WO2023213226A1 - 一种授权的方法和装置 - Google Patents

一种授权的方法和装置 Download PDF

Info

Publication number
WO2023213226A1
WO2023213226A1 PCT/CN2023/091313 CN2023091313W WO2023213226A1 WO 2023213226 A1 WO2023213226 A1 WO 2023213226A1 CN 2023091313 W CN2023091313 W CN 2023091313W WO 2023213226 A1 WO2023213226 A1 WO 2023213226A1
Authority
WO
WIPO (PCT)
Prior art keywords
network
data
user
network element
identification information
Prior art date
Application number
PCT/CN2023/091313
Other languages
English (en)
French (fr)
Inventor
胡力
吴�荣
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2023213226A1 publication Critical patent/WO2023213226A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/088—Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H04L9/3228—One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication

Definitions

  • the present application relates to the field of communication technology, and more specifically to an authorization method and device.
  • a data controller such as a company
  • the data controller needs to obtain the user's express consent for the purpose of data processing before processing personal information.
  • the purpose of processing the user's location information by the data controller with the user's consent is to provide location-based service quality improvement services
  • the user's location information collected by the data controller cannot be used for other purposes (such as location-based advertising). services), unless the user's consent for this other purpose is obtained.
  • the field of communications technology is considering technicalizing regulations that require user consent before processing user data. For example, before a network processes user data for a certain purpose, it should obtain the user's consent to process user data for that purpose. That is, the network can obtain authorization to process the user's data based on the user's consent to processing the user's data for that purpose. This authorization method does not consider how to authorize the processing of user data in cross-network scenarios.
  • This application provides an authorization method to authorize the processing of user data in cross-network scenarios.
  • this application provides an authorization method.
  • the method includes: the authorization verification network element receives a request message from the data using network element for triggering the processing of user data; the authorization verification network element obtains the request message from the data management network element.
  • the purpose of data processing is used to indicate the purpose of processing the user's data.
  • the user consent result is used to indicate whether the user agrees to be based on the data.
  • the processing purpose is to process the user data, in which the data management network element and the authorization verification network element are not in the same network, or the data management network element and the data usage network element are not in the same network; the authorization verification network element is based on the network element.
  • the identification information determines whether the user data is authorized to be processed.
  • the authorization verification network element receives a request that triggers the processing of user data. After receiving the message, it is determined whether the processing of the user data is authorized based on the identification information of the network that the user allows to process the user data. This achieves authorization for processing user data in cross-network scenarios.
  • the authorization verification network element determines whether the user data is authorized to be processed based on the identification information of the network. The authorization verification network element determines whether the request message comes from the network based on the identification information of the network.
  • the network indicated by the network's identification information if the request message comes from the network indicated by the network's identification information, the authorization verification network element determines whether to authorize the processing of the user data based on the user's consent result; if the request message does not come from The network identification information indicates that the authorized school The verification network element is not authorized to process the user data.
  • the authorization verification network element further determines whether to authorize the processing of user data based on the user consent result; If the request message does not come from the network indicated by the identification information of the network, it means that the network from which the request message originates is not allowed to process user data, then the authorization verification network element directly does not authorize the processing of user data, and no further judgment is required. In this way, the efficiency of authorization verification of network element authorization is improved, and at the same time, security risks caused by unauthorized network processing of user data are avoided.
  • the authorization verification network element determines whether the request message comes from the network indicated by the identification information of the network based on the identification information of the network, including: if the authorization verification network element belongs to the identification information of the network The authorization verification network element determines that the request message comes from the network indicated by the identification information of the network; if the authorization verification network element does not belong to the network indicated by the identification information of the network, the authorization verification network element determines that the request message comes from the network indicated by the identification information of the network. The network element determines that the request message does not come from the network indicated by the identification information of the network.
  • the authorization verification network element determines whether the request message comes from the network indicated by the identification information of the network by determining whether it belongs to the network indicated by the identification information of the network.
  • the data usage network element and the authorization verification network element are located on the same network.
  • the method further includes: the authorization verification network element obtains the identity of the network where the data usage network element is located; then the authorization verification network element determines whether the request message comes from the network element based on the identity information of the network.
  • the network indicated by the identification information of the network includes: if it is determined based on the identification of the network where the data using network element is located that the data using network element belongs to the network indicated by the identification information of the network, then the authorization verification network element determines that the request message comes from to the network indicated by the identification information of the network; if it is determined based on the identification of the network where the data using network element is located that the data using network element does not belong to the network indicated by the identification information of the network, then the authorization verification network element determines that the request message is not The network indicated by the identification information from this network.
  • the authorization verification network element uses the obtained data to determine whether the request message comes from the network indicated by the identification information of the network using the identity of the network where the network element is located.
  • the request message includes an identifier of the network where the data usage network element is located. That is to say, the authorization verification network element can obtain the identity of the network where the data usage network element is located through the request message.
  • the authorization verification network element is not authorized to process the user data including: the authorization verification network element sends a rejection message to the data usage network element, the rejection message includes a rejection reason value, and the rejection reason The value is used to indicate that the data using network element is not from a network that the user is allowed to process the user's data.
  • the authorization verification network element indicates to the data using network element that the reason for the failure is that the data using network element is not from a network that the user is allowed to process user data, making subsequent data use
  • the network element learns the reason for rejection and stops triggering processing of the user data. In this way, subsequent data usage network elements can no longer trigger the processing of the user data based on the reason for rejection, avoiding unnecessary signaling interactions and improving the efficiency of network service provision.
  • the authorization verification network element is not authorized to process the user data, including: the authorization verification network element records an event that the user data is not authorized to be processed. In this way, the authorization verification network element records unauthorized events without authorization to process user data.
  • the method further includes: the authorization verification network element requests the user data from the data providing network element; the authorization verification network element receives the user data from the data providing network element. In this way, the verification network element is authorized to process user data.
  • the authorization verification network element obtains the identification information of the network, the data processing purpose, and the user consent result from the data management network element, including: the authorization verification network element reports to the data management network element
  • the network element requests user contract data; the authorization verification network element receives the user contract data from the data management network element.
  • the user contract data includes the identification information of the network, the purpose of data processing and the user consent result.
  • the authorization verification network element can obtain the identification information of the network, the purpose of data processing, and the user's consent result in the user's contract data.
  • the identification information of the network is the identification ID of the public land mobile network PLMN.
  • this application provides an authorization method.
  • the method includes: the data management network element receives the identification information of the user from the authorization verification network element and the identification information of the first network, and the identification information of the first network is used for Identify the network that processes the user's data, where the network where the data management network element is located is not the same network as the network that processes the user's data; the data management network element is based on the identification information of the first network and the second network.
  • the identification information of the second network is used to determine the first user consent result, the identification information of the second network is used to identify the network that the user allows to process the user's data, and the first user consent result indicates whether the user agrees in the first network based on
  • the first data processing purpose is to process the user's data; the data management network element sends the first user consent result to the authorization verification network element.
  • the authorization verification network element can determine whether to process user data based on the first user's consent result, thereby realizing authorization to process user data in a cross-network scenario.
  • the data management network element determines the first user consent result based on the identification information of the first network and the identification information of the second network: if the identification information of the second network includes the identification information of the first network, the data management network element determines that one or more data processing purposes corresponding to the identification information of the first network is the first data processing purpose, and determines the user corresponding to the one or more data processing purposes.
  • the consent result is the first user's consent result; if the identification information of the second network does not include the identification information of the first network, the data management network element determines that the data processing purpose corresponding to the identification information of the second network is the third network's identification information. A purpose of data processing, and it is determined that the first user agrees and the result is no consent.
  • the data management network element determines the data processing purpose and the corresponding data processing purpose of the first network.
  • User consent result when it is determined that the identification information of the second network does not contain the identification information of the first network, which means that the user does not allow the first network to process user data, the data management network element determines that the first user consent result is disagreement. In this way, subsequent authorization verification network elements are not authorized to process user data based on the consent result of the first user who disagrees, thus avoiding security risks caused by unauthorized network processing of user data.
  • the data management network element sending the first user consent result to the authorization verification network element includes: the data management network element sending the first data processing purpose and the authorization verification network element to the authorization verification network element. The first user agrees with the result.
  • the data management network element receiving the identification information of the user and the identification information of the first network from the authorization verification network element includes: the data management network element receiving the identification information from the authorization verification network
  • the message includes the identification information of the user, the identification information of the first network and the first data processing purpose; then the data management network element shall use the identification information of the first network and the identification information of the second network to ,
  • determining the first user consent result includes: if the identification information of the second network includes the identification information of the first network, the data management network element determines that the The user consent result corresponding to the first data processing purpose is the first user consent result; if the identification information of the second network does not include the identification information of the first network, the data management network element determines that the first user consent result is disagree.
  • the authorization verification network element also provides the first data processing purpose to the data management network element.
  • the data management network element needs to consider that the first user consent result corresponds to the first user consent result. Data Processing Purposes. And when the identification information of the second network does not include the identification information of the first network, the consent result of the first user is determined to be disagreement, thereby avoiding security risks caused by the unauthorized network processing of user data.
  • the method further includes: the data management network element sending identification information of the network used to determine whether the network is authorized to process the user's data to the authorization verification network element. That is to say, the authorization verification network element can also obtain the identification information of the network used to determine whether the user's data is authorized to be processed from the data management network element, so as to determine whether the user data is authorized to be processed based on the identification information of the network, thereby achieving Dual authorization is provided to ensure the accuracy of authorization.
  • the identification information of the second network is the identification ID of the public land mobile network PLMN that the user is allowed to process the user's data.
  • the identification information of the first network is the identification ID of the public land mobile network PLMN where the authorization verification network element is located or the public land mobile network PLMN where the network element that triggers processing of the first data is located.
  • the identification ID is the identification ID of the public land mobile network PLMN where the authorization verification network element is located or the public land mobile network PLMN where the network element that triggers processing of the first data is located.
  • this application provides an authorization method.
  • the method includes: the data management network element receives a message from the authorization verification network element requesting the user's contract data, wherein the data management network element and the authorization verification network element Not in the same network; the data management network element sends the user's contract data to the authorization verification network element.
  • the user's contract data includes the identification information of the network that the user allows to process the user's data, the purpose of data processing, and the user's consent result.
  • the data processing purpose is used to indicate the purpose of processing the user data
  • the user consent result is used to indicate whether the user agrees to the processing of the user data based on the data processing purpose.
  • the user's subscription data includes the identification information of the network that the user allows to process user data, so that the authorization verification network element Networks requesting processing of user data can be authorized based on the network's identification information. This achieves authorization for processing user data in cross-network scenarios.
  • this application provides an authorization method.
  • the method includes: the authorization verification network element receives a request message from the data using network element for triggering the processing of the user's data; the authorization verification network element sends a request message to the data management network The element sends the identification information of the user and the identification information of the first network.
  • the identification information of the first network is used to identify the network that processes the user's data, wherein the network where the data management network element is located is the same as the network that processes the user's data.
  • the networks are not the same network; the authorization verification network element receives the first user consent result from the data management network element, and the first user consent result indicates whether the user in the first network agrees to the first data processing purpose.
  • the authorization verification network element determines whether the user's data is authorized to be processed based on the first user's consent result.
  • the authorization verification network element receives the first user consent result from the data management network element, and The first user consent result is directed to whether the user agrees to process the user's data based on the first data processing purpose in the first network.
  • the authorization verification network element determines whether the user data is authorized to be processed based on the first user consent result. This achieves authorization for processing user data in cross-network scenarios.
  • the first network does not belong to a network where the user is allowed to process the user's data
  • the first user consent result indicates that the user does not agree to process the user's data in the first network.
  • the authorization verification network element concludes the agreement based on the consent of the first user who does not agree. As a result, it is determined that the processing of user data is not allowed, thus avoiding the security risks caused by the unauthorized network processing of user data.
  • the authorization verification network element receiving the first user consent result from the data management network element includes: the authorization verification network element receiving the first user consent from the data management network element. results and the first data processing purpose.
  • the authorization verification network element sending the user's identification information and the identification information of the first network to the data management network element includes: the authorization verification network element sending a message to the data management network element , the message includes the identification information of the user, the first data processing purpose and the identification information of the first network.
  • embodiments of the present application provide a communication device, which may be an authorization verification network element or a module (such as a chip) applied in an authorization verification network element.
  • the device has the function of implementing any implementation method of the above-mentioned first aspect or fourth aspect. This function can be implemented by hardware, or it can be implemented by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the above functions.
  • embodiments of the present application provide a communication device, which may be a data management network element or a module (such as a chip) applied in the data management network element.
  • the device has the function of realizing any implementation method of the above second aspect or third aspect. This function can be implemented by hardware, or it can be implemented by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the above functions.
  • embodiments of the present application provide a communication device, including a processor coupled to a memory.
  • the processor is configured to call a program stored in the memory to execute any implementation method in the first to fourth aspects.
  • the memory may be located within the device or external to the device.
  • the processor can be one or more.
  • embodiments of the present application provide a communication device, including a processor and a memory; the memory is used to store computer instructions, and when the device is running, the processor executes the computer instructions stored in the memory, so that the device executes Any implementation method in the above first to fourth aspects.
  • embodiments of the present application provide a communication device, including units or means for executing each step of any implementation method in the above first to fourth aspects.
  • embodiments of the present application provide a communication device, including a processor and an interface circuit.
  • the processor is configured to communicate with other devices through the interface circuit and execute any implementation method in the above first to fourth aspects.
  • the processor includes one or more.
  • embodiments of the present application further provide a chip system, including: a processor configured to execute any implementation method in the above first to fourth aspects.
  • embodiments of the present application further provide a computer-readable storage medium that stores instructions that, when run on a communication device, enable the above-described first to fourth aspects. Any implementation method is executed.
  • embodiments of the present application further provide a computer program product.
  • the computer program product includes a computer program or instructions.
  • the computer program or instructions are run by a communication device, any one of the above-mentioned first to fourth aspects is enabled.
  • the implementation method is executed.
  • an embodiment of the present application provides a communication system, including a communication device that performs any implementation method in the first aspect and a communication device that performs any implementation method in the third aspect.
  • a communication device that performs any implementation method in the first aspect
  • a communication device that performs any implementation method in the third aspect.
  • other communication devices that communicate with the above devices are also included, such as data usage network elements, base stations, or user equipment.
  • an embodiment of the present application provides a communication system, including a communication device that performs any implementation method in the second aspect and a communication device that performs any implementation method in the fourth aspect.
  • a communication device that performs any implementation method in the second aspect
  • a communication device that performs any implementation method in the fourth aspect.
  • other communication devices that communicate with the above devices are also included, such as data usage network elements, base stations, or user equipment.
  • Figure 1 is a schematic diagram of a 5G network architecture provided by an embodiment of this application.
  • FIG. 2 is a schematic diagram of another 5G network architecture provided by an embodiment of this application.
  • Figure 3 is a schematic flowchart of a method for authorizing processing of user data provided by an embodiment of the present application
  • Figure 4 is a schematic flowchart of another method for authorizing processing of user data provided by an embodiment of the present application.
  • Figure 5 is a schematic flowchart of yet another method for authorizing processing of user data provided by an embodiment of the present application
  • Figure 6 is a schematic flowchart of yet another method for authorizing processing of user data provided by an embodiment of the present application.
  • Figure 7 is a schematic flowchart of yet another method for authorizing processing of user data provided by an embodiment of the present application.
  • Figure 8 is a schematic flowchart of yet another method for authorizing processing of user data provided by an embodiment of the present application.
  • Figure 9 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • Figure 10 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • A/B can mean A or B; “and/or” in this application is just an “or” relationship. Describes the association of associated objects, indicating that there can be three relationships.
  • a and/or B can represent: A exists alone, A and B exist simultaneously, and B exists alone.
  • a and B can be singular or singular respectively. plural.
  • plural means two or more than two.
  • One or more” or similar expressions refer to any combination of these items, including any combination of single items (items) or plural items (items).
  • a, b or c can mean: a, b, c, a-b, a-c, b-c, or a-b-c, where a, b, and c can be single or multiple respectively.
  • words such as “first” and “second” are used in this application to distinguish the same or similar items with basically the same functions and effects. Those skilled in the art can understand that words such as “first” and “second” do not limit the number and execution order, and words such as “first” and “second” do not limit the number and execution order.
  • the technical solution of this application can be applied to various communication systems, such as fifth generation (5th generation, 5G) mobile communication systems, new radio (NR) systems, home base station networks, non-3GPP such as wireless fidelity (wireless fidelity) , WIFI) accessed mobile network, fixed mobile convergence (FMC) network or future 6G network, etc.; for example, it can be applied to standalone non-public network (SNPN), public land mobile network ( public land mobile network, PLMN) integrated non-public network (PLMN-intergrated non-public-network, PNI-NPN), or networks built by enterprises and universities themselves, etc.
  • 5G fifth generation
  • 5G fifth generation
  • NR new radio
  • NR new radio
  • non-3GPP such as wireless fidelity (wireless fidelity) , WIFI) accessed mobile network
  • FMC fixed mobile convergence
  • SNPN standalone non-public network
  • PLMN public land mobile network
  • PLMN public land mobile network
  • PLMN-intergrated non-public-network PNI-
  • User equipment is a device with wireless transceiver functions. User equipment can communicate with the core network or the Internet via a radio access network (eg, radio access network, RAN), exchanging voice and/or data with the RAN.
  • a radio access network eg, radio access network, RAN
  • the user equipment in this application can also be called a terminal equipment, for example, it can be a wireless terminal equipment, a mobile terminal equipment, a device-to-device (D2D) terminal equipment, a vehicle to everything (V2X) terminal Devices, machine-to-machine/machine-type communications, M2M/MTC) terminal equipment, Internet of things (IoT) terminal equipment, subscriber unit (subscriber unit), subscriber station (subscriber station), mobile station (mobile station), remote station (remote station), access point (access point, AP), remote terminal (remote terminal), access terminal (access terminal), user terminal (user terminal), user agent (user agent) or user device (user device), etc.
  • IoT Internet of things
  • the user equipment in this application can be a mobile phone, a tablet computer, a computer with wireless transceiver functions, a portable, pocket-sized, handheld, a mobile device built into a computer, etc.; for another example, it can also be a virtual reality (VR) device.
  • terminal equipment augmented reality (AR) terminal equipment, wireless terminals in industrial control, wireless terminals in self-driving, wireless terminals in remote medical surgery, Wireless terminals in smart grid, wireless terminals in transportation safety, wireless terminals in smart city, wireless terminals in smart home, and future evolution of public land mobile Terminal equipment in the communication network (public land mobile network, PLMN), or vehicle equipment in V2X, customer premises equipment (customer premises equipment, CPE), etc.
  • PLMN public land mobile network
  • CPE customer premises equipment
  • the terminal device can also be a personal communication service (PCS) phone, a cordless phone, a session initiation protocol (SIP) phone, a wireless local loop (WLL) station, a personal digital phone Assistant (personal digital assistant, PDA) and other equipment.
  • PCS personal communication service
  • SIP session initiation protocol
  • WLL wireless local loop
  • PDA personal digital assistant
  • the user device in this application may also be a wearable device.
  • Wearable devices can also be called wearable smart devices or smart wearable devices. It is a general term for applying wearable technology to intelligently design daily wear and develop wearable devices, such as glasses, gloves, watches, clothing and shoes. wait.
  • a wearable device is a portable device that is worn directly on the body or integrated into the user's clothing or accessories. Wearable devices are not just hardware devices, but also achieve powerful functions through software support, data interaction, and cloud interaction. Generalized wearable smart devices can realize complete or partial functions without relying on smartphones, such as smart watches or smart glasses. They can also focus on a certain type of application function and be used in conjunction with other devices such as smartphones, such as various types of physical signs.
  • the various devices introduced above can be considered as vehicle-mounted terminal equipment if they are located on the vehicle (for example, placed in the vehicle or installed in the vehicle).
  • the vehicle-mounted terminal equipment is also called an on-board unit (OBU), for example. .
  • OBU on-board unit
  • Wireless access network equipment is a device used in the communication system to access the UE to the wireless network.
  • Wireless access network equipment can generally be connected to the core network through wired links (such as fiber optic cables).
  • the radio access network equipment can be a node in the RAN, and can also be called a base station, or a RAN node (or device).
  • Wireless access network equipment may include base stations, LTE systems or evolved base stations (evolved NodeB, eNodeB) in LTE systems (LTE-Advanced, LTE-A), next generation base stations (next generation NodeB, gNB), transmission reception point (TRP), base band unit (BBU), access point (AP) in wireless local area networks (WLAN), access backhaul Integrated access and backhaul (IAB) nodes, base stations in future mobile communication systems or access nodes in WiFi systems, etc.
  • the wireless access network equipment can also be a module or unit that completes some functions of the base station, such as a centralized unit (central unit, CU) or a distributed unit (distributed unit, DU).
  • the radio access network device may be a CU node, a DU node, or a radio access network device including a CU node and a DU node.
  • the CU node is used to support protocols such as radio resource control (RRC), packet data convergence protocol (PDCP), service data adaptation protocol (SDAP), etc.
  • the DU node uses To support wireless link control Control (radio link control, RLC) layer protocol, media access control (medium access control, MAC) layer protocol and physical layer protocol.
  • Wireless access network equipment and user equipment can be deployed on land, indoors or outdoors, handheld or vehicle-mounted; they can also be deployed on water; they can also be deployed on aircraft, balloons and satellites in the sky.
  • the embodiments of this application do not limit the application scenarios of wireless access network equipment and user equipment.
  • the wireless access network equipment may be referred to as the access network equipment.
  • the access network equipment in the following refers to the wireless access network equipment.
  • Core network equipment refers to equipment in the core network (CN) that provides business support for user equipment.
  • the 5G core network equipment includes access and mobility management function (AMF), session management function, SMF), policy control function (PCF), network slice selection function (NSSF), authentication server function (AUSF), unified data management function (UDM) , user plane function (UPF), network exposure function (NEF) (not shown in the figure), network data analytics function (NWDAF) (not shown in the figure) , application function (AF) and other network elements.
  • AMF access and mobility management function
  • SMF session management function
  • PCF policy control function
  • NSSF network slice selection function
  • AUSF authentication server function
  • UDM unified data management function
  • UPF user plane function
  • NEF network exposure function
  • NWDAAF network data analytics function
  • AF application function
  • the AMF network element (hereinafter referred to as AMF) is mainly responsible for mobility management, access management and other services.
  • the SMF network element (hereinafter referred to as SMF) is mainly responsible for session management, user equipment address management and allocation, dynamic host configuration protocol functions, user plane function selection and control, etc.
  • the PCF network element (hereinafter referred to as PCF) is mainly responsible for providing a unified policy framework for network behavior management, providing policy rules for control plane functions, and obtaining registration information related to policy decisions.
  • NSSF network elements are mainly responsible for selecting a set of network slicing instances that serve user equipment.
  • the AUSF network element is mainly responsible for the authentication function of user equipment.
  • NSSAAF network elements mainly support authentication and authorization of network slicing.
  • the UDM network element (hereinafter referred to as UDM) is mainly responsible for storing the subscription data, credential and persistent identity (subscriber permanent identifier, SUPI) of the subscriber equipment in the network.
  • the UPF network element (hereinafter referred to as UPF) is mainly responsible for external connection to the data network (DN) and user plane data packet routing and forwarding, message filtering, and execution of quality of service (QoS) control related functions.
  • NEF network element (hereinafter referred to as NEF) is mainly responsible for opening network capabilities and events, obtaining external application information from AF, and storing information for external opening in the user database (user data repository, UDR).
  • NWDAF is mainly used to analyze various network data.
  • Network data includes network operation data collected from network function (NF) or application data obtained from third-party AF.
  • the analysis results generated by NWDAF will also be output to NF and third-party AF.
  • the AF network element (hereinafter referred to as AF) is mainly responsible for providing services to the 3GPP network, such as affecting service routing and interacting with PCF network elements for policy control.
  • Network elements can communicate with each other through the next generation network (NG) interface.
  • N1 is the interface between the AMF and the UE, which is used to transmit QoS control rules to the UE.
  • N2 is the interface between AMF and RAN, and is used to transmit wireless bearer control information from the core network side to the RAN.
  • N3 is the interface between RAN and UPF and is used to transmit user plane data between RAN and UPF.
  • N4 is the interface between SMF and UPF. It is used to transfer information between the control plane and the user plane, including controlling the distribution of forwarding rules, QoS control rules, traffic statistics rules, etc. for the user plane, and reporting user plane information.
  • N5 is the interface between AF and PCF, which is used to deliver application service requests and report network events.
  • N6 is the interface between UPF and DN, and is used to transmit user plane data between UPF and DN.
  • N7 is the interface between PCF and SMF, used to deliver protocol data unit (PDU) session granularity And business data flow granularity control strategy.
  • N8 is the interface between AMF and UDM, which is used by AMF to obtain access and mobility management-related subscription data and authentication data from UDM, and for AMF to register UE's current mobility management-related information with UDM.
  • N10 is the interface between SMF and UDM. It is used by SMF to obtain session management-related subscription data from UDM, and by SMF to register UE current session-related information with UDM.
  • N11 is the interface between SMF and AMF and is used to transfer PDU session tunnel information between RAN and UPF, transfer control messages sent to UE, transfer radio resource control information sent to RAN, etc.
  • There may be a southbound interface between NEF and other NFs (not shown in the figure), for example, the N29 interface between NEF and SMF, and the N30 interface between NEF and PCF.
  • FIG. 2 it is a schematic diagram of another 5G communication system applicable to the embodiment of the present application.
  • each network element can use service-oriented interfaces to communicate with each other.
  • the service-oriented interface provided by AUSF to the outside world can be Nausf
  • the service-oriented interface provided by AMF to the outside world can be Namf
  • the service-oriented interface provided by SMF to the outside world can be It is Nsmf
  • the service interface provided by NSSF to the outside world can be Nnssf
  • the service interface provided by NEF to the outside world can be Nnef
  • the service interface provided by NRF to the outside world can be Nnrf
  • the service interface provided by PCF to the outside world can be Npcf
  • the service interface provided by UDM to the outside world can be Nsmf.
  • the service interface provided by AF can be Nudm
  • the service interface provided by AF can be Naf
  • the service interface provided by NWDAF can be Nnwdaf.
  • the above network elements can be called functional units or functional entities. They can be network elements in hardware devices, software functions running on dedicated hardware, or instantiated on a platform (for example, a cloud platform). virtualization capabilities.
  • the above functional unit may be implemented by one device, or may be implemented by multiple devices, or may be different functional modules within one device, which is not limited in the embodiments of the present application.
  • the user in the embodiment of this application may be an individual or other entity that signs a contract with the network and uses the network connection to implement communication.
  • the user equipment may be the equipment used by the user.
  • the data generated by the user by using the user equipment can be It is called user data, or it can also be called user device data. It is understood that whether it is the data of the user or the data of the user's device, the data belongs to the user.
  • Figure 3 is a schematic flowchart of a method for authorizing operation (or processing) of user data provided by an embodiment of the present application. The method includes the following steps:
  • NF network function
  • NF consumer can be, for example, AF, or PCF, a network element that requests analysis data.
  • the analytics subscription request message may include user identification information such as user permanent identifier (subscription permanent identifier, SUPI) and analytics ID.
  • user identification information such as user permanent identifier (subscription permanent identifier, SUPI) and analytics ID.
  • the Analytics ID can indicate the current analysis type, such as UE mobility analysis (UE mobility analysis), or UE communication analysis (UE communication analysis), etc.
  • the mobility analysis of the UE is used for statistics and prediction of the mobility characteristics of the UE, such as analyzing the location of the UE at a certain time, analyzing the possible movement trajectory of the UE, and at least one of the following.
  • the communication analysis of the UE is used for statistics and prediction of the communication characteristics of the UE, such as analyzing the traffic characteristics of the UE at a certain time, including at least one of flow speed, traffic size, etc.
  • the analysis subscription request message is used to request analysis of data, that is to say, the message sent in step S101 can indicate the purpose of processing, for example, data analysis.
  • the analysis subscription request message is the Nnwdaf_AnalyticsSubscription_Subscribe Request message.
  • Analytics ID is used to indicate the specific type of data analysis. For example, when the Analytics ID is UE mobility Analytics or UE communication Analytics When analyzing user data. When the Analytics ID is the network function load information NF load information, the network data is analyzed and user data is not involved.
  • the name of the analysis subscription request message indicates that the user data processing purpose corresponding to the message is data analysis.
  • the NF consumer sending an analysis subscription request message to NWDAF can also be understood as calling NWDAF's analysis subscription service.
  • NWDAF can determine whether it is necessary to verify user consent for this call based on local policies.
  • the local policy may include: If this call does not involve the operation of the user's data (for example, it involves the operation of network data), then no verification is required and steps S103-S105 are skipped; if it involves the operation of the user's data Operation requires verification. If it involves an operation on the user's data and the locally saved context of NWDAF contains user consent information, verification will be performed directly based on the locally saved user consent information and steps S103-S105 will be skipped. If it involves an operation on the user's data and If the user consent information is not saved locally in NWDAF, steps S103-S105 will continue to be executed.
  • User consent information can include the purpose of data processing and the results of user consent.
  • the purpose of data processing is used to indicate the purpose of operating user data, such as data analysis or data model training.
  • the user consent result is used to indicate whether the user agrees to operate the user data based on the purpose of data use. For example, 1 represents agreement and 0 represents disagreement.
  • the purpose of data processing is data analysis, it means that the user's data will be collected for analysis and analysis results will be obtained, such as at least one of the above-mentioned UE mobility analysis, UE communication analysis, etc.
  • the purpose of data processing is data model training, it means that the user's data will be collected for machine learning model training to obtain a machine learning model.
  • S103 NWDAF sends a subscription data acquisition request message to UDM.
  • UDM receives the subscription data acquisition request message from NWDAF.
  • the subscription data acquisition request message may be a Nudm_SDM_Get Request message, which is used to obtain the user's subscription data.
  • the subscription data acquisition request message may include the user identifier SUPI, and optionally may also include a subscription type.
  • the subscription type is used to indicate the type of subscription data, for example, indicating that the type of subscription data is access and mobility subscription data. subscription data), SMF selection subscription data, SMF management subscription data, or user consent-related subscription data.
  • the contract type here may be a contract type indicating the user's consent.
  • UDM obtains the user's contract data based on the user identifier SUPI, and the contract data includes user consent information.
  • UDM obtains the user consent information based on the user identifier SUPI.
  • UDM sends contract data to NWDAF, and accordingly, NWDAF receives the contract data from UDM.
  • UDM sends a Nudm_SDM_Get Response message to NWDAF.
  • the message may include the user's subscription data, and the subscription data includes the user's consent information.
  • S106 NWDAF determines whether to authorize the data operation corresponding to the analysis subscription request message.
  • NWDAF determines whether to authorize the data operation corresponding to the analysis subscription request message based on the data processing purpose in the Nnwdaf_AnalyticsSubscription_SubscribeRequest message, the user consent information, and the user consent result message. For example, NWDAF determines based on the Nnwdaf_AnalyticsSubscription_Subscribe Request message that the data processing purpose corresponding to the message is data analysis, and further obtains the user consent result corresponding to the data analysis. If the result is consent, it is authorized to analyze the data analysis corresponding to the subscription request message. If the result is disagreement , then it will not be awarded Data analysis corresponding to the weight analysis subscription request message.
  • NWDAF sends an analysis subscription response message to NF consumer.
  • NF consumer receives the analysis subscription response message from NWDAF.
  • the analysis subscription response message can be the Nnwdaf_AnalyticsSubscription_Subscribe Response message.
  • the analysis subscription response message is used to indicate that the analysis subscription (for example, Nnwdaf_AnalyticsSubscription_Subscribe) request failed. If NWDAF authorizes the corresponding data operation based on the user consent result in S106, the analysis subscription response message is used to indicate that the analysis subscription request is successful. In the case where the data operation is authorized, S108 to S110 are executed.
  • NWDAF sends a user data request message to the NF provider (NF provider).
  • the NF provider receives the user data request message from NWDAF.
  • NF provider can be AMF, SMF and other network elements that provide data.
  • the user data request message may be an Nnf_EventExposure_Subscribe message, which is used to request to obtain user data of the terminal device.
  • the user data request message may contain the user identifier SUPI.
  • NF provider sends user data to NWDAF, and accordingly, NWDAF receives user data from NF provider.
  • the NF provider sends an Nnf_EventExposure_Notify message to NWDAF, which carries the user data requested by NWDAF.
  • the requested user data may be, for example, location data provided by AMF (such as tracking area identity (TAI), etc.), or communication data provided by SMF (such as communication interval, or communication rate), etc.
  • NWDAF analyzes the user data based on the collected user data according to the analysis requested by NF consumer, and obtains the analysis results.
  • the analysis result is the location statistics of the UE.
  • the location statistics information of the UE may include at least one of the location of the UE, the time the UE appears at this location, the time the UE stays at this location, and so on.
  • the analysis result is communication characteristic information.
  • the communication characteristic information of the UE may include at least one of whether the UE communicates periodically, communication interval, communication start time, communication end time, communication traffic size, communication flow rate, etc.
  • NWDAF sends an Nnwdaf_AnalysisSubscription_Notify message to the NF consumer, which contains the analysis results.
  • NWDAF and UDM are in the same public land mobile network (PLMN), and the scenario where NWDAF and UDM, or NF consumer and UDM are in different PLMNs, is not considered.
  • PLMN public land mobile network
  • Figure 4 is a method for authorizing processing of user data provided by this application. It should be noted that the processing of user data in the embodiments of this application may include any operations on user data, such as collection, recording, acquisition, construction, storage, update, analysis, compression, retrieval, sharing, and use. , or delete, etc.
  • the method shown in Figure 4 involves interactions between data usage network elements, authorization verification network elements, data management network elements and data providing network elements.
  • Data usage network elements can be understood as network elements that trigger the processing of user data.
  • the process shown in Figure 3 involves a data usage network element (NF consumer) requesting analysis of user data, which is triggering the analysis of user data.
  • Data usage network elements can also process user data.
  • the step for NF consumer to obtain user analysis results is to process user data.
  • the name "data usage network element" is just an example and does not impose any limitation on the functions or characteristics of the network element.
  • the data using network element may also be called a data requesting network element, a network function consumer, a service consuming network element, or a data user.
  • the data usage network element can be PCF, AF, etc.
  • the authorization verification network element can be understood as a network element that authorizes the processing of user data.
  • the process shown in Figure 3 involves NWDAF determining whether to authorize the data operation corresponding to the analysis subscription request message, that is, authorizing the processing of user data.
  • the authorization verification network element can also process user data.
  • the step in which NWDAF analyzes user data based on the collected user data is to process user data.
  • the name "authorization verification network element" is just an example and does not place any restrictions on the functions or characteristics of the network element.
  • the authorization verification network element can be NEF, NWDAF, Data Collection Coordination Function (DCCF), or edge enabler server (EES), etc.
  • the authorization verification network element and the data usage network element can be co-located in one device.
  • the data management network element can be understood as a network element used to save or manage relevant parameters agreed by the user, which can be UDM, UDR, or PCF, etc.
  • the data providing network element is used to provide user data, which can be AMF, SMF, or UPF, etc.
  • the data providing network element can be co-located with the authorization verification network element in one device.
  • the data management network element and the authorization verification network element can be located in different networks (such as different PLMNs or different slices), or the data management network element and the data using network elements can be located in different networks (such as different PLMNs or different slices). slices).
  • the method includes the following steps:
  • Pre-stored in the user's subscription data are identifiers of networks that the user allows to process user data (hereinafter referred to as allowed networks).
  • the allowed network means that the network can be authorized to process user data, that is, the allowed network is allowed by the user to control, use or save user data, and assumes the responsibility of user data protection.
  • the network may be authorized to process user data based on part or all of the data processing purposes contracted by the user, which is not limited by this application.
  • the allowed network may be of PLMN granularity, for example, the identifier of the allowed network may be, for example, a PLMN ID.
  • the allowed network may be slice granular, which is not limited by this application.
  • the identifier of the allowed network may be preconfigured by the administrator in the subscription data of the UE when the user opens an account, for example, based on the network accepted by the user in the contract signed with the operator.
  • the user's contract data can be stored in the data management network element, for example, at the UDM.
  • the data usage network element sends a data call request message to the authorization verification network element.
  • the authorization verification network element receives the data call request message from the data usage network element.
  • the data call request message is used to trigger processing of user data.
  • the data call request message contains user ID 01.
  • the data call request message may be triggered by a specific application programming interface (application programming interface, API).
  • the "01" in user ID 01 represents a type of user ID and is not used to limit the specific content of the user ID.
  • user ID 01 is used to identify the user, which can be SUPI or a general public subscription identifier (GPSI), etc., and is not limited by this application.
  • GPSI general public subscription identifier
  • the data call request message is used to indicate the purpose of processing user data by the data using network element, for example Collect, read, analyze, share, or model training, etc.
  • collecting user data can be an operation of obtaining user data from multiple devices or from one device at different times; reading user data can be an operation of obtaining user data and putting it locally/stored in other devices; analyzing user data It can be the operation of decomposing and integrating user data to draw conclusions; sharing user data can be the operation of providing user data to external devices; model training can be the operation of performing machine learning on user data to derive a training model.
  • the name of the data call request message can be used to reflect the purpose of processing user data.
  • Nnwdaf_AnalyticsSubscription_SubscribeRequest in Figure 3 is used to indicate that the purpose of processing user data is analysis.
  • the data call request message may include an operation instruction (or processing instruction) to indicate the purpose of processing the user data.
  • the data call request message can also carry Analytics ID. Analytics ID is used to indicate the specific type of data analysis, such as UE mobility analysis or UE communication analysis.
  • the data call request message may also include identification information of the network where the data using network element is located.
  • the identification information of the network where the data using network element is located is used to identify the network where the data using network element is located. For example, it may be a PLMN ID.
  • the identification information of the network where the data using network is located can be carried in the identification information of the data using network element, that is, the data call request message includes the identification of the data using network element, and the identification of the data using network element includes the identification of the network where the data using network element is located. Identification information.
  • the identification information of the data usage network element is NF ID
  • the NF ID may include PLMN ID.
  • the data call request message may include Nnef_Location and Nnef_UEIdentifier_Get.
  • the data call request message may include Nnwdaf_AnalyticsSubscription_Subscribe and other messages.
  • the data usage network element is the server of an online shopping platform
  • the service of the online shopping platform calls the API opened by the authorization verification network element NEF to request the UE identification.
  • the online shopping platform server initiates a Nnef_UEIdentifier_Get call request to NEF.
  • the online shopping platform server sets the user information in Nnef_UEIdentifier_Get to the IP address of a certain UE. This action represents the online shopping platform server's request to obtain the user corresponding to the IP address. identification information.
  • the data call message for calling NEF's API instructs the online shopping platform server to read the user's data (ie, identity information).
  • the data usage network element is PCF, and PCF calls the data analysis API provided by the authorized verification network element NWDAF, and instructs the analysis of the UE location.
  • PCF initiates a Nnwdaf_AnalyticsSubscription_Subscribe call request to NWDAF.
  • PCF sets the analytics ID in Nnwdaf_AnalyticsSubscription_Subscribe to UE mobility analytics, and the Target of Analytics Reporting is set to the SUPI of a certain UE, which is used to indicate that PCF requests NWDAF to analyze the UE's mobility data.
  • the data call message for calling the NWDAF API instructs PCF to analyze the user's data (ie, mobility data).
  • the authorization verification network element determines whether the user consent information of the UE is stored locally.
  • the user consent information of the UE is stored in the context of the authorization verification network element, the user consent information is obtained directly from the context without obtaining the user consent information from the data management network element.
  • the relevant description in S204 See the relevant description in S204.
  • S203-S204 is executed.
  • the authorization verification network element sends a contract data acquisition request message to the data management network element.
  • the data management network element receives the contract data acquisition request message from the authorization verification network element.
  • the subscription data acquisition request message is used to request the user's subscription data.
  • the subscription data acquisition request message may include user identification 02.
  • User ID 02 can be the same as user ID 01, or it can be the authorization verification network element based on User ID 01 is converted.
  • the authorization verification network element converts GPSI into SUPI, which is not limited by this application.
  • the subscription data acquisition request message may also include a subscription type, and the subscription type is a subscription type indicating the user's consent.
  • the subscription information acquisition request message can be a Nudm_SDM_Get Request message.
  • S204 The data management network element sends a contract data acquisition response message to the authorization verification network element.
  • the authorization verification network element accepts the contract data acquisition response message from the data management network element.
  • the contract data acquisition response message contains user consent information.
  • the subscription data acquisition response message can be a Nudm_SDM_Get Response message.
  • the data management network element obtains the user's contract data based on user identification 02, and the contract data includes user consent information.
  • the user consent information contains the purpose of the data processing, the results of the user consent, and also contains the identification of the permitted networks.
  • the purpose of data processing is used to indicate the purpose of processing user data, such as data analysis, data model training, data reading, or data sharing.
  • the user consent result is used to indicate whether the user agrees to the processing of data based on the data processing purpose. For example, 1 represents agreement and 0 represents disagreement. For a description of the identification of allowed networks, see S200.
  • user consent information is shown in Table 1:
  • the authorization verification network element saves the obtained user consent information as the context of the UE, and can provide the context of the UE to other authorization verification network elements.
  • the authorization verification network element determines whether the user data is authorized to be processed based on the user consent information.
  • the authorization checking network element determines whether the data call request message originates from a permitted network (that is, whether the data using network element belongs to a permitted network), thereby determining whether the user data is authorized to be processed (for example, the data using network element is authorized to processing of user data).
  • the authorized data uses network elements to process user data; when the data call request message does not come from a permitted network , or if the user does not agree to process the user data based on the data processing purpose of the data call request even though it comes from a permitted network, the data use network element is not authorized to process the user data.
  • the specific judgment of the authorization verification network element can be as follows:
  • the authorization verification network element determines whether it belongs to the allowed network. If it does, it further determines (A2). If it does not belong, the data is not authorized to use the network element to process user data.
  • the authorization verification network element determines in the user consent information whether the user consent result corresponding to the data processing purpose of the data call request is consent. If it is consent, the data is authorized to use the network element to process the user data; if not, then Data is not authorized to use network elements to process user data.
  • the authorization verification network element determines whether the network PLMN A in which it is located belongs to an allowed network. If it is determined to belong to the allowed network identification in Table 1, then further judgment is made (A2).
  • the authorization verification network element determines that the data processing purpose of the data call request is purpose #1 in the user consent information, and the corresponding user consent result is consent, then the data use network element is authorized to process the user data.
  • the authorization verification network element determines that the network PLMN C it is in does not belong to the allowed network, and does not authorize the network element to use the data to process the user. data.
  • the authorization verification network element can obtain the data processing purpose corresponding to the data call request through the name of the data call request message itself, or the operation instructions contained in the data call request message. For example, if the data call request message is Nnef_UEIdentifier_Get, the data processing purpose corresponding to the data call request is data reading; if the operation instruction is used to indicate that the operation on user data is analysis, the data processing purpose corresponding to the data call request is data analysis. .
  • the authorization verification network element can obtain the identification information of the network where the data usage network element is located in the data call request.
  • the network may use the PLMN where the network element is located for the data.
  • the authorization verification network element determines whether the data use network element belongs to the allowed network. If it does, further judge (B2). If it does not, the data use network element is not authorized to process user data.
  • the authorization verification network element determines in the user consent information whether the user consent result corresponding to the data processing purpose of the data call request is consent. If it is consent, the data is authorized to use the network element to process the user data; if not, then Data is not authorized to use network elements to process user data.
  • the authorization verification network element determines whether it belongs to a permitted network, thereby determining whether it is authorized to process user data (for example, whether it is authorized to process user data).
  • the authorization verification network element when the authorization verification network element itself belongs to a permitted network and the user agrees to process data based on the data processing purpose of the data call request, it authorizes itself to process user data; when the authorization verification network element itself does not belong to a network that the user is allowed to process user data , or if the user does not agree to process user data based on the data processing purpose of the data call request, it does not authorize itself to process user data.
  • the specific judgment of the authorization verification network element can be as follows:
  • the authorization verification network element determines whether it belongs to an allowed network. If it does, it further determines (C2). If it does not, it does not authorize itself to process user data.
  • the authorization verification network element determines whether the user consent result corresponding to the data processing purpose of the data call request is consent. If it is consent, it authorizes itself to process user data; if not, it does not authorize itself to process user data.
  • the authorization verification network element can determine whether it belongs to an allowed network and whether the data using network element belongs to an allowed network. If it belongs to both, determine the authorization to process user data. .
  • the order of judgment for authorization verification network elements is to first judge whether they belong to an allowed network. Then determine whether the user consent result is consent.
  • the scheme in which the authorization verification network element first determines whether the user consent result corresponding to the data processing purpose of the data call request is consent, and then determines whether the authorization verification network element and/or the data usage network element belongs to a permitted network is also included in Within the scope of the embodiments of the present application, the embodiments of the present application do not limit the order of judgment.
  • Authorization to process user data can be understood as authorization for the actions of relevant network elements that process user data, or authorization for data call requests, or authorization for the event of processing data. Its expression can be that the relevant network elements that process user data execute data call requests according to normal procedures. Relevant network elements that process user data may include authorization verification network elements and data usage network elements. The actions of related network elements that process user data may be, for example, the authorization verification network element obtains user data according to the data call request message, or uses the obtained user data for data analysis, or uses the obtained user data for model training, etc.; processing users The action of the data-related network element may also be, for example, the data using network element to obtain user data or data analysis results or model training results.
  • non-authorization to process user data can be understood as non-authorization of the actions of relevant network elements that process user data, or non-authorization of data call requests, or authorization of the event of processing data.
  • the manifestation may be that the relevant network elements that process user data fail to execute the data call request according to the normal process.
  • S206a may be initiated. If the processing of user data is not authorized, S206b can be initiated, that is, the authorization verification network element sends a message rejecting the data call request to the data using network element, or other non-authorization methods can be used. Or, if it is determined that the request is not authorized, for example, S206a is still initiated, that is, the data call request is authorized and the data request is initiated according to the data call request message, but the event that the request is unauthorized is recorded. This application does not limit this.
  • step S205 one of the following two processes is executed:
  • the authorization verification network element sends a data request message to the data providing network element according to the data call request message, which is used to request the user data 01 required by the data call request message.
  • S206b The authorization verification network element sends a message rejecting the data call request to the data using network element, which is used to reject the data call request message in S201.
  • the message rejecting the data call request may include a reason value indicating that the data using network element does not belong to a network that the user is allowed to process data.
  • the cause value may indicate an unauthorized network, or indicate that the data-using network element does not belong to an allowed network, etc.
  • the data providing network element provides the user data 01 to the authorization verification network element.
  • the authorization verification network element receives the user data 01 from the data provider.
  • user data 01 is the input data required to obtain user data 02.
  • user data 02 is the input data required to obtain user data 02.
  • the authorization verification network element provides the user data 02 to the data usage network element.
  • the data usage network element receives the user data 02 from the authorization verification network element.
  • user data 02 is the result of operating user data requested by the data call message request message.
  • the data uses the network element online shopping platform server to call the authorization verification network element NEF's open API for requesting the UE identifier.
  • the online shopping platform server calls NEF's Nnef_UEIdentifier_Get and sets the user information to the IP address of a certain UE.
  • both user data 01 and user data 02 can be the identification information of the user corresponding to the requested IP address.
  • the data usage network element PCF calls the API for data analysis provided by the authorized verification network element NWDAF, and provides analysis of the UE location. For example, calling NWDAF's Nnwdaf_AnalyticsSubscription_Subscribe for PCF, and setting the input analytics ID to UE mobility analytics, Target of Analytics Reporting is set to a SUPI of a UE), then user data 01 is the location information of the UE, and user data 02 is the analysis result obtained based on the location information of the UE.
  • S207 and S208 may be executed when it is determined in S205 that the user data is authorized to be processed, or when S206a is still performed although the user data is not authorized to be processed in S205.
  • the authorization verification network element Obtain the identifier of the allowed network from the data management network element, and verify whether the network element currently processing user data belongs to the network allowed by the user during the authorization process based on the identifier of the allowed network.
  • Authorization for processing user data can be achieved across scenarios.
  • the network where the data management network element is located stores user consent information and is a network that allows the processing of user data. If the authorization verification network element and the data usage network element are also located on the network where the data management network element is located, there is no need to verify the network where the authorization verification network element is located or the network where the data using network element is located. However, the embodiments of this application do not exclude the scenario where the authorization verification network element and the data usage network element are also located on the same network as the data management network element. That is, in this scenario, the authorization verification network element or the data usage network element can also be located on the same network as the data management network element. network for verification.
  • the authorization verification network element performs authorization according to the identifier of the allowed network, the accuracy of authorization is improved and the security risks caused by the unauthorized network processing user data are avoided.
  • the user consent information can be migrated between different authorization verification network elements as the context of the UE, thereby reducing the frequency of the authorization verification network element repeatedly requesting user consent information. Reduce the impact on data management network elements.
  • FIG. 5 is a schematic flowchart of the method.
  • the data management network element verifies whether the network currently processing user data is a network allowed by the user.
  • the method includes the following steps:
  • S300-S301 is the same as S200-S201 in Figure 4 and will not be described again.
  • the authorization verification network element determines whether the user consent information of the UE is stored locally.
  • the user consent information of the UE is stored in the context of the authorization verification network element, the user consent information is obtained directly from the context without obtaining the user consent information from the data management network element. Among them, the user consent information can be found in the relevant description in S304.
  • S303-S304 is executed.
  • the authorization verification network element sends a contract data acquisition request message to the data management network element.
  • the data management network element accepts the contract data acquisition request message from the authorization verification network element.
  • the subscription data acquisition request message is used to request the user's subscription data.
  • the subscription data acquisition request message may include the user identification 02 and the identification of the network that processes the user data.
  • the user ID 02 can be the same as the user ID 01, or it can be converted by the authorization verification network element based on the user ID 01.
  • the authorization verification network element converts GPSI into SUPI, which is not limited by this application.
  • the identifier of the network that processes user data is used to identify the network where the network element that processes user data is located. For example, it can be the identifier of the network where the authorization verification network element is located, or it can be the identifier of the network where the data using network element is located.
  • the subscription data acquisition request message may also include a subscription type, and the subscription type is a subscription type indicating the user's consent.
  • the contract data acquisition request message may also include indication information of the data processing purpose.
  • the indication information is used to indicate the purpose of processing the data, and may also be understood to be used to indicate the data processing purpose corresponding to the data call request message in S301.
  • the instruction information may specifically be an operation instruction included in the data call request message, or an authorized calibration
  • the verification network element generates new information based on the data call request message. For example, both the new information and the operation instructions can indicate the analysis of the data, but the forms of the two can be different.
  • the data call request message includes operation instruction #1
  • the instruction information of the data processing purpose may also be operation instruction #1
  • the instruction information of the data processing purpose may also be a character string #1
  • the character string #1 indicates the data processing purpose indicated by the operation instruction #1.
  • the network where the data management network element is located and the network where user data is processed may not be the same network (for example, they may not be the same PLMN or slice).
  • the authorization verification network element can obtain the identity of the network where the authorization verification network element is located from its own context. If the identity of the network that processes user data is the identity of the network where the data using network element is located, the authorization verification network element can obtain the identity of the network where the data using network element is located from the message interacting with the data using network element. For example, the authorization verification network element can obtain the identity of the network where the data usage network element is located from S301.
  • the identity of the network where the authorization verification network element is located is the ID of the PLMN where the authorization verification network element is located.
  • the ID of the PLMN where the authorization verification network element is located can be included in the identity of the authorization verification network element, that is, contract data acquisition
  • the request message contains the identity of the authorization verification network element, and the identity of the authorization verification network element includes the ID of the PLMN where the authorization verification network element is located.
  • the identity of the authorization verification network element may be, for example, NF ID.
  • the identifier of the network where the data usage network element is located can be the ID of the PLMN where the data usage network element is located.
  • the subscription data acquisition request message can be a Nudm_SDM_Get Request message.
  • the data management network element obtains user consent information 02.
  • the data management network element obtains the user's contract data based on the user identifier 02.
  • the contract data includes user consent information 01
  • the user consent information 01 includes data processing purpose 01 and user consent result 01.
  • the data processing purpose 01 may include one or more data processing purposes
  • the corresponding user consent result 01 may also include one or more user consent results.
  • the subscription data also contains the identification of the permitted networks.
  • the data management network element determines the user consent result 02 in the user consent information 02 based on the identification of the network that processes the user data and the identification of the allowed network.
  • the data management network element determines the user consent result 02 in the user consent information 02 based on whether the identifier of the allowed network contains the identifier of the network that processes user data. If the identifier of the allowed network does not include the identifier of the network that processes user data, the data management network element constructs the user consent result 02 that does not agree; if the identifier of the allowed network includes the identifier of the network that processes user data, then the data management network element Obtain data processing purpose 02 and user consent result 02.
  • the data management network element may construct the user consent result 02 that disagrees in the following manner.
  • the first implementation method is: the data management network element constructs its corresponding disagreeing user consent result 02 according to the preconfigured data processing purpose 03.
  • the preconfigured data processing purpose 03 can be all data processing purposes supported by the network.
  • the user consent information 01 is as shown in Table 1.
  • the identity of the network that processes user data is PLMN C
  • the identities of the networks that are not allowed are PLMN A and PLMN B.
  • the preconfigured data processing purpose 03 is purpose #1, purpose #2 and purpose #3
  • the data management network element constructs the user consent result 02 as disagree, that is, the structure purpose #1, purpose #2 and purpose #3 respectively correspond to Users who disagree agree with the results.
  • the user consent information 02 including the user consent result 02 may be as shown in Table 2.
  • the second implementation method is: the data management network element constructs the corresponding disagreeing user consent result 02 according to the data processing purpose 04 corresponding to the identification of the allowed network.
  • user consent information 01 is shown in Table 1.
  • the identity of the network that processes user data is PLMN C, and the identities of the networks that are not allowed are PLMN A and PLMN B.
  • the data management network element obtains the data processing purpose corresponding to PLMN A or PLMN B. If the data management network element obtains the data processing purposes #1 and #2 of PLMN A, and the constructed user consent result 02 is disagreement, that is, the constructed purpose #1 and purpose #2 respectively correspond to the disagreeing user consent results, including the user
  • the user consent information 02 of the consent result 02 can be as shown in Table 3.
  • the third implementation method is: if the contract data acquisition request message contains indication information of the data processing purpose, the data management network element constructs a disagreeing user consent result corresponding to the data processing purpose of the data call request based on the indication information of the data processing purpose. 02.
  • user consent information 01 is shown in Table 1.
  • the identity of the network that processes user data is PLMN C, and the identities of the networks that are not allowed are PLMN A and PLMN B.
  • the data management network element obtains the data processing purpose of the data call request as purpose #1 according to the contract data acquisition request message, and constructs the user consent result 02 of disagreement corresponding to the purpose #1, including the user consent result 02 of the user consent Information 02 can be as shown in Table 4.
  • the data management network element is configured as a user consent result 02 that does not agree, the user consent information 02 may not include the purpose of data processing.
  • the data management network element may obtain the data processing purpose 02 and the user consent result 02 in the following manner. .
  • the first method is: the data management network element obtains the data processing purpose 02 corresponding to the identification of the permitted network (for example, the identification of the network that processes user data) and the user consent result 02 corresponding to the data processing purpose 02.
  • user consent information 01 is shown in Table 1.
  • the identity of the network that processes user data is PLMN A, which is an identity of a permitted network.
  • the data management network element obtains the data processing purpose 02 and user consent result 02 corresponding to PLMN A, and the data processing purpose includes purpose #1 and purpose #2.
  • the user consent information 02 includes the user consent corresponding to purpose #1 and is consent.
  • the results correspond to Purpose #2 and are agreed upon for users who disagree.
  • user consent information 02 can be as shown in Table 5:.
  • the second method is: if the contract data acquisition request message contains indication information of the data processing purpose, the data management network element obtains the data processing purpose of the data call request (i.e., data processing purpose 02) and its data based on the indication information of the data processing purpose. The corresponding user agrees with the result 02.
  • user consent information 01 is shown in Table 1.
  • the identity of the network that processes user data is PLMN A, which is an identity of a permitted network.
  • the data processing purpose 02 of the data call request obtained by the data management network element is purpose #1, and the user consent result 02 corresponding to purpose #1 obtained by the data management network element based on the user consent information 01 is consent.
  • user consent information 02 can be as shown in Table 6:
  • the user consent information 02 may only include the consent result of the user and does not include the processing purpose 02.
  • S305 The data management network element sends a contract data acquisition response message to the authorization verification network element.
  • the authorization verification network element receives the contract data acquisition response message from the data management network element.
  • the contract data acquisition response message includes the user consent information 02 obtained in S304.
  • the contract data acquisition response message can be a Nudm_SDM_Get Response message.
  • the authorization verification network element determines whether the user data is authorized to be processed based on the user consent information 02.
  • the authorization verification network element determines whether the user agrees to the current call based on the user consent result 02. Without consent, processing of user data is not authorized. If consent is given, processing of user data is authorized.
  • the specific judgment of the authorization verification network element is as follows:
  • the authorization verification network element determines whether the user agrees to the current call based on the data processing purpose, data processing purpose 02 and user consent result 02 of the data call request message. If you do not agree, the processing of user data is not authorized. If you agree, the processing of user data is authorized.
  • the authorization verification network element can obtain the data processing purpose of the data call request through the name of the data call request message itself, or the operation instructions contained in the data call request message.
  • S307a can be initiated. If the processing of user data is not authorized, S307b can be initiated. That is, the verification network element is authorized to send a message rejecting the data call request to the data using network element. It can also be other Not authorized.
  • Other non-authorization methods include still initiating S307a, that is, authorizing the data call request and initiating the data request according to the data call request message, but recording the event that the request is unauthorized, and this application does not limit this.
  • step S306 one of the following two processes is executed:
  • the authorization verification network element sends a data request message to the data providing network element according to the data call request message, which is used to request the user data 01 required by the data call request message.
  • the authorization verification network element sends a message rejecting the data call request to the data using network element, which is used to reject the data call request message in S201.
  • the message rejecting the data call request may include a reason value indicating that the data using network element does not belong to a network that the user is allowed to process data.
  • the cause value may indicate an unauthorized network, or that the data-using network element is not Belong to allowed networks, etc.
  • S308-S309 can refer to S207-S208 and will not be described in detail here.
  • S308 and S309 may be executed when it is determined in S306 that the user data is authorized to be processed, or when S307a is still performed although the user data is not authorized to be processed in S306.
  • the data management network element submits the request to the authorization verification network based on the identifier of the allowed network.
  • it is verified whether the network currently processing user data is a network allowed by the user.
  • the data management network element provides the user consent result to the authorization verification network element based on the verification result, so that the authorization verification network element determines whether to authorize the processing of user data based on the user consent result. Therefore, processing of users in a cross-network scenario can be realized.
  • Authorization of data is a cross-network scenario where the network where the data management network element is located and the network where user data is processed may not be the same network.
  • the network where the data management network element is located stores user consent information and is a network that allows the processing of user data. If the network that processes user data is the network where the data management network element is located, there is no need to verify the network that processes user data. However, the embodiments of the present application do not exclude the scenario where the network that processes user data is the network where the data management network element is located. That is, in this scenario, the network that processes user data can also be verified.
  • the data management network element determines the user consent result based on the identification of the allowed network, the accuracy of authorization is improved and the security risks caused by the unauthorized network processing user data are avoided.
  • FIG. 6 is a schematic flow chart of the method.
  • the data management network element verifies whether the network currently processing user data belongs to the network allowed by the user, and provides the identification of the allowed network to the authorization verification network element, so that the authorization
  • the verification network element determines whether the user data is authorized to be processed based on the identification of the allowed network.
  • the method includes the following steps:
  • S400-S403 are the same as S300-S303 in Figure 5 and will not be described again.
  • the data management network element obtains user consent information 02.
  • the data management network element obtains the user's contract data based on the user identifier 02.
  • the contract data includes user consent information 01
  • the user consent information 01 includes data processing purpose 01 and user consent result 01.
  • the data processing purpose 01 may include one or more data processing purposes
  • the corresponding user consent result 01 may also include one or more user consent results.
  • the subscription data also contains the identification 01 of the permitted network.
  • the data management network element determines the user consent result 02 in the user consent information 02 based on the identification of the network that processes the user data and the identification of the allowed network. For example, the data management network element determines the user consent result 02 in the user consent information 02 based on whether the identifier of the allowed network contains the identifier of the network that processes user data. If the identifier of the allowed network does not include the identifier of the network that processes user data, the data management network element constructs the user consent result 02 that does not agree; if the identifier of the allowed network includes the identifier of the network that processes user data, then the data management network element Identification of the permitted network 02, purpose of data processing 02 and user consent result 02.
  • the network where the data management network element is located and the network where user data is processed may not be the same network (for example, they may not be the same PLMN or slice).
  • the data management network element may construct the user consent result 02 that disagrees in the following manner.
  • the first implementation method is: the data management network element constructs its corresponding disagreeing user consent result 02 according to the preconfigured data processing purpose 03.
  • the preconfigured data processing purpose 03 can be all data processing purposes supported by the network.
  • the user consent information 01 is as shown in Table 1, the identity of the network that processes user data is PLMN C, and the identities of the networks that are not allowed are PLMN A and PLMN B.
  • the preconfigured data processing purpose 03 is purpose #1, purpose #2 and purpose #3, then the data management network element constructs the user consent result 02 as disagree, that is, the structure purpose #1, purpose #2 and purpose #3 respectively correspond to Users who disagree agree with the results.
  • the user consent information 02 including the user consent result 02 can be as shown in Table 7.
  • the data management network element also constructs the allowed network identifier in the user consent information 02 as the identifier PLMN C of the network that processes user data.
  • the second implementation method is: the data management network element constructs the corresponding disagreeing user consent result 02 according to the data processing purpose 04 corresponding to the identification of the allowed network.
  • user consent information 01 is shown in Table 1.
  • the identity of the network that processes user data is PLMN C, and the identities of the networks that are not allowed are PLMN A and PLMN B.
  • the data management network element obtains the data processing purpose corresponding to PLMN A or PLMN B. If the data management network element obtains the data processing purposes #1 and #2 of PLMN A, and the constructed user consent result 02 is disagreement, that is, the constructed purpose #1 and purpose #2 respectively correspond to the disagreeing user consent results, including the user
  • the user consent information 02 of the consent result 02 can be as shown in Table 8.
  • the data management network element may construct the allowed network identifier in the user consent information 02 as the identifier PLMN C of the network that processes user data.
  • the third implementation method is: if the contract data acquisition request message contains indication information of the data processing purpose, the data management network element constructs a disagreeing user consent result corresponding to the data processing purpose of the data call request based on the indication information of the data processing purpose. 02.
  • the data management network element constructs a disagreeing user consent result corresponding to the data processing purpose of the data call request based on the indication information of the data processing purpose.
  • user consent information 01 is shown in Table 1.
  • the identity of the network that processes user data is PLMN C, and the identities of the networks that are not allowed are PLMN A and PLMN B.
  • the data management network element obtains the data processing purpose of the data call request as purpose #1 according to the contract data acquisition request message, and constructs the user consent result 02 of disagreement corresponding to the purpose #1, including the user consent result 02 of the user consent Information 02 can be as shown in Table 9.
  • the data management network element may construct the allowed network identifier in the user consent information 02 as the identifier PLMN C of the network that processes user data.
  • the user consent information 02 may not include data processing purposes.
  • the data management network element may obtain the identifier 02 of the allowed network, the data processing purpose 02, and the user consent result 02 in the following manner.
  • the first method is: the allowed network identifier 02 is the identifier of the network that processes user data, and the data management network element obtains the data processing purpose 02 and its corresponding user consent result 02 based on the identifier of the network that processes user data.
  • user consent information 01 is as shown in Table 1, and the identifier of the network that processes user data is PLMN A, which is an identifier of a permitted network.
  • the data management network element obtains data processing purpose 02 and user consent result 02 corresponding to PLMN A, and the data processing purpose 02 includes purpose #1 and purpose #2, and the user consent information 02 includes purpose #1 corresponding to the consenting user
  • the consent result corresponds to Purpose #2 and is the consent result for users who disagree.
  • user consent information 02 can be as shown in Table 10:.
  • the second method is: if the contract data acquisition request message contains indication information of the data processing purpose, the data management network element obtains the data processing purpose of the data call request based on the identification of the network that processes user data and the indication information of the data processing purpose ( That is, data processing purpose 02) and its corresponding user consent result 02.
  • user consent information 01 is shown in Table 1.
  • the identity of the network that processes user data is PLMN A, which is an identity of a permitted network.
  • the data management network element obtains the data processing purposes corresponding to PLMN A as Purpose #1 and Purpose #2, and then obtains the data processing purpose 02 of the data call request as Purpose #1, and obtains the user consent result 02 corresponding to Purpose #1 as consent.
  • user consent information 02 can be as shown in Table 11:
  • the user consent information 02 may only include the identification 02 of the permitted network for PLMN A and the consent result 02 for the agreed user, and may not include the processing purpose 02.
  • S405 The data management network element sends a contract data acquisition response message to the authorization verification network element.
  • the authorization verification network element receives the contract data acquisition response message from the authorized storer.
  • the subscription data acquisition response message includes the user consent information 02 obtained in S304.
  • the contract data acquisition response message can be the Nudm_SDM_Get Response message.
  • the user consent information 02 includes the identification of the allowed network.
  • the authorization verification network element determines whether the user data is authorized to be processed based on the user consent information 02.
  • the difference between S406 and S306 is that the user consent information 02 in S406 includes the identification information of the allowed network.
  • the authorization verification network element Before the authorization verification network element determines whether the user data is authorized to be processed based on the user consent result 02, the authorization verification network element needs to determine whether the data using network element or the authorization verification network element is based on the identification of the allowed network included in the user consent information 02. Belongs to an allowed network.
  • the authorization verification network element can determine whether the data call request message originates from the allowed network (that is, whether the data using network element belongs to the allowed network) according to the identifier of the allowed network, or determine whether it belongs to the allowed network. If it is determined that the data call request comes from an allowed network, or it is determined that it belongs to an allowed network, authorize the school to The verification network element then determines whether to authorize the processing of user data based on the user consent result 02.
  • the network element can determine whether the data invocation request message originates from the allowed network based on the identifier of the allowed network, or determine whether it belongs to the allowed network by referring to the relevant description in S205.
  • the authorization verification network element determining whether to authorize processing of user data based on the user consent result 02 please refer to the relevant description in S306, which will not be described again here.
  • S407a can be initiated. If the processing of user data is not authorized, S407b can be initiated. That is, the verification network element is authorized to send a message rejecting the data call request to the data using network element. It can also be other Not authorized.
  • Other non-authorization methods include still initiating S407a, that is, authorizing the data call request and initiating the data request according to the data call request message, but recording the event that the request is unauthorized, and this application does not limit this.
  • step S406 one of the following two processes is executed:
  • the authorization verification network element sends a data request message to the data provider according to the data call request message, which is used to request the user data 01 required by the data call request message.
  • the authorization verification network element sends a message rejecting the data call request to the data using network element, which is used to reject the data call request message in S201.
  • the message rejecting the data call request may include a reason value indicating that the data using network element does not belong to a network that the user is allowed to process data.
  • the reason value may indicate an unauthorized network, or indicate that the data-using network element does not belong to an allowed network, etc. After receiving the above reason value, the data using network element will terminate the data calling request.
  • S408-S409 can refer to S207-S208 and will not be described in detail here.
  • S408 and S409 may be executed when it is determined in S406 that the user data is authorized to be processed, or when S407a is still performed although the user data is not authorized to be processed in S406.
  • the data management network element provides contract data to the authorization verification network element. Verify whether the network currently processing user data is a network allowed by the user, and during the authorization verification network element authorization process, verify whether the network element currently processing user data is a network allowed by the user. Therefore, authorization for processing user data in cross-network scenarios can be achieved, and the security and accuracy of authorization are double guaranteed.
  • FIG. 7 is a schematic flow chart of the method. The method includes the following steps:
  • the data usage network element sends a request message for triggering the processing of user data to the authorization verification network element.
  • the authorization verification network element receives the request message from the data usage network element.
  • the request message used to trigger the processing of user data may be the data call request message in S201.
  • the request message may include the user identification, and optionally include an operation instruction and/or an identification of the network where the data using network element is located.
  • the operation instruction may The data processing purpose of the request message may be indicated. For a detailed introduction to this request message, please refer to the description in S201 and will not be described again here.
  • the authorization verification network element obtains the identification information, data processing purpose and user consent result of the network that the user allows to process user data (hereinafter referred to as the allowed network) from the data management network element.
  • the data processing purpose is used to indicate the purpose of processing user data, such as data analysis, data model training, or data reading, etc.
  • the user consent result is used to indicate whether the user agrees to the processing of user data based on the purpose of data processing, such as consent or disagreement.
  • identification information of allowed networks please refer to the user permission processing in S200. The identification of the user data network will not be described here.
  • the authorization verification network element obtains the identification information, data processing purpose, and user consent result of the allowed network locally.
  • the locally obtained identification information, data processing purpose, and user consent result of the allowed network may be The authorization verification network element previously obtained it from the data management network element.
  • the authorization verification network element requests user subscription data from the data management network element, and the authorization verification network element receives user subscription data from the data management network element.
  • the user subscription data includes identification information of allowed networks, Purposes of data processing and consequences of user consent.
  • the data management network element and the authorization verification network element are not in the same network, or the data management network element and the data usage network element are not in the same network.
  • the authorization verification network element determines whether the user data is authorized to be processed based on the identification information of the allowed network.
  • the authorization verification network element determines whether the request message in S501 originates from the allowed network based on the identification information of the allowed network. If the request message originates from the allowed network, it is further determined based on the user consent result whether the user data is authorized to be processed; if the request message does not originate from the allowed network, the user data is not authorized to be processed.
  • the data usage network element and the authorization verification network element can be located in different networks. Determining whether the request message comes from the allowed network can include: the authorization verification network element obtains the network where the data usage network element is located identification, and determine whether the data using network element belongs to the allowed network based on the identification of the network where the data using network element is located. If it is determined that the data-using network element belongs to the allowed network, it is determined that the request message comes from the allowed network; if it is determined that the data-using network element does not belong to the allowed network, it is determined that the request message does not originate from the allowed network. Among them, the authorization verification network element can obtain the data carried in the request message in S501 and use the identity of the network where the network element is located, or obtain the data and use the identity of the network where the network element is located based on the source of the request message.
  • the authorization verification network element determines whether it belongs to the allowed network based on the identification information of the allowed network. If it belongs to the allowed network, it will further determine whether to authorize the processing of user data based on the user consent result; if it does not belong to the allowed network, it will not be authorized to process user data.
  • authorization to process user data can be understood as authorization for the actions of relevant network elements that process user data, or authorization for data call requests, or authorization for the event of processing data. Its expression can be that the relevant network elements that process user data execute data call requests according to normal procedures. Relevant network elements that process user data may include authorization verification network elements and data usage network elements.
  • the actions of related network elements that process user data may be, for example, the authorization verification network element obtains user data according to the data call request message, or uses the obtained user data for data analysis, or uses the obtained user data for model training, etc.; processing users
  • the action of the data-related network element may also be, for example, the data using network element to obtain user data or data analysis results or model training results.
  • non-authorization to process user data can be understood as non-authorization of the actions of relevant network elements that process user data, or non-authorization of data call requests, or authorization of the event of processing data.
  • the manifestation may be that the relevant network elements that process user data fail to execute the data call request according to the normal process.
  • the authorization verification network element determines whether to authorize processing of user data based on the user consent result. For example, the authorization verification network element determines whether to process the user data based on the data processing purpose corresponding to the request message (for example, data processing purpose 05) and the data processing obtained in S502. Purpose and user consent result, determine the user consent result 03 of data processing purpose 05. If the user agrees and the result 03 is consent, the processing of user data is authorized. If the user agrees and the result 03 is disagreement, the processing of user data is not authorized.
  • the authorization verification network element can learn the data processing purpose corresponding to the request message through the name of the request message or the operation instructions in the request message.
  • not authorizing the processing of user data may include sending a message refusing to process the user data to the data using network element, and the message refusing to process the user data may include a reason value for the rejection, the reason value indicating that the data using network element does not come from the user allowing the processing.
  • User data network may include logging an event that processing of user data is not authorized or logging an event that a request message is not authorized.
  • the authorization verification network element When the authorized processing of user data or recording of user data processing is not authorized, the authorization verification network element requests the user data from the data providing network element and performs processing based on the user data, such as analysis or training models. The authorization verification network element then feeds back the user data processing results to the data using network element.
  • the result is, for example, a data analysis result or a trained model. It can be understood that the result is also user data.
  • the authorization verification network element is transferred from the data management network element Obtain the identification information of the allowed network, and verify whether the network element currently processing user data belongs to the network allowed by the user based on the identification information of the allowed network, which can realize authorization for processing user data in a cross-network scenario.
  • Figure 8 is a schematic flow chart of the method. The method includes the following steps:
  • the authorization verification network element sends the identification information of the user and the identification information of the first network to the data management network element.
  • the data management network element receives the identification information of the user and the identification information of the first network from the authorization verification network element. information.
  • the identification information of the first network is used to identify the network that processes the user's data, which may be the network where the data using network element is located and/or the network where the authorization verification network element is located.
  • the user's identification information can be SUPI or GPSI.
  • the authorization verification network element before the authorization verification network element sends the user's identification information and the identification information of the first network to the data management network element, it receives a request message from the data using network element for triggering the processing of user data.
  • a request message please refer to the description in S501, which will not be described again here.
  • the authorization verification network element sends a subscription data acquisition request message to the data management network element, where the subscription data acquisition request message includes the user's identification information and the first network's identification information.
  • the subscription data acquisition request message includes indication information of data processing purpose.
  • the indication information is used to indicate the purpose of processing data. It can also be understood as indicating the data processing purpose corresponding to the request message for triggering the processing of user data. Regarding this implementation method, please refer to the description in S303, which will not be described again here.
  • the network where the data management network element is located and the network where the user's data is processed are not the same network.
  • the data management network element determines the first user consent result based on the identification information of the first network and the identification information of the second network.
  • the identification information of the second network is used to identify the network that the user allows to process the user data, and the first user agrees to the settlement.
  • the result indicates whether the user in the first network agrees to the processing of the first user's data based on the first data processing purpose.
  • the data management network element determines that the identification information of the second network contains the identification information of the first network, which means that the user allows the first network to process the user data, the data management network element determines one or more corresponding to the identification information of the first network. Multiple data processing purposes are the first data processing purpose, and the user consent result corresponding to one or more data processing purposes is determined to be the first user consent result.
  • the data management network element determines that the identification information of the second network does not contain the identification information of the first network, which means that the user does not allow the first network to process user data
  • the data management network element can determine the data corresponding to the identification information of the second network.
  • the processing purpose or preconfigured data processing purpose is the first data processing purpose, and the first user's consent results in disagreement.
  • the data management network element may determine that the first user's consent result is disagreement without determining the first data processing purpose.
  • the subscription data acquisition request message in S601 also includes the first data processing purpose (that is, the purpose indicated by the indication information for the data processing purpose).
  • the data management network element determines that the identification information of the second network contains the identification information of the first network, the data management network element determines that the user consent result corresponding to the first data processing purpose is the first user consent result. . If the identification information of the second network does not include the identification information of the first network, the data management network element determines that the first user's consent result is disagreement.
  • S603 The data management network element sends the first user consent result to the authorization verification network element.
  • the authorization verification network element receives the first user consent result from the data management network element.
  • the data management network element if the data management network element also determines the first processing purpose in S602, the data management network element sends the first data processing purpose and the first user consent result to the authorization verification network element.
  • the data management network element also sends the identifier #1 of the allowed network to the authorization verification network element (which may include networks where the user is allowed to process data or networks where the user is not allowed to process data. In the case where the user is not allowed to process data, Under this condition, the identifier #1 may be constructed by the data management network element). The allowed network identifier #1 is used by the authorization verification network element to determine whether the user data is authorized to be processed.
  • the identification #1 of the allowed network may include identification information of the first network. If the data management network element determines that the identification information of the second network does not include the identification information of the first network, the data management network element may also send the identification of the first network to the authorization verification network element. The authorization verification network element determines whether the user data is authorized to be processed based on the identification of the first network. This does not change the logic of the authorization verification network element determining whether the user data is authorized to be processed based on the identification of the allowed network and the user consent result. If the data management network element determines that the identification information of the second network contains the identification information of the first network, the data management network element may send the identification of the first network to the authorization verification network element.
  • the authorization verification network element determines whether the data using network element and/or the network where the authorization verification network element is located belongs to the first network according to the identification of the first network, so that double verification can be achieved.
  • S604 The authorization verification network element determines whether the user data is authorized to be processed based on the first user's consent result.
  • the authorization verification network element determines whether the first user's consent result is disagreement. If it is disagreement, the user data is not authorized to be processed. If it is consent, it is authorized. Process user data; if the authorization verification network element receives the first data processing purpose and the first user consent result, the authorization verification network element determines the data processing purpose of the request message based on the first data processing purpose and the first user consent result. The corresponding user agrees to the result. If the user agrees to disagree, the user data is not authorized to be processed. If the user agrees to agree, the user data is authorized to be processed. Regarding the authorization verification network element determining whether to authorize processing of user data based on the first user's consent result, reference may also be made to the relevant descriptions in S306 and S406, which will not be described again here.
  • the authorization verification network element receives the identification #1 of the allowed network from the data management network element. That Then, before determining whether to authorize processing of the user based on the first user consent result, the authorization verification network element can determine whether the identifier #1 of the allowed network includes the network where the data usage network element is located/the network where the authorization verification network element is located. For this specific judgment, please refer to the relevant description in S503, and will not be described again here.
  • the data management network element uses the identification information of the allowed network, Verify whether the network currently processing user data is a network allowed by the user.
  • the data management network element provides the user consent result to the authorization verification network element based on the verification result, so that the authorization verification network element determines whether to authorize the processing of user data based on the user consent result. Therefore, the processing of user data in cross-network scenarios can be realized. authorization.
  • the communication device 900 includes a processing unit 910 and a transceiver unit 920 .
  • the communication device 900 is used to implement the functions of the authorization verification network element, data management network element or data usage network element in the above method embodiment, and may also be applied to the authorization verification network element, data management network element or data usage network element. Modules (such as chips).
  • the communication device is used to perform the function of authorization verification network element
  • the transceiver unit 920 is used to receive a request message from the data using network element for triggering the processing of user data
  • the processing unit 910 is used to obtain The identification information of the network from the data management network element that allows the user to process the user's data, the data processing purpose and the user consent result.
  • the data processing purpose is used to indicate the purpose of processing the user data.
  • the user consent result is used to indicate whether the user Agree to process the user data based on the data processing purpose; and used to determine whether to authorize the processing of the user data based on the identification information of the network. .
  • the processing unit 910 is also configured to determine whether the request message comes from the network indicated by the identification information of the network according to the identification information of the network; if the request message comes from the network indicated by the identification information of the network, If the request message is not from the network indicated by the identification information of the network, then the user data is not authorized to be processed based on the user's consent result.
  • the processing unit 910 if the communication device belongs to the network indicated by the identification information of the network, the processing unit 910 is also used to determine that the request message comes from the network indicated by the identification information of the network; if the authorization verification If the network element does not belong to the network indicated by the identification information of the network, the processing unit 910 is further configured to determine that the request message does not come from the network indicated by the identification information of the network.
  • the data usage network element and the communication device are located on the same network.
  • the processing unit 910 is also configured to obtain the identity of the network where the data-using network element is located; if it is determined based on the identity of the network where the data-using network element is located, the identification information indicates that the data-using network element belongs to the network. network, it is determined that the request message comes from the network indicated by the identification information of the network; if it is determined based on the identification of the network where the data using network element is located that the data using network element does not belong to the network indicated by the identification information of the network, then it is determined that the data using network element does not belong to the network indicated by the identification information of the network. The request message does not originate from the network indicated by the network's identification information.
  • the request message includes an identifier of the network where the data usage network element is located.
  • the transceiver unit 920 is also configured to send a rejection message to the data using network element.
  • the rejection message contains a rejection reason value.
  • the rejection reason value is used to indicate that the data using network element does not come from the user. allow The network that processes this user's data.
  • the processing unit 910 is also configured to record an event that processing of the user data is unauthorized.
  • the transceiver unit 920 is also configured to request the user data from the data providing network element; and receive the user data from the data providing network element.
  • the data using network element and the data management network element are located on different networks.
  • the transceiver unit 920 is also configured to request user subscription data from the data management network element; and receive user subscription data from the data management network element, where the user subscription data includes identification information of the network, The purpose of the data processing and the consequences of the user's consent.
  • the identification information of the network is the identification ID of the public land mobile network PLMN.
  • the communication device is used to perform the function of a data management network element
  • the transceiver unit 920 is used to receive identification information from a user authorized to verify the network element and identification information of the first network.
  • the identification information is used to identify the network that processes the user's data;
  • the processing unit 910 is used to determine the consent result of the first user based on the identification information of the first network and the identification information of the second network.
  • the identification information of the second network is used
  • the first user consent result indicates whether the user agrees to process the user's data based on the first data processing purpose in the first network;
  • the transceiver unit 920 is also used to send the user's data to the first network.
  • the authorization verification network element sends the first user consent result.
  • the processing unit 910 is also configured to determine one or more data processing purposes corresponding to the identification information of the first network. For the first data processing purpose, determine the user consent result corresponding to the one or more data processing purposes as the first user consent result; if the identification information of the second network does not include the identification information of the first network, process Unit 910 is also configured to determine that the data processing purpose corresponding to the identification information of the second network is the first data processing purpose, and determine that the first user's consent result is disagreement.
  • the transceiver unit 920 is also configured to send the first data processing purpose and the first user consent result to the authorization verification network element.
  • the transceiver unit 920 is also configured to receive a message from the authorization verification network element, where the message includes the user's identification information, the first network's identification information, and the first data processing purpose; If the identification information of the second network includes the identification information of the first network, the processing unit 910 is also configured to determine that the user consent result corresponding to the first data processing purpose is the first user consent result; if the second network's identification information If the identification information does not include the identification information of the first network, the processing unit 910 is further configured to determine that the first user's consent result is disagreement.
  • the transceiver unit 920 is also configured to send identification information of the network used to determine whether the network is authorized to process the user's data to the authorization verification network element.
  • the identification information of the second network is the identification ID of the public land mobile network PLMN that the user is allowed to process the user's data.
  • the identification information of the first network is the identification ID of the public land mobile network PLMN where the authorization verification network element is located or the public land mobile network PLMN where the network element that triggers processing of the first data is located.
  • the identification ID is the identification ID of the public land mobile network PLMN where the authorization verification network element is located or the public land mobile network PLMN where the network element that triggers processing of the first data is located.
  • the communication device 1000 includes a processor 1010 and an interface circuit 1020 .
  • the processor 1010 and the interface circuit 1020 are coupled to each other.
  • the interface circuit 1020 may be a transceiver or an input-output interface.
  • the communication device 1000 may also include a memory 1030 for storing instructions executed by the processor 1010 or input data required for the processor 1010 to run the instructions or data generated after the processor 1010 executes the instructions.
  • the processor 1010 is used to realize the function of the above processing unit 910
  • the interface circuit 1020 is used to realize the function of the above transceiver unit 920.
  • processor in the embodiment of the present application can be a central processing unit (CPU), or other general-purpose processor, digital signal processor (DSP), or application-specific integrated circuit (application specific integrated circuit, ASIC), field programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof.
  • CPU central processing unit
  • DSP digital signal processor
  • ASIC application specific integrated circuit
  • FPGA field programmable gate array
  • a general-purpose processor can be a microprocessor or any conventional processor.
  • the method steps in the embodiments of the present application can be implemented by hardware or by a processor executing software instructions.
  • Software instructions can be composed of corresponding software modules, and the software modules can be stored in random access memory, flash memory, read-only memory, programmable read-only memory, erasable programmable read-only memory, electrically erasable programmable read-only memory In memory, register, hard disk, mobile hard disk, CD-ROM or any other form of storage medium well known in the art.
  • An exemplary storage medium is coupled to the processor such that the processor can read information from the storage medium and write information to the storage medium.
  • the storage medium can also be an integral part of the processor.
  • the processor and storage media may be located in an ASIC. Additionally, the ASIC can be located in the base station or terminal. Of course, the processor and the storage medium may also exist as discrete components in the base station or terminal.
  • the computer program product includes one or more computer programs or instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, a base station, a user equipment, or other programmable device.
  • the computer program or instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another.
  • the computer program or instructions may be transmitted from a website, computer, A server or data center transmits via wired or wireless means to another website site, computer, server, or data center.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or data center that integrates one or more available media.
  • the available media may be magnetic media, such as floppy disks, hard disks, and tapes; optical media, such as digital video optical disks; or semiconductor media, such as solid-state hard drives.
  • the computer-readable storage medium may be volatile or nonvolatile storage media, or may include both volatile and nonvolatile types of storage media.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

一种授权方法，实现跨网络的场景下对处理用户数据的授权，该方法包括：授权校验网元接收来自数据使用网元的用于触发处理用户数据的请求消息；该授权校验网元获取来自数据管理网元的用户允许处理该用户数据的网络的标识信息、数据处理目的以及用户同意结果，该数据处理目的用于指示处理该用户数据的目的，该用户同意结果用于指示该用户是否同意基于该数据处理目的处理该用户数据，其中，该数据管理网元与该授权校验网元不在同一网络，或者该数据管理网元与该数据使用网元不在同一网络；该授权校验网元根据该网络的标识信息确定是否授权处理该用户数据。

Description

一种授权的方法和装置
本申请要求在2022年5月6日提交中国专利局、申请号为202210489905.4、申请名称为“一种授权的方法和装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，更具体地涉及一种授权方法和装置。
背景技术
当前保护个人信息的法律法规都对如何保护个人信息提出了要求。例如，如果按照法律法规，数据控制者(例如企业)在处理个人信息前应获得用户同意，那么数据控制者在处理个人信息前需获得用户对于数据处理目的的明示同意。例如，如果经用户同意的数据控制者处理用户的位置信息的目的是提供基于位置的服务质量提升服务，那么数据控制者收集的用户的位置信息就不能用于其他目的(比如基于位置的广告投放服务)，除非获得了用户对于这一其他目的的同意。
通信技术领域正在考虑将处理用户数据前需获得用户同意的法规技术化。例如，某个网络在基于某个目的处理用户数据前，应获得该用户对基于该目的处理用户数据的同意。也就是说，该网络可以根据用户对基于该目的处理用户数据的同意，获得处理用户数据的授权。该授权方式并未考虑跨网络场景下，如何对处理用户数据进行授权。
发明内容
本申请提供一种授权的方法，实现跨网络场景下对处理用户数据的授权。
第一方面，本申请提供一种授权的方法，该方法包括：授权校验网元接收来自数据使用网元的用于触发处理用户数据的请求消息；该授权校验网元获取来自数据管理网元的用户允许处理该用户数据的网络的标识信息、数据处理目的以及用户同意结果，该数据处理目的用于指示处理该用户数据的目的，该用户同意结果用于指示该用户是否同意基于该数据处理目的处理该用户数据，其中，该数据管理网元与该授权校验网元不在同一网络，或者该数据管理网元与该数据使用网元不在同一网络；该授权校验网元根据该网络的标识信息确定是否授权处理该用户数据。
通过该方法，在数据管理网元与授权校验网元不在同一网络，或者数据管理网元与数据使用网元不在同一网络的跨网络场景下，授权校验网元接收触发处理用户数据的请求消息后，根据用户允许处理该用户数据的网络的标识信息确定是否对处理用户数据进行授权。这样实现了跨网络的场景下对处理用户数据的授权。在一种可能的实现方式中，该授权校验网元根据该网络的标识信息确定是否授权处理该用户数据包括：该授权校验网元根据该网络的标识信息确定该请求消息是否来自于该网络的标识信息指示的网络；若该请求消息来自于该网络的标识信息指示的网络，则该授权校验网元根据该用户同意结果确定是否授权处理该用户数据；若该请求消息不是来自于该网络的标识信息指示的网络，则该授权校 验网元不授权处理该用户数据。
通过该方式，若该请求消息来自于该网络的标识信息指示的网络，即该请求消息来源的网络允许处理用户数据，那授权校验网元进一步根据该用户同意结果确定是否授权处理用户数据；若该请求消息不是来自于该网络的标识信息指示的网络，即意味着该请求消息来源的网络不允许处理用户数据，那授权校验网元直接不授权处理用户数据，不需做进一步判断。这样，提高了授权校验网元授权的效率，同时避免了不被允许的网络处理用户数据带来的安全隐患。
在一种可能的实现方式中，该授权校验网元根据该网络的标识信息确定该请求消息是否来自于该网络的标识信息指示的网络包括：若该授权校验网元属于该网络的标识信息指示的网络，则该授权校验网元确定该请求消息来自于该网络的标识信息指示的网络；若该授权校验网元不属于该网络的标识信息指示的网络，则该授权校验网元确定该请求消息不是来自于该网络的标识信息指示的网络。
通过该方式，授权校验网元通过判断自身是否属于该网络的标识信息指示的网络来确定该请求消息是否来自于该网络的标识信息指示的网络。
在一种可能的实现方式中，该数据使用网元和该授权校验网元位于同一网络。
在一种可能的实现方式中，该方法还包括：该授权校验网元获取该数据使用网元所在网络的标识；则该授权校验网元根据该网络的标识信息确定该请求消息是否来自于该网络的标识信息指示的网络包括：若根据该数据使用网元所在网络的标识确定该数据使用网元属于该网络的标识信息指示的网络，则该授权校验网元确定该请求消息来自于该网络的标识信息指示的网络；若根据该数据使用网元所在网络的标识确定该数据使用网元不属于该网络的标识信息指示的网络，则该授权校验网元确定该请求消息不是来自于该网络的标识信息指示的网络。
通过该方式，授权校验网元通过获取的数据使用网元所在的网络的标识来确定该请求消息是否来自于该网络的标识信息指示的网络。
在一种可能的实现方式中，该请求消息包括该数据使用网元所在网络的标识。也就是说，授权校验网元可以通过该请求消息获取该数据使用网元所在网络的标识。
在一种可能的实现方式中，该授权校验网元不授权处理该用户数据包括：该授权校验网元向该数据使用网元发送拒绝消息，该拒绝消息包含拒绝原因值，该拒绝原因值用于指示该数据使用网元不是来自于该用户允许处理该用户数据的网络。
通过该方式，在不授权处理用户数据的情况下，授权校验网元向数据使用网元指示失败的原因为该数据使用网元不是来自于该用户允许处理用户数据的网络，使得后续数据使用网元获知被拒绝的原因，以及停止触发处理该用户数据。这样，后续数据使用网元可根据被拒绝的原因，不再触发对该用户数据的处理，避免了不必要的信令交互、提升了网络提供服务的效率。
一种可能的实现方式中，该授权校验网元不授权处理该用户数据包括：该授权校验网元记录处理该用户数据未授权的事件。通过该方式，在不授权处理用户数据的情况下，授权校验网元记录未授权事件。
一种可能的实现方式中，该方法还包括：该授权校验网元向数据提供网元请求该用户数据；该授权校验网元接收来自该数据提供网元的该用户数据。通过该方式，授权校验网元执行对用户数据的处理。
在一种可能的实现方式中，该授权校验网元获取来自该数据管理网元的该网络的标识信息、该数据处理目的以及该用户同意结果包括：该授权校验网元向该数据管理网元请求用户签约数据；该授权校验网元接收来自该数据管理网元的用户签约数据，该用户签约数据包括该网络的标识信息、该数据处理目的以及该用户同意结果。
也就是说，该方式中，授权校验网元可以在用户的签约数据中，获取到该网络的标识信息、该数据处理目的以及该用户同意结果。
在一种可能的实现方式中，该网络的标识信息为公共陆地移动网PLMN的标识ID。
第二方面，本申请提供一种授权的方法，该方法包括：数据管理网元接收来自授权校验网元的用户的标识信息以及第一网络的标识信息，该第一网络的标识信息用于标识处理该用户的数据的网络，其中，该数据管理网元所在的网络与该处理该用户的数据的网络不为同一网络；该数据管理网元根据该第一网络的标识信息和第二网络的标识信息，确定第一用户同意结果，该第二网络的标识信息用于标识该用户允许处理该用户的数据的网络，该第一用户同意结果指示在该第一网络中该用户是否同意基于第一数据处理目的处理该用户的数据；该数据管理网元向该授权校验网元发送该第一用户同意结果。
通过该方法，在数据管理网元所在的网络与该处理该用户的数据的网络不为同一网络的跨网络场景下，数据管理网元接收第一网络的标识信息后，并根据第一网络的标识信息和用户允许处理该用户数据的网络的第二网络的标识信息确定第一用户同意结果，并向授权校验网元发送该第一用户同意结果。这样授权校验网元可根据该第一用户同意结果，确定是否处理用户数据，从而实现了跨网络的场景下对处理用户数据的授权。
在一种可能的实现方式中，该数据管理网元根据该第一网络的标识信息和该第二网络的标识信息，确定该第一用户同意结果包括：若该第二网络的标识信息包含该第一网络的标识信息，则该数据管理网元确定该第一网络的标识信息对应的一个或多个数据处理目的为该第一数据处理目的，确定该一个或多个数据处理目的对应的用户同意结果为该第一用户同意结果；若该第二网络的标识信息不包含该第一网络的标识信息，则该数据管理网元确定该第二网络的标识信息对应的数据处理目的为该第一数据处理目的，且确定该第一用户同意结果为不同意。
通过该方式，在确定第二网络的标识信息包含第一网络的标识信息，即意味着用户允许第一网络处理用户数据的情况下，数据管理网元确定第一网络所对应的数据处理目的和用户同意结果；在确定第二网络的标识信息不包含第一网络的标识信息，即意味着用户不允许第一网络处理用户数据的情况下，数据管理网元确定第一用户同意结果为不同意，这样后续授权校验网元基于为不同意的该第一用户同意结果，不授权处理用户数据，避免了不被允许的网络处理用户数据带来的安全隐患。
在一种可能的实现方式中，该数据管理网元向该授权校验网元发送该第一用户同意结果包括：该数据管理网元向该授权校验网元发送该第一数据处理目的和该第一用户同意结果。
在一种可能的实现方式中，该数据管理网元接收来自该授权校验网元的该用户的标识信息以及该第一网络的标识信息包括：该数据管理网元接收来自该授权校验网元的消息，该消息包括该用户的标识信息、该第一网络的标识信息以及该第一数据处理目的；则该数据管理网元根据该第一网络的标识信息和该第二网络的标识信息，确定该第一用户同意结果包括：若该第二网络的标识信息包含该第一网络的标识信息，则该数据管理网元确定该 第一数据处理目的对应的用户同意结果为该第一用户同意结果；若该第二网络的标识信息不包含该第一网络的标识信息，则该数据管理网元确定该第一用户同意结果为不同意。
在该方式中，授权校验网元还向数据管理网元提供了第一数据处理目的，那数据管理网元在确定第一用户同意结果时需考虑该第一用户同意结果对应于该第一数据处理目的。并且在，第二网络的标识信息不包含第一网络的标识信息的情况下，确定该第一用户同意结果为不同意，从而避免了不被允许的网络处理用户数据带来的安全隐患。
在一种可能的实现方式中，该方法还包括：该数据管理网元向该授权校验网元发送用于确定是否授权处理该用户的数据的网络的标识信息。也就是说，该授权校验网元还可以从数据管理网元处获取用于确定是否授权处理该用户的数据的网络的标识信息，从而基于该网络的标识信息判断是否授权处理用户数据，实现了双重授权，保证了授权的准确性。
在一种可能的实现方式中，该第二网络的标识信息为该用户允许处理该用户的数据的公共陆地移动网PLMN的标识ID。
在一种可能的实现方式中，该第一网络的标识信息为该授权校验网元所在的公共陆地移动网PLMN的标识ID或触发处理该第一数据的网元所在的公共陆地移动网PLMN的标识ID。
第三方面，本申请提供一种授权的方法，该方法包括：数据管理网元接收来自授权校验网元请求用户的签约数据的消息，其中，该数据管理网元与该授权校验网元不在同一网络；该数据管理网元向该授权校验网元发送该用户的签约数据，该用户的签约数据包括该用户允许处理该用户数据的网络的标识信息、数据处理目的以及用户同意结果，该数据处理目的用于指示处理该用户数据的目的，该用户同意结果用于指示该用户是否同意基于该数据处理目的处理该用户数据。
通过该方法，在该数据管理网元与该授权校验网元不在同一网络的跨网络场景下，在用户的签约数据中包括用户允许处理用户数据的网络的标识信息，这样授权校验网元可以基于该网络的标识信息对请求处理用户数据的网络进行授权。这样实现了跨网络的场景下对处理用户数据的授权。
第四方面，本申请提供一种授权的方法，该方法包括：授权校验网元接收来自数据使用网元的用于触发处理用户的数据的请求消息；该授权校验网元向数据管理网元发送该用户的标识信息以及第一网络的标识信息，该第一网络的标识信息用于标识处理该用户的数据的网络，其中，该数据管理网元所在的网络与该处理该用户的数据的网络不为同一网络；该授权校验网元接收来自该数据管理网元的第一用户同意结果，该第一用户同意结果指示在该第一网络中该用户是否同意基于第一数据处理目的处理该用户的数据；该授权校验网元根据该第一用户同意结果，确定是否授权处理该用户的数据。
该方法中，该数据管理网元所在的网络与该处理该用户的数据的网络不为同一网络的跨网络场景下，授权校验网元接收来自数据管理网元的第一用户同意结果，且该第一用户同意结果针对在第一网络中用户是否同意基于第一数据处理目的处理该用户的数据。授权校验网元基于该第一用户同意结果确定是否授权处理用户数据。这样实现了跨网络的场景下对处理用户数据的授权。
在一种可能的实现方式中，若该第一网络不属于该用户允许处理该用户的数据的网络，该第一用户同意结果指示在该第一网络中该用户不同意处理该用户的数据。该方式中，在第一网络不被允许处理用户数据的情况下，授权校验网元根据为不同意的第一用户同意结 果，确定不允许处理用户数据，从而避免了不被允许的网络处理用户数据带来的安全隐患。
在一种可能的实现方式中，该授权校验网元接收来自该数据管理网元的该第一用户同意结果包括：该授权校验网元接收来自该数据管理网元的该第一用户同意结果和该第一数据处理目的。
在一种可能的实现方式中，该授权校验网元向数据管理网元发送该用户的标识信息以及该第一网络的标识信息包括：该授权校验网元向该数据管理网元发送消息，该消息包括该用户的标识信息、该第一数据处理目的以及该第一网络的标识信息。
第五方面，本申请实施例提供一种通信装置，该装置可以是授权校验网元或应用于授权校验网元中的模块(如芯片)。该装置具有实现上述第一方面或第四方面的任意实现方法的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块。
第六方面，本申请实施例提供一种通信装置，该装置可以是数据管理网元或应用于数据管理网元中的模块(如芯片)。该装置具有实现上述第二方面或第三方面的任意实现方法的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块。
第七方面，本申请实施例提供一种通信装置，包括与存储器耦合的处理器，该处理器用于调用该存储器中存储的程序，以执行上述第一方面至第四方面中的任意实现方法。该存储器可以位于该装置之内，也可以位于该装置之外。且该处理器可以是一个或多个。
第八方面，本申请实施例提供一种通信装置，包括处理器和存储器；该存储器用于存储计算机指令，当该装置运行时，该处理器执行该存储器存储的计算机指令，以使该装置执行上述第一方面至第四方面中的任意实现方法。
第九方面，本申请实施例提供一种通信装置，包括用于执行上述第一方面至第四方面中的任意实现方法的各个步骤的单元或手段(means)。
第十方面，本申请实施例提供一种通信装置，包括处理器和接口电路，该处理器用于通过接口电路与其它装置通信，并执行上述第一方面至第四方面中的任意实现方法。该处理器包括一个或多个。
第十一方面，本申请实施例还提供一种芯片系统，包括：处理器，用于执行上述第一方面至第四方面中的任意实现方法。
第十二方面，本申请实施例还提供一种计算机可读存储介质，该计算机可读存储介质中存储有指令，当其在通信装置上运行时，使得上述第一方面至第四方面中的任意实现方法被执行。
第十三方面，本申请实施例还提供一种计算机程序产品，该计算机程序产品包括计算机程序或指令，当计算机程序或指令被通信装置运行时，使得上述第一方面至第四方面中的任意实现方法被执行。
第十四方面，本申请实施例一种通信系统，包括执行上述第一方面中任意实现方法的通信装置和执行上述第三方面中任意实现方法的通信装置。可选地，还包括与上述装置通信的其他通信装置，例如数据使用网元、基站、或用户设备等。
第十五方面，本申请实施例一种通信系统，包括执行上述第二方面中任意实现方法的通信装置和执行上述第四方面中任意实现方法的通信装置。可选地，还包括与上述装置通信的其他通信装置，例如数据使用网元、基站、或用户设备等。
附图说明
图1为本申请实施例提供的一种5G网络架构示意图；
图2为本申请实施例提供的另一种5G网络架构示意图；
图3为本申请实施例提供的一种授权处理用户数据的方法的流程示意图；
图4为本申请实施例提供的另一种授权处理用户数据的方法的流程示意图；
图5为本申请实施例提供的又一种授权处理用户数据的方法的流程示意图；
图6为本申请实施例提供的又一种授权处理用户数据的方法的流程示意图；
图7为本申请实施例提供的又一种授权处理用户数据的方法的流程示意图；
图8为本申请实施例提供的又一种授权处理用户数据的方法的流程示意图；
图9为本申请实施例提供的一种通信装置结构示意图；
图10为本申请实施例提供的一种通信装置结构示意图。
具体实施方式
为了使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请实施例进行描述。
在本申请中，除非另有说明，“/”表示前后关联的对象是一种“或”的关系，例如A/B可以表示A或B；本申请中的“和/或”仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如A和/或B可以表示：单独存在A，同时存在A和B，单独存在B这三种情况，其中A和B可以分别是单数或者复数。并且，在本申请中，除非另有说明，“多个”是指两个或多于两个。“一个或多个”或其类似的表达是指这些项中的任意组合，包括单项(个)或复数项(个)的任意组合，例如a、b或c中的一个或多个可以表示：a，b，c，a-b，a-c，b-c，或a-b-c，其中a、b和c可以分别是单个或是多个。另外，为了便于清楚地描述本申请的技术方案，在本申请中采用了“第一”、“第二”等字样对功能和作用基本相同的相同项或相似项进行区分。本领域技术人员可以理解“第一”、“第二”等字样并不对数量和执行次序进行限定，并且“第一”、“第二”等字样也并不限定一定不同。
本申请的技术方案可以应用于各种通信系统，例如第五代(5th generation，5G)移动通信系统、新无线(new radio，NR)系统、家庭基站网络、非3GPP如无线保真(wireless fidelity，WIFI)接入的移动网络、固移融合(fixed mobile convergence，FMC)网络或者未来6G网络等；又例如可以应用于独立非公共网络(standalone non-public network，SNPN)，公共陆地移动网(public land mobile network,PLMN)合一非公网(PLMN-intergrated non-public-network，PNI-NPN)，或者企业、高校自己搭建的网络等。
以下，对本申请中的部分用语进行解释说明，以便于本领域技术人员理解。
1)用户设备(user equipment，UE)，是一种具有无线收发功能的设备。用户设备可以经无线接入网(如，radio access network，RAN)与核心网或者互联网进行通信，与RAN交换语音和/或数据。
本申请中的用户设备又可以称之为终端设备，例如可以为无线终端设备、移动终端设备、设备到设备(device-to-device，D2D)终端设备、车联网(vehicle to everything，V2X)终端设备、机器到机器/机器类通信(machine-to-machine/machine-type communications， M2M/MTC)终端设备、物联网(internet of things，IoT)终端设备、订户单元(subscriber unit)、订户站(subscriber station)、移动站(mobile station)、远程站(remote station)、接入点(access point，AP)、远程终端(remote terminal)、接入终端(access terminal)、用户终端(user terminal)、用户代理(user agent)或用户装备(user device)等。
例如，本申请中的用户设备可以是手机、平板电脑、带无线收发功能的电脑、便携式、袖珍式、手持式、计算机内置的移动装置等；又例如，还可以是虚拟现实(virtual reality，VR)终端设备、增强现实(augmented reality，AR)终端设备、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程手术(remote medical surgery)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端、未来演进的公用陆地移动通信网络(public land mobile network，PLMN)中的终端设备、或者V2X中的车辆设备、客户前置设备(customer premises equipment，CPE)等等。再例如，终端设备还可以是个人通信业务(personal communication service，PCS)电话、无绳电话、会话发起协议(session initiation protocol，SIP)话机、无线本地环路(wireless local loop，WLL)站、个人数字助理(personal digital assistant，PDA)等设备。
作为示例而非限定，本申请中的用户设备还可以是可穿戴设备。可穿戴设备也可以称为穿戴式智能设备或智能穿戴式设备等，是应用穿戴式技术对日常穿戴进行智能化设计、开发出可以穿戴的设备的总称，如眼镜、手套、手表、服饰及鞋等。可穿戴设备即直接穿在身上，或是整合到用户的衣服或配件的一种便携式设备。可穿戴设备不仅仅是一种硬件设备，更是通过软件支持以及数据交互、云端交互来实现强大的功能。广义穿戴式智能设备可以不依赖智能手机实现完整或者部分的功能，例如：智能手表或智能眼镜等，也可以专注于某一类应用功能，和其它设备如智能手机配合使用，如各类进行体征监测的智能手环、智能头盔、智能首饰等。而如上介绍的各种设备，如果位于车辆上(例如放置在车辆内或安装在车辆内)，都可以认为是车载终端设备，车载终端设备例如也称为车载单元(on-board unit，OBU)。
本申请实施例对用户设备所采用的具体技术和具体设备形态不作限定。
2)无线接入网设备，是通信系统中用于将UE接入到无线网络的设备。无线接入网设备一般可以通过有线链路(例如光纤线缆)连接到核心网。无线接入网设备可以为RAN中的节点，又可以称为基站(base station)，还可以称为RAN节点(或设备)。
无线接入网设备可以包括基站、LTE系统或演进的LTE系统(LTE-Advanced，LTE-A)中的演进型基站(evolved NodeB，eNodeB)、5G通信系统中的下一代基站(next generation NodeB，gNB)、发送接收点(transmission reception point，TRP)、基带单元(base band unit，BBU)、无线局域网(wireless local area networks，WLAN)中的接入点(access point，AP)、接入回传一体化(integrated access and backhaul，IAB)节点、未来移动通信系统中的基站或WiFi系统中的接入节点等。无线接入网设备也可以是完成基站部分功能的模块或单元，例如集中式单元(central unit，CU)或者分布式单元(distributed unit，DU)。
例如，在一种网络结构中，无线接入网设备可以为CU节点、或DU节点、或为包括CU节点和DU节点的无线接入网设备。其中，CU节点用于支持无线资源控制(radio resource control，RRC)、分组数据汇聚协议(packet data convergence protocol，PDCP)、业务数据适配协议(service data adaptation protocol，SDAP)等协议；DU节点用于支持无线链路控 制(radio link control，RLC)层协议、媒体接入控制(medium access control，MAC)层协议和物理层协议。
无线接入网设备和用户设备可以部署在陆地上，包括室内或室外、手持或车载；也可以部署在水面上；还可以部署在空中的飞机、气球和卫星上。本申请实施例对无线接入网设备和用户设备的应用场景不作限定。在本申请实施例中，无线接入网设备可以简称为接入网设备，如无特殊说明，下文中的接入网设备均指无线接入网设备。
本申请实施例对接入网设备所采用的具体技术和具体设备形态不作限定。
3)核心网设备，是指为用户设备提供业务支持的核心网(core network，CN)中的设备。如图1所示，为本申请实施例适用的一种5G通信系统的示意图，5G核心网设备包括接入和移动管理功能(access and mobility management function，AMF)、会话管理功能(session management function，SMF)、策略控制功能(policy control function，PCF)、网络切片选择功能(network slice selection function，NSSF)、鉴权服务器功能(authentication server function，AUSF)、统一数据管理功能(unified data management，UDM)、用户面功能(user plane function，UPF)、网络能力开放功能(network exposure function，NEF)(图中未示出)、网络数据分析功能(network data analytics function，NWDAF)(图中未示出)、应用功能(application function，AF)等多个网元。
其中，AMF网元(以下简称AMF)主要负责移动性管理、接入管理等服务。SMF网元(以下简称SMF)主要负责会话管理、用户设备地址管理和分配、动态主机配置协议功能、用户面功能的选择和控制等。PCF网元(以下简称PCF)主要负责为网络行为管理提供统一的策略框架、提供控制面功能的策略规则、获取与策略决策相关的注册信息等。NSSF网元主要负责选择为用户设备服务的网络切片实例的集合。AUSF网元主要负责对用户设备的认证功能等。NSSAAF网元主要支持网络切片的认证和授权。UDM网元(以下简称UDM)主要负责存储网络中签约用户设备的签约数据、信任状(credential)和持久身份标识(subscriber permanent identifier，SUPI)等。UPF网元(以下简称UPF)主要负责对外连接到数据网络(data network，DN)以及用户面的数据包路由转发、报文过滤、执行服务质量(quality of service，QoS)控制相关功能等。NEF网元(以下简称NEF)主要负责开放网络能力和事件，从AF获取外部应用信息，以及将用于外部开放的信息存储在用户数据库(user data repository，UDR)。NWDAF主要用于对各类网络数据的分析，网络数据包括从网络功能(network function，NF)收集的网络运行数据、或从第三方AF获取的应用数据。NWDAF生成的分析结果也会输出给NF、第三方AF。AF网元(以下简称AF)主要负责向3GPP网络提供业务，如影响业务路由、与PCF网元之间交互以进行策略控制等。
各网元之间可以通过下一代网络(next generation，NG)接口进行通信，例如：N1为AMF与UE之间的接口，用于向UE传递QoS控制规则等。N2为AMF与RAN之间的接口，用于传递核心网侧至RAN的无线承载控制信息等。N3为RAN与UPF间的接口，用于在RAN与UPF间传递用户面数据。N4为SMF与UPF之间的接口，用于控制面与用户面之间传递信息，包括控制面向用户面的转发规则、QoS控制规则、流量统计规则等的下发以及用户面的信息上报。N5为AF与PCF之间的接口，用于应用业务请求下发以及网络事件上报。N6为UPF与DN连接间的接口，用于在UPF与DN间传递用户面数据。N7为PCF与SMF之间的接口，用于下发协议数据单元(protocol data unit，PDU)会话粒度 以及业务数据流粒度控制策略。N8为AMF与UDM间的接口，用于AMF向UDM获取接入与移动性管理相关签约数据与鉴权数据，以及AMF向UDM注册UE当前移动性管理相关信息等。N10为SMF与UDM间的接口，用于SMF向UDM获取会话管理相关签约数据，以及SMF向UDM注册UE当前会话相关信息等。N11为SMF与AMF之间的接口，用于传递RAN和UPF之间的PDU会话隧道信息、传递发送给UE的控制消息、传递发送给RAN的无线资源控制信息等。NEF与其他NF之间可以为南向接口(图中未示出)，例如NEF与SMF之间为N29接口，NEF与PCF之间为N30接口。NWDAF与PCF之间为N23接口(图中未示出)。
如图2所示，为本申请实施例适用的另一种5G通信系统的示意图。
该系统中，各网元之间可以使用服务化的接口进行通信，例如：AUSF对外提供的服务化接口可以为Nausf；AMF对外提供的服务化接口可以为Namf；SMF对外提供的服务化接口可以为Nsmf；NSSF对外提供的服务化接口可以为Nnssf；NEF对外提供的服务化接口可以为Nnef；NRF对外提供的服务化接口可以为Nnrf；PCF对外提供的服务化接口可以为Npcf；UDM对外提供的服务化接口可以为Nudm；AF对外提供的服务化接口可以为Naf；NWDAF对外提供的服务化接口可以为Nnwdaf。
应注意，上述网元可以称为功能单元或者功能实体，它们既可以是硬件设备中的网络元件，也可以是在专用硬件上运行的软件功能，或者是平台(例如，云平台)上实例化的虚拟化功能。可选的，上述功能单元可以由一个设备实现，也可以由多个设备共同实现，还可以是一个设备内的不同的功能模块，本申请实施例对此不作限定。
需要说明的是，本申请实施例中的用户可以是与网络进行签约从而使用网络连接实现通信的个人或其他实体，用户设备可以是用户使用的设备，用户因为使用用户设备产生的数据，即可以称之为用户的数据，也可以称之为用户设备的数据。可以理解的是，无论是称为用户的数据还是用户设备的数据，该数据都归属于用户。
图3为本申请实施例提供的一种授权操作(或处理)用户数据的方法的流程示意图，该方法包括以下步骤：
S101：网络功能(network function，NF)消费者(consumer)向NWDAF发送分析订阅请求消息，相应地，NWDAF接收来自NF consumer的分析订阅请求消息。
其中，NF consumer例如可以是AF，或PCF等请求分析数据的网元。
分析订阅请求消息可以包含用户的标识信息例如用户永久标识(subscription permanent identifier，SUPI)以及分析标识Analytics ID。其中，Analytics ID可以指示当前的分析类型，例如UE的移动性分析(UE mobility Analytics)、或UE的通信分析(UE communication Analytics)等。
UE的移动性分析用于对UE移动特征的统计和预测，例如分析UE在某个时间的位置，分析UE可能的移动轨迹等中的至少一项。
UE的通信分析用于对UE通信特征的统计和预测，例如分析UE在某个时间的流量特征，包含流速，流量大小等中的至少一项。
可以理解的是，该分析订阅请求消息用于请求对数据进行分析，也就是说，步骤S101中发送的消息能够指示处理的目的，例如，数据分析。比如，该分析订阅请求消息是Nnwdaf_AnalyticsSubscription_Subscribe Request消息。此外，Analytics ID用于表示数据分析的具体类型。例如，当Analytics ID为UE mobility Analytics或UE communication Analytics 时，针对用户数据进行分析。当Analytics ID为网络功能负载信息NF load information时，针对网络数据进行分析，不涉及用户数据。在针对用户数据进行分析的情况下，该分析订阅请求消息的名称(或者说分析订阅请求消息本身)指示该消息对应的用户数据处理目的为数据分析。
NF consumer向NWDAF发送分析订阅请求消息也可以理解为调用NWDAF的分析订阅的服务。
S102：NWDAF判断是否需要对本次调用校验用户同意。
例如，NWDAF可以根据本地策略判断是否需要对本次调用校验用户同意。
其中，本地策略可以包含：若本次调用不涉及对用户的数据的操作(例如涉及的是网络数据的操作)，则不需要校验，跳过步骤S103-S105；若涉及对用户的数据的操作，则需要校验。若涉及对用户的数据的操作且NWDAF本地保存的上下文中包含用户同意信息，则直接根据本地保存的用户同意信息进行校验，并跳过步骤S103-S105，若涉及对用户的数据的操作且NWDAF本地未保存用户同意信息，则继续执行步骤S103-S105。
用户同意信息可以包括数据处理目的和用户同意结果。数据处理目的用于指示对用户数据操作的目的，例如包含数据分析，或数据模型训练等。用户同意结果用于指示是否同意基于该数据使用目的操作用户数据，例如，1代表同意，0代表不同意。
例如，若数据处理目的为数据分析，则代表将收集用户的数据进行分析，得出分析结果，如上述UE的移动性分析、UE的通信分析等中的至少一项。若数据处理目的为数据模型训练，则代表将收集用户的数据进行机器学习的模型训练，得到机器学习模型。
S103：NWDAF向UDM发送签约数据获取请求消息，相应地，UDM接收来自NWDAF的签约数据获取请求消息。
其中，签约数据获取请求消息可以为Nudm_SDM_Get Request消息，用于获得用户的签约数据。该签约数据获取请求消息可以包含用户标识SUPI，可选地，还可以包含签约类型，签约类型用于指示签约数据的类型，例如指示签约数据的类型是接入与移动性签约数据(access and mobility subscription data)、SMF选择的签约数据(SMF selection subscription data)、SMF管理的签约数据(SMF management subscription data)、或用户同意相关的签约数据。这里的签约类型可以为指示用户同意的签约类型。
S104：UDM根据用户标识SUPI获得用户的签约数据，签约数据包含用户同意信息。
可选地，若签约类型为用户同意相关的签约数据，则UDM根据用户标识SUPI获得用户同意信息。
S105：UDM向NWDAF发送签约数据，相应地，NWDAF接收来自UDM的签约数据。
在一种实现方式中，UDM向NWDAF发送Nudm_SDM_Get Response消息，消息可以包括用户的签约数据，该签约数据包含用户同意信息。
S106：NWDAF判断是否授权分析订阅请求消息对应的数据操作。
在一种实现方式中，NWDAF根据Nnwdaf_AnalyticsSubscription_SubscribeRequest消息、用户同意信息中的数据处理目的以及用户同意结果消息判断是否授权分析订阅请求消息对应的数据操作。例如，NWDAF根据Nnwdaf_AnalyticsSubscription_Subscribe Request消息确定该消息对应的数据处理目的为数据分析，进一步获得数据分析对应的用户同意结果，若结果是同意，则授权分析订阅请求消息对应的数据分析，若结果是不同意，则不授 权分析订阅请求消息对应的数据分析。
S107：NWDAF向NF consumer发送分析订阅响应消息，相应地，NF consumer接收来自NWDAF的分析订阅响应消息。
其中，分析订阅响应消息可以是Nnwdaf_AnalyticsSubscription_Subscribe Response消息。
例如，若S106中NWDAF根据用户同意结果，不授权对应的数据操作，则该分析订阅响应消息用于指示分析订阅(例如Nnwdaf_AnalyticsSubscription_Subscribe)请求失败。若S106中NWDAF根据用户同意结果，授权对应的数据操作，则该分析订阅响应消息用于指示分析订阅请求成功。在授权数据操作的情况下，执行S108至S110。
S108：NWDAF向NF提供者(NF provider)发送用户数据请求消息，相应地，NF provider接收来自NWDAF的用户数据请求消息。
其中，NF provider可以是AMF,SMF等提供数据的网元。用户数据请求消息可以是Nnf_EventExposure_Subscribe消息，该消息用于请求获得终端设备的用户数据。用户数据请求消息中可以包含用户标识SUPI。
S109：NF provider向NWDAF发送用户数据，相应地，NWDAF接收来自NF provider的用户数据。
在一种实现方式中，NF provider向NWDAF发送Nnf_EventExposure_Notify消息，该消息携带NWDAF所请求的用户数据。该请求的用户数据例如可以是AMF提供的位置数据(如跟踪区标识(tracking area identity，TAI)等)，或者是SMF提供的通信数据(如通信间隔，或通信速率)等。
S110：NWDAF根据收集到的用户数据按照NF consumer请求的分析对该用户数据进行分析，并获得分析结果。
例如，当Analytics ID指示UE的移动性分析，该分析结果为UE的位置统计信息。其中，UE的位置统计信息可以包含UE的位置、UE在此位置出现的时间、UE在此位置停留的时间等中的至少一项。又例如，当Analytics ID指示UE的通信分析，该分析结果为通信特征信息。UE的通信特征信息可以包含UE是否是周期性通信、通信间隔、通信开始时间、通信结束时间、通信的流量大小、通信的流速等中的至少一项。
在一种实现方式中，NWDAF向NF consumer发送Nnwdaf_AnalysisSubscription_Notify消息，该消息中包含分析结果。
在图3所示的方法中，NWDAF和UDM处于同一个公共陆地移动网(public land mobile network，PLMN)中，并未考虑NWDAF与UDM，或NF consumer与UDM处于不同PLMN的场景。
图4为本申请提供的一种授权处理用户数据的方法。需要说明的是，本申请实施例中对用户数据的的处理(process)可以包含对用户数据的任意操作，例如收集、记录、获取、构造、存储、更新、分析、压缩、检索、共享、使用、或删除等。
图4所示的方法涉及数据使用网元、授权校验网元、数据管理网元和数据提供网元之间的交互。
数据使用网元可以理解为触发处理用户数据的网元。例如图3所示的流程中，涉及到数据使用网元(NF consumer)请求对用户数据进行分析，即为触发分析用户数据。此外， 数据使用网元也可以处理用户数据。例如，NF consumer获取用户的分析结果的步骤即为处理用户数据。在本申请实施例中，“数据使用网元”的这个名称仅仅是一种示例，并不对该网元的功能或特性造成任何限定。例如，该数据使用网元还可以称为数据请求网元、网络功能消费者、服务消费网元、或数据使用者等。在5G架构中，数据使用网元可以是PCF、或AF等。
授权校验网元可以理解为对处理用户数据进行授权的网元。例如图3所示的流程中，涉及到NWDAF判断是否授权分析订阅请求消息对应的数据操作，即为对处理用户数据进行授权。此外，授权校验网元也可以处理用户数据。例如，NWDAF根据收集到的用户数据对用户数据进行分析的步骤，即为处理用户数据。在本申请实施例中，“授权校验网元”的这个名称仅仅是一种示例，并不对该网元的功能或特性造成任何限定。在5G架构中，授权校验网元可以是NEF、NWDAF、数据收集协调功能网元(Data Collection Coordination Function，DCCF)、或边缘使能服务器(edge enabler server，EES)等。其中，授权校验网元与数据使用网元可以合设在一个设备中。
数据管理网元可以理解为用于保存或管理用户同意的相关参数的网元，可以是UDM、UDR、或PCF等。
数据提供网元用于提供用户的数据，可以是AMF、SMF、或UPF等。数据提供网元可以与授权校验网元合设在一个设备中。
其中，数据管理网元与授权校验网元可以位于不同的网络(例如不同的PLMN或不同的切片)，或者数据管理网元与数据使用网元可以位于不同的网络(例如不同的PLMN或不同的切片)。
如图4所示，该方法包括以下步骤：
S200：用户的签约数据中预存用户允许处理用户数据的网络(以下可简称为允许的网络)的标识。
其中，允许的网络即说明该网络可以被授权处理用户数据，即该允许的网络被用户允许控制、使用或者保存用户数据，承担着用户数据保护的职责。该网络可以被授权基于该用户签约的部分或全部数据处理目的处理用户数据，本申请不作限定。
允许的网络可以是PLMN粒度的，例如该允许的网络的标识例如可以是PLMN ID。或者，允许的网络可以是切片粒度的，本申请在此并不限制。
该允许的网络的标识可以是在用户开户时，由管理员预先配置在UE的签约数据中的，例如根据用户在与运营商签约的合同中用户接受的网络而预配置。
用户的签约数据可以预存在数据管理网元，例如预存在UDM处。
S201：数据使用网元向授权校验网元发送数据调用请求消息，相应地，授权校验网元接收来自数据使用网元的数据调用请求消息。
其中，该数据调用请求消息用于触发处理用户数据。该数据调用请求消息包含用户标识01。该数据调用请求消息可以是由具体的应用编程接口(application programming interface，API)触发的。
用户标识01中的“01”代表一种类型的用户标识，并不用于限制用户标识中的具体内容。例如，用户标识01用于标识用户，可以是SUPI或一般公共订阅标识符(generic public subscription identifier，GPSI)等，本申请不予限制。
可选的，该数据调用请求消息用于指示该数据使用网元对用户数据的处理目的，例如 收集、读取、分析、共享、或模型训练等。其中，收集用户数据可以为从多个设备中或从一个设备的不同时刻获取到用户数据的操作；读取用户数据可以为取得用户数据并放入本地/存入其他设备的操作；分析用户数据可以为将用户数据进行分解、整合，从而得出结论的操作；共享用户数据可以为将用户数据提供给外部设备的操作；模型训练可以为将用户数据进行机器学习，得出训练模型的操作。
例如，可通过该数据调用请求消息的名称来体现对用户数据的处理目的，如，图3中的Nnwdaf_AnalyticsSubscription_SubscribeRequest用于指示对用户数据的处理目的为分析。或者，该数据调用请求消息可以包括操作指示(或称之为处理指示)来指示对用户数据的处理目的。此外，数据调用请求消息还可以携带Analytics ID，Analytics ID用于表示数据分析的具体类型，如UE的移动性分析、或UE的通信分析。
可选的，该数据调用请求消息中还可以包括数据使用网元所在网络的标识信息，该数据使用网元所在网络的标识信息用于标识数据使用网元所在的网络，例如可以是PLMN ID。该数据使用网络所在网络的标识信息可以携带在该数据使用网元的标识信息中，即数据调用请求消息包括数据使用网元的标识，数据使用网元的标识包括数据使用网元所在的网络的标识信息。例如，数据使用网元的标识信息为NF ID，该NF ID可以包括PLMN ID。
例如，当授权校验网元为NEF时，数据调用请求消息可以包括Nnef_Location、Nnef_UEIdentifier_Get。当授权校验网元为NWDAF时，数据调用请求消息可以包括Nnwdaf_AnalyticsSubscription_Subscribe等消息。
例如，数据使用网元为线上购物平台的服务器，该线上购物平台的服务调用授权校验网元NEF开放的请求UE标识的API。例如，线上购物平台服务器向NEF发起Nnef_UEIdentifier_Get的调用请求，线上购物平台服务器将Nnef_UEIdentifier_Get中的user information设置为某个UE的IP地址，该动作代表线上购物平台服务器请求获得IP地址对应的用户的标识信息。该示例中，调用NEF的API的数据调用消息指示了线上购物平台服务器对用户的数据(即身份信息)采取读取的处理。
又例如，数据使用网元为PCF，PCF调用授权校验网元NWDAF提供的数据分析的API，并指示分析UE位置。例如，PCF向NWDAF发起Nnwdaf_AnalyticsSubscription_Subscribe的调用请求，PCF将Nnwdaf_AnalyticsSubscription_Subscribe中的analytics ID设置为UE mobility analytics，Target of Analytics Reporting设置为某个UE的SUPI，用于表示PCF请求NWDAF对UE的移动性数据进行分析。该示例中，调用NWDAF的API的数据调用消息指示了PCF对用户的数据(即移动性数据)采取分析的处理。
S202：授权检验网元判断本地是否保存有UE的用户同意信息。
若授权校验网元的上下文中保存有UE的用户同意信息，则直接从上下文中获得用户同意信息，无需从数据管理网元获得用户同意信息。其中，用户同意信息详见S204中的相关描述。
若授权校验网元的上下文中没有保存有UE的用户同意信息，则执行S203-S204。
S203：授权校验网元向数据管理网元发送签约数据获取请求消息，相应地，数据管理网元接收来自授权校验网元的签约数据获取请求消息。
其中，该签约数据获取请求消息用于请求用户的签约数据。该签约数据获取请求消息可以包含用户标识02。用户标识02可以与用户标识01相同，也可以是授权校验网元根据 用户标识01转化的。例如，授权校验网元将GPSI转化为SUPI，本申请对此不作限制。可选地，该签约数据获取请求消息还可以包含签约类型，签约类型为指示用户同意的签约类型。
签约信息获取请求消息可以为Nudm_SDM_Get Request消息。
S204：数据管理网元向授权校验网元发送签约数据获取响应消息，相应地，授权校验网元接受来自数据管理网元的签约数据获取响应消息。
其中，该签约数据获取响应消息包含用户同意信息。该签约数据获取响应消息可以为Nudm_SDM_Get Response消息。
例如，数据管理网元根据用户标识02获得用户的签约数据，签约数据包含用户同意信息。用户同意信息包含数据处理目的、用户同意结果，以及还包含允许的网络的标识。数据处理目的用于指示对用户数据处理的目的，例如包含数据分析、数据模型训练、数据读取、或数据共享等。用户同意结果用于指示用户是否同意基于该数据处理目的处理数据，例如，1代表同意，0代表不同意。允许的网络的标识的描述参见S200。
在一个示例中，用户同意信息如表1所示：
表1
在一种实现方式中，授权校验网元将获取的用户同意信息保存为UE的上下文，且可以将该UE的上下文提供给其他授权校验网元。
S205：授权校验网元根据用户同意信息，确定是否授权处理用户数据。
在第一种实现方式中，授权检验网元确定数据调用请求消息是否来源于允许的网络(即数据使用网元是否属于允许的网络)，从而确定是否授权处理用户数据(例如授权数据使用网元处理用户数据)。
其中，在数据调用请求消息来源于允许的网络以及用户同意基于数据调用请求的数据处理目的处理用户数据的情况下，授权数据使用网元处理用户数据；在数据调用请求消息不是来源于允许的网络，或者虽来源于允许的网络但用户不同意基于数据调用请求的数据处理目的处理用户数据的情况下，不授权数据使用网元处理用户数据。
该实现方式中，若授权校验网元与数据使用网元位于同一网络，那授权校验网元的具体判断可以如下：
(A1)授权校验网元判断自身是否属于允许的网络，若属于，进一步判断(A2)，若不属于，则不授权数据使用网元处理用户数据。
(A2)授权校验网元在用户同意信息中确定出数据调用请求的数据处理目的对应的用户同意结果是否为同意，若为同意，则授权数据使用网元处理用户数据；若不同意，则不授权数据使用网元处理用户数据。
结合表1的举例，假设授权校验网元位于网络PLMN A，那对应的(A1)和(A2)的判断可以为：
(A1)授权校验网元判断自身所在的网络PLMN A是否属于允许的网络，根据表1中的允许的网络标识确定属于，则进一步判断(A2)。
(A2)授权校验网元在用户同意信息中确定出数据调用请求的数据处理目的为目的#1，且对应的用户同意结果为同意，则授权数据使用网元处理用户数据。
或者，假设授权校验网元位于网络PLMN C，对应的(A1)和(A2)的判断可以为：
(A1)由于授权校验网元收到的用户同意信息中不包括PLMN C的标识，授权校验网元判断自身所在的网络PLMN C不属于允许的网络，则不授权数据使用网元处理用户数据。
可选地，授权校验网元可以通过数据调用请求消息本身的名称，或数据调用请求消息包含的操作指示，获得数据调用请求对应的数据处理目的。例如，若数据调用请求消息为Nnef_UEIdentifier_Get，则数据调用请求对应的数据处理目的为数据读取；若操作指示用于指示对用户数据的操作为分析，则数据调用请求对应的数据处理目的为数据分析。
该实现方式中，若授权校验网元与数据使用网元位于不同的网络，那授权校验网元可以在数据调用请求中获取数据使用网元所在网络的标识信息，该数据使用网元所在网络可以为所述数据使用网元所在的PLMN。在授权校验网元与数据使用网元位于不同的网络情况下，授权校验网元的具体判断可以如下：
(B1)授权校验网元判断数据使用网元是否属于允许的网络，若属于，进一步判断(B2)，若不属于，则不授权数据使用网元处理用户数据。
(B2)授权校验网元在用户同意信息中确定出数据调用请求的数据处理目的对应的用户同意结果是否为同意，若为同意，则授权数据使用网元处理用户数据；若不同意，则不授权数据使用网元处理用户数据。
可以理解的是，(B1)和(B2)的判断步骤与上述的(A1)和(A2)类似，区别在于授权校验网元判断的是自身所在的网络还是数据使用网元所在的网络是否属于允许的网络，对(B1)和(B2)的说明可参考上述对(A1)和(A2)的示例性描述，此处不作赘述。
在第二种实现方式中，授权校验网元确定自身是否属于允许的网络，从而确定是否授权处理用户数据(例如是否授权自身处理用户数据)。
其中，在授权检验网元自身属于允许的网络且用户同意基于数据调用请求的数据处理目的处理数据的情况下，授权自身处理用户数据；在授权检验网元自身不属于用户允许处理用户数据的网络，或者虽属于但是用户不同意基于数据调用请求的数据处理目的处理用户数据的情况下，不授权自身处理用户数据。
该实现方式中，授权校验网元的具体判断可以如下：
(C1)授权校验网元判断自身是否属于允许的网络，若属于，进一步判断(C2)，若不属于，则不授权自身处理用户数据。
(C2)授权校验网元确定出数据调用请求的数据处理目的对应的用户同意结果是否为同意，若为同意，则授权自身处理用户数据；若不同意，则不授权自身处理用户数据。
可以理解的是，(C1)和(C2)的判断步骤与上述的(A1)和(A2)相同，可参考上述对(A1)和(A2)的示例性描述，此处不作赘述。
在另一实现方式中，授权校验网元可以即确定自身是否属于允许的网络以及数据使用网元是否属于允许的网络，在两者都属于的情况下，确定授权处理用户数据的这一操作。需要说明的是，上述实现方式中，授权校验网元的判断顺序是先判断是否属于允许的网络， 后判断用户同意结果是否为同意。对于授权校验网元先判断数据调用请求的数据处理目的对应的用户同意结果是否为同意，再判断授权校验网元和/或数据使用网元是否属于允许的网络的方案，也被包含在本申请实施例的范围中，本申请实施例对判断的顺序不作限定。
授权处理用户数据，可以理解为对处理用户数据的相关网元的动作的授权、或者是对数据调用请求的授权、或者是对处理数据这个事件授权。其表现形式可以是处理用户数据的相关网元按正常流程执行数据调用请求。处理用户数据的相关网元可以包含授权校验网元，也可以包含数据使用网元。处理用户数据的相关网元的动作例如可以是授权校验网元根据数据调用请求消息获取用户数据，或者使用获取的用户数据进行数据分析，或者是使用获取的用户数据进行模型训练等；处理用户数据的相关网元的动作例如还可以是数据使用网元获取用户数据或数据分析结果或模型训练结果。
相应地，不授权处理用户数据，可以理解为对处理用户数据的相关网元的动作的不授权、或者是对数据调用请求的不授权、或者是对处理数据这个事件的授权。其表现形式可以是处理用户数据的相关网元未按正常流程执行数据调用请求。
具体地，授权处理用户数据的情况下，可以发起S206a。不授权处理用户数据的情况下，可以发起S206b，即授权校验网元向数据使用网元发送拒绝数据调用请求的消息，也可以是其他不授权方式。或者，在确定不授权的情况下，例如为依然发起S206a，即授权数据调用请求并根据数据调用请求消息发起数据请求，但记录该请求未经授权的事件，本申请对此不予限制。
根据步骤S205的判断，执行以下2个流程中的其中1个流程：
S206a：授权校验网元根据数据调用请求消息，向数据提供网元发送数据请求消息，用于请求数据调用请求消息所需要的用户数据01。
S206b：授权校验网元向数据使用网元发送拒绝数据调用请求的消息，用于拒绝S201中的数据调用请求消息。
其中，拒绝数据调用请求的消息可以包括一个指示数据使用网元不属于用户允许处理数据的网络的原因值。例如，原因值可以指示未授权的网络，或者指示数据使用网元不属于允许的网络等。数据使用网元在接收到上述原因值后，将终止数据调用请求。
S207：数据提供网元向授权校验网元提供用户数据01，相应地，授权校验网元接收来自数据提供者的用户数据01。
其中，用户数据01是获得用户数据02所需要的输入数据，用户数据02详见S208中的相关描述。
S208：授权校验网元向数据使用网元提供用户数据02，相应地，数据使用网元接收来自授权校验网元的用户数据02。
其中，用户数据02是数据调用消息请求消息所请求操作用户数据的结果。例如，数据使用网元线上购物平台服务器调用授权校验网元NEF开放的请求UE标识的API，例如为线上购物平台服务器调用NEF的Nnef_UEIdentifier_Get，并将user information设置为某个UE的IP地址，则用户数据01和用户数据02都可以是请求的IP地址对应的用户的标识信息。
又例如，数据使用网元PCF调用授权校验网元NWDAF提供的数据分析的API，并提供分析UE位置，例如为PCF调用NWDAF的Nnwdaf_AnalyticsSubscription_Subscribe，并将输入analytics ID设置为UE mobility analytics，Target of Analytics Reporting设置为某 个UE的SUPI)，则用户数据01为UE的位置信息，用户数据02为根据UE的位置信息得出的分析结果。
需要注意的是，S207和S208可以是在S205中确定授权处理用户数据的情况下，或者虽然S205中未授权处理用户数据但仍执行S206a的情况下执行。
根据图4所示的方法，在数据管理网元与授权校验网元位于不同的网络，或者数据管理网元与数据使用网元可以位于不同的网络的跨网络场景下，授权校验网元从数据管理网元处获取允许的网络的标识，并根据该允许的网络的标识，在授权过程中对当前处理用户数据的网元是否属于用户允许的网络进行校验。可以实现跨场景下对处理用户数据的授权。
可以理解的是，数据管理网元所在的网络保存用户同意信息，为允许处理用户数据的网络。如果授权校验网元和数据使用网元也位于数据管理网元所在的网络，那就无需对授权校验网元所在的网络或数据使用网元所在的网络进行校验。但是，本申请实施例并不排除授权校验网元和数据使用网元也位于数据管理网元所在的网络的场景，即该场景下，也可以对授权校验网元或数据使用网元所在的网络进行校验。
进一步地，因为授权校验网元根据该允许的网络的标识进行授权，提高了授权的准确性，避免了不被允许的网络处理用户数据带来的安全隐患。
同时，由于将检验放在了授权校验网元，用户同意信息可以作为UE的上下文在不同的授权校验网元之间进行迁移，从而减少授权校验网元重复请求用户同意信息的频率，减小对数据管理网元的影响。
本申请提供又一种授权处理用户数据的方法。图5为该方法的流程示意图，该方法中数据管理网元对当前处理用户数据的网络是否属于用户允许的网络进行校验，该方法包括以下步骤：
S300-S301同图4中的S200-S201，不作赘述。
S302：授权检验网元判断本地是否保存有UE的用户同意信息。
若授权校验网元的上下文中保存有UE的用户同意信息，则直接从上下文中获得用户同意信息，无需从数据管理网元获得用户同意信息。其中，用户同意信息详见S304中的相关描述。
若授权校验网元的上下文中没有保存有UE的用户同意信息，则执行S303-S304。
S303：授权校验网元向数据管理网元发送签约数据获取请求消息，相应地，数据管理网元接受来自授权校验网元的签约数据获取请求消息。
其中，该签约数据获取请求消息用于请求用户的签约数据。该签约数据获取请求消息可以包含用户标识02以及处理用户数据的网络的标识。其中，用户标识02可以与用户标识01相同，也可以是授权校验网元根据用户标识01转化的。例如，授权校验网元将GPSI转化为SUPI，本申请对此不作限制。处理用户数据的网络的标识用于标识处理用户数据的网元所在的网络，例如可以是授权校验网元所在的网络的标识，也可以是数据使用网元所在的网络的标识。
可选地，该签约数据获取请求消息还可以包含签约类型，签约类型为指示用户同意的签约类型。或者该签约数据获取请求消息还可以包含数据处理目的的指示信息，该指示信息用于指示处理数据的目的，也可以理解为用于指示S301中的数据调用请求消息对应的数据处理目的。该指示信息具体可以为数据调用请求消息包括的操作指示，或者是授权校 验网元根据该数据调用请求消息生成的一个新的信息，例如该新的信息和操作指示都可以指示对数据进行分析，但两者的形式可以不同。
例如，数据调用请求消息包括的操作指示#1，数据处理目的的指示信息也可以为操作指示#1。或者，数据处理目的的指示信息也可以为字符串#1，字符串#1指示操作指示#1指示的数据处理目的。
其中，数据管理网元所在的网络与处理用户数据的网络可以不为同一网络(例如不为同一PLMN或者切片)。
在一种实现方式中，若处理用户数据的网络的标识为授权校验网元所在的网络的标识，授权校验网元可以从自身的上下文中获得授权校验网元所在网络的标识。若处理用户数据的网络的标识为数据使用网元所在的网络的标识，授权校验网元可以从与数据使用网元交互的消息中获得数据使用网元所在网络的标识。例如，授权校验网元可以从S301中获得数据使用网元所在网络的标识。
可选地，授权校验网元所在网络的标识为授权校验网元所在PLMN的ID，该授权校验网元所在PLMN的ID可以包含于授权校验网元的标识中，即签约数据获取请求消息包含授权校验网元的标识，授权校验网元的标识包括授权校验网元所在PLMN的ID。授权校验网元的标识例如可以是NF ID。类似的，数据使用网元所在的网络的标识可以为数据使用网元所在PLMN的ID。
签约数据获取请求消息可以为Nudm_SDM_Get Request消息。
S304：数据管理网元获取用户同意信息02。
例如，数据管理网元根据用户标识02获得用户的签约数据，签约数据包括用户同意信息01，用户同意信息01包含数据处理目的01以及用户同意结果01。其中，数据处理目的01可以包含一个或多个数据处理目的，对应的用户同意结果01也可以包括一个或多个用户同意结果。额外地，签约数据还包含允许的网络的标识。
数据管理网元根据处理用户数据的网络的标识以及允许的网络的标识，确定用户同意信息02中的用户同意结果02。
例如，数据管理网元根据允许的网络的标识是否包含处理用户数据的网络的标识，确定用户同意信息02中的用户同意结果02。若允许的网络的标识不包含处理用户数据的网络的标识，则数据管理网元构造不同意的用户同意结果02；若允许的网络的标识包含处理用户数据的网络的标识，则数据管理网元获得数据处理目的02以及用户同意结果02。
其中，在允许的网络的标识不包含处理用户数据的网络的标识的情况下，数据管理网元构造为不同意的用户同意结果02可以采用如下方式。
第一种实现方式为：数据管理网元根据预配置的数据处理目的03构造其对应的不同意的用户同意结果02。其中，预配置的数据处理目的03可以是该网络支持的所有数据处理目的。
例如，用户同意信息01为表1所示所示，所示，处理用户数据的网络的标识为PLMN C，不属于允许的网络的标识PLMN A和PLMN B。预配置的数据处理目的03为目的#1、目的#2和目的#3，则数据管理网元构造用户同意结果02为不同意，即构造目的#1、目的#2和目的#3分别对应于不同意的用户同意结果。该示例中，包含用户同意结果02的用户同意信息02可如表2所示。

表2
第二种实现方式为：数据管理网元根据允许的网络的标识对应的数据处理目的04构造其对应的不同意的用户同意结果02。
例如，用户同意信息01为表1所示。处理用户数据的网络的标识为PLMN C，不属于允许的网络的标识PLMN A和PLMN B。数据管理网元获得PLMN A或PLMN B对应的数据处理目的。若数据管理网元获得PLMN A的数据处理目的#1和#2，且构造用户同意结果02为不同意，即构造目的#1和目的#2分别对应于不同意的用户同意结果，包含该用户同意结果02的用户同意信息02可如表3所示。
表3
第三种实现方式为：若签约数据获取请求消息包含了数据处理目的的指示信息，数据管理网元根据该数据处理目的的指示信息构造数据调用请求的数据处理目的对应的不同意的用户同意结果02。
例如，用户同意信息01为表1所示。处理用户数据的网络的标识为PLMN C，不属于允许的网络的标识PLMN A和PLMN B。例如，数据管理网元根据签约数据获取请求消息获得数据调用请求的数据处理目的为目的#1，并构造该目的#1对应的不同意的用户同意结果02，包含该用户同意结果02的用户同意信息02可如表4所示。
表4
需要说明的是，如果数据管理网元构造为不同意的用户同意结果02，用户同意信息02可以不包括数据处理目的。
在允许的网络的标识包含处理用户数据的网络的标识的情况下，数据管理网元获得数据处理目的02以及用户同意结果02可以采用如下方式。。
第一种方式为：数据管理网元获得允许的网络的标识(例如处理用户数据的网络的标识)所对应的数据处理目的02以及该数据处理目的02对应的用户同意结果02。
例如，用户同意信息01为表1所示。处理用户数据的网络的标识为PLMN A，属于允许的网络的标识。数据管理网元获得PLMN A对应的数据处理目的02和用户同意结果02，且该数据处理目的包括目的#1和目的#2，该用户同意信息02包括目的#1对应的且为同意的用户同意结果以及目的#2对应的且为不同意的用户同意结果。该示例中，用户同意信息02可以如表5所示：。
表5
第二种方式为：若签约数据获取请求消息包含了数据处理目的的指示信息，数据管理网元根据该数据处理目的的指示信息获得数据调用请求的数据处理目的(即数据处理目的02)及其对应的用户同意结果02。
例如，用户同意信息01为表1所示。处理用户数据的网络的标识为PLMN A，属于允许的网络的标识。数据管理网元获取的数据调用请求的数据处理目的02为目的#1，数据管理网元根据用户同意信息01获取目的#1对应的用户同意结果02为同意。该示例中，用户同意信息02可以如表6所示：
表6
需要说明的是，该示例中，用户同意信息02可以仅包括为同意的用户同意结果，不包括处理处理目的02。
S305：数据管理网元向授权校验网元发送签约数据获取响应消息，相应地，授权校验网元接收来自数据管理网元的签约数据获取响应消息。
其中，该签约数据获取响应消息包含S304中获得的用户同意信息02。签约数据获取响应消息可以为Nudm_SDM_Get Response消息。
S306：授权校验网元根据用户同意信息02，确定是否授权处理用户数据。
在第一种实现方式中，如果用户同意信息02包括用户同意结果02，则授权校验网元根据用户同意结果02确定用户是否同意当前调用。若不同意，则不授权处理用户数据。若同意，即授权处理用户数据。
在第二种实现方式中，如果用户同意信息02包括数据处理目的02和用户同意结果02，则授权校验网元的具体判断如下：
授权校验网元根据数据调用请求消息的数据处理目的、数据处理目的02及用户同意结果02判断用户是否同意当前调用。若不同意，则不授权处理用户数据，若同意，则授权处理用户数据。
可选地，授权校验网元可以通过数据调用请求消息本身的名称，或数据调用请求消息包含的操作指示，获得数据调用请求的数据处理目的。
其中，关于授权处理用户数据和不授权处理用户数据的理解，可以参考S205中的描述，此处不作赘述。
具体地，授权处理用户数据的情况下，可以发起S307a，不授权处理用户数据的情况下可以发起S307b，即授权校验网元向数据使用网元发送拒绝数据调用请求的消息，也可以是其他不授权方式。其他不授权方式例如为依然发起S307a，即授权数据调用请求并根据数据调用请求消息发起数据请求，但记录该请求未经授权的事件，本申请对此不予限制。
根据步骤S306的判断，执行以下2个流程中的其中1个流程：
S307a：授权校验网元根据数据调用请求消息，向数据提供网元发送数据请求消息，用于请求数据调用请求消息所需要的用户数据01。
S307b：授权校验网元向数据使用网元发送拒绝数据调用请求的消息，用于拒绝S201中的数据调用请求消息。
其中，拒绝数据调用请求的消息可以包括一个指示数据使用网元不属于用户允许处理数据的网络的原因值。例如，该原因值可以指示未授权的网络，或者指示数据使用网元不 属于允许的网络等。数据使用网元在接收到上述原因值后，将终止数据调用请求。
S308-S309可参考S207-S208，此处不作赘述。
需要注意的是，S308和S309可以是在S306中确定授权处理用户数据的情况下，或者虽然S306中未授权处理用户数据但仍执行S307a的情况下执行。
根据图5所示的方法，在数据管理网元所在的网络与处理用户数据的网络可以不为同一网络的跨网络场景下，数据管理网元根据允许的网络的标识，在向授权校验网元提供签约数据的过程中对当前处理用户数据的网络是否属于用户允许的网络进行校验。数据管理网元基于该校验结果向授权校验网元提供用户同意结果，以使得授权校验网元根据该用户同意结果确定是否授权处理用户数据，因此可以实现跨网络的场景下对处理用户数据的授权。
可以理解的是，数据管理网元所在的网络保存用户同意信息，为允许处理用户数据的网络。如果处理用户数据的网络为数据管理网元所在的网络，那就无需对处理用户数据的网络进行校验。但是，本申请实施例并不排除处理用户数据的网络为数据管理网元所在的网络的场景，即该场景下，也可以对处理用户数据的网络进行校验。
进一步地，因为数据管理网元根据该允许的网络的标识确定用户同意结果，提高了授权的准确性，避免了不被允许的网络处理用户数据带来的安全隐患。
此外，本申请提供又一种授权处理用户数据的方法。图6为该方法的流程示意图，该方法中数据管理网元对当前处理用户数据的网络是否属于用户允许的网络进行校验，且向授权校验网元提供允许的网络的标识，以使得授权校验网元再基于该允许的网络的标识确定是否授权处理用户数据，该方法包括以下步骤：
S400-S403同图5中的S300-S303，不作赘述。
S404：数据管理网元获取用户同意信息02。
例如，数据管理网元根据用户标识02获得用户的签约数据，签约数据包括用户同意信息01，用户同意信息01包含数据处理目的01以及用户同意结果01。其中，数据处理目的01可以包含一个或多个数据处理目的，对应的用户同意结果01也可以包括一个或多个用户同意结果。额外地，签约数据还包含允许的网络的标识01。
数据管理网元根据处理用户数据的网络的标识以及允许的网络的标识，确定用户同意信息02中的用户同意结果02。例如，数据管理网元根据允许的网络的标识是否包含处理用户数据的网络的标识，确定用户同意信息02中的用户同意结果02。若允许的网络的标识不包含处理用户数据的网络的标识，则数据管理网元构造不同意的用户同意结果02；若允许的网络的标识包含处理用户数据的网络的标识，则数据管理网元获得允许的网络的标识02、数据处理目的02以及用户同意结果02。
其中，数据管理网元所在的网络与处理用户数据的网络可以不为同一网络(例如不为同一PLMN或者切片)。
其中，在允许的网络的标识不包含处理用户数据的网络的标识的情况下，数据管理网元构造为不同意的用户同意结果02可以采用如下方式。
第一种实现方式为：数据管理网元根据预配置的数据处理目的03构造其对应的不同意的用户同意结果02。其中，预配置的数据处理目的03可以是该网络支持的所有数据处理目的。
例如，用户同意信息01为表1所示，处理用户数据的网络的标识为PLMN C，不属于允许的网络的标识PLMN A和PLMN B。预配置的数据处理目的03为目的#1、目的#2和目的#3，则数据管理网元构造用户同意结果02为不同意，即构造目的#1、目的#2和目的#3分别对应于不同意的用户同意结果。该示例中，包含用户同意结果02的用户同意信息02可如表7所示。
表7
需要注意的是，该示例中，数据管理网元还构造用户同意信息02中的允许的网络标识为处理用户数据的网络的标识PLMN C。
第二种实现方式为：数据管理网元根据允许的网络的标识对应的数据处理目的04构造其对应的不同意的用户同意结果02。
例如，用户同意信息01为表1所示。处理用户数据的网络的标识为PLMN C，不属于允许的网络的标识PLMN A和PLMN B。数据管理网元获得PLMN A或PLMN B对应的数据处理目的。若数据管理网元获得PLMN A的数据处理目的#1和#2，且构造用户同意结果02为不同意，即构造目的#1和目的#2分别对应于不同意的用户同意结果，包含该用户同意结果02的用户同意信息02可如表8所示。
表8
需要注意的是，该示例中，数据管理网元可以构造用户同意信息02中的允许的网络标识为处理用户数据的网络的标识PLMN C。
第三种实现方式为：若签约数据获取请求消息包含了数据处理目的的指示信息，数据管理网元根据该数据处理目的的指示信息构造数据调用请求的数据处理目的对应的不同意的用户同意结果02。关于数据处理目的的指示信息，可参考S303中的描述。
例如，用户同意信息01为表1所示。处理用户数据的网络的标识为PLMN C，不属于允许的网络的标识PLMN A和PLMN B。例如，数据管理网元根据签约数据获取请求消息获得数据调用请求的数据处理目的为目的#1，并构造该目的#1对应的不同意的用户同意结果02，包含该用户同意结果02的用户同意信息02可如表9所示。
表9
需要注意的是，该示例中，数据管理网元可以构造用户同意信息02中的允许的网络标识为处理用户数据的网络的标识PLMN C。
需要说明的是，如果数据管理网元构造为不同意的用户同意结果02，用户同意信息 02可以不包括数据处理目的。
在允许的网络的标识包含处理用户数据的网络的标识的情况下，数据管理网元获得允许的网络的标识02、数据处理目的02以及用户同意结果02可以采用如下方式。
第一种方式为：允许的网络的标识02为处理用户数据的网络的标识，数据管理网元根据处理用户数据的网络的标识获取数据处理目的02及其对应的用户同意结果02。
例如，用户同意信息01为表1所示,处理用户数据的网络的标识为PLMN A，属于允许的网络的标识。数据管理网元获得PLMN A对应的数据处理目的02和用户同意结果02，且该数据处理目的02包括目的#1和目的#2，该用户同意信息02包括目的#1对应的且为同意的用户同意结果以及目的#2对应的且为不同意的用户同意结果。该示例中，用户同意信息02可以如表10所示：。
表10
第二种方式为：若签约数据获取请求消息包含了数据处理目的的指示信息，数据管理网元根据处理用户数据的网络的标识以及该数据处理目的的指示信息获得数据调用请求的数据处理目的(即数据处理目的02)及其对应的用户同意结果02。
例如，用户同意信息01为表1所示。处理用户数据的网络的标识为PLMN A，属于允许的网络的标识。数据管理网元获得PLMN A对应的数据处理目的为目的#1和目的#2，再根据数据调用请求的数据处理目的02为目的#1，获取目的#1对应的用户同意结果02为同意。该示例中，用户同意信息02可以如表11所示：
表11
需要说明的是，该示例中，用户同意信息02可以仅包括为PLMN A的允许的网络的标识02以及为同意的用户同意结果02，可以不包括处理处理目的02。
S405：数据管理网元向授权校验网元发送签约数据获取响应消息，相应地，授权校验网元接收来自授权存储者的签约数据获取响应消息。
其中，该签约数据获取响应消息包含S304中获得的用户同意信息02。签约数据获取响应消息可以为Nudm_SDM_Get Response消息。
且可以理解的是，该用户同意信息02包含了允许的网络的标识。
S406：授权校验网元根据用户同意信息02，确定是否授权处理用户数据。
可以理解的是，S406与S306的区别在于，S406中的用户同意信息02包括了允许的网络的标识信息。在授权校验网元根据用户同意结果02确定是否授权处理用户数据之前，授权校验网元需要根据用户同意信息02包含的允许的网络的标识，确定数据使用网元或者授权校验网元是否属于允许的网络。
其中，授权校验网元可以根据该允许的网络的标识，确定数据调用请求消息是否来源于允许的网络(即数据使用网元是否属于允许的网络)，或者确定自身是否属于允许的网络。如果确定数据调用请求来源于允许的网络，或者确定自身属于允许的网络，则授权校 验网元再根据用户同意结果02确定是否授权处理用户数据。
关于授权校验网元可以根据该允许的网络的标识，确定数据调用请求消息是否来源于允许的网络，或者确定自身是否属于允许的网络可以参考S205中的相关描述。关于授权校验网元根据用户同意结果02确定是否授权处理用户数据，可以参考S306中的相关描述，此处不作赘述。
具体地，授权处理用户数据的情况下，可以发起407a，不授权处理用户数据的情况下可以发起S407b，即授权校验网元向数据使用网元发送拒绝数据调用请求的消息，也可以是其他不授权方式。其他不授权方式例如为依然发起S407a，即授权数据调用请求并根据数据调用请求消息发起数据请求，但记录该请求未经授权的事件，本申请对此不予限制。
根据步骤S406的判断，执行以下2个流程中的其中1个流程：
S407a：授权校验网元根据数据调用请求消息，向数据提供者发送数据请求消息，用于请求数据调用请求消息所需要的用户数据01。
S407b：授权校验网元向数据使用网元发送拒绝数据调用请求的消息，用于拒绝S201中的数据调用请求消息。
其中，拒绝数据调用请求的消息可以包括一个指示数据使用网元不属于用户允许处理数据的网络的原因值。例如，该原因值可以指示未授权的网络，或者指示数据使用网元不属于允许的网络等。数据使用网元在接收到上述原因值后，将终止数据调用请求。
S408-S409可参考S207-S208，此处不作赘述。
需要注意的是，S408和S409可以是在S406中确定授权处理用户数据的情况下，或者虽然S406中未授权处理用户数据但仍执行S407a的情况下执行。
根据图6所示的方法，在数据管理网元所在的网络与处理用户数据的网络可以不为同一网络的跨网络场景下，数据管理网元向授权校验网元提供签约数据的过程中对当前处理用户数据的网络是否为用户允许的网络进行校验，以及在授权校验网元授权过程中对当前处理用户数据的网元是否属于用户允许的网络进行校验。因此可以实现跨网络的场景下对处理用户数据的授权，并双重保证了授权的安全性和准确性。
在图4所示方法的基础上，本申请实施例提供又一种授权处理用户数据的方法。图7为该方法的流程示意图，该方法包括以下步骤：
S501：数据使用网元向授权校验网元发送用于触发处理用户数据的请求消息，相应地，授权校验网元接收来自数据使用网元的该请求消息。
其中，
用于触发处理用户数据的请求消息可以是S201中的数据调用请求消息，该请求消息可以包含用户标识，以及可选地包含操作指示和/或数据使用网元所在的网络的标识，该操作指示可以指示该请求消息的数据处理目的。关于该请求消息详细介绍可参考S201中的描述，此处不作赘述。
S502：授权校验网元获取来自数据管理网元的用户允许处理用户数据的网络(以下简称允许的网络)的标识信息、数据处理目的以及用户同意结果。
其中，数据处理目的用于指示处理用户数据的目的，例如为数据分析、数据模型训练、或数据读取等。用户同意结果用于指示用户是否同意基于数据处理目的处理用户数据，例如可以为同意或者不同意。关于允许的网络的标识信息可以参考S200中的用户允许处理 用户数据的网络的标识，此处不作赘述。
在一种实现方式中，授权校验网元从本地获取允许的网络的标识信息、数据处理目的和用户同意结果，该本地获取的允许的网络的标识信息、数据处理目的和用户同意结果可以是授权检验网元先前从数据管理网元处获取的。
在另一种实现方式中，授权校验网元向数据管理网元请求用户签约数据，授权检验网元接收来自数据管理网元的用户签约数据，该用户签约数据包括允许的网络的标识信息、数据处理目的和用户同意结果。
示例性地，数据管理网元与授权校验网元不在同一网络，或者数据管理网元与数据使用网元不在同一网络。
S503：授权校验网元根据允许的网络的标识信息确定是否授权处理用户数据。
在一种实现方式中，授权校验网元根据该允许的网络的标识信息确定S501中的请求消息是否来源于该允许的网络。如果该请求消息来源于该允许的网络，则进一步根据用户同意结果确定是否授权处理用户数据；如果该请求消息不是来源于该允许的网络，则不授权处理用户数据。
可选地，该实现方式中，数据使用网元和授权校验网元可以位于同一网络，那确定请求消息是否来源于该允许的网络可以包括：确定授权校验网元是否属于该允许的网络。如果授权校验网元属于该允许的网络，则确定该请求消息来源于允许的网络；如果授权校验网元不属于该允许的网络，则确定该请求消息不是来源于允许的网络。
可选地，该实现方式中，数据使用网元和授权校验网元可以位于不同网络，那确定请求消息是否来源于该允许的网络可以包括：授权校验网元获取数据使用网元所在网络的标识，并根据该数据使用网元所在网络的标识确定数据使用网元是否属于该允许的网络。如果确定数据使用网元属于该允许的网络，则确定该请求消息来自于该允许的网络；如果确定数据使用网元不属于该允许的网络，则确定该请求消息不是来源于该允许的网络。其中，授权校验网元可以在S501中获取请求消息所携带的数据使用网元所在网络的标识，或者根据该请求消息的来源获取数据使用网元所在网络的标识。
关于该实现方式还可以参考S205中的相关介绍，此处不作赘述。
在另一种实现方式中，授权校验网元根据该允许的网络的标识信息确定自身是否属于该允许的网络。如果自身属于该允许的网络，则进一步根据用户同意结果确定是否授权处理用户数据；如果自身不属于该允许的网络，则不授权处理用户数据。
关于该实现方式还可以参考S205中的相关介绍，此处不作赘述。其中，授权处理用户数据，可以理解为对处理用户数据的相关网元的动作的授权、或者是对数据调用请求的授权、或者是对处理数据这个事件授权。其表现形式可以是处理用户数据的相关网元按正常流程执行数据调用请求。处理用户数据的相关网元可以包含授权校验网元，也可以包含数据使用网元。处理用户数据的相关网元的动作例如可以是授权校验网元根据数据调用请求消息获取用户数据，或者使用获取的用户数据进行数据分析，或者是使用获取的用户数据进行模型训练等；处理用户数据的相关网元的动作例如还可以是数据使用网元获取用户数据或数据分析结果或模型训练结果。
相应地，不授权处理用户数据，可以理解为对处理用户数据的相关网元的动作的不授权、或者是对数据调用请求的不授权、或者是对处理数据这个事件的授权。其表现形式可以是处理用户数据的相关网元未按正常流程执行数据调用请求。
其中，授权校验网元根据用户同意结果确定是否授权处理用户数据例如可以为：授权校验网元根据请求消息所对应的数据处理目的(例如为数据处理目的05)以及S502中获取的数据处理目的以及用户同意结果，确定数据处理目的05的用户同意结果03，若该用户同意结果03为同意，则授权处理用户数据，若该用户同意结果03为不同意，则不授权处理用户数据。授权校验网元可以通过请求消息的名称或者请求消息中的操作指示获知请求消息所对应的数据处理目的。
其中，不授权处理用户数据可以包括向数据使用网元发送拒绝处理用户数据的消息，该拒绝处理用户数据的消息可以包括拒绝的原因值，该原因值指示数据使用网元不是来自于用户允许处理用户数据的网络。或者不授权处理用户数据可以包括记录处理用户数据未被授权的事件或者记录请求消息未被授权的事件。
在授权处理用户数据或者记录用户处理处理数据未被授权的情况下，授权校验网元向数据提供网元请求用户数据，并基于该用户数据进行处理，例如进行分析或训练模型。授权检验网元进而将用户数据进行处理的结果反馈给数据使用网元。该结果例如是数据的分析结果或者训练出的模型，可以理解的是，该结果也为用户数据。
关于授权处理用户数据和不授权处理用户数据，还可以参考S205至S208中的相关介绍，此处不作赘述。
根据图7所示的方法，在数据管理网元与授权校验网元不在同一网络，或者数据管理网元与数据使用网元不在同一网络的场景下，授权校验网元从数据管理网元处获取允许的网络的标识信息，并根据该允许的网络的标识信息，对当前处理用户数据的网元是否属于用户允许的网络进行校验，可以实现跨网络场景下对处理用户数据的授权。
在图5和图6所示方法的基础上，本申请实施例提供又一种授权处理用户数据的方法。图8为该方法的流程示意图，该方法包括以下步骤：
S601：授权校验网元向数据管理网元发送用户的标识信息和第一网络的标识信息，相应地，数据管理网元接收来自授权校验网元的用户的标识信息和第一网络的标识信息。
其中，第一网络的标识信息用于标识处理该用户的数据的网络，可以为数据使用网元所在的网络和/或授权检验网元所在的网络。用户的标识信息可以为SUPI或GPSI。
在一种实现方式中，授权校验网元向数据管理网元发送用户的标识信息和第一网络的标识信息前，接收来自数据使用网元的用于触发处理用户数据的请求消息。关于该请求消息，可参考S501中的描述，此处不作赘述。
在一种实现方式中，授权检验网元向数据管理网元发送签约数据获取请求消息，该签约数据获取请求消息包括用户的标识信息和第一网络的标识信息。可选地，该签约数据获取请求消息包括数据处理目的的指示信息，该指示信息用于指示处理数据的目的，也可以理解为指示用于触发处理用户数据的请求消息对应的数据处理目的。关于该实现方式，可参考S303中的描述，此处不作赘述。
在一种实现方式中，所述数据管理网元所在的网络与所述处理所述用户的数据的网络不为同一网络。
S602：数据管理网元根据第一网络的标识信息和第二网络的标识信息，确定第一用户同意结果。
其中，第二网络的标识信息用于标识用户允许处理用户数据的网络，第一用户同意结 果指示在第一网络中用户是否同意基于第一数据处理目的处理第一用户的数据。
如果数据管理网元确定第二网络的标识信息包含所述第一网络的标识信息，即意味着用户允许第一网络处理用户数据，则数据管理网元确定第一网络的标识信息对应的一个或多个数据处理目的为第一数据处理目的，确定一个或多个数据处理目的对应的用户同意结果为第一用户同意结果。
如果数据管理网元确定第二网络的标识信息不包含第一网络的标识信息，即意味着用户不允许第一网络处理用户数据，则数据管理网元可以确定第二网络的标识信息对应的数据处理目的或预配置的数据处理目的为第一数据处理目的，且第一用户同意结果为不同意。或者，数据管理网元可以确定第一用户同意结果为不同意，而不确定第一数据处理目的。
在一种实现方式中，S601中的签约数据获取请求消息还包括第一数据处理目的(即为数据处理目的的指示信息指示的目的)。在该实现方式中，如果数据管理网元确定第二网络的标识信息包含所述第一网络的标识信息，则数据管理网元确定第一数据处理目的对应的用户同意结果为第一用户同意结果。如果第二网络的标识信息不包含第一网络的标识信息，则所述数据管理网元确定第一用户同意结果为不同意。
关于确定第一用户同意结果，可参考S304或S404中的相关描述，此处不作赘述。
S603：数据管理网元向授权校验网元发送第一用户同意结果，相应地，授权校验网元接收来自数据管理网元的第一用户同意结果。
其中，可选地，如果S602中数据管理网元也确定出了第一处理目的，则数据管理网元向授权校验网元发送第一数据处理目的和第一用户同意结果。
在一种实现方式中，数据管理网元还向授权校验网元发送允许的网络的标识#1(可能包括用户允许处理数据的网络或者用户不允许处理数据的网络，在用户不允许的情况下，该标识#1可以是数据管理网元构造的)。该允许的网络的标识#1用于授权校验网元确定是否授权处理用户数据。
例如，该允许的网络的标识#1可以包括第一网络的标识信息。如果数据管理网元确定第二网络的标识信息不包含所述第一网络的标识信息，数据管理网元也可以向授权校验网元发送该第一网络的标识。授权校验网元根据该第一网络的标识确定是否授权处理用户数据，这样可以不改变授权校验网元根据允许的网络的标识以及用户同意结果确定是否授权处理用户数据的逻辑。如果数据管理网元确定第二网络的标识信息包含所述第一网络的标识信息的情况下，数据管理网元可以向授权校验网元发送该第一网络的标识。授权校验网元根据该第一网络的标识确定数据使用网元和/或授权校验网元所在的网络是否属于该第一网络，这样可以实现双重校验。S604：授权校验网元根据第一用户同意结果，确定是否授权处理用户数据。
例如，如果授权校验网元接收第一用户同意结果，则授权校验网元确定第一用户同意结果是否为不同意，若为不同意，则不授权处理用户数据，若为同意，则授权处理用户数据；如果授权校验网元接收第一数据处理目的和第一用户同意结果，则授权校验网元根据该第一数据处理目的和第一用户同意结果确定请求消息的数据处理目的所对应的用户同意结果，若该用户同意结果为不同意，则不授权处理用户数据，若为同意，则授权处理用户数据。关于授权校验网元根据第一用户同意结果确定是否授权处理用户数据，还可参考S306和S406中相关描述，此处不作赘述。
在一种实现方式中，授权校验网元接收来自数据管理网元的允许的网络的标识#1。那 么在根据第一用户同意结果确定是否授权处理用户前，授权校验网元可以确定允许的网络的标识#1是否包括数据使用网元所在的网络/授权校验网元所在的网络。该具体判断可参照S503中的相关描述，此处不作赘述。
其中，关于授权处理用户数据和不授权处理用户数据可参考S503中的相关描述，此处不作赘述。
根据图8所示的方法，所述数据管理网元所在的网络与所述处理所述用户的数据的网络不为同一网络的跨网络场景下，数据管理网元根据允许的网络的标识信息，对当前处理用户数据的网络是否属于用户允许的网络进行校验。数据管理网元基于该校验结果向授权校验网元提供用户同意结果，以使得授权校验网元根据该用户同意结果确定是否授权处理用户数据，因此可以实现跨网络场景下对处理用户数据的授权。
以上，结合图3至图8详细说明了本申请实施例提供的方法。以下，结合图9至图10详细说明本申请实施例提供的装置。应理解，装置实施例的描述与方法实施例的描述相互对应，因此，未详细描述的内容可以参见上文方法实施例，为了简洁，这里不再赘述。
如图9所示，通信装置900包括处理单元910和收发单元920。通信装置900用于实现上述方法实施例中授权校验网元、数据管理网元或数据使用网元的功能，也可以是应用于授权校验网元、数据管理网元或数据使用网元的模块(如芯片)。
在第一个实施例中，该通信装置用于执行授权校验网元的功能，收发单元920用于接收来自数据使用网元的用于触发处理用户数据的请求消息；处理单元910用于获取来自数据管理网元的用户允许处理该用户数据的网络的标识信息、数据处理目的以及用户同意结果，该数据处理目的用于指示处理该用户数据的目的，该用户同意结果用于指示该用户是否同意基于该数据处理目的处理该用户数据；以及用于根据该网络的标识信息确定是否授权处理该用户数据。。
在一种可能的实现方法中，处理单元910还用于根据该网络的标识信息确定该请求消息是否来自于该网络的标识信息指示的网络；若该请求消息来自于该网络的标识信息指示的网络，则根据该用户同意结果确定是否授权处理该用户数据；若该请求消息不是来自于该网络的标识信息指示的网络，则不授权处理该用户数据。
在一种可能的实现方法中，若该通信装置属于该网络的标识信息指示的网络，则处理单元910还用于确定该请求消息来自于该网络的标识信息指示的网络；若该授权校验网元不属于该网络的标识信息指示的网络，则处理单元910还用于确定该请求消息不是来自于该网络的标识信息指示的网络。
在一种可能的实现方式中，该数据使用网元和该通信装置位于同一网络。
在一种可能的实现方式中，处理单元910还用于获取该数据使用网元所在网络的标识；若根据该数据使用网元所在网络的标识确定该数据使用网元属于该网络的标识信息指示的网络，则确定该请求消息来自于该网络的标识信息指示的网络；若根据该数据使用网元所在网络的标识确定该数据使用网元不属于该网络的标识信息指示的网络，则确定该请求消息不是来自于该网络的标识信息指示的网络。
在一种可能的实现方式中，该请求消息包括该数据使用网元所在网络的标识。
在一种可能的实现方式中，收发单元920还用于向该数据使用网元发送拒绝消息，该拒绝消息包含拒绝原因值，该拒绝原因值用于指示该数据使用网元不是来自于该用户允许 处理该用户数据的网络。
在一种可能的实现方式中，处理单元910还用于记录处理该用户数据未授权的事件。
在一种可能的实现方式中，收发单元920还用于向数据提供网元请求该用户数据；以及接收来自该数据提供网元的该用户数据。
在一种可能的实现方式中，该数据使用网元和该数据管理网元位于不同的网络。
在一种可能的实现方式中，收发单元920还用于向该数据管理网元请求用户签约数据；以及接收来自该数据管理网元的用户签约数据，该用户签约数据包括该网络的标识信息、该数据处理目的以及该用户同意结果。
在一种可能的实现方式中，该网络的标识信息为公共陆地移动网PLMN的标识ID。
在第二个实施例中，该通信装置用于执行数据管理网元的功能，收发单元920用于接收来自授权校验网元的用户的标识信息以及第一网络的标识信息，该第一网络的标识信息用于标识处理该用户的数据的网络；处理单元910用于根据该第一网络的标识信息和第二网络的标识信息，确定第一用户同意结果，该第二网络的标识信息用于标识该用户允许处理该用户的数据的网络，该第一用户同意结果指示在该第一网络中该用户是否同意基于第一数据处理目的处理该用户的数据；收发单元920还用于向该授权校验网元发送该第一用户同意结果。
在一种可能的实现方法中，若该第二网络的标识信息包含该第一网络的标识信息，则处理单元910还用于确定该第一网络的标识信息对应的一个或多个数据处理目的为该第一数据处理目的，确定该一个或多个数据处理目的对应的用户同意结果为该第一用户同意结果；若该第二网络的标识信息不包含该第一网络的标识信息，则处理单元910还用于确定该第二网络的标识信息对应的数据处理目的为该第一数据处理目的，且确定该第一用户同意结果为不同意。
在一种可能的实现方法中，收发单元920还用于向该授权校验网元发送该第一数据处理目的和该第一用户同意结果。
在一种可能的实现方法中，收发单元920还用于接收来自该授权校验网元的消息，该消息包括该用户的标识信息、该第一网络的标识信息以及该第一数据处理目的；若该第二网络的标识信息包含该第一网络的标识信息，则处理单元910还用于确定该第一数据处理目的对应的用户同意结果为该第一用户同意结果；若该第二网络的标识信息不包含该第一网络的标识信息，则处理单元910还用于确定该第一用户同意结果为不同意。
在一种可能的实现方式中，收发单元920还用于向该授权校验网元发送用于确定是否授权处理该用户的数据的网络的标识信息。
在一种可能的实现方式中，该第二网络的标识信息为该用户允许处理该用户的数据的公共陆地移动网PLMN的标识ID。
在一种可能的实现方式中，该第一网络的标识信息为该授权校验网元所在的公共陆地移动网PLMN的标识ID或触发处理该第一数据的网元所在的公共陆地移动网PLMN的标识ID。
有关上述处理单元910和收发单元920更详细的描述可以直接参考上述方法实施例中相关描述直接得到，这里不加赘述。
如图10所示，通信装置1000包括处理器1010和接口电路1020。处理器1010和接口电路1020之间相互耦合。可以理解的是，接口电路1020可以为收发器或输入输出接口。 可选的，通信装置1000还可以包括存储器1030，用于存储处理器1010执行的指令或存储处理器1010运行指令所需要的输入数据或存储处理器1010运行指令后产生的数据。
当通信装置1000用于实现上述方法实施例时，处理器1010用于实现上述处理单元910的功能，接口电路1020用于实现上述收发单元920的功能。
可以理解的是，本申请的实施例中的处理器可以是中央处理单元(central processing unit，CPU)，还可以是其它通用处理器、数字信号处理器(digital signal processor，DSP)、专用集成电路(application specific integrated circuit，ASIC)、现场可编程门阵列(field programmable gate array，FPGA)或者其它可编程逻辑器件、晶体管逻辑器件，硬件部件或者其任意组合。通用处理器可以是微处理器，也可以是任何常规的处理器。
本申请的实施例中的方法步骤可以通过硬件的方式来实现，也可以由处理器执行软件指令的方式来实现。软件指令可以由相应的软件模块组成，软件模块可以被存放于随机存取存储器、闪存、只读存储器、可编程只读存储器、可擦除可编程只读存储器、电可擦除可编程只读存储器、寄存器、硬盘、移动硬盘、CD-ROM或者本领域熟知的任何其它形式的存储介质中。一种示例性的存储介质耦合至处理器，从而使处理器能够从该存储介质读取信息，且可向该存储介质写入信息。当然，存储介质也可以是处理器的组成部分。处理器和存储介质可以位于ASIC中。另外，该ASIC可以位于基站或终端中。当然，处理器和存储介质也可以作为分立组件存在于基站或终端中。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机程序或指令。在计算机上加载和执行所述计算机程序或指令时，全部或部分地执行本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、基站、用户设备或者其它可编程装置。所述计算机程序或指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机程序或指令可以从一个网站站点、计算机、服务器或数据中心通过有线或无线方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是集成一个或多个可用介质的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，例如，软盘、硬盘、磁带；也可以是光介质，例如，数字视频光盘；还可以是半导体介质，例如，固态硬盘。该计算机可读存储介质可以是易失性或非易失性存储介质，或可包括易失性和非易失性两种类型的存储介质。
在本申请的各个实施例中，如果没有特殊说明以及逻辑冲突，不同的实施例之间的术语和/或描述具有一致性、且可以相互引用，不同的实施例中的技术特征根据其内在的逻辑关系可以组合形成新的实施例。

Claims (28)

  1. 一种授权的方法，其特征在于，包括：
    授权校验网元接收来自数据使用网元的用于触发处理用户数据的请求消息；
    所述授权校验网元获取来自数据管理网元的用户允许处理所述用户数据的网络的标识信息、数据处理目的以及用户同意结果，所述数据处理目的用于指示处理所述用户数据的目的，所述用户同意结果用于指示所述用户是否同意基于所述数据处理目的处理所述用户数据，其中，所述数据管理网元与所述授权校验网元不在同一网络，或者所述数据管理网元与所述数据使用网元不在同一网络；
    所述授权校验网元根据所述网络的标识信息确定是否授权处理所述用户数据。
  2. 根据权利要求1所述的方法，其特征在于，所述授权校验网元根据所述网络的标识信息确定是否授权处理所述用户数据包括：
    所述授权校验网元根据所述网络的标识信息确定所述请求消息是否来自于所述网络的标识信息指示的网络；
    若所述请求消息来自于所述网络的标识信息指示的网络，则所述授权校验网元根据所述用户同意结果确定是否授权处理所述用户数据；
    若所述请求消息不是来自于所述网络的标识信息指示的网络，则所述授权校验网元不授权处理所述用户数据。
  3. 根据权利要求2所述的方法，其特征在于，所述授权校验网元根据所述网络的标识信息确定所述请求消息是否来自于所述网络的标识信息指示的网络包括：
    若所述授权校验网元属于所述网络的标识信息指示的网络，则所述授权校验网元确定所述请求消息来自于所述网络的标识信息指示的网络；
    若所述授权校验网元不属于所述网络的标识信息指示的网络，则所述授权校验网元确定所述请求消息不是来自于所述网络的标识信息指示的网络。
  4. 根据权利要求3所述的方法，其特征在于，所述数据使用网元和所述授权校验网元位于同一网络。
  5. 根据权利要求2所述的方法，其特征在于，所述方法还包括：
    所述授权校验网元获取所述数据使用网元所在网络的标识；
    所述授权校验网元根据所述网络的标识确定所述请求消息是否来自于所述网络的标识信息指示的网络包括：
    若根据所述数据使用网元所在网络的标识确定所述数据使用网元属于所述网络的标识信息指示的网络，则所述授权校验网元确定所述请求消息来自于所述网络的标识信息指示的网络；
    若根据所述数据使用网元所在网络的标识确定所述数据使用网元不属于所述网络的标识信息指示的网络，则所述授权校验网元确定所述请求消息不是来自于所述网络的标识信息指示的网络。
  6. 根据权利要求5所述的方法，其特征在于，所述请求消息包括所述数据使用网元所在网络的标识。
  7. 根据权利要求2至6中任一项所述的方法，其特征在于，所述授权校验网元不授权处理所述用户数据包括：
    所述授权校验网元向所述数据使用网元发送拒绝消息，所述拒绝消息包含拒绝原因值，所述拒绝原因值用于指示所述数据使用网元不是来自于所述用户允许处理所述用户数据的网络。
  8. 根据权利要求2至7中任一项所述的方法，其特征在于，所述授权校验网元不授权处理所述用户数据包括：
    所述授权校验网元记录处理所述用户数据未授权的事件。
  9. 根据权利要求8所述的方法，其特征在于，所述方法还包括：
    所述授权校验网元向数据提供网元请求所述用户数据；
    所述授权校验网元接收来自所述数据提供网元的所述用户数据。
  10. 根据权利要求1至9中任一项所述的方法，其特征在于，所述授权校验网元获取来自所述数据管理网元的所述网络的标识信息、所述数据处理目的以及所述用户同意结果包括：
    所述授权校验网元向所述数据管理网元请求用户签约数据；
    所述授权校验网元接收来自所述数据管理网元的用户签约数据，所述用户签约数据包括所述网络的标识信息、所述数据处理目的以及所述用户同意结果。
  11. 根据权利要求1至10中任一项所述的方法，其特征在于，所述网络的标识信息为公共陆地移动网PLMN的标识ID。
  12. 一种授权的方法，其特征在于，包括：
    数据管理网元接收来自授权校验网元的用户的标识信息以及第一网络的标识信息，所述第一网络的标识信息用于标识处理所述用户的数据的网络，其中，所述数据管理网元所在的网络与所述处理所述用户的数据的网络不为同一网络；
    所述数据管理网元根据所述第一网络的标识信息和第二网络的标识信息，确定第一用户同意结果，所述第二网络的标识信息用于标识所述用户允许处理所述用户的数据的网络，所述第一用户同意结果指示在所述第一网络中所述用户是否同意基于第一数据处理目的处理所述用户的数据；
    所述数据管理网元向所述授权校验网元发送所述第一用户同意结果。
  13. 根据权利要求12所述的方法，其特征在于，所述数据管理网元根据所述第一网络的标识信息和所述第二网络的标识信息，确定所述第一用户同意结果包括：
    若所述第二网络的标识信息包含所述第一网络的标识信息，则所述数据管理网元确定所述第一网络的标识信息对应的一个或多个数据处理目的为所述第一数据处理目的，确定所述一个或多个数据处理目的对应的用户同意结果为所述第一用户同意结果；
    若所述第二网络的标识信息不包含所述第一网络的标识信息，则所述数据管理网元确定所述第二网络的标识信息对应的数据处理目的为所述第一数据处理目的，且确定所述第一用户同意结果为不同意。
  14. 根据权利要求13所述的方法，其特征在于，所述数据管理网元向所述授权校验网元发送所述第一用户同意结果包括：
    所述数据管理网元向所述授权校验网元发送所述第一数据处理目的和所述第一用户同意结果。
  15. 根据权利要求12所述的方法，其特征在于，
    所述数据管理网元接收来自所述授权校验网元的所述用户的标识信息以及所述第一 网络的标识信息包括：所述数据管理网元接收来自所述授权校验网元的消息，所述消息包括所述用户的标识信息、所述第一网络的标识信息以及所述第一数据处理目的；
    所述数据管理网元根据所述第一网络的标识信息和所述第二网络的标识信息，确定所述第一用户同意结果包括：若所述第二网络的标识信息包含所述第一网络的标识信息，则所述数据管理网元确定所述第一数据处理目的对应的用户同意结果为所述第一用户同意结果；
    若所述第二网络的标识信息不包含所述第一网络的标识信息，则所述数据管理网元确定所述第一用户同意结果为不同意。
  16. 根据权利要求12至15中任一项所述的方法，其特征在于，所述方法还包括：
    所述数据管理网元向所述授权校验网元发送用于确定是否授权处理所述用户的数据的网络的标识信息。
  17. 根据权利要求12至16中任一项所述的方法，其特征在于，所述第二网络的标识信息为所述用户允许处理所述用户的数据的公共陆地移动网PLMN的标识ID。
  18. 根据权利要求12至17中任一项所述的方法，其特征在于，所述第一网络的标识信息为所述授权校验网元所在的公共陆地移动网PLMN的标识ID或触发处理所述第一数据的网元所在的公共陆地移动网PLMN的标识ID。
  19. 一种通信装置，其特征在于，包括用于执行如权利要求1至11中任一项所述方法的模块。
  20. 一种通信装置，其特征在于，包括用于执行如权利要求12至18中任一项所述方法的模块。
  21. 一种通信装置，其特征在于，包括处理器和接口电路，所述接口电路用于接收来自所述通信装置之外的其它通信装置的信号并传输至所述处理器或将来自所述处理器的信号发送给所述通信装置之外的其它通信装置，所述处理器通过逻辑电路或执行代码指令用于实现如权利要求1至11中任一项所述的方法。
  22. 一种通信装置，其特征在于，包括处理器和接口电路，所述接口电路用于接收来自所述通信装置之外的其它通信装置的信号并传输至所述处理器或将来自所述处理器的信号发送给所述通信装置之外的其它通信装置，所述处理器通过逻辑电路或执行代码指令用于实现如权利要求12至18中任一项所述的方法。
  23. 一种计算机程序产品，其特征在于，包括计算机程序，当所述计算机程序被通信装置执行时，实现如权利要求1至18中任一项所述的方法。
  24. 一种计算机可读存储介质，其特征在于，所述存储介质中存储有计算机程序或指令，当所述计算机程序或指令被通信装置执行时，实现如权利要求1至18中任一项所述的方法。
  25. 一种通信系统，其特征在于，包括执行如权利要求1至11中任一项所述的授权校验网元和数据管理网元，所述数据管理网元用于向所述授权校验网元提供所述用户允许处理所述用户数据的网络的标识信息、所述数据处理目的以及所述用户同意结果。
  26. 一种通信系统，其特征在于，包括执行如权利要求12至18中任一项所述的数据管理网元和授权校验网元，所述授权校验网元用于向所述数据管理网元发送所述用户的标识信息以及所述第一网络的标识信息，以及接收来自所述数据管理网元的所述第一用户同意结果。
  27. 一种授权的方法，其特征在于，包括：
    授权校验网元接收来自数据使用网元的用于触发处理用户数据的请求消息；
    所述授权校验网元获取来自数据管理网元的用户允许处理所述用户数据的网络的标识信息、数据处理目的以及用户同意结果，所述数据处理目的用于指示处理所述用户数据的目的，所述用户同意结果用于指示所述用户是否同意基于所述数据处理目的处理所述用户数据，其中，所述数据管理网元与所述授权校验网元不在同一网络，或者所述数据管理网元与所述数据使用网元不在同一网络；
    所述授权校验网元根据所述网络的标识信息确定是否授权处理所述用户数据；
    所述方法还包括：
    所述数据管理网元向所述授权校验网元提供所述用户允许处理所述用户数据的网络的标识信息、所述数据处理目的以及所述用户同意结果。
  28. 一种授权的方法，其特征在于，包括：
    数据管理网元接收来自授权校验网元的用户的标识信息以及第一网络的标识信息，所述第一网络的标识信息用于标识处理所述用户的数据的网络，其中，所述数据管理网元所在的网络与所述处理所述用户的数据的网络不为同一网络；
    所述数据管理网元根据所述第一网络的标识信息和第二网络的标识信息，确定第一用户同意结果，所述第二网络的标识信息用于标识所述用户允许处理所述用户的数据的网络，所述第一用户同意结果指示在所述第一网络中所述用户是否同意基于第一数据处理目的处理所述用户的数据；
    所述数据管理网元向所述授权校验网元发送所述第一用户同意结果；
    所述方法还包括：
    所述授权校验网元向所述数据管理网元发送所述用户的标识信息以及所述第一网络的标识信息，以及接收来自所述数据管理网元的所述第一用户同意结果。
PCT/CN2023/091313 2022-05-06 2023-04-27 一种授权的方法和装置 WO2023213226A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210489905.4A CN117061093A (zh) 2022-05-06 2022-05-06 一种授权的方法和装置
CN202210489905.4 2022-05-06

Publications (1)

Publication Number Publication Date
WO2023213226A1 true WO2023213226A1 (zh) 2023-11-09

Family

ID=88646264

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/091313 WO2023213226A1 (zh) 2022-05-06 2023-04-27 一种授权的方法和装置

Country Status (2)

Country Link
CN (1) CN117061093A (zh)
WO (1) WO2023213226A1 (zh)

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105246076A (zh) * 2011-08-08 2016-01-13 华为技术有限公司 跨plmn的访问控制处理方法、设备和系统
CN111464934A (zh) * 2019-01-21 2020-07-28 华为技术有限公司 数据传输系统、方法及其装置
WO2022027492A1 (zh) * 2020-08-06 2022-02-10 华为技术有限公司 一种通信方法、设备及系统

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105246076A (zh) * 2011-08-08 2016-01-13 华为技术有限公司 跨plmn的访问控制处理方法、设备和系统
CN111464934A (zh) * 2019-01-21 2020-07-28 华为技术有限公司 数据传输系统、方法及其装置
WO2022027492A1 (zh) * 2020-08-06 2022-02-10 华为技术有限公司 一种通信方法、设备及系统

Also Published As

Publication number Publication date
CN117061093A (zh) 2023-11-14

Similar Documents

Publication Publication Date Title
US20230179967A1 (en) Wireless network policy manager for a service mesh
KR20200139771A (ko) 5g 네트워크에서의 로컬 영역 데이터 네트워크(ladn)에 대한 접속들을 관리하는 방법들
US20220030117A1 (en) Systems and methods to enable programmable xhaul transport
WO2021223507A1 (zh) 一种通信方法、装置及芯片
EP4138439A1 (en) Communication method, apparatus, and system
WO2020200254A1 (zh) 一种通信方法及装置
WO2020199868A1 (zh) 一种网络接入方法和装置
US20230199550A1 (en) Relay Management Method and Communication Apparatus
US20210112437A1 (en) User Plane QOS Bearer Control Method for 5G Fixed Access
US20230147409A1 (en) Apparatus and method for network automation in wireless communication system
WO2022141295A1 (zh) 一种通信方法和装置
JP2022530333A (ja) 通信方法、通信装置、及び通信システム
US11477829B2 (en) Systems and methods for paging over WiFi for mobile terminating calls
US20220225463A1 (en) Communications method, apparatus, and system
WO2023213226A1 (zh) 一种授权的方法和装置
CN113543216B (zh) 媒体报文的传输方法、装置及系统
KR20230137998A (ko) Af 세션에 대한 외부 매개변수 프로비저닝을 위한 새로운 방법
WO2021189496A1 (zh) 用于网络切片的数据传输方法及设备
WO2024099016A1 (zh) 一种通信方法及装置
WO2023030077A1 (zh) 一种通信方法、通信装置及通信系统
WO2023179262A1 (zh) 小区信息的配置方法、装置、可读存储介质及芯片系统
WO2023272670A1 (zh) 一种网络连接的方法、装置及系统
WO2023061207A1 (zh) 一种通信方法、通信装置及通信系统
WO2024032290A1 (zh) 会话建立方法、装置、网络设备及存储介质
WO2024109221A1 (zh) 一种网络切片匹配方法和装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23799212

Country of ref document: EP

Kind code of ref document: A1