WO2024065334A1 - 一种用户设备ue的授权令牌的生成方法/装置/设备及存储介质 - Google Patents

一种用户设备ue的授权令牌的生成方法/装置/设备及存储介质 Download PDF

Info

Publication number
WO2024065334A1
WO2024065334A1 PCT/CN2022/122340 CN2022122340W WO2024065334A1 WO 2024065334 A1 WO2024065334 A1 WO 2024065334A1 CN 2022122340 W CN2022122340 W CN 2022122340W WO 2024065334 A1 WO2024065334 A1 WO 2024065334A1
Authority
WO
WIPO (PCT)
Prior art keywords
authorization
network element
discovery
role
response message
Prior art date
Application number
PCT/CN2022/122340
Other languages
English (en)
French (fr)
Inventor
陆伟
商正仪
Original Assignee
北京小米移动软件有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京小米移动软件有限公司 filed Critical 北京小米移动软件有限公司
Priority to PCT/CN2022/122340 priority Critical patent/WO2024065334A1/zh
Priority to CN202280003799.2A priority patent/CN118104258A/zh
Publication of WO2024065334A1 publication Critical patent/WO2024065334A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/06—Selective distribution of broadcast services, e.g. multimedia broadcast multicast service [MBMS]; Services to user groups; One-way selective calling services
    • H04W4/08—User group management

Definitions

  • the present disclosure relates to the field of communication technology, and in particular to a method/device/equipment for generating an authorization token of a UE and a storage medium.
  • UE user equipment
  • the UE roles may include reference UE (such as sidelink reference UE (SL Reference UE)), target UE (Target UE), assistant UE (Assistant UE), located UE (Located UE), UE as a server (such as UE as a sidelink positioning server (SL Positioning Server UE)), client UE (such as sidelink positioning client UE (SL Positioning Client UE)), etc.
  • a UE before executing a service, a UE usually needs to discover a peer UE first. During the discovery process, the UE and the peer UE will communicate their respective roles.
  • the UE may deceive the peer UE.
  • the UE role is the target UE, but the UE role it declares to the peer UE (i.e., the UE role transmitted by the UE to the peer UE) is: server UE, which may affect the accuracy of service execution.
  • server UE which may affect the accuracy of service execution.
  • the UE deception is successful, it will further cause the insecurity of information leakage.
  • the method/device/equipment and storage medium for generating the authorization token of the UE proposed in the present disclosure are used to perform authorization verification on the UE role declared by the UE for the UE to ensure the accuracy of service execution and information security.
  • an embodiment of the present disclosure provides a method for generating an authorization token of a UE, the method being executed by a network device, including:
  • a discovery response message is sent to the first UE and/or the second UE, where the discovery response message includes an authorization token generated by the network device for the first UE and/or the second UE.
  • a network device may receive a discovery request message sent by a first UE and/or a second UE, the discovery request message being used to request an authorization token for the first UE and/or the second UE, the authorization token being used to perform authorization verification on the UE role declared by the UE; thereafter, the network device may send a discovery response message to the first UE and/or the second UE, the discovery response message including the authorization token generated by the network device for the first UE and/or the second UE. It can be seen from this that in the present disclosure, a UE may obtain an authorization token generated by the network device for the UE, the authorization token being used to perform authorization verification on the UE role declared by the UE.
  • the two UEs may exchange their respective authorization tokens, so that both UEs may perform authorization verification on the UE role declared by the other UE based on the authorization token of the other UE, thereby avoiding mutual deception between UEs, improving the accuracy of service execution, and improving information security.
  • an embodiment of the present disclosure provides a method for generating an authorization token of a UE, the method being executed by a first UE, including:
  • the discovery request message is used to request an authorization token for the first UE, and the authorization token is used to perform authorization verification on a UE role declared by the first UE;
  • a discovery response message sent by the network device is received, where the discovery response message includes an authorization token of the first UE.
  • an embodiment of the present disclosure provides a method for generating an authorization token of a UE, the method being executed by a second UE, including:
  • a discovery response message sent by the network device is received, where the discovery response message includes an authorization token of the second UE.
  • an embodiment of the present disclosure provides a method for generating an authorization token of a UE, the method being executed by a DDNMF network element of a first UE or a PKMF network element of the first UE, including:
  • the first authorization response message includes an authorization token of the first UE generated by the server or the UDM network element, or includes the first authorization information, where the first authorization information includes information related to the authorization of the first UE;
  • a discovery response message is sent to the first UE, where the discovery response message includes an authorization token of the first UE.
  • an embodiment of the present disclosure provides a method for generating an authorization token of a UE, the method being executed by a DDNMF network element of a second UE or a PKMF network element of the second UE, including:
  • first authorization response message sent by the server or the UDM network element, where the first authorization response message includes an authorization token of the second UE generated by the server or the UDM network element, or the second authorization information, where the second authorization information includes authorization-related information of the second UE;
  • a discovery response message is sent to the second UE, where the discovery response message includes an authorization token of the second UE.
  • an embodiment of the present disclosure provides a method for generating an authorization token of a UE, the method being executed by a server or a UDM network element, including:
  • first authorization request message sent by a DDNMF network element or a PKMF network element of the first UE and/or the second UE, where the first authorization request message is used to request an authorization token for the first UE and/or the second UE, and the authorization token is used to perform authorization verification on a UE role declared by the UE;
  • a first authorization response message is sent to the DDNMF network element or the PKMF network element of the first UE and/or the second UE, where the first authorization response message includes the authorization token of the first UE and/or the second UE, or the first authorization information and/or the second authorization information; wherein the first authorization information includes authorization-related information of the first UE, and the second authorization information includes authorization-related information of the second UE.
  • an embodiment of the present disclosure provides a communication device, including:
  • a transceiver module used to receive a discovery request message sent by the first UE and/or the second UE, wherein the discovery request message is used to request an authorization token for the first UE and/or the second UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE;
  • the transceiver module is further used to send a discovery response message to the first UE and/or the second UE, where the discovery response message includes an authorization token generated by the network device for the first UE and/or the second UE.
  • an embodiment of the present disclosure provides a communication device, including:
  • a transceiver module configured to send a discovery request message to a network device, wherein the discovery request message is used to request an authorization token for the first UE, and the authorization token is used to perform authorization verification on a UE role declared by the first UE;
  • the transceiver module is further used to receive a discovery response message sent by the network device, where the discovery response message includes an authorization token of the first UE.
  • an embodiment of the present disclosure provides a communication device, including:
  • a transceiver module configured to send a discovery request message to a network device, wherein the discovery request message is used to request an authorization token for the second UE, and the authorization token is used to perform authorization verification on a UE role declared by the second UE;
  • the transceiver module is further used to receive a discovery response message sent by the network device, where the discovery response message includes an authorization token of the second UE.
  • an embodiment of the present disclosure provides a communication device, including:
  • a transceiver module configured to receive a discovery request message sent by a first UE, wherein the discovery request message is used to request an authorization token for the first UE, and the authorization token is used to perform authorization verification on a UE role declared by the first UE;
  • the transceiver module is further used to send a first authorization request message to the server or the UDM network element;
  • the transceiver module is further used to receive a first authorization response message sent by the server or the UDM network element, where the first authorization response message includes an authorization token of the first UE generated by the server or the UDM network element, or includes the first authorization information, where the first authorization information includes information related to the authorization of the first UE;
  • the transceiver module is further used to send a discovery response message to the first UE, where the discovery response message includes an authorization token of the first UE.
  • an embodiment of the present disclosure provides a communication device, including:
  • a transceiver module configured to receive a discovery request message sent by a second UE, wherein the discovery request message is used to request an authorization token for the second UE, and the authorization token is used to perform authorization verification on a UE role declared by the second UE;
  • the transceiver module is further used to send a first authorization request message to the server or the UDM network element;
  • the transceiver module is further used to receive a first authorization response message sent by the server or the UDM network element, where the first authorization response message includes an authorization token of the second UE generated by the server or the UDM network element, or the second authorization information, where the second authorization information includes authorization-related information of the second UE;
  • the transceiver module is further used to send a discovery response message to the second UE, where the discovery response message includes an authorization token of the second UE.
  • an embodiment of the present disclosure provides a communication device, including:
  • a transceiver module configured to receive a first authorization request message sent by a DDNMF network element or a PKMF network element of the first UE and/or the second UE, wherein the first authorization request message is used to request an authorization token for the first UE and/or the second UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE;
  • the transceiver module is used to send a first authorization response message to the DDNMF network element or PKMF network element of the first UE and/or the second UE, where the first authorization response message includes the authorization token of the first UE and/or the second UE, or the first authorization information and/or the second authorization information; wherein the first authorization information includes authorization-related information of the first UE, and the second authorization information includes authorization-related information of the second UE.
  • an embodiment of the present disclosure provides a communication device, which includes a processor.
  • the processor calls a computer program in a memory, it executes any method described in the first to sixth aspects above.
  • an embodiment of the present disclosure provides a communication device, which includes a processor and a memory, in which a computer program is stored; the processor executes the computer program stored in the memory so that the communication device executes any method described in the first to sixth aspects above.
  • an embodiment of the present disclosure provides a communication device, which includes a processor and an interface circuit, wherein the interface circuit is used to receive code instructions and transmit them to the processor, and the processor is used to run the code instructions to enable the device to execute any one of the methods described in the first to sixth aspects above.
  • an embodiment of the present disclosure provides a communication system, which includes the communication device described in the seventh aspect to the communication device described in the twelfth aspect, or the system includes the communication device described in the thirteenth aspect, or the system includes the communication device described in the fourteenth aspect, or the system includes the communication device described in the fifteenth aspect.
  • an embodiment of the present disclosure provides a computer-readable storage medium for storing instructions used by the above-mentioned base station.
  • the terminal device executes the method described in any one of the above-mentioned first to sixth aspects.
  • the present disclosure further provides a computer program product comprising a computer program, which, when executed on a computer, enables the computer to execute the method described in any one of the first to sixth aspects above.
  • the present disclosure provides a chip system, which includes at least one processor and an interface, and is used to support the base station to implement the functions involved in the method described in any one of the first aspect to the sixth aspect, for example, determining or processing at least one of the data and information involved in the above method.
  • the chip system also includes a memory, and the memory is used to store computer programs and data necessary for the source auxiliary node.
  • the chip system can be composed of chips, and can also include chips and other discrete devices.
  • the present disclosure provides a computer program which, when executed on a computer, enables the computer to execute the method described in any one of the first to fifth aspects above.
  • the present disclosure provides a communication system, characterized in that it includes:
  • a first UE used to send a discovery request message
  • a second UE is used to send a discovery request message
  • a network device configured to send a discovery response message, wherein the discovery response message includes a role determined by the network device for the first UE and/or the second UE;
  • the first UE is further used to: receive the discovery response message, where the discovery response message includes a role determined by the network device for the first UE;
  • the second UE is further used to: receive the discovery response message, where the discovery response message includes the role determined by the network device for the second UE.
  • FIG. 1a and FIG. 1b are schematic diagrams of the architecture of some communication systems provided by embodiments of the present disclosure.
  • FIGS. 2a-2m are flowchart diagrams of a method for generating an authorization token of a UE provided in another embodiment of the present disclosure
  • FIG3 is a flow chart of a method for generating an authorization token of a UE provided in yet another embodiment of the present disclosure
  • FIG4 is a flow chart of a method for generating an authorization token of a UE provided in yet another embodiment of the present disclosure
  • FIG5 is a flow chart of a method for generating an authorization token of a UE provided in another embodiment of the present disclosure
  • FIG6 is a flow chart of a method for generating an authorization token of a UE provided in yet another embodiment of the present disclosure
  • FIG7 is a flow chart of a method for generating an authorization token of a UE provided in yet another embodiment of the present disclosure
  • FIG8 is a flow chart of a method for generating an authorization token of a UE provided in an embodiment of the present disclosure
  • 9a-9b are flowchart diagrams of a method for generating an authorization token of a UE provided in another embodiment of the present disclosure.
  • FIG10 is a flow chart of a method for generating an authorization token of a UE provided in another embodiment of the present disclosure
  • FIG11 is a flow chart of a method for generating an authorization token of a UE provided in another embodiment of the present disclosure.
  • FIG12 is a flow chart of a method for generating an authorization token of a UE provided in another embodiment of the present disclosure.
  • FIG13 is a flow chart of a method for generating an authorization token of a UE provided in another embodiment of the present disclosure.
  • FIG14 is a flow chart of a method for generating an authorization token of a UE provided in another embodiment of the present disclosure.
  • FIG15 is a flow chart of a method for generating an authorization token of a UE provided in another embodiment of the present disclosure.
  • 16a-16c are flowchart diagrams of a method for generating an authorization token of a UE provided in another embodiment of the present disclosure
  • FIG17 is a schematic diagram of the structure of a communication device provided by another embodiment of the present disclosure.
  • FIG18 is a schematic diagram of the structure of a communication device provided by another embodiment of the present disclosure.
  • FIG19 is a schematic diagram of the structure of a communication device provided by another embodiment of the present disclosure.
  • FIG20 is a schematic diagram of the structure of a communication device provided by another embodiment of the present disclosure.
  • FIG21a is a schematic diagram of the structure of a communication device provided by another embodiment of the present disclosure.
  • FIG21b is a schematic diagram of the structure of a communication device provided by another embodiment of the present disclosure.
  • FIG22 is a schematic diagram of the structure of a communication system provided by another embodiment of the present disclosure.
  • FIG23 is a block diagram of a communication device provided by an embodiment of the present disclosure.
  • FIG. 24 is a schematic diagram of the structure of a chip provided by an embodiment of the present disclosure.
  • first, second, third, etc. may be used to describe various information in the embodiments of the present disclosure, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other.
  • the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information.
  • the words "if” and “if” as used herein may be interpreted as "at the time of” or "when” or "in response to determining”.
  • UDM Unified Data Management
  • AMF Access and Mobility Management Function
  • SMF Session Management Function
  • Fig. 1a is a schematic diagram of the architecture of a communication system provided by an embodiment of the present disclosure.
  • the communication system may include but is not limited to a network device 13, and at least two UEs (such as a first UE 11 and a second UE 12).
  • LTE long term evolution
  • 5G fifth generation
  • NR 5G new radio
  • the network device 13 may include, for example, an access network device (e.g., a base station) and a core network device, wherein the access network device in the embodiment of the present disclosure is an entity on the network side for transmitting or receiving signals.
  • the access network device may be an evolved NodeB (eNB), a transmission reception point (TRP), a next generation NodeB (gNB) in an NR system, a base station in other future mobile communication systems, or an access node in a wireless fidelity (WiFi) system.
  • eNB evolved NodeB
  • TRP transmission reception point
  • gNB next generation NodeB
  • WiFi wireless fidelity
  • the embodiment of the present disclosure does not limit the specific technology and specific device form adopted by the access network device.
  • the access network device provided in the embodiment of the present disclosure may be composed of a central unit (CU) and a distributed unit (DU), wherein the CU may also be referred to as a control unit.
  • the CU-DU structure may be used to split the protocol layer of the access network device, such as a base station, and the functions of some protocol layers are placed in the CU for centralized control, and the functions of the remaining part or all of the protocol layers are distributed in the DU, and the DU is centrally controlled by the CU.
  • core network equipment is equipment deployed in the core network
  • core network network elements are network elements deployed in the core network. The functions of both are to provide user connection, user management, and service carrying, and to provide an interface to the external network as a bearer network.
  • the first UE11 and the second UE12 in the embodiment of the present disclosure are entities for receiving or transmitting signals on the user side, such as mobile phones.
  • the terminal device may also be referred to as a terminal device (terminal), a user equipment (UE), a mobile station (MS), a mobile terminal device (MT), etc.
  • the terminal device may be a car with communication function, a smart car, a mobile phone (mobile phone), a wearable device, a tablet computer (Pad), a computer with wireless transceiver function, a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a wireless terminal device in industrial control (industrial control), a wireless terminal device in self-driving, a wireless terminal device in remote medical surgery, a wireless terminal device in smart grid (smart grid), a wireless terminal device in transportation safety (transportation safety), a wireless terminal device in a smart city (smart city), a wireless terminal device in a smart home (smart home), etc.
  • the embodiments of the present disclosure do not limit the specific technology and specific device form adopted by the terminal device.
  • the core network equipment in the communication system may, for example, include a proximity communication service name management function (direct discovery name management function, DDNMF)/proximity communication service key management function (ProSe key management function, PKMF) network element of the first UE, a DDNMF/PKMF network element of the second UE, and a server/UDM network element.
  • DDNMF direct discovery name management function
  • PKMF ProSe key management function
  • the DDNMF/PKMF network element of the first UE and the DDNMF/PKMF network element of the second UE may be the same or different.
  • the communication system described in the embodiment of the present disclosure is for the purpose of more clearly illustrating the technical solution of the embodiment of the present disclosure, and does not constitute a limitation on the technical solution provided by the embodiment of the present disclosure.
  • a person skilled in the art can know that with the evolution of the system architecture and the emergence of new business scenarios, the technical solution provided by the embodiment of the present disclosure is also applicable to similar technical problems.
  • FIG2a is a flow chart of a method for generating an authorization token of a UE provided in an embodiment of the present disclosure. The method is executed by a network device. As shown in FIG2a , the method for generating an authorization token of a UE may include the following steps:
  • Step 201a Receive a discovery request message sent by the first UE and/or the second UE, where the discovery request message is used to request an authorization token for the first UE and/or the second UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE.
  • the UE role declared by the above UE can be understood as: the role transmitted between UEs during the UE discovery process.
  • the role of the first UE transmitted from the first UE to the second UE is the UE role declared by the first UE
  • the role of the second UE transmitted from the second UE to the first UE is the UE role declared by the second UE.
  • the discovery request message sent by the first UE may include at least one of the following:
  • An identifier of a service requested to be discovered by the first UE is an identifier of a service requested to be discovered by the first UE
  • the capabilities of the first UE are the capabilities of the first UE.
  • the discovery request message sent by the second UE may include at least one of the following:
  • the capabilities of the second UE are the capabilities of the second UE.
  • the RAUID is used to identify the UE so that the network device knows which UE sends the discovery request message.
  • the service requested to be discovered by the UE may be, for example, a ranging service and/or a sidelink positioning service.
  • the above-mentioned UE capability may be, for example, a ranging service capability supported by the UE and/or a sidelink positioning service capability supported by the UE.
  • Step 202a Send a discovery response message to the first UE and/or the second UE, where the discovery response message includes an authorization token generated by the network device for the first UE and/or the second UE.
  • the authorization token of the first UE and/or the second UE can at least indicate the role authorized by the network device (such as a server or a UDM network element) for the first UE and/or the second UE; and the authorization token of the first UE and/or the second UE can be used for: during the discovery process, the counterpart UE of the first UE and/or the second UE performs authorization verification on the role of the first UE and/or the second UE received and transmitted by the first UE and/or the second UE.
  • the network device such as a server or a UDM network element
  • the role authorized by the above-mentioned network device for the first UE and/or the second UE can be determined by the network device based on the capabilities of the UE, the identifier of the service requested to be discovered by the UE, and the contract information of the UE. After the network device authorizes the role for the first UE and/or the second UE, the role will be sent to the first UE and/or the second UE so that the first UE and the second UE can subsequently exchange and transmit their respective roles to achieve mutual discovery between the first UE and the second UE.
  • the first UE and the second UE may deceive the opposite UE, such as the role of the UE declared to the opposite UE is not the role authorized by the network device, which may affect the accuracy of the service execution. And, if the first UE and/or the second UE succeed in deceiving, it will further cause the insecurity of information leakage.
  • the network device can generate an authorization token for the first UE and/or the second UE that can indicate the role authorized by the network device for the first UE and/or the second UE, and enable the first UE and the second UE to exchange their respective authorization tokens with each other during the discovery process, so that the counterpart UE of the first UE and/or the second UE can perform authorization verification on the UE role declared by the first UE and/or the second UE based on the authorization token of the first UE and/or the second UE, so as to avoid the first UE and/or the second UE using other roles not authorized by the network device to deceive the counterpart UE during the discovery process, thereby improving the accuracy of service execution and improving information security.
  • the network device can generate an authorization token for the first UE and/or the second UE based on at least one of the UE's capabilities, the identifier of the service requested to be discovered by the UE, and the UE's contract information.
  • the above-mentioned contract information can be a service agreement and/or a UE subscription, and the contract information is registered with information related to the authorization of each UE in the ranging service and/or the sidelink positioning service (such as including the role allowed for each UE in the ranging service and/or the sidelink positioning service).
  • the network device generates an authorization token for the first UE and/or the second UE in this step will be described in subsequent embodiments.
  • the discovery response message may also carry key information generated by the network device for the service requested to be discovered by the first UE and/or key information corresponding to the service requested to be discovered by the second UE, wherein the key information corresponding to the service requested to be discovered by the first UE is the same as the key information corresponding to the service requested to be discovered by the second UE.
  • the key information is used to: perform security protection on the subsequent discovery process of the second UE by the first UE, so as to ensure that when the first UE and/or the second UE transmit the role of the first UE and/or the second UE and the authorization token of the first UE and/or the second UE in the subsequent discovery process, the unrelated UE cannot monitor or tamper with the role of the first UE and/or the second UE, and cannot obtain the authorization token of the first UE and/or the second UE, thereby preventing the unrelated UE from impersonating the role of the first UE and/or the second UE to deceive the opposite UE, avoiding interference from other unrelated UEs in the subsequent service execution process, improving the accuracy of service execution, and improving information security.
  • unrelated UEs include, for example, UEs that request to discover services different from those requested by the first UE and the second UE, UEs that do not request services, UEs whose roles are not authorized by the network device, UEs that have not obtained authorization tokens from the network device, UEs that have not obtained the key information from the network device, etc.
  • the network device can receive a discovery request message sent by the first UE and/or the second UE, and the discovery request message is used to request an authorization token for the first UE and/or the second UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE; thereafter, the network device can send a discovery response message to the first UE and/or the second UE, and the discovery response message includes the authorization token generated by the network device for the first UE and/or the second UE.
  • the UE can obtain the authorization token generated by the network device for the UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE. Based on this, when the discovery process is performed between subsequent UEs, the two UEs can exchange their respective authorization tokens, so that both UEs can perform authorization verification on the UE role declared by the other UE based on the authorization token of the other UE, thereby avoiding mutual deception between UEs, improving the accuracy of service execution, and improving information security.
  • the key information can be used to: perform security protection on the subsequent process of the UE discovering other UEs, to ensure that when the UE transmits the UE role and the UE authorization token during the subsequent discovery process, unrelated UEs cannot eavesdrop or tamper with the UE role, and cannot obtain the UE authorization token, thereby preventing unrelated UEs from impersonating the UE role, avoiding interference from other unrelated UEs during the subsequent service execution, and further improving the accuracy of service execution and information security.
  • FIG2b is a flow chart of a method for generating an authorization token of a UE provided in an embodiment of the present disclosure. The method is executed by a first UE. As shown in FIG2b , the method for generating an authorization token of the UE may include the following steps:
  • Step 201b Send a discovery request message to the network device, where the discovery request message is used to request an authorization token for the first UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE.
  • Step 202b Receive a discovery response message sent by the network device, where the discovery response message includes an authorization token of the first UE.
  • the authorization token of the first UE may at least indicate the role that the network device authorizes for the first UE; the authorization token of the first UE may be used to: during the discovery process, the peer UE of the first UE performs authorization verification on the role of the first UE transmitted by the first UE.
  • the verification process based on the authorization token will be described in detail in subsequent embodiments.
  • steps 201b - 202b please refer to the above embodiment description.
  • the first UE can send a discovery request message to the network device, and the discovery request message is used to request an authorization token for the first UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE; thereafter, the first UE can receive a discovery response message sent by the network device, and the discovery response message includes the authorization token of the first UE. It can be seen that in the present disclosure, the UE can obtain the authorization token generated by the network device for the UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE.
  • the two UEs can exchange their respective authorization tokens, so that both UEs can perform authorization verification on the UE role declared by the other UE based on the authorization token of the other UE, thereby avoiding mutual deception between UEs, improving the accuracy of service execution, and improving information security.
  • the key information can be used to: perform security protection on the subsequent process of the UE discovering other UEs, to ensure that when the UE transmits the UE role and the UE authorization token during the subsequent discovery process, unrelated UEs cannot eavesdrop or tamper with the UE role, and cannot obtain the UE authorization token, thereby preventing unrelated UEs from impersonating the UE role, avoiding interference from other unrelated UEs during the subsequent service execution, and further improving the accuracy of service execution and information security.
  • FIG2c is a flow chart of a method for generating an authorization token of a UE provided in an embodiment of the present disclosure. The method is executed by a first UE. As shown in FIG2c , the method for generating an authorization token of the UE may include the following steps:
  • Step 201c broadcast a first discovery message, where the first discovery message includes an authorization token of the first UE.
  • the first discovery message may also include the role of the first UE.
  • the first UE will broadcast the key information corresponding to the service requested to be discovered by the first UE to protect the first discovery message.
  • the key information corresponding to the service requested to be discovered by the second UE is the same as the security key corresponding to the service requested to be discovered by the first UE. Therefore, the second UE can use the same key information to successfully verify the first discovery message broadcast by the first UE, and achieve successful discovery with the first UE. After that, the second UE can verify whether the role of the second UE matches the role of the first UE, and authorize the role of the first UE included in the first discovery message based on the authorization token of the first UE.
  • the roles of UE may include, for example: reference UE (such as sidelink reference UE (SL Reference UE)), target UE (Target UE), assistant UE (Assistant UE), located UE (Located UE), UE as a server (such as UE as a sidelink positioning server (SL Positioning Server UE)), client UE (such as sidelink positioning client UE (SL Positioning Client UE)), etc.
  • reference UE such as sidelink reference UE (SL Reference UE)
  • target UE target UE
  • assistant UE Assistant UE
  • located UE located Located UE
  • UE UE as a server
  • client UE such as sidelink positioning client UE (SL Positioning Client UE)
  • client UE such as sidelink positioning client UE (SL Positioning Client UE)
  • the above-mentioned target UE may be a UE to be located or measured;
  • the above-mentioned positioning UE may be a UE to obtain the positioning position of the target UE;
  • the above-mentioned reference UE may be: a UE that can determine the positioning position or ranging distance of the target UE based on the position of the reference UE or the distance between the reference UE and the target UE;
  • the above-mentioned assistant UE may be: a UE used to assist in forwarding messages in ranging service or sidelink positioning service;
  • the above-mentioned UE as a server may be: a UE with positioning calculation capability or ranging calculation capability;
  • the above-mentioned client UE may be: a UE that can act as a client in ranging service or sidelink positioning service.
  • the above-mentioned matching of the role of the first UE and the role of the second UE in the service requested to be discovered by the two UEs can be understood as: the role of the first UE and the role of the second UE cooperate with each other to complete the service requested to be discovered by the two UEs.
  • the two roles that can cooperate with each other to complete the ranging service are generally: the target UE and the reference UE; for the sidelink positioning service, the two roles that can cooperate with each other to complete the sidelink positioning service are generally: the positioning UE and the target UE.
  • the service requested to be discovered by the two UEs is ranging service 1
  • the role of the first UE is: target UE
  • the role of the second UE is: reference UE
  • the role of the first UE and the role of the second UE do not match in the service requested to be discovered by the two UEs, which can be understood as: the role of the first UE and the role of the second UE cannot cooperate with each other to complete the service requested to be discovered by the two UEs.
  • the service requested to be discovered by the two UEs is ranging service 1
  • the role of the first UE is: target UE
  • the role of the second UE is also: target UE
  • the second UE can verify whether the role of the second UE matches the role of the first UE by determining whether the role of the second UE and the role of the first UE included in the first discovery message can cooperate with each other to complete the service requested by the two UEs to discover.
  • the above-mentioned method for authorizing the role of the first UE included in the first discovery message based on the authorization token of the first UE may include: determining the role authorized by the network device for the first UE based on the authorization token of the first UE, and comparing whether the role authorized by the network device for the first UE indicated by the authorization token of the first UE is consistent with the role of the first UE included in the first discovery message; if they are consistent, it is determined that the second UE has successfully authorized the role of the first UE included in the first discovery message, that is, the first UE has not deceived the second UE; if they are inconsistent, it is determined that the second UE has failed to authorize the role of the first UE included in the first discovery message, that is, the first UE has not deceived the second UE.
  • the second UE can subsequently establish a connection with the first UE to complete the requested service, otherwise, the second UE does not establish a connection with the first UE.
  • Step 202c Receive a first response message sent by the second UE.
  • the first response message is protected by key information corresponding to the service discovered according to the second UE request.
  • the first response message is sent by the second UE after successfully verifying the role declared by the first UE based on the authorization token of the first UE. This part of the content will be described in detail in subsequent embodiments.
  • the first UE can send a discovery request message to the network device, and the discovery request message is used to request an authorization token for the first UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE; thereafter, the first UE can receive a discovery response message sent by the network device, and the discovery response message includes the authorization token of the first UE. It can be seen that in the present disclosure, the UE can obtain the authorization token generated by the network device for the UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE.
  • the two UEs can exchange their respective authorization tokens, so that both UEs can perform authorization verification on the UE role declared by the other UE based on the authorization token of the other UE, thereby avoiding mutual deception between UEs, improving the accuracy of service execution, and improving information security.
  • the key information can be used to: perform security protection on the subsequent process of the UE discovering other UEs, to ensure that when the UE transmits the UE role and the UE authorization token during the subsequent discovery process, unrelated UEs cannot eavesdrop or tamper with the UE role, and cannot obtain the UE authorization token, thereby preventing unrelated UEs from impersonating the UE role, avoiding interference from other unrelated UEs during the subsequent service execution, and further improving the accuracy of service execution and information security.
  • FIG2d is a flow chart of a method for generating an authorization token of a UE provided in an embodiment of the present disclosure. The method is executed by a first UE. As shown in FIG2d , the method for generating an authorization token of the UE may include the following steps:
  • Step 201d Receive a second discovery message broadcast by the second UE, where the second discovery message includes an authorization token of the second UE.
  • the second discovery message is protected by the key information corresponding to the service requested to be discovered by the second UE, and the second discovery message may also include the role of the second UE.
  • Step 202d When it is verified according to the authorization token of the second UE that the role declared by the second UE is a role authorized by the network device, a second response message is sent to the second UE.
  • the first UE after the first UE receives the second response message sent by the second UE, it will decode and verify the second discovery message; in response to successful verification, it will determine whether the role of the second UE matches the role of the first UE, and authorize the role of the second UE included in the second discovery message based on the authorization token of the second UE.
  • the key information may be used to verify the second discovery message, and the principle of this part may refer to the description of the above embodiment.
  • the service requested by the second UE to be discovered is the same as the service requested by the first UE to be discovered, if the role of the first UE and the role of the second UE also match each other, it means that the first UE and the second UE can complete the services requested by the two UEs.
  • the first UE decodes and verifies the second discovery message it can further determine whether the role of the first UE and the role of the second UE match each other, so as to know whether the first UE and the second UE can complete the services requested by the two UEs. If they can be completed, the role of the second UE included in the second discovery message is authorized based on the authorization token of the second UE. If the authorization is successful, the two UEs can subsequently perform the discovery process to establish a connection. If it cannot be completed, it will be ignored.
  • a second response message is sent to the second UE, and the second response message is protected by the key information corresponding to the service requested to be discovered by the first UE.
  • the second response message includes the authorization token of the first UE and/or the role of the first UE.
  • the above steps 201d-202d are the discovery process of the first UE and the second UE. After the two UEs discover each other, a connection can be established to implement the service.
  • the first UE can send a discovery request message to the network device, and the discovery request message is used to request an authorization token for the first UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE; thereafter, the first UE can receive a discovery response message sent by the network device, and the discovery response message includes the authorization token of the first UE. It can be seen that in the present disclosure, the UE can obtain the authorization token generated by the network device for the UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE.
  • the two UEs can exchange their respective authorization tokens, so that both UEs can perform authorization verification on the UE role declared by the other UE based on the authorization token of the other UE, thereby avoiding mutual deception between UEs, improving the accuracy of service execution, and improving information security.
  • the key information can be used to: perform security protection on the subsequent process of the UE discovering other UEs, to ensure that when the UE transmits the UE role and the UE authorization token during the subsequent discovery process, unrelated UEs cannot eavesdrop or tamper with the UE role, and cannot obtain the UE authorization token, thereby preventing unrelated UEs from impersonating the UE role, avoiding interference from other unrelated UEs during the subsequent service execution, and further improving the accuracy of service execution and information security.
  • FIG2e is a flow chart of a method for generating an authorization token of a UE provided in an embodiment of the present disclosure. The method is executed by a second UE. As shown in FIG2e , the method for generating an authorization token of the UE may include the following steps:
  • Step 201e Send a discovery request message to the network device, where the discovery request message is used to request an authorization token for the second UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE;
  • Step 202e Receive a discovery response message sent by the network device, where the discovery response message includes an authorization token of the second UE.
  • the authorization token of the second UE at least indicates a role authorized by the network device for the second UE;
  • the authorization token of the second UE is used for: during the discovery process, the peer UE of the second UE performs authorization verification on the role of the second UE received and transmitted by the second UE.
  • the second UE can send a discovery request message to the network device, and the discovery request message is used to request an authorization token for the second UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE; thereafter, the second UE can receive a discovery response message sent by the network device, and the discovery response message includes the authorization token of the second UE. It can be seen that in the present disclosure, the UE can obtain the authorization token generated by the network device for the UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE.
  • the two UEs can exchange their respective authorization tokens, so that both UEs can perform authorization verification on the UE role declared by the other UE based on the authorization token of the other UE, thereby avoiding mutual deception between UEs, improving the accuracy of service execution, and improving information security.
  • the key information can be used to: perform security protection on the subsequent process of the UE discovering other UEs, to ensure that when the UE transmits the UE role and the UE authorization token during the subsequent discovery process, unrelated UEs cannot eavesdrop or tamper with the UE role, and cannot obtain the UE authorization token, thereby preventing unrelated UEs from impersonating the UE role, avoiding interference from other unrelated UEs during the subsequent service execution, and further improving the accuracy of service execution and information security.
  • FIG2f is a flow chart of a method for generating an authorization token of a UE provided in an embodiment of the present disclosure. The method is executed by a second UE. As shown in FIG2f , the method for generating an authorization token of the UE may include the following steps:
  • Step 201f Receive a first discovery message broadcast by the first UE, where the first discovery message includes an authorization token of the first UE.
  • Step 202f When it is verified according to the authorization token of the first UE that the role declared by the first UE is a role authorized by the network device, a first response message is sent to the first UE.
  • the action performed by the second UE after receiving the first discovery message is similar to the action performed by the first UE after receiving the second discovery message mentioned above, and will not be repeated in this disclosure.
  • the second UE can send a discovery request message to the network device, and the discovery request message is used to request an authorization token for the second UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE; thereafter, the second UE can receive a discovery response message sent by the network device, and the discovery response message includes the authorization token of the second UE. It can be seen that in the present disclosure, the UE can obtain the authorization token generated by the network device for the UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE.
  • the two UEs can exchange their respective authorization tokens, so that both UEs can perform authorization verification on the UE role declared by the other UE based on the authorization token of the other UE, thereby avoiding mutual deception between UEs, improving the accuracy of service execution, and improving information security.
  • the key information can be used to: perform security protection on the subsequent process of the UE discovering other UEs, to ensure that when the UE transmits the UE role and the UE authorization token during the subsequent discovery process, unrelated UEs cannot eavesdrop or tamper with the UE role, and cannot obtain the UE authorization token, thereby preventing unrelated UEs from impersonating the UE role, avoiding interference from other unrelated UEs during the subsequent service execution, and further improving the accuracy of service execution and information security.
  • FIG2g is a flow chart of a method for generating an authorization token of a UE provided in an embodiment of the present disclosure. The method is executed by a second UE. As shown in FIG2g , the method for generating an authorization token of the UE may include the following steps:
  • Step 201g broadcast a second discovery message, where the second discovery message includes an authorization token of the second UE.
  • Step 202g Receive a second response message sent by the first UE, where the second response message includes an authorization token of the first UE.
  • Step 203g Verify, based on the authorization token of the first UE, whether the role declared by the first UE is a role authorized by the network device.
  • the second UE can send a discovery request message to the network device, and the discovery request message is used to request an authorization token for the second UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE; thereafter, the second UE can receive a discovery response message sent by the network device, and the discovery response message includes the authorization token of the second UE. It can be seen that in the present disclosure, the UE can obtain the authorization token generated by the network device for the UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE.
  • the two UEs can exchange their respective authorization tokens, so that both UEs can perform authorization verification on the UE role declared by the other UE based on the authorization token of the other UE, thereby avoiding mutual deception between UEs, improving the accuracy of service execution, and improving information security.
  • the key information can be used to: perform security protection on the subsequent process of the UE discovering other UEs, to ensure that when the UE transmits the UE role and the UE authorization token during the subsequent discovery process, unrelated UEs cannot eavesdrop or tamper with the UE role, and cannot obtain the UE authorization token, thereby preventing unrelated UEs from impersonating the UE role, avoiding interference from other unrelated UEs during the subsequent service execution, and further improving the accuracy of service execution and information security.
  • the network side device may include: a first network element, a second network element and a third network element, wherein the first network element includes a DDNMF network element of the first UE or a PKMF network element of the first UE, the second network element includes a DDNMF network element of the second UE or a PKMF network element of the second UE, and the third network element includes a proximity service server or a UDM network element. Based on this, the specific steps of the interaction between the first network element, the second network element, the third network element, the first UE and the second UE are introduced below.
  • FIG2h is a schematic diagram of an interaction flow of a method for generating an authorization token of a UE provided in an embodiment of the present disclosure.
  • the method for generating an authorization token of a UE may include the following steps:
  • Step 201h The first network element receives a discovery request message sent by the first UE;
  • Step 202h The first network element sends a first authorization request message to the third network element;
  • Step 203h The third network element sends a first authorization response message to the first network element, where the first authorization response message includes an authorization token of the first UE generated by the third network element.
  • the premise for the third network element to generate the authorization token of the first UE should be that the third network element can successfully authorize the role for the first UE.
  • the third network element can first determine whether the role can be authorized for the first UE based on the capability of the first UE and the contract information of the first UE stored in the third network element, and in response to being able to authorize the role for the first UE, further generate an authorization token for the first UE.
  • the method in which the third network element determines whether a role can be authorized for the first UE according to the capability of the first UE and the subscription information of the first UE stored in the third network element may include:
  • the contract information registers the allowed roles of each UE in the ranging service and/or the sidelink positioning service.
  • the third network element can determine the allowed role of a certain UE in the ranging service and/or the sidelink positioning service by searching the contract information, and then determine whether the UE's capabilities support the role determination among the allowed roles of the UE. If so, it is determined that the role can be successfully authorized for the first UE. Otherwise, it is determined that the role cannot be authorized for the first UE.
  • the third network element finds out from the service protocol based on the identifier of the first UE that the roles allowed for the first UE in the ranging service are target UE and serving UE, and/or the third network element can determine the subscription of the first UE based on the identifier of the first UE, and find out from the subscription of the first UE that the roles allowed for the first UE in the sidelink positioning service are target UE and serving UE.
  • the third network element determines that the roles supported by the first UE in the ranging service are target UE and positioning UE based on the capabilities of the first UE, it can be known that among the roles allowed for the UE, there is a role that the capabilities of the UE support, so that it can be determined that the third network element can successfully authorize the role for the first UE, and thus the third network element can further generate an authorization token for the first UE.
  • the method for the third network element to generate an authorization token for the first UE may include: generating an authorization token for the first UE based on the service requested to be discovered by the first UE and the contract information of the first UE. Specifically, the third network element may determine the authorization-related information corresponding to the service requested to be discovered by the first UE from the contract information of the first UE (such as the service agreement and/or the subscription of the first UE) based on the service requested to be discovered by the first UE, and then generate an authorization token for the first UE based on the authorization-related information corresponding to the service requested to be discovered by the first UE.
  • Step 204h The first network element sends a discovery response message to the first UE.
  • the present disclosure provides a method for generating an authorization token for a UE, wherein the UE can obtain the authorization token generated by the network device for the UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE. Based on this, when the discovery process is performed between the subsequent UEs, the two UEs can exchange their respective authorization tokens, so that both UEs can perform authorization verification on the UE role declared by the other UE based on the authorization token of the other UE, thereby avoiding mutual deception between UEs, improving the accuracy of service execution, and improving information security.
  • the key information can be used to: perform security protection on the subsequent process of the UE discovering other UEs, so as to ensure that when the UE transmits the UE role and the UE authorization token in the subsequent discovery process, the unrelated UE cannot monitor or tamper with the UE role, and cannot obtain the UE authorization token, thereby preventing the unrelated UE from impersonating the UE role, avoiding interference from other unrelated UEs in the subsequent service execution process, and further improving the accuracy of service execution and information security.
  • FIG. 2i is a schematic diagram of an interaction flow of a method for generating an authorization token of a UE provided in an embodiment of the present disclosure.
  • the method for generating an authorization token of a UE may include the following steps:
  • Step 201i The first network element receives a discovery request message sent by the first UE;
  • Step 202i The first network element sends a first authorization request message to the third network element;
  • Step 203i The third network element sends a first authorization response message to the first network element.
  • the first authorization response message includes first authorization information determined by the third network element.
  • the first authorization information includes authorization-related information of the first UE.
  • the premise for the third network element to determine the first authorization information should be that the third network element can successfully authorize the role for the first UE.
  • the third network element can first determine whether the role can be authorized for the first UE based on the capability of the first UE and the contract information of the first UE stored in the third network element, and in response to being able to authorize the role for the first UE, further determine the first authorization information.
  • the method for the third network element to determine whether it can authorize a role for the first UE and the method for the third network element to determine the first authorization information for the first UE can refer to the description of the above embodiment.
  • Step 204i The first network element generates an authorization token for the first UE based on the first authorization information.
  • Step 205i The first network element sends a discovery response message to the first UE.
  • the present disclosure provides a method for generating an authorization token for a UE, wherein the UE can obtain the authorization token generated by the network device for the UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE. Based on this, when the discovery process is performed between the subsequent UEs, the two UEs can exchange their respective authorization tokens, so that both UEs can perform authorization verification on the UE role declared by the other UE based on the authorization token of the other UE, thereby avoiding mutual deception between UEs, improving the accuracy of service execution, and improving information security.
  • the key information can be used to: perform security protection on the subsequent process of the UE discovering other UEs, so as to ensure that when the UE transmits the UE role and the UE authorization token in the subsequent discovery process, the unrelated UE cannot monitor or tamper with the UE role, and cannot obtain the UE authorization token, thereby preventing the unrelated UE from impersonating the UE role, avoiding interference from other unrelated UEs in the subsequent service execution process, and further improving the accuracy of service execution and information security.
  • FIG2j is a schematic diagram of an interaction flow of a method for generating an authorization token of a UE provided in an embodiment of the present disclosure.
  • the method for generating an authorization token of a UE may include the following steps:
  • Step 201j The second network element receives a discovery request message sent by the second UE;
  • Step 202j The second network element sends a first authorization request message to the third network element
  • Step 203j The third network element sends a first authorization response message to the second network element, where the first authorization response message includes an authorization token of the second UE generated by the third network element.
  • Step 204j The second network element sends a discovery response message to the second UE.
  • the present disclosure provides a method for generating an authorization token for a UE, wherein the UE can obtain the authorization token generated by the network device for the UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE. Based on this, when the discovery process is performed between the subsequent UEs, the two UEs can exchange their respective authorization tokens, so that both UEs can perform authorization verification on the UE role declared by the other UE based on the authorization token of the other UE, thereby avoiding mutual deception between UEs, improving the accuracy of service execution, and improving information security.
  • the key information can be used to: perform security protection on the subsequent process of the UE discovering other UEs, so as to ensure that when the UE transmits the UE role and the UE authorization token in the subsequent discovery process, the unrelated UE cannot monitor or tamper with the UE role, and cannot obtain the UE authorization token, thereby preventing the unrelated UE from impersonating the UE role, avoiding interference from other unrelated UEs in the subsequent service execution process, and further improving the accuracy of service execution and information security.
  • FIG. 2k is a schematic diagram of an interaction flow of a method for generating an authorization token of a UE provided in an embodiment of the present disclosure.
  • the method for generating an authorization token of a UE may include the following steps:
  • Step 201k The second network element receives a discovery request message sent by the second UE;
  • Step 202k The second network element sends a first authorization request message to the third network element
  • Step 203k The third network element sends a first authorization response message to the second network element, where the first authorization response message includes second authorization information determined by the third network element, and the second authorization information includes authorization-related information of the second UE.
  • Step 204k The second network element sends a monitoring request message to the first network element
  • Step 205k The first network element sends a second authorization request message to the third network element;
  • Step 206k The third network element sends a second authorization response message to the first network element, where the second authorization response message includes third authorization information, where the third authorization information at least indicates a matching relationship between a role of the first UE and a role of the second UE in services requested to be discovered by the two UEs.
  • Step 207k The first network element sends a monitoring response message to the second network element, where the monitoring response message includes the third authorization information.
  • Step 208k The second network element generates an authorization token for the second UE based on the second authorization information and the third authorization information.
  • Step 209k The second network element sends a discovery response message to the second UE.
  • the present disclosure provides a method for generating an authorization token for a UE, wherein the UE can obtain the authorization token generated by the network device for the UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE. Based on this, when the discovery process is performed between the subsequent UEs, the two UEs can exchange their respective authorization tokens, so that both UEs can perform authorization verification on the UE role declared by the other UE based on the authorization token of the other UE, thereby avoiding mutual deception between UEs, improving the accuracy of service execution, and improving information security.
  • the key information can be used to: perform security protection on the subsequent process of the UE discovering other UEs, so as to ensure that when the UE transmits the UE role and the UE authorization token in the subsequent discovery process, the unrelated UE cannot monitor or tamper with the UE role, and cannot obtain the UE authorization token, thereby preventing the unrelated UE from impersonating the UE role, avoiding interference from other unrelated UEs in the subsequent service execution process, and further improving the accuracy of service execution and information security.
  • the above-mentioned method for generating the authorization token of the UE is written from the perspective of the network device, the first UE and the second UE.
  • the network device may include the DDNMF network element of the first UE or the PKMF network element of the first UE, the DDNMF network element of the second UE or the PKMF network element of the second UE, and the third network element includes a server or a UDM network element for proximity services.
  • the following will introduce the method of the present disclosure from the perspective of the DDNMF network element of the first UE or the PKMF network element of the first UE, the perspective of the DDNMF network element of the second UE or the PKMF network element of the second UE, the perspective of the server or the UDM network element, the perspective of the first UE interacting with the DDNMF/PKMF network element, and the perspective of the second UE interacting with the DDNMF/PKMF network element in the method for generating the authorization token of the UE.
  • FIG2L is a flow chart of a method for generating an authorization token of a UE provided in an embodiment of the present disclosure. The method is executed by a DDNMF network element of a first UE or a PKMF network element of a first UE. As shown in FIG2 , the method for generating an authorization token of a UE may include the following steps:
  • Step 201L receive a discovery request message (Discovery Request message) sent by the first UE, where the discovery request message is used to request an authorization token for the first UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE.
  • discovery request message Discovery Request message
  • Step 202L send the first authorization request message (Authorization Request) to the server or UDM network element.
  • the method of sending a first authorization request message to a server or a UDM network element may be: first converting the RAUID corresponding to the first UE into a first identifier that can be recognized by the server or the UDM network element, and the first identifier is used to indicate the first UE; then carrying the first identifier, the service requested to be discovered by the first UE, and at least one of the capabilities of the first UE in the first authorization request message and sending it to the server or the UDM network element.
  • the server may be, for example: a ranging or sidelink positioning server (Ranging/SL positioning server).
  • Step 203L receive the first authorization response message (Authorization Response) sent by the server or UDM network element, and the first authorization response message includes the authorization token of the first UE generated by the server or UDM network element.
  • Authorization Response the first authorization response message
  • the authorization token of the first UE is used for: during the discovery process, the counterpart UE of the first UE performs authorization verification on the role of the first UE received and transmitted by the first UE.
  • Step 204L send a discovery response message (Discovery Request) to the first UE, and the discovery response message includes the authorization token of the first UE.
  • Discovery Request a discovery response message
  • the discovery response message may also include key information (Discovery Security Material) generated by the DDNMF network element of the first UE or the PKMF network element of the first UE for the service requested to be discovered by the first UE.
  • key information Discovery Security Material
  • the key information please refer to the description of the above embodiment.
  • the DDNMF network element of the first UE or the PKMF network element of the first UE when the DDNMF network element of the first UE or the PKMF network element of the first UE receives the role of the first UE, the DDNMF network element of the first UE or the PKMF network element of the first UE will further determine the application code corresponding to the service to be executed by the first UE, and carry the application code corresponding to the service to be executed by the first UE in the discovery response message and send it to the first UE.
  • the application code can be used for: the first UE discovers other UEs that perform the same service as the first UE based on the application code.
  • the DDNMF network element of the first UE or the PKMF network element of the first UE when the first authorization response message received by the DDNMF network element of the first UE or the PKMF network element of the first UE indicates an authorization failure, the DDNMF network element of the first UE or the PKMF network element of the first UE will not generate key information and application code, and will send a discovery response message to the first UE to indicate the rejection of the discovery request of the first UE.
  • the DDNMF network element of the first UE or the PKMF network element of the first UE will receive the discovery request message sent by the first UE, and the discovery request message is used to request an authorization token for the first UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE; afterwards, a first authorization request message will be sent to the server or UDM network element; and a first authorization response message will be received from the server or UDM network element, and the first authorization response message includes the authorization token of the first UE generated by the server or UDM network element; finally, the DDNMF network element of the first UE or the PKMF network element of the first UE will send a discovery response message to the first UE, and the discovery response message includes the authorization token.
  • the UE can obtain the authorization token generated by the network device for the UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE. Based on this, when the discovery process is performed between subsequent UEs, the two UEs can exchange their respective authorization tokens, so that both UEs can perform authorization verification on the UE role declared by the other UE based on the authorization token of the other UE, thereby avoiding mutual deception between UEs, improving the accuracy of service execution, and improving information security.
  • the key information can be used to: provide security protection for the subsequent process of the UE discovering other UEs, to ensure that when the UE transmits the UE role and the UE authorization token in the subsequent discovery process, unrelated UEs cannot monitor or tamper with the UE role, and cannot obtain the UE authorization token, thereby preventing unrelated UEs from impersonating the UE role, avoiding interference from other unrelated UEs in the subsequent service execution process, and further improving the accuracy of service execution and information security.
  • FIG2m is a flow chart of a method for generating an authorization token of a UE provided in an embodiment of the present disclosure. The method is executed by a DDNMF network element of a first UE or a PKMF network element of a first UE. As shown in FIG2 , the method for generating an authorization token of the UE may include the following steps:
  • Step 201m receiving a discovery request message (Discovery Request message) sent by the first UE, where the discovery request message is used to request an authorization token for the first UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE.
  • discovery Request message Discovery Request message
  • Step 202m send the first authorization request message (Authorization Request) to the server or UDM network element.
  • the method of sending a first authorization request message to a server or a UDM network element may be: first converting the RAUID corresponding to the first UE into a first identifier that can be recognized by the server or the UDM network element, and the first identifier is used to indicate the first UE; then carrying the first identifier, the service requested to be discovered by the first UE, and at least one of the capabilities of the first UE in the first authorization request message and sending it to the server or the UDM network element.
  • the server may be, for example: a ranging or sidelink positioning server (Ranging/SL positioning server).
  • Step 203m receiving a first authorization response message (Authorization Response) sent by the server or UDM network element, where the first authorization response message includes first authorization information determined by the server or UDM network element, and the first authorization information includes authorization-related information of the first UE.
  • Authorization Response a first authorization response message sent by the server or UDM network element
  • Step 204m Generate an authorization token for the first UE based on the first authorization information.
  • Step 205m send a discovery response message (Discovery Request) to the first UE, and the discovery response message includes the authorization token of the first UE.
  • Discovery Request a discovery response message
  • the DDNMF network element of the first UE or the PKMF network element of the first UE will receive the discovery request message sent by the first UE, and the discovery request message is used to request an authorization token for the first UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE; afterwards, a first authorization request message will be sent to the server or UDM network element; and a first authorization response message will be received from the server or UDM network element, and the first authorization response message includes the authorization token of the first UE generated by the server or UDM network element; finally, the DDNMF network element of the first UE or the PKMF network element of the first UE will send a discovery response message to the first UE, and the discovery response message includes the authorization token.
  • the UE can obtain the authorization token generated by the network device for the UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE. Based on this, when the discovery process is performed between subsequent UEs, the two UEs can exchange their respective authorization tokens, so that both UEs can perform authorization verification on the UE role declared by the other UE based on the authorization token of the other UE, thereby avoiding mutual deception between UEs, improving the accuracy of service execution, and improving information security.
  • the key information can be used to: provide security protection for the subsequent process of the UE discovering other UEs, to ensure that when the UE transmits the UE role and the UE authorization token in the subsequent discovery process, unrelated UEs cannot monitor or tamper with the UE role, and cannot obtain the UE authorization token, thereby preventing unrelated UEs from impersonating the UE role, avoiding interference from other unrelated UEs in the subsequent service execution process, and further improving the accuracy of service execution and information security.
  • FIG3 is a flow chart of a method for generating an authorization token of a UE provided in an embodiment of the present disclosure. The method is executed by a DDNMF network element of a first UE or a PKMF network element of a first UE. As shown in FIG3 , the method for generating an authorization token of a UE may include the following steps:
  • Step 301 Receive a monitor request message (Monitor Request message) sent by the DDNMF network element of the second UE or the PKMF network element of the second UE.
  • Monitor Request message a monitor request message sent by the DDNMF network element of the second UE or the PKMF network element of the second UE.
  • the monitoring request message may be: after the DDNMF network element of the second UE or the PKMF network element of the second UE obtains the role of the second UE determined by the server or the UDM network element, it is sent to the DDNMF network element of the first UE or the PKMF network element of the first UE, and the monitoring request message includes at least one of the role of the second UE, the service requested to be discovered by the second UE, and the second identifier used to indicate the second UE.
  • the specific process for the DDNMF network element of the second UE or the PKMF network element of the second UE to obtain the role of the second UE determined by the server or the UDM network element is similar to the specific process for the DDNMF network element of the first UE or the PKMF network element of the first UE to obtain the role of the first UE, please refer to the subsequent introduction of the implementation examples of the DDNMF network element of the second UE or the PKMF network element of the second UE.
  • Step 302 In response to the second UE requesting to discover a service that is the same as the service requested to be discovered by the first UE, a second authorization request message is sent to the server or UDM network element, where the second authorization request message includes the role of the first UE, the role of the second UE, and the services requested to be discovered by both UEs.
  • Step 303 Receive a second authorization response message sent by the server or the UDM network element, where the second authorization response message includes third authorization information, and the third authorization information at least indicates a matching relationship between the first UE and the second UE in the services requested to be discovered by the two UEs.
  • the premise that the second authorization response includes the third authorization information is that the server or the UDM network element determines that the role of the first UE matches the role of the second UE.
  • Step 304 Send a monitor response message (Monitor Response message) to the DDNMF network element of the second UE or the PKMF network element of the second UE, where the monitor response message includes the third authorization information.
  • Monitor Response message Monitoring Response message
  • the third authorization information is sent to the DDNMF network element of the second UE or the PKMF network element of the second UE so that the DDNMF network element of the second UE or the PKMF network element of the second UE can generate an authorization token for the second UE based on the third authorization information.
  • the monitoring response message also carries the key information generated by the DDNMF network element of the first UE or the PKMF network element of the first UE for the same service requested to be discovered by the first UE, so that the key information corresponding to the service requested to be discovered by the second UE is the same as the key information corresponding to the service requested to be discovered by the first UE.
  • the role of the first UE and the role of the second UE match each other, it means that the first UE and the second UE can cooperate with each other to complete the service requested by the two UEs to discover.
  • the DDNMF network element of the first UE or the PKMF network element of the first UE should generate the same security discovery key for the service requested by the second UE to discover as the security discovery key generated for the service requested by the first UE to discover, so that the second UE can subsequently successfully verify the information transmitted by the first UE during the discovery process based on the same security discovery key, thereby ensuring that the two UEs can successfully discover each other and successfully complete the services requested by the two UEs to discover.
  • the DDNMF network element of the first UE or the PKMF network element of the first UE from the server or the UDM network element indicates that the role of the first UE and the role of the second UE do not match in the services requested to be discovered by the two UEs
  • the DDNMF network element of the first UE or the PKMF network element of the first UE should send a monitoring response message indicating the rejection of the monitoring request to the DDNMF network element of the second UE or the PKMF network element of the second UE.
  • the DDNMF network element of the first UE or the PKMF network element of the first UE will receive the discovery request message sent by the first UE, and the discovery request message is used to request an authorization token for the first UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE; afterwards, a first authorization request message will be sent to the server or UDM network element; and a first authorization response message will be received from the server or UDM network element, and the first authorization response message includes the authorization token of the first UE generated by the server or UDM network element; finally, the DDNMF network element of the first UE or the PKMF network element of the first UE will send a discovery response message to the first UE, and the discovery response message includes the authorization token.
  • the UE can obtain the authorization token generated by the network device for the UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE. Based on this, when the discovery process is performed between subsequent UEs, the two UEs can exchange their respective authorization tokens, so that both UEs can perform authorization verification on the UE role declared by the other UE based on the authorization token of the other UE, thereby avoiding mutual deception between UEs, improving the accuracy of service execution, and improving information security.
  • the key information can be used to: provide security protection for the subsequent process of the UE discovering other UEs, to ensure that when the UE transmits the UE role and the UE authorization token in the subsequent discovery process, unrelated UEs cannot monitor or tamper with the UE role, and cannot obtain the UE authorization token, thereby preventing unrelated UEs from impersonating the UE role, avoiding interference from other unrelated UEs in the subsequent service execution process, and further improving the accuracy of service execution and information security.
  • FIG4 is a flow chart of a method for generating an authorization token of a UE provided in an embodiment of the present disclosure. The method is executed by a DDNMF network element of a second UE or a PKMF network element of a second UE. As shown in FIG4 , the method for generating an authorization token of the UE may include the following steps:
  • Step 401 Receive a discovery request message sent by a second UE, where the discovery request message is used to request an authorization token for the second UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE.
  • the discovery request message may include at least one of the following:
  • the second UE requests the discovered service
  • the capabilities of the second UE are the capabilities of the second UE.
  • the above RAUID is used to indicate the UE so that the network device knows which UE sends the discovery request message.
  • Step 402 Send a first authorization request message to the server or UDM network element.
  • sending the first authorization request message to the server or the UDM network element may include:
  • At least one of the second identifier, the service requested to be discovered by the second UE, and the capability of the second UE is carried in the authorization request message and sent to the server or the UDM network element.
  • Step 403 Receive a first authorization response message sent by the server or the UDM network element, where the first authorization response message includes an authorization token of the second UE generated by the server or the UDM network element.
  • the authorization token of the second UE is used for: during the discovery process, the peer UE of the second UE performs authorization verification on the role of the second UE received and transmitted by the second UE.
  • Step 404 Send a discovery response message to the second UE, where the discovery response message includes an authorization token of the second UE.
  • the discovery response message may also carry key information generated by the DDNMF network element of the first UE or the PKMF network element of the second UE for the service requested to be discovered by the second UE.
  • steps 401 - 404 are similar to the principles of the steps 201 - 204 in the aforementioned embodiment of FIG. 2 , and the rest may refer to the introduction of the aforementioned embodiment.
  • the DDNMF network element of the second UE or the PKMF network element of the second UE will receive the discovery request message sent by the second UE, and the discovery request message is used to request an authorization token for the second UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE; afterwards, a first authorization request message will be sent to the server or UDM network element; and a first authorization response message will be received from the server or UDM network element, and the first authorization response message includes the authorization token of the second UE generated by the server or UDM network element; finally, the DDNMF network element of the second UE or the PKMF network element of the second UE will send a discovery response message to the second UE, and the discovery response message includes the authorization token.
  • the UE can obtain the authorization token generated by the network device for the UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE. Based on this, when the discovery process is performed between subsequent UEs, the two UEs can exchange their respective authorization tokens, so that both UEs can perform authorization verification on the UE role declared by the other UE based on the authorization token of the other UE, thereby avoiding mutual deception between UEs, improving the accuracy of service execution, and improving information security.
  • the key information can be used to: provide security protection for the subsequent process of the UE discovering other UEs, to ensure that when the UE transmits the UE role and the UE authorization token in the subsequent discovery process, unrelated UEs cannot monitor or tamper with the UE role, and cannot obtain the UE authorization token, thereby preventing unrelated UEs from impersonating the UE role, avoiding interference from other unrelated UEs in the subsequent service execution process, and further improving the accuracy of service execution and information security.
  • FIG5 is a flow chart of a method for generating an authorization token of a UE provided in an embodiment of the present disclosure.
  • the method is executed by a DDNMF network element of a second UE or a PKMF network element of a second UE.
  • the method for generating an authorization token of the UE may include the following steps:
  • Step 501 Receive a discovery request message sent by a second UE, where the discovery request message is used to request an authorization token for the second UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE.
  • the above RAUID is used to indicate the UE so that the network device knows which UE sends the discovery request message.
  • Step 502 Send a first authorization request message to the server or UDM network element.
  • Step 503 Receive a first authorization response message sent by the server or the UDM network element, where the first authorization response message includes second authorization information determined by the server or the UDM network element, and the second authorization information includes authorization-related information of the second UE.
  • Step 504 Send a monitoring request message to the DDNMF network element of the first UE or the PKMF network element of the first UE, where the monitoring request message carries at least one of the role of the second UE, the service requested to be discovered by the second UE, and a second identifier for indicating the second UE.
  • the second UE actually knows which UE the opposite UE (i.e., the first UE) is. Based on this, when the second UE sends a discovery request message to the DDNMF network element of the second UE or the PKMF network element of the second UE, it can also carry indication information indicating the first UE, or indicating the DDNMF network element or PKMF network element of the first UE in the discovery request message, so that the DDNMF network element of the second UE or the PKMF network element of the second UE can determine, based on the indication information, to which UE's DDNMF network element or PKMF network element it needs to send the monitoring request message, thereby ensuring that the DDNMF network element or PKMF network element of the second UE can successfully send the monitoring request message to the DDNMF network element or PKMF network element of the first UE.
  • Step 505 Receive a monitoring response message sent by the DDNMF network element of the first UE or the PKMF network element of the first UE, where the monitoring response message includes third authorization information, and the third authorization information at least indicates a matching relationship between the first UE and the second UE in the services requested to be discovered by the two UEs.
  • the monitoring response message also carries key information corresponding to the service requested to be discovered by the second UE; wherein the key information is: after the DDNMF network element of the first UE or the PKMF network element of the first UE receives the second authorization response message sent by the server or the UDM network element to indicate that the role of the first UE and the role of the second UE match each other, it is sent to the DDNMF network element of the second UE or the PKMF network element of the second UE, and the key information corresponding to the service requested to be discovered by the second UE is the same as the security key corresponding to the service requested to be discovered by the first UE.
  • Step 506 Generate an authorization token for the second UE based on the second authorization information and the third authorization information.
  • Step 507 Send a discovery response message to the second UE, where the discovery response message includes an authorization token of the second UE.
  • steps 501 - 507 please refer to the description of the aforementioned embodiment, which will not be elaborated in detail in the embodiment of the present disclosure.
  • the DDNMF network element of the second UE or the PKMF network element of the second UE will receive the discovery request message sent by the second UE, and the discovery request message is used to request an authorization token for the second UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE; afterwards, a first authorization request message will be sent to the server or UDM network element; and a first authorization response message will be received from the server or UDM network element, and the first authorization response message includes the authorization token of the second UE generated by the server or UDM network element; finally, the DDNMF network element of the second UE or the PKMF network element of the second UE will send a discovery response message to the second UE, and the discovery response message includes the authorization token.
  • the UE can obtain the authorization token generated by the network device for the UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE. Based on this, when the discovery process is performed between subsequent UEs, the two UEs can exchange their respective authorization tokens, so that both UEs can perform authorization verification on the UE role declared by the other UE based on the authorization token of the other UE, thereby avoiding mutual deception between UEs, improving the accuracy of service execution, and improving information security.
  • the key information can be used to: provide security protection for the subsequent process of the UE discovering other UEs, to ensure that when the UE transmits the UE role and the UE authorization token in the subsequent discovery process, unrelated UEs cannot monitor or tamper with the UE role, and cannot obtain the UE authorization token, thereby preventing unrelated UEs from impersonating the UE role, avoiding interference from other unrelated UEs in the subsequent service execution process, and further improving the accuracy of service execution and information security.
  • FIG6 is a flow chart of a method for generating an authorization token of a UE provided in an embodiment of the present disclosure. The method is executed by a server or a UDM network element. As shown in FIG6 , the method for generating an authorization token of a UE may include the following steps:
  • Step 601 Receive a first authorization request message sent by a DDNMF network element or a PKMF network element of a first UE and/or a second UE, where the first authorization request message is used to request an authorization token for the first UE and/or the second UE, and the authorization token is used to perform authorization verification on a UE role declared by the UE.
  • the first authorization request message includes at least one of the following:
  • the first UE and/or the second UE requests a service to be discovered
  • the capabilities of the first UE and/or the second UE are provided.
  • Step 602 Send a first authorization response message to the DDNMF network element or PKMF network element of the first UE and/or the second UE, where the first authorization response message includes an authorization token of the first UE and/or the second UE, or first authorization information and/or second authorization information; wherein the first authorization information includes authorization-related information of the first UE, and the second authorization information includes authorization-related information of the second UE.
  • steps 601 - 602 For the detailed principle introduction of steps 601 - 602 , reference may be made to the description of the aforementioned embodiment.
  • a server or UDM network element will receive a first authorization request message sent by a DDNMF network element or a PKMF network element of the first UE and/or the second UE, and the first authorization request message is used to request an authorization token for the first UE and/or the second UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE; thereafter, the server or UDM network element will send a first authorization response message to the DDNMF network element or the PKMF network element of the first UE and/or the second UE, and the first authorization response message includes the authorization token of the first UE and/or the second UE, or the first authorization information and/or the second authorization information; wherein the first authorization information includes authorization-related information of the first UE, and the second authorization information includes authorization-related information of the second UE.
  • an authorization token can be generated for a UE in the present disclosure, and the authorization token is used to perform authorization verification on the UE role declared by the UE. Based on this, when the discovery process is performed between subsequent UEs, the two UEs can exchange their respective authorization tokens so that both UEs can perform authorization verification on the UE role declared by the other UE based on the authorization token of the other UE, thereby avoiding mutual deception between UEs, improving the accuracy of service execution, and improving information security.
  • FIG. 7 is a flow chart of a method for generating an authorization token of a UE provided in an embodiment of the present disclosure. The method is executed by a server or a UDM network element. As shown in FIG. 7 , the method for generating an authorization token of a UE may include the following steps:
  • Step 701 Generate an authorization token for the first UE and/or the second UE based on the role authorized by the server or the UDM network element for the first UE and/or the second UE.
  • a server or UDM network element will receive a first authorization request message sent by a DDNMF network element or a PKMF network element of the first UE and/or the second UE, and the first authorization request message is used to request an authorization token for the first UE and/or the second UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE; thereafter, the server or UDM network element will send a first authorization response message to the DDNMF network element or the PKMF network element of the first UE and/or the second UE, and the first authorization response message includes the authorization token of the first UE and/or the second UE, or the first authorization information and/or the second authorization information; wherein the first authorization information includes authorization-related information of the first UE, and the second authorization information includes authorization-related information of the second UE.
  • an authorization token can be generated for a UE in the present disclosure, and the authorization token is used to perform authorization verification on the UE role declared by the UE. Based on this, when the discovery process is performed between subsequent UEs, the two UEs can exchange their respective authorization tokens so that both UEs can perform authorization verification on the UE role declared by the other UE based on the authorization token of the other UE, thereby avoiding mutual deception between UEs, improving the accuracy of service execution, and improving information security.
  • FIG8 is a flow chart of a method for generating an authorization token of a UE provided in an embodiment of the present disclosure. The method is executed by a server or a UDM network element. As shown in FIG8 , the method for generating an authorization token of a UE may include the following steps:
  • Step 801 Determine first authorization information and/or second authorization information based on subscription information of the first UE and/or the second UE.
  • a server or UDM network element will receive a first authorization request message sent by a DDNMF network element or a PKMF network element of the first UE and/or the second UE, and the first authorization request message is used to request an authorization token for the first UE and/or the second UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE; thereafter, the server or UDM network element will send a first authorization response message to the DDNMF network element or the PKMF network element of the first UE and/or the second UE, and the first authorization response message includes the authorization token of the first UE and/or the second UE, or the first authorization information and/or the second authorization information; wherein the first authorization information includes authorization-related information of the first UE, and the second authorization information includes authorization-related information of the second UE.
  • an authorization token can be generated for a UE in the present disclosure, and the authorization token is used to perform authorization verification on the UE role declared by the UE. Based on this, when the discovery process is performed between subsequent UEs, the two UEs can exchange their respective authorization tokens so that both UEs can perform authorization verification on the UE role declared by the other UE based on the authorization token of the other UE, thereby avoiding mutual deception between UEs, improving the accuracy of service execution, and improving information security.
  • FIG9a is a flow chart of a method for generating an authorization token of a UE provided in an embodiment of the present disclosure. The method is executed by a first UE. As shown in FIG9a , the method for generating an authorization token of the UE may include the following steps:
  • Step 901a Receive a second authorization request message sent by the DDNMF network element of the first UE or the PKMF network element of the first UE.
  • Step 902a determine the third authorization information based on the contract information of the first UE and the contract information of the second UE.
  • Step 903a Send a second authorization response message to the DDNMF network element of the first UE or the PKMF network element of the first UE, where the second authorization response message includes third authorization information, where the third authorization information at least indicates a matching relationship between the first UE and the second UE in the services requested to be discovered by the two UEs.
  • a server or UDM network element will receive a first authorization request message sent by a DDNMF network element or a PKMF network element of the first UE and/or the second UE, and the first authorization request message is used to request an authorization token for the first UE and/or the second UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE; thereafter, the server or UDM network element will send a first authorization response message to the DDNMF network element or the PKMF network element of the first UE and/or the second UE, and the first authorization response message includes the authorization token of the first UE and/or the second UE, or the first authorization information and/or the second authorization information; wherein the first authorization information includes authorization-related information of the first UE, and the second authorization information includes authorization-related information of the second UE.
  • an authorization token can be generated for a UE in the present disclosure, and the authorization token is used to perform authorization verification on the UE role declared by the UE. Based on this, when the discovery process is performed between subsequent UEs, the two UEs can exchange their respective authorization tokens so that both UEs can perform authorization verification on the UE role declared by the other UE based on the authorization token of the other UE, thereby avoiding mutual deception between UEs, improving the accuracy of service execution, and improving information security.
  • FIG9b is a flow chart of a method for role authorization of a UE provided in an embodiment of the present disclosure. The method is executed by a first UE. As shown in FIG9b , the method for role authorization of the UE may include the following steps:
  • Step 901b Send a discovery request message to the DDNMF network element of the first UE or the PKMF network element of the first UE, where the discovery request message is used to request an authorization token for the first UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE;
  • Step 902b Receive a discovery response message sent by the DDNMF network element of the first UE or the PKMF network element of the first UE, where the discovery response message includes the authorization token of the first UE, the role of the first UE, and the key information corresponding to the service requested to be discovered by the first UE.
  • the first UE will send a discovery request message to the DDNMF network element of the first UE or the PKMF network element of the first UE, the discovery request message is used to request an authorization token for the first UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE; the first UE will receive a discovery response message sent by the DDNMF network element of the first UE or the PKMF network element of the first UE, and the discovery response message includes the authorization token of the first UE.
  • the UE can obtain the authorization token generated by the network device for the UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE. Based on this, when the discovery process is performed between subsequent UEs, the two UEs can exchange their respective authorization tokens, so that both UEs can perform authorization verification on the UE role declared by the other UE based on the authorization token of the other UE, thereby avoiding mutual deception between UEs, improving the accuracy of service execution, and improving information security.
  • the key information can be used to: perform security protection on the subsequent process of the UE discovering other UEs, to ensure that when the UE transmits the UE role and the UE authorization token during the subsequent discovery process, unrelated UEs cannot eavesdrop or tamper with the UE role, and cannot obtain the UE authorization token, thereby preventing unrelated UEs from impersonating the UE role, avoiding interference from other unrelated UEs during the subsequent service execution, and further improving the accuracy of service execution and information security.
  • FIG10 is a flow chart of a method for generating an authorization token of a UE provided in an embodiment of the present disclosure. The method is executed by a first UE. As shown in FIG10 , the method for generating an authorization token of the UE may include the following steps:
  • Step 1001 broadcast a first discovery message, where the first discovery message is protected by key information corresponding to a service requested to be discovered by a first UE, and includes a role of the first UE, an authorization token of the first UE, and an application code corresponding to the service requested to be discovered by the first UE.
  • the first UE broadcasts a first discovery message protected by the key information corresponding to the service requested to be discovered by the first UE, and the key information corresponding to the service requested to be discovered by the second UE is the same as the security key corresponding to the service requested to be discovered by the first UE. Therefore, the second UE can use the same key information to successfully verify the first discovery message broadcast by the first UE, and achieve successful discovery with the first UE. After that, the second UE can verify whether the role of the second UE matches the role of the first UE, and authorize the role verification of the first UE included in the first broadcast message through the authorization token of the first UE, so as to ensure whether a connection is established with the first UE in the future.
  • the first UE will send a discovery request message to the DDNMF network element of the first UE or the PKMF network element of the first UE, the discovery request message is used to request an authorization token for the first UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE; the first UE will receive a discovery response message sent by the DDNMF network element of the first UE or the PKMF network element of the first UE, and the discovery response message includes the authorization token of the first UE.
  • the UE can obtain the authorization token generated by the network device for the UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE. Based on this, when the discovery process is performed between subsequent UEs, the two UEs can exchange their respective authorization tokens, so that both UEs can perform authorization verification on the UE role declared by the other UE based on the authorization token of the other UE, thereby avoiding mutual deception between UEs, improving the accuracy of service execution, and improving information security.
  • the key information can be used to: perform security protection on the subsequent process of the UE discovering other UEs, to ensure that when the UE transmits the UE role and the UE authorization token during the subsequent discovery process, unrelated UEs cannot eavesdrop or tamper with the UE role, and cannot obtain the UE authorization token, thereby preventing unrelated UEs from impersonating the UE role, avoiding interference from other unrelated UEs during the subsequent service execution, and further improving the accuracy of service execution and information security.
  • FIG. 11 is a flow chart of a method for generating an authorization token of a UE provided in an embodiment of the present disclosure. The method is executed by a first UE. As shown in FIG. 11 , the method for generating an authorization token of the UE may include the following steps:
  • Step 1101 receive a second discovery message broadcast by a second UE, where the second discovery message is protected by key information corresponding to a service requested to be discovered by the second UE, and includes a role of the second UE, an authorization token of the second UE, and an application code corresponding to the service requested to be discovered by the second UE.
  • Step 1102 decode and verify the second discovery message based on the key information corresponding to the service requested to be discovered by the first UE; in response to successful verification, determine whether the application code corresponding to the service requested to be discovered by the second UE is consistent with the application code corresponding to the service requested to be discovered by the first UE, if consistent, determine whether the role of the second UE matches the role of the first UE, and authorize the role of the second UE included in the second discovery message based on the authorization token of the second UE.
  • the principle of the first UE using key information to verify the second discovery message can be described in the above-mentioned embodiment. If the application code corresponding to the service requested to be discovered by the second UE is consistent with the application code corresponding to the service requested to be discovered by the first UE, it means that the two UEs request to discover the same service. At this time, it can be further determined whether the roles of the two UEs match, and the role of the second UE included in the second discovery message is authorized based on the authorization token of the second UE. If it matches and the authorization is successful, it means that the two UEs can cooperate to complete the service requested to be discovered by the two UEs and the second UE has not deceived the first UE.
  • the two UEs can establish a connection to complete the service. If it does not match, it means that the two UEs cannot complete the service requested to be discovered by the two UEs, or, if the authorization fails, it means that the second UE has deceived the first UE. At this time, the two UEs do not establish a connection.
  • Step 1103 in response to the role of the first UE matching the role of the second UE and the successful authorization of the role of the second UE included in the second discovery message, a first response message is sent to the second UE, the first response message is protected by the key information corresponding to the service requested to be discovered by the first UE, and the first response message includes the authorization token of the first UE, the role of the first UE and the application code corresponding to the service requested to be discovered by the first UE.
  • the above steps 1101-1103 are the discovery process of the first UE and the second UE. After the two UEs discover each other, a connection can be established to realize the service.
  • the first UE will send a discovery request message to the DDNMF network element of the first UE or the PKMF network element of the first UE, the discovery request message is used to request an authorization token for the first UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE; the first UE will receive a discovery response message sent by the DDNMF network element of the first UE or the PKMF network element of the first UE, and the discovery response message includes the authorization token of the first UE.
  • the UE can obtain the authorization token generated by the network device for the UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE. Based on this, when the discovery process is performed between subsequent UEs, the two UEs can exchange their respective authorization tokens, so that both UEs can perform authorization verification on the UE role declared by the other UE based on the authorization token of the other UE, thereby avoiding mutual deception between UEs, improving the accuracy of service execution, and improving information security.
  • the key information can be used to: perform security protection on the subsequent process of the UE discovering other UEs, to ensure that when the UE transmits the UE role and the UE authorization token during the subsequent discovery process, unrelated UEs cannot eavesdrop or tamper with the UE role, and cannot obtain the UE authorization token, thereby preventing unrelated UEs from impersonating the UE role, avoiding interference from other unrelated UEs during the subsequent service execution, and further improving the accuracy of service execution and information security.
  • FIG. 12 is a flow chart of a method for generating an authorization token of a UE provided in an embodiment of the present disclosure. The method is executed by a second UE. As shown in FIG. 12 , the method for generating an authorization token of the UE may include the following steps:
  • Step 1201 Send a discovery request message to the DDNMF network element of the second UE or the PKMF network element of the second UE, where the discovery request message is used to request an authorization token for the first UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE;
  • Step 1202 Receive a discovery response message sent by the DDNMF network element of the second UE or the PKMF network element of the second UE, where the discovery response message includes the authorization token of the first UE, the role of the second UE, and the key information corresponding to the service requested to be discovered by the second UE.
  • the second UE in the method for generating the authorization token of the UE provided in the embodiment of the present disclosure, will send a discovery request message to the DDNMF network element of the second UE or the PKMF network element of the second UE, and the discovery request message is used to request an authorization token for the second UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE; the second UE will receive a discovery response message sent by the DDNMF network element of the second UE or the PKMF network element of the second UE, and the discovery response message includes the authorization token of the second UE.
  • the UE can obtain the authorization token generated by the network device for the UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE. Based on this, when the discovery process is performed between subsequent UEs, the two UEs can exchange their respective authorization tokens, so that both UEs can perform authorization verification on the UE role declared by the opposite UE based on the authorization token of the opposite UE, thereby avoiding mutual deception between UEs, improving the accuracy of service execution, and improving information security.
  • the key information can be used to: perform security protection on the subsequent process of the UE discovering other UEs, to ensure that when the UE transmits the UE role and the UE authorization token during the subsequent discovery process, unrelated UEs cannot eavesdrop or tamper with the UE role, and cannot obtain the UE authorization token, thereby preventing unrelated UEs from impersonating the UE role, avoiding interference from other unrelated UEs during the subsequent service execution, and further improving the accuracy of service execution and information security.
  • FIG. 13 is a flow chart of a method for generating an authorization token of a UE provided in an embodiment of the present disclosure. The method is executed by a second UE. As shown in FIG. 13 , the method for generating an authorization token of the UE may include the following steps:
  • Step 1301 receive a first discovery message broadcast by a first UE, the first discovery message is protected by key information corresponding to a service requested to be discovered by the first UE, and the first discovery message includes an authorization token of the first UE, a role of the first UE, and an application code corresponding to the service requested to be discovered by the first UE.
  • Step 1302 decode and verify the first discovery message based on the key information corresponding to the service requested to be discovered by the second UE; in response to successful verification, determine whether the application code corresponding to the service requested to be discovered by the first UE is consistent with the application code corresponding to the service requested to be discovered by the second UE, and if they are consistent, determine whether the role of the second UE matches the role of the first UE, and authorize the role of the first UE included in the first discovery message based on the authorization token of the first UE.
  • the second UE in the method for generating the authorization token of the UE provided in the embodiment of the present disclosure, will send a discovery request message to the DDNMF network element of the second UE or the PKMF network element of the second UE, and the discovery request message is used to request an authorization token for the second UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE; the second UE will receive a discovery response message sent by the DDNMF network element of the second UE or the PKMF network element of the second UE, and the discovery response message includes the authorization token of the second UE.
  • the UE can obtain the authorization token generated by the network device for the UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE. Based on this, when the discovery process is performed between subsequent UEs, the two UEs can exchange their respective authorization tokens, so that both UEs can perform authorization verification on the UE role declared by the opposite UE based on the authorization token of the opposite UE, thereby avoiding mutual deception between UEs, improving the accuracy of service execution, and improving information security.
  • the key information can be used to: perform security protection on the subsequent process of the UE discovering other UEs, to ensure that when the UE transmits the UE role and the UE authorization token during the subsequent discovery process, unrelated UEs cannot eavesdrop or tamper with the UE role, and cannot obtain the UE authorization token, thereby preventing unrelated UEs from impersonating the UE role, avoiding interference from other unrelated UEs during the subsequent service execution, and further improving the accuracy of service execution and information security.
  • FIG. 14 is a flow chart of a method for generating an authorization token of a UE provided in an embodiment of the present disclosure. The method is executed by a second UE. As shown in FIG. 14 , the method for generating an authorization token of the UE may include the following steps:
  • Step 1401 broadcast a second discovery message, where the second discovery message is protected by the key information corresponding to the service requested to be discovered by the second UE, and includes the authorization token of the second UE, the role of the second UE, and the application code corresponding to the service requested to be discovered by the second UE.
  • Step 1402 receive a first response message sent by the first UE, the first response message is protected by the key information corresponding to the service requested to be discovered by the first UE, and the first response message includes the authorization token of the first UE, the role of the first UE and the application code corresponding to the service requested to be discovered by the first UE.
  • Step 1403 decode and verify the first response message based on the key information corresponding to the service requested to be discovered by the second UE; in response to successful verification, determine whether the role of the second UE matches the role of the first UE, and authorize the role of the first UE included in the first response message based on the authorization token of the first UE.
  • the second UE in the method for generating the authorization token of the UE provided in the embodiment of the present disclosure, will send a discovery request message to the DDNMF network element of the second UE or the PKMF network element of the second UE, and the discovery request message is used to request an authorization token for the second UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE; the second UE will receive a discovery response message sent by the DDNMF network element of the second UE or the PKMF network element of the second UE, and the discovery response message includes the authorization token of the second UE.
  • the UE can obtain the authorization token generated by the network device for the UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE. Based on this, when the discovery process is performed between subsequent UEs, the two UEs can exchange their respective authorization tokens, so that both UEs can perform authorization verification on the UE role declared by the opposite UE based on the authorization token of the opposite UE, thereby avoiding mutual deception between UEs, improving the accuracy of service execution, and improving information security.
  • the key information can be used to: perform security protection on the subsequent process of the UE discovering other UEs, to ensure that when the UE transmits the UE role and the UE authorization token during the subsequent discovery process, unrelated UEs cannot eavesdrop or tamper with the UE role, and cannot obtain the UE authorization token, thereby preventing unrelated UEs from impersonating the UE role, avoiding interference from other unrelated UEs during the subsequent service execution, and further improving the accuracy of service execution and information security.
  • FIG. 15 is a schematic diagram of an interaction flow of a method for generating an authorization token of a UE provided in an embodiment of the present disclosure, as shown in FIG. 15 , including:
  • A-UE (which may be the first UE in the above embodiment) sends a discovery request message containing the ranging application user ID (RAUID) to its 5G DDNMF/PKMF to obtain the ranging application code to announce and obtain related key information.
  • A-UE should include its UE ranging service capabilities (i.e., the "capabilities of the first UE" in the above embodiment, for example, the ability to act as a target/server UE) in the discovery request message.
  • the 5G DDNMF/PKMF of A-UE sends a first authorization request message to the ranging/SL positioning server or UDM of A-UE to announce the authorization, which contains the UE's capability for ranging service received from A-UE.
  • the ranging/SL positioning server checks the service agreement or the A-UE's UDM checks the A-UE's subscription to determine whether the A-UE is allowed to play a role corresponding to its capabilities (e.g., whether the A-UE is allowed to act as a target/server UE).
  • the A-UE's ranging/SL positioning server or UDM then generates an authorization token (Auth-Token) for the A-UE based on the authorization-related information in the subscription or service agreement.
  • Auth-Token authorization token
  • the ranging/SL positioning server or the UDM of the A-UE returns a first authorization response message containing the role of the A-UE and the authorization token of the A-UE to the 5G DDNMF/PKMF. If the UE capabilities and the allowed roles do not match (for example, the A-UE is not allowed to act as a target UE or a server UE), the Ranging/SL positioning server or the UDM A-UE returns a first authorization response message containing the reason for the failure.
  • the 5G DDNMF/PKMF of A-UE returns the ranging application code and the corresponding key information in the discovery response message.
  • the key information provides the A-UE with the necessary information to protect the transmission of the ranging application code and is stored together with the ranging application code.
  • the 5G DDNMF/PKMF of A-UE also includes the role of A-UE and the authorization token of A-UE received from the Ranging/SL positioning server or the UDM of A-UE in the discovery response message. If the authorization with the Ranging/SL positioning server or UDM of A-UE fails, the 5G DDNMF/PKMF of A-UE does not generate key information and rejects the discovery request from A-UE.
  • the M-UE (which may be the second UE in the above embodiment) sends a discovery request message containing the ranging application user ID (RAUID) to its 5G DDNMF/PKMF to obtain the ranging application code to announce and obtain related key information.
  • the M-UE should include its UE ranging service capabilities (i.e., the "capabilities of the second UE" in the above embodiment, for example, the ability to act as a reference/positioning UE) in the discovery request message.
  • the 5G DDNMF/PKMF of M-UE sends a first authorization request message to the Ranging/SL positioning server or the UDM of M-UE, which contains the UE capabilities of the ranging service received from the M-UE.
  • the Ranging/SL positioning server checks the service agreement or the M-UE's UDM checks the M-UE's subscription to determine whether the M-UE is allowed to play a role corresponding to its capabilities (e.g., whether the M-UE is allowed to act as a reference/positioning UE).
  • the M-UE's ranging/SL positioning server or UDM then generates an authorization token (Auth-Token) for the M-UE based on the authorization-related information in the subscription or service agreement.
  • Auth-Token authorization token
  • the ranging/SL positioning server or the UDM of the M-UE returns a first authorization response message to the 5G DDNMF/PKMF, which contains the role of the M-UE and the authorization token of the M-UE. If the UE capabilities and the allowed roles do not match (e.g., the M-UE is not allowed to act as a reference UE or a positioning UE), the Ranging/SL positioning server or the UDM M-UE returns a first authorization response message containing the reason for the failure.
  • the 5G DDNMF/PKMF of M-UE contacts the 5G DDNMF/PKMF of A-UE by sending a monitoring request message. If the authorization with the Ranging/SL positioning server or the UDM of A-UE fails, the 5G DDNMF/PKMF of M-UE rejects the Discovery Request of M-UE and does not execute the following steps.
  • A-UE s 5G DDNMF/PKMF sends a second authorization request message to the Ranging/SL positioning server, which includes the roles of M-UE and A-UE.
  • the Ranging/SL positioning server checks whether the roles of M-UE and A-UE match each other in the requested service (for example, for the ranging service between two UEs, whether the roles of the two UEs are Target UE and Reference UE respectively, or whether they are positioning UE and target UE respectively. If so, they are used for the Ranging/SL positioning service between the two UEs).
  • the Ranging/SL positioning server returns a second authorization response message, indicating whether the authorization is successful.
  • the 5G DDNMF/PKMF of A-UE responds to the 5G DDNMF/PKMF of M-UE with a monitoring response message, including the ranging application code and the corresponding key information (the security key is the same as the security key fed back to A-UE).
  • the key information provides the information required by M-UE to revoke the protection applied by A-UE (i.e., the information required to verify the message transmitted by A-UE).
  • the 5G DDNMF/PKMF of A-UE rejects the monitoring request message from the 5G DDNMF/PKMF of M-UE and does not perform the following steps.
  • the 5G DDNMF/PKMF of the M-UE returns the key information in the discovery response message, as well as the role of the M-UE and the authorization token of the M-UE received from the ranging/SL positioning server or the UDM of the M-UE.
  • FIG. 16a is a schematic diagram of an interaction flow of a method for generating an authorization token of a UE provided in an embodiment of the present disclosure, as shown in FIG. 16a , including:
  • Steps 1 to 2 of the embodiment of FIG. 16 a are the same as steps 1 to 2 of FIG. 15 .
  • the ranging/SL positioning server checks the service agreement or the A-UE's UDM checks the A-UE's subscription to determine whether the A-UE is allowed to play a role corresponding to its capabilities (e.g., whether the A-UE is allowed to act as a target/server UE).
  • the ranging/SL positioning server or the UDM of the A-UE returns a first authorization response to the 5G DDNMF/PKMF, which contains the matching A-UE role and the authorization-related information in the subscription or service agreement of the A-UE (i.e., the first authorization information mentioned above).
  • A-UE's 5G DDNMF/PKMF generates an authorization token for A-UE based on the received authorization-related information (i.e., the first authorization information mentioned above).
  • Steps in the embodiment of FIG. 16a Step 6 is the same as step 5 in FIG. 15 ;
  • Steps 7-8 of the embodiment of FIG. 16a are the same as steps 6-7 of FIG. 15 ;
  • the Ranging/SL positioning server checks the service agreement or the M-UE's UDM checks the M-UE's subscription to determine whether the M-UE is allowed to play a role corresponding to its capabilities (e.g., whether the M-UE is allowed to act as a reference/positioning UE).
  • the ranging/SL positioning server or the UDM of the M-UE returns an authorization response to the 5G DDNMF/PKMF, which contains the matching role of the M-UE and the authorization-related information in the subscription or service agreement of the M-UE (i.e., the second authorization information mentioned above).
  • Steps 11-13 of the embodiment of FIG. 16a are the same as steps 10-12 of FIG. 15 ;
  • the Ranging/SL positioning server or UDM returns a second authorization response, indicating whether the authorization is successful.
  • the response may also include more authorization information about the association between the A-UE and the M-UE in the requested service (ie, the third authorization information in the above embodiment).
  • the 5G DDNMF/PKMF of A-UE responds with a monitoring response message to the 5G DDNMF/PKMF of M-UE, including the corresponding key information and authorization information about the association between A-UE and M-UE in the requested service (i.e. the third authorization information mentioned above).
  • the 5G DDNMF/PKMF of M-UE generates an authorization token for the M-UE based on the authorization-related information received in steps #10 and #15 (i.e., the second authorization information and the third authorization information of the above-mentioned embodiment).
  • Step 17 of the embodiment of FIG. 16 a is the same as step 15 of FIG. 15 .
  • FIG. 16b is a schematic diagram of an interaction flow of a method for generating an authorization token of a UE provided in an embodiment of the present disclosure, as shown in FIG. 16b , including:
  • Step 1 A-UE starts the first discovery message.
  • A-UE forms an announcement message and protects it with key information.
  • the announcement message also contains the role of A-UE that allows it to act and the authorization token of A-UE provided by the network.
  • Step 2 The M-UE listens to and receives the first discovery message containing the authorization token of the A-UE, and verifies the message using the key information.
  • Step 3 The M-UE checks the role of the A-UE and determines whether the role of the A-UE is the role it monitors, for example: if the role of the A-UE is the target UE, and the M-UE as the reference UE can determine that it has found a match.
  • the M-UE uses the authorization token of the A-UE received from the A-UE to further authorize the UE role declared by the A-UE (i.e., the role of the A-UE included in the first discovery message).
  • FIG. 16c is a schematic diagram of an interaction flow of a method for generating an authorization token of a UE provided in an embodiment of the present disclosure, as shown in FIG. 16c , including:
  • the M-UE forms a second discovery message and broadcasts it after protecting it with key information.
  • the second discovery message also contains the roles that the M-UE is allowed to perform and its authorization token provided by the network.
  • A-UE listens to the second discovery message and verifies the message with the key information, then A-UE checks the role of M-UE in the second discovery message and determines whether the role of M-UE in the second discovery message is monitored by it. For example, if the role of M-UE is the target UE, and A-UE as a located UE can determine that it has found a match. Then, A-UE uses the authorization token of M-UE received from M-UE to further authorize the role contained in the second discovery message of M-UE.
  • A-UE returns a first response message to M-UE, which includes the role of A-UE and the authorization token of A-UE provided by the network.
  • the M-UE uses the key information to verify the discovery first response message, and then the M-UE checks the A-UE role in the first response message and determines whether the A-UE role is the role it requested, and then the M-UE uses the authorization token of A-UE received from A-UE to further authorize the UE role declared in the first response message of A-UE.
  • FIG. 17 is a schematic diagram of the structure of a communication device provided by an embodiment of the present disclosure. As shown in FIG. 17 , the device may include:
  • a transceiver module used to receive a discovery request message sent by the first UE and/or the second UE, wherein the discovery request message is used to request an authorization token for the first UE and/or the second UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE;
  • the transceiver module is further used to send a discovery response message to the first UE and/or the second UE, where the discovery response message includes an authorization token generated by the network device for the first UE and/or the second UE.
  • the network device can receive a discovery request message sent by the first UE and/or the second UE, and the discovery request message is used to request an authorization token for the first UE and/or the second UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE; thereafter, the network device can send a discovery response message to the first UE and/or the second UE, and the discovery response message includes the authorization token generated by the network device for the first UE and/or the second UE.
  • the UE can obtain the authorization token generated by the network device for the UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE.
  • the two UEs can exchange their respective authorization tokens, so that both UEs can perform authorization verification on the UE role declared by the other UE based on the authorization token of the other UE, thereby avoiding mutual deception between UEs, improving the accuracy of service execution, and improving information security.
  • the key information can be used to: perform security protection on the subsequent process of the UE discovering other UEs, to ensure that when the UE transmits the UE role and the UE authorization token during the subsequent discovery process, unrelated UEs cannot eavesdrop or tamper with the UE role, and cannot obtain the UE authorization token, thereby preventing unrelated UEs from impersonating the UE role, avoiding interference from other unrelated UEs during the subsequent service execution, and further improving the accuracy of service execution and information security.
  • the authorization token of the first UE and/or the second UE at least indicates a role authorized by a server or a unified data management (UDM) network element for the first UE and/or the second UE;
  • UDM unified data management
  • the authorization token of the first UE is used to: during the discovery process, the peer UE of the first UE performs authorization verification on the role of the first UE declared by the first UE;
  • the authorization token of the second UE is used for: during the discovery process, the peer UE of the second UE performs authorization verification on the role of the second UE declared by the second UE.
  • the discovery request message includes at least one of the following:
  • the capabilities of the first UE and/or the second UE are provided.
  • the network side device includes: a first network element, a second network element and a third network element, the first network element includes a proximity communication service name management function DDNMF network element of the first UE or a proximity communication service key management function PKMF network element of the first UE, the second network element includes the DDNMF network element of the second UE or the PKMF network element of the second UE, and the third network element includes a server for ranging and positioning services or a unified data management UDM network element.
  • the first network element receives a discovery request message sent by the first UE
  • the first network element sends a discovery response message to the first UE
  • the first network element sends a first authorization request message to the third network element
  • the third network element sends a first authorization response message to the first network element, where the first authorization response message includes an authorization token of the first UE generated by the third network element, or first authorization information determined by the third network element, where the first authorization information includes authorization-related information of the first UE.
  • the first network element generates an authorization token for the first UE based on the first authorization information.
  • the second network element receives a discovery request message sent by the second UE
  • the second network element sends a discovery response message to the second UE
  • the second network element sends a first authorization request message to the third network element
  • the third network element sends a first authorization response message to the second network element, where the first authorization response message includes an authorization token of the second UE generated by the third network element; or second authorization information determined by the third network element, where the second authorization information includes authorization-related information of the second UE.
  • the second network element sends a monitoring request message to the first network element
  • the first network element sends a second authorization request message to the third network element
  • the third network element sends a second authorization response message to the first network element, where the second authorization response message includes third authorization information, where the third authorization information at least indicates a matching relationship between a role of the first UE and a role of the second UE in services requested to be discovered by the two UEs;
  • the first network element sends a monitoring response message to the second network element, where the monitoring response message includes the third authorization information.
  • FIG. 18 is a schematic diagram of the structure of a communication device provided by an embodiment of the present disclosure. As shown in FIG. 18 , the device may include:
  • a transceiver module configured to send a discovery request message to a network device, wherein the discovery request message is used to request an authorization token for the first UE, and the authorization token is used to perform authorization verification on a UE role declared by the first UE;
  • the transceiver module is further used to receive a discovery response message sent by the network device, where the discovery response message includes an authorization token of the first UE.
  • the first UE can send a discovery request message to the network device, and the discovery request message is used to request an authorization token for the first UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE; thereafter, the first UE can receive a discovery response message sent by the network device, and the discovery response message includes the authorization token of the first UE. It can be seen that in the present disclosure, the UE can obtain the authorization token generated by the network device for the UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE.
  • the two UEs can exchange their respective authorization tokens, so that both UEs can perform authorization verification on the UE role declared by the other UE based on the authorization token of the other UE, thereby avoiding mutual deception between UEs, improving the accuracy of service execution, and improving information security.
  • the key information can be used to: perform security protection on the subsequent process of the UE discovering other UEs, to ensure that when the UE transmits the UE role and the UE authorization token during the subsequent discovery process, irrelevant UEs cannot eavesdrop or tamper with the UE role, and cannot obtain the UE authorization token, thereby preventing irrelevant UEs from impersonating the UE role, avoiding interference from other irrelevant UEs during the subsequent service execution, and further improving the accuracy of service execution and information security.
  • the authorization token of the first UE at least indicates a role authorized by the network device for the first UE.
  • the device is further used for:
  • the first discovery message is protected by key information corresponding to a service requested to be discovered by the first UE; and/or,
  • the first response message is protected by the key information corresponding to the service discovered according to the second UE request.
  • the device is further used for:
  • a second response message is sent to the second UE.
  • the second discovery message also includes a role of the second UE
  • the apparatus Before sending the second response message to the second UE, the apparatus is further configured to:
  • the second response message carries an authorization token of the first UE, which is used by the second UE to determine whether the role declared by the first UE is a role authorized by the network device.
  • the second discovery message is protected by key information corresponding to a service requested to be discovered by the second UE; and/or,
  • the second response message is protected by the key information corresponding to the service discovered according to the first UE request.
  • FIG. 19 is a schematic diagram of the structure of a communication device provided by an embodiment of the present disclosure. As shown in FIG. 19 , the device may include:
  • a transceiver module configured to send a discovery request message to a network device, wherein the discovery request message is used to request an authorization token for the second UE, and the authorization token is used to perform authorization verification on a UE role declared by the second UE;
  • the transceiver module is further used to receive a discovery response message sent by the network device, where the discovery response message includes an authorization token of the second UE.
  • the second UE can send a discovery request message to the network device, and the discovery request message is used to request an authorization token for the second UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE; thereafter, the second UE can receive a discovery response message sent by the network device, and the discovery response message includes the authorization token of the second UE. It can be seen that in the present disclosure, the UE can obtain the authorization token generated by the network device for the UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE.
  • the two UEs can exchange their respective authorization tokens, so that both UEs can perform authorization verification on the UE role declared by the other UE based on the authorization token of the other UE, thereby avoiding mutual deception between UEs, improving the accuracy of service execution, and improving information security.
  • the key information can be used to: perform security protection on the subsequent process of the UE discovering other UEs, to ensure that when the UE transmits the UE role and the UE authorization token during the subsequent discovery process, unrelated UEs cannot eavesdrop or tamper with the UE role, and cannot obtain the UE authorization token, thereby preventing unrelated UEs from impersonating the UE role, avoiding interference from other unrelated UEs during the subsequent service execution, and further improving the accuracy of service execution and information security.
  • the device is further used for:
  • a first response message is sent to the first UE.
  • the first discovery message further includes a role of the first UE
  • the device is also used for:
  • the first discovery message is protected by key information corresponding to a service requested to be discovered by the first UE; and/or,
  • the first response message is protected by the key information corresponding to the service discovered according to the second UE request.
  • the device is further used for:
  • Verify based on the authorization token of the first UE, whether the role declared by the first UE is a role authorized by the network device.
  • the second response message further includes a role of the first UE
  • the device is also used for:
  • FIG. 20 is a schematic diagram of the structure of a communication device provided by an embodiment of the present disclosure. As shown in FIG. 20 , the device may include:
  • a transceiver module configured to receive a discovery request message sent by a first UE, wherein the discovery request message is used to request an authorization token for the first UE, and the authorization token is used to perform authorization verification on a UE role declared by the first UE;
  • the transceiver module is further used to send a first authorization request message to the server or the UDM network element;
  • the transceiver module is further used to receive a first authorization response message sent by the server or the UDM network element, where the first authorization response message includes an authorization token of the first UE generated by the server or the UDM network element, or includes the first authorization information, where the first authorization information includes information related to the authorization of the first UE;
  • the transceiver module is further used to send a discovery response message to the first UE, where the discovery response message includes an authorization token of the first UE.
  • the DDNMF network element of the first UE or the PKMF network element of the first UE will receive a discovery request message sent by the first UE, and the discovery request message is used to request an authorization token for the first UE, and the authorization token is used to perform authorization verification on the UE role declared by the first UE; afterwards, a first authorization request message will be sent to the server or UDM network element; and a first authorization response message will be received from the server or UDM network element, and the first authorization response message includes the authorization token of the first UE generated by the server or UDM network element; finally, the DDNMF network element of the first UE or the PKMF network element of the first UE will send a discovery response message to the first UE, and the discovery response message includes the authorization token.
  • the UE can obtain the authorization token generated by the network device for the UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE. Based on this, when the discovery process is performed between subsequent UEs, the two UEs can exchange their respective authorization tokens, so that both UEs can perform authorization verification on the UE role declared by the other UE based on the authorization token of the other UE, thereby avoiding mutual deception between UEs, improving the accuracy of service execution, and improving information security.
  • the key information can be used to: provide security protection for the subsequent process of the UE discovering other UEs, to ensure that when the UE transmits the UE role and the UE authorization token in the subsequent discovery process, unrelated UEs cannot monitor or tamper with the UE role, and cannot obtain the UE authorization token, thereby preventing unrelated UEs from impersonating the UE role, avoiding interference from other unrelated UEs in the subsequent service execution process, and further improving the accuracy of service execution and information security.
  • the authorization token of the first UE at least indicates a role authorized by the server or UDM network element for the first UE;
  • the authorization token of the first UE is used for: during the discovery process, the counterpart UE of the first UE performs authorization verification on the role of the first UE received and transmitted by the first UE.
  • the discovery request message includes at least one of the following:
  • the capabilities for the service supported by the first UE are the capabilities for the service supported by the first UE.
  • the device is further used for:
  • An authorization token is generated for the first UE based on the first authorization information.
  • the device is further used for:
  • FIG. 21a is a schematic diagram of the structure of a communication device provided by an embodiment of the present disclosure. As shown in FIG. 21a , the device may include:
  • a transceiver module configured to receive a discovery request message sent by a second UE, wherein the discovery request message is used to request an authorization token for the second UE, and the authorization token is used to perform authorization verification on a UE role declared by the second UE;
  • the transceiver module is further used to send a first authorization request message to the server or the UDM network element;
  • the transceiver module is further used to receive a first authorization response message sent by the server or the UDM network element, where the first authorization response message includes an authorization token of the second UE generated by the server or the UDM network element, or includes the second authorization information, where the second authorization information includes information related to the authorization of the second UE;
  • the transceiver module is further used to send a discovery response message to the second UE, where the discovery response message includes an authorization token of the second UE.
  • the DDNMF network element of the second UE or the PKMF network element of the second UE will receive a discovery request message sent by the second UE, and the discovery request message is used to request an authorization token for the second UE, and the authorization token is used to perform authorization verification on the UE role declared by the second UE; afterwards, a first authorization request message will be sent to the server or UDM network element; and a first authorization response message will be received from the server or UDM network element, and the first authorization response message includes the authorization token of the second UE generated by the server or UDM network element; finally, the DDNMF network element of the second UE or the PKMF network element of the second UE will send a discovery response message to the second UE, and the discovery response message includes the authorization token.
  • the UE can obtain the authorization token generated by the network device for the UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE. Based on this, when the discovery process is performed between subsequent UEs, the two UEs can exchange their respective authorization tokens, so that both UEs can perform authorization verification on the UE role declared by the other UE based on the authorization token of the other UE, thereby avoiding mutual deception between UEs, improving the accuracy of service execution, and improving information security.
  • the key information can be used to: provide security protection for the subsequent process of the UE discovering other UEs, to ensure that when the UE transmits the UE role and the UE authorization token in the subsequent discovery process, unrelated UEs cannot monitor or tamper with the UE role, and cannot obtain the UE authorization token, thereby preventing unrelated UEs from impersonating the UE role, avoiding interference from other unrelated UEs in the subsequent service execution process, and further improving the accuracy of service execution and information security.
  • the authorization token of the second UE at least indicates a role authorized by the server or UDM network element for the second UE;
  • the authorization token of the second UE is used for: during the discovery process, the counterpart UE of the second UE performs authorization verification on the role of the second UE received and transmitted by the second UE.
  • the discovery request message includes at least one of the following:
  • the capabilities for the service supported by the second UE are the capabilities for the service supported by the second UE.
  • the device is further used for:
  • the monitoring response message includes third authorization information, where the third authorization information at least indicates a matching relationship between the first UE and the second UE in services requested to be discovered by the two UEs;
  • An authorization token for the second UE is generated based on the second authorization information and the third authorization information.
  • FIG. 21b is a schematic diagram of the structure of a communication device provided by an embodiment of the present disclosure. As shown in FIG. 21b , the device may include:
  • a transceiver module configured to receive a first authorization request message sent by a DDNMF network element or a PKMF network element of the first UE and/or the second UE, wherein the first authorization request message is used to request an authorization token for the first UE and/or the second UE, and the authorization token is used to perform authorization verification on the UE role declared by the UE;
  • the transceiver module is used to send a first authorization response message to the DDNMF network element or PKMF network element of the first UE and/or the second UE, where the first authorization response message includes the authorization token of the first UE and/or the second UE, or the first authorization information and/or the second authorization information; wherein the first authorization information includes authorization-related information of the first UE, and the second authorization information includes authorization-related information of the second UE.
  • the server or UDM network element will receive a first authorization request message sent by the DDNMF network element or PKMF network element of the first UE and/or the second UE, and the first authorization request message is used to request an authorization role for the service requested to be discovered by the first UE and/or the second UE; and the role of the first UE and/or the second UE will be determined based on the first authorization request message; thereafter, the server or UDM network element will send a first authorization response message to the DDNMF network element or PKMF network element of the first UE and/or the second UE, and the first authorization response message includes the role of the first UE and/or the second UE.
  • the present disclosure provides a method for authorizing a role for the first UE and/or the second UE in the service requested to be discovered, wherein the role of the first UE and/or the second UE can be determined by the server or UDM network element based on the capabilities of the first UE and/or the second UE and the roles that the first UE and/or the second UE can be allowed in the service requested to be discovered by the first UE and/or the second UE, thereby ensuring that the role can be correctly authorized for the first UE and/or the second UE, and ensuring the accuracy of the service execution.
  • the device is further used for:
  • the device is further used for:
  • the first authorization information and/or the second authorization information is determined based on the subscription information of the first UE and/or the second UE.
  • the device is further used for:
  • a second authorization response message is sent to the DDNMF network element of the first UE or the PKMF network element of the first UE, where the second authorization response message includes third authorization information, and the third authorization information at least indicates a matching relationship between the first UE and the second UE in the services requested to be discovered by the two UEs.
  • the device is further used for:
  • the third authorization information is determined based on the subscription information of the first UE and the subscription information of the second UE.
  • FIG. 22 is a schematic diagram of the structure of a communication system provided by an embodiment of the present disclosure. As shown in FIG. 22 , the communication system may include:
  • a first UE used to send a discovery request message
  • a second UE is used to send a discovery request message
  • a network device configured to send a discovery response message, wherein the discovery response message includes an authorization token generated by the network device for the first UE and/or the second UE;
  • the first UE is further used to: receive the discovery response message, where the discovery response message includes an authorization token generated by the network device for the first UE;
  • the second UE is further used to: receive the discovery response message, where the discovery response message includes an authorization token generated by the network device for the second UE.
  • FIG 23 is a schematic diagram of the structure of a communication device 2300 provided in an embodiment of the present application.
  • the communication device 2300 can be a base station, or a terminal device, or a chip, a chip system, or a processor that supports the base station to implement the above method, or a chip, a chip system, or a processor that supports the terminal device to implement the above method.
  • the device can be used to implement the method described in the above method embodiment, and the details can be referred to the description in the above method embodiment.
  • the communication device 2300 may include one or more processors 2301.
  • the processor 2301 may be a general-purpose processor or a dedicated processor, etc. For example, it may be a baseband processor or a central processing unit.
  • the baseband processor may be used to process the communication protocol and communication data
  • the central processing unit may be used to control the communication device (such as a base station, a baseband chip, a terminal device, a terminal device chip, a DU or a CU, etc.), execute a computer program, and process the data of the computer program.
  • the communication device 2300 may further include one or more memories 2302, on which a computer program 2304 may be stored, and the processor 2301 executes the computer program 2304 so that the communication device 2300 performs the method described in the above method embodiment.
  • data may also be stored in the memory 2302.
  • the communication device 2300 and the memory 2302 may be provided separately or integrated together.
  • the communication device 2300 may further include a transceiver 2305 and an antenna 2306.
  • the transceiver 2305 may be referred to as a transceiver unit, a transceiver, or a transceiver circuit, etc., for implementing a transceiver function.
  • the transceiver 2305 may include a receiver and a transmitter, the receiver may be referred to as a receiver or a receiving circuit, etc., for implementing a receiving function; the transmitter may be referred to as a transmitter or a transmitting circuit, etc., for implementing a transmitting function.
  • the communication device 2300 may further include one or more interface circuits 2307.
  • the interface circuit 2307 is used to receive code instructions and transmit them to the processor 2301.
  • the processor 2301 runs the code instructions to enable the communication device 2300 to execute the method described in the above method embodiment.
  • the processor 2301 may include a transceiver for implementing the receiving and sending functions.
  • the transceiver may be a transceiver circuit, an interface, or an interface circuit.
  • the transceiver circuit, interface, or interface circuit for implementing the receiving and sending functions may be separate or integrated.
  • the above-mentioned transceiver circuit, interface, or interface circuit may be used for reading and writing code/data, or the above-mentioned transceiver circuit, interface, or interface circuit may be used for transmitting or delivering signals.
  • the processor 2301 may store a computer program 2303, which runs on the processor 2301 and enables the communication device 2300 to perform the method described in the above method embodiment.
  • the computer program 2303 may be fixed in the processor 2301, in which case the processor 2301 may be implemented by hardware.
  • the communication device 2300 may include a circuit that can implement the functions of sending or receiving or communicating in the aforementioned method embodiments.
  • the processor and transceiver described in the present application can be implemented in an integrated circuit (IC), an analog IC, a radio frequency integrated circuit RFIC, a mixed signal IC, an application specific integrated circuit (ASIC), a printed circuit board (PCB), an electronic device, etc.
  • the processor and transceiver can also be manufactured using various IC process technologies, such as complementary metal oxide semiconductor (CMOS), N-type metal oxide semiconductor (nMetal-oxide-semiconductor, NMOS), P-type metal oxide semiconductor (positive channel metal oxide semiconductor, PMOS), bipolar junction transistor (bipolar junction transistor, BJT), bipolar CMOS (BiCMOS), silicon germanium (SiGe), gallium arsenide (GaAs), etc.
  • CMOS complementary metal oxide semiconductor
  • N-type metal oxide semiconductor nMetal-oxide-semiconductor
  • PMOS bipolar junction transistor
  • BJT bipolar junction transistor
  • BiCMOS bipolar CMOS
  • SiGe silicon germanium
  • GaAs gallium arsenide
  • the communication device described in the above embodiments may be a base station or a terminal device, but the scope of the communication device described in the present application is not limited thereto, and the structure of the communication device may not be limited by FIG. 23.
  • the communication device may be an independent device or may be part of a larger device.
  • the communication device may be:
  • the IC set may also include a storage component for storing data and computer programs;
  • ASIC such as modem
  • the communication device can be a chip or a chip system
  • the communication device can be a chip or a chip system
  • the schematic diagram of the chip structure shown in Figure 24 includes a processor 2401 and an interface 2402.
  • the number of processors 2401 can be one or more, and the number of interfaces 2402 can be multiple.
  • the chip further includes a memory 2403, and the memory 2403 is used to store necessary computer programs and data.
  • the present application also provides a readable storage medium having instructions stored thereon, which implement the functions of any of the above method embodiments when executed by a computer.
  • the present application also provides a computer program product, which implements the functions of any of the above method embodiments when executed by a computer.
  • the computer program product includes one or more computer programs.
  • the computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device.
  • the computer program can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • the computer program can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center.
  • the computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more available media integrated.
  • the available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a high-density digital video disc (DVD)), or a semiconductor medium (e.g., a solid state disk (SSD)), etc.
  • a magnetic medium e.g., a floppy disk, a hard disk, a magnetic tape
  • an optical medium e.g., a high-density digital video disc (DVD)
  • DVD high-density digital video disc
  • SSD solid state disk
  • At least one in the present application can also be described as one or more, and a plurality can be two, three, four or more, which is not limited in the present application.
  • the technical features in the technical feature are distinguished by “first”, “second”, “third”, “A”, “B”, “C” and “D”, etc., and there is no order of precedence or size between the technical features described by the "first”, “second”, “third”, “A”, “B”, “C” and “D”.
  • the corresponding relationships shown in each table in the present application can be configured or predefined.
  • the values of the information in each table are only examples and can be configured as other values, which are not limited by the present application.
  • the corresponding relationships shown in some rows may not be configured.
  • appropriate deformation adjustments can be made based on the above table, such as splitting, merging, etc.
  • the names of the parameters shown in the titles in the above tables can also use other names that can be understood by the communication device, and the values or representations of the parameters can also be other values or representations that can be understood by the communication device.
  • other data structures can also be used, such as arrays, queues, containers, stacks, linear lists, pointers, linked lists, trees, graphs, structures, classes, heaps, hash tables or hash tables.
  • the predefined in the present application may be understood as defined, predefined, stored, pre-stored, pre-negotiated, pre-configured, solidified, or pre-burned.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Multimedia (AREA)
  • Computer Security & Cryptography (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本公开提出一种UE的授权令牌的生成方法/装置/设备及存储介质，所述方法包括：接收第一UE和/或第二UE发送的发现请求消息，所述发现请求消息用于为第一UE和/或第二UE请求授权令牌，所述授权令牌用于对UE所声明的UE角色进行授权验证；向所述第一UE和/或第二UE发送发现响应消息，所述发现响应消息包括所述网络设备为所述第一UE和/或所述第二UE生成的授权令牌。本公开提供的方法避免了UE间的相互欺骗，提升了服务执行的准确性，还提升了信息安全性。

Description

一种用户设备UE的授权令牌的生成方法/装置/设备及存储介质 技术领域
本公开涉及通信技术领域，尤其涉及一种UE的授权令牌的生成方法/装置/设备及存储介质。
背景技术
通信系统中，在进行测距(Ranging)服务和/或侧行链路(Sidelink，SL)定位服务时，通常需要由多个用户设备(User Equipment，UE)来分别扮演不同的角色参与完成服务，其中，UE角色可以包括参考UE(如侧行链路参考UE(SL Reference UE))、目标UE(Target UE)、辅助UE(Assistant UE)、定位UE(Located UE)、作为服务器的UE(如作为侧行链路定位服务器的UE(SL Positioning Server UE))、客户端UE(如侧行链路定位客户端UE(SL Positioning Client UE))等。
相关技术中，在执行服务之前，UE通常需要先发现对端UE。其中，在发现过程中，UE与对端UE之间会传输各自扮演的角色。
但是，在发现过程中，UE可能会欺骗对端UE，例如UE的角色为目标UE，但其向对端UE声明的UE角色(即该UE向对端UE传输的该UE的角色)为：服务器UE，此时可能会影响服务执行的准确性。以及，若UE欺骗成功，还会进一步造成信息泄露的不安全问题。
发明内容
本公开提出的UE的授权令牌的生成方法/装置/设备及存储介质，用为UE对UE所声明的UE角色进行授权验证，以确保服务执行的准确度和信息安全性。
第一方面，本公开实施例提供一种UE的授权令牌的生成方法，该方法被网络设备执行，包括：
接收第一UE和/或第二UE发送的发现请求消息，所述发现请求消息用于为第一UE和/或第二UE请求授权令牌，所述授权令牌用于对UE所声明的UE角色进行授权验证；
向所述第一UE和/或第二UE发送发现响应消息，所述发现响应消息包括所述网络设备为所述第一UE和/或所述第二UE生成的授权令牌。
本公开中，网络设备可以接收第一UE和/或第二UE发送的发现请求消息，该发现请求消息用于为第一UE和/或第二UE请求授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证；之后，网络设备可以向第一UE和/或第二UE发送发现响应消息，该发现响应消息包括网络设备为第一UE和/或第二UE生成的授权令牌。由此可知，本公开中，UE可以获取网络设备为UE生成的授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证。基于此，当后续UE之间进行发现过程时，两UE可以交互各自的授权令牌，以便两UE均可以基于对端UE的授权令牌来对对端UE声明的UE角色进行授权验证，从而避免了UE间的相互欺骗，提升了服务执行的准确性，还提升了信息安全性。
第二方面，本公开实施例提供一种UE的授权令牌的生成方法，该方法被第一UE执行，包括：
向网络设备发送发现请求消息，所述发现请求消息用于为第一UE请求授权令牌，所述授权令牌用于对第一UE所声明的UE角色进行授权验证；
接收所述网络设备发送的发现响应消息，所述发现响应消息包括所述第一UE的授权令牌。
第三方面，本公开实施例提供一种UE的授权令牌的生成方法，该方法被第二UE执行，包括：
向网络设备发送发现请求消息，所述发现请求消息用于为第二UE请求授权令牌，所述授权令牌用于对第二UE所声明的UE角色进行授权验证；
接收所述网络设备发送的发现响应消息，所述发现响应消息包括第二UE的授权令牌。
第四方面，本公开实施例提供一种UE的授权令牌的生成方法，该方法被第一UE的DDNMF网元或所述第一UE的PKMF网元执行，包括：
接收第一UE发送的发现请求消息，所述发现请求消息用于为第一UE请求授权令牌，所述授权令牌用于对第一UE所声明的UE角色进行授权验证；
向服务器或UDM网元发送第一授权请求消息；
接收所述服务器或UDM网元发送的第一授权响应消息，所述第一授权响应消息包括所述服务器或UDM网元生成的所述第一UE的授权令牌，或者包括所述第一授权信息，所述第一授权信息包括第一UE的授权相关的信息；
向所述第一UE发送发现响应消息，所述发现响应消息包括第一UE的授权令牌。
第五方面，本公开实施例提供一种UE的授权令牌的生成方法，该方法被第二UE的DDNMF网元或所述第二UE的PKMF网元执行，包括：
接收第二UE发送的发现请求消息，所述发现请求消息用于为第二UE请求授权令牌，所述授权令牌用于对第二UE所声明的UE角色进行授权验证；
向服务器或UDM网元发送第一授权请求消息；
接收所述服务器或UDM网元发送的第一授权响应消息，所述第一授权响应消息包括所述服务器或UDM网元生成的第二UE的授权令牌，或者所述第二授权信息，所述第二授权信息包括第二UE的授权相关的信息；
向所述第二UE发送发现响应消息，所述发现响应消息包括所述第二UE的授权令牌。
第六方面，本公开实施例提供一种UE的授权令牌的生成方法，该方法被服务器或UDM网元执行，包括：
接收第一UE和/或第二UE的DDNMF网元或PKMF网元发送的第一授权请求消息，所述第一授权请求消息用于为第一UE和/或第二UE请求授权令牌，所述授权令牌用于对UE所声明的UE角色进行授权验证；
向所述第一UE和/或第二UE的DDNMF网元或PKMF网元发送第一授权响应消息，所述第一授权响应消息包括所述第一UE和/或第二UE的授权令牌，或者所述第一授权信息和/或第二授权信息；其中，所述第一授权信息包括第一UE的授权相关的信息，所述第二授权信息包括第二UE的授权相关的信息。
第七方面，本公开实施例提供一种通信装置，包括：
收发模块，用于接收第一UE和/或第二UE发送的发现请求消息，所述发现请求消息用于为第一UE和/或第二UE请求授权令牌，所述授权令牌用于对UE所声明的UE角色进行授权验证；
所述收发模块，还用于向所述第一UE和/或第二UE发送发现响应消息，所述发现响应消息包括所述网络设备为所述第一UE和/或所述第二UE生成的授权令牌。
第八方面，本公开实施例提供一种通信装置，包括：
收发模块，用于向网络设备发送发现请求消息，所述发现请求消息用于为第一UE请求授权令牌，所述授权令牌用于对第一UE所声明的UE角色进行授权验证；
所述收发模块，还用于接收所述网络设备发送的发现响应消息，所述发现响应消息包括所述第一UE的授权令牌。
第九方面，本公开实施例提供一种通信装置，包括：
收发模块，用于向网络设备发送发现请求消息，所述发现请求消息用于为第二UE请求授权令牌，所述授权令牌用于对第二UE所声明的UE角色进行授权验证；
所述收发模块，还用于接收所述网络设备发送的发现响应消息，所述发现响应消息包括第二UE的授权令牌。
第十方面，本公开实施例提供一种通信装置，包括：
收发模块，用于接收第一UE发送的发现请求消息，所述发现请求消息用于为第一UE请求授权令牌，所述授权令牌用于对第一UE所声明的UE角色进行授权验证；
所述收发模块，还用于向服务器或UDM网元发送第一授权请求消息；
所述收发模块，还用于接收所述服务器或UDM网元发送的第一授权响应消息，所述第一授权响应消息包括所述服务器或UDM网元生成的所述第一UE的授权令牌，或者包括所述第一授权信息，所述第一授权信息包括第一UE的授权相关的信息；
所述收发模块，还用于向所述第一UE发送发现响应消息，所述发现响应消息包括第一UE的授权令牌。
第十一方面，本公开实施例提供一种通信装置，包括：
收发模块，用于接收第二UE发送的发现请求消息，所述发现请求消息用于为第二UE请求授权令牌，所述授权令牌用于对第二UE所声明的UE角色进行授权验证；
所述收发模块，还用于向服务器或UDM网元发送第一授权请求消息；
所述收发模块，还用于接收所述服务器或UDM网元发送的第一授权响应消息，所述第一授权响应消息包括所述服务器或UDM网元生成的第二UE的授权令牌，或者所述第二授权信息，所述第二授权信息包括第二UE的授权相关的信息；
所述收发模块，还用于向所述第二UE发送发现响应消息，所述发现响应消息包括所述第二UE的授权令牌。
第十一方面，本公开实施例提供一种通信装置，包括：
收发模块，用于接收第一UE和/或第二UE的DDNMF网元或PKMF网元发送的第一授权请求消息，所述第一授权请求消息用于为第一UE和/或第二UE请求授权令牌，所述授权令牌用于对UE所声明的UE角色进行授权验证；
所述收发模块，用于向所述第一UE和/或第二UE的DDNMF网元或PKMF网元发送第一授权响应消息，所述第一授权响应消息包括所述第一UE和/或第二UE的授权令牌，或者所述第一授权信息和/或第二授权信息；其中，所述第一授权信息包括第一UE的授权相关的信息，所述第二授权信息包括第二UE的授权相关的信息。
第十三方面，本公开实施例提供一种通信装置，该通信装置包括处理器，当该处理器调用存储器中的计算机程序时，执行上述第一方面至第六方面任一所述的方法。
第十四方面，本公开实施例提供一种通信装置，该通信装置包括处理器和存储器，该存储器中存储有计算机程序；所述处理器执行该存储器所存储的计算机程序，以使该通信装置执行上述第一方面至第六方面任一所述的方法。
第十五方面，本公开实施例提供一种通信装置，该装置包括处理器和接口电路，该接口电路用于接收代码指令并传输至该处理器，该处理器用于运行所述代码指令以使该装置执行上述第一方面至第六方面任一所述的方法。
第十六方面，本公开实施例提供一种通信系统，该系统包括第七方面所述的通信装置至第十二方面所述的通信装置，或者，该系统包括第十三方面所述的通信装置，或者，该系统包括第十四方面所述的通信装置，或者，该系统包括第十五方面所述的通信装置。
第十七方面，本公开实施例提供一种计算机可读存储介质，用于储存为上述基站所用的指令，当所述指令被执行时，使所述终端设备执行上述第一方面至第六方面的任一方面所述的方法。
第十八方面，本公开还提供一种包括计算机程序的计算机程序产品，当其在计算机上运行时，使得计算机执行上述第一方面至第六方面的任一方面所述的方法。
第十九方面，本公开提供一种芯片系统，该芯片系统包括至少一个处理器和接口，用于支持基站实现第一方面至第六方面的任一方面所述的方法所涉及的功能，例如，确定或处理上述方法中所涉及的数据和信息中的至少一种。在一种可能的设计中，所述芯片系统还包括存储器，所述存储器，用于保存源辅节点必要的计算机程序和数据。该芯片系统，可以由芯片构成，也可以包括芯片和其他分立器件。
第二十方面，本公开提供一种计算机程序，当其在计算机上运行时，使得计算机执行上述第一方面至第五方面的任一方面所述的方法。
第二十一方面，本公开提供一种通信系统，其特征在于，包括：
第一UE，用于发送发现请求消息；
第二UE，用于发送发现请求消息；
网络设备，用于发送发现响应消息，所述发现响应消息包括所述网络设备为所述第一UE和/或第二UE确定的角色；
所述第一UE还用于：接收所述发现响应消息，所述发现响应消息包括所述网络设备为第一UE确定的角色；
所述第二UE还用于：接收所述发现响应消息，所述发现响应消息包括所述网络设备为第二UE确定的角色。
附图说明
本公开上述的和/或附加的方面和优点从下面结合附图对实施例的描述中将变得明显和容易理解，其中：
图1a和图1b为本公开实施例提供的一些通信系统的架构示意图；
图2a-2m为本公开另一个实施例所提供的UE的授权令牌的生成方法的流程示意图；
图3为本公开再一个实施例所提供的UE的授权令牌的生成方法的流程示意图；
图4为本公开又一个实施例所提供的UE的授权令牌的生成方法的流程示意图；
图5为本公开另一个实施例所提供的UE的授权令牌的生成方法的流程示意图；
图6为本公开再一个实施例所提供的UE的授权令牌的生成方法的流程示意图；
图7为本公开又一个实施例所提供的UE的授权令牌的生成方法的流程示意图；
图8为本公开一个实施例所提供的UE的授权令牌的生成方法的流程示意图；
图9a-9b为本公开另一个实施例所提供的UE的授权令牌的生成方法的流程示意图；
图10为本公开另一个实施例所提供的UE的授权令牌的生成方法的流程示意图；
图11为本公开另一个实施例所提供的UE的授权令牌的生成方法的流程示意图；
图12为本公开另一个实施例所提供的UE的授权令牌的生成方法的流程示意图；
图13为本公开另一个实施例所提供的UE的授权令牌的生成方法的流程示意图；
图14为本公开另一个实施例所提供的UE的授权令牌的生成方法的流程示意图；
图15为本公开另一个实施例所提供的UE的授权令牌的生成方法的流程示意图；
图16a-16c为本公开另一个实施例所提供的UE的授权令牌的生成方法的流程示意图；
图17为本公开另一个实施例所提供的通信装置的结构示意图；
图18为本公开另一个实施例所提供的通信装置的结构示意图；
图19为本公开另一个实施例所提供的通信装置的结构示意图；
图20为本公开另一个实施例所提供的通信装置的结构示意图；
图21a为本公开另一个实施例所提供的通信装置的结构示意图；
图21b为本公开另一个实施例所提供的通信装置的结构示意图；
图22为本公开另一个实施例所提供的通信系统的结构示意图；
图23是本公开一个实施例所提供的一种通信装置的框图；
图24为本公开一个实施例所提供的一种芯片的结构示意图。
具体实施方式
这里将详细地对示例性实施例进行说明，其示例表示在附图中。下面的描述涉及附图时，除非另有表示，不同附图中的相同数字表示相同或相似的要素。以下示例性实施例中所描述的实施方式并不代表与本公开实施例相一致的所有实施方式。相反，它们仅是与如所附权利要求书中所详述的、本公开实施例的一些方面相一致的装置和方法的例子。
在本公开实施例使用的术语是仅仅出于描述特定实施例的目的，而非旨在限制本公开实施例。在本公开实施例和所附权利要求书中所使用的单数形式的“一种”和“该”也旨在包括多数形式，除非上下文清楚地表示其他含义。还应当理解，本文中使用的术语“和/或”是指并包含一个或多个相关联的列出项目的任何或所有可能组合。
应当理解，尽管在本公开实施例可能采用术语第一、第二、第三等来描述各种信息，但这些信息不应限于这些术语。这些术语仅用来将同一类型的信息彼此区分开。例如，在不脱离本公开实施例范围的 情况下，第一信息也可以被称为第二信息，类似地，第二信息也可以被称为第一信息。取决于语境，如在此所使用的词语“如果”及“若”可以被解释成为“在……时”或“当……时”或“响应于确定”。
下面详细描述本公开的实施例，所述实施例的示例在附图中示出，其中自始至终相同或类似的标号表示相同或类似的要素。下面通过参考附图描述的实施例是示例性的，旨在用于解释本公开，而不能理解为对本公开的限制。
为了便于理解，首先介绍本申请涉及的术语。
1、统一数据管理功能(Unified Data Management，UDM)网元
负责用户标识、签约数据、鉴权数据的管理、用户的服务网元注册管理(比如当前为终端提供业务的移动性管理功能(Access and Mobility Management Function，AMF)网元、网元和会话管理功能(Session Management Function，SMF)网元等，如当用户切换了访问的AMF时，UDM还会向旧的AMF发起注销消息，要求旧的AMF删除用户相关信息)。
为了更好的理解本公开实施例公开的一种UE的授权令牌的生成方法，下面首先对本公开实施例适用的通信系统进行描述。
请参见图1a，图1a为本公开实施例提供的通信系统的架构示意图。如图1a所示，该通信系统可包括但不限于一个网络设备13，以及至少两个UE(如第一UE11、第二UE12)。
需要说明的是，本公开实施例的技术方案可以应用于各种通信系统。例如：长期演进(long term evolution，LTE)系统、第五代(5th generation，5G)移动通信系统、5G新空口(new radio，NR)系统，或者其他未来的新型移动通信系统等。
网络设备13例如可以包括接入网设备(例如基站)和核心网设备，其中，本公开实施例中的接入网设备是网络侧的一种用于发射或接收信号的实体。例如，接入网设备可以为演进型基站(evolved NodeB，eNB)、发送接收点(transmission reception point，TRP)、NR系统中的下一代基站(next generation NodeB，gNB)、其他未来移动通信系统中的基站或无线保真(wireless fidelity，WiFi)系统中的接入节点等。本公开的实施例对接入网设备所采用的具体技术和具体设备形态不做限定。本公开实施例提供的接入网设备可以是由集中单元(central unit，CU)与分布式单元(distributed unit，DU)组成的，其中，CU也可以称为控制单元(control unit)，采用CU-DU的结构可以将接入网设备，例如基站的协议层拆分开，部分协议层的功能放在CU集中控制，剩下部分或全部协议层的功能分布在DU中，由CU集中控制DU。
以及，核心网设备是部署在核心网中的设备，核心网网元是部署在核心网中的网元，两者的功能是提供用户连接、对用户的管理以及对业务完成承载，作为承载网络提供到外部网络的接口。
本公开实施例中的第一UE11和第二UE12是用户侧的一种用于接收或发射信号的实体，如手机。终端设备也可以称为终端设备(terminal)、用户设备(user equipment，UE)、移动台(mobile station，MS)、移动终端设备(mobile terminal，MT)等。终端设备可以是具备通信功能的汽车、智能汽车、手机(mobile phone)、穿戴式设备、平板电脑(Pad)、带无线收发功能的电脑、虚拟现实(virtual reality，VR)终端设备、增强现实(augmented reality，AR)终端设备、工业控制(industrial control)中的无线终端设备、无人驾驶(self-driving)中的无线终端设备、远程手术(remote medical surgery)中的无线终端设备、智能电网(smart grid)中的无线终端设备、运输安全(transportation safety)中的无线终端设备、智慧城市(smart city)中的无线终端设备、智慧家庭(smart home)中的无线终端设备等等。本公开的实施例对终端设备所采用的具体技术和具体设备形态不做限定。
如图1b所示，该通信系统中核心网设备例如可以包括第一UE的邻近通信服务名称管理功能(directdiscovery name management function，DDNMF)/邻近通信服务密钥管理功能(ProSe key management function，PKMF)网元、第二UE的DDNMF/PKMF网元、服务器/UDM网元。
其中，第一UE的DDNMF/PKMF网元和第二UE的DDNMF/PKMF网元可以相同，也可以不同。
可以理解的是，本公开实施例描述的通信系统是为了更加清楚的说明本公开实施例的技术方案，并不构成对于本公开实施例提供的技术方案的限定，本领域普通技术人员可知，随着系统架构的演变和新业务场景的出现，本公开实施例提供的技术方案对于类似的技术问题，同样适用。
下面参考附图对本公开实施例所提供的UE的授权令牌的生成方法/装置/设备及存储介质进行详细描述。
需要说明的是，下述各个消息(包括请求消息、响应消息等)的命名仅为方便方案，命名本身并不构成对该消息功能的限定。
图2a为本公开实施例所提供的一种UE的授权令牌的生成方法的流程示意图，该方法由网络设备执行，如图2a所示，该UE的授权令牌的生成方法可以包括以下步骤：
步骤201a、接收第一UE和/或第二UE发送的发现请求消息，该发现请求消息用于为第一UE和/或第二UE请求授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证。
在本公开的一个实施例之中，上述的UE所声明的UE角色可以理解为：UE发现过程中UE间传输的角色。例如，第一UE与第二UE发现过程中，第一UE向第二UE传输的第一UE的角色即为第一UE声明的UE角色，第二UE向第一UE传输的第二UE的角色即为第二UE声明的UE角色。
其中，在本公开的一个实施例之中，第一UE发送的发现请求消息中可以包括有以下至少一种：
第一UE对应的测距或侧行链路定位应用程序用户标识(Ranging Application User ID，RAUID)；
第一UE请求发现的服务的标识；
第一UE的能力。
在本公开的另一个实施例之中，第二UE发送的发现请求消息中可以包括以下至少一种：
第二UE对应的RAUID；
第二UE请求发现的服务的标识；
第二UE的能力。
其中，上述的RAUID用于标识UE，以便网络设备知晓是哪个UE发送的发现请求消息。
上述的UE请求发现的服务例如可以为测距服务和/或侧行链路定位服务。
上述的UE的能力例如可以为UE支持的测距服务能力和/或UE支持的侧行链路定位服务能力。
步骤202a、向第一UE和/或第二UE发送发现响应消息，该发现响应消息包括网络设备为第一UE和/或第二UE生成的授权令牌。
其中，在本公开的一个实施例之中，该第一UE和/或第二UE的授权令牌至少可以指示网络设备(如服务器或UDM网元)为第一UE和/或第二UE授权的角色；以及，该第一UE和/或第二UE的授权令牌可以用于：在发现过程中第一UE和/或第二UE的对端UE对接收到的由第一UE和/或第二UE传输的第一UE和/或第二UE的角色进行授权验证。
需要说明的是，在本公开的一个实施例之中，上述的网络设备为第一UE和/或第二UE授权的角色可以是网络设备基于UE的能力、UE请求发现的服务的标识以及UE的签约信息确定的。当网络设备为第一UE和/或第二UE授权了角色后，会向第一UE和/或第二UE发送该角色，以便后续第一UE和第二UE之间可以交互传输各自的角色，实现第一UE和第二UE的相互发现。但是，在第一UE与第二UE之间实际交互各自的角色时，第一UE和/或第二UE可能会欺骗对端UE，如向对端UE声明的UE的角色并非是网络设备授权的角色，由此可能会影响服务执行的准确性。以及，若第一UE和/或第二UE欺骗成功，则还会进一步造成信息泄露的不安全问题。
基于此为了解决上述问题，本公开实施例中，网络设备可以为第一UE和/或第二UE生成能够指示网络设备为第一UE和/或第二UE授权的角色的授权令牌，并且使得第一UE与第二UE在发现过程中互相交互各自的授权令牌，以便第一UE和/或第二UE的对端UE能够基于第一UE和/或第二UE的授权令牌来对第一UE和/或第二UE声明的UE角色进行授权验证，以避免在发现过程中，第一UE和/或第二UE用其他的非网络设备授权的角色来欺骗对端UE，从而提升了服务执行的准确性，还提升了信息安全性。
其中，在本公开的一个实施例之中，网络设备可以基于UE的能力、UE请求发现的服务的标识以及UE的签约信息中的至少一种来为第一UE和/或第二UE生成授权令牌。其中，上述签约信息可以为服务协议和/或UE订阅，该签约信息中注册有各个UE在测距服务和/或侧行链路定位服务中的授权相关的信息(如可以包括各个UE在测距服务和/或侧行链路定位服务中所被允许的角色)。以及，关于 本步骤中网络设备如何为第一UE和/或第二UE生成授权令牌的详细介绍会在后续实施例描述。
进一步地，在本公开的一个实施例之中，该发现响应消息中还可以携带有网络设备为第一UE请求发现的服务生成的密钥信息和/或第二UE请求发现的服务对应生成的密钥信息，其中，第一UE请求发现的服务对应的密钥信息与第二UE请求发现的服务对应的密钥信息相同。该密钥信息用于：对第一UE后续发现第二UE的过程进行安全保护，以确保该第一UE和/或第二UE在后续发现过程中传输第一UE和/或第二UE的角色以及第一UE和/或第二UE的授权令牌时，不相关UE无法监听或篡改第一UE和/或第二UE的角色，以及无法获取第一UE和/或第二UE的授权令牌，从而防止了不相关UE冒充该第一UE和/或第二UE的角色来欺骗对端UE，可以避免后续服务执行的过程中其他不相关UE干扰，提升了服务执行的准确性，还提升了信息安全性。其中，不相关UE例如包括请求发现的服务与第一UE和第二UE请求发现的服务不同的UE、未请求服务的UE、未被网络设备授权角色的UE、未从网络设备处获取到授权令牌的UE、未从网络设备处获取到该密钥信息的UE等。
综上所述，在本公开实施例提供的UE的授权令牌的生成方法之中，网络设备可以接收第一UE和/或第二UE发送的发现请求消息，该发现请求消息用于为第一UE和/或第二UE请求授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证；之后，网络设备可以向第一UE和/或第二UE发送发现响应消息，该发现响应消息包括网络设备为第一UE和/或第二UE生成的授权令牌。由此可知，本公开中，UE可以获取到网络设备为该UE生成的授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证。基于此，当后续UE之间进行发现过程时，两UE可以交互各自的授权令牌，以便两UE均可以基于对端UE的授权令牌来对对端UE声明的UE角色进行授权验证，从而避免了UE间的相互欺骗，提升了服务执行的准确性，还提升了信息安全性。同时，由于还会向UE发送UE请求发现的服务对应的密钥信息，该密钥信息可以用于：对UE后续发现其他UE的过程进行安全保护，以确保该UE在后续发现过程中传输UE的角色和UE的授权令牌时，不相关UE无法监听或篡改UE的角色，以及无法获取到UE的授权令牌，从而防止了不相关UE冒充该UE的角色，避免了后续服务执行的过程中其他不相关UE干扰，进一步提升了服务执行的准确性和信息安全性。
图2b为本公开实施例所提供的一种UE的授权令牌的生成方法的流程示意图，该方法由第一UE执行，如图2b所示，该UE的授权令牌的生成方法可以包括以下步骤：
步骤201b、向网络设备发送发现请求消息，该发现请求消息用于为第一UE请求授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证。
步骤202b、接收网络设备发送的发现响应消息，发现响应消息包括第一UE的授权令牌。
可选的，在本公开的一个实施例之中，该第一UE的授权令牌至少可以指示网络设备为第一UE授权的角色；第一UE的授权令牌可以用于：在发现过程中第一UE的对端UE对接收到的由第一UE传输的第一UE的角色进行授权验证。其中，关于基于授权令牌的验证过程会在后续实施例进行详细说明。
其中，关于步骤201b-202b的详细介绍可以参考上述实施例描述。
综上所述，在本公开实施例提供的UE的授权令牌的生成方法之中，第一UE可以向网络设备发送发现请求消息，该发现请求消息用于为第一UE请求授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证；之后，第一UE可以接收网络设备发送的发现响应消息，该发现响应消息包括第一UE的授权令牌。由此可知，本公开中，UE可以获取到网络设备为该UE生成的授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证。基于此，当后续UE之间进行发现过程时，两UE可以交互各自的授权令牌，以便两UE均可以基于对端UE的授权令牌来对对端UE声明的UE角色进行授权验证，从而避免了UE间的相互欺骗，提升了服务执行的准确性，还提升了信息安全性。同时，由于还会向UE发送UE请求发现的服务对应的密钥信息，该密钥信息可以用于：对UE后续发现其他UE的过程进行安全保护，以确保该UE在后续发现过程中传输UE的角色和UE的授权令牌时，不相关UE无法监听或篡改UE的角色，以及无法获取到UE的授权令牌，从而防止了不相关UE冒充该UE的角色，避免了后续服务执行的过程中其他不相关UE干扰，进一步提升了服务执行的准确性和信息安全性。
图2c为本公开实施例所提供的一种UE的授权令牌的生成方法的流程示意图，该方法由第一UE执行，如图2c所示，该UE的授权令牌的生成方法可以包括以下步骤：
步骤201c、广播第一发现消息，该第一发现消息包括第一UE的授权令牌。
其中，在本公开的一个实施例之中该第一发现消息中还可以包括有第一UE的角色，同时，第一UE会广播由第一UE请求发现的服务所对应的密钥信息保护第一发现消息，基于第二UE请求发现的服务所对应的密钥信息与第一UE请求发现的服务所对应的安全密钥相同，由此第二UE可以利用相同的密钥信息成功验证出第一UE广播的第一发现消息，实现与第一UE的成功发现，之后，第二UE即可验证第二UE的角色与第一UE的角色是否匹配，以及基于第一UE的授权令牌对第一发现消息中包括的第一UE的角色进行授权。
具体的，在本公开的一个实施例之中，UE的角色例如可以包括：参考UE(如侧行链路参考UE(SL Reference UE))、目标UE(Target UE)、辅助UE(Assistant UE)、定位UE(Located UE)、作为服务器的UE(如作为侧行链路定位服务器的UE(SL Positioning Server UE))、客户端UE(如侧行链路定位客户端UE(SL Positioning Client UE))等。其中，上述目标UE可以为被定位或被测距的UE；上述定位UE可以为要获取目标UE的定位位置的UE；上述参考UE可以为：基于该参考UE的位置或参考UE与目标UE之间的距离能够确定出目标UE的定位位置或测距距离的UE；上述辅助UE可以为：在测距服务或侧行链路定位服务中用于协助转发消息的UE；上述作为服务器的UE可以为：具有定位计算能力或测距计算能力的UE；上述的客户端UE可以为：能够在测距服务或侧行链路定位服务中充当客户端的UE。
在此基础上，上述的第一UE的角色和第二UE的角色在两UE请求发现的服务中匹配可以理解为：第一UE的角色与第二UE的角色相互配合可以完成两UE请求发现的服务。其中，对于测距服务而言，相互配合能完成测距服务的两个角色一般为：目标UE和参考UE；对于侧行链路定位服务而言，相互配合能完成侧行链路定位服务的两个角色一般为：定位UE和目标UE。基于此，当两UE请求发现的服务为测距服务1时，若第一UE的角色为：目标UE，第二UE的角色为：参考UE，则说明第一UE的角色和第二UE的角色在两UE请求发现的服务中相互匹配。
在本公开的另一个实施例之中，第一UE的角色和第二UE的角色在两UE请求发现的服务中不匹配可以理解为：第一UE的角色与第二UE的角色相互配合无法完成两UE请求发现的服务。示例的，假设两UE请求发现的服务为测距服务1时，其中，第一UE的角色为：目标UE，第二UE的角色也为：目标UE，则说明第一UE的角色和第二UE的角色在两UE请求发现的服务中不匹配。
由上述内容可知，第二UE通过确定第二UE的角色与第一发现消息中包括的第一UE的角色是否能相互配合完成两UE请求发现的服务，就可以验证出第二UE的角色与第一UE的角色是否匹配。
进一步地，在本公开的一个实施例之中，上述的基于第一UE的授权令牌对第一发现消息中包括的第一UE的角色进行授权的方法可以包括：基于第一UE的授权令牌确定出网络设备为第一UE授权的角色，比对第一UE的授权令牌指示的网络设备为第一UE授权的角色与第一发现消息中包括的第一UE的角色是否一致，若一致，则确定第二UE对第一发现消息中包括的第一UE的角色授权成功，即第一UE未欺骗第二UE，若不一致，则确定第二UE对第一发现消息中包括的第一UE的角色授权失败，即第一UE未欺骗第二UE。
需要说明的是，在本公开一个实施例之中，若第一UE的角色和第二UE的角色相互匹配，且第二UE基于第一UE的授权令牌对第一发现消息中包括的第一UE的角色授权成功，则后续第二UE可以与第一UE建立连接以完成请求的服务，否则，第二UE不与第一UE建立连接。
步骤202c、接收第二UE发送第一响应消息。
可选的，所述第一响应消息为根据所述第二UE请求发现的服务所对应的密钥信息保护。
进一步地，在本公开的一个实施例之中，该第一响应消息为第二UE基于第一UE的授权令牌对第一UE声明的角色验证成功后发送的。关于该部分内容在后续实施例会进行详细介绍。
综上所述，在本公开实施例提供的UE的授权令牌的生成方法之中，第一UE可以向网络设备发送发现请求消息，该发现请求消息用于为第一UE请求授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证；之后，第一UE可以接收网络设备发送的发现响应消息，该发现响应消息包括第一UE的授权令牌。由此可知，本公开中，UE可以获取到网络设备为该UE生成的授权令牌，该授权令牌 用于对UE所声明的UE角色进行授权验证。基于此，当后续UE之间进行发现过程时，两UE可以交互各自的授权令牌，以便两UE均可以基于对端UE的授权令牌来对对端UE声明的UE角色进行授权验证，从而避免了UE间的相互欺骗，提升了服务执行的准确性，还提升了信息安全性。同时，由于还会向UE发送UE请求发现的服务对应的密钥信息，该密钥信息可以用于：对UE后续发现其他UE的过程进行安全保护，以确保该UE在后续发现过程中传输UE的角色和UE的授权令牌时，不相关UE无法监听或篡改UE的角色，以及无法获取到UE的授权令牌，从而防止了不相关UE冒充该UE的角色，避免了后续服务执行的过程中其他不相关UE干扰，进一步提升了服务执行的准确性和信息安全性。
图2d为本公开实施例所提供的一种UE的授权令牌的生成方法的流程示意图，该方法由第一UE执行，如图2d所示，该UE的授权令牌的生成方法可以包括以下步骤：
步骤201d、接收第二UE广播的第二发现消息，第二发现消息包括第二UE的授权令牌。
其中，第二发现消息由第二UE请求发现的服务所对应的密钥信息保护，以及第二发现消息中还可以包括第二UE的角色。
步骤202d、当根据所述第二UE的授权令牌验证所述第二UE声明的角色为所述网络设备授权的角色时，向所述第二UE发送第二响应消息。
具体的，在本公开的一个实施例之中，第一UE接收到第二UE发送的第二响应消息后，会解码验证第二发现消息；响应于验证成功，确定第二UE的角色与第一UE的角色是否匹配，以及基于第二UE的授权令牌对第二发现消息中包括的第二UE的角色进行授权。
其中，可以是利用密钥信息验证第二发现消息，以及关于此部分的原理可以参考上述实施例描述。
进一步地，需要说明的是，当第二UE请求发现的服务与第一UE请求发现的服务相同时，若第一UE的角色与第二UE的角色还相互匹配，则说明该第一UE和第二UE能够完成两UE所请求发现的服务，基于此，当第一UE解码验证了第二发现消息后，可以进一步确定第一UE的角色与第二UE的角色是否相互匹配，以便知晓该第一UE和第二UE是否可以完成两UE请求的服务，若能完成，则基于第二UE的授权令牌对第二发现消息中包括的第二UE的角色进行授权，若授权成功，则两UE后续可进行发现过程以建立连接，若不能完成，则忽略。
其中，关于第一UE的角色与第二UE的角色相互匹配，以及基于授权令牌进行授权的相关介绍可以参考上述实施例描述。
响应于第一UE的角色与第二UE的角色相互匹配，且对第二发现消息中包括的第二UE的角色授权成功，向第二UE发送第二响应消息，第二响应消息由第一UE请求发现的服务所对应的密钥信息保护，第二响应消息中包括第一UE的授权令牌和/或第一UE的角色。
其中，上述步骤201d-202d为第一UE和第二UE的发现过程，当两UE相互发现之后，即可建立连接以实现服务。
综上所述，在本公开实施例提供的UE的授权令牌的生成方法之中，第一UE可以向网络设备发送发现请求消息，该发现请求消息用于为第一UE请求授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证；之后，第一UE可以接收网络设备发送的发现响应消息，该发现响应消息包括第一UE的授权令牌。由此可知，本公开中，UE可以获取到网络设备为该UE生成的授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证。基于此，当后续UE之间进行发现过程时，两UE可以交互各自的授权令牌，以便两UE均可以基于对端UE的授权令牌来对对端UE声明的UE角色进行授权验证，从而避免了UE间的相互欺骗，提升了服务执行的准确性，还提升了信息安全性。同时，由于还会向UE发送UE请求发现的服务对应的密钥信息，该密钥信息可以用于：对UE后续发现其他UE的过程进行安全保护，以确保该UE在后续发现过程中传输UE的角色和UE的授权令牌时，不相关UE无法监听或篡改UE的角色，以及无法获取到UE的授权令牌，从而防止了不相关UE冒充该UE的角色，避免了后续服务执行的过程中其他不相关UE干扰，进一步提升了服务执行的准确性和信息安全性。
图2e为本公开实施例所提供的一种UE的授权令牌的生成方法的流程示意图，该方法由第二UE执行，如图2e所示，该UE的授权令牌的生成方法可以包括以下步骤：
步骤201e、向网络设备发送发现请求消息，发现请求消息用于为第二UE请求授权令牌，授权令牌 用于对UE所声明的UE角色进行授权验证；
步骤202e、接收网络设备发送的发现响应消息，发现响应消息包括第二UE的授权令牌。
可选的，第二UE的授权令牌至少指示网络设备为第二UE授权的角色；
第二UE的授权令牌用于：在发现过程中第二UE的对端UE对接收到的由第二UE传输的第二UE的角色进行授权验证。
综上所述，在本公开实施例提供的UE的授权令牌的生成方法之中，第二UE可以向网络设备发送发现请求消息，该发现请求消息用于为第二UE请求授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证；之后，第二UE可以接收网络设备发送的发现响应消息，该发现响应消息包括第二UE的授权令牌。由此可知，本公开中，UE可以获取到网络设备为该UE生成的授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证。基于此，当后续UE之间进行发现过程时，两UE可以交互各自的授权令牌，以便两UE均可以基于对端UE的授权令牌来对对端UE声明的UE角色进行授权验证，从而避免了UE间的相互欺骗，提升了服务执行的准确性，还提升了信息安全性。同时，由于还会向UE发送UE请求发现的服务对应的密钥信息，该密钥信息可以用于：对UE后续发现其他UE的过程进行安全保护，以确保该UE在后续发现过程中传输UE的角色和UE的授权令牌时，不相关UE无法监听或篡改UE的角色，以及无法获取到UE的授权令牌，从而防止了不相关UE冒充该UE的角色，避免了后续服务执行的过程中其他不相关UE干扰，进一步提升了服务执行的准确性和信息安全性。
图2f为本公开实施例所提供的一种UE的授权令牌的生成方法的流程示意图，该方法由第二UE执行，如图2f所示，该UE的授权令牌的生成方法可以包括以下步骤：
步骤201f、接收第一UE广播的第一发现消息，第一发现消息包括第一UE的授权令牌。
步骤202f、当根据所述第一UE的授权令牌验证所述第一UE声明的角色为所述网络设备授权的角色时，向所述第一UE发送第一响应消息。
其中，第二UE接收到第一发现消息后所执行的动作与上述的第一UE接收到第二发现消息后所执行的动作类同，本公开在此不再赘述。
此外，关于本实施例的其他详细介绍可以参考上述实施例描述。
综上所述，在本公开实施例提供的UE的授权令牌的生成方法之中，第二UE可以向网络设备发送发现请求消息，该发现请求消息用于为第二UE请求授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证；之后，第二UE可以接收网络设备发送的发现响应消息，该发现响应消息包括第二UE的授权令牌。由此可知，本公开中，UE可以获取到网络设备为该UE生成的授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证。基于此，当后续UE之间进行发现过程时，两UE可以交互各自的授权令牌，以便两UE均可以基于对端UE的授权令牌来对对端UE声明的UE角色进行授权验证，从而避免了UE间的相互欺骗，提升了服务执行的准确性，还提升了信息安全性。同时，由于还会向UE发送UE请求发现的服务对应的密钥信息，该密钥信息可以用于：对UE后续发现其他UE的过程进行安全保护，以确保该UE在后续发现过程中传输UE的角色和UE的授权令牌时，不相关UE无法监听或篡改UE的角色，以及无法获取到UE的授权令牌，从而防止了不相关UE冒充该UE的角色，避免了后续服务执行的过程中其他不相关UE干扰，进一步提升了服务执行的准确性和信息安全性。
图2g为本公开实施例所提供的一种UE的授权令牌的生成方法的流程示意图，该方法由第二UE执行，如图2g所示，该UE的授权令牌的生成方法可以包括以下步骤：
步骤201g、广播第二发现消息，第二发现消息包括第二UE的授权令牌。
步骤202g、接收第一UE发送的第二响应消息，第二响应消息包括第一UE的授权令牌。
步骤203g、根据所述第一UE的授权令牌验证所述第一UE声明的角色是否为所述网络设备授权的角色。
其中，关于本实施例的详细介绍可以参考上述实施例描述。
综上所述，在本公开实施例提供的UE的授权令牌的生成方法之中，第二UE可以向网络设备发送发现请求消息，该发现请求消息用于为第二UE请求授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证；之后，第二UE可以接收网络设备发送的发现响应消息，该发现响应消息包括第二 UE的授权令牌。由此可知，本公开中，UE可以获取到网络设备为该UE生成的授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证。基于此，当后续UE之间进行发现过程时，两UE可以交互各自的授权令牌，以便两UE均可以基于对端UE的授权令牌来对对端UE声明的UE角色进行授权验证，从而避免了UE间的相互欺骗，提升了服务执行的准确性，还提升了信息安全性。同时，由于还会向UE发送UE请求发现的服务对应的密钥信息，该密钥信息可以用于：对UE后续发现其他UE的过程进行安全保护，以确保该UE在后续发现过程中传输UE的角色和UE的授权令牌时，不相关UE无法监听或篡改UE的角色，以及无法获取到UE的授权令牌，从而防止了不相关UE冒充该UE的角色，避免了后续服务执行的过程中其他不相关UE干扰，进一步提升了服务执行的准确性和信息安全性。
进一步地，在本公开的一个实施例之中，上述的网络侧设备可以包括：第一网元、第二网元和第三网元，其中，该第一网元包括第一UE的DDNMF网元或第一UE的PKMF网元，第二网元包括第二UE的DDNMF网元或第二UE的PKMF网元，第三网元包括接近服务的服务器或UDM网元。基于此，以下对第一网元、第二网元、第三网元、第一UE、第二UE交互时的具体步骤进行介绍。
图2h为本公开实施例所提供的一种UE的授权令牌的生成方法的交互流程示意图，该UE的授权令牌的生成方法可以包括以下步骤：
步骤201h、第一网元接收第一UE发送的发现请求消息；
步骤202h、第一网元向第三网元发送第一授权请求消息；
步骤203h、第三网元向第一网元发送第一授权响应消息，该第一授权响应消息包括第三网元生成的第一UE的授权令牌。
其中，在本公开的一个实施例之中，第三网元生成第一UE的授权令牌的前提应当为：第三网元能够为第一UE成功授权角色。具体的，在本公开的一个实施例之中，第三网元可以先根据第一UE的能力，以及第三网元存储的第一UE的签约信息确定是否能为第一UE授权角色，响应于能为第一UE授权角色，则进一步为第一UE生成授权令牌。
其中，上述的第三网元根据第一UE的能力，以及第三网元存储的第一UE的签约信息确定是否能为第一UE授权角色的方法可以包括：
由前述内容可知，该签约信息中注册有各个UE在测距服务和/或侧行链路定位服务中所被允许的角色，基于此，第三网元通过查找签约信息即可确定出某UE在测距服务和/或侧行链路定位服务中所被允许的角色，之后再结合UE的能力，确定UE所被允许的角色中，是否有该UE的能力支持实现的角色确定，若有，则确定能成功为第一UE授权角色，否则，确定不能为第一UE授权角色。
示例的，假设两UE请求发现的服务为：测距服务，则第三网元基于第一UE的标识从服务协议中查找出第一UE在测距服务中所被允许的角色为：目标UE和服务UE，和/或，第三网元可以基于第一UE的标识确定出该第一UE的订阅，并从该第一UE的订阅中查找出第一UE在侧行链路定位服务中所被允许的角色为：目标UE和服务UE。此时，若第三网元基于第一UE的能力确定出第一UE在测距服务中支持实现的角色为目标UE和定位UE，则可以得知：UE所被允许的角色中存在该UE的能力支持实现的角色，从而可以确定第三网元能成功为第一UE授权角色，由此第三网元可以进一步为第一UE生成授权令牌。
在本公开的一个实施例之中，上述的第三网元为第一UE生成授权令牌的方法可以包括：基于第一UE请求发现的服务以及第一UE的签约信息来为第一UE生成授权令牌。具体的，第三网元可以基于第一UE请求发现的服务从第一UE的签约信息(如服务协议和/或第一UE的订阅)中确定出第一UE请求发现的服务所对应的授权相关的信息，再基于该第一UE请求发现的服务所对应的授权相关的信息来为第一UE生成授权令牌。
步骤204h、第一网元向第一UE发送发现响应消息。
综上所述，本公开提供了一种对UE的授权令牌的生成方法，其中，UE可以获取到网络设备为该UE生成的授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证。基于此，当后续UE之间进行发现过程时，两UE可以交互各自的授权令牌，以便两UE均可以基于对端UE的授权令牌来对 对端UE声明的UE角色进行授权验证，从而避免了UE间的相互欺骗，提升了服务执行的准确性，还提升了信息安全性。同时，由于还会向UE发送UE请求发现的服务对应的密钥信息，该密钥信息可以用于：对UE后续发现其他UE的过程进行安全保护，以确保该UE在后续发现过程中传输UE的角色和UE的授权令牌时，不相关UE无法监听或篡改UE的角色，以及无法获取到UE的授权令牌，从而防止了不相关UE冒充该UE的角色，避免了后续服务执行的过程中其他不相关UE干扰，进一步提升了服务执行的准确性和信息安全性。
图2i为本公开实施例所提供的一种UE的授权令牌的生成方法的交互流程示意图，该UE的授权令牌的生成方法可以包括以下步骤：
步骤201i、第一网元接收第一UE发送的发现请求消息；
步骤202i、第一网元向第三网元发送第一授权请求消息；
步骤203i、第三网元向第一网元发送第一授权响应消息，该第一授权响应消息包括第三网元确定的第一授权信息，第一授权信息包括第一UE的授权相关的信息。
其中，在本公开的一个实施例之中，第三网元确定第一授权信息的前提应当为：第三网元能够为第一UE成功授权角色。具体的，在本公开的一个实施例之中，第三网元可以先根据第一UE的能力，以及第三网元存储的第一UE的签约信息确定是否能为第一UE授权角色，响应于能为第一UE授权角色，则进一步确定第一授权信息。
其中，关于第三网元确定是否能为第一UE授权角色的方法、以及第三网元为第一UE确定第一授权信息的方法可以参见上述实施例描述。
步骤204i、第一网元基于第一授权信息生成第一UE的授权令牌。
步骤205i、第一网元向第一UE发送发现响应消息。
综上所述，本公开提供了一种对UE的授权令牌的生成方法，其中，UE可以获取到网络设备为该UE生成的授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证。基于此，当后续UE之间进行发现过程时，两UE可以交互各自的授权令牌，以便两UE均可以基于对端UE的授权令牌来对对端UE声明的UE角色进行授权验证，从而避免了UE间的相互欺骗，提升了服务执行的准确性，还提升了信息安全性。同时，由于还会向UE发送UE请求发现的服务对应的密钥信息，该密钥信息可以用于：对UE后续发现其他UE的过程进行安全保护，以确保该UE在后续发现过程中传输UE的角色和UE的授权令牌时，不相关UE无法监听或篡改UE的角色，以及无法获取到UE的授权令牌，从而防止了不相关UE冒充该UE的角色，避免了后续服务执行的过程中其他不相关UE干扰，进一步提升了服务执行的准确性和信息安全性。
图2j为本公开实施例所提供的一种UE的授权令牌的生成方法的交互流程示意图，该UE的授权令牌的生成方法可以包括以下步骤：
步骤201j、第二网元接收第二UE发送的发现请求消息；
步骤202j、第二网元向第三网元发送第一授权请求消息；
步骤203j、第三网元向第二网元发送第一授权响应消息，第一授权响应消息包括第三网元生成的第二UE的授权令牌。
步骤204j、第二网元向第二UE发送发现响应消息。
综上所述，本公开提供了一种对UE的授权令牌的生成方法，其中，UE可以获取到网络设备为该UE生成的授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证。基于此，当后续UE之间进行发现过程时，两UE可以交互各自的授权令牌，以便两UE均可以基于对端UE的授权令牌来对对端UE声明的UE角色进行授权验证，从而避免了UE间的相互欺骗，提升了服务执行的准确性，还提升了信息安全性。同时，由于还会向UE发送UE请求发现的服务对应的密钥信息，该密钥信息可以用于：对UE后续发现其他UE的过程进行安全保护，以确保该UE在后续发现过程中传输UE的角色和UE的授权令牌时，不相关UE无法监听或篡改UE的角色，以及无法获取到UE的授权令牌，从而防止了不相关UE冒充该UE的角色，避免了后续服务执行的过程中其他不相关UE干扰，进一步提升了服务执行的准确性和信息安全性。
图2k为本公开实施例所提供的一种UE的授权令牌的生成方法的交互流程示意图，该UE的授权令牌的生成方法可以包括以下步骤：
步骤201k、第二网元接收第二UE发送的发现请求消息；
步骤202k、第二网元向第三网元发送第一授权请求消息；
步骤203k、第三网元向第二网元发送第一授权响应消息，第一授权响应消息包括第三网元确定的第二授权信息，第二授权信息包括第二UE的授权相关的信息。
步骤204k、第二网元向第一网元发送监听请求消息；
步骤205k、第一网元向第三网元发送第二授权请求消息；
步骤206k、第三网元向第一网元发送第二授权响应消息，第二授权响应消息包括第三授权信息，第三授权信息至少指示第一UE的角色和第二UE的角色在两UE请求发现的服务中的匹配关系。
步骤207k、第一网元向第二网元发送监听响应消息，监听响应消息包括第三授权信息。
步骤208k、第二网元基于第二授权信息以及第三授权信息生成第二UE的授权令牌。
步骤209k、第二网元向第二UE发送发现响应消息。
综上所述，本公开提供了一种对UE的授权令牌的生成方法，其中，UE可以获取到网络设备为该UE生成的授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证。基于此，当后续UE之间进行发现过程时，两UE可以交互各自的授权令牌，以便两UE均可以基于对端UE的授权令牌来对对端UE声明的UE角色进行授权验证，从而避免了UE间的相互欺骗，提升了服务执行的准确性，还提升了信息安全性。同时，由于还会向UE发送UE请求发现的服务对应的密钥信息，该密钥信息可以用于：对UE后续发现其他UE的过程进行安全保护，以确保该UE在后续发现过程中传输UE的角色和UE的授权令牌时，不相关UE无法监听或篡改UE的角色，以及无法获取到UE的授权令牌，从而防止了不相关UE冒充该UE的角色，避免了后续服务执行的过程中其他不相关UE干扰，进一步提升了服务执行的准确性和信息安全性。
进一步地，上述的UE的授权令牌的生成方法是以网络设备、第一UE以及第二UE的视角撰写的。但由上述内容可知，网络设备可以包括有第一UE的DDNMF网元或第一UE的PKMF网元，第二UE的DDNMF网元或第二UE的PKMF网元，第三网元包括接近服务的服务器或UDM网元，基于此，以下分别以UE的授权令牌的生成方法中的第一UE的DDNMF网元或第一UE的PKMF网元的视角、第二UE的DDNMF网元或第二UE的PKMF网元的视角、服务器或UDM网元的视角、第一UE与DDNMF/PKMF网元交互时的视角、第二UE与DDNMF/PKMF网元交互时的视角来介绍本公开的方法。
图2L为本公开实施例所提供的一种UE的授权令牌的生成方法的流程示意图，该方法由第一UE的DDNMF网元或第一UE的PKMF网元执行，如图2所示，该UE的授权令牌的生成方法可以包括以下步骤：
步骤201L、接收第一UE发送的发现请求消息(Discovery Request message)，发现请求消息用于为第一UE请求授权令牌，授权令牌用于对UE所声明的UE角色进行授权验证。
步骤202L、向服务器或UDM网元发送第一授权请求消息(Authorization Request)。
具体的，在本公开的一个实施例之中，该向服务器或UDM网元发送第一授权请求消息的方法可以为：先将第一UE对应的RAUID转换为能被服务器或UDM网元识别的第一标识，该第一标识用于指示第一UE；再将第一标识、第一UE请求发现的服务、第一UE的能力中的至少一种携带于第一授权请求消息中发送至服务器或UDM网元。
进一步地，在本公开的一个实施例之中，该服务器例如可以为：测距或侧行链路定位服务器(Ranging/SL positioning服务器)。
步骤203L、接收服务器或UDM网元发送的第一授权响应消息(Authorization Response)，该第一授权响应消息包括服务器或UDM网元生成的第一UE的授权令牌。
可选的，第一UE的授权令牌用于：在发现过程中第一UE的对端UE对接收到的由第一UE传输的第一UE的角色进行授权验证。
步骤204L、向第一UE发送发现响应消息(Discovery Request)，该发现响应消息包括第一UE的授权令牌。
其中，在本公开的一个实施例之中，该发现响应消息中还可以包括和第一UE的DDNMF网元或第一UE的PKMF网元为第一UE请求发现的服务生成的密钥信息(Discovery Security Material)。该密钥信息的相关介绍可以参考上述实施例描述。
进一步地，在本公开的一个实施例之中，当第一UE的DDNMF网元或第一UE的PKMF网元接收到第一UE的角色时，第一UE的DDNMF网元或第一UE的PKMF网元还会进一步确定第一UE需执行的服务所对应的应用程序代码，并将第一UE需执行的服务所对应的应用程序代码携带于发现响应消息中发送至第一UE，该应用程序代码可以用于：第一UE基于该应用程序代码发现与第一UE执行相同服务的其他UE。
此外，在本公开的一个实施例之中，当该第一UE的DDNMF网元或第一UE的PKMF网元接收到的第一授权响应消息指示授权失败时，则该第一UE的DDNMF网元或第一UE的PKMF网元不会生成密钥信息和应用程序代码，且向第一UE发送用于指示拒绝第一UE的发现请求的发现响应消息。
综上所述，在本公开实施例提供的UE的授权令牌的生成方法之中，第一UE的DDNMF网元或第一UE的PKMF网元会接收第一UE发送的发现请求消息，该发现请求消息用于为第一UE请求授权令牌，授权令牌用于对UE所声明的UE角色进行授权验证；之后，会向服务器或UDM网元发送第一授权请求消息；并接收服务器或UDM网元发送的第一授权响应消息，该第一授权响应消息包括服务器或UDM网元生成的第一UE的授权令牌；最后，第一UE的DDNMF网元或第一UE的PKMF网元会向第一UE发送发现响应消息，发现响应消息包括的授权令牌。由此可知，本公开中UE可以获取到网络设备为该UE生成的授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证。基于此，当后续UE之间进行发现过程时，两UE可以交互各自的授权令牌，以便两UE均可以基于对端UE的授权令牌来对对端UE声明的UE角色进行授权验证，从而避免了UE间的相互欺骗，提升了服务执行的准确性，还提升了信息安全性。同时，由于还会向UE发送UE请求发现的服务对应的密钥信息，该密钥信息可以用于：对UE后续发现其他UE的过程进行安全保护，以确保该UE在后续发现过程中传输UE的角色和UE的授权令牌时，不相关UE无法监听或篡改UE的角色，以及无法获取到UE的授权令牌，从而防止了不相关UE冒充该UE的角色，避免了后续服务执行的过程中其他不相关UE干扰，进一步提升了服务执行的准确性和信息安全性。
图2m为本公开实施例所提供的一种UE的授权令牌的生成方法的流程示意图，该方法由第一UE的DDNMF网元或第一UE的PKMF网元执行，如图2所示，该UE的授权令牌的生成方法可以包括以下步骤：
步骤201m、接收第一UE发送的发现请求消息(Discovery Request message)，发现请求消息用于为第一UE请求授权令牌，授权令牌用于对UE所声明的UE角色进行授权验证。
步骤202m、向服务器或UDM网元发送第一授权请求消息(Authorization Request)。
具体的，在本公开的一个实施例之中，该向服务器或UDM网元发送第一授权请求消息的方法可以为：先将第一UE对应的RAUID转换为能被服务器或UDM网元识别的第一标识，该第一标识用于指示第一UE；再将第一标识、第一UE请求发现的服务、第一UE的能力中的至少一种携带于第一授权请求消息中发送至服务器或UDM网元。
进一步地，在本公开的一个实施例之中，该服务器例如可以为：测距或侧行链路定位服务器(Ranging/SL positioning服务器)。
步骤203m、接收服务器或UDM网元发送的第一授权响应消息(Authorization Response)，该第一授权响应消息包括服务器或UDM网元确定的第一授权信息，第一授权信息包括第一UE的授权相关的信息。
步骤204m、基于第一授权信息为第一UE生成授权令牌。
步骤205m、向第一UE发送发现响应消息(Discovery Request)，该发现响应消息包括第一UE的授权令牌。
综上所述，在本公开实施例提供的UE的授权令牌的生成方法之中，第一UE的DDNMF网元或第一UE的PKMF网元会接收第一UE发送的发现请求消息，该发现请求消息用于为第一UE请求授权令牌，授权令牌用于对UE所声明的UE角色进行授权验证；之后，会向服务器或UDM网元发送第一授权请求消息；并接收服务器或UDM网元发送的第一授权响应消息，该第一授权响应消息包括服务器或UDM网元生成的第一UE的授权令牌；最后，第一UE的DDNMF网元或第一UE的PKMF网元会向第一UE发送发现响应消息，发现响应消息包括的授权令牌。由此可知，本公开中UE可以获取到网络设备为该UE生成的授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证。基于此，当后续UE之间进行发现过程时，两UE可以交互各自的授权令牌，以便两UE均可以基于对端UE的授权令牌来对对端UE声明的UE角色进行授权验证，从而避免了UE间的相互欺骗，提升了服务执行的准确性，还提升了信息安全性。同时，由于还会向UE发送UE请求发现的服务对应的密钥信息，该密钥信息可以用于：对UE后续发现其他UE的过程进行安全保护，以确保该UE在后续发现过程中传输UE的角色和UE的授权令牌时，不相关UE无法监听或篡改UE的角色，以及无法获取到UE的授权令牌，从而防止了不相关UE冒充该UE的角色，避免了后续服务执行的过程中其他不相关UE干扰，进一步提升了服务执行的准确性和信息安全性。
图3为本公开实施例所提供的一种UE的授权令牌的生成方法的流程示意图，该方法由第一UE的DDNMF网元或第一UE的PKMF网元执行，如图3所示，该UE的授权令牌的生成方法可以包括以下步骤：
步骤301、接收第二UE的DDNMF网元或第二UE的PKMF网元发送的监听请求消息(Monitor Request message)。
其中，在本公开的一个实施例之中，该监听请求消息可以为：第二UE的DDNMF网元或第二UE的PKMF网元获取到服务器或UDM网元确定的第二UE的角色之后发送至第一UE的DDNMF网元或第一UE的PKMF网元的，该监听请求消息包括第二UE的角色、第二UE请求发现的服务、用于指示第二UE的第二标识中的至少一种。关于第二UE的DDNMF网元或第二UE的PKMF网元获取服务器或UDM网元确定的第二UE的角色的具体流程与第一UE的DDNMF网元或第一UE的PKMF网元获取第一UE的角色的具体流程类似，参见后续第二UE的DDNMF网元或第二UE的PKMF网元侧实施例介绍。
步骤302、响应于第二UE请求发现的服务与第一UE请求发现的服务相同，向服务器或UDM网元发送第二授权请求消息，该第二授权请求消息中包括第一UE的角色、第二UE的角色和两UE请求发现的服务。
步骤303、接收服务器或UDM网元发送的第二授权响应消息，第二授权响应消息包括第三授权信息，第三授权信息至少指示第一UE和第二UE在两UE请求发现的服务中的匹配关系。
其中，在本公开的一个实施例之中，该第二授权响应中包括第三授权信息的前提为：服务器或UDM网元确定第一UE的角色与第二UE的角色相互匹配。
步骤304、向第二UE的DDNMF网元或第二UE的PKMF网元发送监听响应消息(Monitor Response message)，该监听响应消息中包括第三授权信息。
其中，在本公开的一个实施例之中，通过向第二UE的DDNMF网元或第二UE的PKMF网元发送该第三授权信息，以便第二UE的DDNMF网元或第二UE的PKMF网元可以基于该第三授权信息生成第二UE的授权令牌。
在本公开的一个实施例之中，该监听响应消息中还携带有第一UE的DDNMF网元或第一UE的PKMF网元为第一UE请求发现的相同服务所生成的密钥信息，这样可以使得，第二UE请求发现的服务所对应的密钥信息与第一UE请求发现的服务所对应的密钥信息相同。
需要说明的是，在本公开的一个实施例之中，当第一UE的角色和第二UE的角色相互匹配时，则说明第一UE和第二UE相互配合可以完成两UE请求发现的服务。则此时，第一UE的DDNMF网元或第一UE的PKMF网元应当为第二UE请求发现的服务生成与其为第一UE请求发现的服务生成的安全发现密钥相同的安全发现密钥，以便后续第二UE可以基于相同的安全发现密钥来成功验证第一UE 在发现过程中所传输的信息，从而确保两UE能成功相互发现，以成功完成两UE请求发现的服务。
此外，在本公开的一个实施例之中，当第一UE的DDNMF网元或第一UE的PKMF网元从服务器或UDM网元处接收到的第二授权响应消息指示第一UE的角色和第二UE的角色在两UE请求发现的服务中不匹配，则第一UE的DDNMF网元或第一UE的PKMF网元应向第二UE的DDNMF网元或第二UE的PKMF网元发送指示拒绝监听请求的监听响应消息。
综上所述，在本公开实施例提供的UE的授权令牌的生成方法之中，第一UE的DDNMF网元或第一UE的PKMF网元会接收第一UE发送的发现请求消息，该发现请求消息用于为第一UE请求授权令牌，授权令牌用于对UE所声明的UE角色进行授权验证；之后，会向服务器或UDM网元发送第一授权请求消息；并接收服务器或UDM网元发送的第一授权响应消息，该第一授权响应消息包括服务器或UDM网元生成的第一UE的授权令牌；最后，第一UE的DDNMF网元或第一UE的PKMF网元会向第一UE发送发现响应消息，发现响应消息包括的授权令牌。由此可知，本公开中UE可以获取到网络设备为该UE生成的授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证。基于此，当后续UE之间进行发现过程时，两UE可以交互各自的授权令牌，以便两UE均可以基于对端UE的授权令牌来对对端UE声明的UE角色进行授权验证，从而避免了UE间的相互欺骗，提升了服务执行的准确性，还提升了信息安全性。同时，由于还会向UE发送UE请求发现的服务对应的密钥信息，该密钥信息可以用于：对UE后续发现其他UE的过程进行安全保护，以确保该UE在后续发现过程中传输UE的角色和UE的授权令牌时，不相关UE无法监听或篡改UE的角色，以及无法获取到UE的授权令牌，从而防止了不相关UE冒充该UE的角色，避免了后续服务执行的过程中其他不相关UE干扰，进一步提升了服务执行的准确性和信息安全性。
图4为本公开实施例所提供的一种UE的授权令牌的生成方法的流程示意图，该方法由第二UE的DDNMF网元或第二UE的PKMF网元执行，如图4所示，该UE的授权令牌的生成方法可以包括以下步骤：
步骤401、接收第二UE发送的发现请求消息，发现请求消息用于为第二UE请求授权令牌，授权令牌用于对UE所声明的UE角色进行授权验证。
可选的，在本公开的一个实施例之中，发现请求消息中可以包括以下至少一种：
第二UE对应的RAUID；
第二UE请求发现的服务；
第二UE的能力。
其中，上述的RAUID用于指示UE，以便网络设备知晓是哪个UE发送的发现请求消息。
步骤402、向服务器或UDM网元发送第一授权请求消息。
可选的，向服务器或UDM网元发送第一授权请求消息可以包括：
将第二UE对应的RAUID转换为能被服务器或UDM网元识别的第二标识，第二标识用于指示第二UE；
将第二标识、第二UE请求发现的服务、第二UE的能力中的至少一种携带于授权请求消息中发送至服务器或UDM网元。
步骤403、接收服务器或UDM网元发送的第一授权响应消息，第一授权响应消息包括服务器或UDM网元生成的第二UE的授权令牌。
可选的，第二UE的授权令牌用于：在发现过程中第二UE的对端UE对接收到的由第二UE传输的第二UE的角色进行授权验证。
步骤404、向第二UE发送发现响应消息，发现响应消息包括第二UE的授权令牌。
其中，该发现响应消息中还可以携带有和第一UE的DDNMF网元或第二UE的PKMF网元为第二UE请求发现的服务生成的密钥信息。
上述的步骤401-404的原理与前述的图2实施例中的步骤201-204的原理雷同，其他可参考前述实施例介绍。
综上所述，在本公开实施例提供的UE的授权令牌的生成方法之中，第二UE的DDNMF网元或第 二UE的PKMF网元会接收第二UE发送的发现请求消息，该发现请求消息用于为第二UE请求授权令牌，授权令牌用于对UE所声明的UE角色进行授权验证；之后，会向服务器或UDM网元发送第一授权请求消息；并接收服务器或UDM网元发送的第一授权响应消息，该第一授权响应消息包括服务器或UDM网元生成的第二UE的授权令牌；最后，第二UE的DDNMF网元或第二UE的PKMF网元会向第二UE发送发现响应消息，发现响应消息包括的授权令牌。由此可知，本公开中UE可以获取到网络设备为该UE生成的授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证。基于此，当后续UE之间进行发现过程时，两UE可以交互各自的授权令牌，以便两UE均可以基于对端UE的授权令牌来对对端UE声明的UE角色进行授权验证，从而避免了UE间的相互欺骗，提升了服务执行的准确性，还提升了信息安全性。同时，由于还会向UE发送UE请求发现的服务对应的密钥信息，该密钥信息可以用于：对UE后续发现其他UE的过程进行安全保护，以确保该UE在后续发现过程中传输UE的角色和UE的授权令牌时，不相关UE无法监听或篡改UE的角色，以及无法获取到UE的授权令牌，从而防止了不相关UE冒充该UE的角色，避免了后续服务执行的过程中其他不相关UE干扰，进一步提升了服务执行的准确性和信息安全性。
图5为本公开实施例所提供的一种UE的授权令牌的生成方法的流程示意图，该方法由第二UE的DDNMF网元或第二UE的PKMF网元执行，如图4所示，该UE的授权令牌的生成方法可以包括以下步骤：
步骤501、接收第二UE发送的发现请求消息，发现请求消息用于为第二UE请求授权令牌，授权令牌用于对UE所声明的UE角色进行授权验证。
其中，上述的RAUID用于指示UE，以便网络设备知晓是哪个UE发送的发现请求消息。
步骤502、向服务器或UDM网元发送第一授权请求消息。
步骤503、接收服务器或UDM网元发送的第一授权响应消息，第一授权响应消息包括服务器或UDM网元确定的第二授权信息，第二授权信息包括第二UE的授权相关的信息。
步骤504、向第一UE的DDNMF网元或第一UE的PKMF网元发送监听请求消息，该监听请求消息中携带有第二UE的角色、第二UE请求发现的服务、用于指示第二UE的第二标识中的至少一种。
需要说明的是，在本公开的一个实施例之中，第二UE实质是知晓对端UE(即第一UE)是哪个UE的，基于此，第二UE在向第二UE的DDNMF网元或第二UE的PKMF网元发送发现请求消息时，还可以在该发现请求消息中携带指示第一UE，或者，指示第一UE的DDNMF网元或PKMF网元的指示信息，以便第二UE的DDNMF网元或第二UE的PKMF网元能够基于该指示信息确定出其需要向哪一个UE的DDNMF网元或PKMF网元来发送该监听请求消息，以此确保第二UE的DDNMF网元或PKMF网元能够成功向第一UE的DDNMF网元或PKMF网元发送该监听请求消息。
步骤505、接收第一UE的DDNMF网元或第一UE的PKMF网元发送的监听响应消息，监听响应消息包括第三授权信息，第三授权信息至少指示第一UE和第二UE在两UE请求发现的服务中的匹配关系。
其中，在本公开的一个实施例之中，该监听响应消息中还携带有第二UE请求发现的服务所对应的密钥信息；其中，该密钥信息为：第一UE的DDNMF网元或第一UE的PKMF网元接收到服务器或UDM网元发送的用于指示第一UE的角色和第二UE的角色相互匹配的第二授权响应消息之后，发送至第二UE的DDNMF网元或第二UE的PKMF网元的，且该第二UE请求发现的服务所对应的密钥信息与第一UE请求发现的服务所对应的安全密钥相同。
步骤506、基于第二授权信息以及第三授权信息生成第二UE的授权令牌。
步骤507、向第二UE发送发现响应消息，发现响应消息包括第二UE的授权令牌。
关于步骤501-507的详细介绍可以参考前述实施例描述，本公开实施例在此不做赘述。
综上所述，在本公开实施例提供的UE的授权令牌的生成方法之中，第二UE的DDNMF网元或第二UE的PKMF网元会接收第二UE发送的发现请求消息，该发现请求消息用于为第二UE请求授权令牌，授权令牌用于对UE所声明的UE角色进行授权验证；之后，会向服务器或UDM网元发送第一授权请求消息；并接收服务器或UDM网元发送的第一授权响应消息，该第一授权响应消息包括服务器或 UDM网元生成的第二UE的授权令牌；最后，第二UE的DDNMF网元或第二UE的PKMF网元会向第二UE发送发现响应消息，发现响应消息包括的授权令牌。由此可知，本公开中UE可以获取到网络设备为该UE生成的授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证。基于此，当后续UE之间进行发现过程时，两UE可以交互各自的授权令牌，以便两UE均可以基于对端UE的授权令牌来对对端UE声明的UE角色进行授权验证，从而避免了UE间的相互欺骗，提升了服务执行的准确性，还提升了信息安全性。同时，由于还会向UE发送UE请求发现的服务对应的密钥信息，该密钥信息可以用于：对UE后续发现其他UE的过程进行安全保护，以确保该UE在后续发现过程中传输UE的角色和UE的授权令牌时，不相关UE无法监听或篡改UE的角色，以及无法获取到UE的授权令牌，从而防止了不相关UE冒充该UE的角色，避免了后续服务执行的过程中其他不相关UE干扰，进一步提升了服务执行的准确性和信息安全性。
图6为本公开实施例所提供的一种UE的授权令牌的生成方法的流程示意图，该方法由服务器或UDM网元执行，如图6所示，该UE的授权令牌的生成方法可以包括以下步骤：
步骤601、接收第一UE和/或第二UE的DDNMF网元或PKMF网元发送的第一授权请求消息，第一授权请求消息用于为第一UE和/或第二UE请求授权令牌，授权令牌用于对UE所声明的UE角色进行授权验证。
可选的，第一授权请求消息中包括以下至少一种：
用于指示第一UE和/或第二UE的标识；
第一UE和/或第二UE请求发现的服务；
第一UE和/或第二UE的能力。
步骤602、向第一UE和/或第二UE的DDNMF网元或PKMF网元发送第一授权响应消息，第一授权响应消息包括第一UE和/或第二UE的授权令牌，或者第一授权信息和/或第二授权信息；其中，第一授权信息包括第一UE的授权相关的信息，第二授权信息包括第二UE的授权相关的信息。
其中，关于步骤601-602的详细原理介绍可以参考前述实施例描述。
综上所述，在本公开实施例提供的UE的授权令牌的生成方法之中，服务器或UDM网元会接收第一UE和/或第二UE的DDNMF网元或PKMF网元发送的第一授权请求消息，第一授权请求消息用于为第一UE和/或第二UE请求授权令牌，授权令牌用于对UE所声明的UE角色进行授权验证；之后，服务器或UDM网元会向第一UE和/或第二UE的DDNMF网元或PKMF网元发送第一授权响应消息，第一授权响应消息包括第一UE和/或第二UE的授权令牌，或者第一授权信息和/或第二授权信息；其中，第一授权信息包括第一UE的授权相关的信息，第二授权信息包括第二UE的授权相关的信息。由此可知，本公开中可以为UE生成授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证。基于此，当后续UE之间进行发现过程时，两UE可以交互各自的授权令牌，以便两UE均可以基于对端UE的授权令牌来对对端UE声明的UE角色进行授权验证，从而避免了UE间的相互欺骗，提升了服务执行的准确性，还提升了信息安全性。
图7为本公开实施例所提供的一种UE的授权令牌的生成方法的流程示意图，该方法由服务器或UDM网元执行，如图7所示，该UE的授权令牌的生成方法可以包括以下步骤：
步骤701、基于服务器或UDM网元为第一UE和/或第二UE授权的角色生成第一UE和/或第二UE的授权令牌。
综上所述，在本公开实施例提供的UE的授权令牌的生成方法之中，服务器或UDM网元会接收第一UE和/或第二UE的DDNMF网元或PKMF网元发送的第一授权请求消息，第一授权请求消息用于为第一UE和/或第二UE请求授权令牌，授权令牌用于对UE所声明的UE角色进行授权验证；之后，服务器或UDM网元会向第一UE和/或第二UE的DDNMF网元或PKMF网元发送第一授权响应消息，第一授权响应消息包括第一UE和/或第二UE的授权令牌，或者第一授权信息和/或第二授权信息；其中，第一授权信息包括第一UE的授权相关的信息，第二授权信息包括第二UE的授权相关的信息。由此可知，本公开中可以为UE生成授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证。基于此，当后续UE之间进行发现过程时，两UE可以交互各自的授权令牌，以便两UE均可以基于对 端UE的授权令牌来对对端UE声明的UE角色进行授权验证，从而避免了UE间的相互欺骗，提升了服务执行的准确性，还提升了信息安全性。
图8为本公开实施例所提供的一种UE的授权令牌的生成方法的流程示意图，该方法由服务器或UDM网元执行，如图8所示，该UE的授权令牌的生成方法可以包括以下步骤：
步骤801、基于第一UE和/或第二UE的签约信息确定第一授权信息和/或第二授权信息。
综上所述，在本公开实施例提供的UE的授权令牌的生成方法之中，服务器或UDM网元会接收第一UE和/或第二UE的DDNMF网元或PKMF网元发送的第一授权请求消息，第一授权请求消息用于为第一UE和/或第二UE请求授权令牌，授权令牌用于对UE所声明的UE角色进行授权验证；之后，服务器或UDM网元会向第一UE和/或第二UE的DDNMF网元或PKMF网元发送第一授权响应消息，第一授权响应消息包括第一UE和/或第二UE的授权令牌，或者第一授权信息和/或第二授权信息；其中，第一授权信息包括第一UE的授权相关的信息，第二授权信息包括第二UE的授权相关的信息。由此可知，本公开中可以为UE生成授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证。基于此，当后续UE之间进行发现过程时，两UE可以交互各自的授权令牌，以便两UE均可以基于对端UE的授权令牌来对对端UE声明的UE角色进行授权验证，从而避免了UE间的相互欺骗，提升了服务执行的准确性，还提升了信息安全性。
图9a为本公开实施例所提供的一种UE的授权令牌的生成方法的流程示意图，该方法由第一UE执行，如图9a所示，该UE的授权令牌的生成方法可以包括以下步骤：
步骤901a、接收第一UE的DDNMF网元或第一UE的PKMF网元发送的第二授权请求消息。
步骤902a、基于第一UE的签约信息和第二UE的签约信息确定第三授权信息。
步骤903a、向第一UE的DDNMF网元或第一UE的PKMF网元发送第二授权响应消息，第二授权响应消息包括第三授权信息，第三授权信息至少指示第一UE和第二UE在两UE请求发现的服务中的匹配关系。
综上所述，在本公开实施例提供的UE的授权令牌的生成方法之中，服务器或UDM网元会接收第一UE和/或第二UE的DDNMF网元或PKMF网元发送的第一授权请求消息，第一授权请求消息用于为第一UE和/或第二UE请求授权令牌，授权令牌用于对UE所声明的UE角色进行授权验证；之后，服务器或UDM网元会向第一UE和/或第二UE的DDNMF网元或PKMF网元发送第一授权响应消息，第一授权响应消息包括第一UE和/或第二UE的授权令牌，或者第一授权信息和/或第二授权信息；其中，第一授权信息包括第一UE的授权相关的信息，第二授权信息包括第二UE的授权相关的信息。由此可知，本公开中可以为UE生成授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证。基于此，当后续UE之间进行发现过程时，两UE可以交互各自的授权令牌，以便两UE均可以基于对端UE的授权令牌来对对端UE声明的UE角色进行授权验证，从而避免了UE间的相互欺骗，提升了服务执行的准确性，还提升了信息安全性。
图9b为本公开实施例所提供的一种UE的角色授权方法的流程示意图，该方法由第一UE执行，如图9b所示，该UE的角色授权方法可以包括以下步骤：
步骤901b、向第一UE的DDNMF网元或第一UE的PKMF网元发送发现请求消息，发现请求消息用于为第一UE请求授权令牌，授权令牌用于对UE所声明的UE角色进行授权验证；
步骤902b、接收第一UE的DDNMF网元或第一UE的PKMF网元发送的发现响应消息，发现响应消息包括第一UE的授权令牌、第一UE的角色和第一UE请求发现的服务所对应的密钥信息。
综上所述，在本公开实施例提供的UE的授权令牌的生成方法之中，第一UE会向第一UE的DDNMF网元或第一UE的PKMF网元发送发现请求消息，发现请求消息用于为第一UE请求授权令牌，授权令牌用于对UE所声明的UE角色进行授权验证；第一UE会接收第一UE的DDNMF网元或第一UE的PKMF网元发送的发现响应消息，发现响应消息包括第一UE的授权令牌。由此可知，本公开中UE可以获取到网络设备为该UE生成的授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证。基于此，当后续UE之间进行发现过程时，两UE可以交互各自的授权令牌，以便两UE均可以基于对端UE的授权令牌来对对端UE声明的UE角色进行授权验证，从而避免了UE间的相互欺骗，提升了 服务执行的准确性，还提升了信息安全性。同时，由于还会向UE发送UE请求发现的服务对应的密钥信息，该密钥信息可以用于：对UE后续发现其他UE的过程进行安全保护，以确保该UE在后续发现过程中传输UE的角色和UE的授权令牌时，不相关UE无法监听或篡改UE的角色，以及无法获取到UE的授权令牌，从而防止了不相关UE冒充该UE的角色，避免了后续服务执行的过程中其他不相关UE干扰，进一步提升了服务执行的准确性和信息安全性。
图10为本公开实施例所提供的一种UE的授权令牌的生成方法的流程示意图，该方法由第一UE执行，如图10所示，该UE的授权令牌的生成方法可以包括以下步骤：
步骤1001、广播第一发现消息，该第一发现消息由第一UE请求发现的服务所对应的密钥信息保护，第一发现消息中包括第一UE的角色、第一UE的授权令牌第一UE请求发现的服务所对应的应用程序代码。
其中，在本公开的一个实施例之中，第一UE通过广播由第一UE请求发现的服务所对应的密钥信息保护的第一发现消息，则基于第二UE请求发现的服务所对应的密钥信息与第一UE请求发现的服务所对应的安全密钥形同，由此第二UE可以利用相同的密钥信息成功验证出第一UE广播的第一发现消息，实现与第一UE的成功发现，之后，第二UE即可验证第二UE的角色与第一UE的角色是否匹配，以及，通过第一UE的授权令牌对第一广播消息中包括的第一UE的角色验证时授权，以便确保后续是否与第一UE建立连接。
综上所述，在本公开实施例提供的UE的授权令牌的生成方法之中，第一UE会向第一UE的DDNMF网元或第一UE的PKMF网元发送发现请求消息，发现请求消息用于为第一UE请求授权令牌，授权令牌用于对UE所声明的UE角色进行授权验证；第一UE会接收第一UE的DDNMF网元或第一UE的PKMF网元发送的发现响应消息，发现响应消息包括第一UE的授权令牌。由此可知，本公开中UE可以获取到网络设备为该UE生成的授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证。基于此，当后续UE之间进行发现过程时，两UE可以交互各自的授权令牌，以便两UE均可以基于对端UE的授权令牌来对对端UE声明的UE角色进行授权验证，从而避免了UE间的相互欺骗，提升了服务执行的准确性，还提升了信息安全性。同时，由于还会向UE发送UE请求发现的服务对应的密钥信息，该密钥信息可以用于：对UE后续发现其他UE的过程进行安全保护，以确保该UE在后续发现过程中传输UE的角色和UE的授权令牌时，不相关UE无法监听或篡改UE的角色，以及无法获取到UE的授权令牌，从而防止了不相关UE冒充该UE的角色，避免了后续服务执行的过程中其他不相关UE干扰，进一步提升了服务执行的准确性和信息安全性。
图11为本公开实施例所提供的一种UE的授权令牌的生成方法的流程示意图，该方法由第一UE执行，如图11所示，该UE的授权令牌的生成方法可以包括以下步骤：
步骤1101、接收第二UE广播的第二发现消息，该第二发现消息由第二UE请求发现的服务所对应的密钥信息保护，该二发现消息中包括第二UE的角色、第二UE的授权令牌第二UE请求发现的服务所对应的应用程序代码。
步骤1102、基于第一UE请求发现的服务所对应的密钥信息解码验证第二发现消息；响应于验证成功，确定第二UE请求发现的服务所对应的应用程序代码与第一UE请求发现的服务所对应的应用程序代码是否一致，若一致，确定第二UE的角色与第一UE的角色是否匹配，以及基于第二UE的授权令牌对第二发现消息中包括的第二UE的角色进行授权。
其中，关于第一UE利用密钥信息验证第二发现消息的原理可以参考上述实施例描述，上述的第二UE请求发现的服务所对应的应用程序代码与第一UE请求发现的服务所对应的应用程序代码一致则说明，两UE请求发现的服务相同，则此时可以进一步确定两UE的角色是否匹配，以及基于第二UE的授权令牌对第二发现消息中包括的第二UE的角色进行授权，若匹配且授权成功，则说明两UE配合可以完成两UE请求发现的服务且第二UE未欺骗第一UE，则两UE可以建立连接以完成服务，若不匹配，则说明两UE无法完成两UE请求发现的服务，或者，若授权未成功，则说明第二UE欺骗了第一UE，此时，两UE不建立建立。
步骤1103、响应于第一UE的角色与第二UE的角色相互匹配，且对第二发现消息中包括的第二 UE的角色授权成功，向第二UE发送第一响应消息，第一响应消息由第一UE请求发现的服务所对应的密钥信息保护，第一响应消息中包括第一UE的授权令牌、第一UE的角色和第一UE请求发现的服务所对应的应用程序代码。
其中，上述步骤1101-1103为第一UE和第二UE的发现过程，当两UE相互发现之后，即可建立连接以实现服务。
综上所述，在本公开实施例提供的UE的授权令牌的生成方法之中，第一UE会向第一UE的DDNMF网元或第一UE的PKMF网元发送发现请求消息，发现请求消息用于为第一UE请求授权令牌，授权令牌用于对UE所声明的UE角色进行授权验证；第一UE会接收第一UE的DDNMF网元或第一UE的PKMF网元发送的发现响应消息，发现响应消息包括第一UE的授权令牌。由此可知，本公开中UE可以获取到网络设备为该UE生成的授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证。基于此，当后续UE之间进行发现过程时，两UE可以交互各自的授权令牌，以便两UE均可以基于对端UE的授权令牌来对对端UE声明的UE角色进行授权验证，从而避免了UE间的相互欺骗，提升了服务执行的准确性，还提升了信息安全性。同时，由于还会向UE发送UE请求发现的服务对应的密钥信息，该密钥信息可以用于：对UE后续发现其他UE的过程进行安全保护，以确保该UE在后续发现过程中传输UE的角色和UE的授权令牌时，不相关UE无法监听或篡改UE的角色，以及无法获取到UE的授权令牌，从而防止了不相关UE冒充该UE的角色，避免了后续服务执行的过程中其他不相关UE干扰，进一步提升了服务执行的准确性和信息安全性。
图12为本公开实施例所提供的一种UE的授权令牌的生成方法的流程示意图，该方法由第二UE执行，如图12所示，该UE的授权令牌的生成方法可以包括以下步骤：
步骤1201、向第二UE的DDNMF网元或第二UE的PKMF网元发送发现请求消息，发现请求消息用于为第一UE请求授权令牌，授权令牌用于对UE所声明的UE角色进行授权验证；
步骤1202、接收第二UE的DDNMF网元或第二UE的PKMF网元发送的发现响应消息，发现响应消息包括第一UE的授权令牌、第二UE的角色和第二UE请求发现的服务所对应的密钥信息。
综上所述，在本公开实施例提供的UE的授权令牌的生成方法之中，在本公开实施例提供的UE的授权令牌的生成方法之中，第二UE会向第二UE的DDNMF网元或第二UE的PKMF网元发送发现请求消息，发现请求消息用于为第二UE请求授权令牌，授权令牌用于对UE所声明的UE角色进行授权验证；第二UE会接收第二UE的DDNMF网元或第二UE的PKMF网元发送的发现响应消息，发现响应消息包括第二UE的授权令牌。由此可知，本公开中UE可以获取到网络设备为该UE生成的授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证。基于此，当后续UE之间进行发现过程时，两UE可以交互各自的授权令牌，以便两UE均可以基于对端UE的授权令牌来对对端UE声明的UE角色进行授权验证，从而避免了UE间的相互欺骗，提升了服务执行的准确性，还提升了信息安全性。同时，由于还会向UE发送UE请求发现的服务对应的密钥信息，该密钥信息可以用于：对UE后续发现其他UE的过程进行安全保护，以确保该UE在后续发现过程中传输UE的角色和UE的授权令牌时，不相关UE无法监听或篡改UE的角色，以及无法获取到UE的授权令牌，从而防止了不相关UE冒充该UE的角色，避免了后续服务执行的过程中其他不相关UE干扰，进一步提升了服务执行的准确性和信息安全性。
图13为本公开实施例所提供的一种UE的授权令牌的生成方法的流程示意图，该方法由第二UE执行，如图13所示，该UE的授权令牌的生成方法可以包括以下步骤：
步骤1301、接收第一UE广播的第一发现消息，第一发现消息由第一UE请求发现的服务所对应的密钥信息保护，第一发现消息包括第一UE的授权令牌、第一UE的角色和第一UE请求发现的服务所对应的应用程序代码。
步骤1302、基于第二UE请求发现的服务所对应的密钥信息解码验证第一发现消息；响应于验证成功，确定第一UE请求发现的服务所对应的应用程序代码与第二UE请求发现的服务所对应的应用程序代码是否一致，若一致，确定第二UE的角色与第一UE的角色是否匹配，以及基于第一UE的授权令牌对第一发现消息中包括的第一UE的角色进行授权。
综上所述，在本公开实施例提供的UE的授权令牌的生成方法之中，在本公开实施例提供的UE的授权令牌的生成方法之中，第二UE会向第二UE的DDNMF网元或第二UE的PKMF网元发送发现请求消息，发现请求消息用于为第二UE请求授权令牌，授权令牌用于对UE所声明的UE角色进行授权验证；第二UE会接收第二UE的DDNMF网元或第二UE的PKMF网元发送的发现响应消息，发现响应消息包括第二UE的授权令牌。由此可知，本公开中UE可以获取到网络设备为该UE生成的授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证。基于此，当后续UE之间进行发现过程时，两UE可以交互各自的授权令牌，以便两UE均可以基于对端UE的授权令牌来对对端UE声明的UE角色进行授权验证，从而避免了UE间的相互欺骗，提升了服务执行的准确性，还提升了信息安全性。同时，由于还会向UE发送UE请求发现的服务对应的密钥信息，该密钥信息可以用于：对UE后续发现其他UE的过程进行安全保护，以确保该UE在后续发现过程中传输UE的角色和UE的授权令牌时，不相关UE无法监听或篡改UE的角色，以及无法获取到UE的授权令牌，从而防止了不相关UE冒充该UE的角色，避免了后续服务执行的过程中其他不相关UE干扰，进一步提升了服务执行的准确性和信息安全性。
图14为本公开实施例所提供的一种UE的授权令牌的生成方法的流程示意图，该方法由第二UE执行，如图14所示，该UE的授权令牌的生成方法可以包括以下步骤：
步骤1401、广播第二发现消息，第二发现消息由第二UE请求发现的服务所对应的密钥信息保护，第二发现消息包括第二UE的授权令牌、第二UE的角色和第二UE请求发现的服务所对应的应用程序代码。
步骤1402、接收第一UE发送的第一响应消息，第一响应消息由第一UE请求发现的服务所对应的密钥信息保护，第一响应消息中包括第一UE的授权令牌、第一UE的角色和第一UE请求发现的服务所对应的应用程序代码。
步骤1403、基于第二UE请求发现的服务所对应的密钥信息解码验证第一响应消息；响应于验证成功，确定第二UE的角色与第一UE的角色是否匹配，以及基于第一UE的授权令牌对第一响应消息中包括的第一UE的角色进行授权。
综上所述，在本公开实施例提供的UE的授权令牌的生成方法之中，在本公开实施例提供的UE的授权令牌的生成方法之中，第二UE会向第二UE的DDNMF网元或第二UE的PKMF网元发送发现请求消息，发现请求消息用于为第二UE请求授权令牌，授权令牌用于对UE所声明的UE角色进行授权验证；第二UE会接收第二UE的DDNMF网元或第二UE的PKMF网元发送的发现响应消息，发现响应消息包括第二UE的授权令牌。由此可知，本公开中UE可以获取到网络设备为该UE生成的授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证。基于此，当后续UE之间进行发现过程时，两UE可以交互各自的授权令牌，以便两UE均可以基于对端UE的授权令牌来对对端UE声明的UE角色进行授权验证，从而避免了UE间的相互欺骗，提升了服务执行的准确性，还提升了信息安全性。同时，由于还会向UE发送UE请求发现的服务对应的密钥信息，该密钥信息可以用于：对UE后续发现其他UE的过程进行安全保护，以确保该UE在后续发现过程中传输UE的角色和UE的授权令牌时，不相关UE无法监听或篡改UE的角色，以及无法获取到UE的授权令牌，从而防止了不相关UE冒充该UE的角色，避免了后续服务执行的过程中其他不相关UE干扰，进一步提升了服务执行的准确性和信息安全性。
以下对UE的授权令牌的生成方法的交互流程进行介绍：
图15为本公开实施例所提供的一种UE的授权令牌的生成方法的交互流程示意图，如图15所示，包括：
1.A-UE(可以为上述实施例的第一UE)向其5G DDNMF/PKMF发送包含测距应用程序用户ID(RAUID)的发现请求消息，以获取测距应用程序代码以宣布并获得相关的密钥信息。此外，A-UE应在发现请求消息中包括其UE测距服务能力(即上述实施例中的“第一UE的能力”，例如，充当目标/服务器UE的能力)。
2.A-UE的5G DDNMF/PKMF向A-UE的测距/SL定位服务器或UDM发送第一授权请求消息，用于宣布授权，其中包含从A-UE接收到的UE对测距服务的能力。
3.测距/SL定位服务器检查服务协议或A-UE的UDM检查A-UE的订阅，以确定是否允许A-UE扮演与其能力相对应的角色(例如，是否A-UE被允许充当目标/服务器UE)。然后A-UE的测距/SL定位服务器或UDM根据订阅或服务协议中的授权相关信息为A-UE生成一个授权令牌(Auth-Token)。
4.如果UE能力和允许的角色之间存在匹配(例如，允许A-UE充当目标UE或允许A-UE充当目标UE和服务器UE)，则测距/SL定位服务器或A-UE的UDM向5G DDNMF/PKMF返回包含A-UE的角色和A-UE的授权令牌的第一授权响应消息。如果UE能力和允许的角色不匹配(例如，A-UE既不允许作为目标UE也不允许作为服务器UE)，Ranging/SL定位服务器或UDM A-UE返回包含失败原因的第一授权响应消息。
5.如果与Ranging/SL定位服务器或A-UE的UDM授权成功，则A-UE的5G DDNMF/PKMF在发现响应消息中返回测距应用程序代码和对应的密钥信息。密钥信息为A-UE提供必要的信息以保护测距应用代码的传输，并与测距应用代码一起存储。A-UE的5G DDNMF/PKMF还包括在发现响应消息中从Ranging/SL定位服务器或A-UE的UDM接收到的A-UE的角色和A-UE的授权令牌。如果与A-UE的Ranging/SL定位服务器或UDM的授权失败，则A-UE的5G DDNMF/PKMF不生成密钥信息并拒绝来自A-UE的发现请求。
6.M-UE(可以为上述实施例的第二UE)向其5G DDNMF/PKMF发送包含测距应用程序用户ID(RAUID)的发现请求消息，以获取测距应用程序代码以宣布并获得相关的密钥信息。此外，M-UE应在发现请求消息中包含其UE测距服务能力(即上述实施例中的“第二UE的能力”，例如，充当参考/定位UE的能力)。
7.M-UE的5G DDNMF/PKMF向Ranging/SL定位服务器或M-UE的UDM发送第一授权请求消息，其中包含从M-UE接收到的测距服务的UE能力。
8.Ranging/SL定位服务器检查服务协议或M-UE的UDM检查M-UE的订阅，以确定是否允许M-UE扮演与其能力相对应的角色(例如，是否允许M-UE充当参考/定位UE)。然后M-UE的测距/SL定位服务器或UDM根据订阅或服务协议中的授权相关信息为M-UE生成一个授权令牌(Auth-Token)。
9.如果UE能力和允许的角色之间存在匹配(例如，允许M-UE充当参考UE或允许A-UE充当参考UE和定位UE)，则测距/SL定位服务器或M-UE的UDM向5G DDNMF/PKMF返回第一授权响应消息，其中包含M-UE的角色和M-UE的授权令牌。如果UE能力和允许的角色不匹配(例如，M-UE既不允许作为参考UE也不允许作为定位UE)，Ranging/SL定位服务器或UDM M-UE返回包含失败原因的第一授权响应消息。
10.如果向Ranging/SL定位服务器或A-UE的UDM授权成功，则M-UE的5G DDNMF/PKMF通过发送监控请求消息联系A-UE的5G DDNMF/PKMF。如果与A-UE的Ranging/SL定位服务器或UDM的授权失败，则M-UE的5G DDNMF/PKMF拒绝M-UE的Discovery Request，不执行以下步骤。
11.A-UE的5G DDNMF/PKMF向Ranging/SL定位服务器发送第二授权请求消息，其中包含M-UE和A-UE的角色。
12.Ranging/SL定位服务器检查M-UE和A-UE的角色在请求的服务中是否相互匹配(例如，对于两个UE之间的测距服务，两UE的角色是否分别是Target UE和Reference UE，或者是否分别是定位UE和目标UE，若是，则用于两个UE之间的Ranging/SL定位服务)。
13.Ranging/SL定位服务器返回第二授权响应消息，指示授权是否成功。
14.如果与Ranging/SL定位服务器的授权成功，则A-UE的5G DDNMF/PKMF向M-UE的5G DDNMF/PKMF响应一个监听响应消息，包括测距应用程序代码和对应的密钥信息(该安全密钥与向A-UE反馈的安全密钥相同)。密钥信息提供了M-UE撤消A-UE应用的保护所需的信息(即验证A-UE传输的消息时所需的信息)。如果与Ranging/SL定位服务器的授权失败，则A-UE的5G DDNMF/PKMF拒绝来自M-UE的5G DDNMF/PKMF的监听请求消息，不执行以下步骤。
15.M-UE的5G DDNMF/PKMF在发现响应消息中返回密钥信息，以及从测距/SL定位服务器或M-UE的UDM接收到的M-UE的角色和M-UE的授权令牌。
图16a为本公开实施例所提供的一种UE的授权令牌的生成方法的交互流程示意图，如图16a所示，包括：
图16a实施例的步骤步骤1～2与图15的步骤1～2相同。
3.测距/SL定位服务器检查服务协议或A-UE的UDM检查A-UE的订阅，以确定是否允许A-UE扮演与其能力相对应的角色(例如，是否A-UE被允许充当目标/服务器UE)。
4.如果A-UE能力和允许的角色之间存在匹配(例如，允许A-UE充当目标UE或允许A-UE充当目标UE和服务器UE)，则测距/SL定位服务器或A-UE的UDM向5G DDNMF/PKMF返回第一授权响应，其中包含匹配的A-UE角色和A-UE的订阅或服务协议中的授权相关信息(即上述的第一授权信息)。
5.A-UE的5G DDNMF/PKMF根据接收到的授权相关信息(即上述的第一授权信息)为A-UE生成授权令牌。
图16a实施例的步骤步骤6与图15的步骤5相同；
图16a实施例的步骤步骤7-8与图15的步骤6-7相同；
9.Ranging/SL定位服务器检查服务协议或M-UE的UDM检查M-UE的订阅，以确定是否允许M-UE扮演与其能力相对应的角色(例如，是否允许M-UE充当参考/定位UE)。
10.如果M-UE能力和允许的角色之间存在匹配(例如，允许M-UE充当参考UE或允许A-UE充当参考UE和定位UE)，则测距/SL定位服务器或M-UE的UDM向5G DDNMF/PKMF返回授权响应，其中包含M-UE的匹配角色以及M-UE的订阅或服务协议中的授权相关信息(即上述的第二授权信息)。
图16a实施例的步骤步骤11-13与图15的步骤10-12相同；
14.Ranging/SL定位服务器或UDM返回第二授权响应，指示授权是否成功。该响应还可以包括关于所请求服务中的A-UE和M-UE之间的关联的更多授权信息(即上述实施例的第三授权信息)。
15.如果与Ranging/SL定位服务器的授权成功，则A-UE的5G DDNMF/PKMF向M-UE的5G DDNMF/PKMF响应一个监听响应消息，包括相应的密钥信息和授权信息关于请求服务中A-UE和M-UE之间的关联(即上述的第三授权信息)。
16.M-UE的5G DDNMF/PKMF基于在步骤#10和#15中接收到的授权相关信息(即上述实施例的第二授权信息和第三授权信息)为M-UE生成授权令牌。
图16a实施例的步骤步骤17与图15的步骤15相同。
以下对第一UE和第二UE的发现过程的交互流程进行介绍：
图16b为本公开实施例所提供的一种UE的授权令牌的生成方法的交互流程示意图，如图16b所示，包括：
步骤1.A-UE开始第一发现消息。A-UE形成公告消息并用密钥信息保护它。公告消息还包含允许其行动的A-UE的角色以及由网络提供的A-UE的授权令牌。
步骤2.M-UE侦听并接收包含A-UE的授权令牌的第一发现消息，并使用密钥信息验证该消息。
步骤3.M-UE检查A-UE的角色，并确定A-UE的角色是否是它所监视的角色，例如：如果A-UE的角色是目标UE，并且作为参考UE的M-UE可以确定它找到了匹配项。然后，M-UE使用从A-UE接收到的A-UE的授权令牌进一步授权A-UE声明的UE角色(即第一发现消息中包括的A-UE的角色)。
图16c为本公开实施例所提供的一种UE的授权令牌的生成方法的交互流程示意图，如图16c所示，包括：
1.M-UE形成第二发现消息并使用密钥信息保护它后广播。该第二发现消息还包含允许M-UE执行的角色及其由网络提供的M-UE的授权令牌。
2.A-UE监听第二发现消息，并用密钥信息验证该消息，然后A-UE检查第二发现消息中M-UE的角色，并确定第二发现消息中M-UE的角色是否为它监视。例如，如果M-UE的角色是目标UE，并且作为已定位UE的A-UE可以确定它找到了匹配项。然后，A-UE使用从M-UE接收到的M-UE的授权令牌进一步授权M-UE的第二发现消息中包含的角色。
3.A-UE向M-UE返回第一响应消息，其中包含A-UE的角色以及网络提供的A-UE的授权令牌。
4.M-UE使用密钥信息验证发现第一响应消息，然后M-UE检查第一响应消息中的A-UE角色，并确定A-UE角色是否是它请求的角色，然后，M-UE使用从A-UE接收到的A-UE的授权令牌进一步授权A-UE的第一响应消息中声明的UE角色。
图17为本公开实施例所提供的一种通信装置的结构示意图，如图17所示，装置可以包括：
收发模块，用于接收第一UE和/或第二UE发送的发现请求消息，所述发现请求消息用于为第一UE和/或第二UE请求授权令牌，所述授权令牌用于对UE所声明的UE角色进行授权验证；
所述收发模块，还用于向所述第一UE和/或第二UE发送发现响应消息，所述发现响应消息包括所述网络设备为所述第一UE和/或所述第二UE生成的授权令牌。
综上所述，在本公开实施例提供的通信装置之中，网络设备可以接收第一UE和/或第二UE发送的发现请求消息，该发现请求消息用于为第一UE和/或第二UE请求授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证；之后，网络设备可以向第一UE和/或第二UE发送发现响应消息，该发现响应消息包括网络设备为第一UE和/或第二UE生成的授权令牌。由此可知，本公开中，UE可以获取到网络设备为该UE生成的授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证。基于此，当后续UE之间进行发现过程时，两UE可以交互各自的授权令牌，以便两UE均可以基于对端UE的授权令牌来对对端UE声明的UE角色进行授权验证，从而避免了UE间的相互欺骗，提升了服务执行的准确性，还提升了信息安全性。同时，由于还会向UE发送UE请求发现的服务对应的密钥信息，该密钥信息可以用于：对UE后续发现其他UE的过程进行安全保护，以确保该UE在后续发现过程中传输UE的角色和UE的授权令牌时，不相关UE无法监听或篡改UE的角色，以及无法获取到UE的授权令牌，从而防止了不相关UE冒充该UE的角色，避免了后续服务执行的过程中其他不相关UE干扰，进一步提升了服务执行的准确性和信息安全性。
可选的，在本公开的一个实施例之中，所述第一UE和/或所述第二UE的授权令牌至少指示服务器或统一数据管理UDM网元为所述第一UE和/或所述第二UE授权的角色；
可选的，在本公开的一个实施例之中，所述第一UE的授权令牌用于：在发现过程中所述第一UE的对端UE对所述第一UE声明的第一UE的角色进行授权验证；
所述第二UE的授权令牌用于：在发现过程中所述第二UE的对端UE对所述第二UE声明的第二UE的角色进行授权验证。。
可选的，在本公开的一个实施例之中，所述发现请求消息中包括以下至少一种：
应用程序用户标识RAUID；
服务的标识；
所述第一UE和/或第二UE的能力。
可选的，在本公开的一个实施例之中，所述网络侧设备包括：第一网元、第二网元和第三网元，所述第一网元包括所述第一UE的邻近通信服务名称管理功能DDNMF网元或第一UE的邻近通信服务密钥管理功能PKMF网元，所述第二网元包括所述第二UE的DDNMF网元或第二UE的PKMF网元，所述第三网元包括测距定位业务的服务器或统一数据管理UDM网元。
可选的，在本公开的一个实施例之中，
所述第一网元接收所述第一UE发送的发现请求消息；
所述第一网元向所述第一UE发送发现响应消息；
所述第一网元向第三网元发送第一授权请求消息；
所述第三网元向所述第一网元发送第一授权响应消息，所述第一授权响应消息包括第三网元生成的第一UE的授权令牌，或者第三网元确定的第一授权信息，所述第一授权信息包括第一UE的授权相关 的信息。
可选的，在本公开的一个实施例之中，第一网元基于所述第一授权信息生成第一UE的授权令牌。
可选的，在本公开的一个实施例之中，所述第二网元接收所述第二UE发送的发现请求消息；
所述第二网元向所述第二UE发送发现响应消息；
所述第二网元向第三网元发送第一授权请求消息；
所述第三网元向所述第二网元发送第一授权响应消息，所述第一授权响应消息包括第三网元生成的第二UE的授权令牌；或者第三网元确定的第二授权信息，所述第二授权信息包括第二UE的授权相关的信息。
可选的，在本公开的一个实施例之中，所述第二网元向第一网元发送监听请求消息；
所述第一网元向第三网元发送第二授权请求消息；
第三网元向所述第一网元发送第二授权响应消息，所述第二授权响应消息包括第三授权信息，所述第三授权信息至少指示所述第一UE的角色和所述第二UE的角色在两UE请求发现的服务中的匹配关系；
第一网元向第二网元发送监听响应消息，所述监听响应消息包括所述第三授权信息。
图18为本公开实施例所提供的一种通信装置的结构示意图，如图18所示，装置可以包括：
收发模块，用于向网络设备发送发现请求消息，所述发现请求消息用于为第一UE请求授权令牌，所述授权令牌用于对第一UE所声明的UE角色进行授权验证；
所述收发模块，还用于接收所述网络设备发送的发现响应消息，所述发现响应消息包括所述第一UE的授权令牌。
综上所述，在本公开实施例提供的通信装置之中，第一UE可以向网络设备发送发现请求消息，该发现请求消息用于为第一UE请求授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证；之后，第一UE可以接收网络设备发送的发现响应消息，该发现响应消息包括第一UE的授权令牌。由此可知，本公开中，UE可以获取到网络设备为该UE生成的授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证。基于此，当后续UE之间进行发现过程时，两UE可以交互各自的授权令牌，以便两UE均可以基于对端UE的授权令牌来对对端UE声明的UE角色进行授权验证，从而避免了UE间的相互欺骗，提升了服务执行的准确性，还提升了信息安全性。同时，由于还会向UE发送UE请求发现的服务对应的密钥信息，该密钥信息可以用于：对UE后续发现其他UE的过程进行安全保护，以确保该UE在后续发现过程中传输UE的角色和UE的授权令牌时，不相关UE无法监听或篡改UE的角色，以及无法获取到UE的授权令牌，从而防止了不相关UE冒充该UE的角色，避免了后续服务执行的过程中其他不相关UE干扰，进一步提升了服务执行的准确性和信息安全。
可选的，在本公开的一个实施例之中，所述第一UE的授权令牌至少指示所述网络设备为所述第一UE授权的角色。
可选的，在本公开的一个实施例之中，所述装置还用于：
广播第一发现消息，用于发现邻近的UE，其中，所述第一发现消息包括所述第一UE的授权令牌；
接收到所述第二UE发送第一响应消息；所述第一响应消息为所述第二UE根据所述第一UE的授权令牌确定所述第一UE声明的角色后发送的。
可选的，在本公开的一个实施例之中，所述第一发现消息为根据所述第一UE请求发现的服务所对应的密钥信息保护；和/或，
所述第一响应消息为根据所述第二UE请求发现的服务所对应的密钥信息保护。
可选的，在本公开的一个实施例之中，所述装置还用于：
接收第二UE广播的第二发现消息，所述第二发现消息包括所述第二UE的授权令牌；
当根据所述第二UE的授权令牌验证所述第二UE声明的角色为所述网络设备授权的角色时，向所述第二UE发送第二响应消息。
可选的，在本公开的一个实施例之中，
所述第二发现消息还包括所述第二UE的角色；
在所述向所述第二UE发送第二响应消息之前，所述装置还用于：
确定所述第二UE的角色与所述第一UE的角色匹配。
可选的，在本公开的一个实施例之中，所述第二响应消息携带所述第一UE的授权令牌，用于所述第二UE确定所述第一UE声明的角色是否为所述网络设备授权的角色。
可选的，在本公开的一个实施例之中，所述第二发现消息为根据所述第二UE请求发现的服务所对应的密钥信息保护；和/或，
所述第二响应消息为根据所述第一UE请求发现的服务所对应的密钥信息保护。
图19为本公开实施例所提供的一种通信装置的结构示意图，如图19所示，装置可以包括：
收发模块，用于向网络设备发送发现请求消息，所述发现请求消息用于为第二UE请求授权令牌，所述授权令牌用于对第二UE所声明的UE角色进行授权验证；
所述收发模块，还用于接收所述网络设备发送的发现响应消息，所述发现响应消息包括第二UE的授权令牌。
综上所述，在本公开实施例提供的通信装置之中，第二UE可以向网络设备发送发现请求消息，该发现请求消息用于为第二UE请求授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证；之后，第二UE可以接收网络设备发送的发现响应消息，该发现响应消息包括第二UE的授权令牌。由此可知，本公开中，UE可以获取到网络设备为该UE生成的授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证。基于此，当后续UE之间进行发现过程时，两UE可以交互各自的授权令牌，以便两UE均可以基于对端UE的授权令牌来对对端UE声明的UE角色进行授权验证，从而避免了UE间的相互欺骗，提升了服务执行的准确性，还提升了信息安全性。同时，由于还会向UE发送UE请求发现的服务对应的密钥信息，该密钥信息可以用于：对UE后续发现其他UE的过程进行安全保护，以确保该UE在后续发现过程中传输UE的角色和UE的授权令牌时，不相关UE无法监听或篡改UE的角色，以及无法获取到UE的授权令牌，从而防止了不相关UE冒充该UE的角色，避免了后续服务执行的过程中其他不相关UE干扰，进一步提升了服务执行的准确性和信息安全性。
可选的，在本公开的一个实施例之中，所述装置还用于：
接收第一UE广播的第一发现消息，所述第一发现消息包括所述第一UE的授权令牌；
当根据所述第一UE的授权令牌验证所述第一UE声明的角色为所述网络设备授权的角色时，向所述第一UE发送第一响应消息。
可选的，在本公开的一个实施例之中，所述第一发现消息还包括所述第一UE的角色；
所述装置还用于：
确定所述第二UE的角色与所述第一UE的角色是否匹配。
可选的，在本公开的一个实施例之中，所述第一发现消息为根据所述第一UE请求发现的服务所对应的密钥信息保护；和/或，
所述第一响应消息为根据所述第二UE请求发现的服务所对应的密钥信息保护。
可选的，在本公开的一个实施例之中，所述装置还用于：
广播第二发现消息，用于发现邻近的UE，所述第二发现消息包括所述第二UE的授权令牌；
接收所述第一UE发送的第二响应消息，所述第二响应消息包括所述第一UE的授权令牌；
根据所述第一UE的授权令牌验证所述第一UE声明的角色是否为所述网络设备授权的角色。
可选的，在本公开的一个实施例之中，所述第二响应消息还包括所述第一UE的角色；
所述装置还用于：
确定所述第二UE的角色与所述第一UE的角色是否匹配。
图20为本公开实施例所提供的一种通信装置的结构示意图，如图20所示，装置可以包括：
收发模块，用于接收第一UE发送的发现请求消息，所述发现请求消息用于为第一UE请求授权令牌，所述授权令牌用于对第一UE所声明的UE角色进行授权验证；
所述收发模块，还用于向服务器或UDM网元发送第一授权请求消息；
所述收发模块，还用于接收所述服务器或UDM网元发送的第一授权响应消息，所述第一授权响应 消息包括所述服务器或UDM网元生成的所述第一UE的授权令牌，或者包括所述第一授权信息，所述第一授权信息包括第一UE的授权相关的信息；
所述收发模块，还用于向所述第一UE发送发现响应消息，所述发现响应消息包括第一UE的授权令牌。
综上所述，在本公开实施例提供的通信装置之中，第一UE的DDNMF网元或第一UE的PKMF网元会接收第一UE发送的发现请求消息，该发现请求消息用于为第一UE请求授权令牌，所述授权令牌用于对第一UE所声明的UE角色进行授权验证；之后，会向服务器或UDM网元发送第一授权请求消息；并接收服务器或UDM网元发送的第一授权响应消息，该第一授权响应消息包括服务器或UDM网元生成的第一UE的授权令牌；最后，第一UE的DDNMF网元或第一UE的PKMF网元会向第一UE发送发现响应消息，发现响应消息包括的授权令牌。由此可知，本公开中UE可以获取到网络设备为该UE生成的授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证。基于此，当后续UE之间进行发现过程时，两UE可以交互各自的授权令牌，以便两UE均可以基于对端UE的授权令牌来对对端UE声明的UE角色进行授权验证，从而避免了UE间的相互欺骗，提升了服务执行的准确性，还提升了信息安全性。同时，由于还会向UE发送UE请求发现的服务对应的密钥信息，该密钥信息可以用于：对UE后续发现其他UE的过程进行安全保护，以确保该UE在后续发现过程中传输UE的角色和UE的授权令牌时，不相关UE无法监听或篡改UE的角色，以及无法获取到UE的授权令牌，从而防止了不相关UE冒充该UE的角色，避免了后续服务执行的过程中其他不相关UE干扰，进一步提升了服务执行的准确性和信息安全性。
可选的，在本公开的一个实施例之中，所述第一UE的授权令牌至少指示服务器或UDM网元为所述第一UE授权的角色；
所述第一UE的授权令牌用于：在发现过程中所述第一UE的对端UE对接收到的由所述第一UE传输的第一UE的角色进行授权验证。
可选的，在本公开的一个实施例之中，所述发现请求消息中包括以下至少一种：
所述第一UE对应的RAUID；
所述第一UE请求发现的服务；
所述第一UE支持的用于服务的能力。
可选的，在本公开的一个实施例之中，所述装置还用于：
基于所述第一授权信息为所述第一UE生成授权令牌。
可选的，在本公开的一个实施例之中，所述装置还用于：
接收第二UE的DDNMF网元或第二UE的PKMF网元发送的监听请求消息；
向服务器或UDM网元发送第二授权请求消息；
接收服务器或UDM网元发送的第二授权响应消息，所述第二授权响应消息包括第三授权信息，所述第三授权信息至少指示所述第一UE和所述第二UE在两UE请求发现的服务中的匹配关系；
向第二UE的DDNMF网元或第二UE的PKMF网元发送监听响应消息，所述监听响应消息包括所述第三授权信息。
图21a为本公开实施例所提供的一种通信装置的结构示意图，如图21a所示，装置可以包括：
收发模块，用于接收第二UE发送的发现请求消息，所述发现请求消息用于为第二UE请求授权令牌，所述授权令牌用于对第二UE所声明的UE角色进行授权验证；
所述收发模块，还用于向服务器或UDM网元发送第一授权请求消息；
所述收发模块，还用于接收所述服务器或UDM网元发送的第一授权响应消息，所述第一授权响应消息包括所述服务器或UDM网元生成的所述第二UE的授权令牌，或者包括所述第二授权信息，所述第二授权信息包括第二UE的授权相关的信息；
所述收发模块，还用于向所述第二UE发送发现响应消息，所述发现响应消息包括第二UE的授权令牌。
综上所述，在本公开实施例提供的通信装置之中，第二UE的DDNMF网元或第二UE的PKMF 网元会接收第二UE发送的发现请求消息，该发现请求消息用于为第二UE请求授权令牌，所述授权令牌用于对第二UE所声明的UE角色进行授权验证；之后，会向服务器或UDM网元发送第一授权请求消息；并接收服务器或UDM网元发送的第一授权响应消息，该第一授权响应消息包括服务器或UDM网元生成的第二UE的授权令牌；最后，第二UE的DDNMF网元或第二UE的PKMF网元会向第二UE发送发现响应消息，发现响应消息包括的授权令牌。由此可知，本公开中UE可以获取到网络设备为该UE生成的授权令牌，该授权令牌用于对UE所声明的UE角色进行授权验证。基于此，当后续UE之间进行发现过程时，两UE可以交互各自的授权令牌，以便两UE均可以基于对端UE的授权令牌来对对端UE声明的UE角色进行授权验证，从而避免了UE间的相互欺骗，提升了服务执行的准确性，还提升了信息安全性。同时，由于还会向UE发送UE请求发现的服务对应的密钥信息，该密钥信息可以用于：对UE后续发现其他UE的过程进行安全保护，以确保该UE在后续发现过程中传输UE的角色和UE的授权令牌时，不相关UE无法监听或篡改UE的角色，以及无法获取到UE的授权令牌，从而防止了不相关UE冒充该UE的角色，避免了后续服务执行的过程中其他不相关UE干扰，进一步提升了服务执行的准确性和信息安全性。
可选的，在本公开的一个实施例之中，所述第二UE的授权令牌至少指示服务器或UDM网元为所述第二UE授权的角色；
所述第二UE的授权令牌用于：在发现过程中所述第二UE的对端UE对接收到的由所述第二UE传输的第二UE的角色进行授权验证。
可选的，在本公开的一个实施例之中，所述发现请求消息中包括以下至少一种：
所述第二UE对应的RAUID；
所述第二UE请求发现的服务；
所述第二UE支持的用于服务的能力。
可选的，在本公开的一个实施例之中，所述装置还用于：
向第一UE的DDNMF网元或第一UE的PKMF网元发送监听请求消息；
接收第一UE的DDNMF网元或第一UE的PKMF网元发送的监听响应消息，所述监听响应消息包括第三授权信息，所述第三授权信息至少指示所述第一UE和所述第二UE在两UE请求发现的服务中的匹配关系；
基于所述第二授权信息以及所述第三授权信息生成第二UE的授权令牌。
图21b为本公开实施例所提供的一种通信装置的结构示意图，如图21b所示，装置可以包括：
收发模块，用于接收第一UE和/或第二UE的DDNMF网元或PKMF网元发送的第一授权请求消息，所述第一授权请求消息用于为第一UE和/或第二UE请求授权令牌，所述授权令牌用于对UE所声明的UE角色进行授权验证；
所述收发模块，用于向所述第一UE和/或第二UE的DDNMF网元或PKMF网元发送第一授权响应消息，所述第一授权响应消息包括所述第一UE和/或第二UE的授权令牌，或者所述第一授权信息和/或第二授权信息；其中，所述第一授权信息包括第一UE的授权相关的信息，所述第二授权信息包括第二UE的授权相关的信息。
综上所述，在本公开实施例提供的通信装置之中，服务器或UDM网元会接收第一UE和/或第二UE的DDNMF网元或PKMF网元发送的第一授权请求消息，该第一授权请求消息用于为第一UE和/或第二UE请求发现的服务请求授权角色；并会基于第一授权请求消息确定第一UE和/或第二UE的角色；之后，服务器或UDM网元会向第一UE和/或第二UE的DDNMF网元或PKMF网元发送第一授权响应消息，该第一授权响应消息包括所述第一UE和/或第二UE的角色。由此可知，本公开提供了一种对第一UE和/或第二UE在其请求发现的服务中授权角色方法，其中，该第一UE和/或第二UE的角色可以是服务器或UDM网元基于第一UE和/或第二UEUE的能力以及第一UE和/或第二UE在第一UE和/或第二UE请求发现的服务中所能被允许的角色确定的，从而可以保证能为该第一UE和/或第二UE正确授权角色，确保了服务执行时的准确性。
可选的，在本公开的一个实施例之中，所述装置还用于：
基于所述服务器或UDM网元为所述第一UE和/或第二UE授权的角色生成所述第一UE和/或第二UE的授权令牌。
可选的，在本公开的一个实施例之中，所述装置还用于：
基于所述第一UE和/或第二UE的签约信息确定所述第一授权信息和/或第二授权信息。
可选的，在本公开的一个实施例之中，所述装置还用于：
接收所述第一UE的DDNMF网元或第一UE的PKMF网元发送的第二授权请求消息；
向所述第一UE的DDNMF网元或第一UE的PKMF网元发送第二授权响应消息，所述第二授权响应消息包括第三授权信息，所述第三授权信息至少指示所述第一UE和所述第二UE在两UE请求发现的服务中的匹配关系。
可选的，在本公开的一个实施例之中，所述装置还用于：
基于所述第一UE的签约信息和第二UE的签约信息确定第三授权信息。
图22为本公开实施例所提供的一种通信系统的结构示意图，如图22所示，可以包括：
第一UE，用于发送发现请求消息；
第二UE，用于发送发现请求消息；
网络设备，用于发送发现响应消息，所述发现响应消息包括所述网络设备为所述第一UE和/或第二UE生成的授权令牌；
所述第一UE还用于：接收所述发现响应消息，所述发现响应消息包括所述网络设备为第一UE生成的授权令牌；
所述第二UE还用于：接收所述发现响应消息，所述发现响应消息包括所述网络设备为第二UE生成的授权令牌。
请参见图23，图23是本申请实施例提供的一种通信装置2300的结构示意图。通信装置2300可以是基站，也可以是终端设备，也可以是支持基站实现上述方法的芯片、芯片系统、或处理器等，还可以是支持终端设备实现上述方法的芯片、芯片系统、或处理器等。该装置可用于实现上述方法实施例中描述的方法，具体可以参见上述方法实施例中的说明。
通信装置2300可以包括一个或多个处理器2301。处理器2301可以是通用处理器或者专用处理器等。例如可以是基带处理器或中央处理器。基带处理器可以用于对通信协议以及通信数据进行处理，中央处理器可以用于对通信装置(如，基站、基带芯片，终端设备、终端设备芯片，DU或CU等)进行控制，执行计算机程序，处理计算机程序的数据。
可选的，通信装置2300中还可以包括一个或多个存储器2302，其上可以存有计算机程序2304，处理器2301执行所述计算机程序2304，以使得通信装置2300执行上述方法实施例中描述的方法。可选的，所述存储器2302中还可以存储有数据。通信装置2300和存储器2302可以单独设置，也可以集成在一起。
可选的，通信装置2300还可以包括收发器2305、天线2306。收发器2305可以称为收发单元、收发机、或收发电路等，用于实现收发功能。收发器2305可以包括接收器和发送器，接收器可以称为接收机或接收电路等，用于实现接收功能；发送器可以称为发送机或发送电路等，用于实现发送功能。
可选的，通信装置2300中还可以包括一个或多个接口电路2307。接口电路2307用于接收代码指令并传输至处理器2301。处理器2301运行所述代码指令以使通信装置2300执行上述方法实施例中描述的方法。
在一种实现方式中，处理器2301中可以包括用于实现接收和发送功能的收发器。例如该收发器可以是收发电路，或者是接口，或者是接口电路。用于实现接收和发送功能的收发电路、接口或接口电路可以是分开的，也可以集成在一起。上述收发电路、接口或接口电路可以用于代码/数据的读写，或者，上述收发电路、接口或接口电路可以用于信号的传输或传递。
在一种实现方式中，处理器2301可以存有计算机程序2303，计算机程序2303在处理器2301上运行，可使得通信装置2300执行上述方法实施例中描述的方法。计算机程序2303可能固化在处理器2301 中，该种情况下，处理器2301可能由硬件实现。
在一种实现方式中，通信装置2300可以包括电路，所述电路可以实现前述方法实施例中发送或接收或者通信的功能。本申请中描述的处理器和收发器可实现在集成电路(integrated circuit，IC)、模拟IC、射频集成电路RFIC、混合信号IC、专用集成电路(application specific integrated circuit，ASIC)、印刷电路板(printed circuit board，PCB)、电子设备等上。该处理器和收发器也可以用各种IC工艺技术来制造，例如互补金属氧化物半导体(complementary metal oxide semiconductor，CMOS)、N型金属氧化物半导体(nMetal-oxide-semiconductor，NMOS)、P型金属氧化物半导体(positive channel metal oxide semiconductor，PMOS)、双极结型晶体管(bipolar junction transistor，BJT)、双极CMOS(BiCMOS)、硅锗(SiGe)、砷化镓(GaAs)等。
以上实施例描述中的通信装置可以是基站或者终端设备，但本申请中描述的通信装置的范围并不限于此，而且通信装置的结构可以不受图23的限制。通信装置可以是独立的设备或者可以是较大设备的一部分。例如所述通信装置可以是：
(1)独立的集成电路IC，或芯片，或，芯片系统或子系统；
(2)具有一个或多个IC的集合，可选的，该IC集合也可以包括用于存储数据，计算机程序的存储部件；
(3)ASIC，例如调制解调器(Modem)；
(4)可嵌入在其他设备内的模块；
(5)接收机、终端设备、智能终端设备、蜂窝电话、无线设备、手持机、移动单元、车载设备、基站、云设备、人工智能设备等等；
(6)其他等等。
对于通信装置可以是芯片或芯片系统的情况，可参见图24所示的芯片的结构示意图。图24所示的芯片包括处理器2401和接口2402。其中，处理器2401的数量可以是一个或多个，接口2402的数量可以是多个。
可选的，芯片还包括存储器2403，存储器2403用于存储必要的计算机程序和数据。
本领域技术人员还可以了解到本申请实施例列出的各种说明性逻辑块(illustrative logical block)和步骤(step)可以通过电子硬件、电脑软件，或两者的结合进行实现。这样的功能是通过硬件还是软件来实现取决于特定的应用和整个系统的设计要求。本领域技术人员可以对于每种特定的应用，可以使用各种方法实现所述的功能，但这种实现不应被理解为超出本申请实施例保护的范围。
本申请还提供一种可读存储介质，其上存储有指令，该指令被计算机执行时实现上述任一方法实施例的功能。
本申请还提供一种计算机程序产品，该计算机程序产品被计算机执行时实现上述任一方法实施例的功能。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机程序。在计算机上加载和执行所述计算机程序时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机程序可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机程序可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(digital subscriber line，DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)、光介质(例如，高密度数字视频光盘(digital video disc，DVD))、或者半导体介质(例如，固态硬盘(solid state disk，SSD))等。
本领域普通技术人员可以理解：本申请中涉及的第一、第二等各种数字编号仅为描述方便进行的区分，并不用来限制本申请实施例的范围，也表示先后顺序。
本申请中的至少一个还可以描述为一个或多个，多个可以是两个、三个、四个或者更多个，本申请不做限制。在本申请实施例中，对于一种技术特征，通过“第一”、“第二”、“第三”、“A”、“B”、“C”和“D”等区分该种技术特征中的技术特征，该“第一”、“第二”、“第三”、“A”、“B”、“C”和“D”描述的技术特征间无先后顺序或者大小顺序。
本申请中各表所示的对应关系可以被配置，也可以是预定义的。各表中的信息的取值仅仅是举例，可以配置为其他值，本申请并不限定。在配置信息与各参数的对应关系时，并不一定要求必须配置各表中示意出的所有对应关系。例如，本申请中的表格中，某些行示出的对应关系也可以不配置。又例如，可以基于上述表格做适当的变形调整，例如，拆分，合并等等。上述各表中标题示出参数的名称也可以采用通信装置可理解的其他名称，其参数的取值或表示方式也可以通信装置可理解的其他取值或表示方式。上述各表在实现时，也可以采用其他的数据结构，例如可以采用数组、队列、容器、栈、线性表、指针、链表、树、图、结构体、类、堆、散列表或哈希表等。
本申请中的预定义可以理解为定义、预先定义、存储、预存储、预协商、预配置、固化、或预烧制。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (51)

  1. 一种UE的授权令牌的生成方法，其特征在于，被网络设备执行，所述方法包括：
    接收第一UE和/或第二UE发送的发现请求消息，所述发现请求消息用于为第一UE和/或第二UE请求授权令牌，所述授权令牌用于对UE所声明的UE角色进行授权验证；
    向所述第一UE和/或第二UE发送发现响应消息，所述发现响应消息包括所述网络设备为所述第一UE和/或所述第二UE生成的授权令牌。
  2. 如权利要求1所述的方法，其特征在于，所述第一UE和/或所述第二UE的授权令牌至少指示服务器或统一数据管理UDM网元为所述第一UE和/或所述第二UE授权的角色。
  3. 如权利要求1所述的方法，其特征在于，所述第一UE的授权令牌用于：在发现过程中所述第一UE的对端UE对所述第一UE声明的第一UE的角色进行授权验证；
    和/或，
    所述第二UE的授权令牌用于：在发现过程中所述第二UE的对端UE对所述第二UE声明的第二UE的角色进行授权验证。
  4. 如权利要求1所述的方法，其特征在于，所述发现请求消息中包括以下至少一种：
    应用程序用户标识RAUID；
    服务的标识；
    所述第一UE和/或第二UE的能力。
  5. 如权利要求1-4任一项所述的方法，其特征在于，所述网络侧设备包括：第一网元、第二网元和第三网元，所述第一网元包括所述第一UE的邻近通信服务名称管理功能DDNMF网元或第一UE的邻近通信服务密钥管理功能PKMF网元，所述第二网元包括所述第二UE的DDNMF网元或第二UE的PKMF网元，所述第三网元包括测距定位业务的服务器或UDM网元。
  6. 如权利要求5所述的方法，其特征在于，
    所述网络设备接收所述第一UE发送的发现请求消息，包括：
    所述第一网元接收所述第一UE发送的发现请求消息；
    所述网络设备向所述第一UE发送发现响应消息，包括：
    所述第一网元向所述第一UE发送发现响应消息；
    所述方法还包括：
    所述第一网元向第三网元发送第一授权请求消息；
    所述第三网元向所述第一网元发送第一授权响应消息，所述第一授权响应消息包括第三网元生成的第一UE的授权令牌，或者第三网元确定的第一授权信息，所述第一授权信息包括第一UE的授权相关的信息。
  7. 如权利要求6所述的方法，其特征在于，所述方法还包括：
    第一网元基于所述第一授权信息生成第一UE的授权令牌。
  8. 如权利要求5所述的方法，其特征在于，
    所述网络设备接收所述第二UE发送的发现请求消息，包括：
    所述第二网元接收所述第二UE发送的发现请求消息；
    所述网络设备向所述第二UE发送发现响应消息，包括：
    所述第二网元向所述第二UE发送发现响应消息；
    所述方法还包括：
    所述第二网元向第三网元发送第一授权请求消息；
    所述第三网元向所述第二网元发送第一授权响应消息，所述第一授权响应消息包括第三网元生成的第二UE的授权令牌；或者第三网元确定的第二授权信息，所述第二授权信息包括第二UE的授权相关的信息。
  9. 如权利要求8所述的方法，其特征在于，所述方法还包括：
    所述第二网元向第一网元发送监听请求消息；
    所述第一网元向第三网元发送第二授权请求消息；
    第三网元向所述第一网元发送第二授权响应消息，所述第二授权响应消息包括第三授权信息，所述第三授权信息至少指示所述第一UE的角色和所述第二UE的角色在两UE请求发现的服务中的匹配关系；
    第一网元向第二网元发送监听响应消息，所述监听响应消息包括所述第三授权信息。
  10. 如权利要求9所述的方法，其特征在于，所述方法还包括：
    所述第二网元基于所述第二授权信息以及所述第三授权信息生成第二UE的授权令牌。
  11. 一种UE的授权令牌的生成方法，其特征在于，被第一UE执行，所述方法包括：
    向网络设备发送发现请求消息，所述发现请求消息用于为第一UE请求授权令牌，所述授权令牌用于对所述第一UE所声明的UE角色进行授权验证；
    接收所述网络设备发送的发现响应消息，所述发现响应消息包括所述第一UE的授权令牌。
  12. 如权利要求11所述的方法，其特征在于，所述第一UE的授权令牌至少指示所述网络设备为所述第一UE授权的角色。
  13. 如权利要求11所述的方法，其特征在于，所述方法还包括：
    广播第一发现消息，用于发现邻近的UE，其中，所述第一发现消息包括所述第一UE的授权令牌；
    接收到所述第二UE发送第一响应消息；所述第一响应消息为所述第二UE根据所述第一UE的授权令牌确定所述第一UE声明的角色后发送的。
  14. 如权利要求13所述的方法，其特征在于，所述第一发现消息为根据所述第一UE请求发现的服务所对应的密钥信息保护；和/或，
    所述第一响应消息为根据所述第二UE请求发现的服务所对应的密钥信息保护。
  15. 如权利要求11所述的方法，其特征在于，所述方法还包括：
    接收第二UE广播的第二发现消息，所述第二发现消息包括所述第二UE的授权令牌；
    当根据所述第二UE的授权令牌验证所述第二UE声明的角色为所述网络设备授权的角色时，向所述第二UE发送第二响应消息。
  16. 如权利要求15所述的方法，其特征在于，
    所述第二发现消息还包括所述第二UE的角色；
    在所述向所述第二UE发送第二响应消息之前，所述方法还包括：
    确定所述第二UE的角色与所述第一UE的角色匹配。
  17. 如权利要求15或16所述的方法，其特征在于，所述第二响应消息携带所述第一UE的授权令牌，用于所述第二UE确定所述第一UE声明的角色是否为所述网络设备授权的角色。
  18. 如权利要求15所述的方法，其特征在于，所述第二发现消息为根据所述第二UE请求发现的服务所对应的密钥信息保护；和/或，
    所述第二响应消息为根据所述第一UE请求发现的服务所对应的密钥信息保护。
  19. 一种UE的授权令牌的生成方法，其特征在于，被第二UE执行，所述方法包括：
    向网络设备发送发现请求消息，所述发现请求消息用于为第二UE请求授权令牌，所述授权令牌用于对第二UE所声明的UE角色进行授权验证；
    接收所述网络设备发送的发现响应消息，所述发现响应消息包括第二UE的授权令牌。
  20. 如权利要求19所述的方法，其特征在于，所述第二UE的授权令牌至少指示服务器或UDM网元为所述第二UE授权的角色。
  21. 如权利要求19所述的方法，其特征在于，所述方法还包括：
    接收第一UE广播的第一发现消息，所述第一发现消息包括所述第一UE的授权令牌；
    当根据所述第一UE的授权令牌验证所述第一UE声明的角色为所述网络设备授权的角色时，向所述第一UE发送第一响应消息。
  22. 如权利要求19所述的方法，其特征在于，
    所述第一发现消息还包括所述第一UE的角色；
    在所述向所述第一UE发送第一响应消息之前，所述方法还包括：
    确定所述第二UE的角色与所述第一UE的角色是否匹配。
  23. 如权利要求21所述的方法，其特征在于，所述第一发现消息为根据所述第一UE请求发现的服务所对应的密钥信息保护；和/或，
    所述第一响应消息为根据所述第二UE请求发现的服务所对应的密钥信息保护。
  24. 如权利要求19所述的方法，其特征在于，所述方法还包括：
    广播第二发现消息，用于发现邻近的UE，所述第二发现消息包括所述第二UE的授权令牌；
    接收所述第一UE发送的第二响应消息，所述第二响应消息包括所述第一UE的授权令牌；
    根据所述第一UE的授权令牌验证所述第一UE声明的角色是否为所述网络设备授权的角色。
  25. 如权利要求24所述的方法，其特征在于，
    所述第二响应消息还包括所述第一UE的角色；
    所述方法还包括：
    确定所述第二UE的角色与所述第一UE的角色是否匹配。
  26. 一种UE的授权令牌的生成方法，其特征在于，被第一UE的DDNMF网元或所述第一UE的PKMF网元执行执行，所述方法包括：
    接收第一UE发送的发现请求消息，所述发现请求消息用于为第一UE请求授权令牌，所述授权令牌用于对第一UE所声明的UE角色进行授权验证；
    向服务器或UDM网元发送第一授权请求消息；
    接收所述服务器或UDM网元发送的第一授权响应消息，所述第一授权响应消息包括所述服务器或UDM网元生成的所述第一UE的授权令牌，或者包括所述第一授权信息，所述第一授权信息包括第一UE的授权相关的信息；
    向所述第一UE发送发现响应消息，所述发现响应消息包括第一UE的授权令牌。
  27. 如权利要求26所述的方法，其特征在于，所述第一UE的授权令牌至少指示服务器或UDM网元为所述第一UE授权的角色。
  28. 如权利要求26所述的方法，其特征在于，所述第一UE的授权令牌用于：在发现过程中所述第一UE的对端UE对接收到的由所述第一UE传输的第一UE的角色进行授权验证。
  29. 如权利要求26所述的方法，其特征在于，所述发现请求消息中包括以下至少一种：
    所述第一UE对应的RAUID；
    所述第一UE请求发现的服务；
    所述第一UE支持的用于服务的能力。
  30. 如权利要求26所述的方法，其特征在于，所述方法还包括：
    基于所述第一授权信息为所述第一UE生成授权令牌。
  31. 如权利要求26所述的方法，其特征在于，所述方法还包括：
    接收第二UE的DDNMF网元或第二UE的PKMF网元发送的监听请求消息；
    向服务器或UDM网元发送第二授权请求消息；
    接收服务器或UDM网元发送的第二授权响应消息，所述第二授权响应消息包括第三授权信息，所述第三授权信息至少指示所述第一UE和所述第二UE在两UE请求发现的服务中的匹配关系；
    向第二UE的DDNMF网元或第二UE的PKMF网元发送监听响应消息，所述监听响应消息包括所述第三授权信息。
  32. 一种UE的授权令牌的生成方法，其特征在于，被第二UE的DDNMF网元或第二UE的PKMF网元执行，所述方法包括：
    接收第二UE发送的发现请求消息，所述发现请求消息用于为第二UE请求授权令牌，所述授权令牌用于对第二UE所声明的UE角色进行授权验证；
    向服务器或UDM网元发送第一授权请求消息；
    接收所述服务器或UDM网元发送的第一授权响应消息，所述第一授权响应消息包括所述服务器或 UDM网元生成的第二UE的授权令牌，或者所述第二授权信息，所述第二授权信息包括第二UE的授权相关的信息；
    向所述第二UE发送发现响应消息，所述发现响应消息包括所述第二UE的授权令牌。
  33. 如权利要求32所述的方法，其特征在于，所述第二UE的授权令牌至少指示服务器或UDM网元为所述第二UE授权的角色。
  34. 如权利要求32所述的方法，其特征在于，所述第二UE的授权令牌用于：在发现过程中所述第二UE的对端UE对接收到的由所述第二UE传输的第二UE的角色进行授权验证。
  35. 如权利要求32所述的方法，其特征在于，所述发现请求消息中包括以下至少一种：
    所述第二UE对应的RAUID；
    所述第二UE请求发现的服务；
    所述第二UE支持的用于服务的能力。
  36. 如权利要求32所述的方法，其特征在于，所述方法还包括：
    向第一UE的DDNMF网元或第一UE的PKMF网元发送监听请求消息；
    接收第一UE的DDNMF网元或第一UE的PKMF网元发送的监听响应消息，所述监听响应消息包括第三授权信息，所述第三授权信息至少指示所述第一UE和所述第二UE在两UE请求发现的服务中的匹配关系；
    基于所述第二授权信息以及所述第三授权信息生成第二UE的授权令牌。
  37. 一种UE的授权令牌的生成方法，其特征在于，被服务器或UDM网元执行，所述方法包括：
    接收第一UE和/或第二UE的DDNMF网元或PKMF网元发送的第一授权请求消息，所述第一授权请求消息用于为第一UE和/或第二UE请求授权令牌，所述授权令牌用于对UE所声明的UE角色进行授权验证；
    向所述第一UE和/或第二UE的DDNMF网元或PKMF网元发送第一授权响应消息，所述第一授权响应消息包括所述第一UE和/或第二UE的授权令牌，或者所述第一授权信息和/或第二授权信息；其中，所述第一授权信息包括第一UE的授权相关的信息，所述第二授权信息包括第二UE的授权相关的信息。
  38. 如权利要求37所述的方法，其特征在于，所述方法还包括：
    基于所述服务器或UDM网元为所述第一UE和/或第二UE授权的角色生成所述第一UE和/或第二UE的授权令牌。
  39. 如权利要求37所述的方法，其特征在于，所述方法还包括：
    基于所述第一UE和/或第二UE的签约信息确定所述第一授权信息和/或第二授权信息。
  40. 如权利要求39所述的方法，其特征在于，所述方法还包括：
    接收所述第一UE的DDNMF网元或第一UE的PKMF网元发送的第二授权请求消息；
    向所述第一UE的DDNMF网元或第一UE的PKMF网元发送第二授权响应消息，所述第二授权响应消息包括第三授权信息，所述第三授权信息至少指示所述第一UE和所述第二UE在两UE请求发现的服务中的匹配关系。
  41. 如权利要求40所述的方法，其特征在于，所述方法还包括：
    基于所述第一UE的签约信息和第二UE的签约信息确定第三授权信息。
  42. 一种通信装置，被配置在网络设备中，包括：
    收发模块，用于接收第一UE和/或第二UE发送的发现请求消息，所述发现请求消息用于为第一UE和/或第二UE请求授权令牌，所述授权令牌用于对UE所声明的UE角色进行授权验证；
    所述收发模块，还用于向所述第一UE和/或第二UE发送发现响应消息，所述发现响应消息包括所述网络设备为所述第一UE和/或所述第二UE生成的授权令牌。
  43. 一种通信装置，被配置在第一UE中，包括：
    收发模块，用于向网络设备发送发现请求消息，所述发现请求消息用于为第一UE请求授权令牌，所述授权令牌用于对第一UE所声明的UE角色进行授权验证；
    所述收发模块，还用于接收所述网络设备发送的发现响应消息，所述发现响应消息包括所述第一UE的授权令牌。
  44. 一种通信装置，被配置在第二UE中，包括：
    收发模块，用于向网络设备发送发现请求消息，所述发现请求消息用于为第二UE请求授权令牌，所述授权令牌用于对第二UE所声明的UE角色进行授权验证；
    所述收发模块，还用于接收所述网络设备发送的发现响应消息，所述发现响应消息包括第二UE的授权令牌。
  45. 一种通信装置，被配置在第一UE的DDNMF网元或所述第一UE的PKMF网元执行中，包括：
    收发模块，用于接收第一UE发送的发现请求消息，所述发现请求消息用于为第一UE请求授权令牌，所述授权令牌用于对第一UE所声明的UE角色进行授权验证；
    所述收发模块，还用于向服务器或UDM网元发送第一授权请求消息；
    所述收发模块，还用于接收所述服务器或UDM网元发送的第一授权响应消息，所述第一授权响应消息包括所述服务器或UDM网元生成的所述第一UE的授权令牌，或者包括所述第一授权信息，所述第一授权信息包括第一UE的授权相关的信息；
    所述收发模块，还用于向所述第一UE发送发现响应消息，所述发现响应消息包括第一UE的授权令牌。
  46. 一种通信装置，被配置在被第二UE的DDNMF网元或第二UE的PKMF网元中，包括：
    收发模块，用于接收第二UE发送的发现请求消息，所述发现请求消息用于为第二UE请求授权令牌，所述授权令牌用于对第二UE所声明的UE角色进行授权验证；
    所述收发模块，还用于向服务器或UDM网元发送第一授权请求消息；
    所述收发模块，还用于接收所述服务器或UDM网元发送的第一授权响应消息，所述第一授权响应消息包括所述服务器或UDM网元生成的第二UE的授权令牌，或者所述第二授权信息，所述第二授权信息包括第二UE的授权相关的信息；
    所述收发模块，还用于向所述第二UE发送发现响应消息，所述发现响应消息包括所述第二UE的授权令牌。
  47. 一种通信装置，被配置在服务器或UDM网元执行，包括：
    收发模块，用于接收第一UE和/或第二UE的DDNMF网元或PKMF网元发送的第一授权请求消息，所述第一授权请求消息用于为第一UE和/或第二UE请求授权令牌，所述授权令牌用于对UE所声明的UE角色进行授权验证；
    所述收发模块，用于向所述第一UE和/或第二UE的DDNMF网元或PKMF网元发送第一授权响应消息，所述第一授权响应消息包括所述第一UE和/或第二UE的授权令牌，或者所述第一授权信息和/或第二授权信息；其中，所述第一授权信息包括第一UE的授权相关的信息，所述第二授权信息包括第二UE的授权相关的信息。
  48. 一种通信装置，其特征在于，所述装置包括处理器和存储器，其中，所述存储器中存储有计算机程序，所述处理器执行所述存储器中存储的计算机程序，以使所述装置执行如权利要求1至10中任一项所述的方法，或所述处理器执行所述存储器中存储的计算机程序，以使所述装置执行如权利要求11至18中任一项所述的方法，或所述处理器执行所述存储器中存储的计算机程序，以使所述装置执行如权利要求19至25中任一项所述的方法，或所述处理器执行所述存储器中存储的计算机程序，以使所述装置执行如权利要求26至31中任一项所述的方法，或所述处理器执行所述存储器中存储的计算机程序，以使所述装置执行如权利要求32至36中任一项所述的方法，或所述处理器执行所述存储器中存储的计算机程序，以使所述装置执行如权利要求37至41中任一项所述的方法。
  49. 一种通信装置，其特征在于，包括：处理器和接口电路，其中
    所述接口电路，用于接收代码指令并传输至所述处理器；
    所述处理器，用于运行所述代码指令以执行如权利要求1至10中任一项所述的方法，或用于运行所述代码指令以执行如权利要求11至18中任一项所述的方法，或用于运行所述代码指令以执行如权利 要求19至25中任一项所述的方法，或用于运行所述代码指令以执行如权利要求26至31中任一项所述的方法，或用于运行所述代码指令以执行如权利要求32至36中任一项所述的方法，或用于运行所述代码指令以执行如权利要求37至41中任一项所述的方法。
  50. 一种通信系统，其特征在于，包括：
    第一UE，用于发送发现请求消息；
    第二UE，用于发送发现请求消息；
    网络设备，用于发送发现响应消息，所述发现响应消息包括所述网络设备为所述第一UE和/或第二UE生成的授权令牌；
    所述第一UE还用于：接收所述发现响应消息，所述发现响应消息包括所述网络设备为第一UE生成的授权令牌；
    所述第二UE还用于：接收所述发现响应消息，所述发现响应消息包括所述网络设备为第二UE生成的授权令牌。
  51. 一种计算机可读存储介质，用于存储有指令，当所述指令被执行时，使如权利要求1至10中任一项所述的方法被实现，或当所述指令被执行时，使如权利要求11至18中任一项所述的方法被实现，或当所述指令被执行时，使如权利要求19至25中任一项所述的方法被实现，或当所述指令被执行时，使如权利要求26至31中任一项所述的方法被实现，或当所述指令被执行时，使如权利要求32至36中任一项所述的方法被实现，或当所述指令被执行时，使如权利要求37至41中任一项所述的方法被实现。
PCT/CN2022/122340 2022-09-28 2022-09-28 一种用户设备ue的授权令牌的生成方法/装置/设备及存储介质 WO2024065334A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/CN2022/122340 WO2024065334A1 (zh) 2022-09-28 2022-09-28 一种用户设备ue的授权令牌的生成方法/装置/设备及存储介质
CN202280003799.2A CN118104258A (zh) 2022-09-28 2022-09-28 一种用户设备ue的授权令牌的生成方法/装置/设备及存储介质

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2022/122340 WO2024065334A1 (zh) 2022-09-28 2022-09-28 一种用户设备ue的授权令牌的生成方法/装置/设备及存储介质

Publications (1)

Publication Number Publication Date
WO2024065334A1 true WO2024065334A1 (zh) 2024-04-04

Family

ID=90475315

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/122340 WO2024065334A1 (zh) 2022-09-28 2022-09-28 一种用户设备ue的授权令牌的生成方法/装置/设备及存储介质

Country Status (2)

Country Link
CN (1) CN118104258A (zh)
WO (1) WO2024065334A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113132334A (zh) * 2019-12-31 2021-07-16 华为技术有限公司 授权结果的确定方法及装置
US20220109996A1 (en) * 2020-10-01 2022-04-07 Qualcomm Incorporated Secure communication link establishment for a ue-to-ue relay
CN114339622A (zh) * 2020-09-29 2022-04-12 大唐移动通信设备有限公司 一种ProSe通信组的通信方法、装置及存储介质
CN114866964A (zh) * 2022-04-13 2022-08-05 中国电信股份有限公司 基于邻近服务的消息传输方法、装置、电子设备及介质

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113132334A (zh) * 2019-12-31 2021-07-16 华为技术有限公司 授权结果的确定方法及装置
CN114339622A (zh) * 2020-09-29 2022-04-12 大唐移动通信设备有限公司 一种ProSe通信组的通信方法、装置及存储介质
US20220109996A1 (en) * 2020-10-01 2022-04-07 Qualcomm Incorporated Secure communication link establishment for a ue-to-ue relay
CN114866964A (zh) * 2022-04-13 2022-08-05 中国电信股份有限公司 基于邻近服务的消息传输方法、装置、电子设备及介质

Also Published As

Publication number Publication date
CN118104258A (zh) 2024-05-28

Similar Documents

Publication Publication Date Title
WO2024077455A1 (zh) 一种非陆地网络的接入方法及装置
WO2024065334A1 (zh) 一种用户设备ue的授权令牌的生成方法/装置/设备及存储介质
WO2024065140A1 (zh) 一种用户设备ue的角色授权方法/装置/设备及存储介质
WO2024082143A1 (zh) 一种设备业务角色的验证方法/装置/设备及存储介质
CN114339748A (zh) 一种鉴权方法及其装置
WO2023245520A1 (zh) 一种定位服务的直接通信方法及装置
WO2024092525A1 (zh) 一种用户设备ue选择或重选方法、装置、设备及存储介质
WO2024065706A1 (zh) 一种构建连接的方法及装置
WO2024065335A1 (zh) 一种侧行链路定位方法及装置
WO2024065336A1 (zh) 一种侧行链路定位方法及装置
WO2024065339A1 (zh) 一种网络卫星覆盖数据的授权方法、设备及存储介质
WO2023115487A1 (zh) 一种人工智能会话的创建方法及其装置
WO2024138581A1 (zh) 一种网络切片的授权方法、装置、设备及存储介质
WO2024138338A1 (zh) 一种服务调用方法/装置/设备及存储介质
WO2024065564A1 (zh) 一种api的调用方法、装置、设备及存储介质
WO2024065844A1 (zh) 一种路径切换能力的交互方法及其装置
WO2024050778A1 (zh) 一种人工智能服务策略的更新方法及装置
WO2024098323A1 (zh) 一种通过托管网络提供本地化服务的方法及其装置
WO2024145902A1 (zh) 密钥获取方法、装置、设备及芯片系统
WO2023225878A1 (zh) 一种ai网络功能的重新认证授权方法/装置/设备及存储介质
WO2024138390A1 (zh) 通信控制方法及装置
WO2023221000A1 (zh) 一种核心网中ai功能的认证授权方法及其装置
WO2024065121A1 (zh) 一种多路径传输方法/装置/设备及存储介质
WO2024130561A1 (zh) 一种用户位置信息的可信确定方法及其装置
WO2024020751A1 (zh) 一种第三方服务管理方法/装置/设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22959977

Country of ref document: EP

Kind code of ref document: A1