WO2024078258A1 - 一种路径建立方法及装置 - Google Patents

一种路径建立方法及装置 Download PDF

Info

Publication number
WO2024078258A1
WO2024078258A1 PCT/CN2023/119096 CN2023119096W WO2024078258A1 WO 2024078258 A1 WO2024078258 A1 WO 2024078258A1 CN 2023119096 W CN2023119096 W CN 2023119096W WO 2024078258 A1 WO2024078258 A1 WO 2024078258A1
Authority
WO
WIPO (PCT)
Prior art keywords
session
information
trust
path
trust level
Prior art date
Application number
PCT/CN2023/119096
Other languages
English (en)
French (fr)
Inventor
张家蕾
闫峥
王海光
李铁岩
刘翔
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2024078258A1 publication Critical patent/WO2024078258A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W40/00—Communication routing or communication path finding
    • H04W40/02—Communication route or path selection, e.g. power-based or shortest path routing

Definitions

  • the present application relates to the field of communication technology, and in particular to a path establishment method and device.
  • the embodiments of the present application provide a path establishment method and device to implement end-to-end trusted routing in communication networks and IP networks to meet various routing requirements.
  • the present application provides a path establishment method, comprising the following processes: a mobility management node receives session information from a terminal, the session information including a trust level requirement of the session and a trust quality policy of the session, and the trust quality policy is used to select a routing node for the session; the mobility management node sends the session information to a routing control node through the session management node; the mobility management node receives base station information from the routing control node, the base station information is used to indicate a base station on a transmission path that meets the trust level requirement, and the transmission path is related to the trust level requirement and the trust quality policy; the mobility management node sends the base station information to the terminal.
  • the mobility management node forwards the trust level requirements and trust quality policy of the session to the routing control node, and the routing control node selects a base station that meets the trust level requirements as a routing node on the transmission path, thereby establishing a transmission path that meets the trust level requirements, realizing end-to-end trusted routing, and meeting various routing requirements.
  • the mobility management node and the base station are deployed in the communication network, and the routing control node is deployed in the IP network. Therefore, this method can establish a transmission path that meets the trust level requirements between the communication network and the IP network, and realize end-to-end trusted routing in the communication network and the IP network.
  • the trust level in the method may not be limited to trusted and untrusted, but may include at least two levels, such as trust level 1, ..., trust level 5, etc., which is more conducive to adapting to applications with multiple trust level requirements and is conducive to expanding the scope of application of trusted networks.
  • a router is also deployed under the IP network to determine whether to forward the data packet on the transmission path according to the trust level requirement of the session to which the data packet belongs and the trust level of the transmission path.
  • the mobility management node may also obtain the trust level range and trust quality policy set supported by the terminal, wherein the trust level requirement is selected by the terminal in the trust level range, and the trust quality policy is selected by the terminal in the trust quality policy set; the mobility management node saves the trust level range and trust quality policy set supported by the terminal; and the mobility management node sends the trust level range and trust quality policy set to the terminal.
  • the mobility management node may also determine to create a transmission path for the session based on the trust level requirement, the trust quality policy, the trust level range, and the trust quality policy set.
  • the session information also includes the source address and the destination address of the session; if the source address and the destination address belong to the same network, the transmission path is an intra-domain path; if the source address and the destination address belong to different networks, the transmission path is an inter-domain path.
  • the session information further includes a base station information set, and the base station information is selected from the base station information set.
  • the mobility management node may also select the above session management node for the session.
  • the base station information is carried in the path selection information, and the path selection information also includes the trust level of the transmission path.
  • the trust level of the transmission path is related to the trust level of the routing nodes on the transmission path.
  • the path selection information further includes information about inter-domain paths.
  • the present application provides a path establishment method, comprising the following processes: a routing control node receives session information of a terminal, the session information including a trust level requirement of the session and a trust quality policy of the session, and the trust quality policy is used to select a routing node for the session; the routing control node selects a transmission path for the session according to the trust level requirement and the trust quality policy; the routing control node sends the trust level of the transmission path to an ingress router of the network, wherein the trust level of the transmission path is related to the trust level of the routing node on the transmission path; the routing control node sends base station information to a mobility management node, and the base station information is used to indicate the base station on the transmission path.
  • the session information also includes the source address and the destination address of the session; if the source address and the destination address belong to the same network, the transmission path is an intra-domain path; if the source address and the destination address belong to different networks, the transmission path is an inter-domain path.
  • the session information further includes a base station information set
  • the routing control node may further select base station information from the base station information set.
  • the routing control node when the routing control node receives the session information of the terminal, it may receive the session information from the session management node.
  • the base station information is carried in the path selection information, and the path selection information further includes the trust level of the transmission path, wherein the trust level of the transmission path is related to the trust level of the routing node on the transmission path.
  • the path selection information further includes information about inter-domain paths.
  • the routing control node may also determine a border router that meets the trust level requirement based on the acquired routing information of at least one border router; the routing control node selects an intra-domain path to the border router and an inter-domain path including the border router based on the border router.
  • the intra-domain path to the border router includes an ingress router.
  • the routing control node may also send information about the inter-domain path to the border router.
  • the present application provides a path establishment method, comprising the following process: a terminal sends session information to a mobility management node, the session information including a trust level requirement for the session and a trust quality policy for the session, the trust quality policy being used to select a routing node for the session; the terminal receives base station information from the mobility management node, the base station information being used to indicate a base station on a transmission path that meets the trust level requirement, the transmission path being related to the trust level requirement and the trust quality policy; the terminal selects a target base station for the session based on the base station information and the base station to which the terminal is connected.
  • the terminal may also obtain a trust level range and a trust quality policy set supported by the terminal; the terminal selects a trust level requirement in the trust level range; and the terminal selects a trust quality policy in the trust quality policy set.
  • the session information also includes the source address and the destination address of the session; if the source address and the destination address belong to the same network, the transmission path is an intra-domain path; if the source address and the destination address belong to different networks, the transmission path is an inter-domain path.
  • the base station information is carried in the path selection information, and the path selection information further includes the trust level of the transmission path, wherein the trust level of the transmission path is related to the trust level of the routing node on the transmission path.
  • the path selection information further includes information about inter-domain paths.
  • the terminal may also obtain verification information of each router on the inter-domain path, where the verification information includes one or more of the following: a router certificate, remote proof material of the router, and a trust level of the router; the terminal verifies that each router on the inter-domain path meets the trust level requirement based on the verification information of each router; and the terminal determines that the inter-domain path is a transmission path for the session.
  • the verification information includes one or more of the following: a router certificate, remote proof material of the router, and a trust level of the router
  • the terminal verifies that each router on the inter-domain path meets the trust level requirement based on the verification information of each router
  • the terminal determines that the inter-domain path is a transmission path for the session.
  • the terminal when the terminal obtains the verification information of each router on the inter-domain path, the terminal can send a verification information acquisition request to the blockchain node, and the verification information acquisition request is used to obtain the verification information of each router on the inter-domain path; the terminal receives the verification information of each router on the inter-domain path from the blockchain node.
  • the present application provides a path establishment method, comprising the following process: a router receives a trust level of a transmission path of a session from a routing control node, wherein the trust level of the transmission path is related to the trust level of a routing node on the transmission path; the router receives a first data packet of the session; the router forwards the first data packet on the transmission path according to the trust level.
  • the router receives the source address and the destination address of the session from the routing control node; if the source address and the destination address belong to the same network, the transmission path is an intra-domain path; if the source address and the destination address belong to different networks, the transmission path is an inter-domain path.
  • the router may also receive information about inter-domain paths.
  • the router may also upload verification information of the router to the blockchain node, where the verification information includes one or more of the following: the router's certificate, the router's remote proof material, and the router's trust level.
  • a communication device which may be a mobility management node or a routing control node or a terminal or a router, or a chip arranged in a mobility management node or a routing control node or a terminal or a router.
  • the communication device may implement the methods provided in the first, second, third and fourth aspects above.
  • the communication device includes a module, unit, or means corresponding to the above method, which can be implemented by hardware, software, or by hardware executing corresponding software.
  • the hardware or software includes one or more modules or units corresponding to the above functions.
  • a communication device comprising a transceiver unit.
  • the communication device further comprises a processing unit.
  • the communication device can implement the method provided in the first aspect, the second aspect, the third aspect, the fourth aspect, or any one of the first aspect, the second aspect, the third aspect, and the fourth aspect.
  • a communication device comprising a processor.
  • the processor may be used to execute the method provided in the first aspect, the second aspect, the third aspect, the fourth aspect, or any one of the first aspect, the second aspect, the third aspect, and the fourth aspect.
  • the device further comprises a memory, the processor is coupled to the memory, the memory is used to store computer programs or instructions, and the processor may execute the program or instructions in the memory, so that the device may execute the method provided in the first aspect, the second aspect, the third aspect, the fourth aspect, or any one of the first aspect, the second aspect, the third aspect, and the fourth aspect.
  • a communication device comprising an interface circuit and a logic circuit, wherein the logic circuit is coupled to the interface circuit.
  • the interface circuit may be a code/data read/write interface circuit, the interface circuit being used to receive a computer execution instruction (the computer execution instruction is stored in a memory, may be read directly from the memory, or may pass through other devices) and transmit it to the logic circuit, so that the logic circuit runs the computer execution instruction to execute the method provided in the first aspect, the second aspect, the third aspect, the fourth aspect, or any one of the first aspect, the second aspect, the third aspect, and the fourth aspect.
  • the communication device may be a chip or a chip system.
  • a communication device comprising a processor coupled to a memory.
  • the processor is used to read instructions stored in the memory, and can receive signals through a receiver and transmit signals through a transmitter to execute the method provided in the first aspect, the second aspect, the third aspect, the fourth aspect, or any one of the first aspect, the second aspect, the third aspect, and the fourth aspect.
  • the processor may be one or more, and the memory may be one or more.
  • the memory may be integrated with the processor, or the memory may be separately arranged from the processor.
  • the memory can be a non-transitory memory, such as a read-only memory (ROM), which can be integrated with the processor on the same chip or can be set on different chips.
  • ROM read-only memory
  • the communication device may be a chip, and the processor may be implemented by hardware or by software.
  • the processor When implemented by hardware, the processor may be a logic circuit, an integrated circuit, etc.; when implemented by software, the processor may be a general-purpose processor implemented by reading software codes stored in a memory.
  • the memory may be integrated in the processor or may be located outside the processor and exist independently.
  • a processor comprising: an input circuit, an output circuit, and a processing circuit.
  • the processing circuit is used to receive a signal through the input circuit and transmit a signal through the output circuit, so that the processor executes the first aspect, the second aspect, the third aspect, the fourth aspect, or any one of the first aspect, the second aspect, the third aspect, and the fourth aspect to implement the provided method.
  • the above-mentioned processor can be a chip
  • the input circuit can be an input pin
  • the output circuit can be an output pin
  • the processing circuit can be a transistor, a gate circuit, a trigger, and various logic circuits.
  • the input signal received by the input circuit can be, for example, but not limited to, received and input by a receiver
  • the signal output by the output circuit can be, for example, but not limited to, output to a transmitter and transmitted by the transmitter
  • the input circuit and the output circuit can be the same circuit, which is used as an input circuit and an output circuit at different times.
  • This application does not limit the specific implementation of the processor and various circuits.
  • a communication device comprising: a logic circuit and an input/output interface, the input/output interface being used to communicate with a module outside the communication device; the logic circuit being used to run a computer program or instruction to execute the method provided by any one of the designs of the first, second, third, and fourth aspects.
  • the communication device may be a mobility management node or routing control node or terminal or router in the first, second, third, and fourth aspects, or a device including the mobility management node or routing control node or terminal or router, or a device included in the mobility management node or routing control node or terminal or router, such as a chip.
  • the input/output interface may be a code/data read/write interface circuit, or a communication interface, and the input/output interface is used to receive a computer program or instruction (the computer program or instruction is stored in a memory, may be read directly from the memory, or may pass through other devices) And transmitted to the input-output interface so that the input-output interface runs the computer program or instruction to execute the method of the first aspect, the second aspect, the third aspect, and the fourth aspect.
  • the communication device may be a chip.
  • a computer program product which includes: a computer program (also referred to as code, or instruction), which, when executed, enables a computer to execute any one of the above aspects or any one of the aspects to implement the provided method.
  • a computer program also referred to as code, or instruction
  • a computer-readable medium which stores a computer program (also referred to as code, or instruction).
  • a computer program also referred to as code, or instruction.
  • the computer-readable medium When the computer-readable medium is run on a computer, the computer executes the method provided in the first aspect, the second aspect, the third aspect, the fourth aspect, or any one of the first aspect, the second aspect, the third aspect, and the fourth aspect.
  • a chip system including a processor and an interface, for supporting a communication device to implement the functions provided by the first aspect, the second aspect, the third aspect, the fourth aspect, or any one of the first aspect, the second aspect, the third aspect, and the fourth aspect.
  • the chip system also includes a memory for storing necessary information and data of the aforementioned communication device.
  • the chip system may be composed of a chip, or may include a chip and other discrete devices.
  • a chip device comprising an input interface and/or an output interface.
  • the input interface can implement the receiving function provided by the first aspect, the second aspect, the third aspect, the fourth aspect, or any one of the first aspect, the second aspect, the third aspect, and the fourth aspect
  • the output interface can implement the communication function provided by the first aspect, the second aspect, the third aspect, the fourth aspect, or any one of the first aspect, the second aspect, the third aspect, and the fourth aspect.
  • a functional entity is provided, which is used to implement the method provided by the first aspect, the second aspect, the third aspect, the fourth aspect or any one of the first aspect, the second aspect, the third aspect, and the fourth aspect.
  • a communication system comprising a mobility management node for executing the method in the above-mentioned first aspect and a routing control node for executing the method in the above-mentioned second aspect.
  • the above system also includes a terminal for executing the method in the third aspect, and/or a router for executing the method in the fourth aspect.
  • the technical effects brought about by any implementation of the above-mentioned second to seventeenth aspects can refer to the technical effects brought about by the above-mentioned first aspect, and will not be repeated here.
  • FIG1 is a schematic diagram of a network architecture provided in an embodiment of the present application.
  • FIG2 is a schematic diagram of a network architecture provided in an embodiment of the present application.
  • FIG3 is a schematic diagram of a trust level definition provided in an embodiment of the present application.
  • FIG4 is a schematic diagram of a path establishment process provided in an embodiment of the present application.
  • FIG5 is a schematic diagram of an intra-domain path establishment process provided by an embodiment of the present application.
  • FIG6 is a schematic diagram of an inter-domain path establishment process provided in an embodiment of the present application.
  • FIG7 is a schematic diagram of a path establishment process provided in an embodiment of the present application.
  • FIG8 is a schematic diagram of a path establishment process provided in an embodiment of the present application.
  • FIG9 is a schematic diagram of a path establishment process provided in an embodiment of the present application.
  • FIG10 is a schematic diagram of a path verification process provided by an embodiment of the present application.
  • FIG11 is a schematic diagram of the structure of a communication device provided in an embodiment of the present application.
  • FIG12 is a schematic diagram of the structure of a communication device provided in an embodiment of the present application.
  • FIG13 is a schematic diagram of the structure of a communication device provided in an embodiment of the present application.
  • heterogeneous network integration can expand the coverage of the network and make the network more scalable; network integration can make full use of existing network resources, reduce operating costs, and enhance competitiveness; network integration can provide different users with various services. different services to better meet the diverse needs of future network users; network convergence can improve network reliability and anti-attack capabilities.
  • BGP border gateway protocol
  • trusted routing is the foundation for establishing stable and reliable communications, which can effectively improve the quality and performance of network data transmission.
  • establishing a trust-based data transmission channel how to combine the communication network with the IP network to achieve end-to-end trusted data transmission is an urgent problem to be solved.
  • the present application proposes a path establishment method, which includes: a mobility management node receives session information from a terminal, the session information includes a trust level requirement and a trust quality policy of the session, and the trust quality policy is used to select a routing node for the session; the mobility management node sends the session information to a routing control node; the mobility management node receives base station information from the routing control node, the base station information is used to indicate a base station on a transmission path that meets the trust level requirement, and the transmission path is related to the trust level requirement and the trust quality policy; the mobility management node sends the base station information to the terminal.
  • the mobility management node forwards the trust level requirement and the trust quality policy of the session to the routing control node, and the routing control node selects a routing node, thereby establishing a transmission path that meets the trust level requirement, realizing end-to-end trusted routing under a communication network and an IP network, and can also meet various routing requirements.
  • the technical solution of the embodiment of the present application can be applied to future networks, such as heterogeneous networks, wherein the future network can be a combination of a communication network and an Internet protocol (IP) network.
  • the communication network can be a fourth-generation (4G) communication system (e.g., a long-term evolution (LTE) system), a fifth-generation mobile communication (5G) communication system (e.g., a new radio (NR) system), and future mobile communication systems such as 6G.
  • 4G fourth-generation
  • LTE long-term evolution
  • 5G fifth-generation mobile communication system
  • 6G future mobile communication systems
  • FIG1 shows an architecture of a communication system applicable to an embodiment of the present application, including: user equipment, (wireless) access network equipment, user plane network element, data network, mobility management network element, session management network element, application network element, unified data management network element, policy control network element and network open network element, etc.
  • user equipment wireless
  • user plane network element data network
  • mobility management network element mobility management network element
  • session management network element application network element
  • unified data management network element unified data management network element
  • policy control network element and network open network element
  • User equipment can also be called access terminal, terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, user agent or user device, etc.
  • the terminal can be a device with wireless transceiver function, such as a mobile phone, a tablet computer, a computer with wireless transceiver function, a virtual reality (VR) terminal, an augmented reality (AR) terminal, a wireless terminal in industrial control, a wireless terminal in self driving, a wireless terminal in remote medical, a wireless terminal in smart grid, a wireless terminal in transportation safety, a wireless terminal in a smart city, a wireless terminal in a smart home, a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a wireless local loop (WLL) station, a personal digital assistant (PDA), a handheld device with wireless communication function, a computing device or other processing device connected to a wireless modem, a vehicle-mounted device, a wearable device, a terminal in a 5
  • wearable devices can also be called wearable smart devices, which are a general term for the intelligent design and development of wearable devices for daily wear using wearable technology, such as glasses, gloves, watches, clothing and shoes.
  • Wearable devices are portable devices that are worn directly on the body or integrated into the user's clothes or accessories.
  • Wearable devices are not only hardware devices, but also realize powerful functions through software support, data interaction, and cloud interaction.
  • wearable smart devices include full-featured, large-sized, and independent of smartphones to achieve complete or partial functions, such as smart watches or smart glasses, as well as those that only focus on a certain type of application function and need to be used in conjunction with other devices such as smartphones, such as various smart bracelets and smart jewelry for vital sign monitoring.
  • Radio access network equipment can also be called access equipment.
  • R)AN can manage wireless resources, provide access services for user equipment, and complete the forwarding of user equipment data between user equipment and the core network.
  • R)AN can also be understood as a base station in the network.
  • the access network device in the embodiment of the present application can be any communication device with a wireless transceiver function for communicating with a user equipment.
  • the access network device includes but is not limited to: an evolved node B (eNB), a radio network controller (RNC), a node B (NB), a base station controller (BSC), a base transceiver station (BTS), a home evolved NodeB (HeNB, or home node B, HNB), a building base band unit (BBU), a transmit receive point (TRP) or a transmission point
  • eNB evolved node B
  • RNC radio network controller
  • NB node B
  • BSC base station controller
  • BTS base transceiver station
  • HeNB home evolved NodeB
  • HNB home node B
  • BBU building base band unit
  • TRP transmit receive point
  • It may also be a next-generation base station or a next-generation node B (generation node B, gNB) in a 5G system, or a transmission point (
  • the gNB may include a centralized unit (CU) and a DU.
  • the gNB may also include an active antenna unit (AAU).
  • the CU implements some functions of the gNB, and the DU implements some functions of the gNB.
  • the CU is responsible for processing non-real-time protocols and services, and implements the functions of the radio resource control (RRC) and packet data convergence protocol (PDCP) layers.
  • the DU is responsible for processing physical layer protocols and real-time services, and implements the functions of the radio link control (RLC), media access control (MAC) and physical (PHY) layers.
  • the AAU implements some physical layer processing functions, RF processing and related functions of active antennas.
  • the information of the RRC layer is generated by the CU, and will eventually be encapsulated by the PHY layer of the DU to become the PHY layer information, or, it is converted from the PHY layer information. Therefore, in this architecture, high-level signaling such as RRC layer signaling can also be considered to be sent by the DU, or, sent by the DU+AAU.
  • the access network device may be a device including one or more of a CU node, a DU node, and an AAU node.
  • the CU may be classified as an access network device in an access network (radio access network, RAN), or the CU may be classified as an access network device in a core network (CN), and this application does not limit this.
  • User plane network element As the interface with the data network, it completes functions such as user plane data forwarding, session/flow-level billing statistics, bandwidth limitation, etc. That is, packet routing and forwarding, and quality of service (QoS) processing of user plane data.
  • QoS quality of service
  • the user plane network element may be a user plane function (UPF) network element.
  • UPF user plane function
  • Data network A network used to transmit data. It provides, for example, operator services, Internet access or third-party services, including servers, which implement video source encoding and rendering.
  • the data network can be a data network (DN).
  • Mobility management network element mainly used for mobility management and access management.
  • the access management network element can be the access and mobility management function (AMF), which mainly performs mobility management, access authentication/authorization and other functions. In addition, it is also responsible for transmitting user policies between the terminal and the policy control function (PCF) network element.
  • AMF access and mobility management function
  • PCF policy control function
  • Session management network element mainly used for session management, allocation and management of Internet protocol (IP) addresses of user equipment, selection of endpoints of manageable user plane functions, policy control and charging function interfaces, and downlink data notification.
  • IP Internet protocol
  • the session management network element can be a session management function (SMF) network element, which completes terminal IP address allocation, UPF selection, and billing and QoS policy control.
  • SMF session management function
  • the application network element can be an application function (AF) network element, which represents the application function of a third party or operator. It is the interface for the 5G network to obtain external application data and is mainly used to convey the requirements of the application side to the network side.
  • AF application function
  • Unified data management network element responsible for the management of user identification, contract data, authentication data, and user service network element registration management.
  • the unified data management network element can be unified data management (UDM).
  • Policy control network element including user contract data management function, policy control function, billing policy control function, QoS control, etc., a unified policy framework used to guide network behavior, and provide policy rule information for control plane functional network elements (such as AMF, SMF network elements, etc.).
  • the policy control network element may be a PCF.
  • the network open element can be a network open function (NEF) element, which is mainly used to expose the services and capabilities of the 3GPP network function to the AF, and also allows the AF to provide information to the 3GPP network function.
  • NEF network open function
  • FIG2 shows the architecture of another communication system to which an embodiment of the present application is applicable, including: a terminal, a base station, an intra-domain router, a control node, a router 1, a router 2, and a blockchain node (optional).
  • router 1 and router 2 can be border routers (also called inter-domain routers).
  • the control node can include a link control node and a routing control node, wherein the link control node can be a control node in a communication network, such as an access management node and/or a session management node.
  • a blockchain node is a node located in a blockchain system, which is mainly used to share remote proof materials between networks.
  • the data packet can be transmitted within the domain through the intra-domain path, that is, the sender sends the data packet to the sender's base station, and the sender's base station forwards the data packet to the intra-domain router.
  • the intra-domain router forwards the data packet to the recipient's base station, and the recipient's base station sends the data packet to the recipient.
  • the data packet can be transmitted between domains through the inter-domain path, that is, the sender sends the data packet to the sender's base station, the sender's base station forwards the data packet to the intra-domain router, the intra-domain router forwards the data packet to router 1, router 1 sends the data packet to router 2, router 2 forwards the data packet to the intra-domain router, the intra-domain router forwards the data packet to the receiver's base station, and the receiver's base station forwards the data packet to the receiver.
  • the route can be verified, and whether to continue forwarding the data packet can be determined based on the verification result.
  • the inter-domain routers (such as router 1 and router 2) can obtain verification information for remote verification from the blockchain node.
  • the network elements included in the network architecture in Figures 1 and 2 may be more or less than the network elements shown above.
  • the above-mentioned functional network element can be a network element in a hardware device, a software function running on dedicated hardware, or a virtualized function instantiated on a platform (such as a cloud platform).
  • the above-mentioned functional network element can be divided into one or more services, and further, there may be services that exist independently of the network function.
  • an instance of the above-mentioned functional network element, or an instance of a service included in the above-mentioned functional network element, or an instance of a service that exists independently of the network function can be referred to as a service instance.
  • the trust level refers to the quantitative value determined after the trust evaluation of the node, link, or path. In other words, the trust level reflects the degree of trust that the node, link, or path can achieve in a quantitative manner.
  • the trust level can be understood as the quality of trust (QoT) level.
  • QoT quality of trust
  • a node refers to a device in a network, including but not limited to a base station or a router
  • a link refers to a physical link between two nodes
  • a path refers to a path composed of one or more links.
  • Trust level of a link It is related to the trust level of the nodes at both ends of the link.
  • the trust level of a link is the minimum trust level of the nodes at both ends of the link.
  • the link between node A and node B is l AB
  • the trust level of node A is A QoT
  • the trust level of node B is B QoT
  • Trust level of a path related to the trust levels of all links that make up the link.
  • the trust level of a path is the minimum trust level of all links that make up the link.
  • P ⁇ l 1 ,l 2 ,...,l n ⁇
  • FIG4 is a schematic diagram of a path establishment method provided in an embodiment of the present application, comprising the following steps:
  • the terminal sends session information to the mobility management node, and correspondingly, the mobility management node receives the session information.
  • the session information includes the trust level requirement of the session and the trust quality policy of the session.
  • the mobility management node sends session information to the routing control node, and correspondingly, the routing control node receives the session information.
  • the mobility management node sends session information to the routing control node through the session management node, that is, the mobility management node sends the session information to the session management node, and the session management node sends the session information to the session management node.
  • the mobility management node and the session management node are deployed in the communication network, and the routing control node is deployed in the IP network.
  • the routing control node selects a transmission path for the session according to the trust level requirement and the trust quality policy.
  • the routing control node sends the base station information to the mobility management node, and correspondingly, the mobility management node receives the base station information.
  • the base station information is used to indicate the base stations on the transmission path that meet the trust level requirements.
  • the base stations are usually deployed under the communication network.
  • the routing control node sends the base station information to the mobility management node through the session management node, that is, the routing control node sends the base station information to the session management node, and the session management node sends the base station information to the mobility management node.
  • the mobility management node sends the base station information to the terminal, and correspondingly, the terminal receives the base station information.
  • the terminal selects a target base station for the session according to the base station information and the base station to which the terminal is connected.
  • the mobility management node under the communication network forwards the trust level requirements and trust quality policies of the session to the routing control node under the IP network, and the routing control node selects the routing node, thereby establishing a transmission path that meets the trust level requirements between the communication network and the IP network, realizing end-to-end trusted routing under the communication network and the IP network, and meeting various routing requirements.
  • the trust level requirement included in the above session information indicates the trust level required for the session.
  • the trust level of the transmission path established for the session is not lower than the trust level requirement of the session. Therefore, in some cases, the trust level requirement can be used to select routing nodes on the transmission path for the session.
  • a higher trust level requirement indicates a higher security requirement for the session. The lower the requirement, the lower the security required for the session.
  • the trust level requirement can be selected from the trust level range supported by the terminal, and the trust level range includes the maximum trust level and the minimum trust level supported by the terminal.
  • the terminal is set with trust level requirements for each application. Before the above S401, the mobility management node obtains the trust level range supported by the terminal, and then sends the trust level range to the terminal. The terminal can determine the trust level requirement for the session corresponding to the current application within the trust level range.
  • the terminal is UE and the mobility management node is AMF.
  • the trust quality policy included in the above session information is used to select a routing node for the session.
  • the trust quality policy is used to specify a specific type or exclude a specific type of routing node.
  • the specific type may be related to one or more factors such as the trust level of the routing node, the supported protocol version, the manufacturer, or the address information of the device.
  • the trust quality policy may be selected from a trust quality policy set supported by the terminal, and the trust quality policy set includes one or more trust quality policies.
  • the mobility management node obtains the trust quality policy set supported by the terminal, and then sends the trust quality policy set to the terminal.
  • the terminal can determine the trust quality policy of the session corresponding to the current application in the trust quality policy set.
  • the above session information may also include the address information of the session and/or a base station information set, etc.
  • the address information of the session includes the source address (such as the source IP address) and the destination address (such as the destination IP address) of the session.
  • the source address and the destination address can be used to determine whether the transmission path is an intra-domain path. For example, if the source address and the destination address belong to the same network, the transmission path is an intra-domain path; if the source address and the destination address belong to different networks, the transmission path is an inter-domain path.
  • the base station information set includes a set of base stations (or a list of base stations) that can serve the session.
  • the base station that can serve the session can be a base station that includes the terminal within the signal coverage range.
  • the base station information in S404 and S405 is selected from the base station information set.
  • the mobility management node can save the trust level range and trust quality policy set supported by the terminal, so that after S401, the mobility management node determines whether to create a path for the session based on the received session information and the saved trust level range and trust quality policy set.
  • the mobility management node determines not to create a path for the session, and the mobility management node may not execute S402, that is, not send session information to the session control node; if the routing node that meets the trust level requirements in the current network has sufficient resources, the mobility management node determines to create a path for the session, and the mobility management node may execute S402, that is, send session information to the session control node.
  • the mobility management node can also determine to create an intra-domain path (see scenario one) based on the source address and the target address belonging to the same network, or determine to create an inter-domain path (see scenario two) based on the source address and the target address belonging to different networks.
  • the routing control node may include software defined network (SDN) and/or segment routing (IPv6, SRv6) based on the Internet protocol version 6 (IPv6) forwarding plane, etc.
  • the session information in the above S401 can be carried in the session establishment request message.
  • the terminal can request to establish a session by sending a session establishment request message to the mobility management node.
  • the session can be a protocol data unit (PDU) session.
  • the terminal sends a registration request message to the user management node, and the registration request message carries the indication information that the terminal supports trusted routing.
  • the user management node queries and determines the trust level of the registered user and the maximum trust level actually available to the terminal, and determines the maximum trust level supported by the terminal; during the authentication process, two-way authentication is performed between the terminal and the user management node.
  • the user management node sends the maximum trust level supported by the terminal to the mobility management node.
  • the user management node may include an authentication server function (AUSF) and/or UDM, etc.
  • AUSF authentication server function
  • the mobility management node when the mobility management node sends the session information to the routing control node through the session management node, the mobility management node may send a session establishment request message to the session management node selected for the session, the session establishment request message including the session information, and then the session management node establishes the session, and after the session is successfully established, sends a route establishment request message to the routing control node, the route establishment request message is used to request the routing control node to select a transmission path, and the route establishment request message includes the session information.
  • the session management node is an SMF.
  • the routing control node can execute S403 based on the routing establishment request message, that is, select a transmission path for the session.
  • the routing establishment request message can also include indication information for creating an intra-domain path or an inter-domain path, and the routing control node can determine to create an intra-domain path or an inter-domain path according to the indication information.
  • the routing control node can determine to create an intra-domain path or an inter-domain path according to whether the source address and the destination address belong to the same network. According to the difference in creating an intra-domain path and an inter-domain path, the following scenarios 1 and 2 are used for illustration respectively.
  • Scenario 1 Intra-domain path.
  • the routing control node may select an intra-domain path in the manner shown in FIG5 , including the following steps:
  • the routing control node selects a first base station that meets the trust level requirement and the trust quality policy from the base station information set.
  • the first base station selected by the routing control node may be one or more.
  • the routing control node adds the first base station to the network topology.
  • the routing control node selects a router in the network that is connected to the first base station and meets the trust level requirement and the trust quality policy, adds the router to the network topology, and generates a topology G(V,E).
  • the routing control node selects a second base station from the first base station.
  • S505 The routing control node selects a transmission path from the second base station to the router that meets the trust level requirements and the quality of service (QoS) in G(V, E). If the transmission path exists, execute S507; if the transmission path does not exist, execute S506;
  • the process of the routing control node selecting a transmission path can be seen in FIG6 , which will not be described in detail here.
  • S506 The routing control node determines whether to traverse all base stations in the first base station. If not, return to S504.
  • the routing control node may also determine that the transmission path selection fails.
  • S507 The routing control node outputs the session identifier and the transmission path P, and returns to S506.
  • FIG6 is a schematic diagram of a routing control node selecting a transmission path, comprising the following steps:
  • the routing control node obtains a first array, a second array and a third array, wherein each element in the first array indicates whether the node corresponding to the element has been visited, the second array includes the length of the shortest path from the source node to the current node, and the third array includes the predecessor node of the current node.
  • the routing control node updates the first array, the second array and the third array according to the current node i.
  • the routing control node updates the element corresponding to the source node in the first array to have been visited, updates the length of the shortest path between source nodes in the second array to 0, and updates the predecessor node of the current node in the third array to the source node itself.
  • the routing control node determines a node k that is adjacent to the current node i and has not been visited, and updates the second array.
  • the routing control node updates the second array corresponding to each node k for each node k.
  • the routing control node selects a node k with the smallest length from the second array corresponding to the node k.
  • S606 The routing control node determines whether to traverse all nodes in the network. If not, execute S607; if yes, execute S608.
  • the routing control node selects the node k with the shortest length as the current node i, and returns to S603.
  • the routing control node updates the third array according to the node k with the smallest selected length; and determines the transmission path according to the third array.
  • the base station information in S404 may be carried in the path selection information.
  • the path selection information may also include the trust level of the transmission path, where the trust level of the transmission path is related to the trust level of the routing node on the transmission path.
  • the routing control node may also send one or more pieces of information to the ingress router: session address information, intra-domain path information, or the trust level of the transmission path.
  • the intra-domain path information may be a segment ID.
  • Scenario 2 Inter-domain path.
  • the routing control node can determine a border router that meets the trust level requirement based on the routing information of at least one border router (also referred to as an inter-domain router) obtained, and then select an intra-domain path to the border router and an inter-domain path including the border router based on the border router.
  • the intra-domain path to the border router includes an entry router (also referred to as an intra-domain router), for example, the intra-domain path to the border router includes a path from the terminal to the entry router and a path from the entry router to the border router.
  • the routing control node may select an inter-domain path in the manner shown in FIG7 , including the following steps:
  • S701 to S702 refers to the above-mentioned S501 to S502, which will not be described in detail here.
  • S703 The border router broadcasts the border gateway protocol (BGP) to generate a routing list.
  • BGP border gateway protocol
  • the routing control node selects a border router that meets the trust level requirement from the received routing list, and generates a topology G′(V, E) based on G(V, E).
  • S705 The routing control node selects a transmission path that meets the trust level requirement in G′(V,E). If the transmission path exists, execute S707; if the transmission path does not exist, execute S706;
  • the process of the routing control node selecting a transmission path can be seen in FIG6 , except that the topology G(V, E) of the intra-domain path is replaced by the topology G′(V, E), and the repetitions are not repeated here.
  • S706 The routing control node determines whether to traverse all nodes in the network. If not, return to S705.
  • the routing control node may also determine that the transmission path selection fails.
  • S707 The routing control node outputs the session identifier and the transmission path P, and returns to S705.
  • the base station information in S404 may be carried in the path selection information.
  • the path selection information may also include the trust level of the transmission path and/or the information of the inter-domain path.
  • the routing control node may also send one or more information to the ingress router and the border router: the address information of the session, the information of the intra-domain path, the information of the inter-domain path, or the trust level of the transmission path.
  • the information of the intra-domain path may be a segment ID, where the intra-domain path here refers to the intra-domain path that reaches the border router.
  • the terminal decides whether to reconnect to the target base station according to the base station to which the terminal is connected and the received base station information.
  • the terminal may also receive session identification information, intra-domain path information, inter-domain path information, or a trust level of a transmission path.
  • the terminal Before transmitting a data packet based on the transmission path created above, the terminal can verify the transmission path.
  • the intra-domain path is a trusted route within the same operator, so the terminal does not need to verify the intra-domain path, but verifies the inter-domain path.
  • the terminal can verify each router on the inter-domain path.
  • the terminal obtains the verification information of each router on the inter-domain path, and verifies whether each router meets the trust level requirements based on the verification information of each router; if each router meets the trust level requirements, the terminal determines that the inter-domain path is a transmission path for the session; if there is a router that does not meet the trust level requirements, the terminal determines that the inter-domain path is a non-session transmission path, and the terminal can also discard the transmission path.
  • the verification information includes one or more of the following: the router's certificate, the router's remote certification material, and the router's trust level.
  • the terminal can send a verification information acquisition request to the blockchain node to obtain the verification information of each router on the inter-domain path; and then receive the verification information of each router on the inter-domain path from the blockchain node.
  • the terminal if the terminal passes the verification of the transmission path, the terminal can send a first data packet through the transmission path.
  • the first data packet may include one or more of the following information: flow ID, source address, destination address, port number, trust level requirement (such as the trust level requirement of the session to which the data packet belongs), path information (such as information about the intra-domain path and/or information about the inter-domain path).
  • trust level requirement such as the trust level requirement of the session to which the data packet belongs
  • path information such as information about the intra-domain path and/or information about the inter-domain path.
  • the routing node can determine whether to continue forwarding the first data packet based on the trust level requirement of the data packet and the trust level of the transmission path. Usually, a routing node cannot forward a data packet with a high trust level requirement to a routing node with a low trust level.
  • the routing node will not continue to forward the first data packet. If the trust level of the routing node at the next level of the routing node is not lower than the trust level requirement, the routing node will continue to forward the first data packet.
  • FIG8 to FIG10 The signaling flow shown in FIG8 to FIG10 is used below to illustrate the above path creation process, wherein the steps in FIG8 to FIG10 and FIG4 to FIG7 can be referenced to each other, and the terminology concepts can also be referenced to each other.
  • FIG8 is a schematic diagram of creating an intra-domain path, comprising the following steps:
  • the UE sends a registration request message to the AUSF/UDM.
  • the registration request message carries indication information that the UE supports trusted routing.
  • UE is the terminal in the above-mentioned solution of the present application
  • AUSF/UDM is the user management node in the above-mentioned solution of the present application.
  • AUSF/UDM pre-stores the QoT level of the user when the user registers, and the QoT level is the trust level in the above-mentioned solution of the present application.
  • AUSF/UDM queries the user's QoT level and the maximum QoT level actually available to the UE, and determines the maximum QoT level supported by the UE.
  • AUSF/UDM can select the smaller QoT level of the two as the maximum QoT level supported by the UE. For example, there are 5 QoT levels, from low to high, 1, 2, 3, 4, 5. The user's QoT level is 5, and the maximum QoT level actually available to the UE is 4. AUSF/UDM determines that the maximum QoT level supported by the UE is 4.
  • S803 UE and AUSF/UDM complete mutual authentication.
  • AUSF/UDM sends the QoT level range and QoT policy set supported by the UE to AMF.
  • the QoT level range and QoT policy set supported by the UE can also be regarded as the QoT level range and QoT policy set supported by the user, where the QoT level range includes the maximum QoT level and the minimum QoT level.
  • S805 AMF saves the QoT level range and QoT policy set supported by the UE.
  • AMF sends the UE the QoT level range and QoT policy set supported by the UE.
  • S807 The UE saves the QoT level range and QoT policy set supported by the UE.
  • the UE sends a PDU session establishment request message to the AMF.
  • the PDU session establishment request message includes the source IP address, the target IP address, the base station ID list, the QoT level requirement, and the QoT policy.
  • the PDU session establishment request message is the session establishment request message in the above-mentioned solution of the present application.
  • the QoT level requirement is selected by the UE in the QoT level range, and the QoT policy is selected by the UE in the QoT policy set.
  • the above-mentioned base station ID list is the base station information set in the above-mentioned solution of the present application.
  • AMF determines to establish a transmission path based on the information included in the PDU session establishment request message, the locally stored QoT level range, and the QoT policy set.
  • AMF determines to create an intra-domain path.
  • AMF selects SMF and sends a session establishment request message to the SMF.
  • the session establishment request message includes the source IP address, the target IP address, the base station ID list, the QoT level requirement, and the QoT policy.
  • SMF is the session management node in the above solution of the present application.
  • the above session establishment request message is used to request to establish a session.
  • S811 After SMF successfully establishes the session, it sends a routing establishment request message to SDN/SRv6.
  • the routing establishment request message includes the session identifier (Session ID), source IP address, target IP address, base station ID list, QoT level requirements, and QoT policy.
  • the above Session ID refers to the identifier corresponding to the successfully established session.
  • the above routing establishment request message is used for path selection.
  • SDN/SRv6 is the routing control node in the above application scheme.
  • S812 SDN/SRv6 selects an intra-domain path that meets the QoT level requirement.
  • S813 SDN/SRv6 sends the intra-domain path information to the ingress router.
  • the intra-domain path information includes the source IP address, the destination IP address, the segment ID, and the QoT level.
  • the segment identifier refers to the identifier corresponding to the path within the domain
  • the QoT level refers to the QoT level of the path within the domain.
  • S814 The ingress router saves the intra-domain path information.
  • the above intra-domain path information can be used by the ingress router to forward data packets.
  • S815 SDN/SRv6 sends path selection information to SMF.
  • the path selection information includes session ID, base station ID, and QoT level.
  • the above base station ID may be selected by SDN/SRv6 in the base station information set.
  • S816 SMF sends the session ID, base station ID, and QoT level to AMF.
  • S817 AMF sends the session ID, base station ID, and QoT level to the UE.
  • S818 UE stores the session identifier (Session ID), base station ID, and QoT level.
  • S819 The UE re-determines the base station according to the base station ID to which the UE is connected and the received base station ID.
  • S820 The UE sends a data packet to the base station, where the data packet includes the QoT level requirement and the QoT policy.
  • S821 The base station forwards the data packet to the ingress router.
  • the ingress router forwards the data packet according to the QoT level requirement and the QoT policy in the data packet.
  • the routing control node can select an intra-domain path based on the source IP address and the target IP address in the routing establishment request message, combined with the QoT level requirements and the QoT level of the routing nodes in the network, and notify the UE, the base station and other routers in the domain to establish the intra-domain path, thereby providing a trusted routing establishment solution combining the communication network and the IP network.
  • FIG9 is a schematic diagram of creating an inter-domain path, comprising the following steps:
  • S901 to S911 refers to S801 to S811 and will not be described in detail here.
  • S912 SDN/SRv6 determines an inter-domain path that meets the QoT level requirements and the QoT policy based on the routing information, QoT level requirements and the QoT policy provided by the border router.
  • the routing information provided by the border router includes the QoT level of the border router. If there are multiple inter-domain paths that meet the QoT level requirements and QoT policies, SDN/SRv6 selects one of the multiple paths as the inter-domain path.
  • the inter-domain path includes the path to the border router.
  • the intra-domain path includes information such as a segment ID and a segment routing policy (SR Policy).
  • S913 SDN/SRv6 sends control information to the intra-domain router, where the control information includes the source IP address, the destination IP address, the intra-domain path information, and the QoT level of the inter-domain path.
  • the intra-domain router saves the source IP address, the destination IP address, the intra-domain path information, and the QoT level of the inter-domain path.
  • S915 SDN/SRv6 sends control information to the border router, where the control information includes the source IP address, the destination IP address, the intra-domain path information, the QoT level of the inter-domain path, and the inter-domain path information.
  • Inter-domain path information can be represented by a path.
  • the border router saves the source IP address, the destination IP address, the intra-domain path information, the QoT level of the inter-domain path, and the inter-domain path information.
  • Border routers can use the above information to establish trusted inter-domain routing, such as using Internet protocol security (IPSec) to establish a secure channel with the next-hop router.
  • IPSec Internet protocol security
  • S917 SDN/SRv6 sends trusted path information to SMF.
  • the trusted path information includes session ID, base station ID, QoT level, and inter-domain path information.
  • S918 SMF sends the session ID, base station ID, QoT level, and inter-domain path information to AMF.
  • S919 AMF sends the session ID, base station ID, QoT level, and inter-domain path information to the UE.
  • S920 UE saves the session ID, base station ID, QoT level, and inter-domain path information.
  • S921 The UE re-determines the base station according to the base station ID to which the UE is connected and the received base station ID.
  • the UE sends a data packet to the base station, where the data packet includes the QoT level requirement and the QoT policy.
  • S923 The base station forwards the data packet to the intra-domain router.
  • S924 The intra-domain router forwards the data packet to the border router according to the QoT level requirement and QoT policy in the data packet.
  • S925 The border router forwards the data packet according to the QoT level requirement and the QoT policy in the data packet.
  • the routing control node can select the corresponding intra-domain router and border router based on the source IP address and the target IP address in the routing establishment request message, if there is an end-to-end trusted route that meets the QoT level requirements, determine the trusted inter-domain route from the base station to the border router, and notify the UE, the base station and other routers in the domain, so as to establish an intra-domain path, providing a trusted routing establishment solution combining the communication network and the IP network.
  • FIG. 10 is a schematic diagram of verifying inter-domain paths.
  • Each network can store routing information and router verification information on the blockchain.
  • UE or SDN/SRv6 can directly or indirectly download routing information and router verification information from the blockchain and verify whether the inter-domain routing matches the QoT level requirements. The following steps are included:
  • S1001 The border router sends verification information of the border router to the operator proxy node.
  • S1002 The operator proxy node sends verification information of the border router to the blockchain node.
  • S1003 The blockchain node saves the verification information of the border router.
  • S1025 The UE sends a verification information acquisition request to the blockchain node to obtain the verification information of all routers in the inter-domain path.
  • S1026 The blockchain node sends verification information of all routers in the inter-domain path to the UE.
  • S1027 The UE determines, based on the verification information of each router, that all routers in the inter-domain path meet the QoT level requirement, and determines to use the inter-domain path as the transmission path.
  • the UE discards the inter-domain path if there is a router in the inter-domain path that does not meet the QoT level requirement.
  • the operator proxy node uploads the verification information of the border router to the blockchain, and the blockchain shares this information for inter-domain path selection. This can be combined with the user's QoT level requirements to verify the inter-domain path, providing a path verification solution that combines the communication network and the IP network.
  • system and “network” in the embodiments of the present application can be used interchangeably.
  • “and/or” describes the association relationship of associated objects, indicating that three relationships may exist.
  • a and/or B can represent: A exists alone, A and B exist at the same time, and B exists alone.
  • the character "/” generally indicates that the objects associated before and after are in an "or” relationship. At least one referred to in this application refers to one or more; multiple refers to two or more.
  • words such as “first”, “second”, and “third” are only used for the purpose of distinguishing the description, and cannot be understood as indicating or implying relative importance.
  • the communication device 1100 includes a processing unit 1101 and a transceiver unit 1102.
  • the functions implemented by the optional transceiver unit 1102 can be completed by a communication interface, and the transceiver unit 1102 can be integrated by a receiving unit and a sending unit.
  • the communication device 1100 can be a mobility management node or a routing control node or a terminal or a router, or is located in a mobility management node or a routing control node or a terminal or a router.
  • the communication device 1100 can be used to implement the method described in the above-mentioned method embodiment. For example, the communication device 1100 can execute the various steps performed by the mobility management node or the routing control node or the terminal or the router in the above-mentioned methods of FIG4 to FIG10.
  • the communication device 1100 is applied to a mobility management node.
  • the transceiver unit 1102 is used to receive session information from the terminal, where the session information includes a trust level requirement of the session and a trust quality policy of the session, where the trust quality policy is used to select a routing node for the session;
  • the processing unit 1101 is used to determine session information
  • the transceiver unit 1102 is also used to send session information to the routing control node through the session management node; receive base station information from the routing control node, the base station information is used to indicate the base station on the transmission path that meets the trust level requirements, and the transmission path is related to the trust level requirements and the trust quality policy; send the base station information to the terminal.
  • the transceiver unit 1102 is further configured to obtain a trust level range and a trust quality policy set supported by the terminal, wherein the trust level requirement is selected by the terminal in the trust level range, and the trust quality policy is selected by the terminal in the trust quality policy set;
  • the processing unit 1101 is further used to store the trust level range and trust quality policy set supported by the terminal;
  • the transceiver unit 1102 is further configured to send the trust level range and the trust quality policy set to the terminal.
  • the processing unit 1101 is further configured to determine to create a transmission path for the session according to the trust level requirement, the trust quality policy, the trust level range, and the trust quality policy set.
  • the session information also includes the source address and the destination address of the session; if the source address and the destination address belong to the same network, the transmission path is an intra-domain path; if the source address and the destination address belong to different networks, the transmission path is an inter-domain path.
  • the session information further includes a base station information set, and the base station information is selected from the base station information set.
  • the processing unit 1101 is further configured to select a session management node for the session.
  • the base station information is carried in the path selection information, and the path selection information further includes a trust level of the transmission path, wherein the trust level of the transmission path is related to the trust level of the routing node on the transmission path.
  • the path selection information also includes information about inter-domain paths.
  • the communication device 1100 is applied to a routing control node.
  • the transceiver unit 1102 is used to receive session information of the terminal, where the session information includes a trust level requirement of the session and a trust quality policy of the session, where the trust quality policy is used to select a routing node for the session;
  • the processing unit 1101 is used to select a transmission path for the session according to the trust level requirement and the trust quality policy;
  • the transceiver unit 1102 is also used to send the trust level of the transmission path to the ingress router of the network, where the trust level of the transmission path is related to the trust level of the routing node on the transmission path; and send base station information to the mobility management node, where the base station information is used to indicate the base station on the transmission path.
  • the session information also includes the source address and the destination address of the session; if the source address and the destination address belong to the same network, the transmission path is an intra-domain path; if the source address and the destination address belong to different networks, the transmission path is an inter-domain path.
  • the processing unit 1101 is further configured to select base station information from the base station information set.
  • the transceiver unit 1102 is further configured to receive session information from a session management node.
  • the base station information is carried in the path selection information, and the path selection information further includes a trust level of the transmission path, wherein the trust level of the transmission path is related to the trust level of the routing node on the transmission path.
  • the path selection information also includes information about inter-domain paths.
  • the processing unit 1101 is further configured to determine a border router that meets the trust level requirement based on the acquired routing information of at least one border router; and select an intra-domain path to the border router and an inter-domain path including the border router based on the border router.
  • the intra-domain path to the border router includes an ingress router.
  • the transceiver unit 1102 is further configured to send information about the inter-domain path to the border router.
  • the communication device 1100 is applied to a terminal.
  • the transceiver unit 1102 is configured to send session information to the mobility management node, where the session information includes a trust level requirement of the session and a trust quality policy of the session, and the trust quality policy is used to select a routing node for the session; receive base station information from the mobility management node, where the base station information is used to indicate a base station on a transmission path that meets the trust level requirement, and the transmission path is related to the trust level requirement and the trust quality policy;
  • the processing unit 1101 is configured to select a target base station for the session according to the base station information and the base station to which the terminal is connected.
  • the transceiver unit 1102 is further configured to obtain a trust level range and a trust quality policy set supported by the terminal;
  • the processing unit 1101 is further configured to select a trust level requirement from the trust level range; and select a trust quality policy from the trust quality policy set.
  • the session information also includes the source address and the destination address of the session; if the source address and the destination address belong to the same network, the transmission path is an intra-domain path; if the source address and the destination address belong to different networks, the transmission path is an inter-domain path.
  • the base station information is carried in the path selection information, and the path selection information further includes a trust level of the transmission path, wherein the trust level of the transmission path is related to the trust level of the routing node on the transmission path.
  • the path selection information also includes information about inter-domain paths.
  • the transceiver unit 1102 is further configured to obtain verification information of each router on the inter-domain path, the verification information including one or more of the following: a router certificate, a remote certification material of the router, and a trust level of the router;
  • the processing unit 1101 is further configured to verify, based on the verification information of each router, that each router on the inter-domain path meets the trust level requirement; and determine that the inter-domain path is a transmission path for the session.
  • the transceiver unit 1102 is specifically used to send a verification information acquisition request to a blockchain node, where the verification information acquisition request is used to obtain verification information of each router on the inter-domain path; and receive verification information of each router on the inter-domain path from the blockchain node.
  • the communication device 1100 is applied to a router.
  • the transceiver unit 1102 is configured to receive a trust level of a transmission path of a session from a routing control node, wherein the trust level of the transmission path is related to the trust level of a routing node on the transmission path; receive a first data packet of the session;
  • the processing unit 1101 is configured to determine a first data packet
  • the transceiver unit 1102 is further configured to forward the first data packet on a transmission path according to the trust level.
  • the transceiver unit 1102 is further used to receive the source address and destination address of the session from the routing control node; if the source address and destination address belong to the same network, the transmission path is an intra-domain path; if the source address and destination address belong to different networks, the transmission path is an inter-domain path.
  • the transceiver unit 1102 is further configured to receive information about the inter-domain path.
  • the transceiver unit 1102 is also used to upload the verification information of the router to the blockchain node, and the verification information includes one or more of the following: the router's certificate, the router's remote proof material, and the router's trust level.
  • each functional unit in each embodiment of the present application may be integrated into a processing unit, or may exist physically separately, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.
  • the transceiver unit may include a receiving unit and/or a sending unit.
  • the integrated unit can be stored in a computer-readable storage medium. Based on this understanding, the integrated unit can be stored in a storage medium as a computer software product, including several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) or a processor to perform all or part of the steps of the methods of various embodiments of the present application.
  • a computer device which can be a personal computer, server, or network device, etc.
  • a processor to perform all or part of the steps of the methods of various embodiments of the present application.
  • the embodiment of the present application further provides a schematic diagram of the structure of a communication device 1200.
  • the communication device 1200 can be used to implement the method described in the above method embodiment, and the description in the above method embodiment can be referred to.
  • the communication device 1200 can execute each step performed by the mobility management node or the routing control node or the terminal or the router in the above methods of FIG4 to FIG10.
  • the communication device 1200 includes one or more processors 1201.
  • the processor 1201 may be a general-purpose processor or a dedicated processor. For example, it can be a baseband processor or a central processing unit.
  • the baseband processor can be used to process the communication protocol and communication data
  • the central processing unit can be used to control the communication device (such as a base station, a terminal, or a chip, etc.), execute the software program, and process the data of the software program.
  • the communication device may include a transceiver unit to realize the input (reception) and output (transmission) of the signal.
  • the transceiver unit can be a transceiver, a radio frequency chip, etc.
  • the communication device 1200 includes one or more processors 1201, and the one or more processors 1201 can implement the methods in the above-mentioned embodiments.
  • the processor 1201 can also implement other functions.
  • the processor 1201 may execute instructions so that the apparatus 1200 performs the methods described in the above method embodiments.
  • the instructions may be stored in whole or in part in the processor 1201, such as the instructions 1203 may be stored in whole or in part in the processor 1201, or the instructions 1203 may be stored in the processor 1201, and the instructions 1204 may be stored in the memory 1202 coupled to the processor, and the processor 1201 may synchronously execute the instructions 1203 and the instructions 1204 so that the communication apparatus 1200 performs the methods described in the above method embodiments.
  • the instructions 1203 and the instructions 1204 are also referred to as computer programs.
  • the communication device 1200 may further include a circuit, and the circuit may implement the functions of the aforementioned method embodiment.
  • the communication device 1200 may include one or more memories 1202, on which instructions 1204 are stored, and the instructions can be executed on the processor 1201, so that the device 1200 performs the method described in the above method embodiment.
  • data can also be stored in the memory 1202.
  • the optional processor 1201 can also store instructions and/or data.
  • one or more memories 1202 can store the corresponding relationships described in the above embodiments, or the relevant parameters or tables involved in the above embodiments.
  • the processor and the memory can be set separately or integrated together.
  • the device 1200 may further include a transceiver 1205 and an antenna 1206.
  • the processor 1201 may be referred to as a processing unit, which controls the device (terminal or base station).
  • the transceiver 1205 may be referred to as a transceiver, a transceiver circuit, or a transceiver unit, etc., which is used to implement the transceiver function of the device through the antenna 1206.
  • the processor may be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), one or more integrated circuits for controlling the execution of the program of the present application, a general-purpose processor, a digital signal processor (DSP), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components.
  • CPU central processing unit
  • ASIC application-specific integrated circuit
  • DSP digital signal processor
  • FPGA field programmable gate array
  • the general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.
  • the steps of the method disclosed in the embodiments of the present application may be directly embodied as being executed by a hardware decoding processor, or may be executed by a combination of hardware and software modules in the decoding processor.
  • the software module may be stored in a storage medium, which is located in a memory.
  • the memory may be a volatile memory or a nonvolatile memory, or may include both volatile and nonvolatile memory.
  • the nonvolatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory.
  • the volatile memory may be a random access memory (RAM), which is used as an external cache.
  • RAM synchronous link DRAM
  • SRAM static RAM
  • DRAM dynamic RAM
  • SDRAM synchronous DRAM
  • DDR SDRAM double data rate synchronous DRAM
  • ESDRAM enhanced SDRAM
  • SLDRAM synchronous link DRAM
  • DR RAM direct RAM
  • the embodiment of the present application also provides a communication system, including a mobility management node and a routing control node, which can implement the path establishment method of any of the above method embodiments.
  • the communication system also includes a terminal and/or a router, which can implement the path establishment method of any of the above method embodiments.
  • An embodiment of the present application further provides a computer-readable medium having a computer program stored thereon, and when the computer program is executed by a computer, the path establishment method of any of the above method embodiments is implemented.
  • An embodiment of the present application also provides a computer program product, including a computer program, which, when executed by a computer, implements the path establishment method of any of the above method embodiments.
  • all or part of the embodiments may be implemented by software, hardware, firmware or any combination thereof.
  • all or part of the embodiments may be implemented in the form of a computer program product.
  • a computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on the computer, the process or function according to the embodiment of the present application is generated in whole or in part.
  • the computer may be the above-mentioned communication device.
  • the computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • the computer-readable storage medium may be the above-mentioned storage medium or the above-mentioned memory.
  • the processing unit or processor 1201 may be one or more logic circuits, and the transceiver unit or transceiver 1205 may be an input-output interface, or may be called a communication interface, or an interface circuit, or an interface, etc.
  • the transceiver 1205 may also be a sending unit and a receiving unit, the sending unit may be an output interface, the receiving unit may be an input interface, and the sending unit and the receiving unit are integrated into one unit, such as an input-output interface.
  • the logic circuit 1301 includes a logic circuit 1301 and an interface circuit 1302. That is, the above-mentioned processing unit or processor 1201 may be implemented with a logic circuit 1301, and the transceiver unit or transceiver 1205 may be implemented with an interface circuit 1302.
  • the logic circuit 1301 may be a chip, a processing circuit, an integrated circuit or a system on chip (SoC) chip, etc.
  • the interface circuit 1302 may be a communication interface, an input-output interface, etc.
  • the logic circuit and the interface circuit may also be coupled to each other. The embodiments of the present application do not limit the specific connection method between the logic circuit and the interface circuit.
  • the logic circuit 1301 and the interface circuit 1302 may be used to perform the functions or operations performed by the above-mentioned network functions or control plane functions.
  • the interface circuit 1302 may be used to receive signals from other communication devices other than the communication device 1300 and transmit them to the logic circuit 1301 or to send signals from the logic circuit 1301 to other communication devices other than the communication device 1300.
  • the logic circuit 1301 may be used to implement any of the above-mentioned method embodiments by executing code instructions.
  • the functions or operations performed by the communication device may refer to the aforementioned method embodiments and will not be described in detail here.
  • the disclosed systems, devices and methods can be implemented in other ways.
  • the device embodiments described above are only schematic, for example, the division of units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, or it can be an electrical, mechanical or other form of connection.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the embodiments of the present application.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.
  • Computer-readable media include computer storage media and communication media, wherein the communication media include any media that facilitates the transmission of a computer program from one place to another.
  • the storage medium can be any available medium that a computer can access.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请实施例涉及一种路径建立方法及装置，实现通信网络和IP网络下的端到端的可信路由，满足多样的路由需求。该方法包括：移动性管理节点接收来自终端的会话信息，会话信息包括会话的信任级别要求和会话的信任质量策略，信任质量策略用于为会话选择路由节点；移动性管理节点通过会话管理节点向路由控制节点发送会话信息；移动性管理节点接收来自路由控制节点的基站信息，基站信息用于指示满足信任级别要求的传输路径上的基站，传输路径与信任级别要求和信任质量策略有关；移动性管理节点向终端发送基站信息。

Description

一种路径建立方法及装置
相关申请的交叉引用
本申请要求在2022年10月13日提交中国专利局、申请号为202211252717.6、申请名称为“一种路径建立方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种路径建立方法及装置。
背景技术
互联网的各种服务和功能严重依赖于安全可靠的路由系统，作为维护网络功能的基础设施，路由安全对网络的稳定运行至关重要。在未来网络中，可信的路由是建立稳定可靠通信的基础环节，可以有效提升网络数据传输的质量和性能。
在建立基于信任的数据传输通道时，如何将通信网络与IP网络结合，实现端到端的可信数据传输，是需要解决的技术问题。
发明内容
本申请实施例提供一种路径建立方法及装置，实现通信网络和IP网络下的端到端的可信路由，满足多样的路由需求。
第一方面，本申请提供一种路径建立方法，包括如下过程：移动性管理节点接收来自终端的会话信息，会话信息包括会话的信任级别要求和会话的信任质量策略，信任质量策略用于为会话选择路由节点；移动性管理节点通过会话管理节点向路由控制节点发送会话信息；移动性管理节点接收来自路由控制节点的基站信息，基站信息用于指示满足信任级别要求的传输路径上的基站，传输路径与信任级别要求和信任质量策略有关；移动性管理节点向终端发送基站信息。
在该方法中，移动性管理节点将会话的信任级别要求和信任质量策略转发给路由控制节点，由路由控制节点选择满足信任级别要求的基站作为传输路径上的路由节点，从而建立满足信任级别要求的传输路径，实现端到端的可信路由，满足多样的路由需求。通常移动性管理节点、基站部署在通信网络下，路由控制节点部署在IP网络下，因此该方法可以在通信网络和IP网络之间建立满足信任级别要求的传输路径，实现通信网络和IP网络下的端到端的可信路由。
可选地，该方法中信任级别可以不局限于可信和不可信两种级别，而是可以包括至少两种级别，例如信任级别1、……、信任级别5等，更有利于适应当前多种信任级别要求的应用，有利于扩大可信网络的适用范围。
一些场景下，IP网络下还部署有路由器，用于根据数据包所属会话的信任级别要求和传输路径的信任级别，确定是否在该传输路径上转发该数据包。
在一种可能的实现中，移动性管理节点接收来自终端的会话信息之前，移动性管理节点还可以获取终端支持的信任级别范围和信任质量策略集合，其中信任级别要求是终端在信任级别范围中选择的，信任质量策略是终端在信任质量策略集合中选择的；移动性管理节点保存终端支持的信任级别范围和信任质量策略集合；移动性管理节点向终端发送信任级别范围和信任质量策略集合。
在一种可能的实现中，移动性管理节点接收来自终端的会话信息之后，移动性管理节点向路由控制节点发送会话信息之前，移动性管理节点还可以根据信任级别要求、信任质量策略、信任级别范围和信任质量策略集合，确定为会话创建传输路径。
在一种可能的实现中，会话信息还包括会话的源地址和目标地址；若源地址和目标地址属于同一网络，传输路径为域内路径；若源地址和目标地址属于不同网络，传输路径为域间路径。
在一种可能的实现中，会话信息还包括基站信息集合，基站信息是在基站信息集合中选择的。
在一种可能的实现中，移动性管理节点通过会话管理节点向路由控制节点发送会话信息之前，移动性管理节点还可以为会话选择上述的会话管理节点。
在一种可能的实现中，基站信息携带在路径选择信息中，路径选择信息还包括传输路径的信任级别， 其中传输路径的信任级别与传输路径上的路由节点的信任级别有关。
在一种可能的实现中，路径选择信息还包括域间路径的信息。
第二方面，本申请提供一种路径建立方法，包括如下过程：路由控制节点接收终端的会话信息，会话信息包括会话的信任级别要求和会话的信任质量策略，信任质量策略用于为会话选择路由节点；路由控制节点根据信任级别要求和信任质量策略，为会话选择传输路径；路由控制节点向所在网络的入口路由器发送传输路径的信任级别，其中传输路径的信任级别与传输路径上的路由节点的信任级别有关；路由控制节点向移动性管理节点发送基站信息，基站信息用于指示传输路径上的基站。
在一种可能的实现中，会话信息还包括会话的源地址和目标地址；若源地址和目标地址属于同一网络，传输路径为域内路径；若源地址和目标地址属于不同网络，传输路径为域间路径。
在一种可能的实现中，会话信息还包括基站信息集合，路由控制节点还可以在基站信息集合中选择基站信息。
在一种可能的实现中，路由控制节点接收终端的会话信息时，可以接收来自会话管理节点的会话信息。
在一种可能的实现中，基站信息携带在路径选择信息中，路径选择信息还包括传输路径的信任级别，其中传输路径的信任级别与传输路径上的路由节点的信任级别有关。
在一种可能的实现中，路径选择信息还包括域间路径的信息。
在一种可能的实现中，路由控制节点还可以根据获取到的至少一个边界路由器的路由信息，确定满足信任级别要求的边界路由器；路由控制节点根据边界路由器，选择到达边界路由器的域内路径，以及包含边界路由器的域间路径。
在一种可能的实现中，到达边界路由器的域内路径包括入口路由器。
在一种可能的实现中，路由控制节点还可以向边界路由器发送域间路径的信息。
第三方面，本申请提供一种路径建立方法，包括如下过程：终端向移动性管理节点发送会话信息，会话信息包括会话的信任级别要求和会话的信任质量策略，信任质量策略用于为会话选择路由节点；终端接收来自移动性管理节点的基站信息，基站信息用于指示满足信任级别要求的传输路径上的基站，传输路径与信任级别要求和信任质量策略有关；终端根据基站信息和终端连接的基站，为会话选择目标基站。
在一种可能的实现中，终端向移动性管理节点发送会话信息之前，终端还可以获取终端支持的信任级别范围和信任质量策略集合；终端在信任级别范围中选择信任级别要求；终端在信任质量策略集合中选择信任质量策略。
在一种可能的实现中，会话信息还包括会话的源地址和目标地址；若源地址和目标地址属于同一网络，传输路径为域内路径；若源地址和目标地址属于不同网络，传输路径为域间路径。
在一种可能的实现中，基站信息携带在路径选择信息中，路径选择信息还包括传输路径的信任级别，其中传输路径的信任级别与传输路径上的路由节点的信任级别有关。
在一种可能的实现中，路径选择信息还包括域间路径的信息。
在一种可能的实现中，终端还可以获取域间路径上各路由器的验证信息，验证信息包括以下一个或多个：路由器的证书、路由器的远程证明材料、路由器的信任级别；终端根据各路由器的验证信息，验证域间路径上各路由器满足信任级别要求；终端确定域间路径为会话的传输路径。
在一种可能的实现中，终端获取域间路径上各路由器的验证信息时，终端可以向区块链节点发送验证信息获取请求，验证信息获取请求用于获取域间路径上各路由器的验证信息；终端接收来自区块链节点的域间路径上各路由器的验证信息。
第四方面，本申请提供一种路径建立方法，包括如下过程：路由器接收来自路由控制节点的会话的传输路径的信任级别，其中传输路径的信任级别与传输路径上的路由节点的信任级别有关；路由器接收会话的第一数据包；路由器根据信任级别，在传输路径上转发第一数据包。
在一种可能的实现中，路由器接收来自路由控制节点的会话的源地址和目标地址；若源地址和目标地址属于同一网络，传输路径为域内路径；若源地址和目标地址属于不同网络，传输路径为域间路径。
在一种可能的实现中，路由器还可以接收域间路径的信息。
在一种可能的实现中，路由器还可以向区块链节点上传路由器的验证信息，验证信息包括以下一个或多个：路由器的证书、路由器的远程证明材料、路由器的信任级别。
第五方面，提供一种通信装置，该通信装置可以为移动性管理节点或路由控制节点或终端或路由器，或者为设置在移动性管理节点或路由控制节点或终端或路由器中的芯片。该通信装置可以实现上述第一方面、第二方面、第三方面、第四方面所提供的方法。
通信装置包括实现上述方法相应的模块、单元、或手段(means)，该模块、单元、或means可以通过硬件实现，软件实现，或者通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块或单元。
第六方面，提供一种通信装置，包括收发单元。可选地，该通信装置还包括处理单元。该通信装置可以实现第一方面、第二方面、第三方面、第四方面或第一方面、第二方面、第三方面、第四方面中的任一项实现所提供的方法。
第七方面，提供一种通信装置，包括处理器。该处理器可用于执行上述第一方面、第二方面、第三方面、第四方面或第一方面、第二方面、第三方面、第四方面中的任一项实现所提供的方法。可选地，该装置还包括存储器，该处理器与存储器耦合，存储器中用于存储计算机程序或指令，处理器可以执行存储器中的程序或指令，以使得该装置可以执行上述第一方面、第二方面、第三方面、第四方面或第一方面、第二方面、第三方面、第四方面中的任一项实现所提供的方法。
第八方面，提供一种通信装置，该装置包括接口电路和逻辑电路，逻辑电路与接口电路耦合。该接口电路可以为代码/数据读写接口电路，该接口电路用于接收计算机执行指令(计算机执行指令存储在存储器中，可能直接从存储器读取，或可能经过其他器件)并传输至该逻辑电路，以使该逻辑电路运行计算机执行指令以执行上述第一方面、第二方面、第三方面、第四方面或第一方面、第二方面、第三方面、第四方面中的任一项实现所提供的方法。
在一些可能的设计中，该通信装置可以为芯片或芯片系统。
第九方面，提供一种通信装置，包括处理器，处理器和存储器耦合。该处理器用于读取存储器中存储的指令，并可通过接收器接收信号，通过发射器发射信号，以执行上述第一方面、第二方面、第三方面、第四方面或第一方面、第二方面、第三方面、第四方面中的任一项实现所提供的方法。
可选地，该处理器可以为一个或多个，该存储器也可以为一个或多个。可选地，该存储器可以与该处理器集成在一起，或者该存储器与处理器分离设置。
在具体实现过程中，存储器可以为非瞬时性(non-transitory)存储器，例如只读存储器(read only memory，ROM)，其可以与处理器集成在同一块芯片上，也可以分别设置在不同的芯片上，本申请对存储器的类型以及存储器与处理器的设置方式不做限定。
该通信装置可以是一个芯片，该处理器可以通过硬件来实现也可以通过软件来实现，当通过硬件实现时，该处理器可以是逻辑电路、集成电路等；当通过软件来实现时，该处理器可以是一个通用处理器，通过读取存储器中存储的软件代码来实现，该存储器可以集成在处理器中，可以位于该处理器之外，独立存在。
第十方面，提供一种处理器，包括：输入电路、输出电路和处理电路。该处理电路用于通过该输入电路接收信号，并通过该输出电路发射信号，使得该处理器执行上述第一方面、第二方面、第三方面、第四方面或第一方面、第二方面、第三方面、第四方面中的任一项实现所提供的方法。
在具体实现过程中，上述处理器可以为芯片，输入电路可以为输入管脚，输出电路可以为输出管脚，处理电路可以为晶体管、门电路、触发器和各种逻辑电路等。输入电路所接收的输入的信号可以是由例如但不限于接收器接收并输入的，输出电路所输出的信号可以是例如但不限于输出给发射器并由发射器发射的，且输入电路和输出电路可以是同一电路，该电路在不同的时刻分别用作输入电路和输出电路。本申请对处理器及各种电路的具体实现方式不做限定。
第十一方面，提供一种通信装置，包括：逻辑电路和输入输出接口，该输入输出接口用于与该通信装置之外的模块通信；该逻辑电路用于运行计算机程序或指令以执行上述第一方面、第二方面、第三方面、第四方面的任一项设计所提供的方法。该通信装置可以为上述第一方面、第二方面、第三方面、第四方面中的移动性管理节点或路由控制节点或终端或路由器，或者包含上述移动性管理节点或路由控制节点或终端或路由器的装置，或者上述移动性管理节点或路由控制节点或终端或路由器中包含的装置，比如芯片。
或者，该输入输出接口可以为代码/数据读写接口电路，或通信接口，该输入输出接口用于接收计算机程序或指令(计算机程序或指令存储在存储器中，可能直接从存储器读取，或可能经过其他器件) 并传输至该输入输出接口，以使该输入输出接口运行计算机程序或指令以执行上述第一方面、第二方面、第三方面、第四方面的方法。
可选的，该通信装置可以为芯片。
第十二方面，提供一种计算机程序产品，该计算机程序产品包括：计算机程序(也可以称为代码，或指令)，当该计算机程序被运行时，使得计算机执行上述任一方面或任一方面中的任一项实现所提供的方法。
第十三方面，提供一种计算机可读介质，该计算机可读介质存储有计算机程序(也可以称为代码，或指令)当其在计算机上运行时，使得计算机执行上述第一方面、第二方面、第三方面、第四方面或第一方面、第二方面、第三方面、第四方面中的任一项实现所提供的方法。
第十四方面，提供一种芯片系统，该芯片系统包括处理器和接口，用于支持通信装置实现上述第一方面、第二方面、第三方面、第四方面或第一方面、第二方面、第三方面、第四方面中的任一项实现所提供的功能。在一种可能的设计中，芯片系统还包括存储器，用于保存前述通信装置的必要的信息和数据。该芯片系统，可以由芯片构成，也可以包括芯片和其他分立器件。
第十五方面，提供一种芯片装置，该芯片装置包括输入接口和/或输出接口。该输入接口可以实现上述第一方面、第二方面、第三方面、第四方面或第一方面、第二方面、第三方面、第四方面中的任一项实现所提供的接收功能，该输出接口可以实现上述第一方面、第二方面、第三方面、第四方面或第一方面、第二方面、第三方面、第四方面中的任一项实现所提供的通信功能。
第十六方面，提供一种功能实体，该功能实体用于实现上述第一方面、第二方面、第三方面、第四方面或第一方面、第二方面、第三方面、第四方面中的任一项实现所提供的方法。
第十七方面，提供一种通信系统，包括用于执行上述第一方面中的方法的移动性管理节点和用于执行上述第二方面中的方法的路由控制节点。
可选地，上述系统还包括用于执行第三方面中的方法的终端，和/或用于执行第四方面中的方法的路由器。
其中，上述第二方面至第十七方面中任一实现所带来的技术效果可参见上述第一方面所带来的技术效果，此处不再赘述。
附图说明
图1为本申请实施例提供的一种网络架构的示意图；
图2为本申请实施例提供的一种网络架构的示意图；
图3为本申请实施例提供的一种信任级别定义示意图；
图4为本申请实施例提供的一种路径建立过程示意图；
图5为本申请实施例提供的一种域内路径建立过程示意图；
图6为本申请实施例提供的一种域间路径建立过程示意图；
图7为本申请实施例提供的一种路径建立过程示意图；
图8为本申请实施例提供的一种路径建立过程示意图；
图9为本申请实施例提供的一种路径建立过程示意图；
图10为本申请实施例提供的一种路径验证过程示意图；
图11为本申请实施例提供的一种通信装置的结构示意图；
图12为本申请实施例提供的一种通信装置的结构示意图；
图13为本申请实施例提供的一种通信装置的结构示意图。
具体实施方式
下面将结合附图对本申请作进一步地详细描述。
随着第五代移动通信(5th-generation，5G)网络的逐步商用，越来越多的研究开始关注未来网络愿景。目前业界普遍认为异构网络的融合是未来网络发展的必然趋势，未来网络将从各自独立封闭的网络走向异构互联，如蜂窝网、网际互连协议(internet protocol，IP)网络、卫星网络高度融合一体化。异构网络的融合具有的优势包括：网络融合可以扩大网络的覆盖范围，使得网络具有更强的可扩展性；网络融合可以充分利用现有的网络资源，降低运营成本，增强竞争力；网络融合可以向不同用户提供各 种不同服务，更好地满足未来网络用户多样性的需求；网络融合可以提高网络的可靠性、抗攻击能力等。
互联网的各种服务和功能严重依赖于安全可靠的路由系统，作为维护网络功能的基础设施，路由安全对网络的稳定运行至关重要。未来网络由众多网络域互联而成，各网络域由不同的运营商/管理机构管理或控制，并通过边界网关协议(border gateway protocol，BGP)实现各网络域的互联互通。BGP协议是支持域间路由系统运行的重要协议，它能确保域间路由时在各网络域间传递网络可达信息，但没有考虑网络参与者的安全和信任问题以及路由系统的可信问题。
而未来网络中，可信的路由是建立稳定可靠通信的基础环节，可以有效提升网络数据传输的质量和性能。在建立基于信任的数据传输通道时，如何将通信网络与IP网络结合，实现端到端的可信数据传输，是一个亟需解决的问题。
因此，本申请提出一种路径建立方法，该方法包括：移动性管理节点接收来自终端的会话信息，会话信息包括会话的信任级别要求和信任质量策略，该信任质量策略用于为该会话选择路由节点；移动性管理节点向路由控制节点发送会话信息；移动性管理节点接收来自路由控制节点的基站信息，基站信息用于指示满足信任级别要求的传输路径上的基站，传输路径与信任级别要求和信任质量策略有关；移动性管理节点向终端发送基站信息。在该方法中，移动性管理节点将会话的信任级别要求和信任质量策略转发给路由控制节点，由路由控制节点选择路由节点，从而建立满足信任级别要求的传输路径，实现通信网络和IP网络下的端到端的可信路由，还可以满足多样的路由需求。
本申请实施例的技术方案可以应用于未来网络，如异构网络，其中未来网络可以是由通信网络和网际互连协议(internet protocol，IP)网络结合。通信网络可以为第四代(4th Generation，4G)通信系统(例如，长期演进(long term evolution，LTE)系统)，第五代移动通信(5th-generation，5G)通信系统(例如，新无线(new radio，NR)系统)，及未来的移动通信系统如6G等。
图1示出了一种本申请实施例适用的通信系统的架构，包括：用户设备、(无线)接入网设备、用户面网元、数据网络、移动性管理网元、会话管理网元、应用网元、统一数据管理网元、策略控制网元和网络开放网元等。下面对该网络架构中涉及的各个网元分别进行说明。
1、用户设备(user equipment，UE)：用户设备也可称为接入终端、终端、用户单元、用户站、移动站、移动台、远方站、远程终端、移动设备、用户终端、用户代理或用户装置等。该终端可以是一种具有无线收发功能的设备，例如手机(mobile phone)、平板电脑(pad)、带无线收发功能的电脑、虚拟现实(virtual reality，VR)终端、增强现实(augmented reality，AR)终端、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端、蜂窝电话、无绳电话、会话启动协议(session initiation protocol，SIP)电话、无线本地环路(wireless local loop，WLL)站、个人数字助理(personal digital assistant，PDA)、具有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它处理设备、车载设备、可穿戴设备，5G网络中的终端或者未来演进网络中的终端等。
其中，可穿戴设备也可以称为穿戴式智能设备，是应用穿戴式技术对日常穿戴进行智能化设计、开发出可以穿戴的设备的总称，如眼镜、手套、手表、服饰及鞋等。可穿戴设备即直接穿在身上，或是整合到用户的衣服或配件的一种便携式设备。可穿戴设备不仅仅是一种硬件设备，更是通过软件支持以及数据交互、云端交互来实现强大的功能。广义穿戴式智能设备包括功能全、尺寸大、可不依赖智能手机实现完整或者部分的功能，例如：智能手表或智能眼镜等，以及只专注于某一类应用功能，需要和其它设备如智能手机配合使用，如各类进行体征监测的智能手环、智能首饰等。
2、(无线)接入网设备(radio access network，(R)AN)：接入网设备也可以称为接入设备，(R)AN能够管理无线资源，为用户设备提供接入服务，完成用户设备数据在用户设备和核心网之间的转发，(R)AN也可以理解为网络中的基站。
示例性地，本申请实施例中的接入网设备可以是用于与用户设备通信的任意一种具有无线收发功能的通信设备。该接入网设备包括但不限于：演进型节点B(evolved node B，eNB)、无线网络控制器(radio network controller，RNC)、节点B(node B，NB)、基站控制器(base station controller，BSC)、基站收发台(base transceiver station，BTS)、家庭基站(home evolved NodeB，HeNB，或home node B，HNB)、室内基带处理单元(building base band unit，BBU)、收发点(transmit receive point，TRP)或者传输点 (transmission point，TP)等，还可以为5G，如NR系统中的下一代基站或下一代节点B(generation node B，gNB)，或传输点(TRP或TP)，5G系统中的基站的一个或一组(包括多个天线面板)天线面板，或者，还可以为构成gNB或传输点的网络节点，如基带单元(BBU)，或分布式单元(distributed unit，DU)等。
在一些部署中，gNB可以包括集中式单元(centralized unit，CU)和DU。gNB还可以包括有源天线单元(active antenna unit，AAU)。CU实现gNB的部分功能，DU实现gNB的部分功能。比如，CU负责处理非实时协议和服务，实现无线资源控制(radio resource control，RRC)，分组数据汇聚层协议(packet data convergence protocol，PDCP)层的功能。DU负责处理物理层协议和实时服务，实现无线链路控制(radio link control，RLC)层、媒体接入控制(media access control，MAC)层和物理(physical，PHY)层的功能。AAU实现部分物理层处理功能、射频处理及有源天线的相关功能。RRC层的信息由CU生成，最终会经过DU的PHY层封装变成PHY层信息，或者，由PHY层的信息转变而来。因而，在这种架构下，高层信令如RRC层信令，也可以认为是由DU发送的，或者，由DU+AAU发送的。可以理解的是，接入网设备可以为包括CU节点、DU节点、AAU节点中一项或多项的设备。此外，可以将CU划分为接入网(radio access network，RAN)中的接入网设备，也可以将CU划分为核心网(core network，CN)中的接入网设备，本申请对此不做限定。
3、用户面网元：作为和数据网络的接口，完成用户面数据转发、基于会话/流级的计费统计，带宽限制等功能。即分组路由和转发以及用户面数据的服务质量(quality of service，QoS)处理等。
在5G通信系统中，该用户面网元可以是用户面功能(user plane function，UPF)网元。
4、数据网络：用于提供传输数据的网络。提供例如运营商服务、互联网接入或第三方服务，包含服务器，服务器端实现视频源编码、渲染等。在5G通信系统中，该数据网络可以是数据网络(data network，DN)。
5、移动性管理网元：主要用于移动性管理和接入管理等。在5G通信系统中，该接入管理网元可以是接入和移动性管理功能(access and mobility management function，AMF)，主要进行移动性管理、接入鉴权/授权等功能。此外，还负责在终端与策略控制功能(policy control function，PCF)网元间传递用户策略。
6、会话管理网元：主要用于会话管理、用户设备的网络互连协议(internet protocol，IP)地址分配和管理、选择可管理用户平面功能、策略控制和收费功能接口的终结点以及下行数据通知等。
在5G通信系统中，该会话管理网元可以是会话管理功能(session management function，SMF)网元，完成终端IP地址分配，UPF选择，及计费与QoS策略控制等。
7、应用网元：在5G通信系统中，该应用网元可以是应用功能(application function，AF)网元，表示第三方或运营商的应用功能，是5G网络获取外部应用数据的接口，主要用于传递应用侧对网络侧的需求。
8、统一数据管理网元：负责用户标识、签约数据、鉴权数据的管理、用户的服务网元注册管理。在5G通信系统中，该统一数据管理网元可以是统一数据管理(unified data management，UDM)。
9、策略控制网元：包括用户签约数据管理功能、策略控制功能、计费策略控制功能、QoS控制等，用于指导网络行为的统一策略框架，为控制面功能网元(例如AMF，SMF网元等)提供策略规则信息等。
在5G通信系统中，该策略控制网元可以是PCF。
10、网络开放网元：在5G通信系统中，该网络开放网元可以是网络开放功能(network element function，NEF)网元，主要用于向AF暴露3GPP网络功能的业务和能力，同时也可以让AF向3GPP网络功能提供信息。
图2示出了另一种本申请实施例适用的通信系统的架构，包括：终端、基站、域内路由器、控制节点、路由器1、路由器2和区块链节点(可选)。其中，路由器1和路由器2可以是边界路由器(也称为域间路由器)。控制节点可以包括链接控制节点和路由控制节点，其中链接控制节点可以是通信网络中的控制节点，如接入性管理节点和/或会话管理节点等。区块链节点是位于区块链系统中的节点，主要用于在网络间共享远程证明材料。
如果数据包的发送方和接收方属于同一网络(如同一运营商网络的可信域内)，数据包可以通过域内路径在域内传输，即发送方将数据包发送给发送方的基站，发送方的基站将数据包转发给域内路由器， 域内路由器将数据包转发给接收方的基站，接收方的基站将数据包发送给接收方。
如果数据包的发送方和接收方属于不同网络，数据包可以通过域间路径在域间传输，即发送方将数据包发送给发送方的基站，发送方的基站将数据包转发给域内路由器，域内路由器将数据包转发给路由器1，路由器1将数据包发送给路由器2，路由器2将数据包转发给域内路由器，域内路由器将数据包转发给接收方的基站，接收方的基站将数据包转发给接收方。
数据转发过程中可以对路由进行验证，并根据验证结果确定是否继续转发数据包。例如在路由验证过程中，域间路由器(如路由器1和路由器2)可以从区块链节点中获取用于远程验证的验证信息。
可选的，图1和图2中网络架构中包括的网元可以比上述示出的网元更多或更少。
上述功能网元既可以是硬件设备中的网络元件，也可以是在专用硬件上运行的软件功能，或者是平台(例如云平台)上实例化的虚拟化功能。上述功能网元可划分出一个或多个服务，进一步，还可能会出现独立于网络功能存在的服务。在本申请中，上述功能网元的实例、或上述功能网元中包括的服务的实例、或独立于网络功能存在的服务实例均可称为服务实例。
为了便于理解本申请实施例的技术方案，在介绍本申请的技术方案之前，先对“信任级别”进行介绍。信任级别指对节点、链路、或路径进行信任评估后确定的量化的值，也就是说，信任级别是以量化的方式来反映节点、链路、或路径所能达到的信任程度，信任级别可以理解为信任质量(quality of trust，QoT)级别。其中，如图3所示，节点指网络中的设备，包括但不限于基站、或路由器等，链路指两个节点之间的物理链路，路径指由一个或多个链路组成的路径。
节点的信任级别(或QoT级别)：通过一定的信任评估方式，对节点固有的可信属性进行评估得到，例如节点A的信任级别AQoT＝TL，TL为对节点A进行评估得到的信任级别。一种实现中，节点的信任级别越大，表示该节点的可信度越高，反之，节点的信任级别越小，表示该节点的可信度越低。
链路的信任级别：与该链路两端节点的信任级别有关。例如，链路的信任级别为链路两端节点的信任级别的最小值，假设节点A和节点B之间的链路为lAB，节点A的信任级别为AQoT，节点B的信任级别为BQoT，lAB的信任级别l1,QoT＝min(AQoT,BQoT)。
路径的信任级别：与组成该链路的所有链路的信任级别有关。例如路径的信任级别为组成该链路的所有链路的信任级别的最小值，假设路径P＝{l1,l2,…,ln}，P的信任级别PQoT＝min(l1,QoT,l2,QoT,…,ln， QoT)。
下面结合具体实施例介绍本申请的技术方案。
图4为本申请实施例提供的一种路径建立方法的示意图，包括如下步骤：
S401：终端向移动性管理节点发送会话信息，相应的，移动性管理节点接收会话信息。
会话信息包括会话的信任级别要求和会话的信任质量策略。
S402：移动性管理节点向路由控制节点发送会话信息，相应的，路由控制信息接收会话信息。
一种实现中，移动性管理节点通过会话管理节点向路由控制节点发送会话信息，即移动性管理节点向会话管理节点发送会话信息，会话管理节点向会话管理节点发送该会话信息。通常地，移动性管理节点、会话管理节点部署在通信网络下，路由控制节点部署在IP网络下。
S403：路由控制节点根据信任级别要求和信任质量策略，为会话选择传输路径。
S404：路由控制节点向移动性管理节点发送基站信息，相应的，移动性管理节点接收基站信息。
基站信息用于指示满足信任级别要求的传输路径上的基站。基站通常部署在通信网络下。
一种实现中，路由控制节点通过会话管理节点向移动性管理节点发送基站信息，即路由控制节点向会话管理节点发送基站信息，会话管理节点向移动性管理节点发送该基站信息。
S405：移动性管理节点向终端发送基站信息，相应的，终端接收基站信息。
S406：终端根据基站信息和该终端连接的基站，为会话选择目标基站。
在该方法中，通信网络下的移动性管理节点将会话的信任级别要求和信任质量策略转发给IP网络下的路由控制节点，由路由控制节点选择路由节点，从而在通信网络和IP网络之间建立满足信任级别要求的传输路径，实现通信网络和IP网络下的端到端的可信路由，还可以满足多样的路由需求。
上述会话信息中包括的信任级别要求表示该会话所要求的信任级别。一般的，为该会话建立的传输路径的信任级别不低于该会话的信任级别要求，因此在一些情况下，信任级别要求可以用于为会话选择传输路径上的路由节点。在一种实现中，信任级别要求越高表示该会话要求的安全性越高，信任级别要 求越低表示该会话要求的安全性越低。其中，信任级别要求可以是在终端支持的信任级别范围中选择的，信任级别范围包括终端支持的最大信任级别和最小信任级别。可选地，终端中设置有各应用的信任级别要求，在上述S401之前，移动性管理节点获取终端支持的信任级别范围，然后向终端发送该信任级别范围，终端可以在信任级别范围内，确定当前应用对应会话的信任级别要求。示例的，终端为UE，移动性管理节点为AMF。
上述会话信息中包括的信任质量策略用于为会话选择路由节点，例如信任质量策略用于指定特定类型或排除特定类型的路由节点，该特定类型可以与路由节点的信任级别、支持的协议版本、所属厂商、或设备的地址信息等一个或多个因素有关。其中，信任质量策略可以是在终端支持的信任质量策略集合中选择的，信任质量策略集合包括一个或多个信任质量策略。可选地，在上述S401之前，移动性管理节点获取终端支持的信任质量策略集合，然后向终端发送该信任质量策略集合，终端可以在信任质量策略集合中，确定当前应用对应会话的信任质量策略。
可选地，除信任级别要求和信任质量策略外，上述会话信息还可以包括会话的地址信息和/或基站信息集合等。其中，会话的地址信息包括会话的源地址(如源IP地址)和目标地址(如目标IP地址)，源地址和目标地址可以用于确定传输路径是否为域内路径，例如若源地址和目标地址属于同一网络，传输路径为域内路径；若源地址和目标地址属于不同网络，传输路径为域间路径，域内路径的相关描述请参见后文场景一，域间路径的相关描述请参见后文场景二。基站信息集合包括能够服务该会话的基站集合(或基站列表)，能够服务该会话的基站可以是信号覆盖范围内包括该终端的基站。可选地，S404和S405中的基站信息是在该基站信息集合中选择的。
假设移动性管理节点获取到了终端支持的信任级别范围和信任质量策略集合，移动性管理节点可以保存该终端支持的信任级别范围和信任质量策略集合，这样在S401之后，移动性管理节点根据接收到的会话信息、以及保存的信任级别范围和信任质量策略集合，确定是否为该会话创建路径。例如，若当前网络中满足该会话的信任级别要求的路由节点堵塞或资源不足，移动性管理节点确定不为该会话创建路径，移动性管理节点可以不执行S402，即不向会话控制节点发送会话信息；若当前网络中满足信任级别要求的路由节点资源充足，移动性管理节点确定为该会话创建路径，移动性管理节点可以执行S402，即向会话控制节点发送会话信息。进一步地，移动性管理节点还可以根据源地址和目标地址属于同一网络，确定创建域内路径(参见场景一)，或者根据源地址和目标地址属于不同网络，确定创建域间路径(参见场景二)。示例的，路由控制节点可以包括软件定义网络(software defined network，SDN)和/或基于互联网协议第6版(internet protocol version 6，IPv6)转发平面的段路由(segment routing IPv6，SRv6)等。
上述S401中的会话信息可以携带在会话建立请求消息中。一般的，终端在注册和认证成功后，可以通过向移动性管理节点发送会话建立请求消息来请求建立会话。示例的，会话可以为协议数据单元(protocol data unit，PDU)会话。一种可能的实现中，注册过程中，终端向用户管理节点发送注册请求消息，该注册请求消息中携带终端支持可信路由的指示信息，用户管理节点查询并确定注册的用户的信任级别和终端实际可用的最大信任级别，确定终端支持的最大信任级别；认证过程中，终端与用户管理节点之间进行双向认证。可选地，在注册和/或认证过程后，用户管理节点向移动性管理节点发送终端支持的最大信任级别。示例的，用户管理节点可以包括鉴权服务功能(authentication server function，AUSF)和/或UDM等。
在上述S402中，移动性管理节点通过会话管理节点向路由控制节点发送会话信息时，移动性管理节点可以向为会话选择的会话管理节点发送会话建立请求消息，会话建立请求消息包括会话信息，然后会话管理节点建立会话，在会话建立成功后，向路由控制节点发送路由建立请求消息，该路由建立请求消息用于请求路由控制节点选择传输路径，路由建立请求消息包括会话信息。示例的，会话管理节点为SMF。
对于路由控制节点来说，路由控制节点可以基于路由建立请求消息，执行S403，即为会话选择传输路径。可选地，路由建立请求消息还可以包括创建域内路径或域间路径的指示信息，路由控制节点可以根据该指示信息，确定创建域内路径或域间路径。或者，路由控制节点可以根据源地址和目标地址是否属于同一网络，确定创建域内路径或域间路径。根据创建域内路径和域间路径的不同，分别采用下述场景一和场景二进行说明。
场景一：域内路径。
上述S403中，路由控制节点可以通过图5所示的方式选择域内路径，包括以下步骤：
S501：路由控制节点从基站信息集合中选择满足信任级别要求和信任质量策略的第一基站。其中路由控制节点选择到的第一基站可以是一个或多个。
S502：路由控制节点将第一基站加入网络拓扑。
S503：路由控制节点从网络中选择与第一基站连通并满足信任级别要求和信任质量策略的域内路由器，加入网络拓扑，生成拓扑G(V,E)。
S504：路由控制节点从第一基站中选择第二基站。
S505：路由控制节点在G(V,E)中，选择第二基站到路由器中满足信任级别要求和服务质量(quality of service，QoS)的传输路径。如果存在该传输路径，执行S507；如果不存在该传输路径，执行S506；
路由控制节点选择传输路径的过程可以参见图6，此处不做赘述。
S506：路由控制节点判断是否遍历第一基站中的所有基站。如果否，返回S504。
如果遍历了第一基站中的所有基站，且所有基站均不存在对应的传输路径，则路由控制节点还可以确定传输确定路径选择失败。
S507：路由控制节点输出会话标识和传输路径P，返回S506。
图6为一种路由控制节点选择传输路径的示意图，包括以下步骤：
S601：路由控制节点获取第一数组、第二数组和第三数组，其中第一数组中每个元素表示该元素对应的节点是否被访问过，第二数组包括源节点到当前节点之间最短路径的长度，第三数组包括当前节点的前驱节点。
S602：若源节点在G(V,E)中，路由控制节点确定源节点为当前节点i。
S603：路由控制节点根据当前节点i，更新第一数组、第二数组和第三数组。
若当前节点为源节点，路由控制节点将第一数组中源节点对应的元素更新为被访问过，将第二数组中源节点到源节点之间最短路径的长度更新为0，将第三数组中当前节点的前驱节点更新为源节点本身。
S604：若当前节点i被访问过，路由控制节点确定与当前节点i相邻且未被访问过的节点k，更新第二数组。
具体的，路由控制节点针对每个节点k，更新每个节点k对应的第二数组。
S605：路由控制节点在节点k对应的第二数组中选择长度最小的节点k。
S606：路由控制节点判断是否遍历网络中的全部节点。如果否，执行S607；如果是，执行S608。
S607：路由控制节点将选择长度最小的节点k作为当前节点i，返回S603。
S608：路由控制节点根据选择长度最小的节点k，更新第三数组；根据第三数组，确定传输路径。
可选地，在该场景中，上述S404中的基站信息可以携带在路径选择信息中。上述路径选择信息除包括基站信息外，还可以包括传输路径的信任级别，其中该传输路径的信任级别与传输路径上的路由节点的信任级别有关。
路由控制节点在选择传输路径(该场景中指域内路径)后，还可以向入口路由器发送一个或多个信息：会话的地址信息、域内路径的信息、或传输路径的信任级别。示例的，域内路径的信息可以是段标识(Segment ID)。
场景二：域间路径。
路由控制节点在选择域间路径时，可以根据获取到的至少一个边界路由器(也可以称为域间路由器)的路由信息，确定满足信任级别要求的边界路由器，然后根据该边界路由器，选择达到该边界路由器的域内路径，以及包含该边界路由器的域间路径。可选地，达到该边界路由器的域内路径中包括入口路由器(也可以称为域内路由器)，例如该达到该边界路由器的域内路径包括终端到入口路由器的路径，以及入口路由器到边界路由器的路径。
示例的，上述S403中，路由控制节点可以通过图7所示的方式选择域间路径，包括如下步骤：
S701～S702的过程参见上述S501～S502，此处不做赘述。
S703：边界路由器进行边界网关协议(border gateway protocol，BGP)广播生成路由列表。
S704：路由控制节点从接收到的路由列表中，选择满足信任级别要求的边界路由器，并根据G(V,E)，生成拓扑G′(V,E)。
S705：路由控制节点在G′(V,E)中，选择满足信任级别要求的传输路径。如果存在该传输路径，执行S707；如果不存在该传输路径，执行S706；
路由控制节点选择传输路径的过程可以参见图6，区别在于将域内路径的拓扑G(V,E)替换为拓扑G′(V,E)，重复之处不做赘述。
S706：路由控制节点判断是否遍历网络中的所有节点。如果否，返回S705。
如果遍历了网络中的所有节点，且所有节点均不存在对应的传输路径，则路由控制节点还可以确定传输确定路径选择失败。
S707：路由控制节点输出会话标识和传输路径P，返回S705。
可选地，在该场景中，上述S404中的基站信息可以携带在路径选择信息中。上述路径选择信息除包括基站信息外，还可以包括传输路径的信任级别和/或域间路径的信息。
路由控制节点在选择传输路径(该场景中指域间路径)后，还可以向入口路由器和边界路由器发送一个或多个信息：会话的地址信息、域内路径的信息、域间路径的信息、或传输路径的信任级别。示例的，域内路径的信息可以是段标识(Segment ID)，其中这里的域内路径指达到边界路由器的域内路径。
上述S406中，终端根据终端连接的基站以及接收到的基站信息决定是否重新连接到目标基站。终端除基站信息外，还可以接收到会话的标识信息、域内路径的信息、域间路径的信息、或传输路径的信任级别。
基于上述创建的传输路径传输数据包之前，终端可以对传输路径进行验证。可选地，域内路径为同一运营商内的可信路由，因此终端无需对域内路径进行验证，而是对域间路径进行验证。在对域间路径进行验证时，终端可以对域间路径上各路由器进行验证。示例的，终端获取域间路径上各路由器的验证信息，根据各路由器的验证信息，验证各路由器是否满足信任级别要求；如果各路由器满足信任级别要求，终端确定域间路径为会话的传输路径；如果存在路由器不满足信任级别要求，终端确定域间路径非会话的传输路径，终端还可以丢弃该传输路径。其中验证信息包括以下一个或多个：路由器的证书、路由器的远程证明材料、路由器的信任级别。
上述终端获取域间路径上各路由器的验证信息时，终端可以向区块链节点发送验证信息获取请求，用于获取域间路径上各路由器的验证信息；然后接收来自区块链节点的域间路径上各路由器的验证信息。
对于终端来说，如果终端对传输路径验证通过，则终端可以通过该传输路径发送第一数据包，第一数据包中可以包括以下一个或多个信息：流标识(flow ID)、源地址、目标地址、端口号、信任级别要求(如数据包所属会话的信任级别要求)、路径信息(如域内路径的信息和/或域间路径的信息)。对于该传输路径上的各路由节点来说，路由节点接收到第一数据包，可以根据数据包的信任级别要求和传输路径的信任级别，确定是否继续转发该第一数据包。通常路由节点不能把信任级别要求高的数据包转发给信任级别低的路由节点，也就是说，如果路由节点的下一级路由节点的信任级别低于信任级别要求，该路由节点不继续转发第一数据包，如果路由节点的下一级路由节点的信任级别不低于信任级别要求，该路由节点继续转发第一数据包。
下面采用图8～图10所示的信令流程对上述路径创建过程进行说明，其中图8～图10和图4～图7中的步骤之间可以相互引用，术语概念也可以相互引用。
图8为一种创建域内路径的示意图，包括如下步骤：
S801：UE向AUSF/UDM发送注册请求消息，该注册请求消息中携带UE支持可信路由的指示信息。
UE为上述本申请方案中的终端，AUSF/UDM为上述本申请方案中的用户管理节点。其中AUSF/UDM中预先保存有用户注册时用户的QoT级别，QoT级别为上述本申请方案中的信任级别。
S802：AUSF/UDM查询用户的QoT级别和UE实际可用的最大QoT级别，确定UE支持的最大QoT级别。
假设用户的QoT级别和UE实际可用的最大QoT级别不同，AUSF/UDM可以选择两者中QoT级别较小的QoT作为UE支持的最大QoT级别。例如QoT级别共5个级别，由低到高分别是1、2、3、4、5，用户的QoT级别为5，UE实际可用的最大QoT级别为4，AUSF/UDM确定UE支持的最大QoT级别为4。
S803：UE与AUSF/UDM完成双向认证。
S804：AUSF/UDM向AMF发送UE支持的QoT级别范围和QoT策略集合。
AMF为上述本申请方案中的移动性管理节点，UE支持的QoT级别范围和QoT策略集合也可以看作用户支持的QoT级别范围和QoT策略集合，其中QoT级别范围包括最大QoT级别和最小QoT级别。
S805：AMF保存UE支持的QoT级别范围和QoT策略集合。
S806：AMF向UE发送UE支持的QoT级别范围和QoT策略集合。
S807：UE保存UE支持的QoT级别范围和QoT策略集合。
S808：UE向AMF发送PDU会话建立请求消息，PDU会话建立请求消息包括源IP地址、目标IP地址、基站ID列表、QoT级别要求、QoT策略。
PDU会话建立请求消息为上述本申请方案中的会话建立请求消息。其中QoT级别要求是UE在QoT级别范围中选择到的，QoT策略是UE在QoT策略集合中选择到的。上述基站ID列表为上述本申请方案中的基站信息集合。
S809：AMF根据PDU会话建立请求消息中包括的信息、本地保存的QoT级别范围以及QoT策略集合，确定建立传输路径。
若源IP地址和目标IP地址属于同一网络，AMF确定创建域内路径。
S810：AMF选择SMF，向该SMF发送会话建立请求消息，会话建立请求消息包括源IP地址、目标IP地址、基站ID列表、QoT级别要求、QoT策略。
SMF为上述本申请方案中的会话管理节点。上述会话建立请求消息用于请求建立会话。
S811：SMF成功建立会话后，向SDN/SRv6发送路由建立请求消息，路由建立请求消息包括会话标识(Session ID)、源IP地址、目标IP地址、基站ID列表、QoT级别要求、QoT策略。
上述Session ID指成功建立的会话对应的标识。上述的路由建立请求消息用于进行路径选择。SDN/SRv6为上述本申请方案中的路由控制节点。
S812：SDN/SRv6选择满足QoT级别要求的域内路径。
该S812中，SDN/SRv6选择域内路径的过程可以参见上述图5和图6所示。
S813：SDN/SRv6将域内路径信息发送给入口路由器，域内路径信息包括源IP地址、目标IP地址、段标识(Segment ID)、QoT级别。
段标识指域内路径对应的标识，QoT级别指域内路径的QoT级别。
S814：入口路由器保存域内路径信息。
上述域内路径信息可以用于入口路由器进行数据包的转发。
S815：SDN/SRv6向SMF发送路径选择信息，路径选择信息包括会话标识(Session ID)、基站ID、QoT级别。
上述基站ID可以是SDN/SRv6在基站信息集合中选择的。
S816：SMF向AMF发送会话标识(Session ID)、基站ID、QoT级别。
S817：AMF向UE发送会话标识(Session ID)、基站ID、QoT级别。
S818：UE存储会话标识(Session ID)、基站ID、QoT级别。
S819：UE根据UE链接的基站ID以及接收到的基站ID，重新确定基站。
S820：UE向基站发送数据包，数据包中包括QoT级别要求和QoT策略。
S821：基站向入口路由器转发数据包。
S822：入口路由器根据数据包中的QoT级别要求和QoT策略，转发该数据包。
在该实施例中，路由控制节点可以基于路由建立请求消息中的源IP地址和目标IP地址，结合QoT级别要求与网络内路由节点的QoT级别，选出域内路径，并通知UE、基站和域内其它路由器，从而建立域内路径，提供了结合通信网络和IP网络下的可信路由建立方案。
图9为一种创建域间路径的示意图，包括如下步骤：
S901～S911的过程参见S801～S811，此处不做赘述。
S912：SDN/SRv6根据边界路由器提供的路由信息、QoT级别要求和QoT策略，确定满足QoT级别要求和QoT策略的域间路径。
上述边界路由器提供的路由信息包括边界路由器的QoT级别。若满足QoT级别要求和QoT策略的域间路径有多条，SDN/SRv6从多条路径中选择一条作为域间路径。其中域间路径中包括到达边界路由器 的域内路径，该域内路径的信息包括段标识(Segment ID)和段路由策略(segment routing policy，SR Policy)等信息。
S913：SDN/SRv6向域内路由器发送控制信息，控制信息包括源IP地址、目标IP地址、域内路径信息、域间路径的QoT级别。
S914：域内路由器保存源IP地址、目标IP地址、域内路径信息、域间路径的QoT级别。
S915：SDN/SRv6向边界路由器发送控制信息，控制信息包括源IP地址、目标IP地址、域内路径信息、域间路径的QoT级别、域间路径信息。
域间路径信息可以用路径(Path)表示。
S916：边界路由器保存源IP地址、目标IP地址、域内路径信息、域间路径的QoT级别、域间路径信息。
边界路由器可以使用上述信息建立可信域间路由，如使用互联网安全协议(internet protocol security，IPSec)与下一跳路由器建立安全通道。
S917：SDN/SRv6向SMF发送可信路径信息，可信路径信息包括会话标识(Session ID)、基站ID、QoT级别、域间路径信息。
S918：SMF向AMF发送会话标识(Session ID)、基站ID、QoT级别、域间路径信息。
S919：AMF向UE发送会话标识(Session ID)、基站ID、QoT级别、域间路径信息。
S920：UE保存会话标识(Session ID)、基站ID、QoT级别、域间路径信息。
S921：UE根据UE链接的基站ID以及接收到的基站ID，重新确定基站。
S922：UE向基站发送数据包，数据包中包括QoT级别要求和QoT策略。
S923：基站向域内路由器转发数据包。
S924：域内路由器根据数据包中的QoT级别要求和QoT策略，向边界路由器转发该数据包。
S925：边界路由器根据数据包中的QoT级别要求和QoT策略，转发该数据包。
在该实施例中，路由控制节点可以基于路由建立请求消息中的源IP地址和目标IP地址，若存在满足QoT级别要求的端到端的可信路由，选择相应的域内路由器和边界路由器，确定基站到边界路由器的可信域间路由，并通知UE、基站和域内其它路由器，从而建立域内路径，提供了结合通信网络和IP网络下的可信路由建立方案。
图10为一种验证域间路径的示意图，不同运营商网络之间存在区块链系统，各网络可以在区块链上存放路由信息和路由器的验证信息，UE或SDN/SRv6可以直接或间接从区块链下载路由信息和路由器的验证信息，并验证域间路由是否与QoT级别要求匹配。包括如下步骤：
S1001：边界路由器向运营商代理节点发送边界路由器的验证信息。
S1002：运营商代理节点向区块链节点发送边界路由器的验证信息。
S1003：区块链节点保存边界路由器的验证信息。
S1004～1024的过程参见上述S901～S921，相似之处不做赘述。
S1025：UE向区块链节点发送验证信息获取请求，用于获取域间路径中所有路由器的验证信息。
S1026：区块链节点向UE发送该域间路径中所有路由器的验证信息。
S1027：UE根据各路由器的验证信息，确定该域间路径中的所有路由器均满足QoT级别要求，确定使用该域间路径作为传输路径。
在一些情况下，若该域间路径中存在路由器不满足QoT级别要求，则UE丢弃该域间路径。
S1028～S1031的过程参见S922～S925，相似之处不做赘述。
在该实施例中，运营商代理节点将边界路由器的验证信息上传至区块链，区块链将这些信息进行共享用于域间路径选择，这样可以结合用户的QoT级别要求，从而验证域间路径，提供了结合通信网络和IP网络下的路径验证方案。
本申请实施例中的术语“系统”和“网络”可被互换使用。本申请实施例的描述中，“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。字符“/”一般表示前后关联对象是一种“或”的关系。本申请中所涉及的至少一个是指一个或多个；多个，是指两个或两个以上。另外，需要理解的是，在本申请的描述中，“第一”、“第二”、“第三”等词汇，仅用于区分描述的目的，而不能理解为指示或暗示相对重 要性，也不能理解为指示或暗示顺序。在本说明书中描述的参考“一个实施例”或“一些实施例”等意味着在本申请的一个或多个实施例中包括结合该实施例描述的特定特征、结构或特点。由此，在本说明书中的不同之处出现的语句“在一个实施例中”、“在一些实施例中”、“在其他一些实施例中”、“在另外一些实施例中”等不是必然都参考相同的实施例，而是意味着“一个或多个但不是所有的实施例”，除非是以其他方式另外特别强调。术语“包括”、“包含”、“具有”及它们的变形都意味着“包括但不限于”，除非是以其他方式另外特别强调。方法和装置是基于相同或相似技术构思的，由于方法及装置解决问题的原理相似，因此装置与方法的实施可以相互参见，重复之处不再赘述。
基于与上述路径建立方法的同一技术构思，本申请实施例还提供一种通信装置，如图11所示，通信装置1100包括处理单元1101和收发单元1102。可选的收发单元1102所实现的功能可以由通信接口完成，收发单元1102可以由接收单元和发送单元集成。通信装置1100可以为移动性管理节点或路由控制节点或终端或路由器，或者位于移动性管理节点或路由控制节点或终端或路由器中。通信装置1100可以用于实现上述方法实施例中描述的方法，例如通信装置1100能够执行上述图4至图10的方法中由移动性管理节点或路由控制节点或终端或路由器执行的各个步骤。
在一个可能的实施例中，通信装置1100应用于移动性管理节点。
例如，收发单元1102，用于接收来自终端的会话信息，会话信息包括会话的信任级别要求和会话的信任质量策略，信任质量策略用于为会话选择路由节点；
处理单元1101，用于确定会话信息；
收发单元1102，还用于通过会话管理节点向路由控制节点发送会话信息；接收来自路由控制节点的基站信息，基站信息用于指示满足信任级别要求的传输路径上的基站，传输路径与信任级别要求和信任质量策略有关；向终端发送基站信息。
在一个实现方式中，收发单元1102，还用于获取终端支持的信任级别范围和信任质量策略集合，其中信任级别要求是终端在信任级别范围中选择的，信任质量策略是终端在信任质量策略集合中选择的；
处理单元1101，还用于保存终端支持的信任级别范围和信任质量策略集合；
收发单元1102，还用于向终端发送信任级别范围和信任质量策略集合。
在一个实现方式中，处理单元1101，还用于根据信任级别要求、信任质量策略、信任级别范围和信任质量策略集合，确定为会话创建传输路径。
在一个实现方式中，会话信息还包括会话的源地址和目标地址；若源地址和目标地址属于同一网络，传输路径为域内路径；若源地址和目标地址属于不同网络，传输路径为域间路径。
在一个实现方式中，会话信息还包括基站信息集合，基站信息是在基站信息集合中选择的。
在一个实现方式中，处理单元1101，还用于为会话选择会话管理节点。
在一个实现方式中，基站信息携带在路径选择信息中，路径选择信息还包括传输路径的信任级别，其中传输路径的信任级别与传输路径上的路由节点的信任级别有关。
在一个实现方式中，路径选择信息还包括域间路径的信息。
在一个可能的实施例中，通信装置1100应用于路由控制节点。
例如，收发单元1102，用于接收终端的会话信息，会话信息包括会话的信任级别要求和会话的信任质量策略，信任质量策略用于为会话选择路由节点；
处理单元1101，用于根据信任级别要求和信任质量策略，为会话选择传输路径；
收发单元1102，还用于向所在网络的入口路由器发送传输路径的信任级别，其中传输路径的信任级别与传输路径上的路由节点的信任级别有关；向移动性管理节点发送基站信息，基站信息用于指示传输路径上的基站。
在一个实现方式中，会话信息还包括会话的源地址和目标地址；若源地址和目标地址属于同一网络，传输路径为域内路径；若源地址和目标地址属于不同网络，传输路径为域间路径。
在一个实现方式中，处理单元1101，还用于在基站信息集合中选择基站信息。
在一个实现方式中，收发单元1102，还用于接收来自会话管理节点的会话信息。
在一个实现方式中，基站信息携带在路径选择信息中，路径选择信息还包括传输路径的信任级别，其中传输路径的信任级别与传输路径上的路由节点的信任级别有关。
在一个实现方式中，路径选择信息还包括域间路径的信息。
在一个实现方式中，处理单元1101，还用于根据获取到的至少一个边界路由器的路由信息，确定满足信任级别要求的边界路由器；根据边界路由器，选择到达边界路由器的域内路径，以及包含边界路由器的域间路径。
在一个实现方式中，到达边界路由器的域内路径包括入口路由器。
在一个实现方式中，收发单元1102，还用于向边界路由器发送域间路径的信息。
在一个可能的实施例中，通信装置1100应用于终端。
例如，收发单元1102，用于向移动性管理节点发送会话信息，会话信息包括会话的信任级别要求和会话的信任质量策略，信任质量策略用于为会话选择路由节点；接收来自移动性管理节点的基站信息，基站信息用于指示满足信任级别要求的传输路径上的基站，传输路径与信任级别要求和信任质量策略有关；
处理单元1101，用于根据基站信息和终端连接的基站，为会话选择目标基站。
在一个实现方式中，收发单元1102，还用于获取终端支持的信任级别范围和信任质量策略集合；
处理单元1101，还用于在信任级别范围中选择信任级别要求；在信任质量策略集合中选择信任质量策略。
在一个实现方式中，会话信息还包括会话的源地址和目标地址；若源地址和目标地址属于同一网络，传输路径为域内路径；若源地址和目标地址属于不同网络，传输路径为域间路径。
在一个实现方式中，基站信息携带在路径选择信息中，路径选择信息还包括传输路径的信任级别，其中传输路径的信任级别与传输路径上的路由节点的信任级别有关。
在一个实现方式中，路径选择信息还包括域间路径的信息。
在一个实现方式中，收发单元1102，还用于获取域间路径上各路由器的验证信息，验证信息包括以下一个或多个：路由器的证书、路由器的远程证明材料、路由器的信任级别；
处理单元1101，还用于根据各路由器的验证信息，验证域间路径上各路由器满足信任级别要求；确定域间路径为会话的传输路径。
在一个实现方式中，收发单元1102，具体用于向区块链节点发送验证信息获取请求，验证信息获取请求用于获取域间路径上各路由器的验证信息；接收来自区块链节点的域间路径上各路由器的验证信息。
在一个可能的实施例中，通信装置1100应用于路由器。
例如，收发单元1102，用于接收来自路由控制节点的会话的传输路径的信任级别，其中传输路径的信任级别与传输路径上的路由节点的信任级别有关；接收会话的第一数据包；
处理单元1101，用于确定第一数据包；
收发单元1102，还用于根据信任级别，在传输路径上转发第一数据包。
在一个实现方式中，收发单元1102，还用于接收来自路由控制节点的会话的源地址和目标地址；若源地址和目标地址属于同一网络，传输路径为域内路径；若源地址和目标地址属于不同网络，传输路径为域间路径。
在一个实现方式中，收发单元1102，还用于接收域间路径的信息。
在一个实现方式中，收发单元1102，还用于向区块链节点上传路由器的验证信息，验证信息包括以下一个或多个：路由器的证书、路由器的远程证明材料、路由器的信任级别。
本申请实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。例如收发单元可以包括接收单元和/或发送单元。
集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，该集成的单元可以作为计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)或处理器(processor)执行本申请各个实施例方法的全部或部分步骤。
如图12所示，本申请实施例还提供了一种通信装置1200的结构示意图。通信装置1200可用于实现上述方法实施例中描述的方法，可以参见上述方法实施例中的说明。例如通信装置1200能够执行上述图4至图10的方法中由移动性管理节点或路由控制节点或终端或路由器执行的各个步骤。
通信装置1200包括一个或多个处理器1201。处理器1201可以是通用处理器或者专用处理器等。 例如可以是基带处理器、或中央处理器。基带处理器可以用于对通信协议以及通信数据进行处理，中央处理器可以用于对通信装置(如，基站、终端、或芯片等)进行控制，执行软件程序，处理软件程序的数据。通信装置可以包括收发单元，用以实现信号的输入(接收)和输出(发送)。例如，收发单元可以为收发器，射频芯片等。
通信装置1200包括一个或多个处理器1201，一个或多个处理器1201可实现上述所示的实施例中的方法。可选的，处理器1201除了实现上述所示的实施例的方法，还可以实现其他功能。
一种设计中，处理器1201可以执行指令，使得装置1200执行上述方法实施例中描述的方法。指令可以全部或部分存储在处理器1201内，如指令1203可以全部或部分存储在处理器1201中，或者指令1203存储在处理器1201中，以及指令1204存储在与处理器耦合的存储器1202中，处理器1201可以同步执行指令1203和指令1204使得通信装置1200执行上述方法实施例中描述的方法。指令1203和指令1204也称为计算机程序。
在又一种可能的设计中，通信装置1200还可以包括电路，电路可以实现前述方法实施例中的功能。
在又一种可能的设计中通信装置1200中可以包括一个或多个存储器1202，其上存有指令1204，指令可在处理器1201上被运行，使得装置1200执行上述方法实施例中描述的方法。可选的，存储器1202中还可以存储有数据。可选的处理器1201中也可以存储指令和/或数据。例如，一个或多个存储器1202可以存储上述实施例中所描述的对应关系，或者上述实施例中所涉及的相关的参数或表格等。处理器和存储器可以单独设置，也可以集成在一起。
在又一种可能的设计中，装置1200还可以包括收发器1205以及天线1206。处理器1201可以称为处理单元，对装置(终端或者基站)进行控制。收发器1205可以称为收发机、收发电路、或者收发单元等，用于通过天线1206实现装置的收发功能。
处理器可以是一个通用中央处理器(central processing unit，CPU)、微处理器、特定应用集成电路(application-specific integrated circuit，ASIC)、一个或多个用于控制本申请方案程序执行的集成电路、通用处理器、数字信号处理器(digital signal processor，DSP)、现成可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以存储介质中，该存储介质位于存储器。
存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(Read-Only Memory，ROM)、可编程只读存储器(Programmable ROM，PROM)、可擦除可编程只读存储器(Erasable PROM，EPROM)、电可擦除可编程只读存储器(Electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(Random Access Memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(Static RAM，SRAM)、动态随机存取存储器(Dynamic RAM，DRAM)、同步动态随机存取存储器(Synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(Double Data Rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(Enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchronous link DRAM，SLDRAM)和直接内存总线随机存取存储器(Direct Rambus RAM，DR RAM)。应注意，本文描述的系统和方法的存储器旨在包括但不限于这些和任意其它适合类型的存储器。存储器可以是独立存在，通过通信线路与处理器相连接。存储器也可以和处理器集成在一起。
本申请实施例还提供了一种通信系统，包括移动性管理节点和路由控制节点，移动性管理节点和路由控制节点可以实现上述任一方法实施例的路径建立方法。可选地，该通信系统还包括用于终端和/或路由器，终端和/或路由器可以实现上述任一方法实施例的路径建立方法。
本申请实施例还提供了一种计算机可读介质，其上存储有计算机程序，该计算机程序被计算机执行时实现上述任一方法实施例的路径建立方法。
本申请实施例还提供了一种计算机程序产品，包括计算机程序，该计算机程序被计算机执行时实现上述任一方法实施例的路径建立方法。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。计算机程序产品包括一个或多个计算机指令。 在计算机上加载和执行计算机指令时，全部或部分地产生按照本申请实施例的流程或功能。计算机可以是上述通信装置。计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输。计算机可读存储介质可以是上述存储介质或上述存储器。
在一种可能的设计中，当上述通信装置是芯片，如网络设备中的芯片时，或者，如终端设备中的芯片时，处理单元或者处理器1201可以是一个或多个逻辑电路，收发单元或者收发器1205可以是输入输出接口，又或者称为通信接口，或者接口电路，或接口等等。或者收发器1205还可以是发送单元和接收单元，发送单元可以是输出接口，接收单元可以是输入接口，该发送单元和接收单元集成于一个单元，例如输入输出接口。如图13所示，图13所示的通信装置1300包括逻辑电路1301和接口电路1302。即上述处理单元或者处理器1201可以用逻辑电路1301实现，收发单元或者收发器1205可以用接口电路1302实现。其中，该逻辑电路1301可以为芯片、处理电路、集成电路或片上系统(system on chip，SoC)芯片等，接口电路1302可以为通信接口、输入输出接口等。本申请实施例中，逻辑电路和接口电路还可以相互耦合。对于逻辑电路和接口电路的具体连接方式，本申请实施例不作限定。
在本申请的一些实施例中，该逻辑电路1301和接口电路1302可用于执行上述网络功能或控制面功能执行的功能或操作等。接口电路1302可以用于接收来自通信装置1300之外的其它通信装置的信号并传输至逻辑电路1301或将来自逻辑电路1301的信号发送给通信装置1300之外的其它通信装置。逻辑电路1301可以通过执行代码指令用于实现上述任一方法实施例。
通信装置执行的功能或操作可以参照前述方法实施例，在此不再赘述。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、计算机软件或者二者的结合来实现，为了清楚地说明硬件和软件的可互换性，在上述说明中已经按照功能一般性地描述了各示例的组成及步骤。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为了描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另外，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口、装置或单元的间接耦合或通信连接，也可以是电的，机械的或其它的形式连接。
作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本申请实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以是两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
通过以上的实施方式的描述，所属领域的技术人员可以清楚地了解到本申请可以用硬件实现，或固件实现，或它们的组合方式来实现。当使用软件实现时，可以将上述功能存储在计算机可读介质中或作为计算机可读介质上的一个或多个指令或代码进行传输。计算机可读介质包括计算机存储介质和通信介质，其中通信介质包括便于从一个地方向另一个地方传送计算机程序的任何介质。存储介质可以是计算机能够存取的任何可用介质。
总之，以上仅为本申请技术方案的实施例而已，并非用于限定本申请的保护范围。凡在本申请的原则之内，所作的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。

Claims (33)

  1. 一种路径建立方法，其特征在于，所述方法包括：
    移动性管理节点接收来自终端的会话信息，所述会话信息包括会话的信任级别要求和所述会话的信任质量策略，所述信任质量策略用于为所述会话选择路由节点；
    所述移动性管理节点通过会话管理节点向路由控制节点发送所述会话信息；
    所述移动性管理节点接收来自所述路由控制节点的基站信息，所述基站信息用于指示满足所述信任级别要求的传输路径上的基站，所述传输路径与所述信任级别要求和所述信任质量策略有关；
    所述移动性管理节点向所述终端发送所述基站信息。
  2. 如权利要求1所述的方法，其特征在于，所述移动性管理节点接收来自终端的会话信息之前，还包括：
    所述移动性管理节点获取所述终端支持的信任级别范围和信任质量策略集合，其中所述信任级别要求是所述终端在所述信任级别范围中选择的，所述信任质量策略是所述终端在所述信任质量策略集合中选择的；
    所述移动性管理节点保存所述终端支持的信任级别范围和信任质量策略集合；
    所述移动性管理节点向所述终端发送所述信任级别范围和所述信任质量策略集合。
  3. 如权利要求2所述的方法，其特征在于，所述移动性管理节点接收来自终端的会话信息之后，所述移动性管理节点向路由控制节点发送所述会话信息之前，还包括：
    所述移动性管理节点根据所述信任级别要求、所述信任质量策略、所述信任级别范围和所述信任质量策略集合，确定为所述会话创建传输路径。
  4. 如权利要求1-3任一项所述的方法，其特征在于，所述会话信息还包括所述会话的源地址和目标地址；
    若所述源地址和所述目标地址属于同一网络，所述传输路径为域内路径；
    若所述源地址和所述目标地址属于不同网络，所述传输路径为域间路径。
  5. 如权利要求1-4任一项所述的方法，其特征在于，所述会话信息还包括基站信息集合，所述基站信息是在所述基站信息集合中选择的。
  6. 如权利要求1-5任一项所述的方法，其特征在于，所述移动性管理节点通过会话管理节点向路由控制节点发送所述会话信息之前，还包括：
    所述移动性管理节点为所述会话选择所述会话管理节点。
  7. 如权利要求1-6任一项所述的方法，其特征在于，所述基站信息携带在路径选择信息中，所述路径选择信息还包括所述传输路径的信任级别，其中所述传输路径的信任级别与所述传输路径上的路由节点的信任级别有关。
  8. 如权利要求7所述的方法，其特征在于，所述路径选择信息还包括域间路径的信息。
  9. 一种路径建立方法，其特征在于，所述方法包括：
    路由控制节点接收终端的会话信息，所述会话信息包括会话的信任级别要求和所述会话的信任质量策略，所述信任质量策略用于为所述会话选择路由节点；
    所述路由控制节点根据所述信任级别要求和所述信任质量策略，为所述会话选择传输路径；
    所述路由控制节点向所在网络的入口路由器发送所述传输路径的信任级别，其中所述传输路径的信任级别与所述传输路径上的路由节点的信任级别有关；
    所述路由控制节点向移动性管理节点发送基站信息，所述基站信息用于指示所述传输路径上的基站。
  10. 如权利要求9所述的方法，其特征在于，所述会话信息还包括所述会话的源地址和目标地址；
    若所述源地址和所述目标地址属于同一网络，所述传输路径为域内路径；
    若所述源地址和所述目标地址属于不同网络，所述传输路径为域间路径。
  11. 如权利要求9或10所述的方法，其特征在于，所述会话信息还包括基站信息集合，所述方法还包括：
    所述路由控制节点在所述基站信息集合中选择所述基站信息。
  12. 如权利要求9-11任一项所述的方法，其特征在于，所述路由控制节点接收终端的会话信息，包 括：
    所述路由控制节点接收来自会话管理节点的所述会话信息。
  13. 如权利要求9-12任一项所述的方法，其特征在于，所述基站信息携带在路径选择信息中，所述路径选择信息还包括所述传输路径的信任级别，其中所述传输路径的信任级别与所述传输路径上的路由节点的信任级别有关。
  14. 如权利要求13所述的方法，其特征在于，所述路径选择信息还包括域间路径的信息。
  15. 如权利要求14所述的方法，其特征在于，所述方法还包括：
    所述路由控制节点根据获取到的至少一个边界路由器的路由信息，确定满足所述信任级别要求的边界路由器；
    所述路由控制节点根据所述边界路由器，选择到达所述边界路由器的域内路径，以及包含所述边界路由器的域间路径。
  16. 如权利要求15所述的方法，其特征在于，所述到达所述边界路由器的域内路径包括所述入口路由器。
  17. 如权利要求15或16所述的方法，其特征在于，所述方法还包括：
    所述路由控制节点向所述边界路由器发送所述域间路径的信息。
  18. 一种路径建立方法，其特征在于，所述方法包括：
    终端向移动性管理节点发送会话信息，所述会话信息包括会话的信任级别要求和所述会话的信任质量策略，所述信任质量策略用于为所述会话选择路由节点；
    所述终端接收来自所述移动性管理节点的基站信息，所述基站信息用于指示满足所述信任级别要求的传输路径上的基站，所述传输路径与所述信任级别要求和所述信任质量策略有关；
    所述终端根据所述基站信息和所述终端连接的基站，为所述会话选择目标基站。
  19. 如权利要求18所述的方法，其特征在于，所述终端向移动性管理节点发送会话信息之前，还包括：
    所述终端获取所述终端支持的信任级别范围和信任质量策略集合；
    所述终端在所述信任级别范围中选择所述信任级别要求；
    所述终端在所述信任质量策略集合中选择所述信任质量策略。
  20. 如权利要求18或19所述的方法，其特征在于，所述会话信息还包括所述会话的源地址和目标地址；
    若所述源地址和所述目标地址属于同一网络，所述传输路径为域内路径；
    若所述源地址和所述目标地址属于不同网络，所述传输路径为域间路径。
  21. 如权利要求18-20任一项所述的方法，其特征在于，所述基站信息携带在路径选择信息中，所述路径选择信息还包括所述传输路径的信任级别，其中所述传输路径的信任级别与所述传输路径上的路由节点的信任级别有关。
  22. 如权利要求20所述的方法，其特征在于，所述路径选择信息还包括域间路径的信息。
  23. 如权利要求20所述的方法，其特征在于，所述方法还包括：
    所述终端获取所述域间路径上各路由器的验证信息，所述验证信息包括以下一个或多个：路由器的证书、路由器的远程证明材料、路由器的信任级别；
    所述终端根据所述各路由器的验证信息，验证所述域间路径上所述各路由器满足所述信任级别要求；
    所述终端确定所述域间路径为所述会话的传输路径。
  24. 如权利要求23所述的方法，其特征在于，所述终端获取所述域间路径上各路由器的验证信息，包括：
    所述终端向区块链节点发送验证信息获取请求，所述验证信息获取请求用于获取所述域间路径上各路由器的验证信息；
    所述终端接收来自所述区块链节点的所述域间路径上各路由器的验证信息。
  25. 一种路径创建方法，其特征在于，所述方法包括：
    所述路由器接收来自路由控制节点的会话的传输路径的信任级别，其中所述传输路径的信任级别与所述传输路径上的路由节点的信任级别有关；
    所述路由器接收所述会话的第一数据包；
    所述路由器根据所述信任级别，在所述传输路径上转发所述第一数据包。
  26. 如权利要求25所述的方法，其特征在于，所述方法还包括：
    所述路由器接收来自所述路由控制节点的所述会话的源地址和目标地址；
    若所述源地址和所述目标地址属于同一网络，所述传输路径为域内路径；
    若所述源地址和所述目标地址属于不同网络，所述传输路径为域间路径。
  27. 如权利要求25或26所述的方法，其特征在于，所述方法还包括：
    所述路由器接收域间路径的信息。
  28. 如权利要求25-27任一项所述的方法，其特征在于，所述方法还包括：
    所述路由器向区块链节点上传所述路由器的验证信息，所述验证信息包括以下一个或多个：所述路由器的证书、所述路由器的远程证明材料、所述路由器的信任级别。
  29. 一种通信装置，其特征在于，包括用于执行如权利要求1至28中任一项所述方法的单元或模块。
  30. 一种通信装置，其特征在于，包括处理器和接口电路，所述接口电路用于接收来自所述通信装置之外的其它通信装置的信号并传输至所述处理器或将来自所述处理器的信号发送给所述通信装置之外的其它通信装置，所述处理器通过逻辑电路或执行代码指令用于实现如权利要求1至28中任一项所述的方法。
  31. 一种计算机程序产品，其特征在于，包括计算机程序，当所述计算机程序被通信装置执行时，实现如权利要求1至28中任一项所述的方法。
  32. 一种计算机可读存储介质，其特征在于，所述存储介质中存储有计算机可读程序或指令，当所述计算机程序或指令被通信装置执行时，实现如权利要求1至28中任一项所述方法。
  33. 一种通信系统，其特征在于，包括终端、移动性管理节点、会话管理节点、路由控制节点和路由器；
    所述终端，用于向所述移动性管理节点发送会话信息，所述会话信息包括会话的信任级别要求和所述会话的信任质量策略，所述信任质量策略用于为所述会话选择路由节点；
    所述移动性管理节点，用于向所述会话管理节点发送所述会话信息；
    所述会话管理节点，用于向所述路由控制节点发送所述会话信息；
    所述路由控制节点，用于根据所述信任级别要求和所述信任质量策略，为所述会话选择传输路径；向所述路由控制节点所在网络的所述路由器发送所述传输路径的信任级别，其中所述传输路径的信任级别与所述传输路径上的路由节点的信任级别有关；以及向所述移动性管理节点发送基站信息，所述基站信息用于指示所述传输路径上的基站；
    所述移动性管理节点，还用于向所述终端发送所述基站信息；
    所述终端，还用于根据所述基站信息和所述终端连接的基站，为所述会话选择目标基站。
PCT/CN2023/119096 2022-10-13 2023-09-15 一种路径建立方法及装置 WO2024078258A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202211252717.6 2022-10-13
CN202211252717.6A CN117896798A (zh) 2022-10-13 2022-10-13 一种路径建立方法及装置

Publications (1)

Publication Number Publication Date
WO2024078258A1 true WO2024078258A1 (zh) 2024-04-18

Family

ID=90639881

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/119096 WO2024078258A1 (zh) 2022-10-13 2023-09-15 一种路径建立方法及装置

Country Status (2)

Country Link
CN (1) CN117896798A (zh)
WO (1) WO2024078258A1 (zh)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9161227B1 (en) * 2013-02-07 2015-10-13 Sprint Communications Company L.P. Trusted signaling in long term evolution (LTE) 4G wireless communication
CN106254069A (zh) * 2016-09-07 2016-12-21 广东工业大学 用于内容中心网络的多层加密隐私保护方法
US9819679B1 (en) * 2015-09-14 2017-11-14 Sprint Communications Company L.P. Hardware assisted provenance proof of named data networking associated to device data, addresses, services, and servers
CN112236987A (zh) * 2018-06-01 2021-01-15 诺基亚技术有限公司 用于分布式网络中的分散式信任评估的方法和装置
US20220141192A1 (en) * 2020-11-03 2022-05-05 Secureg System and Methods for Path-Aware and Path-Assured Secure Virtual Private Lines and Secure Network Slices using Enhanced Digital Certificates in Multi-Vendor Multi-Domain Networks

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9161227B1 (en) * 2013-02-07 2015-10-13 Sprint Communications Company L.P. Trusted signaling in long term evolution (LTE) 4G wireless communication
US9819679B1 (en) * 2015-09-14 2017-11-14 Sprint Communications Company L.P. Hardware assisted provenance proof of named data networking associated to device data, addresses, services, and servers
CN106254069A (zh) * 2016-09-07 2016-12-21 广东工业大学 用于内容中心网络的多层加密隐私保护方法
CN112236987A (zh) * 2018-06-01 2021-01-15 诺基亚技术有限公司 用于分布式网络中的分散式信任评估的方法和装置
US20220141192A1 (en) * 2020-11-03 2022-05-05 Secureg System and Methods for Path-Aware and Path-Assured Secure Virtual Private Lines and Secure Network Slices using Enhanced Digital Certificates in Multi-Vendor Multi-Domain Networks

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
GUANFENG LIU ; YAN WANG ; MEHMET A. ORGUN: "Finding K Optimal Social Trust Paths for the Selection of Trustworthy Service Providers in Complex Social Networks", WEB SERVICES (ICWS), 2011 IEEE INTERNATIONAL CONFERENCE ON, IEEE, 4 July 2011 (2011-07-04), pages 41 - 48, XP031965122, ISBN: 978-1-4577-0842-8, DOI: 10.1109/ICWS.2011.81 *

Also Published As

Publication number Publication date
CN117896798A (zh) 2024-04-16

Similar Documents

Publication Publication Date Title
KR102389683B1 (ko) 통신 방법 및 통신 장치
TWI725157B (zh) 數據傳輸的方法、基站、終端設備及中繼節點
WO2020029938A1 (zh) 安全会话方法和装置
US9532390B2 (en) Method, apparatus and system for implementing PDN connections
CN113691969B (zh) 通信方法和装置
US11533610B2 (en) Key generation method and related apparatus
WO2022022014A1 (zh) QoS流控制方法及通信装置
WO2019010702A1 (en) MANAGEMENT OF ORIENTATION, SWITCHING AND DIVISION OF ACCESS TRAFFIC
US20230254922A1 (en) Multipath transmission method and communication apparatus
KR20210024160A (ko) 통신 방법 및 장치
EP4132100A1 (en) Method and device for providing local data network information to terminal in wireless communication system
CN109510848B (zh) 一种通信系统、会话管理方法、数据发送方法及装置
WO2021058029A1 (zh) 一种控制业务流传输的方法、装置及系统
US20230132454A1 (en) Method and apparatus for supporting edge computing service for roaming ue in wireless communication system
WO2024078258A1 (zh) 一种路径建立方法及装置
CN112789896B (zh) 切换传输路径的方法及装置
CN114698145A (zh) 用于传输数据的方法和装置
WO2024037256A1 (zh) 一种业务流路由方法及装置
WO2022222748A1 (zh) 中继通信方法和装置
WO2023150974A1 (zh) Iab宿主设备以及传输迁移管理方法
WO2023116560A1 (zh) 通信的方法与装置
WO2022171043A1 (zh) 过滤规则配置和数据传输方法及相关装置
US20230224795A1 (en) Communication method and apparatus
WO2023029679A1 (zh) 第一中继节点发现方法、装置及存储介质
WO2023000798A1 (zh) 一种通信方法和装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23876463

Country of ref document: EP

Kind code of ref document: A1