WO2023130885A1 - 集成可信度量的通信方法 - Google Patents

集成可信度量的通信方法 Download PDF

Info

Publication number
WO2023130885A1
WO2023130885A1 PCT/CN2022/137536 CN2022137536W WO2023130885A1 WO 2023130885 A1 WO2023130885 A1 WO 2023130885A1 CN 2022137536 W CN2022137536 W CN 2022137536W WO 2023130885 A1 WO2023130885 A1 WO 2023130885A1
Authority
WO
WIPO (PCT)
Prior art keywords
network
function service
network function
trusted
certification
Prior art date
Application number
PCT/CN2022/137536
Other languages
English (en)
French (fr)
Inventor
宋雨容
刘斐
陈利群
王东晖
牛顿克里斯托弗·J·P
帕蒂潘洛格纳森
李云鹏
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2023130885A1 publication Critical patent/WO2023130885A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys

Definitions

  • the present application relates to the communication field, and more specifically, to a communication method and device for integrating credibility metrics.
  • the 3rd generation partnership project (3rdgeneration partnership project, 3GPP) does not set special protection measures for the security of core network elements, nor does it set security measures for signaling interaction between network elements. Security behavior will bring great security risks such as network elements being hijacked by attackers and attackers forging core network elements.
  • the hijacked network elements or counterfeit network elements can further affect the normal and trusted core network elements with malicious network elements, resulting in waste of resources, leakage of network element information data, and user privacy data.
  • the present application provides a communication method integrating trustworthiness metrics, which can be used to improve the security of the core network element itself.
  • a communication method for integrating credibility metrics may be executed by a first network element, or may also be executed by a chip or a circuit used for the first network element, which is not limited in this application.
  • the execution by the first network element is taken as an example for description below.
  • the method includes:
  • the first network element sends a registration request message, where the registration request message is used to request registration of the first network element;
  • the first network element receives a registration response message, the registration response message is used to respond to the registration request message, and the registration response message is also used to indicate the verification result of the first certificate, and the first certificate is used to verify the first network element's Whether the first trusted platform is credible.
  • the registration request message includes trusted platform identification information of the first network element.
  • the trusted platform identification information of the first network element is configured to the network storage network element before the first network element sends the registration request message.
  • the registration request message is sent by the first network element, so that the network storage network element obtains the registration request of the first network element; the registration response message is received by the first network element, and the first network element can obtain According to the result of the registration request; by making the registration response message indicate the verification result of the trusted certificate of the first network element, the first network element can determine whether the trusted platform of the first network element has obtained the trust of the network storage network element.
  • the implementation of the technical solution is beneficial for the network storage network element to check whether the trusted platform of the first network element is credible.
  • the first network element Before the first network element applies for an access token, it first verifies its trusted platform, which is conducive to the security of the subsequent token application process and service request process, and is conducive to improving the security of network storage network elements and network function service providers. It is beneficial to improve the security of the network communication process.
  • the request to register the first network element is successful, and the registration response message includes a first trusted certificate, and the first trusted certificate is used to prove that the first trusted platform believable.
  • the request to register with the first network element fails, and the registration response message indicates that the verification of the first certificate fails.
  • the verification of the first certificate included in the registration request by the first network element fails, because the reason for the registration failure of the first network element request given in the registration response message is that the first trusted platform
  • the verification of the first certificate fails. Therefore, after obtaining the registration response message, the first network element may re-collect certificates of other trusted platforms for the next registration request initiation.
  • the implementation of this technical solution is conducive to improving the efficiency of the registration of the first network element on the network storage network element, and to enabling the first network element to register on the network storage network element through a credible and real trusted platform. Improve the security of the network elements of the core network and the security of the communication process between network elements.
  • the network storage network element can obtain the registration request message after receiving the registration request message. Identify information, and then determine the trusted platform supported by the first network element according to the identification information and respond to the platform, which is beneficial for the first network element to obtain network services as soon as possible, and is conducive to improving the registration of network storage network elements to other network elements and authentication efficiency.
  • the network function service consumer sends an authentication permission message, the authentication permission message is used to request to obtain an access token, the access token includes service information that the network function service consumer has the right to access, the authentication permission message includes a second trusted certificate, The second trusted certificate is used to verify whether the trusted platform of the network function service consumer is trusted.
  • the network function service consumer sends an authentication permission message, so that the network storage network element obtains the request of the network function service consumer to apply for an access token; by including the second authentication permission message in the authentication permission message
  • the trusted certificate enables the network storage network element to verify whether the trusted platform of the network function service consumer is credible; the network function service consumer can obtain whether its request for an access token is accepted by receiving the authentication response message .
  • This technical solution is beneficial to the efficiency of obtaining access tokens by network function service consumers, is conducive to improving the security of network storage network elements and network function service providers, and is conducive to improving the security of the communication process between core network network elements.
  • the network function service consumer passes the authentication of the network storage network element, and includes the first certification result in the authentication response message, and the first certification result may include the network function service consumer’s authentication Relevant information of credible verification, the first proof result can be used for credible verification of the network function service consumer by other verifiers next time.
  • the implementation of the technical solution is conducive to speeding up the registration and authentication rate of network function service consumers and improving the network function service experience of network function service consumers.
  • the verifier can directly use the first certification result to judge the network function service consumer when the network function service consumer performs a trusted verification next time. Is it credible.
  • the identity information of the verifier of the credible proof corresponding to the first proof result can be determined through the identity information of the certifier, and the credible content of the credible proof process corresponding to the first proof result can be determined through the credible content, whether Applicable to this trusted proof, the freshness can determine the completion time of the trusted proof corresponding to the first proof result, and then determine whether the trusted proof result is within the validity period, and judge whether it is necessary to re-do the trusted proof.
  • the authentication response message indicates that the verification of the second trusted certificate fails.
  • the network function service consumer determines the reason for the authentication failure, and selects trusted certificates of other trusted platforms for the next authentication process.
  • the authentication response message indicates that the verification of the second trusted certificate fails.
  • the network function service consumer determines the reason for the authentication failure, and selects other certificate issuing methods to obtain a trusted certificate.
  • the second trusted certificate of the network function service consumer is issued through PCA, and after the verification of the second trusted certificate fails, the network function service consumer can choose to use DAA to obtain the trusted certificate of the trusted platform, and Initiate the next authentication request with the reissued trusted certificate.
  • the time stamp, the value of the agreed field, the first random number and the second random number are used as random numbers and used to generate proof information, which can realize multiple ways of trusted verification.
  • different methods are selected to determine the challenge value, so as to complete the credible verification, which is conducive to improving the security of communication between network elements of the core network and the security of devices included in the network elements.
  • a communication method integrating trustworthiness metrics is provided, which can be executed by network function service consumers, or can also be executed by chips or circuits used for network function service consumers, and this application does not make any
  • the implementation by the network function service consumer is taken as an example below.
  • the method includes:
  • the network function service consumer sends a service request message, and the service request message is used to request the service provided by the network function service provider.
  • the network function service consumer receives a service response message, the service response message is used to indicate whether the service request is accepted, and the service response message is also used to indicate the result of authenticity verification for the network function service consumer.
  • the service response message indicates that the authenticity verification of the network function service consumer is successful, and the network function service consumer may further request to verify whether the network function service provider is trustworthy.
  • the service response message indicates that the trusted verification of the network function service consumer fails, and the network function service consumer can obtain the specific reason for the failed trusted verification according to other contents in the service response message, According to the failure reason, the network function service consumer prepares the service request information again, and then initiates the next service request.
  • the network function service consumer receives second certification identification information, and the second certification identification information is used to request acquisition of the second certification information or the third certification result, the The second proof information is used to check whether the network function service consumer is credible, and the third proof result includes the proof result that the network function service consumer has been proven credible.
  • the third attestation result includes one or more items of identity information, credible content, and freshness, where the identity information is used to indicate the identity of the certifier who certifies that the network function service consumer is trustworthy , the trusted content is used to indicate the content that the network function service consumer has proven to be credible, and the freshness is used to indicate the time when the network function service consumer has been proved to be credible.
  • the service response message is used to indicate that the requested service is accepted, and the credible verification includes verification of the second certification information or verification of the third certification result,
  • the second proof information is used to check whether the network function service consumer is credible, and the third proof result includes a proof result that the network function service consumer has been proven credible.
  • the second certification information or the third certification result of the network function service consumer passes the verification, and the second certification information or the third certification result is used to prove that the network function service consumer is in a credible
  • the execution state of the network function service consumer is accepted, and the network service is provided after the network function service consumer is proved to be in a trusted execution state, which is conducive to improving the security of communication between network elements of the core network and Core network functions serve consumers and providers including device security.
  • the credible verification further includes a first proof result verification
  • the first proof result includes a proof that the network function service consumer is proved credible by the network storage network element result.
  • the network function service consumer first performs the verification of the first verification result, and then performs the verification of the second verification information or the third verification result. If the verification of the third verification result fails, the verification of the third verification result is performed The second certification information verification or the third certification result verification.
  • the second certification information or the third certification result and the first certification result of the network function service consumer pass the verification, and the network function service consumer obtains the network service with complete authority.
  • the second certification information or the third certification result of the network function service consumer passes the verification, but the first certification result fails the verification, and the network function service consumer obtains restricted network services.
  • the verification of the second certification information or the third certification result and the verification of the first certification result are set in the credible verification. It can realize double verification of network function service consumers, and provide services for network function service consumers according to the verification situation, which is conducive to improving the security of communication between core network elements and core network function service consumers and providers Contains the security of the device.
  • the trusted verification further includes a third trusted certificate verification, and the third trusted certificate verification is used to verify the network function service year consumer's Whether the trusted platform is credible.
  • the trusted platform of the network function service consumer does not need to generate a trusted certificate in the process of realizing trusted proof, and the network function service provider does not need to generate a trusted certificate when the network function service consumer requests the service. Verify the trusted certificate again.
  • the network function service provider first verifies the third trusted certificate, and then obtains the certification information or certification results of the network function service consumer after verifying that the third trusted certificate is correct, and further verifies .
  • the network function service provider can first verify the trusted certificate of the network function service consumer, and then perform other verifications after confirming that the trusted certificate is credible, which is beneficial to improve the quality of the network.
  • the verification efficiency of the functional service provider is conducive to accelerating the acquisition of network services by the network functional service consumers and improving the network functional service experience of the network functional service consumers.
  • the service response message is used to indicate that the service request is accepted, and the credible verification is a first certification result verification, and the first certification result includes network function service Consumers are proved credible by network storage network elements.
  • the network function service consumer can directly obtain the verification result of the network function service consumer being verified by the network storage network element, that is, the first certification result, and the network function service provider only checks the first certification result Perform verification.
  • the proof information of the network function service consumer is no longer verified, which simplifies the process of credible verification and is conducive to improving the credible verification of network function service providers.
  • the efficiency is conducive to accelerating the acquisition of network function services by network function service consumers, and is conducive to improving the security of communication between core network elements and the security of core network function service consumers and providers including equipment.
  • the service response message is used to indicate that the service request is rejected, and the service response message is used to indicate that the verification of the third trusted certificate fails or that the verification of the second certification information fails. failure or the verification of the first proof result fails or the verification of the third proof result fails, the third trusted certificate is used to verify whether the trusted platform of the network function service consumer is credible, and the second proof information is used for Check whether the network function service consumer is credible, the first proof result includes the proof result that the network function service consumer is proved credible by the network storage network element, and the third proof result includes that the network function service consumer has been proven credible result of the proof.
  • the service response message indicates that the verification of the third trusted certificate fails
  • the network function service consumer determines the cause of the failure after receiving the service response message, and selects trusted certificates of other trusted platforms to use for the next service request.
  • the network function service consumer includes a TPM trusted platform and an Intel SGX trusted platform
  • the third trusted certificate is used to verify whether the TPM trusted platform is credible.
  • Network function service consumers can use the trusted certificate of the Intel SGX trusted platform to re-initiate service requests.
  • the service response message indicates that the verification of the third trusted certificate fails
  • the network function service consumer determines the cause of the failure after receiving the service response message, and selects another certificate issuing method to obtain the trusted certificate.
  • the third trusted certificate of the network function service consumer is issued through PCA, and after the verification of the third trusted certificate fails, the network function service consumer can choose to use DAA to obtain the trusted certificate of the trusted platform, and Use the reissued trusted certificate for the next service request.
  • the service response message indicates that the verification of the second certification information fails
  • the network function service consumer determines the reason for the authentication failure after receiving the authentication response message, and re-collects the credible information corresponding to the second certification information. Relevant information used by the platform for credible proof, so as to regenerate new proof information for the next service request.
  • the service response message indicates that the verification of the second certification information fails
  • the network function service consumer determines the reason for the certification failure after receiving the certification response message, and prepares the certification results of other trusted platforms, using for the next service request.
  • the service response message indicates that the verification of the third certification result fails
  • the network function service consumer determines the reason for the authentication failure after receiving the authentication response message, and re-collects the credible data corresponding to the third certification result. Relevant information used by the platform for credible proof, so as to regenerate new proof information for the next service request.
  • the service response message indicates that the verification of the third certification result fails, and the network function service consumer determines the reason for the certification failure after receiving the certification response message, and prepares the certification results of other trusted platforms, using for the next service request.
  • the service response message indicates that the verification of the third certification result fails, and the network function service consumer determines the reason for the certification failure after receiving the certification response message, and prepares certification information of other trusted platforms, using for the next service request.
  • the service request message further includes second certification information, the second certification information is generated according to the second challenge value, and the second certification information is used to verify the network function Whether the service consumer is credible, the second challenge value is any one of the timestamp, the first random number, the second random number and the value of the agreed field, the first random number is a random number provided by a trusted third party, The second random number is a random number generated for checking whether the trusted platform of the network function service consumer is credible.
  • the time stamp, the value of the agreed field, the first random number and the second random number are used as random numbers and used to generate proof information, which can realize multiple ways of trusted verification.
  • different methods are selected to determine the challenge value, so as to complete the credible verification, which is conducive to improving the security of communication between network elements of the core network and the security of the equipment contained in the network elements.
  • the method includes:
  • the network storage network element sends a registration response message, the registration response message is used to respond to the registration request message, and the registration response message is also used to indicate the verification result of the first certificate, and the first certificate is used to verify the first certificate of the first network element 1. Whether the trusted platform is credible.
  • the trusted platform identification information of the first network element is configured to the network storage network element before the first network element sends the registration request message.
  • the registration request message is sent by the first network element, so that the network storage network element obtains the registration request of the first network element; the registration response message is received by the first network element, and the first network element can obtain According to the result of the registration request; by making the registration response message indicate the verification result of the trusted certificate of the first network element, the first network element can determine whether the trusted platform of the first network element has obtained the trust of the network storage network element.
  • the implementation of the technical solution is beneficial for the network storage network element to check whether the trusted platform of the first network element is credible.
  • the request to register the first network element is successful, and the registration response message includes a first trusted certificate, and the first trusted certificate is used to prove that the first trusted platform believable.
  • the first trusted certificate of the first network element is included in the registration response message, which is used to prove that the trusted platform of the first network element is stored through the network.
  • the first trusted certificate can be used as the identity certificate of the first network element in the subsequent access token acquisition process, service request process and other communication processes, proving that the first network element has a credible and trusted platform, which is conducive to improving network storage.
  • the security of network elements and network function service providers is conducive to improving the security of the communication process between network elements of the core network.
  • the request to register with the first network element fails, and the registration response message indicates that the first certificate verification fails.
  • the registration response message includes an indication that the verification of the first trusted certificate fails, and the first network element can obtain the indication after receiving the registration response message , to a certain extent, it is beneficial to the next registration request process of the first network element, it is beneficial to reduce unnecessary overhead of core network network resources, and it is conducive to improving the service quality of network function service consumers in the core network element's service process .
  • the first network element includes a second trusted platform
  • the network storage network element receives a re-registration request message
  • the re-registration request message is used to request registration of the first network element
  • the re-registration request message includes a second certificate
  • the second certificate is used to verify whether the second trusted platform of the first network element is credible.
  • the verification of the first certificate included in the registration request by the first network element fails, because the reason for the registration failure of the first network element request given in the registration response message is that the first trusted platform
  • the verification of the first certificate fails. Therefore, after obtaining the registration response message, the first network element may re-collect certificates of other trusted platforms for the next registration request initiation.
  • the implementation of this technical solution is conducive to improving the efficiency of the registration of the first network element on the network storage network element, and to enabling the first network element to register on the network storage network element through a credible and real trusted platform. Improve the security of the network elements of the core network and the security of the communication process between network elements.
  • the registration request message includes platform identification information, where the platform identification information is used to identify a trusted platform of the first network element.
  • the network storage network element can obtain the registration request message after receiving the registration request message. Identify information, and then determine the trusted platform supported by the first network element according to the identification information and respond to the platform, which is beneficial for the first network element to obtain network services as soon as possible, and is conducive to improving the registration of network storage network elements to other network elements and authentication efficiency.
  • a communication method for integrating trusted metrics is provided, and the method may be executed by a network storage network element, or may also be executed by a chip or a circuit used for a network storage network element, which is not limited in this application.
  • the following uses the implementation by network storage network elements as an example for description.
  • the network storage network element receives an authentication permission message, the authentication permission message is used to request to obtain an access token, the access token includes service information that the network function service consumer is entitled to access, the authentication permission message includes a second trusted certificate, the The second trusted certificate is used to verify whether the trusted platform of the network function service consumer is trusted;
  • the network storage network element sends an authentication response message, where the authentication response message is used to indicate the result of the request to obtain the access token.
  • the network function service consumer sends an authentication permission message, so that the network storage network element obtains the request of the network function service consumer to apply for an access token; by including the second authentication permission message in the authentication permission message
  • the trusted certificate enables the network storage network element to verify whether the trusted platform of the network function service consumer is credible; the network function service consumer can obtain whether its request for an access token is accepted by receiving the authentication response message .
  • This technical solution is beneficial to the efficiency of obtaining access tokens by network function service consumers, is conducive to improving the security of network storage network elements and network function service providers, and is conducive to improving the security of the communication process between core network network elements.
  • the network function service consumer can prepare the first certification information or the second certification result, which is used to verify whether the network storage network element is credible to the network function service consumer, which is conducive to improving the network function of the core network.
  • the authentication response message is used to indicate obtaining an access token, and the access token includes a first proof result, and the first proof result includes that the network function service consumer is The network storage network element proves the credible proof result.
  • the network function service consumer passes the authentication of the network storage network element, and includes the first certification result in the authentication response message, and the first certification result may include the network function service consumer’s authentication Relevant information of credible verification, the first proof result can be used for credible verification of the network function service consumer by other verifiers next time.
  • the implementation of the technical solution is conducive to speeding up the registration and authentication rate of network function service consumers and improving the network function service experience of network function service consumers.
  • the first certification result includes one or more items of identity information, trusted content, and freshness, where the identity information is used to indicate the network storage network element, the The trusted content is used to indicate that the network function service consumer is trusted by the network storage network element, and the freshness is used to indicate the time when the network function service consumer is certified by the network storage network element.
  • the identity information of the verifier of the credible proof corresponding to the first proof result can be determined through the identity information of the certifier, and the credible content of the credible proof process corresponding to the first proof result can be determined through the credible content, whether Applicable to this trusted proof, the freshness can determine the completion time of the trusted proof corresponding to the first proof result, and then determine whether the trusted proof result is within the validity period, and judge whether it is necessary to re-do the trusted proof.
  • Including the above information in the first certification result is beneficial to improving the efficiency of trusted certification, improving the security of communication between network elements of the core network, and improving the security of equipment contained in network elements.
  • the authentication response message is used to indicate that the access token has not been obtained, and the authentication response message is also used to indicate that the verification of the second trusted certificate fails or that the first certification information If the verification fails, the first certification information is used to verify whether the network function service consumer is credible.
  • the authentication response message indicates that the verification of the second trusted certificate fails.
  • the network function service consumer determines the reason for the authentication failure, and selects trusted certificates of other trusted platforms for the next authentication process.
  • the network function service consumer includes a TPM trusted platform and an Intel SGX trusted platform, and the second certificate is used to verify whether the TPM trusted platform is credible.
  • the network function service consumer The attacker can use the Intel SGX trusted platform to re-initiate the authentication request.
  • the authentication response message indicates that the verification of the second trusted certificate fails.
  • the network function service consumer determines the reason for the authentication failure, and selects other certificate issuing methods to obtain a trusted certificate.
  • the second trusted certificate of the network function service consumer is issued through PCA, and after the verification of the second trusted certificate fails, the network function service consumer can choose to use DAA to obtain the trusted certificate of the trusted platform, and Initiate the next authentication request with the reissued trusted certificate.
  • the authentication response message indicates that the verification of the first certification information fails.
  • the network function service consumer determines the reason for the authentication failure, and can re-collect the relevant information used for credible proof, so as to regenerate the proof information for the next authentication process.
  • the authentication permission message further includes first certification information, the first certification information is generated according to the first challenge value, and the first certification information is used to verify the network function Whether the service consumer is credible, the first challenge value is any one of the timestamp, the first random number, the second random number and the value of the agreed field, and the first random number is a random number provided by a trusted third party , the second random number is a random number generated for verifying whether the trusted platform of the network function service consumer is credible.
  • the challenge value is a time stamp
  • the time stamp is clock information trusted by both the network function service consumer and the network storage network element.
  • the challenge value is a first random number
  • the first random number is a random number trusted by both the network function service consumer and the network storage network element
  • the first random number can be determined by a trusted third party supply.
  • the first random number is generated through the blockchain (such as the timestamp or hash value of the latest block of the blockchain), and the network function service consumer uses the first random number as a challenge value after obtaining the first random number .
  • the challenge value is a second random number
  • the second random number is a random number generated by the network function service provider to verify whether the network function service consumer is credible.
  • the time stamp, the value of the agreed field, the first random number and the second random number are used as random numbers and used to generate proof information, which can realize multiple ways of trusted verification.
  • different methods are selected to determine the challenge value, so as to complete the credible verification, which is conducive to improving the security of communication between the network elements of the core network and the security of the equipment contained in the network elements.
  • a communication method integrating credibility metrics is provided, which can be performed by a network function service provider, or can also be performed by a chip or circuit used for a network function service provider, and this application does not make any
  • the implementation by the network function service provider is taken as an example below.
  • the method includes:
  • the network function service provider receives a service request message, and the service request message is used to request the service provided by the network function service provider;
  • the network function service provider sends a service response message, the service response message is used to indicate whether the service request is accepted, and the service response message is also used to indicate the result of authenticity verification to the network function service consumer.
  • the service response message indicates that the authenticity verification of the network function service consumer is successful, and the network function service consumer may further request to verify whether the network function service provider is trustworthy.
  • the service response message indicates that the trusted verification of the network function service consumer fails, and the network function service consumer can obtain the specific reason for the failed trusted verification according to other contents in the service response message, According to the failure reason, the network function service consumer prepares the service request information again, and then initiates the next service request.
  • the network function service consumer can receive the service response message after sending the service request message, and the service response message can indicate the result of the credible verification of the network function service consumer, according to the Check the result, the web function service consumer can respond.
  • the network function service provider sends second certification identification information, where the second certification identification information is used to request acquisition of the second certification information or the third certification result, the The second proof information is used to check whether the network function service consumer is credible, and the third proof result includes the proof result that the network function service consumer has been proven credible.
  • the network function service consumer After receiving the certification identification information, the network function service consumer can prepare the second certification information or the third certification result, which is used by the network function service provider to verify whether the network function service consumer is trustworthy, which is conducive to improving the quality of core network elements. Security of communications between core network function service consumers and providers including security of devices.
  • the second certification information or the third certification result of the network function service consumer passes the verification, and the second certification information or the third certification result is used to prove that the network function service consumer is in a credible
  • the execution state of the network function service consumer is accepted, and the network service is provided after the network function service consumer is proved to be in a trusted execution state, which is conducive to improving the security of communication between network elements of the core network and Core network functions serve consumers and providers including device security.
  • the credible verification further includes verification of a first proof result, where the first proof result includes a proof that the network function service consumer is certified credible by the network storage network element result.
  • the network function service consumer first performs the verification of the second certification information or the third certification result, and then performs the verification of the first certification result, and the second certification information verification or the third certification result After the verification is passed, the first proof result verification is performed.
  • the second certification information or the third certification result and the first certification result of the network function service consumer pass the verification, and the network function service consumer obtains the network service with complete authority.
  • the second certification information or the third certification result of the network function service consumer passes the verification, but the third certification result fails the verification, and the network function service consumer obtains restricted network services.
  • the verification of the second certification information or the third certification result and the verification of the first certification result are set in the credible verification. It can realize double verification of network function service consumers, and provide services for network function service consumers according to the verification situation, which is conducive to improving the security of communication between core network elements and core network function service consumers and providers Contains the security of the device.
  • the trusted verification further includes a third trusted certificate verification, and the third trusted certificate verification is used to verify the network function service year consumer's Whether the trusted platform is credible.
  • the trusted platform of the network function service consumer does not need to generate a trusted certificate in the process of realizing trusted proof, and the network function service provider does not need to generate a trusted certificate when the network function service consumer requests the service. Verify the trusted certificate again.
  • the network function service provider can first verify the trusted certificate of the network function service consumer, and then perform other verifications after confirming that the trusted certificate is credible, which is beneficial to improve the quality of the network.
  • the verification efficiency of the functional service provider is conducive to accelerating the acquisition of network services by the network functional service consumers and improving the network functional service experience of the network functional service consumers.
  • the service response message is used to indicate that the service request is accepted, and the credible verification is a first certification result verification, and the first certification result includes network function service Consumers are proved credible by network storage network elements.
  • the network function service consumer can directly obtain the verification result of the network function service consumer being verified by the network storage network element, that is, the first certification result, and the network function service provider only checks the first certification result Perform verification.
  • the proof information of the network function service consumer is no longer verified, which simplifies the process of credible verification and is conducive to improving the credible verification of network function service providers.
  • the efficiency is conducive to accelerating the acquisition of network function services by network function service consumers, and is conducive to improving the security of communication between core network elements and the security of core network function service consumers and providers including equipment.
  • the service response message is used to indicate that the service request is rejected, and the service response message is used to indicate that the verification of the third trusted certificate fails or that the verification of the second certification information fails. failure or the verification of the first proof result fails or the verification of the third proof result fails, the third trusted certificate is used to verify whether the trusted platform of the network function service consumer is credible, and the second proof information is used for Check whether the network function service consumer is credible, the first proof result includes the proof result that the network function service consumer is proved credible by the network storage network element, and the third proof result includes the last time the network function service consumer was proved to be credible Letter of proof results.
  • the service response message indicates that the verification of the third trusted certificate fails
  • the network function service consumer determines the cause of the failure after receiving the service response message, and selects trusted certificates of other trusted platforms to use for the next service request.
  • the network function service consumer includes a TPM trusted platform and an Intel SGX trusted platform
  • the third trusted certificate is used to verify whether the TPM trusted platform is credible.
  • Network function service consumers can use the trusted certificate of the Intel SGX trusted platform to re-initiate service requests.
  • the service response message indicates that the verification of the third trusted certificate fails
  • the network function service consumer determines the cause of the failure after receiving the service response message, and selects another certificate issuing method to obtain the trusted certificate.
  • the service response message indicates that the verification of the second certification information fails
  • the network function service consumer determines the reason for the authentication failure after receiving the authentication response message, and re-collects the credible information corresponding to the second certification information. Relevant information used by the platform for credible proof, so as to regenerate new proof information for the next service request.
  • the service response message indicates that the verification of the second certification information fails
  • the network function service consumer determines the reason for the certification failure after receiving the certification response message, and collects certification information of other trusted platforms, using for the next service request.
  • the service response message indicates that the verification of the second certification information fails
  • the network function service consumer determines the reason for the certification failure after receiving the certification response message, and prepares the certification results of other trusted platforms, using for the next service request.
  • the service response message indicates that the verification of the third certification result fails
  • the network function service consumer determines the reason for the authentication failure after receiving the authentication response message, and re-collects the credible data corresponding to the third certification result. Relevant information used by the platform for credible proof, so as to regenerate new proof information for the next service request.
  • the service response message indicates that the verification of the third certification result fails, and the network function service consumer determines the reason for the certification failure after receiving the certification response message, and prepares the certification results of other trusted platforms, using for the next service request.
  • the service response message indicates that the verification of the third certification result fails, and the network function service consumer determines the reason for the certification failure after receiving the certification response message, and prepares certification information of other trusted platforms, using for the next service request.
  • the network function service consumer can determine the failure reason through the service response message, and then make a targeted response to better prepare for the next service request.
  • the service request message further includes second certification information, the second certification information is generated according to the second challenge value, and the second certification information is used to verify the network function Whether the service consumer is credible, the second challenge value is any one of the timestamp, the first random number, the second random number, and the value of the agreed field.
  • the challenge value is clock information generated by a TPM trusted platform with network function service consumers.
  • the challenge value is a value of an agreed field
  • the agreed field may be determined according to a network protocol that both the network function service consumer and the network function service provider abide by.
  • the bit data from the 128th to 160th bits of the authentication permission message is used as the challenge value
  • the network function service consumer and the network storage network element comply with the OAuth 2.0 protocol at the same time, then the network function service consumer obtains The 128th to 160th bit data of the authentication permission message is used as the challenge value.
  • the challenge value is a first random number
  • the first random number is a random number trusted by both the network function service consumer and the network function service provider, and the first random number can be determined by the trusted first random number. Provided by third parties.
  • the first random number is generated through the blockchain (such as the timestamp or hash value of the latest block of the blockchain), and the network function service consumer uses the first random number as a challenge value after obtaining the first random number .
  • the time stamp, the value of the agreed field, the first random number and the second random number are used as random numbers and used to generate proof information, which can realize multiple ways of trusted verification.
  • different methods are selected to determine the challenge value, so as to complete the credible verification, which is conducive to improving the security of communication between network elements of the core network and the security of the equipment contained in the network elements.
  • a communication device in a seventh aspect, includes a sending module and a receiving module,
  • the sending module is used for sending a registration request message, and the registration request message is used for requesting registration of the first network element.
  • the receiving module is used to receive a registration response message, the registration response message is used to respond to the registration request message, and the registration response message is also used to indicate the verification result of the first certificate, and the first certificate is used to verify the first network element of the first network element 1. Whether the trusted platform is credible.
  • the sending module is further configured to send a re-registration request message, where the re-registration request message includes a second certificate, and the second certificate is used to verify that the first network element Whether the second trusted platform is credible.
  • the sending module is used to send an authentication permission message, the authentication permission message is used to request to obtain an access token, the access token includes service information that the network function service consumer has the right to access, the authentication permission message includes a second trusted certificate, the The second trusted certificate is used to verify whether the trusted platform of the network function service consumer is trusted.
  • the receiving module is used to receive an authentication response message, and the authentication response message is used to indicate the result of requesting to obtain the access token.
  • the receiving module is further configured to receive first certification identification information, where the first certification identification information is used to request acquisition of the first certification information or the second certification result, the The first proof information is used to verify whether the network function service consumer is credible, and the second proof result includes a proof result that the network function service consumer has been proven credible.
  • a communication device in a ninth aspect, includes a sending module and a receiving module,
  • the sending module is used for sending a service request message, and the service request message is used for requesting the service provided by the network function service provider.
  • the receiving module is used to receive a service response message, the service response message is used to indicate whether the service request is accepted, and the service response message is also used to indicate the result of authenticity check on the network function service consumer.
  • the receiving module is further configured to receive second certification identification information, where the second certification identification information is used to request acquisition of the second certification information or the third certification result, the The second proof information is used to check whether the network function service consumer is credible, and the third proof result includes the proof result that the network function service consumer has been proven credible.
  • a communication device in a tenth aspect, includes a receiving module and a sending module,
  • the receiving module is used for receiving a registration request message, and the registration request message is used for requesting registration of the first network element.
  • the receiving module is further configured to receive a re-registration request message, where the re-registration request message includes a second certificate, and the second certificate is used to verify that the first network element Whether the second trusted platform is credible.
  • a communication device in an eleventh aspect, includes a receiving module and a sending module,
  • the receiving module is used to receive an authentication permission message, the authentication permission message is used to request to obtain an access token, the access token includes service information that the network function service consumer has the right to access, the authentication permission message includes a second trusted certificate, the The second trusted certificate is used to verify whether the trusted platform of the network function service consumer is trusted.
  • the sending module is used to send an authentication response message, and the authentication response message is used to indicate the result of requesting to obtain the access token.
  • a communication device in a twelfth aspect, includes a receiving module and a sending module,
  • the sending module is used to send a service response message, the service response message is used to indicate whether the service request is accepted, and the service response message is also used to indicate the result of authenticity check on the network function service consumer.
  • the sending module is further configured to send second certification identification information, where the second certification identification information is used to request acquisition of the second certification information or the third certification result , the second certification information is used to check whether the network function service consumer is credible, and the third certification result includes a certification result that the network function service consumer has been proven credible.
  • a communication device including at least one processor, at least one processor is coupled to at least one memory, at least one memory is used to store computer programs or instructions, and at least one processor is used to call from at least one memory and Executing the computer program or instruction causes the communication device to execute the method in the first aspect or any possible implementation manner thereof.
  • a communication device including at least one processor, at least one processor is coupled to at least one memory, at least one memory is used to store computer programs or instructions, and at least one processor is used to call from at least one memory and Executing the computer program or instruction causes the communication device to execute the method in the second aspect, the third aspect or any possible implementation thereof.
  • a communication device including at least one processor, at least one processor is coupled with at least one memory, at least one memory is used to store computer programs or instructions, and at least one processor is used to call from at least one memory and Executing the computer program or instruction causes the communication device to execute the method in the fourth aspect, the fifth aspect or any possible implementation thereof.
  • a computer-readable storage medium is provided, and computer instructions are stored in the computer-readable storage medium.
  • the computer instructions are run on a computer, the method in the first aspect or any possible implementation thereof is executed. implement.
  • a computer-readable storage medium is provided.
  • Computer instructions are stored in the computer-readable storage medium.
  • the method in is executed.
  • a computer-readable storage medium is provided.
  • Computer instructions are stored in the computer-readable storage medium.
  • the fourth aspect, the fifth aspect, or any possible implementation thereof The method in is executed.
  • a computer program product includes computer program code.
  • the computer program product includes computer program code.
  • a computer program product includes computer program code, and when the computer program code is run on a computer, the method is executed.
  • a chip including a processor, configured to read an instruction stored in a memory, and when the processor executes the instruction, the chip implements the first aspect or any possible implementation thereof. method is executed.
  • a chip including a processor for reading instructions stored in the memory, and when the processor executes the instructions, the chip realizes the second aspect, the third aspect or any possible combination thereof The method in the implementation is executed.
  • a chip including a processor, configured to read instructions stored in the memory, and when the processor executes the instructions, the chip realizes the fourth aspect, the fifth aspect, or any possible combination thereof The method in the implementation is executed.
  • a chip including a processor, configured to read an instruction stored in a memory, and when the processor executes the instruction, the chip implements the sixth aspect or any possible implementation thereof. method is executed.
  • Fig. 1 is a schematic diagram of a communication system applicable to the embodiment of the present application.
  • Fig. 2 is a schematic diagram of a communication method based on OAuth 2.0 provided by the embodiment of the present application.
  • Fig. 3 is a schematic diagram of a communication method for integrating credibility metrics provided by an embodiment of the present application.
  • Fig. 4 is a schematic diagram of another communication method for integrating credibility metrics provided by an embodiment of the present application.
  • Fig. 5 is a schematic diagram of another communication method for integrating credibility metrics provided by an embodiment of the present application.
  • Fig. 6 is a schematic diagram of yet another communication method for integrating credibility metrics provided by an embodiment of the present application.
  • Fig. 8 is a schematic diagram of another communication method for integrating credibility metrics provided by an embodiment of the present application.
  • Fig. 10 is a schematic diagram of yet another communication method for integrating credibility metrics provided by an embodiment of the present application.
  • Fig. 12 is a schematic diagram of another communication method for integrating credibility metrics provided by an embodiment of the present application.
  • Fig. 13 is a schematic diagram of another communication method for integrating credibility metrics provided by an embodiment of the present application.
  • Fig. 15 is a schematic diagram of another communication method for integrating credibility metrics provided by an embodiment of the present application.
  • Fig. 16 is a schematic diagram of another communication method for integrating credibility metrics provided by an embodiment of the present application.
  • Fig. 17 is a schematic diagram of another communication method for integrating credibility metrics provided by an embodiment of the present application.
  • Fig. 18 is a schematic diagram of another communication method for integrating credibility metrics provided by an embodiment of the present application.
  • Fig. 19 is a schematic diagram of another communication method for integrating credibility metrics provided by an embodiment of the present application.
  • Fig. 20 is a schematic diagram of another communication method for integrating credibility metrics provided by an embodiment of the present application.
  • Fig. 22 is a schematic diagram of a communication device provided by an embodiment of the present application.
  • the technical solution of the embodiment of the present application can be applied to various communication systems, for example: global system of mobile communication (global system of mobile communication, GSM) system, code division multiple access (code division multiple access, CDMA) system, broadband code division multiple access (wideband code division multiple access, WCDMA) system, general packet radio service (general packet radio service, GPRS), long term evolution (long term evolution, LTE) system, LTE frequency division duplex (frequency division duplex, FDD) system, LTE Time division duplex (time division duplex, TDD), universal mobile telecommunications system (universal mobile telecommunications system, UMTS), worldwide interconnection microwave access (worldwide interoperability for microwave access, WiMAX) communication system or the fifth generation (5th generation, 5G) system etc.
  • GSM global system of mobile communication
  • CDMA code division multiple access
  • WCDMA wideband code division multiple access
  • general packet radio service general packet radio service
  • GPRS general packet radio service
  • long term evolution long term evolution
  • LTE long term evolution
  • the terminal equipment in the embodiment of the present application may refer to user equipment, access terminal, subscriber unit, subscriber station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication device, user agent, or user device.
  • the terminal device may also be a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a wireless local loop (WLL) station, a personal digital assistant (PDA), a Functional handheld devices, computing devices or other processing devices connected to wireless modems, vehicle-mounted devices, wearable devices, terminal devices in 5G networks or terminals in the future evolution of public land mobile network (PLMN) equipment, etc., which are not limited in this embodiment of the present application.
  • SIP session initiation protocol
  • WLL wireless local loop
  • PDA personal digital assistant
  • the network device in the embodiment of the present application may be a device for communicating with a terminal device, and the network device may be a global system of mobile communication (GSM) system or a code division multiple access (CDMA)
  • GSM global system of mobile communication
  • CDMA code division multiple access
  • the base station (base transceiver station, BTS) in the wideband code division multiple access (wideband code division multiple access, WCDMA) system (NodeB, NB) can also be the evolved base station (evolutionalNodeB) in the LTE system , eNB or eNodeB), can also be a wireless controller in a cloud radio access network (cloud radio access network, CRAN) scenario, or the network device can be a relay station, an access point, a vehicle device, a wearable device, and a 5G network
  • the network device in the network or the network device in the PLMN network is not limited in this embodiment of the present application.
  • nouns as for the number of nouns, unless otherwise specified, it means “singular noun or plural noun", that is, “one or more”. “At least one” refers to one or more, “multiple” refers to two or more, and “multiple” in “one or more” refers to two or more. "And/or” describes the association relationship of associated objects, indicating that there may be three types of relationships, for example, A and/or B, which can mean: A exists alone, A and B exist at the same time, and B exists alone, where A, B can be singular or plural. The character “/" generally indicates that the contextual objects are an "or” relationship. For example, A/B means: A or B.
  • At least one of the following or similar expressions refer to any combination of these items, including any combination of single or plural items.
  • at least one item (piece) of a, b, or c means: a, b, c, a and b, a and c, b and c, or a and b and c, where a, b, c Can be single or multiple.
  • FIG. 1 a communication system applicable to the embodiment of the present application is briefly introduced first with reference to FIG. 1 .
  • FIG. 1 is a network architecture applied to the embodiment of the present application. As shown in FIG. 1 , each part involved in the network architecture will be described separately below.
  • (wireless) access network (radio access network, (R)AN) network element 120 used to provide network access functions for authorized terminal equipment in a specific area, and can use different quality according to the level of terminal equipment, business requirements, etc. transmission tunnel.
  • R radio access network
  • (R)AN network elements can manage wireless resources, provide access services for terminal devices, and then complete the forwarding of control signals and terminal device data between terminal devices and the core network.
  • (R)AN network elements can also be understood as traditional networks base station in .
  • User plane (user plane) network element 130 used for packet routing and forwarding, and user plane data quality of service (quality of service, QoS) processing, etc.
  • Data network 140 a data network that provides business services for users.
  • the client is located in the UE, and the server is located in the data network.
  • the data network can be a private network, such as a local area network, or an external network that is not controlled by the operator, such as the Internet, or a proprietary network jointly deployed by operators, such as a network that provides IMS services.
  • the data network may be a data network, DN.
  • the data network may still be a DN, or may have other names, which are not limited in this application.
  • Authentication server 150 used for authentication services, generating keys to realize two-way authentication of terminal devices, and supporting a unified authentication framework.
  • the authentication server may be an authentication server function (authentication server function, AUSF) network element.
  • the authentication server functional network element may still be an AUSF network element, or may have other names, which are not limited in this application.
  • Access management (access management) network element 160 mainly used for mobility management and access management, etc., and can be used to implement functions other than session management in the mobility management entity (mobility management entity, MME) function , for example, functions such as monitoring and access authorization/authentication.
  • mobility management entity mobility management entity, MME
  • the access management network element may be an access and mobility management function (access and mobility management function, AMF) network element.
  • AMF access and mobility management function
  • the access management network element may still be an AMF network element, or may have other names, which are not limited in this application.
  • Session management session management
  • network element 170 mainly used for session management, network interconnection protocol (internet protocol, IP) address allocation and management of terminal equipment, selection of manageable user plane functions, policy control and charging function interfaces Endpoint and downlink data notification, etc.
  • IP network interconnection protocol
  • the session management network element may be a session management function (session management function, SMF) network element.
  • SMF session management function
  • the session management network element may still be an SMF network element, or may have other names, which are not limited in this application.
  • Slice selection (slice selection) network element 180 used to select a group of network slice instances for serving terminal devices, and determine a group of access management network elements for serving terminal devices.
  • the network open network element may be a network slice selection function (network slice selection function, NSSF) network element.
  • NSSF network slice selection function
  • the network open network element may still be an NSSF network element, or may have other names, which are not limited in this application.
  • Network exposure (network exposure) network element 190 used to expose network capabilities to third-party applications, enabling friendly connection between network capabilities and service requirements.
  • the network exposure network element may be a network exposure function (network exposure function, NEF) network element.
  • NEF network exposure function
  • the open network element may still be an NEF network element, or may have other names, which are not limited in this application.
  • Policy control (policy control) network element 1110 a unified policy framework for guiding network behavior, providing policy rule information, etc. for control plane functional network elements (such as AMF, SMF network elements, etc.).
  • the policy control network element may be a policy and charging rules function (policy and charging rules function, PCRF) network element.
  • policy control network element may be a policy control function (policy control function, PCF) network element.
  • policy control network element may still be a PCF network element, or may have other names, which are not limited in this application.
  • Data management (data management) network element 1120 used for processing terminal equipment identification, access authentication, registration and mobility management, etc.
  • the data management network element may be a unified data management (unified data management, UDM) network element.
  • UDM unified data management
  • the unified data management may still be a UDM network element, or may have other names, which are not limited in this application.
  • the above-mentioned network element or function may be a network element in a hardware device, or a software function running on dedicated hardware, or a virtualization function instantiated on a platform (for example, a cloud platform).
  • the above-mentioned network elements or functions can be divided into one or more services, and further, there may also be services that exist independently of network functions.
  • the AF network element is referred to as AF
  • the NEF network element is referred to as NEF
  • the NRF network element is referred to as NRF
  • the PCF network element is referred to as PCF. That is, the AF described in this application can be replaced by an application network element, the NEF can be replaced by a network open network element, the NRF can be replaced by a network storage network element, and the PCF can be replaced by a policy control network element.
  • Authentication server used to authenticate the user's identity and generate tokens.
  • Resource server used to save user resources and verify tokens.
  • Resource Owner The user who owns the resource.
  • Third-party apps request access to user data on other service providers.
  • the OAuth protocol includes four authorization modes for third-party applications, namely: authorization code (authorization code) mode, simplified (implicit) mode, password (resourceowner password credentials) mode and client (client credentials) mode.
  • authorization code authorization code
  • simplified (implicit) mode password (resourceowner password credentials) mode
  • client client credentials
  • authorization code mode has complete functions and strict logic.
  • the resource owner authorizes a third-party application to access data of the resource owner stored by other service providers.
  • the third-party application applies for an access token from the authorization server according to the authorization obtained in S120.
  • the authorization server authenticates the third-party application, and issues an access token to the third-party application after confirming that it is correct.
  • the third-party application uses the access token to apply to the resource server for acquiring data of the resource owner.
  • the resource server confirms that the access token of the third-party application is correct, and agrees to open the data of the resource owner to the third-party application.
  • Trusted computing (trusted computing, TC) is a technology designed to make the computer always run in the expected way, "trusted” emphasizes that the behavior results are predictable and controllable. Trusted computing is enforced by computer hardware and software. The trusted technology of computing systems starts with a root of trust and develops to trust in hardware platforms, operating systems, and applications. The strength of management and authentication at each layer corresponds to the credibility of each layer. Further, trust will be extended to the complete computer system, and protective measures will be adopted to ensure the integrity of computer resources and expected computer behavior, thereby enhancing the trustworthiness of computer systems.
  • Remote attestation is one of the key technologies in the overall trusted computing solution, which is used to judge the trustworthiness status of the device.
  • Remote attestation allows a user or others to detect changes to that user's computer, which prevents sending private information or important commands to unsecured or compromised computers.
  • the remote attestation mechanism generates a certificate through the hardware, stating which software is running. The user can send this certificate to a remote party to show that his computer has not been tampered with.
  • Remote attestation is often combined with public key cryptography to ensure that sent messages can only be read by the program requesting the attestation, not other eavesdroppers. Through these restrictions, the purpose of enhancing the credibility of the terminal and strengthening the security of the system is achieved.
  • the remote proof technology mainly adopts the following schemes:
  • PCA Privacy certificate authority
  • TPM trusted platform module
  • PCR platform configuration registers
  • the challenger sends a challenge to the trusted computing platform (trusted platform module, TPM), that is, requests the contents of one or more platform configuration registers (PCR);
  • TPM uses the identity key to sign the content of the PCR;
  • the platform sends a message to the certificate center CA to request a platform certificate, and then sends the platform certificate, storage measurement logs, and signed PCR to the challenger;
  • the challenger Attestation request i.e. recalculate storage metrics log and compare with received PCR value, verify platform certificate and signature.
  • TPM selects a secret information, and obtains the DAA certificate issued by the DAA issuer (issuer) for the secret information through a secure zero-knowledge protocol; the verifier (verifier) passes The "zero-knowledge proof” method proves that the TPM has a credible and valid DAA certificate.
  • Intel software guard extensions Intel software guard extensions, Intel SGX
  • SGX technology allows developers to divide applications into enclave (enclave) strengthened by central processing unit (CPU) or in memory Executable protected areas for increased security even in compromised platforms.
  • the scheme of Intel SGX is roughly as follows: the certified enclave obtains the current information to generate a report structure, uses the report key of the quoted enclave (quoteenclave, QE) to generate a label, and sends it to the quoted enclave; the quoted enclave verifies whether the certified enclave is On the same platform (like the same device), wrap the received report structure into a reference structure and sign it with the signing key; the target enclave verifies that the reference is generated by a reliable Intel processor.
  • the certified enclave obtains the current information to generate a report structure, uses the report key of the quoted enclave (quoteenclave, QE) to generate a label, and sends it to the quoted enclave; the quoted enclave verifies whether the certified enclave is On the same platform (like the same device), wrap the received report structure into a reference structure and sign it with the signing key; the target enclave verifies that the reference is generated by a reliable Intel
  • the OAuth2.0 protocol requires the authorization server to authenticate the identity of the client, but does not clearly specify the method of identity authentication, which provides the possibility of integrating remote attestation technology with trusted computing.
  • trusted computing technology can provide a trusted operating environment for OAuth2.0 entities from hardware, and has higher security capabilities.
  • Enclave An area used to separate and encrypt code data, and only decrypt it inside the processor. It is part of the application and can fully access the application memory.
  • TPM Trusted Platform Module
  • TPM Software Stack A software specification that provides a standard application programming interface (application programming interface, API) for accessing TPM functions. Application developers can use this software specification to develop interoperable client applications for stronger tamper-resistant computing.
  • Digital certificate also known as public key certificate or identity certificate. It is an electronic document used in public key infrastructure to prove the identity of the public key owner. This file contains public key information, owner identity information (subject), and the digital signature of this file by a digital certificate certification authority (issuer) to ensure that the overall content of this file is correct. With this file, the owner can identify himself to the computer system or other users, so that the other party can be trusted and authorized to access or use certain sensitive computer services. The computer system or other users can verify the contents of the certificate through certain procedures, including whether the certificate has expired and whether the digital signature is valid. If you trust the issuing organization, you can trust the key on the certificate, and encrypt it with the owner with the public key. reliable communication.
  • the certification authority uses its own private key to apply a digital signature to the public key of the person (or organization) that needs to be certified and generates a certificate, that is, the essence of the certificate is to apply a digital signature to the public key.
  • a certificate signing request (Certification signing request, CSR) is a message sent by the applicant to the certificate authority to apply for a public key certificate. It usually includes the public key used to issue the certificate, information used for identification (such as domain name), and integrity protection (such as digital signature). Both parts are inserted into the certificate when the certificate is signed.
  • Certificate authority also known as e-commerce certification center and e-commerce certification authority, is an authoritative organization responsible for issuing and managing digital certificates, and as a trusted third party in e-commerce transactions, it undertakes Responsibility for authenticity verification of the public key in the public key system.
  • TEE Executable Environment
  • TEE It is a secure area in the central processing unit, which can ensure that the programs and data in it are protected in terms of confidentiality and integrity.
  • TEE is an isolated execution environment, which can have security functions, such as isolated execution, application integrity executed with TEE, and confidentiality of its assets.
  • TEE provides a more secure execution space for trusted software execution, which is more secure than an operating system and more functional than a secure element.
  • Attestation identity key It can be used to encrypt and sign data to prove the existence of TPM. AIK and EK are bound, but except for the platform where the TPM is located and PCA, other devices cannot obtain the corresponding relationship between AIK and EK, which can guarantee the privacy of users.
  • Timestamp refers to the data generated using digital signature technology, and the signature object includes original file information, signature parameters, signature time and other information.
  • Trusted cryptography module A module of a trusted computing platform, which provides cryptographic computing functions for the trusted computing platform and has a protected storage space.
  • FIG. 3 is a schematic diagram of an initialization registration process of a network element.
  • both the network function service consumer and the network function service provider need to register on the network storage network element.
  • the following uses the registration process of the first network element as an example to illustrate the communication method provided by the embodiment of the present application.
  • the registration process of the network function service consumer and the network function service provider is similar, and for the sake of brevity, no repeated description is given here.
  • the first network element sends a registration request message.
  • the registration request (registration_request) message is used to request registration of the first network element.
  • the registration request message includes trusted platform identification information, where the trusted platform identification information is used to indicate the trusted platform type of the first network element.
  • the network registration request message includes a network function profile (network function profile, NF Profile), and the trusted platform identification information is included in the NF Profile.
  • NF Profile network function profile
  • the trusted platform identification information of the first network element may be pre-configured to the network storage network element before the first network element sends the registration request. In this way, the trusted platform identification information may not be included in the registration request message.
  • the first network element receives and sends a registration response message.
  • the registration response (registration_response) message is used to respond to the registration request message.
  • the registration response message is also used to indicate the verification result of the first certificate, where the first certificate is used to verify whether the first trusted platform of the first network element is trustworthy.
  • the registration response message includes the first trusted certificate of the first network element, and the first trusted certificate is used to prove that the first trusted platform is trustworthy.
  • the network storage network element can determine whether to issue a certificate for the trusted platform of the first network element. For a specific trusted platform, there is no need to issue a trusted certificate, and the registration The trusted certificate no longer needs to be included in the response message.
  • the registration response message indicates that the verification of the first certificate fails, and at this time the registration response message may also be called a registration rejection (registration reject) message.
  • the first network element after receiving the registration response message indicating that the first certificate verification fails, the first network element sends a re-registration request message, the re-registration request message is used to request registration of the first network element, and the re-registration request message A second certificate is included, and the second certificate is used to verify whether the second trusted platform of the first network element is trustworthy.
  • the verification result of the first certificate of the first network element is included in the registration response message, and the first network element can determine whether to complete the registration after receiving the registration response message.
  • the first network element can obtain the first trusted certificate, which can be used as the identity certificate of the first network element; when the registration fails, the first network element can determine that the registration failure is due to the first If the verification of the first certificate of the trusted platform fails, then the trusted platform is replaced or other methods are used to prepare for the next registration request.
  • the implementation of the technical solution is conducive to improving the registration efficiency of the first network element.
  • FIG. 4 is a schematic diagram of an authorization request flow of a network function service consumer.
  • the network function service consumer sends an authentication permission message.
  • the authentication grant (authorization_grant) message is used to request to obtain an access token, which includes service information that the network function consumer is entitled to access.
  • the authentication permission message further includes a second trusted certificate, and the second trusted certificate is used to verify whether the trusted platform of the network function service consumer is trusted.
  • the authentication permission message further includes first certification information, the first certification information is generated according to the first challenge data, and the first certification information is used to prove whether the network function service consumer is credible.
  • the first challenge value is any one of a timestamp, a first random number, a second random number, and a value in an agreed field
  • the first random number is a random number provided by a trusted third party
  • the The second random number is a random number generated for checking whether the trusted platform of the network function service consumer is credible.
  • the first challenge value is a time stamp
  • the time stamp is clock information trusted by both the network function service consumer and the network storage network element.
  • the first challenge value is clock information generated by a TPM trusted platform with network function service consumers.
  • the first challenge value is a value of a promise field
  • the promise field may be determined according to a network protocol that both the network function service consumer and the network storage network element comply with.
  • the bit data from the 256th to the 320th bit of the authentication permission message is used as the challenge value, and the network function service consumer and the network storage network element comply with the OAuth 2.0 protocol at the same time, then the network function service consumer obtains The 256th to 320th bit data of the authentication permission message is used as the challenge value.
  • the first challenge value is a first random number
  • the first random number is a random number trusted by both the network function service consumer and the network storage network element.
  • the first random number is generated through the blockchain (such as the timestamp or hash value of the latest block of the blockchain), and the network function service consumer uses the first random number as a challenge value after obtaining the first random number .
  • the time stamp, the value of the agreed field, the first random number and the second random number are used as random numbers and used to generate proof information, which can realize multiple ways of trusted verification. Choose an appropriate way to determine the challenge value according to the situation, so as to complete the credible verification, which is conducive to improving the adaptability of the communication method integrating credible metrics provided by this application in different application scenarios.
  • the network function service consumer sends certification information or certification results to network storage network elements according to an agreed trigger mechanism.
  • the trigger mechanism is triggered periodically according to an agreed time or triggered in response to a specific event.
  • the network function service consumer triggers the action of sending the certification result after receiving the first certification identification information.
  • the network function service consumer receives the first certification identification information, the first certification identification information is used to request to obtain the first certification information or the second certification result, and the first certification information is used to verify the network function service consumption Whether the provider is credible, the second proof result includes the proof result that the network function service consumer has been proven credible.
  • the prover can generate proof information according to the agreed method, which is beneficial for the prover to choose the way of generating proof information according to the actual situation.
  • the network function service consumer receives an authentication response message.
  • the authentication response (authorization_response) message is used to indicate the result of the request to obtain the access token.
  • the authentication response message is used to indicate to obtain an access token
  • the access token includes a first proof result
  • the first proof result includes a verification result that the first proof information is verified
  • the first proof information uses It is used to verify whether the network function service consumer is trustworthy.
  • the access token containing the verification result of the certification information of the first network element can be used in the following service request process.
  • the network function service provider can directly obtain the verification result of the certification information of the network function service consumer of the network storage network element through the access token, without requesting the network function service consumer to regenerate the certification information.
  • the technical solution provided by the embodiment of the present application can obviously simplify the verification process of the network function service consumer in the service request process, and improve the verification efficiency.
  • the first attestation result includes one or more of identity information, trusted content and freshness
  • the identity information is used to indicate the identity of the certifier who certifies that the network function service consumer is trustworthy, that is, the network For the storage network element
  • the trusted content is used to indicate the content that the network function service consumer is certified by the network storage network element
  • the freshness is used to indicate the time when the network function service consumer is certified by the network storage network element.
  • the verifier can directly use the first certification result to judge whether the network function service consumer is valid or not when the network function service consumer is verified next time. It is beneficial to improve the efficiency of credible proof.
  • the identity information of the verifier of the credible proof corresponding to the first proof result can be determined through the identity information of the certifier, and the credible content of the credible proof process corresponding to the first proof result can be determined through the credible content, whether Applicable to this trusted proof, the freshness can determine the completion time of the trusted proof corresponding to the first proof result, and then determine whether the trusted proof result is within the validity period, and judge whether it is necessary to re-do the trusted proof.
  • the authentication response message is used to indicate that the access token has not been obtained, and the authentication response message is used to indicate that the second trusted certificate fails to be verified or the first certification information fails to be verified.
  • the network function service consumer can determine whether to obtain the access token after receiving the authentication response message, and if the access token is not obtained, the trusted certificate included in the authentication response message can be verified. If there is an indication of verification failure or an indication of certification information verification failure, the network function service consumer can re-prepare the trusted certificate or certification information for the next authorization authentication process.
  • the attestation result contained on the access token facilitates the verification of the service request process.
  • the embodiment of the present application is conducive to improving the verification efficiency in the authorization authentication process, and is beneficial to the verification of subsequent network function service consumers.
  • the network function service consumer sends a service request message.
  • the service request message further includes second certification information, the second certification information is generated according to the second challenge value, and the second certification information is used to verify whether the network function service consumer is credible.
  • the second challenge value is any one of a time stamp, a first random number, a second random number, and a value in the agreed field.
  • the time stamp, the value of the agreed field, the first random number and the second random number are used as random numbers and used to generate proof information, which can realize multiple ways of trusted verification. According to the situation, an appropriate method is selected to determine the challenge value, so as to complete the credible verification, which is conducive to improving the adaptability of the communication method integrating credible metrics provided by this application in different application scenarios.
  • the network function service consumer receives a second challenge value, and the second challenge value is used to generate second proof information, and the second proof information is used to prove whether the network function service consumer is trustworthy.
  • the prover can generate proof information according to the agreed method, which is beneficial for the prover to choose the way of generating proof information according to the actual situation.
  • the network function service consumer receives a service response message.
  • the service response message is used to indicate that the service request is accepted, and the credible verification includes second certification information or third certification result verification, and the second certification information is used to verify whether the network function service consumer is credible .
  • the trusted verification further includes a third trusted certificate verification, and the third trusted certificate is used to verify whether the trusted platform of the network function service consumer is trusted.
  • the network function service consumer first checks the first certification result and then checks the second certification information or the third certification result. If the first certification result fails to pass the verification, the second certification information or the third certification 3. Verification of proof results.
  • the trusted content of the first certification result determines that the trusted content is suitable for this verification, and the freshness is determined.
  • the certification result has expired and cannot be used as evidence to prove that the network function service consumer is trustworthy, and the network function service provider requests the network function service consumer to verify the second certification information or the third certification result.
  • the second certification information or the third certification result and the first certification result of the network function service consumer pass the verification, and the network function service consumer obtains the network service with complete authority.
  • the network function service provider When the network function service provider first verifies the first certification result for the network function service consumer, and determines that the trusted content contained in the verification result of the network storage network element is applicable to this time through the credible content of the first certification result Verification, determined by freshness, the first proof result is within the validity period, which can be used as evidence to prove that the consumer of the network function service is credible.
  • the network function service provider no longer requests to obtain the certification information of the network function service consumer, and can provide network service for the network function service consumer.
  • the network storage network element proves the credible certification result, that is, the first certification result can be used to prove that the network element function service consumer is credible. , it can significantly speed up the verification of network function service consumers in the service request process.
  • the service response message is used to indicate that the service request is rejected, and the service response message is also used to indicate that the verification of the third trusted certificate fails or the verification of the second certification information fails or the verification of the third certification result fails or The first proof result verification failed.
  • the trusted platform of the network function service consumer does not need to generate a trusted certificate in the process of realizing trusted certification, and the network function service provider no longer verifies when the network function service consumer requests the service. Trusted certificates.
  • the verification of the certification information and the verification of the certification results are set in the trusted verification. It can realize double verification of network function service consumers, and provide services for network function service consumers according to the verification situation, which is conducive to improving the security of communication between core network elements and core network function service consumers and providers Contains the security of the device.
  • FIG. 6 is a communication method for integrating credibility metrics provided by an embodiment of the present application.
  • the first network element requests to register on the network storage network element, and according to the registration request of the first network element, the network storage network element requests to perform identity authentication on the first network element.
  • the first network element sends a registration request message.
  • the registration request message is used to request registration of the first network element.
  • the network registration request message includes the NF Profile
  • the trusted platform identification information is included in the NF Profile of the first network element.
  • the trusted platform identification information may indicate that the first network element supports one or more of TPM, TCM, Intel SGX and trust zone.
  • the NF Profile sets 4 binary bits as trusted platform identification information, which are used to identify the trusted platform supported by the first network element.
  • 0001 indicates that the first network element supports TPM
  • 0010 indicates that the first network element supports TCM
  • 0100 indicates that the first network element supports Intel SGX
  • 1000 indicates that the first network element supports the trust zone
  • 1010 indicates that the first network element supports The element supports the trust zone and TCM at the same time
  • 0101 indicates that the first network element supports both Intel SGX and TPM.
  • the network storage network element sends an authentication request message.
  • the first network element requests a trusted certificate from a trusted third party (such as PCA), and the authentication request message includes the public key of the network storage network element, wherein the public key of the network storage network element is used to calculate the remote proof required parameters.
  • a trusted third party such as PCA
  • the first network element obtains the trusted certificate of the first network element through DAA
  • the authentication request message includes the challenge value and the public key of the network storage network element
  • the challenge value and the public key of the network storage network element are used for Calculate the parameters needed for remote attestation.
  • the challenge value is included in the authentication request message, and the receiver of the authentication request message prepares parameters related to identity authentication and parameters for remote certification at the same time according to the authentication request message.
  • the first network element generates a remote certification parameter.
  • the remote attestation parameters generated by the first network element are used for the network storage network element to generate a trusted certificate for the first network element, and the remote attestation parameters are determined according to the trusted platform of the first network element.
  • the first network element supports one or more trusted platforms in TPM, TCM, Intel SGX and trust zone.
  • the first network element supports the TPM
  • the remote attestation parameters include: an AIK public key and an EK certificate of the TPM.
  • the first network element supports TCM
  • the remote attestation parameters include: AIK public key and EK certificate of TPM.
  • the first network element sends an authentication response message.
  • the authentication response message includes the remote attestation parameters generated by the first network element and the identity information of the first network element, the remote attestation parameters are used to generate the trusted certificate of the first network element, and the identity information is used to verify The identity of the first network element.
  • the authentication response message includes a remote attestation parameter
  • the remote attestation parameter is used not only to generate a trusted certificate of the first network element, but also to verify the identity of the first network element.
  • the first network element can provide parameters for identity verification to the network storage network element, and according to the OAuth 2.0 protocol, the network storage network element can verify the identity of the first network element according to the parameters. Since the authentication response message also includes the remote attestation parameter, the network storage network element can also use the remote attestation parameter to generate the trusted certificate of the first network element. By using the remote attestation parameter for the identity certification of the first network element, the amount of data contained in the authentication response message can be reduced, which is beneficial to the sending, receiving and processing of the authentication response message.
  • the network storage network element verifies the identity of the first network element, and generates a trusted certificate.
  • the network storage network element verifies the identity of the first network element according to the authentication response message.
  • the network storage network element verifies the identity of the first network element according to the identity information of the first network element in the authentication response message.
  • the network storage network element verifies the identity of the first network element according to the remote certification information in the authentication response message.
  • the identity of the first network element is verified, the remote attestation parameters are verified, and the network storage network element generates a trusted certificate.
  • the identity of the first network element has not passed the verification, and the network storage network element does not generate a trusted certificate.
  • the first network element supports TPM
  • the remote certification parameters included in the authentication response message include the AIK public key and the EK certificate of the TPM.
  • the network storage network element verifies that the EK certificate of the TPM is correct, the network storage network element uses the Sign the AIK public key with the private key to obtain the trusted certificate of the first network element.
  • the network storage network element sends a registration response message.
  • the network storage network element assigns the first network element identifier to the first network element, and the first network element identifier can be used as a link between the first network element and the network storage network element, The identification of the network function service provider when communicating.
  • the trusted certificate generated by the network storage network element is included in the above-mentioned first network element identifier.
  • the identity of the first network element fails to pass the verification, and the network storage network element sends a registration response message to the first network element, indicating that the registration fails.
  • the registration response message may also be called a registration rejection message.
  • the network storage network element uses the trusted certificate as the identity certificate of the first network element when verifying the identity of the first network element later.
  • the first network element with the trusted certificate can directly use the trusted certificate as a kind of identity proof in the subsequent identity verification, which is beneficial to improve the efficiency of the first network element's identity verification.
  • Fig. 7 is another communication method for integrating credibility metrics provided by the embodiment of the present application.
  • the first network element requests to register on the network storage network element, and according to the trusted platform of the first network element, the network storage network element does not need to issue a trusted certificate for the first network element.
  • the first network element sends a registration request message.
  • the trusted platform identification information has been configured on the network storage network element before the first network element sends the registration request message, and the registration request message does not include the trusted platform identification information.
  • the network storage network element can obtain the registration request of the first network element, and according to the content of the registration request message or other methods, the network storage network element can obtain the trusted platform type of the first network element, and then according to the The platform type responds.
  • the network storage network element verifies the identity of the first network element.
  • the first network element supports the Intel SGX trusted platform, and the network storage network element does not need to sign a trusted certificate for the first network element. After receiving the registration request message from the first network element, the network storage network element verifies the identity of the first network element according to the content of the registration request message.
  • the first network element supports the ArmTrustZone trusted platform, and the network storage network element does not need to sign a trusted certificate for the first network element.
  • the network storage network element After receiving the registration request message from the first network element, the network storage network element verifies the identity of the first network element according to the content of the registration request message.
  • the network storage network element sends a registration response message.
  • the identity of the first network element is verified by the network storage network element, and the network storage network element sends a registration response message to the first network element, indicating that the registration of the first network element is successful.
  • the identity of the first network element fails the verification of the network storage network element, and the network storage network element sends a registration rejection message to the first network element, indicating that the first network element fails the identity verification and the registration fails.
  • the application of the communication method provided by the embodiment of the present application in the registration process of the core network element is described by taking the registration process of the first network element as an example with reference to FIG. 6 and FIG. 7 .
  • Fig. 8 is another communication method for integrating credibility metrics provided by the embodiment of the present application.
  • the network function service consumer requests the network storage network element to obtain an access token, and after the network storage network element passes the verification of the network function service consumer, it issues an access token to the network function service consumer. access token.
  • the network function service consumer generates a remote certification parameter.
  • the remote attestation parameters generated by the network function service consumer are used to generate a trusted certificate, and the remote attestation parameters are determined according to the trusted platform supported by the network function service consumer.
  • the network function service consumer supports one or more trusted platforms among TPM, TCM, Intel SGX, and ArmTrustZone.
  • the network function service consumer sends an access token acquisition request message.
  • the access token acquisition request (access_token_get_request) message is used to initiate a request to the recipient of the message to obtain an access token.
  • the access token acquisition request message includes the remote proof parameters generated by the network function service consumer and the parameters acquired during the registration process.
  • the trusted certificate is used to verify whether the trusted platform of the network function service consumer is trustworthy.
  • the usage time of the access token acquired by the network function service consumer has exceeded the timeout period of the token, and the network function service consumer obtains the access token through a refresh token (refresh token) request.
  • the network storage network element can obtain the request of the network function service consumer to obtain the access token. Since the message also includes the trusted certificate of the network function service consumer, the network storage network element can obtain the access token in the Verify the trusted certificate of the network function service consumer after receiving the access token acquisition request message.
  • the network storage network element verifies the trusted certificate of the network function service consumer.
  • the trusted certificate includes the signature of the network storage network element and the public key of the network function service consumer during the registration process. After receiving the access token acquisition request message, the network storage network element verifies the signature of the trusted certificate and the public key of the network function service consumer contained in the trusted certificate, thereby verifying the identity of the network function service consumer.
  • the network storage network element sends a certification request message.
  • the certification request message is used to send a certification request to the receiver of the certification request message.
  • the proof request message includes a challenge value, which is used to generate proof information, and the challenge value is a random number that can also be used to prevent replay of the proof request message.
  • the network storage network element After verifying that the identity of the network function service consumer is correct, the network storage network element needs to further verify whether the software and/or hardware of the network function service consumer is trustworthy. By sending a challenge value to the network function service consumer, the network function service consumer The operator may obtain a request from the network storage network element to further verify the data such as the measurement value of the software and/or hardware of the network function service consumer.
  • the network function service consumer prepares certification information or a certification result.
  • Attestation information can also be called attestation evidence or attestation data (attestation data), which is generated by network function service consumers in response to attestation request messages, including software and/or hardware measurements of network function service consumers and other data information.
  • the certification information includes a quote (quote) and a measurement log (event_log), the quote is a summary of the measurement log, and is used to verify whether the content of the measurement log has been tampered with.
  • the measurement log includes the network function service consumer's Measurement records for software and/or hardware.
  • the reference is a hash value of the measurement log, through which the full text of the measurement log can be restored, and then compared with the measurement log contained in the certification information, to realize verification of the verification data.
  • the network function service consumption supports a TPM trusted platform
  • the certification information includes a reference and a measurement log
  • the reference includes an identification of a platform configuration register (platform configuration register, PCR), a signature of the PCR identification, and a summary of the measurement log
  • the metric log includes metric records of software and/or hardware of the network function service consumer.
  • the first certification information may include one or more of the following information:
  • the certification result includes one or more of identity information, trusted content and freshness
  • the identity information is used to indicate the identity of the verifier of the first certification information
  • the trusted content is used to indicate The credible content in the first certification information
  • the freshness is used to indicate the time when the first certification information was verified.
  • the attestation results include one or more of the following information:
  • the verifier verifies the configuration of the verifier
  • File system (file-system): The verifier verifies the file system of the verifier;
  • the verifier has verified the hardware and firmware of the verifier, and can sign and run the program;
  • Proof environment identity the verifier verifies the identity of the proof environment of the verifier, such as AIK of TPM;
  • Runtime visibility The verifier verifies the visibility of the prover from outside the memory of the verifier;
  • Sourced-data The verifier verifies the integrity of the data used by the verifier
  • Storage visibility (storage-opaque): The verifier verifies that the verifier can encrypt persistent storage.
  • the network function service consumer sends certification information or a certification result.
  • the network function service consumer before sending the certification information, uses the private key of the network function service consumer to encrypt the certification information, and the information encrypted by the private key can be decrypted by using the public key corresponding to the private key .
  • the proof information includes a random number, which is used for anti-replay of the proof information.
  • the sender of the certification request information can obtain information such as the measurement value of the software and/or hardware of the network function service consumer, so as to further judge whether the operating environment of the network function service consumer is credible based on the certification information .
  • the network stores the verification certificate information of the network element.
  • verification of the certification information can be achieved by comparing the content of the full-text data recovered by reference to the measurement log.
  • the certificate information is encrypted by the private key of the network function service consumer, and the verification of the certificate information can be realized according to whether the private key of the network function service consumer possessed by the network storage network element can decrypt the certificate information.
  • the certification information includes a metric value
  • the metric value is data related to the running state of the software and/or hardware of the first network element
  • the metric log records the possible state of the software and/or hardware of the first network element.
  • the process information of the credit measurement, the process information can be calculated to obtain the status information, so that the verification of the certification information can be realized by comparing the measurement value in the certification information with the content of the measurement log.
  • the network storage network element verifies whether the network function service consumer is authorized.
  • the network storage network element verifies whether the network function service consumer is authorized to access the requested service according to the OAuth 2.0 protocol.
  • the network storage network element generates an access token.
  • An access token (access_token) is used to indicate that the holder of the access token has permission to access resources, data or services.
  • the access token includes a first attestation result
  • the first attestation result includes attestation results that the network function service consumer is certified to be credible by the network storage network element.
  • the network function service consumer can check whether the network function service consumer is determined according to the proof result in the access token. Verification is carried out through the verification of proof information, so as to realize double verification.
  • the network storage network element sends an access token acquisition response message.
  • the access token acquisition response message is used to respond to the access token acquisition request message sent by the network function service consumer.
  • the access token acquisition response message includes the access token issued by the network storage network element.
  • the access token acquisition response message also includes a refresh token
  • the network function service consumer can use the refresh token to re-submit to the network storage network when the usage time of the access token exceeds the timeout period of the token.
  • Meta application token
  • the network function service consumer can use the access token to obtain the requested service from the network function service provider.
  • Fig. 9 is another communication method for integrating credibility metrics provided by the embodiment of the present application.
  • the network function service consumer requests the network storage network element to acquire an access token
  • the trusted certificate of the network function service consumer fails the verification of the network storage network element
  • the network storage network element refuses to A web function service consumer issues access tokens.
  • the network function service consumer generates a remote certification parameter.
  • the remote attestation parameters generated by the network function service consumer are used for the network storage network element to generate a trusted certificate for the network function service consumer, and the remote attestation parameters are determined according to the trusted platform supported by the network function service consumer.
  • the network function service consumer supports one or more trusted platforms among TPM, TCM, Intel SGX, and ArmTrustZone.
  • the network function service consumer sends an access token acquisition request message.
  • the access token acquisition request message is used to initiate a request to the recipient of the message to acquire an access token
  • the access token acquisition request message includes the remote attestation parameters generated by the network function service consumer and the Trusted certificates obtained during the process.
  • the network storage network element can obtain the request of the network function service consumer to obtain the access token. Since the message also includes the trusted certificate of the network function service consumer, the network storage network element The trusted certificate of the network function service consumer may be verified after receiving the access token acquisition request message.
  • the network storage network element verifies the trusted certificate of the network function service consumer.
  • the network storage network element inquires the signer of the signature period through the signature of the trusted certificate, and verifies that the trusted certificate is not within the validity period according to the period.
  • the network storage network element obtains the public key of the network function service consumer according to the trusted certificate, and uses the public key to decrypt the encrypted information sent by the network function service consumer. It is determined that the public key cannot decrypt the network function service Encrypted information sent by consumers.
  • the network storage network element verifies the authenticity of the trusted certificate of the network function service consumer, so as to judge whether the owner of the trusted certificate is to perform the next verification or reject the request of the trusted certificate owner, which is conducive to improving Security of network storage network elements and other network elements.
  • the network storage network element sends an access token acquisition response message.
  • This message may also be called an access token acquisition rejection (accesstoken_get_reject) message or an authentication rejection (authorization_reject) message. Since the verification of the trusted certificate of the network function service consumer fails, the network storage network element rejects the access token acquisition request of the network function service consumer, and the network storage network element sends an authorization rejection message to the network function service consumer.
  • access token acquisition rejection access token_get_reject
  • authorization_reject authentication rejection
  • the authorization denial message is also used to indicate that the verification of the trusted certificate of the network function service consumer fails.
  • the network function service consumer forges the signature of the trusted certificate or forges the trusted certificate in an attempt to deceive the network storage network element. Denying the network function service consumers is conducive to improving the security of the network and network elements.
  • Fig. 10 is another communication method for integrating credibility metrics provided by the embodiment of the present application.
  • the network function service consumer requests the network storage network element to obtain an access token, and the network function service consumer sends certification information to the network storage network element after passing the verification of the trusted certificate. The proof information has not passed the verification of the network storage network element.
  • the contents of S901 to S906 are consistent with the contents of S701 to S706.
  • the network stores the verification certificate information of the network element.
  • the proof information includes a metric value
  • the metric log is calculated and the state value of the software and/or hardware of the network function service consumer contained in the metric value is calculated, and the state value obtained by the calculation is consistent with the state value in the proof information If the metric values are different, it proves that the verification of the information fails.
  • the network storage network element sends an access token acquisition rejection message.
  • the access token acquisition rejection message is also used to indicate that the certification information of the network function service consumer fails the verification.
  • the network function service consumer is an insecure network element or a device carrying a threat.
  • the forged trusted certificate of the network function service consumer has passed the verification of the network storage network element, but its forged certification information It cannot pass the verification of network storage network elements. Refusing to issue an access token to the network function service consumer is conducive to improving the security of the network, core network elements, and user data.
  • Fig. 11 is another communication method for integrating credibility metrics provided by the embodiment of the present application.
  • the network function service consumer requests the network storage network element to obtain an access token, and the network storage network element verifies the network function service consumer's trusted certificate and certification information.
  • the network function service consumer is not authorized to apply for an access token, and the network storage network element refuses the network function service consumer to issue an access token.
  • the contents of S1001 to S1007 are consistent with the contents of S701 to S707.
  • the network storage network element verifies whether the network function service consumer is authorized.
  • the network storage network element After passing the verification of the trusted certificate and proof information, the network storage network element verifies that the network function service consumer is not authorized to access the service requested by the network function service consumer according to the OAuth 2.0 protocol, and the network storage network element rejects the request of the network function service consumer Access token acquisition request, send access token acquisition rejection message to network function service consumer
  • this message is also used to indicate that the web function service consumer is not authorized to request an access token.
  • the network storage network element generates an access token acquisition rejection message.
  • the network storage network element refuses to provide the access token to the network function service consumer, and the network storage network element sends an access token acquisition rejection message to the network function service consumer.
  • the access token acquisition rejection message is also used to indicate that the network function service consumer is not authorized to apply for an access token.
  • the network storage network element rejects the access token acquisition request of the unauthorized network function service consumer, which helps to reduce the service load of the network function service provider, helps to ensure the service quality of the authorized network function service consumer, and is beneficial to Improve the security of the network, network elements, and network users.
  • Fig. 12 is another communication method for integrating credibility metrics provided by the embodiment of the present application.
  • the network function service consumer sends an access token acquisition request message to the network storage network element, requesting to obtain the access token, and the request message also includes the proof information generated by the challenge value, and the network storage
  • the network element After the network element receives the access token acquisition request message, it obtains the trusted certificate and certification information at the same time.
  • the network storage network element verifies the trusted certificate and certification information in turn, and whether the network function service consumer is authorized. After determining the above information After correct, issue an access token to the network function service consumer.
  • the network function service consumer generates a remote certification parameter.
  • the remote attestation parameters generated by the network function service consumer are used for the network storage network element to generate a trusted certificate for the network function service consumer, and the remote attestation parameters are determined according to the trusted platform supported by the network function service consumer.
  • the network function service consumer supports one or more trusted platforms among TPM, TCM, Intel SGX, and ArmTrustZone.
  • the network function service consumer uses any one of the timestamp, the first random number, the second random number, and the value of the agreed field to generate the proof information as the challenge value.
  • the challenge value is a time stamp
  • the time stamp is clock information generated by the TPM trusted platform of the network function service consumer.
  • the challenge value is a value of an agreed field
  • the agreed field may be determined according to a network protocol that both the first network device and the second network device comply with.
  • the challenge value is a first random number
  • the first random number is a random number trusted by both the first network device and the second network device
  • the first random number can be obtained by a trusted third party supply.
  • the network function service consumer sends an access token acquisition request message.
  • the network storage network element verifies the trusted certificate and proof information.
  • the trusted certificate includes the signature of the network storage network element and the public key of the network function service consumer during the registration process. After receiving the access token acquisition request message, the network storage network element verifies the signature of the trusted certificate and the public key of the network function service consumer included in the trusted certificate, thereby verifying the identity of the network function service consumer.
  • the network storage network element verifies whether the network function service consumer is authorized.
  • the network storage network element generates an access token.
  • An access token is used to indicate that the holder of the access token has permission to access a resource, data, or service.
  • the access token includes first identification information, and the first identification information is used to identify whether the network function service consumer verifies the certification information.
  • the network storage network element does not remotely authenticate the network function service consumer, but also issues an access token for the network function service consumer, and the access token includes the attestation result, and the attestation result is used to indicate the network function The service consumer did not verify the proof information.
  • the attestation result is used to identify that the network function service consumer has not passed the remote attestation verification.
  • the network function service consumer can check whether the network function service consumer can use the proof result in the access token Verification is done via remote attestation verification.
  • the network function service consumer sends an access token acquisition response message.
  • the access token acquisition response message is used to respond to the access token acquisition request message sent by the network function service consumer.
  • the access token acquisition response message includes the access token issued by the network storage network element.
  • the network function service consumer can use the access token to request the service from the network function service provider.
  • Fig. 13 is another communication method of credibility measurement provided by the embodiment of the present application.
  • the trusted platform supported by the network function service consumer does not need to generate a trusted certificate when registering on the network storage network element.
  • the network storage network element supports the network function service consumer.
  • the trusted platform determines that it is not necessary to verify the trusted certificate of the network function service consumer. After confirming that the proof information is correct and that the network function service consumer is authorized to apply for an access token, the network storage network element issues an access token to the network function service consumer.
  • the attestation information is generated with a timestamp as the challenge value.
  • the network function service consumer sends an access token acquisition request message.
  • the generated certification information can be sent to the network storage network element while sending the access token acquisition request message.
  • the network storage network element can directly verify the certification information of the network function service consumer, which is conducive to improving the efficiency of information verification by the network storage network element, and is conducive to the access of network function service consumers Token acquisition.
  • the network stores the verification certificate information of the network element.
  • the identity of the sender of the certification information By verifying the certification information, the identity of the sender of the certification information, whether the certification information is complete, whether the certification information has been tampered with, etc. can be determined, which helps to reduce the threats that may be caused by the above factors and helps to improve the security of the core network elements.
  • the network storage network element verifies whether the network function service consumer is authorized.
  • the network storage network element verifies whether the network function service consumer is authorized to access the requested service according to the OAuth 2.0 protocol.
  • the network storage network element generates an access token.
  • the network function service consumer sends an access token acquisition response message.
  • the access token acquisition response message is used to respond to the access token acquisition request message sent by the network function service consumer.
  • the access token acquisition response message includes the access token issued by the network storage network element.
  • the network function service consumer can use the access token to request the service from the network function service provider.
  • the application of the communication method provided by the embodiment of the present application in the process of obtaining the access token by the network function service consumer is described above in conjunction with FIG. 8 to FIG. 13 .
  • the communication method provided in the embodiment of the present application is described below in conjunction with FIG. 14 to FIG. 20 Applied when network function service consumers access network services.
  • Fig. 14 is another communication method for integrating credibility metrics provided by the embodiment of the present application.
  • the network function service consumer requests to access the service provided by the network function service provider, and the network function service provider first verifies the network function service consumer. After passing the verification by the network function service provider, the network function service consumer makes a verification request to the network function service provider, and then verifies the network function service provider.
  • a network function service consumer generates a first remote certification parameter.
  • the first remote attestation parameter is used to generate a trusted certificate of the network function service consumer.
  • the network function service consumer sends a service request message.
  • the service request message is used to request a service from the receiver of the service request.
  • the service request includes the access token obtained in the process of obtaining the access token, the trusted certificate obtained in the registration process, and the first remote attestation parameter generated in S1301.
  • the network function service provider verifies the first trusted certificate of the network function service consumer.
  • the first trusted certificate is used to verify whether the trusted platform of the network function service consumer is trusted.
  • the method for verifying the first trusted certificate is similar to the method for verifying the trusted certificate in S703. For details, please refer to S703, which will not be repeated here.
  • the network function service provider can determine whether the trusted platform of the network function service consumer is authentic and credible.
  • the network function service provider sends a first certification request message.
  • the first certification request message is used to send a certification request to the network function service consumer, requiring the network function service consumer to provide data such as the measurement value of its software and/or hardware, so as to judge the network according to the data such as the measurement value of the software and/or hardware. Whether the function service consumer is trustworthy.
  • the network function service consumer generates first certification information.
  • the first certification information includes data such as software and/or hardware metric values of the network function service consumer, and is used to determine whether the network function service consumer is credible.
  • the type of information included in the first certification information is similar to the certification information described in S705, and will not be repeated here. For specific content, refer to the description in S705.
  • the network function service consumer sends first certification information.
  • the network function service provider can obtain information such as software and/or hardware measurement values of the network function service consumer, so as to further judge whether the network function service consumer is credible according to the certification information.
  • the network function service provider verifies the first certification information.
  • the identity of the sender of the first certification information By verifying the certification information, the identity of the sender of the first certification information, whether the certification information is complete, whether the certification information has been tampered with, etc. can be determined, thereby helping to reduce the probability of threats caused by the above factors and improving the security of core network elements. safety.
  • the network function service provider verifies the access token of the network function service consumer.
  • Access tokens are used to indicate that a network function service consumer has permission to access a resource, data, or service.
  • the access token includes a first certification result, where the first certification result is used to identify that the first certification information of the network function service consumer has passed the verification of the network storage network element.
  • the access token includes a first certification result, where the first certification result is used to identify that the first certification information of the network function service consumer has not passed the verification of the network storage network element.
  • the network function service consumer By verifying the access token of the network function service consumer, it can be determined whether the network function service consumer has the authority to access the service determined by the access token, the type of service that the network function service consumer can access, and the network function service consumer can also be determined. Functional service consumers can access information such as the time of the service.
  • the network function service provider verifies the first certification result of the network function service consumer.
  • the first certification result identifying the first certification information of the network function service consumer passes the verification of the network storage network element, and the network function service provider provides the network function service consumer with the requested service.
  • S1309 may not be executed.
  • the second remote attestation parameter is used to generate a trusted certificate of the network function service provider.
  • the network function service provider sends a service response message.
  • the network function service consumer verifies the second trusted certificate of the network function service provider.
  • the second trusted certificate is used to indicate whether the trusted platform of the network function service provider is trusted.
  • the method for verifying the second trusted certificate is similar to the method for verifying the trusted certificate in S703. For details, please refer to S703, which will not be repeated here.
  • the network function service consumer can determine whether the network function service provider is registered with the network storage network element and the trusted platform of the network storage network element is credible.
  • the network function service consumer sends a second certification request message.
  • the second certification request message is used to send a certification request to the network function service provider, requiring the network function service provider to provide data such as the measurement value of its software and/or hardware, so as to judge the network according to the data such as the measurement value of the software and/or hardware. Whether the function service provider is credible.
  • the network function service provider generates second certification information.
  • the second certification information includes data such as software and/or hardware measurement values of the network function service provider, and is used to determine whether the network function service provider is credible.
  • the type of information included in the second verification data is similar to the verification information described in S705, and will not be repeated here, and details can refer to the description in S705.
  • the network function service provider sends second certification information.
  • the network function service consumer can obtain the network function service provider's software and/or hardware measurement value and other data information, so as to further judge whether the network function service provider is credible according to the certification information.
  • the network function service consumer verifies the second certification information.
  • the network function service consumer establishes a service relationship with the network function service provider.
  • the network function service consumer After determining that the trusted platform of the network function service provider and the network function service provider are credible, the network function service consumer establishes a connection with the network function service provider, and the network function service consumer obtains the requested service from the network function service provider .
  • Fig. 15 is another communication method for integrating credibility metrics provided by the embodiment of the present application.
  • the network function service consumer requests to access the service provided by the network function service provider.
  • the network function service consumer generates a first remote certification parameter, and in S1102, sends the first remote certification parameter to the network function service provider.
  • the contents of these two steps are respectively consistent with the contents of S1001 and S1002, and will not be repeated here.
  • the network function service provider verifies the first trusted certificate.
  • the network function service provider verifies the signature of the first trusted certificate, and determines that the first trusted certificate is not within the validity period.
  • the network function service provides a public key that verifies the first trusted certificate, determines that the public key cannot decrypt the encrypted information sent by the network function service consumer.
  • a network function service consumer whose trusted certificate cannot pass the verification may carry unsafe factors, and refusing the network function service consumer is conducive to improving the security of network elements and networks.
  • the first trusted certificate of the network function service consumer passes the verification, but the first certification information fails the verification, and the network function service provider refuses to provide services to the network function service consumer.
  • the contents of S1501 to S1506 are respectively consistent with the contents of S1301 to S1306, and will not be repeated here.
  • the content of the restored full-text data quoted in the proof information is different from the content of the measurement log, and the verification of the proof information fails.
  • the public key of the network function service consumer possessed by the network storage network element cannot decrypt the certification information, and the verification of the certification message fails.
  • the proof information includes a metric value
  • the metric log is calculated and the state value of the software and/or hardware of the network function service consumer contained in the metric value is calculated, and the state value obtained by the calculation is consistent with the state value in the proof information If the metric values are different, it proves that the verification of the information fails.
  • the network function service provider refuses to provide services to the network function service consumer.
  • the network function service consumer whose information cannot pass the verification may carry unsafe factors, and rejecting the network function service consumer is beneficial to improve the security of the network element and the network.
  • Fig. 17 is another communication method for integrating credibility metrics provided by the embodiment of the present application.
  • the first trusted certificate and the first certification information of the network function service consumer pass the verification, but the third certification result indicates that the network function service consumer did not verify the certification information during the authorization stage,
  • the network function service provider refuses to provide services to the network function service consumer.
  • the first certification result is used to indicate whether the network function service consumer has passed the verification of the certification information of the network storage network element in the process of applying for the access token.
  • the first certification result is used to indicate that the network function service consumer has not passed the verification of the trusted information of the network storage network element.
  • the scenario where the network function service consumer requests services has high requirements on time delay and low security requirements, and the network storage network element has not verified the certificate information of the network function service consumer, the first certificate The result indicates that the network function service consumer has not passed the verification of the trusted information of the network storage network element.
  • the network function service provider sends a service rejection message to the network function service consumer.
  • the network function service provider refuses to provide services to the network function service consumer.
  • the network function service consumer whose first proof result fails to pass the verification may carry unsafe factors, and rejecting the network function service consumer is conducive to improving the security of the network element and the network.
  • Fig. 18 is another communication method for integrating credibility metrics provided by the embodiment of the present application.
  • the contents of S1701 to S1711 are respectively consistent with the contents of S1301 to S1311, and will not be repeated here.
  • the network function service consumer verifies the second trusted certificate.
  • the network function service consumer verifies the signature of the second trusted certificate, and determines that the second trusted certificate is not within the validity period.
  • the network function service consumer verifies the public key of the second trusted certificate, and determines that the public key cannot decrypt the encrypted information sent by the network function service provider.
  • the network function service consumer sends a service cancellation message to the network function service provider.
  • the network function service consumer cancels obtaining the service from the network function service provider.
  • a network function service provider whose trusted certificate cannot pass the verification may carry unsafe factors, and canceling the service obtained from the network function service provider is conducive to improving the security of network elements and networks.
  • Fig. 19 is another communication method for integrating credibility metrics provided by the embodiment of the present application.
  • the network function service consumer passes the verification of the network function service provider, and the certification information of the network function service provider fails to pass the verification of the network function service consumer, and the network function service consumer cancels the verification of the network function service consumer A function service provider acquires a service.
  • the contents of S1801 to S1815 are respectively consistent with the contents of S1301 to S1315.
  • the network function service consumer verifies the second certification information.
  • the recovered full-text data quoted in the second proof information is different from the content of the measurement log, and the verification of the second proof information fails.
  • the public key of the network function service provider owned by the network function service consumer cannot decrypt the proof information, and the verification of the proof message fails.
  • the proof information includes a metric value
  • the metric log is obtained through calculation and the state value of the software and/or hardware of the network function service provider contained in the metric value, and the state value obtained by the calculation is consistent with the state value in the proof information If the metric values are different, it proves that the verification of the information fails.
  • the network function service consumer sends a service cancellation message to the network function service provider.
  • the network function service consumer cancels obtaining services from the network function service provider.
  • the network function service provider whose proof information fails to pass the verification may carry unsafe factors, and canceling the service from the network function service provider is conducive to improving the security of network elements and networks.
  • Fig. 20 is another communication method for integrating credibility metrics provided by the embodiment of the present application.
  • the network function service consumer requests to obtain the service provided by the network function service provider, and generates proof information with the timestamp as the challenge value, and the network function service provider can simultaneously verify the network function service consumer’s Trust certificates and attestation information, and verify access tokens and identity information. After confirming that the information to be verified by the network function service consumer is correct, the network function service provider generates certification information based on the trusted platform without generating a trusted certificate. The network function service provider sends the certification information to the network function service consumer by sending a service response message, and the network function service consumer obtains the service from the network function service provider after verifying that the certification information is correct.
  • the network function service consumer generates a first remote certification parameter and first certification information.
  • the network function service consumer generates the first certification information with the timestamp as the challenge value.
  • the timestamp refers to a time value related to the network function service consumer, for example, the time when the network function service consumer sends and receives a certain message.
  • the service request message is used to request a service from the receiver of the service request.
  • the service request includes the access token acquired in the access token acquisition process, the trusted certificate acquired in the registration process, and the first remote attestation parameter and first attestation information generated in S1301.
  • the network function service provider verifies the first trusted certificate and the first certification information.
  • the first trusted certificate is used to instruct the network function service consumer to pass the verification of the network storage network element.
  • the method for verifying the first trusted certificate is similar to the method for verifying the trusted certificate in S703. For details, please refer to S703, which will not be repeated here.
  • the network function service provider can determine whether the network function service consumer is registered with the network storage network element and passes the verification of the network storage network element.
  • the access token includes a first attestation result identifying that the network function service consumer's remote attestation was verified.
  • the access token includes a first attestation result identifying that the web function service consumer has not been verified by the remote attestation.
  • the network function service consumer By verifying the access token of the network function service consumer, it can be determined whether the network function service consumer has the authority to access the service determined by the access token, the type of service that the network function service consumer can access, and the network function service consumer can also be determined. Functional service consumers can access information such as the time of the service.
  • the network function service provider verifies the first certification result of the network function service consumer.
  • the first attestation result identifies that the network function service consumer has not passed the remote attestation verification, and the network function service provider provides limited services to the network function service consumer.
  • the first attestation result identifies that the network function service consumer has verified through the remote attestation that the network function service provider provides the service requested by the network function service consumer.
  • S1905 may not be executed.
  • the network function service provider generates a second remote certification parameter.
  • the network function service provider generates the second certification information according to the trusted platform of the network function service provider, and the second certification information includes data such as the software and/or hardware measurement value of the network function service provider, and is used for judging and judging the network function service Whether the provider is trustworthy.
  • the network function service provider sends a service response message.
  • the network function service consumer verifies the second certification information.
  • the network function service consumer establishes a service relationship with the network function service provider.
  • the network function service consumer After determining that the operating environment of the network function service provider is credible, the network function service consumer establishes a connection with the network function service provider, and the network function service consumer obtains the requested service from the network function service provider.
  • the communication device may have the functions of the first network element, the network storage network element, the network function service consumer, and the network function service provider in the above method embodiment, and may be used to perform the functions of the first network element in the above method embodiment The steps performed by the network element, the network storage network element, the network function service consumer and the network function service provider.
  • the communication device 2100 shown in FIG. 21 may serve as the first network element involved in the above method embodiment, and execute the steps performed by the first network element in the above method embodiment.
  • the communication device 2100 may include a sending module 2110 and a receiving module 2120 .
  • the sending module 2110 may be used to support the communication device 2100 to send information, for example, to perform the sending action performed by the first network element in S201, S501, S504 and S601 in FIG. 3 , FIG. 6 and FIG. 7 .
  • the receiving module 2120 may be used to support the communication device 2100 to receive information, for example, to perform the receiving actions performed by the first network element in S202, S502 and S506 in FIG. 3 , FIG. 6 and FIG. 7 .
  • the communication device 2100 may further include a processing module 2130, which is coupled to the sending module 2110 and the receiving module 2120, and may be used to support the communication device 2100 to perform the processing actions in the above method embodiments, for example, to perform the processing actions in FIG. 6 S503 and S507 and other processing actions performed by the first network element.
  • a processing module 2130 which is coupled to the sending module 2110 and the receiving module 2120, and may be used to support the communication device 2100 to perform the processing actions in the above method embodiments, for example, to perform the processing actions in FIG. 6 S503 and S507 and other processing actions performed by the first network element.
  • the communication device 2100 shown in FIG. 21 may serve as the network storage network element involved in the above method embodiment, and execute the steps performed by the network storage network element in the above method embodiment.
  • the communication device 2100 may include a sending module 2110 and a receiving module 2120 .
  • the sending module 2110 can be used to support the communication device 2100 to send information, for example, execute S202, S302, In S502, S506, S603, S704, S710, S804, S904, S908, S1004, S1009, S1106 and S1206, the sending action performed by the network element of the network storage.
  • the receiving module 2120 can be used to support the communication device 2100 to receive information, for example, execute S201, S301, In S501 , S504 , S601 , S702 , S706 , S802 , S902 , S906 , S1002 , S1006 , S1102 and S1202 , the network storage network element executes the receiving action.
  • the communication device 2100 may further include a processing module 2130, which is coupled to the sending module 2110 and the receiving module 2120, and may be used to support the communication device 2100 to perform the processing actions in the above method embodiments, for example, to perform the processing actions in FIG. 6 and FIG. 7.
  • S505, S602, S707, S708, S709, S803, S903, S907, S1003, S1007, S1008, S1103, S1104, S1105, S1203 in Fig. 8, Fig. 9, Fig. 10, Fig. 11, Fig. 12 and Fig. 13 , S1204, and S1205 are processing actions performed by network storage network elements.
  • the communication device 2100 may include a sending module 2110 and a receiving module 2120 .
  • the sending module 2110 can be used to support the communication device 2100 to send information, for example, execute the steps shown in Figure 4, Figure 5, Figure 8, Figure 9, Figure 10, Figure 11, Figure 12, Figure 13, Figure 14, Figure 15, Figure 16, Figure 17 , S301, S401, S702, S706, S802, S902, S906, S1002, S1006, S1102, S1202, S1302, S1306, and S1313 in FIG. 18, FIG. 19, and FIG. 20 are performed by the network function service consumer.
  • the receiving module 2120 can be used to support the communication device 2100 to receive information, for example, execute the information shown in Figure 4, Figure 5, Figure 8, Figure 9, Figure 10, Figure 11, Figure 12, Figure 13, Figure 14, Figure 15, Figure 16, Figure 17 , S302, S402, S704, S710, S804, S904, S908, S1004, S1009, S1106, S1206, S1304, S1311, S1315, S1404, S1504, S1508, S1604, S1610 in Fig. 18, Fig. 19 and Fig. 20 S1704 , S1711, S1804, S1811, S1815 and S1907 are receiving actions performed by the network function service consumer.
  • the communication device 2100 may further include a processing module 2130, which is coupled with the sending module 2110 and the receiving module 2120, and may be used to support the communication device 2100 to perform the processing actions in the above method embodiments, for example, to perform the processing actions in FIG. 8 and FIG. 9.
  • a processing module 2130 which is coupled with the sending module 2110 and the receiving module 2120, and may be used to support the communication device 2100 to perform the processing actions in the above method embodiments, for example, to perform the processing actions in FIG. 8 and FIG. 9.
  • S701, S705, S801, S901, S905, S1001, S1005, Network Processing actions performed by functional service consumers may further include a processing module 2130, which is coupled with the sending module 2110 and the receiving module 2120, and may be used to support the communication device 2100 to perform the processing actions in the above method embodiments, for example, to perform the processing actions in FIG. 8 and FIG. 9.
  • the communication device 2100 shown in FIG. 21 can serve as the network function service consumer involved in the above method embodiment, and execute the steps performed by the network function service provider in the above method embodiment. .
  • the communication device 2100 may include a sending module 2110 and a receiving module 2120 .
  • the sending module 2110 can be used to support the communication device 2100 to send information, for example, execute S401, S1304, S1311, S1315, S1404, The sending action performed by the network function service provider in S1504, S1508, S1604, S1610, S1704, S1711, S1804, S1811, S1815, and S1907.
  • the receiving module 2120 can be used to support the communication device 2100 to receive information, for example, execute S401, S1302, S1306, S1313, S1315, Receiving actions performed by the network function service provider in S1402, S1502, S1506, S1602, S1606, S1702, S1706, S1713, S1802, S1806, S1813, S1817, and S1902.
  • the communication device 2100 may further include a storage module 2140 for storing program codes and data of the communication device 2100 .
  • Fig. 22 is a schematic block diagram of a communication device 2200 provided by an embodiment of the present application.
  • the communication device 2200 includes: at least one processor 2210 and a transceiver 2220 .
  • the processor 2210 is coupled with the memory, and is used for executing instructions stored in the memory to control the transceiver 2220 to send signals and/or receive signals.
  • the transceiver 2220 may include a receiver (or called receiver) and a transmitter (or called transmitter).
  • the transceiver 2220 may further include an antenna, and the number of antennas may be one or more.
  • the transceiver 2220 may be a communication interface or an interface circuit.
  • the chip When the communication device 2200 is a chip, the chip includes a transceiver unit and a processing unit.
  • the transceiver unit may be an input-output circuit or a communication interface
  • the processing unit may be a processor or a microprocessor or an integrated circuit integrated on the chip.
  • the disclosed systems, devices and methods may be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit.
  • the functions described above are realized in the form of software function units and sold or used as independent products, they can be stored in a computer-readable storage medium.
  • the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disk or optical disc and other media that can store program codes. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Storage Device Security (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请提供了一种集成可信度量的通信方法和装置，该方法包括：网络功能服务消费者发送服务请求消息，服务请求消息用于请求获取网络功能服务提供者提供的服务；网络功能服务消费者接收服务响应消息，该服务响应消息用于指示服务请求消息是否被接受，该服务响应消息还用于指示对网络功能服务消费者的可信校验的结果。本申请提供的通信方法有利于网络功能服务提供者在提供网络服务前校验网络功能服务消费者的身份并确定网络功能服务消费者是否可信，有利于提高核心网网元之间通信的安全性，有利于提高核心网设备的安全性。

Description

集成可信度量的通信方法
本申请要求于2022年01月05日提交中国专利局、申请号为202210010007.6、发明名称为“集成可信度量的通信方法”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信领域，更具体地，涉及一种集成可信度量的通信方法和装置。
背景技术
第三代合作伙伴计划(3rdgeneration partnership project，3GPP)没有为核心网网元自身的安全性设置专门的保护措施，也没有为网元之间的信令交互设置安全措施，因此，网元的不安全行为将会带来网元被攻击者劫持和攻击者伪造核心网网元等极大的安全风险。
被劫持的网元或伪造的网元可以恶意网元进一步影响正常可信的核心网网元，从而造成资源浪费、网元信息数据和用户隐私数据泄露等问题。
因此，有必要为核心网网元的安全性和网元之间的信令交互设置安全措施，以增强对网元信息数据和用户隐私数据等的保护。
发明内容
本申请提供一种集成可信度量的通信方法，可以用于提高对核心网网元自身的安全性。
第一方面，提供了一种集成可信度量的通信方法，该方法可以由第一网元执行，或者，也可以由用于第一网元的芯片或电路执行，本申请对此不作限定，为了便于描述，下面以由第一网元执行为例进行说明。
该方法包括：
第一网元发送注册请求消息，该注册请求消息用于请求注册第一网元；
该第一网元接收注册响应消息，该注册响应消息用于响应注册请求消息，该注册响应消息还用于指示第一证书的校验结果，该第一证书用于校验第一网元的第一可信平台是否可信。
在一种可能的实现方式中，注册请求消息包括第一网元的可信平台标识信息。
在一种可能的实现方式中，第一网元的可信平台标识信息在第一网元发送注册请求消息前配置到网络存储网元。
本申请实施例提供的技术方案，通过第一网元发送注册请求消息，使网络存储网元获取到第一网元的注册请求；通过第一网元接收注册响应消息，第一网元可以获取到注册请求的结果；通过使注册响应消息指示第一网元可信证书的校验结果，可以使第一网元确定第一网元的可信平台是否取得网络存储网元的信任。该技术方案的实施有利于网络存储网元对第一网元的可信平台是否可信的校验。在第一网元申请访问令牌前首先对其可信平台进行校验，有利于后续令牌申请流程和服务请求流程的安全，有利于提高网络存储网元和 网络功能服务提供者等的安全性，有利于提高网络通信过程的安全性。
结合第一方面，在第一方面的某些实现方式中，该请求注册第一网元成功，该注册响应消息包括第一可信证书，该第一可信证书用于证明第一可信平台可信。
本申请实施例提供的技术方案，在第一网元注册请求成功后，在注册响应消息中包括第一网元的第一可信证书，用于证明第一网元的可信平台通过网络存储网元的校验。该第一可信证书可以用作第一网元在后续访问令牌获取流程、服务请求流程等通信过程中的身份证明，证明第一网元拥有可信的可信任平台，有利于提高网络存储网元和网络功能服务提供者的安全性，有利于提高核心网网元之间通信过程的安全性。
结合第一方面，在第一方面的某些实现方式中，该请求注册第一网元失败，该注册响应消息指示第一证书校验失败。
本申请实施例提供的技术方案，在第一网元请求注册失败后，注册响应消息中包括第一可信证书校验失败的指示，第一网元在接收注册响应消息后可以获取到该指示，在一定程度上有利于第一网元的下一次注册请求流程，有利于减少核心网网络资源的不必要开销，有利于提高核心网网元的对服务过程中网络功能服务消费者的服务质量。
结合第一方面，在第一方面的某些实现方式中，第一网元包括第二可信平台，第一网元发送重新注册请求消息，该重新注册请求消息用于请求注册第一网元，该重新注册请求消息包括第二证书，第二证书用于校验第一网元的第二可信平台是否可信。
本申请实施例提供的技术方案，第一网元在注册请求中包含的第一证书校验失败，由于注册响应消息中给出了第一网元请求注册失败的原因是第一可信平台的第一证书校验失败，因此，在获取注册响应消息后，第一网元可以通过重新收集其他可信平台的证书用于下一次发起注册请求。本技术方案的实施，有利于提高第一网元在网络存储网元上注册的效率，有利于使得第一网元通过可信的、真实的可信平台在网络存储网元上注册，有利于提高核心网网元的安全性以及网元之间通信过程的安全性。
结合第一方面，在第一方面的某些实现方式中，该注册请求消息包括平台标识信息，该平台标识信息用于标识第一网元的可信平台。
本申请实施例提供的技术方案，通过在第一网元的注册请求消息中包括用于指示第一网元的可信平台的标识信息，网络存储网元在接收注册请求消息后可以获取到该标识信息，进而根据该标识信息确定的第一网元支持的可信平台并针对该平台作出响应，有利于第一网元尽早获取网络服务，有利于提高网络存储网元对其他网元的注册和认证效率。
第二方面，提供了一种集成可信度量的通信方法，该方法可以由网络功能服务消费者执行，或者，也可以由用于网络功能服务消费者的芯片或电路执行，本申请对此不作限定，为了便于描述，下面以由网络功能服务消费者执行为例进行说明。
该方法包括：
网络功能服务消费者发送认证许可消息，该认证许可消息用于请求获取访问令牌，该访问令牌包括网络功能服务消费者有权访问的服务信息，该认证许可消息包括第二可信证书，该第二可信证书用于校验网络功能服务消费者的可信平台是否可信。
该网络功能服务消费者接收认证响应消息，该认证响应消息用于指示请求获取访问令牌的结果。
本申请实施例提供的技术方案中，网络功能服务消费者通过发送认证许可消息，使网 络存储网元获取到网络功能服务消费者申请获取访问令牌的请求；通过在认证许可消息中包括第二可信证书，可以使网络存储网元对网络功能服务消费者的可信平台是否可信进行校验；网络功能服务消费者通过接收认证响应消息可以获取到其申请访问令牌的请求是否被接受。该技术方案有利于网络功能服务消费者获取访问令牌的效率，有利于提高网络存储网元和网络功能服务提供者的安全性，有利于提高核心网网元之间通信过程的安全性。
结合第二方面，在第二方面的某些实现方式中，该网络功能服务消费者接收第一证明标识信息，该第一证明标识信息用于请求获取第一证明信息或第二证明结果，该第一证明信息用于校验该网络功能服务消费者是否可信，该第二证明结果包括该网络功能服务消费者已经被证明可信的证明结果。
在一种可能的实现方式中，第二证明结果包括身份信息、可信内容和新鲜度中的一项或多项，该身份信息用于指示证明网络功能服务消费者可信的证明者的身份，该可信内容用于指示网络功能服务消费者被证明可信的内容，该新鲜度用于指示网络功能服务消费者被证明可信的时间。
网络功能服务消费者在接收第一证明标识信息后可以准备第一证明信息或第二证明结果，用于网络存储网元对网络功能服务消费者是否可信的校验，有利于提高核心网网元之间通信的安全性以及核心网功能服务消费者和提供者包含设备的安全性。
结合第二方面，在第二方面的某些实现方式中，该认证响应消息用于指示获得访问令牌，该访问令牌包括第一证明结果，该第一证明结果包括网络功能服务消费者被网络存储网元证明可信的证明结果。
本申请实施例提供的技术方案中，网络功能服务消费者通过网络存储网元的认证，在认证响应消息中包括第一证明结果，该第一证明结果可以包含此次对网络功能服务消费者的可信校验的相关信息，该第一证明结果可以用于下一次其他验证者对该网络功能服务消费者的可信验证。本技术方案的实施有利于加快网络功能服务消费者的注册认证速率，有利于提高网络功能服务消费者的网络功能服务体验。
结合第二方面，在第二方面的某些实现方式中，第一证明结果包括身份信息、可信内容和新鲜度中的一项或多项，该身份信息用于指示网络存储网元，该可信内容用于指示网络功能服务消费者被网络存储网元证明可信的内容，该新鲜度用于指示网络功能服务消费者被网络存储网元证明可信的时间。
通过在第一证明结果中包括证明者的身份信息、可信内容和新鲜度，网络功能服务消费者下一次进行可信校验时，验证者可以直接利用第一证明结果判断网络功能服务消费者是否可信。
其中，通过证明者的身份信息可以确定第一证明结果对应的可信证明的验证者的身份，通过可信内容可以确定第一证明结果对应的可信证明过程证明的可信内容有哪些，是否适用于本次的可信证明，通过新鲜度可以确定第一证明结果对应的可信证明完成的时间，进而确定该可信证明结果是否在有效期内，判断是否需要重新进行可信证明。
在第一证明结果中包括上述信息有利于提高可信证明的效率，有利于提高核心网网元之间通信的安全性，有利于提高网元包含设备的安全性。
结合第二方面，在第二方面的某些实现方式中，该认证响应消息用于指示未获得访问令牌，该认证响应消息还用于指示第二可信证书校验失败或第一证明信息校验失败，该第 一证明信息用于校验网络功能服务消费者是否可信。
在一种可能的实现方式中，该认证响应消息指示第二可信证书校验失败。网络功能服务消费者在接收该认证响应消息后确定认证失败的原因，并选择其他可信平台的可信证书用于下一次的认证过程。
示例性地，网络功能服务消费者包括TPM可信平台和Intel SGX可信平台，第二证书用于校验TPM可信平台是否可信，当该第二证书校验失败后，网络功能服务消费者可以利用Intel SGX可信平台，重新发起认证请求。
在一种可能的实现方式中，该认证响应消息指示第二可信证书校验失败。网络功能服务消费者在接收该认证响应消息后确定认证失败的原因，并选择其他证书颁发方式获取可信证书。
示例性地，网络功能服务消费者的第二可信证书通过PCA颁布，在第二可信证书校验失败后，网络功能服务消费者可以选择利用DAA方式获取可信平台的可信证书，并利用重新颁布的可信证书发起下一次认证请求。
在一种可能的实现方式中，该认证响应消息指示第一证明信息校验失败。网络功能服务消费者在接收该认证响应消息后确定认证失败的原因，可以重新收集用于可信证明的相关信息，从而重新生成证明信息，用于下一次认证过程。
结合第二方面，在第二方面的某些实现方式中，该认证许可消息还包括第一证明信息，该第一证明信息根据第一挑战值生成，该第一证明信息用于校验网络功能服务消费者是否可信，该第一挑战值为时间戳、第一随机数、第二随机数和约定字段的数值中的任一种，该第一随机数为可信第三方提供的随机数，该第二随机数为为校验网络功能服务消费者的可信平台是否可信而生成的随机数。
通过时间戳、约定字段的数值、第一随机数和第二随机数等方式用作随机数，并用于生成证明信息，可以实现多种方式的可信校验，可信校验双方可以根据实际情况来选取不同的方式来确定挑战值，从而完成可信校验，有利于提高核心网网元之间通信的安全性，有利于提高网元包含的设备的安全性。
第三方面，提供了一种集成可信度量的通信方法，该方法可以由网络功能服务消费者执行，或者，也可以由用于网络功能服务消费者的芯片或电路执行，本申请对此不作限定，为了便于描述，下面以由网络功能服务消费者执行为例进行说明。
该方法包括：
网络功能服务消费者发送服务请求消息，该服务请求消息用于请求获取网络功能服务提供者提供的服务。
该网络功能服务消费者接收服务响应消息，该服务响应消息用于指示该请求获取服务是否被接受，所述服务响应消息还用于指示对网络功能服务消费者可信校验的结果。
在一种可能的实现方式中，服务响应消息指示对网络功能服务消费者可信校验成功，网络功能服务消费者可以进一步请求校验网络功能服务提供者是否可信。
在一种可能的实现方式中，服务响应消息指示对网络功能服务消费者可信校验失败，网络功能服务消费者可以根据该服务响应消息中的其他内容获取可信校验失败的具体原因，根据失败原因，网络功能服务消费者重新准备服务请求信息，进而发起下一次服务请求。
本申请实施例中提供的技术方案，网络功能服务消费者在发送服务请求消息后可以接收到服务响应消息，该服务响应消息可以指示对网络功能服务消费者的可信校验的结果，根据该校验结果，网络功能服务消费者可以作出响应。
结合第三方面，在第三方面的某些实现方式中，该网络功能服务消费者接收第二证明标识信息，该第二证明标识信息用于请求获取第二证明信息或第三证明结果，该第二证明信息用于校验网络功能服务消费者是否可信，该第三证明结果包括网络功能服务消费者已经被证明可信的证明结果。
在一种可能的实现方式中，第三证明结果包括身份信息、可信内容和新鲜度中的一项或多项，该身份信息用于指示证明网络功能服务消费者可信的证明者的身份，该可信内容用于指示网络功能服务消费者被证明可信的内容，该新鲜度用于指示网络功能服务消费者被证明可信的时间。
网络功能服务消费者在接收证明标识信息后可以准备第二证明信息或第三证明结果，用于网络功能服务提供者对网络功能服务消费者是否可信的校验，有利于提高核心网网元之间通信的安全性以及核心网功能服务消费者和提供者包含设备的安全性。
结合第三方面，在第三方面的某些实现方式中，该服务响应消息用于指示该请求获取服务被接受，该可信校验包括第二证明信息校验或第三证明结果校验，该第二证明信息用于校验网络功能服务消费者是否可信，该第三证明结果包括网络功能服务消费者已经被证明可信的证明结果。
本申请实施例提供的技术方案中，网络功能服务消费者的第二证明信息或第三证明结果通过校验，该第二证明信息或第三证明结果用于证明网络功能服务消费者处于可信的执行状态，网络功能服务消费者的服务请求被接受，在证明网络功能服务消费者处于可信的执行状态后在为其提供网络服务，有利于提高核心网网元之间通信的安全性以及核心网功能服务消费者和提供者包含设备的安全性。
结合第三方面，在第三方面的某些实现方式中，可信校验还包括第一证明结果校验，该第一证明结果包括网络功能服务消费者被网络存储网元证明可信的证明结果。
在一种可能的实现方式中，对网络功能服务消费者先进行第二证明信息或第三证明结果的校验再进行第一证明结果的校验，第二证明信息校验或第三证明结果校验通过后进行第一证明结果校验。
在一种可能的实现方式中，对网络功能服务消费者先进行第一证明结果校验再进行第二证明信息校验或第三证明结果校验，第三证明结果校验不通过时进行第二证明信息校验或第三证明结果校验。
在一种可能的实现方式中，网络功能服务消费者的第二证明信息或第三证明结果和第一证明结果都通过校验，网络功能服务消费者获取权限完整的网络服务。
在一种可能的实现方式中，网络功能服务消费者的第二证明信息或第三证明结果通过校验，第一证明结果未通过校验，网络功能服务消费者获取受限的网络服务。
本申请实施例提供的技术方案中，在可信校验中设置第二证明信息或第三证明结果的校验和第一证明结果的校验。可以实现对网络功能服务消费者的双重校验，并且根据校验情况为网络功能服务消费者提供服务，有利于提高核心网网元之间通信的安全性以及核心网功能服务消费者和提供者包含设备的安全性。
结合第三方面，在第三方面的某些实现方式中，该可信校验还包括第三可信证书校验，该第三可信证书校验用于校验网络功能服务年消费者的可信平台是否可信。
在一种可能的实现方式中，网络功能服务消费者的可信平台在实现可信证明的过程中无需生成可信证书，网络功能服务消费者请求服务的过程中，网络功能服务提供者也不再校验可信证书。
在一种可能的实现方式中，网络功能服务提供者先校验第三可信证书，在校验第三可信证书无误后再获取网络功能服务消费者的证明信息或证明结果，进一步校验。
本申请实施例提供的技术方案中，网络功能服务提供者可以首先对网络功能服务消费者的可信证书进行校验，在确定可信证书可信后再进行其他的校验，有利于提高网络功能服务提供者的校验效率，有利于加快网络功能服务消费者获取到网络服务，有利于提高网络功能服务消费者的网络功能服务的使用体验。
结合第三方面，在第三方面的某些实现方式中，该服务响应消息用于指示服务请求被接受，该可信校验为第一证明结果校验，该第一证明结果包括网络功能服务消费者被网络存储网元证明可信的证明结果。
本申请实施例提供的技术方案中，网络功能服务消费者可以直接获取网络功能服务消费者被网络存储网元校验的结果，即第一证明结果，网络功能服务提供者只对第一证明结果进行校验，当第一证明结果通过后，不再对网络功能服务消费者的证明信息等作校验，简化了可信校验的流程，有利于提高网络功能服务提供者进行可信校验的效率，有利于加快网络功能服务消费者获取网络功能服务，有利于提高核心网网元之间通信的安全性以及核心网功能服务消费者和提供者包含设备的安全性。
结合第三方面，在第三方面的某些实现方式中，该服务响应消息用于指示服务请求被拒绝，该服务响应消息用于指示第三可信证书校验失败或第二证明信息校验失败或第一证明结果校验失败或第三证明结果校验失败，该第三可信证书用于校验所述网络功能服务消费者的可信平台是否可信，该第二证明信息用于校验网络功能服务消费者是否可信，该第一证明结果包括网络功能服务消费者被网络存储网元证明可信的证明结果，该第三证明结果包括网络功能服务消费者已经被证明可信的证明结果。
在一种可能的实现方式中，服务响应消息指示第三可信证书校验失败，网络功能服务消费者在接收该服务响应消息后确定失败的原因，并选择其他可信平台的可信证书用于下一次的服务请求。
示例性地，网络功能服务消费者包括TPM可信平台和Intel SGX可信平台，第三可信证书用于校验TPM可信平台是否可信，当该第三可信证书校验失败后，网络功能服务消费者可以利用Intel SGX可信平台的可信证书，重新发起服务请求。
在一种可能的实现方式中，服务响应消息指示第三可信证书校验失败，网络功能服务消费者在接收该服务响应消息后确定失败的原因，并选择其他证书颁发方式获取可信证书。
示例性地，网络功能服务消费者的第三可信证书通过PCA颁布，在第三可信证书校验失败后，网络功能服务消费者可以选择利用DAA方式获取可信平台的可信证书，并将重新颁布的可信证书用于下一次服务请求。
在一种可能的实现方式中，服务响应消息指示第二证明信息校验失败，网络功能服务消费者在接收该认证响应消息后确定认证失败的原因，并重新收集第二证明信息对应的可 信平台用于可信证明的相关信息，从而重新生成新的证明信息，用于下一次服务请求。
在一种可能的实现方式中，服务响应消息指示第二证明信息校验失败，网络功能服务消费者在接收该认证响应消息后确定认证失败的原因，并收集其他可信平台的证明信息，用于下一次服务请求。
在一种可能的实现方式中，服务响应消息指示第二证明信息校验失败，网络功能服务消费者在接收该认证响应消息后确定认证失败的原因，并准备其他可信平台的证明结果，用于下一次服务请求。
在一种可能的实现方式中，服务响应消息指示第三证明结果校验失败，网络功能服务消费者在接收该认证响应消息后确定认证失败的原因，并重新收集第三证明结果对应的可信平台用于可信证明的相关信息，从而重新生成新的证明信息，用于下一次服务请求。
在一种可能的实现方式中，服务响应消息指示第三证明结果校验失败，网络功能服务消费者在接收该认证响应消息后确定认证失败的原因，并准备其他可信平台的证明结果，用于下一次服务请求。
在一种可能的实现方式中，服务响应消息指示第三证明结果校验失败，网络功能服务消费者在接收该认证响应消息后确定认证失败的原因，并准备其他可信平台的证明信息，用于下一次服务请求。
通过在服务响应消息中包含可信失败的原因，网络功能服务消费者可以通过该服务响应消息确定失败原因，进而作出针对性的响应，更好地为下一次的服务请求做准备。
结合第三方面，在第三方面的某些实现方式中，该服务请求消息还包括第二证明信息，该第二证明信息根据第二挑战值生成，该第二证明信息用于校验网络功能服务消费者是否可信，第二挑战值为时间戳、第一随机数、第二随机数和约定字段的数值中的任一种，该第一随机数为可信第三方提供的随机数，该第二随机数为为校验网络功能服务消费者的可信平台是否可信而生成的随机数。
通过时间戳、约定字段的数值、第一随机数和第二随机数等方式用作随机数，并用于生成证明信息，可以实现多种方式的可信校验，可信校验双方可以根据实际情况来选取不同的方式来确定挑战值，从而完成可信校验，有利于提高核心网网元之间通信的安全性，有利于网元包含的设备的安全性。
第四方面，提供了一种集成可信度量的通信方法，该方法可以由网络存储网元执行，或者，也可以由用于网络存储网元的芯片或电路执行，本申请对此不作限定，为了便于描述，下面以由网络存储网元执行为例进行说明。
该方法包括：
网络存储网元接收注册请求消息，该注册请求消息用于请求注册第一网元；
该网络存储网元发送注册响应消息，该注册响应消息用于响应注册请求消息，该注册响应消息还用于指示第一证书校验结果，该第一证书用于校验第一网元的第一可信平台是否可信。
在一种可能的实现方式中，注册请求消息包括第一网元的可信平台标识信息。
在一种可能的实现方式中，第一网元的可信平台标识信息在第一网元发送注册请求消息前配置到网络存储网元。
本申请实施例提供的技术方案，通过第一网元发送注册请求消息，使网络存储网元获 取到第一网元的注册请求；通过第一网元接收注册响应消息，第一网元可以获取到注册请求的结果；通过使注册响应消息指示第一网元可信证书的校验结果，可以使第一网元确定第一网元的可信平台是否取得网络存储网元的信任。该技术方案的实施有利于网络存储网元对第一网元的可信平台是否可信的校验。在第一网元申请访问令牌前首先对其可信平台进行校验，有利于后续令牌申请流程和服务请求流程的安全，有利于提高网络存储网元和网络功能服务提供者等的安全性，有利于提高网络通信过程的安全性。
结合第四方面，在第四方面的某些实现方式中，该请求注册第一网元成功，该注册响应消息包括第一可信证书，该第一可信证书用于证明第一可信平台可信。
本申请实施例提供的技术方案，在第一网元注册请求成功后，在注册响应消息中包括第一网元的第一可信证书，用于证明第一网元的可信平台通过网络存储网元的校验。该第一可信证书可以用作第一网元在后续访问令牌获取流程、服务请求流程等通信过程中的身份证明，证明第一网元拥有可信的可信任平台，有利于提高网络存储网元和网络功能服务提供者的安全性，有利于提高核心网网元之间通信过程的安全性。
结合第四方面，在第四方面的某些实现方式中，该请求注册第一网元失败，该注册响应消息指示该第一证书校验失败。
本申请实施例提供的技术方案，在第一网元请求注册失败后，注册响应消息中包括第一可信证书校验失败的指示，第一网元在接收注册响应消息后可以获取到该指示，在一定程度上有利于第一网元的下一次注册请求流程，有利于减少核心网网络资源的不必要开销，有利于提高核心网网元的对服务过程中网络功能服务消费者的服务质量。
结合第四方面，在第四方面的某些实现方式中，第一网元包括第二可信平台，网络存储网元接收重新注册请求消息，该重新注册请求消息用于请求注册第一网元，该重新注册请求消息包括第二证书，第二证书用于校验第一网元的第二可信平台是否可信。
本申请实施例提供的技术方案，第一网元在注册请求中包含的第一证书校验失败，由于注册响应消息中给出了第一网元请求注册失败的原因是第一可信平台的第一证书校验失败，因此，在获取注册响应消息后，第一网元可以通过重新收集其他可信平台的证书用于下一次发起注册请求。本技术方案的实施，有利于提高第一网元在网络存储网元上注册的效率，有利于使得第一网元通过可信的、真实的可信平台在网络存储网元上注册，有利于提高核心网网元的安全性以及网元之间通信过程的安全性。
结合第四方面，在第四方面的某些实现方式中，该注册请求消息包括平台标识信息，该平台标识信息用于标识第一网元的可信平台。
本申请实施例提供的技术方案，通过在第一网元的注册请求消息中包括用于指示第一网元的可信平台的标识信息，网络存储网元在接收注册请求消息后可以获取到该标识信息，进而根据该标识信息确定的第一网元支持的可信平台并针对该平台作出响应，有利于第一网元尽早获取网络服务，有利于提高网络存储网元对其他网元的注册和认证效率。
第五方面，提供了一种集成可信度量的通信方法，该方法可以由网络存储网元执行，或者，也可以由用于网络存储网元的芯片或电路执行，本申请对此不作限定，为了便于描述，下面以由网络存储网元执行为例进行说明。
该方法包括：
网络存储网元接收认证许可消息，该认证许可消息用于请求获取访问令牌，该访问令 牌包括网络功能服务消费者有权访问的服务信息，该认证许可消息包括第二可信证书，该第二可信证书用于校验网络功能服务消费者的可信平台是否可信；
该网络存储网元发送认证响应消息，该认证响应消息用于指示该请求获取访问令牌的结果。
本申请实施例提供的技术方案中，网络功能服务消费者通过发送认证许可消息，使网络存储网元获取到网络功能服务消费者申请获取访问令牌的请求；通过在认证许可消息中包括第二可信证书，可以使网络存储网元对网络功能服务消费者的可信平台是否可信进行校验；网络功能服务消费者通过接收认证响应消息可以获取到其申请访问令牌的请求是否被接受。该技术方案有利于网络功能服务消费者获取访问令牌的效率，有利于提高网络存储网元和网络功能服务提供者的安全性，有利于提高核心网网元之间通信过程的安全性。
结合第五方面，在第五方面的某些实现方式中，该网络存储网元发送第一证明信息，该第一证明标识信息用于请求获取第一证明信息或第二证明结果，该第一证明信息用于校验该网络功能服务消费者是否可信，该第二证明结果包括该网络功能服务消费者已经被证明可信的证明结果。
网络功能服务消费者在接收第一证明标识信息后可以准备第一证明信息或第二证明结果，用于网络存储网元对网络功能服务消费者是否可信的校验，有利于提高核心网网元之间通信的安全性以及核心网功能服务消费者和提供者包含设备的安全性。
结合第五方面，在第五方面的某些实现方式中，该认证响应消息用于指示获得访问令牌，该访问令牌包括第一证明结果，该第一证明结果包括网络功能服务消费者被网络存储网元证明可信的证明结果。
本申请实施例提供的技术方案中，网络功能服务消费者通过网络存储网元的认证，在认证响应消息中包括第一证明结果，该第一证明结果可以包含此次对网络功能服务消费者的可信校验的相关信息，该第一证明结果可以用于下一次其他验证者对该网络功能服务消费者的可信验证。本技术方案的实施有利于加快网络功能服务消费者的注册认证速率，有利于提高网络功能服务消费者的网络功能服务体验。
结合第五方面，在第五方面的某些实现方式中，第一证明结果包括身份信息、可信内容和新鲜度中的一项或多项，该身份信息用于指示网络存储网元，该可信内容用于指示网络功能服务消费者被网络存储网元证明可信的内容，该新鲜度用于指示网络功能服务消费者被网络存储网元证明可信的时间。
通过在第一证明结果中包括证明者的身份信息、可信内容和新鲜度，网络功能服务消费者下一次进行可信校验时，验证者可以直接利用第一证明结果判断网络功能服务消费者是否可信。
其中，通过证明者的身份信息可以确定第一证明结果对应的可信证明的验证者的身份，通过可信内容可以确定第一证明结果对应的可信证明过程证明的可信内容有哪些，是否适用于本次的可信证明，通过新鲜度可以确定第一证明结果对应的可信证明完成的时间，进而确定该可信证明结果是否在有效期内，判断是否需要重新进行可信证明。
在第一证明结果中包括上述信息有利于提高可信证明的效率，有利于提高核心网网元之间通信的安全性，有利于提高网元包含设备的安全性。
结合第五方面，在第五方面的某些实现方式中，该认证响应消息用于指示未获得访问 令牌，该认证响应消息还用于指示第二可信证书校验失败或第一证明信息校验失败，该第一证明信息用于校验网络功能服务消费者是否可信。
在一种可能的实现方式中，该认证响应消息指示第二可信证书校验失败。网络功能服务消费者在接收该认证响应消息后确定认证失败的原因，并选择其他可信平台的可信证书用于下一次的认证过程。
示例性地，网络功能服务消费者包括TPM可信平台和Intel SGX可信平台，第二证书用于校验TPM可信平台是否可信，当该第二证书校验失败后，网络功能服务消费者可以利用Intel SGX可信平台，重新发起认证请求。
在一种可能的实现方式中，该认证响应消息指示第二可信证书校验失败。网络功能服务消费者在接收该认证响应消息后确定认证失败的原因，并选择其他证书颁发方式获取可信证书。
示例性地，网络功能服务消费者的第二可信证书通过PCA颁布，在第二可信证书校验失败后，网络功能服务消费者可以选择利用DAA方式获取可信平台的可信证书，并利用重新颁布的可信证书发起下一次认证请求。
在一种可能的实现方式中，该认证响应消息指示第一证明信息校验失败。网络功能服务消费者在接收该认证响应消息后确定认证失败的原因，可以重新收集用于可信证明的相关信息，从而重新生成证明信息，用于下一次认证过程。
结合第五方面，在第五方面的某些实现方式中，该认证许可消息还包括第一证明信息，该第一证明信息根据第一挑战值生成，该第一证明信息用于校验网络功能服务消费者是否可信，该第一挑战值为时间戳、第一随机数、第二随机数和约定字段的数值中的任一种，该第一随机数为可信第三方提供的随机数，该第二随机数为为校验网络功能服务消费者的可信平台是否可信而生成的随机数。
在一种可能的实现方式中，挑战值为时间戳，该时间戳为网络功能服务消费者和网络存储网元都信任的时钟信息。
示例性地，该挑战值为有网络功能服务消费者的TPM可信平台产生的时钟信息。
在一种可能的实现方式中，挑战值为约定字段的数值，该约定字段可以根据网络功能服务消费者和网络存储网元都遵守的网络协议确定。
示例性地，在OAuth 2.0协议中规定认证许可消息从第128至160位的比特数据用作挑战值，网络功能服务消费者和网络存储网元同时遵守OAuth 2.0协议，则网络功能服务消费者获取该认证许可消息的第128至160位的比特数据作为挑战值。
在一种可能的实现方式中，挑战值为第一随机数，该第一随机数为网络功能服务消费者和网络存储网元都信任的随机数，该第一随机数可以由可信第三方提供。
示例性地，该第一随机数通过区块链的方式生成(如区块链最新区块的时间戳或哈希值)，网络功能服务消费者在获取该第一随机数后用作挑战值。
在一种可能的实现方式中，挑战值为第二随机数，该第二随机数为网络功能服务提供者为校验网络功能服务消费者是否可信而生成的随机数。
通过时间戳、约定字段的数值、第一随机数和第二随机数等方式用作随机数，并用于生成证明信息，可以实现多种方式的可信校验，可信校验双方可以根据实际情况来选取不同的方式来确定挑战值，从而完成可信校验，有利于提高核心网网元之间通信的安全性， 有利于提高网元包含的设备的安全性。
第六方面，提供了一种集成可信度量的通信方法，该方法可以由网络功能服务提供者执行，或者，也可以由用于网络功能服务提供者的芯片或电路执行，本申请对此不作限定，为了便于描述，下面以由网络功能服务提供者执行为例进行说明。
该方法包括：
网络功能服务提供者接收服务请求消息，该服务请求消息用于请求获取网络功能服务提供者提供的服务；
该网络功能服务提供者发送服务响应消息，该服务响应消息用于指示请求获取服务是否被接受，该服务响应消息还用于指示对网络功能服务消费者可信校验的结果。
在一种可能的实现方式中，服务响应消息指示对网络功能服务消费者可信校验成功，网络功能服务消费者可以进一步请求校验网络功能服务提供者是否可信。
在一种可能的实现方式中，服务响应消息指示对网络功能服务消费者可信校验失败，网络功能服务消费者可以根据该服务响应消息中的其他内容获取可信校验失败的具体原因，根据失败原因，网络功能服务消费者重新准备服务请求信息，进而发起下一次服务请求。
本申请实施例中提供的技术方案，网络功能服务消费者在发送服务请求消息后可以接收到服务响应消息，该服务响应消息可以指示对网络功能服务消费者的可信校验的结果，根据该校验结果，网络功能服务消费者可以作出响应。
结合第六方面，在第六方面的某些实现方式中，该网络功能服务提供者发送第二证明标识信息，该第二证明标识信息用于请求获取第二证明信息或第三证明结果，该第二证明信息用于校验网络功能服务消费者是否可信，该第三证明结果包括网络功能服务消费者已经被证明可信的证明结果。
网络功能服务消费者在接收证明标识信息后可以准备第二证明信息或第三证明结果，用于网络功能服务提供者对网络功能服务消费者是否可信的校验，有利于提高核心网网元之间通信的安全性以及核心网功能服务消费者和提供者包含设备的安全性。
结合第六方面，在第六方面的某些实现方式中，该服务响应消息用于指示该请求获取服务被接受，该可信校验包括第二证明信息校验或第三证明结果校验，该第二证明信息用于校验网络功能服务消费者是否可信，该第三证明结果包括网络功能服务消费者已经被证明可信的证明结果。
本申请实施例提供的技术方案中，网络功能服务消费者的第二证明信息或第三证明结果通过校验，该第二证明信息或第三证明结果用于证明网络功能服务消费者处于可信的执行状态，网络功能服务消费者的服务请求被接受，在证明网络功能服务消费者处于可信的执行状态后在为其提供网络服务，有利于提高核心网网元之间通信的安全性以及核心网功能服务消费者和提供者包含设备的安全性。
结合第六方面，在第六方面的某些实现方式中，可信校验还包括第一证明结果校验，该第一证明结果包括网络功能服务消费者被网络存储网元证明可信的证明结果。
在一种可能的实现方式中，对网络功能服务消费者先进行第二证明信息或第三证明结果的校验再进行第一证明结果的校验，第二证明信息校验或第三证明结果校验通过后进行第一证明结果校验。
在一种可能的实现方式中，对网络功能服务消费者先进行第一证明结果校验再进行第二证明信息校验或第三证明结果校验，第三证明结果校验不通过时进行第二证明信息的校验或第三证明结果校验。
在一种可能的实现方式中，网络功能服务消费者的第二证明信息或第三证明结果和第一证明结果都通过校验，网络功能服务消费者获取权限完整的网络服务。
在一种可能的实现方式中，网络功能服务消费者的第二证明信息或第三证明结果通过校验，第三证明结果未通过校验，网络功能服务消费者获取受限的网络服务。
本申请实施例提供的技术方案中，在可信校验中设置第二证明信息或第三证明结果的校验和第一证明结果的校验。可以实现对网络功能服务消费者的双重校验，并且根据校验情况为网络功能服务消费者提供服务，有利于提高核心网网元之间通信的安全性以及核心网功能服务消费者和提供者包含设备的安全性。
结合第六方面，在第六方面的某些实现方式中，该可信校验还包括第三可信证书校验，该第三可信证书校验用于校验网络功能服务年消费者的可信平台是否可信。
在一种可能的实现方式中，网络功能服务消费者的可信平台在实现可信证明的过程中无需生成可信证书，网络功能服务消费者请求服务的过程中，网络功能服务提供者也不再校验可信证书。
在一种可能的实现方式中，网络功能服务提供者先校验第三可信证书，在校验第三可信证书无误后再获取网络功能服务消费者的证明信息或证明结果，进一步校验。
本申请实施例提供的技术方案中，网络功能服务提供者可以首先对网络功能服务消费者的可信证书进行校验，在确定可信证书可信后再进行其他的校验，有利于提高网络功能服务提供者的校验效率，有利于加快网络功能服务消费者获取到网络服务，有利于提高网络功能服务消费者的网络功能服务的使用体验。
结合第六方面，在第六方面的某些实现方式中，该服务响应消息用于指示服务请求被接受，该可信校验为第一证明结果校验，该第一证明结果包括网络功能服务消费者被网络存储网元证明可信的证明结果。
本申请实施例提供的技术方案中，网络功能服务消费者可以直接获取网络功能服务消费者被网络存储网元校验的结果，即第一证明结果，网络功能服务提供者只对第一证明结果进行校验，当第一证明结果通过后，不再对网络功能服务消费者的证明信息等作校验，简化了可信校验的流程，有利于提高网络功能服务提供者进行可信校验的效率，有利于加快网络功能服务消费者获取网络功能服务，有利于提高核心网网元之间通信的安全性以及核心网功能服务消费者和提供者包含设备的安全性。
结合第六方面，在第六方面的某些实现方式中，该服务响应消息用于指示服务请求被拒绝，该服务响应消息用于指示第三可信证书校验失败或第二证明信息校验失败或第一证明结果校验失败或第三证明结果校验失败，该第三可信证书用于校验所述网络功能服务消费者的可信平台是否可信，该第二证明信息用于校验网络功能服务消费者是否可信，该第一证明结果包括网络功能服务消费者被网络存储网元证明可信的证明结果，该第三证明结果包括网络功能服务消费者上一次被证明可信的证明结果。
在一种可能的实现方式中，服务响应消息指示第三可信证书校验失败，网络功能服务消费者在接收该服务响应消息后确定失败的原因，并选择其他可信平台的可信证书用于下 一次的服务请求。
示例性地，网络功能服务消费者包括TPM可信平台和Intel SGX可信平台，第三可信证书用于校验TPM可信平台是否可信，当该第三可信证书校验失败后，网络功能服务消费者可以利用Intel SGX可信平台的可信证书，重新发起服务请求。
在一种可能的实现方式中，服务响应消息指示第三可信证书校验失败，网络功能服务消费者在接收该服务响应消息后确定失败的原因，并选择其他证书颁发方式获取可信证书。
示例性地，网络功能服务消费者的第三可信证书通过PCA颁布，在第三可信证书校验失败后，网络功能服务消费者可以选择利用DAA方式获取可信平台的可信证书，并将重新颁布的可信证书用于下一次服务请求。
在一种可能的实现方式中，服务响应消息指示第二证明信息校验失败，网络功能服务消费者在接收该认证响应消息后确定认证失败的原因，并重新收集第二证明信息对应的可信平台用于可信证明的相关信息，从而重新生成新的证明信息，用于下一次服务请求。
在一种可能的实现方式中，服务响应消息指示第二证明信息校验失败，网络功能服务消费者在接收该认证响应消息后确定认证失败的原因，并收集其他可信平台的证明信息，用于下一次服务请求。
在一种可能的实现方式中，服务响应消息指示第二证明信息校验失败，网络功能服务消费者在接收该认证响应消息后确定认证失败的原因，并准备其他可信平台的证明结果，用于下一次服务请求。
在一种可能的实现方式中，服务响应消息指示第三证明结果校验失败，网络功能服务消费者在接收该认证响应消息后确定认证失败的原因，并重新收集第三证明结果对应的可信平台用于可信证明的相关信息，从而重新生成新的证明信息，用于下一次服务请求。
在一种可能的实现方式中，服务响应消息指示第三证明结果校验失败，网络功能服务消费者在接收该认证响应消息后确定认证失败的原因，并准备其他可信平台的证明结果，用于下一次服务请求。
在一种可能的实现方式中，服务响应消息指示第三证明结果校验失败，网络功能服务消费者在接收该认证响应消息后确定认证失败的原因，并准备其他可信平台的证明信息，用于下一次服务请求。
通过在服务响应消息中包含可信失败的原因，网络功能服务消费者可以通过该服务响应消息确定失败原因，进而作出针对性的响应，更好地为下一次的服务请求做准备。
结合第六方面，在第六方面的某些实现方式中，该服务请求消息还包括第二证明信息，该第二证明信息根据第二挑战值生成，该第二证明信息用于校验网络功能服务消费者是否可信，第二挑战值为时间戳、第一随机数、第二随机数和约定字段的数值中的任一种。
示例性地，该挑战值为有网络功能服务消费者的TPM可信平台产生的时钟信息。
在一种可能的实现方式中，挑战值为约定字段的数值，该约定字段可以根据网络功能服务消费者和网络功能服务提供者都遵守的网络协议确定。
示例性地，在OAuth 2.0协议中规定认证许可消息从第128至160位的比特数据用作挑战值，网络功能服务消费者和网络存储网元同时遵守OAuth 2.0协议，则网络功能服务消费者获取该认证许可消息的第128至160位的比特数据作为挑战值。
在一种可能的实现方式中，挑战值为第一随机数，该第一随机数为网络功能服务消费 这和网络功能服务提供者都信任的随机数，该第一随机数可以由可信第三方提供。
示例性地，该第一随机数通过区块链的方式生成(如区块链最新区块的时间戳或哈希值)，网络功能服务消费者在获取该第一随机数后用作挑战值。
通过时间戳、约定字段的数值、第一随机数和第二随机数等方式用作随机数，并用于生成证明信息，可以实现多种方式的可信校验，可信校验双方可以根据实际情况来选取不同的方式来确定挑战值，从而完成可信校验，有利于提高核心网网元之间通信的安全性，有利于网元包含的设备的安全性。
第七方面，提供一种通信装置，该通信装置包括发送模块和接收模块，
该发送模块用于发送注册请求消息，该注册请求消息用于请求注册第一网元。
该接收模块用于接收注册响应消息，该注册响应消息用于响应注册请求消息，该注册响应消息还用于指示第一证书的校验结果，第一证书用于校验第一网元的第一可信平台是否可信。
结合第七方面，在第七方面的某些实现方式中，该发送模块还用于发送重新注册请求消息，该重新注册请求消息包括第二证书，该第二证书用于校验第一网元的第二可信平台是否可信。
第八方面，提供一种通信装置，该通信装置包括发送模块和接收模块，
该发送模块用于发送认证许可消息，该认证许可消息用于请求获取访问令牌，该访问令牌包括网络功能服务消费者有权访问的服务信息，认证许可消息包括第二可信证书，该第二可信证书用于校验网络功能服务消费者的可信平台是否可信。
该接收模块用于接收认证响应消息，该认证响应消息用于指示请求获取访问令牌的结果。
结合第八方面，在第八方面的某些实现方式中，该接收模块还用于接收第一证明标识信息，该第一证明标识信息用于请求获取第一证明信息或第二证明结果，该第一证明信息用于校验网络功能服务消费者是否可信，该第二证明结果包括网络功能服务消费者已经被证明可信的证明结果。
第九方面，提供一种通信装置，该通信装置包括发送模块和接收模块，
该发送模块用于发送服务请求消息，该服务请求消息用于请求获取网络功能服务提供者提供的服务。
该接收模块用于接收服务响应消息，该服务响应消息用于指示服务请求是否被接受，该服务响应消息还用于指示对网络功能服务消费者的可信校验的结果。
结合第九方面，在第九方面的某些实现方式中，该接收模块还用于接收第二证明标识信息，该第二证明标识信息用于请求获取第二证明信息或第三证明结果，该第二证明信息用于校验网络功能服务消费者是否可信，该第三证明结果包括网络功能服务消费者已经被证明可信的证明结果。
第十方面，提供一种通信装置，该通信装置包括接收模块和发送模块，
该接收模块用于接收注册请求消息，该注册请求消息用于请求注册第一网元。
该发送模块用于发送注册响应消息，该注册响应消息用于响应注册请求消息，该注册响应消息还用于指示第一证书的校验结果，第一证书用于校验第一网元的第一可信平台是否可信。
结合第十方面，在第十方面的某些实现方式中，该接收模块还用于接收重新注册请求消息，该重新注册请求消息包括第二证书，该第二证书用于校验第一网元的第二可信平台是否可信。
第十一方面，提供一种通信装置，该通信装置包括接收模块和发送模块，
该接收模块用于接收认证许可消息，该认证许可消息用于请求获取访问令牌，该访问令牌包括网络功能服务消费者有权访问的服务信息，认证许可消息包括第二可信证书，该第二可信证书用于校验网络功能服务消费者的可信平台是否可信。
该发送模块用于发送认证响应消息，该认证响应消息用于指示请求获取访问令牌的结果。
结合第十一方面，在第十一方面的某些实现方式中，该发送模块还用于发送第一证明标识信息，该第一证明标识信息用于请求获取第一证明信息或第二证明结果，该第一证明信息用于校验网络功能服务消费者是否可信，该第二证明结果包括网络功能服务消费者已经被证明可信的证明结果。
第十二方面，提供一种通信装置，该通信装置包括接收模块和发送模块，
该接收模块用于接收服务请求消息，该服务请求消息用于请求获取网络功能服务提供者提供的服务。
该发送模块用于发送服务响应消息，该服务响应消息用于指示服务请求是否被接受，该服务响应消息还用于指示对网络功能服务消费者的可信校验的结果。
结合第十二方面，在第十二方面的某些实现方式中，该发送模块还用于发送第二证明标识信息，该第二证明标识信息用于请求获取第二证明信息或第三证明结果，该第二证明信息用于校验网络功能服务消费者是否可信，该第三证明结果包括网络功能服务消费者已经被证明可信的证明结果。
第十三方面，提供一种通信设备，包括至少一个处理器，至少一个处理器与至少一个存储器耦合，至少一个存储器用于存储计算机程序或指令，至少一个处理器用于从至少一个存储器中调用并运行该计算机程序或指令，使得该通信设备执行第一方面或其任一可能的实现方式中的方法。
第十四方面，提供一种通信设备，包括至少一个处理器，至少一个处理器与至少一个存储器耦合，至少一个存储器用于存储计算机程序或指令，至少一个处理器用于从至少一个存储器中调用并运行该计算机程序或指令，使得该通信设备执行第二方面、第三方面或其任一可能的实现方式中的方法。
第十五方面，提供一种通信设备，包括至少一个处理器，至少一个处理器与至少一个存储器耦合，至少一个存储器用于存储计算机程序或指令，至少一个处理器用于从至少一个存储器中调用并运行该计算机程序或指令，使得该通信设备执行第四方面、第五方面或其任一可能的实现方式中的方法。
第十六方面，提供一种通信设备，包括至少一个处理器，至少一个处理器与至少一个存储器耦合，至少一个存储器用于存储计算机程序或指令，至少一个处理器用于从至少一个存储器中调用并运行该计算机程序或指令，使得该通信设备执行第六方面或其任一可能的实现方式中的方法。
第十七方面，提供一种计算机可读存储介质，该计算机可读存储介质中存储有计算机 指令，当计算机指令在计算机上运行时，使得第一方面或其任意可能的实现方式中的方法被执行。
第十八方面，提供一种计算机可读存储介质，该计算机可读存储介质中存储有计算机指令，当计算机指令在计算机上运行时，使得第二方面、第三方面或其任意可能的实现方式中的方法被执行。
第十九方面，提供一种计算机可读存储介质，该计算机可读存储介质中存储有计算机指令，当计算机指令在计算机上运行时，使得第四方面、第五方面或其任意可能的实现方式中的方法被执行。
第二十方面，提供一种计算机可读存储介质，该计算机可读存储介质中存储有计算机指令，当计算机指令在计算机上运行时，使得第六方面或其任意可能的实现方式中的方法被执行。
第二十一方面，提供一种计算机程序产品，该计算机程序产品包括计算机程序代码，当该计算机程序代码在计算机上运行时，使得第一方面或其任意可能的实现方式中的方法被执行。
第二十二方面，提供一种计算机程序产品，该计算机程序产品包括计算机程序代码，当该计算机程序代码在计算机上运行时，使得第二方面、第三方面或其任意可能的实现方式中的方法被执行。
第二十三方面，提供一种计算机程序产品，该计算机程序产品包括计算机程序代码，当该计算机程序代码在计算机上运行时，使得第四方面、第五方面或其任意可能的实现方式中的方法被执行。
第二十四方面，提供一种计算机程序产品，该计算机程序产品包括计算机程序代码，当该计算机程序代码在计算机上运行时，使得第六方面或其任意可能的实现方式中的方法被执行。
第二十五方面，提供一种芯片，包括处理器，用于读取存储器中存储的指令，当该处理器执行该指令时，使得该芯片实现第一方面或其任意可能的实现方式中的方法被执行。
第二十六方面，提供一种芯片，包括处理器，用于读取存储器中存储的指令，当该处理器执行该指令时，使得该芯片实现第二方面、第三方面或其任意可能的实现方式中的方法被执行。
第二十七方面，提供一种芯片，包括处理器，用于读取存储器中存储的指令，当该处理器执行该指令时，使得该芯片实现第四方面、第五方面或其任意可能的实现方式中的方法被执行。
第二十八方面，提供一种芯片，包括处理器，用于读取存储器中存储的指令，当该处理器执行该指令时，使得该芯片实现第六方面或其任意可能的实现方式中的方法被执行。
附图说明
图1是适用于本申请实施例的通信系统示意图。
图2是本申请实施例提供的一种基于OAuth 2.0的通信方法示意图。
图3是本申请实施例提供的一种集成可信度量的通信方法示意图。
图4是本申请实施例提供的另一种集成可信度量的通信方法示意图。
图5是本申请实施例提供的又一种集成可信度量的通信方法示意图。
图6是本申请实施例提供的又一种集成可信度量的通信方法示意图。
图7是本申请实施例提供的又一种集成可信度量的通信方法示意图。
图8是本申请实施例提供的又一种集成可信度量的通信方法示意图。
图9是本申请实施例提供的又一种集成可信度量的通信方法示意图。
图10是本申请实施例提供的又一种集成可信度量的通信方法示意图。
图11是本申请实施例提供的又一种集成可信度量的通信方法示意图。
图12是本申请实施例提供的又一种集成可信度量的通信方法示意图。
图13是本申请实施例提供的又一种集成可信度量的通信方法示意图。
图14是本申请实施例提供的又一种集成可信度量的通信方法示意图。
图15是本申请实施例提供的又一种集成可信度量的通信方法示意图。
图16是本申请实施例提供的又一种集成可信度量的通信方法示意图。
图17是本申请实施例提供的又一种集成可信度量的通信方法示意图。
图18是本申请实施例提供的又一种集成可信度量的通信方法示意图。
图19是本申请实施例提供的又一种集成可信度量的通信方法示意图。
图20是本申请实施例提供的又一种集成可信度量的通信方法示意图。
图21是本申请实施例提供的一种通信装置示意图。
图22是本申请实施例提供的一种通信设备示意图。
具体实施方式
下面将结合附图，对本申请中的技术方案进行描述。
本申请实施例的技术方案可以应用于各种通信系统，例如：全球移动通讯(global system of mobile communication，GSM)系统、码分多址(code division multiple access，CDMA)系统、宽带码分多址(wideband code division multiple access，WCDMA)系统、通用分组无线业务(general packet radio service，GPRS)、长期演进(long term evolution，LTE)系统、LTE频分双工(frequency division duplex，FDD)系统、LTE时分双工(time division duplex，TDD)、通用移动通信系统(universal mobile telecommunication system，UMTS)、全球互联微波接入(worldwide interoperability for microwave access，WiMAX)通信系统或第五代(5th generation，5G)系统等。
本申请实施例中的终端设备可以指用户设备、接入终端、用户单元、用户站、移动站、移动台、远方站、远程终端、移动设备、用户终端、终端、无线通信设备、用户代理或用户装置。终端设备还可以是蜂窝电话、无绳电话、会话启动协议(session initiation protocol，SIP)电话、无线本地环路(wireless local loop，WLL)站、个人数字处理(personal digital assistant，PDA)、具有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它处理设备、车载设备、可穿戴设备，5G网络中的终端设备或者未来演进的公用陆地移动通信网络(public land mobile network，PLMN)中的终端设备等，本申请实施例对此并不限定。
本申请实施例中的网络设备可以是用于与终端设备通信的设备，该网络设备可以是全球移动通讯(global system of mobile communication，GSM)系统或码分多址(code division  multiple access，CDMA)中的基站(base transceiver station，BTS)，也可以是宽带码分多址(wideband code division multiple access，WCDMA)系统中的基站(NodeB，NB)，还可以是LTE系统中的演进型基站(evolutionalNodeB，eNB或eNodeB)，还可以是云无线接入网络(cloud radio access network，CRAN)场景下的无线控制器，或者该网络设备可以为中继站、接入点、车载设备、可穿戴设备以及5G网络中的网络设备或者PLMN网络中的网络设备等，本申请实施例并不限定。
本申请实施例中，对于名词的数目，除非特别说明，表示“单数名词或复数名词”，即“一个或多个”。“至少一个”是指一个或者多个，“多个”是指两个或两个以上，“一种或多种”中的“多种”是指也类似两种或两种以上。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B的情况，其中A，B可以是单数或者复数。字符“/”一般表示前后关联对象是一种“或”的关系。例如，A/B，表示：A或B。“以下至少一项(个)”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a，b，或c中的至少一项(个)，表示：a，b，c，a和b，a和c，b和c，或a和b和c，其中a，b，c可以是单个，也可以是多个。
为便于理解本申请实施例，首先结合图1简单介绍本申请实施例适用的通信系统。
图1是一种应用于本申请实施例的网络架构。如图1所示，下面对该网络架构中涉及的各个部分分别进行说明。
1、终端设备(terminal equipment)110：移动用户与网络交互的入口，能够提供基本的计算能力，存储能力，向用户显示业务窗口，接受用户操作输入。可以包括各种具有无线通信功能的手持设备、车载设备、可穿戴设备、计算设备或连接到无线调制解调器的其它处理设备，以及各种形式的终端，移动台(mobile station，MS)，终端(terminal)，用户设备(user equipment，UE)，软终端等等。例如，水表、电表、传感器等。
2、(无线)接入网络(radio access network，(R)AN)网元120：用于为特定区域的授权终端设备提供入网功能，并能够根据终端设备的级别，业务的需求等使用不同质量的传输隧道。
(R)AN网元能够管理无线资源，为终端设备提供接入服务，进而完成控制信号和终端设备数据在终端设备和核心网之间的转发，(R)AN网元也可以理解为传统网络中的基站。
3、用户面(user plane)网元130：用于分组路由和转发以及用户面数据的服务质量(quality of service，QoS)处理等。
在5G通信系统中，该用户面网元可以是用户面功能(user plane function，UPF)网元。在未来通信系统中，用户面网元仍可以是UPF网元，或者，还可以有其它的名称，本申请不做限定。
4、数据网络(data network)140：为用户提供业务服务的数据网络，一般客户端位于UE，服务端位于数据网络。数据网络可以是私有网络，如局域网，也可以是不受运营商管控的外部网络，如Internet，还可以是运营商共同部署的专有网络，如提供IMS服务的网络。
在5G通信系统中，该数据网络可以是data network，DN。在未来通信系统中，数据网络仍可以是DN，或者，还可以有其它的名称，本申请不做限定。
5、认证服务器(authentication server)150：用于鉴权服务、产生密钥实现对终端设备的双向鉴权，支持统一的鉴权框架。
在5G通信系统中，该认证服务器可以是认证服务器功能(authentication server function，AUSF)网元。在未来通信系统中，认证服务器功能网元仍可以是AUSF网元，或者，还可以有其它的名称，本申请不做限定。
6、接入管理(access management)网元160：主要用于移动性管理和接入管理等，可以用于实现移动性管理实体(mobility management entity，MME)功能中除会话管理之外的其它功能，例如，监听以及接入授权/鉴权等功能。
在5G通信系统中，该接入管理网元可以是接入管理功能(access and mobility management function，AMF)网元。在未来通信系统中，接入管理网元仍可以是AMF网元，或者，还可以有其它的名称，本申请不做限定。
7、会话管理(session management)网元170：主要用于会话管理、终端设备的网络互连协议(internet protocol，IP)地址分配和管理、选择可管理用户平面功能、策略控制和收费功能接口的终结点以及下行数据通知等。
在5G通信系统中，该会话管理网元可以是会话管理功能(session management function，SMF)网元。在未来通信系统中，会话管理网元仍可以是SMF网元，或者，还可以有其它的名称，本申请不做限定。
8、切片选择(slice selection)网元180：用于选择服务终端设备的一组网络切片实例，确定服务终端设备的一组接入管理网元。
在5G通信系统中，该网络开放网元可以是网络切片选择功能(network slice selection function，NSSF)网元。在未来通信系统中，网络开放网元仍可以是NSSF网元，或者，还可以有其它的名称，本申请不做限定。
9、网络开放(network exposure)网元190：用于将网络能力开放给第三方应用，可以实现网络能力与业务需求的友好对接。
在5G通信系统中，该网络开放网元可以是网络开放功能(network exposure function，NEF)网元。在未来通信系统中，网络开放网元仍可以是NEF网元，或者，还可以有其它的名称，本申请不做限定。
10、网络存储(network repository)网元1100：用于维护网络中所有网络功能服务的实时信息。
在5G通信系统中，该网络存储网元可以是网络注册功能(network repository function，NRF)网元。在未来通信系统中，网络存储网元仍可以是NRF网元，或者，还可以有其它的名称，本申请不做限定。
11、策略控制(policy control)网元1110：用于指导网络行为的统一策略框架，为控制面功能网元(例如AMF，SMF网元等)提供策略规则信息等。
在4G通信系统中，该策略控制网元可以是策略和计费规则功能(policy and charging rules function，PCRF)网元。在5G通信系统中，该策略控制网元可以是策略控制功能(policy control function，PCF)网元。在未来通信系统中，策略控制网元仍可以是PCF网元，或者，还可以有其它的名称，本申请不做限定。
12、数据管理(data management)网元1120：用于处理终端设备标识，接入鉴权，注册以及移动性管理等。
在5G通信系统中，该数据管理网元可以是统一数据管理(unified data management，UDM)网元。在未来通信系统中，统一数据管理仍可以是UDM网元，或者，还可以有其它的名称，本申请不做限定。
13、应用(application)网元1130：用于进行应用影响的数据路由，接入网络，与策略框架交互进行策略控制等。
在5G通信系统中，该应用网元可以是应用功能(application function，AF)网元。在未来通信系统中，应用网元仍可以是AF网元，或者，还可以有其它的名称，本申请不做限定。
可以理解的是，上述网元或者功能既可以是硬件设备中的网络元件，也可以是在专用硬件上运行软件功能，或者是平台(例如，云平台)上实例化的虚拟化功能。上述网元或者功能可划分出一个或多个服务，进一步，还可能会出现独立于网络功能存在的服务。
进一步地，将AF网元简称为AF，NEF网元简称为NEF，NRF网元简称为NRF，PCF网元简称为PCF。即本申请后续所描述的AF均可替换为应用网元，NEF均可替换为网络开放网元，NRF均可替换为网络存储网元，PCF均可替换为策略控制网元。
开放授权(open authorization，OAuth)协议是一种关于授权的开放网络协议，OAuth允许用户授权第三方应用访问用户存储在其他服务提供方上的信息，而不需要将用户名和密码提供给第三方应用或分享用户数据的所有内容。OAuth协议涉及3个角色：服务提供商(provider)、资源所有者(resource owner)和第三方应用(client)。其中，服务提供商逻辑上可以分为认证服务器(authorizationserver)和资源服务器(resourceserver)，认证服务器和资源服务器可以为同一应用程序。
认证服务器：用于认证用户的身份、产生令牌(token)。
资源服务器：用于保存用户的资源、验证令牌。
资源所有者：拥有资源的用户。
第三方应用：请求访问用户在其他服务提供方上的数据。
OAuth协议包括4种为第三方应用授权模式，分别为：授权码(authorizationcode)模式、简化(implicit)模式、密码(resourceowner password credentials)模式和客户端(client credentials)模式。其中，授权码模式功能完整、逻辑严密。
图2所示为本申请实施例适用的一种基于OAuth2.0的通信方法。
S110，第三方应用请求资源拥有者授权第三方应用访问其他服务提供方保存的资源拥有者的数据。
S120，资源拥有者授权第三方应用访问其他服务提供方保存的资源拥有者的数据。
S130，第三方应用根据S120中获得授权，向授权服务器申请访问令牌。
S140，授权服务器对第三方应用进行认证，确认无误后向第三方应用发放访问令牌。
S150，第三方应用使用访问令牌，向资源服务器申请获取资源拥有者的数据。
S160，资源服务器确认第三方应用的访问令牌无误，同意向第三方应用开放资源拥有者的数据。
可信计算(trusted computing，TC)是一项旨在使得计算机总是按照期望的方式运行 的技术，“可信”强调行为结果是可预测和可控制的。可信计算由计算机硬件和软件强制执行。计算系统的可信技术，以一个信任根作为起始，发展到对硬件平台、操作系统和应用程序的信任，每层的管理和认证的强度和每层的可信性相对应。进一步地，信任会被延伸到完整的计算机系统，并且会采用保护措施来保证计算机资源和预期计算机行为的整体性，以此提升计算机系统的可信任性。
目前，可信计算主要包括两个不同的研究方向。一个是利用物理防篡改设备保障可信计算根(trusted computing base，TCB)可信，以TCB为信任锚点构建计算机系统的可信计算体系；另一个是构建隔离计算系统保障特定敏感软件代码运行环境的可信，以此思路为演进，发展出了基于中央处理单元(centralprocessing unit，CPU)特殊安全模式的通用可信执行环境(trusted execution environment，TEE)。
远程证明(remote attestation，RA)是可信计算整体解决方案中的关键技术之一，用来判断设备的可信性状态。远程证明使得用户或其他人可以检测到该用户的计算机的变化，这样可以避免向不安全或安全受损的计算机发送私有信息或重要的命令。远程证明机制通过硬件生成一个证书，声明哪些软件正在运行。用户可以将这个证书发给远程的一方以表明他的计算机没有受到篡改。远程证明通常与公钥加密结合来保证发出的信息只能被发出证明要求的程序读取，而非其它窃听者。通过这些限制，达到增强终端可信性，加强系统安全的目的。目前远程证明技术主要采用以下几种方案：
(1)隐私证书颁发机构(privacy certificate authority，PCA)：挑战者给可信计算平台(trusted platformmodule，TPM)发送挑战，即请求一个或者多个平台状态寄存器(platform configuration register，PCR)的内容；平台收集存储度量日志文件，TPM使用身份密钥对PCR的内容进行签名；平台向证书中心CA发出请求平台证书的消息，然后将平台证书、存储度量日志、签名的PCR发送给挑战者；挑战者证明请求，即重新计算存储度量日志并与收到的PCR值进行比对，验证平台证书和签名。
(2)直接匿名认证(direct anonymous attestation，DAA)：TPM选择一个秘密信息，并通过安全的零知识的协议获取DAA发行者(issuer)对该秘密信息签发的DAA证书；验证者(verifier)通过“零知识证明”的方式证明TPM拥有一个可信的有效的DAA证书。
(3)英特尔软件保护扩展(intelsoftware guard extensions，Intel SGX)跨平台验证：SGX技术使得开发者可以把应用程序划分到中央处理单元(centralprocess unit，CPU)强化的飞地(enclave)中或者内存中可执行的保护区域，即使在受攻击的平台中也能提高安全性。Intel SGX的方案大致如下：被认证飞地获取当前信息生成报告结构，使用引用飞地(quoteenclave，QE)的报告密钥生成标签，发送给引用飞地；引用飞地根据验证被认证飞地是否处于同一平台(如同一设备)，将收到的报告结构封装成引用结构并使用签名密钥进行签名；目标飞地验证引证是否由可靠英特尔处理器生成。
OAuth2.0协议要求授权服务器对客户端进行身份认证，但是没有明确规定身份认证的方法，为融合可信计算的远程证明技术提供了可能。相比于其他认证技术，可信计算技术可以从硬件为OAuth2.0实体提供可信运行环境，具有更高的安全能力。
在正式介绍实施例前，首先对实施例中可能涉及的一些专业术语进行介绍。
1、飞地：用于为代码数据分离和加密的一个区域，且只在处理器内部解密，它是应 用程序的一部分并且可以完全访问应用程序内存。
2、引用飞地(QE)：由英特尔提供的飞地被称为引用飞地。当飞地系统运行时，只有引用飞地可以访问特定于设备的非对称密钥。
3、可信平台模块(TPM)：一种植于计算机内部为计算机提供可信根的芯片。
4、TPM软件栈(TPM Software Stack，TSS)：一种软件规范，它提供了用于访问TPM功能的标准应用程序编程接口(application programming interface，API)。应用程序开发人员可以使用此软件规范来开发可互操作的客户端应用程序，以实现更强的防篡改计算。
5、数字证书(digital certificate)：又称公开密钥认证(public key certificate)或身份证书(identity certificate)。是用于公开密钥基础建设的电子文件，用来证明公开密钥拥有者的身份。此文件包含了公钥信息、拥有者身份信息(主体)、以及数字证书认证机构(发行者)对这份文件的数字签名，以保证这个文件的整体内容正确无误。拥有者凭着此文件，可向电脑系统或其他用户表明身份，从而对方获得信任并授权访问或使用某些敏感的电脑服务。电脑系统或其他用户可以透过一定的程序核实证书上的内容，包括证书是否过期、数字签名是否有效，如果信任签发的机构，就可以信任证书上的密钥，凭公钥加密与拥有者进行可靠的通信。
简而言之，认证机构用自己的私钥对需要认证的人(或组织机构)的公钥施加数字签名并生成证书，即证书的本质就是对公钥施加数字签名。
6、证书签署请求(certification signing request，CSR)是申请者发给证书颁发机构的消息，用于申请公开密钥证书。通常包含用于签发证书的公钥、用于辨识的信息(如域名)、完整性保护(如数字签名)。当证书被签署时，这两部分都会被插入到证书中。
7、证书颁发机构(certificate authority，CA)，也称为电子商务认证中心、电子商务认证授权机构，是负责发放和管理数字证书的权威机构，并作为电子商务交易中受信任的第三方，承担公钥体系中公钥的可信性检验的责任。
8、可执行环境(TEE)：是中央处理器中安全的区域，可以保证其中的程序和资料在机密性和完整性上得到保护。TEE是隔离的执行环境，可以有安全的机能，例如隔离执行、和TEE一起执行的应用程序完整性，也包括其资产的机密性。用一般的术语来说，TEE提供安全性更高的执行空间，给可信软件执行，其安全性比操作系统更强，机能性比安全元件更多。
9、背书密钥(endorsement key，EK)：是制造商在制造TPM时写入的一对公私钥。EK是TPM的唯一标识，但出于对用户隐私的考虑，无法直接用EK对数据进行加密和签名，EK的主要功能之一是生成证明标识密钥，证明标识密钥用于代替EK对数据进行加密和签名。
10、证明标识密钥(attestation identity key，AIK)：可以用于对数据进行加密和签名，用于证明TPM的存在。AIK和EK是绑定的，但是除了TPM所处平台和PCA，其他设备无法获取AIK和EK的对应关系，可以保证用户的隐私性。
时间戳(timestamp)：指使用数字签名技术产生的数据，签名的对象包括了原始文件信息、签名参数、签名时间等信息。
11、信任区(trustzone)：一种安全解决办法，信任区提供了一个独立的安全操作系 统和硬件虚拟技术，用于为移动手机安全提供可信执行环境。信任区实现了在同一套硬件系统上运行两个独立的执行环境，分别称为安全环境(secure world)和常规环境(normal world)。
12、可信密码模块(trusted cryptography module，TCM)：一种可信计算平台的模块，为可信计算平台提供密码运算功能，具有受保护的存储空间。
以下结合核心网网元服务场景对本申请提供的通信方法进行描述，应理解，本申请提供的通信方法还可以应用于核心网服务场景以外的场景，以下实施例并不对本申请提供的通信方法的应用场景构成限制。
目前核心网网元自身的安全性尚未设置专门的保护措施，以下结合图3至图20说明本申请提供的集成可信度量的通信方法如何增强核心网网元自身以及网元之间信令交互的安全性。
图3所示为网元的初始化注册流程示意图。
核心网网络功能服务提供者在向网络功能服务消费者提供网元服务前，网络功能服务消费者和网络功能服务提供者都需要在网络存储网元上进行注册。以下以第一网元的注册流程为例说明本申请实施例提供的通信方法，网络功能服务消费者和网络功能服务提供者的注册流程与之类似，为了简洁，在此不做重复说明。
S201，第一网元发送注册请求消息。
注册请求(registration_request)消息用于请求注册第一网元。
在一些实施例中，注册请求消息除用于请求注册第一网元外，还可以包含可信证明相关的信息，在获取可信证明相关的信息后，注册请求消息的接收方可以执行远程证明相关操作。
在一些实施例中，注册请求消息中包括可信平台标识信息，该可信平台标识信息用于指示第一网元的可信平台类型。
在一些实施例中，网络注册请求消息中包括网络功能档案(network function profile，NF Profile)，可信平台标识信息包含在NF Profile中。
在一些实施例中，第一网元的可信平台标识信息可以在第一网元发送注册请求前预先配置到网络存储网元，这样，注册请求消息中可以不包括可信平台标识信息。
网络存储网元在确定第一网元支持的可信平台后，可以针对该可信平台确定如何对第一网元进行可信校验。当第一网元支持一个以上的可信平台时，网络存储网元可以根据校验的效率、网络状况等其他因素判断并优选校验方式对第一网元进行校验。
S202，第一网元接收发送注册响应消息。
注册响应(registration_response)消息用于响应注册请求消息。
在一些实施例中，该注册响应消息还用于指示第一证书的校验结果，该第一证书用于校验第一网元的第一可信平台是否可信。
在一些实施例中，注册响应消息包括第一网元的第一可信证书，该第一可信证书用于证明第一可信平台可信。
在一些实施例中，根据第一网元的可信平台，网络存储网元可以确定是否需要为第一网元的可信平台颁发证书，对于特定的可信平台，无需颁发可信证书，注册响应消息中便不再需要包含可信证书。
在一些实施例中，注册响应消息指示第一证书校验失败，此时注册响应消息又可以称为注册拒绝(registration reject)消息。
在一些实施例中，第一网元在接收指示第一证书校验失败的注册响应消息后，发送重新注册请求消息，该重新注册请求消息用于请求注册第一网元，该重新注册请求消息包括第二证书，该第二证书用于校验第一网元的第二可信平台是否可信。
在注册响应消息中包含对第一网元的第一证书的校验结果，第一网元在接收注册响应消息后可以确定是否完成注册。当注册成功时，第一网元可以获取第一可信证书，该可信证书可以用作第一网元的身份证明；当注册失败时，第一网元可以确定注册失败是由于第一可信平台的第一证书校验失败导致，进而采取更换可信平台或其他方式来准备下一次的注册请求。本技术方案的实施，有利于提高第一网元的注册效率。
在完成注册后，若网络功能服务消费者需要获取网络功能服务提供者提供的服务，网络功能服务消费者会向网络存储网元请求获取访问令牌，即进行授权请求。依靠访问令牌，网络功能服务消费者可以访问网络功能服务提供者提供的服务。图4为网络功能服务消费者授权请求流程示意图。
S301，网络功能服务消费者发送认证许可消息。
认证许可(authorization_grant)消息用于请求获取访问令牌，该访问令牌包括网络功能消费者有权访问的服务信息。
在一些实施例中，该认证许可消息还包括第二可信证书，第二可信证书用于校验网络功能服务消费者的可信平台是否可信。
在一些实施例中，认证许可消息还包括第一证明信息，第一证明信息根据第一挑战值(challenge data)生成，第一证明信息用于证明网络功能服务消费者是否可信。
在一些实施例中，网络功能服务消费者接收第一挑战值，该第一挑战值用于生成第一证明信息。
在一些实施例中，第一挑战值为时间戳、第一随机数、第二随机数和约定字段的数值中的任一种，该第一随机数为可信第三方提供的随机数，该第二随机数为为校验网络功能服务消费者的可信平台是否可信而生成的随机数。
在一个实施例中，第一挑战值为时间戳，该时间戳为网络功能服务消费者和网络存储网元都信任的时钟信息。
示例性地，该第一挑战值为有网络功能服务消费者的TPM可信平台产生的时钟信息。
在一个实施例中，第一挑战值为约定字段的数值，该约定字段可以根据网络功能服务消费者和网络存储网元都遵守的网络协议确定。
示例性地，在OAuth 2.0协议中规定认证许可消息从第256至320位的比特数据用作挑战值，网络功能服务消费者和网络存储网元同时遵守OAuth 2.0协议，则网络功能服务消费者获取该认证许可消息的第256至320位的比特数据作为挑战值。
在一个实施例中，第一挑战值为第一随机数，该第一随机数为网络功能服务消费者和网络存储网元都信任的随机数。
示例性地，该第一随机数通过区块链的方式生成(如区块链最新区块的时间戳或哈希值)，网络功能服务消费者在获取该第一随机数后用作挑战值。
通过时间戳、约定字段的数值、第一随机数和第二随机数等方式用作随机数，并用于 生成证明信息，可以实现多种方式的可信校验，可信校验双方可以根据实际情况选取合适的方式来确定挑战值，从而完成可信校验，有利于提高本申请提供的集成可信度量的通信方法的在不同应用场景下的适应性。
在一些实施例中，网络功能服务消费者根据约定的触发机制向网络存储网元发送证明信息或证明结果。
在一些实施例中，该触发机制为按照约定的时间周期性触发或响应于特定事件触发。
在一些实施例中，网络功能服务消费者在接收第一挑战值后触发发送证明信息的动作。
在一些实施例中，网络功能服务消费者在接收第一证明标识信息后触发发送证明结果的动作。
在一些实施例中，网络功能服务消费者接收第一证明标识信息，该第一证明标识信息用于请求获取第一证明信息或第二证明结果，第一证明信息用于校验网络功能服务消费者是否可信，第二证明结果包括网络功能服务消费者已经被证明可信的证明结果。
网络功能服务消费者在接收第一证明标识信息后可以准备第一证明信息或第二证明结果，用于网络存储网元对网络功能服务消费者是否可信的校验。
由于标识信息的数据量可以远小于挑战值的数据量，通过标识信息来触发可信证明，有利于简化消息的内容。被证明者可以依据约定的方式生成证明信息，有利于被证明者根据实际情况选择证明信息的生成方式。
S302，网络功能服务消费者接收认证响应消息。
认证响应(authorization_response)消息用于指示获取访问令牌请求的结果。
在一些实施例中，认证响应消息用于指示获得访问令牌，该访问令牌包括第一证明结果，该第一证明结果包括第一证明信息被校验的校验结果，第一证明信息用于校验网络功能服务消费者是否可信。
包含对第一网元的证明信息的校验结果的访问令牌，可以用于接下来服务请求流程。网络功能服务提供者可以直接通过访问令牌获取到网络存储网元的对网络功能服务消费者的证明信息校验的结果，无需再请求网络功能服务消费者重新生成证明信息。本申请实施例提供的技术方案可以明显简化服务请求过程中的对网络功能服务消费者的校验过程，提高校验效率。
在一些实施例中，第一证明结果包括身份信息、可信内容和新鲜度中的一项或多项，该身份信息用于指示证明网络功能服务消费者可信的证明者的身份，即网络存储网元，可信内容用于指示网络功能服务消费者被网络存储网元证明可信的内容，新鲜度用于指示网络功能服务消费者被网络存储网元证明可信的时间。
通过在第一证明结果中包括证明者的身份信息、可信内容和新鲜度，网络功能服务消费者下一次被校验时，验证者可以直接利用第一证明结果判断网络功能服务消费者是否可信，有利于提高可信证明的效率。
其中，通过证明者的身份信息可以确定第一证明结果对应的可信证明的验证者的身份，通过可信内容可以确定第一证明结果对应的可信证明过程证明的可信内容有哪些，是否适用于本次的可信证明，通过新鲜度可以确定第一证明结果对应的可信证明完成的时间，进而确定该可信证明结果是否在有效期内，判断是否需要重新进行可信证明。
在一些实施例中，认证响应消息用于指示未获得访问令牌，该认证响应消息用于指示 第二可信证书校验失败或第一证明信息校验失败。
通过认证响应消息指示获取令牌请求的结果，网络功能服务消费者既可以在接收认证响应消息后确定是否获得访问令牌，在未获得访问令牌时根据认证响应消息中包含的可信证书校验失败的指示或证明信息校验失败的指示，网络功能服务消费者可以重新准备可信证书或证明信息用于下一次授权认证流程。在获得访问令牌时，访问令牌上包含的证明结果有利于服务请求流程的校验。本申请实施例有利于提高授权认证过程中的校验效率，有利于后续网络功能服务消费者的校验。
在获取到访问令牌后，网络功能服务消费者可以使用该访问令牌获取其请求的网络服务，图5为网络功能服务消费者服务请求流程示意图。
S401，网络功能服务消费者发送服务请求消息。
服务请求(service_request)消息用于请求获取网络功能服务提供者提供的服务。
在一些实施例中，服务请求消息还包括第二证明信息，该第二证明信息根据第二挑战值生成，第二证明信息用于校验网络功能服务消费者是否可信。
在一些实施例中，第二挑战值为时间戳、第一随机数、第二随机数和约定字段的数值中的任一种。
通过时间戳、约定字段的数值、第一随机数和第二随机数等方式用作随机数，并用于生成证明信息，可以实现多种方式的可信校验，可信校验双方可以根据实际情况来选取恰当的方式来确定挑战值，从而完成可信校验，有利于提高本申请提供的集成可信度量的通信方法的在不同应用场景下的适应性。
在一些实施例中，网络功能服务消费者接收第二挑战值，该第二挑战值用于生成第二证明信息，第二证明信息用于证明网络功能服务消费者是否可信。
在一些实施例中，网络功能服务消费者接收第二证明标识信息，该第二证明标识信息用于请求获取第二证明信息或第三证明结果，第二证明信息用于校验网络功能服务消费者是否可信，第三证明结果包括网络功能服务消费者已经被证明可信的证明结果。
由于标识信息的数据量可以远小于挑战值的数据量，通过标识信息来触发可信证明，有利于简化消息的内容。被证明者可以依据约定的方式生成证明信息，有利于被证明者根据实际情况选择证明信息的生成方式。
S402，网络功能服务消费者接收服务响应消息。
服务响应(service_response)消息用于指示服务请求是否被接受，服务响应消息还用于指示对网络功能服务消费者的可信校验的结果。
在一些实施例中，服务响应消息用于指示服务请求被接受，可信校验包括第二证明信息或第三证明结果校验，第二证明信息用于校验网络功能服务消费者是否可信。
在一些实施例中，可信校验还包括第一证明结果校验，该第一证明结果包括网络功能服务消费者被网络存储网元证明可信的证明结果。
在一些实施例中，可信校验还包括第三可信证书校验，第三可信证书用于校验网络功能服务消费者的可信平台是否可信。
在一个实施例中，对网络功能服务消费者先进行第二证明信息或第三证明结果的校验再进行第一证明结果的校验，第二证明信息或第三证明结果校验通过后进行第一证明结果校验。
在一个实施例中，对网络功能服务消费者先进行第一证明结果校验再进行第二证明信息或第三证明结果校验，第一证明结果校验不通过时进行第二证明信息或第三证明结果的校验。
当网络功能服务提供者先对网络功能服务消费者进行第一证明结果的校验，通过第一证明结果的可信内容确定可信内容适用于本次校验，通过新鲜度确定，该第一证明结果已经失效，无法用作证明网络功能服务消费者可信的证据，网络功能服务提供者请求对网络功能服务消费者进行第二证明信息或第三证明结果的校验。
在一个实施例中，网络功能服务消费者的第二证明信息或第三证明结果和第一证明结果都通过校验，网络功能服务消费者获取权限完整的网络服务。
在一个实施例中，网络功能服务消费者的第二证明信息或第三证明结果通过校验，第一证明结果未通过校验，网络功能服务消费者获取受限的网络服务。
在一些实施例中，服务响应消息用于指示服务请求被接收，可信校验为第一证明结果校验，第一证明结果包括网络功能服务消费者被网络存储网元证明可信的证明结果。
当网络功能服务提供者先对网络功能服务消费者进行第一证明结果的校验，通过第一证明结果的可信内容确定网络存储网元的校验结果中包含的可信内容适用于本次校验，通过新鲜度确定，该第一证明结果处于有效期内，可以用作证明网络功能服务消费者可信的证据。网络功能服务提供者不再请求获取网络功能服务消费者的证明信息，可以为网络功能服务消费者提供网络服务。
直接进行第一证明结果的校验，而不先校验证明信息，当被网络存储网元证明可信的证明结果，即第一证明结果可以用于本次证明网元功能服务消费者可信时，可以明显加快服务请求流程中对网络功能服务消费者的校验。
在一些实施例中，服务响应消息用于指示服务请求被拒绝，该服务响应消息还用于指示第三可信证书校验失败或第二证明信息校验失败或第三证明结果校验失败或第一证明结果校验失败。
在一个实施例中，网络功能服务消费者的可信平台在实现可信证明的过程中无需生成可信证书，网络功能服务消费者请求服务的过程中，网络功能服务提供者也不再校验可信证书。
本申请实施例提供的技术方案中，在可信校验中设置证明信息的校验和证明结果的校验。可以实现对网络功能服务消费者的双重校验，并且根据校验情况为网络功能服务消费者提供服务，有利于提高核心网网元之间通信的安全性以及核心网功能服务消费者和提供者包含设备的安全性。
图6为本申请实施例提供的一种集成可信度量的通信方法。
在本申请实施例中，第一网元请求在网络存储网元上进行注册，根据第一网元的注册请求，网络存储网元请求对第一网元进行身份认证。
需要说明的是，在本申请实施例中主要介绍与可信度量相关的技术内容，OAuth 2.0协议相关的内容不做详细描述。
S501，第一网元发送注册请求消息。
注册请求消息用于请求注册第一网元。
在一些实施例中，网络注册请求消息中包括NF Profile，可信平台标识信息包含在第 一网元的NF Profile中。
示例性地，可信平台标识信息可以指示第一网元支持TPM、TCM、Intel SGX和信任区中的一种或多种。
在一些实施例中，NF Profile设置4个二进制位作为可信平台标识信息，用于标识第一网元支持的可信平台。
示例性地，0001表示第一网元支持TPM，0010表示第一网元支持TCM，0100表示第一网元支持Intel SGX，1000表示第一网元支持信任区，相应的，1010表示第一网元同时支持信任区和TCM，0101表示第一网元同时支持Intel SGX和TPM。
通过在注册请求中包括可信平台标识信息，可以使注册请求消息的接收方获取第一网元支持的可信平台类型，从而有利于注册请求消息的接收方能够针对第一网元指示的可信平台类型对第一网元的身份或可信状态进行校验，有利于提高对第一网元的校验的效率。
S502，网络存储网元发送认证请求消息。
在一些实施例中，第一网元通过向可信第三方(如PCA)请求可信证书，认证请求消息包括网络存储网元的公钥，其中网络存储网元的公钥用于计算远程证明所需的参数。
在一些实施例中，第一网元通过DAA方式获取第一网元的可信证书，认证请求消息包括挑战值和网络存储网元的公钥，挑战值和网络存储网元的公钥用于计算远程证明所需的参数。
在认证请求消息中包括挑战值，认证请求消息的接收方根据认证请求消息后同时准备身份认证相关参数和用于远程证明的参数。
S503，第一网元生成远程证明参数。
第一网元生成的远程证明参数用于网络存储网元为第一网元生成可信证书，远程证明参数根据第一网元的可信平台确定。
在一些实施例中，第一网元支持TPM、TCM、Intel SGX和信任区中的一种或多种可信平台。
在一个实施例中，第一网元支持TPM，远程证明参数包括：AIK公钥和TPM的EK证书。
在一个实施例中，第一网元支持TCM，远程证明参数包括：AIK公钥和TPM的EK证书。
S504，第一网元发送认证响应消息。
在一些实施例中，认证响应消息包括第一网元已经生成的远程证明参数和第一网元的身份信息，远程证明参数用于生成第一网元的可信证书，身份信息用于校验第一网元的身份。
在一些实施例中，认证响应消息包括远程证明参数，该远程证明参数既用于生成第一网元的可信证书，又用于校验第一网元的身份。
通过认证响应消息，第一网元可以向网络存储网元提供用于身份证明的参数，根据OAuth 2.0协议，网络存储网元可以根据该参数对第一网元进行身份校验。由于认证响应消息中还包括远程证明参数，网络存储网元还可以利用远程证明参数来生成第一网元的可信证书。通过将远程证明参数用于第一网元的身份证明，可以减少认证响应消息中包含的数据量，有利于认证响应消息的收发和处理。
S505，网络存储网元校验第一网元的身份，生成可信证书。
网络存储网元根据认证响应消息对第一网元的身份进行验证。
在一些实施例中，网络存储网元根据认证响应消息中的第一网元的身份信息校验第一网元的身份。
在一些实施例中，网络存储网元根据认证响应消息中的远程证明信息对第一网元的身份进行校验。
在一些实施例中，第一网元的身份通过验证，远程证明参数通过验证，网络存储网元生成可信证书。
在一些实施例中，第一网元的身份未通过验证，网络存储网元不生成可信证书。
在一个实施例中，第一网元支持TPM，认证响应消息中包括的远程证明参数包括AIK公钥和TPM的EK证书，网络存储网元校验TPM的EK证书无误后，用网络存储网元的私钥对AIK公钥签名得到第一网元的可信证书。
S506，网络存储网元发送注册响应消息。
网络存储网元完成对第一网元的验证后向第一网元发送注册响应消息。
在一些实施例中，第一网元的身份通过验证、远程证明参数通过验证，注册响应消息中包括网络存储网元生成的可信证书。
在一个实施例中，第一网元的身份通过验证，网络存储网元向第一网元分配第一网元标识，该第一网元标识可以作为之后第一网元与网络存储网元、网络功能服务提供者进行通信时的标识。
在一个实施例中，网络存储网元生成的可信证书包括在上述第一网元标识中。
在一些实施例中，第一网元的身份未通过验证，网络存储网元向第一网元发送注册响应消息，指示注册失败，此时注册响应消息又可以称为注册拒绝消息。
在一个实施例中，第一网元的身份通过验证，第一网元的远程证明参数未通过验证，注册拒绝消息用于指示注册失败和失败的原因为第一网元的可信平台不可信。
S507，第一网元保存可信证书。
在一些实施例中，网络存储网元在之后对第一网元进行身份校验时将可信证书用作第一网元的身份证明。
拥有可信证书的第一网元可以在后续的身份校验中直接将可信证书作为一种身份证明，有利于提高第一网元身份校验的效率。
图7为本申请实施例提供的另一种集成可信度量的通信方法。
在本申请实施例中，第一网元请求在网络存储网元上进行注册，根据第一网元的可信平台，网络存储网元无需为第一网元颁发可信证书。
S601，第一网元发送注册请求消息。
在一些实施例中，可信平台标识信息在第一网元发送注册请求消息前，已经通过配置到网络存储网元上，注册请求消息中不包括可信平台标识信息。
可信平台标识信息的标识方式可以具体参考S501。
通过发送注册请求消息，网络存储网元可以获取到第一网元的注册请求，根据注册请求消息的内容或者其他方式，网络存储网元可以获取第一网元的可信平台类型，进而根据该平台类型做出响应。
S602，网络存储网元校验第一网元的身份。
在一些实施例中，第一网元支持Intel SGX可信平台，网络存储网元无需为第一网元签署可信证书。网络存储网元在接收第一网元的注册请求消息后，根据注册请求消息的内容对第一网元的身份进行校验。
在一些实施例中，第一网元支持ArmTrustZone可信平台，网络存储网元无需为第一网元签署可信证书。网络存储网元在接收第一网元的注册请求消息后，根据注册请求消息的内容对第一网元的身份进行校验。
S603，网络存储网元发送注册响应消息。
在一些实施例中，第一网元的身份通过网络存储网元的校验，网络存储网元向第一网元发送注册响应消息，指示第一网元注册成功。
在一些实施例中，第一网元的身份未通过网络存储网元的校验，网络存储网元向第一网元发送注册拒绝消息，指示第一网元注册失败。
在一些实施例中，第一网元的身份未通过网络存储网元的校验，网络存储网元向第一网元发送注册拒绝消息，指示第一网元未通过身份校验，注册失败。
以上结合图6和图7以第一网元的注册过程为例，说明了本申请实施例提供的通信方法在核心网网元注册过程中的应用。以下结合图8至图10详细说明本申请实施例提供的通信方法在网络功能服务消费者授权认证流程的应用。
图8为本申请实施例提供的又一种集成可信度量的通信方法。
在本申请实施例提供的方法中，网络功能服务消费者向网络存储网元请求获取访问令牌，在网络存储网元通过对网络功能服务消费者的校验后，向网络功能服务消费者颁发访问令牌。
S701，网络功能服务消费者生成远程证明参数。
网络功能服务消费者生成的远程证明参数用于生成可信证书，远程证明参数根据网络功能服务消费者支持的可信平台确定。
在一些实施例中，网络功能服务消费者支持TPM、TCM、Intel SGX和ArmTrustZone中的一种或多种可信平台。
S702，网络功能服务消费者发送访问令牌获取请求消息。
访问令牌获取请求(access_token_get_request)消息用于向消息的接收方发起获取访问令牌的请求，该访问令牌获取请求消息中包括网络功能服务消费者已经生成的远程证明参数以及在注册过程中获取的可信证书，可信证书用于校验网络功能服务消费者的可信平台是否可信。
在一些实施例中，网络功能服务消费者已经获取的访问令牌的使用时间已经超过令牌的超时时间，网络功能服务消费者通过刷新令牌(refresh token)请求获取访问令牌。
通过发送访问令牌获取请求消息，网络存储网元可以获取网络功能服务消费者获取访问令牌的请求，由于该消息中还包括了网络功能服务消费者的可信证书，网络存储网元可以在接收访问令牌获取请求消息后对网络功能服务消费者的可信证书进行校验。
S703，网络存储网元校验网络功能服务消费者的可信证书。
可信证书包括了注册过程中网络存储网元的签名以及网络功能服务消费者的公钥。网络存储网元接收到访问令牌获取请求消息后，验证可信证书的签名以及可信证书中包含的 网络功能服务消费者的公钥，从而验证网络功能服务消费者的身份。
S704，网络存储网元发送证明请求消息。
证明请求消息用于向证明请求消息的接收方发出证明请求。
在一些实施例中，证明请求消息包括挑战值，该挑战值用于生成证明信息，该挑战值为一个随机数还可以用于对该证明请求消息防重放。
在一些实施例中，证明请求消息包括证明标识信息，该证明标识信息用于请求获取证明信息或证明结果。
在验证网络功能服务消费者的身份无误后，网络存储网元需要进一步校验网络功能服务消费者的软件和/或硬件是否可信，通过发送挑战值至网络功能服务消费者，网络功能服务消费者可以获取到网络存储网元进一步请求校验网络功能服务消费者的软件和/或硬件的度量值等数据的请求。
S705，网络功能服务消费者准备证明信息或证明结果。
证明信息(attestation information)又可以称为证明证据(attestation evidence)或证明数据(attestation data)是网络功能服务消费者响应证明请求消息生成的包括网络功能服务消费者的软件和/或硬件的度量值等数据的信息。
在一些实施例中，证明信息包括引证(quote)和度量日志(event_log)，该引证为度量日志的摘要，用于校验度量日志的内容是否发生篡改，该度量日志包括网络功能服务消费者的软件和/或硬件的度量记录。
在一个实施例中，引证为度量日志的哈希值，通过该哈希值可以恢复度量日志的全文，进而与证明信息中包含的度量日志进行比对，实现对证实数据的校验。
在一个实施例中，网络功能服务消费支持TPM可信平台，该证明信息包括引证和度量日志，该引证包括平台配置寄存器(platform configuration register，PCR)的标识、PCR标识的签名和度量日志的摘要，该度量日志包括网络功能服务消费者的软件和/或硬件的度量记录。
在一些实施例中，第一证明信息可以包括以下信息中的一种或多种：
被验证者的运行状态、健康度、安全相关的配置或构建信息、硬件、固件、软件、文件系统、证明环境的身份、可信执行环境、数据的完整性和PCR数值。
证明结果(attestation result)包括被验证者已经被证明可信的证明结果。
在一些实施例中，证明结果包括身份信息、可信内容和新鲜度中的一项或多项，该身份信息用于指示第一证明信息的校验者的身份，该可信内容用于指示第一证明信息中被证明可信的内容，该新鲜度用于指示第一证明信息被校验的时间。
在一些实施例中，证明结果包括以下信息中的一种或多种：
配置(configuration)：验证者验证了被验证者的配置；
可执行文件(executables)：验证者验证了被验证者的实时文件、脚本和/或其他加载到内存中的内容；
文件系统(file-system)：验证者验证了被验证者的文件系统；
硬件(hardware)：验证者验证了被验证者的硬件和固件，可以签名和运行程序；
证明环境身份(instance-identity)：验证者验证了被验证者的证明环境的身份，如TPM的AIK；
运行可见性(runtime-opaque)：验证者从被验证者内存的外部验证了证明者的可见性；
源数据(sourced-data)：验证者验证了被验证者使用的数据的完整性；
存储可见性(storage-opaque)：验证者验证了被验证者能够加密永久存储器。
S706，网络功能服务消费者发送证明信息或证明结果。
在一些实施例中，网络功能服务消费者在发送证明信息前，利用网络功能服务消费者的私钥对证明信息进行加密，私钥加密后的信息可以利用与该私钥对应的公钥进行解密。
在一些实施例中，该证明信息包括一个随机数，用于该证明信息的防重放。
通过发送证明信息，证明请求信息的发送方可以获取到网络功能服务消费者的软件和/或硬件的度量值等数据的信息，从而根据证明信息进一步判断网络功能服务消费者的运行环境是否可信。
S707，网络存储网元校验证明信息。
在一些实施例中，通过对比引证恢复的全文数据和度量日志的内容可以实现对证明信息的校验。
在一些实施例中，证明信息由网络功能服务消费者的私钥加密，根据网络存储网元拥有的网络功能服务消费者的私钥是否可以对证明信息解密可以实现对证明信息的校验。
在一些实施例中，证明信息中包含度量值，该度量值为第一网元的软件和/或硬件的运行状态相关的数据，度量日志记录了第一网元的软件和/或硬件的可信度量的过程信息，该过程信息经过运算可以得到状态信息，从而通过比对证明信息中的度量值和度量日志的内容，可以实现对证明信息的校验。
通过校验证明信息可以确定证明信息的发送方的身份、证明信息是否完整、证明信息是否被篡改等，从而有利于降低可能由上述因素引起的威胁的几率，有利于提高核心网网元的安全性。
S708，网络存储网元验证网络功能服务消费者是否被授权。
网络存储网元根据OAuth 2.0协议的规定验证网络功能服务消费者是否被授权访问其请求的服务。
S709，网络存储网元生成访问令牌。
访问令牌(access_token)用于指示访问令牌的持有者具有访问资源、数据或服务的许可。
在一些实施例中，访问令牌包括第一证明结果，该第一证明结果包括网络功能服务消费者被网络存储网元证明可信的证明结果。
在一些实施例中，网络存储网元不对网络功能服务消费者进行证明信息的验证，但同样会为网络功能服务消费者颁发访问令牌，该访问令牌包括第一证明结果，该第一证明结果用于指示网络功能服务消费者未进行证明信息的验证。
示例性地，在一些对核心网网元服务的时延要求高对安全性要求不高的场景下，该第一证明结果用于指示网络功能服务消费者未通过证明信息的验证。
通过在访问令牌中添加可以判断是否通过证明信息验证的证明结果，在网络功能服务消费者请求访问核心网网元服务时，可以根据访问令牌中的证明结果对该网络功能服务消费者是否通过证明信息的验证进行校验，从而实现双重校验。
S710，网络存储网元发送访问令牌获取响应消息。
访问令牌获取响应消息用于响应网络功能服务消费者发出的访问令牌获取请求消息。该访问令牌获取响应消息中包括网络存储网元颁发的访问令牌。
在一些实施例中，访问令牌获取响应消息中还包括刷新令牌，网络功能服务消费者可以利用该刷新令牌在访问令牌的使用时间超过令牌的超时时间时，重新向网络存储网元申请令牌。
通过获取访问令牌，网络功能服务消费者可以利用该访问令牌向网络功能服务提供者获取其请求的服务。
图9为本申请实施例提供的又一种集成可信度量的通信方法。
在本申请实施例提供的方法中，网络功能服务消费者向网络存储网元请求获取访问令牌，网络功能服务消费者的可信证书未通过网络存储网元的验证，网络存储网元拒绝向网络功能服务消费者颁发访问令牌。
S801，网络功能服务消费者生成远程证明参数。
网络功能服务消费者生成的远程证明参数用于网络存储网元为网络功能服务消费者生成可信证书，远程证明参数根据网络功能服务消费者支持的可信平台确定。
在一些实施例中，网络功能服务消费者支持TPM、TCM、Intel SGX和ArmTrustZone中的一种或多种可信平台。
S802，网络功能服务消费者发送访问令牌获取请求消息。
在一些实施例中，访问令牌获取请求消息用于向消息的接收方发起获取访问令牌的请求，该访问令牌获取请求消息中包括网络功能服务消费者已经生成的远程证明参数以及在注册过程中获取的可信证书。
通过发送访问令牌获取请求消息，网络存储网元可以获取网络功能服务消费者获取访问令牌的请求，由于该消息中还包括了网络功能服务消费者的可信证书，因此，网络存储网元可以在接收访问令牌获取请求消息后对网络功能服务消费者的可信证书进行校验。
S803，网络存储网元校验网络功能服务消费者的可信证书。
在一些实施例中，网络存储网元通过可信证书的签名询问签署方该签名的期限，并根据该期限校验可信证书不在有效期内。
在一些实施例中，网络存储网元根据可信证书的签名信息判断可信证书的签名为不存在的签名。
在一些实施例中，网络存储网元根据可信证书获取网络功能服务消费者的公钥，并利用该公钥解密网络功能服务消费者发送的加密信息，确定该公钥并无法解密网络功能服务消费者发送的加密信息。
网络存储网元通过校验网络功能服务消费者的可信证书的真伪，从而判断该可信证书的拥有者是进行下一步的校验或者拒绝该可信证书拥有者的请求，有利于提高网络存储网元以及其他网元的安全性。
S804，网络存储网元发送访问令牌获取响应消息。
该消息也可以称为访问令牌获取拒绝(accesstoken_get_reject)消息或认证拒绝(authorization_reject)消息。由于网络功能服务消费者的可信证书校验失败，网络存储网元拒绝网络功能服务消费者的访问令牌获取请求，网络存储网元向网络功能服务消费者发 送拒绝授权消息。
在一些实施例中，该拒绝授权消息还用于指示网络功能服务消费者的可信证书校验失败。
一种可能的情况，网络功能服务消费者伪造可信证书的签名或伪造可信证书企图欺骗网络存储网元，该网络功能服务消费者可能会给网络和网络上的其他网元、用户等带来威胁，拒绝该网络功能服务消费者有利于提高网络与网元的安全性。
图10为本申请实施例提供的又一种集成可信度量的通信方法。
在本申请实施例提供的方法中，网络功能服务消费者向网络存储网元请求获取访问令牌，网络功能服务消费者在通过可信证书的校验后向网络存储网元发送证明信息，该证明信息未通过网络存储网元的校验。
在本申请实施例中S901至S906的内容与S701至S706的内容一致，具体内容可以参考S701至S706，在此不再赘述。
S907，网络存储网元校验证明信息。
在一些实施例中，证明信息中引证恢复全文的数据与度量日志的内容不同，证明信息校验失败。
在一些实施例中，网络存储网元拥有的网络功能服务消费者的公钥无法解密证明信息，证实消息校验失败。
在一些实施例中，证明信息中包含度量值，度量日志经过运算得到的与度量值中包含的网络功能服务消费者的软件和/或硬件的状态值，该运算所得状态值与证明信息中的度量值不同，证明信息校验失败。
S908，网络存储网元发送访问令牌获取拒绝消息。
由于网络功能服务消费者的证明信息校验失败，网络存储网元拒绝向该网络功能服务消费者提供访问令牌，网络存储网元向网络功能服务消费者发送访问令牌获取拒绝消息。
在一些实施例中，该访问令牌获取拒绝消息还用于指示网络功能服务消费者的证明信息未通过校验。
一种可能的情况，网络功能服务消费者为不安全的网元或携带威胁的设备，该网络功能服务消费者伪造的可信证书通过了网络存储网元的校验，但其伪造的证明信息并无法通过网络存储网元的校验。拒绝向该网络功能服务消费者颁发访问令牌，有利于提高网络、核心网网元和用户数据等的安全性。
图11为本申请实施例提供的又一种集成可信度量的通信方法。
在本申请实施例提供的方法中，网络功能服务消费者向网络存储网元请求获取访问令牌，在网络存储网元通过对网络功能服务消费者可信证书校验和证明信息校验。网络功能服务消费者并未被授权申请访问令牌，网络存储网元拒绝网络功能服务消费者颁发访问令牌。
在本申请实施例中S1001至S1007的内容与S701至S707的内容一致，具体内容可以参考S701至S707，在此不再赘述。
S1008，网络存储网元验证网络功能服务消费者是否被授权。
在通过可信证书校验、证明信息校验后，网络存储网元根据OAuth 2.0协议的规定验证网络功能服务消费者未被授权访问其请求的服务，网络存储网元拒绝网络功能服务消费 者的访问令牌获取请求，向网络功能服务消费者发送访问令牌获取拒绝消息
在一些实施例中，该消息还用于指示网络功能服务消费者未被授权申请访问令牌。
S1009，网络存储网元发生访问令牌获取拒绝消息。
由于网络功能服务消费者未被授权，网络存储网元拒绝向该网络功能服务消费者提供访问令牌，网络存储网元向网络功能服务消费者发送访问令牌获取拒绝消息。
在一些实施例中，该访问令牌获取拒绝消息还用于指示网络功能服务消费者的未被授权申请访问令牌。
网络存储网元拒绝未被授权的网络功能服务消费者的访问令牌获取请求，有利于减轻网络功能服务提供者的服务承载，有利于保障已经授权的网络功能服务消费者的服务质量，有利于提高网络、网元以及网络用户等的安全性。
图12为本申请实施例提供的又一种集成可信度量的通信方法。
在本申请实施例提供的方法中，网络功能服务消费者向网络存储网元发送访问令牌获取请求消息，请求获取访问令牌，该请求消息中还包括了挑战值生成的证明信息，网络存储网元在接收到访问令牌获取请求消息后同时获取到可信证书和证明信息，网络存储网元依次校验可信证书和证明信息，以及网络功能服务消费者是否被授权，在确定上述信息无误后，向网络功能服务消费者颁发访问令牌。
S1101，网络功能服务消费者生成远程证明参数。
网络功能服务消费者生成的远程证明参数用于网络存储网元为网络功能服务消费者生成可信证书，远程证明参数根据网络功能服务消费者支持的可信平台确定。
在一些实施例中，网络功能服务消费者支持TPM、TCM、Intel SGX和ArmTrustZone中的一种或多种可信平台。
在一些实施例中，网络功能服务消费者以时间戳、第一随机数、第二随机数和约定字段的数值中的任一种为挑战值生成证明信息。
在一种可能的实现方式中，该挑战值为时间戳，该时间戳为由网络功能服务消费者的TPM可信平台产生的时钟信息。
在一种可能的实现方式中，该挑战值为约定字段的数值，该约定字段可以根据第一网络设备和第二网络设备都遵守的网络协议确定。
在一种可能的实现方式中，该挑战值为第一随机数，该第一随机数为第一网络设备和第二网络设备都信任的随机数，该第一随机数可以由可信第三方提供。
S1102，网络功能服务消费者发送访问令牌获取请求消息。
利用时间戳、第一随机数、第二随机数或约定字段的数值作为挑战值，在发送访问令牌获取请求消息的同时可以将已经生成的证明信息发送至网络存储网元。网络存储网元在接收访问令牌获取请求消息后可以直接对网络功能服务消费者的可信证书和证明信息进行校验，有利于提高网络存储网元进行信息校验的效率，有利于网络功能服务消费者访问令牌的获取。
S1103，网络存储网元校验可信证书和证明信息。
可信证书包括了注册过程中网络存储网元的签名以及网络功能服务消费者的公钥。网络存储网元接收到访问令牌获取请求消息后，验证可信证书的签名以及可信证书中包含的网络功能服务消费者的公钥，从而验证网络功能服务消费者的身份。
通过校验证明信息可以确定证明信息的发送方的身份、证明信息是否完整、证明信息是否被篡改等，从而有利于降低可能由上述因素引起威胁的几率，有利于提高核心网网元的安全性。
S1104，网络存储网元验证网络功能服务消费者是否被授权。
网络存储网元根据OAuth 2.0协议的规定验证网络功能服务消费者是否被授权访问其请求的服务。
S1105，网络存储网元生成访问令牌。
访问令牌用于指示访问令牌的持有者具有访问资源、数据或服务的许可。
在一些实施例中，访问令牌包括第一标识信息，该第一标识信息用于标识网络功能服务消费者是否进行证明信息的验证。
在一些实施例中，网络存储网元不对网络功能服务消费者进行远程证明，但同样会为网络功能服务消费者颁发访问令牌，该访问令牌包括证明结果，该证明结果用于指示网络功能服务消费者未进行证明信息的验证。
示例性地，在一些对核心网网元服务的时延要求高对安全性要求不高的场景下，该证明结果用于标识网络功能服务消费者未通过远程证明的验证。
通过在访问令牌中添加可以判断是否通过远程证明验证的证明结果，在网络功能服务消费者请求访问核心网网元服务时，可以根据访问令牌中的证明结果对该网络功能服务消费者是否通过远程证明的验证进行校验。
S1106，网络功能服务消费者发送访问令牌获取响应消息。
访问令牌获取响应消息用于响应网络功能服务消费者发出的访问令牌获取请求消息。该访问令牌获取响应消息中包括网络存储网元颁发的访问令牌。
通过获取访问令牌，网络功能服务消费者可以利用该访问令牌向网络功能服务提供者方法其请求的服务。
图13是本申请实施例提供的又一种可信度量的通信方法。
在本申请实施例中，网络功能服务消费者支持的可信平台在网络存储网元上注册是不需要生成可信证书，在申请访问令牌是网络存储网元根据网络功能服务消费者支持的可信平台确定无需对该网络功能服务消费者进行可信证书校验。在确定证明信息无误和该网络功能服务消费者已被授权申请访问令牌后，网络存储网元向该网络功能服务消费者颁发访问令牌。
S1201，网络功能服务消费者生成证明信息。
在一些实施例中，以时间戳为挑战值生成证明信息。
S1202，网络功能服务消费者发送访问令牌获取请求消息。
利用时间戳作为挑战值，在发送访问令牌获取请求消息的同时可以将已经生成的证明信息发送至网络存储网元。网络存储网元在接收访问令牌获取请求消息后可以直接对网络功能服务消费者的证明信息进行校验，有利于提高网络存储网元进行信息校验的效率，有利于网络功能服务消费者访问令牌的获取。
S1203，网络存储网元校验证明信息。
通过校验证明信息可以确定证明信息的发送方的身份、证明信息是否完整、证明信息是否被篡改等，从而有利于降低可能由上述因素引起的威胁，有利于提高核心网网元的安 全性。
S1204，网络存储网元验证网络功能服务消费者是否被授权。
网络存储网元根据OAuth 2.0协议的规定验证网络功能服务消费者是否被授权访问其请求的服务。
S1205，网络存储网元生成访问令牌。
访问令牌用于指示访问令牌的持有者具有访问资源、数据或服务的许可。
S1206，网络功能服务消费者发送访问令牌获取响应消息。
访问令牌获取响应消息用于响应网络功能服务消费者发出的访问令牌获取请求消息。该访问令牌获取响应消息中包括网络存储网元颁发的访问令牌。
通过获取访问令牌，网络功能服务消费者可以利用该访问令牌向网络功能服务提供者方法其请求的服务。
以上结合图8至图13说明了本申请实施例提供的通信方法在网络功能服务消费者获取访问令牌的过程中的应用，以下结合图14至图20，说明本申请实施例提供的通信方法在网络功能服务消费者访问网络服务时的应用。
图14为本申请实施例提供的又一种集成可信度量的通信方法。
在本申请实施例中，网络功能服务消费者请求访问网络功能服务提供者提供的服务，网络功能服务提供者首先对网络功能服务消费者进行校验。通过网络功能服务提供者的校验后，网络功能服务消费者对网络功能服务提供者提出校验请求，进而对网络功能服务提供者进行校验。
S1301，网络功能服务消费者生成第一远程证明参数。
第一远程证明参数用于生成网络功能服务消费者的可信证书。
S1302，网络功能服务消费者发送服务请求消息。
服务请求消息用于向服务请求的接收方请求获取服务。该服务请求包括获取访问令牌过程中获取的访问令牌、注册过程获取的可信证书和S1301中生成的第一远程证明参数。
S1303，网络功能服务提供者校验网络功能服务消费者的第一可信证书。
第一可信证书用于校验网络功能服务消费者的可信平台是否可信。第一可信证书的校验方法与S703中的可信证书的校验方法类似，详细内容可以参照S703，在此不做赘述。
通过校验网络功能服务消费者的第一可信证书，网络功能服务提供者可以确定网络功能服务消费者的可信平台是否真实可信。
S1304，网络功能服务提供者发送第一证明请求消息。
第一证明请求消息用于向网络功能服务消费者发出证明请求，要求网络功能服务消费者提供其软件和/或硬件的度量值等数据，从而根据软件和/或硬件的度量值等数据判断网络功能服务消费者是否可信。
S1305，网络功能服务消费者生成第一证明信息。
第一证明信息包括网络功能服务消费者的软件和/或硬件的度量值等数据，用于判断判断网络功能服务消费者是否可信。
第一证明信息包括信息的种类与S705中描述的证明信息类似，在此不做赘述，具体内容可以参考S705中的描述。
S1306，网络功能服务消费者发送第一证明信息。
通过发送第一证明信息，网络功能服务提供者可以获取到网络功能服务消费者的软件和/或硬件的度量值等数据的信息，从而根据证明信息进一步判断网络功能服务消费者是否可信。
S1307，网络功能服务提供者校验第一证明信息。
通过校验证明信息可以确定第一证明信息的发送方的身份、证明信息是否完整、证明信息是否被篡改等，从而有利于降低可能由上述因素引起威胁的几率，有利于提高核心网网元的安全性。
S1308，网络功能服务提供者校验网络功能服务消费者的访问令牌。
访问令牌用于指示网络功能服务消费者具有访问资源、数据或服务的许可。
在一些实施例中，访问令牌包括第一证明结果，该第一证明结果用于标识网络功能服务消费者的第一证明信息通过网络存储网元的验证。
在一些实施例中，访问令牌包括第一证明结果，该第一证明结果用于标识网络功能服务消费者的第一证明信息未通过网络存储网元的验证。
通过校验网络功能服务消费者的访问令牌，可以确定网络功能服务消费者是否具有访问访问令牌确定的服务的权限，也可以确定网络功能服务消费者可以访问服务的类型，也可以确定网络功能服务消费者可以访问服务的时间等信息。
S1309，网络功能服务提供者校验网络功能服务消费者的第一证明结果。
在一些实施例中，第一证明结果标识网络功能服务消费者的第一证明信息未通过网络存储网元的验证，网络功能服务提供者向网络功能服务消费者提供受限的服务。
在一些实施例中，第一证明结果标识网络功能服务消费者的第一证明信息通过网络存储网元的验证，网络功能服务提供者向网络功能服务消费者提供其请求的服务。
通过校验网络功能服务消费者的第一证明结果，可以在对访问令牌验证后再次对网络功能服务消费者是否通过远程证明进行校验，实现对网络功能服务消费者是否通过远程证明的双重验证，有利于增强对网络功能服务提供者的保护。
对于时延要求较小或网络功能服务消费者本身物理安全等级较高的应用场景，S1309可以不执行。
S1310，网络功能服务提供者生成第二远程证明参数。
第二远程证明参数用于生成网络功能服务提供者的可信证书。
S1311，网络功能服务提供者发送服务响应消息。
服务响应消息用于响应网络功能服务消费者的服务请求。该服务响应消息包括注册过程获取的网络功能服务提供者的第二可信证书和用于对网络功能服务提供者进行远程证明用的参数。
S1312，网络功能服务消费者校验网络功能服务提供者的第二可信证书。
第二可信证书用于指示网络功能服务提供者的可信平台是否可信。第二可信证书的校验方法与S703中的可信证书的校验方法类似，详细内容可以参照S703，在此不做赘述。
通过校验网络功能服务提供者的第二可信证书，网络功能服务消费者可以确定网络功能服务提供者是否在网络存储网元进行注册并且网络存储网元的可信平台可信。
S1313，网络功能服务消费者发送第二证明请求消息。
第二证明请求消息用于向网络功能服务提供者发出证明请求，要求网络功能服务提供 者提供其软件和/或硬件的度量值等数据，从而根据软件和/或硬件的度量值等数据判断网络功能服务提供者是否可信。
S1314，网络功能服务提供者生成第二证明信息。
第二证明信息包括网络功能服务提供者的软件和/或硬件的度量值等数据，用于判断判断网络功能服务提供者是否可信。
第二证实数据包括信息的种类与S705中描述的证明信息类似，在此不做赘述，具体内容可以参考S705中的描述。
S1315，网络功能服务提供者发送第二证明信息。
通过发送第二证明信息，网络功能服务消费者可以获取到网络功能服务提供者的软件和/或硬件的度量值等数据的信息，从而根据证明信息进一步判断网络功能服务提供者是否可信。
S1316，网络功能服务消费者校验第二证明信息。
通过校验证明信息可以确定第二证明信息的发送方的身份、证明信息是否完整、证明信息是否被篡改等，从而有利于降低可能由上述因素引起的威胁，有利于提高网络功能服务消费者的安全性。
S1317，网络功能服务消费者与网络功能服务提供者建立服务关系。
在确定网络功能服务提供者的可信平台和网络功能服务提供者可信后，网络功能服务消费者与网络功能服务提供者建立连接，网络功能服务消费者从网络功能服务提供者获取请求的服务。
图15是本申请实施例提供的又一种集成可信度量的通信方法。
在本申请实施例中，网络功能服务消费者请求访问网络功能服务提供者提供的服务，S1101中，网络功能服务消费者生成第一远程证明参数，并在S1102中，将第一远程证明参数发送至网络功能服务提供者。这两步内容分别与S1001和S1002内容一致，在此不再赘述。
S1403，网络功能服务提供者校验第一可信证书。
在一些实施例中，网络功能服务提供者校验第一可信证书的签名，确定第一可信证书不在有效期限内。
在一些实施例中，网络功能服务提供这校验第一可信证书的公钥，确定该公钥并无法解密网络功能服务消费者发送的加密信息。
S1404，网络功能服务提供者向网络功能服务消费者发送服务拒绝消息。
由于网络功能服务消费者的第一可信证书未通过校验，网络功能服务提供者拒绝向网络功能服务消费者提供服务。
可信证书无法通过校验的网络功能服务消费者可能携带不安全因素，拒绝该网络功能服务消费者有利于提高网元和网络的安全。
图16是本申请实施例提供的又一种集成可信度量的通信方法。
在本申请实施例中，网络功能服务消费者的第一可信证书通过校验，但第一证明信息未通过校验，网络功能服务提供者拒绝向该网络功能服务消费者提供服务。
在本申请实施例中，S1501至S1506的内容分别与S1301至S1306的内容一致，在此不再赘述。
S1507，网络功能服务提供者校验第一证明信息。
在一些实施例中，证明信息中引证恢复的全文数据与度量日志的内容不同，证明信息校验失败。
在一些实施例中，网络存储网元拥有的网络功能服务消费者的公钥无法解密证明信息，证实消息校验失败。
在一些实施例中，证明信息中包含度量值，度量日志经过运算得到的与度量值中包含的网络功能服务消费者的软件和/或硬件的状态值，该运算所得状态值与证明信息中的度量值不同，证明信息校验失败。
S1508，网络功能服务提供者向网络功能服务消费者发生服务拒绝消息。
由于网络功能服务消费者的第一证明信息未通过校验，网络功能服务提供者拒绝向网络功能服务消费者提供服务。
证明信息无法通过校验的网络功能服务消费者可能携带不安全因素，拒绝该网络功能服务消费者有利于提高网元和网络的安全。
图17是本申请实施例提供的又一种集成可信度量的通信方法。
在本申请实施例中，网络功能服务消费者的第一可信证书、第一证明信息通过校验，但第三证明结果指示该网络功能服务消费者在授权阶段未进行证明信息的校验，网络功能服务提供者拒绝向该网络功能服务消费者提供服务。
在本申请实施例中，S1601至S1608的内容分别与S1301至S1308的内容一致，在此不再赘述。
S1609，网络功能服务提供者校验第一证明结果。
第一证明结果用于表示网络功能服务消费者在申请访问令牌的过程中是否经过网络存储网元的证明信息校验。
在一些实施例中，第一证明结果用于指示络功能服务消费者未通过网络存储网元的可信信息的校验。
在一个实施例中，网络功能服务消费者请求服务的场景对时延要求高对安全性要求不高，网络存储网元未对该网络功能服务消费者进行证明信息的校验，该第一证明结果指示络功能服务消费者未通过网络存储网元的可信信息的校验。
S1610，网络功能服务提供者向网络功能服务消费者发生服务拒绝消息。
由于网络功能服务消费者的第一证明结果未通过校验，网络功能服务提供者拒绝向该网络功能服务消费者提供服务。
第一证明结果无法通过校验的网络功能服务消费者可能携带不安全因素，拒绝该网络功能服务消费者有利于提高网元和网络的安全。
图18是本申请实施例提供的又一种集成可信度量的通信方法。
在本申请实施例中，网络功能服务消费者通过网络功能服务提供者的校验，网络功能服务提供者的可信证书未通过网络功能服务消费者的校验，网络功能服务消费者取消向该网络功能服务提供者获取服务。
在本申请实施例中，S1701至S1711的内容分别与S1301至S1311的内容一致，在此不再赘述。
S1712，网络功能服务消费者校验第二可信证书。
在一些实施例中，网络功能服务消费者校验第二可信证书的签名，确定第二可信证书不在有效期限内。
在一些实施例中，网络功能服务消费者校验第二可信证书的公钥，确定该公钥并无法解密网络功能服务提供者发送的加密信息。
S1713，网络功能服务消费者向网络功能服务提供者发送服务取消消息。
由于网络功能服务提供者的第二可信证书未通过校验，网络功能服务消费者取消向网络功能服务提供者获取服务。
可信证书无法通过校验的网络功能服务提供者可能携带不安全因素，取消向该网络功能服务提供者获取服务有利于提高网元和网络的安全。
图19是本申请实施例提供的又一种集成可信度量的通信方法。
在本申请实施例中，网络功能服务消费者通过网络功能服务提供者的校验，网络功能服务提供者的证明信息未通过网络功能服务消费者的校验，网络功能服务消费者取消向该网络功能服务提供者获取服务。
在本申请实施例中，S1801至S1815的内容分别与S1301至S1315的内容一致，具体内容可以参考S1301至S1315，在此不再赘述。
S1816，网络功能服务消费者校验第二证明信息。
在一些实施例中，第二证明信息中引证恢复的全文数据与度量日志的内容不同，第二证明信息校验失败。
在一些实施例中，网络功能服务消费者拥有的网络功能服务提供者的公钥无法解密证明信息，证实消息校验失败。
在一些实施例中，证明信息中包含度量值，度量日志经过运算得到的与度量值中包含的网络功能服务提供者的软件和/或硬件的状态值，该运算所得状态值与证明信息中的度量值不同，证明信息校验失败。
S1817，网络功能服务消费者向网络功能服务提供者发送服务取消消息。
由于网络功能服务提供者的第二证明信息未通过校验，网络功能服务消费者取消向网络功能服务提供者获取服务。
证明信息无法通过校验的网络功能服务提供者可能携带不安全因素，取消向该网络功能服务提供者获取服务有利于提高网元和网络的安全。
图20是本申请实施例提供的又一种集成可信度量的通信方法。
在本申请实施例中，网络功能服务消费者请求获取网络功能服务提供者的提供的服务，并以时间戳作为挑战值生成证明信息，网络功能服务提供者可以同时校验网络功能服务消费者的可信证书和证明信息，并验证访问令牌和标识信息。在确认网络功能服务消费者的待校验信息无误后，网络功能服务提供者根据可信平台生成证明信息，无需生成可信证书。网络功能服务提供者通过发送服务响应消息将证明信息发送至网络功能服务消费者，网络功能服务消费者验证证明信息无误后，向网络功能服务提供者获取服务。
S1901，网络功能服务消费者生成第一远程证明参数和第一证明信息。
在一些实施例中，网络功能服务消费者以时间戳为挑战值生成第一证明信息。
在一些实施例中，时间戳指与网络功能服务消费者相关的一个时间值，例如网络功能服务消费者收发某一消息的时间。
S1902，网络功能服务消费者发送服务请求消息。
服务请求消息用于向服务请求的接收方请求获取服务。该服务请求包括获取访问令牌过程中获取的访问令牌、注册过程获取的可信证书和S1301中生成的第一远程证明参数和第一证明信息。
S1903，网络功能服务提供者校验第一可信证书和第一证明信息。
第一可信证书用于指示网络功能服务消费者通过网络存储网元的校验。第一可信证书的校验方法与S703中的可信证书的校验方法类似，详细内容可以参照S703，在此不做赘述。
通过校验网络功能服务消费者的第一可信证书，网络功能服务提供者可以确定网络功能服务消费者是否在网络存储网元进行注册并通过网络存储网元的校验。
通过校验证明信息可以确定第一证明信息的发送方的身份、证明信息是否完整、证明信息是否被篡改等，从而有利于降低可能由上述因素引起的威胁，有利于提高核心网网元的安全性。
S1904，网络功能服务提供者校验访问令牌。
访问令牌用于指示网络功能服务消费者具有访问资源、数据或服务的许可。
在一些实施例中，访问令牌包括第一证明结果，该第一证明结果用于标识网络功能服务消费者的远程证明通过验证。
在一些实施例中，访问令牌包括第一证明结果，该第一证明结果用于标识网络功能服务消费者未通过远程证明的验证。
通过校验网络功能服务消费者的访问令牌，可以确定网络功能服务消费者是否具有访问访问令牌确定的服务的权限，也可以确定网络功能服务消费者可以访问服务的类型，也可以确定网络功能服务消费者可以访问服务的时间等信息。
S1905，网络功能服务提供者校验网络功能服务消费者的第一证明结果。
在一些实施例中，第一证明结果标识网络功能服务消费者未通过远程证明验证，网络功能服务提供者向网络功能服务消费者提供受限的服务。
在一些实施例中，第一证明结果标识网络功能服务消费者通过远程证明验证，网络功能服务提供者向网络功能服务消费者提供其请求的服务。
通过校验网络功能服务消费者的第一证明结果，可以在对访问令牌验证后再次对网络功能服务消费者是否通过远程证明进行校验，实现对网络功能服务消费者是否通过远程证明的双重验证，有利于增强对网络功能服务提供者的保护。
对于时延要求较小或网络功能服务消费者本身物理安全等级较高的应用场景，S1905可以不执行。
S1906，网络功能服务提供者生成第二远程证明参数。
网络功能服务提供者根据网络功能服务提供者的可信平台生成第二证明信息，第二证明信息包括网络功能服务提供者的软件和/或硬件的度量值等数据，用于判断判断网络功能服务提供者是否可信。
通过校验证明信息可以确定第一证明信息的发送方的身份、证明信息是否完整、证明信息是否被篡改等，从而有利于降低可能由上述因素引起的威胁，有利于提高核心网网元的安全性。
S1907，网络功能服务提供者发送服务响应消息。
该服务响应消息包括第二证明信息，通过发生服务响应消息可以将第二证明信息发送至网络功能服务消费者，用于网络功能服务消费者对网络功能服务提供者的校验。网络功能服务消费者可以获取到网络功能服务提供者的软件和/或硬件的度量值等数据的信息，从而根据证明信息进一步判断网络功能服务提供者的运行环境是否可信。
S1908，网络功能服务消费者校验第二证明信息。
通过校验证明信息可以确定第二证明信息的发送方的身份、证明信息是否完整、证明信息是否被篡改等，从而有利于降低可能由上述因素引起的威胁，有利于提高网络功能服务消费者的安全性。
S1909，网络功能服务消费者与网络功能服务提供者建立服务关系。
在确定网络功能服务提供者的运行环境可信后，网络功能服务消费者与网络功能服务提供者建立连接，网络功能服务消费者从网络功能服务提供者获取请求的服务。
以上结合图3至图20说明了本申请实施例提供的集成可信度量的通信方法在不同场景下的应用，基于与以上方法实施例相同的发明构思，本申请实施例还提供了一种通信装置，该通信装置可具备上述方法实施例中的第一网元、网络存储网元、网络功能服务消费者和网络功能服务提供者的功能，并可用于执行上述方法实施例中由第一网元、网络存储网元、网络功能服务消费者和网络功能服务提供者执行的步骤。
在一种可能的实现方式中，如图21所示的通信装置2100可作为上述方法实施例所涉及的第一网元，并执行上述方法实施例中由第一网元执行的步骤。
如图21所示，该通信装置2100可包括发送模块2110和接收模块2120。
发送模块2110可用于支持通信装置2100进行发送信息，例如执行图3、图6和图7中的S201、S501、S504和S601中由第一网元执行的发送动作。
接收模块2120可用于支持通信装置2100进行接收信息，例如执行图3、图6和图7中的S202、S502和S506由第一网元执行的接收动作。
可选的，通信装置2100还可以包括处理模块2130，该处理模块2130与发送模块2110和接收模块2120耦合，可用于支持通信装置2100执行上述方法实施例中的处理动作，例如执行图6中的S503和S507等由第一网元执行的处理动作。
在另一种可能的实现方式中，如图21所示的通信装置2100可作为上述方法实施例所涉及的网络存储网元，并执行上述方法实施例中由网络存储网元执行的步骤。
如图21所示，该通信装置2100可包括发送模块2110和接收模块2120。
发送模块2110可用于支持通信装置2100进行发送信息，例如执行图3、图4、图6、图7、图8、图9、图10、图11、图12和图13中的S202、S302、S502、S506、S603、S704、S710、S804、S904、S908、S1004、S1009、S1106和S1206中由网络存储网元执行的发送动作。
接收模块2120可用于支持通信装置2100进行接收信息，例如执行图3、图4、图6、图7、图8、图9、图10、图11、图12和图13中的S201、S301、S501、S504、S601、S702、S706、S802、S902、S906、S1002、S1006、S1102和S1202中由网络存储网元的执行接收动作。
可选的，通信装置2100还可以包括处理模块2130，该处理模块2130与发送模块2110 和接收模块2120耦合，可用于支持通信装置2100执行上述方法实施例中的处理动作，例如执行图6、图7、图8、图9、图10、图11、图12和图13中的S505、S602、S707、S708、S709、S803、S903、S907、S1003、S1007、S1008、S1103、S1104、S1105、S1203、S1204和S1205等由网络存储网元执行的处理动作。
在另一种可能的实现方式中，如图21所示的通信装置2100可作为上述方法实施例所涉及的网络功能服务消费者，并执行上述方法实施例中由网络功能服务消费者执行的步骤。
如图21所示，该通信装置2100可包括发送模块2110和接收模块2120。
发送模块2110可用于支持通信装置2100进行发送信息，例如执行图4、图5、图8、图9、图10、图11、图12、图13、图14、图15、图16、图17、图18、图19和图20中的S301、S401、S702、S706、S802、S902、S906、S1002、S1006、S1102、S1202、S1302、S1306和S1313中由网络功能服务消费者执行的发送动作。
接收模块2120可用于支持通信装置2100进行接收信息，例如执行图4、图5、图8、图9、图10、图11、图12、图13、图14、图15、图16、图17、图18、图19和图20中的S302、S402、S704、S710、S804、S904、S908、S1004、S1009、S1106、S1206、S1304、S1311、S1315、S1404、S1504、S1508、S1604、S1610、S1704、S1711、S1804、S1811、S1815和S1907中由网络功能服务消费者执行的接收动作。
可选的，通信装置2100还可以包括处理模块2130，该处理模块2130与发送模块2110和接收模块2120耦合，可用于支持通信装置2100执行上述方法实施例中的处理动作，例如执行图8、图9、图10、图11、图12、图13、图14、图15、图16、图17、图18、图19和图20中的S701、S705、S801、S901、S905、S1001、S1005、S1101、S1201、S1301、S1305、S1312、S1316、S1401、S1501、S1505、S1601、S1605、S1701、S1705、S1712、S1801、S1805、S1812、S1816、S1901和S1908中由网络功能服务消费者执行的处理动作。
在另一种可能的实现方式中，如图21所示的通信装置2100可作为上述方法实施例所涉及的网络功能服务消费者，并执行上述方法实施例中由网络功能服务提供者执行的步骤。
如图21所示，该通信装置2100可包括发送模块2110和接收模块2120。
发送模块2110可用于支持通信装置2100进行发送信息，例如执行图5、图14、图15、图16、图17、图18、图19和图20中的S401、S1304、S1311、S1315、S1404、S1504、S1508、S1604、S1610、S1704、S1711、S1804、S1811、S1815、和S1907中由网络功能服务提供者执行的发送动作。
接收模块2120可用于支持通信装置2100进行接收信息，例如执行图5、图14、图15、图16、图17、图18、图19和图20中的S401、S1302、S1306、S1313、S1315、S1402、S1502、S1506、S1602、S1606、S1702、S1706、S1713、S1802、S1806、S1813、S1817和S1902中由网络功能服务提供者执行的接收动作。
可选的，通信装置2100还可以包括处理模块2130，该处理模块2130与发送模块2110和接收模块2120耦合，可用于支持通信装置2100执行上述方法实施例中的处理动作，例如执行图14、图15、图16、图17、图18、图19和图20中的S1303、S1307、S1308、S1309、S1310、S1314、S1403、S1503、S1507、S1603、S1607、S1608、S1609、S1703、S1707、S1708、S1709、S1710、S1803、S1807、S1808、S1809、S1810、S1903、S1904、S1905和S1906等由网络功能服务提供者执行的处理动作。
可选的，通信装置2100还可以包括存储模块2140，用于存储通信装置2100的程序代码和数据。
图22是本申请实施例提供的通信设备2200的示意性框图。如图所示，该通信设备2200包括：至少一个处理器2210和收发器2220。该处理器2210与存储器耦合，用于执行存储器中存储的指令，以控制收发器2220发送信号和/或接收信号。
可选地，该通信设备2200还包括存储器2230，用于存储指令。
在一些实施例中，上述处理器2210和存储器2230可以合成一个处理装置，处理器2210用于执行存储器2230中存储的程序代码来实现上述功能。具体实现时，该存储器2230也可以集成在处理2210中，或者独立于处理器2210。
在一些实施例中，收发器2220可以包括接收器(或者称，接收机)和发射器(或者称，发射机)。
收发器2220还可以进一步包括天线，天线的数量可以为一个或多个。收发器2220有可以是通信接口或者接口电路。
当该通信设备2200为芯片时，该芯片包括收发单元和处理单元。其中，收发单元可以是输入输出电路或通信接口；处理单元可以为该芯片上集成的处理器或者微处理器或者集成电路。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而 前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (31)

  1. 一种集成可信度量的通信方法，其特征在于，包括：
    第一网元发送注册请求消息，所述注册请求消息用于请求注册所述第一网元；
    所述第一网元接收注册响应消息，所述注册响应消息用于响应所述注册请求消息，所述注册响应消息还用于指示第一证书的校验结果，所述第一证书用于校验所述第一网元的第一可信平台是否可信。
  2. 根据权利要求1所述的通信方法，其特征在于，所述第一网元包括第二可信平台，所述方法还包括：
    所述第一网元发送重新注册请求消息，所述重新注册请求消息用于请求注册所述第一网元，所述重新注册请求消息包括第二证书，所述第二证书用于校验所述第二可信平台是否可信。
  3. 一种集成可信度量的通信方法，其特征在于，包括：
    网络存储网元接收注册请求消息，所述注册请求消息用于请求注册第一网元；
    响应于所述注册请求消息，所述网络存储网元发送注册响应消息，所述注册响应消息还用于指示第一证书校验结果，所述第一证书用于校验所述第一网元的第一可信平台是否可信。
  4. 根据权利要求1或3所述的通信方法，其特征在于，所述请求注册第一网元成功，所述注册响应消息包括第一可信证书，所述第一可信证书用于证明所述第一可信平台可信。
  5. 根据权利要求1或3所述的通信方法，其特征在于，所述请求注册第一网元失败，所述注册响应消息指示所述第一证书校验失败。
  6. 根据权利要求5所述的通信方法，其特征在于，所述第一网元包括第二可信平台，所述方法还包括：
    所述网络存储网元接收重新注册请求消息，所述重新注册请求消息用于请求注册所述第一网元，所述重新注册请求消息包括第二证书，所述第二证书用于校验所述第二可信平台是否可信。
  7. 根据权利要求1至6中任一项所述的通信方法，其特征在于，所述注册请求消息包括平台标识信息，所述平台标识信息用于标识所述第一网元的可信平台。
  8. 一种集成可信度量的通信方法，其特征在于，包括：
    网络功能服务消费者发送认证许可消息，所述认证许可消息用于请求获取访问令牌，所述访问令牌包括所述网络功能服务消费者有权访问的服务信息，所述认证许可消息包括第二可信证书，所述第二可信证书用于校验所述网络功能服务消费者的可信平台是否可信；
    所述网络功能服务消费者接收认证响应消息，所述认证响应消息用于指示所述请求获取访问令牌的结果。
  9. 根据权利要求8所述的通信方法，其特征在于，所述方法还包括：
    所述网络功能服务消费者接收第一证明标识信息，所述第一证明标识信息用于请求获取第一证明信息或第二证明结果，所述第一证明信息用于校验所述网络功能服务消费者是否可信，所述第二证明结果包括所述网络功能服务消费者已经被证明可信的证明结果。
  10. 一种集成可信度量的通信方法，其特征在于，包括：
    网络存储网元接收认证许可消息，所述认证许可消息用于请求获取访问令牌，所述访问令牌包括网络功能服务消费者有权访问的服务信息，所述认证许可消息包括第二可信证书，所述第二可信证书用于校验所述网络功能服务消费者的可信平台是否可信；
    所述网络存储网元发送认证响应消息，所述认证响应消息用于指示所述请求获取访问令牌的结果。
  11. 根据权利要求10所述的通信方法，其特征在于，所述方法还包括：
    所述网络存储网元发送第一证明标识信息，所述第一证明标识信息用于请求获取第一证明信息或第二证明结果，所述第一证明信息用于校验所述网络功能服务消费者是否可信，所述第二证明结果包括所述网络功能服务消费者已经被证明可信的证明结果。
  12. 根据权利要求8或10所述的通信方法，其特征在于，所述认证响应消息用于指示获得所述访问令牌，所述访问令牌包括第一证明结果，所述第一证明结果包括所述网络功能服务消费者被网络存储网元证明可信的证明结果。
  13. 根据权利要求12所述的通信方法，其特征在于，所述第一证明结果包括身份信息、可信内容和新鲜度中的一项或多项，所述身份信息用于指示所述网络存储网元，所述可信内容用于指示所述网络功能服务消费者被所述网络存储网元证明可信的内容，所述新鲜度用于指示所述网络功能服务消费者被所述网络存储网元证明可信的时间。
  14. 根据权利要求8或10所述的通信方法，其特征在于，所述认证响应消息用于指示未获得所述访问令牌，所述认证响应消息还用于指示所述第二可信证书校验失败或第一证明信息校验失败，所述第一证明信息用于校验所述网络功能服务消费者是否可信。
  15. 根据权利要求8或10所述的通信方法，其特征在于，所述认证许可消息还包括第一证明信息，所述第一证明信息根据第一挑战值生成，所述第一证明信息用于校验所述网络功能服务消费者是否可信，所述第一挑战值为时间戳、第一随机数、第二随机数和约定字段的数值中的任一种，所述第一随机数为可信第三方提供的随机数，所述第二随机数为为校验所述网络功能服务消费者的可信平台是否可信而生成的随机数。
  16. 一种集成可信度量的通信方法，其特征在于，包括：
    网络功能服务消费者发送服务请求消息，所述服务请求消息用于请求获取网络功能服务提供者提供的服务；
    所述网络功能服务消费者接收服务响应消息，所述服务响应消息用于指示所述请求获取服务是否被接受，所述服务响应消息还用于指示对所述网络功能服务消费者的可信校验的结果。
  17. 根据权利要求16所述的通信方法，其特征在于，所述方法还包括：
    所述网络功能服务消费者接收第二证明标识信息，所述第二证明标识信息用于请求获取第二证明信息或第三证明结果，所述第二证明信息用于校验所述网络功能服务消费者是否可信，所述第三证明结果包括所述网络功能服务消费者已经被证明可信的证明结果。
  18. 一种集成可信度量的通信方法，其特征在于，包括：
    网络功能服务提供者接收服务请求消息，所述服务请求消息用于请求获取所述网络功能服务提供者提供的服务；
    所述网络功能服务提供者发送服务响应消息，所述服务响应消息用于指示所述请求获 取服务是否被接受，所述服务响应消息还用于指示对所述网络功能服务消费者的可信校验的结果。
  19. 根据权利要求18所述的通信方法，其特征在于，所述方法还包括：
    所述网络功能服务提供者发送第二证明标识信息，所述第二证明标识信息用于请求获取第二证明信息或第三证明结果，所述第二证明信息用于校验所述网络功能服务消费者是否可信，所述第三证明结果包括所述网络功能服务消费者已经被证明可信的证明结果。
  20. 根据权利要求16或18所述的通信方法，其特征在于，所述服务响应消息用于指示所述请求获取服务被接受，所述可信校验包括第二证明信息校验或第三证明结果校验，所述第二证明信息用于校验所述网络功能服务消费者是否可信，所述第三证明结果包括所述网络功能服务消费者已经被证明可信的证明结果。
  21. 根据权利要求20所述的通信方法，其特征在于，所述可信校验还包括第一证明结果校验，所述第一证明结果包括所述网络功能服务消费者被网络存储网元证明可信的证明结果。
  22. 根据权利要求20所述的通信方法，其特征在于，所述可信校验还包括第三可信证书校验，所述第三可信证书用于校验所述网络功能服务消费者的可信平台是否可信。
  23. 根据权利要求16或18所述的通信方法，其特征在于，所述服务响应消息用于指示所述请求获取服务被接受，所述可信校验为第一证明结果校验，所述第一证明结果包括所述网络功能服务消费者被网络存储网元证明可信的证明结果。
  24. 根据权利要求16或18所述的通信方法，其特征在于，所述服务响应消息用于指示所述请求获取服务被拒绝，所述服务响应消息还用于指示第三可信证书校验失败或第一证明结果校验失败或第二证明信息校验失败或第三证明结果校验失败，所述第三可信证书用于校验所述网络功能服务消费者的可信平台是否可信，所述第一证明结果包括所述网络功能服务消费者被网络存储网元证明可信的证明结果，所述第二证明信息用于校验所述网络功能服务消费者是否可信，所述第三证明结果包括所述网络功能服务消费者已经被证明可信的证明结果。
  25. 根据权利要求16至18中任一项所述的通信方法，其特征在于，所述服务请求消息还包括第二证明信息，所述第二证明信息根据第二挑战值生成，所述第二证明信息用于校验所述网络功能服务消费者是否可信，所述第二挑战值为时间戳、第一随机数、第二随机数和约定字段的数值中的任一种，所述第一随机数为可信第三方提供的随机数，所述第二随机数为为校验所述网络功能服务消费者的可信平台是否可信而生成的随机数。
  26. 一种通信装置，其特征在于，包括：
    处理器，用于执行存储器中存储的计算机指令，以使得所述装置执行权利要求1、权利要求2、权利要求4、权利要求5或者权利要求7中任一项所述的方法。
  27. 一种通信装置，其特征在于，包括：
    处理器，用于执行存储器中存储的计算机指令，以使得所述装置执行权利要求8、权利要求9、权利要求12至15、权利要求16、权利要求17或者权利要求20至25中任一项所述的方法。
  28. 一种通信装置，其特征在于，包括：
    处理器，用于执行存储器中存储的计算机指令，以使得所述装置执行权利要求3至7 或者权利要求10至15中任一项所述的方法。
  29. 一种通信装置，其特征在于，包括：
    处理器，用于执行存储器中存储的计算机指令，以使得所述装置执行权利要求18至25中任一项所述的方法。
  30. 一种计算机程序产品，其特征在于，所述计算机程序产品中包括计算机程序代码，当所述计算机程序代码在计算机上运行时，1至25中任一项所述的方法被执行。
  31. 一种通信系统，其特征在于，包括：用于执行如权利要求1、2、4至7中任一项所述方法的第一网元，用于执行如权利要求3至7中任一项所述方法的网络存储单元，用于执行如权利要求8、9、12至17、20至25中任一项所述方法的网络功能服务消费者，用于执行如权利要求10至15中任一项所述方法的网络存储网元，以及用于执行如权利要求18至25中任一项所述方法的网络功能服务提供者。
PCT/CN2022/137536 2022-01-05 2022-12-08 集成可信度量的通信方法 WO2023130885A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210010007.6A CN116419229A (zh) 2022-01-05 2022-01-05 集成可信度量的通信方法
CN202210010007.6 2022-01-05

Publications (1)

Publication Number Publication Date
WO2023130885A1 true WO2023130885A1 (zh) 2023-07-13

Family

ID=87058660

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/137536 WO2023130885A1 (zh) 2022-01-05 2022-12-08 集成可信度量的通信方法

Country Status (2)

Country Link
CN (1) CN116419229A (zh)
WO (1) WO2023130885A1 (zh)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109688586A (zh) * 2017-10-19 2019-04-26 中兴通讯股份有限公司 一种网络功能认证的方法、装置及计算机可读存储介质
CN111131242A (zh) * 2019-12-24 2020-05-08 北京格林威尔科技发展有限公司 一种权限控制方法、装置和系统
CN111435932A (zh) * 2019-01-14 2020-07-21 华为技术有限公司 一种令牌处理方法及装置
US20200267214A1 (en) * 2017-11-27 2020-08-20 Telefonaktiebolaget Lm Ericsson (Publ) Status Updates in a 5G Core Network
CN111865598A (zh) * 2019-04-28 2020-10-30 华为技术有限公司 网络功能服务的身份校验方法及相关装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109688586A (zh) * 2017-10-19 2019-04-26 中兴通讯股份有限公司 一种网络功能认证的方法、装置及计算机可读存储介质
US20200267214A1 (en) * 2017-11-27 2020-08-20 Telefonaktiebolaget Lm Ericsson (Publ) Status Updates in a 5G Core Network
CN111435932A (zh) * 2019-01-14 2020-07-21 华为技术有限公司 一种令牌处理方法及装置
CN111865598A (zh) * 2019-04-28 2020-10-30 华为技术有限公司 网络功能服务的身份校验方法及相关装置
CN111131242A (zh) * 2019-12-24 2020-05-08 北京格林威尔科技发展有限公司 一种权限控制方法、装置和系统

Also Published As

Publication number Publication date
CN116419229A (zh) 2023-07-11

Similar Documents

Publication Publication Date Title
TWI510108B (zh) 可信賴聯合身份管理及資料存取授權方法及裝置
EP3175597B1 (en) Apparatus and method for sharing a hardware security module interface in a collaborative network
CN109729523B (zh) 一种终端联网认证的方法和装置
US9197420B2 (en) Using information in a digital certificate to authenticate a network of a wireless access point
KR101563828B1 (ko) 신뢰성있는 인증 및 로그온을 위한 방법 및 장치
WO2016011778A1 (zh) 数据处理的方法和装置
US20040073801A1 (en) Methods and systems for flexible delegation
US20040117623A1 (en) Methods and apparatus for secure data communication links
EP2879421B1 (en) Terminal identity verification and service authentication method, system, and terminal
WO2017185450A1 (zh) 终端的认证方法及系统
Dewanta et al. A mutual authentication scheme for secure fog computing service handover in vehicular network environment
CN104767740A (zh) 用于来自用户平台的可信认证和接入的方法
KR101482938B1 (ko) 인증 메시지 보안 방법, 이를 수행하는 인증 메시지 보안 서버 및 사용자 단말
WO2023130885A1 (zh) 集成可信度量的通信方法
JP2017139026A (ja) 信頼できる認証およびログオンのための方法および装置
CN106576245B (zh) 用户设备邻近请求认证
JP2015111440A (ja) 信頼できる認証およびログオンのための方法および装置
RU2282311C2 (ru) Использование пары открытых ключей в оконечном устройстве для аутентификации и авторизации пользователя телекоммуникационной сети по отношению к сетевому провайдеру и деловым партнерам
Chang et al. Secure intra-device communication protocol between applications on a smart device
Jindal Authentication and Data Security Protocol for Distributed Cloud Architecture
Azizul et al. Authentication and Authorization Design in Honeybee Computing
Yan et al. Achieving secure and convenient WLAN sharing in personal
CN113285805A (zh) 一种通信方法及装置
Rad et al. A secure protocol for traffic police mobile communication system
Mukhtar et al. Improved trust based key management for end-to-end secure communication in cellular networks

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22918335

Country of ref document: EP

Kind code of ref document: A1