于提供指示第一服务或者指示所述第五服务请求成功。
可以理解的是，若第一access token验证失败和/或NF服务consumer认证失败，针对第五服务请求消息的响应消息指示第一服务请求失败。
步骤1914：SCP接收来自于NF服务producer的针对第五服务请求消息的响应消息，并向NF服务consumer发送针对第三服务请求消息的响应消息。
采用上述实施例SCP向NF服务consumer发送指示信息，NF服务consumer根据指示信息发送服务请求消息携带CCA3(第一NF type)和CCA4(第二NF type)，或者，CCA5(第一NF type和第二NF type)，进而可以保障NF服务consumer获取第一服务。
[根据细则91更正 31.05.2022]　
实施例8：结合图12所示实施例，SCP主动请求客户认证凭证，发送客户认证凭证请求消息，NF服务consumer响应客户认证凭证请求消息，NF服务consumer可以采用但不限于以下实施例获取第一服务，如图20所示。
[根据细则91更正 31.05.2022]　
步骤2001至步骤2005可以参考上述实施例7中的步骤1901至步骤1905相关描述。
步骤2006：SCP向NF服务consumer发送CCA请求消息。CCA请求消息包括CCA2。
步骤2007：NF服务consumer向SCP发送针对CCA请求消息的响应消息，针对CCA请求消息的响应消息包括CCA3，或者针对CCA请求消息的响应消息包括CCA4。
CCA3包括NF服务consumer的NF实例的标识，时间戳，CCA3的过期时间，第二NFtype。
CCA4包括NF服务consumer的NF实例的标识，时间戳，CCA4的过期时间，第一NFtype，第二NF type。
其中，第一NF type为期望提供第一服务的NF服务producer的NF type，第二NF type 为期望提供第二服务的NF服务producer的NF type。
示例性地，NF服务consumer根据CCA2认证NRF，确定NRF认证成功，则根据CCA2中的NRF的NF type生成CCA3或CCA4。
步骤2008：SCP向NRF发送第三服务请求消息，第三服务请求消息包括CCA3或CCA4，第三服务请求消息用于请求第二服务。
步骤2009：NRF接收第三服务请求消息，NRF根据第三服务请求消息中的CCA认证NF服务consumer。
示例性地，若第三服务请求消息包括CCA3，NRF根据CCA3对NF服务consumer认证成功。其中，NRF验证CCA3的签名，根据时间戳和/或CCA3的过期时间验证CCA3是否过期，验证CCA3中的NF服务consumer的NF实例ID与用于签名CCA3的证书中的NF实例ID是否匹配。除上述验证内容均验证成功之外，NRF还需要验证CCA3包括的第二NF type是否与NRF的NF type匹配，由于第二NF type与NRF的NF type匹配，则NRF确定NF服务consumer认证成功。
示例性地，若第三服务请求消息包括CCA4，NRF根据CCA4对NF服务consumer认证成功。其中，NRF验证CCA4的签名，根据时间戳和/或CCA4的过期时间验证CCA4是否过期，验证CCA4中的NF服务consumer的NF实例ID与用于签名CCA4的证书中的NF实例ID是否匹配。除上述验证内容均验证成功之外，NRF还需要验证CCA4包括的第一NFtype和第二NF type是否存在与NRF的NF type匹配的NF type，由于第二NF type与NRF的NF type匹配，则NRF确定NF服务consumer认证成功。
步骤2010：NRF向SCP发送针对第三服务请求消息的响应消息。
步骤2011：SCP向NF服务producer发送第四服务请求消息。第四服务请求消息包括CCA3和第一服务对应的access token，或者，第四服务请求消息包括CCA4和第一服务对应的access token。
步骤2012：NF服务producer接收来自于SCP的第四服务请求消息。NF服务producer根据第四服务请求消息中的CCA认证NF服务consumer。
NF服务producer对第一服务对应的access token执行完整性验证，若完整性验证成功，则进一步验证第一服务对应的access token中的claims，详见上述access token中的claims验证的相关内容。
若第四服务请求消息包括CCA3，NF服务producer还需要根据CCA3认证NF服务consumer。其中，NF服务producer验证CCA3的签名，根据时间戳和/或CCA3的过期时间验证CCA3是否过期，验证CCA3中的NF服务consumer的NF实例ID与用于签名CCA的证书中的NF实例ID是否匹配。除上述验证内容均验证成功之外，NF服务consumer还需要验证CCA3包括的第一NF type是否与NF服务producer的NF type匹配，由于第一NF type与NF服务producer的NF type匹配，则确定NF服务consumer认证成功。
若第四服务请求消息包括CCA4，NF服务producer还需要根据CCA4认证NF服务consumer。其中，NF服务producer验证CCA4的签名，根据时间戳和/或CCA4的过期时间验证CCA4是否过期，验证CCA4中的NF服务consumer的NF实例ID与用于签名CCA的证书中的NF实例ID是否匹配。除上述验证内容均验证成功之外，NF服务consumer还需要验证CCA4包括的第一NF type和第二NF type是否包括与NF服务producer的NF type匹配的NF type，由于第一NF type与NF服务producer的NF type匹配，则确定CCA4认 证成功。
步骤2013：NF服务producer确定第一acess token且NF服务consumer认证成功，NF服务producer向SCP发送针对第四服务请求消息的响应消息。针对第四服务请求消息的响应消息用于指示提供第一服务或者指示所述第四服务请求成功。
可以理解的是，若第一access token验证失败和/或NF服务consumer认证失败，针对第四服务请求消息的响应消息指示第一服务请求失败。
步骤2014：SCP接收来自于NF服务producer的针对第四服务请求消息的响应消息，并向NF服务consumer发送针对第一服务请求消息的响应消息。
采用上述实施例SCP向NF服务consumer发送客户认证凭证请求消息，客户认证凭证请求消息包括指示信息，NF服务consumer根据指示信息响应客户认证凭证请求消息。针对客户认证凭证请求消息的响应消息携带CCA3(第二NF type)或CCA4(第一NF type和第二NF type)进而可以保障NF服务consumer获取第一服务。
图21示出了本申请实施例中所涉及的一种装置的可能的示例性框图，该装置2100包括：收发模块2110和处理模块2120，收发模块2110可以包括接收单元和发送单元。处理模块2120用于对装置2100的动作进行控制管理。收发模块2110用于支持装置2100与其他网络实体的通信。可选地，装置2100还可以包括存储单元，所述存储单元用于存储装置2100的程序代码和数据。
可选地，所述装置2100中各个模块可以是通过软件来实现。
可选地，处理模块2120可以是处理器或控制器，例如可以是通用中央处理器(central processing unit，CPU)，通用处理器，数字信号处理(digital signal processing，DSP)，专用集成电路(application specific integrated circuits，ASIC)，现场可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本申请实施例公开内容所描述的各种示例性的逻辑方框，模块和电路。所述处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP和微处理器的组合等等。收发模块2110可以是通信接口、收发器或收发电路等，其中，该通信接口是统称，在具体实现中，该通信接口可以包括多个接口，存储单元可以是存储器。
当装置2100为服务消费网元或服务消费网元中的芯片时，装置2100中的处理模块2120可以支持装置2100执行上文中各方法示例中服务消费网元的动作，例如可以支持装置2100执行，图14中的步骤1401，图15中的步骤1501，图16中的步骤1601，图17中的步骤1701，图18中的步骤1801，图19中的步骤1901，图20中的步骤2001。
收发模块2110可以支持装置2100与服务通信代理(例如SCP)之间的通信，例如，收发模块2110可以支持装置2100执行图8中的步骤801，步骤808，图9中的步骤901，步骤905，步骤906，图10中的步骤1001，步骤1008，图11中的步骤1101，步骤1108，图12中的步骤1201，步骤1205，步骤1206，步骤1213，图13中的步骤1302，步骤1309，图14中的步骤1402，步骤1409，图15中的步骤1502，步骤1509，图16中的步骤1602，步骤1606，图17中的步骤1702，步骤1709，图18中的步骤1802，步骤1809，图19中的步骤1902，步骤1906，步骤1907，步骤1914，图20中的步骤2002，步骤2006，步骤2007，步骤2014。
例如，可以如下：
在一种实现方式中，所述装置2100包括：
所述收发模块2110，向服务通信代理发送第一服务请求消息，服务消费网元从服务通信代理接收针对第一服务请求消息的响应消息。其中，第一服务请求消息用于向服务提供网元请求第一服务，第一服务请求消息包括第一客户认证凭证，第一客户认证凭证用于认证服务消费网元，第一客户认证凭证包括第一网络功能类型和第二网络功能类型，第一网络功能类型为服务提供网元的网络功能类型，第二网络功能类型为提供第二服务的网元的网络功能类型；其中，第二服务与第一服务关联。
在一种可能的实现方式中，所述第二服务用于提供所述第一服务对应的访问令牌，所述第一服务对应的访问令牌用于表征所述服务消费网元具有获取所述第一服务的权限。
在一种可能的实现方式中，所述处理模块2120用于：所述服务消费网元确定不存在所述第一服务对应的可用的访问令牌。
在一种可能的实现方式中，所述处理模块2120用于：确定未存储所述第一服务对应的访问令牌；或，确定存储的所述第一服务对应的访问令牌已过期。
在一种可能的实现方式中，所述第二服务用于提供所述服务提供网元的信息。
在一种可能的实现方式中，所述处理模块2120用于：确定所述第一服务请求消息会触发所述服务通信代理请求所述第二服务。
在一种可能的实现方式中，所述处理模块2120用于：根据以下一项或多项，确定所述第一服务请求消息会触发所述服务通信代理请求所述第二服务：未存储第一终端设备的上下文，所述第一终端设备与所述第一服务关联；或者，未存储所述第一服务的上下文；或者，所述服务提供网元归属于第一切片且未存储所述第一切片对应的上下文；或者，所述服务消费网元首次与所述服务通信代理通信。
在一种可能的实现方式中，所述处理模块2120用于：确定使用模式D的间接通信模式请求所述第一服务。
在一种可能的实现方式中，所述收发模块2110用于：向所述服务通信代理发送第二服务请求消息，所述第二服务请求消息用于请求所述第一服务，所述第二服务请求消息包括第二客户认证凭证，所述第二客户认证凭证包括所述第一网络功能类型，所述第二客户认证凭证用于认证所述服务消费网元；从所述服务通信代理接收针对所述第二服务请求消息的响应消息，所述针对所述第二服务请求消息的响应消息包括指示信息；所述处理模块2120用于：根据所述指示信息，通过所述收发模块2110向所述服务通信代理发送所述第一服务请求消息。
应理解，根据本申请实施例的装置2100可对应于前述方法实施例中服务消费网元，比如，图8中的方法，并且装置2100中的各个模块的操作和/或功能分别为了实现前述方法实施例中服务消费网元的方法的相应步骤，因此也可以实现前述方法实施例中的有益效果，为了简洁，这里不作赘述。
当装置2100为第一网元或第一网元中的芯片时，装置2100中的处理模块2120可以支持装置2100执行上文中各方法示例中网络存储功能网元或服务提供网元的动作。
例如，当第一网元为网络存储功能网元时，可以支持装置2100执行，图8中的步骤803，图9中的步骤903，图10中的步骤1003，图11中的步骤1103，图12中的步骤1203，步骤1208，图13中的步骤1304，图14中的步骤1404，图15中的步骤1504，图17中的 步骤1704，图18中的步骤1804，图19中的步骤1904，步骤1909，图20中的步骤2004，步骤2009。收发模块2110可以支持装置2100与服务通信代理(例如SCP)之间的通信，例如，收发模块2110可以支持装置2100执行图8中的步骤802，步骤804，步骤808，图9中的步骤902，步骤904，图10中的步骤1002，步骤1004，图11中的步骤1102，步骤1104，图12中的步骤1202，步骤1204，步骤1207，步骤1209，图13中的步骤1303，步骤1305，图14中的步骤1403，步骤1405，图15中的步骤1503，步骤1505，图17中的步骤1703，步骤1705，图18中的步骤1803，步骤1805，图19中的步骤1903，步骤1905，步骤1908，步骤1910，图20中的步骤2003，步骤2005，步骤2008，步骤2010。
例如，当第一网元为服务提供网元时，可以支持装置2100执行，图8中的步骤803，图10中的步骤1006，图11中的步骤1106，图12中的步骤1211，图13中的步骤1307，图14中的步骤1407，图15中的步骤1507，图16中的步骤1604，图17中的步骤1707，图18中的步骤1807，图19中的步骤1912，图20中的步骤2012。收发模块2110可以支持装置2100与服务通信代理(例如SCP)之间的通信，例如，收发模块2110可以支持装置2100执行图8中的步骤805，步骤807，步骤808，图10中的步骤1005，步骤1007，图11中的步骤1105，步骤1107，图12中的步骤1210，步骤1212，图13中的步骤1306，步骤1308，图14中的步骤1406，步骤1408，图15中的步骤1506，步骤1508，图16中的步骤1603，步骤1605，图17中的步骤1706，步骤1708，图18中的步骤1806，步骤1808，图19中的步骤1911，步骤1913，图20中的步骤2011，步骤2013。
例如，可以如下：
在一种实现方式中，所述装置2100包括：
收发模块2110用于：从服务通信代理接收第一服务请求消息，所述第一服务请求消息用于向所述第一网元请求第一服务，所述第一服务请求消息包括第一客户认证凭证，所述第一客户认证凭证用于认证服务消费网元，其中，所述第一客户认证凭证包括多个网络功能类型；
所述处理模块2120，用于根据所述第一客户认证凭证，认证所述服务消费网元；在根据所述第一客户认证凭证，认证所述服务消费网元时，判断自身的网络功能类型是否与所述多个网络功能类型中的一个或者多个相匹配；根据认证结果通过所述收发模块2110向所述服务通信代理发送针对所述第一服务请求消息的响应消息。
在一种可能的设计中，所述多个网络功能类型包括第一网络功能类型和第二网络功能类型，所述第一网络功能类型为所述第一网元的网络功能类型，所述第二网络功能类型为提供第二服务的网元的网络功能类型，所述第二服务与所述第一服务关联。
在一种可能的设计中，所述第二服务用于提供所述第一服务对应的访问令牌，其中，所述第一服务对应的访问令牌用于表征所述服务消费网元具有获取所述第一服务的权限；或者，所述第二服务用于提供所述第一装置的信息。
在一种可能的设计中，所述第一服务用于提供所述第二服务对应的访问令牌，其中，所述第二服务对应的访问令牌用于表征所述服务消费网元具有获取所述第二服务的权限；或者，所述第一服务用于提供所述第二服务网元的信息。
在一种可能的设计中，所述收发模块2110用于接收来自于所述服务通信代理的第二服务请求消息，所述第二服务请求消息用于向所述第一网元请求所述第一服务，所述第二服务请求消息包括第二客户认证凭证，所述第二客户认证凭证包括第三网络功能类型；在所 述第三网络功能类型与所述第一网元的网络功能类型不匹配的情况下，向所述服务通信代理发送针对所述第二服务请求消息的响应消息，所述针对所述第二服务请求消息的响应消息包括指示信息，其中，所述指示信息用于触发所述第一服务请求消息。
应理解，根据本申请实施例的装置2100可对应于前述方法实施例中第一网元(例如，网络存储功能网元或服务提供网元)的方法，比如，图8中的方法，并且装置2100中的各个模块的操作和/或功能分别为了实现前述方法实施例中网络存储功能网元的方法的相应步骤，或者，图8中的方法，并且装置2100中的各个模块的操作和/或功能分别为了实现前述方法实施例中服务提供网元的方法的相应步骤，因此也可以实现前述方法实施例中的有益效果，为了简洁，这里不作赘述。
当本申请实施例中的处理模块2120为处理器，收发模块2110为收发器时，本申请实施例所涉及的装置2100可以为图22所示的装置2200。
图22示出了根据本申请实施例的通信装置2200的示意性结构图。如图22所示，所述装置2200包括：处理器2201。
当装置2200为服务消费网元或服务消费网元中的芯片时，一种可能的实现方式中，当所述处理器2201用于调用接口执行以下动作：向服务通信代理发送第一服务请求消息，服务消费网元从服务通信代理接收针对第一服务请求消息的响应消息。其中，第一服务请求消息用于向服务提供网元请求第一服务，第一服务请求消息包括第一客户认证凭证，第一客户认证凭证用于认证服务消费网元，第一客户认证凭证包括第一网络功能类型和第二网络功能类型，第一网络功能类型为服务提供网元的网络功能类型，第二网络功能类型为提供第二服务的网元的网络功能类型；其中，第二服务与第一服务关联。
应理解，所述装置2200还可用于执行前文实施例中服务消费网元侧的其他步骤和/或操作，为了简洁，这里不作赘述。
当装置2200为第一网元或第一网元中的芯片时，一种可能的实现方式中，当所述处理器2201用于调用接口执行以下动作：从服务通信代理接收第一服务请求消息，所述第一服务请求消息用于向所述第一网元请求第一服务，所述第一服务请求消息包括第一客户认证凭证，所述第一客户认证凭证用于认证服务消费网元，其中，所述第一客户认证凭证包括多个网络功能类型；根据所述第一客户认证凭证，认证所述服务消费网元；在根据所述第一客户认证凭证，认证所述服务消费网元时，判断自身的网络功能类型是否与所述多个网络功能类型中的一个或者多个相匹配；根据认证结果向所述服务通信代理发送针对所述第一服务请求消息的响应消息。
应理解，所述装置2200还可用于执行前文实施例中第一网元侧的其他步骤和/或操作，为了简洁，这里不作赘述。
应理解，所述处理器2201可以调用接口执行上述收发动作，其中，调用的接口可以是逻辑接口或物理接口，对此不作限定。可选地，物理接口可以通过收发器实现。可选地，所述装置2200还包括收发器2203。
可选地，所述装置2200还包括存储器2202，存储器2202中可以存储上述方法实施例中的程序代码，以便于处理器2201调用。
具体地，若所述装置2200包括处理器2201、存储器2202和收发器2203，则处理器2201、存储器2202和收发器2203之间通过内部连接通路互相通信，传递控制和/或数据信号。在一个可能的设计中，处理器2201、存储器2202和收发器2203可以通过芯片实现， 处理器2201、存储器2202和收发器2203可以是在同一个芯片中实现，也可能分别在不同的芯片实现，或者其中任意两个功能组合在一个芯片中实现。该存储器2202可以存储程序代码，处理器2201调用存储器2202存储的程序代码，以实现装置2200的相应功能。
上述本申请实施例揭示的方法可以应用于处理器中，或者由处理器实现。处理器可能是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法实施例的各步骤可以通过处理器中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器可以是通用处理器、数字信号处理器(digital signal processor，DSP)、专用集成电路(application specific integrated circuit，ASIC)、现成可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件，还可以是系统芯片(system on chip，SoC)，还可以是中央处理器(central processor unit，CPU)，还可以是网络处理器(network processor，NP)，还可以是数字信号处理电路(digital signal processor，DSP)，还可以是微控制器(micro controller unit，MCU)，还可以是可编程控制器(programmable logic device，PLD)或其他集成芯片。可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器，处理器读取存储器中的信息，结合其硬件完成上述方法的步骤。
可以理解，本申请实施例中的存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(dynamic RAM，DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(direct rambus RAM，DR RAM)。应注意，本文描述的系统和方法的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
应理解，在本申请实施例中，编号“第一”、“第二”…仅仅为了区分不同的对象，比如为了区分不同的参数信息或者消息，并不对本申请实施例的范围构成限制，本申请实施例并不限于此。
还应理解，在本申请的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定。上述各个过程涉及的各种数字编号或序号仅为描述方便进行的区分，而不应对本申请实施例的实施过程构成任何限定。
还应理解，本文中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三 种情况。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系。
本申请中出现的类似于“项目包括如下中的一项或多项：A，B，以及C”表述的含义，如无特别说明，通常是指该项目可以为如下中任一个：A；B；C；A和B；A和C；B和C；A，B和C；A和A；A，A和A；A，A和B；A，A和C，A，B和B；A，C和C；B和B，B，B和B，B，B和C，C和C；C，C和C，以及其他A，B和C的组合。以上是以A，B和C共3个元素进行举例来说明该项目的可选用条目，当表达为“项目包括如下中至少一种：A，B，……，以及X”时，即表达中具有更多元素时，那么该项目可以适用的条目也可以按照前述规则获得。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器ROM、随机存取存储器RAM、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (72)

  1. 一种通信方法，其特征在于，该方法包括：
    服务消费网元向服务通信代理发送第一服务请求消息，所述第一服务请求消息用于向服务提供网元请求第一服务，所述第一服务请求消息包括第一客户认证凭证，所述第一客户认证凭证用于认证所述服务消费网元，所述第一客户认证凭证包括第一网络功能类型和第二网络功能类型，所述第一网络功能类型为所述服务提供网元的网络功能类型，所述第二网络功能类型为提供第二服务的网元的网络功能类型；其中，所述第二服务与所述第一服务关联；
    所述服务消费网元从所述服务通信代理接收针对所述第一服务请求消息的响应消息。
  2. 如权利要求1所述的方法，其特征在于，所述第二服务用于提供所述第一服务对应的访问令牌，所述第一服务对应的访问令牌用于表征所述服务消费网元具有获取所述第一服务的权限。
  3. 如权利要求1或者2所述的方法，其特征在于，还包括：
    所述服务消费网元确定不存在所述第一服务对应的可用的访问令牌。
  4. 如权利要求3所述的方法，其特征在于，所述服务消费网元确定不存在所述第一服务对应的可用的访问令牌，包括：
    所述服务消费网元确定未存储所述第一服务对应的访问令牌；或，
    所述服务消费网元确定存储的所述第一服务对应的访问令牌已过期。
  5. 如权利要求4所述的方法，其特征在于，还包括：
    在存储的所述第一服务对应的访问令牌已过期的情况下，所述服务消费网元删除所述已过期的访问令牌。
  6. 如权利要求1所述的方法，其特征在于，所述第二服务用于提供所述服务提供网元的信息。
  7. 如权利要求1-6任一项所述的方法，其特征在于，还包括：
    所述服务消费网元确定所述第一服务请求消息能够触发所述服务通信代理请求所述第二服务。
  8. 如权利要求7所述的方法，其特征在于，所述服务消费网元确定所述第一服务请求消息能够触发所述服务通信代理请求所述第二服务，包括：
    所述服务消费网元根据以下一项或多项，确定所述第一服务请求消息能够触发所述服务通信代理请求所述第二服务：
    未存储第一终端设备的上下文，所述第一终端设备与所述第一服务关联；或者，未存储所述第一服务的上下文；或者，所述服务提供网元归属于第一切片且未存储所述第一切片对应的上下文；或者，所述服务消费网元首次与所述服务通信代理通信。
  9. 如权利要求1-8任一项所述的方法，其特征在于，还包括：
    所述服务消费网元确定使用模式D的间接通信模式请求所述第一服务。
  10. 如权利要求1-9任一项所述的方法，其特征在于，还包括：
    所述服务消费网元向所述服务通信代理发送第二服务请求消息，所述第二服务请求消息用于请求所述第一服务，所述第二服务请求消息包括第二客户认证凭证，所述第二客户认证凭证包括所述第一网络功能类型，所述第二客户认证凭证用于认证所述服务消费网元；
    所述服务消费网元从所述服务通信代理接收针对所述第二服务请求消息的响应消息，所述针对所述第二服务请求消息的响应消息包括指示信息；
    所述服务消费网元向所述服务通信代理发送第一服务请求消息，包括：
    所述服务消费网元根据所述指示信息，向所述服务通信代理发送所述第一服务请求消息。
  11. 如权利要求10所述的方法，其特征在于，所述指示信息包括第三客户认证凭证，所述第三客户认证凭证包括所述第二网络功能类型；其中，所述第三客户认证凭证用于认证所述提供所述第二服务的网元；
    所述服务消费网元根据所述指示信息，向所述服务通信代理发送所述第一服务请求消息，包括：
    在根据所述第三客户认证凭证对所述提供所述第二服务的网元认证成功的情况下，所述服务消费网元向所述服务通信代理发送所述第一服务请求消息。
  12. 如权利要求1-11任一项所述的方法，其特征在于，所述提供所述第二服务的网元为网络存储功能网元。
  13. 如权利要求1-12任一项所述的方法，其特征在于，所述第一客户认证凭证还包括以下一项或者多项：所述服务消费网元的标识或者有效时间信息，其中，所述有效时间信息用于表征所述第一客户认证凭证的有效时间。
  14. 一种通信方法，其特征在于，该方法包括：
    第一网元从服务通信代理接收第一服务请求消息，所述第一服务请求消息用于向所述第一网元请求第一服务，所述第一服务请求消息包括第一客户认证凭证，所述第一客户认证凭证用于认证服务消费网元，其中，所述第一客户认证凭证包括多个网络功能类型；
    所述第一网元根据所述第一客户认证凭证，认证所述服务消费网元；
    其中，所述第一网元根据所述第一客户认证凭证，认证所述服务消费网元，包括：所述第一网元判断自身的网络功能类型是否与所述多个网络功能类型中的一个或者多个相匹配；
    所述第一网元根据认证结果向所述服务通信代理发送针对所述第一服务请求消息的响应消息。
  15. 如权利要求14所述的方法，其特征在于，所述第一网元根据认证结果向所述服务通信代理发送针对所述第一服务请求消息的响应消息，包括：
    在所述认证结果为认证成功时，所述第一网元向所述服务通信代理发送针对所述第一服务请求消息的响应消息，所述针对所述第一服务请求消息的响应消息用于指示提供所述第一服务；
    或者，在所述认证结果为认证失败时，所述第一网元向所述服务通信代理发送针对所述第一服务请求消息的响应消息，所述针对所述第一服务请求消息的响应消息指示请求所述第一服务失败。
  16. 如权利要求14或者15所述的方法，其特征在于，所述多个网络功能类型包括第一网络功能类型和第二网络功能类型，所述第一网络功能类型为所述第一网元的网络功能类型，所述第二网络功能类型为提供第二服务的网元的网络功能类型，所述第二服务与所述第一服务关联。
  17. 如权利要求16所述的方法，其特征在于，所述第二服务用于提供所述第一服务对 应的访问令牌，其中，所述第一服务对应的访问令牌用于表征所述服务消费网元具有获取所述第一服务的权限；
    或者，所述第二服务用于提供所述第一网元的信息。
  18. [根据细则91更正 31.05.2022]　
    如权利要求16或者17所述的方法，其特征在于，所述提供所述第二服务的网元为网络存储功能网元。
  19. 如权利要求14或者15所述的方法，其特征在于，所述第一服务用于提供所述第二服务对应的访问令牌，其中，所述第二服务对应的访问令牌用于表征所述服务消费网元具有获取所述第二服务的权限；
    或者，所述第一服务用于提供所述第二服务网元的信息。
  20. 如权利要求19所述的方法，其特征在于，所述第一网元为网络存储功能网元。
  21. 如权利要求14-20任一项所述的方法，其特征在于，还包括：
    所述第一网元接收来自于所述服务通信代理的第二服务请求消息，所述第二服务请求消息用于向所述第一网元请求所述第一服务，所述第二服务请求消息包括第二客户认证凭证，所述第二客户认证凭证包括第三网络功能类型；
    在所述第三网络功能类型与所述第一网元的网络功能类型不匹配的情况下，所述第一网元向所述服务通信代理发送针对所述第二服务请求消息的响应消息，所述针对所述第二服务请求消息的响应消息包括指示信息，其中，所述指示信息用于触发所述第一服务请求消息。
  22. 如权利要求21所述的方法，其特征在于，所述指示信息包括用于认证所述第一网元的第三客户认证凭证，所述第三客户认证凭证包括所述第一网元的网络功能类型。
  23. 如权利要求15-22任一项所述的方法，其特征在于，所述第一客户认证凭证还包括所述服务消费网元的标识和所述第一客户认证凭证的有效时间信息；所述第一客户认证凭证的有效时间信息用于表征所述第一客户认证凭证的有效时间；
    所述第一网元根据所述第一客户认证凭证，认证所述服务消费网元，还包括以下一项或者多项：
    所述第一网元验证所述第一客户认证凭证的签名是否通过、根据所述第一客户认证凭证包括的有效时间信息验证所述第一客户认证凭证是否过期或者验证所述第一客户认证凭证中的所述服务消费网元的标识与用于签名所述第一客户认证凭证的证书中的网元的标识是否相同。
  24. 一种通信装置，其特征在于，该装置包括收发单元和处理单元；
    所述处理单元调用所述收发单元执行：向服务通信代理发送第一服务请求消息，所述第一服务请求消息用于向服务提供网元请求第一服务，所述第一服务请求消息包括第一客户认证凭证，所述第一客户认证凭证用于认证所述装置，所述第一客户认证凭证包括第一网络功能类型和第二网络功能类型，所述第一网络功能类型为所述服务提供网元的网络功能类型，所述第二网络功能类型为提供第二服务的网元的网络功能类型；其中，所述第二服务与所述第一服务关联；从所述服务通信代理接收针对所述第一服务请求消息的响应消息。
  25. 如权利要求24所述的通信装置，其特征在于，所述第二服务用于提供所述第一服务对应的访问令牌，所述第一服务对应的访问令牌用于表征所述装置具有获取所述第一服务的权限。
  26. 如权利要求24或25所述的通信装置，其特征在于，所述处理单元，用于确定不存在所述第一服务对应的可用的访问令牌。
  27. 如权利要求26所述的通信装置，其特征在于，所述处理单元，还用于确定未存储所述第一服务对应的访问令牌；或，确定存储的所述第一服务对应的访问令牌已过期。
  28. 如权利要求27所述的通信装置，其特征在于，所述处理单元，还用于在存储的所述第一服务对应的访问令牌已过期的情况下，删除所述已过期的访问令牌。
  29. 如权利要求24所述的通信装置，其特征在于，所述第二服务用于提供所述服务提供网元的信息。
  30. 如权利要求24-29任一项所述的通信装置，其特征在于，所述处理单元，还用于确定所述第一服务请求消息能够触发所述服务通信代理请求所述第二服务。
  31. 如权利要求30所述的通信装置，其特征在于，所述处理单元，用于根据以下一项或多项，确定所述第一服务请求消息能够触发所述服务通信代理请求所述第二服务：
    未存储第一终端设备的上下文，所述第一终端设备与所述第一服务关联；或者，未存储所述第一服务的上下文；或者，所述服务提供网元归属于第一切片且未存储所述第一切片对应的上下文；或者，所述装置首次与所述服务通信代理通信。
  32. 如权利要求24-31任一项所述的通信装置，其特征在于，所述处理单元，还用于确定使用模式D的间接通信模式请求所述第一服务。
  33. 如权利要求24-32任一项所述的通信装置，其特征在于，所述收发单元，还用于向所述服务通信代理发送第二服务请求消息，所述第二服务请求消息用于请求所述第一服务，所述第二服务请求消息包括第二客户认证凭证，所述第二客户认证凭证包括所述第一网络功能类型，所述第二客户认证凭证用于认证所述装置；从所述服务通信代理接收针对所述第二服务请求消息的响应消息，所述针对所述第二服务请求消息的响应消息包括指示信息；在向所述服务通信代理发送第一服务请求消息时，所述处理单元调用所述收发单元根据所述指示信息，向所述服务通信代理发送所述第一服务请求消息。
  34. 如权利要求33所述的通信装置，其特征在于，所述指示信息包括第三客户认证凭证，所述第三客户认证凭证包括所述第二网络功能类型；其中，所述第三客户认证凭证用于认证所述提供所述第二服务的网元；所述收发单元，用于在根据所述第三客户认证凭证对所述提供所述第二服务的网元认证成功的情况下，向所述服务通信代理发送所述第一服务请求消息。
  35. 如权利要求24-34任一项所述的通信装置，其特征在于，所述提供所述第二服务的网元为网络存储功能网元。
  36. 如权利要求24-35任一项所述的通信装置，其特征在于，所述第一客户认证凭证还包括以下一项或者多项：所述装置的标识或者有效时间信息，其中，所述有效时间信息用于表征所述第一客户认证凭证的有效时间。
  37. 一种通信装置，其特征在于，该装置包括收发单元和处理单元；
    所述收发单元，用于从服务通信代理接收第一服务请求消息，所述第一服务请求消息用于向所述装置请求第一服务，所述第一服务请求消息包括第一客户认证凭证，所述第一客户认证凭证用于认证服务消费网元，其中，所述第一客户认证凭证包括多个网络功能类型；
    所述处理单元，用于根据所述第一客户认证凭证，认证所述服务消费网元，其中，在 根据所述第一客户认证凭证，认证所述服务消费网元时，所述处理单元判断自身的网络功能类型是否与所述多个网络功能类型中的一个或者多个相匹配；所述处理单元调用所述收发单元根据认证结果向所述服务通信代理发送针对所述第一服务请求消息的响应消息。
  38. 如权利要求37所述的通信装置，其特征在于，所述收发单元，用于在所述认证结果为认证成功时，向所述服务通信代理发送针对所述第一服务请求消息的响应消息，所述针对所述第一服务请求消息的响应消息用于提供所述第一服务；或者，在所述认证结果为认证失败时，向所述服务通信代理发送针对所述第一服务请求消息的响应消息，所述针对所述第一服务请求消息的响应消息指示请求所述第一服务失败。
  39. 如权利要求37或38所述的通信装置，其特征在于，所述多个网络功能类型包括第一网络功能类型和第二网络功能类型，所述第一网络功能类型为所述装置的网络功能类型，所述第二网络功能类型为提供第二服务的网元的网络功能类型，所述第二服务与所述第一服务关联。
  40. 如权利要求39所述的通信装置，其特征在于，所述第二服务用于提供所述第一服务对应的访问令牌，其中，所述第一服务对应的访问令牌用于表征所述服务消费网元具有获取所述第一服务的权限；或者，所述第二服务用于提供所述装置的信息。
  41. 如权利要求39或40所述的通信装置，其特征在于，所述提供所述第二服务的网元为网络存储功能网元。
  42. 如权利要求37或38所述的通信装置，其特征在于，所述第一服务用于提供所述第二服务对应的访问令牌，其中，所述第二服务对应的访问令牌用于表征所述服务消费网元具有获取所述第二服务的权限；或者，所述第一服务用于提供所述第二服务网元的信息。
  43. 如权利要求42所述的通信装置，其特征在于，所述装置为网络存储功能网元。
  44. 如权利要求37-43任一项所述的通信装置，其特征在于，所述收发单元，还用于接收来自于所述服务通信代理的第二服务请求消息，所述第二服务请求消息用于向所述通信装置请求所述第一服务，所述第二服务请求消息包括第二客户认证凭证，所述第二客户认证凭证包括第三网络功能类型；
    所述收发单元，还用于在所述第三网络功能类型与所述通信装置的网络功能类型不匹配的情况下，向所述服务通信代理发送针对所述第二服务请求消息的响应消息，所述针对所述第二服务请求消息的响应消息包括指示信息，其中，所述指示信息用于触发所述第一服务请求消息。
  45. 如权利要求44所述的通信装置，其特征在于，所述指示信息包括用于认证所述装置的第三客户认证凭证，所述第三客户认证凭证包括所述装置的网络功能类型。
  46. 如权利要求38-45任一项所述的通信装置，其特征在于，所述第一客户认证凭证还包括所述服务消费网元的标识和所述第一客户认证凭证的有效时间信息；所述第一客户认证凭证的有效时间信息用于表征所述第一客户认证凭证的有效时间；所述处理单元，用于根据所述第一客户认证凭证，认证所述服务消费网元，还包括以下一项或者多项：验证所述第一客户认证凭证的签名是否通过、根据所述第一客户认证凭证包括的有效时间信息验证所述第一客户认证凭证是否过期或者验证所述第一客户认证凭证中的所述服务消费网元的标识与用于签名所述第一客户认证凭证的证书中的网元的标识是否相同。
  47. 一种通信装置，其特征在于，所述通信装置包括处理器和存储器；所述存储器用于存储计算机执行指令，当所述装置运行时，所述处理器执行所述存储器存储的所述计算机 执行指令，以使所述通信装置执行如权利要求1-13中任意一项所述的方法。
  48. 一种通信装置，其特征在于，所述通信装置包括处理器和存储器；所述存储器用于存储计算机执行指令，当所述装置运行时，所述处理器执行所述存储器存储的所述计算机执行指令，以使所述通信装置执行如权利要求14-23中任意一项所述的方法。
  49. 一种计算机可读存储介质，其特征在于，所述存储介质中存储有计算机程序或指令，当所述计算机程序或指令被通信装置执行时，实现如权利要求1至23中任一项所述的方法。
  50. 一种通信系统，其特征在于，所述系统包括服务消费网元和服务通信代理；其中，
    所述服务消费网元，用于向服务通信代理发送第一服务请求消息，所述第一服务请求消息用于向服务提供网元请求第一服务，所述第一服务请求消息包括第一客户认证凭证，所述第一客户认证凭证用于认证所述服务消费网元，所述第一客户认证凭证包括第一网络功能类型和第二网络功能类型，所述第一网络功能类型为所述服务提供网元的网络功能类型，所述第二网络功能类型为提供第二服务的网元的网络功能类型；其中，所述第二服务与所述第一服务关联；
    所述服务通信代理，用于接收所述第一服务请求消息；以及向所述服务消费网元发送针对所述第一服务请求消息的响应消息；
    所述服务消费网元，还用于从所述服务通信代理接收所述针对所述第一服务请求消息的响应消息。
  51. 如权利要求50所述的系统，其特征在于，所述服务消费网元，用于确定所述第一服务请求消息能够触发所述服务通信代理请求所述第二服务。
  52. 如权利要求50或51所述的系统，其特征在于，所述服务消费网元，用于确定使用模式D的间接通信模式请求所述第一服务。
  53. 如权利要求50-52任一项所述的系统，其特征在于，所述系统还包括：所述提供所述第二服务的网元；
    所述服务通信代理，还用于在从所述服务消费网元接收所述第一服务请求消息之后，向所述提供所述第二服务的网元发送第二服务请求消息，所述第二服务请求消息用于请求所述第二服务，所述第二服务请求消息包括第一客户认证凭证；
    所述提供所述第二服务的网元，用于接收来自于所述服务通信代理的所述第二服务请求消息，根据所述第一客户认证凭证认证所述服务消费网元，其中，根据所述第一客户认证凭证，认证所述服务消费网元，包括：判断自身的网络功能类型是否与所述第一网络功能类型和所述第二网络功能类型中的一个或者多个相匹配；在所述服务消费网元认证成功时，向所述服务通信代理发送针对所述第二服务请求消息的响应消息，所述针对所述第二服务请求消息的响应消息用于指示提供所述第二服务。
  54. 如权利要求53所述的系统，其特征在于，所述第一客户认证凭证还包括以下一项或者多项：所述服务消费网元的标识或者有效时间信息，其中，所述有效时间信息用于表征所述第一客户认证凭证的有效时间；
    所述提供所述第二服务的网元，用于在根据所述第一客户认证凭证，认证所述服务消费网元时，还包括以下一项或者多项：
    验证所述第一客户认证凭证的签名是否通过、根据所述第一客户认证凭证包括的有效时间信息验证所述第一客户认证凭证是否过期或者验证所述第一客户认证凭证中的所述 服务消费网元的标识与用于签名所述第一客户认证凭证的证书中的网元的标识是否相同。
  55. 如权利要求50-54任一项所述的系统，其特征在于，所述提供所述第二服务的网元为网络存储功能网元。
  56. 如权利要求50-55任一项所述的系统，其特征在于，所述第二服务用于提供所述服务提供网元的信息。
  57. 如权利要求53-56任一项所述的系统，其特征在于，所述系统还包括：所述服务提供网元；
    所述服务通信代理，还用于在所述服务消费网元认证成功时，从所述提供所述第二服务的网元接收所述针对所述第二服务请求消息的响应消息；根据所述针对所述第二服务请求消息的响应消息向所述服务提供网元发送第三服务请求消息，所述第三服务请求消息用于请求所述第一服务，所述第三服务请求消息包括所述第一客户认证凭证；
    所述服务提供网元，用于接收来自于所述服务通信代理的第三服务请求消息，所述服务提供网元根据所述第一客户认证凭证认证服务消费网元；其中，根据所述第一客户认证凭证，认证所述服务消费网元，包括：判断自身的网络功能类型是否与所述第一网络功能类型和所述第二网络功能类型中的一个或者多个相匹配；在所述服务消费网元认证成功时，向所述服务通信代理发送针对所述第三服务请求消息的响应消息，所述针对所述第三年服务请求消息的响应消息用于指示提供所述第一服务。
  58. 如权利要求57所述的系统，其特征在于，所述第一客户认证凭证还包括以下一项或者多项：所述服务消费网元的标识或者有效时间信息，其中，所述有效时间信息用于表征所述第一客户认证凭证的有效时间；
    所述服务提供网元，用于在根据所述第一客户认证凭证，认证所述服务消费网元时，还包括以下一项或者多项：
    验证所述第一客户认证凭证的签名是否通过、根据所述第一客户认证凭证包括的有效时间信息验证所述第一客户认证凭证是否过期或者验证所述第一客户认证凭证中的所述服务消费网元的标识与用于签名所述第一客户认证凭证的证书中的网元的标识是否相同。
  59. 如权利要求57或58所述的系统，其特征在于，当所述针对所述第三年服务请求消息的响应消息用于指示提供所述第一服务时，所述针对所述第一服务请求消息的响应消息用于指示提供所述第一服务。
  60. 一种通信方法，其特征在于，该方法包括：
    服务消费网元向服务通信代理发送第一服务请求消息，所述第一服务请求消息用于向服务提供网元请求第一服务，所述第一服务请求消息包括第一客户认证凭证，所述第一客户认证凭证用于认证所述服务消费网元，所述第一客户认证凭证包括第一网络功能类型和第二网络功能类型，所述第一网络功能类型为所述服务提供网元的网络功能类型，所述第二网络功能类型为提供第二服务的网元的网络功能类型；其中，所述第二服务与所述第一服务关联；
    所述服务通信代理从所述服务消费网元接收所述第一服务请求消息；
    所述服务通信代理向所述服务消费网元发送针对所述第一服务请求消息的响应消息。
  61. 如权利要求60所述的方法，其特征在于，还包括：所述第二服务用于提供所述第一服务对应的访问令牌，所述第一服务对应的访问令牌用于表征所述服务消费网元具有获取所述第一服务的权限。
  62. 如权利要求60或者61所述的方法，其特征在于，还包括：
    所述服务消费网元确定不存在所述第一服务对应的可用的访问令牌。
  63. 如权利要求62所述的方法，其特征在于，所述服务消费网元确定不存在所述第一服务对应的可用的访问令牌，包括：
    所述服务消费网元确定未存储所述第一服务对应的访问令牌；或，
    所述服务消费网元确定存储的所述第一服务对应的访问令牌已过期。
  64. 如权利要求63所述的方法，其特征在于，还包括：
    在存储的所述第一服务对应的访问令牌已过期的情况下，所述服务消费网元删除所述已过期的访问令牌。
  65. 如权利要求60所述的方法，其特征在于，所述第二服务用于提供所述服务提供网元的信息。
  66. 如权利要求60-65任一项所述的方法，其特征在于，还包括：
    所述服务消费网元确定所述第一服务请求消息能够触发所述服务通信代理请求所述第二服务。
  67. 如权利要求66所述的方法，其特征在于，所述服务消费网元确定所述第一服务请求消息能够触发所述服务通信代理请求所述第二服务，包括：
    所述服务消费网元根据以下一项或多项，确定所述第一服务请求消息能够触发所述服务通信代理请求所述第二服务：
    未存储第一终端设备的上下文，所述第一终端设备与所述第一服务关联；或者，未存储所述第一服务的上下文；或者，所述服务提供网元归属于第一切片且未存储所述第一切片对应的上下文；或者，所述服务消费网元首次与所述服务通信代理通信。
  68. 如权利要求60-67任一项所述的方法，其特征在于，还包括：
    所述服务消费网元确定使用模式D的间接通信模式请求所述第一服务。
  69. 如权利要求60-68任一项所述的方法，其特征在于，还包括：
    所述服务消费网元向所述服务通信代理发送第二服务请求消息，所述第二服务请求消息用于请求所述第一服务，所述第二服务请求消息包括第二客户认证凭证，所述第二客户认证凭证包括所述第一网络功能类型，所述第二客户认证凭证用于认证所述服务消费网元；
    所述服务通信代理从所述服务消费网元接收所述第二服务请求消息；
    所述服务通信代理向所述服务消费网元发送针对所述第二服务请求消息的响应消息，所述针对所述第二服务请求消息的响应消息包括指示信息；
    所述服务消费网元向所述服务通信代理发送第一服务请求消息，包括：
    所述服务消费网元根据所述指示信息，向所述服务通信代理发送所述第一服务请求消息。
  70. 如权利要求69所述的方法，其特征在于，所述指示信息包括第三客户认证凭证，所述第三客户认证凭证包括所述第二网络功能类型；其中，所述第三客户认证凭证用于认证所述提供所述第二服务的网元；
    所述服务消费网元根据所述指示信息，向所述服务通信代理发送所述第一服务请求消息，包括：
    在根据所述第三客户认证凭证对所述提供所述第二服务的网元认证成功的情况下，所述服务消费网元向所述服务通信代理发送所述第一服务请求消息。
  71. 如权利要求60-70任一项所述的方法，其特征在于，所述提供所述第二服务的网元为网络存储功能网元。
  72. 如权利要求60-71任一项所述的方法，其特征在于，所述第一客户认证凭证还包括以下一项或者多项：所述服务消费网元的标识或者有效时间信息，其中，所述有效时间信息用于表征所述第一客户认证凭证的有效时间。
PCT/CN2022/091806 2021-05-09 2022-05-09 一种通信方法及装置 WO2022237741A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
EP22806704.7A EP4325918A1 (en) 2021-05-09 2022-05-09 Communication method and apparatus
BR112023023383A BR112023023383A2 (pt) 2021-05-09 2022-05-09 Métodos de comunicação, aparelho de comunicação, meio de armazenamento legível por computador e sistema de comunicação
KR1020237042282A KR20240005900A (ko) 2021-05-09 2022-05-09 통신 방법 및 장치
US18/504,954 US20240073212A1 (en) 2021-05-09 2023-11-08 Communication method and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110502638.5A CN115396892A (zh) 2021-05-09 2021-05-09 一种通信方法及装置
CN202110502638.5 2021-05-09

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/504,954 Continuation US20240073212A1 (en) 2021-05-09 2023-11-08 Communication method and apparatus

Publications (1)

Publication Number Publication Date
WO2022237741A1 true WO2022237741A1 (zh) 2022-11-17

Family

ID=84028853

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/091806 WO2022237741A1 (zh) 2021-05-09 2022-05-09 一种通信方法及装置

Country Status (7)

Country Link
US (1) US20240073212A1 (zh)
EP (1) EP4325918A1 (zh)
KR (1) KR20240005900A (zh)
CN (1) CN115396892A (zh)
BR (1) BR112023023383A2 (zh)
TW (1) TWI820696B (zh)
WO (1) WO2022237741A1 (zh)

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2020260187A1 (en) * 2019-06-24 2020-12-30 Nokia Technologies Oy Apparatuses and methods relating to authorisation of network functions
CN114189557A (zh) * 2020-08-25 2022-03-15 诺基亚技术有限公司 通信网络中的访问令牌的管理

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111435932B (zh) * 2019-01-14 2021-10-01 华为技术有限公司 一种令牌处理方法及装置
WO2020220919A1 (zh) * 2019-04-29 2020-11-05 华为技术有限公司 一种代理订阅的授权方法及装置
CN115065476A (zh) * 2019-04-29 2022-09-16 华为技术有限公司 通信方法和通信设备

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2020260187A1 (en) * 2019-06-24 2020-12-30 Nokia Technologies Oy Apparatuses and methods relating to authorisation of network functions
CN114189557A (zh) * 2020-08-25 2022-03-15 诺基亚技术有限公司 通信网络中的访问令牌的管理

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
ANONYMOUS: "3 Generation Partnership Project; Technical Specification Group Services and System Aspects; Security architecture and procedures for 5G system (Release 16)", 3GPP STANDARD; TECHNICAL SPECIFICATION; 3GPP TS 33.501, vol. SA WG3, no. V16.5.0, 16 December 2020 (2020-12-16), pages 1 - 253, XP051999376 *
NOKIA, NOKIA SHANGHAI BELL: "Reference of general SBA/SBI aspect in 33.513", 3GPP DRAFT; S3-203103, vol. SA WG3, 30 October 2020 (2020-10-30), pages 1 - 2, XP051949677 *

Also Published As

Publication number Publication date
TWI820696B (zh) 2023-11-01
KR20240005900A (ko) 2024-01-12
TW202245442A (zh) 2022-11-16
BR112023023383A2 (pt) 2024-01-23
EP4325918A1 (en) 2024-02-21
CN115396892A (zh) 2022-11-25
US20240073212A1 (en) 2024-02-29

Similar Documents

Publication Publication Date Title
US11844014B2 (en) Service authorization for indirect communication in a communication system
US10645583B2 (en) Security management for roaming service authorization in communication systems with service-based architecture
US20210234706A1 (en) Network function authentication based on public key binding in access token in a communication system
US10849191B2 (en) Unified authentication for heterogeneous networks
JP2020506578A (ja) ユーザ機器の二次認証
CN113438196B (zh) 一种服务授权方法、装置及系统
WO2019017837A1 (zh) 网络安全管理的方法及装置
WO2021037175A1 (zh) 一种网络切片的管理方法及相关装置
WO2020053481A1 (en) Network function authentication using a digitally signed service request in a communication system
CN112514436B (zh) 发起器和响应器之间的安全的、被认证的通信
US20210045050A1 (en) Communications method and apparatus
US20230396602A1 (en) Service authorization method and system, and communication apparatus
WO2022134089A1 (zh) 一种安全上下文生成方法、装置及计算机可读存储介质
WO2021099675A1 (en) Mobile network service security management
CN113472714A (zh) 认证终端设备的方法及装置
WO2020012065A1 (en) Security management for unauthorized requests in communication system with service-based architecture
WO2022237741A1 (zh) 一种通信方法及装置
WO2021079023A1 (en) Inter-mobile network communication security
WO2023159603A1 (zh) 一种安全实现方法及装置、终端设备、网元
CN116528234B (zh) 一种虚拟机的安全可信验证方法及装置
WO2023178686A1 (zh) 安全实现方法、装置、终端设备、网元、及凭证生成设备
WO2024093923A1 (zh) 通信方法和通信装置
WO2023246753A1 (zh) 通信方法和装置
JP2024521649A (ja) 通信方法および装置
WO2023011158A1 (zh) 一种证书管理方法和装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22806704

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2023569715

Country of ref document: JP

WWE Wipo information: entry into national phase

Ref document number: 2022806704

Country of ref document: EP

REG Reference to national code

Ref country code: BR

Ref legal event code: B01A

Ref document number: 112023023383

Country of ref document: BR

ENP Entry into the national phase

Ref document number: 2022806704

Country of ref document: EP

Effective date: 20231116

ENP Entry into the national phase

Ref document number: 20237042282

Country of ref document: KR

Kind code of ref document: A

WWE Wipo information: entry into national phase

Ref document number: 1020237042282

Country of ref document: KR

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 112023023383

Country of ref document: BR

Kind code of ref document: A2

Effective date: 20231108