WO2023051316A1 - 网络服务授权方法、装置及电子设备 - Google Patents

网络服务授权方法、装置及电子设备 Download PDF

Info

Publication number
WO2023051316A1
WO2023051316A1 PCT/CN2022/119877 CN2022119877W WO2023051316A1 WO 2023051316 A1 WO2023051316 A1 WO 2023051316A1 CN 2022119877 W CN2022119877 W CN 2022119877W WO 2023051316 A1 WO2023051316 A1 WO 2023051316A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
service authorization
nrf
message
service
Prior art date
Application number
PCT/CN2022/119877
Other languages
English (en)
French (fr)
Inventor
彭艺
Original Assignee
新华三技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 新华三技术有限公司 filed Critical 新华三技术有限公司
Publication of WO2023051316A1 publication Critical patent/WO2023051316A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/047—Key management, e.g. using generic bootstrapping architecture [GBA] without using a trusted network node as an anchor
    • H04W12/0471—Key exchange
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity

Definitions

  • the present application relates to the communication field, in particular to a network service authorization method, device and electronic equipment.
  • each control plane NF Network Function, network function unit, referred to as network element
  • each control plane NF can communicate by calling each other's service interface.
  • the NF that provides the service is called the service producer.
  • the NF is called a service consumer.
  • the 5G standard defines that before accessing the service-oriented interface of the service producer, the service consumer needs to first access the network from the NRF (Network Repository Function, network storage function network element) obtains the authorization information, and then the service consumer can use the obtained authorization information to apply for the service from the service producer, so as to ensure the safety of the service interface being called.
  • NRF Network Repository Function, network storage function network element
  • the service authorization key used to generate authorization information needs to be pre-shared by NRF and the service producer, and the standard does not specify how to securely share the service authorization key between NRF and the service producer .
  • the application discloses a network service authorization method, device and electronic equipment, so that NRF and NF as a service producer can safely share service authorization keys.
  • a network service authorization method is provided, the method is applied to a network storage function network element NRF, and the method includes:
  • the network function unit NF When it is detected that the network function unit NF needs the second service authorization key, generate first key material according to a key exchange algorithm supported by the obtained NF, and use the NRF in the first key material
  • the public key of the NRF is carried in the first message and sent to the NF; wherein the first key material includes at least: the public key of the NRF and the private key of the NRF;
  • the second service authorization key calculated by the key exchange algorithm, the public key of the NRF, and the private key of the NF is the same; the second service authorization key is used to instruct the NF to provide authorized service consumers with Internet service.
  • a network service authorization method is provided, the method is applied to a network function unit NF, and the method includes:
  • the first message carrying at least one key exchange algorithm supported by the NRF according to the obtained NF
  • the generated public key of the NRF
  • the second The key material includes at least: the public key of the NF and the private key of the NF;
  • the second service authorization key is used to instruct the NF to provide authorized service consumers with Internet service.
  • a network service authorization device is provided, the device is applied to a network storage function network element NRF, and the device includes:
  • the first message sending unit is configured to, when detecting that the network function unit NF needs a second service authorization key, generate first key material according to an obtained key exchange algorithm supported by the NF, and send the first
  • the public key of the NRF in the key material is carried in a first message and sent to the NF; wherein the first key material includes at least: the public key of the NRF and the private key of the NRF;
  • a second message receiving unit configured to receive a second message that the NF responds to the first message, where the second message at least carries the public key of the NF generated by the NF according to the key exchange algorithm;
  • a service authorization key generating unit configured to generate a first service authorization key corresponding to the NF according to the key exchange algorithm, the public key of the NF, and the private key of the NRF, the first service authorization key The key is the same as the second service authorization key calculated by the NF based on the key exchange algorithm, the public key of the NRF, and the private key of the NF; the second service authorization key is used to indicate the The NF provides network services to authorized service consumers.
  • a network service authorization device is provided, the device is applied to a network function unit NF, and the device includes:
  • the first message receiving unit is configured to receive the first message sent by the network storage function network element NRF in response to the need of the NF for the second service authorization key, the first message at least carries the obtained NRF according to the The public key of the NRF generated by a key exchange algorithm supported by the NF;
  • the second message sending unit is configured to generate second key material according to the key exchange algorithm, carry the public key of the NF in the second key material in a second message, and send the message to the NRF sending; wherein, the second key material includes at least: the public key of the NF and the private key of the NF;
  • a service authorization key generating unit configured to calculate the second service authorization key according to the key exchange algorithm, the public key of the NRF, and the private key of the NF, and the second service authorization key is the same as the The first service authorization key corresponding to the NF generated by the NRF based on the key exchange algorithm, the public key of the NF, and the private key of the NRF is the same; the second service authorization key is used to indicate the The NF provides network services to authorized service consumers.
  • an electronic device includes: a processor and a memory;
  • the memory is used to store machine-executable instructions
  • the processor is configured to read and execute the machine-executable instructions stored in the memory, so as to implement the above-mentioned network service authorization method.
  • the NRF and NF in the solution provided by this application can use the same key exchange algorithm supported by NF, generate key material according to the key exchange algorithm and exchange public keys in the key material with each other, Use the public key of the other device and your own private key to generate the same service authorization key.
  • the service authorization key is generated locally in the NRF or NF, and has not been exposed in the network, which ensures the security of the process of sharing the service authorization key between the NRF and NF.
  • FIG. 1 is a flow chart of a method for network service authorization provided by an embodiment of the present application
  • FIG. 2 is a flow chart of another network service authorization method provided by the embodiment of the present application.
  • FIG. 3 is a schematic flowchart of a method for authorizing an application network service provided by an embodiment of the present application
  • Fig. 4 is a schematic diagram of a network service authorization device provided by an embodiment of the present application.
  • FIG. 5 is a schematic diagram of another network service authorization device provided by the embodiment of the present application.
  • FIG. 6 is a schematic diagram of a hardware structure of an electronic device provided by an embodiment of the present application.
  • first, second, third, etc. may be used in this application to describe various information, the information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of the present application, first information may also be called second information, and similarly, second information may also be called first information. Depending on the context, the word “if” as used herein may be interpreted as “at” or “when” or “in response to a determination.”
  • FIG. 1 is a flow chart of a method for network service authorization provided by an embodiment of the present application.
  • the method can be applied to a 5G network, and is specifically applied to a network storage function network element NRF in the 5G network.
  • the process may include the following steps:
  • Step 101 when it is detected that the network function unit NF needs a service authorization key, generate first key material according to a key exchange algorithm supported by the NF that has been obtained, and use the The public key of the NRF is carried in the first message and sent to the NF; wherein the first key material includes at least: the public key of the NRF and the private key of the NRF.
  • the NF needs a service authorization key, including many situations. For example, when receiving the registration request message sent by the NF, it is determined that the NF needs a service authorization key, wherein the registration request message can carry the key exchange algorithm set supported by the NF and the callback URI (Uniform Resource Identifier, Uniform Resource Identifier) of the NF character, used to locate the NF); or, when receiving the service authorization key negotiation request sent by the NF, it is determined that the NF needs the service authorization key; or, if the life cycle of the service authorization key corresponding to the NF is preset in the NRF, Then, when it is determined that the life cycle of the service authorization key corresponding to the NF is over, it is determined that the NF needs the service authorization key.
  • the above situations in which it is detected that the NF needs a service authorization key are just examples, and this application does not limit it.
  • the NRF can acquire a key exchange algorithm supported by the NF in various ways.
  • Method 1 The NRF can select a key exchange algorithm from the set of key exchange algorithms registered by the NF, and then use the selected key exchange algorithm to generate the first key material.
  • the first key material in this embodiment may also include an algorithm identifier corresponding to the key exchange algorithm selected above.
  • Method 2 When receiving the registration request message sent by the NF, the registration response message used to respond to the registration request message carries the key exchange algorithm set supported by the NRF, so that the NF can determine a registration response message based on the received registration response message.
  • the key exchange algorithm supported by both the NRF and the NF, and the NRF can select a key exchange algorithm supported by the NF according to the algorithm identifier carried in the received service authorization key negotiation request sent by the NF.
  • the first message sent by the NRF to the NF in this embodiment not only carries the public key of the NRF, but also carries the above algorithm identifier.
  • the NF in this embodiment can generate the second key material according to the key exchange algorithm corresponding to the algorithm identifier.
  • the NRF can also set The corresponding key identifies the Kid, and the Kid is included in the first key material.
  • the Kid can also be carried in the first message and sent to the NF.
  • Step 102 Receive a second message that the NF responds to the first message, where the second message at least carries the NF's public key generated by the NF according to the key exchange algorithm.
  • the NRF in this embodiment sets the corresponding key identifier Kid for the service authorization key to be generated this time, that is, the above-mentioned first key material includes the corresponding key identifier Kid for the service authorization key to be generated.
  • Key identifier Kid then in this embodiment, after receiving the second message, whether the key identifier Kid carried in the detected second message is consistent with the Kid in the first key material, in the case that the detection result is consistent Next, it is determined that the second message passes the verification, and proceed to step 103.
  • Step 103 Generate a service authorization key corresponding to the NF according to the key exchange algorithm, the public key of the NF, and the private key of the NRF, and the service authorization key and the NF are based on the key
  • the exchange algorithm, the public key of the NRF and the private key of the NF calculate the same service authorization key; the service authorization key is used to instruct the NF to provide network services for authorized service consumers.
  • the NRF can further record the service authorization information matching the NF, and the NF
  • the service authorization information includes at least the service authorization key corresponding to the NF and the service authorization key Kid.
  • the service authorization information matching the NF may be recorded by recording the mapping relationship between the identifier of the NF and the service authorization information.
  • one or more service authorization keys may be generated for one NF in the NRF according to the foregoing embodiments. If multiple service authorization keys are generated for one NF in this embodiment, then the multiple service authorization keys can form a service authorization key set, and each service authorization key can be distinguished by Kid, so as to further strengthen the NF as a service Security guarantees for producers.
  • the service authorization key set corresponding to the NF can be recorded in the following manner in the NRF: ⁇ NF identifier: [ ⁇ Kid1: K1 ⁇ , ⁇ Kid2: K2 ⁇ , ..., ⁇ Kidn: Kn ⁇ ] ⁇ , where K1 ⁇ Kn is the service authorization key.
  • ⁇ represents a pair of mapping relationship
  • [] represents a list of the same object.
  • generating multiple service authorization keys for one NF can also correspond to different services provided by the NF, so that the NF can be based on the Kid carried in the Access Token sent by the service consumer. Quickly determine the service requested by the service consumer.
  • the service authorization key can be used to authorize service consumers to apply for network services from the NF, and the specific application process for services may include the following step:
  • the designated NF for which the service consumer requests authorized access may be determined through the service authorization request.
  • the service authorization request sent by the service consumer at least carries the identity of the service consumer, the identity of the designated NF or the type of NF that is requested to access, and the list of services that are requested to be accessed.
  • the designated NF is determined by the identification of the designated NF, or according to the type of NF that requests authorized access, one NF is selected from multiple NFs belonging to this type of NF to be designated as the designated NF.
  • the process of determining the specified NF according to the NF type can refer to related technologies, for example, it can be determined through the load and weight of the NF, which is not limited in this application.
  • Step b generate a reference Token, and select a target service authorization key from all service authorization keys corresponding to the specified NF, generate an Access Token according to the target service authorization key and the reference Token, and submit to the The service consumer returns the Access Token, so that the service consumer can apply for the service from the designated NF according to the Access Token.
  • the reference Token generated in this embodiment at least includes: service consumer identifier, identifier of the specified NF, and a list of services requested to be accessed.
  • the obtained service can be The list determines the service authorization key corresponding to the service requested by the service consumer, and uses the service authorization key as the target service authorization key.
  • the Access Token can be generated according to the target service authorization key and the reference Token in the following manner:
  • the reference Token in this embodiment includes: Token Header and Token Body.
  • the target Kid corresponding to the target service authorization key can be filled in the Token Header, and the target service authorization key is used to digitally sign the reference Token to obtain the Access Token.
  • using the target service authorization key to digitally sign the reference Token can use the target service authorization key to encrypt the entire reference Token or the Token Body in the reference Token, and then attach the encrypted ciphertext At the end of the reference token to form the Access Token.
  • NRF and NF can use the same key exchange algorithm supported by NF, according to the key material generated by the key exchange algorithm and exchange the public key in the key material with each other, and use each other’s
  • the device's public key and its own private key generate the same service authorization key.
  • the service authorization key is generated locally in the NRF or NF, and has not been exposed in the network, which ensures the security of the process of sharing the service authorization key between the NRF and NF.
  • FIG. 2 is a flow chart of another network service authorization method provided by the embodiment of the present application. As another embodiment, the process shown in Fig. 2 can be applied to NF.
  • Step 201 Receive the first message sent by the NRF in response to the NF's need for a service authorization key, the first message at least carrying the key exchange algorithm generated by the NRF according to the acquired key exchange algorithm supported by the NF NRF's public key.
  • Step 202 Generate second key material according to the key exchange algorithm, and carry the public key of the NF in the second key material in a second message and send it to the NRF; wherein, the The second key material includes at least: the public key of the NF and the private key of the NF.
  • the first message received by the above NF may also carry the algorithm identifier corresponding to the key exchange algorithm. Therefore, in this embodiment, the NF may determine the encryption key from the local key exchange algorithm set of the NF according to the algorithm identifier. key exchange algorithm, and generate second key material according to the determined key exchange algorithm.
  • Step 203 Calculate the service authorization key according to the key exchange algorithm, the public key of the NRF, and the private key of the NF, and the service authorization key and the NRF are based on the key exchange algorithm,
  • the service authorization key corresponding to the NF generated by the public key of the NF and the private key of the NRF is the same; the service authorization key is used to instruct the NF to provide network services for authorized service consumers.
  • the first message received by the above-mentioned NF may also carry the key identifier Kid corresponding to the service authorization key to be generated, so that the NF may use the key exchange algorithm, the public key of the NRF, and the After the private key of the NF determines the service authorization key corresponding to the NF, the NF may further record service authorization information locally, and the service authorization information includes at least the service authorization key generated above and its corresponding Kid.
  • one or more service authorization keys may be generated according to the above method. If the NF in this embodiment generates multiple service authorization keys, the multiple service authorization keys can form a service authorization key set and save it locally, and distinguish each service authorization by the Kid obtained from the NRF Key to further strengthen the security guarantee of NF as a service producer.
  • the service authorization key set recorded in the NF may be recorded in the following manner: [ ⁇ Kid1: K1 ⁇ , ⁇ Kid2: K2 ⁇ , . . . , ⁇ Kidn: Kn ⁇ ].
  • ⁇ represents a pair of mapping relationships
  • [] represents a list of the same objects
  • K1 ⁇ Kn are service authorization keys.
  • the service authorization key can be used to authorize service consumers to apply for network services from the NF.
  • the specific application process for services may include the following steps:
  • Step c receive the Access Token sent by the service consumer
  • Step d obtaining the target Kid from the Token Header of the Access Token, searching for the target service authorization key corresponding to the target Kid, and verifying the digital signature in the Access Token according to the target service authorization key.
  • verifying the digital signature in the Access Token based on the target service authorization key refers to: encrypting the plaintext in the Access Token with the target service authorization key, and encrypting the encrypted ciphertext Compare it with the ciphertext in the Access Token.
  • Step e if the verification is successful, provide network services to the service consumers according to the Access Token.
  • the plaintext in the Access Token is encrypted with the target service authorization key, and the encrypted ciphertext is consistent with the ciphertext in the Access Token, it can be determined that the verification of the service consumer is successful .
  • NRF and NF can use the same key exchange algorithm supported by NF, according to the key material generated by the key exchange algorithm and exchange the public key in the key material with each other, and use each other’s
  • the device's public key and its own private key generate the same service authorization key.
  • the service authorization key is generated locally in the NRF or NF, and has not been exposed in the network, which ensures the security of the process of sharing the service authorization key between the NRF and NF.
  • the above NRF and NF may communicate through HTTP or HTTPS, that is, the format of the above first message and the second message conforms to the HTTP or HTTPS protocol.
  • the above-mentioned key exchange algorithm can include DHE (temporary-Diffie-Hellman algorithm), ECDHE (temporary-elliptic curve-Diffie-Hellman algorithm), etc., which can be obtained by using the public key of the other party and the private key of one's own Algorithm to generate the same key.
  • NRF can generate a digital signature through the service authorization key and send it to the NF, so that the NF can use the service authorization key recorded locally to the Digital signatures are verified.
  • the digital signature may include the Kid of the service authorization key used by the NRF, the identifier of the NF, and the like.
  • messages 1-4 in Figure 3 are the process of sharing the service authorization key between the NRF and the NF as the service producer, and messages 5-8 are the request from the NF as the service consumer to the NF as the service producer service process.
  • the NRF determines that the NF needs a service authorization key through receiving message 1 sent by the NF, and the message 1 is a registration request message sent by the NF.
  • the NRF can determine that the NF needs the service authorization key in various ways.
  • the triggering of the registration request message sent by the NF is taken as an example for description.
  • message 1 can carry the key exchange algorithm set supported by the NF and the callback URI of the NF
  • message 2 is used to respond to message 1 and notify the NF of successful registration.
  • the above message 2 may carry the algorithm identification of the key exchange algorithm selected by the NRF from the key exchange algorithm set supported by the NF, and when the algorithm identification is carried in the message 2, the message 3 in this embodiment is no longer required Carries the algorithm ID of the key exchange algorithm.
  • the NRF may carry the key exchange algorithm set supported by the NRF in the message 2 used to respond to the message 1, and then pass the NF A service authorization key negotiation request is sent to implement service authorization key sharing between the NRF and NF (this process is not shown in Figure 3).
  • the NRF After the NRF determines that the NF needs a service authorization key based on message 1 and returns message 2 as a response to message 1, the NRF will further send a service authorization key negotiation request (ie message 3) to the NF.
  • a service authorization key negotiation request ie message 3
  • the first key material needs to be generated according to the selected key exchange algorithm supported by the NF.
  • the following uses the DHE algorithm as an example to illustrate the generation process of the first key material.
  • the modulus P and the base G are selected.
  • P, G, private key a, public key K NRF and Kid are used as the first key material, and P, G, public key K NRF and Kid are carried in the message 3 .
  • the first key material in this embodiment further includes the algorithm identifier of the DHE algorithm
  • message 3 also carries the algorithm identifier of the DHE algorithm.
  • the NF After the NF receives the message 3 and determines that the algorithm to be used is the DHE algorithm, it can generate the second key material according to the DHE algorithm according to the message 3, and the generation process of the second key material is as follows.
  • NRF will take out the K NF in the message, calculate the service authorization key K as K NF ⁇ a(mod P) according to the DHE algorithm, and record it as the service producer The identifier of the NF, and the mapping relationship between Kid and service authorization key K.
  • the above DHE algorithm can ensure that the K calculated by the NF service producer and the NRF is consistent. So far, the NF service producer and the NRF have obtained the same K through the DHE algorithm.
  • the following describes the process of the NF serving as a service consumer requesting a service from the NF serving as a service producer corresponding to messages 5-8:
  • the NF as a service consumer when the NF as a service consumer needs to access the service provided by the NF as a service producer, it first needs to send an Access Token request message (ie, message 5) to the NRF, which at least carries the service consumer's The NF ID, the NF ID of the service producer or the type of NF requested to access, and the list of services requested to access.
  • message 5 an Access Token request message
  • NRF After receiving message 5, NRF will generate a reference token after going through the authorization check defined in the 5G standard.
  • the reference token includes Token Header and Token Body.
  • Token Body At least the NF identity of the service consumer and the service producer’s NF identifier, list of services requested to be accessed.
  • NRF will use the NF identifier of the service producer as an index to determine a target service authorization key corresponding to the NF of the service producer and the target Kid corresponding to the target service authorization key, and fill the target Kid in the reference
  • NRF will use the target service authorization key to digitally sign the reference Token to form an Access Token, and carry the Access Token in message 6 and return it to the NF as the service consumer.
  • the NF will carry the Access Token obtained from the message 6 to send the service request (ie message 7) to the NF as the service producer, and the NF receives the message 7 Afterwards, the target Kid will be obtained from the Access Token carried in message 7, and then digital signature verification will be performed on the Access Token through the target service authorization key corresponding to the target Kid, and when the digital signature verification passes, the message 8 will be used as a service consumption response
  • the service request of the NF of the reader and normally provide the service to the NF as the service consumer.
  • FIG. 4 is a schematic diagram of a network service authorization device provided by an embodiment of the present application, and the device embodiment is applied to NRF.
  • the unit includes:
  • the first message sending unit 401 is configured to generate a first key material according to an obtained key exchange algorithm supported by the NF when it is detected that the NF needs a service authorization key, and include the first key material in the
  • the public key of the NRF is carried in a first message and sent to the NF; wherein the first key material includes at least: the public key of the NRF and the private key of the NRF.
  • the second message receiving unit 402 is configured to receive a second message that the NF responds to the first message, where the second message at least carries the public key of the NF generated by the NF according to the key exchange algorithm .
  • a service authorization key generation unit 403, configured to generate a service authorization key corresponding to the NF according to the key exchange algorithm, the public key of the NF, and the private key of the NRF, and the service authorization key is related to the The service authorization key calculated by the NF based on the key exchange algorithm, the public key of the NRF, and the private key of the NF is the same; the service authorization key is used to instruct the NF to provide authorized service consumers with Internet service.
  • the first message sending unit 401 generating the first key material according to an obtained key exchange algorithm supported by the NF includes: selecting a key exchange algorithm from the set of key exchange algorithms registered by the NF Algorithm: using the selected key exchange algorithm to generate the first key material.
  • the first key material further includes: an algorithm identifier corresponding to the selected key exchange algorithm; the algorithm identifier is used to instruct the NF to generate the NF's public key according to the corresponding key exchange algorithm.
  • the first message sending unit 401 also carries the algorithm identifier corresponding to the selected key exchange algorithm in the first message.
  • the first key material further includes: a key identifier Kid corresponding to the service authorization key to be generated.
  • the device further includes :
  • a checking unit configured to check whether the Kid carried in the second message is consistent with the Kid in the first key material;
  • the key exchange algorithm, the public key of the NF and the private key of the NRF determine the service authorization key corresponding to the NF.
  • the service authorization key generating unit 403 is further configured to: record service authorization information matching the NF, where the service authorization information includes at least the service authorization key and the Kid.
  • the device further includes a service authorization request unit, configured to receive a service authorization request sent by a service consumer, where the service authorization request is used to request authorization to access a specified NF; generate a reference token, and obtain a reference token from the specified NF corresponding Select a target service authorization key from all service authorization keys, generate an Access Token based on the target service authorization key and the reference Token, and return the Access Token to the service consumer, so that the service consumer can The Access Token applies for services from the designated NF.
  • a service authorization request unit configured to receive a service authorization request sent by a service consumer, where the service authorization request is used to request authorization to access a specified NF; generate a reference token, and obtain a reference token from the specified NF corresponding Select a target service authorization key from all service authorization keys, generate an Access Token based on the target service authorization key and the reference Token, and return the Access Token to the service consumer, so that the service consumer can The Access Token applies for services from the designated NF.
  • the reference Token includes: Token Header, Token Body; the service authorization request unit generates an Access Token according to the target service authorization key and the reference Token, including:
  • FIG. 5 is a schematic diagram of another network service authorization device provided by the embodiment of the present application.
  • the device embodiment is applied to NF.
  • the unit includes:
  • the first message receiving unit 501 is configured to receive a first message sent by the NRF in response to the NF's need for a service authorization key, the first message carrying at least one key supported by the NF obtained by the NRF Exchange the public key of the NRF generated by the algorithm.
  • the second message sending unit 502 is configured to generate second key material according to the key exchange algorithm, carry the public key of the NF in the second key material in the second message, and send the message to the NRF sending; wherein, the second key material includes at least: the public key of the NF and the private key of the NF.
  • a service authorization key generation unit 503, configured to calculate a service authorization key according to the key exchange algorithm, the public key of the NRF, and the private key of the NF, the service authorization key and the NRF are based on the The service authorization key corresponding to the NF generated by the key exchange algorithm, the public key of the NF, and the private key of the NRF is the same; the service authorization key is used to indicate that the NF is an authorized service consumer Provide network services.
  • the first message also carries an algorithm identifier corresponding to the key exchange algorithm.
  • the second message sending unit 502 generating the second key material according to the key exchange algorithm includes:
  • the second key material is generated as described in the determined key exchange algorithm.
  • the first message also carries a key identifier Kid corresponding to the service authorization key to be generated.
  • the method further includes: recording the service authorization information of the NF,
  • the service authorization information includes at least the service authorization key and the Kid.
  • the device further includes a network service providing unit, configured to receive the Access Token sent by the service consumer; obtain the target Kid from the Token Heade of the Access Token, and search for the target service authorization key corresponding to the target Kid, Verify the digital signature in the Access Token according to the target service authorization key; if the verification is successful, provide network services to the service consumer based on the Access Token.
  • a network service providing unit configured to receive the Access Token sent by the service consumer; obtain the target Kid from the Token Heade of the Access Token, and search for the target service authorization key corresponding to the target Kid, Verify the digital signature in the Access Token according to the target service authorization key; if the verification is successful, provide network services to the service consumer based on the Access Token.
  • the embodiment of the present application also provides a hardware structure diagram of an electronic device, as specifically shown in FIG. 6 , the electronic device may be a device implementing the above-mentioned network service authorization method.
  • the hardware structure includes: a processor and a memory.
  • the memory is used for storing machine-executable instructions.
  • the processor is configured to read and execute the machine-executable instructions stored in the memory, so as to implement the corresponding network service authorization method embodiment as shown above.
  • memory may be any electronic, magnetic, optical, or other physical storage device that may contain or store information, such as executable instructions, data, and the like.
  • the memory may be: a volatile memory, a non-volatile memory, or a similar storage medium.
  • the memory can be RAM (Radom Access Memory, random access memory), flash memory, storage drive (such as hard disk drive), solid-state hard disk, any type of storage disk (such as optical disc, DVD, etc.), or similar storage media, or a combination of them.

Abstract

本申请实施例公开了一种网络服务授权方法、装置及电子设备。本申请中的网络存储功能网元NRF和网络功能单元NF可以通过NF支持的同一密钥交换算法，按照该密钥交换算法各自生成的密钥材料并相互交换密钥材料中的公钥，利用对方设备的公钥和自己的私钥生成相同的服务授权密钥。在该过程中，服务授权密钥是在NRF或者NF本地生成的，未曾暴露在网络中，确保了NRF和NF之间共享服务授权密钥的过程的安全。

Description

网络服务授权方法、装置及电子设备 技术领域
本申请涉及通信领域，特别涉及网络服务授权方法、装置及电子设备。
背景技术
在5G网络中，各控制面NF(Network Function，网络功能单元，简称网元)之间可以通过互相调用对方的服务化接口进行通信，其中，提供服务的NF被称为服务生产者，使用服务的NF被称为服务消费者。
同时，为了确保服务生产者的用于提供服务的服务化接口被调用的安全，5G标准中定义了在访问服务生产者的服务化接口之前，服务消费者需要先从网络中的NRF(Network Repository Function，网络存储功能网元)获取授权信息，然后服务消费者可以利用获取到的授权信息向该服务生产者申请服务，从而保证服务化接口被调用的安全。但是在上述方法中，用于生成授权信息的服务授权密钥是需要NRF和该服务生产者预共享的，而标准中并未明确NRF和服务生产者之间如何安全地共享该服务授权密钥。
发明内容
本申请公开了一种网络服务授权方法、装置及电子设备，以使NRF和作为服务生产者的NF之间安全地共享服务授权密钥。
根据本申请实施例的第一方面，提供一种网络服务授权方法，该方法应用于网络存储功能网元NRF，该方法包括：
在检测到网络功能单元NF需要第二服务授权密钥时，依据已获得的所述NF支持的一个密钥交换算法生成第一密钥材料，将所述第一密钥材料中的所述NRF的公钥携带在第一消息中并向所述NF发送；其中，所述第一密钥材料至少包括：所述NRF的公钥、所述NRF的私钥；
接收所述NF针对所述第一消息响应的第二消息，所述第二消息至少携带所述NF按照所述密钥交换算法生成的所述NF的公钥；
依据所述密钥交换算法、所述NF的公钥和所述NRF的私钥生成所述NF对应的第一服务授权密钥，所述第一服务授权密钥与所述NF基于所述密钥交换算法、所述NRF的公钥和所述NF的私钥计算的所述第二服务授权密钥相同；所述第二服务授权密钥用于指示所述NF为授权的服务消费者提供网络服务。
根据本申请实施例的第二方面，提供一种网络服务授权方法，该方法应用于网络功 能单元NF，该方法包括：
接收网络存储功能网元NRF响应所述NF对第二服务授权密钥的需要发送的第一消息，所述第一消息至少携带所述NRF按照已获得的所述NF支持的一个密钥交换算法生成的所述NRF的公钥；
依据所述密钥交换算法生成第二密钥材料，并将所述第二密钥材料中的所述NF的公钥携带在第二消息中并向所述NRF发送；其中，所述第二密钥材料至少包括：所述NF的公钥、所述NF的私钥；
依据所述密钥交换算法、所述NRF的公钥和所述NF的私钥计算所述第二服务授权密钥，所述第二服务授权密钥与所述NRF基于所述密钥交换算法、所述NF的公钥和所述NRF的私钥生成的所述NF对应的第一服务授权密钥相同；所述第二服务授权密钥用于指示所述NF为授权的服务消费者提供网络服务。
根据本申请实施例的第三方面，提供一种网络服务授权装置，该装置应用于网络存储功能网元NRF，该装置包括：
第一消息发送单元，用于在检测到网络功能单元NF需要第二服务授权密钥时，依据已获得的所述NF支持的一个密钥交换算法生成第一密钥材料，将所述第一密钥材料中的所述NRF的公钥携带在第一消息中并向所述NF发送；其中，所述第一密钥材料至少包括：所述NRF的公钥、所述NRF的私钥；
第二消息接收单元，用于接收所述NF针对所述第一消息响应的第二消息，所述第二消息至少携带所述NF按照所述密钥交换算法生成的所述NF的公钥；
服务授权密钥生成单元，用于依据所述密钥交换算法、所述NF的公钥和所述NRF的私钥生成所述NF对应的第一服务授权密钥，所述第一服务授权密钥与所述NF基于所述密钥交换算法、所述NRF的公钥和所述NF的私钥计算的所述第二服务授权密钥相同；所述第二服务授权密钥用于指示所述NF为授权的服务消费者提供网络服务。
根据本申请实施例的第四方面，提供一种网络服务授权装置，该装置应用于网络功能单元NF，该装置包括：
第一消息接收单元，用于接收网络存储功能网元NRF响应所述NF对第二服务授权密钥的需要发送的第一消息，所述第一消息至少携带所述NRF按照已获得的所述NF支持的一个密钥交换算法生成的所述NRF的公钥；
第二消息发送单元，用于依据所述密钥交换算法生成第二密钥材料，并将所述第二密钥材料中的所述NF的公钥携带在第二消息中并向所述NRF发送；其中，所述第二密钥材料至少包括：所述NF的公钥、所述NF的私钥；
服务授权密钥生成单元，用于依据所述密钥交换算法、所述NRF的公钥和所述NF的私钥计算所述第二服务授权密钥，所述第二服务授权密钥与所述NRF基于所述密钥交换算法、所述NF的公钥和所述NRF的私钥生成的所述NF对应的第一服务授权密钥相同；所述第二服务授权密钥用于指示所述NF为授权的服务消费者提供网络服务。
根据本申请实施例的第五方面，提供一种电子设备，该电子设备包括：处理器和存储器；
所述存储器，用于存储机器可执行指令；
所述处理器，用于读取并执行所述存储器存储的机器可执行指令，以实现如上所述的网络服务授权方法。
本申请的实施例提供的技术方案可以包括以下有益效果：
由以上技术方案可知，本申请提供的方案中的NRF和NF可以通过NF支持的同一密钥交换算法，按照该密钥交换算法各自生成的密钥材料并相互交换密钥材料中的公钥，利用对方设备的公钥和自己的私钥生成相同的服务授权密钥。在该过程中，服务授权密钥是在NRF或者NF本地生成的，未曾暴露在网络中，确保了NRF和NF之间共享服务授权密钥的过程的安全。
应当理解的是，以上的一般描述和后文的细节描述仅是示例性和解释性的，并不能限制本申请。
附图说明
此处的附图被并入说明书中并构成本说明书的一部分，示出了符合本说明书的实施例，并与说明书一起用于解释本说明书的原理。
图1是本申请实施例提供的一种网络服务授权的方法流程图；
图2是本申请实施例提供的另一种网络服务授权的方法流程图；
图3是本申请实施例提供的应用网络服务授权方法的流程示意图；
图4是本申请实施例提供的一种网络服务授权的装置示意图；
图5是本申请实施例提供的另一种网络服务授权的装置示意图；
图6是本申请实施例提供的一种电子设备的硬件结构示意图。
具体实施方式
这里将详细地对示例性实施例进行说明，其示例表示在附图中。下面的描述涉及附图时，除非另有表示，不同附图中的相同数字表示相同或相似的要素。以下示例性实施例中所描述的实施方式并不代表与本申请相一致的所有实施方式。相反，它们仅是与如 所附权利要求书中所详述的、本申请的一些方面相一致的装置和方法的例子。
在本申请使用的术语是仅仅出于描述特定实施例的目的，而非旨在限制本申请。在本申请和所附权利要求书中所使用的单数形式的“一种”、“所述”和“该”也旨在包括多数形式，除非上下文清楚地表示其他含义。还应当理解，本文中使用的术语“和/或”是指并包含一个或多个相关联的列出项目的任何或所有可能组合。
应当理解，尽管在本申请可能采用术语第一、第二、第三等来描述各种信息，但这些信息不应限于这些术语。这些术语仅用来将同一类型的信息彼此区分开。例如，在不脱离本申请范围的情况下，第一信息也可以被称为第二信息，类似地，第二信息也可以被称为第一信息。取决于语境，如在此所使用的词语“如果”可以被解释成为“在……时”或“当……时”或“响应于确定”。
为了使本领域技术人员更好地理解本申请实施例提供的技术方案，并使本申请实施例的上述目的、特征和优点能够更加明显易懂，下面结合附图对本申请实施例中技术方案作进一步详细的说明。
参见图1，图1为本申请实施例提供的一种网络服务授权的方法流程图。作为一个实施例，该方法可以应用于5G网络中，并具体应用于5G网络中的网络存储功能网元NRF。
如图1所示，该流程可以包括以下步骤：
步骤101，在检测到网络功能单元NF需要服务授权密钥时，依据已获得的所述NF支持的一个密钥交换算法生成第一密钥材料，将所述第一密钥材料中的所述NRF的公钥携带在第一消息中并向所述NF发送；其中，所述第一密钥材料至少包括：所述NRF的公钥、所述NRF的私钥。
作为一个实施例，本步骤中检测到NF需要服务授权密钥包括多种情况。例如，接收到NF发送的注册请求消息时，确定NF需要服务授权密钥，其中，该注册请求消息中可以携带NF支持的密钥交换算法集以及NF的回调URI(Uniform Resource Identifier，统一资源标识符，用于定位NF)；或者，接收到NF发送的服务授权密钥协商请求时，确定NF需要服务授权密钥；或者，若NRF中预先设置了NF对应的服务授权密钥的生命周期，则在确定NF对应的服务授权密钥的生命周期结束时，确定NF需要服务授权密钥。以上几种检测到NF需要服务授权密钥的情况只是举例，本申请对此不做限定。
作为一个实施例，在确定NF需要服务授权密钥之后，本NRF可以通过多种方式获取NF支持的一个密钥交换算法。
方式一：本NRF可以从该NF注册的密钥交换算法集中选择一个密钥交换算法，进 而利用选择出的该密钥交换算法生成第一密钥材料。其中，本实施例中的第一密钥材料除了NRF的公钥、NRF的私钥之外，还可以包括上述选择出的密钥交换算法对应的算法标识。
方式二：当接收到NF发送的注册请求消息时，在用于响应注册请求消息的注册响应消息中携带本NRF支持的密钥交换算法集，进而可以使NF依据接收到的注册响应消息确定一个NRF和NF都支持的密钥交换算法，NRF则可以依据接收到的NF发送的服务授权密钥协商请求中携带的算法标识选择一个NF支持的密钥交换算法。
基于上述包含算法标识的第一密钥材料，本实施例中NRF发送给NF的第一消息中不仅携带了NRF的公钥，还携带了上述的算法标识。通过接收到的第一消息中携带的算法标识，本实施例中的NF可以按照该算法标识对应的密钥交换算法生成第二密钥材料。
作为另一个实施例，为了便于验证NF针对所述第一消息响应的第二消息是否为针对本次服务授权密钥的共享而返回的，NRF还可以为本次即将生成的服务授权密钥设置对应的密钥标识Kid，并将该Kid纳入第一密钥材料，本实施例中可以将该Kid也携带在第一消息中并发送给NF。
步骤102，接收所述NF针对所述第一消息响应的第二消息，所述第二消息至少携带所述NF按照所述密钥交换算法生成的所述NF的公钥。
作为一个实施例，若本实施例中NRF为本次即将生成的服务授权密钥设置对应的密钥标识Kid，即上述第一密钥材料中包括为即将生成的服务授权密钥对应设置的密钥标识Kid，则本实施例中在接收到第二消息之后，可以通过检测的第二消息中携带的密钥标识Kid与第一密钥材料中的Kid是否一致，在检测结果为一致的情况下，确定第二消息通过验证，并继续执行步骤103。
步骤103，依据所述密钥交换算法、所述NF的公钥和所述NRF的私钥生成所述NF对应的服务授权密钥，所述服务授权密钥与所述NF基于所述密钥交换算法、所述NRF的公钥和所述NF的私钥计算的服务授权密钥相同；所述服务授权密钥用于指示所述NF为授权的服务消费者提供网络服务。
本申请实施例中，在依据所述密钥交换算法、所述NF的公钥和所述NRF的私钥确定服务授权密钥之后，NRF可以进一步记录与该NF匹配的服务授权信息，该NF的服务授权信息中至少包括NF对应的服务授权密钥、和该服务授权密钥Kid。需要说明的是，本实施例中可以通过记录该NF的标识与服务授权信息之间的映射关系，实现记录与该NF匹配的服务授权信息。
可选的，本实施例中可以根据上述实施例在NRF中为一个NF生成一个或者多个服务授权密钥。若本实施例中为一个NF生成多个服务授权密钥，则可以将该多个服务授权密钥构成一个服务授权密钥集，并通过Kid区分各个服务授权密钥，以进一步加强NF作为服务生产者时的安全保证。
示例性的，NRF中可以通过以下方式记录NF对应的服务授权密钥集：{NF标识：[{Kid1：K1}，{Kid2：K2}，…，{Kidn：Kn}]}，其中，K1～Kn为服务授权密钥。上述{}表示一对映射关系，[]表示相同对象的一个列表。
进一步的，本实施例中为一个NF生成多个服务授权密钥还可以与该NF所提供的不同服务一一对应，以便NF可以依据服务消费者发送的接入令牌Access Token中携带的Kid快速确定该服务消费者所申请的服务。
在本申请实施例中，在上述NRF确定了所述NF对应的服务授权密钥之后，该服务授权密钥就可以用于授权服务消费者向NF申请网络服务，服务的具体申请过程可以包括以下步骤：
步骤a，当接收到服务消费者发送的服务授权请求时，可以先通过该服务授权请求确定服务消费者请求授权访问的指定NF。需要说明的是，服务消费者发送的服务授权请求中至少携带了服务消费者标识、指定NF的标识或者请求访问的NF类型、请求访问的服务列表，则本实施例中可以通过服务授权请求中的指定NF的标识确定指定NF，或者根据请求授权访问的NF类型，从属于该类NF的多个NF中选择一个NF确定为指定NF。这里根据NF类型确定指定NF的过程可以参照相关技术，例如可以通过NF的负载、权重等确定，本申请对此不做限定。
步骤b，生成参考Token，并从所述指定NF对应的所有服务授权密钥中选择一个目标服务授权密钥，依据所述目标服务授权密钥和所述参考Token生成Access Token，并向所述服务消费者返回Access Token，以使所述服务消费者依据所述Access Token向所述指定NF申请服务。
本实施例中生成的参考Token中至少包括：服务消费者标识、指定NF的标识和请求访问的服务列表。
可选的，若本实施例中指定NF对应多个服务授权密钥，并且指定NF对应的多个服务授权密钥是与指定NF所提供的服务一一对应的，则可以根据上述获取的服务列表确定服务消费者申请的服务对应的服务授权密钥，将该服务授权密钥作为目标服务授权密钥。
作为一个实施例，本实施例中依据所述目标服务授权密钥和所述参考Token生成 Access Token可以通过以下方式：
首选，需要说明的是，本实施例中的参考Token包括：令牌头Token Header、令牌体Token Body。基于该参考Token，本实施例中可以将目标服务授权密钥对应的目标Kid填写到所述Token Header中，使用所述目标服务授权密钥对所述参考Token进行数字签名，进而得到所述Access Token。
作为一个实施例，使用所述目标服务授权密钥对所述参考Token进行数字签名可以通过目标服务授权密钥对整个参考Token或者参考Token中的Token Body进行加密，然后将加密后的密文附在参考Token的末尾以形成Access Token。
至此，完成图1所示流程。
通过图1所示的流程可以看出，NRF和NF可以通过NF支持的同一密钥交换算法，按照该密钥交换算法各自生成的密钥材料并相互交换密钥材料中的公钥，利用对方设备的公钥和自己的私钥生成相同的服务授权密钥。在该过程中，服务授权密钥是在NRF或者NF本地生成的，未曾暴露在网络中，确保了NRF和NF之间共享服务授权密钥的过程的安全。
以上举例只是为了便于理解，本申请实施例并不具体限定。
下面请参见图2，图2为本申请实施例提供的另一种网络服务授权的方法流程图。作为另一个实施例，图2所示的流程可以应用于NF。
步骤201，接收NRF响应所述NF对服务授权密钥的需要发送的第一消息，所述第一消息至少携带所述NRF按照已获得的所述NF支持的一个密钥交换算法生成的所述NRF的公钥。
步骤202，依据所述密钥交换算法生成第二密钥材料，并将所述第二密钥材料中的所述NF的公钥携带在第二消息中并向所述NRF发送；其中，所述第二密钥材料至少包括：所述NF的公钥、所述NF的私钥。
作为一个实施例，上述NF接收到的第一消息中还可以携带了密钥交换算法对应的算法标识，因此，本实施例中NF可以依据该算法标识从NF本地的密钥交换算法集中确定密钥交换算法，并按照确定出的密钥交换算法所述生成第二密钥材料。
步骤203，依据所述密钥交换算法、所述NRF的公钥和所述NF的私钥计算所述服务授权密钥，所述服务授权密钥与所述NRF基于所述密钥交换算法、所述NF的公钥和所述NRF的私钥生成的所述NF对应的服务授权密钥相同；所述服务授权密钥用于指示所述NF为授权的服务消费者提供网络服务。
作为一个实施例，上述NF接收到的第一消息中还可以携带即将生成的服务授权密 钥对应的密钥标识Kid，从而在NF依据所述密钥交换算法、所述NRF的公钥和所述NF的私钥确定所述NF对应的服务授权密钥之后，NF可以进一步在本地记录服务授权信息，该服务授权信息至少包括上述生成的服务授权密钥和其对应的Kid。
可选的，在本申请实施例NF可以依据上述方法生成一个或者多个服务授权密钥。若本实施例中NF生成了多个服务授权密钥，则可以将该多个服务授权密钥构成一个服务授权密钥集并保存在本地，并通过从NRF处获取到的Kid区分各个服务授权密钥，以进一步加强NF作为服务生产者时的安全保证。
示例性的，NF中记录的服务授权密钥集可以通过以下方式记录：[{Kid1：K1}，{Kid2：K2}，…，{Kidn：Kn}]。这里的{}表示一对映射关系，[]表示相同对象的一个列表，K1～Kn为服务授权密钥。
进一步的，在上述NF确定了本NF的服务授权密钥之后，该服务授权密钥就可以用于授权服务消费者向NF申请网络服务，服务的具体申请过程可以包括以下步骤：
步骤c，接收服务消费者发送的Access Token；
步骤d，从所述Access Token的Token Header中获取目标Kid，查找所述目标Kid对应的目标服务授权密钥，依据所述目标服务授权密钥对所述Access Token中的数字签名进行验证。
本实施例中依据所述目标服务授权密钥对所述Access Token中的数字签名进行验证是指：通过目标服务授权密钥对所述Access Token中的明文进行加密，将加密后得到的密文和Access Token中的密文进行对比。
步骤e，若验证成功，则依据所述Access Token向所述服务消费者提供网络服务。
作为一个实施例，当上述通过目标服务授权密钥对所述Access Token中的明文进行加密，将加密后得到的密文和Access Token中的密文一致时，可以确定对服务消费者的验证成功。
至此，完成图2所示流程。
通过图2所示的流程可以看出，NRF和NF可以通过NF支持的同一密钥交换算法，按照该密钥交换算法各自生成的密钥材料并相互交换密钥材料中的公钥，利用对方设备的公钥和自己的私钥生成相同的服务授权密钥。在该过程中，服务授权密钥是在NRF或者NF本地生成的，未曾暴露在网络中，确保了NRF和NF之间共享服务授权密钥的过程的安全。
需要说明的是，上述NRF和NF之间可以通过HTTP或者HTTPS进行通信，即上述第一消息和第二消息的格式符合HTTP或者HTTPS协议。上述的密钥交换算法可以 包括DHE(临时-迪菲-赫尔曼算法)、ECDHE(临时-椭圆曲线-迪菲-赫尔曼算法)等可以通过使用对方的公钥和自己的私钥各自生成相同的密钥的算法。
以及在本申请实施例中，NRF和NF都生成了服务授权密钥之后，可以由NRF通过服务授权密钥生成一个数字签名并发送给NF，以使NF通过本地记录的服务授权密钥对该数字签名进行验证。其中，该数字签名中可以包括NRF所使用的服务授权密钥的Kid、NF的标识等。
以上对本申请的方法实施例进行了描述，下面以应用于5G网络中为例，结合图3对应用上述方法实施例的具体实施例进行描述：
如图3所示，图3中的消息1-4为NRF和作为服务生产者的NF共享服务授权密钥的过程，消息5-8为作为服务消费者的NF向作为服务生产者的NF请求服务的过程。
在本实施中，NRF确定NF需要服务授权密钥是通过接收到的NF发送的消息1确定的，该消息1为NF发送的注册请求消息。NRF确定NF需要服务授权密钥可以通过多种方式，这里只是为了便于理解，以NF发送的注册请求消息触发为例进行描述。
可选的，若消息1中可以携带NF支持的密钥交换算法集以及NF的回调URI，消息2则是用于响应消息1，通知NF注册成功。
则进一步的，上述消息2中可以携带NRF从NF支持的密钥交换算法集中选择的密钥交换算法的算法标识，而当消息2中携带算法标识时，本实施例中的消息3不再需要携带密钥交换算法的算法标识。
可选的，若该消息1中不包括NF支持的密钥交换算法集，则本实施例中NRF可以在用于响应消息1的消息2中携带NRF支持的密钥交换算法集，进而通过NF发送服务授权密钥协商请求，来实现NRF和NF之间的服务授权密钥共享(该过程并未在图3中显示)。
在NRF基于消息1确定NF需要服务授权密钥并返回了作为消息1的响应的消息2之后，NRF将进一步向NF发送服务授权密钥协商请求(即消息3)。
需要说明的是，在NRF发送消息3之前，需要依据上述选择的NF支持的密钥交换算法生成第一密钥材料，下面以DHE算法为例说明第一密钥材料的生成过程。
依据DHE算法要求，选择出模数P和底数G，P和G可以是NRF中预先设置的或者由NRF随机选择，然后随机生成NRF的私钥a，然后通过公式K NRF＝G^a(mod P)计算出公钥K NRF，并为即将生成的服务授权密钥分配密钥标识Kid。
然后将上述P、G、私钥a、公钥K NRF和Kid作为第一密钥材料，将其中的P、G、公钥K NRF和Kid携带在消息3中。
可选的，若消息2中未携带DHE算法的算法标识，则本实施例中第一密钥材料还包括DHE算法的算法标识，则消息3中也会携带DHE算法的算法标识。
在NF接收到消息3并确定了要使用的算法为DHE算法之后，可以根据消息3按照DHE算法生成第二密钥材料，该第二密钥材料的生成过程如下。
依据DHE算法的要求，随机生成一个NF的私钥b，然后根据消息3中携带的模数P、底数G，以及公式K NF＝G^b(mod P)生成NF的公钥K NF，以及计算出本NF的服务授权密钥K为K NRF^b(mod P)，并记录Kid和服务授权密钥K的映射关系。
然后将上述私钥b、公钥K NF和从消息3中获取的Kid作为第二密钥材料，将其中的公钥K NF和Kid携带在消息4中，以将消息4作为消息3相应的服务授权密钥协商响应消息并发送给NRF。
进一步的，NRF收到服务授权密钥协商响应消息后，将取出消息中的K NF，依据DHE算法，计算得到服务授权密钥K为K NF^a(mod P)，并记录作为服务生产者的该NF的标识、以及上述Kid和服务授权密钥K的映射关系。
需要说明的是，上述DHE算法可以确保NF服务生产者和NRF计算得到的K是一致的，至此，NF服务生产者和NRF通过DHE算法得到了相同的K。
下面对消息5-8对应的作为服务消费者的NF向作为服务生产者的NF请求服务的过程进行描述：
本实施例中，作为服务消费者的NF需要访问作为服务生产者的NF提供的服务时，首先需要发送Access Token请求消息(即消息5)到NRF，该消息5中至少携带了服务消费者的NF标识、服务生产者的NF标识或者请求访问的NF类型、请求访问的服务列表。
NRF在接收到消息5之后，将经过5G标准中定义的授权检查后生成参考Token，该参考Token包括Token Header和Token Body，在Token Body中至少记载了服务消费者的NF标识、服务生产者的NF标识、请求访问的服务列表。然后NRF将以服务生产者的NF标识为索引，确定出一个作为服务生产者的NF对应的目标服务授权密钥，以及目标服务授权密钥对应的目标Kid，并将该目标Kid填写在该参考Token的Token Header中，最后，NRF将使用目标服务授权密钥对参考Token进行数字签名以形成Access Token，并将Access Token携带在消息6中返回给作为服务消费者的NF。
进一步的，在作为服务消费者的NF接收到消息6之后，NF将携带从消息6中获取的Access Token向作为服务生产者的NF发送服务请求(即消息7)，而NF在接收到消息7之后，将从消息7中携带的Access Token中获取目标Kid，然后通过目标Kid对 应的目标服务授权密钥对Access Token进行数字签名验证，并在数字签名验证通过时，通过消息8响应作为服务消费者的NF的服务请求，并向作为服务消费者的NF正常提供服务。
以上对本申请实施例提供的方法进行了描述。下面对本申请实施例提供的装置进行描述：
参见图4，图4为本申请实施例提供的一种网络服务授权的装置示意图，该装置实施例应用于NRF。该装置包括：
第一消息发送单元401，用于在检测到NF需要服务授权密钥时，依据已获得的所述NF支持的一个密钥交换算法生成第一密钥材料，将所述第一密钥材料中的所述NRF的公钥携带在第一消息中并向所述NF发送；其中，所述第一密钥材料至少包括：所述NRF的公钥、所述NRF的私钥。
第二消息接收单元402，用于接收所述NF针对所述第一消息响应的第二消息，所述第二消息至少携带所述NF按照所述密钥交换算法生成的所述NF的公钥。
服务授权密钥生成单元403，用于依据所述密钥交换算法、所述NF的公钥和所述NRF的私钥生成所述NF对应的服务授权密钥，所述服务授权密钥与所述NF基于所述密钥交换算法、所述NRF的公钥和所述NF的私钥计算的服务授权密钥相同；所述服务授权密钥用于指示所述NF为授权的服务消费者提供网络服务。
可选的，所述第一消息发送单元401依据已获得的所述NF支持的一个密钥交换算法生成第一密钥材料包括：从所述NF注册的密钥交换算法集中选择一个密钥交换算法；利用选择出的密钥交换算法生成第一密钥材料。
所述第一密钥材料还包括：选择出的密钥交换算法对应的算法标识；所述算法标识用于指示所述NF按照对应的密钥交换算法生成所述NF的公钥。
所述第一消息发送单元401还将所述选择出的密钥交换算法对应的算法标识携带在所述第一消息中。
可选的，所述第一密钥材料还包括：即将生成的服务授权密钥对应的密钥标识Kid。
若所述第二消息携带所述Kid，则在依据所述密钥交换算法、所述NF的公钥和所述NRF的私钥生成所述NF对应的服务授权密钥之前，该装置进一步包括：
检验单元，用于检验所述第二消息携带的Kid与所述第一密钥材料中的Kid是否一致，在检测结果为一致的情况下，确定第二消息通过验证，并继续执行依据所述密钥交换算法、所述NF的公钥和所述NRF的私钥确定所述NF对应的服务授权密钥的步骤。
可选的，在服务授权密钥生成单元403依据所述密钥交换算法、所述NF的公钥和 所述NRF的私钥生成所述NF对应的服务授权密钥之后，该服务授权密钥生成单元403进一步用于：记录与所述NF匹配的服务授权信息，所述服务授权信息中至少包括所述服务授权密钥、所述Kid。
可选的，该装置进一步包括服务授权请求单元，用于接收服务消费者发送的服务授权请求，所述服务授权请求用于请求授权访问指定NF；生成参考Token，并从所述指定NF对应的所有服务授权密钥中选择一个目标服务授权密钥，依据所述目标服务授权密钥和所述参考Token生成Access Token，并向所述服务消费者返回Access Token，以使所述服务消费者依据所述Access Token向所述指定NF申请服务。
可选的，所述参考Token包括：Token Header、Token Body；所述服务授权请求单元依据所述目标服务授权密钥和所述参考Token生成Access Token，包括：
将所述目标服务授权密钥对应的目标Kid填写到所述Token Header中，使用所述目标服务授权密钥对所述参考Token进行数字签名，得到所述Access Token。
至此，完成图4所示装置实施例的结构图。
下面请参见图5，图5为本申请实施例提供的另一种网络服务授权的装置示意图，该装置实施例应用于NF。该装置包括：
第一消息接收单元501，用于接收NRF响应所述NF对服务授权密钥的需要发送的第一消息，所述第一消息至少携带所述NRF按照已获得的所述NF支持的一个密钥交换算法生成的所述NRF的公钥。
第二消息发送单元502，用于依据所述密钥交换算法生成第二密钥材料，并将所述第二密钥材料中的所述NF的公钥携带在第二消息中并向所述NRF发送；其中，所述第二密钥材料至少包括：所述NF的公钥、所述NF的私钥。
服务授权密钥生成单元503，用于依据所述密钥交换算法、所述NRF的公钥和所述NF的私钥计算的服务授权密钥，所述服务授权密钥与所述NRF基于所述密钥交换算法、所述NF的公钥和所述NRF的私钥生成的所述NF对应的服务授权密钥相同；所述服务授权密钥用于指示所述NF为授权的服务消费者提供网络服务。
可选的，所述第一消息中还携带了密钥交换算法对应的算法标识。
所述第二消息发送单元502依据所述密钥交换算法生成第二密钥材料包括：
依据所述第一消息中密钥交换算法对应的算法标识从所述NF本地的密钥交换算法集中确定密钥交换算法；
按照确定出的密钥交换算法所述生成第二密钥材料。
可选的，所述第一消息中还携带了即将生成的服务授权密钥对应的密钥标识Kid。
所述服务授权密钥生成单元503依据所述密钥交换算法、所述NRF的公钥和所述NF的私钥计算服务授权密钥之后，该方法进一步包括：记录本NF的服务授权信息，所述服务授权信息至少包括所述服务授权密钥、所述Kid。
可选的，该装置进一步包括网络服务提供单元，用于接收服务消费者发送的Access Token；从所述Access Token的Token Heade中获取目标Kid，查找所述目标Kid对应的目标服务授权密钥，依据所述目标服务授权密钥对所述Access Token中的数字签名进行验证；若验证成功，则依据所述Access Token向所述服务消费者提供网络服务。
至此，完成图5所示装置实施例的结构图。
对应地，本申请实施例还提供了一种电子设备的硬件结构图，具体如图6所示，该电子设备可以为实施上述网络服务授权方法的设备。如图6所示，该硬件结构包括：处理器和存储器。
其中，所述存储器，用于存储机器可执行指令。
所述处理器，用于读取并执行所述存储器存储的机器可执行指令，以实现如上所示的所对应的网络服务授权的方法实施例。
作为一个实施例，存储器可以是任何电子、磁性、光学或其它物理存储装置，可以包含或存储信息，如可执行指令、数据，等等。例如，存储器可以是：易失存储器、非易失性存储器或者类似的存储介质。具体地，存储器可以是RAM(Radom Access Memory，随机存取存储器)、闪存、存储驱动器(如硬盘驱动器)、固态硬盘、任何类型的存储盘(如光盘、DVD等)，或者类似的存储介质，或者它们的组合。
至此，完成图6所示电子设备的描述。
以上所述仅为本申请的较佳实施例而已，并不用以限制本申请，凡在本申请的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本申请保护的范围之内。

Claims (13)

  1. 一种网络服务授权方法，其特征在于，该方法应用于网络存储功能网元NRF，该方法包括：
    在检测到网络功能单元NF需要第二服务授权密钥时，依据已获得的所述NF支持的一个密钥交换算法生成第一密钥材料，将所述第一密钥材料中的所述NRF的公钥携带在第一消息中并向所述NF发送；其中，所述第一密钥材料至少包括：所述NRF的公钥、所述NRF的私钥；
    接收所述NF针对所述第一消息响应的第二消息，所述第二消息至少携带所述NF按照所述密钥交换算法生成的所述NF的公钥；
    依据所述密钥交换算法、所述NF的公钥和所述NRF的私钥生成所述NF对应的第一服务授权密钥，所述第一服务授权密钥与所述NF基于所述密钥交换算法、所述NRF的公钥和所述NF的私钥计算的所述第二服务授权密钥相同；所述第二服务授权密钥用于指示所述NF为授权的服务消费者提供网络服务。
  2. 根据权利要求1所述的方法，其特征在于，
    所述依据已获得的所述NF支持的一个密钥交换算法生成第一密钥材料包括：
    从所述NF注册的密钥交换算法集中选择一个密钥交换算法；
    利用选择出的密钥交换算法生成第一密钥材料；
    所述第一密钥材料还包括：选择出的密钥交换算法对应的算法标识；所述算法标识用于指示所述NF按照对应的密钥交换算法生成所述NF的公钥；
    该方法还包括：
    将所述选择出的密钥交换算法对应的算法标识携带在所述第一消息中。
  3. 根据权利要求1或2所述的方法，其特征在于，所述第一密钥材料还包括：即将生成的所述第一服务授权密钥对应的第一密钥标识Kid；
    若所述第二消息携带第二Kid，则在依据所述密钥交换算法、所述NF的公钥和所述NRF的私钥生成所述NF对应的所述第一服务授权密钥之前，该方法进一步包括：
    检验所述第二消息携带的所述第二Kid与所述第一密钥材料中的所述第一Kid是否一致，在检测结果为一致的情况下，确定所述第二消息通过验证，并继续执行依据所述密钥交换算法、所述NF的公钥和所述NRF的私钥确定所述NF对应的所述第一服务授权密钥的步骤。
  4. 根据权利要求3所述的方法，其特征在于，在依据所述密钥交换算法、所述NF的公钥和所述NRF的私钥生成所述NF对应的所述第一服务授权密钥之后，该方法进一 步包括：记录与所述NF匹配的服务授权信息，所述服务授权信息中至少包括所述第一服务授权密钥、所述第一Kid。
  5. 根据权利要求1-4任一所述的方法，其特征在于，该方法进一步包括：
    接收服务消费者发送的服务授权请求，所述服务授权请求用于请求授权访问所述NF；
    生成参考令牌Token，并从所述NF对应的所有服务授权密钥中选择一个目标服务授权密钥，依据所述目标服务授权密钥和所述参考Token生成接入令牌Access Token，并向所述服务消费者返回Access Token，以使所述服务消费者依据所述Access Token向所述NF申请服务。
  6. 根据权利要求5所述的方法，其特征在于，所述参考Token包括：令牌头Token Header、令牌体Token Body；
    所述依据所述目标服务授权密钥和所述参考Token生成所述Access Token，包括：
    将所述目标服务授权密钥对应的目标Kid填写到所述Token Header中，使用所述目标服务授权密钥对所述参考Token进行数字签名，得到所述Access Token。
  7. 一种网络服务授权方法，其特征在于，该方法应用于网络功能单元NF，该方法包括：
    接收网络存储功能网元NRF响应所述NF对第二服务授权密钥的需要发送的第一消息，所述第一消息至少携带所述NRF按照已获得的所述NF支持的一个密钥交换算法生成的所述NRF的公钥；
    依据所述密钥交换算法生成第二密钥材料，并将所述第二密钥材料中的所述NF的公钥携带在第二消息中并向所述NRF发送；其中，所述第二密钥材料至少包括：所述NF的公钥、所述NF的私钥；
    依据所述密钥交换算法、所述NRF的公钥和所述NF的私钥计算所述第二服务授权密钥，所述第二服务授权密钥与所述NRF基于所述密钥交换算法、所述NF的公钥和所述NRF的私钥生成的所述NF对应的第一服务授权密钥相同；所述第二服务授权密钥用于指示所述NF为授权的服务消费者提供网络服务。
  8. 根据权利要求7所述的方法，其特征在于，所述第一消息中还携带了密钥交换算法对应的算法标识；
    所述依据所述密钥交换算法生成第二密钥材料包括：
    依据所述第一消息中密钥交换算法对应的算法标识从所述NF本地的密钥交换算法集中确定所述密钥交换算法；
    按照确定出的所述密钥交换算法所述生成第二密钥材料。
  9. 根据权利要求7或8所述的方法，其特征在于，所述第一消息中还携带了即将生成的第一服务授权密钥对应的第一密钥标识Kid；
    所述依据所述密钥交换算法、所述NRF的公钥和所述NF的私钥计算所述第二服务授权密钥之后，该方法进一步包括：记录本NF的服务授权信息，所述服务授权信息至少包括所述第二服务授权密钥、所述第一Kid。
  10. 根据权利要求7-9任一所述的方法，其特征在于，该方法进一步包括：
    接收服务消费者发送的接入令牌Access Token；
    从所述Access Token的令牌头Token Heade中获取目标Kid，查找所述目标Kid对应的目标服务授权密钥，依据所述目标服务授权密钥对所述Access Token中的数字签名进行验证；
    若验证成功，则依据所述Access Token向所述服务消费者提供网络服务。
  11. 一种网络服务授权装置，其特征在于，该装置应用于网络存储功能网元NRF，该装置包括：
    第一消息发送单元，用于在检测到网络功能单元NF需要第二服务授权密钥时，依据已获得的所述NF支持的一个密钥交换算法生成第一密钥材料，将所述第一密钥材料中的所述NRF的公钥携带在第一消息中并向所述NF发送；其中，所述第一密钥材料至少包括：所述NRF的公钥、所述NRF的私钥；
    第二消息接收单元，用于接收所述NF针对所述第一消息响应的第二消息，所述第二消息至少携带所述NF按照所述密钥交换算法生成的所述NF的公钥；
    服务授权密钥生成单元，用于依据所述密钥交换算法、所述NF的公钥和所述NRF的私钥生成所述NF对应的第一服务授权密钥，所述第一服务授权密钥与所述NF基于所述密钥交换算法、所述NRF的公钥和所述NF的私钥计算的所述第二服务授权密钥相同；所述第二服务授权密钥用于指示所述NF为授权的服务消费者提供网络服务。
  12. 一种网络服务授权装置，其特征在于，该装置应用于网络功能单元NF，该装置包括：
    第一消息接收单元，用于接收网络存储功能网元NRF响应所述NF对第二服务授权密钥的需要发送的第一消息，所述第一消息至少携带所述NRF按照已获得的所述NF支持的一个密钥交换算法生成的所述NRF的公钥；
    第二消息发送单元，用于依据所述密钥交换算法生成第二密钥材料，并将所述第二密钥材料中的所述NF的公钥携带在第二消息中并向所述NRF发送；其中，所述第二密 钥材料至少包括：所述NF的公钥、所述NF的私钥；
    服务授权密钥生成单元，用于依据所述密钥交换算法、所述NRF的公钥和所述NF的私钥计算所述第二服务授权密钥，所述第二服务授权密钥与所述NRF基于所述密钥交换算法、所述NF的公钥和所述NRF的私钥生成的所述NF对应的第一服务授权密钥相同；所述第二服务授权密钥用于指示所述NF为授权的服务消费者提供网络服务。
  13. 一种电子设备，其特征在于，该电子设备包括：处理器和存储器；
    所述存储器，用于存储机器可执行指令；
    所述处理器，用于读取并执行所述存储器存储的机器可执行指令，以实现如权利要求1到6任一项所述的方法或者如权利要求7到10任一项所述的方法。
PCT/CN2022/119877 2021-09-29 2022-09-20 网络服务授权方法、装置及电子设备 WO2023051316A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111155028.9 2021-09-29
CN202111155028.9A CN113825134A (zh) 2021-09-29 2021-09-29 一种网络服务授权方法、装置及设备

Publications (1)

Publication Number Publication Date
WO2023051316A1 true WO2023051316A1 (zh) 2023-04-06

Family

ID=78915961

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/119877 WO2023051316A1 (zh) 2021-09-29 2022-09-20 网络服务授权方法、装置及电子设备

Country Status (2)

Country Link
CN (1) CN113825134A (zh)
WO (1) WO2023051316A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113825134A (zh) * 2021-09-29 2021-12-21 新华三技术有限公司 一种网络服务授权方法、装置及设备

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101150849A (zh) * 2006-09-18 2008-03-26 华为技术有限公司 生成绑定管理密钥的方法、系统、移动节点及通信节点
CN106533662A (zh) * 2016-11-03 2017-03-22 北京奇虎科技有限公司 一种传输网络安全密钥的方法与装置
WO2019246206A1 (en) * 2018-06-20 2019-12-26 Iot And M2M Technologies, Llc An ecdhe key exchange for server authentication and a key server
WO2021140272A1 (en) * 2020-01-10 2021-07-15 Nokia Technologies Oy Verification of access tokens with network repository functions in core networks
WO2021165925A1 (en) * 2020-02-20 2021-08-26 Nokia Technologies Oy Key management
CN113825134A (zh) * 2021-09-29 2021-12-21 新华三技术有限公司 一种网络服务授权方法、装置及设备

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9306744B2 (en) * 2014-03-10 2016-04-05 Gazoo, Inc. Video cryptography system and method
CN109379206B (zh) * 2017-08-07 2022-04-22 华为技术有限公司 网络功能信息的管理方法及相关设备
CN109428875B (zh) * 2017-08-31 2024-03-12 华为技术有限公司 基于服务化架构的发现方法及装置
US10963553B2 (en) * 2018-02-15 2021-03-30 Nokia Technologies Oy Security management for service authorization in communication systems with service-based architecture
CN111865597B (zh) * 2019-04-29 2022-05-17 华为技术有限公司 通信方法和通信设备
CN112822678B (zh) * 2019-10-31 2022-05-06 华为技术有限公司 一种服务化架构授权的方法
WO2021165194A1 (en) * 2020-02-19 2021-08-26 Nokia Technologies Oy Key management

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101150849A (zh) * 2006-09-18 2008-03-26 华为技术有限公司 生成绑定管理密钥的方法、系统、移动节点及通信节点
CN106533662A (zh) * 2016-11-03 2017-03-22 北京奇虎科技有限公司 一种传输网络安全密钥的方法与装置
WO2019246206A1 (en) * 2018-06-20 2019-12-26 Iot And M2M Technologies, Llc An ecdhe key exchange for server authentication and a key server
WO2021140272A1 (en) * 2020-01-10 2021-07-15 Nokia Technologies Oy Verification of access tokens with network repository functions in core networks
WO2021165925A1 (en) * 2020-02-20 2021-08-26 Nokia Technologies Oy Key management
CN113825134A (zh) * 2021-09-29 2021-12-21 新华三技术有限公司 一种网络服务授权方法、装置及设备

Also Published As

Publication number Publication date
CN113825134A (zh) 2021-12-21

Similar Documents

Publication Publication Date Title
US10659454B2 (en) Service authorization using auxiliary device
US11050750B2 (en) Recording and verification method and apparatus of internet of things device, and identity authentication method and apparatus
US20200336299A1 (en) Method and system for managing decentralized data access permissions through a blockchain
CN108055274B (zh) 一种基于联盟链存储数据的加密与共享方法及系统
JP6389895B2 (ja) 要求によって供給される鍵を用いたデータセキュリティ
US8196186B2 (en) Security architecture for peer-to-peer storage system
RU2437229C2 (ru) Способ и устройство для совместного использования секретной информации устройствами в домашней сети
JP4896537B2 (ja) 非対称キーセキュリティのための方法およびシステム
JP2019118135A (ja) キーエクスポート技術
KR101982237B1 (ko) 클라우드 컴퓨팅 환경에서의 속성 기반 암호화를 이용한 데이터 공유 방법 및 시스템
WO2017036146A1 (zh) 授权访问方法以及使用该方法的设备
CN110661817B (zh) 资源访问方法、装置及服务网关
EP1530315A1 (en) System and method for authentication of applications in a non-trusted network environment
WO2023051316A1 (zh) 网络服务授权方法、装置及电子设备
CN111770081B (zh) 基于角色认证的大数据机密文件访问方法
JP2009141674A (ja) Ｉｄベース暗号システム、方法
JP5650630B2 (ja) 鍵交換システム、鍵交換装置、鍵交換方法、鍵交換プログラム
CN113206739B (zh) 组合公钥cpk的密钥生成方法、装置及存储介质
JPWO2019144963A5 (zh)
JP7211519B2 (ja) 所有者同一性確認システム、端末および所有者同一性確認方法
CN114513302A (zh) 一种数据加解密方法及设备
JP7211518B2 (ja) 所有者同一性確認システムおよび所有者同一性確認方法
JP6919484B2 (ja) 暗号通信方法、暗号通信システム、鍵発行装置、プログラム
JP6353412B2 (ja) Ｉｄパスワード認証方法、パスワード管理サービスシステム、情報端末、パスワード管理サービス装置、利用端末及びそれらのプログラム
WO2018210288A1 (zh) 一种下发数据的方法及设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22874703

Country of ref document: EP

Kind code of ref document: A1