WO2022247569A1 - 通信方法和网络设备 - Google Patents

通信方法和网络设备 Download PDF

Info

Publication number
WO2022247569A1
WO2022247569A1 PCT/CN2022/089453 CN2022089453W WO2022247569A1 WO 2022247569 A1 WO2022247569 A1 WO 2022247569A1 CN 2022089453 W CN2022089453 W CN 2022089453W WO 2022247569 A1 WO2022247569 A1 WO 2022247569A1
Authority
WO
WIPO (PCT)
Prior art keywords
authorization
authorization method
network
network element
service
Prior art date
Application number
PCT/CN2022/089453
Other languages
English (en)
French (fr)
Inventor
张博
何承东
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2022247569A1 publication Critical patent/WO2022247569A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/02—Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
    • H04W8/08—Mobility data transfer
    • H04W8/14—Mobility data transfer between corresponding nodes

Definitions

  • the present application relates to the communication field, and more specifically, to a communication method and network equipment.
  • the service access between different network function (network function, NF) network elements is based on the authorization mechanism.
  • the authorization mechanism For example: including static authorization method and Oauth authorization method.
  • the network function network element needs to determine the execution authorization method when performing service access. Especially in the roaming scenario, if the service consumption function network element and the service provision function network element belong to different operators, then the authorization mechanism between the two network elements is different, and the problem of authorization conflict will occur, resulting in service interruption. .
  • a communication method which can be performed by a network element of a network repository function (NRF) or a network element of a security edge protection proxy (SEPP), and the method includes: determining the first An authorization method and a second authorization method, the first authorization method is the authorization method corresponding to the network to which the network element with the service consumption function belongs, and the second authorization method is the authorization method corresponding to the network to which the network element with the service provision function belongs; according to the first authorization The method and the second authorization method determine a third authorization method, and the third authorization method is an authorization method for accessing the service providing function network element; and the third authorization method is sent.
  • NRF network repository function
  • SEPP security edge protection proxy
  • determining the second authorization method includes: receiving a first request message, where the first request message includes identification information of the network to which the service providing function network element belongs; according to the The identification information of the network to which the service providing function network element belongs determines the second authorization mode.
  • determining the second authorization mode may be that the network element of the network storage function NRF or the network element of the security edge protection proxy SEPP configures the second authorization mode.
  • the peer-end authorization method such as the authorization method corresponding to the public land mobile network identity (PLMN ID2) of the network element to which the service provider function (NF service producer, NFp) belongs
  • PLMN ID2 public land mobile network identity
  • the NRF or SEPP can receive the NFc
  • the local NRF or SEPP can directly determine the final authorization method for accessing the NFp according to the authorization method corresponding to the network PLMN ID1 to which the NFc network element belongs and the authorization method corresponding to the network PLMN ID2 to which the peer NFp belongs , to reduce authorization conflicts between NFc and NFp.
  • the first request message includes a discovery request message and/or an authorization request message.
  • determining the first authorization method includes: obtaining identification information of the network to which the network element with the service consumption function belongs; determining according to the identification information of the network to which the network element with the service consumption function belongs The first authorization method.
  • obtaining the identification information of the network element to which the network element of the service consumption function belongs includes: receiving the identification information of the network to which the network element of the service consumption function belongs, or according to the first network storage function network The connection between the element and the first security edge protection proxy network element determines the identification information of the network to which the service consumption function network element belongs.
  • the identification information of the network to which the service consumption function network element belongs is received from the service consumption function network element NFc.
  • the NRF or SEPP may directly configure the authorization method corresponding to the access service provisioning function NFp network element, that is, the first authorization method, and the NRF or SEPP directly stores the first authorization method.
  • NRF or SEPP does not need to determine the final authorization method according to the authorization methods supported by PLMN ID1 and PLMN ID2.
  • This implementation method can not only avoid authorization conflicts when different network elements access services each other, but also reduce signaling overhead.
  • the third authorization method is an open authorization method, and the method further includes: receiving a second request message, where the second request message is used to request to obtain the first token , the first token is used to authorize the service consumption functional network element to access the first service; determine the first token; and send the first token.
  • the NRF network element is responsible for the judgment of service authorization. For example, before the service consumption function NFc network element accesses the service provision function NFp network element, it will first send a request message to the NRF. After the NRF judges that the NFc is allowed to access the NFp, it will generate an authorization Token token, and send token to NFc. Make NFc carry token when accessing NFp service. After NFp successfully verifies the token, it will provide corresponding services for NFc.
  • both the first request information and the second request message also include one or more of the following information: identification information of the network to which the network element with the service consumption function belongs, the service type of the network element with the service provision function, and the network element with the service consumption function type of business.
  • determining the third authorization method according to the first authorization method and the second authorization method includes: according to the shared The authorization method determines the third authorization method.
  • the shared authorization method is the static authorization method or the open authorization method
  • determine that the static authorization method or the open authorization method is the third authorization method
  • the shared authorization method is the static authorization method and the open authorization method Authorization mode
  • the third authorization mode is determined according to a local policy, or the open authorization mode is determined as the third authorization mode.
  • the intersection of the first authorization method and the second authorization method is selected to further determine the authorization method used by the NFc to access the NFp service, so as to avoid business interruption due to authorization conflicts.
  • the common authorization method of the first authorization method and the second authorization method supports the static authorization method and the open authorization method at the same time, it can be determined that the open authorization method is the authorization method used by the final NFc to access the NFp service; it can also be based on the local
  • the policy further determines the third authorization mode, for example, according to the capability of the NFc network element, or the authorization policy mechanism of the network where the NFc is located, which is not limited in this application.
  • the NRF or SEPP directly determines the third authorization according to the network to which the NFp belongs (for example, PLMN ID2), without further determining the authorization method for accessing the NFp service according to the common method of the first authorization method and the second authorization method, and Send the third authorization method to the NFc.
  • PLMN ID2 the network to which the NFp belongs
  • a communication method which can be executed by a service consumption function (NF service consumer, NFc) network element, and the method includes: receiving a third authorization method, the third authorization method is to access the service providing function network
  • the authorization method of the element is determined according to the first authorization method and the second authorization method, the first authorization method is the authorization method corresponding to the network to which the service consumption function network element belongs, and the second authorization method is the service providing an authorization method corresponding to the network to which the functional network element belongs; and requesting the first service to the service providing functional network element according to the third authorization method.
  • the third authorization method that is, the authorization method for accessing the network element of the service providing function
  • sending a service request to the NFp according to the third authorization method is determined through negotiation, thereby solving the problem of authorization conflicts between NFc and NFp network elements, and ensuring normal service access between network elements with different network functions.
  • the method before receiving the third authorization method, further includes: sending a first request message, where the first request message is used to request to obtain the third authorization method , the first request message includes identification information of the network to which the service providing function network element belongs.
  • the first request message includes a discovery request message and/or an authorization request message.
  • sending the first request message includes: sending the first request message to a network storage function NRF network element or a security edge protection proxy SEPP network element or a service communication proxy (service communication proxy, SCP) network element.
  • the current 5G architecture includes SCP network elements.
  • the SCP is the agent of the NF network element, and it can also be understood that the SCP is an entrance and exit of an SCP domain, or a proxy node. Therefore, the negotiation between different domains can also be completed through SCP, such as NFc-SCP1-SCP2-NFp. Therefore, the above method of direct negotiation through SEPP can also use the method of SCP.
  • the SCP can be replaced by the above-mentioned SEPP, and the PLMN ID can be replaced by the SCP domain identifier.
  • This application applies to the negotiation between different domains, and the mechanism of determining the authorization mode of this domain through the domain identifier.
  • NRF domain For example, NRF domain, NF set domain, SCP domain, security domain, etc.
  • Domain IDs can also be different, such as SCP domain ID, NF set domain ID, security domain ID, NRF domain ID, etc.
  • the following describes the roaming scenario where the domain identifier is the PLMN ID as an example.
  • requesting the first service from the service providing functional network element according to the third authorization method includes: when the third authorization method is a development authorization method, sending to the NRF A second request message, where the second request message is used to request to obtain a first token, and the first token is used to authorize the service consumption function network element to access the first service; receive the first token; provide the service with The functional network element sends a message for requesting the first service, where the message for requesting the first service includes the first token.
  • the NRF network element is responsible for the judgment of service authorization. For example, before the service consumption function NFc network element accesses the service provision function NFp network element, it will first send a request message to the NRF. After the NRF judges that the NFc is allowed to access the NFp, it will generate an authorization Token token, and send token to NFc. Make NFc carry token when accessing NFp service. After NFp successfully verifies the token, it will provide corresponding services for NFc.
  • requesting the first service from the service providing functional network element according to the third authorization method includes: when the third authorization method is a static authorization method, the NFc directly uses the The static authorization method requests services from NFp. For example, the service request is sent to the NFp, and the NFp judges whether to authorize the NFc to use the requested service according to a static authorization method (such as a local policy).
  • a static authorization method such as a local policy
  • both the first request information and the second request message also include one or more of the following information: identification information of the network to which the network element with the service consumption function belongs, the service type of the network element with the service provision function, and the network element with the service consumption function type of business.
  • receiving the third authorization method includes: receiving the third authorization method from a network storage function network element or a security edge protection agent network element.
  • a communication method which can be executed by a second network storage function NRF2 network element or a second security edge protection agent SEPP2 network element, and the method includes: receiving a request message, the request message is used to request to obtain An authorization method for accessing the second functional network element, the request message includes the authorization method corresponding to the network to which the first functional network element belongs; determining the authorization method corresponding to the network to which the second functional network element belongs; according to the corresponding authorization method of the network to which the first functional network element belongs determine the authorization method for accessing the second functional network element; and send the authorization method for accessing the second functional network element.
  • the request information includes indication information for instructing NRF2 or SEPP2 to return the authorization mode of the second functional network element.
  • SEPP2 can simultaneously provide services for multiple networks to which multiple NFcs belong, or only provide services for the network PLMN ID1 to which NFcs belong. If SEPP2 provides services for networks corresponding to multiple PLMN IDs, then SEPP2 needs to receive a specific PLMN ID from SEPP1, and determine the corresponding authorization method according to the received PLMN ID.
  • the authorization method for accessing the second functional network element is determined, effectively solving the problem of authorization conflicts between different network elements, and ensuring different network functions Service access between NEs is normal.
  • the first functional network element includes a first network storage functional network element or a first security edge protection proxy network element
  • the second functional network element includes a second network element The storage function network element or the second security edge protection proxy network element.
  • determining the authorization method corresponding to the network to which the second functional network element belongs includes: acquiring identification information of the network to which the second functional network element belongs; The identification information of the network to which the network element belongs determines the authorization mode corresponding to the network to which the second functional network element belongs.
  • the authorization method includes: determining the authorization method for accessing the second functional network element according to the shared authorization method of the authorization method corresponding to the network to which the first functional network element belongs and the authorization method corresponding to the network to which the second functional network element belongs;
  • the shared authorization method is the static authorization method or the open authorization method
  • determine that the static authorization method or the open authorization method is the authorization method for accessing the second functional network element
  • the shared authorization method is the static authorization method
  • the authorization method and the open authorization method determine the authorization method for accessing the second functional network element according to the local policy, or determine that the open authorization method is the authorization method for accessing the second functional network element.
  • the authorization method for accessing the second functional network element is determined according to the local policy, which may be determined based on the capability of the NFc network element, or the mechanism of the authorization policy of the network where the NFc is located, which is not limited in this application. .
  • a communication method which can be executed by the network element of the first network storage function NRF1 or the network element of the first security edge protection agent SEPP1, and the method includes: determining the authorization corresponding to the network to which the first functional network element belongs method; send a request message, the request message is used to request to obtain the authorization method for accessing the second functional network element, and the request message includes the authorization method corresponding to the network to which the first functional network element belongs; receive the authorization method for accessing the second functional network element , the authorization method for accessing the second functional network element is determined according to the authorization method corresponding to the network to which the first functional network element belongs and the authorization method corresponding to the network to which the second functional network element belongs; sending the authorization method for accessing the second functional network element .
  • the request information includes indication information for instructing NRF2 or SEPP2 to return the authorization mode of the second functional network element.
  • SEPP2 can simultaneously provide services for multiple networks to which multiple NFcs belong, or only provide services for the network PLMN ID1 to which NFcs belong. If SEPP2 provides services for networks corresponding to multiple PLMN IDs, then SEPP2 needs to receive a specific PLMN ID from SEPP1, and determine the corresponding authorization method according to the received PLMN ID.
  • the authorization method for accessing the second functional network element is obtained by requesting the peer NRF2 or SEPP2, and receiving the authorization method for accessing the second functional network element. Then send the authorization method for accessing the second functional network element to the NFc, so that the NFc can send a service request to the second functional network element based on the authorization method, avoid authorization conflicts between network elements, and ensure normal service access.
  • the first functional network element includes a first network storage functional network element or a first security edge protection proxy network element
  • the second functional network element includes a second network element The storage function network element or the second security edge protection proxy network element.
  • determining the authorization method corresponding to the network to which the first functional network element belongs includes: acquiring identification information of the network to which the first functional network element belongs; The identification information of the network to which the network element belongs determines the authorization mode corresponding to the network to which the first functional network element belongs.
  • a communication method which can be executed by the network element of the first network storage function NRF1 or the network element of the first security edge protection agent SEPP1, and the method includes: sending a request message, the request message including obtaining the second Indication information of the authorization method corresponding to the network to which the functional network element belongs; receiving the authorization method corresponding to the network to which the second functional network element belongs; according to the authorization method corresponding to the network to which the second functional network element belongs and the authorization method corresponding to the network to which the first functional network element belongs The authorization method determines the authorization method for accessing the second functional network element; and sends the authorization method for accessing the second functional network element.
  • the NRF1 network element or the SEPP1 network element sends an authorization method for accessing the second functional network element to the NFc, so that the NFc can send a service request to the second functional network element based on the authorization method, avoiding authorization conflicts between network elements, and ensuring service Access proceeds normally.
  • the authorization method corresponding to the network to which the second functional network element belongs is obtained by sending a request to obtain the indication information of the authorization method corresponding to the network described by the second functional network element, and then according to the first functional network element and the second functional network element
  • the authorization methods corresponding to the two functional network elements further determine the final authorization method, that is, the authorization method for the NFc to access the second functional network element.
  • the authorization mode for accessing the second functional network element is determined through the negotiation between the NRFs at both ends or the negotiation between the SEPPs. This implementation method has better timeliness, because if the authorization method of the peer network changes, the latest authorization mechanism can be obtained through negotiation between network elements at both ends.
  • the first functional network element includes a first network storage functional network element or a first security edge protection proxy network element
  • the second functional network element includes a second network element The storage function network element or the second security edge protection proxy network element.
  • a notification message is sent, the notification message is used to indicate the authorization method for accessing the first functional network element, and the notification message includes the network to which the first functional network element belongs The corresponding authorization method.
  • the NRF1 network element or the SEPP1 network element sends the notification message to the NRF2 network element or the SEPP2 network element, so that subsequent NF network elements in the network where the NFp is located can request access to the authorization method corresponding to the NF network element in the network where the first functional network element is located
  • the NRF2 network element or SEPP2 network element can directly send the authorization method corresponding to the first functional network element to the NFp, avoiding the negotiation process, which can not only solve the problem of authorization conflicts between network elements, but also reduce signaling overhead.
  • the identification information of the network to which the first functional network element belongs is obtained; and the network to which the first functional network element belongs is determined according to the identification information of the network to which the first functional network element belongs The corresponding authorization method.
  • the third request information includes a third indication
  • the third indication is used to indicate an authorization mode that needs to be returned to the second functional network element.
  • a communication method which can be executed by the network element of the second network storage function NRF2 or the network element of the second security edge protection agent SEPP2, and the method includes: receiving a request message, the request message including obtaining the second indication information of the authorization mode corresponding to the network to which the functional network element belongs; determining the authorization mode corresponding to the network to which the second functional network element belongs; and sending the authorization mode corresponding to the network to which the second functional network element belongs.
  • the indication information of the authorization mode corresponding to the network of the second functional network element is obtained by receiving the request, and the authorization mode corresponding to the network to which the second functional network element belongs is sent to NRF1 or SEPP1.
  • the authorization mode for accessing the second functional network element is determined through the negotiation between the NRFs at both ends or the negotiation between the SEPPs.
  • This implementation method has better timeliness, because if the authorization method of the peer network changes, the latest authorization mechanism can be obtained through negotiation between network elements at both ends.
  • the first functional network element includes a first network storage functional network element or a first security edge protection proxy network element
  • the second functional network element includes a second network element The storage function network element or the second security edge protection proxy network element.
  • a notification message is received, the notification message is used to indicate the authorization method for accessing the first functional network element, and the notification message includes the network to which the first functional network element belongs. The corresponding authorization method.
  • the NRF2 network element or the SEPP2 network element when the NRF2 network element or the SEPP2 network element receives the notification message from the NRF1 network element or the SEPP1 network element to facilitate subsequent NFp requests to access the authorization method corresponding to the first functional network element, the NRF2 network element or the SEPP2 network element can directly send the The authorization mode corresponding to the first functional network element is sent to the NFp, avoiding the negotiation process, which can not only solve the problem of authorization conflict between network elements, but also reduce signaling overhead.
  • determining the authorization method corresponding to the network to which the second functional network element belongs includes: obtaining identification information of the network to which the second functional network element belongs; The identification information of the network to which the network element belongs determines the authorization mode corresponding to the network to which the second functional network element belongs.
  • a communication method which can be executed by a service consumption function NFc network element, and the method includes: receiving authorization indication information, where the authorization indication information is used to determine an authorization method for accessing a service provision function network element, the The authorization indication information is one of a plurality of indication information, and the multiple indication information includes first indication information and second indication information, the first indication information is used to indicate a static authorization mode, and the second indication information is used to indicate a static authorization mode.
  • the open authorization method is preferred in the authorization method and the open authorization method; determine the authorization method for accessing the service providing function network element according to the authorization instruction information; request the second service to the service providing function network element according to the authorization method for accessing the service providing function network element .
  • the open authorization method is preferred in the static authorization method and the open authorization method because the open authorization method is relatively more applicable.
  • the NFc by receiving the authorization indication information, further determine the authorization method for accessing the service providing function network element; according to the authorization method for accessing the service providing function network element, request the service providing function network element.
  • determining the authorization method for accessing the service providing function network element according to the authorization indication information includes:
  • the authorization method corresponding to the network to which the service consumption function network element belongs includes the open authorization method, or the static authorization method and the open authorization method, and the authorization indication information is the second indication information, determine to access the service providing function network element
  • the authorized method is the open authorization method, or it is determined according to the local policy whether the authorization method for accessing the service providing function network element is the open authorization method; or
  • the authorization method corresponding to the network to which the network element with the service consumption function belongs includes the static authorization method, and the authorization indication information is the first indication information or the second indication information, it is determined that the authorization mode for accessing the network element with the service provision function is the Static authorization method.
  • the authorization method for accessing the second functional network element is determined according to the local policy, which may be determined based on the capability of the NFc network element, or the mechanism of the authorization policy of the network where the NFc is located, which is not limited in this application. .
  • the NFc further determines through the authorization indication that the authorization mode for accessing the service providing function network element is a static authorization mode and/or an open authorization mode. And request services from NFp according to the determined authorization method.
  • the final authorization method is a static method
  • NFc directly uses the static authorization method to send a service request to NFp
  • the final authorization method is an open authorization method
  • NFc needs to first send a request to NRF to obtain an authorization token token, and then carry The authorization token token requests services from NFp, and after NFp verifies the token successfully, it provides corresponding services to NFc.
  • the plurality of indication information further includes third indication information, the third indication information is used to indicate the open authorization mode, and the access service provisioning is determined according to the authorization indication information.
  • Authorization methods for functional network elements including:
  • the authorization method corresponding to the network to which the network element of the service consumption function belongs includes the open authorization method, or the static authorization method and the open authorization method, and the authorization indication information is the third indication information, it is determined according to the third indication information to access the
  • the authorization method of the service providing function network element is the open authorization method; or
  • the authorization method corresponding to the network to which the service consuming function network element belongs is the static authorization method
  • the authorization method for accessing the service providing function network element is the open authorization method
  • send a rejection message or determine the access service providing function network according to the local policy
  • the authorization method of meta is the static authorization method.
  • a notification message is sent, the notification message is used to indicate the authorization method for accessing the network element with the service consumption function, and the notification message includes the information of the network to which the network element with the service consumption function belongs.
  • the NFc network element sends a notification message to the NFp network element, so that when the subsequent NF network element in the network where the NFp is located requests access to the NF network element in the network where the service consumption function NFc is located, the authorization method corresponding to the NFc network element can be directly sent to NFp avoids the negotiation process, which can not only solve the problem of authorization conflicts between network elements, but also reduce signaling overhead.
  • a communication method may be performed by a second service providing function (NF service producer, NFp) network element, the method includes: determining the authorization indication information of the authorization mode for accessing the service providing function network element,
  • the authorization indication information is one of multiple indication information, and the multiple indication information includes first indication information and second indication information, the first indication information is used to indicate the static authorization mode, and the second indication information is used to indicate the
  • the open authorization method is preferred among the static authorization method and the open authorization method; the authorization indication information is sent.
  • the open authorization method is preferred in the static authorization method and the open authorization method because the open authorization method is relatively more applicable.
  • NFp determines and sends the authorization indication information to NFc, so that NFc completes the determination of the authorization method for accessing the service providing function network element, reducing unnecessary negotiation procedures.
  • a notification message is received, the notification message is used to indicate the authorization method for accessing the network element with the service consumption function, and the notification message includes the network to which the network element with the service consumption function belongs The identification information and the authorization method corresponding to the network to which the network element with the service consumption function belongs.
  • the NFp network element receives the notification message from the NFc network element, so that when the subsequent NFp requests to access the service consumption function NFc network element, it can directly send the authorization method corresponding to the NFc network element to the NFp, avoiding the negotiation process, and can solve the problem Authorization conflicts between network elements can also reduce signaling overhead.
  • the first authorization manner and the second authorization manner include a static authorization manner and/or an open authorization manner.
  • the third authorization mode is a static authorization mode and/or an open authorization mode.
  • the static authorization method static
  • the open authorization method open authorization, Oauth
  • authorization parameters such as tokens, which includes authorization centers, business users, business An entity such as a provider or owner of a resource. The authorization center will authorize whether the business user is allowed to use the service of the business provider. Tokens are distributed to business consumers, if allowed.
  • the business user sends the token to the service provider, and when the token verification is successful, the service provider provides services for the business user.
  • a network storage function NRF network element is defined to judge the service authorization, and the network storage function network element corresponds to the service consumption function network element.
  • a network device configured to execute by a network storage function NRF network element or a security edge protection agent SEPP network element, and the method includes: a processing unit configured to determine the first authorization method and the second authorization method , the first authorization method is the authorization method corresponding to the network to which the network element with the service consumption function belongs, and the second authorization method is the authorization method corresponding to the network to which the network element with the service provision function belongs; the processing unit is also used to A third authorization method is determined with the second authorization method, and the third authorization method is an authorization method for accessing a network element with a service providing function; a transceiver unit is configured to send the third authorization method.
  • the transceiving unit may perform processing related to receiving/sending in the above first aspect; the processing unit may perform other processing in the above first aspect except receiving/sending.
  • a network device configured to be executed by a service consumption function NFc network element, and the method includes: a transceiver unit, configured to receive a third authorization method, the third authorization method is to access the service providing function network element
  • the third authorization method is determined according to the first authorization method and the second authorization method.
  • the first authorization method is the authorization method corresponding to the network to which the network element with the service consumption function belongs.
  • the second authorization method is the service provider An authorization method corresponding to the network to which the functional network element belongs; a processing unit configured to provide the service to the service and request the first service to the functional network element according to the third authorization method.
  • the transceiving unit may perform processing related to receiving/sending in the above second aspect; the processing unit may perform other processing in the above second aspect except receiving/sending.
  • a network device configured to be performed by a second network storage function NRF2 network element or a second security edge protection agent SEPP2 network element, the method includes: a transceiver unit, configured to receive a request message, the The request message is used to request an authorization method for accessing the second functional network element, and the request message includes the authorization method corresponding to the network to which the first functional network element belongs; the processing unit is used to determine the authorization method corresponding to the network to which the second functional network element belongs The processing unit is also used to determine the authorization method for accessing the second functional network element according to the authorization method corresponding to the network to which the first functional network element belongs and the authorization method corresponding to the network to which the second functional network element belongs; the transceiver unit, It is also used to send the authorization mode for accessing the second functional network element.
  • a transceiver unit configured to receive a request message, the The request message is used to request an authorization method for accessing the second functional network element, and the request message includes the authorization method corresponding to the network to which the first functional
  • the transceiving unit may perform processing related to receiving/sending in the above third aspect; the processing unit may perform other processing in the above third aspect except receiving/sending.
  • a network device is provided.
  • the method can be executed by the network element of the first network storage function NRF1 or the network element of the first security edge protection agent SEPP1.
  • the method includes: a processing unit, configured to determine the network element of the first function network The authorization method corresponding to the network to which the element belongs; the transceiver unit is used to send a request message, the request message is used to request the authorization method for accessing the second functional network element, and the request message includes the authorization method corresponding to the network to which the first functional network element belongs
  • the transceiver unit is also used to receive the authorization method for accessing the second functional network element.
  • the authorization method for accessing the second functional network element is based on the authorization method corresponding to the network to which the first functional network element belongs and the authorization method to which the second functional network element belongs.
  • the authorization method corresponding to the network is determined; the transceiver unit is also used to send the authorization method for accessing the second functional network element.
  • the transceiving unit may perform processing related to receiving/sending in the fourth aspect above; the processing unit may perform other processing in the fourth aspect above except receiving/sending.
  • a network device configured to execute by a first network storage function NRF1 network element or a first security edge protection agent SEPP1 network element, and the method includes: a transceiver unit, configured to send a request message, the The request message includes instruction information for obtaining the authorization method corresponding to the network to which the second functional network element belongs; the transceiver unit is also used to receive the authorization method corresponding to the network to which the second functional network element belongs; the processing unit is used to The authorization method corresponding to the network to which the network element belongs and the authorization method corresponding to the network to which the first functional network element belongs determine the authorization method for accessing the second functional network element; the transceiver unit is also used to send the authorization method for accessing the second functional network element .
  • the transceiving unit may perform processing related to receiving/sending in the fifth aspect above; the processing unit may perform other processing in the fifth aspect above except receiving/sending.
  • a network device in a fourteenth aspect, is provided, and the method may be executed by a network element of a second network storage function NRF2 or a network element of a second security edge protection agent SEPP2, and the method includes: receiving a request message, the request message including obtaining the first Indication information of the authorization mode corresponding to the network to which the second functional network element belongs; determining the authorization mode corresponding to the network to which the second functional network element belongs; and sending the authorization mode corresponding to the network to which the second functional network element belongs.
  • the transceiving unit may perform processing related to receiving/sending in the sixth aspect above; the processing unit may perform other processing in the sixth aspect above except receiving/sending.
  • a network device configured to be executed by a service consumption function NFc network element, and the method includes: a transceiver unit, configured to receive authorization indication information, and the authorization indication information is used to determine access to the service provision function network
  • the authorization mode of the unit, the authorization indication information is one of multiple indication information, the multiple indication information includes first indication information and second indication information, the first indication information is used to indicate the static authorization mode, and the second indication information
  • the information is used to indicate that the open authorization method is preferentially used in the static authorization method and the open authorization method;
  • the processing unit is used to determine the authorization method for accessing the service providing function network element according to the authorization instruction information;
  • the processing unit is also used to access the service according to the The authorization method of the network element providing the function requests the second service from the network element providing the service function.
  • the transceiving unit may perform processing related to receiving/sending in the seventh aspect above; the processing unit may perform other processing in the seventh aspect above except receiving/sending.
  • a network device configured to be performed by a second service providing function (NF service producer, NFp) network element, and the method includes: a processing unit, configured to determine authorization for accessing the service providing function network element
  • the authorization indication information of the mode, the authorization indication information is one of multiple indication information, the multiple indication information includes the first indication information and the second indication information, the first indication information is used to indicate the static authorization mode, and the second indication information
  • the instruction information is used to indicate that the open authorization method is preferred to be used in the static authorization method and the open authorization method; the transceiver unit is used to send the authorization instruction information.
  • the transceiving unit may perform processing related to reception/transmission in the above eighth aspect; the processing unit may perform other processing in the above eighth aspect except reception/transmission.
  • a network device including: a processor, and optionally, a memory, the processor is used to control the transceiver to send and receive signals, the memory is used to store a computer program, and the processor is used to read from the memory calling and running the computer program, so that the network device executes the method in the first aspect or any possible implementation manner of the first aspect, or the method in the second aspect or any possible implementation manner of the second aspect, Or the third aspect or the method in any possible implementation manner of the third aspect, or the fourth aspect or the method in any possible implementation manner of the fourth aspect, or the fifth aspect or any one of the fifth aspect
  • processors there are one or more processors, and one or more memories.
  • the memory can be integrated with the processor, or the memory can be set separately from the processor.
  • the terminal device further includes a transceiver, and the transceiver may specifically be a transmitter (transmitter) and a receiver (receiver).
  • a communication device including: a unit for implementing the method in the first aspect or any possible implementation manner of the first aspect; or for implementing the second aspect or any one of the second aspect A method in a possible implementation; or a method for realizing the third aspect or any of the possible implementations of the third aspect, or the fourth aspect or a method in any of the possible implementations of the fourth aspect, or the fifth A method in any possible implementation manner of the aspect or the fifth aspect, or a method in the sixth aspect or any possible implementation manner of the sixth aspect, or a possible implementation manner of the seventh aspect or the seventh aspect The method in the method, or the method in the eighth aspect or any possible implementation manner of the eighth aspect.
  • a communication system including: a network device configured to execute the method in the first aspect or any possible implementation of the first aspect above; or the second aspect or any one of the second aspects A method in a possible implementation; or the third aspect or a method in any possible implementation of the third aspect, or the fourth aspect or a method in any possible implementation of the fourth aspect, or the fifth aspect or the method in any possible implementation of the fourth aspect.
  • the method in any possible implementation manner of the fifth aspect, or the sixth aspect or the method in any possible implementation manner of the sixth aspect, or the seventh aspect or the method in any possible implementation manner of the seventh aspect , or the eighth aspect or the method in any possible implementation manner of the eighth aspect.
  • a computer-readable storage medium stores computer programs or codes, and when the computer programs or codes run on a computer, the computer executes the above-mentioned first aspect Or the method in any possible implementation manner of the first aspect, the second aspect or the method in any possible implementation manner of the second aspect, the third aspect or the method in any possible implementation manner of the third aspect, the fourth aspect
  • the method in any possible implementation manner of the aspect or the fourth aspect, the method in the fifth aspect or any possible implementation manner of the fifth aspect, the sixth aspect or the method in any possible implementation manner of the sixth aspect A method, the seventh aspect or a method in any possible implementation manner of the seventh aspect, and the eighth aspect or a method in any possible implementation manner of the eighth aspect.
  • a chip including at least one processor, the at least one processor is coupled to a memory, the memory is used to store a computer program, and the processor is used to call and run the computer program from the memory, Make the network device installed with the system-on-a-chip execute the method in the above-mentioned first aspect or any possible implementation of the first aspect, the second aspect or the method in any possible implementation of the second aspect, and the third aspect or the method in any possible implementation of the second aspect The method in any possible implementation manner of the third aspect.
  • the chip may include an input circuit or interface for sending information or data, and an output circuit or interface for receiving information or data.
  • a computer program product comprising: computer program code, when the computer program code is run by a network device, the network device executes the above-mentioned first aspect or the first A method in any possible implementation of the second aspect, a method in any of the possible implementations of the second aspect or the second aspect, a method in the third aspect or any of the possible implementations of the third aspect, the fourth aspect or the method in any of the possible implementations of the third aspect.
  • the peer-end authorization mode by configuring the peer-end authorization mode, or increasing the negotiation between the network storage function network element or the security edge protection agent network element between NFc and NFp, or extending the indication information in NFp to reduce unnecessary Necessary negotiation process, and then determine the final authorization method for NFc to access NFp.
  • the method can complete the negotiation of the authorization mechanism between different network function network elements, so that the service consumption function network element obtains the authorization mode of service access, thereby solving the problem of authorization conflict, and ensuring the normal progress of service access.
  • FIG. 1 is a schematic diagram of an example of a communication system of the present application.
  • Fig. 2 is a schematic diagram of an example of the method for obtaining an authorization token in this application.
  • FIG. 3 is a schematic diagram of an example of an authorization negotiation scenario of the present application.
  • Fig. 4 is a schematic diagram of an example of requesting to obtain information of a service providing function network element in the present application.
  • FIG. 5 is a schematic diagram of an example of the communication method of the present application.
  • FIG. 6 is a schematic diagram of an example of an authorization mechanism negotiation method between network elements of the present application.
  • FIG. 7 is a schematic diagram of another example of the authorization mechanism negotiation method between network elements of the present application.
  • FIG. 8 is a schematic diagram of another example of an authorization mechanism negotiation method between network elements of the present application.
  • FIG. 9 is a schematic diagram of another example of an authorization mechanism negotiation method between network elements of the present application.
  • FIG. 10 is a schematic diagram of another example of the authorization mechanism negotiation method between network elements of the present application.
  • FIG. 11 is a schematic diagram of an example of a communication device of the present application.
  • FIG. 12 is a schematic diagram of another example of the communication device of the present application.
  • FIG. 13 is a schematic diagram of another example of the communication device of the present application.
  • FIG. 14 is a schematic diagram of an example of a network device of the present application.
  • Fig. 15 is a schematic diagram of another example of the network device of the present application.
  • FIG. 16 is a schematic diagram of another example of the network device of the present application.
  • the technical solution of the embodiment of the present application can be applied to various communication systems, for example: general packet radio service (general packet radio service, GPRS), long term evolution (long term evolution, LTE) system, LTE frequency division duplex (frequency division duplex) , FDD) system, LTE time division duplex (time division duplex, TDD), universal mobile telecommunications system (universal mobile telecommunications system, UMTS), global interconnection microwave access (worldwide interoperability for microwave access, WIMAX) communication system, the fifth generation (5th Generation, 5G) system or new wireless (new radio, NR), can also be extended to similar wireless communication systems, such as wireless fidelity (wireless-fidelity, WIFI), and the third generation partnership project (3rd generation partnership project, 3GPP) related cellular systems, etc.
  • GPRS general packet radio service
  • LTE long term evolution
  • LTE frequency division duplex frequency division duplex
  • FDD frequency division duplex
  • TDD time division duplex
  • TDD time division duplex
  • UMTS universal mobile
  • the mobile communication system will not only support traditional communication, but also support, for example, device to device (device to device, D2D) communication, machine to machine (machine to machine, M2M) communication, machine type Communication (machine type communication, MTC), vehicle networking (vehicle to everything, V2X) communication, for example, vehicle to vehicle (vehicle to vehicle, V2V) communication, vehicle to infrastructure (vehicle to infrastructure, V2I) communication, vehicle to pedestrian (vehicle to pedestrian, V2P) communication, vehicle to network (vehicle to network, V2N) communication, etc., vehicle-to-vehicle communication long-term evolution technology (long term evolution-vehicle, LTE-V), car networking, Internet of Things (Internet of Things, IoT) ), long term evolution-machine (LTE-M) etc.
  • LTE-V long term evolution technology
  • IoT Internet of Things
  • LTE-M long term evolution-machine
  • the network device may be a device deployed in a radio access network to provide a wireless communication function for a terminal device, and may be a device for communicating with a terminal device or a chip of the device.
  • the network equipment includes but not limited to: radio network controller (radio network controller, RNC), base station controller (base station controller, BSC), home base station (for example, home evolved nodeB, or home node B, HNB), baseband unit (baseband unit, BBU), access point (access point, AP), wireless relay node, wireless backhaul node, transmission point (transmission point, TP) or sending and receiving point (transmission and reception point) in the wireless fidelity system , TRP), etc., can also be a gNB or a transmission point (TRP or TP) in a 5G (such as NR) system, or one or a group (including multiple antenna panels) antenna panels of a base station in a 5G system, or it can also be It is a network node constituting a 5G (such as
  • the network equipment in the embodiment of the present application may include various forms of macro base stations, micro base stations (also called small stations), relay stations, access points, etc., and may also be evolved base stations (evolutional nodeB, eNB or eNodeB), can also be a wireless controller in a cloud radio access network (cloud radio access network, CRAN) scenario, or the network device can be a relay station, an access point, a wearable device or a vehicle-mounted device, a wearable device, and a 5G Or a network device in a future network or a network device in a future evolved public land mobile communication network (PLMN), etc.
  • evolutional nodeB, eNB or eNodeB can also be a wireless controller in a cloud radio access network (cloud radio access network, CRAN) scenario
  • the network device can be a relay station, an access point, a wearable device or a vehicle-mounted device, a wearable device, and a 5G Or a network device in a future network or a
  • network devices may include centralized units (centralized units, CUs) and distributed units (distributed units, DUs).
  • the network device may also include a radio frequency unit (radio unit, RU) and an active antenna unit (active antenna unit, AAU).
  • the CU implements some functions of the network device, such as responsible for processing non-real-time protocols and services, and realizing functions of the radio resource control (radio resource control, RRC) and packet data convergence protocol (PDCP) layers.
  • DU implements some functions of network equipment, such as responsible for processing physical layer protocols and real-time services, and realizes radio link control (radio link control, RLC) layer, media access control (media access control, MAC) layer and physical (physical, PHY) ) layer functions.
  • RLC radio link control
  • MAC media access control
  • PHY physical
  • the AAU implements some physical layer processing functions, radio frequency processing and related functions of active antennas. Because the information of the RRC layer will eventually become the information of the PHY layer, or be transformed from the information of the PHY layer. Therefore, under this framework, high-level signaling (for example, RRC layer signaling) can also be considered to be sent by the DU, or sent by the DU+AAU.
  • the network device may be a CU node, or a DU node, or a device including a CU node and a DU node.
  • the CU can be divided into network devices in the access network RAN, and the CU can also be divided into network devices in the core network (core network, CN), which is not limited here.
  • the network device provides services for the cell, and the terminal device communicates with the cell through transmission resources (for example, frequency domain resources, or spectrum resources) allocated by the network device.
  • the cell may belong to a macro base station (for example, a macro eNB or a macro gNB, etc.), or It may belong to a base station corresponding to a small cell, and the small cell here may include: a metro cell, a micro cell, a pico cell, a femto cell, etc., these Small cells have the characteristics of small coverage and low transmission power, and are suitable for providing high-speed data transmission services.
  • Fig. 1 is a schematic diagram of an example of a network architecture 100 applied to the embodiment of the present application.
  • the right side of the dotted line represents a local shared land network (home public land mobile network, HPLMN), and the left side of the dotted line represents a visited public land mobile network (visited public land mobile network, VPLMN).
  • HPLMN home public land mobile network
  • VPLMN visited public land mobile network
  • (wireless) access network (radio access network, (R) AN) network element 120 including RAN equipment and AN equipment, mainly used to provide network access functions for authorized terminal equipment in a specific area, and can according to the level of terminal equipment, service Different quality transmission tunnels are used according to the requirements.
  • the RAN device is mainly a 3GPP network wireless network device, and the AN may be an access network device defined by non-3GPP.
  • User plane network element 130 mainly provides user plane service processing functions for forwarding and receiving user data in terminal equipment, that is, packet routing and forwarding, anchoring functions, quality of service QoS mapping and execution, and uplink Identification and routing to the data network, downlink packet buffering and notification triggering of downlink data arrival, connection with external data network, etc., can receive user data from the data network, transmit it to the terminal device through the access network device, and can also pass the access network device The network access device receives user data from the terminal device and forwards it to the data network.
  • the transmission resources and scheduling functions that provide services for terminal devices in the user plane function (user plane function, UPF) network element can be managed and controlled by the session management function (session management function, SMF) network element.
  • the user plane network element may be a user plane function UPF network element.
  • the user plane network element may still be a UPF network element, or may have other names, which are not limited in this application.
  • Network storage network element 180 used to maintain real-time information of all network function services in the network, responsible for network element control, and performing registration, discovery and authorization functions of network function (network function, NF) network elements.
  • network function network function
  • the network storage network element may be a network storage function (network repository function, NRF) network element.
  • NRF network repository function
  • the network storage network element may still be an NRF network element, or may have other names, which are not limited in this application.
  • the functional network element can be divided into a service consumption functional network element (NF service consumer, NFc) and a service providing functional network element (NF service producer, NFp).
  • NFc is a service consumer NF
  • NFp is a service provider NF.
  • NFc obtains services provided by NFp from NFp.
  • the functional network element may also be an entity such as a terminal, a base station, a network element, a controller, or a server, which is not limited in this application.
  • NF is taken as an example for description in the following.
  • network element may also be referred to as an entity, device, device, or module, etc., which are not specifically limited in this application.
  • SMF SMF network element
  • SMF SMF network element
  • the above-mentioned network element or function may be a network element in a hardware device, or a software function running on dedicated hardware, or a virtualization function instantiated on a platform (for example, a cloud platform).
  • network elements included in the communication system listed above are only illustrative, and the present application is not limited thereto.
  • it may also include but not limited to:
  • Network slice selection function network element used to select a group of network slice instances for user equipment, determine the allowed network slice selection assistance information (network slice selection assistance information, NSSAI) and determine the AMF set that can serve user equipment, which can be slice selection Function network element (network slice selection function, NSSF);
  • NSSAI network slice selection assistance information
  • NSSF slice selection Function network element
  • Binding support function network element used to find the policy control function network element PCF associated with the session;
  • SEPP Security edge protection proxy
  • NWDA network data analytics function
  • the N2 interface is the reference point of the RAN network element 20 and the AMF network element 160, and is used for sending non-access stratum (non-access stratum, NAS) messages, etc.
  • the N3 interface is the RAN network The reference point between the element 120 and the UPF network element 130 is used to transmit user plane data, etc.
  • the N4 interface is the reference point between the SMF network element 170 and the UPF network element 130, which is used to transmit tunnel identification information such as the N3 connection , data cache indication information, and downlink data notification messages and other information
  • the N6 interface is the reference point between the UPF network element 130 and the DN network element 140, and is used to transmit user plane data
  • the N9 interface is the UPF network element 130 and another Reference point between UPF network elements
  • N32 interface is between v-security edge protection proxy (v-security edge protection proxy, vSEPP) network element and h-security edge protection proxy (h-security edge protection proxy, hSEPP) network element The reference point between v-security
  • SBA service based architecture
  • the scope of the service based architecture is limited to the control plane network elements of the core network, and does not include the user plane function UPF network elements.
  • the interfaces N3, N9, N6, and N4 supported by UPF are not service interfaces. It can be seen from the above architecture diagram that the network element devices that can be connected to UPF include SMF, RAN, DN and another UPF.
  • the above-mentioned network architecture applied to the embodiment of the present application is only an example network architecture described from the perspective of a service-oriented architecture, and the network architecture applicable to the embodiment of the present application is not limited thereto. Any network element that can implement the above-mentioned All functional network architectures are applicable to this embodiment of the application.
  • network functional entities such as AMF, SMF, PCF, GMF, and UDM are called network function NF network elements; or, in other network architectures, AMF, SMF, PCF, GMF, and UDM, etc.
  • a collection of network elements may be called a control plane function (control plane function, CPF) network element.
  • this application takes the devices NF, NRF, and SEPP as examples to describe the method for establishing a session.
  • the NF described later in this application can be replaced by a network function network element network
  • the NRF can be replaced by a network storage network element
  • the SEPP can be replaced by a roaming security network element.
  • the device is a chip in the NF body, a chip in the NRF, or a chip in the SEPP entity, refer to the specific description of the devices being the NF entity, the NRF entity, and the SEPP entity, and will not repeat the introduction.
  • This application does not limit the applicable network elements of NF, for example, all functional network element devices such as RAN, UPF, and AMF are applicable.
  • the embodiment of the present application does not specifically limit the specific structure of the execution subject of the method provided in the embodiment of the present application, as long as the program that records the code of the method provided in the embodiment of the present application can be executed according to the method provided in the embodiment of the present application Just communicate.
  • the execution subject of the method provided by the embodiment of the present application may be a network device, or a functional module in the network device that can call a program and execute the program; or a component (such as a chip or a circuit) that can be used in the network device.
  • various aspects or features of the present application may be implemented as a method, apparatus, or article of manufacture using standard programming and/or engineering techniques.
  • article of manufacture covers a computer program accessible from any computer readable device, carrier or media.
  • computer-readable media may include, but are not limited to: magnetic storage devices (e.g., hard disk, floppy disk, or tape, etc.), optical disks (e.g., compact disc (compact disc, CD), digital versatile disc (digital versatile disc, DVD) etc.), smart cards and flash memory devices (for example, erasable programmable read-only memory (EPROM), card, stick or key drive, etc.).
  • magnetic storage devices e.g., hard disk, floppy disk, or tape, etc.
  • optical disks e.g., compact disc (compact disc, CD), digital versatile disc (digital versatile disc, DVD) etc.
  • smart cards and flash memory devices for example, erasable programmable read-only memory (EPROM), card, stick or key drive, etc.
  • various storage media described herein can represent one or more devices and/or other machine-readable media for storing information.
  • the term "machine-readable medium” may include, but is not limited to, wireless channels and various other media capable of storing, containing and/or carrying instructions and/or data.
  • the service-oriented architecture draws on the successful experience of the IT system service-oriented/micro-service architecture, and realizes the decoupling and integration of network functions through modularization.
  • Each 5G functional network element is an independent function.
  • the interaction between all NFs on the control plane adopts a service interface, and the same service can be invoked by multiple NFs.
  • the standard defines two authorization methods for mutual access between NFs, one is static authorization and the other is Oauth authorization.
  • the static authorization mode is a mechanism based on a local authorization policy.
  • SMF judges whether to allow AMF to access its own services according to the parameters and local policies in the service request sent by AMF. If the AMF is allowed to access its own service according to the local authorization policy, it will provide the service for the AMF.
  • the local policy may be whether to allow the AMF type network to access its own service, and this application does not limit the example of the local policy.
  • the Oauth authorization method refers to an open authorization mechanism based on authorization parameters such as tokens, which includes entities such as an authorization center, a service user, a service provider, or a resource owner.
  • the authorization center will authorize whether the business user is allowed to use the service of the business provider.
  • Tokens are distributed to business consumers, if allowed.
  • the business user sends the token to the service provider, and when the token verification is successful, the service provider provides services for the business user.
  • an NRF network element is defined, which is responsible for judging service authorization.
  • the service consumption function network element NF service consumer, NFc
  • the NRF judges that the NFc is allowed to access the NFp
  • it will generate an authorization Token token, and send token to NFc.
  • the NFc accesses the NFp service, it sends a service request carrying a token.
  • NFp successfully verifies the token, it will provide corresponding services for NFc.
  • Fig. 2 has shown the method 200 that the NFc of practical application obtains token, as shown in Fig. 2, specific implementation steps include:
  • the service consumption function network element NFc (described by NF1) completes registration with the network storage function network element NRF;
  • the NFc sends a request message to the NRF (described by NF2); correspondingly, the NRF receives the request message from the NFc.
  • the request message is used to request to obtain an authorization token token for sequentially accessing the NFp.
  • the request message includes: NF1 instance ID (for example, NF Instance Id(s) of the NF service consumer), NF type of NF2, business expected by NF1 (for example, expected NF service name(s)), and the expected NFc NF type of NFp.
  • the NRF determines whether to authorize the NF1 to obtain the token according to the local policy.
  • the NRF calculates the token, and protects the integrity of the token based on a digital signature or a message authentication code.
  • the token includes a claim
  • the claim includes: NF instance ID of NRF, NF1 instance ID, NF type of NF2, desired service name and validity period, etc.
  • the NRF sends an authorization response message to the NFc; correspondingly, the NFc receives the authorization response message from the NRF.
  • the response message is used to indicate that the NFc is authorized to access the NFp, and the response message includes an authorization token token.
  • the NFc can request the NFp to access the service and send a service request.
  • NFp provides services for NFc after successfully verifying the token.
  • the static authorization method is used for interaction between two network elements.
  • NFc and NFp belong to different operators, due to the difference in authorization mechanism, NFp will also reject the service request of NFc, thus causing service interruption.
  • NFc supports static authorization
  • NFp supports Oauth authorization
  • Figure 3 shows four scenarios in which NFc and NFp negotiate based on different authorization methods.
  • both NFc and NFp in scenario 1 only support static authorization, and the two can be directly negotiated through static authorization.
  • Access and service in Scenario 2, NFc only supports static authorization mode (static), NFp supports both static authorization mode (static) and Oauth authorization mode, when NFc makes an access request to NFp, NFp can provide NFc with corresponding services; in Scenario 3, NFc supports both static authorization methods (static) and Oauth authorization methods, and NFp only supports static authorization methods (static), so the two can only access and serve based on static authorization methods (static), NFc It is necessary to further determine whether to use the Oauth authorization method.
  • the NFp will reject the corresponding access request of the NFc. Further determine whether to adopt the Oauth authorization method, if the NFc directly uses the static authorization method (static) to initiate an access request, then the token or Oauth authorization method as a stronger authorization control capability may never be adopted. Therefore, there is a problem of inconsistent authorization mechanisms between NFc and NFp in the above scenarios 3 and 4, and authorization conflicts between NFs are prone to occur. In addition, if NFp only supports Oauth authorization, but NFc supports both static authorization and Oauth authorization, when NFc directly initiates static authorization, it will also be rejected by NFp. There are many conflict scenarios between NFc and NFp, which will not be repeated here.
  • FIG. 4 shows a schematic diagram of an example of an NFc discovery process 400 applicable to this application. As shown in FIG. 4 , the specific implementation steps include:
  • the service consumption function network element NFc sends a discovery service request message to the network storage function NRF network element; correspondingly, the NRF receives the discovery service request message from the NFc.
  • the service request may be Nnrf_NFDiscovery_Request.
  • the discovery request message is used to request information on NFp that can provide services for NFc.
  • the NFc may send a discovery request message related to the SMF to the NRF, for the NFc to access services from the SMF.
  • the NRF authorizes and agrees to the discovery service request message.
  • the NRF determines and agrees to authorize the NFc to access services to the SMF according to the local network policy.
  • the NRF sends a discovery request response message to the NFc; correspondingly, the NFc receives the discovery request response message from the NRF.
  • the NRF will send the information in the Nfprofile of the NFp (for example, SMF) to the NFc.
  • the NF service of the NF profile includes oauth2required
  • the NFc accessing the NF produce needs to execute the Oauth mechanism.
  • the definition of the standard is also unreasonable in the specific implementation, and it is prone to roaming, or the problem that NFs in different domains cannot communicate with each other. For example, NFp in domain 1 requires the Oauth mechanism, and NFc in domain 2 only supports static authorization.
  • the domain here can be different concepts such as SCP domain, NRF domain, NF set domain, and security domain.
  • How to negotiate the authorization method between the two NFs is an urgent problem to be solved, that is, whether to use the Oauth authorization method or the static authorization method for business access and services between the two NFs.
  • the current protocol is also unreasonable, and it is prone to the problem that NFs cannot communicate with each other during roaming or between domains.
  • the present application provides a communication method, starting with whether to consider the Oauth2required indication information, using NRF or SEPP to configure the peer authorization method, and then determining the final authorization method, so that the NFc determines to use the static authorization method or the Oauth authorization method for access.
  • the method can solve the problem of inconsistent authorization mechanisms between network elements (for example, NFc and NFp), and avoid authorization conflicts between NFs.
  • FIG. 5 is a schematic diagram of an example of an authorization mechanism negotiation method applicable to the embodiment of the present application, and the specific implementation step 500 includes:
  • the NRF network element of the network storage function or the SEPP network element of the security edge protection proxy determines the first authorization mode and the second authorization mode.
  • the first authorization mode is an authorization mode corresponding to the network to which the service consumption function network element belongs
  • the second authorization mode is an authorization mode corresponding to the network to which the service provision function network element belongs.
  • determining the second authorization method includes: NRF or SEPP receiving a first request message from NFc, where the first request message includes identification information of the network to which the service providing function network element belongs; according to the service providing function network The identification information of the network to which the element belongs determines the second authorization mode.
  • the NFc sends the first request message to a service communication proxy (service communication proxy, SCP) network element.
  • service communication proxy service communication proxy, SCP
  • the current 5G architecture includes SCP network elements.
  • the SCP is the agent of the NF network element, and it can also be understood that the SCP is an entrance and exit of an SCP domain, or a proxy node. Therefore, the negotiation between different domains can also be completed through SCP, such as NFc-SCP1-SCP2-NFp. Therefore, the above method of direct negotiation through SEPP can also use the method of SCP.
  • the SCP can be replaced by the above-mentioned SEPP, and the PLMN ID can be replaced by the SCP domain identifier.
  • determining the second authorization mode may be that the network element of the network storage function NRF or the network element of the security edge protection proxy SEPP configures the second authorization mode.
  • the peer-end authorization method such as the authorization method corresponding to the public land mobile network identity (PLMN ID2) of the network element to which the service provider function (NF service producer, NFp) belongs
  • PLMN ID2 public land mobile network identity
  • the NRF or SEPP can receive the NFc
  • the local NRF or SEPP can directly determine the final authorization method for accessing the NFp according to the authorization method corresponding to the network PLMN ID1 to which the NFc network element belongs and the authorization method corresponding to the network PLMN ID2 to which the peer NFp belongs , to reduce authorization conflicts between NFc and NFp.
  • the first request message includes a discovery request message and/or an authorization request message.
  • determining the first authorization method includes: acquiring identification information of the network to which the network element with the service consumption function belongs; and determining the first authorization method according to the identification information of the network to which the network element with the service consumption function belongs.
  • acquiring the identification information of the network to which the network element of the service consumption function belongs includes: receiving the identification information of the network to which the network element of the service consumption function belongs, or according to the communication between the first network storage function network element and the first security edge protection agent network element The connection determines the identification information of the network to which the network element with the service consumption function belongs.
  • the identification information of the network to which the service consumption function network element belongs is received from the service consumption function network element NFc.
  • the NRF or SEPP determines a third authorization method according to the first authorization method and the second authorization method.
  • the third authorization method is an authorization method for accessing the service providing function network element.
  • the first authorization method and the second authorization method include a static authorization method (static) and/or an open authorization method (Oauth).
  • the third authorization mode is a static authorization mode and/or an open authorization mode.
  • the static authorization method (static) is a mechanism based on a local authorization policy
  • the open authorization method (Oauth) requires a network storage function NRF network element to perform service authorization judgment, and the network storage function network element corresponds to the service consumption function network element.
  • the static authorization mode is a mechanism based on a local authorization policy.
  • the Oauth authorization method refers to an open authorization mechanism based on authorization parameters such as tokens, which includes entities such as an authorization center, a service user, a service provider, or a resource owner.
  • the authorization center will authorize whether the business user is allowed to use the service of the business provider.
  • Tokens are distributed to business consumers, if allowed.
  • the business user sends the token to the service provider, and when the token verification is successful, the service provider provides services for the business user.
  • an NRF network element is defined, which is responsible for judging service authorization.
  • the third authorization method is an open authorization method, and the method further includes: receiving a second request message, where the second request message is used to request to obtain a first token, and the first token is used to authorize the service consumption
  • the functional network element accesses the first service; determines the first token; and sends the first token.
  • the NRF network element is responsible for the judgment of service authorization. For example, before the service consumption function NFc network element accesses the service provision function NFp network element, it will first send a request message to the NRF. After the NRF judges that the NFc is allowed to access the NFp, it will generate an authorization Token token, and send token to NFc. Make NFc carry token when accessing NFp service. After NFp successfully verifies the token, it will provide corresponding services for NFc.
  • both the first request information and the second request message also include one or more of the following information: identification information of the network to which the network element with the service consumption function belongs, the service type of the network element with the service provision function, and the network element with the service consumption function type of business.
  • determining the third authorization method according to the first authorization method and the second authorization method includes: determining the third authorization method according to a shared authorization method of the first authorization method and the second authorization method; when the shared If the authorization method is the static authorization method or the open authorization method, it is determined that the static authorization method or the open authorization method is the third authorization method; when the shared authorization method is the static authorization method and the open authorization method, it is determined according to the local policy The third authorization method, or determine that the open authorization method is the third authorization method.
  • the intersection of the first authorization method and the second authorization method is selected to further determine the authorization method used by the NFc to access the NFp service, so as to avoid business interruption due to authorization conflicts.
  • the common authorization method of the first authorization method and the second authorization method supports the static authorization method and the open authorization method at the same time, it can be determined that the open authorization method is the authorization method used by the final NFc to access the NFp service; it can also be based on the local
  • the policy further determines the third authorization mode, for example, according to the capability of the NFc network element, or the mechanism of the authorization policy of the network where the NFc is located, which is not limited in this application.
  • NRF or SEPP directly determines the third authorization according to the network to which the NFp belongs (for example, PLMN ID2), without further determining the authorization method for accessing the NFp service according to the common method of the first authorization method and the second authorization method, And send the third authorization method to the NFc.
  • the NRF or SEPP sends the third authorization method to the network element of the service consumption function NFc; correspondingly, the NFc receives the third authorization method from the NRF or SEPP.
  • NRF or SEPP sends a notification message to the peer network storage function network element NRF2 or security edge protection agent network element SEPP2, the notification message is used to indicate the authorization method for accessing the NFc network element, and the notification message includes The authorization method corresponding to the PLMN ID1 of the network to which the NFc network element belongs.
  • the NRF2 network element or SEPP2 network element can directly send the authorization method corresponding to the NFc network element to NFp, avoiding the negotiation process. The problem of authorization conflict between network elements can be solved, and signaling overhead can also be reduced.
  • the NFc requests the first service from the service providing functional network element according to the third authorization manner.
  • requesting the first service from the service providing function network element according to the third authorization method includes: when the third authorization method is an open authorization method, sending a second request message to the NRF, the second request message It is used to request to obtain a first token, and the first token is used to authorize the service consumption function network element to access the first service; receive the first token; send a request to the service providing function network element to request the first A service message, the message for requesting the first service includes the first token.
  • the NRF network element is responsible for the judgment of service authorization. For example, before the service consumption function NFc network element accesses the service provision function NFp network element, it will first send a request message to the NRF. After the NRF judges that the NFc is allowed to access the NFp, it will generate an authorization Token token, and send token to NFc. Make NFc carry token when accessing NFp service. After NFp successfully verifies the token, it will provide corresponding services for NFc.
  • the NFc directly uses the static authorization method to request a service from the NFp.
  • the service request is sent to the NFp, and the NFp judges whether to authorize the NFc to use the requested service according to a static authorization method (such as a local policy).
  • a static authorization method such as a local policy
  • the peer network authorization method is configured through the network storage function network element, and the final authorization method is determined, so that the service consumption function network element obtains the authorization method for service access.
  • the specific implementation step 600 includes:
  • the network storage function network element (for example, NRF#1) configures the authorization mode corresponding to the peer end (for example, PLMN ID2).
  • NRF#1 belongs to domain 1
  • NRF#2 belongs to domain 2
  • domain 1 and domain 2 have different identifiers, which can be PLMN ID, SCP domain identifier, NRF domain identifier, etc.
  • Negotiation between different domains can be done through PLMN ID, SCP domain, NRF domain, NF set domain, security domain, etc.
  • NRF#1 belongs to operator 1
  • NRF#2 belongs to operator 2.
  • authorization modes are different between network function network elements of different operators, and authorization mechanisms between network function network elements of the same operator are the same.
  • NRF#1 and NRF#2 may belong to the same operator. In this case, the authorization method of the service type corresponding to NRF#1 is different from the authorization method of the service type corresponding to NRF#2.
  • NRF#1 and NRF#2 are configured with authorization methods corresponding to their respective PLMN IDs. That is, NRF#1 configures the authorization method corresponding to PLMN ID1, and NRF#2 configures the authorization method corresponding to PLMN ID2.
  • NRF#1 is configured with an authorization method corresponding to the peer PLMND ID2, or NRF#1 sends a request message to other network elements (for example, a control network element and/or a management network element), and the request message includes the peer PLMN ID2 is used to request the authorization method corresponding to the PLMN ID2.
  • Other network elements determine the authorization method corresponding to the PLMN ID2 according to the PLMN ID2 and send it to NRF#1.
  • the authorization method corresponding to the specific PLMN ID includes: a static authorization method (static), and/or an Oauth authorization method.
  • the service consumption function network element (for example, NFc) sends a discovery request message to NRF#1; correspondingly, NRF#1 receives the discovery request message from NFc.
  • the discovery request message includes the PLMN ID2, and the discovery request message is used to request and determine the information of the NFp that accesses the network corresponding to the PLMN ID2.
  • the discovery request message also includes PLMN ID1, other parameters corresponding to NFc, and other parameters corresponding to NFp expected to be accessed.
  • the PLMN ID1 is the identification information of the network where the NFc is located
  • the PLMN ID2 is the identification information of the network corresponding to the network element of the NFp network element that the NFc wishes to access to services.
  • the NFp may be a network element with a session management function SMF, or a network element with a policy control function PCF.
  • NRF#1 sends the discovery request message to NRF#2; correspondingly, NRF#2 receives the discovery request message from NRF#1.
  • the discovery request message is used to request to determine the information of the NFp that accesses the network corresponding to the PLMN ID2.
  • the discovery request message may include one or more of the following parameters: PLMN ID1, PLMN ID2, other parameters corresponding to NFc, and other parameters corresponding to NFp expected to be accessed.
  • the discovery request message may not include PLMN ID1, other parameters corresponding to NFc, and other parameters corresponding to NFp expected to be accessed.
  • NRF#1 when NRF#1 sends the discovery request message to NRF#2, it can first forward it to SEPP#2 through SEPP#1, and then send it to NRF#2.
  • SEPP#2 can determine the PLMN ID1 according to the remote PLMN ID information in the N32-f context negotiated with SEPP#1, or determine the PLMN ID1 according to the connection between SEPP#1 and SEPP#1, and send the PLMN ID1 to NRF#2.
  • other parameters corresponding to NFc and other parameters corresponding to NFp expected to be accessed may be the network service types of NFc and NFp, and the name of the discovery request message may be an existing service name, such as Nnrf_NFDiscovery_Request, also It may be a newly defined service name, which is not limited in this application.
  • NRF#2 sends a discovery response message to NRF#1; correspondingly, NRF#1 receives the discovery response message from NRF#2.
  • the discovery response message may include one or more of the following parameters: PLMN ID1, PLMN ID2, and other parameters corresponding to the NFp expected to be accessed.
  • steps S630 and S640 may refer to the content of the current discovery request message and the discovery response message, which is not limited in this application.
  • NRF#1 determines the final authorization method according to the configured authorization method corresponding to the peer PLMN ID2 and the authorization method corresponding to the PLMN ID1.
  • the final authorization method may indicate a static authorization method (static) or an Oauth authorization method, or may indicate both a static authorization method (static) and an Oauth authorization method.
  • the PLMN ID1 here may be obtained from the discovery request message sent by the NFc in step S620, or the identification information of the network where NRF#1 itself is located, that is, the PLMN ID1.
  • NRF#1 can determine whether it has stored or configured the corresponding final authorization method according to PLMN ID1 and PLMN ID2 after step S640. 1 and NRF#2 negotiate the authorization mechanism, proceed to the following step S660; otherwise, continue to execute step S650 to determine the final authorization mode.
  • the final authorization method stored in NRF#1 may be that NRF#1 determines the final authorization method according to the authorization method corresponding to PLMN ID1 and the authorization method corresponding to PLMN ID2, or may be stored in Inside NRF#1. Then, when NFc accesses the NFp corresponding to PLMN ID2, NRF#1 can directly determine and provide the final authorization method to NFc according to PLMN ID2, so as to promote business access and service between NFc and NFp.
  • the final authorization method is determined by taking the intersection method, that is, the final authorization method is determined according to the intersection of the authorization method corresponding to PLMN ID1 and the authorization method corresponding to PLMN ID2, specifically including:
  • intersection supports both the Oauth authorization method and the static authorization method, it can be determined according to the local network policy whether to use the Oauth authorization method or the static authorization method for the service access between NFc and NFp.
  • the Oauth authorization method can be directly selected for service access between NFc and NFp. Compared with the static authorization method, the Oauth authorization method has better authorization control and higher security.
  • step S650 may be executed at any step after step S610, and the specific execution location is not limited.
  • step S650 can be performed after step S620, that is, after receiving the discovery request message of NFc, NRF#1 can determine the final authorization method according to the authorization method corresponding to PLMN ID1 and the authorization method corresponding to PLMN ID2.
  • step S650 may be performed before step S620, that is, NRF#1 may inform NFc in advance of the final authorization method used when accessing NFp for services, and this implementation method may further reduce signaling overhead of NFc.
  • NRF#1 sends a discovery response message to NFc; correspondingly, NFc receives the discovery response message from NRF#1.
  • the discovery response message includes the final authorization mode.
  • the final authorization method can be carried in the payload (payload) or header (header) of the discovery response message, such as in the http header.
  • indication information may be added to the existing one or more headers to indicate the final authorization method; or in the discovery response message Add a header to carry the final authorization method information.
  • the final authorization method can be a static authorization method or an Oauth authorization method.
  • the NFc can request service access from the NFp according to the static authorization method or the Oauth authorization method; optionally, the final authorization can also support static authorization at the same time.
  • Authorization method and Oauth authorization method At this time, NFc needs a local policy to further determine which authorization method to use to request service access from NFp. That is, when NFc receives the static and Oauth authorization methods, it decides which authorization method to use.
  • the discovery response message may include the following parameters: other parameters corresponding to the NFp expected to be accessed.
  • other parameters corresponding to the NFp expected to be accessed may be information such as NFprofile of the NFp, and the name of the discovery response message may be a new service name, or an existing service name, such as Nnrf_NFDiscovery_Response, the present application There is no limit to this.
  • the final authorization method is determined by NRF#2.
  • NRF#2 configures the authorization mode corresponding to the peer PLMN ID1.
  • NRF#2 receives a discovery request message from NRF#1, and the request message includes PLMN ID1.
  • NRF#2 determines the final authorization method according to the authorization method corresponding to PLMN ID1 and the authorization method corresponding to PLMN ID2, and sends the final authorization method to NFc through NRF#1.
  • the specific implementation steps are similar to step S620 to step S660 in the above-mentioned method 600 . For the sake of brevity, details are not repeated here.
  • NFc sends an authorization request message to NRF#1; correspondingly, NRF#1 receives the authorization request message from NFc.
  • the authorization request message includes the PLMN ID2, and the authorization request message is used to request to determine the authorization method for accessing the network corresponding to the PLMN ID2.
  • the authorization request message also includes PLMN ID1, other parameters corresponding to NFc, and other parameters corresponding to NFp expected to be accessed.
  • the PLMN ID1 is the identification information of the network where the NFc is located
  • the PLMN ID2 is the identification information of the network corresponding to the network element of the NFp network element that the NFc wishes to access to services.
  • the NFp may be a network element with a session management function SMF, or a network element with a policy control function PCF.
  • the indication information includes PLMN ID1.
  • NRF#1 determines the final authorization method according to the configured authorization method corresponding to the peer PLMN ID2 and the authorization method corresponding to the PLMN ID1.
  • the final authorization method may indicate a static authorization method (static) or an Oauth authorization method, or may indicate both a static authorization method (static) and an Oauth authorization method.
  • the PLMN ID1 here may be obtained from the authorization request message sent by the NFc in step S670, or the identification information of the network where NRF#1 is located, that is, the PLMN ID1.
  • NRF#1 can determine whether it has the corresponding final authorization method according to the PLMN ID1 and PLMN ID2, if so, skip the step S680 of determining the final authorization method, and continue to the following step S690; otherwise, It is necessary to continue to execute step S680 to determine the final authorization mode.
  • the final authorization method stored in NRF#1 may be that NRF#1 determines the final authorization method according to the authorization method corresponding to PLMN ID1 and the authorization method corresponding to PLMN ID2, or may be stored in Inside NRF#1. Then, when NFc accesses the NFp corresponding to PLMN ID2, NRF#1 can directly determine and provide the final authorization method to NFc according to PLMN ID2, so as to promote business access and service between NFc and NFp.
  • the determination of the final authorization method adopts the intersection method, that is, the final authorization method is determined according to the intersection of the authorization method corresponding to the PLMN ID1 and the authorization method corresponding to the PLMN ID2, and the specific implementation is consistent with that in step S650. For the sake of brevity, details are not repeated here.
  • NRF#1 sends an authorization response message to NFc; correspondingly, NFc receives an authorization response message from NRF#1.
  • the authorization response message includes the final authorization mode.
  • the final authorization method can be carried in the payload (payload) or header (header) of the discovery response message, such as in the http header.
  • indication information can be added to the existing one or more headers to indicate the final authorization method; or in the discovery response message Add a header to carry the final authorization method information.
  • the final authorization method can be a static authorization method or an Oauth authorization method.
  • the NFc can request service access from the NFp according to the static authorization method or the Oauth authorization method; optionally, the final authorization can also support static authorization at the same time.
  • Authorization method and Oauth authorization method At this time, NFc needs a local policy to further determine which authorization method to use to request service access from NFp. That is, when NFc receives the static and Oauth authorization methods, it decides which authorization method to use.
  • the authorization response message may include the following parameters: other parameters corresponding to NFp.
  • the name of the authorization response message may be a new service name, such as Nnrf_Authorization_Response, which is not limited in this application.
  • the NFc determines whether to initiate a process of obtaining an authorization token according to the final authorization manner.
  • the NFc uses the static authorization method to directly send a service request to the NFp; when the final authorization method is Oauth, the NFc needs to first initiate a request to the NRF to obtain an authorization token token, and then Carry the token to send a service request to NFp, and NFp will provide corresponding business services for NFc after verifying the token successfully.
  • the specific implementation steps of obtaining the token have been described in the method 200, and for the sake of brevity, details are not repeated here.
  • the final authorization method is determined by NRF#2.
  • NRF#2 configures the authorization mode corresponding to the peer PLMN ID1.
  • NRF#2 receives an authorization request message from NRF#1, and the request message includes PLMN ID1.
  • NRF#2 determines the final authorization method according to the authorization method corresponding to PLMN ID1 and the authorization method corresponding to PLMN ID2, and sends the final authorization method to NFc through NRF#1.
  • the specific implementation steps are similar to step S670 to step S690 in the above method 600 . For the sake of brevity, details are not repeated here.
  • Fig. 7 is a schematic diagram of an example of the authorization mechanism negotiation method applicable to the embodiment of the present application.
  • the peer network authorization method is configured through the security edge protection proxy network element, and the final authorization method is determined, so that the service consumption function network element obtains the authorization method for service access .
  • the difference between this specific implementation and the above-mentioned method 600 is that the configuration and negotiation of the authorization mode are completed based on SEPP, which avoids the impact on NRF, and controls the authorized content between roaming security network elements.
  • SEPP service consumption function network element NFc, network storage function network element NRF#A, network storage function network element NRF#B, security edge protection agent network element SEPP#A and security edge protection agent network element SEPP# B
  • the specific implementation step 700 includes:
  • the security edge protection agent network element (for example, SEPP#A) configures the authorization mode corresponding to the peer end (for example, PLMN ID2).
  • NRF#A belongs to domain 1
  • NRF#B belongs to domain 2
  • domain 1 and domain 2 have different identifiers, which can be PLMN ID, SCP domain identifier, NRF domain identifier, etc.
  • Negotiation between different domains can be done through PLMN ID, SCP domain ID, NRF domain ID, NF set domain ID, security domain ID, etc.
  • NRF#A belongs to operator 1
  • NRF#B belongs to operator 2.
  • authorization modes are different between network function network elements of different operators, and authorization mechanisms between network function network elements of the same operator are the same.
  • NRF#A and NRF#B may belong to the same operator. In this case, the authorization method of the service type corresponding to NRF#A is different from the authorization method of the service type corresponding to NRF#B.
  • both NRF#A and NRF#B are configured with authorization methods corresponding to their respective PLMN IDs
  • both SEPP#A and SEPP#B are configured with authorization methods corresponding to their respective PLMN IDs. That is, NRF#A and SEPP#A configure the authorization method corresponding to PLMN ID1, and NRF#B and SEPP#B configure the authorization method corresponding to PLMN ID2.
  • SEPP#A and SEPP#B are connected through the N32 interface, and the information exchange between NRF#A and NRF#B needs to be transmitted through SEPP# and SEPP#B successively.
  • SEPP#A is configured with an authorization method corresponding to the peer PLMND ID2, or SEPP#A sends a request message to other network elements (for example, a control network element and/or a management network element), and the request message includes the peer PLMN ID2 is used to request the authorization method corresponding to the PLMN ID2.
  • Other network elements determine the authorization method corresponding to the PLMN ID2 according to the PLMN ID2 and send it to SEPP#A.
  • the authorization method corresponding to the specific PLMN ID includes: a static authorization method (static), and/or an Oauth authorization method.
  • the service consumption function network element (for example, NFc) sends a discovery request message to NRF#A; correspondingly, NRF#A receives the discovery request message from NFc.
  • NRF#A determines SEPP#A, and sends a discovery request message to NRF#B through SEPP#A and SEPP#B; correspondingly, NRF#B receives the discovery request message from NRF#A.
  • the discovery request message includes the PLMN ID2, and the discovery request message is used to request to determine the information of the NFp that accesses the network corresponding to the PLMN ID2.
  • the discovery request message also includes PLMN ID1, other parameters corresponding to NFc, and other parameters corresponding to NFp expected to be accessed.
  • the PLMN ID1 is the identification information of the network where the NFc is located
  • the PLMN ID2 is the identification information of the network corresponding to the network element of the NFp network element that the NFc wishes to access to services.
  • the NFp may be a network element with a session management function SMF, or a network element with a policy control function PCF.
  • the discovery request message in step S732 may not include other parameters corresponding to PLMN ID1, PLMN ID2, NFc and other parameters corresponding to the NFp expected to visit.
  • SEPP#B can determine the PLMN ID1 according to the remote PLMN ID information in the N32-f context negotiated with SEPP#A , or determine PLMN ID1 according to its connection with SEPP#A, and send PLMN ID1 to NRF#B.
  • the discovery request message includes PLMN ID1, which is used to request to determine the information of accessing the network corresponding to PLMN ID2.
  • the discovery request message also includes PLMN ID2, other parameters corresponding to NFc, and other parameters corresponding to NFp expected to be accessed.
  • step S720 to step S733 other parameters corresponding to NFp and other parameters corresponding to NFp expected to be accessed may be the network service types of NFc and NFp, and the name of the discovery response message may be an existing service name, such as Nnrf_NFDiscovery_Request, It can also be a newly defined service name, which is not limited in this application.
  • NRF#B sends a discovery response message to SEPP#A through SEPP#B; correspondingly, SEPP#A receives the discovery response message from NRF#B.
  • the discovery response message may include the following parameters: NFpofile corresponding to NFp and other parameters.
  • steps S732 and S742 may refer to the content of the current discovery request message and the discovery response message, which is not limited in this application.
  • SEPP#A determines the final authorization method according to the configured authorization method corresponding to the peer PLMN ID2 and the authorization method corresponding to PLMN ID1.
  • the final authorization method may indicate a static authorization method (static) or an Oauth authorization method, or may indicate both a static authorization method (static) and an Oauth authorization method.
  • the PLMN ID1 here may be obtained from the discovery request message sent by the NFc in step S731, or the identification information of the network where SEPP#A is located, that is, the PLMN ID1.
  • SEPP#A can determine whether it has stored or configured the corresponding final authorization method according to PLMN ID1 and PLMN ID2, or PLMNID2, and if so, skips step S750 of determining the final authorization method and continues Next step S760; otherwise, continue to execute step S750 to determine the final authorization method.
  • the final authorization method stored in SEPP#A can be that SEPP#A determines the final authorization method according to the authorization method corresponding to PLMN ID1 and the authorization method corresponding to PLMN ID2, or can be stored in Inside SEPP#A. Then, when NFc accesses NFp corresponding to PLMN ID2, SEPP#A can directly determine and provide the final authorization method to NFc according to PLMN ID2, so as to promote business access and service between NFc and NFp.
  • the determination of the final authorization method adopts the intersection method, that is, the final authorization method is determined according to the intersection of the authorization method corresponding to the PLMN ID1 and the authorization method corresponding to the PLMN ID2, and the specific implementation is consistent with that in step S650. For the sake of brevity, details are not repeated here.
  • PLMN ID1 PLMN ID2
  • PLMN ID2 is received from NRF#A.
  • PLMN ID1 can be obtained from the discovery request message sent by NFc in step S731; or the identification information of SEPP#A's own network, that is, PLMN ID1; or NRF#A determined according to the connection between SEPP#A and NRF#A The network ID where it is located, that is, PLMN ID1.
  • SEPP#A is determined based on the fully qualified domain name (fully qualified domain name, FQDN) of NRF#A received from NRF#A, and/or the address of NRF#AD, and/or the PLMN ID information in the certificate of NRF#A PLMN ID.
  • FQDN fully qualified domain name
  • step S750 may be executed at any step after step S731, and the specific execution location is not limited.
  • step S750 can be performed after step S731, that is, after SEPP#A receives the discovery request message of NRF#A, it can determine the final authorization method according to the authorization method corresponding to PLMN ID1 and the authorization method corresponding to PLMN ID2.
  • SEPP#A sends a discovery response message to NFc through NRF#A; correspondingly, NFc receives the discovery response message from SEPP#A.
  • the discovery response message includes the final authorization mode.
  • the final authorization method can be carried in the payload (payload) or header (header) of the discovery response message, such as in the http header.
  • indication information may be added to the existing one or more headers to indicate the final authorization method; or in the discovery response message Add a header to carry the final authorization method information.
  • the final authorization method can be a static authorization method or an Oauth authorization method.
  • the NFc can request service access from the NFp according to the static authorization method or the Oauth authorization method; optionally, the final authorization can also support static authorization at the same time.
  • Authorization method and Oauth authorization method At this time, NFc needs a local policy to further determine which authorization method to use to request service access from NFp. That is, when NFc receives the static and Oauth authorization methods, it decides which authorization method to use.
  • the discovery response message may include the following parameters: other parameters corresponding to the NFp expected to be accessed.
  • other parameters corresponding to the NFp expected to be accessed may be information such as NFprofile of the NFp, and the name of the discovery response message may be a new service name, such as Nnrf_NFDiscovery_Response. Not limited.
  • the final authorization method is determined by SEPP#B.
  • SEPP#B configures the authorization method corresponding to the peer PLMN ID1.
  • SEPP#B receives a discovery request message from SEPP#A, the request message includes PLMN ID1, and receives a discovery response message from NRF#B.
  • SEPP#B determines the final authorization method according to the authorization method corresponding to PLMN ID1 and the authorization method corresponding to PLMN ID2, and sends the final authorization method to NFc through SEPP#A and NRF#A.
  • the specific implementation steps are similar to step S720 to step S770 in the above method 700 . For the sake of brevity, details are not repeated here.
  • NFc sends an authorization request message to SEPP#A; correspondingly, SEPP#A receives the authorization request message from NFc.
  • the authorization request message includes the PLMN ID2, and the authorization request message is used to request to determine the authorization method for accessing the network corresponding to the PLMN ID2.
  • the authorization request message also includes PLMN ID1.
  • the PLMN ID1 is the identification information of the network where the NFc is located
  • the PLMN ID2 is the identification information of the network corresponding to the network element of the NFp network element that provides the service that the NFc wishes to access.
  • the name of the authorization request message can be a new service name, such as Nnrf_Authorization_Request, which is not limited in this application; or it can be an existing service name, then it is necessary to add instruction information to indicate the request to determine the network corresponding to PLMN ID2 authorization method.
  • the indication information includes PLMN ID1.
  • the NFc may access SEPP#A through other network elements.
  • NRF service communication proxy
  • SCP service communication proxy
  • the current 5G architecture includes SCP network elements.
  • SCP is the agent of NF network elements. It can also be understood that SCP is the entrance and exit of an SCP domain, or a proxy node. Therefore, the negotiation between different domains can also be completed through SCP.
  • service access between NFc and NFp may pass through SCP1 and SCP2 successively, that is, NFc-SCP1-SCP2-NFp. Therefore, the above method of direct negotiation through SEPP also uses the method of SCP. That is, the SCP can be replaced by the above-mentioned SEPP, and the PLMN ID can be replaced by the SCP domain identifier.
  • the address of SEPP#A may be the address information received by NFc from NRF#A in the NF discovery process, or the address information of SEPP#A pre-configured by NFc, which is not limited in this application.
  • SEPP#A determines the final authorization method according to the configured authorization method corresponding to the peer PLMN ID2 and the authorization method corresponding to PLMN ID1.
  • the final authorization method may indicate a static authorization method (static) or an Oauth authorization method, or may indicate both a static authorization method (static) and an Oauth authorization method.
  • the PLMN ID1 here may be obtained from the authorization request message sent by the NFc in step S780, or the identification information of the network where SEPP#A is located, that is, the PLMN ID1.
  • SEPP#A can determine whether the corresponding final authorization method is saved according to the PLMN ID1 and PLMN ID2, if so, skip the step S790 of determining the final authorization method, and continue to the following step S791; otherwise, It is necessary to continue to execute step S790 to determine the final authorization mode.
  • the final authorization method stored in SEPP#A can be that SEPP#A determines the final authorization method according to the authorization method corresponding to PLMN ID1 and the authorization method corresponding to PLMN ID2, or can be stored in Inside SEPP#A. Then, when NFc accesses NFp corresponding to PLMN ID2, SEPP#A can directly determine and provide the final authorization method to NFc according to PLMN ID2, so as to promote business access and service between NFc and NFp.
  • the determination of the final authorization method adopts the intersection method, that is, the final authorization method is determined according to the intersection of the authorization method corresponding to the PLMN ID1 and the authorization method corresponding to the PLMN ID2, and the specific implementation is consistent with that in step S650. For the sake of brevity, details are not repeated here.
  • SEPP#A sends an authorization response message to NFc; correspondingly, NFc receives an authorization response message from SEPP#A.
  • the authorization response message includes the final authorization mode.
  • the final authorization method can be carried in the payload (payload) or header (header) of the authorization response message, such as in the http header.
  • indication information can be added to the existing one or more headers to indicate the final authorization method; or in the authorization response message Add a header to carry the final authorization method information.
  • the final authorization method can be a static authorization method or an Oauth authorization method.
  • the NFc can request service access from the NFp according to the static authorization method or the Oauth authorization method; optionally, the final authorization can also support static authorization at the same time.
  • Authorization method and Oauth authorization method At this time, NFc needs a local policy to further determine which authorization method to use to request service access from NFp. That is, when NFc receives the static and Oauth authorization methods, it decides which authorization method to use.
  • the name of the authorization response message may be a new service name, such as Nnrf_Authorization_Response, which is not limited in this application.
  • the NFc determines whether to initiate a process of obtaining an authorization token according to the final authorization manner. Refer to the above step S691 for the specific implementation manner, and for the sake of brevity, details are not described here.
  • the final authorization method is determined by SEPP#B.
  • SEPP#B configures the authorization mode corresponding to the peer PLMN ID1, and at this time, SEPP#B receives an authorization request message from SEPP#A, and the request message includes PLMN ID1. Then, SEPP#B determines the final authorization method according to the authorization method corresponding to PLMN ID1 and the authorization method corresponding to PLMN ID2, and sends the final authorization method to NFc through SEPP#A.
  • the specific implementation steps are similar to step S780 to step S791 in the above-mentioned method 700 . For the sake of brevity, details are not repeated here.
  • FIG. 8 is a schematic diagram of an example of the authorization mechanism negotiation method applicable to the embodiment of the present application.
  • the local network authorization method is configured through the network storage function network element, and the final authorization method is determined through negotiation with the network storage function network element of the peer end, so that the service consumption function The authorization method for network elements to obtain service access.
  • the difference between this specific implementation manner and the foregoing method 600 is that a process of interactive negotiation between network storage function network elements is newly added. Supports dynamic authorization negotiation. If the authorization method of the peer network changes, the negotiation method can obtain the latest authorization mechanism. The configuration method needs to be configured before the latest authorization mechanism can be obtained, so the timeliness is not as good as the negotiation mechanism.
  • the specific implementation step 800 includes:
  • the service consumption function network element (for example, NFc) sends a discovery request message to NRF#1; correspondingly, NRF#1 receives the discovery request message from NFc.
  • the discovery request message includes the PLMN ID2, and the discovery request message is used to request to determine an authorization method for accessing the network corresponding to the PLMN ID2.
  • the discovery request message also includes PLMN ID1, other parameters corresponding to NFc, and other parameters corresponding to NFp expected to be accessed.
  • the PLMN ID1 is the identification information of the network where the NFc is located
  • the PLMN ID2 is the identification information of the network corresponding to the network element of the NFp network element that the NFc wishes to access to services.
  • the NFp may be a network element with a session management function SMF, or a network element with a policy control function PCF.
  • NRF#1 sends a discovery request message to NRF#2; correspondingly, NRF#2 receives the discovery request message from NRF#1.
  • the discovery request message includes the authorization method corresponding to the PLMN ID1, and is used to request to determine the authorization method for accessing the network corresponding to the PLMN ID2.
  • the authorization method corresponding to PLMN ID1 can be carried in the payload (payload) or header (header) of the discovery request message, such as in the http header.
  • indication information may be added to the existing one or more headers to indicate the final authorization method; or in the discovery request message Add a header to carry the final authorization method information.
  • the discovery request message may include one or more of the following parameters: PLMN ID1, PLMN ID2, other parameters corresponding to NFc, and other parameters corresponding to NFp expected to be accessed.
  • the discovery request message may not include PLMN ID1, PLMN ID2, other parameters corresponding to NFc, and other parameters corresponding to NFp expected to be accessed.
  • NRF#1 when NRF#1 sends the discovery request message to NRF#2, it can first forward it to SEPP#2 through SEPP#1, and then send it to NRF#2.
  • SEPP#2 can determine the PLMN ID1 according to the remote PLMN ID information in the N32-f context negotiated with SEPP#1, or determine it according to the connection between SEPP#1 and send the PLMN ID1 to NRF #2.
  • other parameters corresponding to PLMN ID1 and other parameters corresponding to PLMN ID2 can be the network service types of NFc and NFp, and the name of the discovery request message can be an existing service name, such as Nnrf_NFDiscovery_Request, or can be The newly defined service name is not limited in this application.
  • the discovery request message may carry indication information for indicating the final authorization mode for obtaining access to the NFp, and NRF#2 determines the final authorization mode according to the indication information.
  • NRF#2 determines the final authorization method according to the authorization method corresponding to the local PLMN ID2 and the received authorization method corresponding to the PLMN ID1.
  • the final authorization method may indicate a static authorization method (static) or an Oauth authorization method, or may indicate both a static authorization method (static) and an Oauth authorization method.
  • the PLMN ID1 may be obtained from the discovery request message sent by NRF#1 in step S820.
  • the determination of the final authorization method adopts the intersection method, that is, the final authorization method is determined according to the intersection of the authorization method corresponding to PLMN ID1 and the authorization method corresponding to PLMN ID2, and the specific implementation is consistent with that in step S650. For the sake of brevity, details are not repeated here.
  • NRF#2 sends a discovery response message to NFc through NRF#1; correspondingly, NFc receives the discovery response message from NRF#2.
  • the discovery response message includes the final authorization mode.
  • the final authorization method can be carried in the payload (payload) or header (header) of the discovery response message, such as in the http header.
  • indication information may be added to the existing one or more headers to indicate the final authorization method; or in the discovery response message Add a header to carry the final authorization method information.
  • the final authorization method can be a static authorization method or an Oauth authorization method.
  • the NFc can request service access from the NFp according to the static authorization method or the Oauth authorization method; optionally, the final authorization can also support static authorization at the same time.
  • Authorization method and Oauth authorization method At this time, NFc needs a local policy to further determine which authorization method to use to request service access from NFp. That is, when NFc receives the static and Oauth authorization methods, it decides which authorization method to use.
  • the discovery response message may include one or more of the following parameters: PLMN ID1, PLMN ID2, and other parameters corresponding to the NFp expected to be accessed, such as NFprofile.
  • the name of the discovery response message may be an existing service name, such as Nnrf_NFDiscovery_Response, or a newly defined service name, which is not limited in this application.
  • the final authorization method is determined by NRF#1.
  • NRF#1 sends a discovery request message to NRF#2, and the request message is used to request the authorization method corresponding to PLMN ID2, and receives the authorization method corresponding to PLMN ID2 from NRF#2.
  • NRF#1 determines the final authorization method according to the authorization method corresponding to PLMN ID1 and the authorization method corresponding to PLMN ID2, and sends the final authorization method to NFc.
  • the specific implementation steps are similar to step S810 to step S850 in the above method 800 . For the sake of brevity, details are not repeated here.
  • the service consumption function network element (for example, NFc) sends a discovery request message to NRF#1; correspondingly, NRF#1 receives the discovery request message from NFc.
  • the discovery request message includes PLMN ID2.
  • NRF#1 sends a capability request message to NRF#2; correspondingly, NRF#2 receives the capability request message from NRF#1.
  • the capability request message includes indication information #1, which is used to instruct NRF #2 to send the authorization mode of the network corresponding to PLMN ID2.
  • the capability request message may include the following parameters: PLMN ID1.
  • the name of the authorization response message can be a new service name, such as Nnrf_Bootstrapping_Get_Request, which is not limited in this application; or it can be an existing service name, then it is necessary to add instruction information #2, which is used to indicate the request to determine the access PLMN ID2 Authorization method corresponding to the network.
  • the indication information #2 includes PLMN ID1.
  • NRF#2 determines the authorization method corresponding to the PLMN ID2 according to the capability request message and the indication information #1; or determines the authorization method corresponding to the PLMN ID2 according to the new service name.
  • NRF#2 sends a capability response message to NRF#1; correspondingly, NRF#1 receives the capability response message from NRF#2.
  • the capability response message includes the authorization method corresponding to the PLMN ID2.
  • the name of the capability response message may be an existing service name, such as Nnrf_Bootstrapping_Get_Response, which is not limited in this application.
  • NRF#1 determines the final authorization method according to the received authorization method corresponding to the PLMN ID2 and the authorization method corresponding to the local PLMN ID1.
  • the final authorization method may indicate a static authorization method (static) or an Oauth authorization method, or may indicate both a static authorization method (static) and an Oauth authorization method.
  • the PLMN ID1 here may be obtained from the discovery request message sent by the NFc in step S860, or the identification information of the network where NRF#1 itself is located, that is, the PLMN ID1.
  • the final authorization method stored in NRF#1 may be that NRF#1 determines the final authorization method according to the authorization method corresponding to PLMN ID1 and the authorization method corresponding to PLMN ID2, or may be stored in Inside NRF#1. Then, when NFc accesses the NFp corresponding to PLMN ID2, NRF#1 can directly determine and provide the final authorization method to NFc according to PLMN ID2, so as to promote business access and services between NFc and NFp.
  • the determination of the final authorization method adopts the intersection method, that is, the final authorization method is determined according to the intersection of the authorization method corresponding to the PLMN ID1 and the authorization method corresponding to the PLMN ID2, and the specific implementation is consistent with that in step S650. For the sake of brevity, details are not repeated here.
  • NRF#1 sends a notification message to NRF#2; correspondingly, NRF#2 receives the notification message from NRF#1.
  • the notification message includes the final authorization method, which is used for when the network function NF network element corresponding to PLMN ID2 sends a service access request message to the network function NF network element corresponding to PLMN ID1, the NRF#2 network element can use the above-mentioned final authorization method Perform the corresponding authorization operation.
  • NRF#1 sends an authorization response message to NFc; correspondingly, NFc receives an authorization response message from NRF#1.
  • the authorization response message includes the final authorization mode.
  • the final authorization method can be carried in the payload (payload) or header (header) of the discovery response message, such as in the http header.
  • indication information may be added to the existing one or more headers to indicate the final authorization method; or in the discovery response message Add a header to carry the final authorization method information.
  • the final authorization method can be a static authorization method or an Oauth authorization method.
  • the NFc can request service access from the NFp according to the static authorization method or the Oauth authorization method; optionally, the final authorization can also support static authorization at the same time.
  • Authorization method and Oauth authorization method At this time, NFc needs a local policy to further determine which authorization method to use to request service access from NFp. That is, when NFc receives the static and Oauth authorization methods, it decides which authorization method to use.
  • the NFc determines whether to initiate a process of obtaining an authorization token according to the final authorization manner. Refer to the above step S691 for the specific implementation manner, and for the sake of brevity, details are not described here.
  • the final authorization method is determined by NRF#2.
  • NRF#2 receives a request message from NRF#1, and the request message includes the authorization mode corresponding to PLMN ID1.
  • the request message includes PLMN ID2.
  • NRF#2 determines the final authorization method according to the authorization method corresponding to PLMN ID1 and the authorization method corresponding to PLMN ID2, and sends the final authorization method to NFc through NRF#1.
  • the specific implementation steps are similar to step S860 to step S893 in the above method 800 . For the sake of brevity, details are not repeated here.
  • FIG. 9 is a schematic diagram of an example of the authorization mechanism negotiation method applicable to the embodiment of the present application.
  • the local network authorization method is configured through the security edge protection proxy network element, and the final authorization method is determined through negotiation with the peer network storage function network element, so that service consumption Authorization method for functional NEs to obtain service access.
  • the difference between this specific implementation and the above-mentioned method 600 is that a process of interactive negotiation between SEPPs is added, which avoids the impact on NRF, and controls authorized content between roaming security network elements. Supports dynamic authorization negotiation. If the authorization method of the peer network changes, the negotiation method can obtain the latest authorization mechanism. The configuration method needs to be configured before the latest authorization mechanism can be obtained, so the timeliness is not as good as the negotiation mechanism.
  • the specific implementation step 900 includes:
  • the service consumption function network element (for example, NFc) sends a discovery request message to NRF#A; correspondingly, NRF#A receives the discovery request message from NFc.
  • NRF#A determines SEPP#A, and sends a discovery request message to SEPP#A; correspondingly, SEPP#A receives the discovery request message from NRF#A.
  • the discovery request message includes the PLMN ID2, and the discovery request message is used to request to determine the authorization method for accessing the network corresponding to the PLMN ID2.
  • the discovery request message further includes at least one of PLMN ID1, other parameters corresponding to NFc, and other parameters corresponding to NFp expected to be accessed.
  • the PLMN ID1 is the identification information of the network where the NFc is located
  • the PLMN ID2 is the identification information of the network corresponding to the network element of the NFp network element that the NFc wishes to access to services.
  • the NFp may be a network element with a session management function SMF, or a network element with a policy control function PCF.
  • SEPP#A determines the authorization mode corresponding to the PLMN ID1 according to the PLMN ID1.
  • PLMN ID1 may be obtained from the discovery request message received in step S912; or the identification information of SEPP#A's own network, that is, PLMN ID1; or the NRF# determined according to the connection between SEPP#A and NRF#A The network ID where A is located, that is, PLMN ID1.
  • SEPP#A determines the PLMN ID based on the FQDN of NRF#A received from NRF#A, and/or the address of NRF#A, and/or the PLMN ID information in the NRF#A certificate.
  • SEPP#A sends a discovery request message to NRF#B through SEPP#B; correspondingly, NRF#B receives the discovery request message from SEPP#A.
  • the discovery request message in step S930 includes: the authorization method corresponding to the PLMN ID1.
  • the discovery request message may not include PLMN ID1, PLMN ID2, other parameters corresponding to NFc, and other parameters corresponding to NFp expected to be accessed.
  • SEPP#B when SEPP#A sends a discovery request message to SEPP#B, for example, SEPP#B can determine the PLMN ID1 according to the remote PLMN ID information in the N32-f context negotiated with SEPP#A , or determine PLMN ID1 according to its connection with SEPP#A, and send PLMN ID1 to NRF#B.
  • the discovery request message includes PLMN ID1, which is used to request to determine the authorization method for accessing the network corresponding to PLMN ID2.
  • other parameters corresponding to PLMN ID1 and other parameters corresponding to PLMN ID2 can be the network service types of NFc and NFp, and the name of the discovery response message can be an existing
  • the service name, such as Nnrf_NFDiscovery_Request, may also be a newly defined service name, which is not limited in this application.
  • the discovery request message may carry indication information for indicating the final authorization mode for obtaining access to the NFp, and NRF#B determines the final authorization mode according to the indication information.
  • NRF#B sends a discovery response message to SEPP#B; correspondingly, SEPP#B receives the discovery response message from NRF#B.
  • the discovery response message may include the following parameters: other parameters corresponding to the NFp expected to be accessed.
  • S960, SEPP#B determines the final authorization method according to the authorization method corresponding to the PLMN ID2 and the authorization method corresponding to the PLMN ID1.
  • the final authorization method may indicate a static authorization method (static) or an Oauth authorization method, or may indicate both a static authorization method (static) and an Oauth authorization method.
  • the PLMN ID1 here may be obtained from the discovery request message received in step S930, or the identification information of the network where SEPP#A is located, that is, the PLMN ID1.
  • the determination of the final authorization method adopts the intersection method, that is, the final authorization method is determined according to the intersection of the authorization method corresponding to the PLMN ID1 and the authorization method corresponding to the PLMN ID2, and the specific implementation is consistent with that in step S650. For the sake of brevity, details are not repeated here.
  • SEPP# sends a discovery response message to NFc through SEPP#A and NRF#A; correspondingly, NFc receives a discovery response message from SEPP#B.
  • the discovery response message includes the final authorization mode.
  • the final authorization method can be carried in the payload (payload) or header (header) of the discovery response message, such as in the http header.
  • indication information may be added to the existing one or more headers to indicate the final authorization method; or in the discovery response message Add a header to carry the final authorization method information.
  • the final authorization method can be a static authorization method or an Oauth authorization method.
  • the NFc can request service access from the NFp according to the static authorization method or the Oauth authorization method; optionally, the final authorization can also support static authorization at the same time.
  • Authorization method and Oauth authorization method At this time, NFc needs a local policy to further determine which authorization method to use to request service access from NFp. That is, when NFc receives the two authorization methods of static and Oauth, it decides which authorization method to use.
  • the discovery response message may include the following parameters: other parameters corresponding to the NFp expected to be accessed.
  • other parameters corresponding to PLMN ID1 and other parameters corresponding to PLMN ID2 can be the network service types of NFc and NFp, and the name of the discovery response message can be an existing service name, for example Nnrf_NFDiscovery_Response can also be a newly defined service name, which is not limited in this application.
  • the final authorization method is determined by NRF#B.
  • SEPP#B sends the authorization method corresponding to PLMN ID1 to NRF#B.
  • NRF#B determines the final authorization method according to the authorization method corresponding to PLMN ID1 and the authorization method corresponding to PLMN ID2, and sends the final authorization method to NFc through SEPP#B, SEPP#A and NRF#A.
  • the specific implementation steps are similar to step S911 to step S973 in the method 900 above. For the sake of brevity, details are not repeated here.
  • the service consumption function network element for example, NFc
  • the service consumption function network element sends a discovery request message to SEPP#A through NRF#A; correspondingly, SEPP#A receives the discovery request message from NFc.
  • the discovery request message includes PLMN ID2, which is used to request to determine the authorization method for accessing the network corresponding to PLMN ID2.
  • SEPP#A sends an N32 connection establishment request message to SEPP#B; correspondingly, SEPP#B receives the N32 connection establishment request message from SEPP#A.
  • the N32 interface is used for communication between SEPP#A and SEPP#B.
  • the N32 connection establishment request message includes indication information #A, which is used to instruct SEPP #B to send the authorization mode supported by the network where SEPP #B is located.
  • PLMN ID2 corresponds to the authorization method of the network, or the authorization method corresponding to other PLMN IDs.
  • the SEPP#B needs to determine and send the authorization method corresponding to the PLMN ID2 to SEPP#A. If the above steps S981-S982 are not performed, then the SEPP#B can determine multiple PLMN IDs that provide services for the NFc, and corresponding authorization methods. Because SEPP#B may support multiple PLMN IDs, this application does not limit it.
  • the N32 connection establishment request message may include one or more of the following parameters: PLMN ID1, PLMN ID2.
  • the name of the authorization response message can be a new service name, such as N32 connection establishment Request (indicator), which is not limited in this application; or it can be an existing service name, then it is necessary to add indication information #B for Indicates the request to determine the authorization method for accessing the network corresponding to SEPP2.
  • the indication information #B includes PLMN ID1.
  • SEPP#B determines the authorization method corresponding to the network supported by SEPP#B according to the connection establishment request message and the indication information #A (may support multiple PLMN IDs, and corresponding authorization methods), or the authorization method corresponding to PLMN ID2, namely SEPP#B determines the authorization method corresponding to the network supported by SEPP#B, or the authorization method corresponding to the PLMN ID2 received from SEPP#A.
  • the network PLMN IDs supported by SEPP#B and their corresponding authorization methods depend on whether the above steps S981-S982 are performed.
  • SEPP#B determines to send to SEPP#A the authorization method corresponding to the network supported by SEPP#B, or the authorization method corresponding to PLMN ID2, according to the new service name.
  • the PLMN ID2 here is the received PLMN ID2, or SEPP#B determines the PLMN ID1 according to the remote PLMN ID information in the N32-f context negotiated between the two SEPPs, or according to the PLMN ID between it and SEPP#A connection to be sure.
  • SEPP#B sends an N32 connection establishment response message to SEPP#A; correspondingly, SEPP#A receives the N32 connection establishment response message from SEPP#A.
  • connection establishment response message includes the authorization mode corresponding to the PLMN ID2.
  • the name of the connection establishment response message may be a new service name, such as N32connection establishment Response, which is not limited in this application.
  • SEPP#A determines the final authorization method according to the authorization method corresponding to the received PLMN ID2 and the authorization method corresponding to the local PLMN ID1.
  • the final authorization method may indicate a static authorization method (static) or an Oauth authorization method, or may indicate both a static authorization method (static) and an Oauth authorization method.
  • the PLMN ID1 here may be obtained from the discovery request message received in step S982, or the identification information of the network where SEPP#A is located, that is, the PLMN ID1.
  • the final authorization method stored in SEPP#A can be that SEPP#A determines the final authorization method according to the authorization method corresponding to PLMN ID1 and the authorization method corresponding to PLMN ID2, or can be stored in The final authorization method for SEPP#A to internally access PLMN ID2, or PLMN ID1 to access the network corresponding to PLMN ID2. Then, when NFc accesses NFp corresponding to PLMN ID2, SEPP#A can directly determine and provide the final authorization method to NFc according to PLMN ID2, so as to promote business access and service between NFc and NFp.
  • the determination of the final authorization method adopts the intersection method, that is, the final authorization method is determined according to the intersection of the authorization method corresponding to the PLMN ID1 and the authorization method corresponding to the PLMN ID2, and the specific implementation is consistent with that in step S650. For the sake of brevity, details are not repeated here.
  • SEPP#A sends a notification message to SEPP#B; correspondingly, SEPP#B receives the notification message from SEPP#A.
  • the notification message includes the final authorization method, which is used for when the network function NF network element corresponding to PLMN ID2 sends a service access request message to the network function NF network element corresponding to PLMN ID1, SEPP#B can execute the corresponding authorized operations.
  • SEPP#A sends an authorization response message to NFc through NRF#A; correspondingly, NFc receives the authorization response message from SEPP#A.
  • the authorization response message includes the final authorization mode.
  • the final authorization method can be carried in the payload (payload) or header (header) of the discovery response message, such as in the http header.
  • indication information can be added to the existing one or more headers to indicate the final authorization method; or in the authorization response message Add a header to carry the final authorization method information.
  • the final authorization method can be a static authorization method or an Oauth authorization method.
  • the NFc can request service access from the NFp according to the static authorization method or the Oauth authorization method; optionally, the final authorization can also support static authorization at the same time.
  • Authorization method and Oauth authorization method At this time, NFc needs a local policy to further determine which authorization method to use to request service access from NFp. That is, when NFc receives the static and Oauth authorization methods, it decides which authorization method to use.
  • the NFc determines whether to initiate the process of obtaining the authorization token token according to the final authorization method. Refer to the above step S691 for the specific implementation manner, and for the sake of brevity, details are not described here.
  • the final authorization method is determined by SEPP#B.
  • SEPP#A sends PLMN ID1 and the corresponding authorization mode supported by PLMN ID1 to SEPP#B.
  • SEPP#B determines the final authorization method according to the received authorization method corresponding to PLMN ID1 and PLMN ID2.
  • the specific implementation steps are similar to step S981 to step S995 in the above method 900 . For the sake of brevity, details are not repeated here.
  • the NRF will send the information in the Nfprofile of the NFp to the NFc.
  • the NFservice message of the Nfprofile may carry Oauth2required indication information, and the indication information indicates that the NFc needs to implement the Oauth authorization mode.
  • the method 600 in FIG. 6 to the method 900 in FIG. 9 do not consider the way of the Oauth2required indication, that is, ignore the indication information.
  • the negotiation of the authorization mechanism between the service consumption function network element and the service provision function network element is completed mainly by configuring the authorization mode of the peer end or the local end, thereby ensuring the normal operation of service access between different NFs.
  • FIG. 10 is a schematic diagram of an example of an authorization mechanism negotiation method applicable to the embodiment of the present application, considering the way indicated by Oauth2required, and extending Oauth2required.
  • the current Oauth2required indicates that the Oauth authentication method is required.
  • the unnecessary negotiation process is reduced, and the determination of the authorization policy is completed.
  • the specific implementation steps 1000 include:
  • the service consumption function network element (for example, NFc) sends a discovery request message to NRF#1; correspondingly, NRF#1 receives the discovery request message from NFc.
  • the discovery request message includes the PLMN ID2, and the discovery request message is used to request to determine an authorization method for accessing the network corresponding to the PLMN ID2.
  • the discovery request message also includes PLMN ID1, other parameters corresponding to NFc, and other parameters corresponding to NFp expected to be accessed.
  • the PLMN ID1 is the identification information of the network where the NFc is located
  • the PLMN ID2 is the identification information of the network corresponding to the network element of the NFp network element that the NFc wishes to access to services.
  • the NFp may be a network element with a session management function SMF, or a network element with a policy control function PCF.
  • NRF#1 forwards the discovery request message to NRF#2; correspondingly, NRF#2 receives the discovery request message from NRF#1.
  • the discovery request message may include one or more of the following parameters: PLMN ID1, PLMN ID2, other parameters corresponding to NFc, and other parameters corresponding to NFp expected to be accessed.
  • the discovery request message may not include PLMN ID1, PLMN ID2, other parameters corresponding to NFc, and other parameters corresponding to NFp expected to be accessed.
  • NRF#1 when NRF#1 sends the discovery request message to NRF#2, it can first forward it to SEPP#2 through SEPP#1, and then send it to NRF#2.
  • SEPP#2 can determine the PLMN ID1 according to the remote PLMN ID information in the N32-f context negotiated with SEPP#1, or determine the PLMN ID1 according to the connection between SEPP#1 and SEPP#2, and assign the PLMN ID1 is sent to NRF#2.
  • other parameters corresponding to PLMN ID1 and other parameters corresponding to PLMN ID2 can be the network service types of NFc and NFp, and the name of the discovery request message can be an existing service name, such as Nnrf_NFDiscovery_Request, or It is a newly defined service name, which is not limited in this application.
  • NRF#2 determines the NFprofile information of the NFp according to the discovery request message.
  • the NFprofile information includes Oauth2required.
  • NRF#2 sends a discovery response message to NFc through NRF#1; correspondingly, NFc receives the discovery response message from NRF#2.
  • the discovery response message includes indication information #a, such as Oauth2required.
  • the indication information #a may be carried in the payload (payload) or header (header) of the discovery response message, such as in the http header.
  • indication information may be added to the existing one or more headers to indicate the final authorization method; or in the discovery response message Add a header to carry the final authorization method information.
  • the discovery response message may include one or more of the following parameters: other parameters corresponding to the NFp expected to be accessed.
  • the name of the discovery response message may be an existing service name, such as Nnrf_NFDiscovery_Response; it may also be a newly defined service name, which is not limited in this application.
  • the NFc determines whether to initiate a token acquisition process according to the received Oauth2required indication information.
  • NFc After NFc receives Oauth2required, it is divided into the following three processing methods:
  • NFc After NFc receives Oauth2required, it is divided into the following three processing methods:
  • NFc executes Oauth authorization request and sends the process of obtaining authorization token token to NRF; if Oauth2required indicates Preferred, NFc determines whether to execute according to local policy Oauth authorization request; if Oauth2required indicates Not needed, execute the static authorization method.
  • the network where the NFc is located does not support the Oauth authorization method, if the Oauth2required indication is required, the NFc sends a rejection message to NRF#1.
  • the rejection message here may carry a rejection reason value, which is used to indicate that the NFc does not support the authorization method indicated by Oauth2required.
  • the final authorization method determined by NRF#2 or NRF#1 conflicts with the Oauth2required indication in Nfprofile determined in step S1030 above, the final authorization method shall prevail; and a notification message is sent to NFp at the same time.
  • the determination of the authorization policy does not consider the Oauth2required indication information carried in the Nfprofile of the NFp. If while considering the Oauth2required indication information, the final authorization mode determined by the NRF or SEPP is inconsistent with the authorization mode indicated by the Oauth2required, generally the final authorization mode negotiated between network elements shall prevail.
  • NFc, or NRF#1, or NRF#2 can send a notification message to NFp, namely:
  • NFc sends a notification message to NFp through NRF#1 and NRF#2; correspondingly, NFp receives the notification message from NFc.
  • NFc sends a rejection message to NRF#1, so that NRF#1 determines that the authorization method indicated in Oauth2required is not supported by NFc.
  • NRF#1 determines that the final authorization method is inconsistent with the Oauth2required indication according to the previous embodiment, or sends a mismatch notification message to NRF#2 according to receiving the rejection message sent by the NFc.
  • NRF#2 determines that the final authorization method is inconsistent with the Oauth2required indication according to the previous embodiment, or receives the rejection message sent by NRF#1.
  • the notification message includes NFc ID and PLMN ID1, at least one of the authorization methods corresponding to NFc or PLMN ID1, so that NFp will receive service requests from the network NF corresponding to NFc ID and/or PLMN ID1 in the future, and execute the service request based on NFc or PLMN ID1
  • Authorization corresponding to the authorization method such as static authorization; when NFp receives the service request sent by NFc, which carries NFc ID and/or PLMN ID1, NFp determines to use NFc or PLMN ID1 correspondence based on the NFc ID and/or PLMN ID1.
  • Execute verification of the authorization mode and execute the authorization process. For example, the Oauth2required of NFp indicates that Oauth authorization is required, and the NFc ID and/or PLMN ID1 received by NFp through this notification message will also allow the use of static authorization.
  • the above notification message may not carry the authorization method corresponding to NFc or PLMN ID1.
  • NFp receives the service request from the network NF corresponding to NFc ID and/or PLMN ID1, and executes the authorization method opposite to the authorization method indicated in Oauth2required. For example, if Oauth2required indicates Oauth, then static authorization is accepted; if Oauth2required indicates static authorization, Oauth authorization is accepted.
  • the NFc sends a service request message to the NFp; correspondingly, the NFp receives the service request message from the NFc.
  • the service request message includes NFc ID and/or PLMN ID1, so that NFp will receive the service request corresponding to NFc ID in the future and perform static authorization; when NFp receives the service request sent by NFc, it carries NFc ID and/or PLMN ID1. NFp determines to adopt the execution verification of static authorization according to the NFc ID and/or PLMN ID1, and then executes the static authorization process.
  • first NFc sends request message to NRF or SEPP, is used for requesting to obtain the final authorization mode of accessing NFp, and this request message includes the network identification PLMN ID2 of the NFp that NFc wishes to visit.
  • NRF or SEPP configures the authorization method of the peer, that is, the authorization method of PLMN ID2.
  • the NRF or SEPP determines the final authorization method according to the authorization method of the local PLMN ID1 and the configured authorization method of the PLMN ID2, and sends it to the NFc.
  • NFc determines the final authorization execution method based on the final authorization method.
  • the final authorization method is static, directly access NFp; if the authorization method is Oauth, initiate a token request to NRF and carry the token to access NFp. Or add NRF negotiation or SEPP negotiation between NFc and NFp to determine the final authorization method. Or extend Oauth2required to reduce unnecessary negotiation process and complete the determination of authorization strategy, so that the service consumption function network element NFc can obtain the authorization method for accessing the service provision function network element NFp, thereby solving the problem of authorization conflict and ensuring the normal operation of business access .
  • carrying parameters such as the final authorization method and Oauth2required in the header can not affect the content of the payload, and can better allow the receiver to identify the information carried in the header.
  • the above-mentioned PLMN ID is used as the domain identifier in the roaming scenario for description. It should be understood that this application is also applicable to non-roaming scenarios of other domains and domain identifiers, for example, the operator includes multiple SCP domains and SCP domain identifiers; or the operator includes multiple NRF domains and NRF domain identifiers, or the operator It includes multiple security domains, security domain IDs, or the operator includes multiple NF set domains, NF set domain IDs, etc. without limitation.
  • the PLMNID can be replaced by other domain identifiers mentioned above.
  • two entities, NRF and SEPP are mentioned in the embodiment of the present application, and other functional network elements that distinguish between different domain managements can also replace the above-mentioned NRF or SEPP network elements to negotiate and determine the authorization mechanism.
  • FIG. 11 is a schematic diagram of a communication device 10 applicable to the embodiment of the present application.
  • the communication device 10 may be a network device (for example, NRF or SEPP).
  • the communication device 10 includes: a transceiver unit 11 and a processing unit 12 .
  • the processing unit 22 is used to determine a first authorization method and a second authorization method.
  • the first authorization method is the authorization method corresponding to the network to which the network element of the service consumption function belongs
  • the second authorization method is the authorization method of the service providing function network element.
  • the authorization method corresponding to the network to which the element belongs; the processing unit 22 is also used to determine a third authorization method according to the first authorization method and the second authorization method, and the third authorization method is an authorization method for accessing a service providing function network element; the transceiver unit 21 Used to send the third authorization method.
  • the processing unit 22 is used to determine the authorization method corresponding to the network to which the first functional network element belongs; the transceiver unit 21 is used to send a request message, and the request message is used to request to obtain an authorization method for accessing the second functional network element.
  • Authorization method the request message includes the authorization method corresponding to the network to which the first functional network element belongs; the transceiver unit 21 is also used to receive the authorization method for accessing the second functional network element, and the authorization method for accessing the second functional network element is based on the first function
  • the authorization method corresponding to the network to which the network element belongs and the authorization method corresponding to the network to which the second functional network element belongs are determined; the transceiver unit 21 is also used to send the authorization method to the second functional network element.
  • the transceiver unit 21 is also configured to receive a request message, the request message is used to request to obtain an authorization method for accessing the second functional network element, and the request message includes the Authorization method; the processing unit 22 is also used to determine the authorization method corresponding to the network to which the second functional network element belongs; the processing unit 22 is also used to determine the authorization method corresponding to the network to which the first functional network element belongs and the network to which the second functional network element belongs The corresponding authorization method determines the authorization method for accessing the second functional network element; the transceiving unit 21 sends the authorization method for accessing the second functional network element.
  • the transceiving unit 21 is configured to send a request message, and the request message includes the indication information for obtaining the authorization mode corresponding to the network to which the second functional network element belongs; the transceiving unit 21 is also configured to receive The authorization method corresponding to the network to which the second functional network element belongs; the processing unit 22 is used to determine the authorization method for accessing the second functional network element according to the authorization method corresponding to the network to which the second functional network element belongs and the authorization method corresponding to the network to which the first functional network element belongs; Unit 21 is also configured to send an authorization method for accessing the second functional network element.
  • the communication device 10 may correspond to the network device (for example, NRF or SEPP) in the method 500/600/700/800/900/1000 according to the embodiment of the present application, and the communication device 10 may include a device for executing FIG. 5 / Modules (or units) of the method executed by the network device in FIG. 6 / FIG. 7 / FIG. 8 / FIG. 9 / FIG. 10 .
  • each module (or unit) and the above-mentioned other operations and/or functions in the communication device 10 are respectively for realizing the corresponding procedures of the methods 500/600/700/800/900/1000.
  • the communication device 10 may correspond to the network device (for example, NRF or SEPP) of the aforementioned method embodiment, and the above-mentioned and other management operations and/or other management operations of each module (or unit) in the communication device 10 Or the functions are to realize the corresponding steps of the aforementioned methods respectively, so the beneficial effects in the aforementioned method embodiments can also be realized.
  • the network device for example, NRF or SEPP
  • SEPP SEPP
  • processing module in the embodiment of the present application may be implemented by a processor
  • transceiver module or unit
  • transceiver may be implemented by a transceiver
  • FIG. 12 is a schematic diagram of a communication device 20 applicable to the embodiment of the present application. It can be understood that the communication device 20 may be a network device (for example, NFc). As shown in FIG. 12 , the communication device 20 includes: a transceiver unit 21 and a processing unit 22 .
  • NFc network device
  • the transceiver unit 11 is configured to receive a third authorization method, the third authorization method is an authorization method for accessing a service providing function network element, and the third authorization method is determined according to the first authorization method and the second authorization method
  • the first authorization method is the authorization method corresponding to the network to which the network element of the service consumption function belongs
  • the second authorization method is the authorization method corresponding to the network to which the network element of the service provision function belongs
  • the processing unit 12 is used to provide the service according to the third authorization method
  • the functional network element requests the first service.
  • the transceiving unit 11 is configured to receive authorization indication information, the authorization indication information is used to determine the authorization method for accessing the service providing function network element, the authorization indication information is one of multiple indication information, and the multiple indication information
  • the information includes first indication information and second indication information, the first indication information is used to indicate the static authorization mode, and the second indication information is used to indicate that the open authorization mode is preferentially used in the static authorization mode and the open authorization mode;
  • the processing unit 12 uses Determine the authorization method for accessing the service providing function network element according to the authorization indication information;
  • the processing unit 12 is further configured to request the service providing function network element for a second service according to the authorization method for accessing the service providing function network element.
  • the communication device 20 may correspond to the network device (for example, NFc) in the method 500/600/700/800/900/1000 according to the embodiment of the present application, and the communication device 20 may include the 6/ A module (or unit) of a method executed by a network device (eg, NFc) in FIG. 7/FIG. 8/FIG. 9/FIG. 10.
  • each module (or unit) and the above-mentioned other operations and/or functions in the communication device 20 are respectively for realizing the corresponding procedures of the method 500/600/700/800/900/1000.
  • the communication device 20 may correspond to the network equipment (for example, NFc) in the foregoing method embodiment, and the above-mentioned and other management operations and/or functions of the various modules (or units) in the communication device 20
  • the beneficial effects in the foregoing method embodiments can also be realized.
  • processing module in the embodiment of the present application may be implemented by a processor
  • transceiver module or unit
  • transceiver may be implemented by a transceiver
  • FIG. 13 is a schematic diagram of a communication device 30 applicable to the embodiment of the present application.
  • the communication device 30 may be a network device (for example, NRF2).
  • the communication device 30 includes: a transceiver unit 31 and a processing unit 32 .
  • the processing unit 32 is configured to determine authorization indication information of an authorization mode for accessing a service providing function network element, where the authorization indication information is one of a plurality of indication information, and the plurality of indication information includes first indication information and second indication information , the first indication information is used to indicate the static authorization mode, and the second indication information is used to indicate that the open authorization mode is preferentially used in the static authorization mode and the open authorization mode; the transceiving unit 31 is used for sending the authorization indication information.
  • the communication device 30 may correspond to the network device (for example, NRF2) in the method 500/600/700/800/900/1000 according to the embodiment of the present application, and the communication device 30 may include the 6/ Modules of the method performed by the network device (eg NRF2) in Fig. 7/Fig. 8/Fig. 9/Fig. 10. Moreover, each module and the above-mentioned other operations and/or functions in the communication device 10 are respectively for realizing the corresponding processes of the methods 500/600/700/800/900/1000.
  • NRF2 network device
  • the communication device 30 may include the 6/ Modules of the method performed by the network device (eg NRF2) in Fig. 7/Fig. 8/Fig. 9/Fig. 10.
  • each module and the above-mentioned other operations and/or functions in the communication device 10 are respectively for realizing the corresponding processes of the methods 500/600/700/800/900/1000.
  • the communication device 30 may correspond to the network device (for example, NRF2) of the foregoing method embodiment, and the above-mentioned and other management operations and/or functions of each module (or unit) in the communication device 30
  • NRF2 network device
  • the beneficial effects in the foregoing method embodiments can also be realized.
  • processing module in the embodiment of the present application may be implemented by a processor
  • transceiver module or unit
  • transceiver may be implemented by a transceiver
  • FIG. 14 is a schematic diagram of a communication device (also referred to as a network device) 40 provided in an embodiment of the present application.
  • the device 40 may be a network device (for example, NRF or SEPP), or It is a chip or a circuit, such as a chip or a circuit that can be installed in a network device.
  • the device 40 may include a processor 41 (ie, an example of a processing unit) and a memory 42 .
  • the memory 42 is used to store instructions
  • the processor 41 is used to execute the instructions stored in the memory 42, so that the apparatus 40 implements the steps performed by the network equipment (for example, NRF or SEPP) in the above methods.
  • the network equipment for example, NRF or SEPP
  • the device 40 may further include an input port 43 (ie, an example of a communication unit) and an output port 44 (ie, another example of a communication unit).
  • an input port 43 ie, an example of a communication unit
  • an output port 44 ie, another example of a communication unit.
  • the memory 42 is used to store a computer program
  • the processor 41 can be used to call and run the computer program from the memory 42, to control the input port 43 to receive signals, and to control the output port 44 to send signals, so as to complete the network device in the above method A step of.
  • the memory 42 can be integrated in the processor 41 or can be set separately from the processor 41 .
  • the input port 43 is a receiver
  • the output port 44 is a transmitter.
  • the receiver and the transmitter may be the same or different physical entities. When they are the same physical entity, they can be collectively referred to as transceivers.
  • the input port 43 is an input interface
  • the output port 44 is an output interface
  • the functions of the input port 43 and the output port 44 may be realized by a transceiver circuit or a dedicated chip for transceiver.
  • the processor 41 may be realized by a dedicated processing chip, a processing circuit, a processor or a general-purpose chip.
  • a general-purpose computer to implement the network device provided in the embodiment of the present application.
  • the program codes to realize the functions of the processor 41 , the input port 43 and the output port 44 are stored in the memory 42 , and the general processor realizes the functions of the processor 41 , the input port 43 and the output port 44 by executing the codes in the memory 42 .
  • the processor 41 is used to determine the first authorization method and the second authorization method.
  • the first authorization method is the authorization method corresponding to the network to which the network element of the service consumption function belongs
  • the second authorization method is the authorization method of the network element of the service providing function network.
  • the processor 41 is also configured to determine a third authorization method according to the first authorization method and the second authorization method, and the third authorization method is an authorization method for accessing the service providing function network element; the output port 44 is used for sending the third authorization method.
  • the processor 41 is used to determine the authorization method corresponding to the network to which the first functional network element belongs; the output port 44 is used to send a request message, and the request message is used to request authorization to access the second functional network element method, the request message includes the authorization method corresponding to the network to which the first functional network element belongs; the input port 43 is used to receive the authorization method for accessing the second functional network element, and the authorization method for accessing the second functional network element is based on the first functional network element The authorization method corresponding to the network to which it belongs is determined by the authorization method corresponding to the network to which the second functional network element belongs; the output port 44 is also used to send the authorization method to the second functional network element.
  • the input port 43 is also used to receive a request message, the request message is used to request to obtain an authorization method for accessing the second functional network element, and the request message includes the corresponding information of the network to which the first functional network element belongs Authorization method; the processor 41 is also used to determine the authorization method corresponding to the network to which the second functional network element belongs; the processor 41 is also used to determine the authorization method corresponding to the network to which the first functional network element belongs and the The authorization method corresponding to the network determines the authorization method for accessing the second functional network element; the output port 44 is also used to send the authorization method for accessing the second functional network element.
  • the output port 44 is used to send a request message, and the request message includes the indication information for obtaining the authorization mode corresponding to the network to which the second functional network element belongs;
  • the input port 43 is used to receive The authorization method corresponding to the network;
  • the processor 41 is used to determine the authorization method for accessing the second functional network element according to the authorization method corresponding to the network to which the second functional network element belongs and the authorization method corresponding to the network to which the first functional network element belongs;
  • the output Port 44 is also used to send the authorization method for accessing the second functional network element.
  • the apparatus 40 is configured on or itself is a network device, such as NRF or SEPP.
  • the functions and actions of the modules or units in the device 40 listed above are only illustrative, and the modules or units in the device 40 can be used to implement the above method 500/600/700/800/900/1000 by the network device (For example, NRF or SEPP) performs various actions or processing procedures, here, in order to avoid redundant description, the detailed description thereof is omitted.
  • SoC system-on-chip
  • all or part of the functions of the device 30 are implemented by SoC technology, for example, by a network device function chip
  • the network device The functional chip integrates processors, memory, communication interfaces and other devices. Programs related to network equipment functions are stored in the memory, and the processor executes the programs to realize the relevant functions of the base station.
  • the network device function chip can also read the memory outside the chip to realize related functions of the base station.
  • FIG. 15 is a schematic diagram of a communication device (also referred to as a network device) 50 provided in the embodiment of the present application.
  • the device 50 may be a network device (for example, NFc) or a chip Or a circuit, such as a chip or a circuit that can be provided in a network device.
  • NFc network device
  • a circuit such as a chip or a circuit that can be provided in a network device.
  • the device 50 may include a processor 51 (ie, an example of a processing unit) and a memory 52 .
  • the memory 52 is used to store instructions
  • the processor 51 is used to execute the instructions stored in the memory 52, so that the apparatus 50 implements the steps performed by the network device (eg, NFc) in the above methods.
  • the network device eg, NFc
  • the device 50 may further include an input port 53 (ie, an example of a communication unit) and an output port 54 (ie, another example of a communication unit).
  • an input port 53 ie, an example of a communication unit
  • an output port 54 ie, another example of a communication unit.
  • the memory 52 is used to store a computer program, and the processor 51 can be used to call and run the computer program from the memory 52 to control the input port 53 to receive signals and the output port 54 to send signals to complete the network device in the above method A step of.
  • the memory 52 can be integrated in the processor 51 or can be set separately from the processor 51 .
  • the input port 53 is a receiver
  • the output port 54 is a transmitter.
  • the receiver and the transmitter may be the same or different physical entities. When they are the same physical entity, they can be collectively referred to as transceivers.
  • the input port 53 is an input interface
  • the output port 54 is an output interface
  • the functions of the input port 53 and the output port 54 may be realized by a transceiver circuit or a dedicated chip for transceiver.
  • the processor 51 may be realized by a dedicated processing chip, a processing circuit, a processor or a general-purpose chip.
  • a general-purpose computer to implement the network device provided in the embodiment of the present application.
  • the program codes to realize the functions of the processor 51 , the input port 53 and the output port 54 are stored in the memory 52 , and the general processor realizes the functions of the processor 51 , the input port 53 and the output port 54 by executing the codes in the memory 52 .
  • the input port 53 is used to receive the third authorization method
  • the third authorization method is the authorization method for accessing the service providing function network element
  • the third authorization method is determined according to the first authorization method and the second authorization method
  • the first authorization method is the authorization method corresponding to the network to which the network element of the service consumption function belongs
  • the second authorization method is the authorization method corresponding to the network to which the network element of the service provision function belongs
  • the processor 51 is used to provide the service according to the third authorization method
  • the functional network element requests the first service.
  • the input port 53 is used to receive authorization indication information, and the authorization indication information is used to determine the authorization method for accessing the service providing function network element, the authorization indication information is one of multiple indication information, and the multiple indication information Including first indication information and second indication information, the first indication information is used to indicate the static authorization mode, and the second indication information is used to indicate that the open authorization mode is preferentially used in the static authorization mode and the open authorization mode; the processor 51 is used to Determine an authorization method for accessing the service providing function network element according to the authorization indication information; the processor 51 is further configured to request a second service from the service providing function network element according to the authorization method for accessing the service providing function network element.
  • the apparatus 50 is configured on or itself is a network device, such as NFc.
  • each module or unit in the device 50 listed above are only illustrative, and each module or unit in the device 50 can be used to implement the above method 500/600/700/800/900/1000 by the network device
  • NFc for example, NFc
  • SoC technology for example, by a network device function chip, and the network device function chip integrates a processor, a memory , communication interface and other devices, the programs related to network equipment functions are stored in the memory, and the processor executes the programs to realize the related functions of the base station.
  • the network device function chip can also read a memory outside the chip to implement related functions of the base station.
  • FIG. 16 is a schematic diagram of a communication device (also referred to as a network device) 60 provided in the embodiment of the present application.
  • the device 60 can be a network device (for example, NRF2), or a chip Or a circuit, such as a chip or a circuit that can be provided in a network device.
  • the device 60 may include a processor 61 (ie, an example of a processing unit) and a memory 62 .
  • the memory 62 is used to store instructions
  • the processor 61 is used to execute the instructions stored in the memory 62, so that the apparatus 60 implements the steps performed by the network device (for example, NRF2) in the above method.
  • the network device for example, NRF2
  • the device 60 may further include an input port 63 (ie, an example of a communication unit) and an output port 64 (ie, another example of a communication unit).
  • an input port 63 ie, an example of a communication unit
  • an output port 64 ie, another example of a communication unit.
  • the processor 61 , the memory 62 , the input port 63 and the output port 64 may communicate with each other through internal connection paths to transmit control and/or data signals.
  • the memory 62 is used to store a computer program, and the processor 61 can be used to call and run the computer program from the memory 62, to control the input port 63 to receive signals, and to control the output port 64 to send signals, so as to complete the network device in the above method A step of.
  • the memory 62 can be integrated in the processor 61 or can be set separately from the processor 61 .
  • the input port 63 is a receiver
  • the output port 64 is a transmitter.
  • the receiver and the transmitter may be the same or different physical entities. When they are the same physical entity, they can be collectively referred to as transceivers.
  • the input port 63 is an input interface
  • the output port 64 is an output interface
  • the functions of the input port 63 and the output port 64 may be realized by a transceiver circuit or a dedicated chip for transceiver.
  • the processor 61 may be realized by a dedicated processing chip, a processing circuit, a processor or a general-purpose chip.
  • a general-purpose computer to implement the network device provided in the embodiment of the present application.
  • the program codes to realize the functions of the processor 61 , the input port 63 and the output port 64 are stored in the memory 62 , and the general processor realizes the functions of the processor 61 , the input port 63 and the output port 64 by executing the codes in the memory 62 .
  • the processor 61 is used to determine the authorization indication information of the authorization method for accessing the service providing function network element, the authorization indication information is one of a plurality of indication information, and the plurality of indication information includes the first indication information and The second indication information, the first indication information is used to indicate the static authorization mode, and the second indication information is used to indicate that the open authorization mode should be used preferentially in the static authorization mode and the open authorization mode; the output port 64 is used to send the authorization indication information.
  • the apparatus 60 is configured on or itself is a network device, such as NRF2.
  • the functions and actions of the modules or units in the device 60 listed above are only illustrative, and the modules or units in the device 60 can be used to implement the above method 500/600/700/800/900/1000 by the network device (For example, NRF2) performs various actions or processing procedures.
  • the network device For example, NRF2
  • the detailed description thereof is omitted.
  • the SoC technology for example, by a network device function chip, and the network device function chip integrates a processor, a memory , communication interface and other devices, the programs related to network equipment functions are stored in the memory, and the processor executes the programs to realize the related functions of the base station.
  • the network device function chip can also read a memory outside the chip to implement related functions of the base station.
  • the processor may be a central processing unit (central processing unit, CPU), and the processor may also be other general-purpose processors, digital signal processors (digital signal processor, DSP), dedicated integrated Circuit (application specific integrated circuit, ASIC), off-the-shelf programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.
  • a general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like.
  • the memory in the embodiments of the present application may be a volatile memory or a nonvolatile memory, or may include both volatile and nonvolatile memories.
  • the non-volatile memory can be read-only memory (read-only memory, ROM), programmable read-only memory (programmable ROM, PROM), erasable programmable read-only memory (erasable PROM, EPROM), electrically programmable Erases programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • Volatile memory can be random access memory (RAM), which acts as external cache memory.
  • RAM random access memory
  • SRAM static random access memory
  • DRAM dynamic random access memory
  • SDRAM synchronous dynamic random access memory
  • Double data rate synchronous dynamic random access memory double data rate SDRAM, DDR SDRAM
  • enhanced SDRAM enhanced synchronous dynamic random access memory
  • SLDRAM synchronous connection dynamic random access memory
  • direct rambus RAM direct rambus RAM
  • the above-mentioned embodiments may be implemented in whole or in part by software, hardware, firmware or other arbitrary combinations.
  • the above-described embodiments may be implemented in whole or in part in the form of computer program products.
  • the computer program product comprises one or more computer instructions or computer programs. When the computer instruction or computer program is loaded or executed on the computer, the process or function according to the embodiment of the present application will be generated in whole or in part.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transferred from a website, computer, server, or data center by wire (such as infrared, wireless, microwave, etc.) to another website site, computer, server or data center.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server, a data center, or a collection of one or more available media.
  • the available media may be magnetic media (eg, floppy disk, hard disk, magnetic tape), optical media (eg, DVD), or semiconductor media.
  • the semiconductor medium may be a solid state drive.
  • sequence numbers of the above-mentioned processes do not mean the order of execution, and the execution order of the processes should be determined by their functions and internal logic, and should not be used in the embodiments of the present application.
  • the implementation process constitutes any limitation.
  • a component may be, but is not limited to being, a process running on a processor, a processor, an object, an executable, a thread of execution, a program, and/or a computer.
  • an application running on a computing device and the computing device can be components.
  • One or more components can reside within a process and/or thread of execution and a component can be localized on one computer and/or distributed between two or more computers.
  • these components can execute from various computer readable media having various data structures stored thereon.
  • a component may, for example, be based on a signal having one or more packets of data (e.g., data from two components interacting with another component between a local system, a distributed system, and/or a network, such as the Internet via a signal interacting with other systems). Communicate through local and/or remote processes.
  • packets of data e.g., data from two components interacting with another component between a local system, a distributed system, and/or a network, such as the Internet via a signal interacting with other systems.
  • the disclosed systems, devices and methods may be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.
  • a unit described as a separate component may or may not be physically separated, and a component displayed as a unit may or may not be a physical unit, that is, it may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit.
  • this function is realized in the form of a software function unit and sold or used as an independent product, it can be stored in a computer-readable storage medium.
  • the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disk or optical disc and other media that can store program codes. .

Abstract

一种通信方法和网络设备，通信方法包括：确定第二授权方式和第三授权方式，第二授权方式是服务消费功能网元所属网络对应的授权方式，第三授权方式是服务提供功能网元所属网络对应的授权方式；根据第二授权方式和第三授权方式确定第一授权方式，第一授权方式是访问服务提供功能网元的授权方式；发送第一授权方式。通信方法和网络设备，能够完成不同网络功能网元之间授权机制的协商，使得服务消费功能网元获得业务访问的授权方式，进而解决授权冲突的问题。

Description

通信方法和网络设备
本申请要求于2021年05月24日提交中国专利局、申请号为202110567958.9、申请名称为“通信方法和网络设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信领域，并且更具体地，涉及一种通信方法和网络设备。
背景技术
当前第五代(the 5th Generation，5G)网络中，针对基于服务化架构(Service Based Architecture，SBA)，不同网络功能(network function，NF)网元之间的业务访问是基于授权机制进行的，比如：包括静态授权方式和Oauth授权方式。
其中，网络功能网元在进行业务访问时需要确定执行的授权方式。特别是在漫游场景下，如果服务消费功能网元和服务提供功能网元属于不同的运营商，那么两个网元之间的授权机制不同，就会出现授权冲突的问题，从而发生业务的中断。
因此，不同网络功能网元之间如何完成授权方式的协商是亟待解决的问题。
发明内容
第一方面，提供了一种通信方法，该方法可以由网络存储功能(network repository function，NRF)网元或安全边缘保护代理(security edge protection proxy，SEPP)网元执行，该方法包括：确定第一授权方式和第二授权方式，该第一授权方式是服务消费功能网元所属网络对应的授权方式，该第二授权方式是服务提供功能网元所属网络对应的授权方式；根据该第一授权方式和该第二授权方式确定第三授权方式，该第三授权方式是访问服务提供功能网元的授权方式；发送该第三授权方式。
根据本申请提供的方案，通过确定第一授权方式和第二授权方式，根据第一授权方式和第二授权方式确定第三授权方式，并向服务消费功能网元发送该第三授权方式。采用协商的方式进行确定访问服务提供功能网元的授权方式，进而解决授权冲突的问题，保证不同网络功能网元之间的业务访问正常进行。
结合第一方面，在第一方面的某些实现方式中，确定第二授权方式，包括：接收第一请求消息，该第一请求消息包括该服务提供功能网元所属网络的标识信息；根据该服务提供功能网元所属网络的标识信息确定该第二授权方式。
示例性的，确定第二授权方式可以是网络存储功能NRF网元或安全边缘保护代理SEPP网元配置该第二授权方式。通过配置对端授权方式，例如服务提供功能(NF service producer，NFp)网元所属网络公共陆地移动网标识(public land mobile network identity，PLMN ID2)对应的授权方式，使得NRF或SEPP在接收到NFc请求访问对端NFp网元 的授权方式时，本端NRF或SEPP可以直接根据NFc网元所属网络PLMN ID1对应的授权方式和对端NFp所属网络PLMN ID2对应的授权方式确定最终访问NFp的授权方式，减少NFc和NFp之间的授权冲突。
应理解，本申请实施例中，第一请求消息包括发现请求消息和/或授权请求消息。
结合第一方面，在第一方面的某些实现方式中，确定第一授权方式，包括：获取该服务消费功能网元所属网络的标识信息；根据该服务消费功能网元所属网络的标识信息确定该第一授权方式。
结合第一方面，在第一方面的某些实现方式中，获取服务消费功能网元所属网络的标识信息，包括：接收服务消费功能网元所属网络的标识信息，或者根据第一网络存储功能网元和第一安全边缘保护代理网元之间的连接确定所述服务消费功能网元所属网络的标识信息。
示例性的，从服务消费功能网元NFc接收服务消费功能网元所属网络的标识信息。
作为示例而非限定，NRF或者SEPP可以直接配置访问服务提供功能NFp网元对应的授权方式，即第一授权方式，NRF或者SEPP直接保存有该第一授权方式。此时，当NFc请求访问NFp的授权方式时，NRF或者SEPP不需要再根据PLMN ID1和PLMN ID2支持的授权方式确定最终授权方式。该实现方式既可以避免不同网元互相访问服务时发生授权冲突，又能够较少信令开销。
结合第一方面，在第一方面的某些实现方式中，该第三授权方式为开放授权方式，该方法还包括：接收第二请求消息，该第二请求消息用于请求获取第一令牌，该第一令牌用于授权该服务消费功能网元访问该第一服务；确定该第一令牌；发送该第一令牌。
示例性的，NRF网元负责服务授权的判断，例如服务消费功能NFc网元在访问服务提供功能NFp网元之前，会先向NRF发送请求消息，NRF判断允许NFc访问NFp之后，会生成一个授权令牌token，并发送token给NFc。使得NFc在访问NFp服务携带token。待NFp在校验token成功后，会为NFc提供对应的服务。
示例性的，第一请求信息和第二请求消息均还包括以下信息中的一个或多个：服务消费功能网元所属网络的标识信息、服务提供功能网元的业务类型、服务消费功能网元的业务类型。
结合第一方面，在第一方面的某些实现方式中，根据该第一授权方式和该第二授权方式确定第三授权方式，包括：根据该第一授权方式和该第二授权方式的共有授权方式确定该第三授权方式。
示例性的，当该共有授权方式为该静态授权方式或该开放授权方式，确定该静态授权方式或该开放授权方式为该第三授权方式；当该共有授权方式为该静态授权方式和该开放授权方式，根据本地策略确定该第三授权方式，或者确定该开放授权方式为该第三授权方式。
通过选取第一授权方式和第二授权方式的交集进一步确定最终NFc访问NFp服务使用的授权方式，避免由于授权冲突的问题，导致发生业务的中断。
示例性的，当第一授权方式和第二授权方式的共有授权方式同时支持静态授权方式和开放授权方式时，可以确定开放授权方式为最终NFc访问NFp服务所使用的授权方式；也可以根据本地策略进一步确定该第三授权方式，例如，根据NFc网元的能力，或者NFc 所在网络的授权策略的机制等，本申请对此不作限定。
作为示例而非限定，NRF或SEPP根据NFp所属网络(例如，PLMN ID2)直接确定第三授权，无需根据第一授权方式和第二授权方式的共有方式，进一步确定访问NFp服务的授权方式，并向NFc发送该第三授权方式。
第二方面，提供了一种通信方法，该方法可以由服务消费功能(NF service consumer，NFc)网元执行，该方法包括：接收第三授权方式，该第三授权方式是访问服务提供功能网元的授权方式，该第三授权方式是根据第一授权方式和第二授权方式确定的，该第一授权方式是服务消费功能网元所属网络对应的授权方式，该第二授权方式是该服务提供功能网元所属网络对应的授权方式；根据该第三授权方式向该服务提供功能网元请求第一服务。
根据本申请提供的方案，通过接收第三授权方式，即访问服务提供功能网元的授权方式，并根据该第三授权方式向NFp发送服务请求。该第三授权方式是采用协商的方式进行确定的，进而解决NFc和NFp网元之间授权冲突的问题，保证不同网络功能网元之间的业务访问正常进行。
结合第二方面，在第二方面的某些实现方式中，在接收该第三授权方式之前，该方法还包括：发送第一请求消息，该第一请求消息用于请求获取该第三授权方式，该第一请求消息包括该服务提供功能网元所属网络的标识信息。
应理解，本申请实施例中，第一请求消息包括发现请求消息和/或授权请求消息。
示例性的，发送第一请求消息包括：向网络存储功能NRF网元或安全边缘保护代理SEPP网元或服务通信代理(service communication proxy，SCP)网元发送第一请求消息。
应理解，当前5G架构包括SCP网元。SCP是NF网元的代理，也可以理解SCP为一个SCP域的出入口，或者代理节点。因此不同域之间的协商，也可以通过SCP来完成，例如NFc-SCP1-SCP2-NFp。所以上述通过SEPP直接协商的方式，也可以使用SCP的方式。对应的，可以将SCP替换为上述SEPP，PLMN ID替换为SCP域标识。
本申请适用不同域之间的协商，通过域标识确定此域授权方式的机制。例如NRF域、NF set域、SCP域，安全域等。域标识也可以不同，例如SCP域ID，NF set域ID，安全域ID，NRF域ID等。以下以漫游场景，域标识为PLMN ID为例进行描述。
结合第二方面，在第二方面的某些实现方式中，根据该第三授权方式向该服务提供功能网元请求第一服务，包括：当该第三授权方式为开发授权方式，向NRF发送第二请求消息，该第二请求消息用于请求获取第一令牌，该第一令牌用于授权该服务消费功能网元访问该第一服务；接收该第一令牌；向该服务提供功能网元发送用于请求该第一服务的消息，该用于请求该第一服务的消息中包括该第一令牌。
示例性的，NRF网元负责服务授权的判断，例如服务消费功能NFc网元在访问服务提供功能NFp网元之前，会先向NRF发送请求消息，NRF判断允许NFc访问NFp之后，会生成一个授权令牌token，并发送token给NFc。使得NFc在访问NFp服务携带token。待NFp在校验token成功后，会为NFc提供对应的服务。
结合第二方面，在第二方面的某些实现方式中，根据该第三授权方式向该服务提供功能网元请求第一服务，包括：当第三授权方式为静态授权方式，NFc直接使用该静态授权方式向NFp请求服务。例如发送业务请求至NFp，NFp根据静态授权方式(例如本地策略)判断是否授权NFc使用其请求的服务。
示例性的，第一请求信息和第二请求消息均还包括以下信息中的一个或多个：服务消费功能网元所属网络的标识信息、服务提供功能网元的业务类型、服务消费功能网元的业务类型。
结合第二方面，在第二方面的某些实现方式中，该接收第三授权方式包括：从网络存储功能网元或安全边缘保护代理网元接收该第三授权方式。
第三方面，提供了一种通信方法，该方法可以由第二网络存储功能NRF2网元或第二安全边缘保护代理SEPP2网元执行，该方法包括：接收请求消息，该请求消息用于请求获取访问第二功能网元的授权方式，该请求消息包括第一功能网元所属网络对应的授权方式；确定该第二功能网元所属网络对应的授权方式；根据该第一功能网元所属网络对应的授权方式和该第二功能网元所属网络对应的授权方式确定访问该第二功能网元的授权方式；发送访问该第二功能网元的授权方式。
可选地，该请求信息包括用于指示NRF2或SEPP2返回第二功能网元的授权方式的指示信息。
示例性的，SEPP2可以同时为多个NFc所属多个网络提供服务，或者仅为NFc所属网络PLMN ID1提供服务。如果SEPP2为多个PLMN ID对应的网络提供服务，那么SEPP2需要从SEPP1接收具体的某一PLMN ID，并根据接收到的PLMN ID确定对应的授权方式。
根据本申请提供的方案，通过两端NRF之间的协商，或者SEPP之间的协商，进而确定访问第二功能网元的授权方式，有效解决不同网元间授权冲突的问题，保证不同网络功能网元之间的业务访问正常进行。
结合第三方面，在第三方面的某些实现方式中，该第一功能网元包括第一网络存储功能网元或第一安全边缘保护代理网元，该第二功能网元包括第二网络存储功能网元或第二安全边缘保护代理网元。
结合第三方面，在第三方面的某些实现方式中，确定该第二功能网元所属网络对应的授权方式，包括：获取该第二功能网元所属网络的标识信息；根据该第二功能网元所属网络的标识信息确定该第二功能网元所属网络对应的授权方式。
结合第三方面，在第三方面的某些实现方式中，根据该第一功能网元所属网络对应的授权方式和该第二功能网元所属网络对应的授权方式确定访问该第二功能网元的授权方式，包括：根据该第一功能网元所属网络对应的授权方式和该第二功能网元所属网络对应的授权方式的共有授权方式确定访问该第二功能网元的授权方式；
示例性的，当该共有授权方式为该静态授权方式或该开放授权方式，确定该静态授权方式或该开放授权方式为访问该第二功能网元的授权方式；当该共有授权方式为该静态授权方式和该开放授权方式，根据本地策略确定访问该第二功能网元的授权方式，或者确定该开放授权方式为访问该第二功能网元的授权方式。应理解，本申请实施例中根据本地策略确定访问该第二功能网元的授权方式，可以是基于NFc网元的能力，或者NFc所在网络的授权策略的机制等确定，本申请对此不作限定。
第四方面，提供了一种通信方法，该方法可以由第一网络存储功能NRF1网元或第一安全边缘保护代理SEPP1网元执行，该方法包括：确定第一功能网元所属网络对应的授权方式；发送请求消息，该请求消息用于请求获取访问第二功能网元的授权方式，该请求消息包括该第一功能网元所属网络对应的授权方式；接收访问第二功能网元的授权方式， 访问第二功能网元的授权方式是根据该第一功能网元所属网络对应的授权方式和该第二功能网元所属网络对应的授权方式确定的；发送访问第二功能网元的授权方式。
可选地，该请求信息包括用于指示NRF2或SEPP2返回第二功能网元的授权方式的指示信息。
示例性的，SEPP2可以同时为多个NFc所属多个网络提供服务，或者仅为NFc所属网络PLMN ID1提供服务。如果SEPP2为多个PLMN ID对应的网络提供服务，那么SEPP2需要从SEPP1接收具体的某一PLMN ID，并根据接收到的PLMN ID确定对应的授权方式。
根据本申请提供的方案，通过向对端NRF2或SEPP2请求获取访问第二功能网元的授权方式，并接收访问第二功能网元的授权方式。再向NFc发送访问第二功能网元的授权方式，使得NFc可以基于该授权方式向第二功能网元发送服务请求，避免网元间授权冲突，保证业务访问的正常进行。
结合第四方面，在第四方面的某些实现方式中，该第一功能网元包括第一网络存储功能网元或第一安全边缘保护代理网元，该第二功能网元包括第二网络存储功能网元或第二安全边缘保护代理网元。
结合第四方面，在第四方面的某些实现方式中，确定该第一功能网元所属网络对应的授权方式，包括：获取该第一功能网元所属网络的标识信息；根据该第一功能网元所属网络的标识信息确定该第一功能网元所属网络对应的授权方式。
第五方面，提供了一种通信方法，该方法可以由第一网络存储功能NRF1网元或第一安全边缘保护代理SEPP1网元执行，该方法包括：发送请求消息，该请求消息包括获取第二功能网元所属网络对应的授权方式的指示信息；接收该第二功能网元所属网络对应的授权方式；根据该第二功能网元所属网络对应的授权方式和第一功能网元所属网络对应的授权方式确定访问该第二功能网元的授权方式；发送访问该第二功能网元的授权方式。
示例性的，NRF1网元或SEPP1网元向NFc发送访问第二功能网元的授权方式，使得NFc可以基于该授权方式向第二功能网元发送服务请求，避免网元间授权冲突，保证业务访问正常进行。
根据本申请提供的方案，通过发送请求获取第二功能网元所述网络对应的授权方式的指示信息，来获取第二功能网元所属网络对应的授权方式，再根据第一功能网元和第二功能网元分别对应的授权方式进一步确定最终的授权方式，即NFc访问第二功能网元的授权方式。通过两端NRF之间的协商或SEPP之间的协商来确定访问第二功能网元的授权方式。该实现方式时效性较好，因为如果对端网络的授权方式发生变化，通过两端网元之间的协商可以获得最新的授权机制。
结合第五方面，在第五方面的某些实现方式中，该第一功能网元包括第一网络存储功能网元或第一安全边缘保护代理网元，该第二功能网元包括第二网络存储功能网元或第二安全边缘保护代理网元。
结合第五方面，在第五方面的某些实现方式中，发送通知消息，该通知消息用于指示访问该第一功能网元对应的授权方式，该通知消息包括该第一功能网元所属网络对应的授权方式。
示例性的，NRF1网元或SEPP1网元向NRF2网元或SEPP2网元发送该通知消息，方便后续NFp所在网络内NF网元请求访问第一功能网元所在网络内NF网元对应的授权方 式时，NRF2网元或SEPP2网元可以直接将第一功能网元对应的授权方式发送给NFp，避免协商流程，既能解决网元间授权冲突问题，还能够减少信令开销。
结合第五方面，在第五方面的某些实现方式中，获取该第一功能网元所属网络的标识信息；根据该第一功能网元所属网络的标识信息确定该第一功能网元所属网络对应的授权方式。
示例性的，第三请求信息包括第三指示，第三指示用于指示需要返回第二功能网元的授权方式。
第六方面，提供了一种通信方法，该方法可以由第二网络存储功能NRF2网元或第二安全边缘保护代理SEPP2网元执行，该方法包括：接收请求消息，该请求消息包括获取第二功能网元所属网络对应的授权方式的指示信息；确定该第二功能网元所属网络对应的授权方式；发送该第二功能网元所属网络对应的授权方式。
根据本申请提供的方案，通过接收请求获取第二功能网元所述网络对应的授权方式的指示信息，并向NRF1或SEPP1发送第二功能网元所属网络对应的授权方式。通过两端NRF之间的协商或SEPP之间的协商来确定访问第二功能网元的授权方式。该实现方式时效性较好，因为如果对端网络的授权方式发生变化，通过两端网元之间的协商可以获得最新的授权机制。
结合第六方面，在第六方面的某些实现方式中，该第一功能网元包括第一网络存储功能网元或第一安全边缘保护代理网元，该第二功能网元包括第二网络存储功能网元或第二安全边缘保护代理网元。
结合第六方面，在第六方面的某些实现方式中，接收通知消息，该通知消息用于指示访问该第一功能网元对应的授权方式，该通知消息包括该第一功能网元所属网络对应的授权方式。
示例性的，NRF2网元或SEPP2网元接收来自NRF1网元或SEPP1网元的通知消息，方便后续NFp请求访问第一功能网元对应的授权方式时，NRF2网元或SEPP2网元可以直接将第一功能网元对应的授权方式发送给NFp，避免协商流程，既能解决网元间授权冲突问题，还能够减少信令开销。
结合第六方面，在第六方面的某些实现方式中，确定该第二功能网元所属网络对应的授权方式，包括：获取该第二功能网元所属网络的标识信息；根据该第二功能网元所属网络的标识信息确定该第二功能网元所属网络对应的授权方式。
第七方面，提供了一种通信方法，该方法可以由服务消费功能NFc网元执行，该方法包括：接收授权指示信息，该授权指示信息用于确定访问服务提供功能网元的授权方式，该授权指示信息为多个指示信息中的一个，该多个指示信息包括第一指示信息和第二指示信息，该第一指示信息用于指示静态授权方式，该第二指示信息用于指示在静态授权方式和开放授权方式中优先使用开放授权方式；根据该授权指示信息确定访问服务提供功能网元的授权方式；根据访问服务提供功能网元的授权方式向该服务提供功能网元请求第二服务。
应理解，在静态授权方式和开放授权方式中优先使用开放授权方式，是因为开放授权方式相对来说适用性更好。
根据本申请提供的方案，通过接收授权指示信息，进一步确定访问服务提供功能网元 的授权方式；根据访问服务提供功能网元的授权方式向该服务提供功能网元请求。通过新定义授权指示信息Oauth2required，使得NFc完成授权策略的确定，减少了不必要的协商流程。
结合第七方面，在第七方面的某些实现方式中，根据该授权指示信息确定访问服务提供功能网元的授权方式，包括：
当该服务消费功能网元所属网络对应的授权方式包括该开放授权方式，或该静态授权方式和该开放授权方式，该授权指示信息为该第二指示信息时，确定访问该服务提供功能网元的授权方式是该开放授权方式，或者根据本地策略确定访问服务提供功能网元的授权方式是否为该开放授权方式；或者
当该服务消费功能网元所属网络对应的授权方式包括该静态授权方式，该授权指示信息为该第一指示信息或该第二指示信息时，确定访问该服务提供功能网元的授权方式是该静态授权方式。
应理解，本申请实施例中根据本地策略确定访问该第二功能网元的授权方式，可以是基于NFc网元的能力，或者NFc所在网络的授权策略的机制等确定，本申请对此不作限定。
在该实现方式中，NFc通过授权指示进一步确定访问服务提供功能网元的授权方式是静态授权方式和/或开放授权方式。并根据确定的授权方式向NFp请求服务。其中，如果最终的授权方式是静态方式，则NFc直接采用静态授权方式向NFp发送服务请求；如最终的授权方式是开放授权方式，NFc则需要先向NRF发送请求获取授权令牌token，再携带该授权令牌token向NFp请求服务，待NFp校验token成功后，为NFc提供相应的服务。
结合第七方面，在第七方面的某些实现方式中，该多个指示信息还包括第三指示信息，该第三指示信息用于指示该开放授权方式，根据该授权指示信息确定访问服务提供功能网元的授权方式，包括：
当该服务消费功能网元所属网络对应的授权方式包括该开放授权方式，或该静态授权方式和该开放授权方式，该授权指示信息为第三指示信息时，根据该第三指示信息确定访问该服务提供功能网元的授权方式是该开放授权方式；或者
当该服务消费功能网元所属网络对应的授权方式为该静态授权方式，并且访问该服务提供功能网元的授权方式为该开放授权方式，发送拒绝消息，或者根据本地策略确定访问服务提供功能网元的授权方式为该静态授权方式。
结合第七方面，在第七方面的某些实现方式中，发送通知消息，该通知消息用于指示访问该服务消费功能网元对应的授权方式，该通知消息包括该服务消费功能网元所属网络的标识信息和该服务消费功能网元所属网络对应的授权方式。
示例性的，NFc网元向NFp网元发送通知消息，方便后续NFp所在网络内NF网元请求访问服务消费功能NFc所在网络内NF网元时，可以直接将NFc网元对应的授权方式发送给NFp，避免协商流程，既能解决网元间授权冲突问题，还能够减少信令开销。
第八方面，提供了一种通信方法，该方法可以由第二服务提供功能(NF service producer，NFp)网元执行，该方法包括：确定访问服务提供功能网元的授权方式的授权指示信息，该授权指示信息为多个指示信息中的一个，该多个指示信息包括第一指示信息和第二指示信息，该第一指示信息用于指示静态授权方式，该第二指示信息用于指示在静态授权方式 和开放授权方式中优先使用开放授权方式；发送该授权指示信息。
应理解，在静态授权方式和开放授权方式中优先使用开放授权方式，是因为开放授权方式相对来说适用性更好。
根据本申请提供的方案，通过新定义的授权指示信息Oauth2required，NFp确定并向NFc发送授权指示信息，使得NFc完成访问服务提供功能网元的授权方式的确定，减少了不必要的协商流程。
结合第八方面，在第八方面的某些实现方式中，接收通知消息，该通知消息用于指示访问该服务消费功能网元对应的授权方式，该通知消息包括该服务消费功能网元所属网络的标识信息和该服务消费功能网元所属网络对应的授权方式。
示例性的，NFp网元接收来自NFc网元的通知消息，方便后续NFp请求访问服务消费功能NFc网元时，可以直接将NFc网元对应的授权方式发送给NFp，避免协商流程，既能解决网元间授权冲突问题，还能够减少信令开销。
结合第一方面至第八方面，在某些实现方式中，该第一授权方式和第二授权方式包括静态授权方式和/或开放授权方式。对应地，该第三授权方式是静态授权方式和/或开放授权方式。这里静态授权方式(static)是基于本地授权策略的机制，开放授权方式(open authorization，Oauth)是一种基于令牌等授权参数的开放授权机制，其包括授权中心，业务的使用者，业务的提供者或者资源的拥有者等实体。授权中心会授权是否允许业务使用者使用业务提供者的服务。如果允许的话，则为业务使用者分发令牌。业务使用者发送令牌至业务提供者，当令牌校验成功后，业务提供者则为业务使用者提供服务。在5G网络则定义一个网络存储功能NRF网元进行服务授权的判断，该网络存储功能网元与该服务消费功能网元对应。
第九方面，提供了一种网络设备，该方法可以由网络存储功能NRF网元或安全边缘保护代理SEPP网元执行，该方法包括：处理单元，用于确定第一授权方式和第二授权方式，该第一授权方式是服务消费功能网元所属网络对应的授权方式，该第二授权方式是服务提供功能网元所属网络对应的授权方式；该处理单元，还用于根据该第一授权方式和该第二授权方式确定第三授权方式，该第三授权方式是访问服务提供功能网元的授权方式；收发单元，用于发送该第三授权方式。
具体地，该收发单元可以执行上述第一方面中涉及接收/发送的处理；该处理单元可以执行上述第一方面中除了接收/发送之外的其他处理。
第十方面，提供了一种网络设备，该方法可以由服务消费功能NFc网元执行，该方法包括：收发单元，用于接收第三授权方式，该第三授权方式是访问服务提供功能网元的授权方式，该第三授权方式是根据第一授权方式和第二授权方式确定的，该第一授权方式是服务消费功能网元所属网络对应的授权方式，该第二授权方式是该服务提供功能网元所属网络对应的授权方式；处理单元，用于根据该第三授权方式向该服务提供功能网元请求第一服务。
具体地，该收发单元可以执行上述第二方面中涉及接收/发送的处理；该处理单元可以执行上述第二方面中除了接收/发送之外的其他处理。
第十一方面，提供了一种网络设备，该方法可以由第二网络存储功能NRF2网元或第二安全边缘保护代理SEPP2网元执行，该方法包括：收发单元，用于接收请求消息，该 请求消息用于请求获取访问第二功能网元的授权方式，该请求消息包括第一功能网元所属网络对应的授权方式；处理单元，用于确定该第二功能网元所属网络对应的授权方式；该处理单元，还用于根据该第一功能网元所属网络对应的授权方式和该第二功能网元所属网络对应的授权方式确定访问该第二功能网元的授权方式；该收发单元，还用于发送访问该第二功能网元的授权方式。
具体地，该收发单元可以执行上述第三方面中涉及接收/发送的处理；该处理单元可以执行上述第三方面中除了接收/发送之外的其他处理。
第十二方面，提供了一种网络设备，该方法可以由第一网络存储功能NRF1网元或第一安全边缘保护代理SEPP1网元执行，该方法包括：处理单元，用于确定第一功能网元所属网络对应的授权方式；收发单元，用于发送请求消息，该请求消息用于请求获取访问第二功能网元的授权方式，该请求消息包括该第一功能网元所属网络对应的授权方式；该收发单元，还用于接收访问第二功能网元的授权方式，访问第二功能网元的授权方式是根据该第一功能网元所属网络对应的授权方式和该第二功能网元所属网络对应的授权方式确定的；该收发单元，还用于发送访问第二功能网元的授权方式。
具体地，该收发单元可以执行上述第四方面中涉及接收/发送的处理；该处理单元可以执行上述第四方面中除了接收/发送之外的其他处理。
第十三方面，提供了一种网络设备，该方法可以由第一网络存储功能NRF1网元或第一安全边缘保护代理SEPP1网元执行，该方法包括：收发单元，用于发送请求消息，该请求消息包括获取第二功能网元所属网络对应的授权方式的指示信息；该收发单元，还用于接收该第二功能网元所属网络对应的授权方式；处理单元，用于根据该第二功能网元所属网络对应的授权方式和第一功能网元所属网络对应的授权方式确定访问该第二功能网元的授权方式；该收发单元，还用于发送访问该第二功能网元的授权方式。
具体地，该收发单元可以执行上述第五方面中涉及接收/发送的处理；该处理单元可以执行上述第五方面中除了接收/发送之外的其他处理。
第十四方面，提供了一种网络设备，该方法可以由第二网络存储功能NRF2网元或第二安全边缘保护代理SEPP2网元执行，该方法包括：接收请求消息，该请求消息包括获取第二功能网元所属网络对应的授权方式的指示信息；确定该第二功能网元所属网络对应的授权方式；发送该第二功能网元所属网络对应的授权方式。
具体地，该收发单元可以执行上述第六方面中涉及接收/发送的处理；该处理单元可以执行上述第六方面中除了接收/发送之外的其他处理。
第十五方面，提供了一种网络设备，该方法可以由服务消费功能NFc网元执行，该方法包括：收发单元，用于接收授权指示信息，该授权指示信息用于确定访问服务提供功能网元的授权方式，该授权指示信息为多个指示信息中的一个，该多个指示信息包括第一指示信息和第二指示信息，该第一指示信息用于指示静态授权方式，该第二指示信息用于指示在静态授权方式和开放授权方式中优先使用开放授权方式；处理单元，用于根据该授权指示信息确定访问服务提供功能网元的授权方式；该处理单元，还用于根据访问服务提供功能网元的授权方式向该服务提供功能网元请求第二服务。
具体地，该收发单元可以执行上述第七方面中涉及接收/发送的处理；该处理单元可以执行上述第七方面中除了接收/发送之外的其他处理。
第十六方面，提供了一种网络设备，该方法可以由第二服务提供功能(NF service producer，NFp)网元执行，该方法包括：处理单元，用于确定访问服务提供功能网元的授权方式的授权指示信息，该授权指示信息为多个指示信息中的一个，该多个指示信息包括第一指示信息和第二指示信息，该第一指示信息用于指示静态授权方式，该第二指示信息用于指示在静态授权方式和开放授权方式中优先使用开放授权方式；收发单元，用于发送该授权指示信息。
具体地，该收发单元可以执行上述第八方面中涉及接收/发送的处理；该处理单元可以执行上述第八方面中除了接收/发送之外的其他处理。
第十七方面，提供了一种网络设备，包括：处理器，可选地，还包括存储器，该处理器用于控制收发器收发信号，该存储器用于存储计算机程序，该处理器用于从存储器中调用并运行该计算机程序，使得该网络设备执行上述第一方面或第一方面中任一种可能实现方式中的方法，或者第二方面或第二方面中任一种可能实现方式中的方法，或者第三方面或第三方面中任一种可能实现方式中的方法，或者第四方面或第四方面中任一种可能实现方式中的方法，或者第五方面或第五方面中任一种可能实现方式中的方法，或者第六方面或第六方面中任一种可能实现方式中的方法，或者第七方面或第七方面中任一种可能实现方式中的方法，或者第八方面或第八方面中任一种可能实现方式中的方法。
可选地，该处理器为一个或多个，该存储器为一个或多个。
可选地，该存储器可以与该处理器集成在一起，或者该存储器与处理器分离设置。
可选地，该终端设备还包括收发器，收发器具体可以为发射机(发射器)和接收机(接收器)。
第十八方面，提供了一种通信装置，包括：用于实现第一方面或第一方面任一种可能实现方式中的方法的单元；或者用于实现第二方面或第二方面任一种可能实现方式中的方法；或者用于实现第三方面或第三方面任一种可能实现方式中的方法，或者第四方面或第四方面中任一种可能实现方式中的方法，或者第五方面或第五方面中任一种可能实现方式中的方法，或者第六方面或第六方面中任一种可能实现方式中的方法，或者第七方面或第七方面中任一种可能实现方式中的方法，或者第八方面或第八方面中任一种可能实现方式中的方法。
第十九方面，提供了一种通信系统，包括：网络设备，用于执行如上述第一方面或第一方面任一种可能实现方式中的方法；或者第二方面或第二方面任一种可能实现方式中的方法；或者第三方面或第三方面任一种可能实现方式中的方法，或者第四方面或第四方面中任一种可能实现方式中的方法，或者第五方面或第五方面中任一种可能实现方式中的方法，或者第六方面或第六方面中任一种可能实现方式中的方法，或者第七方面或第七方面中任一种可能实现方式中的方法，或者第八方面或第八方面中任一种可能实现方式中的方法。
第二十方面，提供了一种计算机可读存储介质，所述计算机可读存储介质存储有计算机程序或代码，所述计算机程序或代码在计算机上运行时，使得所述计算机执行上述第一方面或第一方面任一种可能实现方式中的方法，第二方面或第二方面任一种可能实现方式中的方法，第三方面或第三方面任一种可能实现方式中的方法，第四方面或第四方面中任一种可能实现方式中的方法，第五方面或第五方面中任一种可能实现方式中的方法，第六 方面或第六方面中任一种可能实现方式中的方法，第七方面或第七方面中任一种可能实现方式中的方法，以及第八方面或第八方面中任一种可能实现方式中的方法。
第二十一方面，提供了一种芯片，包括至少一个处理器，所述至少一个处理器与存储器耦合，该存储器用于存储计算机程序，该处理器用于从存储器中调用并运行该计算机程序，使得安装有该芯片系统的网络设备执行上述第一方面或第一方面任一种可能实现方式中的方法，第二方面或第二方面任一种可能实现方式中的方法，以及第三方面或第三方面任一种可能实现方式中的方法。
其中，该芯片可以包括用于发送信息或数据的输入电路或者接口，以及用于接收信息或数据的输出电路或者接口。
第二十二方面，提供了一种计算机程序产品，所述计算机程序产品包括：计算机程序代码，当所述计算机程序代码被网络设备运行时，使得所述网络设备执行上述第一方面或第一方面任一种可能实现方式中的方法，第二方面或第二方面任一种可能实现方式中的方法，第三方面或第三方面任一种可能实现方式中的方法，第四方面或第四方面中任一种可能实现方式中的方法，第五方面或第五方面中任一种可能实现方式中的方法，第六方面或第六方面中任一种可能实现方式中的方法，第七方面或第七方面中任一种可能实现方式中的方法，以及第八方面或第八方面中任一种可能实现方式中的方法。
根据本申请实施例的方案，通过配置对端授权方式，或者增加NFc和NFp之间的网络存储功能网元的协商或安全边缘保护代理网元的协商，或者扩展NFp中的指示信息来减少不必要的协商流程，进而确定NFc访问NFp最终的授权方式。该方法能够完成不同网络功能网元之间授权机制的协商，使得服务消费功能网元获得业务访问的授权方式，进而解决授权冲突的问题，保证业务访问的正常进行。
附图说明
图1是本申请的通信系统的一例的示意图。
图2是本申请的获取授权令牌的方法的一例示意图。
图3是本申请的授权协商场景的一例示意图。
图4是本申请的请求获取服务提供功能网元的信息的一例示意图。
图5是本申请的通信方法的一例示意图。
图6是本申请的网元间授权机制协商方法的一例示意图。
图7是本申请的网元间授权机制协商方法的另一例示意图。
图8是本申请的网元间授权机制协商方法的又一例示意图。
图9是本申请的网元间授权机制协商方法的又一例示意图。
图10是本申请的网元间授权机制协商方法的又一例示意图。
图11是本申请的通信装置的一例示意图。
图12是本申请的通信装置的另一例示意图。
图13是本申请的通信装置的又一例示意图。
图14是本申请的网络设备的一例示意图。
图15是本申请的网络设备的另一例示意图。
图16是本申请的网络设备的又一例示意图。
具体实施方式
下面将结合附图，对本申请中的技术方案进行描述。
本申请实施例的技术方案可以应用于各种通信系统，例如：通用分组无线业务(general packet radio service，GPRS)、长期演进(long term evolution，LTE)系统、LTE频分双工(frequency division duplex，FDD)系统、LTE时分双工(time division duplex，TDD)、通用移动通信系统(universal mobile telecommunication system，UMTS)、全球互联微波接入(worldwide interoperability for microwave access，WIMAX)通信系统、第五代(5th Generation，5G)系统或新无线(new radio，NR)，也可以扩展到类似的无线通信系统中，如无线保真(wireless-fidelity，WIFI)，以及第三代合作伙伴计划(3rd generation partnership project，3GPP)相关的蜂窝系统等。
通常来说，传统的通信系统支持的连接数有限，也易于实现。然而，随着通信技术的发展，移动通信系统将不仅支持传统的通信，还将支持例如，设备到设备(device to device，D2D)通信，机器到机器(machine to machine，M2M)通信，机器类型通信(machine type communication，MTC)，车联网(vehicle to everything，V2X)通信，例如，车到车(vehicle to vehicle，V2V)通信、车到基础设施(vehicle to infrastructure，V2I)通信、车到行人(vehicle to pedestrian，V2P)通信、车到网络(vehicle to network，V2N)通信等，车间通信长期演进技术(long term evolution-vehicle，LTE-V)、车联网、物联网(Internet of Things，IoT)、机器间通信长期演进技术(long term evolution-machine，LTE-M)等。
本申请提供的技术方案还可以应用于未来的通信系统，如第六代移动通信系统等。本申请对此不作限定。
在本申请实施例中，网络设备可以是一种部署在无线接入网中为终端设备提供无线通信功能的装置，可以是用于与终端设备通信的设备或者该设备的芯片。该网络设备包括但不限于：无线网络控制器(radio network controller，RNC)、基站控制器(base station controller，BSC)、家庭基站(例如，home evolved nodeB，或home node B，HNB)、基带单元(baseband unit，BBU)，无线保真系统中的接入点(access point，AP)、无线中继节点、无线回传节点、传输点(transmission point，TP)或者发送接收点(transmission and reception point，TRP)等，还可以为5G(如NR)系统中的gNB或传输点(TRP或TP)，或者5G系统中的基站的一个或一组(包括多个天线面板)天线面板，或者还可以为构成gNB或传输点的网络节点，如基带单元BBU，或分布式单元(distributed unit，DU)等。
本申请实施例中的网络设备可以包括各种形式的宏基站，微基站(也称为小站)，中继站，接入点等，还可以是LTE系统中的演进型基站(evolutional nodeB，eNB或eNodeB)，还可以是云无线接入网络(cloud radio access network，CRAN)场景下的无线控制器，或者该网络设备可以为中继站、接入点、可穿戴设备或车载设备、可穿戴设备以及5G或未来网络中的网络设备或者未来演进的公用陆地移动通信网络PLMN网络中的网络设备等。
在一些网络部署中，网络设备可以包括集中式单元(centralized unit，CU)和分布式单元(distributed unit，DU)。网络设备还可以包括射频单元(radio unit，RU)、有源天线单元(active antenna unit，AAU)。CU实现网络设备的部分功能，比如负责处理非实时协议和服务，实现无线资源控制(radio resource control，RRC)，分组数据汇聚层协议 (packet data convergence protocol，PDCP)层的功能。DU实现网络设备的部分功能，比如负责处理物理层协议和实时服务，实现无线链路控制(radio link control，RLC)层、媒体接入控制(media access control，MAC)层和物理(physical，PHY)层的功能。AAU实现部分物理层处理功能、射频处理及有源天线的相关功能。由于RRC层的信息最终会变成PHY层的信息，或者，由PHY层的信息转变而来。因而在这种架构下，高层信令(例如，RRC层信令)也可以认为是由DU发送的，或者由DU+AAU发送的。可以理解的是，网络设备可以为CU节点、或DU节点、或包括CU节点和DU节点的设备。此外，CU可以划分为接入网RAN中的网络设备，也可以将CU划分为核心网(core network，CN)中的网络设备，在此不做限制。
网络设备为小区提供服务，终端设备通过网络设备分配的传输资源(例如，频域资源，或者频谱资源)与小区进行通信，该小区可以属于宏基站(例如，宏eNB或宏gNB等)，也可以属于小小区(small cell)对应的基站，这里的小小区可以包括：城市小区(metro cell)、微小区(micro cell)、微微小区(pico cell)、毫微微小区(femto cell)等，这些小小区具有覆盖范围小、发射功率低的特点，适用于提供高速率的数据传输服务。
图1是应用于本申请实施例的网络架构100的一例示意图，如图1所示，虚线右侧表示本地共用陆地网络(home public land mobile network，HPLMN)，虚线左侧表示拜访公用陆地移动网(visited public land mobile network，VPLMN)。下面对该网络架构中可能涉及的部分网元分别进行说明。
(无线)接入网络(radio access network，(R)AN)网元120：包含RAN设备和AN设备，主要用于为特定区域的授权终端设备提供入网功能，并能够根据终端设备的级别，业务的需求等使用不同质量的传输隧道。RAN设备主要是3GPP网络无线网络设备，AN可以是non-3GPP定义的接入网设备。
用户面网元130：主要提供用户平面的业务处理功能，用于终端设备中用户数据的转发和接收，即数据包分组路由和转发，锚定功能、服务质量QoS映射和执行、上行链路的标识识别并路由到数据网络、下行包缓存和下行链路数据到达的通知触发、与外部数据网络连接等，可以从数据网络接收用户数据，通过接入网设备传输给终端设备，还可以通过接入网设备从终端设备接收用户数据，转发到数据网络。
用户面功能(user plane function，UPF)网元中为终端设备提供服务的传输资源和调度功能可以由会话管理功能(session management function，SMF)网元管理控制。在5G通信系统中，该用户面网元可以是用户面功能UPF网元。在未来通信系统中，用户面网元仍可以是UPF网元，或者，还可以有其它的名称，本申请不做限定。
网络存储网元180：用于维护网络中所有网络功能服务的实时信息，负责网元的控制，以及执行网络功能(network function，NF)网元的注册，发现和授权功能。
在5G通信系统中，该网络存储网元可以是网络存储功能(network repository function，NRF)网元。在未来通信系统中，网络存储网元仍可以是NRF网元，或者，还可以有其它的名称，本申请不做限定。
在本申请中，功能网元可以分为服务消费功能网元(NF service consumer，NFc)和服务提供功能网元(NF service producer，NFp)。NFc是业务消费者NF，NFp是业务提供者NF。NFc从NFp获得NFp提供的服务。在其他场景中，该功能网元也可以为终端、基 站、网元、控制器或服务器等实体，本申请不做限定。为描述方便，后续以NF为例进行描述。
需要说明的是，上述“网元”也可以称为实体、设备、装置或模块等，本申请并未特别限定。并且，在本申请中，为了便于理解和说明，在对部分描述中省略“网元”这一描述，例如，将SMF网元简称SMF，此情况下，该“SMF”应理解为SMF网元或SMF实体，以下，省略对相同或相似情况的说明。
可以理解的是，上述网元或者功能既可以是硬件设备中的网络元件，也可以是在专用硬件上运行软件功能，或者是平台(例如，云平台)上实例化的虚拟化功能。
应理解，以上列举的通信系统包括的网元仅仅为示例性说明，本申请并未限定于此，例如，还可以包括但不限于：
网络切片选择功能网元：用于为用户设备选择一组网络切片实例、确定允许的网络切片选择辅助信息(network slice selection assistance information，NSSAI)和确定可以服务用户设备的AMF集，可以是切片选择功能网元(network slice selection function，NSSF)；
绑定支持功能网元：用于查找会话所关联的策略控制功能网元PCF；
安全边缘保护代理(security edge protection proxy，SEPP)网元：两个运营商之间漫游的安全功能网元，分为cSEPP和pSEPP。其中，消费安全边缘保护代理(consumer of SEPP，cSEPP)网元为NFc侧对应的SEPP，服务安全边缘保护代理(producer of SEPP，pSEPP)网元为NFp侧对应的SEPP。主要执行漫游数据的封装，保护，校验等操作。
网络数据分析功能(network data analytics funtion，NWDA)网元：用于收集与存储来自于终端设备，RAN网元，以及其他网络实体(例如，AMF网元)的信息，并对这些信息进行分析，以及生成关于用户的上下文信息(可以认为是应用层的信息)，并对此应用层的信息进行分发等。
在图1所示的网络架构中，N2接口为RAN网元20和AMF网元160的参考点，用于非接入层(non-access stratum，NAS)消息的发送等；N3接口为RAN网元120和UPF网元130之间的参考点，用于传输用户面的数据等；N4接口为SMF网元170和UPF网元130之间的参考点，用于传输例如N3连接的隧道标识信息，数据缓存指示信息，以及下行数据通知消息等信息；N6接口为UPF网元130和DN网元140之间的参考点，用于传输用户面的数据；N9接口为UPF网元130和另一个UPF网元之间的参考点；N32接口为v-安全边缘保护代理(v-security edge protection proxy，vSEPP)网元和h-安全边缘保护代理(h-security edge protection proxy，hSEPP)网元之间的参考点，用于vSEPP和hSEPP通信等。
需要说明的是，基于服务化架构(service based architecture，SBA)的范围限于核心网的控制面网元，不包括用户面功能UPF网元。而且，UPF支持的接口N3，N9，N6，N4都不是服务化接口。从上述架构图中可见，与UPF可以连接的网元设备有SMF，RAN，DN和另一个UPF。
应理解，上述应用于本申请实施例的网络架构仅是举例说明的从服务化架构的角度描述的网络架构，适用本申请实施例的网络架构并不局限于此，任何能够实现上述各个网元的功能的网络架构都适用于本申请实施例。
例如，在某些网络架构中，AMF、SMF、PCF、GMF以及UDM等网络功能实体都称 为网络功能NF网元；或者，在另一些网络架构中，AMF、SMF、PCF、GMF及UDM等网元的集合都可以称为控制面功能(control plane function，CPF)网元。
为方便说明，本申请以装置NF、NRF、SEPP为例，对用于建立会话的方法进行说明。本申请后续所描述的NF均可替换为网络功能网元网，NRF均可替换为网络存储网元、SEPP均可替换为漫游安全网元。对于装置为NF体内的芯片、NRF内的芯片或为SEPP实体内的芯片的实现方法，可参考装置分别为NF实体、NRF实体、SEPP实体的具体说明，不再重复介绍。本申请对NF适用的网元不做限制，例如RAN，UPF，AMF等所有功能网元设备都适用。
本申请实施例并未对本申请实施例提供的方法的执行主体的具体结构特别限定，只要能够通过运行记录有本申请实施例的提供的方法的代码的程序，以根据本申请实施例提供的方法进行通信即可。例如，本申请实施例提供的方法的执行主体可以是网络设备，或者是网络设备中能够调用程序并执行程序的功能模块；或者是可用于网络设备的部件(例如芯片或者电路)。
另外，本申请的各个方面或特征可以实现成方法、装置或使用标准编程和/或工程技术的制品。本申请中使用的术语“制品”涵盖可从任何计算机可读器件、载体或介质访问的计算机程序。例如，计算机可读介质可以包括，但不限于：磁存储器件(例如，硬盘、软盘或磁带等)，光盘(例如，压缩盘(compact disc，CD)、数字通用盘(digital versatile disc，DVD)等)，智能卡和闪存器件(例如，可擦写可编程只读存储器(erasable programmable read-only memory，EPROM)、卡、棒或钥匙驱动器等)。另外，本文描述的各种存储介质可代表用于存储信息的一个或多个设备和/或其它机器可读介质。术语“机器可读介质”可包括但不限于，无线信道和能够存储、包含和/或承载指令和/或数据的各种其它介质。
当前5G网络中，服务化架构借鉴IT系统服务化/微服务化架构的成功经验，通过模块化实现网络功能间的解耦和整合，每个5G的功能网元都是一个独立的功能。控制面所有NF之间的交互采用服务化接口，同一种服务可以被多种NF调用。针对服务化架构，标准定义了两种NF之间相互访问的授权方式，一种为静态授权方式，一种为Oauth授权方式。
具体地，静态授权方式(static)是一种基于本地授权策略的机制。例如，AMF访问SMF场景，SMF根据AMF发送的业务请求内的参数和本地策略，判断是否允许AMF访问自己的服务。若根据本地授权策略判断允许AMF访问自己的服务，则为AMF提供服务。这里本地策略可以为是否允许AMF类型网络访问自己的服务，本申请对本地策略的举例不做限定。
Oauth授权方式是指，一种基于令牌等授权参数的开放授权机制，其包括授权中心，业务的使用者，业务的提供者或者资源的拥有者等实体。授权中心会授权是否允许业务使用者使用业务提供者的服务。如果允许的话，则为业务使用者分发令牌。业务使用者发送令牌至业务提供者，当令牌校验成功后，业务提供者则为业务使用者提供服务。在5G网络则定义一个NRF网元，其负责服务授权的判断。例如，服务消费功能网元(NF service consumer，NFc)在访问服务提供功能网元(NF service producer，NFp)之前，会先向NRF发送请求消息，NRF判断允许NFc访问NFp之后，会生成一个授权令牌token，并向NFc发送token。然后，NFc在访问NFp服务时，发送服务请求，其中携带token。NFp在校验 token成功后，会为NFc提供对应的服务。图2示出了实用本申请的NFc获取token的方法200，如图2所示，具体实现步骤包括：
S210，可选地，服务消费功能网元NFc(用NF1描述)在网络存储功能网元NRF完成注册；
S220，该NFc向NRF(用NF2描述)发送请求消息；对应的，NRF接收来自NFc的请求消息。
其中，该请求消息用于请求获取循序访问NFp的授权令牌token。该请求消息包括：NF1实例ID(例如，NF Instance Id(s)of the NF service consumer)、NF2的NF类型、NF1期望的业务(例如，expected NF service name(s))、以及该NFc期望的NFp的NF类型。
S230，NRF根据本地策略，确定是否授权NF1获取token的请求。
示例性的，NRF计算token，并基于数字签名或者消息验证码的方式完整性保护该token。其中，token包括声明(claim)，该claim包括：NRF的NF实例ID，NF1实例ID，NF2的NF类型，期望的业务名称和有效期等。
S240，NRF向NFc发送授权响应消息；对应的，NFc接收来自NRF的授权响应消息。
其中，该响应消息用于指示同意授权该NFc访问NFp，该响应消息包括授权令牌token。
应理解，基于该授权令牌token，NFc可以向NFp请求访问服务，发送服务请求。相应的，NFp在成功校验token后为NFc提供服务。
应理解，以上列举的获取授权令牌token的过程仅为示例性说明，本申请并未限定于此，其他能够实现获取授权令牌的方法及过程均落入本申请的保护范围内。
需要说明的是，当Oauth授权方式没有被采纳的时候，两个网元之间就使用静态授权方式进行交互。特别是在漫游场景下，若NFc和NFp属于不同的运营商，由于授权机制的不同，也会使得NFp拒绝NFc的业务请求，从而发生业务的中断。例如NFc支持静态授权，而NFp支持Oauth授权，那么就会出现授权冲突问题。
图3示出了NFc和NFp基于不同授权方式进行协商的4种场景，如图3所示，场景1中NFc和NFp均只支持静态授权方式(static)，二者可以直接通过静态授权方式进行访问与服务；场景2中NFc仅支持静态授权方式(static)，NFp同时支持静态授权方式(static)和Oauth授权方式，当NFc向NFp提出访问请求时，NFp可以基于静态授权方式为NFc提供相应的服务；场景3中NFc同时支持静态授权方式(static)和Oauth授权方式，NFp仅支持静态授权方式(static)，那么二者之间只能基于静态授权方式(static)进行访问与服务，NFc需要进一步确定是否采用Oauth授权方式，如果该NFc直接发起token授权请求，NFp会拒绝NFc对应的访问请求；场景4中NFc和NFp均同时支持静态授权方式(static)和Oauth授权方式，但是NFc需要进一步确定是否采用Oauth授权方式，如果该NFc直接使用静态授权方式(static)发起访问请求，那么作为更强授权控制能力的token或者Oauth授权方式将可能永远不会被采纳。因此，上述场景3和场景4中都存在NFc和NFp授权机制不一致的问题，容易发生NF间的授权冲突。另外，若NFp仅支持Oauth授权方式，而NFc支持静态授权和Oauth授权方式，当NFc直接发起静态授权，也将会被NFp拒绝。NFc和NFp之间发生冲突的场景较多，此处就不再赘述。
另外，图4示出了适用于本申请的NFc发现流程400的一例示意图，如图4所示，具体实现步骤包括：
S410，服务消费功能网元NFc向网络存储功能NRF网元发送发现服务请求消息；对应的，NRF接收来自NFc的发现服务请求消息。
其中，该服务请求可以为Nnrf_NFDiscovery_Request。该发现请求消息用来请求获得能够为NFc提供服务的NFp的信息。
示例性的，NFc可以向NRF发送与SMF相关的发现请求消息，用于NFc向SMF访问业务。
S420，NRF授权同意该发现服务请求消息。
可选地，NRF根据本地网络策略确定同意授权NFc向SMF访问业务。
S430，NRF向NFc发送发现请求响应消息；对应的，NFc接收来自NRF的发现请求响应消息。
需要说明的是，当前协议定义，在NF发现流程中，NRF会将NFp(例如，SMF)的Nfprofile中的信息发送给NFc。可选地，如果该NFprofile的NF service中包括oauth2required，那么接入NF produce的NFc需要执行Oauth机制。而如果NFc仅支持static，则出现业务中断。因此标准的定义在具体实现中也存在不合理，容易出现漫游时，或者不同域间NF不能互通的问题，例如域1内NFp要求Oauth机制，域2内NFc仅支持static授权。这里域可以为SCP域，NRF域，NF set域，安全域等不同的概念。综上所述，两个NF之间如何进行授权方式的协商是亟待解决的问题，即两个NF之间的业务访问与服务是使用Oauth授权方式还是静态授权方式。另外，当前协议也存在不合理，容易出现漫游时或者域间NF不能互通的问题。基于此，本申请提供了一种通信方法，根据是否考虑Oauth2required指示信息入手，利用NRF或SEPP配置对端授权方式，进而确定最终授权方式，使得NFc确定采用静态授权方式或Oauth授权方式进行访问。该方法能够解决网元(例如，NFc和NFp)之间授权机制不一致的问题，避免NF间授权冲突。
下面结合附图对本申请实施例中通信方法进行详细说明。
图5是适用本申请实施例的授权机制协商方法的一例示意图，具体实现步骤500包括：
S510，网络存储功能NRF网元或安全边缘保护代理SEPP网元确定第一授权方式和第二授权方式。
其中，第一授权方式是服务消费功能网元所属网络对应的授权方式，第二授权方式是服务提供功能网元所属网络对应的授权方式。
根据本申请提供的方案，通过确定第一授权方式和第二授权方式，根据第一授权方式和第二授权方式确定第三授权方式，并向服务消费功能网元发送该第三授权方式。采用协商的方式进行确定访问服务提供功能网元的授权方式，进而解决授权冲突的问题，保证不同网络功能网元之间的业务访问正常进行。
一种可能的实现方式，确定第二授权方式包括：NRF或SEPP接收来自NFc的第一请求消息，该第一请求消息包括该服务提供功能网元所属网络的标识信息；根据该服务提供功能网元所属网络的标识信息确定该第二授权方式。
可选地，NFc向服务通信代理(service communication proxy，SCP)网元发送第一请求消息。
应理解，当前5G架构包括SCP网元。SCP是NF网元的代理，也可以理解SCP为一个SCP域的出入口，或者代理节点。因此不同域之间的协商，也可以通过SCP来完成， 例如NFc-SCP1-SCP2-NFp。所以上述通过SEPP直接协商的方式，也可以使用SCP的方式。对应的，可以将SCP替换为上述SEPP，PLMN ID替换为SCP域标识。
示例性的，确定第二授权方式可以是网络存储功能NRF网元或安全边缘保护代理SEPP网元配置该第二授权方式。通过配置对端授权方式，例如服务提供功能(NF service producer，NFp)网元所属网络公共陆地移动网标识(public land mobile network identity，PLMN ID2)对应的授权方式，使得NRF或SEPP在接收到NFc请求访问对端NFp网元的授权方式时，本端NRF或SEPP可以直接根据NFc网元所属网络PLMN ID1对应的授权方式和对端NFp所属网络PLMN ID2对应的授权方式确定最终访问NFp的授权方式，减少NFc和NFp之间授权冲突。
应理解，本申请实施例中，第一请求消息包括发现请求消息和/或授权请求消息。
另一种可能的实现方式，确定第一授权方式包括：获取该服务消费功能网元所属网络的标识信息；根据该服务消费功能网元所属网络的标识信息确定该第一授权方式。
进一步地，获取服务消费功能网元所属网络的标识信息，包括：接收服务消费功能网元所属网络的标识信息，或者根据第一网络存储功能网元和第一安全边缘保护代理网元之间的连接确定所述服务消费功能网元所属网络的标识信息。
示例性的，从服务消费功能网元NFc接收服务消费功能网元所属网络的标识信息。
S520，NRF或SEPP根据第一授权方式和第二授权方式确定第三授权方式。
其中，第三授权方式是访问服务提供功能网元的授权方式。
需要说明的是，本申请实施例中，第一授权方式和第二授权方式包括静态授权方式(static)和/或开放授权方式(Oauth)。对应地，该第三授权方式是静态授权方式和/或开放授权方式。这里静态授权方式(static)是基于本地授权策略的机制，开放授权方式(Oauth)是需要网络存储功能NRF网元进行服务授权的判断，该网络存储功能网元与该服务消费功能网元对应。
示例性的，静态授权方式(static)是一种基于本地授权策略的机制。Oauth授权方式是指，一种基于令牌等授权参数的开放授权机制，其包括授权中心，业务的使用者，业务的提供者或者资源的拥有者等实体。授权中心会授权是否允许业务使用者使用业务提供者的服务。如果允许的话，则为业务使用者分发令牌。业务使用者发送令牌至业务提供者，当令牌校验成功后，业务提供者则为业务使用者提供服务。在5G网络则定义一个NRF网元，其负责服务授权的判断。
示例性的，该第三授权方式为开放授权方式，该方法还包括：接收第二请求消息，该第二请求消息用于请求获取第一令牌，该第一令牌用于授权该服务消费功能网元访问该第一服务；确定该第一令牌；发送该第一令牌。
示例性的，NRF网元负责服务授权的判断，例如服务消费功能NFc网元在访问服务提供功能NFp网元之前，会先向NRF发送请求消息，NRF判断允许NFc访问NFp之后，会生成一个授权令牌token，并发送token给NFc。使得NFc在访问NFp服务携带token。待NFp在校验token成功后，会为NFc提供对应的服务。
示例性的，第一请求信息和第二请求消息均还包括以下信息中的一个或多个：服务消费功能网元所属网络的标识信息、服务提供功能网元的业务类型、服务消费功能网元的业务类型。
示例性的，根据该第一授权方式和该第二授权方式确定第三授权方式，包括：根据该第一授权方式和该第二授权方式的共有授权方式确定该第三授权方式；当该共有授权方式为该静态授权方式或该开放授权方式，确定该静态授权方式或该开放授权方式为该第三授权方式；当该共有授权方式为该静态授权方式和该开放授权方式，根据本地策略确定该第三授权方式，或者确定该开放授权方式为该第三授权方式。
通过选取第一授权方式和第二授权方式的交集进一步确定最终NFc访问NFp服务使用的授权方式，避免由于授权冲突的问题，导致发生业务的中断。
示例性的，当第一授权方式和第二授权方式的共有授权方式同时支持静态授权方式和开放授权方式时，可以确定开放授权方式为最终NFc访问NFp服务所使用的授权方式；也可以根据本地策略进一步确定该第三授权方式，例如，根据NFc网元的能力，或者NFc所在网络的授权策略的机制等，本申请对此不作限定。
一种可能的实现方式，NRF或SEPP根据NFp所属网络(例如，PLMN ID2)直接确定第三授权，无需根据第一授权方式和第二授权方式的共有方式，进一步确定访问NFp服务的授权方式，并向NFc发送该第三授权方式。
S530，NRF或SEPP向服务消费功能NFc网元发送第三授权方式；对应的，NFc接收来自NRF或SEPP的第三授权方式。
作为示例而非限定，NRF或SEPP向对端网络存储功能网元NRF2或安全边缘保护代理网元SEPP2发送通知消息，该通知消息用于指示访问该NFc网元对应的授权方式，该通知消息包括该NFc网元所属网络PLMN ID1对应的授权方式。该实现方式为了方便后续NFp所在网络内NF网元请求访问NFc所在网络内NF网元时，NRF2网元或SEPP2网元可以直接将NFc网元对应的授权方式发送给NFp，避免协商流程，既能解决网元间授权冲突问题，还能够减少信令开销。
S540，NFc根据第三授权方式向服务提供功能网元请求第一服务。
一种可能的实现方式，根据该第三授权方式向该服务提供功能网元请求第一服务，包括：当第三授权方式为开放授权方式，向NRF发送第二请求消息，该第二请求消息用于请求获取第一令牌，该第一令牌用于授权该服务消费功能网元访问该第一服务；接收该第一令牌；向该服务提供功能网元发送用于请求该第一服务的消息，该用于请求该第一服务的消息中包括该第一令牌。
示例性的，NRF网元负责服务授权的判断，例如服务消费功能NFc网元在访问服务提供功能NFp网元之前，会先向NRF发送请求消息，NRF判断允许NFc访问NFp之后，会生成一个授权令牌token，并发送token给NFc。使得NFc在访问NFp服务携带token。待NFp在校验token成功后，会为NFc提供对应的服务。
另一种可能的实现方式，当第三授权方式为静态授权方式，NFc直接使用该静态授权方式向NFp请求服务。例如发送业务请求至NFp，NFp根据静态授权方式(例如本地策略)判断是否授权NFc使用其请求的服务。
图6是适用本申请实施例的授权机制协商方法的一例示意图，通过网络存储功能网元配置对端网络授权方式，并确定最终的授权方式，使得服务消费功能网元获得业务访问的授权方式。如图6所示，包括服务消费功能网元NFc、网络存储功能网元NRF#1和网络存储功能网元NRF#2，具体实现步骤600包括：
S610，网络存储功能网元(例如，NRF#1)配置对端(例如，PLMN ID2)对应的授权方式。
示例性的，NRF#1属于域1，NRF#2属于域2，域1和域2有不同的标识，可以为PLMN ID、SCP域标识、NRF域标识等。不同域之间的协商可以通过PLMN ID、SCP域、NRF域、NF set域、安全域等来完成。可选地，NRF#1属于运营商1，NRF#2属于运营商2。一般地，不同运营商的网络功能网元之间的授权方式不同，同一运营商中网络功能网元之间的授权机制相同。可选地，NRF#1和NRF#2可以属于同一个运营商，此时NRF#1对应的业务类型的授权方式与NRF#2对应的业务类型的授权方式不同。
需要说明的是，本申请中NRF#1和NRF#2均配置各自PLMN ID对应的授权方式。即NRF#1配置PLMN ID1对应的授权方式，NRF#2配置PLMN ID2对应的授权方式。
示例性的，NRF#1配置有对端PLMND ID2对应的的授权方式，或者NRF#1向其他网元(例如，控制网元和/或管理网元)发送请求消息，该请求消息包括对端PLMN ID2，用于请求该PLMN ID2对应的授权方式，其他网元根据PLMN ID2确定PLMN ID2对应的授权方式，并发送给NRF#1。
其中，具体的PLMN ID对应的授权方式包括：静态授权方式(static)，和/或Oauth授权方式。
一种可能的实现方式：
S620，服务消费功能网元(例如，NFc)向NRF#1发送发现请求消息；对应的，NRF#1接收来自NFc的发现请求消息。
其中，该发现请求消息包括PLMN ID2，该发现请求消息用于请求确定访问PLMN ID2对应网络的NFp的信息。
可选地，该发现请求消息还包括PLMN ID1、NFc对应的其他参数和期望访问的NFp对应的其他参数。
需要说明的是，PLMN ID1为NFc所在网络的标识信息，PLMN ID2为NFc希望进行业务访问的服务提供功能NFp网元对应网络的标识信息。示例性的，该NFp可以为会话管理功能SMF网元，或者策略控制功能PCF网元等。
S630，NRF#1向NRF#2发送该发现请求消息；对应的，NRF#2接收来自NRF#1的发现请求消息。
其中，该发现请求消息用于请求确定访问PLMN ID2对应网络的NFp的信息。
示例性地，该发现请求消息可以包括以下参数中的一个或多个：PLMN ID1、PLMN ID2、NFc对应的其他参数和期望访问的NFp对应的其他参数。
可选地，该发现请求消息可以不包括PLMN ID1、NFc对应的其他参数和期望访问的NFp对应的其他参数。在这种情况下，NRF#1在向NRF#2发送发现请求消息时，可以先经过SEPP#1转发至SEPP#2，再发送至NRF#2。此时，SEPP#2可以根据与SEPP#1之间协商的N32-f context中远端PLMN ID信息确定PLMN ID1，或者根据其与SEPP#1之间的连接确定PLMN ID1，并将PLMN ID1发送至NRF#2。
其中，上述步骤S620和S630中，NFc对应的其他参数和期望访问的NFp对应的其他参数可以为NFc和NFp的网络业务类型，发现请求消息的名称可以为已有的服务名称，例如Nnrf_NFDiscovery_Request，也可以为新定义的服务名称，本申请对此不作限定。
S640，NRF#2向NRF#1发送发现响应消息；对应的，NRF#1接收来自NRF#2的发现响应消息。
示例性地，该发现响应消息可以包括以下参数中的一个或多个：PLMN ID1、PLMN ID2、期望访问的NFp对应的其他参数。
需要说明的是，步骤S630和S640可以参考目前发现请求消息和发现响应消息的内容，本申请对此不做限制。
S650，NRF#1根据配置的对端PLMN ID2对应的授权方式，以及PLMN ID1对应的授权方式，确定最终的授权方式。
应理解，最终的授权方式既可以指示静态授权方式(static)或者Oauth授权方式，还可以同时指示静态授权方式(static)和Oauth授权方式。
示例性的，这里PLMN ID1可以是从步骤S620中NFc发送的发现请求消息中获取的，或者NRF#1自己所在网络的标识信息，即PLMN ID1。
特别地，NRF#1可以在步骤S640之后，根据PLMN ID1和PLMN ID2确定自己是否保存有或配置有该对应的最终授权方式，若有则跳过确定最终授权方式的步骤S650，即无需NRF#1与NRF#2之间进行授权机制的协商，继续下面步骤S660；否则，需要继续执行步骤S650进行最终授权方式的判定。
本申请实施例中，NRF#1中保存有的最终授权方式，可以是NRF#1根据PLMN ID1对应的授权方式和PLMN ID2对应的授权方式确定最终的授权方式，或者可以是一开始就保存在NRF#1内部。那么，NFc在访问PLMN ID2对应的NFp时，NRF#1中根据PLMN ID2可以直接确定和提供该最终授权方式给NFc，促进NFc和NFp之间业务的访问和服务。
需要说明的是，最终授权方式的确定采用取交集的方式，即根据PLMN ID1对应的授权方式和PLMN ID2对应的授权方式的交集确定最终的授权方式，具体包括：
(1)如果交集为支持静态授权方式(static)，NFc和NFp之间的业务访问使用static授权方式。
(2)如果交集为支持Oauth授权方式，NFc和NFp之间的业务访问使用Oauth授权方式。
(3)如果交集为同时支持Oauth授权方式和static授权方式，可以根据本地网络策略来决定NFc和NFp之间的业务访问是使用Oauth授权方式，还是static授权方式。可选地，如果两个交集都支持Oauth授权方式和static授权方式，可以直接选择Oauth授权方式进行NFc和NFp之间的业务访问。因为Oauth授权方式相对于static授权方式来说，授权的控制更好，安全性更高。
可选地，上述步骤S650可以在步骤S610之后的任一步执行，具体执行位置不作限定。例如，步骤S650可以在步骤S620之后执行，即NRF#1在收到NFc的发现请求消息后，就可以根据PLMN ID1对应的授权方式和PLMN ID2对应的授权方式确定最终的授权方式。又或者，步骤S650可以在步骤S620之前执行，即NRF#1可以提前告知NFc进行业务访问NFp时，采用的最终授权方式，该实现方式可以进一步减少NFc的信令开销。
S660，NRF#1向NFc发送发现响应消息；对应的，NFc接收来自NRF#1的发现响应消息。
其中，该发现响应消息包括最终的授权方式。最终的授权方式可以携带在发现响应消息的有效载荷(payload)或头(header)中，例如http header中。
示例性的，发现响应消息中已有header可以有1个或多个，可以在已有的一个或多个header中新增指示信息，用于指示最终的授权的方式；或者在发现响应消息中新增一个header，用于携带最终的授权方式信息。
需要说明的是，该最终授权方式可以为静态授权方式或Oauth授权方式，对应的，NFc可以根据静态授权方式或Oauth授权方式向NFp请求业务访问；可选地，该最终授权还可以同时支持静态授权方式和Oauth授权方式，此时NFc需要本地策略进一步确定使用哪种授权方式向NFp请求业务访问。即NFc在接收到静态和Oauth两种授权方式时，自己决定使用哪种授权方式。
可选地，该发现响应消息可以包括以下参数：期望访问的NFp对应的其他参数。
其中，上述步骤S640和S660中，期望访问的NFp对应的其他参数可以为NFp的NFprofile等信息，该发现响应消息的名称可以为新的服务名称，或者已有的服务名称，例如Nnrf_NFDiscovery_Response，本申请对此不作限定。
作为示例而非限定，通过NRF#2确定最终授权方式。示例性的，NRF#2配置对端PLMN ID1对应的授权方式，此时NRF#2从NRF#1接收发现请求消息，该请求消息包括PLMN ID1。然后，NRF#2根据PLMN ID1对应的授权方式和PLMN ID2对应的授权方式，确定最终的授权方式，并将最终的授权方式通过NRF#1发送给NFc。其中，具体的实现步骤与上述方法600中步骤S620至步骤S660类似。为了简洁，此处不再赘述。
另一种可能的实现方式：
S670，NFc向NRF#1发送授权请求消息；对应的，NRF#1接收来自NFc的授权请求消息。
其中，该授权请求消息包括PLMN ID2，该授权请求消息用于请求确定访问PLMN ID2对应网络的授权方式。
可选地，该授权请求消息还包括PLMN ID1、NFc对应的其他参数和期望访问的NFp对应的其他参数。
需要说明的是，PLMN ID1为NFc所在网络的标识信息，PLMN ID2为NFc希望进行业务访问的服务提供功能NFp网元对应网络的标识信息。示例性的，该NFp可以为会话管理功能SMF网元，或者策略控制功能PCF网元等。
其中，NFc对应的其他参数和期望访问的NFp对应的其他参数可以为NFc和NFp的网络业务类型，授权请求消息的名称可以为新的服务名称，例如Nnrf_Authorization_Request，本申请对此不作限定；或者可以为已有的服务名称，那么需要新增指示信息，用于指示请求确定访问PLMN ID2对应网络的授权方式。可选地，该指示信息包括PLMN ID1。
S680，NRF#1根据配置的对端PLMN ID2对应的授权方式，以及PLMN ID1对应的授权方式，确定最终的授权方式。
应理解，最终的授权方式既可以指示静态授权方式(static)或者Oauth授权方式，还可以同时指示静态授权方式(static)和Oauth授权方式。
示例性的，这里PLMN ID1可以是从步骤S670中NFc发送的授权请求消息中获取的， 或者NRF#1自己所在网络的标识信息，即PLMN ID1。
特别地，NRF#1可以在步骤S670之后，根据PLMN ID1和PLMN ID2确定自己是否保存有该对应的最终授权方式，若有则跳过确定最终授权方式的步骤S680，继续下面步骤S690；否则，需要继续执行步骤S680进行最终授权方式的判定。
本申请实施例中，NRF#1中保存有的最终授权方式，可以是NRF#1根据PLMN ID1对应的授权方式和PLMN ID2对应的授权方式确定最终的授权方式，或者可以是一开始就保存在NRF#1内部。那么，NFc在访问PLMN ID2对应的NFp时，NRF#1中根据PLMN ID2可以直接确定和提供该最终授权方式给NFc，促进NFc和NFp之间业务的访问和服务。
示例性的，最终授权方式的确定采用取交集的方式，即根据PLMN ID1对应的授权方式和PLMN ID2对应的授权方式的交集确定最终的授权方式，具体实现与步骤S650中一致。为了简洁，此处不再赘述。
S690，NRF#1向NFc发送授权响应消息；对应的，NFc接收来自NRF#1授权响应消息。
其中，该授权响应消息包括最终的授权方式。最终的授权方式可以携带在发现响应消息的有效载荷(payload)或头(header)中，例如http header中。
示例性的，授权响应消息中已有header可以有1个或多个，可以在已有的一个或多个header中新增指示信息，用于指示最终的授权的方式；或者在发现响应消息中新增一个header，用于携带最终的授权方式信息。
需要说明的是，该最终授权方式可以为静态授权方式或Oauth授权方式，对应的，NFc可以根据静态授权方式或Oauth授权方式向NFp请求业务访问；可选地，该最终授权还可以同时支持静态授权方式和Oauth授权方式，此时NFc需要本地策略进一步确定使用哪种授权方式向NFp请求业务访问。即NFc在接收到静态和Oauth两种授权方式时，自己决定使用哪种授权方式。
可选地，该授权响应消息可以包括以下参数：NFp对应的其他参数。
其中，授权响应消息的名称可以为新的服务名称，例如Nnrf_Authorization_Response，本申请对此不作限定。
S691，基于上述两种可能的实现方式，NFc根据最终的授权方式确定是否发起获取授权令牌token的流程。
示例性的，当最终的授权方式为static时，NFc采用静态授权方式直接向NFp发送业务请求；当最终的授权方式为Oauth时，NFc需要先向NRF发起请求获取授权令牌token的流程，再携带token向NFp发送业务请求，NFp在校验token成功后，为NFc提供相应的业务服务。其中，获取token的具体实现步骤在方法200中已经阐述，为了简洁，这里不再赘述。
作为示例而非限定，通过NRF#2确定最终授权方式。示例性的，NRF#2配置对端PLMN ID1对应的授权方式，此时NRF#2从NRF#1接收授权请求消息，该请求消息包括PLMN ID1。然后，NRF#2根据PLMN ID1对应的授权方式和PLMN ID2对应的授权方式，确定最终的授权方式，并将最终的授权方式通过NRF#1发送给NFc。其中，具体的实现步骤与上述方法600中步骤S670至步骤S690类似。为了简洁，此处不再赘述。
图7是适用本申请实施例的授权机制协商方法的一例示意图，通过安全边缘保护代理网元配置对端网络授权方式，并确定最终的授权方式，使得服务消费功能网元获得业务访问的授权方式。该具体实现方式和上述方法600的区别在于，基于SEPP完成授权方式的配置和协商，避免了对于NRF的影响，将授权内容控制在漫游安全网元之间。如图7所示，包括服务消费功能网元NFc、网络存储功能网元NRF#A、网络存储功能网元NRF#B、安全边缘保护代理网元SEPP#A和安全边缘保护代理网元SEPP#B，具体实现步骤700包括：
S710，安全边缘保护代理网元(例如，SEPP#A)配置对端(例如，PLMN ID2)对应的授权方式。
示例性的，NRF#A属于域1，NRF#B属于域2，域1和域2有不同的标识，可以为PLMN ID、SCP域标识、NRF域标识等。不同域之间的协商可以通过PLMN ID、SCP域ID、NRF域ID、NF set域ID、安全域ID等来完成。可选地，NRF#A属于运营商1，NRF#B属于运营商2。一般地，不同运营商的网络功能网元之间的授权方式不同，同一运营商中网络功能网元之间的授权机制相同。可选地，NRF#A和NRF#B可以属于同一个运营商，此时NRF#A对应的业务类型的授权方式与NRF#B对应的业务类型的授权方式不同。
需要说明的是，本申请中NRF#A和NRF#B均配置各自PLMN ID对应的授权方式，SEPP#A和SEPP#B均配置各自PLMN ID对应的授权方式。即NRF#A和SEPP#A配置PLMN ID1对应的授权方式，NRF#B和SEPP#B配置PLMN ID2对应的授权方式。这里SEPP#A和SEPP#B是通过N32接口连接，NRF#A与NRF#B之间的信息交互需要先后通过SEPP#和SEPP#B传输。
示例性的，SEPP#A配置有对端PLMND ID2对应的的授权方式，或者SEPP#A向其他网元(例如，控制网元和/或管理网元)发送请求消息，该请求消息包括对端PLMN ID2，用于请求该PLMN ID2对应的授权方式，其他网元根据PLMN ID2确定PLMN ID2对应的授权方式，并发送给SEPP#A。
其中，具体的PLMN ID对应的授权方式包括：静态授权方式(static)，和/或Oauth授权方式。
一种可能的实现方式：
S720，服务消费功能网元(例如，NFc)向NRF#A发送发现请求消息；对应的，NRF#A接收来自NFc的发现请求消息。
S731-S733，NRF#A确定SEPP#A，并通过SEPP#A和SEPP#B向NRF#B发送发现请求消息；对应的，NRF#B接收来自NRF#A的发现请求消息。
其中，在上述步骤S720和步骤S731中，该发现请求消息包括PLMN ID2，该发现请求消息用于请求确定访问PLMN ID2对应网络的NFp的信息。
可选地，该发现请求消息还包括PLMN ID1、NFc对应的其他参数和期望访问的NFp对应的其他参数。
需要说明的是，PLMN ID1为NFc所在网络的标识信息，PLMN ID2为NFc希望进行业务访问的服务提供功能NFp网元对应网络的标识信息。示例性的，该NFp可以为会话管理功能SMF网元，或者策略控制功能PCF网元等。
可选地，步骤S732中该发现请求消息可以不包括PLMN ID1、PLMN ID2、NFc对应 的其他参数和期望访问的NFp对应的其他参数。
在这种情况下，NRF#A在向NRF#B发送发现请求消息时，示例性的，SEPP#B可以根据与SEPP#A之间协商的N32-f context中远端PLMN ID信息确定PLMN ID1，或者根据其与SEPP#A之间的连接确定PLMN ID1，并将PLMN ID1发送至NRF#B。
其中，步骤S733中该发现请求消息包括PLMN ID1，用于请求确定访问PLMN ID2对应网络的信息。可选地，该发现请求消息还包括PLMN ID2、NFc对应的其他参数和期望访问的NFp对应的其他参数。
其中，上述步骤S720至步骤S733中，NFp对应的其他参数和期望访问的NFp对应的其他参数可以为NFc和NFp的网络业务类型，发现响应消息的名称可以为已有的服务名称，例如Nnrf_NFDiscovery_Request，也可以为新定义的服务名称，本申请对此不作限定。
S741-S742，NRF#B通过SEPP#B向SEPP#A发送发现响应消息；对应的，SEPP#A接收来自NRF#B的发现响应消息。
示例性地，该发现响应消息可以包括以下参数：NFp对应的NFpofile等其他参数。
需要说明的是，步骤S732和S742可以参考目前发现请求消息和发现响应消息的内容，本申请对此不做限制。
应理解，上述步骤S732至步骤S742的发现流程的具体实现方式可以参照上述方法400，本申请对此不作限定。
S750，SEPP#A根据配置的对端PLMN ID2对应的授权方式，以及PLMN ID1对应的授权方式，确定最终的授权方式。
应理解，最终的授权方式既可以指示静态授权方式(static)或者Oauth授权方式，还可以同时指示静态授权方式(static)和Oauth授权方式。
示例性的，这里PLMN ID1可以是从步骤S731中NFc发送的发现请求消息中获取的，或者SEPP#A自己所在网络的标识信息，即PLMN ID1。
特别地，SEPP#A可以在步骤S742之后，根据PLMN ID1和PLMN ID2，或者PLMNID2确定自己是否保存有或配置有该对应的最终授权方式，若有则跳过确定最终授权方式的步骤S750，继续下面步骤S760；否则，需要继续执行步骤S750进行最终授权方式的判定。
本申请实施例中，SEPP#A中保存有的最终授权方式，可以是SEPP#A根据PLMN ID1对应的授权方式和PLMN ID2对应的授权方式确定最终的授权方式，或者可以是一开始就保存在SEPP#A内部。那么，NFc在访问PLMN ID2对应的NFp时，SEPP#A中根据PLMN ID2可以直接确定和提供该最终授权方式给NFc，促进NFc和NFp之间业务的访问和服务。
示例性的，最终授权方式的确定采用取交集的方式，即根据PLMN ID1对应的授权方式和PLMN ID2对应的授权方式的交集确定最终的授权方式，具体实现与步骤S650中一致。为了简洁，此处不再赘述。
需要说明的是，SEPP#A在确定最终的授权方式之前需要确定PLMN ID1和PLMN ID2。其中，PLMN ID2是从NRF#A接收的。PLMN ID1可以是从步骤S731中NFc发送的发现请求消息中获取的；或者SEPP#A自己所在网络的标识信息，即PLMN ID1；或者根据SEPP#A与NRF#A之间连接确定的NRF#A所在的网络标识，即PLMN ID1。例如，SEPP#A 根据从NRF#A接收的NRF#A的全限定域名(fully qualified domain name，FQDN)，和/或NRF#AD地址，和/或NRF#A证书内PLMN ID信息等确定的PLMN ID。
可选地，上述步骤S750可以在步骤S731之后的任一步执行，具体执行位置不作限定。例如，步骤S750可以在步骤S731之后执行，即SEPP#A在收到NRF#A的发现请求消息后，就可以根据PLMN ID1对应的授权方式和PLMN ID2对应的授权方式确定最终的授权方式。
S760-S770，SEPP#A通过NRF#A向NFc发送发现响应消息；对应的，NFc接收来自SEPP#A的发现响应消息。
其中，在上述步骤S760和步骤S770中，该发现响应消息包括最终的授权方式。最终的授权方式可以携带在发现响应消息的有效载荷(payload)或头(header)中，例如http header中。
示例性的，发现响应消息中已有header可以有1个或多个，可以在已有的一个或多个header中新增指示信息，用于指示最终的授权的方式；或者在发现响应消息中新增一个header，用于携带最终的授权方式信息。
需要说明的是，该最终授权方式可以为静态授权方式或Oauth授权方式，对应的，NFc可以根据静态授权方式或Oauth授权方式向NFp请求业务访问；可选地，该最终授权还可以同时支持静态授权方式和Oauth授权方式，此时NFc需要本地策略进一步确定使用哪种授权方式向NFp请求业务访问。即NFc在接收到静态和Oauth两种授权方式时，自己决定使用哪种授权方式。
可选地，该发现响应消息可以包括以下参数：期望访问的NFp对应的其他参数。
其中，在上述步骤S741、S742、S760和S770中，期望访问的NFp对应的其他参数可以为NFp的NFprofile等信息，该发现响应消息的名称可以为新的服务名称，例如Nnrf_NFDiscovery_Response，本申请对此不作限定。
作为示例而非限定，通过SEPP#B确定最终授权方式。示例性的，SEPP#B配置对端PLMN ID1对应的授权方式，此时SEPP#B从SEPP#A接收发现请求消息，该请求消息包括PLMN ID1，并接收来自NRF#B的发现响应消息。然后，SEPP#B根据PLMN ID1对应的授权方式和PLMN ID2对应的授权方式，确定最终的授权方式，并将最终的授权方式通过SEPP#A和NRF#A发送给NFc。其中，具体的实现步骤与上述方法700中步骤S720至步骤S770类似。为了简洁，此处不再赘述。
另一种可能的实现方式：
S780，NFc向SEPP#A发送授权请求消息；对应的，SEPP#A接收来自NFc的授权请求消息。
其中，该授权请求消息包括PLMN ID2，该授权请求消息用于请求确定访问PLMN ID2对应网络的授权方式。
可选地，该授权请求消息还包括PLMN ID1。
应理解，PLMN ID1为NFc所在网络的标识信息，PLMN ID2为NFc希望进行业务访问的服务提供功能NFp网元对应网络的标识信息。
其中，授权请求消息的名称可以为新的服务名称，例如Nnrf_Authorization_Request，本申请对此不作限定；或者可以为已有的服务名称，那么需要新增指示信息，用于指示请 求确定访问PLMN ID2对应网络的授权方式。可选地，该指示信息包括PLMN ID1。
作为示例而非限定，NFc访问SEPP#A，也可以通过其他网元进行访问。例如NRF，服务通信代理(service communication proxy，SCP)等，本申请对此不作限定。当前5G架构包括SCP网元，SCP是NF网元的代理，也可以理解SCP为一个SCP域的出入口，或者代理节点。因此不同域之间的协商，也可以通过SCP来完成。例如，NFc与NFp之间的业务访问可以先后经过SCP1和SCP2，即NFc-SCP1-SCP2-NFp。所以上述通过SEPP直接协商的方式，也使用SCP的方式。即可以将SCP替换为上述SEPP，PLMN ID替换为SCP域标识。
示例性的，SEPP#A的地址可以是NF发现流程中，NFc从NRF#A接收到的地址信息，或者NFc预先配置SEPP#A的地址信息，本申请对此不作限定。
S790，SEPP#A根据配置的对端PLMN ID2对应的授权方式，以及PLMN ID1对应的授权方式，确定最终的授权方式。
应理解，最终的授权方式既可以指示静态授权方式(static)或者Oauth授权方式，还可以同时指示静态授权方式(static)和Oauth授权方式。
示例性的，这里PLMN ID1可以是从步骤S780中NFc发送的授权请求消息中获取的，或者SEPP#A自己所在网络的标识信息，即PLMN ID1。
特别地，SEPP#A可以在步骤S780之后，根据PLMN ID1和PLMN ID2确定自己是否保存有该对应的最终授权方式，若有则跳过确定最终授权方式的步骤S790，继续下面步骤S791；否则，需要继续执行步骤S790进行最终授权方式的判定。
本申请实施例中，SEPP#A中保存有的最终授权方式，可以是SEPP#A根据PLMN ID1对应的授权方式和PLMN ID2对应的授权方式确定最终的授权方式，或者可以是一开始就保存在SEPP#A内部。那么，NFc在访问PLMN ID2对应的NFp时，SEPP#A中根据PLMN ID2可以直接确定和提供该最终授权方式给NFc，促进NFc和NFp之间业务的访问和服务。
示例性的，最终授权方式的确定采用取交集的方式，即根据PLMN ID1对应的授权方式和PLMN ID2对应的授权方式的交集确定最终的授权方式，具体实现与步骤S650中一致。为了简洁，此处不再赘述。
S791，SEPP#A向NFc发送授权响应消息；对应的，NFc接收来自SEPP#A授权响应消息。
其中，该授权响应消息包括最终的授权方式。最终的授权方式可以携带在授权响应消息的有效载荷(payload)或头(header)中，例如http header中。
示例性的，授权响应消息中已有header可以有1个或多个，可以在已有的一个或多个header中新增指示信息，用于指示最终的授权的方式；或者在授权响应消息中新增一个header，用于携带最终的授权方式信息。
需要说明的是，该最终授权方式可以为静态授权方式或Oauth授权方式，对应的，NFc可以根据静态授权方式或Oauth授权方式向NFp请求业务访问；可选地，该最终授权还可以同时支持静态授权方式和Oauth授权方式，此时NFc需要本地策略进一步确定使用哪种授权方式向NFp请求业务访问。即NFc在接收到静态和Oauth两种授权方式时，自己决定使用哪种授权方式。
其中，授权响应消息的名称可以为新的服务名称，例如Nnrf_Authorization_Response，本申请对此不作限定。
S792，基于上述两种可能的实现方式，NFc根据最终的授权方式确定是否发起获取授权令牌token的流程。具体实现方式参见上述步骤S691，为了简洁，此处不再赘述。
作为示例而非限定，通过SEPP#B确定最终授权方式。示例性的，SEPP#B配置对端PLMN ID1对应的授权方式，此时SEPP#B从SEPP#A接收授权请求消息，该请求消息包括PLMN ID1。然后，SEPP#B根据PLMN ID1对应的授权方式和PLMN ID2对应的授权方式，确定最终的授权方式，并将最终的授权方式通过SEPP#A发送给NFc。其中，具体的实现步骤与上述方法700中步骤S780至步骤S791类似。为了简洁，此处不再赘述。
图8是适用本申请实施例的授权机制协商方法的一例示意图，通过网络存储功能网元配置本端网络授权方式，并与对端网络存储功能网元协商确定最终的授权方式，使得服务消费功能网元获得业务访问的授权方式。该具体实现方式和上述方法600的区别在于，新增了网络存储功能网元之间交互协商的流程。支持动态的授权协商，若对端网络授权方式发生变化，协商方式可以获得最新的授权机制。而配置方式需要配置之后，才能获得最新的授权机制，因此时效性没有协商机制好。如图8所示，包括服务消费功能网元NFc、网络存储功能网元NRF#1和网络存储功能网元NRF#2，具体实现步骤800包括：
一种可能的实现方式：
S810，服务消费功能网元(例如，NFc)向NRF#1发送发现请求消息；对应的，NRF#1接收来自NFc的发现请求消息。
其中，该发现请求消息包括PLMN ID2，该发现请求消息用于请求确定访问PLMN ID2对应网络的授权方式。
可选地，该发现请求消息还包括PLMN ID1、NFc对应的其他参数和期望访问的NFp对应的其他参数。
需要说明的是，PLMN ID1为NFc所在网络的标识信息，PLMN ID2为NFc希望进行业务访问的服务提供功能NFp网元对应网络的标识信息。示例性的，该NFp可以为会话管理功能SMF网元，或者策略控制功能PCF网元等。
S820，NRF#1向NRF#2发送发现请求消息；对应的，NRF#2接收来自NRF#1的发现请求消息。
其中，该发现请求消息包括PLMN ID1对应的授权方式，用于请求确定访问PLMN ID2对应网络的授权方式。PLMN ID1对应的授权方式可以携带在发现请求消息的有效载荷(payload)或头(header)中，例如http header中。
示例性的，发现请求消息中已有header可以有1个或多个，可以在已有的一个或多个header中新增指示信息，用于指示最终的授权的方式；或者在发现请求消息中新增一个header，用于携带最终的授权方式信息。
可选地，该发现请求消息可以包括以下参数中的一个或多个：PLMN ID1、PLMN ID2、NFc对应的其他参数和期望访问的NFp对应的其他参数。
可选地，该发现请求消息可以不包括PLMN ID1、PLMN ID2、NFc对应的其他参数和期望访问的NFp对应的其他参数。在这种情况下，NRF#1在向NRF#2发送发现请求消息时，可以先经过SEPP#1转发至SEPP#2，再发送至NRF#2。此时，SEPP#2可以根据与 SEPP#1之间协商的N32-f context中远端PLMN ID信息确定PLMN ID1，或者根据其与SEPP#1之间的连接确定，并将PLMN ID1发送至NRF#2。
其中，上述步骤S810和S820中，PLMN ID1对应的其他参数和PLMN ID2对应的其他参数可以为NFc和NFp的网络业务类型，发现请求消息的名称可以为已有服务名称，例如Nnrf_NFDiscovery_Request，也可以为新定义的服务名称，本申请对此不作限定。可选地，该发现请求消息可以携带指示信息，用于指示获取访问NFp的最终授权方式，NRF#2根据此指示信息确定最终授权方式。
S830，NRF#2根据本端PLMN ID2对应的授权方式，以及接收的PLMN ID1对应的授权方式，确定最终的授权方式。
应理解，最终的授权方式既可以指示静态授权方式(static)或者Oauth授权方式，还可以同时指示静态授权方式(static)和Oauth授权方式。
示例性的，PLMN ID1可以是从步骤S820中NRF#1发送的发现请求消息中获取的。
需要说明的是，最终授权方式的确定采用取交集的方式，即根据PLMN ID1对应的授权方式和PLMN ID2对应的授权方式的交集确定最终的授权方式，具体实现与步骤S650中一致。为了简洁，此处不再赘述。
S840-S850，NRF#2通过NRF#1向NFc发送发现响应消息；对应的，NFc接收来自NRF#2的发现响应消息。
其中，该发现响应消息包括最终的授权方式。最终的授权方式可以携带在发现响应消息的有效载荷(payload)或头(header)中，例如http header中。
示例性的，发现响应消息中已有header可以有1个或多个，可以在已有的一个或多个header中新增指示信息，用于指示最终的授权的方式；或者在发现响应消息中新增一个header，用于携带最终的授权方式信息。
需要说明的是，该最终授权方式可以为静态授权方式或Oauth授权方式，对应的，NFc可以根据静态授权方式或Oauth授权方式向NFp请求业务访问；可选地，该最终授权还可以同时支持静态授权方式和Oauth授权方式，此时NFc需要本地策略进一步确定使用哪种授权方式向NFp请求业务访问。即NFc在接收到静态和Oauth两种授权方式时，自己决定使用哪种授权方式。
可选地，该发现响应消息可以包括以下参数中的一个或多个：PLMN ID1、PLMN ID2、期望访问的NFp对应的其他参数，例如NFprofile。发现响应消息的名称可以为已有的服务名称，例如Nnrf_NFDiscovery_Response，也可以为新定义的服务名称，本申请对此不作限定。
作为示例而非限定，通过NRF#1确定最终授权方式。示例性的，NRF#1向NRF#2发送发现请求消息，该请求消息用于请求PLMN ID2对应的授权方式，并从NRF#2接收PLMN ID2对应的授权方式。然后NRF#1根据PLMN ID1对应的授权方式和PLMN ID2对应的授权方式确定最终的授权方式，并将最终的授权方式发送给NFc。其中，具体的实现步骤与上述方法800中步骤S810至步骤S850类似。为了简洁，此处不再赘述。
另一种可能的实现方式：
S860，可选地，服务消费功能网元(例如，NFc)向NRF#1发送发现请求消息；对应的，NRF#1接收来自NFc的发现请求消息。其中，该发现请求消息包括PLMN ID2。
S870，NRF#1向NRF#2发送能力请求消息；对应的，NRF#2接收来自NRF#1的能力请求消息。
其中，该能力请求消息包括指示信息#1，用于指示NRF#2发送PLMN ID2对应网络的授权方式。
可选地，该能力请求消息可以包括以下参数：PLMN ID1。
其中，授权响应消息的名称可以为新的服务名称，例如Nnrf_Bootstrapping_Get_Request，本申请对此不作限定；或者可以为已有的服务名称，那么需要新增指示信息#2，用于指示请求确定访问PLMN ID2对应网络的授权方式。可选地，该指示信息#2包括PLMN ID1。
S880，NRF#2根据能力请求消息和指示信息#1确定PLMN ID2对应的授权方式；或者根据新的服务名称，确定PLMN ID2对应的授权方式。
S890，NRF#2向NRF#1发送能力响应消息；对应的，NRF#1接收来自NRF#2的能力响应消息。
其中，能力响应消息包括PLMN ID2对应的授权方式。能力响应消息的名称可以为已有的服务名称，例如Nnrf_Bootstrapping_Get_Response，本申请对此不作限定。
S891，NRF#1根据接收的PLMN ID2对应的授权方式，以及本地PLMN ID1对应的授权方式，确定最终的授权方式。
应理解，最终的授权方式既可以指示静态授权方式(static)或者Oauth授权方式，还可以同时指示静态授权方式(static)和Oauth授权方式。
示例性的，这里PLMN ID1可以是从步骤S860中NFc发送的发现请求消息中获取的，或者NRF#1自己所在网络的标识信息，即PLMN ID1。
本申请实施例中，NRF#1中保存有的最终授权方式，可以是NRF#1根据PLMN ID1对应的授权方式和PLMN ID2对应的授权方式确定最终的授权方式，或者可以是一开始就保存在NRF#1内部。那么，NFc在访问PLMN ID2对应的NFp时，NRF#1根据PLMN ID2可以直接确定和提供该最终授权方式给NFc，促进NFc和NFp之间业务的访问和服务。
示例性的，最终授权方式的确定采用取交集的方式，即根据PLMN ID1对应的授权方式和PLMN ID2对应的授权方式的交集确定最终的授权方式，具体实现与步骤S650中一致。为了简洁，此处不再赘述。
S892，可选地，NRF#1向NRF#2发送通知消息；对应的，NRF#2接收来自NRF#1的通知消息。
其中，该通知消息包括最终授权方式，用于后续PLMN ID2对应的网络功能NF网元向PLMN ID1对应的网络功能NF网元发送业务访问请求消息时，NRF#2网元可以根据上述最终授权方式执行对应的授权操作。
S893，NRF#1向NFc发送授权响应消息；对应的，NFc接收来自NRF#1授权响应消息。
其中，该授权响应消息包括最终的授权方式。最终的授权方式可以携带在发现响应消息的有效载荷(payload)或头(header)中，例如http header中。
示例性的，发现响应消息中已有header可以有1个或多个，可以在已有的一个或多个header中新增指示信息，用于指示最终的授权的方式；或者在发现响应消息中新增一个 header，用于携带最终的授权方式信息。
需要说明的是，该最终授权方式可以为静态授权方式或Oauth授权方式，对应的，NFc可以根据静态授权方式或Oauth授权方式向NFp请求业务访问；可选地，该最终授权还可以同时支持静态授权方式和Oauth授权方式，此时NFc需要本地策略进一步确定使用哪种授权方式向NFp请求业务访问。即NFc在接收到静态和Oauth两种授权方式时，自己决定使用哪种授权方式。
S894，基于上述两种可能的实现方式，NFc根据最终的授权方式确定是否发起获取授权令牌token的流程。具体实现方式参见上述步骤S691，为了简洁，此处不再赘述。
作为示例而非限定，通过NRF#2确定最终授权方式。示例性的，NRF#2从NRF#1接收请求消息，该请求消息包括PLMN ID1对应的授权方式。可选地，该请求消息包括PLMN ID2。然后，NRF#2根据PLMN ID1对应的授权方式和PLMN ID2对应的授权方式，确定最终的授权方式，并将最终的授权方式通过NRF#1发送给NFc。其中，具体的实现步骤与上述方法800中步骤S860至步骤S893类似。为了简洁，此处不再赘述。
图9是适用本申请实施例的授权机制协商方法的一例示意图，通过安全边缘保护代理网元配置本端网络授权方式，并与对端网络存储功能网元协商确定最终的授权方式，使得服务消费功能网元获得业务访问的授权方式。该具体实现方式和上述方法600的区别在于，新增了SEPP间交互协商的流程，避免了对于NRF的影响，将授权内容控制在漫游安全网元之间。支持动态的授权协商，若对端网络授权方式发生变化，协商方式可以获得最新的授权机制。而配置方式需要配置之后，才能获得最新的授权机制，因此时效性没有协商机制好。如图9所示，包括服务消费功能网元NFc、网络存储功能网元NRF#A、网络存储功能网元NRF#B、安全边缘保护代理网元SEPP#A和安全边缘保护代理网元SEPP#B，具体实现步骤900包括：
一种可能的实现方式：
S911，服务消费功能网元(例如，NFc)向NRF#A发送发现请求消息；对应的，NRF#A接收来自NFc的发现请求消息。
S912，NRF#A确定SEPP#A，并向SEPP#A发送发现请求消息；对应的，SEPP#A接收来自NRF#A的发现请求消息。
其中，在上述步骤S9110和步骤S912中，该发现请求消息包括PLMN ID2，该发现请求消息用于请求确定访问PLMN ID2对应网络的授权方式。
可选地，该发现请求消息还包括PLMN ID1、NFc对应的其他参数和期望访问的NFp对应的其他参数中的至少一项。
需要说明的是，PLMN ID1为NFc所在网络的标识信息，PLMN ID2为NFc希望进行业务访问的服务提供功能NFp网元对应网络的标识信息。示例性的，该NFp可以为会话管理功能SMF网元，或者策略控制功能PCF网元等。
S920，SEPP#A根据PLMN ID1确定PLMN ID1对应的授权方式。
其中，PLMN ID1可以是从步骤S912中接收的发现请求消息中获取的；或者SEPP#A自己所在网络的标识信息，即PLMN ID1；或者根据SEPP#A与NRF#A之间连接确定的NRF#A所在的网络标识，即PLMN ID1。例如，SEPP#A根据从NRF#A接收的NRF#A的FQDN，和/或NRF#A的地址，和/或NRF#A证书内PLMN ID信息等确定的PLMN ID。
S930-S940，SEPP#A通过SEPP#B向NRF#B发送发现请求消息；对应的，NRF#B接收来自SEPP#A的发现请求消息。
其中，步骤S930中该发现请求消息包括：PLMN ID1对应的授权方式。
可选地，该发现请求消息可以不包括PLMN ID1、PLMN ID2、NFc对应的其他参数和期望访问的NFp对应的其他参数。
在这种情况下，SEPP#A在向SEPP#B发送发现请求消息时，示例性的，SEPP#B可以根据与SEPP#A之间协商的N32-f context中远端PLMN ID信息确定PLMN ID1，或者根据其与SEPP#A之间的连接确定PLMN ID1，并将PLMN ID1发送至NRF#B。
其中，步骤S940中该发现请求消息包括PLMN ID1，用于请求确定访问PLMN ID2对应网络的授权方式。
需要说明的是，上述步骤S911、S912、S930和步骤S940中，PLMN ID1对应的其他参数和PLMN ID2对应的其他参数可以为NFc和NFp的网络业务类型，发现响应消息的名称可以为已有的服务名称，例如Nnrf_NFDiscovery_Request，也可以为新定义的服务名称，本申请对此不作限定。
可选地，该发现请求消息可以携带指示信息，用于指示获取访问NFp的最终授权方式，NRF#B根据此指示信息确定最终授权方式。
S950，NRF#B向SEPP#B发送发现响应消息；对应的，SEPP#B接收来自NRF#B的发现响应消息。
示例性地，该发现响应消息可以包括以下参数：期望访问的NFp对应的其他参数。
S960，SEPP#B根据PLMN ID2对应授权方式和PLMN ID1对应的授权方式，确定最终的授权方式。
应理解，最终的授权方式既可以指示静态授权方式(static)或者Oauth授权方式，还可以同时指示静态授权方式(static)和Oauth授权方式。
示例性的，这里PLMN ID1可以是从步骤S930中接收的发现请求消息中获取的，或者SEPP#A自己所在网络的标识信息，即PLMN ID1。
示例性的，最终授权方式的确定采用取交集的方式，即根据PLMN ID1对应的授权方式和PLMN ID2对应的授权方式的交集确定最终的授权方式，具体实现与步骤S650中一致。为了简洁，此处不再赘述。
S971-S973，SEPP#通过SEPP#A和NRF#A向NFc发送发现响应消息；对应的，NFc接收来自SEPP#B的发现响应消息。
其中，该发现响应消息包括最终的授权方式。最终的授权方式可以携带在发现响应消息的有效载荷(payload)或头(header)中，例如http header中。
示例性的，发现响应消息中已有header可以有1个或多个，可以在已有的一个或多个header中新增指示信息，用于指示最终的授权的方式；或者在发现响应消息中新增一个header，用于携带最终的授权方式信息。
需要说明的是，该最终授权方式可以为静态授权方式或Oauth授权方式，对应的，NFc可以根据静态授权方式或Oauth授权方式向NFp请求业务访问；可选地，该最终授权还可以同时支持静态授权方式和Oauth授权方式，此时NFc需要本地策略进一步确定使用哪种授权方式向NFp请求业务访问。即NFc在接收到静态和Oauth两种授权方式时，自己决 定使用哪种授权方式。
可选地，该发现响应消息可以包括以下参数：期望访问的NFp对应的其他参数。
其中，在上述步骤S741、S742、S760和S770中，PLMN ID1对应的其他参数和PLMN ID2对应的其他参数可以为NFc和NFp的网络业务类型，发现响应消息的名称可以为已有服务名称，例如Nnrf_NFDiscovery_Response，也可以为新定义的服务名称，本申请对此不作限定。
作为示例而非限定，通过NRF#B确定最终授权方式。示例性的，基于上述方法900的基础上，在步骤S930之后，SEPP#B将PLMN ID1对应的授权方式发送给NRF#B。然后，NRF#B根据PLMN ID1对应的授权方式和PLMN ID2对应的授权方式，确定最终的授权方式，并将最终的授权方式通过SEPP#B、SEPP#A和NRF#A发送给NFc。其中，具体的实现步骤与上述方法900中步骤S911至步骤S973类似。为了简洁，此处不再赘述。
另一种可能的实现方式：
S981-S982，可选地，服务消费功能网元(例如，NFc)通过NRF#A向SEPP#A发送发现请求消息；对应的，SEPP#A接收来自NFc的发现请求消息。
其中，该发现请求消息包括PLMN ID2，用于请求确定访问PLMN ID2对应网络的授权方式。
S983，SEPP#A向SEPP#B发送N32连接建立请求消息；对应的，SEPP#B接收来自SEPP#A的N32连接建立请求消息。
其中，该N32接口是用于SEPP#A和SEPP#B之间的通信。可选地，该N32连接建立请求消息包括指示信息#A，用于指示SEPP#B发送SEPP#B所在网络支持的授权方式。例如，PLMN ID2对应网络的授权方式，或者其他PLMN ID对应的授权方式。
应理解，如果执行上述步骤S981-S982，那么该SEPP#B需要确定并向SEPP#A发送PLMN ID2对应的授权方式。如果不执行上述步骤S981-S982，那么该SEPP#B可以确定多个为NFc提供服务的PLMN ID，以及对应的授权方式。因为SEPP#B可能支持多个PLMN ID，本申请对此不作限定。
可选地，该N32连接建立请求消息可以包括以下参数中的一个或多个：PLMN ID1、PLMN ID2。
其中，授权响应消息的名称可以为新的服务名称，例如N32 connection establishment Request(indicator)，本申请对此不作限定；或者可以为已有的服务名称，那么需要新增指示信息#B，用于指示请求确定访问SEPP2对应网络的授权方式。可选地，该指示信息#B包括PLMN ID1。
S990，SEPP#B根据连接建立请求消息和指示信息#A确定SEPP#B支持的网络对应的授权方式(可能支持多个PLMN ID，以及对应的授权方式)，或者PLMN ID2对应的授权方式，即SEPP#B确定SEPP#B支持的网络对应的授权方式，或者从SEPP#A接收到的PLMN ID2对应的授权方式。SEPP#B支持的网络PLMN ID及其对应的授权方式取决于是否执行上述步骤S981-S982。
可选地，SEPP#B根据新的服务名称，确定向SEPP#A发送SEPP#B支持的网络对应的授权方式，或者PLMN ID2对应的授权方式。
需要说明的是，这里PLMN ID2为接收的PLMN ID2，或者SEPP#B根据两个SEPP 之间协商的N32-f context中远端PLMN ID信息确定PLMN ID1，或者根据其与SEPP#A之间的连接来确定。
S991，SEPP#B向SEPP#A发送N32连接建立响应消息；对应的，SEPP#A接收来自SEPP#A的N32连接建立响应消息。
其中，该连接建立响应消息包括PLMN ID2对应的授权方式。
其中，该连接建立响应消息的名称可以为新的服务名称，例如N32connection establishment Response，本申请对此不作限定。
S992，SEPP#A根据接收的PLMN ID2对应的授权方式，以及本地PLMN ID1对应的授权方式，确定最终的授权方式。
应理解，最终的授权方式既可以指示静态授权方式(static)或者Oauth授权方式，还可以同时指示静态授权方式(static)和Oauth授权方式。
示例性的，这里PLMN ID1可以是从步骤S982中接收的发现请求消息中获取的，或者SEPP#A自己所在网络的标识信息，即PLMN ID1。
本申请实施例中，SEPP#A中保存有的最终授权方式，可以是SEPP#A根据PLMN ID1对应的授权方式和PLMN ID2对应的授权方式确定最终的授权方式，或者可以是一开始就保存在SEPP#A内部访问PLMN ID2，或者PLMN ID1访问PLMN ID2对应网络的最终授权方式。那么，NFc在访问PLMN ID2对应的NFp时，SEPP#A根据PLMN ID2可以直接确定和提供该最终授权方式给NFc，促进NFc和NFp之间业务的访问和服务。
示例性的，最终授权方式的确定采用取交集的方式，即根据PLMN ID1对应的授权方式和PLMN ID2对应的授权方式的交集确定最终的授权方式，具体实现与步骤S650中一致。为了简洁，此处不再赘述。
S993，可选地，SEPP#A向SEPP#B发送通知消息；对应的，SEPP#B接收来自SEPP#A的通知消息。
其中，该通知消息包括最终授权方式，用于后续PLMN ID2对应的网络功能NF网元向PLMN ID1对应的网络功能NF网元发送业务访问请求消息时，SEPP#B可以根据上述最终授权方式执行对应的授权操作。
S994-S995，SEPP#A通过NRF#A向NFc发送授权响应消息；对应的，NFc接收来自SEPP#A授权响应消息。
其中，该授权响应消息包括最终的授权方式。最终的授权方式可以携带在发现响应消息的有效载荷(payload)或头(header)中，例如http header中。
示例性的，授权响应消息中已有header可以有1个或多个，可以在已有的一个或多个header中新增指示信息，用于指示最终的授权的方式；或者在授权响应消息中新增一个header，用于携带最终的授权方式信息。
需要说明的是，该最终授权方式可以为静态授权方式或Oauth授权方式，对应的，NFc可以根据静态授权方式或Oauth授权方式向NFp请求业务访问；可选地，该最终授权还可以同时支持静态授权方式和Oauth授权方式，此时NFc需要本地策略进一步确定使用哪种授权方式向NFp请求业务访问。即NFc在接收到静态和Oauth两种授权方式时，自己决定使用哪种授权方式。
S996，基于上述两种可能的实现方式，NFc根据最终的授权方式确定是否发起获取授 权令牌token的流程。具体实现方式参见上述步骤S691，为了简洁，此处不再赘述。
作为示例而非限定，通过SEPP#B确定最终授权方式。示例性的，基于上述方法900中，在步骤S983之后，SEPP#A向SEPP#B发送PLMN ID1及其对应的PLMN ID1支持的授权方式。然后，SEPP#B根据接收到的PLMN ID1对应授权方式和PLMN ID2对应授权方式，确定最终授权方式。并将最终的授权方式通过SEPP#A和NRF#A发送给NFc。其中，具体的实现步骤与上述方法900中步骤S981至步骤S995类似。为了简洁，此处不再赘述。
特别地，上述提供的几种实现方式，NF发现流程中，NRF会将NFp的Nfprofile中的信息发送给NFc。其中，Nfprofile的NFservice消息中可能会携带Oauth2required指示信息，该指示信息表示NFc需要执行Oauth授权方式。上述图6中方法600至图9中方法900均不考虑该Oauth2required指示的方式，即忽略此指示信息。主要通过配置对端授权方式或者配置本端授权方式，完成服务消费功能网元和服务提供功能网元之间的授权机制的协商，进而保证不同NF之间的业务访问正常进行。
图10是适用本申请实施例的授权机制协商方法的一例示意图，考虑Oauth2required指示的方式，并对Oauth2required做扩展。当前Oauth2required指示信息需要Oauth的认证方式。减少了不必要的协商流程，完成授权策略的确定。如图10所示，包括服务消费功能网元NFc、网络存储功能网元NRF#1、网络存储功能网元NRF#2和服务提供功能网元NFp，具体实现步骤1000包括：
S1010，服务消费功能网元(例如，NFc)向NRF#1发送发现请求消息；对应的，NRF#1接收来自NFc的发现请求消息。
其中，该发现请求消息包括PLMN ID2，该发现请求消息用于请求确定访问PLMN ID2对应网络的授权方式。
可选地，该发现请求消息还包括PLMN ID1、NFc对应的其他参数和期望访问的NFp对应的其他参数。
需要说明的是，PLMN ID1为NFc所在网络的标识信息，PLMN ID2为NFc希望进行业务访问的服务提供功能NFp网元对应网络的标识信息。示例性的，该NFp可以为会话管理功能SMF网元，或者策略控制功能PCF网元等。
S1020，NRF#1向NRF#2转发该发现请求消息；对应的，NRF#2接收来自NRF#1的发现请求消息。
示例性地，该发现请求消息可以包括以下参数中的一个或多个：PLMN ID1、PLMN ID2、NFc对应的其他参数和期望访问的NFp对应的其他参数。
可选地，该发现请求消息可以不包括PLMN ID1、PLMN ID2、NFc对应的其他参数和期望访问的NFp对应的其他参数。在这种情况下，NRF#1在向NRF#2发送发现请求消息时，可以先经过SEPP#1转发至SEPP#2，再发送至NRF#2。此时，SEPP#2可以根据与SEPP#1之间协商的N32-f context中远端PLMN ID信息确定PLMN ID1，或者根据SEPP#1与SEPP#2之间的连接确定PLMN ID1，并将PLMN ID1发送至NRF#2。
其中，上述步骤S1010和S1020中，PLMN ID1对应的其他参数和PLMN ID2对应的其他参数可以为NFc和NFp的网络业务类型，发现请求消息的名称可以为已有的服务名称，例如Nnrf_NFDiscovery_Request，也可以为新定义的服务名称，本申请对此不作限定。
S1030，NRF#2根据发现请求消息确定NFp的NFprofile信息。
其中，NFprofile信息中包括Oauth2required。
S1040-S1050，NRF#2通过NRF#1向NFc发送发现响应消息；对应的，NFc接收来自NRF#2的发现响应消息。
其中，该发现响应消息包括指示信息#a，例如Oauth2required。该指示信息#a可以携带在发现响应消息的有效载荷(payload)或头(header)中，例如http header中。
示例性的，发现响应消息中已有header可以有1个或多个，可以在已有的一个或多个header中新增指示信息，用于指示最终的授权的方式；或者在发现响应消息中新增一个header，用于携带最终的授权方式信息。
可选地，该发现响应消息可以包括以下参数中的一个或多个：期望访问的NFp对应的其他参数。
其中，发现响应消息的名称可以为已有的服务名称，例如Nnrf_NFDiscovery_Response；也可以为新定义的服务名称，本申请对此不作限定。
S1060，NFc根据接收的Oauth2required指示信息，确定是否发起获取token的流程。
一种可能的实现方式：
将Oauth2required其扩充为3种值，Preferred，Required，Not needed。
NFc接收到Oauth2required之后，分为以下三种处理方式：
(1)若required，则执行Oauth授权；
(2)若Preferred，倾向于执行Oauth授权；
(3)若Not needed，则执行静态授权。
另一种可能的实现方式：
将Oauth2required其扩充为2种值，Preferred，Not needed。
NFc接收到Oauth2required之后，分为以下三种处理方式：
(1)NFc所在网络支持Oauth授权和静态授权方式
若Required，确定执行Oauth授权请求；
若Preferred，根据本地策略确定是否执行Oauth授权请求；
若Not needed，则执行静态授权方式。
(2)NFc所在网络仅支持静态授权
若Preferred或Not needed，则执行静态授权方式；
若Required，发生冲突，采用如下的处理方式。
(3)NFc所在网络仅支持Oauth授权
若Required，确定执行Oauth授权请求；
若Preferred，确定执行Oauth授权请求；
若Not needed，则执行静态授权方式。发生冲突，采用如下的处理方式。
综上所述，当NFc所在网络支持Oauth授权方式，若Oauth2required指示为required，则NFc执行Oauth授权请求，向NRF发送获取授权令牌token的流程；若Oauth2required指示Preferred，NFc根据本地策略确定是否执行Oauth授权请求；若Oauth2required指示Not needed，则执行静态授权方式。当NFc所在网络不支持Oauth授权方式，若Oauth2required指示为required，则NFc向NRF#1发送拒绝消息。可选地，这里拒绝消息 可以携带拒绝原因值，用于指示NFc不支持Oauth2required指示的授权方式。
作为示例而非限定，如果NRF#2或者NRF#1确定的最终授权方式与上述步骤S1030中确定的Nfprofile中Oauth2required指示发生冲突，那么以最终授权的方式结果为准；同时发送通知消息至NFp。
在本申请实施例中，上述方法500/600/700/800/900中，授权策略的确定均未考虑NFp的Nfprofile中携带的Oauth2required指示信息。如果考虑该Oauth2required指示信息的同时，NRF或SEPP确定的最终授权方式与Oauth2required指示的授权方式不一致，一般以网元间协商的最终授权方式为准。此时，NFc，或者NRF#1，或者NRF#2可以向NFp发送通知消息，即：
S1071-S1073，NFc通过NRF#1和NRF#2向NFp发送通知消息；对应的，NFp接收来自NFc的通知消息。
可选地，NFc向NRF#1发送拒绝消息，使得NRF#1确定Oauth2required中指示的授权方式NFc不支持。
可选地，NRF#1根据之前实施例确定最终授权方式与Oauth2required指示不一致，或根据接收到NFc发送的拒绝消息，发送不匹配的通知消息至NRF#2。
可选地，NRF#2根据之前实施例确定最终授权方式与Oauth2required指示不一致，或根据接收到NRF#1发送的拒绝消息。
其中，该通知消息包括NFc ID和PLMN ID1，NFc或者PLMN ID1对应授权方式的至少一项，以使NFp未来接收来自NFc ID和/或PLMN ID1对应网络NF的业务请求，执行基于NFc或者PLMN ID1对应授权方式的授权，例如静态授权；当NFp接收到NFc发送的服务请求service request，其中携带NFc ID和/或PLMN ID1，NFp根据此NFc ID和/或PLMN ID1确定采用基于NFc或者PLMN ID1对应授权方式的执行校验，则执行授权流程。例如，NFp的Oauth2required指示为需要Oauth授权，通过此通知消息使得NFp接收到NFc ID和/或PLMN ID1也会允许采用静态授权方式。
可选的，上述通知消息也可以不携带NFc或者PLMN ID1对应授权方式，此时NFp接收来自NFc ID和/或PLMN ID1对应网络NF的业务请求，执行与Oauth2required中指示授权方式相反的授权方式。例如若Oauth2required指示Oauth，则接受静态授权；若Oauth2required指示静态授权，则接受Oauth授权。
S1080，NFc向NFp发送服务请求消息；对应的，NFp接收来自NFc的服务请求消息。
其中，该服务请求消息包括NFc ID和/或PLMN ID1，以使NFp未来接收来自NFc ID对应的业务请求，执行静态授权；当NFp接收到NFc发送的service request，其中携带NFc ID和/或PLMN ID1。NFp根据此NFc ID和/或PLMN ID1确定采用静态授权的执行校验，则执行静态授权流程。
综上所述，在上述实施例中，首先NFc通过向NRF或SEPP发送请求消息，用于请求获得访问NFp最终的授权方式，该请求消息中包括NFc希望访问的NFp所在网络标识PLMN ID2。其中，NRF或SEPP配置对端的授权方式，即PLMN ID2的授权方式。NRF或SEPP根据本端PLMN ID1的授权方式和配置的PLMN ID2的授权方式确定的最终的授权方式，并发送给NFc。NFc基于最终的授权方式确定最终的授权执行方式。即如果最终授权方式为static就直接访问NFp；若授权方式为Oauth，则向NRF发起token请求，并 携带该token访问NFp。或者增加NFc和NFp之间的NRF协商或SEPP协商，确定最终的授权方式。又或者扩展Oauth2required，减少不必要的协商流程，完成授权策略的确定，使得服务消费功能网元NFc获得访问服务提供功能网元NFp的授权方式，进而解决授权冲突的问题，保证业务访问的正常进行。
在本申请实施例中，将最终授权方式、Oauth2required等参数携带在header中能够不影响payload的内容，可以更好地让接收者识别header中携带的信息。
在本申请实施例中，以上述PLMN ID作为漫游场景下域标识进行了描述。应理解，本申请同时也适用于其他域和域标识的非漫游场景，例如运营商内包括多个SCP域，SCP域标识；或者运营商内包括多个NRF域，NRF域标识，或者运营商内包括多个安全域，安全域标识，或者运营商内包括多个NF set域，NF set域标识，等等不做限制。上述流程可以将PLMNID替换为上述其他域标识。另外，本申请实施例中提到了NRF和SEPP两个实体，其他区分不同域管理的功能网元，也可以替换上述NRF或者SEPP网元进行授权机制的协商和确定。
需要说明的是，本申请对于服务消息的名称不做限制。
上文结合图5至图10，详细描述了本申请实施例提供的网元间授权机制协商的方法侧实施例，下面将结合图11至图16，详细描述本申请的网元间授权机制协商的装置侧实施例。应理解，方法实施例的描述与装置实施例的描述相互对应，因此，未详细描述的部分可以参见前面方法实施例。
根据前述方法，图11是适用于本申请实施例的通信装置10的示意图。可以理解的是，该通信装置10可以是网络设备(例如，NRF或SEPP)。如图11所示，该通信装置10包括：收发单元11和处理单元12。
一种可能的实现方式，该处理单元22用于确定第一授权方式和第二授权方式，第一授权方式是服务消费功能网元所属网络对应的授权方式，第二授权方式是服务提供功能网元所属网络对应的授权方式；该处理单元22还用于根据第一授权方式和第二授权方式确定第三授权方式，第三授权方式是访问服务提供功能网元的授权方式；该收发单元21用于发送第三授权方式。
另一种可能的实现方式，该处理单元22用于确定第一功能网元所属网络对应的授权方式；该收发单元21用于发送请求消息，请求消息用于请求获取访问第二功能网元的授权方式，请求消息包括第一功能网元所属网络对应的授权方式；该收发单元21还用于接收访问第二功能网元的授权方式，访问第二功能网元的授权方式是根据第一功能网元所属网络对应的授权方式和第二功能网元所属网络对应的授权方式确定的；该收发单元21还用于发送问第二功能网元的授权方式。
在该另一种可能的实现方式中，该收发单元21还用于接收请求消息，请求消息用于请求获取访问第二功能网元的授权方式，请求消息包括第一功能网元所属网络对应的授权方式；该处理单元22还用于确定第二功能网元所属网络对应的授权方式；该处理单元22还用于根据第一功能网元所属网络对应的授权方式和第二功能网元所属网络对应的授权方式确定访问第二功能网元的授权方式；该收发单元21发送访问第二功能网元的授权方式。
又一种可能的实现方式，该收发单元21用于发送请求消息，请求消息包括获取第二 功能网元所属网络对应的授权方式的指示信息；该收发单元21还用于接收第二功能网元所属网络对应的授权方式；该处理单元22用于根据第二功能网元所属网络对应的授权方式和第一功能网元所属网络对应的授权方式确定访问第二功能网元的授权方式；该收发单元21还用于发送访问第二功能网元的授权方式。
应理解，通信装置10可以对应于根据本申请实施例的方法500/600/700/800/900/1000中的网络设备(例如，NRF或SEPP)，该通信装置10可以包括用于执行图5/图6/图7/图8/图9/图10中网络设备执行的方法的模块(或单元)。并且，该通信装置10中的各模块(或单元)和上述其他操作和/或功能分别为了实现方法500/600/700/800/900/1000的相应流程。
应理解，图11示例的装置10的结构仅为一种可能的形态，而不应对本申请实施例构成任何限定。本申请并不排除未来可能出现的其他形态的网络设备的可能。
应理解，根据本申请实施例的通信装置10可对应于前述方法实施例的网络设备(例如，NRF或SEPP)，并且通信装置10中的各个模块(或单元)的上述和其它管理操作和/或功能分别为了实现前述各个方法的相应步骤，因此也可以实现前述方法实施例中的有益效果。
还应理解，本申请实施例中的处理模块(或单元)可以由处理器实现，收发模块(或单元)可以由收发器实现。
根据前述方法，图12是适用于本申请实施例的通信装置20的示意图。可以理解的是，该通信装置20可以是网络设备(例如，NFc)。如图12所示，该通信装置20包括：收发单元21和处理单元22。
一种可能的实现方式，该收发单元11用于接收第三授权方式，第三授权方式是访问服务提供功能网元的授权方式，第三授权方式是根据第一授权方式和第二授权方式确定的，第一授权方式是服务消费功能网元所属网络对应的授权方式，第二授权方式是服务提供功能网元所属网络对应的授权方式；该处理单元12用于根据第三授权方式向服务提供功能网元请求第一服务。
另一种可能的实现方式，该收发单元11用于接收授权指示信息，授权指示信息用于确定访问服务提供功能网元的授权方式，授权指示信息为多个指示信息中的一个，多个指示信息包括第一指示信息和第二指示信息，第一指示信息用于指示静态授权方式，第二指示信息用于指示在静态授权方式和开放授权方式中优先使用开放授权方式；该处理单元12用于根据授权指示信息确定访问服务提供功能网元的授权方式；该处理单元12还用于根据访问服务提供功能网元的授权方式向服务提供功能网元请求第二服务。
应理解，通信装置20可以对应于根据本申请实施例的方法500/600/700/800/900/1000中的网络设备(例如，NFc)，该通信装置20可以包括用于执行图5/图6/图7/图8/图9/图10中网络设备(例如，NFc)执行的方法的模块(或单元)。并且，该通信装置20中的各模块(或单元)和上述其他操作和/或功能分别为了实现方法500/600/700/800/900/1000的相应流程。
应理解，图12示例的装置20的结构仅为一种可能的形态，而不应对本申请实施例构成任何限定。本申请并不排除未来可能出现的其他形态的网络设备的可能。
应理解，根据本申请实施例的通信装置20可对应于前述方法实施例的网络设备(例 如，NFc)，并且通信装置20中的各个模块(或单元)的上述和其它管理操作和/或功能分别为了实现前述各个方法的相应步骤，因此也可以实现前述方法实施例中的有益效果。
还应理解，本申请实施例中的处理模块(或单元)可以由处理器实现，收发模块(或单元)可以由收发器实现。
根据前述方法，图13是适用于本申请实施例的通信装置30的示意图。可以理解的是，该通信装置30可以是网络设备(例如，NRF2)。如图13所示，该通信装置30包括：收发单元31和处理单元32。
示例地，该处理单元32用于确定访问服务提供功能网元的授权方式的授权指示信息，授权指示信息为多个指示信息中的一个，多个指示信息包括第一指示信息和第二指示信息，第一指示信息用于指示静态授权方式，第二指示信息用于指示在静态授权方式和开放授权方式中优先使用开放授权方式；该收发单元31用于发送授权指示信息。
应理解，通信装置30可以对应于根据本申请实施例的方法500/600/700/800/900/1000中的网络设备(例如，NRF2)，该通信装置30可以包括用于执行图5/图6/图7/图8/图9/图10中网络设备(例如，NRF2)执行的方法的模块。并且，该通信装置10中的各模块和上述其他操作和/或功能分别为了实现方法500/600/700/800/900/1000的相应流程。
应理解，图13示例的装置30的结构仅为一种可能的形态，而不应对本申请实施例构成任何限定。本申请并不排除未来可能出现的其他形态的网络设备的可能。
应理解，根据本申请实施例的通信装置30可对应于前述方法实施例的网络设备(例如，NRF2)，并且通信装置30中的各个模块(或单元)的上述和其它管理操作和/或功能分别为了实现前述各个方法的相应步骤，因此也可以实现前述方法实施例中的有益效果。
还应理解，本申请实施例中的处理模块(或单元)可以由处理器实现，收发模块(或单元)可以由收发器实现。
根据前述方法，图14为本申请实施例提供的通信装置(也可以称为网络设备)40的示意图，如图14所示，该装置40可以为网络设备(例如，NRF或SEPP)，也可以为芯片或电路，比如可设置于网络设备的芯片或电路。
该装置40可以包括处理器41(即，处理单元的一例)和存储器42。该存储器42用于存储指令，该处理器41用于执行该存储器42存储的指令，以使该装置40实现上述方法中网络设备(例如，NRF或SEPP)执行的步骤。
可选地，该装置40还可以包括输入口43(即，通信单元的一例)和输出口44(即，通信单元的另一例)。应理解，该处理器41、存储器42、输入口43和输出口44可以通过内部连接通路互相通信，传递控制和/或数据信号。
该存储器42用于存储计算机程序，该处理器41可以用于从该存储器42中调用并运行该计算计程序，以控制输入口43接收信号，控制输出口44发送信号，完成上述方法中网络设备的步骤。
该存储器42可以集成在处理器41中，也可以与处理器41分开设置。
可选地，若该装置40为网络设备，该输入口43为接收器，该输出口44为发送器。其中，接收器和发送器可以为相同或者不同的物理实体。为相同的物理实体时，可以统称为收发器。
可选地，若该装置40为芯片或电路，该输入口43为输入接口，该输出口44为输出 接口。
作为一种实现方式，输入口43和输出口44的功能可以考虑通过收发电路或者收发的专用芯片实现。处理器41可以考虑通过专用处理芯片、处理电路、处理器或者通用芯片实现。
作为另一种实现方式，可以考虑使用通用计算机的方式来实现本申请实施例提供的网络设备。即将实现处理器41、输入口43和输出口44功能的程序代码存储在存储器42中，通用处理器通过执行存储器42中的代码来实现处理器41、输入口43和输出口44的功能。
在本申请实施例中，该处理器41用于确定第一授权方式和第二授权方式，第一授权方式是服务消费功能网元所属网络对应的授权方式，第二授权方式是服务提供功能网元所属网络对应的授权方式；
该处理器41还用于根据第一授权方式和第二授权方式确定第三授权方式，第三授权方式是访问服务提供功能网元的授权方式；该输出口44用于发送第三授权方式。
一种可能的实现方式，该处理器41用于确定第一功能网元所属网络对应的授权方式；该输出口44用于发送请求消息，请求消息用于请求获取访问第二功能网元的授权方式，请求消息包括第一功能网元所属网络对应的授权方式；该输入口43用于接收访问第二功能网元的授权方式，访问第二功能网元的授权方式是根据第一功能网元所属网络对应的授权方式和第二功能网元所属网络对应的授权方式确定的；该输出口44还用于发送问第二功能网元的授权方式。
在该一种可能的实现方式中，该该输入口43还用于接收请求消息，请求消息用于请求获取访问第二功能网元的授权方式，请求消息包括第一功能网元所属网络对应的授权方式；该该处理器41还用于确定第二功能网元所属网络对应的授权方式；该处理器41还用于根据第一功能网元所属网络对应的授权方式和第二功能网元所属网络对应的授权方式确定访问第二功能网元的授权方式；该输出口44还用于发送访问第二功能网元的授权方式。
又一种可能的实现方式，该输出口44用于发送请求消息，请求消息包括获取第二功能网元所属网络对应的授权方式的指示信息；该输入口43用于接收第二功能网元所属网络对应的授权方式；该处理器41用于根据第二功能网元所属网络对应的授权方式和第一功能网元所属网络对应的授权方式确定访问第二功能网元的授权方式；该该输出口44还用于发送访问第二功能网元的授权方式。
可选地，该装置40配置在或本身即为网络设备，例如NRF或SEPP。
其中，以上列举的装置40中各模块或单元的功能和动作仅为示例性说明，装置40中各模块或单元可以用于执行上述方法500/600/700/800/900/1000中由网络设备(例如，NRF或SEPP)所执行的各动作或处理过程，这里，为了避免赘述，省略其详细说明。
该装置40所涉及的与本申请实施例提供的技术方案相关的概念，解释和详细说明及其他步骤请参见前述方法或其他实施例中关于这些内容的描述，此处不做赘述。
在一种可能的实施方式中，随着片上系统(system-on-chip，SoC)技术的发展，装置30的全部或者部分功能由SoC技术实现，例如由一网络设备功能芯片实现，该网络设备功能芯片集成了处理器、存储器、通信接口等器件，网络设备相关功能的程序存储在存储器中，由处理器执行程序以实现基站的相关功能。可选地，该网络设备功能芯片也能够读 取该芯片外部的存储器以实现基站的相关功能。
应理解，图14示例的装置40的结构仅为一种可能的形态，而不应对本申请实施例构成任何限定。本申请并不排除未来可能出现的其他形态的基站结构的可能。
根据前述方法，图15为本申请实施例提供的通信装置(也可以称为网络设备)50的示意图，如图15所示，该装置50可以为网络设备(例如，NFc)，也可以为芯片或电路，比如可设置于网络设备的芯片或电路。
该装置50可以包括处理器51(即，处理单元的一例)和存储器52。该存储器52用于存储指令，该处理器51用于执行该存储器52存储的指令，以使该装置50实现上述方法中网络设备(例如，NFc)执行的步骤。
可选地，该装置50还可以包括输入口53(即，通信单元的一例)和输出口54(即，通信单元的另一例)。应理解，该处理器51、存储器52、输入口53和输出口54可以通过内部连接通路互相通信，传递控制和/或数据信号。
该存储器52用于存储计算机程序，该处理器51可以用于从该存储器52中调用并运行该计算计程序，以控制输入口53接收信号，控制输出口54发送信号，完成上述方法中网络设备的步骤。
该存储器52可以集成在处理器51中，也可以与处理器51分开设置。
可选地，若该装置50为网络设备，该输入口53为接收器，该输出口54为发送器。其中，接收器和发送器可以为相同或者不同的物理实体。为相同的物理实体时，可以统称为收发器。
可选地，若该装置50为芯片或电路，该输入口53为输入接口，该输出口54为输出接口。
作为一种实现方式，输入口53和输出口54的功能可以考虑通过收发电路或者收发的专用芯片实现。处理器51可以考虑通过专用处理芯片、处理电路、处理器或者通用芯片实现。
作为另一种实现方式，可以考虑使用通用计算机的方式来实现本申请实施例提供的网络设备。即将实现处理器51、输入口53和输出口54功能的程序代码存储在存储器52中，通用处理器通过执行存储器52中的代码来实现处理器51、输入口53和输出口54的功能。
在本申请实施例中，该输入口53用于接收第三授权方式，第三授权方式是访问服务提供功能网元的授权方式，第三授权方式是根据第一授权方式和第二授权方式确定的，第一授权方式是服务消费功能网元所属网络对应的授权方式，第二授权方式是服务提供功能网元所属网络对应的授权方式；该处理器51用于根据第三授权方式向服务提供功能网元请求第一服务。
一种可能的实现方式，该输入口53用于接收授权指示信息，授权指示信息用于确定访问服务提供功能网元的授权方式，授权指示信息为多个指示信息中的一个，多个指示信息包括第一指示信息和第二指示信息，第一指示信息用于指示静态授权方式，第二指示信息用于指示在静态授权方式和开放授权方式中优先使用开放授权方式；该处理器51用于根据授权指示信息确定访问服务提供功能网元的授权方式；该处理器51还用于根据访问服务提供功能网元的授权方式向服务提供功能网元请求第二服务。
可选地，该装置50配置在或本身即为网络设备，例如NFc。
其中，以上列举的装置50中各模块或单元的功能和动作仅为示例性说明，装置50中各模块或单元可以用于执行上述方法500/600/700/800/900/1000中由网络设备(例如，NFc)所执行的各动作或处理过程，这里，为了避免赘述，省略其详细说明。
该装置50所涉及的与本申请实施例提供的技术方案相关的概念，解释和详细说明及其他步骤请参见前述方法或其他实施例中关于这些内容的描述，此处不做赘述。
在一种可能的实施方式中，随着片上系统SoC技术的发展，装置50的全部或者部分功能由SoC技术实现，例如由一网络设备功能芯片实现，该网络设备功能芯片集成了处理器、存储器、通信接口等器件，网络设备相关功能的程序存储在存储器中，由处理器执行程序以实现基站的相关功能。可选地，该网络设备功能芯片也能够读取该芯片外部的存储器以实现基站的相关功能。
应理解，图15示例的装置50的结构仅为一种可能的形态，而不应对本申请实施例构成任何限定。本申请并不排除未来可能出现的其他形态的基站结构的可能。
根据前述方法，图16为本申请实施例提供的通信装置(也可以称为网络设备)60的示意图，如图16所示，该装置60可以为网络设备(例如，NRF2)，也可以为芯片或电路，比如可设置于网络设备的芯片或电路。
该装置60可以包括处理器61(即，处理单元的一例)和存储器62。该存储器62用于存储指令，该处理器61用于执行该存储器62存储的指令，以使该装置60实现上述方法中网络设备(例如，NRF2)执行的步骤。
可选地，该装置60还可以包括输入口63(即，通信单元的一例)和输出口64(即，通信单元的另一例)。应理解，该处理器61、存储器62、输入口63和输出口64可以通过内部连接通路互相通信，传递控制和/或数据信号。
该存储器62用于存储计算机程序，该处理器61可以用于从该存储器62中调用并运行该计算计程序，以控制输入口63接收信号，控制输出口64发送信号，完成上述方法中网络设备的步骤。
该存储器62可以集成在处理器61中，也可以与处理器61分开设置。
可选地，若该装置60为网络设备，该输入口63为接收器，该输出口64为发送器。其中，接收器和发送器可以为相同或者不同的物理实体。为相同的物理实体时，可以统称为收发器。
可选地，若该装置60为芯片或电路，该输入口63为输入接口，该输出口64为输出接口。
作为一种实现方式，输入口63和输出口64的功能可以考虑通过收发电路或者收发的专用芯片实现。处理器61可以考虑通过专用处理芯片、处理电路、处理器或者通用芯片实现。
作为另一种实现方式，可以考虑使用通用计算机的方式来实现本申请实施例提供的网络设备。即将实现处理器61、输入口63和输出口64功能的程序代码存储在存储器62中，通用处理器通过执行存储器62中的代码来实现处理器61、输入口63和输出口64的功能。
在本申请实施例中，该处理器61用于确定访问服务提供功能网元的授权方式的授权指示信息，授权指示信息为多个指示信息中的一个，多个指示信息包括第一指示信息和第二指示信息，第一指示信息用于指示静态授权方式，第二指示信息用于指示在静态授权方 式和开放授权方式中优先使用开放授权方式；该输出口64用于发送授权指示信息。
可选地，该装置60配置在或本身即为网络设备，例如NRF2。
其中，以上列举的装置60中各模块或单元的功能和动作仅为示例性说明，装置60中各模块或单元可以用于执行上述方法500/600/700/800/900/1000中由网络设备(例如，NRF2)所执行的各动作或处理过程，这里，为了避免赘述，省略其详细说明。
该装置60所涉及的与本申请实施例提供的技术方案相关的概念，解释和详细说明及其他步骤请参见前述方法或其他实施例中关于这些内容的描述，此处不做赘述。
在一种可能的实施方式中，随着片上系统SoC技术的发展，装置60的全部或者部分功能由SoC技术实现，例如由一网络设备功能芯片实现，该网络设备功能芯片集成了处理器、存储器、通信接口等器件，网络设备相关功能的程序存储在存储器中，由处理器执行程序以实现基站的相关功能。可选地，该网络设备功能芯片也能够读取该芯片外部的存储器以实现基站的相关功能。
应理解，图16示例的装置60的结构仅为一种可能的形态，而不应对本申请实施例构成任何限定。本申请并不排除未来可能出现的其他形态的基站结构的可能。
应理解，本申请实施例中，该处理器可以为中央处理单元(central processing unit，CPU)，该处理器还可以是其他通用处理器、数字信号处理器(digital signal processor，DSP)、专用集成电路(application specific integrated circuit，ASIC)、现成可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
还应理解，本申请实施例中的存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(direct rambus RAM，DR RAM)。
上述实施例，可以全部或部分地通过软件、硬件、固件或其他任意组合来实现。当使用软件实现时，上述实施例可以全部或部分地以计算机程序产品的形式实现。该计算机程序产品包括一个或多个计算机指令或计算机程序。在计算机上加载或执行该计算机指令或计算机程序时，全部或部分地产生按照本申请实施例该的流程或功能。该计算机可以为通用计算机、专用计算机、计算机网络、或者其他可编程装置。该计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，该计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。该计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介 质集合的服务器、数据中心等数据存储设备。该可用介质可以是磁性介质(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质。半导体介质可以是固态硬盘。
应理解，本文中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系。
应理解，在本申请的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
还应理解，本文提及的“第一”和“第二”等等仅仅是为了更清楚地表述本申请的技术方案而加以区分，不应对本申请构成任何限定。
在本说明书中使用的术语“部件”、“模块”、“系统”等用于表示计算机相关的实体、硬件、固件、硬件和软件的组合、软件、或执行中的软件。例如，部件可以是但不限于，在处理器上运行的进程、处理器、对象、可执行文件、执行线程、程序和/或计算机。通过图示，在计算设备上运行的应用和计算设备都可以是部件。一个或多个部件可驻留在进程和/或执行线程中，部件可位于一个计算机上和/或分布在2个或更多个计算机之间。此外，这些部件可从在上面存储有各种数据结构的各种计算机可读介质执行。部件可例如根据具有一个或多个数据分组(例如来自与本地系统、分布式系统和/或网络间的另一部件交互的二个部件的数据，例如通过信号与其它系统交互的互联网)的信号通过本地和/或远程进程来通信。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
该功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有 技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (19)

  1. 一种通信方法，其特征在于，包括：
    确定第一授权方式和第二授权方式，所述第一授权方式是服务消费功能网元所属网络对应的授权方式，所述第二授权方式是服务提供功能网元所属网络对应的授权方式；
    根据所述第一授权方式和所述第二授权方式确定第三授权方式，所述第三授权方式是访问服务提供功能网元的授权方式；
    发送所述第三授权方式。
  2. 根据权利要求1所述的方法，其特征在于，所述确定第二授权方式包括：
    接收第一请求消息，所述第一请求消息包括所述服务提供功能网元所属网络的标识信息；
    根据所述服务提供功能网元所属网络的标识信息确定所述第二授权方式；和/或，
    所述确定第一授权方式包括：
    获取所述服务消费功能网元所属网络的标识信息；
    根据所述服务消费功能网元所属网络的标识信息确定所述第一授权方式。
  3. 根据权利要求1或2所述的方法，其特征在于，所述第三授权方式为开放授权方式，所述方法还包括：
    接收第二请求消息，所述第二请求消息用于请求获取第一令牌，所述第一令牌用于授权所述服务消费功能网元访问所述第一服务；
    确定所述第一令牌；
    发送所述第一令牌。
  4. 根据权利要求1至3中任一项所述的方法，其特征在于，所述根据所述第一授权方式和所述第二授权方式确定第三授权方式，包括：
    根据所述第一授权方式和所述第二授权方式的共有授权方式确定所述第三授权方式；
    当所述共有授权方式为所述静态授权方式或所述开放授权方式，确定所述静态授权方式或所述开放授权方式为所述第三授权方式；
    当所述共有授权方式为所述静态授权方式和所述开放授权方式，根据本地策略确定所述第三授权方式，或者确定所述开放授权方式为所述第三授权方式。
  5. 一种通信方法，其特征在于，包括：
    接收第三授权方式，所述第三授权方式是访问服务提供功能网元的授权方式，所述第三授权方式是根据第一授权方式和第二授权方式确定的，所述第一授权方式是服务消费功能网元所属网络对应的授权方式，所述第二授权方式是所述服务提供功能网元所属网络对应的授权方式；
    根据所述第三授权方式向所述服务提供功能网元请求第一服务。
  6. 根据权利要求5所述的方法，其特征在于，在接收所述第三授权方式之前，所述方法还包括：
    发送第一请求消息，所述第一请求消息用于请求获取所述第三授权方式，所述第一请求消息包括所述服务提供功能网元所属网络的标识信息。
  7. 根据权利要求5或6所述的方法，其特征在于，所述第三授权方式为开放授权方式，所述根据所述第三授权方式向所述服务提供功能网元请求第一服务，包括：
    发送第二请求消息，所述第二请求消息用于请求获取第一令牌，所述第一令牌用于授权所述服务消费功能网元访问所述第一服务；
    接收所述第一令牌；
    向所述服务提供功能网元发送用于请求所述第一服务的消息，所述用于请求所述第一服务的消息中包括所述第一令牌。
  8. 根据权利要求5至7中任一项所述的方法，其特征在于，所述接收第三授权方式包括：
    从网络存储功能网元或安全边缘保护代理网元接收所述第三授权方式。
  9. 一种网络设备，其特征在于，包括：
    处理单元，用于确定第一授权方式和第二授权方式，所述第一授权方式是服务消费功能网元所属网络对应的授权方式，所述第二授权方式是服务提供功能网元所属网络对应的授权方式；
    所述处理单元，还用于根据所述第一授权方式和所述第二授权方式确定第三授权方式，所述第三授权方式是访问服务提供功能网元的授权方式；
    收发单元，用于发送所述第三授权方式。
  10. 根据权利要求9所述的网络设备，其特征在于，
    所述收发单元，还用于接收第一请求消息，所述第一请求消息包括所述服务提供功能网元所属网络的标识信息；
    所述处理单元，还用于根据所述服务提供功能网元所属网络的标识信息确定所述第二授权方式；和/或，
    所述处理单元，还用于：
    获取所述服务消费功能网元所属网络的标识信息；
    根据所述服务消费功能网元所属网络的标识信息确定所述第一授权方式。
  11. 根据权利要求9或10所述的网络设备，其特征在于，所述第三授权方式为开放授权方式，
    所述收发单元，还用于接收第二请求消息，所述第二请求消息用于请求获取第一令牌，所述第一令牌用于授权所述服务消费功能网元访问所述第一服务；
    所述处理单元，还用于确定所述第一令牌；
    所述收发单元，还用于发送所述第一令牌。
  12. 根据权利要求9至11中任一项所述的网络设备，其特征在于，所述处理单元，还用于：
    根据所述第一授权方式和所述第二授权方式的共有授权方式确定所述第三授权方式；
    当所述共有授权方式为所述静态授权方式或所述开放授权方式，确定所述静态授权方式或所述开放授权方式为所述第三授权方式；
    当所述共有授权方式为所述静态授权方式和所述开放授权方式，根据本地策略确定所述第三授权方式，或者确定所述开放授权方式为所述第三授权方式。
  13. 一种网络设备，其特征在于，包括：
    收发单元，用于接收第三授权方式，所述第三授权方式是访问服务提供功能网元的授权方式，所述第三授权方式是根据第一授权方式和第二授权方式确定的，所述第一授权方式是服务消费功能网元所属网络对应的授权方式，所述第二授权方式是所述服务提供功能网元所属网络对应的授权方式；
    处理单元，用于根据所述第三授权方式向所述服务提供功能网元请求第一服务。
  14. 根据权利要求13所述的网络设备，其特征在于，所述收发单元，在接收所述第三授权方式之前，还用于发送第一请求消息，所述第一请求消息用于请求获取所述第三授权方式，所述第一请求消息包括所述服务提供功能网元所属网络的标识信息。
  15. 根据权利要求13或14所述的网络设备，其特征在于，
    所述收发单元，还用于发送第二请求消息，所述第二请求消息用于请求获取第一令牌，所述第一令牌用于授权所述服务消费功能网元访问所述第一服务；
    所述收发单元，还用于接收所述第一令牌；
    所述处理单元，还用于向所述服务提供功能网元发送用于请求所述第一服务的消息，所述用于请求所述第一服务的消息中包括所述第一令牌。
  16. 根据权利要求13至15中任一项所述的网络设备，其特征在于，所述收发单元，还用于从第一网络存储功能网元或第一安全边缘保护代理网元接收所述第三授权方式。
  17. 一种芯片系统，其特征在于，包括：处理器，用于从存储器中调用并运行计算机程序，使得安装有所述芯片系统的网络设备执行如权利要求1至8中任意一项所述的方法。
  18. 一种计算机程序产品，其特征在于，所述计算机程序产品在计算机上执行时，使得所述计算机执行如权利要求1至4中任一项所述的方法；或者使得所述计算机执行如权利要求5至8中任一项所述的方法。
  19. 一种计算机可读存储介质，其特征在于，包括：所述计算机可读存储介质上存储有计算机程序，当所述计算机程序运行时，使得所述计算机执行如权利要求1至4中任一项所述的方法；或者使得所述计算机执行如权利要求5至8中任一项所述的方法。
PCT/CN2022/089453 2021-05-24 2022-04-27 通信方法和网络设备 WO2022247569A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110567958.9A CN115396867A (zh) 2021-05-24 2021-05-24 通信方法和网络设备
CN202110567958.9 2021-05-24

Publications (1)

Publication Number Publication Date
WO2022247569A1 true WO2022247569A1 (zh) 2022-12-01

Family

ID=84114627

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/089453 WO2022247569A1 (zh) 2021-05-24 2022-04-27 通信方法和网络设备

Country Status (2)

Country Link
CN (1) CN115396867A (zh)
WO (1) WO2022247569A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111435932A (zh) * 2019-01-14 2020-07-21 华为技术有限公司 一种令牌处理方法及装置
CN112492592A (zh) * 2019-09-11 2021-03-12 华为技术有限公司 一种多个nrf场景下的授权方法
CN112822678A (zh) * 2019-10-31 2021-05-18 华为技术有限公司 一种服务化架构授权的方法
CN112825571A (zh) * 2019-11-21 2021-05-21 中兴通讯股份有限公司 网络功能管理、注册、请求方法、装置、网元及介质

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111435932A (zh) * 2019-01-14 2020-07-21 华为技术有限公司 一种令牌处理方法及装置
CN112492592A (zh) * 2019-09-11 2021-03-12 华为技术有限公司 一种多个nrf场景下的授权方法
CN112822678A (zh) * 2019-10-31 2021-05-18 华为技术有限公司 一种服务化架构授权的方法
CN112825571A (zh) * 2019-11-21 2021-05-21 中兴通讯股份有限公司 网络功能管理、注册、请求方法、装置、网元及介质

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
HUAWEI, HISILICON, CHINA MOBILE: "New solution for the authorization mechanism negotiation", 3GPP DRAFT; S3-212652, vol. SA WG3, 9 August 2021 (2021-08-09), pages 1 - 2, XP052063308 *

Also Published As

Publication number Publication date
CN115396867A (zh) 2022-11-25

Similar Documents

Publication Publication Date Title
JP7118237B2 (ja) 通信方法及び通信装置
WO2021135295A1 (zh) 建立连接和获取中继服务代码的方法和通信装置
US20230069252A1 (en) Communication Method and Communication Apparatus
CN113630749A (zh) 一种获取边缘服务的方法和装置
WO2022171017A1 (zh) 一种通信方法、装置及系统
WO2021254353A1 (zh) 一种释放中继连接的方法、设备及系统
US20240031798A1 (en) Communication method and apparatus
EP3913982A1 (en) Network slicing with a radio access network node
CN113498121A (zh) 一种通信的方法及装置
WO2023071316A1 (zh) 网络能力开放的方法、装置和系统
WO2022199451A1 (zh) 会话切换的方法和装置
WO2021233362A1 (zh) 认证授权的方法和装置
US20240073848A1 (en) Network Slice in a Wireless Network
WO2023066210A1 (zh) 鉴权方法及装置
WO2022247569A1 (zh) 通信方法和网络设备
WO2023040927A1 (zh) 终端设备的管理方法及装置
WO2024074148A1 (zh) 通信方法、装置及系统
WO2023216934A1 (zh) 通信方法及装置
WO2023065778A1 (zh) 中继通信的方法和装置
WO2023015973A1 (zh) 一种网络切片准入控制方法和装置
WO2023220998A1 (zh) 无线通信的方法、用户设备及网络设备
US20230362639A1 (en) Method and apparatus for transferring network information to ai/ml application in wireless communication system
WO2023123218A1 (zh) 网络切片的请求方法、设备、存储介质及程序产品
WO2023134649A1 (en) Method and system for enhanced channel map advertisements
US20240056897A1 (en) Method and apparatus for managing edge computing service session in wireless communication system

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22810298

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE