WO2024065706A1 - 一种构建连接的方法及装置 - Google Patents

一种构建连接的方法及装置 Download PDF

Info

Publication number
WO2024065706A1
WO2024065706A1 PCT/CN2022/123346 CN2022123346W WO2024065706A1 WO 2024065706 A1 WO2024065706 A1 WO 2024065706A1 CN 2022123346 W CN2022123346 W CN 2022123346W WO 2024065706 A1 WO2024065706 A1 WO 2024065706A1
Authority
WO
WIPO (PCT)
Prior art keywords
ecs
target
connection
certificate
information
Prior art date
Application number
PCT/CN2022/123346
Other languages
English (en)
French (fr)
Inventor
梁浩然
陆伟
Original Assignee
北京小米移动软件有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京小米移动软件有限公司 filed Critical 北京小米移动软件有限公司
Priority to PCT/CN2022/123346 priority Critical patent/WO2024065706A1/zh
Publication of WO2024065706A1 publication Critical patent/WO2024065706A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication

Definitions

  • the present disclosure relates to the field of communication technology, and in particular to a method and device for establishing a connection.
  • edge configuration servers are provided in both the home public land mobile network (HPLMN) and the visited (V) public land mobile network (VPLMN).
  • the edge enabler client (EEC) in the terminal device can obtain services from the visited ECS (V-ECS) and the visited edge enabler server (V-EES).
  • V-ECS visited ECS
  • V-EES visited edge enabler server
  • a new connection is defined between the ECSs (i.e., V–ECS and H-ECS). The new connection can be used for EES discovery or V-ECS information retrieval in the roaming PLMN.
  • a malicious H-ECS can obtain EES information or V-ECS information from a V-ECS through a new connection, thereby leaking topology details and server information in the VPLMN domain.
  • a malicious V-ECS may obtain terminal device information from an H-ECS through a new connection, thereby exposing the privacy of the terminal device.
  • the embodiments of the present disclosure provide a method and device for establishing a connection.
  • an embodiment of the present disclosure provides a method for establishing a connection, the method being executed by an H-ECS, and the method comprising:
  • a connection with the target V-ECS is established.
  • H-ECS first determines the authorization information of V-ECS and the target V-ECS, and then performs mutual identity authentication with the target V-ECS. After the authentication is successful, it determines whether the target V-ECS is allowed to establish a connection with H-ECS based on the authenticated identity information and the authorization information of V-ECS. If it is confirmed to be allowed, the connection with the target V-ECS is established.
  • identity authentication and authorization are performed, which avoids information leakage through the connection, improves the security and reliability of the connection between ECSs, and improves the performance of the system in the roaming scenario.
  • an embodiment of the present disclosure provides a method for establishing a connection, the method being executed by a V-ECS, and the method comprising:
  • a connection with the H-ECS is established.
  • an embodiment of the present disclosure provides a communication device, including:
  • the transceiver module is used to determine the authorization information and target V-ECS for accessing the edge configuration server V-ECS;
  • a processing module used for performing mutual identity authentication with the target V-ECS
  • the processing module is further configured to determine, in response to a mutual identity authentication success, whether the target V-ECS is allowed to establish a connection with the H-ECS based on the authenticated identity information and the authorization information of the V-ECS;
  • the processing module is further configured to establish a connection with the target V-ECS in response to the target V-ECS being allowed to establish a connection with the H-ECS.
  • an embodiment of the present disclosure provides another communication device, including:
  • the transceiver module is used to perform mutual identity authentication with the home edge configuration server H-ECS;
  • a processing module configured to determine, in response to a mutual identity authentication success, whether the H-ECS is allowed to establish a connection with the V-ECS based on the authenticated identity information and the authorization information of the H-ECS;
  • the processing module is further configured to establish a connection with the H-ECS in response to the H-ECS being allowed to establish a connection with the V-ECS.
  • an embodiment of the present disclosure provides a communication device, which includes a processor.
  • the processor calls a computer program in a memory, the method described in the first aspect is executed.
  • an embodiment of the present disclosure provides a communication device, which includes a processor.
  • the processor calls a computer program in a memory, the method described in the second aspect is executed.
  • an embodiment of the present disclosure provides a communication device, which includes a processor and a memory, in which a computer program is stored; the processor executes the computer program stored in the memory so that the communication device executes the method described in the first aspect above.
  • an embodiment of the present disclosure provides a communication device, which includes a processor and a memory, in which a computer program is stored; the processor executes the computer program stored in the memory so that the communication device executes the method described in the second aspect above.
  • an embodiment of the present disclosure provides a communication device, which includes a processor and an interface circuit, wherein the interface circuit is used to receive code instructions and transmit them to the processor, and the processor is used to run the code instructions to enable the device to execute the method described in the first aspect above.
  • an embodiment of the present disclosure provides a communication device, which includes a processor and an interface circuit, wherein the interface circuit is used to receive code instructions and transmit them to the processor, and the processor is used to run the code instructions to enable the device to execute the method described in the second aspect above.
  • an embodiment of the present disclosure provides a communication system, the system comprising the communication device described in the third aspect and the communication device described in the fourth aspect, or the system comprising the communication device described in the fifth aspect and the communication device described in the sixth aspect, or the system comprising the communication device described in the seventh aspect and the communication device described in the eighth aspect, or the system comprising the communication device described in the ninth aspect and the communication device described in the tenth aspect.
  • an embodiment of the present invention provides a computer-readable storage medium for storing instructions for the above-mentioned terminal device, and when the instructions are executed, the terminal device executes the method described in the first aspect.
  • an embodiment of the present invention provides a readable storage medium for storing instructions used by the above-mentioned network device, and when the instructions are executed, the network device executes the method described in the above-mentioned second aspect.
  • the present disclosure further provides a computer program product comprising a computer program, which, when executed on a computer, enables the computer to execute the method described in the first aspect above.
  • the present disclosure further provides a computer program product comprising a computer program, which, when executed on a computer, enables the computer to execute the method described in the second aspect above.
  • the present disclosure provides a chip system, which includes at least one processor and an interface, and is used to support a terminal device to implement the functions involved in the first aspect, for example, determining or processing at least one of the data and information involved in the above method.
  • the chip system also includes a memory, and the memory is used to store computer programs and data necessary for the terminal device.
  • the chip system can be composed of a chip, or it can include a chip and other discrete devices.
  • the present disclosure provides a chip system, which includes at least one processor and an interface, and is used to support a network device to implement the functions involved in the second aspect, for example, determining or processing at least one of the data and information involved in the above method.
  • the chip system also includes a memory, and the memory is used to store computer programs and data necessary for the network device.
  • the chip system can be composed of a chip, or it can include a chip and other discrete devices.
  • the present disclosure provides a computer program, which, when executed on a computer, enables the computer to execute the method described in the first aspect.
  • the present disclosure provides a computer program which, when executed on a computer, enables the computer to execute the method described in the second aspect.
  • FIG1 is a schematic diagram of the architecture of a communication system provided by an embodiment of the present disclosure.
  • FIG2 is a schematic diagram of a flow chart of a method for establishing a connection provided by an embodiment of the present disclosure
  • FIG3 is a flow chart of another method for establishing a connection provided by an embodiment of the present disclosure.
  • FIG4 is a flow chart of another method for establishing a connection provided by an embodiment of the present disclosure.
  • FIG5 is a flow chart of another method for establishing a connection provided by an embodiment of the present disclosure.
  • FIG. 6 is a flow chart of another method for establishing a connection provided by an embodiment of the present disclosure
  • FIG7 is a flow chart of another method for establishing a connection provided by an embodiment of the present disclosure.
  • FIG8 is an interactive schematic diagram of another method for building a connection according to an embodiment of the present disclosure.
  • FIG9 is a schematic diagram of the structure of a communication device provided by an embodiment of the present disclosure.
  • FIG10 is a schematic diagram of the structure of another communication device provided in an embodiment of the present disclosure.
  • FIG. 11 is a schematic diagram of the structure of a chip provided in an embodiment of the present disclosure.
  • HPLMN Home PLMN
  • HPLMN is the PLMN to which the terminal device belongs.
  • MCC Mobile Country Code
  • MNC Mobile Network Code
  • IMSI International Mobile Subscriber Identity
  • USIM universal subscriber identity module
  • VPN Visiting PLMN
  • VPLMN is the PLMN accessed by the terminal device. Its PLMN is not exactly the same as the MCC and MNC of the IMSI stored in the USIM card. When the terminal device loses coverage, a VPLMN will be selected.
  • H-ECS Home edge configuration server
  • H-ECS is an edge configuration server located in the home network. It can be used to configure and manage the home edge enabler server (H-EES) in the home network, communicate with other servers in the home network, or communicate with V-ECS, etc.
  • H-EES home edge enabler server
  • V-ECS Visited edge configuration server
  • V-ECS is an edge configuration server located in the visited network. It can be used to configure and manage the visited edge enabler server (V-EES) in the visited network, communicate with other servers in the visited network, or communicate with H-ECS.
  • V-EES visited edge enabler server
  • FIG. 1 is a schematic diagram of the architecture of a communication system provided by an embodiment of the present disclosure.
  • the communication system may include, but is not limited to, a network device and a terminal device.
  • the number and form of devices shown in FIG. 1 are only used as examples and do not constitute a limitation on the embodiments of the present disclosure. In actual applications, two or more network devices and two or more terminal devices may be included.
  • the communication system shown in FIG. 1 includes, for example, one H-ECS 11, one V-ECS 12, and one terminal device 13.
  • LTE long term evolution
  • 5G fifth generation
  • NR 5G new radio
  • the H-ECS 11 and V-ECS 12 in the embodiment of the present disclosure are devices that provide a channel for a terminal device to enter a network and communicate with other server devices.
  • the communication system also includes a home network device and a visited network device.
  • the network device is an entity used to transmit or receive signals on the network side.
  • eNB evolved NodeB
  • TRP transmission point
  • gNB next generation NodeB
  • WiFi wireless fidelity
  • the embodiments of the present disclosure do not limit the specific technology and specific device form adopted by the network device.
  • the network device provided by the embodiments of the present disclosure may be composed of a centralized unit (CU) and a distributed unit (DU), wherein the CU may also be referred to as a control unit.
  • the CU-DU structure may be used to split the protocol layer of a network device, such as a base station, and the functions of some protocol layers are placed in the CU for centralized control, and the functions of the remaining part or all of the protocol layers are distributed in the DU, and the DU is centrally controlled by the CU.
  • a network device such as a base station
  • the terminal device 13 in the disclosed embodiment is an entity on the user side for receiving or transmitting signals, such as a mobile phone.
  • the terminal device may also be referred to as a terminal device (terminal), a user equipment (UE), a mobile station (MS), a mobile terminal device (MT), etc.
  • the terminal device may be a car with communication function, a smart car, a mobile phone (mobile phone), a wearable device, a tablet computer (Pad), a computer with wireless transceiver function, a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a wireless terminal device in industrial control (industrial control), a wireless terminal device in self-driving, a wireless terminal device in remote medical surgery, a wireless terminal device in smart grid (smart grid), a wireless terminal device in transportation safety (transportation safety), a wireless terminal device in a smart city (smart city), a wireless terminal device in a smart home (smart home), etc.
  • the embodiments of the present disclosure do not limit the specific technology and specific device form adopted by the terminal device.
  • the communication system described in the embodiment of the present disclosure is for the purpose of more clearly illustrating the technical solution of the embodiment of the present disclosure, and does not constitute a limitation on the technical solution provided by the embodiment of the present disclosure.
  • a person skilled in the art can know that with the evolution of the system architecture and the emergence of new business scenarios, the technical solution provided by the embodiment of the present disclosure is also applicable to similar technical problems.
  • H-ECS can implement the method shown in any embodiment of Figures 2 to 5 of the present disclosure.
  • V-HCS can implement the method described in Figures 6 to 7 of the present disclosure.
  • the communication system described in the embodiment of the present disclosure is for the purpose of more clearly illustrating the technical solution of the embodiment of the present disclosure, and does not constitute a limitation on the technical solution provided by the embodiment of the present disclosure.
  • a person skilled in the art can know that with the evolution of the system architecture and the emergence of new business scenarios, the technical solution provided by the embodiment of the present disclosure is also applicable to similar technical problems.
  • a malicious H-ECS can obtain EES information or V-ECS information from a V-ECS through a new connection, thereby attacking and causing the topology details and server information in the VPLMN domain to be leaked.
  • a malicious V-ECS may obtain UE information from an H-ECS through a new connection, thereby causing the problem of UE privacy exposure, and a method for establishing a connection is proposed.
  • ECSs Before establishing a connection, ECSs first perform mutual identity authentication, and after the authentication is passed, a connection authorization confirmation is performed.
  • Figure 2 is a flow chart of a method for establishing a connection provided by an embodiment of the present disclosure.
  • the method provided by this embodiment can be executed by a home edge configuration server H-ECS.
  • the method may include but is not limited to the following steps:
  • Step 201 determining authorization information for accessing the edge configuration server V-ECS and the target V-ECS.
  • the target V-ECS is the ECS to be connected to the H-ECS.
  • the authorization information of the V-ECS may include identity information of a trusted V-ECS, or a certificate corresponding to the trusted V-ECS, and the like.
  • the authorization information of the V-ECS may also include identity information of the V-ECS that is allowed to establish a connection with the H-ECS and a corresponding certificate.
  • the H-ECS may obtain the authorization information of the V-ECS from a local preset storage area; or, the H-ECS may obtain the authorization information of the V-ECS from a terminal device. This disclosure does not limit this.
  • Step 202 Perform mutual identity authentication with the target V-ECS.
  • the H-ECS may perform mutual identity authentication with the target V-ECS.
  • mutual identity authentication may be for the H-ECS to determine whether the target V-ECS is a trusted ECS; or, the target V-ECS may determine whether the H-ECS is a trusted ECS; or, the H-ECS may determine whether the target V-ECS is a trusted ECS, and the target V-ECS may determine whether the H-ECS is a trusted ECS.
  • Step 203 In response to the mutual identity authentication being successful, it is determined whether the target V-ECS is allowed to establish a connection with the H-ECS based on the authenticated identity information and the authorization information of the V-ECS.
  • Step 204 In response to the target V-ECS being allowed to establish a connection with the H-ECS, a connection with the target V-ECS is established.
  • the authenticated identity information can be the fully qualified domain name (FQDN) of the ECS, or any other information that can uniquely represent its identity in the network, such as the Internet Protocol (IP) address of the ECS.
  • FQDN fully qualified domain name
  • IP Internet Protocol
  • the authenticated identity information of the target V-ECS may be its corresponding FQDN, or IP address, etc., which is not limited in the present disclosure.
  • the V-ECS that the terminal device allows to establish a connection with the H-ECS may not include the target V-ECS currently determined by the H-ECS. Therefore, after the H-ECS performs identity authentication with the V-ECS, the H-ECS can further determine whether the target V-ECS is allowed to establish a connection with the H-ECS based on the authenticated identity information and the authorization information of the V-ECS. If the target V-ECS is allowed to establish a connection with the H-ECS, a connection between the two can be established. Since the connection between the two is established after the two authenticate each other's identities and are allowed, the security of the connection is guaranteed, and the leakage of information in the VPLMN domain or the terminal device through the connection is avoided.
  • the H-ECS may terminate the connection establishment process.
  • the H-ECS may establish a transport layer security (TLS) connection with the target V-ECS based on the first certificate corresponding to the H-ECS and the second certificate corresponding to the target V-ECS. That is, the H-ECS and the target V-ECS may encrypt the information exchanged in the TLS connection between the two based on the first certificate and the second certificate; or the H-ECS may encrypt the key used for the information exchanged between the two based on the second certificate corresponding to the V-ECS, and the corresponding V-ECS may encrypt the key used for the information exchanged between the two based on the first certificate corresponding to the H-ECS, and so on, and the present disclosure does not limit this.
  • TLS transport layer security
  • the H-ECS can further discover the target edge enabler server (EES). For example, the target EES can be discovered based on whether the service area of the EES can cover the location information of the terminal device. After that, the H-ECS can return the identifier of the target EES to the terminal device or the source EES.
  • EES target edge enabler server
  • H-ECS first determines the authorization information of V-ECS and the target V-ECS, and then performs mutual identity authentication with the target V-ECS. After the authentication is successful, it determines whether the target V-ECS is allowed to establish a connection with H-ECS based on the authenticated identity information and the authorization information of V-ECS. If it is confirmed to be allowed, the connection with the target V-ECS is established. Therefore, before establishing the connection between H-ECS and the target V-ECS, identity authentication and authorization are performed, which avoids information leakage through the connection, improves the security and reliability of the connection between ECSs, and improves the performance of the system in roaming scenarios.
  • FIG. 3 is a flow chart of another method for establishing a connection provided by an embodiment of the present disclosure.
  • the method provided by this embodiment can be executed by H-ECS. As shown in FIG. 3, the method can include but is not limited to the following steps:
  • Step 301 receiving a first request sent by an edge enabling client EEC in a terminal device, wherein the first request includes authorization information of a V-ECS.
  • the first request may also include location information of the terminal device.
  • the terminal device when it needs to access the V-ECS, it can send a first request to the H-ECS through the EEC (edge enabler client), and send the authorization information of the V-ECS allowed by it (such as the certificate and/or identity information of the V-ECS allowed to access) to the H-ECS.
  • the EEC edge enabler client
  • Step 302 Determine the target V-ECS according to the location information of the terminal device.
  • the H-ECS can determine the target edge enabler server (T-EES) that can cover the location of the terminal device based on the location information of the terminal device included in the first request, and then determine the ECS corresponding to the determined T-EES as the target V-ECS.
  • T-EES target edge enabler server
  • the H-ECS needs to interact with the core network device to determine the location information of the terminal device, and then determine the target V-ECS based on the determined location information of the terminal device.
  • Step 303 Send a first certificate to the target V-ECS.
  • the first certificate is used by the target V-ECS to authenticate the identity of the H-ECS.
  • the first certificate may be any information that can characterize the identity of the H-ECS.
  • the first certificate may be pre-configured in the H-ECS by the operator, or may be determined by the H-ECS according to the protocol and its own information, which is not limited in the present disclosure.
  • H-ECS before sending the first certificate to the target ECS, H-ECS can also determine whether V-ECS is credible. For example, determine that the identity information (such as FQDN, IP address information) of the target V-ECS is in the first list in the authorization information of V-ECS, and/or the corresponding second certificate is in the first list in the authorization information of V-ECS. In other words, H-ECS sends the first certificate to the target V-ECS only when it determines that the target V-ECS is allowed to establish a connection with it, and the target V-ECS authenticates the identity of H-ECS.
  • the identity information such as FQDN, IP address information
  • Step 304 Receive the second certificate sent by the target V-ECS.
  • Step 305 Authenticate the identity of the target V-ECS based on the second certificate.
  • the target V-ECS authenticates the first certificate of the H-ECS
  • the corresponding second certificate can be sent to the H-ECS, and then the H-ECS authenticates the identity of the target V-ECS. This ensures that both the H-ECS and the target V-ECS that establish the connection are trustworthy ECSs, thus ensuring the security of the connection.
  • H-ECS can use the root certificate authority (CA) corresponding to the target V-ECS to authenticate the second certificate. If the authentication is successful, it can be determined that the information in the second certificate is the authenticated V-ECS identity information, that is, the target V-ECS identity is determined to be legal; otherwise, the target V-ECS identity is determined to be illegal.
  • CA root certificate authority
  • Step 306 In response to the mutual identity authentication being successful and the authenticated identity information of the target V-ECS being included in the first list of the authorization information of the V-ECS, determining that the target V-ECS is allowed to establish a connection with the H-ECS.
  • the first list of V-ECS authorization information contains one or more V-ECS identity information or corresponding second certificates that are allowed to connect to H-ECS.
  • the authenticated identity information of the target V-ECS can be the FQDN of the target V-ECS, or it can also be the IP address of the target V-ECS, which is not limited in this disclosure.
  • the H-ECS may also determine that the target V-ECS is allowed to establish a connection with the H-ECS when determining that the successfully authenticated second certificate of the target V-ECS is included in the first list of authorization information of the V-ECS.
  • the H-ECS may determine that the target V-ECS is allowed to establish a connection with the H-ECS only when the authenticated identity information of the target V-ECS is included in the first list of the authorization information of the V-ECS and the successfully authenticated second certificate is also included in the first list of the authorization information of the V-ECS.
  • Step 307 Establish a connection with the target V-ECS.
  • step 307 can refer to the detailed description of any embodiment of the present disclosure, which will not be repeated here.
  • the H-ECS can further discover the target edge enabler server (EES). After that, the H-ECS can return the identifier of the target EES to the terminal device.
  • EES target edge enabler server
  • H-ECS when H-ECS receives the authorization information of V-ECS sent by the terminal device, it first determines the target V-ECS according to the location information of the terminal device, and then exchanges certificates with the target V-ECS to perform mutual identity authentication. After the authentication is successful, it determines whether the target V-ECS is allowed to establish a connection with H-ECS based on the authenticated identity information and the authorization information of V-ECS. If it is confirmed to be allowed, it establishes a connection with the target V-ECS.
  • identity authentication and authorization are performed, and a check is performed on whether the connection is allowed, thereby avoiding information leakage through the connection, improving the security and reliability of the connection between ECSs, and improving the performance of the system in the roaming scenario.
  • FIG. 4 is a flow chart of another method for establishing a connection provided by an embodiment of the present disclosure.
  • the method provided by this embodiment can be executed by H-ECS. As shown in FIG. 4, the method can include but is not limited to the following steps:
  • Step 401 receiving a second request sent by a source edge enabling server S-EES, wherein the second request includes an identifier of a terminal device.
  • the identifier of the terminal device may be any information that can uniquely identify the terminal device by the H-ECS, for example, the number of the terminal device in the H-ECS, or the device identification code of the terminal device, etc., which is not limited in the present disclosure.
  • Step 402 Send a V-ECS authorization information acquisition request to the terminal device corresponding to the identifier of the terminal device.
  • Step 403 Receive the authorization information of the V-ECS returned by the terminal device.
  • the source edge enabler server (S-EES) is the EES that currently provides services to the terminal devices.
  • the S-EES when the S-EES needs to find the target V-ECS for the terminal device, it can send a second request to the H-ECS to request the H-ECS to retrieve the target V-ECS for the terminal device. After that, the H-ECS can request the authorization information of the corresponding V-ECS from the terminal device.
  • Step 404 Determine the target V-ECS according to the location information of the terminal device.
  • the location information of the terminal device may be synchronously returned when the terminal device returns the authorization information of the V-ECS to the H-ECS; or, it may be determined by the H-ECS through interaction with the core network, which is not limited in the present disclosure.
  • Step 405 Send a first certificate to the target V-ECS.
  • the first certificate is used by the target V-ECS to authenticate the identity of the H-ECS.
  • Step 406 Receive the second certificate sent by the target V-ECS.
  • Step 407 Authenticate the identity of the target V-ECS based on the second certificate.
  • Step 408 In response to the mutual identity authentication being successful and the second certificate of the target V-ECS being successfully authenticated being included in the first list of the authorization information, it is determined that the target V-ECS is allowed to establish a connection with the H-ECS.
  • the H-ECS may also determine that the target V-ECS is allowed to establish a connection with the H-ECS when determining that the authenticated identity information of the target V-ECS, such as the FQDN or IP address, is included in the first list of the authorization information of the V-ECS.
  • the authenticated identity information of the target V-ECS such as the FQDN or IP address
  • Step 409 Establish a TLS connection with the target V-ECS based on the first certificate corresponding to the H-ECS and the second certificate corresponding to the target V-ECS.
  • the H-ECS can further discover the target edge enabler server (EES). After that, the H-ECS can return the identifier of the target EES to the source EES.
  • EES target edge enabler server
  • H-ECS after receiving the second request sent by S-EES, H-ECS first requests the authorization information of V-ECS from the terminal device, and then determines the target V-ECS based on the location information of the terminal device, and then exchanges certificates with the target V-ECS to perform mutual identity authentication. After the authentication is successful, it is determined whether the target V-ECS is allowed to establish a connection with H-ECS. If it is confirmed to be allowed, the connection with the target V-ECS is established.
  • identity authentication and authorization are performed, and a check is performed to see whether the connection is allowed, thereby avoiding information leakage through the connection, improving the security and reliability of the connection between ECSs, and improving the performance of the system in roaming scenarios.
  • FIG. 5 is a flow chart of another method for establishing a connection provided by an embodiment of the present disclosure.
  • the method provided by this embodiment can be executed by H-ECS. As shown in FIG. 5, the method can include but is not limited to the following steps:
  • Step 501 Acquire the authorization information of the V-ECS from a preset storage area.
  • the authorization information of the V-ECS in the preset storage area may be pre-configured in the H-ECS by the operator; or, it may be requested by the H-ECS from the terminal device when the H-ECS established a connection with the V-ECS last time; or, it may be determined by the H-ECS according to the protocol agreement, which is not limited in the present disclosure.
  • Step 502 In response to receiving a target V-ECS query request sent by a terminal device, determine a target V-ECS according to a location of the terminal device.
  • step 502 may also be executed before step 501. That is, if the H-ECS first receives the target V-ECS query request sent by the terminal device, and the terminal device does not send the authorization information of its corresponding V-ECS to the H-ECS, then the H-ECS can obtain the stored V-ECS authorization information from its local preset storage area, and this disclosure does not limit this.
  • a terminal device when a terminal device needs to access a VPLMN after losing coverage, it can send a target V-ECS query request to the H-ECS.
  • the query request may include the location information of the terminal device, or may not include the location information of the terminal device.
  • the H-ECS determines the location information of the terminal device through interaction with the core network, and the present disclosure does not limit this.
  • Step 503 Send a first certificate to the target V-ECS.
  • the first certificate is used by the target V-ECS to authenticate the identity of the H-ECS.
  • Step 504 Receive the second certificate sent by the target V-ECS.
  • Step 505 Authenticate the identity of the target V-ECS based on the second certificate.
  • Step 506 In response to the mutual identity authentication being successful and the authenticated identity information of the target V-ECS being included in the first list of the authorization information of the V-ECS, it is determined that the target V-ECS is allowed to establish a connection with the H-ECS.
  • Step 507 Establish a connection with the target V-ECS.
  • H-ECS when H-ECS receives a query request for a target V-ECS sent by a terminal device, it can first determine the target V-ECS based on the location information of the terminal device, and then perform certificate interaction with the target V-ECS based on the authorization information of the local V-ECS to perform mutual identity authentication. After successful authentication, it is determined whether the target V-ECS is allowed to establish a connection with the H-ECS. If it is confirmed to be allowed, the connection with the target V-ECS is established.
  • identity authentication and authorization are performed, and a check is performed to see whether the connection is allowed, thereby avoiding information leakage through the connection, improving the security and reliability of the connection between ECSs, and improving the performance of the system in roaming scenarios.
  • Figure 6 is a flow chart of another method for establishing a connection provided by an embodiment of the present disclosure, and the method is executed by V-ECS. As shown in Figure 6, the method may include but is not limited to the following steps:
  • Step 601 Perform mutual identity authentication with the home edge configuration server H-ECS.
  • Step 602 In response to the mutual identity authentication being successful, it is determined whether the H-ECS is allowed to establish a connection with the V-ECS based on the authenticated identity information and the authorization information of the H-ECS.
  • the authorization information of the H-ECS may be configured in the V-ECS by the operator through configuration information, so that the V-ECS can extract the authorization information of the H-ECS from the configuration information; or, it may be generated by the V-ECS according to the agreement, which is not limited in this disclosure.
  • the authorization information of the H-ECS may include identity information of a trusted H-ECS, or a certificate corresponding to the trusted H-ECS, and the like.
  • the authorization information of the H-ECS may also include identity information of the H-ECS that is allowed to establish a connection with the V-ECS and a corresponding certificate.
  • Step 603 In response to the H-ECS being allowed to establish a connection with the target V-ECS, a connection with the H-ECS is established.
  • the authenticated identity information can be the fully qualified domain name (FQDN) of the ECS, or any other information that can uniquely represent its identity in the network, such as the Internet Protocol (IP) address of the ECS.
  • FQDN fully qualified domain name
  • IP Internet Protocol
  • the authenticated identity information of the H-ECS may be its corresponding FQDN, or IP address, etc., which is not limited in the present disclosure.
  • the H-ECS that the V-ECS allows to establish a connection with may not include the H-ECS that has currently completed identity authentication. Therefore, after the H-ECS performs identity authentication with the V-ECS, the V-ECS can further determine whether the H-ECS is allowed to establish a connection with the V-ECS based on the authenticated identity information and the authorization information of the H-ECS. If the H-ECS is allowed to establish a connection with the V-ECS, a connection between the two can be established. Since the connection between the two is established after the two authenticate each other's identities and are allowed, the security of the connection is guaranteed, and the situation in which information in the VPLMN domain or terminal device is leaked through the connection is avoided.
  • the V-ECS may terminate the connection establishment process.
  • V-ECS can establish a transport layer security (TLS) connection with the target V-ECS based on the first certificate corresponding to H-ECS and the second certificate corresponding to V-ECS. That is, H-ECS and V-ECS can encrypt the information exchanged in the TLS connection between the two based on the first certificate and the second certificate; or H-ECS can encrypt the key used for the information exchanged between the two based on the second certificate corresponding to V-ECS, and the corresponding V-ECS can encrypt the key used for the information exchanged between the two based on the first certificate corresponding to H-ECS, and so on, and the present disclosure does not limit this.
  • TLS transport layer security
  • V-ECS before V-ECS establishes a connection with H-ECS, it can first perform mutual identity authentication with H-ECS, and then after successful authentication, determine whether H-ECS is allowed to establish a connection with V-ECS based on the authenticated identity information and H-ECS authorization information, and then establish a connection with H-ECS if it is confirmed to be allowed.
  • identity authentication and authorization are performed, avoiding information leakage through the connection, improving the security and reliability of the connection between ECSs, and improving the performance of the system in roaming scenarios.
  • Figure 7 is a flow chart of another method for establishing a connection provided by an embodiment of the present disclosure, and the method is executed by V-ECS. As shown in Figure 7, the method may include but is not limited to the following steps:
  • Step 701 extract H-ECS authorization information from configuration information.
  • the V-ECS may also determine the authorization information of the H-ECS according to the protocol, which is not limited in the present disclosure.
  • Step 702 Receive a first certificate sent by the H-ECS.
  • the V-ECS may also execute step 702 first and then execute step 701, which is not limited in the present disclosure.
  • the first certificate may be any information that can characterize the identity of the H-ECS.
  • the first certificate may be pre-configured in the H-ECS by the operator, or may be determined by the H-ECS according to the protocol and its own information, which is not limited in the present disclosure.
  • Step 703 Authenticate the identity of the H-ECS based on the first certificate.
  • V-ECS can use the root certificate authority (CA) corresponding to H-ECS to authenticate the first certificate. If the authentication is successful, it can be determined that the information in the first certificate is the authenticated H-ECS identity information, that is, the H-ECS identity is determined to be legal. Otherwise, it is determined that the H-ECS identity is illegal.
  • CA root certificate authority
  • Step 704 Send the second certificate to the H-ECS.
  • V-ECS after receiving the first certificate sent by H-ECS, V-ECS can first authenticate the identity of H-ECS based on the first certificate. If the authentication is successful, it can be determined that H-ECS is a legitimate ECS, so that the corresponding second certificate can be sent to H-ECS, and H-ECS authenticates V-ECS based on the second certificate.
  • V-ECS may also first determine whether H-ECS is allowed to establish a connection with itself before sending the second certificate to H-ECS, and send the second certificate to H-ECS only when it is determined that H-ECS is allowed to establish a connection with V-ECS.
  • Step 705 In response to the mutual identity authentication being successful and the authenticated identity information of the H-ECS being included in the first list of authorization information of the H-ECS, it is determined that the H-ECS is allowed to establish a connection with the V-ECS.
  • the first list of H-ECS authorization information includes identity information and/or corresponding first certificates of one or more H-ECSs that are allowed to connect to the V-ECS.
  • the authenticated identity information of the H-ECS may be the FQDN of the H-ECS, or may be an IP address corresponding to the H-ECS, which is not limited in the present disclosure.
  • the V-ECS may determine that the H-ECS is allowed to establish a connection with the V-ECS when determining that the authenticated identity information of the H-ECS is included in the first list of authorization information of the H-ECS.
  • the V-ECS may also determine that the H-ECS is allowed to establish a connection with the V-ECS when the first certificate that has been successfully authenticated by the H-ECS is included in the first list of authorization information of the H-ECS.
  • the V-ECS may determine that the H-ECS is allowed to establish a connection with the V-ECS only when the authenticated identity information of the H-ECS is included in the first list of the authorization information of the V-ECS and the successfully authenticated first certificate is also included in the first list of the authorization information of the H-ECS.
  • Step 706 Establish a TLS connection with the H-ECS based on the first certificate corresponding to the H-ECS and the second certificate corresponding to the V-ECS.
  • step 706 may refer to the detailed description of any embodiment of the present disclosure and will not be repeated here.
  • V-ECS before V-ECS establishes a connection with H-ECS, it can first perform mutual identity authentication with H-ECS, and then after successful authentication, determine whether H-ECS is allowed to establish a connection with V-ECS based on the authenticated identity information and H-ECS authorization information, and then establish a connection with H-ECS if it is confirmed to be allowed.
  • identity authentication and authorization are performed, avoiding information leakage through the connection, improving the security and reliability of the connection between ECSs, and improving the performance of the system in roaming scenarios.
  • Figure 8 is an interactive schematic diagram of a method for establishing a connection provided by an embodiment of the present disclosure. As shown in Figure 8, the method may include but is not limited to the following steps:
  • Step 801 The H-ECS determines the authorization information of the V-ECS and the target V-ECS.
  • Step 802 The H-ECS determines whether to allow connection with the target V-ECS according to the authorization information of the V-ECS.
  • connection establishment process may be terminated.
  • Step 803 The H-ECS determines that the connection with the target V-ECS is allowed, and sends the first certificate to the target V-ECS.
  • Step 804 The target V-ECS authenticates the first certificate.
  • Step 805 the target V-ECS determines that the first certificate is valid, and the target V-ECS determines whether to allow connection with the local H-ECS according to the authorization information of the H-ECS.
  • Step 806 The V-ECS determines that the connection with the H-ECS is allowed, and sends the second certificate to the H-ECS.
  • Step 807 H-ECS authenticates the second certificate.
  • Step 808 The H-ECS determines that the second certificate is valid, and establishes a TLS connection with the V-HCS.
  • the H-ECS after determining the authorization information of the V-ECS and the target V-ECS, the H-ECS can perform mutual identity authentication with the target V-ECS, and when the authentication is successful and the ECSs are mutually allowed to connect, the connection with the target V-ECS is established.
  • identity authentication and authorization are performed, which avoids information leakage through the connection, improves the security and reliability of the connection between ECSs, and improves the performance of the system in the roaming scenario.
  • the communication device 900 shown in Figure 9 may include a transceiver module 901 and a processing module 902.
  • the transceiver module 901 may include a sending module and/or a receiving module, the sending module is used to implement a sending function, the receiving module is used to implement a receiving function, and the transceiver module 901 may implement a sending function and/or a receiving function.
  • the communication device 900 may be an H-ECS, or may be a device in the H-ECS, or may be a device that can be used in conjunction with the H-ECS.
  • the communication device 900 is on the H-ECS side, wherein:
  • the transceiver module 901 is used to determine the authorization information and the target V-ECS for accessing the edge configuration server V-ECS;
  • Processing module 902 used for mutual identity authentication with the target V-ECS
  • the processing module 902 is further configured to determine, in response to a mutual identity authentication success, whether the target V-ECS is allowed to establish a connection with the H-ECS based on the authenticated identity information and the authorization information of the V-ECS;
  • the processing module 902 is further configured to establish a connection with the target V-ECS in response to the target V-ECS being allowed to establish a connection with the H-ECS.
  • the transceiver module 901 is further configured to receive a first request sent by an edge enablement client EEC in a terminal device, wherein the first request includes authorization information of the V-ECS.
  • the transceiver module 901 is further used for:
  • the processing module 902 is further configured to obtain authorization information of the V-ECS from a preset storage area.
  • the processing module 902 is further used to determine the target V-ECS according to the location information of the terminal device, wherein the terminal device is a terminal device that sends the authorization information of the V-ECS to the H-ECS, or the terminal device is a terminal device that sends a V-ECS query request to the H-ECS.
  • the transceiver module 901 is further configured to send a first certificate to the target V-ECS, where the first certificate is used for the target V-ECS to authenticate the identity of the H-ECS.
  • the processing module 902 is further configured to determine whether the identity information of the target V-ECS or the corresponding second certificate is in the first list in the authorization information.
  • the transceiver module 901 is further configured to receive a second certificate sent by the target V-ECS;
  • the processing module 902 is further configured to authenticate the identity of the target V-ECS based on the second certificate.
  • processing module 902 is further configured to authenticate the second certificate using the root certificate issuing authority CA corresponding to the target V-ECS;
  • processing module 902 is further used to:
  • the processing module 902 is further configured to establish a transport layer security TLS connection with the target V-ECS based on a first certificate corresponding to the H-ECS and a second certificate corresponding to the target V-ECS.
  • H-ECS first determines the authorization information of V-ECS and the target V-ECS, and then performs mutual identity authentication with the target V-ECS. After the authentication is successful, it determines whether the target V-ECS is allowed to establish a connection with H-ECS based on the authenticated identity information and the authorization information of V-ECS. If it is confirmed to be allowed, the connection with the target V-ECS is established. Therefore, before establishing the connection between H-ECS and the target V-ECS, identity authentication and authorization are performed, which avoids information leakage through the connection, improves the security and reliability of the connection between ECSs, and improves the performance of the system in the roaming scenario.
  • the communication device 900 is on the V-ECS side, wherein:
  • the transceiver module 901 is used to perform mutual identity authentication with the home edge configuration server H-ECS;
  • a processing module 902 is used to determine whether the H-ECS is allowed to establish a connection with the V-ECS based on the authenticated identity information and the authorization information of the H-ECS in response to the mutual identity authentication being successful;
  • the processing module 902 is further configured to establish a connection with the H-ECS in response to the H-ECS being allowed to establish a connection with the V-ECS.
  • processing module 902 is further used to:
  • the authorization information of the H-ECS is determined.
  • the transceiver module 901 is further configured to receive a first certificate sent by the H-ECS;
  • the processing module 902 is further configured to authenticate the identity of the H-ECS based on the first certificate.
  • the processing module 902 is further configured to authenticate the first certificate using a root certificate issuing authority CA corresponding to the H-ECS;
  • the transceiver module 901 is further configured to send a second certificate to the H-ECS in response to the H-ECS being allowed to establish a connection with the V-ECS.
  • the processing module 902 is further configured to determine that the H-ECS is allowed to establish a connection with the V-ECS in response to the authenticated identity information of the H-ECS being included in the first list of authorization information of the H-ECS; or,
  • the processing module 902 is further configured to establish a transport layer security TLS connection with the H-ECS based on a first certificate corresponding to the H-ECS and a second certificate corresponding to the V-ECS.
  • V-ECS before V-ECS establishes a connection with H-ECS, it can first perform mutual identity authentication with H-ECS, and then after successful authentication, determine whether H-ECS is allowed to establish a connection with V-ECS based on the authenticated identity information and H-ECS authorization information, and then establish a connection with H-ECS if it is confirmed to be allowed.
  • identity authentication and authorization are performed, avoiding information leakage through the connection, improving the security and reliability of the connection between ECSs, and improving the performance of the system in roaming scenarios.
  • the communication device 1000 can be an H-ECS, or a chip, a chip system, or a processor that supports H-ECS to implement the above method.
  • it can be a V-ECS, or a chip, a chip system, or a processor that supports V-ECS to implement the above method.
  • the device can be used to implement the method described in the above method embodiment, and the details can be referred to the description in the above method embodiment.
  • the communication device 1000 may include one or more processors 1001.
  • the processor 1001 may be a general-purpose processor or a dedicated processor, etc. For example, it may be a baseband processor or a central processing unit.
  • the baseband processor may be used to process the communication protocol and communication data
  • the central processing unit may be used to control the communication device (such as a base station, a baseband chip, a terminal device, a terminal device chip, a DU or a CU, etc.), execute a computer program, and process the data of the computer program.
  • the communication device 1000 may further include one or more memories 1002, on which a computer program 1004 may be stored, and the processor 1001 executes the computer program 1004 so that the communication device 1000 performs the method described in the above method embodiment.
  • data may also be stored in the memory 1002.
  • the communication device 1000 and the memory 1002 may be provided separately or integrated together.
  • the communication device 1000 may further include a transceiver 1005 and an antenna 1006.
  • the transceiver 1005 may be referred to as a transceiver unit, a transceiver, or a transceiver circuit, etc., for implementing a transceiver function.
  • the transceiver 1205 may include a receiver and a transmitter, the receiver may be referred to as a receiver or a receiving circuit, etc., for implementing a receiving function; the transmitter may be referred to as a transmitter or a transmitting circuit, etc., for implementing a transmitting function.
  • the communication device 1000 may further include one or more interface circuits 1007.
  • the interface circuit 1007 is used to receive code instructions and transmit them to the processor 1001.
  • the processor 1001 executes the code instructions to enable the communication device 1000 to execute the method described in the above method embodiment.
  • the transceiver 1005 in the communication device 1000 may be used to execute the transceiver steps in the above figures, and the processor 1001 may be used to execute the processing steps in the above figures.
  • the processor 1001 may include a transceiver for implementing the receiving and sending functions.
  • the transceiver may be a transceiver circuit, or an interface, or an interface circuit.
  • the transceiver circuit, interface, or interface circuit for implementing the receiving and sending functions may be separate or integrated.
  • the above-mentioned transceiver circuit, interface, or interface circuit may be used for reading and writing code/data, or the above-mentioned transceiver circuit, interface, or interface circuit may be used for transmitting or delivering signals.
  • the processor 1001 may store a computer program 1003, which runs on the processor 1001 and enables the communication device 1000 to perform the method described in the above method embodiment.
  • the computer program 1003 may be fixed in the processor 1001, in which case the processor 1001 may be implemented by hardware.
  • the communication device 1000 may include a circuit that can implement the functions of sending or receiving or communicating in the aforementioned method embodiments.
  • the processor and transceiver described in the present disclosure may be implemented in an integrated circuit (IC), an analog IC, a radio frequency integrated circuit RFIC, a mixed signal IC, an application specific integrated circuit (ASIC), a printed circuit board (PCB), an electronic device, etc.
  • the processor and transceiver may also be manufactured using various IC process technologies, such as complementary metal oxide semiconductor (CMOS), N-type metal oxide semiconductor (NMOS), P-type metal oxide semiconductor (positive channel metal oxide semiconductor, PMOS), bipolar junction transistor (BJT), bipolar CMOS (BiCMOS), silicon germanium (SiGe), gallium arsenide (GaAs), etc.
  • CMOS complementary metal oxide semiconductor
  • NMOS N-type metal oxide semiconductor
  • PMOS P-type metal oxide semiconductor
  • BJT bipolar junction transistor
  • BiCMOS bipolar CMOS
  • SiGe silicon germanium
  • GaAs gallium arsenide
  • the communication device described in the above embodiments may be a network device or an intelligent relay, but the scope of the communication device described in the present disclosure is not limited thereto, and the structure of the communication device may not be limited by FIG. 10.
  • the communication device may be an independent device or may be part of a larger device.
  • the communication device may be:
  • the IC set may also include a storage component for storing data and computer programs;
  • ASIC such as modem
  • the communication device can be a chip or a chip system
  • the communication device can be a chip or a chip system
  • the schematic diagram of the chip structure shown in Figure 11 includes a processor 1101 and an interface 1102.
  • the number of processors 1101 can be one or more, and the number of interfaces 1102 can be multiple.
  • the chip further includes a memory 1103, and the memory 1103 is used to store necessary computer programs and data.
  • the present disclosure also provides a readable storage medium having instructions stored thereon, which implement the functions of any of the above method embodiments when executed by a computer.
  • the present disclosure also provides a computer program product, which implements the functions of any of the above method embodiments when executed by a computer.
  • the computer program product includes one or more computer programs.
  • the computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device.
  • the computer program can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • the computer program can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center.
  • the computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more available media integrated.
  • the available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a high-density digital video disc (DVD)), or a semiconductor medium (e.g., a solid state disk (SSD)), etc.
  • a magnetic medium e.g., a floppy disk, a hard disk, a magnetic tape
  • an optical medium e.g., a high-density digital video disc (DVD)
  • DVD high-density digital video disc
  • SSD solid state disk
  • At least one in the present disclosure may also be described as one or more, and a plurality may be two, three, four or more, which is not limited in the present disclosure.
  • the technical features in the technical feature are distinguished by “first”, “second”, “third”, “A”, “B”, “C” and “D”, etc., and there is no order of precedence or size between the technical features described by the "first”, “second”, “third”, “A”, “B”, “C” and “D”.
  • the corresponding relationships shown in the tables in the present disclosure can be configured or predefined.
  • the values of the information in each table are only examples and can be configured as other values, which are not limited by the present disclosure.
  • the corresponding relationships shown in some rows may not be configured.
  • appropriate deformation adjustments can be made based on the above table, such as splitting, merging, etc.
  • the names of the parameters shown in the titles of the above tables can also use other names that can be understood by the communication device, and the values or representations of the parameters can also be other values or representations that can be understood by the communication device.
  • other data structures can also be used, such as arrays, queues, containers, stacks, linear lists, pointers, linked lists, trees, graphs, structures, classes, heaps, hash tables or hash tables.
  • the predefined in the present disclosure may be understood as defined, predefined, stored, pre-stored, pre-negotiated, pre-configured, solidified, or pre-burned.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本公开实施例公开了一种构建连接的方法及装置，可应用于通信技术领域，由H-ECS 执行的方法包括:确定访问边缘配置服务器 V-ECS的授权信息及目标V-ECS（201）；与目标V-ECS进行相互身份认证（202）；响应于相互身份认证成功，基于已认证的身份信息及 V-ECS的授权信息，确定目标V-ECS是否被允许与H-ECS 建立连接（203）；响应于目标V-ECS 被允许与 H-ECS建立连接,建立与目标V-ECS的连接（204）。从而在建立H-ECS与目标V-ECS 间的连接前，进行了身份的认证和授权,避免了通过该连接泄露信息，提高了ECS间连接的安全性和可靠性，提高了漫游场景中系统的性能。

Description

一种构建连接的方法及装置 技术领域
本公开涉及通信技术领域，尤其涉及一种构建连接的方法及装置。
背景技术
在漫游架构中，归属公共陆地移动网(home public land mobile network，简称：HPLMN)和访问(visited，V)公共陆地移动网VPLMN中均提供了边缘配置服务器(edge configuration server，ECS)。其中，终端设备中的边缘使能客户端(edge enabler client，EEC)可以从访问ECS(V-ECS)和访问边缘使能服务器(visited edge enabler server，V-EES)处获得服务。ECS之间(即V–ECS和H-ECS)定义了一个新的连接。新的连接可用于漫游PLMN中的EES发现或V-ECS信息检索。
恶意H-ECS可以通过新的连接从V-ECS获取EES信息或V-ECS信息，以此攻击导致VPLMN域中的拓扑详细信息和服务器信息泄露。恶意V-ECS可能会通过新的连接从H-ECS获取终端设备信息，从而导致终端设备的隐私暴露。
发明内容
本公开实施例提供一种构建连接的方法及装置。
第一方面，本公开实施例提供一种构建连接的方法，该方法由H-ECS执行，方法包括：
确定访问边缘配置服务器V-ECS的授权信息及目标V-ECS；
与所述目标V-ECS进行相互身份认证；
响应于相互身份认证成功，基于已认证身份信息及所述V-ECS的授权信息，确定所述目标V-ECS是否被允许与所述H-ECS建立连接；
响应于所述目标V-ECS被允许与所述H-ECS建立连接，建立与所述目标V-ECS的连接。
本公开中，H-ECS首先确定V-ECS的授权信息及目标V-ECS，进而再与目标V-ECS进行相互身份认证，在认证成功后，再基于已认证身份信息及V-ECS的授权信息，确定目标V-ECS是否被允许与H-ECS建立连接，在确认被允许的情况下，再建立与目标V-ECS间的连接。从而在建立H-ECS与目标V-ECS间的连接前，进行了身份的认证和授权，避免了通过该连接泄露信息，提高了ECS间连接的安全性和可靠性，提高了漫游场景中系统的性能。
第二方面，本公开实施例提供一种构建连接的方法，该方法由V-ECS执行，方法包括：
与归属边缘配置服务器H-ECS进行相互身份认证；
响应于相互身份认证成功，基于已认证身份信息及H-ECS的授权信息，确定所述H-ECS是否被允许与所述V-ECS建立连接；
响应于所述H-ECS被允许与所述V-ECS建立连接，建立与所述H-ECS的连接。
第三方面，本公开实施例提供一种通信装置，包括：
收发模块，用于确定访问边缘配置服务器V-ECS的授权信息及目标V-ECS；
处理模块，用于与所述目标V-ECS进行相互身份认证；
所述处理模块，还用于响应于相互身份认证成功，基于已认证身份信息及所述V-ECS的授权信息，确定所述目标V-ECS是否被允许与所述H-ECS建立连接；
所述处理模块，还用于响应于所述目标V-ECS被允许与所述H-ECS建立连接，建立与所述目标V-ECS的连接。
第四方面，本公开实施例提供另一种通信装置，包括：
收发模块，用于与归属边缘配置服务器H-ECS进行相互身份认证；
处理模块，用于响应于相互身份认证成功，基于已认证身份信息及H-ECS的授权信息，确定所述H-ECS是否被允许与所述V-ECS建立连接；
所述处理模块，还用于响应于所述H-ECS被允许与所述V-ECS建立连接，建立与所述H-ECS的连接。
第五方面，本公开实施例提供一种通信装置，该通信装置包括处理器，当该处理器调用存储器中的计算机程序时，执行上述第一方面所述的方法。
第六方面，本公开实施例提供一种通信装置，该通信装置包括处理器，当该处理器调用存储器中的计算机程序时，执行上述第二方面所述的方法。
第七方面，本公开实施例提供一种通信装置，该通信装置包括处理器和存储器，该存储器中存储有 计算机程序；所述处理器执行该存储器所存储的计算机程序，以使该通信装置执行上述第一方面所述的方法。
第八方面，本公开实施例提供一种通信装置，该通信装置包括处理器和存储器，该存储器中存储有计算机程序；所述处理器执行该存储器所存储的计算机程序，以使该通信装置执行上述第二方面所述的方法。
第九方面，本公开实施例提供一种通信装置，该装置包括处理器和接口电路，该接口电路用于接收代码指令并传输至该处理器，该处理器用于运行所述代码指令以使该装置执行上述第一方面所述的方法。
第十方面，本公开实施例提供一种通信装置，该装置包括处理器和接口电路，该接口电路用于接收代码指令并传输至该处理器，该处理器用于运行所述代码指令以使该装置执行上述第二方面所述的方法。
第十一方面，本公开实施例提供一种通信系统，该系统包括第三方面所述的通信装置以及第四方面所述的通信装置，或者，该系统包括第五方面所述的通信装置以及第六方面所述的通信装置，或者，该系统包括第七方面所述的通信装置以及第八方面所述的通信装置，或者，该系统包括第九方面所述的通信装置以及第十方面所述的通信装置。
第十二方面，本发明实施例提供一种计算机可读存储介质，用于储存为上述终端设备所用的指令，当所述指令被执行时，使所述终端设备执行上述第一方面所述的方法。
第十三方面，本发明实施例提供一种可读存储介质，用于储存为上述网络设备所用的指令，当所述指令被执行时，使所述网络设备执行上述第二方面所述的方法。
第十四方面，本公开还提供一种包括计算机程序的计算机程序产品，当其在计算机上运行时，使得计算机执行上述第一方面所述的方法。
第十五方面，本公开还提供一种包括计算机程序的计算机程序产品，当其在计算机上运行时，使得计算机执行上述第二方面所述的方法。
第十六方面，本公开提供一种芯片系统，该芯片系统包括至少一个处理器和接口，用于支持终端设备实现第一方面所涉及的功能，例如，确定或处理上述方法中所涉及的数据和信息中的至少一种。在一种可能的设计中，所述芯片系统还包括存储器，所述存储器，用于保存终端设备必要的计算机程序和数据。该芯片系统，可以由芯片构成，也可以包括芯片和其他分立器件。
第十七方面，本公开提供一种芯片系统，该芯片系统包括至少一个处理器和接口，用于支持网络设备实现第二方面所涉及的功能，例如，确定或处理上述方法中所涉及的数据和信息中的至少一种。在一种可能的设计中，所述芯片系统还包括存储器，所述存储器，用于保存网络设备必要的计算机程序和数据。该芯片系统，可以由芯片构成，也可以包括芯片和其他分立器件。
第十八方面，本公开提供一种计算机程序，当其在计算机上运行时，使得计算机执行上述第一方面所述的方法。
第十九方面，本公开提供一种计算机程序，当其在计算机上运行时，使得计算机执行上述第二方面所述的方法。
附图说明
为了更清楚地说明本公开实施例或背景技术中的技术方案，下面将对本公开实施例或背景技术中所需要使用的附图进行说明。
图1是本公开实施例提供的一种通信系统的架构示意图；
图2是本公开实施例提供的一种构建连接的方法的流程示意图；
图3是本公开实施例提供的另一种构建连接的方法的流程示意图；
图4是本公开实施例提供的另一种构建连接的方法的流程示意图；
图5是本公开实施例提供的另一种构建连接的方法的流程示意图；
图6是本公开实施例提供的另一种构建连接的方法的流程示意图
图7是本公开实施例提供的另一种构建连接的方法的流程示意图；
图8是本公开实施例提供的另一种构建连接的位方法的交互示意图；
图9是本公开实施例提供的一种通信装置的结构示意图；
图10是本公开实施例提供的另一种通信装置的结构示意图；
图11是本公开实施例提供的一种芯片的结构示意图。
具体实施方式
为了便于理解，首先介绍本公开涉及的术语。
1、归属PLMN(HPLMN)
HPLMN为终端设备归属的PLMN。也就是说，终端设备中的全球用户识别卡(universal subscriber identity module，USIM)卡上的国际移动用户识别码(International Mobile Subscriber Identity，IMSI)中包含的移动国家码(Mobile Country Code，MCC)和移动网络号码(Mobile Network CodeMNC)与HPLMN上的MCC和MNC是一致的，对于某一USIM卡来说，其归属的PLMN只有一个。
2、访问PLMN(VPLMN)
VPLMN为终端设备访问的PLMN。其PLMN和存在USIM卡中的IMSI的MCC，MNC是不完全相同的。当终端设备丢失覆盖后，一个VPLMN将被选择。
为了更好的理解本公开实施例公开的一种迁移的方法，下面首先对本公开实施例适用的通信系统进行描述。
3、归属边缘配置服务器(home edge configuration server，H-ECS)
H-ECS为位于归属网络的边缘配置服务器。其可以用于对位于归属网络的边缘使能服务器(home edge enabler server，H-EES)进行配置管理，与归属网络中的其他服务器、或与V-ECS进行通讯等。
4、访问边缘配置服务器(visited edge configuration server，V-ECS)
V-ECS为位于拜访地(访问地)网络的边缘配置服务器。其可以用于对位于访问网络的边缘使能服务器(visited edge enabler server，V-EES)进行配置管理，与访问网络中的其他服务器、或与H-ECS进行通讯等。
请参见图1，图1为本公开实施例提供的一种通信系统的架构示意图。该通信系统可包括但不限于一个网络设备和一个终端设备，图1所示的设备数量和形态仅用于举例并不构成对本公开实施例的限定，实际应用中可以包括两个或两个以上的网络设备，两个或两个以上的终端设备。图1所示的通信系统以包括1个H-ECS11、一个V-ECS12为例和一个终端设备13。
需要说明的是，本公开实施例的技术方案可以应用于各种通信系统。例如：长期演进(long term evolution，LTE)系统、第五代(5th generation，5G)移动通信系统、5G新空口(new radio，NR)系统，或者其他未来的新型移动通信系统等。
本公开实施例中的H-ECS11和V-ECS12是一种为终端设备提供一个进入网络的通道和与其它服务器设备通讯的功能的设备。
可选的，该通信系统中，还包括归属网络设备及访问地网络设备。其中，网络设备为网络侧用于发射或接收信号的实体。例如，演进型基站(evolved NodeB，eNB)、传输点(transmission reception point，TRP)、NR系统中的下一代基站(next generation NodeB，gNB)、其他未来移动通信系统中的基站或无线保真(wireless fidelity，WiFi)系统中的接入节点等。本公开的实施例对网络设备所采用的具体技术和具体设备形态不做限定。本公开实施例提供的网络设备可以是由集中单元(central unit，CU)与分布式单元(distributed unit，DU)组成的，其中，CU也可以称为控制单元(control unit)，采用CU-DU的结构可以将网络设备，例如基站的协议层拆分开，部分协议层的功能放在CU集中控制，剩下部分或全部协议层的功能分布在DU中，由CU集中控制DU。
本公开实施例中的终端设备13为用户侧的一种用于接收或发射信号的实体，如手机。终端设备也可以称为终端设备(terminal)、用户设备(user equipment，UE)、移动台(mobile station，MS)、移动终端设备(mobile terminal，MT)等。终端设备可以是具备通信功能的汽车、智能汽车、手机(mobile phone)、穿戴式设备、平板电脑(Pad)、带无线收发功能的电脑、虚拟现实(virtual reality，VR)终端设备、增强现实(augmented reality，AR)终端设备、工业控制(industrial control)中的无线终端设备、无人驾驶(self-driving)中的无线终端设备、远程手术(remote medical surgery)中的无线终端设备、智能电网(smart grid)中的无线终端设备、运输安全(transportation safety)中的无线终端设备、智慧城市(smart city)中的无线终端设备、智慧家庭(smart home)中的无线终端设备等等。本公开的实施例对终端设备所采用的具体技术和具体设备形态不做限定。
可以理解的是，本公开实施例描述的通信系统是为了更加清楚的说明本公开实施例的技术方案，并不构成对于本公开实施例提供的技术方案的限定，本领域普通技术人员可知，随着系统架构的演变和新业务场景的出现，本公开实施例提供的技术方案对于类似的技术问题，同样适用。
本系统中，H-ECS可以实现本公开图2至图5任一实施例所示的方法，另外，V-HCS可以实现本公开图6至图7所述的方法。
可以理解的是，本公开实施例描述的通信系统是为了更加清楚的说明本公开实施例的技术方案，并不构成对于本公开实施例提供的技术方案的限定，本领域普通技术人员可知，随着系统架构的演变和新业务场景的出现，本公开实施例提供的技术方案对于类似的技术问题，同样适用。
本公开中，主要针对现有的漫游架构中，恶意H-ECS可以通过新的连接从V-ECS获取EES信息或V-ECS信息，以此攻击导致VPLMN域中的拓扑详细信息和服务器信息泄露。恶意V-ECS可能会通过新的连接从H-ECS获取UE信息，从而导致UE隐私暴露的问题，提出一种构建连接的方法。ECS之间在构建连接前，首先进行相互身份认证，在认证通过后，再进行连接授权确认，仅在被允许(allowed)建立连接的情况，才建立二者直接的连接，从而提高了ECS之间连接的安全性，即避免了VPLMN域中的拓扑详细信息和服务器信息泄露，又避免了终端设备的隐私暴露，提高了漫游场景中信息的安全性和可靠性，提高了通信系统性能。
下面结合各流程图，对本公开实施例提供的构建连接的方法进行详细的说明。
请参见图2，图2是本公开实施例提供的一种构建连接的方法的流程示意图。本实施例提供的方法，可以由归属边缘配置服务器H-ECS执行。如图2所示，该方法可以包括但不限于如下步骤：
步骤201，确定访问边缘配置服务器V-ECS的授权信息及目标V-ECS。
其中，目标V-ECS为待与H-ECS建立连接的ECS。
可选的，V-ECS的授权信息中可以包括可信的V-ECS的身份信息，或者可信的V-ECS对应的证书等等。
可选的，V-ECS的授权信息中还可以包括允许与H-ECS建立连接的V-ECS的身份信息及对应的证书等。
可选的，H-ECS可以从本地预设的存储区域获取V-ECS的授权信息；或者，也可以从终端设备处获取V-ECS的授权信息。本公开对此不做限定。
步骤202，与目标V-ECS进行相互身份认证。
本公开中H-ECS在确定目标V-ECS后，可以与目标V-ECS进行相互身份认证。
可选的，相互身份认证，可以为由H-ECS确定目标V-ECS是否为可信的ECS；或者，也可以为目标V-ECS确定H-ECS是否为可信的ECS；或者，还可以为H-ECS确定目标V-ECS是否为可信的ECS，和目标V-ECS确定H-ECS是否为可信的ECS。
步骤203，响应于相互身份认证成功，基于已认证身份信息及V-ECS的授权信息，确定目标V-ECS是否被允许与H-ECS建立连接。
步骤204，响应于目标V-ECS被允许与H-ECS建立连接，建立与目标V-ECS的连接。
可选的，已认证身份信息，可以为ECS的完全限定域名(fully qualified domain name，FQDN)，或者，还可以为任一其它可唯一表征其在网络中的身份的信息，比如为ECS的网络协议(Internet Protocol，IP)地址。
举例来说，目标V-ECS的已认证身份信息，可以为其对应的FQDN，或者IP地址等，本公开对此不做限定。
本公开中，终端设备允许与H-ECS建立连接的V-ECS，可能并不包括H-ECS当前确定的目标V-ECS，因此H-ECS在与V-ECS进行了身份认证后，H-ECS还可以基于已认证身份信息及V-ECS的授权信息，进一步判断目标V-ECS是否被允许与H-ECS建立连接。若目标V-ECS被允许与H-ECS建立连接，则可以建立二者之间的连接。由于构建的二者之间的连接，是在二者对彼此身份进行了认证后、且在被允许的情况下才建立的，从而保证了该连接的安全性，避免了通过该连接使得VPLMN域或终端设备中的信息被泄露的情况。
可选的，若目标V-ECS无权与H-ECS建立连接，那么H-ECS即可结束连接建立过程。
可选的，H-ECS可以基于H-ECS对应的第一证书及目标V-ECS对应的第二证书，建立与目标V-ECS之间的传输层安全性(transport layer security，TLS)连接。也就是说，H-ECS及目标V-ECS可以基于第一证书及第二证书对二者之间的TLS连接中交互的信息进行加密性；或者H-ECS可以基于V-ECS对应的第二证书对二者之间交互的信息采用的密钥进行加密，相应的V-ECS可以基于H-ECS对应的第第一证书对二者之间交互的信息采用的密钥进行加密等等，本公开对此不做限定。
需要说明的是，H-ECS在与目标V-ECS建立连接后，还可以进一步发现目标边缘使能服务器(edge enabler server，EES)。比如，可以根据EES的服务区域是否可以覆盖终端设备的位置信息来发现目标EES。之后，H-ECS即可向终端设备或者源EES返回目标EES的标识。
本公开中，H-ECS首先确定V-ECS的授权信息及目标V-ECS，进而再与目标V-ECS进行相互身份认证， 在认证成功后，再基于已认证身份信息及V-ECS的授权信息，确定目标V-ECS是否被允许与H-ECS建立连接，在确认被允许的情况下，再建立与目标V-ECS间的连接。从而在建立H-ECS与目标V-ECS间的连接前，进行了身份的认证和授权，避免了通过该连接泄露信息，提高了ECS间连接的安全性和可靠性，提高了漫游场景中系统的性能。
请参见图3，图3是本公开实施例提供的另一种构建连接的方法的流程示意图。本实施例提供的方法，可以由H-ECS执行。如图3所示，该方法可以包括但不限于如下步骤：
步骤301，接收终端设备中的边缘使能客户端EEC发送的第一请求，其中，第一请求中包含V-ECS的授权信息。
可选的，第一请求中，还可能包含终端设备的位置信息。
本公开实施例中，终端设备在需要接入V-ECS时，即可通过EEC(edge enabler client)向H-ECS发送第一请求，并将其允许的V-ECS的授权信息(比如允许接入的V-ECS的证书和/或身份信息)发送给H-ECS。
步骤302，根据终端设备的位置信息，确定目标V-ECS。
可选的，若第一请求中包含终端设备的位置信息，那么H-ECS即可根据第一请求中包含的终端设备的位置信息，确定可以覆盖该终端设备的位置的目标边缘使能服务器(target edge enabler server，T-EES),进而将确定的T-EES对应的ECS确定为目标V-ECS。
可选的，若第一请求中未包含终端设备的位置信息，那么H-ECS还需要与核心网设备进行交互，以确定终端设备的位置信息，进而再基于确定的终端设备的位置信息，确定目标V-ECS。
步骤303，向目标V-ECS发送第一证书，第一证书用于目标V-ECS对H-ECS的身份进行认证。
可选的，第一证书可以为任意可表征H-ECS身份的信息。该第一证书可以运营商预先配置在H-ECS中的，或者，也可以为H-ECS根据协议约定及自身信息确定的，本公开对此不做限定。
可选的，H-ECS在向目标ECS发送第一证书之前，还可以先确定V-ECS是否可信。比如，确定目标V-ECS的身份信息(例如FQDN，IP地址信息)在V-ECS的授权信息中的第一列表内，和/或对应的第二证书在V-ECS的授权信息中的第一列表内。也就是说，H-ECS仅在确定目标V-ECS被允许与其建立连接时，才将第一证书发送给目标V-ECS，由目标V-ECS对H-ECS的身份进行认证。
步骤304，接收目标V-ECS发送的第二证书。
步骤305，基于第二证书，对目标V-ECS的身份进行认证。
本公开实施例中，目标V-ECS在对H-ECS的第一证书进行认证后，若确定H-ECS可信，那么可以将其对应的第二证书发送给H-ECS，再由H-ECS对目标V-ECS的身份进行认证。从而保证建立连接的H-ECS与目标V-ECS均为可信的ECS，保证了连接的安全性。
可选的，H-ECS可以利用目标V-ECS对应的根证书签发机构(certificate authority，CA)对所述第二证书进行认证，如果认证成功，则可以确定第二证书中的信息为已认证的V-ECS身份信息，也就是说，确定目标V-ECS身份合法，否则确定目标V-ECS身份不合法。
步骤306，响应于相互身份认证成功、且目标V-ECS的已认证身份信息包含在V-ECS的授权信息的第一列表内，确定目标V-ECS被允许与所述H-ECS建立连接。
其中，V-ECS的授权信息的第一列表中，包含了一个或多个被允许与H-ECS进行连接的V-ECS的身份信息或对应的第二证书。可选的，目标V-ECS已认证身份信息可以为目标V-ECS的FQDN，或者也可以为目标V-ECS的IP地址，本公开对此不做限定。
可选的，本公开中，H-ECS也可以在确定目标V-ECS的已认证成功的第二证书包含在V-ECS的授权信息的第一列表内时，确定目标V-ECS被允许与所述H-ECS建立连接。
可选的，H-ECS也可以在目标V-ECS的已认证身份信息包含在V-ECS的授权信息的第一列表内、且已认证成功的第二证书也包含在V-ECS的授权信息的第一列表内时，才确定目标V-ECS被允许与所述H-ECS建立连接。
步骤307，建立与目标V-ECS的连接。
上述步骤307的具体实现方式可以参照本公开任一实施例的详细描述，此处不再赘述。
需要说明的是，H-ECS在与目标V-ECS建立连接后，还可以进一步发现目标边缘使能服务器(edge enabler server，EES)。之后，H-ECS即可向终端设备返回目标EES的标识。
本公开中，H-ECS在收到终端设备发送的V-ECS的授权信息时，首先根据终端设备的位置信息，确定 目标V-ECS，进而再与目标V-ECS进行证书交互，以进行相互身份认证，在认证成功后，再基于已认证身份信息及V-ECS的授权信息，确定目标V-ECS是否被允许与H-ECS建立连接，在确认被允许的情况下，再建立与目标V-ECS间的连接。从而在建立H-ECS与目标V-ECS间的连接前，进行了身份的认证授权，并进行是否被允许建立连接的检查，避免了通过该连接泄露信息，提高了ECS间连接的安全性和可靠性，提高了漫游场景中系统的性能。
请参见图4，图4是本公开实施例提供的另一种构建连接的方法的流程示意图。本实施例提供的方法，可以由H-ECS执行。如图4所示，该方法可以包括但不限于如下步骤：
步骤401，接收源边缘使能服务器S-EES发送的第二请求，其中，第二请求中包括终端设备的标识。
其中，终端设备的标识，可以为任一由H-ECS可唯一确定该终端设备的信息。比如，可以为终端设备在H-ECS中的编号、或者为终端设备的设备识别码等等，本公开对此不做限定。
步骤402，向终端设备的标识对应的终端设备发送V-ECS的授权信息获取请求。
步骤403，接收终端设备返回的所述V-ECS的授权信息。
其中，源边缘使能服务器(source edge enabler server，S-EES)为当前为终端设备提供服务的EES。
本公开实施例中，S-EES在需要为终端设备查找目标V-ECS时，可以向H-ECS发送第二请求，以请求H-ECS为终端设备检索目标V-ECS。之后，H-ECS即可向该终端设备请求其对应的V-ECS的授权信息。
步骤404，根据终端设备的位置信息，确定所述目标V-ECS。
可选的，终端设备的位置信息，可以为终端设备在向H-ECS返回V-ECS的授权信息时，同步返回的；或者，也可以为H-ECS通过与核心网的交互确定的，本公开对此不做限定。
步骤405，向目标V-ECS发送第一证书，第一证书用于目标V-ECS对H-ECS的身份进行认证。
步骤406，接收目标V-ECS发送的第二证书。
步骤407，基于所述第二证书，对目标V-ECS的身份进行认证。
步骤408，响应于相互身份认证成功、且目标V-ECS已认证成功的第二证书包含在所述授权信息的第一列表内，确定目标V-ECS被允许与H-ECS建立连接。
可选的，H-ECS也可以在确定所述目标V-ECS的已认证身份信息，比如FQDN或IP地址包含在V-ECS的授权信息的第一列表内时，确定目标V-ECS被允许与H-ECS建立连接。
步骤409，基于H-ECS对应的第一证书及目标V-ECS对应的第二证书，建立与目标V-ECS之间的TLS连接。
上述步骤404至409的具体实现方式，可以参照本公开任一实施例的详细描述，此处不再赘述。
需要说明的是，H-ECS在与目标V-ECS建立连接后，还可以进一步发现目标边缘使能服务器(edge enabler server，EES)。之后，H-ECS即可向源EES返回目标EES的标识。
本公开中，H-ECS在收到S-EES发送的第二请求后，首先向终端设备请求V-ECS的授权信息，之后再根据终端设备的位置信息，确定目标V-ECS，进而再与目标V-ECS进行证书交互，以进行相互身份认证，在认证成功后，再确定目标V-ECS是否被允许与H-ECS建立连接，在确认被允许的情况下，再建立与目标V-ECS间的连接。从而在建立H-ECS与目标V-ECS间的连接前，进行了身份的认证授权，并进行是否被允许建立连接的检查，避免了通过该连接泄露信息，提高了ECS间连接的安全性和可靠性，提高了漫游场景中系统的性能。
请参见图5，图5是本公开实施例提供的另一种构建连接的方法的流程示意图。本实施例提供的方法，可以由H-ECS执行。如图5所示，该方法可以包括但不限于如下步骤：
步骤501，从预设的存储区域获取V-ECS的授权信息。
可选的，预设的存储区域中的V-ECS的授权信息，可以为运营商预先配置在H-ECS中的；或者，也可以为H-ECS在上一次与V-ECS建立连接时，从终端设备处请求的；或者，也可以为H-ECS根据协议约定确定的，本公开对此不做限定。
步骤502，响应于接收到终端设备发送的目标V-ECS查询请求，根据终端设备的位置，确定目标V-ECS。
其中，步骤502也可能在步骤501之前执行。也就是H-ECS先收到了终端设备发送的目标V-ECS查询请求、且终端设备并未将其对应的V-ECS的授权信息发送给H-ECS，那么H-ECS即可从其本地的预设存储区域中获取已存储的V-ECS的授权信息，本公开对此不做限定。
本公开中，终端设备在丢失覆盖后，需要接入VPLMN时，即可向H-ECS发送目标V-ECS查询请求。其中，该查询请求中，可以包括终端设备的位置信息，或者，也可以不包含终端设备的位置信息，由H-ECS通过与核心网的交互来确定终端设备的位置信息，本公开对此不做限定。
步骤503，向目标V-ECS发送第一证书，第一证书用于目标V-ECS对H-ECS的身份进行认证。
步骤504，接收目标V-ECS发送的第二证书。
步骤505，基于第二证书，对目标V-ECS的身份进行认证。
步骤506，响应于相互身份认证成功、且目标V-ECS已认证身份信息包含在V-ECS的授权信息的第一列表内，确定目标V-ECS被允许与H-ECS建立连接。
步骤507，建立与目标V-ECS的连接。
其中，上述步骤502至步骤507的具体实现过程，可以参照本公开任一实施例的详细描述，此处不再赘述。
本公开中，H-ECS在收到收到终端设备发送的目标V-ECS查询请求时，可以首先根据终端设备的位置信息，确定目标V-ECS，进而再基于本地的V-ECS的授权信息，与目标V-ECS进行证书交互，以进行相互身份认证，在认证成功后，再确定目标V-ECS是否被允许与H-ECS建立连接，在确认被允许的情况下，再建立与目标V-ECS间的连接。从而在建立H-ECS与目标V-ECS间的连接前，进行了身份的认证授权，并进行是否被允许建立连接的检查，避免了通过该连接泄露信息，提高了ECS间连接的安全性和可靠性，提高了漫游场景中系统的性能。
请参见图6，图6是本公开实施例提供的另一种构建连接的方法的流程示意图，该方法由V-ECS执行。如图6所示，该方法可以包括但不限于如下步骤：
步骤601，与归属边缘配置服务器H-ECS进行相互身份认证。
其中，V-ECS与H-ECS进行相互身份认证的具体实现方式，可以参照本公开任一实施例的详细描述，此处不再赘述。
步骤602，响应于相互身份认证成功，基于已认证身份信息及H-ECS的授权信息，确定H-ECS是否被允许与V-ECS建立连接。
可选的，H-ECS的授权信息，可以为运营商通过配置信息配置在V-ECS中的。从而V-ECS即可从配置信息中提取该H-ECS的授权信息；或者，也可以为V-ECS根据协议约定生成的，本公开对此不做限定。
可选的，H-ECS的授权信息中可以包括可信的H-ECS的身份信息，或者可信的H-ECS对应的证书等等。
可选的，H-ECS的授权信息中还可以包括允许与V-ECS建立连接的H-ECS的身份信息及对应的证书等。
步骤603，响应于H-ECS被允许与目标V-ECS建立连接，建立与H-ECS的连接。
可选的，已认证身份信息，可以为ECS的完全限定域名(fully qualified domain name，FQDN)，或者，还可以为任一其它可唯一表征其在网络中的身份的信息，比如为ECS的网络协议(Internet Protocol，IP)地址。
举例来说，H-ECS已认证身份信息，可以为其对应的FQDN，或者IP地址等，本公开对此不做限定。
本公开中，V-ECS允许与其建立连接的H-ECS，可能并不包括当前已经完成了身份认证的H-ECS，因此H-ECS在与V-ECS进行了身份认证后，V-ECS还可以基于已认证身份信息及H-ECS的授权信息，进一步判断H-ECS是否被允许与V-ECS建立连接。若H-ECS被允许与V-ECS建立连接，则可以建立二者之间的连接。由于构建的二者之间的连接，是在二者对彼此身份进行了认证后、且在被允许的情况下才建立的，从而保证了该连接的安全性，避免了通过该连接使得VPLMN域或终端设备中的信息被泄露的情况。
可选的，若H-ECS无权与V-ECS建立连接，那么V-ECS即可结束连接建立过程。
可选的，V-ECS可以基于H-ECS对应的第一证书及V-ECS对应的第二证书，建立与目标V-ECS之间的传输层安全性(transport layer security，TLS)连接。也就是说，H-ECS及V-ECS可以基于第一证书及第二证书对二者之间的TLS连接中交互的信息进行加密性；或者H-ECS可以基于V-ECS对应的第二证书对二者之间交互的信息采用的密钥进行加密，相应的V-ECS可以基于H-ECS对应的第第一证书对二者之间交互的信息采用的密钥进行加密等等，本公开对此不做限定。
本公开中，V-ECS与H-ECS构建连接前，可以首先与H-ECS进行相互身份认证，之后在认证成功后，再基于已认证身份信息及H-ECS的授权信息，确定H-ECS是否被允许与V-ECS建立连接，在确认被允许的情况下，再建立与H-ECS间的连接。从而在建立H-ECS与目标V-ECS间的连接前，进行了身份的认证和授权，避免了通过该连接泄露信息，提高了ECS间连接的安全性和可靠性，提高了漫游场景中系统的性能。
请参见图7，图7是本公开实施例提供的另一种构建连接的方法的流程示意图，该方法由V-ECS执行。如图7所示，该方法可以包括但不限于如下步骤：
步骤701，从配置信息中提取H-ECS的授权信息。
可选的，V-ECS还可以根据协议约定确定H-ECS的授权信息，本公开对此不做限定。
步骤702，接收H-ECS发送的第一证书。
其中，V-ECS也可以先执行步骤702，再执行步骤701，本公开对此不做限定。
可选的，第一证书可以为任意可表征H-ECS身份的信息。该第一证书可以运营商预先配置在H-ECS中的，或者，也可以为H-ECS根据协议约定及自身信息确定的，本公开对此不做限定。
步骤703，基于第一证书，对H-ECS的身份进行认证。
可选的，V-ECS可以利用H-ECS对应的根证书签发机构(certificate authority，CA)对第一证书进行认证，如果认证成功，则可以确定第一证书中的信息为已认证的H-ECS身份信息，也就是说确定H-ECS身份合法，否则确定H-ECS身份不合法。
步骤704，向H-ECS发送第二证书。
本公开中，V-ECS在收到H-ECS发送的第一证书后，可以首先根据第一证书，对H-ECS的身份进行认证。若认证通过，则可以确定H-ECS为合法的ECS，从而即可再将其对应的第二证书发送给H-ECS，由H-ECS基于第二证书，对V-ECS进行认证。
可选的，由于V-ECS将第二证书发送给H-ECS的目的是在相互认证通过后，在二者之间建立连接，为了避免无效的认证过程，本公开中V-ECS也可以在向H-ECS发送第二证书前，首先确定其是否被允许与自身建立连接，仅在确定H-ECS被允许与V-ECS建立连接的情况下，再将第二证书发送给H-ECS。
步骤705，响应于相互身份认证成功，且H-ECS的已认证身份信息包含在H-ECS的授权信息的第一列表内，确定H-ECS被允许与V-ECS建立连接。
其中，H-ECS的授权信息的第一列表中，包含了一个或多个被允许与V-ECS进行连接的H-ECS的身份信息和/或对应的第一证书。
可选的，H-ECS的已认证身份信息可以为H-ECS的FQDN，或者也可以为H-ECS对应的IP地址，本公开对此不做限定。
可选的，V-ECS可以在确定H-ECS的已认证身份信息包含在H-ECS的授权信息的第一列表内时，确定H-ECS被允许与V-ECS建立连接。
可选的，V-ECS也可以在H-ECS已认证成功的第一证书包含在所述H-ECS的授权信息的第一列表内时，确定H-ECS被允许与V-ECS建立连接。
可选的，V-ECS也可以在H-ECS的已认证身份信息包含在V-ECS的授权信息的第一列表内、且已认证成功的第一证书，也包含在H-ECS的授权信息的第一列表内时，才确定H-ECS被允许与V-ECS建立连接。
步骤706，基于H-ECS对应的第一证书及V-ECS对应的第二证书，建立与H-ECS之间的TLS连接。
其中，步骤706的具体实现方式，可以参照本公开任一实施例的详细描述，此处不再赘述。
本公开中，V-ECS与H-ECS构建连接前，可以首先与H-ECS进行相互身份认证，之后在认证成功后，再基于已认证身份信息及H-ECS的授权信息，确定H-ECS是否被允许与V-ECS建立连接，在确认被允许的情况下，再建立与H-ECS间的连接。从而在建立H-ECS与目标V-ECS间的连接前，进行了身份的认证和授权，避免了通过该连接泄露信息，提高了ECS间连接的安全性和可靠性，提高了漫游场景中系统的性能。
请参见图8，图8是本公开实施例提供的一种构建连接的方法的交互示意图。如图8所示，该方法可以包括但不限于如下步骤：
步骤801，H-ECS确定V-ECS的授权信息及目标V-ECS。
步骤802，H-ECS根据V-ECS的授权信息确定是否允许与目标V-ECS连接。
需要说明的是，如果H-ECS确定不允许与目标V-ECS建立连接，那么就可以结束该连接构建过程。
步骤803，H-ECS确定允许与目标V-ECS连接，向目标V-ECS发送第一证书。
步骤804，目标V-ECS认证第一证书。
步骤805，目标V-ECS确定第一证书有效，目标V-ECS根据本地H-ECS的授权信息，确定是否允许与H-ECS连接。
步骤806，V-ECS确定允许与H-ECS连接，向H-ECS发送第二证书。
步骤807，H-ECS认证第二证书。
步骤808，H-ECS确定第二证书有效，构建与V-HCS间的TLS连接。
本公开中，H-ECS在确定V-ECS的授权信息及目标V-ECS后，即可与目标V-ECS进行相互身份认证，在认证成功、且互为允许连接的ECS时，再建立与目标V-ECS间的连接。从而在建立H-ECS与目标V-ECS间的连接前，进行了身份的认证和授权，避免了通过该连接泄露信息，提高了ECS间连接的安全性和可靠性，提高了漫游场景中系统的性能。
请参见图9，图9为本公开实施例提供的一种通信装置的结构示意图。图9所示的通信装置900可包括收发模块901和处理模块902。收发模块901可包括发送模块和/或接收模块，发送模块用于实现发送功能，接收模块用于实现接收功能，收发模块901可以实现发送功能和/或接收功能。
可以理解的是，通信装置900可以是H-ECS，或者，也可以是H-ECS中的装置，或者，还可以是能够与H-ECS匹配使用的装置。
通信装置900在H-ECS侧，其中：
收发模块901，用于确定访问边缘配置服务器V-ECS的授权信息及目标V-ECS；
处理模块902，用于与所述目标V-ECS进行相互身份认证；
所述处理模块902，还用于响应于相互身份认证成功，基于已认证身份信息及所述V-ECS的授权信息，确定所述目标V-ECS是否被允许与所述H-ECS建立连接；
所述处理模块902，还用于响应于所述目标V-ECS被允许与所述H-ECS建立连接，建立与所述目标V-ECS的连接。
可选的，上述收发模块901，还用于接收终端设备中的边缘使能客户端EEC发送的第一请求，其中，所述第一请求中包含所述V-ECS的授权信息。
可选的，上述收发模块901，还用于：
接收源边缘使能服务器S-EES发送的第二请求，其中，所述第二请求中包括终端设备的标识；
向所述终端设备的标识对应的终端设备发送V-ECS的授权信息获取请求；
接收所述终端设备返回的所述V-ECS的授权信息；
可选的，上述处理模块902，还用于从预设的存储区域获取所述V-ECS的授权信息。
可选的，上述处理模块902，还用于根据终端设备的位置信息，确定所述目标V-ECS，其中，所述终端设备为向所述H-ECS发送所述V-ECS的授权信息的终端设备，或者，所述终端设备为向所述H-ECS发送V-ECS查询请求的终端设备。
可选的，上述收发模块901，还用于向所述目标V-ECS发送第一证书，所述第一证书用于所述目标V-ECS对所述H-ECS的身份进行认证。
可选的，上述处理模块902，还用于确定所述目标V-ECS的身份信息或对应的第二证书在所述授权信息中的第一列表内。
可选的，上述收发模块901，还用于接收所述目标V-ECS发送的第二证书；
上述处理模块902，还用于基于所述第二证书，对所述目标V-ECS的身份进行认证。
可选的，上述处理模块902，还用于利用所述目标V-ECS对应的根证书签发机构CA对所述第二证书进行认证；
响应于认证成功，确定第二证书中的信息为已认证的V-ECS身份信息。
可选的，上述处理模块902，还用于：
响应于所述目标V-ECS的已认证身份信息包含在所述V-ECS的授权信息的第一列表内，确定所述目标V-ECS被允许与所述H-ECS建立连接；和/或，
响应于所述目标V-ECS已认证成功的第二证书包含在所述V-ECS的授权信息的第一列表内，确定所述目标V-ECS被允许与所述H-ECS建立连接。
可选的，上述处理模块902，还用于基于所述H-ECS对应的第一证书及所述目标V-ECS对应的第二证书，建立与所述目标V-ECS之间的传输层安全性TLS连接。
本公开中，H-ECS首先确定V-ECS的授权信息及目标V-ECS，进而再与目标V-ECS进行相互身份认证，在认证成功后，再基于已认证身份信息及V-ECS的授权信息，确定目标V-ECS是否被允许与H-ECS建立连接，在确认被允许的情况下，再建立与目标V-ECS间的连接。从而在建立H-ECS与目标V-ECS间的连接前，进行了身份的认证和授权，避免了通过该连接泄露信息，提高了ECS间连接的安全性和可 靠性，提高了漫游场景中系统的性能。
或者，通信装置900在V-ECS侧，其中：
收发模块901，用于与归属边缘配置服务器H-ECS进行相互身份认证；
处理模块902，用于响应于相互身份认证成功，基于已认证身份信息及H-ECS的授权信息，确定所述H-ECS是否被允许与所述V-ECS建立连接；
处理模块902，还用于响应于所述H-ECS被允许与所述V-ECS建立连接，建立与所述H-ECS的连接。
可选的，上述处理模块902，还用于：
从配置信息中提取所述H-ECS的授权信息；或者，
根据协议约定，确定所述H-ECS的授权信息。
可选的，上述收发模块901，还用于接收所述H-ECS发送的第一证书；
处理模块902，还用于基于所述第一证书，对所述H-ECS的身份进行认证。
可选的，处理模块902，还用于利用所述H-ECS对应的根证书签发机构CA对所述第一证书进行认证；
响应于认证成功，确定第一证书中的信息为已认证的H-ECS身份信息。
可选的，收发模块901，还用于响应于所述H-ECS被允许与V-ECS建立连接向所述H-ECS发送第二证书。
可选的，上述处理模块902，还用于响应于所述H-ECS的已认证身份信息包含在所述H-ECS的授权信息的第一列表内，确定所述H-ECS被允许与所述V-ECS建立连接；或者，
响应于所述H-ECS的已认证成功的第一证书包含在所述H-ECS的授权信息的第一列表内，确定所述H-ECS被允许与所述V-ECS建立连接。
可选的，上述处理模块902，还用于基于所述H-ECS对应的第一证书及所述V-ECS对应的第二证书，建立与所述H-ECS之间的传输层安全性TLS连接。
本公开中，V-ECS与H-ECS构建连接前，可以首先与H-ECS进行相互身份认证，之后在认证成功后，再基于已认证身份信息及H-ECS的授权信息，确定H-ECS是否被允许与V-ECS建立连接，在确认被允许的情况下，再建立与H-ECS间的连接。从而在建立H-ECS与目标V-ECS间的连接前，进行了身份的认证和授权，避免了通过该连接泄露信息，提高了ECS间连接的安全性和可靠性，提高了漫游场景中系统的性能。
请参见图10，图10是本公开实施例提供的另一种通信装置的结构示意图。通信装置1000可以是H-ECS，也可以是支持H-ECS实现上述方法的芯片、芯片系统、或处理器等。或者，也可以以是V-ECS，也可以是支持V-ECS实现上述方法的芯片、芯片系统、或处理器等。该装置可用于实现上述方法实施例中描述的方法，具体可以参见上述方法实施例中的说明。
通信装置1000可以包括一个或多个处理器1001。处理器1001可以是通用处理器或者专用处理器等。例如可以是基带处理器或中央处理器。基带处理器可以用于对通信协议以及通信数据进行处理，中央处理器可以用于对通信装置(如，基站、基带芯片，终端设备、终端设备芯片，DU或CU等)进行控制，执行计算机程序，处理计算机程序的数据。
可选的，通信装置1000中还可以包括一个或多个存储器1002，其上可以存有计算机程序1004，处理器1001执行所述计算机程序1004，以使得通信装置1000执行上述方法实施例中描述的方法。可选的，所述存储器1002中还可以存储有数据。通信装置1000和存储器1002可以单独设置，也可以集成在一起。
可选的，通信装置1000还可以包括收发器1005、天线1006。收发器1005可以称为收发单元、收发机、或收发电路等，用于实现收发功能。收发器1205可以包括接收器和发送器，接收器可以称为接收机或接收电路等，用于实现接收功能；发送器可以称为发送机或发送电路等，用于实现发送功能。
可选的，通信装置1000中还可以包括一个或多个接口电路1007。接口电路1007用于接收代码指令并传输至处理器1001。处理器1001运行所述代码指令以使通信装置1000执行上述方法实施例中描述的方法。
通信装置1000中的收发器1005可用于执行上述各图中的收发步骤，处理器1001可用于执行上述各图中的处理步骤。
在一种实现方式中，处理器1001中可以包括用于实现接收和发送功能的收发器。例如该收发器可 以是收发电路，或者是接口，或者是接口电路。用于实现接收和发送功能的收发电路、接口或接口电路可以是分开的，也可以集成在一起。上述收发电路、接口或接口电路可以用于代码/数据的读写，或者，上述收发电路、接口或接口电路可以用于信号的传输或传递。
在一种实现方式中，处理器1001可以存有计算机程序1003，计算机程序1003在处理器1001上运行，可使得通信装置1000执行上述方法实施例中描述的方法。计算机程序1003可能固化在处理器1001中，该种情况下，处理器1001可能由硬件实现。
在一种实现方式中，通信装置1000可以包括电路，所述电路可以实现前述方法实施例中发送或接收或者通信的功能。本公开中描述的处理器和收发器可实现在集成电路(integrated circuit，IC)、模拟IC、射频集成电路RFIC、混合信号IC、专用集成电路(application specific integrated circuit，ASIC)、印刷电路板(printed circuit board，PCB)、电子设备等上。该处理器和收发器也可以用各种IC工艺技术来制造，例如互补金属氧化物半导体(complementary metal oxide semiconductor，CMOS)、N型金属氧化物半导体(nMetal-oxide-semiconductor，NMOS)、P型金属氧化物半导体(positive channel metal oxide semiconductor，PMOS)、双极结型晶体管(bipolar junction transistor，BJT)、双极CMOS(BiCMOS)、硅锗(SiGe)、砷化镓(GaAs)等。
以上实施例描述中的通信装置可以是网络设备或者智能中继，但本公开中描述的通信装置的范围并不限于此，而且通信装置的结构可以不受图10的限制。通信装置可以是独立的设备或者可以是较大设备的一部分。例如所述通信装置可以是：
(1)独立的集成电路IC，或芯片，或，芯片系统或子系统；
(2)具有一个或多个IC的集合，可选的，该IC集合也可以包括用于存储数据，计算机程序的存储部件；
(3)ASIC，例如调制解调器(Modem)；
(4)可嵌入在其他设备内的模块；
(5)接收机、终端设备、智能终端设备、蜂窝电话、无线设备、手持机、移动单元、车载设备、网络设备、云设备、人工智能设备等等；
(6)其他等等。
对于通信装置可以是芯片或芯片系统的情况，可参见图11所示的芯片的结构示意图。图11所示的芯片包括处理器1101和接口1102。其中，处理器1101的数量可以是一个或多个，接口1102的数量可以是多个。
对于芯片用于实现本公开实施例中终端设备的功能的情况。
可选的，芯片还包括存储器1103，存储器1103用于存储必要的计算机程序和数据。
本领域技术人员还可以了解到本公开实施例列出的各种说明性逻辑块(illustrative logical block)和步骤(step)可以通过电子硬件、电脑软件，或两者的结合进行实现。这样的功能是通过硬件还是软件来实现取决于特定的应用和整个系统的设计要求。本领域技术人员可以对于每种特定的应用，可以使用各种方法实现所述的功能，但这种实现不应被理解为超出本公开实施例保护的范围。
本公开还提供一种可读存储介质，其上存储有指令，该指令被计算机执行时实现上述任一方法实施例的功能。
本公开还提供一种计算机程序产品，该计算机程序产品被计算机执行时实现上述任一方法实施例的功能。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机程序。在计算机上加载和执行所述计算机程序时，全部或部分地产生按照本公开实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机程序可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机程序可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(digital subscriber line，DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)、光介质(例如，高密度数字视频光盘(digital video disc，DVD))、或者半导体介质(例如，固态硬盘(solid state disk，SSD))等。
本领域普通技术人员可以理解：本公开中涉及的第一、第二等各种数字编号仅为描述方便进行的区分，并不用来限制本公开实施例的范围，也表示先后顺序。
本公开中的至少一个还可以描述为一个或多个，多个可以是两个、三个、四个或者更多个，本公开不做限制。在本公开实施例中，对于一种技术特征，通过“第一”、“第二”、“第三”、“A”、“B”、“C”和“D”等区分该种技术特征中的技术特征，该“第一”、“第二”、“第三”、“A”、“B”、“C”和“D”描述的技术特征间无先后顺序或者大小顺序。
本公开中各表所示的对应关系可以被配置，也可以是预定义的。各表中的信息的取值仅仅是举例，可以配置为其他值，本公开并不限定。在配置信息与各参数的对应关系时，并不一定要求必须配置各表中示意出的所有对应关系。例如，本公开中的表格中，某些行示出的对应关系也可以不配置。又例如，可以基于上述表格做适当的变形调整，例如，拆分，合并等等。上述各表中标题示出参数的名称也可以采用通信装置可理解的其他名称，其参数的取值或表示方式也可以通信装置可理解的其他取值或表示方式。上述各表在实现时，也可以采用其他的数据结构，例如可以采用数组、队列、容器、栈、线性表、指针、链表、树、图、结构体、类、堆、散列表或哈希表等。
本公开中的预定义可以理解为定义、预先定义、存储、预存储、预协商、预配置、固化、或预烧制。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本公开的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
以上所述，仅为本公开的具体实施方式，但本公开的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本公开揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本公开的保护范围之内。因此，本公开的保护范围应以所述权利要求的保护范围为准。

Claims (23)

  1. 一种构建连接的方法，其特征在于，由归属边缘配置服务器H-ECS执行，所述方法包括：
    确定访问边缘配置服务器V-ECS的授权信息及目标V-ECS；
    与所述目标V-ECS进行相互身份认证；
    响应于相互身份认证成功，基于已认证身份信息及所述V-ECS的授权信息，确定所述目标V-ECS是否被允许与所述H-ECS建立连接；
    响应于所述目标V-ECS被允许与所述H-ECS建立连接，建立与所述目标V-ECS的连接。
  2. 如权利要求1所述的方法，其特征在于，所述V-ECS的授权信息的确定过程，包括：
    接收终端设备中的边缘使能客户端EEC发送的第一请求，其中，所述第一请求中包含所述V-ECS的授权信息。
  3. 如权利要求1所述的方法，其特征在于，所述V-ECS的授权信息的确定过程，包括：
    接收源边缘使能服务器S-EES发送的第二请求，其中，所述第二请求中包括终端设备的标识；
    向所述终端设备的标识对应的终端设备发送V-ECS的授权信息获取请求；
    接收所述终端设备返回的所述V-ECS的授权信息；
  4. 如权利要求1所述的方法，其特征在于，所述V-ECS的授权信息的确定过程，包括：
    从预设的存储区域获取所述V-ECS的授权信息。
  5. 如权利要求1所述的方法，其特征在于，所述目标V-ECS的确定过程，包括：
    根据终端设备的位置信息，确定所述目标V-ECS，其中，所述终端设备为向所述H-ECS发送所述V-ECS的授权信息的终端设备，或者，所述终端设备为向所述H-ECS发送V-ECS查询请求的终端设备。
  6. 如权利要求1-5任一所述的方法，其特征在于，所述与所述目标V-ECS进行相互身份认证，包括：
    向所述目标V-ECS发送第一证书，所述第一证书用于所述目标V-ECS对所述H-ECS的身份进行认证。
  7. 如权利要求6所述的方法，其特征在于，在所述向所述目标V-ECS发送第一证书之前，还包括：
    确定所述目标V-ECS的身份信息或对应的第二证书在所述授权信息中的第一列表内。
  8. 如权利要求1-7任一所述的方法，其特征在于，所述与所述目标V-ECS进行相互身份认证，包括：
    接收所述目标V-ECS发送的第二证书；
    基于所述第二证书，对所述目标V-ECS的身份进行认证。
  9. 如权利要求8所述的方法，其特征在于，所述基于所述第二证书，对所述目标V-ECS的身份进行认证，包括：
    利用所述目标V-ECS对应的根证书签发机构CA对所述第二证书进行认证；
    响应于认证成功，确定所述第二证书中的信息为已认证的V-ECS身份信息。
  10. 如权利要求1-9任一所述的方法，其特征在于，所述基于已认证身份信息及所述V-ECS的授权信息，确定所述目标V-ECS是否被允许与所述H-ECS建立连接，包括：
    响应于所述目标V-ECS的已认证身份信息包含在所述V-ECS的授权信息的第一列表内，确定所述目标V-ECS被允许与所述H-ECS建立连接；和/或，
    响应于所述目标V-ECS已认证成功的的第二证书包含在所述V-ECS的授权信息的第一列表内，确定所述目标V-ECS被允许与所述H-ECS建立连接。
  11. 如权利要求1-10任一所述的方法，其特征在于，所述建立与所述目标V-ECS的连接，包括：
    基于所述H-ECS对应的第一证书及所述目标V-ECS对应的第二证书，建立与所述目标V-ECS之间 的传输层安全性TLS连接。
  12. 一种构建连接的方法，其特征在于，由访问边缘配置服务器V-ECS执行，所述方法包括：
    与归属边缘配置服务器H-ECS进行相互身份认证；
    响应于相互身份认证成功，基于已认证身份信息及H-ECS的授权信息，确定所述H-ECS是否被允许与所述V-ECS建立连接；
    响应于所述H-ECS被允许与所述V-ECS建立连接，建立与所述H-ECS的连接。
  13. 如权利要求12所述的方法，其特征在于，还包括：
    从配置信息中提取所述H-ECS的授权信息；或者，
    根据协议约定，确定所述H-ECS的授权信息。
  14. 如权利要求12所述的方法，其特征在于，所述与归属边缘配置服务器H-ECS进行相互身份认证，包括：
    接收所述H-ECS发送的第一证书；
    基于所述第一证书，对所述H-ECS的身份进行认证。
  15. 如权利要求14所述的方法，其特征在于，所述基于所述第一证书，对所述H-ECS的身份进行认证，包括：
    利用所述H-ECS对应的根证书签发机构CA对所述第一证书进行认证；
    响应于认证成功，确定所述第一证书中的信息为已认证的H-ECS身份信息。
  16. 如权利要求12所述的方法，其特征在于，所述与归属边缘配置服务器H-ECS进行相互身份认证，包括：
    响应于所述H-ECS被允许与V-ECS建立连接向所述H-ECS发送第二证书。
  17. 如权利要求12-16任一所述的方法，其特征在于，所述基于已认证身份信息及预设的授权信息，确定所述H-ECS是否被允许与所述V-ECS建立连接，包括：
    响应于所述H-ECS的已认证身份信息包含在所述H-ECS的授权信息的第一列表内，确定所述H-ECS被允许与所述V-ECS建立连接；或者，
    响应于所述H-ECS已认证成功的第一证书包含在所述H-ECS的授权信息的第一列表内，确定所述H-ECS被允许与所述V-ECS建立连接。
  18. 如权利要求12-17任一所述的方法，其特征在于，所述建立与所述H-ECS的连接，包括：
    基于所述H-ECS对应的第一证书及所述V-ECS对应的第二证书，建立与所述H-ECS之间的传输层安全性TLS连接。
  19. 一种通信装置，其特征在于，包括：
    收发模块，用于确定访问边缘配置服务器V-ECS的授权信息及目标V-ECS；
    处理模块，用于与所述目标V-ECS进行相互身份认证；
    所述处理模块，还用于响应于相互身份认证成功，基于已认证的身份信息及所述V-ECS的授权信息，确定所述目标V-ECS是否被允许与所述H-ECS建立连接；
    所述处理模块，还用于响应于所述目标V-ECS被允许与所述H-ECS建立连接，建立与所述目标V-ECS的连接。
  20. 一种通信装置，其特征在于，包括：
    收发模块，用于与归属边缘配置服务器H-ECS进行相互身份认证；
    处理模块，用于响应于相互身份认证成功，基于已认证的身份信息及H-ECS的授权信息，确定所述H-ECS是否被允许与所述V-ECS建立连接；
    所述处理模块，还用于响应于所述H-ECS被允许与所述V-ECS建立连接，建立与所述H-ECS的连接。
  21. 一种通信系统，其特征在于，所述通信系统包括H-ECS及V-ECS，所述H-ECS用于执行如权利要求1-11任一所述的方法，所述V-ECS用于执行如权利要求12-18任一所述的方法。
  22. 一种通信装置，其特征在于，所述装置包括处理器和存储器，所述存储器中存储有计算机程序，所述处理器执行所述存储器中存储的计算机程序，以使所述装置执行如权利要求1至11中任一项所述的方法，或者执行如权利要求12-18任一项所述的方法。
  23. 一种计算机可读存储介质，用于存储有指令，当所述指令被执行时，使如权利要求1至11中任一项所述的方法被实现，或者使如权利要求12至18中任一项所述的方法被实现。
PCT/CN2022/123346 2022-09-30 2022-09-30 一种构建连接的方法及装置 WO2024065706A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/CN2022/123346 WO2024065706A1 (zh) 2022-09-30 2022-09-30 一种构建连接的方法及装置

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2022/123346 WO2024065706A1 (zh) 2022-09-30 2022-09-30 一种构建连接的方法及装置

Publications (1)

Publication Number Publication Date
WO2024065706A1 true WO2024065706A1 (zh) 2024-04-04

Family

ID=90475670

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/123346 WO2024065706A1 (zh) 2022-09-30 2022-09-30 一种构建连接的方法及装置

Country Status (1)

Country Link
WO (1) WO2024065706A1 (zh)

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112291279A (zh) * 2020-12-31 2021-01-29 南京敏宇数行信息技术有限公司 路由器内网访问方法、系统、设备以及可读存储介质
CN113840293A (zh) * 2021-08-18 2021-12-24 华为技术有限公司 获取边缘服务的方法和装置
CN113938910A (zh) * 2020-07-13 2022-01-14 华为技术有限公司 一种通信方法及装置
WO2022031505A1 (en) * 2020-08-04 2022-02-10 Intel Corporation Edge security procedures for edge enabler server onboarding
CN114268943A (zh) * 2020-09-16 2022-04-01 华为技术有限公司 授权方法及装置
CN114339688A (zh) * 2020-09-25 2022-04-12 英特尔公司 用于ue与边缘数据网络的认证的装置和方法

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113938910A (zh) * 2020-07-13 2022-01-14 华为技术有限公司 一种通信方法及装置
WO2022031505A1 (en) * 2020-08-04 2022-02-10 Intel Corporation Edge security procedures for edge enabler server onboarding
CN114268943A (zh) * 2020-09-16 2022-04-01 华为技术有限公司 授权方法及装置
CN114339688A (zh) * 2020-09-25 2022-04-12 英特尔公司 用于ue与边缘数据网络的认证的装置和方法
CN112291279A (zh) * 2020-12-31 2021-01-29 南京敏宇数行信息技术有限公司 路由器内网访问方法、系统、设备以及可读存储介质
CN113840293A (zh) * 2021-08-18 2021-12-24 华为技术有限公司 获取边缘服务的方法和装置

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
"3rd Generation Partnership Project; Technical Specification Group Services and System Aspects Study on Security Enhancement of Support for Edge Computing — Phase 2 (Release 18)", 3GPP DRAFT; S3-221685, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, 7 July 2022 (2022-07-07), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France, XP052257950 *
HUAWEI, HISILICON: "New KI on Authentication and Authorization between V-ECS and H-ECS", 3GPP DRAFT; S3-221411, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG3, no. e-meeting; 20220627 - 20220701, 20 June 2022 (2022-06-20), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France, XP052195727 *

Similar Documents

Publication Publication Date Title
EP4167625A1 (en) Communication method and apparatus
CN111050318B (zh) 终端信息的传递方法及相关产品
CN106851632A (zh) 一种智能设备接入无线局域网的方法及装置
CN113573326B (zh) 一种地址获取方法及装置
CN108293055A (zh) 用于认证到移动网络的方法、设备和系统以及用于将设备认证到移动网络的服务器
WO2024077455A1 (zh) 一种非陆地网络的接入方法及装置
US20230232318A1 (en) Authentication method and apparatus therefor
WO2024065706A1 (zh) 一种构建连接的方法及装置
WO2024065339A1 (zh) 一种网络卫星覆盖数据的授权方法、设备及存储介质
WO2024065335A1 (zh) 一种侧行链路定位方法及装置
WO2024065564A1 (zh) 一种api的调用方法、装置、设备及存储介质
WO2024098323A1 (zh) 一种通过托管网络提供本地化服务的方法及其装置
WO2024065336A1 (zh) 一种侧行链路定位方法及装置
WO2024092826A1 (zh) 身份验证方法及装置
WO2024082143A1 (zh) 一种设备业务角色的验证方法/装置/设备及存储介质
WO2024098219A1 (zh) 一种密钥分发方法、装置、设备及存储介质
WO2023225878A1 (zh) 一种ai网络功能的重新认证授权方法/装置/设备及存储介质
WO2024050778A1 (zh) 一种人工智能服务策略的更新方法及装置
WO2024065334A1 (zh) 一种用户设备ue的授权令牌的生成方法/装置/设备及存储介质
WO2023221000A1 (zh) 一种核心网中ai功能的认证授权方法及其装置
WO2023245520A1 (zh) 一种定位服务的直接通信方法及装置
WO2023115487A1 (zh) 一种人工智能会话的创建方法及其装置
CN118104186A (zh) 一种侧行链路定位方法及装置
WO2024065469A1 (zh) 一种直连链路建立方法、设备及存储介质
WO2024065843A1 (zh) 私有物联网单元pine的接入认证方法和装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22960325

Country of ref document: EP

Kind code of ref document: A1