WO2023246753A1 - 通信方法和装置 - Google Patents

通信方法和装置 Download PDF

Info

Publication number
WO2023246753A1
WO2023246753A1 PCT/CN2023/101302 CN2023101302W WO2023246753A1 WO 2023246753 A1 WO2023246753 A1 WO 2023246753A1 CN 2023101302 W CN2023101302 W CN 2023101302W WO 2023246753 A1 WO2023246753 A1 WO 2023246753A1
Authority
WO
WIPO (PCT)
Prior art keywords
certificate
network element
service discovery
function network
nfp
Prior art date
Application number
PCT/CN2023/101302
Other languages
English (en)
French (fr)
Inventor
孙陶然
吴义壮
李论
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2023246753A1 publication Critical patent/WO2023246753A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys

Definitions

  • the present application relates to the field of communication, and more specifically, to a communication method and device.
  • NF network function
  • IPSec Internet protocol security
  • TLS transport layer security
  • the network function service consumer network element obtains the network function service provider network element information (NF service producer) that can provide services from the network function repository function network element (network function repository function, NRF).
  • NFp network function repository function
  • NFc and NFp exchange their respective certificates with each other for verification. If the NFp certificate becomes invalid or revoked at this time, the NFp certificate will fail to be verified, causing the network connection to fail to be established, affecting network efficiency and reducing user experience.
  • This application provides a communication method and device that can improve network efficiency and user experience.
  • the first aspect provides a communication method, which can be executed by a service discovery function network element (such as NRF), or can also be executed by a component (such as a chip or circuit) of the service discovery function network element.
  • a service discovery function network element such as NRF
  • a component such as a chip or circuit
  • the method includes: a service discovery function network element receives a service discovery request message, and the service request message is used to request the service discovery function network element to provide a first type of network function network element; in determining the first network function network element of the first type, When a certificate is valid, the service discovery function network element sends a service discovery response message including the identification information of the first network function network element.
  • the service request message is used to request the service discovery function network element to provide the first type of network function network element. It can be understood that: the service request message is used to request the service discovery function network element to provide the information of the first type of network function network element. , such as the identification of the first network function network element and/or the configuration data of the first network function network element, etc. This application does not specifically limit this.
  • determining the validity of the first certificate of the first network function network element of the first type includes: the service discovery function network element determines the first certificate based on the validity period of the first certificate. The certificate has not expired; and the service discovery function network element determines that the first certificate has not been revoked.
  • the first certificate is provided to the network function service consuming network element.
  • the first network function network element of the type is used to establish a network connection between the two.
  • the service discovery function network element determines that the first certificate has not been revoked, including: the service discovery function network element locally queries the certificate revocation list, and when the first certificate does not belong to the certificate revocation In the case of the list, the service discovery function network element determines that the first certificate has not been revoked.
  • the service discovery function network element determines that the first certificate has not been revoked.
  • the service discovery function network element can locally query the certificate revocation list to determine whether the first certificate has been revoked. Query requests need to be sent to external servers to reduce signaling overhead and communication delays, thereby improving network efficiency.
  • the service discovery function network element determines that the first certificate has not been revoked, including: the service discovery function network element sends a query request message to the server, and the query request message is used to query the first certificate. Whether a certificate has been revoked; the service discovery function network element receives an inquiry response message from the server, and the inquiry response message includes an indication that the first certificate has not been revoked; the service discovery function network element determines that the first certificate has not been revoked according to the instruction.
  • this server is the server that deploys the certificate revocation list, so the certificate status of the certificate (whether it is revoked) can be obtained from the slave server.
  • the service discovery function network element can query the external server whether the first certificate of the current first network function network element has been revoked.
  • the real-time accuracy of the certificate status of the first certificate is better.
  • the service discovery function network element receives a registration request message, and the registration request message is used to request to register the first network function network element to the service discovery function network element.
  • the registration request The message includes a first certificate, and the first certificate includes identification information of the first certificate and a validity period of the first certificate.
  • the service discovery function network element receives a connection establishment request message, and the connection establishment request message is used to request the first network function network element to establish a connection with the service discovery function network element, and the connection The establishment request message includes a first certificate, and the first certificate includes identification information of the first certificate and a validity period of the first certificate.
  • the service discovery function network element when it is determined that the first certificate is valid, stores the first certificate; or, when it is determined that the first certificate is valid, the service discovery function The functional network element stores the identification information of the first certificate and the validity period of the first certificate.
  • ensuring that the first certificate is valid can provide secure communication, which is beneficial to the subsequent establishment of network connection between the first network function network element and the second network function network element. Improve network efficiency and user experience, and try to avoid failure to establish a network connection due to the failure or revocation of the certificate of the first network function network element.
  • determining that the first certificate is valid includes: the service discovery function network element determines the first certificate based on the public key of the first network function network element and the public key of the certificate issuance network element.
  • the certificate is a certificate issued by the certificate-issuing network element for the first network function network element; the service discovery function network element determines that the first certificate has not expired based on the validity period of the first certificate; and the service discovery function network element determines that the certificate of the first certificate has not been revoked .
  • the first certificate that is, the first certificate is issued by the certificate-issuing network element to the first network function network element to avoid malicious tampering of the first certificate
  • validity the first certificate has not expired, At the same time, the first certificate has not been revoked
  • the service discovery function network element may not store the first certificate, or may not store the identification information of the first certificate and the validity period of the first certificate. Therefore, based on this implementation, when the service discovery function network element receives a service for requesting discovery of the first type of network function network element, it can send the identification information of the first type of first network function network element to the external server, For example, the certificate revocation list server or the online certificate status protocol server is used to request to obtain the validity of the first certificate (query the validity period of the first certificate and whether the certificate status is revoked), and then the service discovery function network element responds based on the feedback from the external server.
  • the certificate revocation list server or the online certificate status protocol server is used to request to obtain the validity of the first certificate (query the validity period of the first certificate and whether the certificate status is revoked)
  • the message determines whether to provide the identification information of the first network function network element to the second network function network element NFc. For example, if the external server feedbacks that the first certificate is valid, the service discovery function network element provides the identification information of the first network function network element NFp to the second network function network element NFc.
  • the service discovery function network element after the service discovery function network element sends the service discovery response message including the identification information of the first network function network element, the service discovery function network element receives the indication information, indicating The information is used to indicate that the first certificate is revoked, and the indication information includes identification information of the first certificate; the service discovery function network element sends a notification message, and the notification message is used to notify the first network function network element that the first certificate is revoked.
  • the service discovery function network element can obtain the certificate status of the first certificate (whether it has been revoked) in a relatively timely manner, and promptly notify the second network function network element NFc, which can avoid network failures caused by the first certificate becoming invalid or revoked. Connection establishment failure occurs, thus improving network efficiency and user experience.
  • the service discovery function network element receives a subscription request message, and the subscription request message is used to request the service discovery function network element to subscribe to the certificate status of the first certificate.
  • the service discovery function network element can promptly notify the second network function network element and the proxy network element based on the subscription request message. Or other NFc events regarding whether the first certificate is revoked, that is to say, the second network function network element or other NFc can effectively obtain the certificate status of the first certificate in real time, ensuring the network efficiency of subsequent communication between network function network elements.
  • the service discovery function network element receives the instruction information, including: the service discovery function network element receives the instruction information from the certificate issuance network element.
  • the service discovery function network element adds the first certificate to the certificate revocation list according to the instruction information.
  • the service discovery function network element can promptly obtain whether the first certificate has been revoked through the certificate issuance network element, and timely update the certificate status of the first certificate on the certificate revocation list, which is valid in real time.
  • the service discovery function network element after the service discovery function network element sends a service discovery response message including the identification information of the first network function network element, the service discovery function network element receives the service discovery response message from the first network function network element.
  • the service discovery function network element can obtain the certificate status of the first certificate (whether it has been revoked) in a relatively timely manner, and promptly notify the second network function network element NFc, which can avoid network failures caused by the first certificate becoming invalid or revoked. Connection establishment failure occurs, thus improving network efficiency and user experience.
  • the service discovery function network element receives an update registration service request message from the first network function network element, the update registration service request message includes a second certificate, and the second certificate includes The identification information of the second certificate and the validity period of the second certificate corresponding to the identification information of the second certificate; when it is determined that the second certificate is valid, update the locally stored information of the first network function network element, optionally, The second certificate (validity period and identification information) is stored on the service discovery function network element as the NFp context.
  • the service discovery function network element when it is determined that the first certificate of the third network function network element of the first type is invalid, the service discovery function network element sends a certificate that does not include the third network function network element. The meta-identifying information of the service discovery response message.
  • the service discovery function network element does not provide the information of the third network function network element to the second network function network element NFc to avoid Failure to establish subsequent network connections occurs, thereby improving network efficiency.
  • the service discovery function network element sends a service discovery response message to refuse to provide the network function network element of the first type.
  • the service discovery function network element refuses to provide discovery services to the second network function network element NFc.
  • the second aspect provides a communication method, which can be executed by a network function service consuming network element (such as NFc), or can also be executed by a component (such as a chip or circuit) of the network function service consuming network element.
  • a network function service consuming network element such as NFc
  • a component such as a chip or circuit
  • the method includes: the network function service consuming network element sends a subscription request message, the subscription request message is used to request the service discovery function network element to subscribe to the certificate status of the first certificate of the network function service providing network element, and the network function service providing network element is the network The function service consuming network element provides services; the network function service consuming network element receives a notification message from the network function service consuming network element, and the notification message is used to notify the network function service providing network element that the first certificate is revoked or invalid.
  • the service discovery function network element can promptly notify the network function service consuming network element of whether the first certificate has been revoked based on the subscription request message. That is to say, the network function service consuming network element can effectively obtain network functions in real time.
  • the service provides the certificate status of the first certificate of the network element to ensure the network efficiency of subsequent communication between network functional network elements.
  • the network function service consuming network element when it is determined that the network function service consuming network element fails to establish a connection with the network function service providing network element, the network function service consuming network element sends instruction information, and the instruction The information is used to indicate that the first certificate of the network function service providing network element is revoked, and the indication information includes identification information of the first certificate.
  • the network function service consuming network element when it is determined that the network function service consuming network element fails to establish a connection with the network function service providing network element, the network function service consuming network element sends the first information, the first information including the first certificate and the first certificate.
  • Expiration indication alternatively, the first information includes the identification information of the first certificate and the expiration indication of the first certificate.
  • the service discovery function network element can obtain the certificate status (whether it is revoked) of the first certificate of the network function service providing network element in a relatively timely manner, and promptly notify other NFcs, that is, the network function service providing network element also reports to the NRF in a timely manner. Requesting the NFc of the first type of network function network element can avoid the failure of network connection establishment due to the failure or revocation of the first certificate. generation, thereby improving network efficiency and improving user experience.
  • a communication method is provided, which method can be performed by a certificate-issuing network element (such as a CA/RA), or can also be performed by a component (such as a chip or circuit) used by the certificate-issuing network element, This application does not limit this.
  • a certificate-issuing network element such as a CA/RA
  • a component such as a chip or circuit
  • the method includes: the certificate issuance network element determines that the first certificate of the first network function network element is revoked; the certificate issuance network element sends instruction information to the network storage function network element corresponding to the first network function network element, and the instruction information is used to instruct the The first certificate is added to the certificate revocation list.
  • the indication information may also be used to indicate that the first certificate is revoked, and the indication information includes identification information of the first certificate. That is to say, the instruction information and the instruction information that causes the receiving end (for example, the network storage function network element NRF) to add the first certificate to the revocation list may be the same, and there is no specific limitation on this.
  • the service discovery function network element can obtain the certificate status of the first certificate (whether it has been revoked) in a relatively timely manner, and promptly notify the second network function network element NFc. This can avoid failure to establish a network connection due to the failure or revocation of the first certificate, thereby improving network efficiency and user experience.
  • the service discovery function network element can promptly obtain whether the first certificate has been revoked, and promptly update the certificate status of the first certificate on the certificate revocation list, which is valid in real time.
  • the certificate issuance network element before the certificate issuance network element sends the instruction information to the network storage function network element corresponding to the first network function network element, the certificate issuance network element performs the operation according to the preconfigured first network element.
  • the network storage function network element information corresponding to the network function network element determines the network storage function network element.
  • the fourth aspect provides a communication method, which can be executed by a first network function network element (such as NFp), or can also be executed by a component (such as a chip or circuit) of the first network function network element.
  • a first network function network element such as NFp
  • a component such as a chip or circuit
  • the method includes: the first network function network element sends a registration request message, the registration request message is used to request to register the first network function network element to the service discovery function network element, and the registration request message includes the first name of the first network function network element.
  • certificate the first certificate includes identification information of the first certificate and a first certificate validity period corresponding to the identification information of the first certificate; the first network function network element receives the registration request response message.
  • the first network function network element carries the first certificate it owns when sending the registration request message, so that the service discovery network element verifies the validity of the first certificate and determines that the first certificate is valid. Accept the registration request under the circumstances, thereby ensuring that the first network function network element is truly available, and is conducive to providing the safe and available first network function network element to the network function service consuming network element NFc in the subsequent service discovery process to avoid due to The certificate of the first network function network element becomes invalid or revoked, causing failure to establish a network connection, thereby improving network efficiency.
  • the first network function network element sends a deregistration request message, and the deregistration request message is used to request that the context of the first network function network element be removed from the service discovery function network.
  • the deregistration request message includes the identifier of the first network function network element.
  • the service discovery function network element can obtain the certificate status of the first certificate in a relatively timely manner (through the de-registration request message), and promptly notify the second network function network element NFc, which can avoid network connection failure due to the failure of the first certificate. Failure to establish occurs, thus improving network efficiency and user experience.
  • the first network function network element obtains a second certificate, and the second certificate includes identification information of the second certificate and a second certificate corresponding to the identification information of the second certificate. Validity period; the first network function network element sends an update registration service request message to the service discovery function network element.
  • the update registration service request message is used to request the service discovery function network element to provide an update registration service.
  • the update registration service request message includes the second certificate. .
  • the fifth aspect provides a communication method, which can be executed by a service discovery function network element (such as NRF), or can also be executed by a component (such as a chip or circuit) of the service discovery function network element.
  • a service discovery function network element such as NRF
  • a component such as a chip or circuit
  • the method includes: a service discovery function network element receives a first service discovery request message, the first service request message is used to request the service discovery function network element to provide a first type of network function network element; the service discovery function network element sends a first service discovery request message including a first type of network function network element.
  • the first service discovery response message contains the identification information of the first network function network element; the service discovery function network element receives the second service discovery request message, and the second service request message is used to request the service discovery function network element to provide the first type of network Functional network element, the second service discovery request message includes the first network function network element identifier and the reason why the first network function network element fails to establish a connection with the second network function network element; the service discovery function network element sends a third service discovery request message including the first type.
  • the second service of the identification information of the three network function network elements service discovery response message.
  • the service discovery function network element by carrying the first network function network element identifier and the reason why the first network function network element NFp and the second network function network element NFc failed to establish a connection in the service discovery request message, the service discovery function network element In the subsequent service discovery process, identification information of other first-type network function network elements except the first network function network element NFp is provided to the second network function network element NFc to avoid the service discovery function network element from repeatedly sending the third network function network element.
  • the identification information of a network function network element causes network connection to fail to be established again, increases communication delay, and reduces network efficiency.
  • a communication method is provided.
  • the method can be executed by a second network function network element (such as NFc), or can also be executed by a component (such as a chip or circuit) of the second network function network element.
  • This method There are no restrictions on this application. For convenience of description, the following description takes the execution by the second network function network element as an example.
  • the method includes: the second network function network element sends a first service discovery request message, the first service request message is used to request the service discovery function network element to provide a first type of network function network element; the second network function network element receives the first service discovery request message including the first service discovery request message.
  • the second service request message is used to request the service discovery function network element to provide a first type of network function network element, the second service discovery request message includes the first network function network element identifier and the reason for the failure to establish a connection;
  • the second network function network element receives a second service discovery response message including identification information of the third network function network element of the first type.
  • the service discovery function network element by carrying the first network function network element identifier and the reason why the first network function network element NFp and the second network function network element NFc failed to establish a connection in the service discovery request message, the service discovery function network element In the subsequent service discovery process, identification information of other first-type network function network elements except the first network function network element NFp is provided to the second network function network element NFc to avoid the service discovery function network element from repeatedly sending the third network function network element.
  • the identification information of a network function network element causes network connection to fail to be established again, increases communication delay, and reduces network efficiency.
  • the reasons for failure to establish the connection include one or more of the following: the certificate of the first network function network element has expired; the certificate of the first network function network element has been revoked; Or, the routing of the first network function network element fails.
  • a communication device is provided.
  • the device is used to perform the method provided in the above first or fifth aspect.
  • the communication device may include units and/or modules for performing the method provided by any of the above implementations of the first aspect or the fifth aspect.
  • the communication device is a service discovery function network element.
  • the transceiver can be a transceiver, or an input/output interface.
  • the processing module may be at least one processor.
  • the transceiver may be a transceiver circuit.
  • the input/output interface may be an input/output circuit.
  • the communication device is a chip, chip system or circuit in a service discovery function network element.
  • the transceiver module may be an input/output interface, interface circuit, output circuit, input circuit, pin or related circuit on the chip, chip system or circuit.
  • the processing module may be at least one processor, processing circuit or logic circuit, etc.
  • beneficial effects of the method shown in the above seventh aspect and its possible designs may be referred to the beneficial effects of the first aspect or the fifth aspect and its possible designs.
  • a communication device is provided.
  • the device is used to perform the method provided by the above-mentioned second aspect or sixth aspect.
  • the communication device may include units and/or modules for performing the method provided by any of the above implementations of the second aspect or the sixth aspect.
  • the communication device is a second network function network element.
  • the transceiver can be a transceiver, or an input/output interface.
  • the processing module may be at least one processor.
  • the transceiver may be a transceiver circuit.
  • the input/output interface may be an input/output circuit.
  • the communication device is a chip, chip system or circuit in the second network function network element.
  • the transceiver module may be an input/output interface, interface circuit, output circuit, input circuit, pin or related circuit on the chip, chip system or circuit.
  • the processing module may be at least one processor, processing circuit or logic circuit, etc.
  • beneficial effects of the method shown in the above eighth aspect and its possible designs may be referred to the beneficial effects of the second or sixth aspect and its possible designs.
  • a communication device is provided.
  • the device is used to perform the above third aspect or the method provided in the third aspect.
  • the communication device may include units and/or modules for performing the method provided by the third aspect or any one of the above implementations of the third aspect.
  • the communication device is a certificate issuing network element.
  • the transceiver can be a transceiver, or an input/output interface.
  • Processing mode A block can be at least one processor.
  • the transceiver may be a transceiver circuit.
  • the input/output interface may be an input/output circuit.
  • the communication device is a chip, chip system or circuit in the certificate issuing network element.
  • the transceiver module may be an input/output interface, interface circuit, output circuit, input circuit, pin or related circuit on the chip, chip system or circuit.
  • the processing module may be at least one processor, processing circuit or logic circuit, etc.
  • a communication device is provided.
  • the device is used to perform the above fourth aspect or the method provided in the fourth aspect.
  • the communication device may include units and/or modules for performing the method provided by the fourth aspect or any one of the above implementations of the fourth aspect.
  • the communication device is a first network function network element.
  • the transceiver can be a transceiver, or an input/output interface.
  • the processing module may be at least one processor.
  • the transceiver may be a transceiver circuit.
  • the input/output interface may be an input/output circuit.
  • the communication device is a chip, chip system or circuit in the first network function network element.
  • the transceiver module may be an input/output interface, interface circuit, output circuit, input circuit, pin or related circuit on the chip, chip system or circuit.
  • the processing module may be at least one processor, processing circuit or logic circuit, etc.
  • An eleventh aspect provides a processor for executing the methods provided by the above aspects.
  • operations such as sending and getting/receiving involved in the processor, if there is no special explanation, or if it does not conflict with its actual role or internal logic in the relevant description, it can be understood as processor output, reception, input and other operations. , can also be understood as the transmitting and receiving operations performed by the radio frequency circuit and the antenna, which is not limited in this application.
  • a computer-readable storage medium stores program code for device execution, and the program code includes a method for executing any one of the above implementations of the first to fourth aspects.
  • a computer program product containing instructions is provided.
  • the computer program product is run on a computer, the computer is caused to execute the method provided by any one of the above implementations of the first to fourth aspects.
  • a fourteenth aspect provides a chip, which includes a processor and a communication interface.
  • the processor reads the instructions stored in the memory through the communication interface and executes the method provided by any one of the above-mentioned implementations of the first to fourth aspects.
  • the chip also includes a memory, in which computer programs or instructions are stored.
  • the processor is used to execute the computer programs or instructions stored in the memory.
  • the processor is used to execute The method provided by any one of the above implementations of the second aspect to the fourth aspect.
  • a fifteenth aspect provides a communication system, including any one of the communication devices described in the seventh aspect to the tenth aspect.
  • a communication method including: the first network element obtains the certificate status of the certificate to which the network function network element belongs; when the certificate status is that the certificate is invalid, the first network element determines the configuration of the network function network element
  • the configuration method is one of the following methods: configuring the network function network element to deregister, or marking the network function network element as invalid.
  • the first network element obtains the certificate status of the network function network element through a certificate revocation notification message, where the certificate revocation notification message contains indication information for indicating the certificate status, or the certificate status.
  • the first network element obtains the certificate status of the network function network element including: the first network element receives a certificate revocation notification message from the certificate issuing network element, and the certificate revocation notification message also includes the network function network element identifier, where , the network function network element identifier is used to identify the network function network element corresponding to the certificate; when the certificate status is that the certificate is invalid, the first network element determines the configuration method of the network function network element, including: the first network element determines the configuration method of the network function network element according to the network function Network element identification configures the network function network element to be deregistered or the identification function network element to be invalid.
  • the first network element obtains the certificate status of the network function network element including: the first network element receives a certificate revocation notification message from the certificate issuing network element.
  • the certificate revocation notification message also contains a service name, and the service name is used for Identify the service corresponding to the certificate; when the certificate status is certificate invalid, the first network element identifies the network function network element as invalid, including: when the certificate status is certificate invalid, the first network element identifies the network according to the service name The service corresponding to the functional network element is invalid.
  • the certificate revocation notification message also includes a certificate identifier, which is used to identify the certificate; when the certificate status is certificate invalid, the first network element identifies the network function network element as invalid, including: in the certificate status In the event that the certificate expires, the A network element identifies the service corresponding to the functional service network element as invalid based on the certificate identification.
  • the certificate expiration status is one of revocation or suspension.
  • the first network element sends the configuration method determined by the first network element to the OAM.
  • the first network element is a service discovery function network element or a certificate management network element.
  • a communication device is provided.
  • the device is used to perform the method provided by the sixteenth aspect or any one of the above implementations of the sixteenth aspect.
  • the communication device may include units and/or modules for performing the method provided by the sixteenth aspect or any one of the above implementations of the sixteenth aspect.
  • Figure 1 is a schematic diagram of a network architecture applicable to this application.
  • Figure 2 is a schematic diagram of the hierarchical structure of the PKI system.
  • Figure 3 is a schematic flow chart of NF registration/registration update/de-registration.
  • Figure 4 is a schematic flowchart of NF service discovery in different scenarios.
  • FIG. 5 is a flow example diagram of the first communication method provided by the embodiment of the present application.
  • Figure 6 is an example flow chart of the second communication method provided by the embodiment of the present application.
  • Figure 7 is an example flow chart of the third communication method provided by the embodiment of the present application.
  • Figure 8 is a flow example diagram of the fourth communication method provided by the embodiment of the present application.
  • Figure 9 is a flow example diagram of the fifth communication method provided by the embodiment of the present application.
  • Figure 10 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • Figure 11 is a schematic structural diagram of another communication device provided by an embodiment of the present application.
  • Figure 12 is a flowchart of a communication method provided by an embodiment of the present application.
  • Figure 13 is a flow example diagram of another communication method provided by an embodiment of the present application.
  • Figure 14 is a flow example diagram of another communication method provided by an embodiment of the present application.
  • the technical solution provided by this application can be applied to various communication systems, such as: new radio (NR) system, long term evolution (LTE) system, LTE frequency division duplex (FDD) system , LTE time division duplex (TDD) system, etc.
  • NR new radio
  • LTE long term evolution
  • FDD frequency division duplex
  • TDD time division duplex
  • This application can also be applied to device-to-device (D2D) communication, vehicle-to-everything (V2X) communication, machine-to-machine (M2M) communication, machine-type communication (machine type) communication (MTC), and the Internet of things (IoT) communication system or other communication systems.
  • NR new radio
  • LTE long term evolution
  • FDD frequency division duplex
  • TDD LTE time division duplex
  • D2D device-to-device
  • V2X vehicle-to-everything
  • M2M machine-to-machine
  • MTC machine-type communication
  • IoT Internet of things
  • the part operated by the operator can be called the public land mobile network (PLMN), or the operator network, etc.
  • PLMN is a network established and operated by the government or its approved operators for the purpose of providing land mobile communication services to the public. It is mainly a public network where mobile network operators (MNOs) provide mobile broadband access services to users. .
  • MNOs mobile network operators
  • the PLMN described in the embodiments of this application may specifically be a network that meets the standard requirements of the 3rd generation partnership project (3GPP), referred to as a 3GPP network.
  • 3GPP networks generally include but are not limited to fifth-generation mobile communication (5th-generation, 5G) networks, fourth-generation mobile communication networks, and other future communication systems, such as sixth-generation mobile communication networks.
  • the embodiments of this application will take the PLMN or 5G network as an example for description.
  • Figure 1 is a schematic diagram of a network architecture applicable to this application, taking the 5G network architecture based on the service-based architecture SBA in the non-roaming scenario defined in the 3GPP standardization process as an example.
  • the network architecture can include three parts, namely the terminal equipment part, the data network (DN) and the operator network part. The following is a brief description of the functions of each part of the network element.
  • the terminal device part may include a terminal device 110, which may also be called user equipment (UE).
  • UE user equipment
  • the terminal device 110 in this application is a device with a wireless transceiver function, which can communicate with an or Multiple core network (core network, CN) devices communicate.
  • core network CN
  • the embodiments of the present application do not limit the type or type of terminal equipment. For ease of understanding, this application will take UE to refer to terminal equipment as an example for subsequent explanation.
  • the operator network part may include but is not limited to the (radio) access network, (R)AN 120 and the core network (core network, CN) part.
  • (R)AN 120 can be regarded as the operator network
  • the sub-network is the implementation system between the service nodes and the terminal equipment 110 in the operator's network. To access the operator's network, the terminal equipment 110 first passes through the (R)AN 120, and then can communicate with the operator through the (R)AN 120
  • the access network device in the embodiment of this application is a device that provides wireless communication functions for the terminal device 110, and can also be called a network device. It should be understood that this article does not make any specific types of access network devices. Restricted.
  • the CN part may include but is not limited to: user plane function (UPF) 130, network exposure function (NEF) 131, NRF 132, policy control function (PCF) 133, unified Data management function (unified data management, UDM) 134, unified data repository function (UDR) 135, network data analytics function (NWDAF) 136, authentication server function (AUSF) 137. Access and mobility management function (AMF) 138. Session management function (SMF) 139.
  • UPF user plane function
  • NRF network exposure function
  • PCF policy control function
  • UDM unified Data management function
  • UDM unified data management, UDM
  • UDM unified data management, UDM
  • UDM unified data repository function
  • NWDAF network data analytics function
  • AUSF authentication server function
  • SMS Session management function
  • DN 140 also known as packet data network (PDN)
  • PDN packet data network
  • IMS IP multimedia service
  • the PLMN can access multiple DNs 140, and a variety of services can be deployed on the DN 140 to provide data and/or voice services to the terminal equipment 110.
  • the terminal device 110 can access the DN 140 through the operator network, and use the operator services deployed on the DN 140, and/or services provided by third parties.
  • the NF included in CN is further briefly explained below.
  • UPF 130 is a gateway provided by the operator. It is the gateway for communication between the operator's network and the data network DN 140.
  • UPF network functions 130 include user plane functions such as data packet routing and transmission, data packet detection, business usage reporting, quality of service (QoS) processing, legal interception, uplink data packet detection, downlink data packet storage, etc.
  • QoS quality of service
  • NEF 131 is a control plane function provided by the operator. It mainly enables third parties to use the services provided by the network, supports the network to open its capabilities, events and data analysis, provides PLMN security configuration information from external applications, and exchanges information inside and outside the PLMN. conversion etc.
  • NRF 132 is a control plane function provided by operators, which can be used to maintain real-time information on network functions and services in the network. For example, support network service discovery, maintain NF configuration data (NF profile) of NF instances, support SCP service discovery, maintain SCP configuration data (SCP profile) of SCP instances, and send NF related to new registration, de-registration, and updates. and SCP notifications, maintaining the health status of NF and SCP operations, etc.
  • NF profile NF configuration data
  • SCP profile SCP configuration data
  • PCF 133 is a control plane function provided by operators. It supports a unified policy framework to govern network behavior, and provides policy rules and contract information related to policy decisions to other control functions.
  • UDM 134 is a control plane function provided by the operator. It is responsible for storing the user permanent identifier (subscriber permanent identifier, SUPI) and the publicly used subscription identifier (generic public subscription identifier, GPSI) of the subscribed user in the operator's network. ), credential and other information.
  • SUPI subscriber permanent identifier
  • GPSI public subscription identifier
  • UDR 135 is a control plane function provided by the operator. It provides UDM with the function of storing and obtaining contract data, provides PCF with the function of storing and obtaining policy data, and stores and obtains the user's NF group ID (group ID) information.
  • NWDAF 136 is a control plane function provided by the operator. Its main function is to collect data from NF, external application function (Application Function, AF) and Operations, Administration and Maintenance (OAM) systems, etc., to NF and AF provide NWDAF business registration, data opening and analysis data, etc.
  • NF external application function
  • OAM Operations, Administration and Maintenance
  • AUSF 137 is a control plane function provided by the operator. It is usually used for authentication between the terminal device 110 (subscriber) and the operator's network. After receiving the authentication request initiated by the contracted user, the AUSF network function 137 can authenticate and/or authorize the contracted user through the authentication information and/or authorization information stored in the UDM network function 134, or generate the contracted user's profile through the UDM network function 134. Authentication and/or authorization information. The AUSF network function 137 may feedback authentication information and/or authorization information to the subscriber.
  • AMF 138 is a control plane network function provided by the operator network. It is responsible for the access control and mobility management of the terminal device 110 accessing the operator network, such as mobility status management, assigning user temporary identities, authenticating and authorizing users. and other functions.
  • SMF 139 is a control plane network function provided by the operator network and is responsible for managing the protocol data unit (PDU) session of the terminal device 110.
  • the PDU session is a channel used to transmit PDUs.
  • the terminal equipment needs to transmit PDUs to each other through the PDU session and the data network DN 140.
  • the PDU session is established, maintained and deleted by the SMF network function 139.
  • SMF network functions 139 include session management (e.g. session establishment, modification and release, including tunnel maintenance between user plane functions UPF 130 and (R)AN 120), selection and control of UPF network functions 130, service and session continuity modes Selection, roaming and other session functions.
  • NF can be implemented by hardware or software.
  • network functions (such as NEF 131...SMF139) are collectively referred to as NF. That is, the NF described later in the embodiment of this application can be replaced by any network function.
  • FIG. 1 only schematically describes part of the network functions, and the NF described later is not limited to the network functions shown in FIG. 1 .
  • the above-mentioned network architecture applied to the embodiments of the present application is only a network architecture described from the perspective of a service-oriented architecture.
  • the network architecture applicable to the embodiments of the present application is not limited to this. Any network architecture that can realize the functions of each of the above network elements All network architectures are applicable to the embodiments of this application.
  • AMF, SMF, UPF, NEF, AUSF, NRF, PCF, and UDM shown in Figure 1 can be understood as network elements used to implement different functions in the core network, and can, for example, be combined into network slices as needed.
  • These core network elements can be independent devices, or can be integrated into the same device to implement different functions. This application does not limit the specific forms of the above network elements.
  • An encryption process using an asymmetric encryption algorithm is: Party A first generates a pair of keys and uses one of them as a public key. Party B, who obtains the public key, uses the key to encrypt the information that needs to be encrypted. Send it to Party A, who then uses another corresponding private key to decrypt the encrypted information, thus realizing confidential data transmission.
  • Party A uses its own private key to encrypt the information and sends it to Party B.
  • Party B uses the public key provided by Party A to decrypt the encrypted information. If the decryption is successful, It can be verified that the information is indeed sent by Party A and is not impersonated by others. This is a commonly used digital signature technology.
  • Digital signature is an application of asymmetric cryptography technology.
  • Asymmetric encryption is a type of cryptography algorithm that requires a pair of keys, one is a private key (often called the private key) and the other is a public key (often called the public key). key). These two keys are mathematically related, usually one is used as the encryption key and the other is used as the decryption key.
  • Information encrypted by the encryption key can only be decrypted by the decryption key corresponding to the encryption key. Therefore, the private key holder can encrypt information through the private key to ensure the integrity and accuracy of the information.
  • the information encrypted with the private key is called a digital signature, or signature for short.
  • Digital signatures have the following characteristics: (1) Anti-impersonation (forgery): The private key is known only to the signer himself, so others cannot construct the correct one. (2) Identifiable identity: As mentioned above, digital signatures can prevent others from forging them, so the recipient can authenticate the identity claimed by the sender. (3) Anti-tampering (anti-destruction of information integrity): For digital signatures, the signature and the original file have formed a mixed overall data, which cannot be tampered with, thus ensuring the integrity of the data. (4) Anti-replay. In digital signatures, if techniques such as adding serial numbers and timestamps to signed messages are used, replay attacks can be prevented. (5) Anti-repudiation.
  • Signature verification is when the information recipient uses the public key to verify whether the data or files released by the private key holder are complete and whether the source of the information is accurate.
  • the private key holder uses the private key to encrypt the data to be sent (or the summary information of the data to be sent), and then sends the data to be sent and the ciphertext to the recipient.
  • the ciphertext is the ciphertext of the data. sign.
  • the recipient decrypts the ciphertext through the public key and verifies whether the decrypted data is consistent with the data received by the recipient from the private key holder (or the summary information generated based on the received data). If they are consistent, If the verification passes, it means that the received data information is complete and accurate, and it can be determined that the data was sent by the private key holder.
  • signature verification may also be called signature verification, and passing verification may also be called verification success.
  • PKI Public key infrastructure
  • certificates certificates
  • certificate authorities
  • PKI is used to realize the generation, management, storage, distribution and revocation of keys and digital certificates based on public and private keys. able.
  • the public key and private key are used to encrypt and generate digital signatures respectively.
  • the public key can be sent to the network, while the private key must be stored within the holder.
  • a digital certificate is digital authentication information used to identify a party's identity and ownership of a public key in digital communications.
  • the digital certificate in this application can also be referred to as a certificate for short. Simply put, the certificate is used to identify the user, and the PKI is used to issue the identity certificate and verify that the identity certificate is valid.
  • a typical PKI system includes one or more certificate authorities (certificate authorities, CA).
  • the CA is responsible for managing the entire life cycle of the public key, including issuing certificates, defining certificate validity periods, and revoking certificates.
  • the CA can also include a registration authority (RA), which is used to obtain and authenticate the user's identity and then submit a certificate issuance request to the CA.
  • RA can be a function integrated in CA, or can be deployed separately. In this application, it is assumed that CA integrates the function of RA.
  • the PKI system hierarchy adopts a tree structure.
  • the tree-like PKI architecture has the following characteristics: (1) The root CA, as the trust endpoint of all network elements, needs to be in an absolutely secure position to ensure security isolation and as little communication interaction as possible. (2) Multi-level CAs can be used to divide the scope of use of certificates. For example, network elements located in different regions use different leaf CAs to issue certificates, or network elements used for public services and private services use different leaf CAs to issue certificates. Issue certificates, etc. (3) When a certain leaf CA is attacked, it will not cause the entire PKI architecture to fail and collapse, which is beneficial to the stability of the entire PKI system.
  • FIG 2 is a schematic diagram of the hierarchical structure of a PKI system. Under the PKI architecture, whether any two network elements can trust each other is based on whether the certificates they hold are issued by a common trusted endpoint. As shown in Figure 2, the common trusted endpoint is the root CA.
  • the root CA will belong to multi-level leaf CAs according to the deployment situation (other CAs except the root CA in Figure 2).
  • the root CA is responsible for itself (self-signed certificate) and the next level leaf CA (CA-A and CA in Figure 2).
  • CA-B) issues a certificate, and the next-level leaf CA then issues a certificate to the next-level CA.
  • the next-level CAs of CA-A are CA-A1 and CA-A2, and so on.
  • the last level leaf CA The CA issues a certificate to the network element, for example, CA-B1 issues a certificate to the network element B1.
  • the process for a user to request a certificate from a leaf CA is as follows: (1) The user locally generates a paired public key and private key, and hands the public key and his/her identity information to the CA. (2) The CA determines whether it agrees to issue a certificate for the user, including verifying the user's identity and public and private keys before agreeing to issue it. For example, the user sends an initial credential and a private key signature to the CA, and the CA verifies the initial credential to determine the user's identity. , and use the public key to verify the private key signature, and confirm that the public and private key pair is the user's own, then the certificate can be issued. If agreed, generate a certificate and use the CA's private key to generate a digital signature for the certificate.
  • the certificate has at least the information shown in Table 1.
  • the user obtains the certificate issued by the CA for the user from the CA, and at the same time obtains the address and certificate chain information for querying certificate revocation information from the CA.
  • the address for querying certificate revocation can be querying the certificate revocation list (certificate revocation list, CRL) or online certificate status protocol (online certificate status protocol, OCSP) that records certificate revocation information.
  • the certificate chain is used to display sequentially from the underlying leaf CA all the way up to the root CA to show other network elements how to find a common trust endpoint in order.
  • the certificates of network element A1 and network element B1 in Figure 2 are issued by CA-A1 and CA-B1 respectively.
  • the certificates of network element A1 and network element B1 cannot independently display the common trust endpoint. They need to use the certificate chain to display the common trust endpoint. Trust endpoint (such as root CA).
  • Trust endpoint such as root CA
  • the certificate chain of network element A1 is ⁇ CA-A1 certificate, CA-A certificate, root CA certificate ⁇
  • the certificate chain of network element B1 is ⁇ CA-B1 certificate, CA-B certificate, root CA certificate ⁇ .
  • the core network defines different types of certificate authorities, including but not limited to: security gateway (SEG) CA, network element (NE) CA, transport layer security (TLS) client CA, TLS server CA and interconnection CA. in:
  • SEG CA refers to the CA that issues terminal entity certificates to SEGs in a specific operator domain, and is used to interact with SEGs in other domains or with network elements in its own domain.
  • NE CA refers to the CA that issues terminal entity IPsec certificates to network elements within a specific operator domain. Certificates issued by NE CA Books should be restricted to the Zb interface, for interaction with other NEs or SEGs.
  • TLS client CA refers to the CA that issues terminal entity TLS client certificates to TLS entities in a specific operator domain, and is used to establish a TLS connection between the client and the server.
  • TLS server CA refers to the CA that issues terminal entity TLS server certificates to TLS entities within a specific operator domain.
  • Interconnection CA A CA that issues cross certificates on behalf of a specific operator to the SEG CA, TLS client CA, and TLS server CA of other domains with which the operator's SEG and TLS entities are interconnected.
  • NF Profile is generated by operation, administration and maintenance (OAM) and configured to NF.
  • NF Profile includes but is not limited to the following parameters: network element identifier (such as NF ID (Identity or Identifier), NF instance ID), network element type (NF type), fully qualified domain name (fully qualified domain) name, FQDN)/IP address, slices and services supported by the network element, NF location information, NF's home network identification PLMN ID, or NF-specific service authorization information and other parameters.
  • network element identifier such as NF ID (Identity or Identifier), NF instance ID), network element type (NF type), fully qualified domain name (fully qualified domain) name, FQDN)/IP address, slices and services supported by the network element, NF location information, NF's home network identification PLMN ID, or NF-specific service authorization information and other parameters.
  • NF instance ID, NF type, FQDN/IP address, etc. can be used to apply for certificates.
  • CRL is a time-stamped list, including all revoked or suspended digital certificate information. It also includes two fields: the current CRL update date and the next update date. Users can determine the CRL they currently own based on these two date information. Whether it is the latest, and manages the CRL buffer, that is, the user can always use the original CRL buffer before the next CRL update. Since the CRL contains the digital signature of the CA, the CRL can be stored at any node on the network, such as NRF.
  • the updated CRL is regularly published to the lightweight directory access protocol (LDAP) directory server so that the relying party can learn the current status of the certificate.
  • the relying party can determine whether the CRL contains a certificate to be verified.
  • To determine whether the status of the certificate is revoked or not revoked if the CRL contains a verification certificate, it means that the certificate has been revoked. If the CRL does not contain a verification certificate, it means that the certificate has not been revoked.
  • Specific implementation steps include: obtaining the corresponding CRL, verifying whether the digital signature of the CA on the CRL is valid, and checking whether the certificate to be verified is in the CRL.
  • the status of the certificate in the CRL includes revocation and suspension.
  • Revocation means that the certificate has been irreversibly revoked, for example, the certificate was issued by an improper certificate authority, or the private key of the certificate is believed to have been compromised or stolen, that is, the user no longer has the exclusive private key of the certificate.
  • the sling indicates that the certificate is a reversible sling and can continue to be used after the certificate is restored.
  • OCSP is an online certificate query interface. It establishes a mechanism that can respond in real time, allowing the browser to send a certificate query request to the CA server. The CA server then responds in real time to verify whether the certificate is legal and valid, so that the validity of each certificate can be queried in real time. , which solves the real-time problem of CRL.
  • NFs on the control plane interact based on service-based interfaces. That is to say, any two NFs are physically connected, and they can interact directly or indirectly through other NFs (such as service communication proxy SCP), that is, one NF calls the service provided by another NF.
  • NFs such as service communication proxy SCP
  • each NF for example, NFc or NFp
  • 5G network needs to obtain authorization from the NRF before interacting with other NFs.
  • NF can obtain NRF authorization through a registration process with NRF. For example, NF initiates registration with NRF after instantiation, and registers NF configuration data on NRF so that other NF network elements can discover the NF during the service discovery process.
  • FIG 3 is a schematic flow chart of NF registration/registration update/de-registration 300.
  • steps S311-S313 are the NF registration process
  • steps S321-S323 are the NF registration update process
  • steps S331-S333 are the NF de-registration process. As shown in Figure 3, it specifically includes the following steps.
  • NF for example, NFp
  • NRF Registration Request
  • NRF receives the registration request message from NF.
  • the registration request message includes the configuration data (NF Profile) of the NF, and the NF Profile includes the NF identifier, such as the NF instance identifier (Instance ID).
  • NF Profile configuration data
  • the NF Profile includes the NF identifier, such as the NF instance identifier (Instance ID).
  • the NF Profile can also include other information.
  • NF type or parameters such as slices and services supported by NF.
  • the configuration data of the NFp may also include specific NFp resources or specific operations that can be used by NFcs of different types (such as SMF or AMF) or NFcs with different Instance IDs.
  • registration information interaction can be carried out according to the OAuth 2.0 standard authorization framework formulated by the Internet Engineering Task Force (IETF).
  • IETF Internet Engineering Task Force
  • the client in OAuth2.0 corresponds to the NF here
  • the client ID corresponds to the NF instance ID
  • the authorization server corresponds to the NRF.
  • NRF ie, authorization server
  • the NRF accepts the registration request of the NFp, it stores the NFp Profile and marks the NFp as available.
  • the NRF can verify the request before accepting the NF registration.
  • NRF determines whether to accept NF's request by verifying whether the registration request information is true and valid.
  • the OAuth authorization framework does not limit the specific verification methods used by NRF.
  • the NFp can obtain a digital certificate in advance, which is issued by the NRF or other network elements, and describes the legal profile of the NFp in the certificate.
  • NRF uses the public key of the issuer (NRF or other network element) to verify the authenticity of the digital certificate, thereby determining the authenticity of the content in the certificate.
  • NRF can also obtain an NFp Profile signed by NRF or other network elements in advance, and NRF determines the authenticity of the NFp Profile by using the signer's public key to verify the authenticity of the signature.
  • NFp and NRF can also use other pre-agreed credentials or methods (such as passwords, or shared keys, etc.) to enable NRF to verify the authenticity of the NFp Profile, which is not limited by this application. Furthermore, if it is a digital certificate, NRF can also check that the parameters in the Profile described in the certificate are consistent with the parameters of the NFp Profile in the registration request message.
  • NRF sends a registration response (Nnrf_NFManagement_NFRegister Response) message to NF.
  • NF receives the registration response message from NRF.
  • the registration response message is used to notify the NF service of successful registration (or failure).
  • NF for example, NFp
  • NRF registration update request
  • NRF receives the registration update request message from NF.
  • the registration update request message includes the configuration data of the NF to be updated (for example, with new service capacity), and is used to request the NRF to update the previously stored NF profile.
  • NRF updates the configuration data of NF.
  • the NRF accepts the NFp's registration update request, it updates the stored NFp profile.
  • NRF sends a registration update response (Nnrf_NFManagement_NFUpdate Response) message to NF.
  • NF receives the registration update response message from NRF.
  • NF for example, NFp
  • NRF deregistration request
  • NRF receives the deregistration request message from NF.
  • the deregistration request message is used to notify NRF that the NF is unavailable.
  • the reason for deregistration may be that the NFp is destroyed, or the NFp needs to be registered on another NRF due to network planning changes, or the NF is unavailable when the NRF is about to be shut down or disconnected from the network.
  • NRF deletes the configuration data of NF.
  • the NRF can delete the NFp profile according to the NFp management policy and mark the NFp as unavailable.
  • NRF sends a deregistration response (Nnrf_NFManagement_NFDeregister Response) message to NF.
  • NF receives the deregistration response message from NRF.
  • NFp registration/registration update/deregistration process is only an example, and this application is not limited thereto. Other methods and processes that can realize NF registration fall within the scope of protection of this application.
  • NF can obtain authorization from NRF by performing a service discovery process with NRF. That is, before NF requests services from other NFs, it will request information from NRF about the NF that can provide this service. For example, the AMF requests the NRF for information about the SMF that can provide the UE with a PDU session.
  • FIG 4 is a schematic flowchart of NF service discovery 400 in different scenarios.
  • steps S411-S413 are the NF service discovery process in the non-roaming scenario, that is, NF and NRF belong to the same service PLMN
  • steps S421-S423 are the NF service discovery process in the roaming scenario, that is, NF and NRF belong to different service PLMNs.
  • NF for example, NFc
  • NRF service discovery request
  • NRF receives the service discovery request message from NF.
  • the service discovery request message is used for NFc to request to discover the desired NFp instance, and the service discovery request message includes the desired The NFp service name, the NF type of the desired NFp instance and the NF type of NFc.
  • the NFc discovers the services available in the PLMN network based on the service name (eg, establishing a PDU session) and the target NF type (eg, SMF).
  • the service name e.g, establishing a PDU session
  • the target NF type e.g, SMF
  • the service discovery request message also includes the producer NF set ID, NF service set ID, SUPI, data set identifier, external group ID (for UDM and UDR discovery), the UE's routing indicator and home network public domain.
  • Key identifier used for UDM and AUSF discovery
  • S-NSSAI S-NSSAI
  • NSI ID and other service-related parameters.
  • the service discovery request message may include an SMF area ID or an SMF set ID.
  • the service discovery request message includes indication information of the SMF location.
  • NRF authorizes Nnrf_NFdiscovery_Request and determines the NFp instance expected by NFc.
  • the NRF determines whether to allow NFc to discover the desired NFp instance based on the configuration file of the desired NFp or NFp service, and the type of NFc. If the desired NFp instance or NF service instance is deployed in a certain network slice, NRF authorizes the discovery request based on the network slice's discovery configuration. For example, a desired NFp instance can only be discovered by NFc in the same network slice.
  • NRF determines the set of NFp instances that match the service discovery request message and the NRF internal policy based on parameters such as service name, home network, or desired NFp set included in the request sent by NFc.
  • NFp determined by NRF may be one or more, and this application does not specifically limit this.
  • NRF sends a service discovery response (Nnrf_NFdiscovery_Response) message to NF.
  • NF receives the service discovery response message from NRF.
  • the service discovery response message includes information about the NFp instance collection, such as NFp profile.
  • the NRF should not limit the set of discovered NFp instances or NFp service instances to the target NFp location. For example, if an NFp instance or NFp service instance cannot be found for a preferred target NFp location, the NRF may provide an NFp instance or NFp service instance at a location other than the preferred target NFp location.
  • NF for example, NFc
  • NRF NRF
  • NRF receives the service discovery request message from NF.
  • the service discovery request message is used for NFc to request to discover the desired NFp instance.
  • the service discovery request message includes the desired NFp service name, the NF type of the desired NFp instance, the home PLMN ID, the service PLMN ID, or the NF type of the NFc. .
  • the service discovery request message also includes the producer NF set ID, NF service set ID, S-NSSAI, NSI ID and other service-related parameters.
  • the NRF interacts with the home hNRF in service discovery request messages to obtain the NFp profile of the NFp instance.
  • the NRF in the serving PLMN identifies the hNRF in the home PLMN according to the home PLMN ID, and forwards the NFc service discovery request message to the hNRF to obtain the NFp profile of the desired NFp instance deployed in the home PLMN. Since the NRF in the serving PLMN triggers the service discovery request on behalf of the NFc, the NRF in the serving PLMN should not replace the information of the NFc.
  • the hNRF may also query the hPLMN for a suitable local NRF based on input information received from the NRF serving the PLMN.
  • the FQDN of the local NRF or the endpoint address of the NF discovery service of the local NRF in the hPLMN may be configured in the hNRF, or may need to be discovered based on the input information.
  • the NRF determines the NFp instance set that matches the service discovery request message and the NRF internal policy, and sends the NFp instance set to the NRF.
  • NF sends a service discovery response message to NRF.
  • NRF receives the service discovery response message from NF.
  • the service discovery response message includes information about the NFp instance collection, such as NFp profile.
  • NF service discovery process is only an exemplary description, and this application is not limited thereto. Other methods and processes that can achieve the acquisition of the desired NFp instance fall within the protection scope of this application.
  • NRF can register NFp based on the configuration data of NFp and provide the desired NFp instance or NFp service instance for NFc. Further, NFc needs to try to establish a network connection with NFp. Specifically, between NFc and NFp, if the certificate of NFp expires (for example, the certificate expires) or is revoked (for example, the certificate does not expire but is revoked due to network management, or the private key of NFp is leaked, etc.), then This connection will fail to be established, which will affect network efficiency.
  • the certificate of NFp expires
  • revoked for example, the certificate does not expire but is revoked due to network management, or the private key of NFp is leaked, etc.
  • NFc fails to establish a network connection with NFp, it can re-request service discovery from NFp. However, subsequent NFc may still provide the same NFp to NFc, causing the network connection to fail again and affecting the service process.
  • NF life cycle when the NF life cycle is inconsistent with the certificate life cycle, some security risks will be exposed.
  • NRF may still discover the NF during the NF service discovery process and provide it to NFc.
  • NFc establishes a TLS connection with NFp, although NFc can choose another NFp, the connection between NFc and NFp may fail because the NFp's certificate is invalid.
  • failure to set up a connection can also affect network efficiency.
  • this application provides a communication method and device.
  • the certificate information owned by NFp in the NFp registration process and adding verification of the validity of the certificate owned by NFp in the NFc service discovery process, it can avoid Or it can reduce the possibility of failure to establish a network connection due to the invalidation or revocation of the NFp certificate when subsequently establishing a TLS connection between NFc and NFp, thereby improving network efficiency and user experience.
  • At least one refers to one or more, and “multiple” refers to two or more.
  • “And/or” describes the association of associated objects, indicating that there can be three relationships, for example, A and/or B, which can mean: A exists alone, A and B exist simultaneously, and B exists alone, where A, B can be singular or plural.
  • the character “/” generally indicates that the related objects are in an "or” relationship.
  • “At least one of the following” or similar expressions thereof refers to any combination of these items, including any combination of a single item (items) or a plurality of items (items).
  • At least one of a, b and c can mean: a, or, b, or, c, or, a and b, or, a and c, or, b and c, or, a , b and c.
  • a, b and c can be single or multiple respectively.
  • first”, “second” and various numerical numbers indicate distinctions for convenience of description and are not used to limit the embodiments of the present application. range. For example, to distinguish different messages, etc., rather than describing a specific order or sequence. It is to be understood that objects so described are interchangeable where appropriate to enable description of aspects other than the embodiments of the present application.
  • “for indication” may include “for direct indication” and “for indirect indication”.
  • certain indication information when used to indicate A, it may include that the indication information directly indicates A or indirectly indicates A, but it does not mean that the indication information must carry A.
  • the instruction methods involved in the embodiments of this application should be understood to cover various methods that can enable the party to be instructed to obtain the information to be instructed.
  • the information to be instructed can be sent together as a whole, or can be divided into multiple sub-information and sent separately, and the sending cycle and/or sending timing of these sub-information can be the same or different. This application does not limit the specific sending method.
  • the "instruction information" in the embodiment of this application may be an explicit indication, that is, a direct indication through signaling, or may be obtained based on parameters indicated by signaling, combined with other rules or other parameters, or obtained through derivation. It can also be an implicit indication, that is, obtained based on rules or relationships, or based on other parameters, or derivation. This application does not specifically limit this.
  • protocol may refer to a standard protocol in the communication field, which may include, for example, 5G protocol, new radio (NR) protocol, and related protocols applied in future communication systems.
  • Preconfigured may include predefined. For example, protocol definition. Among them, “pre-definition” can be realized by pre-saving corresponding codes, tables or other methods that can be used to indicate relevant information in the device. This application does not limit its specific implementation method.
  • storage may refer to saving in one or more memories.
  • the one or more memories may be a separate device, or may be integrated in an encoder or decoder, a processor, or a communication device.
  • the one or more memories may also be partially provided separately and partially integrated in the decoder, processor, or communication device.
  • the type of memory can be any form of storage medium, and this application is not limited thereto.
  • FIG. 5 is a schematic flowchart of the first communication method 500 provided by the embodiment of the present application. As shown in Figure 5, the method includes the following steps.
  • the service discovery function network element receives a service discovery request message.
  • the service request message is used to request the service discovery function network element to provide the first type of network function network element.
  • the service discovery function network element receives the service discovery request message from the second network function network element (for example, the network function service consuming network element NFc); or, the service discovery function network element receives the service discovery request message through the proxy network element (for example, the communication agent ( service communication proxy (SCP)) receives a service discovery request message from the second network function network element.
  • the proxy network element for example, the communication agent ( service communication proxy (SCP)
  • the service discovery function network element (for example, NRF1) can also receive service discovery request messages from other service discovery function network elements (for example, NRF2).
  • the service discovery request message can be understood as a message that calls the service discovery request, and service discovery can be understood as: the service discovery function network element discovers the first network function network element that can provide a specific service for the second network function network element.
  • sending a service discovery request message can be understood as triggering the service discovery process.
  • the service discovery request message may include the type of network function expected by the second network function network element (ie, the first type).
  • the service discovery function network element may be an NRF or a network element used for the service discovery function in the future.
  • the first type may be session management
  • the second network function network element may be an AMF
  • the network function network element requesting discovery may be an SMF.
  • the AMF requests the NRF for information about the SMF used to provide a PDU session for a certain user.
  • the service discovery function network element sends a service discovery response message including the identification information of the first network function network element to the second network function network element NFc; or, the service discovery function network element sends a service discovery response message to the second network function network element through SCP.
  • Service discovery response message Send a service discovery response message including the identification information of the first network function network element; or, the service discovery function network element sends a service discovery response message including the identification information of the first network function network element to the second network function network element through other service discovery function network elements.
  • the identification information of the first network function network element may be NF ID (Identity or Identifier), or the instance ID of NF, which is used for subsequent communication between the second network function network element and the first network function.
  • Network elements establish network connections.
  • the service discovery response message includes the configuration data (NF Profile) of the first network function network element, such as the type of NF (such as AMF, SMF, etc.), the PLMN identifier to which the NF belongs (such as PLMN ID), and slice-related identification.
  • Identifier for example, the single network slice selection auxiliary information to which the NF belongs), the NSI ID of the slice instance to which the NF belongs), or the location information of the NF, etc. This application does not specifically limit this.
  • the service discovery function network element determines the first network function network element of the first type according to the first type in the service discovery request message. For specific implementation methods, please refer to step S412 in the above-mentioned method 400. For the sake of simplicity, details will not be described here. Further, the service discovery function network element determines that the first certificate has not expired according to the validity period of the first certificate, and the service discovery function network element determines that the first certificate has not been revoked, and then determines the first certificate of the first network function network element of the first type. The certificate is valid.
  • the service discovery function network element can obtain the validity period of the first certificate by querying the NF context.
  • the service discovery function network element determines that the first certificate has not been revoked, including the following implementation methods.
  • the service discovery function network element locally queries the certificate revocation list (for example, it can be a certificate revocation list (certificate revocation list, CRL) or online certificate status protocol (online certificate status protocol, OCSP)), and in When the first certificate does not belong to the certificate revocation list, the service discovery function network element determines that the first certificate has not been revoked.
  • the certificate revocation list for example, it can be a certificate revocation list (certificate revocation list, CRL) or online certificate status protocol (online certificate status protocol, OCSP)
  • the service discovery function network element determines that the first certificate has not been revoked.
  • the certificate revocation list may be preconfigured.
  • the certificate revocation list is deployed on the service discovery function network element, and the certificate revocation list will list all currently revoked or suspended digital certificate information.
  • the service discovery function network element sends a query request message to the server, and the query request message is used to query whether the first certificate is revoked; the service discovery function network element receives a query response message from the server, and the query response message The message includes an indication that the first certificate has not been revoked; the service discovery function network element determines that the first certificate has not been revoked based on the indication.
  • the server can be a CRL or OCSP server.
  • NRF queries NFp via CRL or OCSP server The status of the certificate (whether it has been revoked).
  • the NRF can interact with the CRL or OCSP server directly or through the proxy network element SCP, depending on where the CRL/OCSP server is deployed (for example, the NRF, or the CRL or OCSP server).
  • the certificate revocation list is deployed on an external server.
  • the certificate revocation list is a time-stamped list, including information on all currently revoked or suspended digital certificates.
  • the certificate revocation list contains two fields: the current update date and the next update date. Users can use these two date information to determine whether the current certificate revocation list is the latest and manage the certificate revocation list buffer.
  • the first certificate also includes one or more of the following: the identification of the certificate-issuing network element that issued the first certificate; the identification of the holder of the first certificate; the public key of the holder of the first certificate; or the certificate-issuing network element. Certificate signature of network element, etc.
  • the service discovery function network element receives a registration request message.
  • the registration request message is used to request to register the first network function network element to the service discovery function network element.
  • the registration request message includes the first certificate, and the first certificate.
  • One certificate includes the identification information of the first certificate and the validity period of the first certificate.
  • the identification information of the first certificate may be the first certificate ID (identity or identifier), which represents the identity information of the first certificate itself.
  • the service discovery function network element receives the registration request message from the network function service consuming network element; or, it receives the registration request message from the network function service consuming network element through the proxy network element (such as SCP).
  • the proxy network element such as SCP
  • the service discovery function network element NRF receives the registration request message from the network function service consuming network element NFc through the SCP, the SCP needs to carry the SCP certificate in the connection establishment request message and complete two-way authentication with the NRF to establish a network connection. . Therefore, when establishing a connection through SCP, all certificates of the first network function network element NFp are carried in the registration request message and not in the SCP connection establishment request message.
  • the network function service providing network element needs to complete two-way authentication based on the certificate when establishing a network connection with the service discovery function network element, so a certain certificate needs to be carried in the connection establishment request.
  • the first certificate in the registration request message can be all certificates owned by the network function service providing network element, or it can be other certificates except the certificate used to establish the network connection. This application does not specifically limit this.
  • the service discovery function network element receives a connection establishment request message.
  • the connection establishment request message is used to request the first network function network element to establish a connection with the service discovery function network element.
  • the connection establishment request message includes the first
  • the first certificate includes the identification information of the first certificate and the validity period of the first certificate.
  • the service discovery function network element receives the connection establishment request message from the first network function network element NFp; or, it receives the connection establishment request message from the first network function network element NFp through the proxy network element (for example, SCP).
  • the proxy network element for example, SCP
  • the first certificate may be one.
  • the network function service providing network element needs to complete two-way authentication based on the certificate when establishing a network connection with the service discovery function network element, so the network connection establishment request needs to carry the first certificate.
  • the registration request message may or may not carry the first certificate, which is not specifically limited in this application.
  • the service discovery function network element notifies the acceptance of the registration request of the first network function network element NFp by sending a registration response message, and stores the configuration data of the first network function network element.
  • the service discovery function network element when it is determined that the first certificate is valid, stores the first certificate as an NFp context on the service discovery function network element; or, when it is determined that the first certificate is valid, Next, the service discovery function network element stores the identification information of the first certificate and the validity period of the first certificate as the NFp context on the service discovery function network element.
  • the service discovery function network element only accepts the registration request of the first network function network element (for example, NFp) after confirming that the first certificate is valid, that is, it stores the configuration data of the first network function network element and the first certificate. Or the identification information of the first certificate and the validity period of the first certificate.
  • the first network function network element for example, NFp
  • NRF needs to store the certificate information used to establish a TLS connection between NF and NRF on NRF as the context of NF.
  • the service discovery function network element may not store the first certificate, or may not store the identification information of the first certificate and the first certificate. Validity period. Based on this implementation, when the service discovery function network element receives a service for requesting discovery of the first type of network function network element, it can send the identification information of the first type of first network function network element to the external server, such as a certificate.
  • the revocation list server or the online certificate status protocol server is used to request to obtain the validity of the first certificate (query the validity period and certificate status of the first certificate), and then the service discovery function network element based on the external server
  • the feedback response message determines whether to provide the identification information of the first network function network element to the second network function network element NFc. For example, if the external server feedbacks that the first certificate is valid, the service discovery function network element provides the identification information of the first network function network element NFp to the second network function network element NFc.
  • the service discovery function network element sends message #1 to the certificate revocation list server.
  • the message #1 includes the identification information of the first network function network element of the first type (for example, NFp ID or NF instance ID).
  • the message #1 #1 is used to query the certificate revocation list server for the validity of the first certificate of the first network function network element.
  • the certificate revocation list server receives message #1 from the service discovery function network element and searches for the certificate corresponding to NFp based on the NF instance ID.
  • the server does not find its corresponding certificate, it means that the first certificate owned by the NFp instance has not been revoked; if the server finds its corresponding certificate, it means that one or more of the first certificates owned by the NFp instance have been revoked, then An indication that the first certificate of the NFp instance is revoked is returned to the service discovery function network element.
  • the service discovery function network element determines that the first certificate is issued by the certificate-issuing network element for the first network function network element based on the public key of the first network function network element and the public key of the certificate-issuing network element. certificate; the service discovery function network element determines that the first certificate has not expired based on the validity period of the first certificate; and the service discovery function network element determines that the certificate of the first certificate has not been revoked.
  • the public key of the first network function network element and the public key of the certificate issuing network element may be pre-configured by the service discovery function network element, or may be carried through the registration request message, which is not specifically limited in this application.
  • the public key and the private key are used for encryption and generating digital signatures respectively.
  • the public key can be sent to the network and the private key must be stored within the holder. That is to say, the first network function network element and the certificate issuing network element can respectively generate digital signatures for the first certificate through their respective private keys.
  • the service discovery function network element can use the first network function network element to generate digital signatures for the first certificate.
  • the public key of the certificate-issuing network element and the public key of the certificate-issuing network element are decrypted to verify the encryption protection of the two. If the verification is successful, it means that the first certificate belongs to the first network functional network element and is signed and authenticated by the certificate-issuing network element. There is no Tampered by other functional entities.
  • the second network function network element NFc can obtain the identification information of the first network function network element NFp of the first type from the service discovery function network element NRF, and establish a network connection with it. At this time, if the first certificate of the first network function network element becomes invalid or revoked, it will cause the network connection to fail to be established, thus affecting network efficiency.
  • the service discovery function network element receives indication information, the indication information is used to indicate that the first certificate is revoked, and the indication information includes the identification information of the first certificate; the service discovery function network element sends a notification message, and the notification message Used to notify the first network function network element that the first certificate is revoked.
  • the service discovery function network element may receive indication information from the certificate issuing network element (when the first certificate is revoked); or, it may also receive indication information from the second network function network element NFc (when the network connection fails to be established).
  • the service discovery function network element receives a subscription request message, and the subscription request message is used to request the service discovery function network element to subscribe to the certificate status of the first certificate.
  • the service discovery function network element receives the subscription request message from the second network function network element NFc; or, the service discovery function network element receives the subscription request message from the second network function network element NFc through the proxy network element SCP.
  • the service discovery function network element receives indication information from the certificate issuing network element.
  • the certificate issuing network element sends instruction information to the network storage function network element corresponding to the first network function network element.
  • the certificate issuing network element determines the network storage function network element based on the preconfigured network storage function network element corresponding to the first network function network element.
  • the network storage function network element information corresponding to the first network function network element may be sent when the first network function network element NFp requests a certificate from the certificate issuance network element, and stored in the certificate issuance network element; or , the network storage function network element information corresponding to the first network function network element can also be part of the content of the first certificate issued by the certificate issuance network element to the first network function network element NFp; or, it can be a network management network element or network The administrator pre-configures it on the certificate-issuing network element.
  • the certificate issuance network element determines the first network function network element based on the instance identifier of the first network function network element or the first network function network element on the first certificate.
  • the certificate revocation list address on the certificate determines that the functional network element that maintains the first certificate is the network storage functional network element.
  • the service discovery function network element adds the first certificate to the certificate revocation list according to the instruction information.
  • the service discovery function network element receives the instruction information from the certificate-issuing network element and promptly updates the locally stored certificate revocation list.
  • the reason why the certificate-issuing network element revokes the first certificate may be: the certificate-issuing network element receives a revocation request from another entity, or actively revokes the first certificate, such as the private key of the first network function network element being leaked. After detecting this security incident, the network administrator requests the certificate-issuing network element to revoke the certificate, or due to network maintenance by the operator, it is necessary to update the configuration of the first network function network element, revoke or temporarily suspend the first certificate, etc.
  • the indication information may also be used to indicate that the first certificate is revoked, and the indication information includes identification information of the first certificate. That is to say, the instruction information and the instruction information that causes the receiving end (for example, the network storage function network element NRF) to add the first certificate to the revocation list may be the same instruction information, and there is no specific limitation on this.
  • the service discovery function network element receives a deregistration request message from the first network function network element; the service discovery function network element sends a notification message, and the notification message is used to notify the first network function network element of The first certificate is invalid.
  • certificate invalidity includes certificate invalidation or certificate revocation. Certificate invalidation is generally understood as the validity period of the certificate has expired, and certificate revocation is generally understood as the certificate has not expired, but due to some reasons (such as NF Private key leakage or network management, etc.) and was revoked.
  • the service discovery function network element may receive an indication that the first certificate is invalid from the first network function network element (deregistration request).
  • the reason for de-registration may be that the first network function network element is destroyed, or it may be that the network planning change requires the first network function network element to register on another service discovery function network element (such as NRF), etc. This application discusses this Not limited.
  • NRF determining NFp in the service discovery process and verifying the validity of the NFp's certificate is only an illustrative description and should not constitute any limitation on the technical solution of this application.
  • the above solution is mainly aimed at the scenario where NFc requests the first type of network function network element NFp and NFc provided by NRF to be registered on the same NRF and belong to the same PLMN.
  • the application contexts of NFc and NFp are stored on the same NRF. .
  • this application is also applicable to the following scenario, that is, the first type of network function network element provided by the NRF (for example, NRF1) requested by the NFc may be discovered and determined by other NRFs (for example, NRF2). That is, the application contexts of NFc and NFp are stored in NRF1 and NRF2 respectively. Therefore, this application does not limit the number of NRFs.
  • NRF1 the first type of network function network element provided by the NRF
  • NRF2 for example, NRF2
  • NFc initiates the service discovery process.
  • NFc sends a service discovery request message to the NRF (ie NRF1) in the VPLMN.
  • the request message carries the home PLMN ID.
  • NRF1 identifies the NRF (hNRF) in the home HPLMN (i.e. NRF2) based on the home PLMN ID, and triggers "NF Discovery" on behalf of the NFc.
  • NRF2 in HPLMN queries the NFp's certificate validity through the NF context, and queries the NFp's certificate revocation status through the CRL or OCSP server.
  • NRF2 in HPLMN can interact with the CRL or OCSP server directly or through a proxy, depending on where the CRL or OCSP server is deployed (for example, on NRF2 or a third-party server).
  • NRF2 in the HPLMN sends a service discovery response message to NRF1 in the VPLMN, carrying NFp information (such as the instance ID of the NFp).
  • NRF1 in the VPLMN then forwards the service discovery response message to the NFc.
  • the process of NRF2 searching and discovering NFp and NRF2 verifying the validity of the NFp's certificate can refer to the above steps S510 and S520, as well as the steps S421-S423 in the above method 400. For the sake of brevity, they will not be described again here.
  • the technical solution of this application is suitable for describing management certificates and communications in non-roaming scenarios, and is also applicable to roaming scenarios. This application does not specifically limit this.
  • this application can verify the validity of the first certificate of the first network function network element and provide the information of the first network function network element to the second network function network element if the verification is passed. Avoid or reduce the failure of network connection establishment due to the invalidation or revoking of the certificate of the first network function network element during the process of establishing network connection between the first network function network element and the second network function network element, thereby improving network efficiency. , and improve user experience.
  • the service discovery function network element sends the service discovery response message that does not include the identification information of the third network function network element.
  • the service discovery function network element when it is determined that the certificates of all network function network elements of the first type are invalid, the service discovery function network element sends a service discovery response message to refuse to provide the network function network element of the first type.
  • the technical solution of this application is based on the existing business discovery process and combines the certificate revocation status query with the service discovery process, thereby optimizing the efficiency of the certificate revocation status query.
  • the technical solution of this application can also prevent the NRF from continuing to provide the NFp to the NFc after the NFp's certificate expires or is revoked, which may cause the connection setup to fail.
  • the following takes NFp requesting service registration from NRF and NFc requesting service discovery from NRF as an example.
  • NRF NFp requesting service registration
  • NFc NFc requesting service discovery
  • FIG. 6 is a flow example diagram of the second communication method 600 provided by the embodiment of the present application. As shown in Figure 6, it specifically includes the following steps.
  • NRF maintains the CRL of the certificates of all NFs in the service area.
  • the CRL is stored in NRF, that is, NRF can locally query the certificate status information of all NFs in the service area.
  • NFp sends registration request message #1 to NRF.
  • NRF receives registration request message #1 from NFp.
  • the registration request message #1 carries the certificate owned by the NFp, and each certificate of the NFp includes a certificate ID and a certificate validity period.
  • the certificate validity period can be the issuance time and validity period of the certificate, or it can be the certificate's validity expiration time, etc.
  • the NFp certificate also includes the CA ID that issued the certificate, the certificate's signature, the certificate holder ID, or the certificate holder's public key, etc.
  • the registration request message #1 includes all certificates owned by the NFp, and this application does not limit the number of certificates owned by the NFp.
  • the number of NFp certificates depends on different levels of CA issuance, or business types, etc.
  • NRF stores the certificate owned by NFp as NFp context on NRF.
  • NRF can store the certificate ID and certificate validity period of NFp as NFp context on NRF.
  • NRF can also store all the information of all certificates of NFp on NRF as NFp context. This application does not specifically limit this. .
  • the NRF after receiving the registration request message #1, stores the certificate information of the NFp as the NFp context on the NRF.
  • the registration request message #1 may or may not carry the certificate information. This is because if NFp has only one certificate, then when establishing a TLS connection, NFp and NRF need to send certificates to each other to verify the legitimacy of both parties, and then initiate a registration request. At this time, NRF has obtained the certificate of NFp, so NFp does not need to carry the certificate information in the registration request message #1.
  • the registration request message #1 may carry the certificate information of the multiple certificates, or may not carry the information of the certificate used when establishing a TLS connection with the NRF. This application will Not limited.
  • the NRF verifies all certificates of the NFp. For example, NRF verifies the validity of the certificate (certificate validity period and certificate status), and verifies the authenticity of the certificate (whether the certificate belongs to the NFp). After the verification is passed, the NFp's certificate information is stored on the NRF as the NFp context.
  • the NRF uses the CA public key to verify the CA's signature on the received NFp's certificate, and the NRF uses the NFp's public key to verify the NFp's signature on the received NFp's certificate to determine that the certificate belongs to the CA A certificate issued for this NFp and has not been tampered with. Further, determine whether the certificate has expired by querying the certificate information (certificate validity period) in the stored NFp context, and locally query whether the certificate status of the NFp in the CRL has been revoked.
  • the certificate information certificate validity period
  • NRF stores the NFp's certificate ID and certificate validity period as NFp context in NRF superior.
  • the NRF may not store the certificate of the NFp, or may not store the identification information and validity period of the certificate of the NFp.
  • the subsequent NRF when it receives a service for requesting discovery of the first type of network function network element, it can send the identification information of the first type of NFp to an external server, such as a certificate revocation list server CRL or a line certificate status.
  • the protocol OCSP server is used to request the validity of the NFp certificate (query the validity period and certificate status of the certificate), and then provide the NFp identification information to the NFc when it is determined that the NFp certificate is valid.
  • NF does not need to carry information about the certificate used to establish a TLS connection with NRF.
  • NFc1 sends service discovery request message #1 to NRF.
  • NRF receives service discovery request message #1 from NFc1.
  • the service discovery request message #1 is used by NFc1 to request discovery of the desired NFp instance.
  • the service discovery request message #1 includes the desired NFp service name, the NF type of the desired NFp instance, the NF type of NFc1, etc.
  • NRF verifies the validity of the NFp's certificate and determines that the NFp's certificate is valid, that is, the NFp's certificate validity verification passes.
  • the NRF may authorize the discovery request of NFc1 according to the configuration file of the desired NFp or NFp service, and the type of NFc.
  • the NRF may authorize the discovery request of NFc1 according to the configuration file of the desired NFp or NFp service, and the type of NFc.
  • step S412 in the above method 400 to determine the set of NFp instances that match the service discovery request message #1 and the NRF internal policy.
  • the NRF verifies the validity of the NFp certificate after determining one or more NFp that can serve NFc1. Specifically, NRF determines whether this certificate has expired by querying the certificate information (certificate validity period) in the stored NFp context (certificate information), and then locally queries whether the status of this certificate recorded in the CRL has been revoked. If all verifications pass, the NFp is considered to be an NFp instance that can serve NFc1. For example, NFp has only one certificate, and the validity expiration time of the certificate is t5. Assuming that the current time is t1, it means that the certificate has not expired. Then NRF queries the status of the certificate in the CRL as non-revoked, which means that the certificate of the NFp After passing the verification, it can be used for the NFp instance serving NFc1.
  • the judgment criterion is that all certificates of the NFp pass verification, or the certificate used to serve NFc1 passes verification. At this time, the NFp can be used for the NFp instance serving NFc1.
  • NFc1 is AMF and NFp is SMF.
  • SMF There are multiple certificates on SMF, including TLS client certificates and TLS server certificates used to establish connections with other NFs, and there are also NE certificates used to establish connections with UPF.
  • AMF requests NRF to discover SMFs that can be used for services, and the NE certificate of an SMF found by NRF expires or is revoked, NRF can determine whether to provide the SMF to AMF based on the revocation reason or local policy. For example, if the reason for revocation is that the private key of the SMF is leaked, the SMF cannot be provided to AMF; if the reason for revocation is network maintenance or the NE certificate is temporarily suspended, then the SMF can be provided to AMF.
  • NRF sends service discovery response message #1 to NFc1.
  • NFc1 receives service discovery response message #1 from NRF.
  • the service discovery response message #1 is used to notify NFc1 that the service discovery request is successful.
  • the service discovery response message #1 includes information about the NFp instance collection, such as NFp profile.
  • NRF can provide NFp information to NFc1, such as NFp Instance ID and NF type of NFp.
  • steps S613-S615 can refer to the above-mentioned steps S411-S413, and for the sake of simplicity, they will not be described again here.
  • NFc1 sends a subscription request message #1 to NRF, which is used to subscribe to NRF for the certificate status of NFp provided in the above step S615; or in other words, this subscription request message #1 is used to subscribe to NRF Whether the NFp provided in step S615 above is available.
  • This implementation method can ensure that NFc1 understands the certificate validity of NFp in real time and avoids network establishment failure or failure to request services from NFp, thereby reducing network efficiency and user experience.
  • the subscription request message #1 may be sent to the NRF together with the service discovery request message #1, that is, in step S613.
  • the subscription request message #1 may also be sent after NFc1 receives the NFp information provided by NRF, that is, after step S615.
  • the first method is that the CA/RA revokes or revokes the NFp's certificate, and requests the NRF to update the NFp's certificate status in the CRL to invalid (revoked or revoked).
  • the second method is that the NFp actively requests NRF to register and delete the NFp's certificate information.
  • the CA/RA receives revocation requests sent by other NF entities. For example, when the network administrator detects that the NFp's private key is leaked, it requests the CA/RA to revoke the NFp's certificate.
  • the CA/RA proactively revokes the NFp's certificate. For example, due to the operator's network maintenance, the configuration information of the NFp needs to be updated, so the NFp's certificate is revoked or temporarily suspended.
  • CA/RA sends CRL update request message #1 to NRF.
  • NRF receives CRL update request message #1 from CA/RA.
  • CRL update request message #1 is used to request to update the CRL stored on the NRF.
  • the CA/RA after the CA/RA revokes the certificate, it locates the location of the functional entity that maintains the CRL of the certificate based on the NFp instance ID or CRL address on the certificate, that is, the NRF. Then, the CA/RA sends a CRL update request to the NRF to request to update the certificate status of the NFp in the CRL on the NRF. For example, suspension or suspension.
  • the CA/RA periodically updates the CRL.
  • the CA/RA updates the CRL every hour, day, or week.
  • the CA/RA can trigger a CRL update every time a new certificate is revoked.
  • the CA/RA is pre-configured to send the instruction information of the CRL update request message #1 to the NRF.
  • the NRF updates the locally stored CRL, that is, adds the NFp's certificate to the CRL.
  • NRF sends notification message #1 to NFc1.
  • NFc1 receives notification message #1 from NRF.
  • the notification message #1 is used to notify NFc1 that the certificate of the NFp is revoked (invalid).
  • the NRF may notify NFc1 that the NFp's certificate has been revoked (invalid) based on the subscription request message #1 received from NFc1 in step S613.
  • the NRF sends notification message #1 to the NFc.
  • the NRF may not perform step S623, that is, the NFp may still serve as an NFp instance serving NFc1.
  • NRF notifies NFc1 that the NFp's certificate has been revoked, so that NFc1, which has already performed the service discovery process and obtained NFp information, will not establish a connection with the NFp to continue communication, which can improve network efficiency and user experience.
  • NFc2 sends service discovery request message #2 to NRF.
  • NRF receives service discovery request message #2 from NFc2.
  • the service discovery request message #2 is used for NFc2 to request discovery of a desired NFp instance.
  • the service discovery request message #2 includes the desired NFp service name, the NF type of the desired NFp instance and the NF type of NFc2.
  • NRF verifies the validity of the NFp's certificate and determines that the NFp's certificate is invalid, that is, the NFp's certificate validity verification fails.
  • NRF sends service discovery response message #2 to NFc2.
  • NFc2 receives service discovery response message #2 from NRF.
  • the service discovery response message #2 is used to notify NFc2 that the service discovery request failed.
  • NRF fails to verify the validity of the certificate owned by NFp, it will not provide NFp's information to NFc2. For example, NRF needs to check the certificate validity period and certificate status of NFp. Since the certificate of NFp is revoked or revoked in step S621, even if the certificate of NFp is still within the validity period, its validity is not passed.
  • steps S624-S626 may refer to the above-mentioned steps S613-S615, and for the sake of simplicity, they will not be described again here.
  • NFp can request the CA/RA to issue a certificate again. After obtaining the certificate, the NFp can send a registration update message to the NRF to request an update of the NFp's certificate information. Further, it is convenient for other NFs to find the NFp in the subsequent service discovery process requesting the NRF.
  • the registration update message carries information about the new certificate obtained by NFp.
  • steps S321-S323 in method 300 For the specific implementation method of NFp requesting registration from NRF, please refer to the above steps S612a and S612b.
  • steps S612a and S612b For the specific implementation method of NFp requesting CA/RA to issue a certificate, please refer to the current standard.
  • the technical solution provided is not specifically limited in this application. For the sake of brevity, no further details will be given here.
  • NRF can notify NFc2 after the certificate suspension is restored.
  • the NRF may also send the NFp's certificate suspension duration or the suspension period to the NFc2, so that the NFc2 can continue to communicate with the NFp after the certificate suspension is restored.
  • NFp sends deregistration request message #1 to NRF.
  • NRF receives deregistration request message #1 from NFp.
  • the deregistration request message #1 is used to notify the NRF that the NFp is unavailable.
  • the reason why the NFp requests to register may be that the NFp is destroyed, or the NFp's private key is stolen or destroyed, or the NFp needs to register on other NRFs due to network planning changes, etc.
  • NRF deletes the NFp context and adds the NFp certificate information to the CRL.
  • the NRF deregisters the NFp according to the deregistration request message. For example, NRF deletes NFp profile and NFp certificate information, and marks NFp as unavailable. At the same time, NRF adds the certificate information of NFp (such as integer ID and pin number validity period) In the CRL, it is used to indicate that the certificate owned by the NFp has expired.
  • NFp such as integer ID and pin number validity period
  • NRF sends notification message #2 to NFc1.
  • NFc1 receives notification message #2 from NRF.
  • the notification message #2 is used to notify NFc1 that the NFp has been deregistered or the NFp's certificate has expired.
  • NRF notifies NFc1 that the NFp's certificate is invalid, so that NFc1, which has already performed the service discovery process and obtained NFp information, will not establish a connection with the NFp to continue communication, which can improve network efficiency and user experience.
  • the above description takes the network functions belonging to the same PLMN as an example, that is, the management certificate and communication are described in a non-roaming scenario, but the technical solution of this application is also applicable to the roaming scenario, that is, NFp and NRF belong to different PLMNs.
  • the specific implementation method may refer to the above-mentioned method 600 and steps S421-S423 in the method 400. For the sake of simplicity, details will not be described here.
  • the method disclosed in this application prevents NFc from establishing a TLS connection with NFp by providing certificate information owned by NFp in the NFp registration process and adding validity verification of the certificate owned by NFp in the NFc service discovery NFp process. , connection establishment fails due to invalid NFp certificate, reducing network efficiency and user experience.
  • the following method 700 is proposed to deploy the CRL on an external CRL server.
  • NRF can obtain the certificate status of the NFp certificate (whether it has been revoked) in real time through information interaction with the CRL server.
  • the following takes NFp requesting service registration from NRF and NFc requesting service discovery from NRF as an example.
  • NRF NFp requesting service registration
  • NFc NFc requesting service discovery
  • FIG. 7 is a flow example diagram of the third communication method 700 provided by the embodiment of the present application. As shown in Figure 7, the method includes the following steps.
  • NFp sends registration request message #a to NRF.
  • NRF receives the registration request message #a from NFp.
  • the registration request message #a carries the certificate owned by the NFp, and each NFp's certificate includes a certificate ID and a certificate validity period.
  • NRF verifies the validity of NFp's certificate.
  • NRF verifies the validity of the NFp's certificate, including the certificate validity period and certificate status, as well as the authenticity of the certificate (whether the certificate belongs to the NFp). For example, regarding the authenticity of the NFp certificate, NRF can verify the signature of the certificate through the NFp public and private keys to ensure that the certificate is the certificate of the NFp. For another example, for the verification of NFp's certificate validity period and certificate status, NRF first checks the NFp's certificate information (such as the validity period of the certificate), determines whether the certificate is within the validity period (that is, determines whether the certificate has expired), and then queries the CRL server Whether the certificate has been revoked. When the NFp's certificate has not expired and the certificate has not been revoked or revoked, the NRF can determine that the certificate's validity verification has passed.
  • the NFp's certificate information such as the validity period of the certificate
  • NRF stores the certificate information owned by NFp as NFp context on NRF.
  • the NRF stores the certificate information of the NFp (for example, certificate ID and certificate validity period) on the NRF.
  • NRF can also store all information of all certificates of NFp on NRF.
  • the NRF sets the certificate status value of each certificate of the NFp to valid or invalid.
  • NRF can add a status value (valid/invalid) to each certificate of NFp according to local policies.
  • the judgment standard is that all certificates of NFp have passed verification or are used for services.
  • the certificate of NFc1 is verified, and the NFp can be used for the NFp instance serving NFc1. For example, when a certain certificate of NFp expires, NFp cannot communicate, and the entire certificate status of NFp is invalid.
  • steps S711a-S711c may refer to steps S612a and S612b in the method 600. For the sake of simplicity, they will not be described again here.
  • NFc1 sends service discovery request message #a to NRF.
  • NRF receives the service discovery request message #a from NFc1.
  • the service discovery request message #a is used by NFc1 to request discovery of the desired NFp instance.
  • the service discovery request message #a includes the desired NFp service name, the NF type of the desired NFp instance, the NF type of NFc1, etc.
  • NRF sends query message #1 to the CRL server.
  • the CRL server receives query message #1 from NRF.
  • query message #1 is used to query the CRL server for the certificate status of NFp.
  • the CRL server sends response message #1 to the NRF.
  • NRF receives response message #1 from CRL.
  • response message #1 includes the certificate status of NFp. For example, if the certificate status of NFp is non-revoked, it means that the certificate of NFp is valid.
  • NRF sends service discovery response message #a to NFc1.
  • NFc1 receives the service discovery response message #a from NRF.
  • the service discovery response message #a is used to notify NFc1 that the service discovery request is successful.
  • the service discovery response message #a includes information about the NFp instance collection, such as NFp Instance ID and NF type of NFp.
  • NFc1 sends a subscription request message #a to NRF for subscribing to the certificate status of the NFp provided by the NRF, or for subscribing to whether the NFp provided by the NRF is available.
  • method one is that the CA/RA revokes or revokes the NFp's certificate, sends a certificate expiration instruction to the NRF, and updates the NFp's certificate status.
  • the second method is that the NFp actively requests NRF to register and delete the NFp's certificate information.
  • step S612 in method 600 For specific implementation methods, reference may be made to step S612 in method 600. For the sake of brevity, no further details will be given here.
  • CA/RA sends certificate invalidation indication information #a to NRF.
  • NRF receives certificate expiration indication information #a from CA/RA.
  • the certificate invalidation indication information #a is used to indicate that the certificate of the NFp is revoked or suspended, and the certificate invalidation indication information #a includes the certificate ID of the NFp.
  • the CA/RA may also send the NFp certificate and the certificate expiration indication to the NRF.
  • the CA/RA after the CA/RA revokes the certificate, it determines the NRF based on the preconfigured network storage function network element information to which the NFp belongs, and sends the certificate invalidation indication information #a to the NRF.
  • the pre-configured network storage function network element information to which the NFp belongs can be sent to the CA/RA when the NFp requests a certificate from the CA/RA, or can be stored in the CA/RA, or can be issued to the NFp as a certificate by the CA/RA.
  • Part of the content of the certificate may be pre-configured on the CA/RA by the network management network element or network administrator. This application does not specifically limit this.
  • the CA/RA may also send the NFp certificate and the certificate expiration indication to the NRF.
  • NRF sends notification message #a to NFc1.
  • NFc1 receives notification message #a from NRF.
  • the notification message #a is used to notify NFc1 that the certificate of the NFp is invalid.
  • NRF sends a notification message #a to NFc1 according to the certificate invalidation indication information #a.
  • NRF receives the subscription request message #1 from NFc1 based on the above step S714, and notifies NFc1 that the certificate of the NFp has been revoked or revoked. That is to say, at this time, NFp fails or NFp is unavailable, and NFc does not need to establish a connection with NFp.
  • NFc2 sends service discovery request message #b to NRF.
  • NRF receives the service discovery request message #b from NFc2.
  • the service discovery request message #b is used for NFc2 to request discovery of a desired NFp instance.
  • the service discovery request message #b includes the desired NFp service name, the NF type of the desired NFp instance and the NF type of NFc2.
  • NRF sends query message #2 to the CRL server.
  • the CRL server receives query message #2 from NRF.
  • query message #2 is used to query the CRL server for the certificate status of NFp.
  • the CRL server sends response message #2 to the NRF.
  • NRF receives response message #2 from CRL.
  • response message #2 includes the certificate status of NFp. For example, if the certificate status of NFp is revoked, it means that the certificate of NFp is invalid.
  • NRF sends service discovery response message #b to NFc2.
  • NFc2 receives the service discovery response message #b from NRF.
  • the service discovery response message #b is used to notify NFc2 that the service discovery request failed.
  • steps S724-S727 may refer to the above-mentioned steps S712-S714.
  • steps S712-S714 For the sake of simplicity, details will not be described here.
  • the specific implementation method may refer to the above-mentioned step S627 and the above-mentioned steps S711a-S711c. For the sake of brevity, no further details will be given here.
  • NFp sends deregistration request message #a to NRF.
  • NRF receives the deregistration request message #a from NFp.
  • the deregistration request message #a is used to notify the NRF that the NFp is unavailable.
  • NRF deletes the NFp context.
  • the NRF sends the NFp's certificate information (for example, certificate ID and certificate validity period) to an external CRL server to notify the NFp of the certificate expiration and update the NFp's certificate status in the CRL.
  • NFp's certificate information for example, certificate ID and certificate validity period
  • NRF sends notification message #b to NFc1.
  • NFc1 receives notification message #b from NRF.
  • the notification message #b is used to notify NFc1 that the NFp has been deregistered or the NFp's certificate has expired.
  • steps S731-S733 may refer to the above-mentioned steps S631-S633. For the sake of simplicity, details will not be described here.
  • the method disclosed in this application prevents NFc from establishing a TLS connection with NFp by providing certificate information owned by NFp in the NFp registration process and adding validity verification of the certificate owned by NFp in the NFc service discovery NFp process. , connection establishment fails due to invalid NFp certificate, reducing network efficiency and user experience.
  • the CA/RA revokes or revokes the NFp's certificate, and sends a certificate invalidation indication to the NRF.
  • the update of the CRL list requires a certain period, there may be effectiveness issues.
  • the NFp certificate has been revoked, but the CA does not immediately feedback the NFp certificate status to the NRF. Instead, it needs to notify the NRF during the next update period. If this happens If the network connection is established between NFc and NFp during the time period, the connection establishment will fail, thus affecting network efficiency. Therefore, the following method 800 is proposed.
  • the NFc proactively and promptly reports the certificate invalidation indication of the NFp to the NRF, which facilitates the NRF to provide other NFp for the NFc to establish network connections and provide services, and also facilitates the NRF to notify other NFcs of the NFp's certificate.
  • the certificate expires to avoid unnecessary network connection failure and affect network efficiency.
  • the following takes NFp requesting service registration from NRF and NFc requesting service discovery from NRF as an example.
  • NRF NFp requesting service registration
  • NFc NFc requesting service discovery
  • FIG 8 is a flow example diagram of the fourth communication method 800 provided by the embodiment of the present application.
  • the difference from the above method 600 or 700 is that in this implementation, after the NFc fails to establish a network connection with the NFp provided by the NRF, it actively reports the certificate invalidation indication of the NFp to the NRF.
  • the method includes the following steps.
  • NFp sends registration request message #A to NRF.
  • NRF receives registration request message #A from NFp.
  • the registration request message #A carries NFp certificate information, and the NFp certificate information includes certificate ID and certificate validity period.
  • NRF verifies the validity of the NFp's certificate.
  • the NRF verifies all certificates of the NFp, including the validity of the certificate (certificate validity period and certificate status) and the authenticity of the certificate (whether the certificate belongs to the NFp).
  • NRF stores the certificate information owned by NFp as NFp context on NRF.
  • steps S811a-S811c may refer to steps S711a-S711c in the method 700.
  • steps S811a-S811c may refer to steps S711a-S711c in the method 700.
  • NFc1 sends service discovery request message #A to NRF.
  • NRF receives the service discovery request message #A from NFc1.
  • the service discovery request message #A is used by NFc1 to request discovery of the desired NFp instance.
  • the service discovery request message #A includes the desired NFp service name, the NF type of the desired NFp instance, the NF type of NFc1, etc.
  • NRF sends query message #A to the CRL server.
  • the CRL server receives query message #A from NRF.
  • query message #A is used to query the CRL server for the certificate status of NFp.
  • the CRL server sends response message #A to the NRF.
  • NRF receives response message #A from CRL.
  • the response message #A includes the certificate status of the NFp. For example, if the certificate status of the NFp is non-revoked, it means that the certificate of the NFp is valid.
  • NRF sends service discovery response message #A to NFc1.
  • NFc1 receives the service discovery response message #A from NRF.
  • the service discovery response message #A is used to notify NFc1 that the service discovery request is successful.
  • the service discovery response message #A includes information about the NFp instance collection, such as NFp Instance ID and NF type of NFp.
  • steps S812-S814 may refer to steps S712-S714 in method 700.
  • steps S812-S814 may refer to steps S712-S714 in method 700.
  • NFc1 attempts to establish a network connection with the NFp.
  • the failure reason may be that the NFp certificate has been revoked or expired.
  • the NFp's certificate is revoked or invalidated, causing NFc1 to fail to establish a connection with the NFp.
  • NFc1 sends certificate invalidation indication information #A to NRF.
  • NRF receives certificate invalidation indication information #A from NFc1.
  • the certificate invalidation indication information #A is used to indicate that the NFp's certificate is revoked or invalid.
  • the certificate invalidation indication information #A includes the NFp ID, certificate ID, or certificate type.
  • NFc1 may directly send the certificate and invalidation indication of NFp to NRF.
  • NRF sends notification message #A according to certificate invalidation indication information #A.
  • the NRF queries the CRL server for the certificate status of the NFp to determine whether the certificate of the NFp has been revoked. After confirming that the NFp's certificate has been revoked, a notification message #A is sent to other NFcs (such as NFc3) to avoid subsequent interaction failures between NFc3 and NFp when establishing a network connection or providing services, thereby affecting network efficiency. .
  • NFc3 other NFcs
  • NFc2 sends service discovery request message #B to NRF.
  • NRF receives the service discovery request message #B from NFc2.
  • the service discovery request message #B is used for NFc2 to request discovery of a desired NFp instance.
  • the service discovery request message #B includes the desired NFp service name, the NF type of the desired NFp instance and the NF type of NFc2.
  • NRF sends query message #B to the CRL server.
  • the CRL server receives query message #B from NRF.
  • query message #A is used to query the CRL server for the certificate status of NFp.
  • the CRL server sends response message #B to the NRF.
  • NRF receives response message #B from CRL.
  • the response message #B includes the certificate status of the NFp. For example, if the certificate status of the NFp is revoked, it means that the certificate of the NFp is invalid.
  • NRF sends service discovery response message #B to NFc2.
  • NFc2 receives the service discovery response message #B from NRF.
  • the service discovery response message #B is used to notify NFc2 that the service discovery request failed.
  • steps S818-S820 may refer to the above-mentioned steps S812-S814. For the sake of simplicity, details will not be described here.
  • step S816 based on the certificate invalidation indication information #A in step S816, the above steps S819a-S819b can be deleted.
  • step S728 in method 700 For specific implementation methods, reference may be made to step S728 in method 700. For the sake of simplicity, details will not be described here.
  • the method disclosed in this application prevents errors in establishing a TLS connection between NFc and NFp by providing certificate information owned by NFp in the NFp registration process and adding verification of the validity of the certificate owned by NFp in the NFc service discovery process.
  • the failure of NFp certificate causes connection establishment failure, which can improve network efficiency.
  • the following takes NFp requesting service registration from NRF and NFc requesting service discovery from NRF as an example.
  • NRF NFp requesting service registration
  • NFc NFc requesting service discovery
  • Figure 9 is a flow example diagram of the fifth communication method 900 provided by the embodiment of the present application. As shown in Figure 9, the method includes the following steps.
  • NFc1 sends service discovery request message # ⁇ to NRF.
  • NRF receives the service discovery request message # ⁇ from NFc1.
  • the service discovery request message # ⁇ is used by NFc1 to request discovery of a desired NFp instance, and the service discovery request message #B includes the desired NFp service name, the NF type of the desired NFp instance, and the NF type of NFc2.
  • NRF authorizes and determines the NFp instance set.
  • NRF sends service discovery response message #B to NFc1.
  • NFc1 receives the service discovery response message #B from NRF.
  • the service discovery response message #B includes information about the NFp instance collection, such as NFp profile.
  • steps S911-S913 may refer to steps S411-S413 in method 400. For the sake of simplicity, details will not be described here.
  • NFc1 attempts to establish a network connection with the NFp.
  • the failure reason may be that the NFp certificate has been revoked or expired.
  • NFc1 fails to establish a connection with NFp due to expiration of the NFp's certificate, failure of NFp routing, network maintenance, or leakage of NFp's private key.
  • the NFc after the NFc fails to establish a connection with the NFp, it can query the CRL to determine that the certificate status of the NFp is revoked, or that the certificate of the NFp has expired.
  • NFc1 sends the service discovery request message # ⁇ to NRF.
  • NRF receives the service discovery request message # ⁇ from NFc1.
  • the service discovery request message # ⁇ includes information about the NFp that failed to connect, such as NFp ID and failure reason.
  • step S914 if NFc fails to establish connections with one or more NFp in the NFp instance set provided by NRF, then NFc continues to request service discovery NFp from NRF, and carries the establishment in the service discovery request message # ⁇ The NFp ID for which the connection failed and the reason for the failure.
  • NRF authorizes and determines other NFp instance sets.
  • the NRF continues to search for other NFp that meet the requirements for the NFc according to the service discovery request message # ⁇ except for the NFp that has failed to establish a connection.
  • NRF search for NFp reference can be made to step S412 in the above method 400. For the sake of simplicity, details will not be described here.
  • NRF sends service discovery response message # ⁇ to NFc1.
  • NFc1 receives the service discovery response message # ⁇ from NRF.
  • the service discovery response message # ⁇ includes information about other NFp instance collections, such as other NFp profiles.
  • NFc successfully establishes a connection with other NFp.
  • steps S915-S917 may refer to the above-mentioned steps S911-S917. For the sake of simplicity, details will not be described here.
  • the method disclosed in this application prevents errors in establishing a TLS connection between NFc and NFp by providing certificate information owned by NFp in the NFp registration process and adding verification of the validity of the certificate owned by NFp in the NFc service discovery process.
  • the failure of NFp certificate causes connection establishment failure, which can improve network efficiency.
  • the communication method embodiment of the present application is described in detail above with reference to FIGS. 1 to 9 .
  • the device side embodiment of the present application will be described in detail with reference to FIGS. 10 and 11 . It should be understood that the description of the device embodiments corresponds to the description of the method embodiments. Therefore, the parts not described in detail can be referred to the previous method embodiments.
  • FIG 10 is a schematic block diagram of a device provided by an embodiment of the present application.
  • the device 1000 may include a transceiver unit 1010 and a processing unit 1020.
  • the transceiver unit 1010 can communicate with the outside, and the processing unit 1020 is used for data processing.
  • the transceiver unit 1010 may also be called a communication interface or a transceiver unit.
  • the device 1000 can implement steps or processes corresponding to those performed by the service discovery function network element (for example, NRF) in the above method embodiment, wherein the processing unit 1020 is used to execute the above method embodiment.
  • the transceiver unit 1010 is configured to perform operations related to the processing of the service discovery function network element in the above method embodiment.
  • the device 1000 can implement steps or processes corresponding to those performed by the second network function network element (for example, NFc) in the above method embodiment, wherein the transceiver unit 1010 is used to perform the above method.
  • the processing unit 1020 is configured to perform operations related to the processing of the second network function network element in the above method embodiment.
  • the device 1000 can implement steps or processes corresponding to those performed by the certificate issuance network element (for example, CA/RA) in the above method embodiment, wherein the processing unit 1020 is used to execute the above method.
  • the transceiver unit 1010 is configured to perform operations related to the processing of the certificate issuance network element in the above method embodiment.
  • the device 1000 can implement steps or processes corresponding to those performed by the first network function network element (for example, NFp) in the above method embodiment, wherein the transceiver unit 1010 is used to perform the above method.
  • the processing unit 1020 is configured to perform operations related to the processing of the first network function network element in the above method embodiment.
  • the device 1000 here is embodied in the form of a functional unit.
  • the term "unit” as used herein may refer to an application specific integrated circuit (ASIC), an electronic circuit, a processor for executing one or more software or firmware programs (e.g., a shared processor, a proprietary processor, or a processor). processor, etc.) and memory, merged logic circuitry, and/or other suitable components to support the described functionality.
  • ASIC application specific integrated circuit
  • processor for executing one or more software or firmware programs (e.g., a shared processor, a proprietary processor, or a processor). processor, etc.) and memory, merged logic circuitry, and/or other suitable components to support the described functionality.
  • the device 1000 can be specifically the sending end in the above embodiment, and can be used to perform various processes and/or steps corresponding to the sending end in the above method embodiment, or, The device 1000 may be specifically a receiving end in the above embodiments, and may be used to perform various processes and/or steps corresponding to the receiving end in the above method embodiments. To avoid duplication, they will not be described again here.
  • the device 1000 of each of the above solutions has the function of realizing the corresponding steps performed by the sending end in the above method, or the device 1000 of each of the above solutions has the function of realizing the corresponding steps of the receiving end of the above method.
  • the functions described can be implemented by hardware, or can be implemented by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the above functions; for example, the transceiver unit can be replaced by a transceiver (for example, the sending unit in the transceiver unit can be replaced by a transmitter, and the receiving unit in the transceiver unit can be replaced by a receiving unit. (machine replacement), other units, such as processing units, etc., can be replaced by processors to respectively perform the sending and receiving operations and related processing operations in each method embodiment.
  • the above-mentioned transceiver unit may also be a transceiver circuit (for example, it may include a receiving circuit and a transmitting circuit), and the processing unit may be a processing circuit.
  • the device in Figure 10 may be the receiving end or transmitting end in the aforementioned embodiment, or it may be a chip or a chip system, such as a system on chip (SoC).
  • SoC system on chip
  • the transceiver unit may be an input-output circuit or a communication interface.
  • the processing unit is a processor or microprocessor or integrated circuit integrated on the chip, which is not limited.
  • Figure 11 shows a device 2000 provided by an embodiment of the present application.
  • the device 2000 includes a processor 2010 and a transceiver 2020.
  • the processor 2010 and the transceiver 2020 communicate with each other through an internal connection path, and the processor 2010 is used to execute instructions to control the transceiver 2020 to send signals and/or receive signals.
  • the device 2000 may also include a memory 2030, which communicates with the processor 2010 and the transceiver 2020 through internal connection paths.
  • the memory 2030 is used to store instructions, and the processor 2010 can execute the instructions stored in the memory 2030.
  • the device 2000 is used to implement various processes and steps corresponding to the service discovery function network element (for example, NRF) in the above method embodiment.
  • the service discovery function network element for example, NRF
  • the device 2000 is configured to implement various processes and steps corresponding to the first network function network element (for example, NFp) in the above method embodiment.
  • the first network function network element for example, NFp
  • the device 2000 is configured to implement various processes and steps corresponding to the second network function network element (for example, NFc) in the above method embodiment.
  • the second network function network element for example, NFc
  • the device 2000 is used to implement various processes and steps corresponding to the certificate issuance network element (for example, CA/RA) in the above method embodiment.
  • the certificate issuance network element for example, CA/RA
  • the device 2000 may be specifically the transmitting end or the receiving end in the above embodiment, or may be a chip or a chip system.
  • the transceiver 2020 may be the transceiver circuit of the chip, which is not limited.
  • the device 2000 can be used to perform various steps and/or processes corresponding to the sending end or the receiving end in the above method embodiments.
  • the memory 2030 may include read-only memory and random access memory and provide instructions and data to the processor.
  • a portion of the memory may also include non-volatile random access memory.
  • the memory may also store device type information. the place
  • the processor 2010 may be used to execute instructions stored in the memory, and when the processor 2010 executes the instructions stored in the memory, the processor 2010 is used to execute each step of the method embodiment corresponding to the sending end or the receiving end and /or process.
  • Figure 12 is a schematic flowchart of a communication method provided by an embodiment of the present application. As shown in Figure 12, it includes the following steps:
  • S210.CA/RA sends a certificate revocation notification message to the first network element.
  • the certificate revocation notification message includes identification information of the network function network element NF and indication information indicating the certificate status of the certificate to which the network function network element belongs.
  • the certificate revocation notification message includes the identification information of the NF and the certificate status of the certificate described by the NF.
  • the certificate status of the certificate to which the network function network element belongs refers to the status of one or more certificates to which the NF belongs or the certificate status of the certificate set to which the NF belongs. Certificate status refers to whether the certificate is invalid or valid.
  • certificate invalidation also includes certificate revocation or suspension.
  • the first network element determines the configuration mode of the NF based on the certificate expiration status of the certificate to which the NF belongs.
  • the first network element determines that the NF performs one of the following configuration methods: configuring the NF to deregister, or marking the NF as invalid.
  • the first network element is the NRF or certificate management network element. It is understandable that the first network element can also be integrated with the NRF and the certificate management network element.
  • the first network element sends notification message #1 to the OAM.
  • OAM receives notification message #1 from the first network element.
  • the notification message #1 is used to send the NF configuration method determined by the first network element to the OAM.
  • the notification message #1 includes indication information #1 indicating the configuration mode of the NF.
  • the indication information #1 may indicate that the certificate status is revoked or suspended.
  • Figure 13 is a schematic flowchart of a communication method provided by an embodiment of the present application. As shown in Figure 13, it specifically includes the following steps:
  • NRF receives registration request message #2 from NF1.
  • NF1 is the network function service consumption network element.
  • the registration request message #2 carries the certificate owned by NF1.
  • Each certificate of NF1 includes a certificate ID and a certificate validity period.
  • the certificate validity period can be the issuance time and validity period of the certificate, or it can be the certificate's validity expiration time, etc.
  • the NFp certificate also includes the CA ID that issued the certificate, the certificate's signature, the certificate holder ID, or the certificate holder's public key, etc.
  • the registration request message #2 includes all certificates owned by NF1, and this application does not limit the number of certificates owned by NF1.
  • the number of NF1 certificates depends on different levels of CA issuance, or business types, etc.
  • S222.NRF determines that NF1 is available.
  • NRF receives registration request message #2 from NF1. After NF1 registers successfully, NRF verifies that NF1's configuration information passes, and NRF determines that NF1 is available.
  • the certificate management network element receives the registration request message #3.
  • Registration request message #3 carries the identification information of NF1.
  • the identification information can be NF ID (Identity or Identifier), or NF instance ID (NF Instance ID).
  • the registration request message #3 also carries the identification information of the NRF corresponding to NF1.
  • the identification information of the NRF may be the instance ID of the NRF
  • the certificate management network element stores the corresponding relationship between NF and NRF.
  • the certificate management network element stores the corresponding relationship between NF1 and NRF according to the registration request message #3. For example, there is a one-to-one correspondence between network function network elements and NRF.
  • the registration request message #3 carries the NF instance ID and NRF identifier. After receiving the registration request message #3, the certificate management network element stores the NF instance ID and NRF ID it carries.
  • the certificate management network element can receive registration request messages from multiple NFs. Each registration request message carries its own NF instance ID and NRF.
  • the certificate management network element also stores the certificate ID and the purpose of its corresponding certificate. These correspondences can be configured by the CA/RA in the certificate management network element after the certificate is issued, or they can be successfully registered in the NF Afterwards, NRF configures the certificate management network element. , or can be pre-configured in the certificate management network element. The certificate management network element can determine the purpose of the revoked certificate through the correspondence between the certificate ID and the certificate purpose.
  • S225.CA/RA sends a certificate revocation notification message to the certificate management network element.
  • the certificate management network element receives the certificate invalidation notification message.
  • the certificate revocation notification message is used to notify the certificate management network element that the certificate is invalid.
  • the certificate revocation notification message contains NF instance ID and certificate status.
  • NF instance ID is the identification of the NF serving the certificate
  • the certificate status is one of the certificate revocation status or the certificate suspension status.
  • the certificate expiration notification also includes the service name or certificate ID.
  • the certificate ID is used to identify the certificate, and certificates identified by different certificate IDs have different uses.
  • the service name is used to identify the service corresponding to the certificate. For example, if the service is Namf_Communication, the service name is used to identify the service associated with the certificate. It is understandable that each service corresponds to a certificate.
  • the certificate expiry notification includes the service name.
  • NF may have multiple certificates, and different certificates have different functions. There are certificates dedicated to establishing TLS connections, certificates dedicated to signing client credential assertions (Client Credentials Assertion, CCA), and certificates dedicated to certain A certificate for a slice or a service.
  • CCA Client Credentials Assertion
  • NF1 is AMF
  • AMF can serve a network slice S-NSSAI#1.
  • AMF will obtain the certificate for this network slice from the CA/RA.
  • AMF will initiate a network slice authentication process to the network slice.
  • the service request needs to carry a certificate dedicated to S-NSSAI#1, and NSSAA will authenticate certificate #4 to confirm that AMF can serve this network slice.
  • AMF can also obtain a certificate dedicated to a certain service.
  • AMF can request the UE's subscription information from UDM. At this time, AMF can carry certificate 2 dedicated to requesting subscription information services in the request.
  • AMF can obtain the contract information; for another example, AMF can request NSSAAF to re-authenticate the network slice.
  • the request message carries certificate 3 dedicated to this service.
  • NSSAAF authenticates certificate 3 successfully, it is determined that AMF can initiate network slice re-authentication. Serve.
  • the CA/RA may not carry the service name, but carry the certificate ID.
  • the certificate ID is used to indicate the revoked certificate in the certificate management network element.
  • the certificate management network element stores the certificate ID and its corresponding certificate. Purpose, these correspondences can be configured in the certificate management network element by the CA/RA after the certificate is issued, or can be configured in the certificate management network element by the NRF after the NF registration is successful, or can be pre-configured in the certificate management network element.
  • the certificate management network element can determine the purpose of the revoked certificate through the corresponding relationship between the certificate ID and the certificate.
  • the certificate ID or service name carried in the certificate revocation notification message can identify the certificate at the service granularity and obtain the certificate status at the service granularity.
  • the certificate management network element determines the NRF serving the NF corresponding to the certificate.
  • the certificate management network element determines the NRF corresponding to the NF based on the corresponding relationship between the stored NF instance ID and the NRF.
  • the certificate management network element obtains the NF instance ID based on the received revocation notification message, and determines the NRF corresponding to the NF based on the NF instanceID.
  • the certificate management network element sends request message #1 to the NRF.
  • This request message #1 contains indication information indicating the status of the certificate.
  • the certificate status is the certificate valid status or the certificate invalid status.
  • the certificate invalidation state is one of the certificate revocation state or the certificate suspension state.
  • request message #1 also includes the NF instance ID and service name.
  • request message #1 also includes the NF instance ID and certificate ID.
  • S228.NRF determines the processing method of the NF network element serving the certificate based on the certificate status.
  • the NRF receives the request message #1 from the certificate management network element, and determines the processing method of the NF network element serving the certificate based on the certificate status carried in the request message #1. When the indication information indicates that the certificate status is invalid, NRF determines to perform one of the following processing methods: configure NF1 to deregister, or mark NF1 or the service corresponding to NF1 as invalid.
  • the first implementation plan is a first implementation plan
  • Request message #1 includes: NF instance ID #1 and instruction information #1. Among them, indication information #1 indicates that the certificate is in an invalid state, and NRF determines that the certificate corresponding to the NF instance ID is in an invalid state based on the NF instance ID and indication information #1.
  • NRF determines that the certificate corresponding to the NF instance ID is in an invalid state, it sets the NF to invalid. reached or failed. In this way, when the NF consumer performs the NF discovery process and NRF receives the discovery request from the NF consumer, NRF will not recommend the NF to the NF consumer. The NF consumer will not establish a connection with NF and continue to communicate, which can improve network efficiency and user experience.
  • indication information #1 is a status parameter.
  • the status parameter is 1, it means that the certificate is valid.
  • the status parameter is 0, it means that the certificate is invalid.
  • the status parameter is 00, it means that the certificate's invalid status is suspended.
  • the status parameter is 01, it means that the certificate's expiration status is revoked. It can be understood that this is only an exemplary description, and this application does not limit it.
  • NRF determines that the certificate corresponding to the NF instance ID is in an invalid state, for example, the certificate is in a revoked state
  • NRF sets the NF to deregister, that is, deletes the certificate corresponding to the NF in NRF. In this way, NF will not be searched by the NF consumer.
  • Request message #1 includes: NF instance ID #2, instruction information #2 and service name.
  • NF instance ID#2 is used to identify NF#2
  • indication information #2 is used to indicate that the certificate in NF#2 is invalid
  • the service name is used to identify the disabled service in NF#2.
  • notification message #1 carries a service name
  • NRF determines the service to disable NF1 based on the service name, for example, the service name indicates that the revoked certificate is used for S-NSSAI#1
  • NRF will set the status of NF1 to S-NSSAI #1 fails.
  • NRF will not recommend NF1 to the NF consumer.
  • the service name indicates that a revoked certificate is used for a service
  • NRF sets the status of NF1 to the service indicated by the service name as unavailable.
  • the service corresponding to the expired certificate can be set to be unavailable at a finer granularity, improving network communication efficiency and flexibility.
  • Request message #1 includes: NF instance ID #3, instruction information #3 and certificate ID.
  • NF instance ID#3 is used to identify NF#3
  • the certificate ID is used to identify the certificate in NF#3.
  • Instruction information #3 is used to indicate that the certificate corresponding to the certificate ID in NF#3 is invalid.
  • the NRF sends response message #2 in response to request message #1 to the certificate management network element.
  • the response message #2 carries the first indication information.
  • the first indication information is used to indicate the configuration mode of the NF network element serving the certificate determined by the NRF in step 228.
  • S130a.NRF sends notification message #2 to OAM.
  • the first message #2 includes the NF instance ID and the instruction information #2 used to indicate the processing method determined by the NRF.
  • Instruction information #2 indicates configuring NF1 for deregistration or marking NF1 as invalid.
  • step S229b is optionally performed.
  • S229b.NRF sends notification message #1 to OAM.
  • notification message #1 The information contained in notification message #1 can be found in notification message #2, which will not be described again here.
  • S230.OAM determines the processing method for NF1 based on the notification message.
  • OAM destroys NF1 or initiates a remote measurement process to NF1.
  • the remote measurement process can measure NF1's hardware and software information to determine the security and integrity of NF1.
  • NF1 will obtain the measurement certificate, and NF1 can reapply for a certificate from the CA/RA through the measurement certificate.
  • the OAM initiates a remote measurement process to NF1 to obtain the measurement voucher, and re-applies for a certificate to the CA/RA based on the measurement voucher.
  • the CA/RA will send a certificate recovery notification to the certificate management network element.
  • the certificate recovery notification contains the NF instance ID, as well as the certificate ID or service name. After receiving the certificate management network element, it sends the NF instance ID, as well as the service name or certificate ID to the NRF. After receiving the certificate recovery notification message, the NRF sets the NF1 status to valid or reachable.
  • Figure 14 is a schematic flowchart of a communication method provided by an embodiment of the present application. As shown in Figure 14, it includes the following steps:
  • CA/RA sends certificate revocation notification message #3 to the certificate management network element.
  • Certificate management network element receives certificate revocation notification message #3.
  • Certificate revocation notification message #3 contains the identification information of NF1 and the certificate status of the certificate to which NF1 belongs.
  • step S221 For the specific implementation of this step, please refer to step S221, which will not be described again here.
  • the certificate management network element sends request message #3 to the NRF/OAM.
  • the certificate management network element determines whether to send request message #3 based on the received identification information and certificate status of NF1.
  • Request message #3 carries identification information and routing indication information of NFl, where the routing indication information is used to indicate information about other NFs requesting communication with NFl.
  • S233.NRF/OAM obtains information about other NFs communicating with NF1.
  • the certificate management network element sends request message #3 to OAM, and OAM determines the information of NFc communicating with NF1 based on the stored record log associated with NF1.
  • NRF determines the information of the NFc communicating with NF1 based on stored records, for example, Li Lu of the service discovery request.
  • the NRF/OAM sends response message #3 in response to request message #3 to the certificate management network element.
  • Response message #3 is used to send the information of NFc communicating with NF1 obtained in step S233 to the certificate management network element.
  • Response message #3 carries information about the NFc communicating with NFl and indication information indicating the expiration of the certificate to which NFl belongs.
  • the certificate management network element receives response message #3 from NRF or OAM.
  • NFcs there can be one or more NFcs communicating with NF1.
  • the certificate management network element sends notification message #4 to NFc communicating with NF1.
  • Notification message #4 is used to notify the NFc communicating with NF1 that the certificate of the certificate to which NF1 belongs is invalid.
  • This notification message #4 carries information about the NFc communicating with NF1, and the certificate status of the certificate to which NF1 belongs.
  • NFs in Figure 14 represent one or more NFs communicating with NFl.
  • the one or more NFs know that the certificate of NF1 is invalid, they will no longer continue to communicate with the NF1, which can improve network efficiency and enhance user experience.
  • the CA/RA sends the certificate recovery notification message #4 to the certificate management network element.
  • the CA/RA is triggered to send the certificate recovery notification message #4 to the certificate management network element, which is used to notify the certificate management network element that the certificate to which NF1 belongs has been restored.
  • the certificate management network element sends notification message #5 to other NFs.
  • the certificate management network element notifies other NFs through notification message #5 that the certificate to which NF1 belongs has been restored. Thereby, other NFs communicating with NFl can communicate with NFl again.
  • each step of the above method can be completed by instructions in the form of hardware integrated logic circuits or software in the processor.
  • the steps of the methods disclosed in conjunction with the embodiments of the present application can be directly implemented by a hardware processor, or executed by a combination of hardware and software modules in the processor.
  • the software module can be located in random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, registers and other mature storage media in this field.
  • the storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware. To avoid repetition, it will not be described in detail here.
  • the processor in the embodiment of the present application may be an integrated circuit chip with signal processing capabilities. During the implementation process, each step of the above method embodiment can be completed through an integrated logic circuit of hardware in the processor or instructions in the form of software.
  • the above-mentioned processor may be a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component.
  • the processor in the embodiment of the present application can implement or execute the various methods, steps and logical block diagrams disclosed in the embodiment of the present application.
  • a general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.
  • the steps of the methods disclosed in conjunction with the embodiments of the present application can be directly implemented by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, registers and other mature storage media in this field.
  • the storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.
  • the memory in the embodiment of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories.
  • the non-volatile memory can be read-only memory (ROM), programmable ROM (PROM), erasable programmable read-only memory (erasable PROM, EPROM), electrically removable memory. Erase programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • Volatile memory may be random access memory (RAM), which is used as an external cache.
  • RAM static random access memory
  • DRAM dynamic random access memory
  • SDRAM synchronous dynamic random access memory
  • double data rate SDRAM double data rate SDRAM
  • DDR SDRAM double data rate SDRAM
  • ESDRAM enhanced synchronous dynamic random access memory
  • SLDRAM synchronous link dynamic random access memory
  • direct memory bus random access memory direct rambus RAM, DR RAM
  • the present application also provides a computer program product.
  • the computer program product includes: computer program code.
  • the computer program code When the computer program code is run on a computer, it causes the computer to execute the above embodiments. Methods.
  • the present application also provides a computer-readable medium.
  • the computer-readable medium stores program code.
  • the program code When the program code is run on a computer, it causes the computer to execute the above-described embodiments. Methods.
  • the disclosed systems, devices and methods can be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or can be integrated into another system, or some features can be ignored, or not implemented.
  • the coupling or direct coupling or communication connection between each other shown or discussed may be through some interfaces, and the indirect coupling or communication connection of the devices or units may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or they may be distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application can be integrated into one processing unit, each unit can exist physically alone, or two or more units can be integrated into one unit.
  • the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium.
  • the technical solution of the present application is essentially or the part that contributes to the existing technology or the part of the technical solution can be embodied in the form of a software product.
  • the computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of this application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory, random access memory, magnetic disk or optical disk and other various media that can store program codes.

Abstract

本申请实施例提供了一种通信方法和装置。该方法包括：服务发现功能网元接收服务发现请求消息，该服务发现请求消息用于请求服务发现功能网元提供第一类型的网络功能网元,在确定第一类型的第一网络功能网元的第一证书有效的情况下，服务发现功能网元发送包括第一网络功能网元的标识信息的服务发现响应消息。本申请所揭示的方法，通过在服务发现流程中增加对第一网络功能网元所拥有的证书的有效性进行验证，能够避免后续网络功能服务消费网元和第一网络功能网元之间建立连接时,由于第一网络功能网元的证书失效或被吊销导致网络连接建立失败，从而提高网络效率，以及提升用户体验。

Description

通信方法和装置 技术领域
本申请涉及通信领域，并且更具体地，涉及一种通信方法和装置。
背景技术
当前，在服务化的架构(service based architecture，SBA)中，网络功能(network function，NF)网元之间基于服务化的接口进行交互，采用互联网协议安全(internet protocil security，IPSec)或传输层安全协议(transport layer security，TLS)等技术建立网络连接，这些安全技术要求具有相互通信的双方配置证书，证书包含通信双方用于验证的秘钥及算法，从而降低网络通信中的安全隐患。也就是说，每个NF上必须部署证书，NF之间进行通信之前需要基于证书完成双向认证，以提高通信安全性。
示例性的，网络功能服务消费网元(NF service consumer，NFc)从网络功能存储库功能网元(network function repository function，NRF)获取可以提供服务的网络功能服务提供网元信息(NF service producer，NFp)后，将与NFp尝试建立连接。具体地，NFc和NFp互相交换各自的证书进行验证。如果此时NFp的证书失效或者被吊销，那么NFp的证书将验证失败，进而导致此次网络连接建立失败，影响网络效率，以及降低用户体验。
发明内容
本申请提供一种通信方法和装置，能够提高网络效率，以及提升用户体验。
第一方面，提供了一种通信方法，该方法可以由服务发现功能网元(例如NRF)执行，或者，也可以由服务发现功能网元的组成部件(例如芯片或电路)执行，本申请对此不作限定。为了便于描述，下面以由服务发现功能网元执行为例进行说明。该方法包括：服务发现功能网元接收服务发现请求消息，服务请求消息用于请求服务发现功能网元提供第一类型的网络功能网元；在确定第一类型的第一网络功能网元的第一证书有效的情况下，服务发现功能网元发送包括第一网络功能网元的标识信息的服务发现响应消息。
应理解，服务请求消息用于请求服务发现功能网元提供第一类型的网络功能网元，可以理解为：服务请求消息用于请求服务发现功能网元提供第一类型的网络功能网元的信息，例如第一网络功能网元的标识，和/或第一网络功能网元的配置数据等，本申请对此不作具体限定。
根据本申请提供的方案，通过对第一网络功能网元的第一证书的有效性进行验证，并在验证通过的情况下向第二网络功能网元提供第一网络功能网元的信息，能够避免或者降低第一网络功能网元和第二网络功能网元在建立网络连接过程中，由于第一网络功能网元的证书无效(例如，失效或者被吊销)，导致网络连接建立失败的情况发生，进而提高网络效率，以及提升用户体验。
结合第一方面，在第一方面的某些实现方式中，确定第一类型的第一网络功能网元的第一证书的有效，包括：服务发现功能网元根据第一证书的有效期确定第一证书未过期；以及服务发现功能网元确定第一证书未被吊销。
基于上述方案，通过在第一证书未过期且第一证书未被吊销的情况下确定第一类型的第一网络功能网元的第一证书的有效，进而向网络功能服务消费网元提供第一类型的第一网络功能网元，用于二者之间建立网络连接。
结合第一方面，在第一方面的某些实现方式中，服务发现功能网元确定第一证书未被吊销，包括：服务发现功能网元本地查询证书撤销列表，在第一证书不属于证书撤销列表的情况下，服务发现功能网元确定第一证书未被吊销。
可选地，在服务发现功能网元本地未查询到证书撤销列表的情况下，服务发现功能网元确定第一证书未被吊销。
基于上述方案，服务发现功能网元可以在本地查询证书撤销列表以确定第一证书是否被吊销，无 需向外部服务器发送询问请求，减少信令开销和通信时延，进而能够提升网络效率。
结合第一方面，在第一方面的某些实现方式中，服务发现功能网元确定第一证书未被吊销，包括：服务发现功能网元向服务器发送询问请求消息，询问请求消息用于查询第一证书是否被吊销；服务发现功能网元接收来自服务器的询问响应消息，询问响应消息包括第一证书未被吊销的指示；服务发现功能网元根据指示确定第一证书未被吊销。
应理解，该服务器是部署证书撤销列表的服务器，因此可以从该从服务器查询获取证书的证书状态(是否被吊销)。
基于上述方案，服务发现功能网元可以通过向外部服务器询问当前第一网络功能网元的第一证书是否被吊销，该实现方式中第一证书的证书状态的实时准确性较好。
结合第一方面，在第一方面的某些实现方式中，服务发现功能网元接收注册请求消息，注册请求消息用于请求将第一网络功能网元注册到服务发现功能网元上，注册请求消息包括第一证书，第一证书包括第一证书的标识信息和第一证书有效期。
结合第一方面，在第一方面的某些实现方式中，服务发现功能网元接收连接建立请求消息，连接建立请求消息用于请求第一网络功能网元与服务发现功能网元建立连接，连接建立请求消息包括第一证书，第一证书包括第一证书的标识信息和第一证书的有效期。
结合第一方面，在第一方面的某些实现方式中，在确定第一证书有效的情况下，服务发现功能网元存储第一证书；或者，在确定第一证书有效的情况下，服务发现功能网元存储第一证书的标识信息和第一证书有效期。
基于上述方案，在接收第一网络功能网元注册请求之前，确保第一证书有效，能够提供安全通信，有利于后续第一网络功能网元和第二网络功能网元在建立网络连接过程中，提高网络效率，以及提升用户体验，尽量避免由于第一网络功能网元的证书失效或者被吊销，导致网络连接建立失败的情况发生。
结合第一方面，在第一方面的某些实现方式中，确定第一证书有效，包括：服务发现功能网元根据第一网络功能网元的公钥和证书颁发网元的公钥确定第一证书是证书颁发网元为第一网络功能网元签发的证书；服务发现功能网元根据第一证书的有效期确定第一证书未过期；以及服务发现功能网元确定第一证书的证书未被吊销。
基于上述方案，通过验证第一证书的真实性(即第一证书是证书颁发网元签发给第一网络功能网元的，避免第一证书被恶意篡改)和有效性(第一证书未超期，同时第一证书未被吊销)，确保接受注册服务的第一网络功能网元的安全性和可用性，有利于后续第一网络功能网元和第二网络功能网元之间成功进行网络连接建立，提高网络效率。
可选地，在确定注册请求消息中第一证书有效的情况下，服务发现功能网元也可以不存储第一证书，或者不存储第一证书的标识信息和第一证书有效期。因此，基于该实现方式，服务发现功能网元在接收用于请求发现第一类型的网络功能网元的服务时，可以将第一类型的第一网络功能网元的标识信息发送给外部服务器，例如证书撤销列表服务器或线证书状态协议服务器，用于请求获取第一证书的有效性(查询第一证书的有效期和证书状态是否为被吊销)，进而服务发现功能网元根据外部服务器反馈的响应消息确定是否提供第一网络功能网元的标识信息给第二网络功能网元NFc。例如，外部服务器反馈第一证书有效，则服务发现功能网元向第二网络功能网元NFc提供第一网络功能网元NFp的标识信息。
结合第一方面，在第一方面的某些实现方式中，在服务发现功能网元发送包括第一网络功能网元的标识信息的服务发现响应消息之后，服务发现功能网元接收指示信息，指示信息用于指示第一证书被吊销，指示信息包括第一证书的标识信息；服务发现功能网元发送通知消息，通知消息用于通知第一网络功能网元的第一证书被吊销。
基于上述方案，服务发现功能网元可以比较及时地获取第一证书的证书状态(是否被吊销)，并及时通知第二网络功能网元NFc，能够避免因为第一证书失效或者被吊销，导致网络连接建立失败的情况发生，进而提高网络效率，提升用户体验。
结合第一方面，在第一方面的某些实现方式中，服务发现功能网元接收订阅请求消息，订阅请求消息用于向服务发现功能网元请求订阅第一证书的证书状态。
基于上述方案，服务发现功能网元基于订阅请求消息可以及时通知第二网络功能网元、代理网元 或者其他NFc关于第一证书是否被吊销的事件，也就是说第二网络功能网元或者其他NFc能够实时有效获取第一证书的证书状态，保证后续网络功能网元之间通信的网络效率。
结合第一方面，在第一方面的某些实现方式中，服务发现功能网元接收指示信息，包括：服务发现功能网元接收来自证书颁发网元的指示信息。
进一步地，服务发现功能网元根据指示信息将第一证书增加至证书撤销列表。
基于上述方案，服务发现功能网元通过证书颁发网元可以及时获取第一证书是否被吊销，并及时更新证书撤销列表上第一证书的证书状态，实时有效。
结合第一方面，在第一方面的某些实现方式中，在服务发现功能网元发送包括第一网络功能网元的标识信息的服务发现响应消息之后，服务发现功能网元接收来自第一网络功能网元的去注册请求消息；服务发现功能网元发送通知消息，通知消息用于通知第一网络功能网元的第一证书无效。
基于上述方案，服务发现功能网元可以比较及时地获取第一证书的证书状态(是否被吊销)，并及时通知第二网络功能网元NFc，能够避免因为第一证书失效或者被吊销，导致网络连接建立失败的情况发生，进而提高网络效率，提升用户体验。
结合第一方面，在第一方面的某些实现方式中，服务发现功能网元接收来自第一网络功能网元的更新注册服务请求消息，更新注册服务请求消息包括第二证书，第二证书包括第二证书的标识信息以及与第二证书的标识信息对应的第二证书的有效期；在确定第二证书有效的情况下，更新本地存储的第一网络功能网元的信息，可选地，将第二证书(有效期和标识信息)作为NFp上下文存储到服务发现功能网元上。
基于上述方案，通过接收第一网络功能网元的更新注册请求，并在第二证书有效的情况下提供更新注册服务，有利于在后续服务发现流程中查找到第一网络功能网元，用于向网络功能服务消费网元提供服务。
结合第一方面，在第一方面的某些实现方式中，在确定第一类型的第三网络功能网元的第一证书无效的情况下，服务发现功能网元发送不包括第三网络功能网元的标识信息的该服务发现响应消息。
基于上述方案，基于第三网络功能网元的第一证书的有效性验证不通过的情况下，服务发现功能网元向第二网络功能网元NFc不提供第三网络功能网元的信息，避免后续网络连接建立失败的情况发生，进而提高网络效率。
另外，在确定第一类型的所有网络功能网元的证书都无效的情况下，服务发现功能网元发送服务发现响应消息,用于拒绝提供第一类型的网络功能网元。
基于上述方案，基于第一类型的所有网络功能网元的证书的有效性验证都不通过的情况下，服务发现功能网元拒绝向第二网络功能网元NFc提供发现服务。
第二方面，提供了一种通信方法，该方法可以由网络功能服务消费网元(例如NFc)执行，或者，也可以由网络功能服务消费网元的组成部件(例如芯片或电路)执行，本申请对此不作限定。为了便于描述，下面以由网络功能服务消费网元执行为例进行说明。该方法包括：网络功能服务消费网元发送订阅请求消息，订阅请求消息用于向服务发现功能网元请求订阅网络功能服务提供网元的第一证书的证书状态，网络功能服务提供网元为网络功能服务消费网元提供服务；网络功能服务消费网元接收来自通知消息，通知消息用于通知网络功能服务提供网元第一证书被吊销或者无效。
根据本申请提供的方案，服务发现功能网元基于订阅请求消息可以及时通知网络功能服务消费网元该第一证书是否被吊销的事件，也就是说网络功能服务消费网元能够实时有效获取网络功能服务提供网元的第一证书的证书状态，保证后续网络功能网元之间通信的网络效率。
结合第二方面，在第二方面的某些实现方式中，在确定网络功能服务消费网元与网络功能服务提供网元建立连接失败的情况下，网络功能服务消费网元发送指示信息，该指示信息用于指示网络功能服务提供网元的第一证书被吊销，该指示信息包括第一证书的标识信息。
可选地，在确定网络功能服务消费网元与网络功能服务提供网元建立连接失败的情况下，网络功能服务消费网元发送第一信息，该第一信息包括第一证书和第一证书的失效指示；或者，该第一信息包括第一证书的标识信息和第一证书的失效指示。
基于上述方案，服务发现功能网元可以比较及时地获取网络功能服务提供网元的第一证书的证书状态(是否被吊销)，并及时通知其他NFc，即与网络功能服务提供网元同样向NRF请求提供第一类型的网络功能网元的NFc，能够避免因为第一证书失效或者被吊销，导致网络连接建立失败的情况发 生，进而提高网络效率，提升用户体验。
第三方面，提供了一种通信方法，该方法可以由证书颁发网元(例如CA/RA)执行，或者，也可以由用于由证书颁发网元的组成部件(例如芯片或电路)执行，本申请对此不作限定。为了便于描述，下面以由证书颁发网元执行为例进行说明。该方法包括：证书颁发网元确定第一网络功能网元的第一证书被吊销；证书颁发网元向第一网络功能网元对应的网络存储功能网元发送指示信息，指示信息用于指示将第一证书增加至证书撤销列表。
需要说明的是，该指示信息还可以用于指示第一证书被吊销，指示信息包括第一证书的标识信息。也就是说，该指示信息以及使得接收端(例如网络存储功能网元NRF)将第一证书添加至撤销列表的指示信息可以是同一个，本身其对此不作具体限定。
根据本申请提供的方案，基于证书颁发网元发送的指示信息，服务发现功能网元可以比较及时地获取第一证书的证书状态(是否被吊销)，并及时通知第二网络功能网元NFc，能够避免因为第一证书失效或者被吊销，导致网络连接建立失败的情况发生，进而提高网络效率，提升用户体验。同时，基于证书颁发网元发送的指示信息，服务发现功能网元可以及时获取第一证书是否被吊销，并及时更新证书撤销列表上第一证书的证书状态，实时有效。
结合第三方面，在第三方面的某些实现方式中，在证书颁发网元向第一网络功能网元对应的网络存储功能网元发送指示信息之前，证书颁发网元根据预先配置的第一网络功能网元对应的网络存储功能网元信息确定该网络存储功能网元。
第四方面，提供了一种通信方法，该方法可以由第一网络功能网元(例如NFp)执行，或者，也可以由第一网络功能网元的组成部件(例如芯片或电路)执行，本申请对此不作限定。为了便于描述，下面以由第一网络功能网元执行为例进行说明。该方法包括：第一网络功能网元发送注册请求消息，注册请求消息用于请求将第一网络功能网元注册到服务发现功能网元上，注册请求消息包括第一网络功能网元的第一证书，第一证书包括第一证书的标识信息以及与第一证书的标识信息对应的第一证书有效期；第一网络功能网元接收注册请求响应消息。
根据本申请提供的方案，第一网络功能网元在发送注册请求消息时携带其所拥有的第一证书，使得服务发现网元对第一证书的有效性进行验证，并在确定第一证书有效的情况下接受注册请求，从而确保第一网络功能网元是真实可用的，以及有利于后续服务发现流程中向网络功能服务消费网元NFc提供该安全可用的第一网络功能网元，避免由于第一网络功能网元的证书失效或者被吊销，导致网络连接建立失败的情况发生，进而提高网络效率。
结合第四方面，在第四方面的某些实现方式中，第一网络功能网元发送去注册请求消息，该去注册请求消息用于请求将第一网络功能网元的上下文从服务发现功能网元上删除，该去注册请求消息包括第一网络功能网元的标识。
基于上述方案，服务发现功能网元可以比较及时地获取第一证书的证书状态(通过去注册请求消息)，并及时通知第二网络功能网元NFc，能够避免因为第一证书失效，导致网络连接建立失败的情况发生，进而提高网络效率，提升用户体验。
结合第四方面，在第四方面的某些实现方式中，第一网络功能网元获取第二证书，第二证书包括第二证书的标识信息以及与第二证书的标识信息对应的第二证书的有效期；第一网络功能网元向服务发现功能网元发送更新注册服务请求消息，该更新注册服务请求消息用于请求服务发现功能网元提供更新注册服务，更新注册服务请求消息包括第二证书。
基于上述方案，通过向服务发现功能网元请求更新注册，可以在后续服务发现流程中被查找到，实现与网络功能服务消费网元的建立连接以及向网络功能服务消费网元提供服务。
第五方面，提供了一种通信方法，该方法可以由服务发现功能网元(例如NRF)执行，或者，也可以由服务发现功能网元的组成部件(例如芯片或电路)执行，本申请对此不作限定。为了便于描述，下面以由服务发现功能网元执行为例进行说明。该方法包括：服务发现功能网元接收第一服务发现请求消息，第一服务请求消息用于请求服务发现功能网元提供第一类型的网络功能网元；服务发现功能网元发送包括第一类型的第一网络功能网元的标识信息的第一服务发现响应消息；服务发现功能网元接收第二服务发现请求消息，第二服务请求消息用于请求服务发现功能网元提供第一类型的网络功能网元，第二服务发现请求消息包括第一网络功能网元标识以及第一网络功能网元与第二网络功能网元建立连接失败的原因；服务发现功能网元发送包括第一类型的第三网络功能网元的标识信息的第二服 务发现响应消息。
根据本申请提供的方案，通过在服务发现请求消息中携带第一网络功能网元标识以及第一网络功能网元NFp与第二网络功能网元NFc建立连接失败的原因，使得服务发现功能网元在接下来的服务发现流程中向第二网络功能网元NFc提供除第一网络功能网元NFp之外的其他第一类型的网络功能网元的标识信息，避免服务发现功能网元重复发送第一网络功能网元的标识信息，造成网络连接再次建立失败等，增加通信时延，以及降低网络效率。
第六方面，提供了一种通信方法，该方法可以由第二网络功能网元(例如NFc)执行，或者，也可以由第二网络功能网元的组成部件(例如芯片或电路)执行，本申请对此不作限定。为了便于描述，下面以由第二网络功能网元执行为例进行说明。该方法包括：第二网络功能网元发送第一服务发现请求消息，第一服务请求消息用于请求服务发现功能网元提供第一类型的网络功能网元；第二网络功能网元接收包括第一类型的第一网络功能网元的标识信息的第一服务发现响应消息；在确定第一网络功能网元与第二网络功能网元建立连接失败的情况下，第二网络功能网元发送第二服务发现请求消息，第二服务请求消息用于请求服务发现功能网元提供第一类型的网络功能网元，第二服务发现请求消息包括第一网络功能网元标识和建立连接失败的原因；第二网络功能网元接收包括第一类型的第三网络功能网元的标识信息的第二服务发现响应消息。
根据本申请提供的方案，通过在服务发现请求消息中携带第一网络功能网元标识和第一网络功能网元NFp与第二网络功能网元NFc建立连接失败的原因，使得服务发现功能网元在接下来的服务发现流程中向第二网络功能网元NFc提供除第一网络功能网元NFp之外的其他第一类型的网络功能网元的标识信息，避免服务发现功能网元重复发送第一网络功能网元的标识信息，造成网络连接再次建立失败等，增加通信时延，以及降低网络效率。
结合第五方面或第六方面，在某些实现方式中，建立连接失败的原因包括以下一项或多项：第一网络功能网元的证书过期；第一网络功能网元的证书被吊销；或者，第一网络功能网元的路由失败。
第七方面，提供了一种通信装置。该装置用于执行上述第一方面或第五方面提供的方法。具体地，该通信装置可以包括用于执行第一方面或第五方面的上述任意一种实现方式提供的方法的单元和/或模块。
在一种实现方式中，该通信装置为服务发现功能网元。收发可以是收发器，或输入/输出接口。处理模块可以是至少一个处理器。可选地，收发器可以为收发电路。可选地，输入/输出接口可以为输入/输出电路。
在另一种实现方式中，该通信装置为服务发现功能网元中的芯片、芯片系统或电路。收发模块可以是该芯片、芯片系统或电路上的输入/输出接口、接口电路、输出电路、输入电路、管脚或相关电路等。处理模块可以是至少一个处理器、处理电路或逻辑电路等。
以上第七方面及其可能的设计所示方法的有益效果可参照第一方面或第五方面及其可能的设计中的有益效果。
第八方面，提供了一种通信装置。该装置用于执行上述第二方面或第六方面提供的方法。具体地，该通信装置可以包括用于执行第二方面或第六方面的上述任意一种实现方式提供的方法的单元和/或模块。
在一种实现方式中，该通信装置为第二网络功能网元。收发可以是收发器，或输入/输出接口。处理模块可以是至少一个处理器。可选地，收发器可以为收发电路。可选地，输入/输出接口可以为输入/输出电路。
在另一种实现方式中，该通信装置为第二网络功能网元中的芯片、芯片系统或电路。收发模块可以是该芯片、芯片系统或电路上的输入/输出接口、接口电路、输出电路、输入电路、管脚或相关电路等。处理模块可以是至少一个处理器、处理电路或逻辑电路等。
以上第八方面及其可能的设计所示方法的有益效果可参照第二方面或第六方面及其可能的设计中的有益效果。
第九方面，提供了一种通信装置。该装置用于执行上述第三方面或第三方面提供的方法。具体地，该通信装置可以包括用于执行第三方面或第三方面的上述任意一种实现方式提供的方法的单元和/或模块。
在一种实现方式中，该通信装置为证书颁发网元。收发可以是收发器，或输入/输出接口。处理模 块可以是至少一个处理器。可选地，收发器可以为收发电路。可选地，输入/输出接口可以为输入/输出电路。
在另一种实现方式中，该通信装置为证书颁发网元中的芯片、芯片系统或电路。收发模块可以是该芯片、芯片系统或电路上的输入/输出接口、接口电路、输出电路、输入电路、管脚或相关电路等。处理模块可以是至少一个处理器、处理电路或逻辑电路等。
以上第九方面及其可能的设计所示方法的有益效果可参照第三方面或第三方面及其可能的设计中的有益效果。
第十方面，提供了一种通信装置。该装置用于执行上述第四方面或第四方面提供的方法。具体地，该通信装置可以包括用于执行第四方面或第四方面的上述任意一种实现方式提供的方法的单元和/或模块。
在一种实现方式中，该通信装置为第一网络功能网元。收发可以是收发器，或输入/输出接口。处理模块可以是至少一个处理器。可选地，收发器可以为收发电路。可选地，输入/输出接口可以为输入/输出电路。
在另一种实现方式中，该通信装置为第一网络功能网元中的芯片、芯片系统或电路。收发模块可以是该芯片、芯片系统或电路上的输入/输出接口、接口电路、输出电路、输入电路、管脚或相关电路等。处理模块可以是至少一个处理器、处理电路或逻辑电路等。
以上第十方面及其可能的设计所示方法的有益效果可参照第四方面或第四方面及其可能的设计中的有益效果。
第十一方面，提供了一种处理器，用于执行上述各方面提供的方法。对于处理器所涉及的发送和获取/接收等操作，如果没有特殊说明，或者，如果未与其在相关描述中的实际作用或者内在逻辑相抵触，则可以理解为处理器输出和接收、输入等操作，也可以理解为由射频电路和天线所进行的发送和接收操作，本申请对此不做限定。
第十二方面，提供了一种计算机可读存储介质。该计算机可读存储介质存储用于设备执行的程序代码，该程序代码包括用于执行上述第一方面至第四方面的任意一种实现方式提供的方法。
第十三方面，提供了提供一种包含指令的计算机程序产品。当该计算机程序产品在计算机上运行时，使得计算机执行上述第一方面至第四方面的任意一种实现方式提供的方法。
第十四方面，提供了提供一种芯片，芯片包括处理器与通信接口。处理器通过通信接口读取存储器上存储的指令，执行上述第一方面至第四方面的任意一种实现方式提供的方法。
可选地，作为一种实现方式，芯片还包括存储器，存储器中存储有计算机程序或指令，处理器用于执行存储器上存储的计算机程序或指令，当计算机程序或指令被执行时，处理器用于执行上述第二方面至第四方面的任意一种实现方式提供的方法。
第十五方面，提供了提供一种通信系统，包括：第七方面至第十方面所述的通信装置中的任意多个。
第十六方面，提供过一种通信方法，包括：第一网元获取网络功能网元所属证书的证书状态；在证书状态为证书失效的情况下，第一网元确定网络功能网元的配置方式，其中配置方式为以下方式的一种：配置网络功能网元为去注册，或，标识网络功能网元为失效。
在一种实现方式中，第一网元通过证书吊销通知消息获取网络功能网元的证书状态，其中，证书吊销通知消息包含用于指示证书状态的指示信息，或证书状态。
在一种实现方式中，第一网元获取网络功能网元的证书状态包括：第一网元接收来自证书颁发网元的证书吊销通知消息，证书吊销通知消息还包含网络功能网元标识，其中，网络功能网元标识用于标识证书所对应的网络功能网元；在证书状态为证书失效的情况下，第一网元确定网络功能网元的配置方式，包括：第一网元根据网络功能网元标识配置网络功能网元为去注册或标识功能网元为失效。
在一种实现方式中，第一网元获取网络功能网元的证书状态包括：第一网元接收来自证书颁发网元的证书吊销通知消息，证书吊销通知消息还包含服务名称，服务名称用于标识证书对应的服务；在证书状态为证书失效的情况下，第一网元标识网络功能网元为失效，包括：在证书状态为证书失效的情况下，第一网元根据服务名称来标识网络功能网元所对应的服务为失效。
在一种实现方式中，证书吊销通知消息还包括证书标识，证书标识用于标识证书；在证书状态为证书失效的情况下，第一网元标识网络功能网元为失效，包括：在证书状态为证书失效的情况下，第 一网元根据证书标识来标识功能服务网元所对应的服务为失效。
在一种实现方式中，证书失效状态为吊销或吊扣中的一种。
在一种实现方式中，第一网元向OAM发送第一网元确定的配置方式。
在一种实现方式中，第一网元为服务发现功能网元或证书管理网元。
第十七方面，提供了一种通信装置。该装置用于执行上述第十六方面或第十六方面的上述任一种实现方式提供的方法。具体地，该通信装置可以包括用于执行第十六方面或第十六方面的上述任意一种实现方式提供的方法的单元和/或模块。
附图说明
图1是适用本申请的网络架构的示意图。
图2是PKI系统层级结构的示意图。
图3是NF注册/注册更新/去注册的流程示意图。
图4是不同场景下NF服务发现的流程示意图。
图5是本申请实施例提供的第一种通信方法的流程示例图。
图6是本申请实施例提供的第二种通信方法的流程示例图。
图7是本申请实施例提供的第三种通信方法的流程示例图。
图8是本申请实施例提供的第四种通信方法的流程示例图。
图9是本申请实施例提供的第五种通信方法的流程示例图。
图10是本申请实施例提供的一种通信装置的结构示意图。
图11是本申请实施例提供的另一种通信装置的结构示意图；
图12是本申请实施例提供的一种通信方法的流程示例图。
图13是本申请实施例提供的另一种通信方法的流程示例图。
图14是本申请实施例提供的另一种通信方法的流程示例图。
具体实施方式
下面将结合附图，对本申请中的技术方案进行描述。
本申请提供的技术方案可以应用于各种通信系统，例如：新无线(new radio，NR)系统、长期演进(long term evolution，LTE)系统、LTE频分双工(frequency division duplex，FDD)系统、LTE时分双工(time division duplex，TDD)系统等。本申请还可以应用于设备到设备(device to device，D2D)通信，车到万物(vehicle-to-everything，V2X)通信，机器到机器(machine to machine，M2M)通信，机器类型通信(machine type communication，MTC)，以及物联网(internet of things，IoT)通信系统或者其他通信系统。
在通信系统中，运营者运营的部分可称为公共陆地移动网络(public land mobile network，PLMN)，也可称为运营商网络等。PLMN是由政府或其所批准的经营者为公众提供陆地移动通信业务目的而建立和经营的网络，主要是移动网络运营商(mobile network operator，MNO)为用户提供移动宽带接入服务的公共网络。本申请实施例中所描述的PLMN，具体可为符合第三代合作伙伴项目(3rd generation partnership project，3GPP)标准要求的网络，简称3GPP网络。3GPP网络通常包括但不限于第五代移动通信(5th-generation，5G)网络、第四代移动通信网络，以及未来的其他通信系统，例如第六代移动通信网络等。
为了方便描述，本申请实施例中将以PLMN或5G网络为例进行说明。
图1是适用本申请的一种网络架构的示意图，以3GPP标准化过程中定义的非漫游场景下，基于服务化架构SBA的5G网络架构为例。如图1所示，该网络架构可以包括三部分，分别是终端设备部分、数据网络(data network，DN)和运营商网络部分。下面对各部分的网元的功能进行简单说明。
终端设备部分可以包括终端设备110，该终端设备110也可以称为用户设备(user equipment，UE)。本申请中的终端设备110是一种具有无线收发功能的设备，可以经无线接入网(radio access network，RAN)140中的接入网设备(或者也可以称为接入设备)与一个或多个核心网(core network，CN)设备进行通信。本申请实施例对终端设备的类型或种类等并不限定。为便于理解，本申请后续以UE代指终端设备为例进行说明。
运营商网络部分可以包括但不限于(无线)接入网((radio)access network，(R)AN 120和核心网(core network，CN)部分。(R)AN 120可以看作是运营商网络的子网络，是运营商网络中业务节点与终端设备110之间的实施系统。终端设备110要接入运营商网络，首先是经过(R)AN 120，进而可通过(R)AN 120与运营商网络的业务节点连接。本申请实施例中的接入网设备是一种为终端设备110提供无线通信功能的设备，也可以称为网络设备应理解，本文对接入网设备的具体类型不作限定。CN部分可以包括但不限于：用户面功能(user plane function，UPF)130、网络开放功能(network exposure function，NEF)131、NRF 132、策略控制功能(policy control function，PCF)133、统一数据管理功能(unified data management，UDM)134、统一数据存储库功能(unified data repository，UDR)135、网络数据分析功能(network data analytics function，NWDAF)136、认证服务器功能(authentication server function，AUSF)137、接入与移动性管理功能(access and mobility management function，AMF)138、会话管理功能(session management function，SMF)139。
DN 140，也可以称为分组数据网络(packet data network，PDN)，通常是位于运营商网络之外的网络，例如第三方网络。DN指的是为用户提供数据传输服务的运营商网络，如IP多媒体业务(IP multi-media service，IMS)、Internet等。PLMN可以接入多个DN 140，DN 140上可部署多种业务，可为终端设备110提供数据和/或语音等服务。终端设备110可以通过运营商网络访问DN 140，使用DN 140上部署的运营商业务，和/或第三方提供的业务。
下面对CN包含的NF进行进一步简要说明。
1、UPF 130是由运营商提供的网关，是运营商网络与数据网络DN 140通信的网关。UPF网络功能130包括数据包路由和传输、数据包检测、业务用量上报、服务质量(quality of service，QoS)处理、合法监听、上行数据包检测、下行数据包存储等用户面功能。
2、NEF 131是由运营商提供的控制面功能，主要使能第三方使用网络提供的服务，支持网络开放其能力、事件及数据分析、从外部应用给PLMN安全配备信息、PLMN内外交互信息的转换等。
3、NRF 132是由运营商提供的控制面功能，可用于维护网络中网络功能、服务的实时信息。例如支持网络服务发现、维护NF实例的NF配置数据(NF profile)支持的服务、支持SCP的服务发现、维护SCP实例的SCP配置数据(SCP profile)、发送有关新注册、去注册、更新的NF和SCP的通知、维护NF和SCP运行的健康状态等。
4、PCF 133是由运营商提供的控制面功能，它支持统一的策略框架来治理网络行为、向其他控制功能提供策略规则、策略决策相关的签约信息等。
5、UDM 134是由运营商提供的控制面功能，负责存储运营商网络中签约用户的用户永久标识符(subscriber permanent identifier，SUPI)、签约用户的公开使用的签约标识(generic public subscription identifier，GPSI)、信任状(credential)等信息。
6、UDR 135是由运营商提供的控制面功能，为UDM提供存储和获取签约数据的功能、为PCF提供存储和获取策略数据、存储和获取用户的NF群组ID(group ID)信息等。
7、NWDAF 136是由运营商提供的控制面功能，其主要功能是从NF、外部应用功能(application function，AF)以及运维管理(operations，administration and maintenance，OAM)系统等处收集数据，对NF和AF提供NWDAF业务注册、数据开放和分析数据等。
8、AUSF 137是由运营商提供的控制面功能，通常用于终端设备110(签约用户)与运营商网络之间的认证。AUSF网络功能137接收到签约用户发起的认证请求之后，可通过UDM网络功能134中存储的认证信息和/或授权信息对签约用户进行认证和/或授权，或者通过UDM网络功能134生成签约用户的认证和/或授权信息。AUSF网络功能137可向签约用户反馈认证信息和/或授权信息。
9、AMF 138是由运营商网络提供的控制面网络功能，负责终端设备110接入运营商网络的接入控制和移动性管理，例如包括移动状态管理，分配用户临时身份标识，认证和授权用户等功能。
10、SMF 139是由运营商网络提供的控制面网络功能，负责管理终端设备110的协议数据单元(protocol data unit，PDU)会话。PDU会话是一个用于传输PDU的通道，终端设备需要通过PDU会话与数据网络DN 140互相传送PDU。PDU会话由SMF网络功能139负责建立、维护和删除等。SMF网络功能139包括会话管理(例如会话建立、修改和释放，包含用户面功能UPF 130和(R)AN 120之间的隧道维护)、UPF网络功能130的选择和控制、业务和会话连续性模式选择、漫游等会话功能。
可以理解的是，上述网元或者功能既可以是硬件设备中的物理实体，也可以是在专用硬件上运行 的软件实例，或者是共享平台(例如，云平台)上实例化的虚拟化功能。简单来说，一个NF可以由硬件来实现，也可以由软件来实现。
为方便说明，本申请实施例中将网络功能(如NEF 131…SMF139)统称/简称为NF，即本申请实施例中后文所描述的NF可替换为任一个网络功能。另外，图1仅示意性地描述了部分网络功能，后文所描述的NF不局限于图1中示出的网络功能。
应理解，上述应用于本申请实施例的网络架构仅是从服务化架构的角度描述的网络架构，适用本申请实施例的网络架构并不局限于此，任何能够实现上述各个网元的功能的网络架构都适用于本申请实施例。
还应理解，图1中所示的AMF、SMF、UPF、NEF、AUSF、NRF、PCF、UDM可以理解为核心网中用于实现不同功能的网元，例如可以按需组合成网络切片。这些核心网网元可以各自独立的设备，也可以集成于同一设备中实现不同的功能，本申请对于上述网元的具体形态不作限定。
还应理解，上述命名仅为便于区分不同的功能而定义，不应对本申请构成任何限定。本申请并不排除在5G网络以及未来其它的网络中采用其他命名的可能。例如，在6G网络中，上述各个网元中的部分或全部可以沿用5G中的术语，也可能采用其他名称等。
为便于理解本申请技术方案，首先对涉及的术语或技术进行简单说明。
1、非对称加密算法、数字签名、签名校验
非对称加密算法在使用时需要同时拥有公开密钥和私有密钥，公开密钥与私有密钥相对应，如果在对数据的加密过程中使用了公开密钥，那么只有使用相对应的私有密钥才能解密。反之，如果在对数据进行加密时使用了私有密钥，也只有使用与之相对应的公开密钥才能解密。利用非对称加密算法的一种加密过程是：甲方首先生成一对密钥同时将其中的一把作为公开密钥，得到公开密钥的乙方使用该密钥对需要加密的信息进行加密后再发送给甲方，甲方再使用另一把对应的私有密钥对加密后的信息进行解密，这样就实现了机密数据传输。利用非对称加密算法的另一种加密过程是：甲方使用自己的私有密钥对信息进行加密后发送给乙方，乙方使用甲方提供的公开密钥对加密后的信息进行解密，如果成功解密即可证实信息确实是由甲方所发，并非他人冒充，这就是常用的数字签名技术。
数字签名是非对称加密(asymmetric cryptography)技术的一种应用。非对称加密是一种密码学算法类型，在这种密码学方法中，需要一对密钥，一个是私人密钥(通常称为私钥)，另一个则是公开密钥(通常称为公钥)。这两个密钥数学相关，通常一个作为加密密钥，一个作为解密密钥，通过加密密钥加密的信息只能通过加密密钥对应的解密密钥进行解密。因此，私钥持有者便可以通过私钥对信息进行加密来保证信息的完整和准确。其中，用私钥加密的信息便被称为数字签名，简称为签名。
数字签名具有以下几个特点：(1)防冒充(伪造)：私有密钥只有签名者自己知道，所以其他人无法构造出正确的。(2)可鉴别身份：如前所述，数字签名可以防止他人伪造，因此接收方能够通过鉴别发送方所宣称的身份。(3)防篡改(防破坏信息的完整性)：对于数字签名，签名与原有文件已经形成了一个混合的整体数据，不可能被篡改，从而保证了数据的完整性。(4)防重放。在数字签名中，如果采用了对签名报文添加流水号、时间戳等技术，可以防止重放攻击。(5)防抵赖。如前所述，数字签名可以鉴别身份，不可能冒充伪造，那么，只要保好签名的报文，就好似保存好了手工签署的合同文本，也就是保留了证据，签名者就无法抵赖。(6)机密性(保密性)。有了机密性保证，截收攻击也就失效了。手工签字的文件(如同文本)是不具备保密性的，文件一旦丢失，其中的信息就极可能泄露。数字签名可以加密要签名的消息，当然，如果签名的报名不要求机密性，也可以不用加密。
签名校验是信息接收方通过公钥来验证私钥持有者发布的数据或文件是否完整，以及信息来源是否准确。例如，私钥持有者通过私钥对待发送的数据(或者是待发送数据的摘要信息)进行加密，然后将待发送的数据和密文一起发送给接收方，该密文即为该数据的签名。接收方通过公钥对密文进行解密，并验证解密之后得到的数据和接收方从私钥持有者接收到的数据(或者是根据接收到的数据生成的摘要信息)是否一致，如果一致，则验证通过，表示接收到的数据信息是完整且准确的，且可以确定该数据是由私钥持有者发送的。在本申请中，签名校验还可以称为验证签名，验证通过也可以称为校验成功。
2、公钥基础设施(public key infrastructure，PKI)、证书、证书机构
PKI用于实现基于公私钥的密钥和数字证书(certificate)的产生、管理、存储、分发和撤销等功 能。公钥和私钥分别用于加密和生成数字签名，公钥可以发到网络中，而私钥必须存在持有者内部。数字证书是用于数字通讯中标识一方身份和所持公钥所有权的数字认证信息，本申请中数字证书也可简称为证书。简单来说，证书用于标识用户的身份，PKI用于签发身份证明和证实该身份证明有效。
一个典型的PKI系统包括一个或多个证书机构(certificate authority，CA)，CA负责管理公钥的整个生命周期，包括发放证书、定义证书有效期和吊销证书。需要说明的是，CA还可包括注册机构(registration authority，RA)，RA用于获取并认证用户身份后向CA提出证书签发请求。其中，RA可以是集成在CA的一项功能，也可单独部署，本申请中假设CA集成了RA的功能。为便于管理证书，PKI系统层级结构采用树状结构。树状PKI架构具备以下特点：(1)根CA作为所有网元的信任终结点，需要出于绝对安全的位置，保证安全隔离和尽量少的通信交互。(2)可以借助多级别CA对证书进行使用范围的划分，例如位于不同区域位置的网元使用不同的叶CA下发证书，或用于公共业务和私有业务的网元使用不同的叶CA下发证书等。(3)当某个叶CA被攻击时，不会导致整个PKI架构失效和崩溃，有利于整个PKI系统的稳定性。
图2是一种PKI系统层级结构的示意图。PKI架构下任意两个网元是否可以信任对端是基于各自所持有的证书是否由共同的信任的终结点颁发，如图2所示的共同的信任的终结点为根CA。根CA会根据部署情况下属多级叶CA(如图2中除根CA外的其他CA)，根CA负责对自己(自签名证书)和下一层叶CA(如图2中的CA-A和CA-B)签发证书，下一层叶CA再对其下一层CA签发证书，如CA-A的下一层CA为CA-A1和CA-A2，以此类推，最终由最后一层叶CA对网元签发证书，如CA-B1对网元B1签发证书。
具体地，用户向叶CA请求签发证书的流程如下：(1)用户本地生成配对的公钥和私钥，将公钥和自己的身份信息交给CA。(2)CA确定是否同意为该用户签发证书，包括验证用户身份和公私钥通过后即可以同意颁发，比如用户向CA发送一个初始的credential和一个私钥签名，CA验证初始credential来确定用户身份，并且使用公钥验证私钥签名，确定这个公私钥对是用户自己的，就可以颁发证书。如果同意则生成证书并使用CA的私钥对该证书生成数字签名。其中，证书至少有如表1所示的信息。(3)用户从CA处获取CA为该用户签发的证书，同时从CA处获取查询证书吊销信息的地址和证书链信息。其中，查询证书吊销的地址可以是查询记录证书吊销信息的证书吊销列表(certificate revocation list，CRL)或线证书状态协议(online certificate status protocol，OCSP)。证书链用于从底层叶CA循序向上一直显示到根CA，以向其他网元显示如何循序找到共同的信任终结点。例如，图2中的网元A1和网元B1的证书分别由CA-A1和CA-B1签发，网元A1和网元B1的证书无法独立显示共同的信任终结点，需要借助证书链显示共同信任终结点(如根CA)。其中，网元A1的证书链为{CA-A1证书，CA-A证书，根CA证书}，网元B1的证书链为{CA-B1证书，CA-B证书，根CA证书}。
表1
3、核心网中的CA
核心网定义了不同类型的证书颁发机构，包括但不限于：安全网关(security gateway，SEG)CA、网元(network element，NE)CA、传输层安全性协议(transport layer security，TLS)客户端CA、TLS服务器CA和互联(interconnection)CA。其中：
(1)SEG CA：指的是向特定运营商域内的SEG颁发终端实体证书的CA，用于与其他域的SEG交互或与自己域的网元交互。
(2)NE CA：指的是向特定运营商域内的网元颁发终端实体IPsec证书的CA，NE CA颁发的证 书应限制在Zb接口，用于与其他NE或SEG交互。
(3)TLS客户端CA：指的是向特定运营商域内的TLS实体颁发终端实体TLS客户端证书的CA，用于客户端(client)和服务器(server)之间建立TLS连接。
(4)TLS服务器CA：指的是向特定运营商域内的TLS实体颁发终端实体TLS服务器证书的CA。
(5)互联CA：代表特定运营商向运营商的SEG和TLS实体与之互连的其他域的SEG CA、TLS客户端CA和TLS服务器CA颁发交叉证书的CA。
应理解，除非运营商选择合并CA，否则每个安全域至少有一个SEG CA、NE CA、TLS客户端CA或TLS服务器CA，以及一个专用的互联CA。
4、NF配置数据(NF Profile)
NF Profile由操作、管理和维护(operation，administration and maintenance，OAM)生成并配置给NF。NF Profile中包括但不限于以下参数：网元标识(例如NF ID(身份Identity或识别符Identifier)、NF的实例(Instance)ID)、网元类型(NF type)、全限定域名(fully qualified domain name，FQDN)/IP地址(IP address)、网元所支持的切片和服务、NF的位置信息、NF的归属网络标识PLMN ID、或NF专用的服务授权信息等参数。其中，NF instance ID、NF type、FQDN/IP address等都可以用于申请证书。
5、证书撤销列表CRL和在线证书状态协议OCSP
CRL是一个具有时间戳的列表，包括所有已经吊销或挂起的数字证书信息，还包括CRL本次更新日期和下次更新日期两个字段，用户可根据这两个日期信息确定当前拥有的CRL是否是最新的，以及管理CRL缓冲区，即在CRL下次更新之前，用户可以一直使用原来的CRL缓冲区。由于CRL中含有CA的数字签名，因此CRL可以存储于网络上的任何节点，例如NRF。
在CRL方案中，更新的CRL会定期发布到轻型目录访问协议(lightweight directory access protocol，LDAP)目录服务器上，以便依赖方获悉证书的当前状态，依赖方可以根据CRL中是否包含待校验的证书来判断证书的状态是吊销或未吊销，如果CRL中包含校验证书，那说明证书被吊销，如果CRL中不包含校验证书，那说明证书没有被吊销。具体实现步骤包括：获取对应的CRL，校验CRL上CA的数字签名是否有效，以及检查待校验的证书是否在CRL中。其中，证书在CRL中的状态包括吊销和吊扣。吊销表示证书被不可逆的吊销，例如该证书是由不当的证书颁发机构颁发，或者该证书的私钥被认为已经破坏或窃取，即用户不再独有该证书的私钥。吊扣表示证书是可逆的吊扣，待证书恢复后可继续使用。
OCSP是一个在线证书查询接口，它建立一个可实时响应的机制，让浏览器发送查询证书请求到CA服务器，然后CA服务器实时响应验证证书是否合法有效，这样可以实时查询每一张证书的有效性，解决了CRL的实时性问题。
在基于服务化架构SBA的核心网中，控制面的NF之间是基于服务化的接口进行交互。也就是说，任何两个NF在物理上都是连通的，它们之间可以直接地或间接地通过其他NF(如服务通信代理SCP)进行交互，即一个NF调用另一个NF提供的服务。为了保证网络中NF交互的安全，5G网络中要求每个NF(例如，NFc或NFp)在与其他NF交互之前，需要先在NRF处获得授权。
在一种可能的实现方式中，NF可以通过与NRF进行注册流程来获得NRF的授权。例如，NF在实例化之后向NRF发起注册，将NF配置数据注册到NRF上，以便在服务发现流程中其他NF网元可以发现该NF。
图3是一种NF注册/注册更新/去注册300的流程示意图。其中，步骤S311-S313是NF注册流程，步骤S321-S323是NF注册更新流程，步骤S331-S333是NF去注册流程。如图3所示，具体包括如下多个步骤。
S311，NF(例如，NFp)向NRF发送注册请求(Nnrf_NFManagement_NFRegister Request)消息。
对应的，NRF接收来自NF的注册请求消息。
其中，该注册请求消息包括该NF的配置数据(NF Profile)，NF Profile包括该NF标识，例如NF实例标识(Instance ID)。
可选地，NF Profile还可以包括其他信息。例如NF类型，或者NF所支持的切片和服务等参数。以NFp向NRF请求注册为例，NFp的配置数据还可以包括针对不同类型的NFc(例如SMF，或AMF)或者不同Instance ID的NFc可以使用的NFp具体资源或具体操作。
为了保证NF与NRF之间信息交互的安全性，可以遵循互联网工程任务组(Internet Engineering Task Force，IETF)制定的OAuth 2.0的标准授权框架来进行注册信息交互。其中，OAuth2.0中的客户端(client)对应这里的NF，客户端ID对应NF实例ID，授权服务器(authorization server)对应NRF。
S312，NRF(即授权服务器)存储NF的配置数据。
示例性的，NRF如果接受NFp的注册请求就存储NFp Profile，并标记NFp可用。
需要说明的是，NRF在接受NF注册之前可以对该请求进行验证。
具体地，基于OAuth的授权框架，NRF通过验证注册请求的信息是否真实有效来确定是否接受NF的请求。OAuth的授权框架不限制NRF具体使用的验证方法。例如，NFp可以事先获取一个数字证书，该证书是由NRF或其他网元签发，并在证书中描述NFp的合法Profile。NRF使用签发者(NRF或其他网元)的公钥验证该数字证书的真实性，由此来确定证书中内容的真实性。又例如，NFp也可以事先获取经过NRF或其他网元签名的NFp Profile，NRF通过使用签名者的公钥验证该签名的真实性来确定NFp Profile的真实性。NFp和NRF也可以使用其他事先约定的信任状(credentials)或方法(如口令，或共享密钥等)，来使得NRF可以验证NFp Profile的真实性，本申请不作限定。进一步，如果是数字证书，NRF还可以检查证书所描述的Profile中的参数与注册请求消息中的NFp Profile的参数是一致的。
S313，NRF向NF发送注册响应(Nnrf_NFManagement_NFRegister Response)消息。
对应的，NF接收来自NRF的注册响应消息。
其中，该注册响应消息用于通知NF服务注册成功(或失败)。
S321，NF(例如，NFp)向NRF发送注册更新请求(Nnrf_NFManagement_NFUpdate Request)消息。
对应的，NRF接收来自NF的注册更新请求消息。
其中，该注册更新请求消息包括该NF待更新的配置数据(例如，具有新的服务容量)，用于请求NRF更新之前存储的NF profile。
S322，NRF更新NF的配置数据。
示例性的，如果NRF接受NFp的注册更新请求，就更新存储的NFp profile。
S323，NRF向NF发送注册更新响应(Nnrf_NFManagement_NFUpdate Response)消息。
对应的，NF接收来自NRF的注册更新响应消息。
S331，NF(例如，NFp)向NRF发送去注册请求(Nnrf_NFManagement_NFDeregister Request)消息。
对应的，NRF接收来自NF的去注册请求消息。
其中，该去注册请求消息用于通知NRF该NF不可用。
示例性的，去注册原因可以是NFp被销毁，或者由于网络规划变更导致NFp需要在另一NRF上注册，又或者当NRF即将关闭或与网络断开时，该NF不可用。
S332，NRF删除NF的配置数据。
示例性的，NRF可以根据NFp管理策略删除NFp profile，并标记NFp不可用。
S333，NRF向NF发送去注册响应(Nnrf_NFManagement_NFDeregister Response)消息。
对应的，NF接收来自NRF的去注册响应消息。
需要说明的是，以上提供的NFp注册/注册更新/去注册流程仅为示例，本申请并未限定于此，其他能够实现NF注册的方法及过程均落入本申请的保护范围内。
在另一种可能的实现方式中，NF可以通过与NRF进行服务发现流程来获得NRF的授权。即NF在向其他NF请求服务之前，会向NRF请求能够提供此服务的NF的信息。例如，AMF向NRF请求能够为UE提供PDU会话的SMF的信息。
图4是不同场景下NF服务发现400的流程示意图。其中，步骤S411-S413是非漫游场景下NF服务发现流程，即NF与NRF属于同一服务PLMN，步骤S421-S423是漫游场景下NF服务发现流程，即NF与NRF属于不同的服务PLMN。如图4所示，具体包括如下多个步骤。
S411，NF(例如，NFc)向NRF发送服务发现请求(Nnrf_NFdiscovery_Request)消息。
对应的，NRF接收来自NF的服务发现请求消息。
其中，该服务发现请求消息用于NFc请求发现期望的NFp实例，该服务发现请求消息包括期望的 NFp服务名称、期望的NFp实例的NF类型和NFc的NF类型。
示例性的，NFc根据服务名称(如，建立PDU会话)和目标NF类型(如SMF)发现PLMN网络中可用的服务。
可选地，该服务发现请求消息还包括生产者NF set ID、NF service set ID、SUPI、数据集标识符、外部组ID(用于UDM和UDR发现)、UE的路由指示符和归属网络公钥标识符(用于UDM和AUSF发现)、S-NSSAI、NSI ID以及其他服务相关参数。
示例性的，对于SMF发现，该服务发现请求消息可以包括SMF区域ID，或SMF set ID。例如，该服务发现请求消息包括对SMF位置的指示信息。
S412，NRF授权Nnrf_NFdiscovery_Request，并确定NFc期望的NFp实例。
示例性的，NRF根据期望的NFp或NFp服务的配置文件，以及NFc的类型，确定是否允许NFc发现期望的NFp实例。如果期望的NFp实例或NF服务实例部署在某个网络切片中，NRF根据网络切片的发现配置对发现请求进行授权。例如，期望的NFp实例只能由同一网络切片中的NFc发现。
进一步的，NRF根据NFc发送的请求中包含的服务名称、归属网络，或期望的NFp集合等参数确定匹配服务发现请求消息和NRF内部策略的NFp实例集合。
应理解，NRF确定的NFp数量可以是一个或多个，本申请对此不作具体限定。
S413，NRF向NF发送服务发现响应(Nnrf_NFdiscovery_Response)消息。
对应的，NF接收来自NRF的服务发现响应消息。
其中，该服务发现响应消息包括NFp实例集合的信息，例如NFp profile。
需要说明的是，如果NFc提供了优选的目标NFp位置，则NRF不应将发现的NFp实例或NFp服务实例的集合限制在目标NFp位置。例如，如果无法为优选目标NFp位置找到NFp实例或NFp服务实例，则NRF可以提供位置不是优选目标NFp位置的NFp实例或NFp服务实例。
S421，NF(例如，NFc)向NRF发送服务发现请求消息。
对应的，NRF接收来自NF的服务发现请求消息。
其中，该服务发现请求消息用于NFc请求发现期望的NFp实例，该服务发现请求消息包括期望的NFp服务名称、期望的NFp实例的NF类型、归属PLMN ID、服务PLMN ID，或NFc的NF类型。
可选地，该服务发现请求消息还包括生产者NF set ID、NF service set ID、S-NSSAI、NSI ID以及其他服务相关参数。
S422，NRF与归属hNRF进行服务发现请求消息的交互，以获取NFp实例的NFp profile。
示例性的，服务PLMN中的NRF根据归属PLMN ID识别归属PLMN中的hNRF，并向hNRF转发NFc的服务发现请求消息，以获得归属PLMN中部署的期望NFp实例的NFp profile。由于服务PLMN中的NRF代表NFc触发服务发现请求，服务PLMN中的NRF不应替换NFc的信息。或者，hNRF还可以根据从服务PLMN的NRF接收的输入信息，在hPLMN中查询合适的本地NRF。本地NRF的FQDN或本地NRF的NF发现服务在hPLMN中的端点地址可能在hNRF中配置，也可能需要根据输入信息发现。
进一步的，NRF确定匹配服务发现请求消息和NRF内部策略的NFp实例集合，并向NRF发送NFp实例集合。
S423，NF向NRF发送服务发现响应消息。
对应的，NRF接收来自NF的服务发现响应消息。
其中，该服务发现响应消息包括NFp实例集合的信息，例如NFp profile。
需要说明的是，以上提供的NF服务发现的流程仅为示例性说明，本申请并未限定于此，其他能够实现获取期望的NFp实例的方法及过程均落入本申请的保护范围内。
综上所述，基于上述NF注册以及服务发现流程，NRF可以基于NFp的配置数据对NFp进行注册，并为NFc提供期望的NFp实例或NFp服务实例。进一步的，NFc需要与NFp尝试建立网络连接。具体地，NFc和NFp之间如果此时NFp的证书失效(例如，证书过期)或被吊销(例如，证书未过期但由于网络管理，或者NFp的私钥泄露等因素导致证书被吊销)，那么此次连接将会建立失败，进而影响网络效率。
进一步地，NFc在与NFp建立网络连接失败后，可以向NFp重新请求服务发现NFp，但是后续NFc仍然有可能为NFc提供相同的NFp，导致网络连接再次失败，影响服务的进程。
也就是说，当NF生命周期与证书生命周期不一致时，会暴露一些安全风险。例如，当NF生命周期长于证书生命周期时，在证书过期或被吊销后，NRF仍可能在NF服务发现过程中发现该NF，并将其提供给NFc。当NFc与NFp建立TLS连接时，虽然NFc可以选择另一个NFp，但NFc和NFp之间的连接可能会失败，因为NFp的证书无效。但是，连接设置失败也会影响网络效率。
有鉴于此，本申请提供了一种通信方法和装置，通过在NFp注册流程中提供NFp所拥有的证书信息，以及在NFc服务发现流程中增加对NFp所拥有的证书有效性进行验证，能够避免或降低后续NFc和NFp建立TLS连接时因NFp证书失效或被吊销导致网络连接建立失败的可能性，进而提高网络效率，以及提升用户体验。
为了便于理解本申请实施例，作出以下几点说明：
第一、在本申请的各个实施例中，如果没有特殊说明以及逻辑冲突，不同的实施例之间的术语和/或描述具有一致性、且可以相互引用，不同的实施例中的技术特征根据其内在的逻辑关系可以组合形成新的实施例。
第二、在本申请实施例中，“至少一个”是指一个或者多个，“多个”是指两个或两个以上。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B的情况，其中A，B可以是单数或者复数。在本申请的文字描述中，字符“/”一般表示前后关联对象是一种“或”的关系。“以下至少一项(个)”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a、b和c中的至少一项(个)，可以表示：a，或，b，或，c，或，a和b，或，a和c，或，b和c，或，a、b和c。其中a、b和c分别可以是单个，也可以是多个。
第三、在本申请实施例中，“第一”、“第二”以及各种数字编号(例如，#1、#2等)指示为了描述方便进行的区分，并不用来限制本申请实施例的范围。例如，区分不同的消息等，而不是用于描述特定的顺序或先后次序。应理解，这样描述的对象在适当情况下可以互换，以便能够描述本申请的实施例以外的方案。
第四、在本申请实施例中，“当……时”、“在……的情况下”以及“如果”等描述均指在某种客观情况下设备会做出相应的处理，并非是限定时间，且也不要求设备在实现时一定要有判断的动作，也不意味着存在其它限定。
第五、在本申请实施例中，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
第六、在本申请实施例中，“用于指示”可以包括用于直接指示和用于间接指示。当描述某一指示信息用于指示A时，可以包括该指示信息直接指示A或间接指示A，而并不代表该指示信息中一定携带有A。
本申请实施例涉及的指示方式应理解为涵盖可以使得待指示方获知待指示信息的各种方法。待指示信息可以作为整体一起发送，也可以分成多个子信息分开发送，而且这些子信息的发送周期和/或发送时机可以相同，也可以不同，本申请对具体的发送方法不作限定。
本申请实施例中的“指示信息”可以是显式指示，即通过信令直接指示，或者根据信令指示的参数，结合其他规则或结合其他参数或通过推导获得。也可以是隐式指示，即根据规则或关系，或根据其他参数，或推导获得。本申请对此不作具体限定。
第七、在本申请实施例中，“协议”可以是指通信领域的标准协议，例如可以包括5G协议、新空口(new radio，NR)协议以及应用于未来的通信系统中的相关协议，本申请对此不做限定。“预配置”可以包括预先定义。例如，协议定义。其中，“预先定义”可以通过在设备中预先保存相应的代码、表格或其他可用于指示相关信息的方式来实现，本申请对于其具体的实现方式不做限定。
第八、本申请实施例中，“存储”可以是指保存在一个或者多个存储器中。所述一个或者多个存储器可以是单独的设置，也可以是集成在编码器或者译码器、处理器、或通信装置中。所述一个或者多个存储器，也可以是一部分单独设置，一部分集成在译码器、处理器、或通信装置中。存储器的类型可以是任意形式的存储介质，本申请并不对此限定。
第九、在本申请实施例中，“通信”还可以描述为“数据传输”、“信息传输”、“数据处理” 等。“传输”包括“发送”和“接收”，本申请对此不作限定。
下面将结合附图详细说明本申请提供的技术方案。
图5是本申请实施例提供的第一种通信方法500的流程示意图。如图5所示，该方法包括如下多个步骤。
S510，服务发现功能网元接收服务发现请求消息，服务请求消息用于请求服务发现功能网元提供第一类型的网络功能网元。
示例性的，服务发现功能网元从第二网络功能网元(例如，网络功能服务消费网元NFc)接收服务发现请求消息；或者，服务发现功能网元通过代理网元(例如，通信代理(service communication proxy，SCP))接收来自第二网络功能网元的服务发现请求消息。
可选地，针对跨PLMN漫游场景下，服务发现功能网元(例如NRF1)还可以从其他服务发现功能网元(例如NRF2)接收服务发现请求消息。
需要说明的是，服务发现请求消息可以理解是调用服务发现请求的消息，服务发现可以理解为：服务发现功能网元发现可以为第二网络功能网元提供特定服务的第一网络功能网元。相应地，发送服务发现请求消息可以理解为触发服务发现流程。其中，所述服务发现请求消息可以包括第二网络功能网元期望的网络功能的类型(即第一类型)。
具体地，服务发现功能网元可以是NRF或未来用于服务发现功能的网元，第一类型可以是会话管理，第二网络功能网元可以是AMF，请求发现的网络功能网元可以是SMF。例如，AMF向NRF请求用于为某一用户提供PDU会话的SMF的信息。
S520，在确定第一类型的第一网络功能网元的第一证书有效的情况下，服务发现功能网元发送包括第一类型的第一网络功能网元的标识信息的服务发现响应消息。
示例性的，服务发现功能网元向第二网络功能网元NFc发送包括第一网络功能网元的标识信息的服务发现响应消息；或者，服务发现功能网元通过SCP向第二网络功能网元发送包括第一网络功能网元的标识信息的服务发现响应消息；或者，服务发现功能网元通过其他服务发现功能网元向第二网络功能网元发送包括第一网络功能网元的标识信息的服务发现响应消息。
示例性的，第一网络功能网元的标识信息可以是NF ID(身份Identity或识别符Identifier)，或者NF的实例标识(Instance ID)，用于后续第二网络功能网元与第一网络功能网元进行网络建立连接。
可选地，服务发现响应消息包括第一网络功能网元的配置数据(NF Profile)，例如NF的类型(例如AMF、SMF等)、NF所属的PLMN识别符(例如PLMN ID)、切片相关识别符Identifier(例如，NF所属的单个网络切片选择辅助信息)、NF所属的切片实例的NSI ID)，或者NF的位置信息等，本申请对此不作具体限定。
具体地，服务发现功能网元根据服务发现请求消息中的第一类型，确定第一类型的第一网络功能网元。具体实现方式可参考上述方法400中步骤S412，为了简洁，这里不再赘述。进一步地，服务发现功能网元根据第一证书的有效期确定第一证书未过期，以及服务发现功能网元确定第一证书未被吊销，进而确定第一类型的第一网络功能网元的第一证书的有效。
其中，服务发现功能网元可以通过查询NF上下文，获取第一证书的有效期。
其中，服务发现功能网元确定第一证书未被吊销，包括以下几种实现方式。
在一种可能的实现方式中，服务发现功能网元本地查询证书撤销列表(例如，可以是证书吊销列表(certificate revocation list，CRL)或线证书状态协议(online certificate status protocol，OCSP))，在第一证书不属于证书撤销列表的情况下，服务发现功能网元确定第一证书未被吊销。
在另一种可能的实现方式中，在服务发现功能网元本地未查询到证书撤销列表的情况下，服务发现功能网元确定第一证书未被吊销。
示例性的，证书撤销列表可以是预配置的。
应理解，该实现方式中证书撤销列表部署在服务发现功能网元上，证书撤销列表上会列出当前所有已经吊销或挂起的数字证书信息。
在又一种可能的实现方式中，服务发现功能网元向服务器发送询问请求消息，询问请求消息用于查询第一证书是否被吊销；服务发现功能网元接收来自服务器的询问响应消息，询问响应消息包括第一证书未被吊销的指示；服务发现功能网元根据指示确定第一证书未被吊销。
可选地，服务器可以是CRL或者OCSP server。例如，NRF通过CRL或OCSP服务器查询NFp 的证书状态(是否被吊销)。NRF可以直接或通过代理网元SCP与CRL或OCSP服务器交互，这具体取决于CRL/OCSP服务器的部署位置(例如，NRF，或者CRL或OCSP服务器)。
应理解，该实现方式中证书撤销列表部署在外部服务器上，证书撤销列表是一个具有时间戳的列表，包括当前所有已经吊销或挂起的数字证书信息。在证书撤销列表中包含本次更新日期和下次更新日期两个字段，用户可由这两个日期信息确定当前拥有的证书撤销列表是否是最新的，以及管理证书撤销列表缓冲区。
示例性的，第一证书还包括以下一项或者多项：签发第一证书的证书颁发网元的标识；第一证书的持有者标识；第一证书的持有者公钥；或者证书颁发网元的证书签名等。
接下来，对服务发现功能网元获取第一证书的具体实现方式进行具体说明。
在一种可能的实现方式中，服务发现功能网元接收注册请求消息，注册请求消息用于请求将第一网络功能网元注册到服务发现功能网元上，注册请求消息包括第一证书，第一证书包括第一证书的标识信息和第一证书有效期。
示例性的，第一证书的标识信息可以是第一证书ID(身份Identity或识别符Identifier)，表示第一证书本身的身份信息。
示例性的，服务发现功能网元从网络功能服务消费网元接收注册请求消息；或者，通过代理网元(例如SCP)接收来自网络功能服务消费网元的注册请求消息。
需要说明的是，服务发现功能网元NRF通过SCP接收来自网络功能服务消费网元NFc的注册请求消息中，SCP需要在建立连接请求消息中携带SCP的证书，与NRF完成双向认证以建立网络连接。所以通过SCP建立连接时，第一网络功能网元NFp的所有证书都是通过注册请求消息携带的，而不通过SCP建立连接请求消息中携带。
在该实现方式中，第一证书可以是多个。例如，当第一证书有多个时，网络功能服务提供网元在与服务发现功能网元建立网络连接时需要基于证书完成双向认证，因此在连接建立请求中需要携带某一个证书。那么注册请求消息中第一证书可以是网络功能服务提供网元所拥有的全部证书，也可以是除了用于建立网络连接的证书以外的其他证书，本申请对此不作具体限定。
在另一种可能的实现方式中，服务发现功能网元接收连接建立请求消息，连接建立请求消息用于请求第一网络功能网元与服务发现功能网元建立连接，连接建立请求消息包括第一证书，第一证书包括第一证书的标识信息和第一证书的有效期。
示例性的，服务发现功能网元从第一网络功能网元NFp接收连接建立请求消息；或者，通过代理网元(例如SCP)接收来自第一网络功能网元NFp的连接建立请求消息。
在该实现方式中，第一证书可以是一个。例如，当第一证书仅有一个时，网络功能服务提供网元在与服务发现功能网元建立网络连接时需要基于证书完成双向认证，因此在网络连接建立请求中需要携带该第一证书。可选地，注册请求消息可以携带该第一证书，也可以不携带该第一证书，本申请对此不作具体限定。
进一步地，服务发现功能网元通过发送注册响应消息来通知接受第一网络功能网元NFp的注册请求，并存储第一网络功能网元的配置数据。
在一种可能的实现方式中，在确定第一证书有效的情况下，服务发现功能网元将第一证书作为NFp上下文存储在服务发现功能网元上；或者，在确定第一证书有效的情况下，服务发现功能网元将第一证书的标识信息和第一证书有效期作为NFp上下文存储在服务发现功能网元上。
也就是说，服务发现功能网元在确定第一证书有效的情况下才接受第一网络功能网元(例如NFp)的注册请求，即存储第一网络功能网元的配置数据，以及第一证书或者第一证书的标识信息和第一证书有效期。
需要说明的是，在本申请技术方案中，NRF需要将用于在NF和NRF之间建立TLS连接的证书信息作为NF的上下文存储到NRF上。
在另一种可能的实现方式中，在确定注册请求消息中第一证书有效的情况下，服务发现功能网元也可以不存储第一证书，或者不存储第一证书的标识信息和第一证书有效期。基于该实现方式，服务发现功能网元在接收用于请求发现第一类型的网络功能网元的服务时，可以将第一类型的第一网络功能网元的标识信息发送给外部服务器，例如证书撤销列表服务器或线证书状态协议服务器，用于请求获取第一证书的有效性(查询第一证书的有效期和证书状态)，进而服务发现功能网元根据外部服务器 反馈的响应消息确定是否提供第一网络功能网元的标识信息给第二网络功能网元NFc。例如，外部服务器反馈第一证书有效，则服务发现功能网元向第二网络功能网元NFc提供第一网络功能网元NFp的标识信息。
示例性的，服务发现功能网元向证书撤销列表服务器发送消息#1，该消息#1包括第一类型的第一网络功能网元的标识信息(例如，NFp ID或者NF instance ID)，该消息#1用于向证书证书撤销列表服务器查询第一网络功能网元的第一证书的有效性。对应的，证书撤销列表服务器接收来自服务发现功能网元的消息#1，并根据NF instance ID查找NFp对应的证书。如果服务器没有找到其对应的证书，则表示NFp instance所拥有的第一证书没有被吊销；如果服务器找到其对应的证书，则表示NFp instance所拥有的第一证书有一个或多个被吊销，则向服务发现功能网元返回NFp instance的第一证书被吊销的指示。
接下来，针对注册请求过程中，服务发现功能网元确定第一证书有效的具体实现方式进行具体说明。
在一种可能的实现方式中，服务发现功能网元根据第一网络功能网元的公钥和证书颁发网元的公钥确定第一证书是证书颁发网元为第一网络功能网元签发的证书；服务发现功能网元根据第一证书的有效期确定第一证书未过期；以及服务发现功能网元确定第一证书的证书未被吊销。
示例性的，第一网络功能网元的公钥和证书颁发网元的公钥可以是服务发现功能网元预配置的，也可以是通过注册请求消息携带的，本申请对此不作具体限定。
应理解，公钥和私钥分别用于加密和生成数字签名，公钥可以发到网络中而私钥必须存在持有者内部。也就是说，第一网络功能网元和证书颁发网元可以分别通过各自的私钥对第一证书生成数字签名，作为加密的一种方式，服务发现功能网元可以通过第一网络功能网元的公钥和证书颁发网元的公钥对二者的加密保护进行解密钥验证，验证通过即说明该第一证书属于第一网络功能网元，且由证书颁发网元签发和认证，没有被其他功能实体篡改。
基于上述实现方式，第二网络功能网元NFc可以从服务发现功能网元NRF获取第一类型的第一网络功能网元NFp的标识信息，并与之进行网络建立连接。此时，如果第一网络功能网元的第一证书失效或者被吊销，将导致网络连接建立失败，进而影响网络效率。
接下来，针对在服务发现功能网元发送包括第一网络功能网元的标识信息的服务发现响应消息之后，但是第一证书被吊销的情况，服务发现功能网元如何管理证书，以及网络功能网元之间如何通信进行具体说明。
在一种可能的实现方式中，服务发现功能网元接收指示信息，指示信息用于指示第一证书被吊销，指示信息包括第一证书的标识信息；服务发现功能网元发送通知消息，通知消息用于通知第一网络功能网元的第一证书被吊销。
示例性的，服务发现功能网元可以从证书颁发网元(第一证书被吊销时)接收指示信息；或者，也可以从第二网络功能网元NFc(网络建立连接失败时)接收指示信息。
可选地，服务发现功能网元接收订阅请求消息，订阅请求消息用于向服务发现功能网元请求订阅第一证书的证书状态。
示例性的，服务发现功能网元从第二网络功能网元NFc接收订阅请求消息；或者，服务发现功能网元通过代理网元SCP接收来自第二网络功能网元NFc的订阅请求消息。
作为示例而非限定，服务发现功能网元接收来自证书颁发网元的指示信息。
对应的，证书颁发网元向第一网络功能网元对应的网络存储功能网元发送指示信息。
示例性的，证书颁发网元根据预先配置的第一网络功能网元对应的网络存储功能网元信息确定该网络存储功能网元。
需要说明的是，第一网络功能网元对应的网络存储功能网元信息可以是在第一网络功能网元NFp向证书颁发网元请求证书时发送的，并存储在证书颁发网元中；或者，第一网络功能网元对应的网络存储功能网元信息也可以是证书颁发网元颁发给第一网络功能网元NFp的第一证书的内容的一部分；或者，可以是网络管理网元或网络管理员预先配置在证书颁发网元上的。
可选地，在证书颁发网元向第一网络功能网元对应的网络存储功能网元发送指示信息之前，证书颁发网元根据第一证书上的第一网络功能网元的实例标识或第一证书上的证书撤销列表地址确定维护该第一证书的功能网元是该网络存储功能网元。
进一步地，服务发现功能网元根据指示信息将第一证书增加至证书撤销列表。
示例性的，当证书颁发网元吊销第一证书时，服务发现功能网元从证书颁发网元接收指示信息，并及时更新本地存储的证书撤销列表。
具体地，证书颁发网元吊销第一证书的原因可以是：证书颁发网元因收到其他实体发送的吊销请求，或主动的吊销第一证书，比如第一网络功能网元的私钥泄露，网管检测到这一安全事件后向证书颁发网元请求吊销证书，或者因为运营商网络维护，需要更新该第一网络功能网元的配置，吊销或暂时吊扣第一证书等。
需要说明的是，该指示信息还可以用于指示第一证书被吊销，指示信息包括第一证书的标识信息。也就是说，该指示信息以及使得接收端(例如网络存储功能网元NRF)将第一证书添加至撤销列表的指示信息可以是同一指示信息，本身其对此不作具体限定。
在另一种可能的实现方式中，服务发现功能网元接收来自第一网络功能网元的去注册请求消息；服务发现功能网元发送通知消息，通知消息用于通知第一网络功能网元的第一证书无效。
需要说明的是，在本申请实施例中，证书无效包括证书失效或者证书被吊销，证书失效一般理解为证书的有效期超期，证书被吊销一般理解为证书未超期，但是因为某些原因(例如NF私钥泄露或者网络管理等)而被吊销。
示例性的，服务发现功能网元可以从第一网络功能网元(去注册请求)接收第一证书无效的指示。其中，去注册原因可以是第一网络功能网元被销毁，也可以是网络规划变更使得第一网络功能网元需要在另一个服务发现功能网元(例如NRF)上注册等，本申请对此不作限定。
需要说明的是，以上NRF在服务发现流程中确定NFp，并验证NFp的证书有效性仅是示例性说明，不应构成对本申请技术方案的任何限定。也就是说，上述方案主要针对NFc请求NRF提供的第一类型的网络功能网元NFp与NFc是注册到同一NRF上的，归属于同一PLMN的场景，NFc和NFp的应用上下文存储到同一NRF上。
类似地，本申请同样适用于如下场景，即NFc请求NRF(例如NRF1)提供的第一类型的网络功能网元可以是其他NRF(例如NRF2)发现并确定的。即NFc和NFp的应用上下文分别存储到NRF1和NRF2上。因此，本申请对NRF的数量也不做限定。
针对上述第二种场景，具体步骤可以是：NFc发起服务发现流程，例如NFc向VPLMN中的NRF(即NRF1)发送服务发现请求消息，该请求消息携带归属PLMN ID。NRF1根据归属PLMN ID识别归属HPLMN中的NRF(hNRF)(即NRF2)，并代表NFc触发“NF Discovery”。HPLMN中的NRF2在确定NFp后，通过NF上下文查询NFp的证书有效性，并通过CRL或OCSP服务器查询NFp的证书吊销状态。其中，HPLMN中的NRF2可以直接或通过代理与CRL或OCSP服务器交互，具体取决于CRL或OCSP服务器的部署位置(例如，NRF2或第三方服务器上)。HPLMN中的NRF2向VPLMN中的NRF1发送服务发现响应消息，携带NFp的信息(例如NFp的实例ID)。VPLMN中的NRF1再向NFc转发该服务发现响应消息。其中，NRF2搜索发现NFp以及NRF2对NFp的证书有效性进行验证的过程可参考上述步骤S510和S520，以及上述方法400中的步骤S421-S423，为了简洁，此处不再赘述。
换句话说，本申请技术方案既适用于非漫游场景下对管理证书以及通信进行描述，也适用于漫游场景，本申请对此不作具体限定。
基于上述技术方案，本申请通过对第一网络功能网元的第一证书的有效性进行验证，并在验证通过的情况下向第二网络功能网元提供第一网络功能网元的信息，能够避免或者降低第一网络功能网元和第二网络功能网元在建立网络连接过程中，由于第一网络功能网元的证书失效或者被吊销，导致网络连接建立失败的情况发生，进而提高网络效率，以及提升用户体验。
可选地，在确定第一类型的第三网络功能网元的第一证书无效的情况下，服务发现功能网元发送不包括第三网络功能网元的标识信息的该服务发现响应消息。
可选地，在确定第一类型的所有网络功能网元的证书都无效的情况下，服务发现功能网元发送服务发现响应消息，用于拒绝提供第一类型的网络功能网元。
综上所述，本申请技术方案基于已有的业务发现过程，将证书吊销状态查询与服务发现过程相结合，从而优化了证书吊销状态查询的效率。此外，本申请技术方案还可以避免NRF在NFp的证书过期或吊销后继续向NFc提供该NFp，这可能会导致连接设置失败。
下面以NFp向NRF请求服务注册，结合NFc向NRF请求服务发现为例，通过在NFp注册流程中提供NFp所拥有的证书信息，以及在NFc服务发现流程中增加对NFp所拥有证书有效性的验证，防止在NFc与NFp建立TLS连接时因NFp证书失效导致连接建立失败，降低网络效率。
图6是本申请实施例提供的第二种通信方法600的流程示例图。如图6所示，具体包括如下多个步骤。
S611，NRF维护所服务区域内的所有NF的证书的CRL。
需要说明的是，该实现方式中CRL存储在NRF，即NRF可以本地查询所服务区域内的所有NF的证书状态信息。
S612a，NFp向NRF发送注册请求消息#1。
对应的，NRF接收来自NFp的注册请求消息#1。
其中，该注册请求消息#1中携带NFp所拥有的证书，NFp的每个证书包括证书ID和证书有效期。例如，证书有效期可以是证书的签发时刻和有效时长，也可以是证书的有效截止时间等。
可选地，NFp的证书还包括签发证书的CA ID、证书的签名、证书持有者ID，或者证书持有者公钥等。
需要说明的是，该注册请求消息#1包括NFp所拥有的所有证书，本申请对NFp的证书数量不作限定。例如，NFp的证书数量取决于不同级别的CA签发，或者业务类型等。
S612b，NRF将NFp所拥有的证书作为NFp上下文存储在NRF上。
示例性的，NRF可以将NFp的证书ID和证书有效期作为NFp上下文存储在NRF上，或者，NRF也可以将NFp的所有证书的全部信息作为NFp上下文存储在NRF上，本申请对此不作具体限定。
在一种可能的实现方式中，NRF在接收到该注册请求消息#1后，将NFp的证书信息作为NFp上下文存储在NRF上。
示例性的，如果NFp只有一个证书，那么注册请求消息#1中可以携带该证书信息，也可以不携带该证书信息。这是因为如果NFp只有一个证书，那么在建立TLS连接时，NFp与NRF之间需要互相发送证书以验证双方的合法性，进而发起注册请求。此时NRF已经获得NFp的证书，所以NFp在注册请求消息#1中可以不携带该证书信息。
示例性的，如果NFp有多个证书，那么注册请求消息#1中可以携带所述多个证书的证书信息，也可以不携带与NRF建立TLS连接时所使用的证书的信息，本申请对此不作限定。
在另一种可能的实现方式中，NRF在接收到该注册请求消息#1后，对NFp所有证书进行验证。例如，NRF验证证书的有效性(证书有效期和证书状态)，以及验证证书的真实性(该证书是否属于该NFp)，待验证通过后将NFp的证书信息作为NFp上下文存储在NRF上。
示例性的，NRF使用CA公钥对接收到的NFp的证书上CA的签名进行验证，以及NRF使用NFp的公钥对接收到的NFp的证书上NFp的签名进行验证，以确定该证书该CA为该NFp签发的证书，且该证书没有被篡改过。进一步地，通过查询存储的NFp上下文中的证书信息(证书有效期)确定证书是否超期，以及本地查询CRL中NFp的证书状态是否被吊销。在确定该证书是CA针对NFp签发的，且该证书的状态是有效(在有效期内且证书未被吊销或吊扣)的情况下时，NRF将NFp的证书ID和证书有效期作为NFp上下文存储在NRF上。
可选地，在步骤S612b中，NRF可以不存储NFp的证书，或者不存储NFp的证书的标识信息和有效期。基于该实现方式，后续NRF在接收用于请求发现第一类型的网络功能网元的服务时，可以将第一类型的NFp的标识信息发送给外部服务器，例如证书撤销列表服务器CRL或线证书状态协议OCSP服务器，用于请求获取NFp的证书的有效性(查询证书的有效期和证书状态)，进而在确定NFp的证书有效的情况下向NFc提供NFp的标识信息。
在该实现方式中，通过对NFp所拥有的证书的有效性进行验证，可以防止其他恶意的NF伪造证书信息进行注册，安全性更强。同样的，NF可以不携带与NRF建立TLS连接时所使用的证书的信息。
S613，NFc1向NRF发送服务发现请求消息#1。
对应的，NRF接收来自NFc1的服务发现请求消息#1。
其中，该服务发现请求消息#1用于NFc1请求发现期望的NFp实例，该服务发现请求消息#1包括期望的NFp服务名称、期望的NFp实例的NF类型和NFc1的NF类型等。
S614，NRF验证NFp的证书有效性，并确定NFp的证书有效，即NFp的证书有效性验证通过。
应理解，在验证NFp之前，NRF可以根据期望的NFp或NFp服务的配置文件，以及NFc的类型对NFc1的发现请求进行授权。同时，参考上述方法400中步骤S412确定匹配服务发现请求消息#1和NRF内部策略的NFp实例集合。
示例性的，NRF确定能够服务NFc1的一个或多个NFp后验证NFp证书的有效性。具体地，NRF通过查询存储的NFp上下文(证书信息)中的证书信息(证书有效期)确定此证书是否过期，然后本地查询CRL中记录的此证书的状态是否被吊销。如果全部验证通过，则认为该NFp是可以作为服务NFc1的NFp实例。例如，NFp只有一个证书，且该证书的有效截止时间为t5，假设当前时刻为t1，则说明该证书未过期，接着NRF查询该证书在CRL中的状态为非吊销，则说明该NFp的证书验证通过，可以用于为NFc1服务的NFp实例。
可选地，当NFp有多个证书时，判断标准为NFp的所有证书均通过验证，或是用于服务NFc1的证书通过验证，此时该NFp可以用于为NFc1服务的NFp实例。
示例性的，NFc1为AMF，NFp为SMF，SMF上有多个证书，包括用于与其他NF建立连接的TLS client证书和TLS server证书，也有用于与UPF建立连接的NE证书。如果AMF向NRF请求发现可以用于服务的SMF，NRF找到的某个SMF的NE证书过期或被吊销，则NRF可以根据吊销原因或本地策略判断是否将该SMF提供给AMF。例如，如果吊销原因为该SMF的私钥被泄露，那么该SMF不可以提供给AMF；如果吊销原因为网络维护或该NE证书为暂时吊扣，那么该SMF可以提供给AMF。
S615，NRF向NFc1发送服务发现响应消息#1。
对应的，NFc1接收来自NRF的服务发现响应消息#1。
其中，该服务发现响应消息#1用于通知NFc1的服务发现请求成功，该服务发现响应消息#1包括NFp实例集合的信息，例如NFp profile。
示例性的，在NFp所拥有证书的有效性被验证通过的情况下，NRF可以将NFp信息提供给NFc1，例如NFp Instance ID和NFp的NF类型等。
需要说明的是，步骤S613-S615的实现方式可以参考上述步骤S411-S413，为了简洁，此处不再赘述。
可选地，NFc1向NRF发送订阅请求消息#1，该订阅请求消息#1用于向NRF订阅上述步骤S615中提供的NFp的证书状态；或者说，该订阅请求消息#1用于向NRF订阅上述步骤S615中提供的NFp是否可用。该实现方式能够保证NFc1实时了解NFp的证书有效性，避免网络建立失败或者向NFp请求服务失败，从而降低网络效率以及用户体验。
示例性的，订阅请求消息#1可以和服务发现请求消息#1一起发送给NRF，即在步骤S613中。或者，订阅请求消息#1也可以在NFc1收到NRF提供的NFp信息后发送，即在步骤S615之后。
接下来，针对NFp的证书失效后如何管理证书进行示例性说明。其中，方式一是CA/RA吊销或吊扣NFp的证书，并请求NRF更新CRL中NFp的证书状态为无效(被吊销或吊扣)。方式二是NFp主动向NRF请求去注册，删除NFp的证书信息。
方式一：
S621，CA/RA吊销或吊扣NFp的证书。
示例性的，CA/RA接收到其他NF实体发送的吊销请求。例如，网管在检测到NFp的私钥泄露的情况下，向CA/RA请求吊销NFp的证书。
示例性的，CA/RA主动吊销NFp的证书。例如，由于运营商的网络维护，需要更新该NFp的配置信息，因此吊销或暂时吊扣NFp的证书等。
S622，CA/RA向NRF发送CRL更新请求消息#1。
对应的，NRF接收来自CA/RA的CRL更新请求消息#1。
其中，CRL更新请求消息#1用于请求更新存储在NRF上的CRL。
示例性的，CA/RA吊销证书后，根据证书上的NFp instance ID或CRL地址，对维护该证书CRL的功能实体的位置进行定位，即NRF。然后，CA/RA向NRF发送CRL更新请求，用于请求更新NRF上的CRL中NFp的证书状态。例如，吊销或吊扣。
可选地，CA/RA周期性地更新CRL。比如，CA/RA每隔一小时、一天或一周更新一次CRL。或者，CA/RA也可以在每当有新的证书被吊销时触发一次CRL更新。
可选地，CA/RA预先配置用于向NRF发送CRL更新请求消息#1的指示信息。
应理解，基于CRL更新请求消息#1，NRF更新本地存储的CRL，即将NFp的证书增加至CRL。
S623，NRF向NFc1发送通知消息#1。
对应的，NFc1接收来自NRF的通知消息#1。
其中，该通知消息#1用于通知NFc1该NFp的证书被吊销(失效)。
示例性的，NRF在更新CRL后，可以基于上述步骤S613中接收到来自NFc1的订阅请求消息#1，通知NFc1该NFp的证书已经被吊销(失效)。
也就是说，对于NFp所拥有的多个证书，如果其中一个或多个证书被撤销则认为该NFp的整个证书状态为无效，即该NFp不可用，此时NRF向NFc发送通知消息#1。
可选地，如果步骤S622中CA吊销的NFp的证书仅是多个证书中一个或多个，且该一个或多个被撤销的NFp证书与用于服务NFc1的证书是不相同的，此时NRF可以不执行步骤S623，即该NFp仍然可以作为用于为NFc1服务的NFp实例。
基于该实现方式，NRF通知NFc1该NFp的证书已经被吊销，使得已经进行过服务发现流程并获取了NFp信息的NFc1不会与NFp建立连接继续通信，能够提高网络效率，提升用户体验。
S624，NFc2向NRF发送服务发现请求消息#2。
对应的，NRF接收来自NFc2的服务发现请求消息#2。
其中，该服务发现请求消息#2用于NFc2请求发现期望的NFp实例，该服务发现请求消息#2包括期望的NFp服务名称、期望的NFp实例的NF类型和NFc2的NF类型。
S625，NRF验证NFp的证书有效性，并确定NFp的证书无效，即NFp的证书有效性验证不通过。
S626，NRF向NFc2发送服务发现响应消息#2。
对应的，NFc2接收来自NRF的服务发现响应消息#2。
其中，该服务发现响应消息#2用于通知NFc2的服务发现请求失败。
示例性的，NRF在验证NFp所拥有证书的有效性不通过后，不会将NFp的信息提供给NFc2。例如，NRF需要检查NFp的证书有效期和证书状态。由于步骤S621中NFp的证书被吊销或吊扣，因此即使NFp的证书还在有效期内，其有效性也不通过。
需要说明的是，步骤S624-S626的具体实现方式可参考上述步骤S613-S615，为了简洁，此处不再赘述。
S627，NFp获取新证书或证书恢复后，向NRF请求更新证书信息。
示例性的，针对NFp的证书被吊销，NFp可以重新向CA/RA请求签发证书。NFp在获取证书后可以向NRF发送注册更新消息，用于请求更新NFp的证书信息。进一步地，便于后续其他NF向NRF请求服务发现流程中找到该NFp。
需要说明的是，注册更新消息中携带NFp获取的新证书的信息。具体的注册更新请求流程可参考方法300中步骤S321-S323，NFp向NRF请求注册的具体实现方式可参考上述步骤S612a和S612b，NFp向CA/RA请求签发证书的具体实现方式可参考当前标准中提供的技术方案，本申请对此不作具体限定。为了简洁，此处不再过多赘述。
示例性的，针对NFp的证书被吊扣，NRF可以在证书吊扣恢复后告知NFc2。或者，NRF也可以向NFc2发送NFp的证书的吊扣时长或者吊扣时段，以便于NFc2在证书吊扣恢复继续与NFp进行通信。
方式二：
S631，NFp向NRF发送去注册请求消息#1。
对应的，NRF接收来自NFp的去注册请求消息#1。
其中，该去注册请求消息#1用于通知NRF该NFp不可用。
示例性的，NFp请求去注册的原因可以是NFp被销毁，或者NFp的私钥被窃取或被破坏，或者由于网络规划变更导致NFp需要在其他NRF上注册等。
S632，NRF删除NFp上下文，并将NFp的证书信息加入CRL。
也就是说，NFp在去注册之后，NFp的证书失效，NRF将其证书增加至CRL。
示例性的，NRF根据去注册请求消息对NFp进行去注册处理。例如，NRF删除NFp profile和NFp的证书信息，并标记NFp不可用。同时，NRF将NFp的证书信息(如，整数ID和针数有效期)加入 CRL中，用于指示该NFp所拥有的证书失效。
S633，NRF向NFc1发送通知消息#2。
对应的，NFc1接收来自NRF的通知消息#2。
其中，该通知消息#2用于通知NFc1该NFp已经去注册或NFp的证书已失效。
基于该实现方式，NRF通知NFc1该NFp的证书失效，使得已经进行过服务发现流程并获取了NFp信息的NFc1不会与NFp建立连接继续通信，能够提高网络效率，提升用户体验。
需要说明的是，上述去注册请求流程可参考方法300中步骤S331-S333，为了简洁，此处不再赘述。
应理解，上述以网络功能属于同一PLMN为例进行说明，即在非漫游场景下对管理证书以及通信进行描述，但本申请技术方案同样也适用于漫游场景，即NFp与NRF归属于不同的PLMN，具体实现方式可参考上述方法600以及方法400中的步骤S421-S423，为了简洁，此处不再赘述。
本申请所揭示的方法，通过在NFp注册流程中提供NFp所拥有的证书信息，以及在NFc服务发现NFp流程中增加对NFp所拥有的证书的有效性验证，防止在NFc与NFp建立TLS连接时，因NFp证书失效导致连接建立失败，降低网络效率以及用户体验。
考虑到上述方法600中的CRL存储在NRF上，在NF上维护CRL或OCSP后，攻击者可能会在CRL更新间隔期间发起攻击。因此提出以下方法700，将CRL部署在外部CRL服务器上，NRF通过与CRL服务器之间的信息交互，能够实时获取NFp证书的证书状态(是否被吊销)。
下面以NFp向NRF请求服务注册，结合NFc向NRF请求服务发现为例，通过在NFp注册流程中提供NFp所拥有的证书信息，以及在NFc服务发现流程中增加对NFp所拥有证书有效性的验证，防止在NFc与NFp建立TLS连接时因NFp证书失效导致连接建立失败，降低网络效率。
图7是本申请实施例提供的第三种通信方法700的流程示例图。如图7所示，该方法包括如下多个步骤。
S711a，NFp向NRF发送注册请求消息#a。
对应的，NRF接收来自NFp的注册请求消息#a。
其中，该注册请求消息#a中携带NFp所拥有的证书，每个NFp的证书包括证书ID和证书有效期。
S711b，NRF验证NFp的证书的有效性。
具体地，NRF对NFp的证书有效性进行验证，包括证书有效期和证书状态，以及证书的真实性(该证书是否属于该NFp)。例如，针对NFp的证书的真实性，NRF可以通过NFp公私密钥对证书的签名进行验证，确保该证书是该NFp的证书。又例如，针对NFp的证书有效期和证书状态的验证，NRF首先查看NFp的证书信息(如证书的有效期)，确定该证书是否在有效期内(即，确定证书有无超期)，然后向CRL server查询该证书是否被吊销。当NFp的证书未超期以及该证书未被吊销或吊扣时，NRF可以确定证书的有效性验证通过。
S711c，NRF将NFp所拥有的证书信息作为NFp上下文存储在NRF上。
示例性的，基于步骤S711bNFp的证书有效性验证通过后，NRF将NFp的证书信息(例如，证书ID和证书有效期)存储在NRF上。可选地，NRF也可以将NFp的所有证书的全部信息存储在NRF上。同时，基于步骤S711b的验证，NRF将NFp的每个证书的证书状态值设置为有效或无效。
示例性的，NRF可以根据本地策略对NFp的每个证书都增加一个状态值(有效/无效)，当NFp有多个证书时，判断标准为NFp的所有证书均通过验证，或是用于服务NFc1的证书通过验证，此时该NFp可以用于为NFc1服务的NFp实例。例如，当NFp的某一个证书失效时，NFp便无法通信，此时NFp的整个证书状态为无效。
需要说明的是，上述步骤S711a-S711c的具体实现方式可参考方法600中步骤S612a和S612b，为了简洁，此处不再过多赘述。
S712，NFc1向NRF发送服务发现请求消息#a。
对应的，NRF接收来自NFc1的服务发现请求消息#a。
其中，该服务发现请求消息#a用于NFc1请求发现期望的NFp实例，该服务发现请求消息#a包括期望的NFp服务名称、期望的NFp实例的NF类型和NFc1的NF类型等。
S713a，NRF向CRL服务器发送查询消息#1。
对应的，CRL服务器接收来自NRF的查询消息#1。
其中，查询消息#1用于向CRL服务器查询NFp的证书状态。
S713b，CRL服务器向NRF发送响应消息#1。
对应的，NRF接收来自CRL的响应消息#1。
其中，响应消息#1包括NFp的证书状态，例如NFp的证书状态为非吊销则说明NFp的证书有效。
S714，NRF向NFc1发送服务发现响应消息#a。
对应的，NFc1接收来自NRF的服务发现响应消息#a。
其中，该服务发现响应消息#a用于通知NFc1的服务发现请求成功，该服务发现响应消息#a包括NFp实例集合的信息，例如NFp Instance ID和NFp的NF类型等。
可选地，NFc1向NRF发送订阅请求消息#a，用于订阅NRF提供的NFp的证书状态，或者用于订阅NRF提供的NFp是否可用。
接下来，针对NFp的证书失效后如何管理证书进行示例性说明。其中，方式一是CA/RA吊销或吊扣NFp的证书，并向NRF发送证书失效指示，更新NFp的证书状态。方式二是NFp主动向NRF请求去注册，删除NFp的证书信息。
方式一：
S721，CA/RA吊销或吊扣NFp的证书。
其中，具体实现方式可参考方法600中步骤S612，为了简洁，此处不再过多赘述。
S722，CA/RA向NRF发送证书失效指示信息#a。
对应的，NRF接收来自CA/RA的证书失效指示信息#a。
其中，证书失效指示信息#a用于指示NFp的证书被吊销或吊扣，证书失效指示信息#a包括NFp的证书ID。
可选地，在步骤S722中，CA/RA也可以向NRF发送NFp的证书以及证书失效指示。
示例性的，CA/RA吊销证书后，根据预先配置的NFp所属的网络存储功能网元信息确定该NRF，并向该NRF发送证书失效指示信息#a。
其中，预先配置的NFp所属的网络存储功能网元信息可以是NFp向CA/RA请求证书时发送给CA/RA的，或者可以存储在CA/RA中，或者可以作为CA/RA颁发给NFp的证书的内容的一部分，或者可以是由网络管理网元或网络管理员预先配置在CA/RA上的，本申请对此不作具体限定。
可选地，在步骤S722中，CA/RA也可以向NRF发送NFp的证书以及证书失效指示。
S723，NRF向NFc1发送通知消息#a。
对应的，NFc1接收来自NRF的通知消息#a。
其中，该通知消息#a用于通知NFc1该NFp的证书失效。
示例性的，NRF根据证书失效指示信息#a向NFc1发送通知消息#a。
可选地，NRF基于上述步骤S714接收到来自NFc1的订阅请求消息#1，通知NFc1该NFp的证书已经被吊销或吊扣。也就是说，此时NFp的失效失效或者NFp不可用，NFc无需与NFp建立连接。
S724，NFc2向NRF发送服务发现请求消息#b。
对应的，NRF接收来自NFc2的服务发现请求消息#b。
其中，该服务发现请求消息#b用于NFc2请求发现期望的NFp实例，该服务发现请求消息#b包括期望的NFp服务名称、期望的NFp实例的NF类型和NFc2的NF类型。
S725a，NRF向CRL服务器发送查询消息#2。
对应的，CRL服务器接收来自NRF的查询消息#2。
其中，查询消息#2用于向CRL服务器查询NFp的证书状态。
S725b，CRL服务器向NRF发送响应消息#2。
对应的，NRF接收来自CRL的响应消息#2。
其中，响应消息#2包括NFp的证书状态，例如NFp的证书状态为吊销则说明NFp的证书无效。
S727，NRF向NFc2发送服务发现响应消息#b。
对应的，NFc2接收来自NRF的服务发现响应消息#b。
其中，该服务发现响应消息#b用于通知NFc2的服务发现请求失败。
需要说明的是，步骤S724-S727的具体实现方式可参考上述步骤S712-S714，为了简洁，此处不再赘述。
S728，NFp获取新证书或证书恢复后，向NRF请求更新证书信息。
其中，具体实现方式可参考上述步骤S627，以及上述步骤S711a-S711c，为了简洁，此处不再过多赘述。
方式二：
S731，NFp向NRF发送去注册请求消息#a。
对应的，NRF接收来自NFp的去注册请求消息#a。
其中，该去注册请求消息#a用于通知NRF该NFp不可用。
S732，NRF删除NFp上下文。
可选地，NRF将NFp的证书信息(例如，证书ID和证书有效期)发送给外部的CRL服务器，用于通知NFp的证书失效并更新CRL中NFp的证书状态。这与方法600中步骤S632将NFp的证书信息加入CRL是不同的，这是由于CRL的部署不同(NRF或CRL服务器)导致的。
S733，NRF向NFc1发送通知消息#b。
对应的，NFc1接收来自NRF的通知消息#b。
其中，该通知消息#b用于通知NFc1该NFp已经去注册或NFp的证书已失效。
需要说明的是，步骤S731-S733的具体实现方式可参考上述步骤S631-S633，为了简洁，此处不再赘述。
应理解，本申请技术方案同样也适用于漫游场景，即NFp与NRF归属于不同的PLMN。
本申请所揭示的方法，通过在NFp注册流程中提供NFp所拥有的证书信息，以及在NFc服务发现NFp流程中增加对NFp所拥有的证书的有效性验证，防止在NFc与NFp建立TLS连接时，因NFp证书失效导致连接建立失败，降低网络效率以及用户体验。
基于上述方法700，由CA/RA撤销或吊销NFp的证书，并向NRF发送证书失效指示。考虑到由于CRL列表更新需要一定的周期，可能存在实效性问题，例如NFp证书已经被吊销，但是CA并不是立即向NRF反馈NFp的证书状态，而是需要在下次更新时期通知NRF，若在这个时间段NFc和NFp之间进行网络建立连接，则会导致连接建立失败，进而影响网络效率。因此提出以下方法800，在建立网络连接失败后，NFc主动及时地向NRF上报NFp的证书失效指示，便于NRF为NFc提供其他NFp进行网络建立连接和提供服务，也便于NRF向其他NFc通知NFp的证书失效，避免不必要的网络建立连接失败，影响网络效率。
下面以NFp向NRF请求服务注册，结合NFc向NRF请求服务发现为例，通过在NFp注册流程中提供NFp所拥有的证书信息，以及在NFc服务发现流程中增加对NFp所拥有证书有效性的验证，防止在NFc与NFp建立TLS连接时因NFp证书失效导致连接建立失败，降低网络效率。
图8是本申请实施例提供的第四种通信方法800的流程示例图。与上述方法600或700不同之处在于，该实现方式中NFc与NRF提供的NFp建立网络连接失败后，主动向NRF上报NFp的证书失效指示。如图8所示，该方法包括如下多个步骤。
S811a，NFp向NRF发送注册请求消息#A。
对应的，NRF接收来自NFp的注册请求消息#A。
其中，该注册请求消息#A中携带NFp的证书信息，NFp的证书信息包括证书ID和证书有效期。
S811b，NRF验证NFp的证书的有效性。
示例性的，NRF对NFp的所有证书进行验证，包括证书的有效性(证书有效期和证书状态)以及证书的真实性(该证书是否属于该NFp)。
S811c，NRF将NFp所拥有的证书信息作为NFp上下文存储在NRF上。
需要说明的是，上述步骤S811a-S811c的具体实现方式可参考方法700中步骤S711a-S711c，为了简洁，此处不再过多赘述。
S812，NFc1向NRF发送服务发现请求消息#A。
对应的，NRF接收来自NFc1的服务发现请求消息#A。
其中，该服务发现请求消息#A用于NFc1请求发现期望的NFp实例，该服务发现请求消息#A包括期望的NFp服务名称、期望的NFp实例的NF类型和NFc1的NF类型等。
S813a，NRF向CRL服务器发送查询消息#A。
对应的，CRL服务器接收来自NRF的查询消息#A。
其中，查询消息#A用于向CRL服务器查询NFp的证书状态。
S813b，CRL服务器向NRF发送响应消息#A。
对应的，NRF接收来自CRL的响应消息#A。
其中，响应消息#A包括NFp的证书状态，例如NFp的证书状态为非吊销则说明NFp的证书有效。
S814，NRF向NFc1发送服务发现响应消息#A。
对应的，NFc1接收来自NRF的服务发现响应消息#A。
其中，该服务发现响应消息#A用于通知NFc1的服务发现请求成功，该服务发现响应消息#A包括NFp实例集合的信息，例如NFp Instance ID和NFp的NF类型等。
需要说明的是，步骤S812-S814的具体实现方式可参考方法700中步骤S712-S714，为了简洁，此处不再过多赘述。
S815，NFc1与NFp建立连接失败。
示例性的，基于NRF提供的NFp实例集合的信息，NFc1尝试与该NFp建立网络连接。其中，失败原因可以是NFp的证书已经被吊销或已经失效。例如，由于NFp的证书有效期过期，或者网络维护，或者NFp的私钥泄露等，导致NFp的证书被吊销或失效，使得NFc1与NFp建立连接失败。
S816，NFc1向NRF发送证书失效指示信息#A。
对应的，NRF接收来自NFc1的证书失效指示信息#A。
其中，证书失效指示信息#A用于指示NFp的证书被吊销或失效，证书失效指示信息#A包括NFp ID、证书ID，或者证书类型。
可选地，在步骤S816中NFc1可以直接向NRF发送NFp的证书和失效指示。
S817，NRF根据证书失效指示信息#A发送通知消息#A。
示例性的，NRF向CRL服务器查询NFp的证书状态，以确定NFp的证书是否被吊销。当确认NFp的证书被吊销后，向其他NFc(例如NFc3)发送通知消息#A，避免NFc3后续与NFp建立网络连接或者提供服务时交互失败，进而影响网络效率。。
S818，NFc2向NRF发送服务发现请求消息#B。
对应的，NRF接收来自NFc2的服务发现请求消息#B。
其中，该服务发现请求消息#B用于NFc2请求发现期望的NFp实例，该服务发现请求消息#B包括期望的NFp服务名称、期望的NFp实例的NF类型和NFc2的NF类型。
S819a，NRF向CRL服务器发送查询消息#B。
对应的，CRL服务器接收来自NRF的查询消息#B。
其中，查询消息#A用于向CRL服务器查询NFp的证书状态。
S819b，CRL服务器向NRF发送响应消息#B。
对应的，NRF接收来自CRL的响应消息#B。
其中，响应消息#B包括NFp的证书状态，例如NFp的证书状态为吊销则说明NFp的证书无效。
S820，NRF向NFc2发送服务发现响应消息#B。
对应的，NFc2接收来自NRF的服务发现响应消息#B。
其中，该服务发现响应消息#B用于通知NFc2的服务发现请求失败。
需要说明的是，步骤S818-S820的具体实现方式可参考上述步骤S812-S814，为了简洁，此处不再赘述。
可选地，基于步骤S816的证书失效指示信息#A，上述步骤S819a-S819b可以删除。
S821，NFp获取新证书或证书恢复后，向NRF请求更新证书信息。
其中，具体实现方式可参考方法700中步骤S728，为了简洁，此处不再赘述。
应理解，本申请技术方案同样也适用于漫游场景，即NFp与NRF归属于不同的PLMN。
本申请所揭示的方法，通过在NFp注册流程中提供NFp所拥有的证书信息，以及在NFc服务发现流程中增加对NFp所拥有的证书有效性的验证，防止在NFc与NFp建立TLS连接时因NFp证书失效导致连接建立失败，能够提高网络效率。
考虑到上述方法600-800中，通过在NFp注册流程中提供NFp所拥有的证书信息，以及在NFc服务发现流程中增加对NFp所拥有的证书有效性的验证，改动当前网络功能的逻辑和交互流程，提高复杂度。因此提出以下方法900，基于当前技术在NFc与NFp之间连接建立失败的情况，重新向NRF请求服务发现，并上报建立失败的NFp信息以及建立失败的原因。相对来说，该实现方式能够简化NRF 的逻辑，尽量避免对现有标准化系统、流程和网络功能(例如NRF或NFp)的改动。
下面以NFp向NRF请求服务注册，结合NFc向NRF请求服务发现为例，通过在NFp注册流程中提供NFp所拥有的证书信息，以及在NFc服务发现流程中增加对NFp所拥有证书有效性的验证，防止在NFc与NFp建立TLS连接时因NFp证书失效导致连接建立失败，降低网络效率。
图9是本申请实施例提供的第五种通信方法900的流程示例图。如图9所示，该方法包括如下多个步骤。
S911，NFc1向NRF发送服务发现请求消息#α。
对应的，NRF接收来自NFc1的服务发现请求消息#α。
其中，该服务发现请求消息#α用于NFc1请求发现期望的NFp实例，该服务发现请求消息#B包括期望的NFp服务名称、期望的NFp实例的NF类型和NFc2的NF类型。
S912，NRF授权并确定NFp实例集合。
S913，NRF向NFc1发送服务发现响应消息#B。
对应的，NFc1接收来自NRF的服务发现响应消息#B。
其中，该服务发现响应消息#B包括NFp实例集合的信息，例如NFp profile。
需要说明的是，步骤S911-S913的具体实现方式可参考方法400中步骤S411-S413，为了简洁，此处不再赘述。
S914，NFc1与NFp建立连接失败。
示例性的，基于NRF提供的NFp实例集合的信息，NFc1尝试与该NFp建立网络连接。其中，失败原因可以是NFp的证书已经被吊销或已经失效。例如，由于NFp的证书过期，或者NFp路由失败，或者网络维护，或者NFp的私钥泄露等导致NFc1与NFp建立连接失败。
示例性的，NFc在于NFp建立连接失败后，可以查询CRL确定该NFp的证书状态为吊销，或者该NFp的证书已经超期等。
S915，NFc1向NRF发送服务发现请求消息#β。
对应的，NRF接收来自NFc1的服务发现请求消息#β。
其中，服务发现请求消息#β包括连接失败的NFp的信息，例如NFp ID和失败原因。
示例性的，在步骤S914中，NFc与NRF提供的NFp实例集合中的一个或多个NFp建立连接全部失败，那么NFc向NRF继续请求服务发现NFp，并在服务发现请求消息#β中携带建立连接失败的NFp ID和失败原因。
S916，NRF授权并确定其他NFp实例集合。
示例性的，NRF根据服务发现请求消息#β继续为NFc搜索除了已经建立连接失败的NFp之外的符合要求的其他NFp。其中，NRF搜索NFp的具体实现方式可参考上述方法400中步骤S412，为了简洁，此处不再赘述。
S917，NRF向NFc1发送服务发现响应消息#β。
对应的，NFc1接收来自NRF的服务发现响应消息#β。
其中，该服务发现响应消息#β包括其他NFp实例集合的信息，例如其他NFp profile。
应理解，基于NRF为NFc1重新提供的其他NFp，NFc与其他NFp建立连接成功。
需要说明的是，步骤S915-S917的具体实现方式可参考上述步骤S911-S917，为了简洁，此处不再赘述。
应理解，本申请技术方案同样也适用于漫游场景，即NFp与NRF归属于不同的PLMN。
本申请所揭示的方法，通过在NFp注册流程中提供NFp所拥有的证书信息，以及在NFc服务发现流程中增加对NFp所拥有的证书有效性的验证，防止在NFc与NFp建立TLS连接时因NFp证书失效导致连接建立失败，能够提高网络效率。
上文结合图1至图9，详细描述了本申请的通信方法侧实施例，下面将结合图10和图11，详细描述本申请的装置侧实施例。应理解，装置实施例的描述与方法实施例的描述相互对应，因此，未详细描述的部分可以参见前面方法实施例。
图10是本申请实施例提供的装置的示意性框图。如图10所示，该装置1000可以包括收发单元1010和处理单元1020。收发单元1010可以与外部进行通信，处理单元1020用于进行数据处理。收发单元1010还可以称为通信接口或收发单元。
在一种可能的设计中，该装置1000可实现对应于上文方法实施例中的服务发现功能网元(例如NRF)执行的步骤或者流程，其中，处理单元1020用于执行上文方法实施例中服务发现功能网元的处理相关的操作，收发单元1010用于执行上文方法实施例中服务发现功能网元的收发相关的操作。
在另一种可能的设计中，该装置1000可实现对应于上文方法实施例中的第二网络功能网元(例如NFc)执行的步骤或者流程，其中，收发单元1010用于执行上文方法实施例中第二网络功能网元的收发相关的操作，处理单元1020用于执行上文方法实施例中第二网络功能网元的处理相关的操作。
在又一种可能的设计中，该装置1000可实现对应于上文方法实施例中的证书颁发网元(例如CA/RA)执行的步骤或者流程，其中，处理单元1020用于执行上文方法实施例中证书颁发网元的处理相关的操作，收发单元1010用于执行上文方法实施例中证书颁发网元的收发相关的操作。
在又一种可能的设计中，该装置1000可实现对应于上文方法实施例中的第一网络功能网元(例如NFp)执行的步骤或者流程，其中，收发单元1010用于执行上文方法实施例中第一网络功能网元的收发相关的操作，处理单元1020用于执行上文方法实施例中第一网络功能网元的处理相关的操作。
应理解，这里的装置1000以功能单元的形式体现。这里的术语“单元”可以指应用特有集成电路(application specific integrated circuit，ASIC)、电子电路、用于执行一个或多个软件或固件程序的处理器(例如，共享处理器、专有处理器或组处理器等)和存储器、合并逻辑电路和/或其它支持所描述的功能的合适组件。在一个可选例子中，本领域技术人员可以理解，装置1000可以具体为上述实施例中的发送端，可以用于执行上述方法实施例中与发送端对应的各个流程和/或步骤，或者，装置1000可以具体为上述实施例中的接收端，可以用于执行上述方法实施例中与接收端对应的各个流程和/或步骤，为避免重复，在此不再赘述。
上述各个方案的装置1000具有实现上述方法中发送端所执行的相应步骤的功能，或者，上述各个方案的装置1000具有实现上述方法中接收端所执行的相应步骤的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块；例如收发单元可以由收发机替代(例如，收发单元中的发送单元可以由发送机替代，收发单元中的接收单元可以由接收机替代)，其它单元，如处理单元等可以由处理器替代，分别执行各个方法实施例中的收发操作以及相关的处理操作。
此外，上述收发单元还可以是收发电路(例如可以包括接收电路和发送电路)，处理单元可以是处理电路。在本申请的实施例，图10中的装置可以是前述实施例中的接收端或发送端，也可以是芯片或者芯片系统，例如：片上系统(system on chip，SoC)。其中，收发单元可以是输入输出电路、通信接口。处理单元为该芯片上集成的处理器或者微处理器或者集成电路，对此不作限定。
图11示出了本申请实施例提供的装置2000。如图11所示，该装置2000包括处理器2010和收发器2020。其中，处理器2010和收发器2020通过内部连接通路互相通信，该处理器2010用于执行指令，以控制该收发器2020发送信号和/或接收信号。
可选地，该装置2000还可以包括存储器2030，该存储器2030与处理器2010、收发器2020通过内部连接通路互相通信。该存储器2030用于存储指令，该处理器2010可以执行该存储器2030中存储的指令。
在一种可能的实现方式中，装置2000用于实现上述方法实施例中的服务发现功能网元(例如NRF)对应的各个流程和步骤。
在另一种可能的实现方式中，装置2000用于实现上述方法实施例中的第一网络功能网元(例如，NFp)对应的各个流程和步骤。
在又一种可能的实现方式中，装置2000用于实现上述方法实施例中的第二网络功能网元(例如，NFc)对应的各个流程和步骤。
在又一种可能的实现方式中，装置2000用于实现上述方法实施例中的证书颁发网元(例如，CA/RA)对应的各个流程和步骤。
应理解，装置2000可以具体为上述实施例中的发送端或接收端，也可以是芯片或者芯片系统。对应的，该收发器2020可以是该芯片的收发电路，对此不作限定。具体地，该装置2000可以用于执行上述方法实施例中与发送端或接收端对应的各个步骤和/或流程。
可选地，该存储器2030可以包括只读存储器和随机存取存储器，并向处理器提供指令和数据。存储器的一部分还可以包括非易失性随机存取存储器。例如，存储器还可以存储设备类型的信息。该处 理器2010可以用于执行存储器中存储的指令，并且当该处理器2010执行存储器中存储的指令时，该处理器2010用于执行上述与发送端或接收端对应的方法实施例的各个步骤和/或流程。
图12是本申请实施例提供的一种通信方法的流程示意图。如图12所示，包括如下步骤：
S210.CA/RA向第一网元发送证书吊销通知消息。
作为实现方式的一种，证书吊销通知消息包含网络功能网元NF的标识信息和指示该网络功能网元所属证书的证书状态的指示信息。
作为实现方式的另一种，证书吊销通知消息包含NF的标识信息和NF所述证书的证书状态。
其中，网络功能网元所属证书的证书状态指NF所属的一个或多个证书的状态或者NF所属的证书集合的证书状态。证书状态指该证书失效或者有效。
可选的，证书失效还包括证书吊销或吊扣两种失效状态。
S220.第一网元根据NF所属证书的证书失效状态，确定该NF的配置方式。
在NF所属证书的证书状态为失效的情况下，第一网元确定该NF执行以下配置方式中的一种：配置该NF为去注册，或者标识该NF为失效。
其中，第一网元为NRF或证书管理网元。可以理解的，第一网元也可以为NRF和证书管理网元的集成。
S230.第一网元向OAM发送通知消息#1。
相应的，OAM接收来自第一网元的通知消息#1。
其中，通知消息#1用于将第一网元确定的NF的配置方式发送至OAM。
作为实现方式的一种，通知消息#1包含指示NF的配置方式的指示信息#1。示例的，该指示信息#1可以指示证书状态为吊销或吊扣。
下面对图12实施例中两种实现方式分别进行详细的描述。
图13是本申请实施例提供的一种通信方法的流程示意图。如图13所示，具体包括如下多个步骤：
S221.NF1向NRF发送注册请求消息#2。
对应的，NRF接收来自NF1的注册请求消息#2。其中，NF1为网络功能服务消费网元。
其中，该注册请求消息#2中携带NF1所拥有的证书，NF1的每个证书包括证书ID和证书有效期。例如，证书有效期可以是证书的签发时刻和有效时长，也可以是证书的有效截止时间等。
可选地，NFp的证书还包括签发证书的CA ID、证书的签名、证书持有者ID，或者证书持有者公钥等。
需要说明的是，该注册请求消息#2包括NF1所拥有的所有证书，本申请对NF1的证书数量不作限定。例如，NF1的证书数量取决于不同级别的CA签发，或者业务类型等。
S222.NRF确定NF1可用。
NRF接收来自NF1的注册请求消息#2，NF1注册成功后，NRF验证NF1的配置信息通过后，NRF确定NF1可用。
S223.NRF向证书管理网元发送注册请求消息#3。
相应的，证书管理网元接收注册请求消息#3。
注册请求消息#3携带NF1的标识信息。该标识信息可以是NF ID(身份Identity或识别符Identifier)，或者NF的实例标识(NF Instance ID)。
可选的，注册请求消息#3还携带NF1所对应的NRF的标识信息。该NRF的标识信息可以是NRF的实例ID
S224.证书管理网元存储NF和NRF的对应关系。
证书管理网元根据注册请求消息#3存储NF1与NRF的对应关系。示例的，网络功能网元与NRF为一一对应的关系。
在一种实现方式中，注册请求消息#3携带NF instance ID和NRF的标识，证书管理网元接收到注册请求消息#3后，存储其携带的NF instance ID和NRF ID。
证书管理网元可接收来自多个NF的注册请求消息，各个注册请求消息分别携带各自的NF instance ID和NRF。
在一种实现方式中，证书管理网元中还存储证书ID和其对应的证书的用途，这些对应关系可以由CA/RA在证书颁发之后配置在证书管理网元中，也可以在NF注册成功后由NRF配置在证书管理网元 中，也可以预配置在证书管理网元中。证书管理网元可以通过证书ID与证书用途的对应关系，确定被吊销证书的用途。
S225.CA/RA向证书管理网元发送证书吊销通知消息。
相应的，证书管理网元接收该证书失效通知消息。
该证书吊销通知消息用于通知证书管理网元证书失效。
该证书吊销通知消息包含NF instance ID，证书状态。其中，NF instance ID为服务于证书的NF的标识，证书状态为证书吊销状态或吊扣状态中的一种。
可选的，该证书失效通知还包括服务名称或证书ID。
其中，证书ID用于标识证书，不同证书ID所标识的证书具有不同的用途。
其中，服务名称用于标识证书对应的服务。示例的，服务为Namf_Communication，则服务名称用于标识与证书关联的服务。可以理解的，每个服务都对应一个证书。在一种实现方式中，证书失效通知包括服务名称。
NF可能会拥有多个证书，其中不同证书的作用是不同的，有专用于建立TLS连接的证书，有专用于对客户端凭证申明(Client Credentials Assertion，CCA)进行签名的证书，也有专用于某个切片或某个服务的证书。
例如，NF1为AMF，AMF可以服务于一个网络切片S-NSSAI#1，AMF会向CA/RA获取用于该网络切片的证书，当UE向AMF请求在该网络切片S-NSSAI#1中注册时，AMF会向该网络切片发起网络切片认证流程，此时服务请求中需要携带专用于S-NSSAI#1的证书，NSSAA会认证证书#4，确定AMF可以服务于此网络切片。另外AMF也可以获取专用于某个服务的证书，比如AMF可以向UDM请求UE的签约信息，此时AMF可以在请求中携带专用于请求签约信息服务的证书2，UDM认证证书2成功后，确定AMF可以获取签约信息；再比如，AMF可以向NSSAAF请求对网络切片进行重认证，此时请求消息中携带专用于此服务的证书3，NSSAAF认证证书3成功后，确定AMF可以发起网络切片重认证服务。
另一种实现方法中，CA/RA可以不携带服务名称，而携带证书ID，证书ID用于指示证书管理网元中被撤销的证书，证书管理网元中存储证书ID和其对应的证书的用途，这些对应关系可以由CA/RA在证书颁发之后配置在证书管理网元中，也可以在NF注册成功后由NRF配置在证书管理网元中，也可以预配置在证书管理网元中。证书管理网元可以通过证书ID与该证书的对应关系，确定被吊销证书的用途。
可见，证书吊销通知消息携带的证书ID或服务名称，可从服务粒度标识证书，获取服务粒度的证书状态。
S226.证书管理网元确定服务于证书对应的NF的NRF。
证书管理网元根据存储的NF instance ID与NRF的对应关系确定NF所对应的NRF。
证书管理网元根据接收的吊销通知消息获得NF instance ID，根据NF instanceID确定该NF所对应的NRF。
S227.证书管理网元向该NRF发送请求消息#1.
该请求消息#1包含用于指示证书状态的指示信息。其中，证书状态为证书有效状态或证书失效状态。证书失效状态为证书吊销状态或证书吊扣状态中的一种。
在一种实现方式中，请求消息#1还包括NF instance ID和服务名称。
在另一种实现方式中，请求消息#1还包括NF instance ID和证书ID。
S228.NRF根据证书状态确定服务于证书的NF网元的处理方式。
NRF接收来自证书管理网元的请求消息#1，根据该请求消息#1携带的证书状态确定服务于该证书的NF网元的处理方式。在指示信息指示证书状态为失效状态时，NRF确定执行以下处理方式中的一种：配置NF1为去注册，或，标识NF1或NF1对应的服务为失效。
以下结合具体实现示例性说明可能的几种实现方案：
第一种实现方案：
请求消息#1包括：NF instance ID#1和指示信息#1。其中，指示信息#1指示证书处于失效状态，NRF根据NF instance ID和指示信息#1确定该NF instance ID对应的证书处于失效状态。
作为实现方式的一种，NRF确定NF instance ID对应的证书处于失效状态后，将该NF设置为不可 达或失效。这样，当NF consumer进行NF discovery流程时，NRF接收来自NF consumer的discovery请求时，NRF不会将该NF推荐给NF consumer。NF consumer不会与NF建立连接，继续通信，能够提高网络效率，提升用户体验。
示例的，指示信息#1为状态参数，当状态参数为1时，表示该证书为有效，当状态参数为0时，表示该证书失效。再例如，当状态参数为00时，表示该证书失效状态为吊扣。当状态参数为01时，表示该证书失效状态为吊销。可以理解的，这里仅为示例性说明，本申请对此不做限制。
作为实现方式的另一种，NRF确定NF instance ID对应的证书处于失效状态后，例如，证书处于吊销状态，NRF将该NF设置为去注册，即删除NRF中该NF对应的证书。这样，NF将不会被NF consumer搜索到。
第二种实现方案：
请求消息#1包括：NF instance ID#2、指示信息#2和服务名称。其中，NF instance ID#2用于标识NF#2，指示信息#2用于指示NF#2中的证书失效，服务名称用于标识NF#2中被禁用的服务。
若通知消息#1中携带服务名称，NRF根据服务名称确定禁用NF1的服务，示例的，服务名称指示被吊销的证书用于S-NSSAI#1，那么NRF会将NF1的状态设置为S-NSSAI#1失效，当NF consumer搜索能够服务S-NSSAI#1的NF时，NRF将不会把NF1推荐给NF consumer。示例的，当服务名称指示被吊销证书用于某个服务时，NRF将NF1的状态设置为该服务名称指示的该服务不可用。
这样，可以从更细的粒度对失效证书所对应的服务设置不可用，提升网络通信效率和灵活性。
第三种实现方案：
请求消息#1包括：NF instance ID#3、指示信息#3和证书ID。其中，NF instance ID#3用于标识NF#3，证书ID用于标识NF#3中的证书。指示信息#3用于指示NF#3中的与证书ID对应的证书失效。
S229a.NRF向证书管理网元发送响应于请求消息#1的响应消息#2。
该响应消息#2携带第一指示信息。该第一指示信息用于指示步骤228中NRF确定的服务于证书的NF网元的配置方式。
S130a.NRF向OAM发送通知消息#2。
第一消息#2包含指NF instance ID和用于指示NRF确定的处理方式的指示信息#2。其中指示信息#2指示配置NF1为去注册或标识NF1为失效。
可以理解的，作为上述步骤S229a和S230a的替代方案，在步骤S228之后，可选的，执行步骤S229b。
S229b.NRF向OAM发送通知消息#1。
通知消息#1包含的信息参见通知消息#2，在此不再赘述。
S230.OAM根据通知消息确定对NF1的处理方式。
在一种实现方式中，若通知消息#1携带的指示信息指示NF1为去注册，则OAM将NF1销毁或向NF1发起远程度量流程。
其中，远程度量流程可以度量NF1的硬件和软件信息，判断NF1的安全性和完整性，远程度量完成后，NF1会获得度量凭证，NF1可以通过度量凭证向CA/RA重新申请证书。
在另一种可能的实现方式中，若通知消息#1携带的指示信息指示标识NF1失效，则OAM向NF1发起远程度量流程以获取度量凭证，根据该度量凭证向CA/RA重新申请证书。
可以理解的，如果证书状态为吊扣状态，那么当证书恢复时，CA/RA会向证书管理网元发送证书恢复通知，该证书恢复通知中包含NF instance ID，以及证书ID或服务名称。证书管理网元收到后向NRF发送NF instance ID，以及服务名称或证书ID，NRF收到该证书恢复通知消息后将NF1状态设置为有效或可达。
图14是本申请实施例提供的一种通信方法的流程示意图。如图14所示，包括如下步骤：
S231.CA/RA向证书管理网元发送证书吊销通知消息#3。
相应的，证书管理网元接收证书吊销通知消息#3。证书吊销通知消息#3包含NF1的标识信息和NF1所属证书的证书状态。
该步骤的具体实现参见步骤S221，在此不再赘述。
S232.证书管理网元向NRF/OAM发送请求消息#3。
证书管理网元根据接收到的NF1的标识信息和证书状态确定是否发送请求消息#3。
在NF1所属证书的证书状态为吊销的情况下，证书管理网元向NRF或OAM发送请求消息#3。请求消息#3携带NF1的标识信息和路由指示信息，其中，路由指示信息用于指示请求与NF1通信的其它NF的信息。
S233.NRF/OAM获取与NF1通信的其它NF的信息。
作为实现方式的一种，若网络中没有部署NRF，则证书管理网元向OAM发送请求消息#3，OAM根据存储的与NF1关联的记录log，确定与NF1通信的NFc的信息。
作为实现方式的另一种，若网络中部署NRF，则NRF根据存储的记录，例如，服务发现请求的李璐，确定与NF1通信的NFc的信息。
S234.NRF/OAM向证书管理网元发送响应于请求消息#3的响应消息#3。
响应消息#3用于将步骤S233获取的与NF1通信的NFc的信息发送给证书管理网元。响应消息#3携带与NF1通信的NFc的信息以及指示NF1所属证书的失效的指示信息。
相应的，证书管理网元接收到来自NRF或OAM的响应消息#3。
可以理解的，与NF1通信的NFc可以为一个或者多个。
S235.证书管理网元向与NF1通信的NFc发送通知消息#4。
通知消息#4用于通知与NF1通信的NFc，该NF1所属证书的证书失效。
该通知消息#4携带与NF1通信的NFc的信息，以及NF1所属证书的证书状态。
可以理解的，图14中其它NF表示与NF1通信的一个或多个NF。
由此该一个或多个NF知晓NF1的证书失效后，不再与该NF1继续通信，能够提高网络效率，提升用户体验。
S236.在证书状态为吊扣状态的情况下，CA/RA向证书管理网元发送证书恢复通知消息#4。
在证书状态为吊扣状态的情况下，待NF1所属的证书恢复后，触发CA/RA向证书管理网元发送证书恢复通知消息#4，用于通知证书管理网元该NF1所属的证书已恢复。
S237.证书管理网元向其它NF发送通知消息#5。
相应的，证书管理网元通过通知消息#5通知其他NF，该NF1所属的证书已恢复。由此，与NF1通信的其它NF可再次与NF1通信。
在实现过程中，上述方法的各步骤可以通过处理器中的硬件的集成逻辑电路或者软件形式的指令完成。结合本申请实施例公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器，处理器读取存储器中的信息，结合其硬件完成上述方法的步骤。为避免重复，这里不再详细描述。
应注意，本申请实施例中的处理器可以是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法实施例的各步骤可以通过处理器中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器可以是通用处理器、数字信号处理器、专用集成电路、现场可编程门阵列或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。本申请实施例中的处理器可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本申请实施例公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器，处理器读取存储器中的信息，结合其硬件完成上述方法的步骤。
可以理解，本申请实施例中的存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(dynamic RAM，DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和 直接内存总线随机存取存储器(direct rambus RAM，DR RAM)。应注意，本文描述的系统和方法的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
根据本申请实施例提供的方法，本申请还提供一种计算机程序产品，该计算机程序产品包括：计算机程序代码，当该计算机程序代码在计算机上运行时，使得该计算机执行上述所示实施例中的方法。
根据本申请实施例提供的方法，本申请还提供一种计算机可读介质，该计算机可读介质存储有程序代码，当该程序代码在计算机上运行时，使得该计算机执行上述所示实施例中的方法。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器、随机存取存储器、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (37)

  1. 一种通信方法，其特征在于，包括：
    服务发现功能网元接收服务发现请求消息，所述服务发现请求消息用于请求所述服务发现功能网元提供第一类型的网络功能网元；
    在确定所述第一类型的第一网络功能网元的第一证书有效的情况下，所述服务发现功能网元发送包括所述第一网络功能网元的标识信息的服务发现响应消息。
  2. 根据权利要求1所述的方法，其特征在于，所述确定所述第一类型的第一网络功能网元的第一证书有效，包括：
    所述服务发现功能网元根据所述第一证书的有效期确定所述第一证书未过期；以及
    所述服务发现功能网元确定所述第一证书未被吊销。
  3. 根据权利要求2所述的方法，其特征在于，所述服务发现功能网元确定所述第一证书未被吊销，包括：
    所述服务发现功能网元本地查询证书撤销列表；
    在所述第一证书不属于所述证书撤销列表的情况下，所述服务发现功能网元确定所述第一证书未被吊销。
  4. 根据权利要求2所述的方法，其特征在于，所述服务发现功能网元确定所述第一证书未被吊销，包括：
    所述服务发现功能网元向服务器发送询问请求消息，所述询问请求消息用于查询所述第一证书是否被吊销；
    所述服务发现功能网元接收来自所述服务器的询问响应消息，所述询问响应消息包括所述第一证书未被吊销的指示；
    所述服务发现功能网元根据所述指示确定所述第一证书未被吊销。
  5. 根据权利要求1至4中任一项所述的方法，其特征在于，所述方法还包括：
    所述服务发现功能网元接收注册请求消息，所述注册请求消息用于请求将所述第一网络功能网元注册到所述服务发现功能网元上，所述注册请求消息包括所述第一证书，所述第一证书包括所述第一证书的标识信息和所述第一证书的有效期；
    或者，
    所述服务发现功能网元接收连接建立请求消息，所述连接建立请求消息用于请求所述第一网络功能网元与所述服务发现功能网元建立连接，所述连接建立请求消息包括所述第一证书，所述第一证书包括所述第一证书的标识信息和所述第一证书的有效期。
  6. 根据权利要求5所述的方法，其特征在于，所述方法还包括：
    在确定所述第一证书有效的情况下，所述服务发现功能网元存储所述第一证书；或者，
    在确定所述第一证书有效的情况下，所述服务发现功能网元存储所述第一证书的标识信息和所述第一证书的有效期。
  7. 根据权利要求6所述的方法，其特征在于，所述确定所述第一证书有效，包括：
    所述服务发现功能网元根据所述第一网络功能网元的公钥和证书颁发网元的公钥确定所述第一证书是所述证书颁发网元为所述第一网络功能网元签发的证书；
    所述服务发现功能网元根据所述第一证书的有效期确定所述第一证书未过期；以及
    所述服务发现功能网元确定所述第一证书未被吊销。
  8. 根据权利要求1至7中任一项所述的方法，其特征在于，在所述服务发现功能网元发送包括所述第一网络功能网元的标识信息的服务发现响应消息之后，所述方法还包括：
    所述服务发现功能网元接收指示信息，所述指示信息用于指示所述第一证书被吊销，所述指示信息包括所述第一证书的标识信息；
    所述服务发现功能网元发送通知消息，所述通知消息用于通知所述第一网络功能网元的第一证书被吊销。
  9. 根据权利要求8所述的方法，其特征在于，所述方法还包括：
    所述服务发现功能网元接收订阅请求消息，所述订阅请求消息用于向所述服务发现功能网元请求订阅所述第一证书的状态。
  10. 根据权利要求8或9所述的方法，其特征在于，所述服务发现功能网元接收指示信息，包括：
    所述服务发现功能网元接收来自证书颁发网元的所述指示信息；
    其中，所述方法还包括：
    所述服务发现功能网元根据所述指示信息将所述第一证书增加至证书撤销列表。
  11. 根据权利要求1至10中任一项所述的方法，其特征在于，在所述服务发现功能网元发送包括所述第一网络功能网元的标识信息的服务发现响应消息之后，所述方法还包括：
    所述服务发现功能网元接收来自所述第一网络功能网元的去注册请求消息；
    所述服务发现功能网元发送通知消息，所述通知消息用于通知所述第一网络功能网元的第一证书无效。
  12. 根据权利要求1至11中任一项所述的方法，其特征在于，所述方法还包括：
    在确定所述第一类型的第三网络功能网元的第一证书无效的情况下，所述服务发现功能网元发送不包括所述第三网络功能网元的标识信息的所述服务发现响应消息。
  13. 一种通信装置，其特征在于，包括：
    收发单元，用于接收服务发现请求消息，所述服务发现请求消息用于请求所述服务发现功能网元提供第一类型的网络功能网元；
    在处理单元确定所述第一类型的第一网络功能网元的第一证书有效的情况下，所述收发单元，还用于发送包括所述第一网络功能网元的标识信息的服务发现响应消息。
  14. 根据权利要求13所述的装置，其特征在于，
    所述处理单元，还用于根据所述第一证书的有效期确定所述第一证书未过期；以及确定所述第一证书未被吊销。
  15. 根据权利要求14所述的装置，其特征在于，
    所述处理单元，还用于本地查询证书撤销列表；
    在所述第一证书不属于所述证书撤销列表的情况下，所述处理单元，还用于确定所述第一证书未被吊销。
  16. 根据权利要求14所述的装置，其特征在于，
    所述收发单元，还用于向服务器发送询问请求消息，所述询问请求消息用于查询所述第一证书是否被吊销；
    所述收发单元，还用于接收来自所述服务器的询问响应消息，所述询问响应消息包括所述第一证书未被吊销的指示；
    所述处理单元，还用于根据所述指示确定所述第一证书未被吊销。
  17. 根据权利要求13至16中任一项所述的装置，其特征在于，
    所述收发单元，还用于接收注册请求消息，所述注册请求消息用于请求将所述第一网络功能网元注册到所述服务发现功能网元上，所述注册请求消息包括所述第一证书，所述第一证书包括所述第一证书的标识信息和所述第一证书的有效期；
    或者，
    所述收发单元，还用于接收连接建立请求消息，所述连接建立请求消息用于请求所述第一网络功能网元与所述服务发现功能网元建立连接，所述连接建立请求消息包括所述第一证书，所述第一证书包括所述第一证书的标识信息和所述第一证书的有效期。
  18. 根据权利要求17所述的装置，其特征在于，
    在确定所述第一证书有效的情况下，所述处理单元，还用于存储所述第一证书；或者，
    在确定所述第一证书有效的情况下，所述处理单元，还用于存储所述第一证书的标识信息和所述第一证书的有效期。
  19. 根据权利要求18所述的装置，其特征在于，所述处理单元，还用于：
    根据所述第一网络功能网元的公钥和证书颁发网元的公钥确定所述第一证书是所述证书颁发网元为所述第一网络功能网元签发的证书；
    根据所述第一证书的有效期确定所述第一证书未过期；以及
    确定所述第一证书未被吊销。
  20. 根据权利要求13至19中任一项所述的装置，其特征在于，
    所述收发单元，还用于接收指示信息，所述指示信息用于指示所述第一证书被吊销，所述指示信息包括所述第一证书的标识信息；
    所述收发单元，还用于发送通知消息，所述通知消息用于通知所述第一网络功能网元的第一证书被吊 销。
  21. 根据权利要求20所述的装置，其特征在于，
    所述收发单元，还用于接收订阅请求消息，所述订阅请求消息用于向所述服务发现功能网元请求订阅所述第一证书的状态。
  22. 根据权利要求20或21所述的方法，其特征在于，
    所述收发单元，还用于接收来自证书颁发网元的所述指示信息；
    所述处理单元，还用于根据所述指示信息将所述第一证书增加至证书撤销列表。
  23. 根据权利要求13至22中任一项所述的装置，其特征在于，
    所述收发单元，还用于接收来自所述第一网络功能网元的去注册请求消息；
    所述收发单元，还用于发送通知消息，所述通知消息用于通知所述第一网络功能网元的第一证书无效。
  24. 根据权利要求13至23中任一项所述的装置，其特征在于，
    在所述处理单元确定所述第一类型的第三网络功能网元的第一证书无效的情况下，所述收发单元，还用于发送不包括所述第三网络功能网元的标识信息的所述服务发现响应消息。
  25. 一种通信方法，其特征在于，包括：
    第一网元获取网络功能网元所属证书的证书状态；
    在所述证书状态为证书失效的情况下，所述第一网元确定所述网络功能网元的配置方式，其中所述配置方式为以下方式的一种：配置所述网络功能网元为去注册，或，标识所述网络功能网元为失效。
  26. 根据权利要求25所述的通信方法，其特征在于，
    所述第一网元通过证书吊销通知消息获取所述网络功能网元所属证书的证书状态，其中，所述证书吊销通知消息包含用于指示所述证书状态的指示信息，或所述证书状态。
  27. 根据权利要求26所述的通信方法，其特征在于，
    所述第一网元获取网络功能网元所属证书的证书状态包括：
    所述第一网元接收来自证书颁发网元的所述证书吊销通知消息，所述证书吊销通知消息还包含网络功能网元标识，其中，所述网络功能网元标识用于标识所述证书所对应的网络功能网元；
    在所述证书状态为证书失效的情况下，所述第一网元确定所述网络功能网元的配置方式，包括：
    所述第一网元根据所述网络功能网元标识配置所述网络功能网元为去注册或标识所述网络功能网元为失效。
  28. 根据权利要求26所述的通信方法，其特征在于，
    所述第一网元获取网络功能网元所属证书的证书状态包括：
    所述第一网元接收来自证书颁发网元的所述证书吊销通知消息，所述证书吊销通知消息还包含服务名称，所述服务名称用于标识所述证书对应的服务；
    在所述证书状态为证书失效的情况下，所述第一网元标识所述网络功能网元为失效，包括：
    在所述证书状态为证书失效的情况下，所述第一网元根据所述服务名称来标识所述网络功能网元所对应的服务为失效。
  29. 根据权利要求26所述的通信方法，其特征在于，所述证书吊销通知消息还包括证书标识，所述证书标识用于标识所述证书；
    在所述证书状态为证书失效的情况下，所述第一网元标识所述网络功能网元为失效，包括：
    在所述证书状态为证书失效的情况下，所述第一网元根据所述证书标识来标识所述功能服务网元所对应的证书为失效。
  30. 根据权利要求25-29任意一项所述的通信方法，其特征在于，
    所述证书失效状态为吊销或吊扣中的一种。
  31. 根据权利要求25-29任意一项所述的通信方法，其特征在于，所述方法还包括：
    所述第一网元向操作、管理和维护OAM发送所述第一网元确定的所述配置方式。
  32. 根据权利要求25-29任意一项所述的通信方法，其特征在于，
    所述第一网元为服务发现功能网元或证书管理网元。
  33. 一种通信装置，其特征在于，包括：
    用于实现权利要求1至12或权利要求25至32中任一项所述的方法的单元。
  34. 一种通信装置，其特征在于，包括：处理器，所述处理器与存储器耦合；所述处理器，用于执行所述存储器中存储的计算机程序，以使得所述装置执行如权利要求1至12或权利要求25至32中任一项 所述的方法。
  35. 一种芯片，其特征在于，包括：处理器，用于从存储器中调用并运行计算机程序，使得安装有所述芯片的网元设备执行如权利要求1至12或权利要求25至32中任一项所述的方法。
  36. 一种计算机程序，其特征在于，所述计算机程序被网元设备执行时，实现如权利要求1至12或权利要求25至32中任一项所述的方法。
  37. 一种计算机可读存储介质，其特征在于，包括：所述计算机可读存储介质上存储有计算机程序，当所述计算机程序在计算机上运行时，使得所述计算机执行如权利要求1至12或权利要求25至32中任一项所述的方法。
PCT/CN2023/101302 2022-06-20 2023-06-20 通信方法和装置 WO2023246753A1 (zh)

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
CN202210699709.X 2022-06-20
CN202210699709 2022-06-20
CN202210998724.4 2022-08-19
CN202210998724.4A CN117318948A (zh) 2022-06-20 2022-08-19 通信方法和装置

Publications (1)

Publication Number Publication Date
WO2023246753A1 true WO2023246753A1 (zh) 2023-12-28

Family

ID=89287253

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/101302 WO2023246753A1 (zh) 2022-06-20 2023-06-20 通信方法和装置

Country Status (2)

Country Link
CN (1) CN117318948A (zh)
WO (1) WO2023246753A1 (zh)

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105472604A (zh) * 2014-09-09 2016-04-06 中兴通讯股份有限公司 一种数字证书的状态处理方法、装置及系统
US20190166004A1 (en) * 2017-11-24 2019-05-30 Microsoft Technology Licensing, Llc Distributed global discovery servers in operational technology infrastructure
CN113966625A (zh) * 2019-07-17 2022-01-21 瑞典爱立信有限公司 用于核心网络域中的证书处理的技术
US20220052992A1 (en) * 2019-04-28 2022-02-17 Huawei Technologies Co.,Ltd. Identity verification method for network function service and related apparatus
CN114257440A (zh) * 2021-12-17 2022-03-29 中国电信股份有限公司 网络功能服务发现方法、系统以及存储介质
CN114528540A (zh) * 2020-10-30 2022-05-24 华为技术有限公司 一种服务授权方法、通信装置及系统

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105472604A (zh) * 2014-09-09 2016-04-06 中兴通讯股份有限公司 一种数字证书的状态处理方法、装置及系统
US20190166004A1 (en) * 2017-11-24 2019-05-30 Microsoft Technology Licensing, Llc Distributed global discovery servers in operational technology infrastructure
US20220052992A1 (en) * 2019-04-28 2022-02-17 Huawei Technologies Co.,Ltd. Identity verification method for network function service and related apparatus
CN113966625A (zh) * 2019-07-17 2022-01-21 瑞典爱立信有限公司 用于核心网络域中的证书处理的技术
CN114528540A (zh) * 2020-10-30 2022-05-24 华为技术有限公司 一种服务授权方法、通信装置及系统
CN114257440A (zh) * 2021-12-17 2022-03-29 中国电信股份有限公司 网络功能服务发现方法、系统以及存储介质

Also Published As

Publication number Publication date
CN117318948A (zh) 2023-12-29

Similar Documents

Publication Publication Date Title
US11824643B2 (en) Security lifecycle management of devices in a communications network
EP3752941B1 (en) Security management for service authorization in communication systems with service-based architecture
US20100115598A1 (en) Method and arrangement for integration of different authentication infrastructures
US20220345307A1 (en) Method, Device, and System for Updating Anchor Key in a Communication Network for Encrypted Communication with Service Applications
EP1849327A1 (en) Method and apparatus for optimal transfer of data in a wireless communications system
Xu et al. BE-RAN: Blockchain-enabled open RAN with decentralized identity management and privacy-preserving communication
US20220368684A1 (en) Method, Device, and System for Anchor Key Generation and Management in a Communication Network for Encrypted Communication with Service Applications
US20220337408A1 (en) Method, Device, and System for Application Key Generation and Management in a Communication Network for Encrypted Communication with Service Applications
Huang et al. 5G authentication and key management for applications
JP2023529951A (ja) 安全な通信方法、関連する装置、およびシステム
WO2016202397A1 (en) Dns based pki system
WO2023246753A1 (zh) 通信方法和装置
WO2021079023A1 (en) Inter-mobile network communication security
WO2023221891A1 (zh) 安全通信的方法与装置
WO2022252658A1 (zh) 一种漫游接入方法及装置
WO2023011158A1 (zh) 一种证书管理方法和装置
TWI820696B (zh) 通訊方法、裝置及電腦可讀儲存介質
TWI837450B (zh) 密鑰再生方法及終端裝置
WO2024032226A1 (zh) 通信方法和通信装置
US20230155832A1 (en) Network security
WO2023142102A1 (en) Security configuration update in communication networks
Kumar et al. A Public Key Infrastructure for 5G Service-Based Architecture
CN117997541A (zh) 通信方法和通信装置
CN116546493A (zh) 一种基于云辅助的车联网认证密钥协商方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23826400

Country of ref document: EP

Kind code of ref document: A1