WO2024083040A1 - 感知鉴权方法、装置及节点 - Google Patents

感知鉴权方法、装置及节点 Download PDF

Info

Publication number
WO2024083040A1
WO2024083040A1 PCT/CN2023/124482 CN2023124482W WO2024083040A1 WO 2024083040 A1 WO2024083040 A1 WO 2024083040A1 CN 2023124482 W CN2023124482 W CN 2023124482W WO 2024083040 A1 WO2024083040 A1 WO 2024083040A1
Authority
WO
WIPO (PCT)
Prior art keywords
perception
sensing
target
area
perceived
Prior art date
Application number
PCT/CN2023/124482
Other languages
English (en)
French (fr)
Inventor
袁雁南
Original Assignee
维沃移动通信有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 维沃移动通信有限公司 filed Critical 维沃移动通信有限公司
Publication of WO2024083040A1 publication Critical patent/WO2024083040A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
    • H04L9/3213—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority using tickets or tokens, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the present application belongs to the technical field of communication perception integration, and specifically relates to a perception authentication method, device and node.
  • Communication and perception integration means realizing the integrated design of communication and perception functions through spectrum sharing and hardware sharing in the same system. While transmitting information, the system can perceive information such as direction, distance, speed, and detect, track, and identify target devices or events.
  • the communication system and the perception system complement each other to achieve overall performance improvement and bring a better service experience.
  • the existing network performs two-way authentication between the terminal and the network for communication.
  • the purpose of the authentication and key agreement process is to achieve mutual authentication between the terminal and the network and provide key materials that can be used between the terminal and the service network in subsequent security processes.
  • the selection of the unified data management function (UDM) and the UDM information are mainly authorization and authentication information indexed by the terminal identifier.
  • perception For perception, if the receiving or sending device of the perception signal is a terminal, etc., then authorization and authentication need to perform two-way authentication of perception based on communication.
  • perception also involves perception auxiliary nodes (for example, providing perception auxiliary information such as geographic location information), perception result generation nodes (converting perception measurement results into perception results required by the requesting party), etc.
  • the relevant technology only provides an authentication method based on terminal identification, while in the perception communication integration technology, the perception device can be a network function node in addition to the terminal. Therefore, the relevant authentication method cannot be applied to the authentication in the field of perception communication integration.
  • the embodiments of the present application provide a perception authentication method, device and node, which can solve the problem that related authentication methods cannot be applied to authentication in the field of perception communication integration.
  • a perception authentication method comprising:
  • the first node obtains a sensing request and sensing authorization information corresponding to the sensing request
  • the first node performs perception authentication according to the perception authorization information; wherein the authentication result of the perception authentication is used to indicate whether to execute the perception requested by the perception request;
  • the sensing authorization information includes at least one of sensing area authorization information, sensing target authorization information and sensing device authorization information.
  • a perception authentication device comprising:
  • a first acquisition module used to acquire a sensing request and sensing authorization information corresponding to the sensing request
  • a perception authentication module used to perform perception authentication according to the perception authorization information; wherein the authentication result of the perception authentication is used to indicate whether to execute the perception requested by the perception request;
  • the sensing authorization information includes at least one of sensing area authorization information, sensing target authorization information and sensing device authorization information.
  • a first node comprising a processor and a memory, wherein the memory stores a program or instruction executable on the processor, and wherein the program or instruction, when executed by the processor, implements the steps of the method described in the first aspect.
  • a first node comprising a processor and a communication interface, wherein the communication interface is used to obtain a perception request and perception authorization information corresponding to the perception request; the processor is used to perform perception authentication based on the perception authorization information; wherein the authentication result of the perception authentication is used to indicate whether to execute the perception requested by the perception request; wherein the perception authorization information includes: at least one item of perception area authorization information, perception target authorization information and perception device authorization information.
  • a readable storage medium on which a program or instruction is stored.
  • the program or instruction is executed by a processor, the steps of the method described in the first aspect are implemented.
  • a chip comprising a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run a program or instruction to implement the method described in the first aspect.
  • a computer program/program product is provided, wherein the computer program/program product is stored in a storage medium and is executed by at least one processor to implement the steps of the method described in the first aspect.
  • the first node obtains a perception request and at least one of the perception area authorization information, the perception target authorization information, and the perception device authorization information corresponding to the perception request, performs perception authentication, and determines whether to execute the perception requested by the perception request based on the authentication result; thereby solving the authorization and authentication of the perception area, perception target, or perception device involved in the perception.
  • This embodiment can ensure the security and privacy of perception, prevent unauthorized perception of a certain area or a certain target, and prevent the perception device from being tracked or captured due to unauthorized designation of the perception device.
  • FIG1 is a block diagram of a wireless communication system to which an embodiment of the present application can be applied;
  • FIG2 is a flowchart showing the steps of the perception authentication method provided in an embodiment of the present application.
  • FIG3 is a schematic diagram showing the structure of a perception authentication device provided in an embodiment of the present application.
  • FIG4 is a schematic diagram showing the structure of a communication device provided in an embodiment of the present application.
  • FIG5 is a schematic diagram showing the structure of a network side device provided in an embodiment of the present application.
  • first, second, etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the terms used in this way are interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by “first” and “second” are generally of the same type, and the number of objects is not limited.
  • the first object can be one or more.
  • “and/or” in the specification and claims represents at least one of the connected objects, and the character “/" generally represents that the objects associated with each other are in an "or” relationship.
  • LTE Long Term Evolution
  • LTE-A Long Term Evolution
  • CDMA Code Division Multiple Access
  • TDMA Time Division Multiple Access
  • FDMA Frequency Division Multiple Access
  • OFDMA Orthogonal Frequency Division Multiple Access
  • SC-FDMA Single-carrier Frequency Division Multiple Access
  • NR new radio
  • FIG1 shows a block diagram of a wireless communication system applicable to an embodiment of the present application.
  • the wireless communication system includes a terminal 11 and a network side device 12 .
  • the terminal 11 may be a mobile phone, a tablet computer, a laptop computer or a notebook computer, a personal digital assistant (PDA), a handheld computer, a netbook, an ultra-mobile personal computer (UMPC), a mobile Internet device (MID), an augmented reality (AR)/virtual reality (VR) device, a robot, a wearable device, a vehicle user equipment (VUE), a pedestrian terminal (PUE), a smart home (a home appliance with wireless communication function, such as a refrigerator, a television, a washing machine or furniture, etc.), a game console, a personal computer (PC), a teller machine or a self-service machine and other terminal side devices, and the wearable device includes: a smart watch, a smart bracelet, a smart headset, a smart glasses, smart jewelry (smart bracelet, smart bracelet, smart ring
  • the network side device 12 may include access network equipment or core network equipment, wherein the access network equipment may also be referred to as wireless access network equipment, wireless access network (Radio Access Network, RAN), wireless access network function or wireless access network unit.
  • the access network equipment may include a base station, a wireless local area network (Wireless Local Area Network, WLAN) access point or a WiFi node, etc.
  • the base station may be referred to as a node B, an evolved node B (eNB), an access point, a base transceiver station (Base Transceiver Station, BTS), a radio base station, a radio transceiver, a basic Basic Service Set (BSS), Extended Service Set (ESS), Home Node B, Home Evolved Node B, Transmitting Receiving Point (TRP) or other appropriate terms in the field, as long as the same technical effect is achieved, the base station is not limited to specific technical vocabulary. It should be noted that in the embodiments of the present application, only the base station in the NR system is introduced as an example, and the specific type of the base station is not limited.
  • Communication and perception integration means realizing the integrated design of communication and perception functions through spectrum sharing and hardware sharing in the same system. While transmitting information, the system can perceive information such as direction, distance, speed, and detect, track, and identify target devices or events.
  • the communication system and the perception system complement each other to achieve overall performance improvement and bring a better service experience.
  • Perception capability refers to the ability of one or more devices with perception capabilities to perceive the direction, distance, speed and other information of target objects through the transmission and reception of wireless signals, or to detect, track, identify and image target objects, events or environments.
  • the perception resolution will be significantly improved compared to centimeter waves, enabling 6G networks to provide more sophisticated perception services.
  • Typical perception functions and application scenarios are shown in Table 1.
  • perception of intelligent transportation, high-precision maps, etc. is usually expressed in terms of perception range, distance resolution, angle resolution, speed resolution, and latency
  • flight intrusion detection perception is usually expressed in terms of coverage height, perception accuracy, and perception latency
  • respiratory monitoring is expressed in terms of perception distance, perception real-time, perception resolution, and perception accuracy
  • indoor intrusion detection is expressed in terms of perception distance, perception real-time, detection probability, and false alarm probability
  • gesture/posture recognition is expressed in terms of perception distance, perception real-time, and perception accuracy.
  • the service request methods of the above-mentioned perception services are different. For example, for service requests based on static areas, a certain coordinate system is used to represent the geographical location area of the content to be perceived; for service requests based on dynamic areas, M meters around a certain user equipment (UE) is used to represent the geographical location range of the content to be perceived, where M is a positive number; for continuous perception service requests of a dynamic target, a target that has been detected and continuously tracked is used to represent the perception target of the content to be perceived.
  • UE user equipment
  • the Access and Mobility Management Function requests the Authentication Server Function (AUSF) for authentication. Based on the request information from AMF, AUSF performs UE authentication. AUSF selects the Unified Data Management (UDM) and obtains authentication data from the UDM.
  • UDM Unified Data Management
  • the home network identifier such as Mobile Network Code (MNC) and Mobile Country Code (MCC)
  • MNC Mobile Network Code
  • MCC Mobile Country Code
  • SUCI Subscription Concealed Identifier
  • SUPI Subscription Permanent Identifier
  • NID network identifier
  • SNPN Stand-alone Non-Public Network
  • NG-RAN Next Generation Radio Access Network
  • the UDM NF consumer selects the UDM instance based on the SUPI range to which the UE’s SUPI belongs or based on the result of the discovery process of the Network Repository Function (NRF) using the UE’s SUPI or internal group ID as UDM discovery input.
  • NRF Network Repository Function
  • GPSI or External Group ID When the UDM NF consumer is unaware of the SUPI/SUCI (e.g. NEF), the UDM NF consumer selects the UDM instance based on the GPSI or External Group ID range to which the UE’s Generic Public Subscription Identifier (GPSI) or External Group ID belongs, or based on the result of the discovery process of the NRF using the UE’s GPSI or External Group ID as UDM discovery input.
  • GPSI Generic Public Subscription Identifier
  • the data AUSF obtains from UDM includes:
  • the AUSF sends the authentication result to the UDM, including the SUPI, the timestamp of the authentication time/type, and the serving network name, and the UDM then stores the above (SUPI, authentication result, timestamp, serving network name) authentication status information of the UE.
  • the user enters login credentials
  • the server verifies that the credentials are correct and returns a signed token.
  • the client is responsible for storing the token, which can be stored locally or in a cookie.
  • the request to the server carries this token
  • the server decodes the JWT and processes the request if the token is valid.
  • the client destroys the token.
  • the Open Authorization (OAuth) authentication and authorization process mainly includes obtaining an unauthorized Request Token; obtaining a user-authorized Request Token; and exchanging an authorized Request Token for an Access Token.
  • OAuth Open Authorization
  • the client (third-party software) requests an unauthorized RequestToken from the OAuth service provider. That is, it initiates a request to the RequestToken URL;
  • the OAuth service provider agrees to the user's request and issues an unauthorized oauth_token and the corresponding oauth_token_secret to the user, and returns it to the user;
  • the user requests the OAuth service provider for a RequestToken for user authorization. That is, a request is made to the UserAuthorization URL and the unauthorized token and its key issued by the service provider in the previous step are carried in the request;
  • the OAuth service provider requires the user to log in and guide the user to complete the authorization through the web page
  • the request parameter has one more parameter than the first step, which is the RequestToken.
  • the OAuth service provider agrees to the user's request, issues an AccessToken and the corresponding key, and returns it to the user;
  • the user can then use the AccessToken returned in the previous step to access the user-authorized resources.
  • perception For perception, if the receiving or sending device of the perception signal is a UE, etc., then authorization and authentication need to perform two-way authentication of perception based on communication.
  • perception also involves perception auxiliary nodes (for example, providing perception auxiliary information such as geographic location information), perception result generation nodes (converting perception measurement results into perception results required by the requesting party), etc.
  • perception auxiliary nodes for example, providing perception auxiliary information such as geographic location information
  • perception result generation nodes converting perception measurement results into perception results required by the requesting party
  • Different perception devices may support different functions, and even support some or all functions based on conditions. Therefore, it is necessary to further solve the authorization and authentication of the perception functions performed by the perception devices.
  • perception authorization and authentication may also involve perception targets and/or perception areas.
  • the perception target has communication capabilities (such as UE, tag, etc.), it is usually called device-based perception.
  • perception also includes device-free perception.
  • the perception targets are drones and terminals, respectively. When they are both user devices with signal sending or receiving capabilities, they belong to device-based synaesthesia scenarios.
  • the perception targets are rain and people, respectively. They are both targets that do not have signal sending or receiving capabilities, and belong to device-free synaesthesia scenarios.
  • Perception also includes perception of designated areas.
  • Perception for designated areas can perceive a certain type of perception target or no perception target, such as vehicle speed perception in highway areas, and the perception target type is vehicle speed; high-speed rail perimeter intrusion detection does not specify a certain type of perception target, and typical intrusion foreign body types can include address disasters (such as landslides, landslides, falling rocks, etc.), vehicles (such as trains, motor vehicles, etc.) and people/animals (such as pedestrians, cattle, sheep, etc.).
  • address disasters such as landslides, landslides, falling rocks, etc.
  • vehicles such as trains, motor vehicles, etc.
  • people/animals such as pedestrians, cattle, sheep, etc.
  • perception authentication needs to solve the authentication of at least one of the perception area, perception target and perception device as a basic guarantee for perception security and privacy.
  • the embodiment of the present application provides a perception authentication method, including:
  • Step 201 The first node obtains a sensing request and sensing authorization information corresponding to the sensing request;
  • Step 202 the first node performs a perception authentication according to the perception authorization information; wherein the authentication result of the perception authentication is used to indicate whether to execute the perception requested by the perception request;
  • the sensing authorization information includes at least one of sensing area authorization information, sensing target authorization information and sensing device authorization information.
  • the authentication result is passed or successful or valid, etc., it is determined to execute the perception requested by the perception request; otherwise, it is determined not to execute the perception requested by the perception request.
  • the first node is a network function node, such as at least one of a network exposure function (NEF) node, a sensing function (SF) node, an access and mobility management function (AMF) node, and an authentication service function (AUSF) node.
  • NEF network exposure function
  • SF sensing function
  • AMF access and mobility management function
  • AUSF authentication service function
  • the sensing area is an area where the network performs sensing, such as a highway area or a housing area, etc.
  • the sensing area authorization information may be provided by a sensing area owner and/or a sensing area manager.
  • the sensing target is an object sensed by the network, such as a drone terminal.
  • the sensing target has a network-recognizable identifier, it is more suitable for the network to authorize and authenticate the sensing target.
  • the sensing target authorization information can be provided by the sensing target and/or the sensing target owner and/or the manager of the sensing target.
  • the sensing device is a device that performs at least one of sensing signal transmission, sensing signal reception, sensing signal measurement, sensing assistance, and sensing result generation.
  • the sensing device may be a UE, a base station, a network function, etc.
  • the sensing device authorization information may be provided by the sensing device and/or the sensing device owner.
  • the first node obtains a perception request and at least one of the perception area authorization information, perception target authorization information, and perception device authorization information corresponding to the perception request, and performs perception authentication to determine whether to execute the perception requested by the perception request; thereby solving the authorization and authentication of the perception area, perception target, or perception device involved in the perception.
  • This embodiment can ensure the security and privacy of perception, prevent unauthorized perception of a certain area or a certain target, and prevent the perception device from being tracked or captured due to unauthorized designation of the perception device.
  • the perception area authorization information includes at least one of the following:
  • First indication information indicating that the first area allows perception
  • the first area allows a range of perception
  • Second indication information indicating that the first area is prohibited from being sensed
  • the communication information of the device with the first regional authorization authority is the device identification of the device; when the regional sensing authorization information is updated or each sensing request inquires whether to authorize, the device identification is used for the network to receive the regional sensing authorization information.
  • the regional manager may know the authorization update information or interact with the regional manager to perceive the authorization information, such as the user equipment (UE) identifier (such as SUPI or telephone number) of the regional manager, the server access address (such as Internet Protocol (IP) address and/or port number) of the regional manager, etc.
  • UE user equipment
  • IP Internet Protocol
  • the first area allows a range of perception including at least one of the following:
  • the content that the first area allows to be perceived can also be called the perception result that the first area allows to be perceived, which is the perception result required by the perception service calculated by the network based on the perception measurement data.
  • Potential perception content includes distance, speed, direction, position, trajectory, whether there is a target, environmental reconstruction, breathing monitoring, heartbeat monitoring, motion recognition, weather monitoring, air quality detection, material composition analysis, etc.;
  • the first area allows the perception measurement data to be perceived, and the perception measurement data includes at least one of the first-level measurement quantity and the second-level measurement quantity of the following perception measurement quantity;
  • the sensing request sending node allowed in the first area may also be referred to as a sensing requester, an initiator of a sensing request, a sending device of a sensing request, etc.; for example, the sensing request sending node is indicated by at least one of an IP address, a port number, and a UE ID (such as a user permanent identifier SUPI, a telephone number, etc.);
  • the perception result receiving node allowed in the first area may also be referred to as a perception result user, a perception result receiving device, etc., for example, the perception result receiving node is indicated by at least one of an IP address, a port number, and a UE ID (such as a user permanent identifier SUPI, a telephone number, etc.);
  • sensing device allowed in the first area, wherein the sensing device is a device that performs at least one of sending a sensing signal, receiving a sensing signal, measuring a sensing signal, reporting sensing auxiliary data, and generating a sensing result;
  • the first area allows a perceived quality of service (QoS), wherein the perceived quality of service QoS includes at least one of the perceived performance indicators in Table 2.
  • QoS perceived quality of service
  • the accuracy is allowed to be lower than a certain value, and the accuracy may be a perceived accuracy or a perceived resolution, etc.
  • the prohibited sensing range of the first area includes at least one of the following:
  • the content that is prohibited from being perceived in the first area can also be called the perception result that is prohibited from being perceived in the first area, and the potential perception content includes distance, speed, direction, position, trajectory, whether there is a target, environment reconstruction, breathing monitoring, heartbeat monitoring, motion recognition, weather monitoring, air quality detection, material composition analysis, etc.;
  • the first area is prohibited from sensing measurement data
  • the sensing request sending node prohibited in the first area may also be referred to as a sensing requester, an initiator of a sensing request, a sending device of a sensing request, etc.; for example, the sensing request sending node is indicated by at least one of an IP address, a port number, and a UE ID (such as a user permanent identifier SUPI, a telephone number, etc.);
  • the sensing result receiving node prohibited in the first area may also be referred to as a sensing result user, a sensing result receiving device, etc., for example, the sensing result receiving node is indicated by at least one of an IP address, a port number, and a UE ID (such as a user permanent identifier SUPI, a telephone number, etc.);
  • the sensing device prohibited in the first area is a device that performs at least one of sending a sensing signal, receiving a sensing signal, measuring a sensing signal, reporting sensing auxiliary data, and generating a sensing result;
  • the perceived quality of service QoS prohibited in the first area is, for example, prohibited when the accuracy is higher than a certain value.
  • the sensing target authorization information includes at least one of the following:
  • the communication information of the device with the first target authorization authority is the device identification of the device; when the target perception authorization information is updated or each perception request inquires whether to authorize, the device identification is used for the network to receive the target perception authorization update information or interact with it to perceive the authorization information. If the perception target is a UE, then the communication information can be the UE's SUPI/IMSI and other IDs.
  • the range in which the first target is allowed to be perceived includes at least one of the following:
  • the first target allows the content to be perceived; it can also be called the perception result allowed by the first target, which is the perception result required by the perception service calculated by the network based on the perception measurement data.
  • Potential perception content includes distance, speed, direction, position, trajectory, whether there is a target, environmental reconstruction, breathing monitoring, heartbeat monitoring, action recognition, weather monitoring, air quality detection, material composition analysis, etc.
  • the first target allows the perception measurement data to be perceived;
  • the perception measurement data includes at least one of the first level measurement quantity and the second level measurement quantity of the following perception measurement quantity;
  • the sensing request sending node allowed by the first target may also be referred to as a sensing requester, an initiator of a sensing request, a sending device of a sensing request, etc.; for example, the sensing request sending node is indicated by at least one of an IP address, a port number, and a UE ID (such as a user permanent identifier SUPI, a telephone number, etc.);
  • the perception result receiving node allowed by the first target may also be referred to as a perception result user, a perception result receiving device, etc., for example, the perception result receiving node is indicated by at least one of an IP address, a port number, and a UE ID (such as a user permanent identifier SUPI, a telephone number, etc.);
  • the sensing device allowed by the first target is a device that performs at least one of sending a sensing signal, receiving a sensing signal, measuring a sensing signal, reporting sensing auxiliary data, and generating a sensing result;
  • the first target allows a perceived service quality QoS, and the perceived service quality QoS includes at least one of the perceived performance indicators in Table 2.
  • the accuracy is allowed when it is lower than a certain value, and the accuracy can be perceived accuracy or perceived resolution.
  • the range in which the first target is prohibited from being perceived includes at least one of the following:
  • the first target prohibits the content from being perceived; it can also be called the perception result that the first target prohibits from being perceived, which is the perception result required by the perception service calculated by the network based on the perception measurement data.
  • Potential perception content includes distance, speed, Direction, location, trajectory, target presence, environment reconstruction, breathing monitoring, heartbeat monitoring, motion recognition, weather monitoring, air quality detection, material composition analysis, etc.
  • the first target prohibits the perception measurement data from being perceived, the perception measurement data comprising at least one of the first level measurement quantity and the second level measurement quantity of the following perception measurement quantities;
  • the first target prohibited sensing request sending node may also be referred to as a sensing requester, an initiator of a sensing request, a sending device of a sensing request, etc.; for example, the sensing request sending node is indicated by at least one of an IP address, a port number, and a UE ID (such as a user permanent identifier SUPI, a telephone number, etc.);
  • the first target prohibited perception result receiving node may also be referred to as a perception result user, a perception result receiving device, etc., for example, the perception result receiving node is indicated by at least one of an IP address, a port number, and a UE ID (such as a user permanent identifier SUPI, a telephone number, etc.);
  • the first target prohibits a sensing device, wherein the sensing device is a device that performs at least one of sending a sensing signal, receiving a sensing signal, measuring a sensing signal, reporting sensing auxiliary data, and generating a sensing result;
  • the first target prohibits the perceived service quality QoS, and the perceived service quality QoS includes at least one of the perceived performance indicators in Table 2. For example, it is prohibited when the accuracy is higher than a certain value, and the accuracy can be the perceived accuracy or the perceived resolution.
  • the sensing device authorization information includes at least one of the following:
  • the first device allows the scope of participation in perception
  • the first device is prohibited from participating in the sensing range.
  • the scope in which the first device is allowed to participate in the perception includes at least one of the following:
  • the first device is allowed to participate in a sensing function, wherein the sensing function includes at least one of sensing signal sending, sensing signal receiving, sensing signal measurement, sensing auxiliary data reporting, and sensing result generation;
  • eighth indication information indicating the node sending the sensing request that allows the first device to be determined to participate in sensing
  • a perception measurement quantity allowed by the first device comprising at least one of the following perception measurement quantities;
  • the first device allows the perception assistance data, and the perception assistance data includes at least one of position information, time information, speed information, and target identification information.
  • the position information is the Global Positioning System (GPS) position, the relative position based on a reference object, etc.; the time information is the absolute time or relative time, etc.; the speed information is still, low speed, high speed or a certain speed value, etc.; the target identification information is the camera image containing the target identification such as the license plate, or when the target is UE, the permanent identification such as the SUPI of the target UE; no specific limitation is made here.
  • GPS Global Positioning System
  • the range in which the first device is prohibited from participating in the sensing includes at least one of the following:
  • Tenth indication information indicating prohibiting the node sending the perception request from determining that the first device participates in the perception
  • a perception measurement quantity prohibited by the first device wherein the perception measurement quantity includes at least one of the following perception measurement quantities;
  • the first device prohibits the perception assistance data, wherein the perception assistance data includes at least one of position information, time information, speed information, and target identification information.
  • the location information is the GPS location, the relative position based on a certain reference object, etc.
  • the time information is the absolute time or the relative time, etc.
  • the speed information is the stationary, low speed, high speed or a certain speed value, etc.
  • the target identification information is the camera image containing the target identification such as the license plate, or when the target is the UE, the permanent identification such as the SUPI of the target UE; no specific limitation is made here.
  • the perceived QoS includes at least one performance indicator and corresponding information (such as numerical requirements, etc.) as shown in Table 2.
  • one potential classification method is to classify the perception measurement quantities into the following four categories (this description focuses on describing the measurement quantities, which can also be classified into three categories or unclassified, etc., and the four categories are only for illustration).
  • the third and fourth level measurement quantities below are also generally referred to as perception results.
  • the second level and/or first level measurement quantities are referred to as perception measurement data.
  • the first-level measurement quantity (received signal/original channel information), including: received signal/channel response complex result, amplitude/phase, I path/Q path and its operation results (operations include addition, subtraction, multiplication and division, matrix addition, subtraction, multiplication, matrix transposition, trigonometric relationship operation, square root operation and power operation, as well as threshold detection results, maximum/minimum value extraction results of the above operation results; operations also include Fast Fourier Transform (FFT)/Inverse Fast Fourier Transform Inverse Fast Fourier Transform (IFFT), Discrete Fourier Transform (DFT)/Inverse Discrete Fourier Transform (IDFT), 2D-FFT, 3D-FFT, matched filtering, autocorrelation operation, wavelet transform and digital filtering, as well as threshold detection results, maximum/minimum value extraction results of the above operation results, etc.);
  • FFT Fast Fourier Transform
  • IFFT Inverse Fast Fourier Transform
  • DFT Discrete Fourier Transform
  • IDFT Inverse
  • Second-level measurement quantities (basic measurement quantities), including: delay, Doppler, angle, signal strength, and their multi-dimensional combination representation;
  • Level 3 measurements including: distance, speed, angle/direction, radar cross section (RCS), acceleration;
  • Level 4 measurement quantities including: spatial position, target presence, trajectory, movement, expression, vital signs, quantity, imaging results, weather, air quality, shape, material, and composition.
  • perception function node includes at least one of the following functions:
  • a sensing service request is received, and a required sensing measurement quantity is determined according to the sensing service request.
  • perception measurement results i.e., the values of perception measurement quantities
  • the perception measurement quantities are first-level measurement quantities and/or second-level measurement quantities
  • this function is referred to as a basic perception function node.
  • a derived perception function node Receives the perception measurement result of the third-level measurement quantity, generate a perception result (fourth-level measurement quantity), respond to the perception service request, and in this application, this function is referred to as a derived perception function node
  • a perception measurement result i.e., the value of a perception measurement quantity
  • the perception measurement quantity is a first-level measurement quantity and/or a second-level measurement quantity and/or a third-level measurement quantity
  • this function is referred to as an integrated perception function node.
  • the control of perceived quality of service is to control the perception-related nodes in order to meet the perceived service QoS requirements.
  • the perception signal sending or receiving node in the mobile communication system includes network equipment (such as base stations) and user equipment UE (such as mobile phones).
  • the perception auxiliary node refers to the information used to provide perception assistance, such as perception information of other sensors, geographic location information, etc., which is used to improve the performance of wireless perception.
  • the perception link may include Uu link (base station sends/UE receives or base station receives/UE sends), side link (transmission and reception between UEs), echo link (base station sends and receives spontaneously, UE sends and receives spontaneously), and inter-base station transceiver link (transmission and reception between base stations);
  • the perception method may include base station sending and UE receiving, UE sending and base station receiving, base station sending and receiving spontaneously, transmission and reception between UEs, transmission and reception between base stations, and UE sending and receiving spontaneously.
  • a perception signal is determined, where potential perception signals include reference signals and data signals, wherein the reference signal may be a communication reference signal or a perception-specific reference signal.
  • Potential perception resources include time-frequency resources not used in communication (such as guard bands), time-frequency resources used in shared communication (such as reference signals or data signals), and time-frequency resources dedicated to perception. Further, the configuration of the perception signal needs to be determined. Potential configurations include time, frequency, and spatial resource information of the perception signal. If the node that determines the perception time-frequency resource is not the sending node of the perception signal, then send the perception signal to the sending node. Number configuration.
  • the potential configuration includes an indication of the perception signal to be measured, the number or time of the perception signal to be measured, an indication of reporting the measurement result, etc. If it is determined that the node for configuring the perception measurement amount is not a receiving and measuring node of the perception signal, then send the perception measurement amount configuration to the perception signal receiving node.
  • the perception function node After the network side determines the perception function node according to the geographical scope of the requested perception service and the geographical scope of the perception service provided by the perception function node, the perception function node needs to determine the AMF in at least one of the following cases: 1) When the UE is a perception signal sending node, a perception signal receiving node or a perception auxiliary node, and the perception target is a certain UE, the perception function node selects the AMF based on the geographical area to be perceived, and the tracking area identification code (Tracking Area identity, TAI) of the AMF requested from the network storage function (Network Repository Function, NRF), and/or the AMF ID/location; 2) When the perception data needs to be transmitted via the AMF (for example, defined as a non-access layer NAS message or the NAS layer as the transmission bearer protocol layer of the perception data), the perception function node selects the AMF based on the geographical location information of the perception node for the data to be transmitted (such as the tracking area (Tracking Area, TA
  • the method further includes at least one of the following:
  • the first node obtains the perception authorization information through the contract information; this may be referred to as option 1;
  • the first node sends a query message to the target device, and receives the sensing authorization information sent by the target device; this may be referred to as option 2;
  • the first node receives the perception authorization information sent by the target device; this may be referred to as option 3.
  • the target device includes at least one of the following:
  • a device with authorization to sense the target
  • the authorization scheme of the embodiment of the present application also includes obtaining different perception authorization information through the above-mentioned multiple options, or obtaining perception authorization information and/or updating perception authorization information through the above-mentioned multiple methods.
  • the contract information includes allowing perception or prohibiting perception. If perception is allowed, the network receives a perception request related to it and asks whether to perform perception.
  • option 1+option 3 based on the contract information, the device updates the perception authorization information through method 3.
  • the perception request carries at least one of the following information:
  • eleventh indication information indicating whether to designate a sensing device
  • the sensing request also includes list information of the specified sensing device, such as sensing device 1, which is used for sensing signal sending; sensing device 2, which is used for sensing signal reception and measurement; and sensing device 3, which is used for sensing result generation.
  • the identification of the node sending the perception request which may also be referred to as the identification of the perception requester or the identification of the initiator of the perception request;
  • the identification of the node receiving the perception result which can also be called the identification of the user of the perception result;
  • Perception content can also be understood as perception service type.
  • Potential perception content includes distance, speed, direction, position, trajectory, presence of target, environment reconstruction, breathing monitoring, heartbeat monitoring, motion recognition, weather monitoring, air quality detection, material composition analysis, etc.
  • the time information of the sensing execution can be absolute time information (Monday, 13:00-19:00) or relative time information (such as within the next month).
  • the time information can include the start time, end time or duration, etc.;
  • QoS Perceived quality of service
  • Authentication credentials also known as authorization credentials, such as a token.
  • the perception type is defined based on the perception authorization or authentication requirements.
  • a potential definition is:
  • Type 1 Perception does not require authorization for the sensing area or the sensing target, and the sensing content is public information. For example, weather monitoring. This category has low security and privacy requirements, and the result of authentication is usually to continue to perform perception.
  • Type 2 The sensing area needs to be authenticated, and the sensing target does not need to be authorized. Considering the dynamic changes of the sensing area, area overlap, or area inclusion/inclusion, in order to better protect the security and privacy of perception, Type 2 can be further divided into single authentication or dual authentication. Single authentication means that the network performs one authentication, and dual authentication means that the network performs at least two authentications.
  • Type 3 The sensing target requires authentication, and the sensing area may or may not require authorization.
  • the meaning of specifying a sensing device includes specifying a sensing device that performs at least one of sensing signal sending, sensing signal receiving, sensing signal measurement, sensing assistance, and sensing result generation. If one or more of the above items are specified, it indicates that a sensing device is specified. If any of the above items is not specified, it indicates that a sensing device is not specified.
  • the method further includes:
  • the first node uses the obtained authentication method to perform authentication verification on the authentication credentials in the perception request to determine whether to perform the perception requested by the perception request. If the authentication credentials are valid, then the perception is performed. If the authentication credentials are invalid, then the perception is rejected.
  • authentication credentials are usually time-limited, so it is recommended in the embodiments of the present application to perform authentication verification on the authentication credentials each time.
  • the first node before the first node determines whether to perform perception based on the perception authorization information, it can also authenticate the sender of the perception request and/or the receiver of the perception result. Prevent illegal perception request senders from occupying network resources and prevent illegal perception receivers from defrauding key information.
  • the network can easily authorize or authenticate based on the association between the perception target/perception request sender/perception result receiver and the UE.
  • the network needs to obtain the association between the communication information (such as IP address and port number) of the perception target/perception request sender/perception result receiver and the identity information (authorized perception target/area owner or manager) in order to receive the perception request or send the perception result.
  • the sender or receiver of the perception request is authenticated, it can be determined whether it matches the perception authorization information; if it matches the perception authorization information, perception authentication is performed based on the perception authorization information.
  • One sensing authorization scheme is that the sensing area owner/manager, sensing target/sensing target owner/manager or sensing device provide the sensing authorization information for the sensing area, sensing target or sensing device through contract information.
  • the network can determine whether to perform the requested sensing based on the contract information.
  • the AF application function
  • the network function such as NEF, AMF, SF or AUSF
  • the perception authorization information can be stored by the network function that performs authorization/authentication, or by the network function used to store authorization information (such as UDM). If it is stored by the network function used to store the authorization letter, the network function that performs authorization/authentication requests authorization/authentication information from it and feeds back the authorization/authentication result. Based on the authorization/authentication result, the network determines whether to perform perception.
  • a process based on a 5G network is briefly described as follows.
  • Step 1 AF sends a perception request message to NEF, or an internal network function (such as SMF, etc.) sends a perception request to SF, or UE sends a perception request to AMF.
  • an internal network function such as SMF, etc.
  • Step 2 if perception authorization/authentication is required, the NEF, SF or AMF corresponding to the aforementioned perception request recipient can perform perception authorization/authentication, or the NEF/SF/AMF can request authorization/authentication from the AUSF.
  • the NEF, SF or AMF corresponding to the aforementioned perception request recipient can perform perception authorization/authentication, or the NEF/SF/AMF can request authorization/authentication from the AUSF.
  • the NEF/SF/AMF/AUSF performs perception authorization/authentication:
  • the required perception authorization information for example (including at least one of the perception area, perception target or perception device).
  • the perception device authorization information is required. Otherwise, the perception device authorization information is not required here.
  • the perception device authorization information is required when the perception function SF determines the perception device to perform each perception function.
  • the name of the sensing service network of the sensing area such as Public Land Mobile Network (PLMN);
  • PLMN Public Land Mobile Network
  • Authorization information of the sensing area The content carried by the authorization information of the sensing area is detailed in the above embodiment.
  • the name of the sensing service network of the sensing target such as PLMN;
  • Authorization information of the sensing target, the content carried by the sensing area authorization information is detailed in the above embodiment.
  • the name of the service network of the sensing device such as PLMN;
  • the authorization information of the sensing device is detailed in the above embodiment.
  • One method of obtaining perception authorization information is to request the required perception authorization information from the UDM.
  • UDM selection compared with the selection based on UE-related identifiers in communication, perception needs to select UDM based on at least one of the perception area, perception target and perception device.
  • the authorization/authentication information of the required perception area, perception target or perception device is selected and stored according to the perception target identifier or the perception device identifier; another method is that the required NEF/SF/AMF/AUSF locally stores the authorization/authentication information of the required perception area, perception target or perception device, which can be the UDM sending the perception authorization information in advance to the NEF/SF/AMF/AUSF that performs authorization/authentication, or it can be through the perception area owner/manager, the perception target/perception target owner/perception target manager, and the perception device sending and storing the perception authorization information in advance in the NEF/SF/AMF/AUSF.
  • the authorization/authentication result is determined based on the perception request and the corresponding perception authorization information.
  • the perception request is to perceive the vehicle speed of a certain road area, and the initiator of the perception demand and the user of the perception result are the same, both being the traffic management department.
  • the authorization/authentication is determined to be passed, and perception can be performed.
  • the perception request is to perform respiratory monitoring perception in a certain housing area, and the initiator of the perception demand is the owner of the house, and the user of the perception result is the child of the owner of the house.
  • the authorization/authentication is determined to be passed, and perception can be performed. If the user of the perception result is not within the scope of the perception result users authorized by the perception, then it will not pass. If it does not pass, then NEF/SF/AMF rejects the perception request and does not perform perception.
  • NEF/SF/AMF/AUSF sends the authentication result to UDM
  • NEF/SF/AMF/AUSF/UDM stores the authentication status, including at least one of the perception area identifier, perception target identifier and perception device identifier, as well as the authentication result, timestamp and service network name. Optionally, it also includes one or more of the initiator of the perception demand, the user of the perception result, the perception content, the perception time and the perception QoS. For the same perception request, repeated authentication is avoided if the authorization information remains unchanged.
  • NEF/SF/AMF/AUSF/ can subscribe to the perception authorization information. Once the perception authorization information is updated, the UDM or other network functions will update the information.
  • Step 3 After authorization/authentication is passed, in one mode, NEF selects a suitable AMF and sends a perception service request message to AMF. When triggered by an internal network element, the internal network element selects a suitable AMF and sends a perception service request message to AMF.
  • NEF selects the AMF that serves the area based on the area information in the AF request.
  • NEF selects the AMF serving the area based on the target location information in the AF request; if the target itself has a UE communication module and has UE capabilities, such as a vehicle, then it can be considered that target-oriented perception is the perception of the UE's surroundings. At this time, the UE's service AMF can be selected as the AMF, and NEF obtains the AMF information serving the UE by querying the UDM.
  • NEF can select SF first, and then SF selects AMF.
  • the internal network element selects SF, and then SF selects AMF.
  • NEF selects the SF that serves the area based on the area information in the AF request.
  • NEF selects the SF serving the area based on the target location information in the AF request; If the target itself has a UE communication module and has UE capabilities, such as a vehicle, it can be considered that target-oriented perception is the perception of the UE's surroundings. At this time, the service SF of the UE can be selected as the SF, and the NEF obtains the AMF ID serving the UE by querying the UDM, and then selects the appropriate SF based on the AMF ID.
  • Step 4 AMF sends the sensing request to SF.
  • Step 5 If SF determines the sensing mode and sensing base station/UE according to the sensing request, the sensing modes are divided from the perspective of the sensing signal sending node and the receiving node, including base station self-transmission and self-reception, base station-to-base station transmission and reception, UE transmission and base station reception, base station transmission and UE reception, UE self-transmission and self-reception, and UE-to-UE transmission and reception.
  • a sensing response is returned to the SF, carrying a success indication, otherwise a failure indication is returned.
  • the sensing network element then returns a sensing response to the third-party application requesting the service.
  • Step 6 SF performs perception calculation based on the perception measurement data fed back by the base station and obtains the final perception result.
  • Step 7 SF returns the sensing result to AMF.
  • SF can return the sensing result to AF through AMF and NEF, or directly return the sensing result to AF through NEF.
  • Step 8 AMF returns the sensing result to AF through NEF.
  • AMF sends the sensing result to the internal network element.
  • a perception authorization and authentication scheme is that when a perception request is received, the network asks the corresponding device with authorization authority for the area, the device with authorization authority for the target, or the perception device whether to allow the perception to be performed based on the perception request (at least one of the perception area, perception target, or designated perception device).
  • AF application function
  • internal network function such as AMF, etc.
  • UE can send a perception request
  • the network function such as NEF, AMF, SF or AUSF
  • the network function determines the device with authorization authority for the perception area and/or perception target involved based on the perception request.
  • the network function performs perception authorization/authentication by querying the device with authorization authority. If the perception device is specified in the perception request, the network function needs to query the specified perception device for perception authorization/authentication.
  • a process based on 5G network is briefly described as follows.
  • Step 1 If perception authorization/authentication is required, the NEF, SF or AMF corresponding to the aforementioned perception request recipient can perform perception authorization/authentication, or the NEF/SF/AMF can request authorization/authentication from the AUSF.
  • the NEF/SF/AMF can request authorization/authentication from the AUSF.
  • the perception type 1 perception does not require perception area authorization/authentication and does not require perception target authorization/authentication, and the perception content is public information. For example, weather monitoring, this category has low security and privacy requirements
  • NEF/SF/AMF/AUSF sends a sensing authorization/authentication request to at least one of a device with sensing area authorization authority, a device with sensing target authorization authority, or a sensing device.
  • the sensing authorization/authentication request information is the same as the sensing request information of this technical proposal.
  • the device with the authorization authority for the perception area determines the authorization/authentication result of the perception area, the perception target or the perception device accordingly, and sends a perception authorization/authentication response.
  • the perception authorization/authentication response includes at least an indication of whether it is passed, and may optionally include a timestamp of the authentication result to prevent the authorization/authentication result from being abused by replay or the like; the validity period of the authentication result is used to avoid frequent repeated requests for the same perception authorization/authentication.
  • the device with the authorization authority for the perception area, the device with the authorization authority for the perception target or the perception device can be three different devices, or any two of them can be the same device, or all three can be the same device.
  • NEF/SF/AMF/AUSF determines whether authorization/authentication is passed based on the received perception authorization/authentication response. If passed, perception can be performed. If not, NEF/SF/AMF/AUSF rejects the perception request and does not perform perception.
  • NEF/SF/AMF/AUSF/UDM stores the authentication status, including at least one of the perception area identifier, perception target identifier and perception device identifier, as well as the authentication result, timestamp and service network name.
  • it also includes one or more of the initiator of the perception demand, the user of the perception result, the perception content, the perception time and the perception QoS. For the same perception request, repeated authentication is avoided if the authorization information remains unchanged.
  • a perception authorization and authentication scheme is that the initiator of the perception demand (perception requester) obtains the perception authorization credential from the required perception area, perception target or perception device.
  • the perception authorization credential obtained must be carried when sending a perception request.
  • the network function responsible for perception authorization/authentication obtains the authentication method of the authentication credential, or the network function responsible for perception authorization/authentication agrees on the authentication method of the authentication credential with the authorizer of the perception area/perception target/perception device through offline or message interaction. Therefore, when the network receives a perception request with an authentication credential, it authenticates based on the known authentication method to determine whether the perception is allowed.
  • the network does not need to interact with the perception area/target/device for perception authorization information, and on the other hand, the perception authorization is directly authorized by the perception area/target/device without the need for a network agent, so that the perception area/target/device has a full authorization scope, which is convenient for updating the authorization information at any time.
  • the function f() is an authentication method, and the credentials can be data and key), tokens, etc., which has good scalability.
  • the sending and receiving of the perception request and the perception process after authorization/authentication are the same as in Example 1, and will not be described in detail in this example.
  • the perception credential is a token
  • a perception authorization/authentication scheme based on the token mechanism is briefly described as follows.
  • Step 1 The initiator of the sensing demand (sensing requester) obtains the authorization token of the required sensing area, sensing target or sensing device.
  • One way to obtain it is to negotiate offline with the owner/manager of the sensing area and/or sensing target, and another way is to send a sensing authorization request to a device with sensing area authorization authority, a device with sensing target authorization authority or a sensing device to request a token.
  • Step 2 The network function responsible for sensing authentication obtains the authentication information of the sensing area, sensing target or sensing device it is responsible for.
  • One way to obtain the token is to negotiate with the owner/manager of the sensing area and/or sensing target offline, and the other way is to send a sensing authentication request to a device with sensing area authentication authority, a device with sensing target authentication authority, or a sensing device to request authentication.
  • step 1 may be performed first and then step 2, or step 2 may be performed first and then step 1, or step 1 and step 2 may be performed simultaneously.
  • Step 3 The initiator of the perception requirement sends the perception request with the obtained token information
  • Step 4 The network verifies the token information in the sensing request based on the obtained authentication method. If the token is valid, the sensing is performed. If the token is invalid, the sensing is rejected.
  • tokens are usually time-limited, so this solution recommends that tokens be authenticated each time.
  • perception area authorization information, perception target authorization information, and perception device authorization information may change due to the will of the authorizer or other reasons.
  • potential update methods include changing the signed contract or authorization agreement offline, and updating authorization/authentication information based on message interaction.
  • This implementation provides a method for updating perception authorization information, focusing on updating authorization information based on message interaction.
  • the manager/owner of the above perception area, perception target or perception device can update it through the device with perception area authorization authority, the device with perception target authorization authority or the operating system interface perception switch/setting options of the perception device, or the physical switch button of the device with perception area authorization authority, the device with perception target authorization authority or the perception device, or send a short message, or through the agreed application function (the application function can be deployed on the device with perception area authorization authority, the device with perception target authorization authority or the perception device, or the application function can be deployed in other locations) message, or.
  • the interactive process of updating the perception authorization information is briefly described as follows.
  • Step 1 At least one of a device with sensing area authorization authority, a device with sensing target authorization authority, or a sensing device or an application function sends at least one of sensing area authorization information, sensing target authorization information, and sensing device authorization information, and the authorization information is used to update the corresponding sensing authorization information and/or sensing authentication information.
  • the sensing authorization information is detailed in the technical solution, and the sensing authentication information mainly includes whether a certain sensing is allowed to be performed.
  • Step 2 After the network function node (such as UDM/NEF/SF/AMF/AUSF, etc.) responsible for maintaining the perception authorization and/or authentication information receives the perception authorization/authentication update information, it sends a message to notify the corresponding subscribed node of the perception authorization/authentication information update based on the subscription of the perception authorization/authentication.
  • the network function node such as UDM/NEF/SF/AMF/AUSF, etc.
  • Step 3 the node that subscribes to the perception authorization/authentication information perceives the authorization and/or authentication network function node (such as NEF/SF/AMF/AUSF) to obtain updated authorization/authentication information, and performs perception authorization/authentication based on the updated authorization/authentication information. If the perception authorization/authentication result is different from the result of the previous authorization/authentication, the updated perception authorization/authentication result is sent to the perception requester.
  • the authorization and/or authentication network function node such as NEF/SF/AMF/AUSF
  • the authorization/authentication update of the sensing area, sensing target or sensing device is based on credentials, it indicates whether it is for subsequent sensing applications or for the current sensing and subsequent sensing applications. If it is for subsequent sensing applications, then the responsible The network function responsible for the perception authorization/authentication uses the updated information to authenticate the newly received perception request. If it is for the current perception application, the network function needs to authenticate the ongoing perception. If the authentication result is not executed, the perception requester needs to be notified of the new perception result.
  • the perception requester is notified to update the perception authorization/authentication information (such as token), and the updated perception authentication is performed according to the updated credential information, and the authorization/authentication information updated by the receiving perception authorization/authentication is no longer notified for authentication.
  • the perception authorization/authentication information such as token
  • the first node obtains the perception request and the perception area authorization information corresponding to the perception request, the perception target authorization information and at least one of the perception device authorization information, and performs perception authentication to determine whether to execute the perception requested by the perception request; thereby solving the authorization and authentication of the perception area, perception target or perception device involved in the perception.
  • This embodiment can ensure the security and privacy of perception, prevent unauthorized perception of a certain area or a certain target, and prevent the unauthorized designation of a perception device from causing the perception device to be tracked or captured.
  • the perception authentication method provided in the embodiment of the present application can be executed by a perception authentication device.
  • the perception authentication device performing the perception authentication method is taken as an example to illustrate the perception authentication device provided in the embodiment of the present application.
  • the embodiment of the present application further provides a perception authentication device 300, including:
  • a first acquisition module 301 is used to acquire a sensing request and sensing authorization information corresponding to the sensing request;
  • a perception authentication module 302 is used to perform perception authentication according to the perception authorization information; wherein the authentication result of the perception authentication is used to indicate whether to execute the perception requested by the perception request;
  • the sensing authorization information includes at least one of sensing area authorization information, sensing target authorization information and sensing device authorization information.
  • the perception area authorization information includes at least one of the following:
  • First indication information indicating that the first area allows perception
  • the first area allows a range of perception
  • Second indication information indicating that the first area is prohibited from being sensed
  • the range of the first area allowed to be perceived includes at least one of the following:
  • the first region allows content to be perceived
  • the first region allows sensory measurement data to be sensed
  • sensing device allowed in the first area, wherein the sensing device is a device that performs at least one of sending a sensing signal, receiving a sensing signal, measuring a sensing signal, reporting sensing auxiliary data, and generating a sensing result;
  • the first area allows a perceived quality of service (QoS).
  • QoS quality of service
  • the range in which the first area is prohibited from sensing includes at least one of the following:
  • the first area prohibits the perceived content
  • the first area is prohibited from sensing measurement data
  • the sensing device prohibited in the first area is a device that performs at least one of sending a sensing signal, receiving a sensing signal, measuring a sensing signal, reporting sensing auxiliary data, and generating a sensing result;
  • the first area prohibits perceived quality of service QoS.
  • the sensing target authorization information includes at least one of the following:
  • the range in which the first target is allowed to be perceived includes at least one of the following:
  • the first objective allows content to be perceived
  • the first objective allows sensed measurement data to be sensed
  • the sensing device allowed by the first target is a device that performs at least one of sending a sensing signal, receiving a sensing signal, measuring a sensing signal, reporting sensing auxiliary data, and generating a sensing result;
  • the first objective allows for a perceived quality of service (QoS).
  • QoS quality of service
  • the range in which the first target is prohibited from being perceived includes at least one of the following:
  • the first goal prohibits the perceived content
  • the first target prohibits the sensed measurement data from being sensed
  • the first target prohibits the sending node of the perception request
  • the first target prohibited perception result receiving node
  • the first target prohibits a sensing device, wherein the sensing device is a device that performs at least one of sending a sensing signal, receiving a sensing signal, measuring a sensing signal, reporting sensing auxiliary data, and generating a sensing result;
  • the first objective prohibits perceived quality of service QoS.
  • the sensing device authorization information includes at least one of the following:
  • the first device allows the scope of participation in perception
  • the first device is prohibited from participating in the sensing range.
  • the scope in which the first device is allowed to participate in the perception includes at least one of the following:
  • the first device is allowed to participate in a sensing function, wherein the sensing function includes at least one of sensing signal sending, sensing signal receiving, sensing signal measurement, sensing auxiliary data reporting, and sensing result generation;
  • eighth indication information indicating the node sending the sensing request that allows the first device to be determined to participate in sensing
  • the first device allows the perception assistance data, and the perception assistance data includes at least one of position information, time information, speed information, and target identification information.
  • the range in which the first device is prohibited from participating in the perception includes at least one of the following:
  • Tenth indication information indicating prohibiting the node sending the perception request from determining that the first device participates in the perception
  • the first device prohibits the perception assistance data, wherein the perception assistance data includes at least one of position information, time information, speed information, and target identification information.
  • the device further includes at least one of the following modules:
  • a second acquisition module used to acquire the perception authorization information through the contract information
  • a third acquisition module is used to send inquiry information to the target device and receive the perception authorization information sent by the target device;
  • the fourth acquisition module is used to receive the perception authorization information sent by the target device
  • the target device includes at least one of the following:
  • a device with authorization to sense the target
  • the perception request carries at least one of the following information:
  • eleventh indication information indicating whether to designate a sensing device
  • QoS Perceived quality of service
  • the device when the perception request carries authentication credentials, the device further includes:
  • a fifth acquisition module used to obtain the authentication method of the authentication credential
  • the authentication module is used to use the acquired authentication method to authenticate the authentication credentials in the perception request to determine whether to execute the perception requested by the perception request.
  • the first node obtains a perception request and at least one of the perception area authorization information, perception target authorization information, and perception device authorization information corresponding to the perception request, and performs perception authentication to determine whether to execute the perception requested by the perception request; thereby solving the authorization and authentication of the perception area, perception target, or perception device involved in the perception.
  • This embodiment can ensure the security and privacy of perception, prevent unauthorized perception of a certain area or a certain target, and prevent the perception device from being tracked or captured due to unauthorized designation of the perception device.
  • the perception authentication device provided in the embodiment of the present application is a device capable of executing the above-mentioned perception authentication method. All embodiments of the above-mentioned perception authentication method are applicable to the device and can achieve the same or similar beneficial effects, which will not be repeated here.
  • the perception authentication device in the embodiment of the present application can be an electronic device, such as an electronic device with an operating system, or a component in an electronic device, such as an integrated circuit or a chip.
  • the electronic device can be a terminal, or it can be other devices other than a terminal.
  • the terminal can include but is not limited to the types of terminals 11 listed above, and other devices can be servers, network attached storage (NAS), etc., which are not specifically limited in the embodiment of the present application.
  • the perception authentication device provided in the embodiment of the present application can implement each process implemented in the method embodiments of Figures 1 to 2 and achieve the same technical effect. To avoid repetition, it will not be repeated here.
  • an embodiment of the present application also provides a communication device 400, including a processor 401 and a memory 402, and the memory 402 stores programs or instructions that can be executed on the processor 401.
  • the communication device 400 is a first node
  • the program or instruction is executed by the processor 401 to implement the various steps of the above-mentioned perception authentication method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.
  • the embodiment of the present application also provides a network side device, including a processor and a communication interface, wherein the communication interface is used to obtain a perception request and the perception authorization information corresponding to the perception request; the processor is used to perform perception authentication based on the perception authorization information to determine whether to execute the perception requested by the perception request; wherein the perception authorization information includes: at least one of the following information: perception area authorization information, perception target authorization information, and perception device authorization information.
  • the network side device embodiment corresponds to the first node side method embodiment described above, and each implementation process and implementation method of the above method embodiment can be applied to the network side device embodiment and can achieve the same technical effect.
  • the embodiment of the present application also provides a network side device.
  • the network side device 500 includes: an antenna 51, a radio frequency device 52, a baseband device 53, a processor 54 and a memory 55.
  • the antenna 51 is connected to the radio frequency device 52.
  • the radio frequency device 52 receives information through the antenna 51 and sends the received information to the baseband device 53 for processing.
  • the baseband device 53 processes the information to be sent and sends it to the radio frequency device 53.
  • Device 52, the radio frequency device 52 processes the received information and then sends it out through the antenna 51.
  • the method executed by the network-side device in the above embodiment may be implemented in the baseband device 53, which includes a baseband processor.
  • the baseband device 53 may include, for example, at least one baseband board, on which a plurality of chips are arranged, as shown in FIG5 , wherein one of the chips is, for example, a baseband processor, which is connected to the memory 55 through a bus interface to call a program in the memory 55 and execute the network device operations shown in the above method embodiment.
  • the network side device may also include a network interface 56, which is, for example, a common public radio interface (CPRI).
  • a network interface 56 which is, for example, a common public radio interface (CPRI).
  • CPRI common public radio interface
  • the network side device 500 of the embodiment of the present application also includes: instructions or programs stored in the memory 55 and executable on the processor 54.
  • the processor 54 calls the instructions or programs in the memory 55 to execute the methods executed by the modules shown in Figure 3 and achieve the same technical effect. To avoid repetition, it will not be repeated here.
  • An embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored.
  • a program or instruction is stored.
  • the various processes of the above-mentioned perception authentication method embodiment are implemented and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.
  • the processor is the processor in the terminal described in the above embodiment.
  • the readable storage medium includes a computer readable storage medium, such as a computer read-only memory ROM, a random access memory RAM, a magnetic disk or an optical disk.
  • An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned perception authentication method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.
  • the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.
  • the embodiment of the present application further provides a computer program/program product, which is stored in a storage medium.
  • the computer program/program product is executed by at least one processor to implement the various processes of the above-mentioned perception authentication method embodiment and can achieve the same technical effect. To avoid repetition, it will not be repeated here.
  • the above embodiment method can be It can be implemented by means of software plus a necessary general hardware platform, or by hardware, but in many cases the former is a better implementation method.
  • the technical solution of the present application, or the part that contributes to the prior art can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM/RAM, disk, CD), and includes several instructions for enabling a terminal (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请公开了一种感知鉴权方法、装置及节点，属于感知通信一体化技术领域，本申请实施例的感知鉴权方法包括：第一节点获取感知请求以及所述感知请求对应的感知授权信息；所述第一节点根据所述感知授权信息，进行感知鉴权；其中，所述感知鉴权的鉴权结果用于指示是否执行所述感知请求所请求的感知；其中，所述感知授权信息包括：感知区域授权信息，感知目标授权信息以及感知设备授权信息中的至少一项信息。

Description

感知鉴权方法、装置及节点
相关申请的交叉引用
本申请主张在2022年10月20日在中国提交的中国专利申请No.202211289252.1的优先权，其全部内容通过引用包含于此。
技术领域
本申请属于通信感知一体化技术领域，具体涉及一种感知鉴权方法、装置及节点。
背景技术
通信感知一体化即在同一系统中通过频谱共享与硬件共享，实现通信、感知功能一体化设计，系统在进行信息传递的同时，能够感知方位、距离、速度等信息，对目标设备或事件进行检测、跟踪、识别，通信系统与感知系统相辅相成，实现整体性能上的提升并带来更好的服务体验。
现有网络面向通信进行终端和网络之间的双向鉴权，认证和密钥协议过程的目的是实现终端和网络之间的相互认证，并提供在后续安全过程中可以在终端和服务网络之间使用的密钥材料。统一数据管理功能(Unified Data Management，UDM)的选择和UDM信息主要是以终端标识为索引的授权和鉴权信息。
对于感知而言，如果感知信号的收或发设备是终端等，那么授权和鉴权需要在通信基础上进行感知的双向鉴权。感知除了涉及前述感知信号发送或接收外，还涉及感知辅助节点(例如提供地理位置信息等感知辅助信息)、感知结果生成节点(将感知测量结果转换为请求方所需的感知结果)等。也就是说，相关技术仅提供了基于终端标识的鉴权方法，而在感知通信一体化技术中，感知设备除了终端之外，还可以是网络功能节点，因此，相关鉴权方法无法适用感知通信一体化领域中的鉴权。
发明内容
本申请实施例提供一种感知鉴权方法、装置及节点，能够解决相关鉴权方法无法适用感知通信一体化领域中的鉴权的问题。
第一方面，提供了一种感知鉴权方法，包括：
所述第一节点获取感知请求以及所述感知请求对应的感知授权信息；
所述第一节点根据所述感知授权信息，进行感知鉴权；其中，所述感知鉴权的鉴权结果用于指示是否执行所述感知请求所请求的感知；
其中，所述感知授权信息包括：感知区域授权信息，感知目标授权信息以及感知设备授权信息中的至少一项信息。
第二方面，提供了一种感知鉴权装置，包括：
第一获取模块，用于获取感知请求以及所述感知请求对应的感知授权信息；
感知鉴权模块，用于根据所述感知授权信息，进行感知鉴权；其中，所述感知鉴权的鉴权结果用于指示是否执行所述感知请求所请求的感知；
其中，所述感知授权信息包括：感知区域授权信息，感知目标授权信息以及感知设备授权信息中的至少一项信息。
第三方面，提供了一种第一节点，该第一节点包括处理器和存储器，所述存储器存储可在所述处理器上运行的程序或指令，所述程序或指令被所述处理器执行时实现如第一方面所述的方法的步骤。
第四方面，提供了一种第一节点，包括处理器及通信接口，其中，所述通信接口用于获取感知请求以及所述感知请求对应的感知授权信息；所述处理器用于根据所述感知授权信息，进行感知鉴权；其中，所述感知鉴权的鉴权结果用于指示是否执行所述感知请求所请求的感知；其中，所述感知授权信息包括：感知区域授权信息，感知目标授权信息以及感知设备授权信息中的至少一项信息。
第五方面，提供了一种可读存储介质，所述可读存储介质上存储程序或指令，所述程序或指令被处理器执行时实现如第一方面所述的方法的步骤。
第六方面，提供了一种芯片，所述芯片包括处理器和通信接口，所述通信接口和所述处理器耦合，所述处理器用于运行程序或指令，实现如第一方面所述的方法。
第七方面，提供了一种计算机程序/程序产品，所述计算机程序/程序产品被存储在存储介质中，所述计算机程序/程序产品被至少一个处理器执行以实现如第一方面所述的方法的步骤。
在本申请实施例中，第一节点获取感知请求以及所述感知请求对应的感知区域授权信息，感知目标授权信息以及感知设备授权信息中的至少一项，进行感知鉴权，从而基于鉴权结果确定是否执行所述感知请求所请求的感知；从而解决感知中涉及的感知区域、感知目标或感知设备的授权和鉴权。本实施例能够保障感知的安全和隐私，防止未经授权对某个区域或某个目标进行感知，防止未经授权指定感知设备引起感知设备被追踪或捕获。
附图说明
图1表示本申请实施例可应用的一种无线通信系统的框图；
图2表示本申请实施例提供的感知鉴权方法的步骤流程图；
图3表示本申请实施例提供的感知鉴权装置的结构示意图；
图4表示本申请实施例提供的通信设备的结构示意图；
图5表示本申请实施例提供的网络侧设备的结构示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚描述，显然，所描述的实施例是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员所获得的所有其他实施例，都属于本申请保护的范围。
本申请的说明书和权利要求书中的术语“第一”、“第二”等是用于区别类似的对象，而不用于描述特定的顺序或先后次序。应该理解这样使用的术语在适当情况下可以互换，以便本申请的实施例能够以除了在这里图示或描述的那些以外的顺序实施，且“第一”、“第二”所区别的对象通常为一类，并不限定对象的个数，例如第一对象可以是一个，也可以是多个。此外，说明书以及权利要求中“和/或”表示所连接对象的至少其中之一，字符“/”一般表示前后关联对象是一种“或”的关系。
值得指出的是，本申请实施例所描述的技术不限于长期演进型(Long Term Evolution，LTE)/LTE的演进(LTE-Advanced，LTE-A)系统，还可用于其他无线通信系统，诸如码分多址(Code Division Multiple Access，CDMA)、时分多址(Time Division Multiple Access，TDMA)、频分多址(Frequency Division Multiple Access，FDMA)、正交频分多址(Orthogonal Frequency Division Multiple Access，OFDMA)、单载波频分多址(Single-carrier Frequency Division Multiple Access，SC-FDMA)和其他系统。本申请实施例中的术语“系统”和“网络”常被可互换地使用，所描述的技术既可用于以上提及的系统和无线电技术，也可用于其他系统和无线电技术。以下描述出于示例目的描述了新空口(New Radio，NR)系统，并且在以下大部分描述中使用NR术语，但是这些技术也可应用于NR系统应用以外的应用，如第6代(6th Generation，6G)通信系统。
图1示出本申请实施例可应用的一种无线通信系统的框图。无线通信系统包括终端11和网络侧设备12。其中，终端11可以是手机、平板电脑(Tablet Personal Computer)、膝上型电脑(Laptop Computer)或称为笔记本电脑、个人数字助理(Personal Digital Assistant，PDA)、掌上电脑、上网本、超级移动个人计算机(ultra-mobile personal computer，UMPC)、移动上网装置(Mobile Internet Device，MID)、增强现实(augmented reality，AR)/虚拟现实(virtual reality，VR)设备、机器人、可穿戴式设备(Wearable Device)、车载设备(Vehicle User Equipment，VUE)、行人终端(Pedestrian User Equipment，PUE)、智能家居(具有无线通信功能的家居设备，如冰箱、电视、洗衣机或者家具等)、游戏机、个人计算机(personal computer，PC)、柜员机或者自助机等终端侧设备，可穿戴式设备包括：智能手表、智能手环、智能耳机、智能眼镜、智能首饰(智能手镯、智能手链、智能戒指、智能项链、智能脚镯、智能脚链等)、智能腕带、智能服装等。需要说明的是，在本申请实施例并不限定终端11的具体类型。网络侧设备12可以包括接入网设备或核心网设备，其中，接入网设备也可以称为无线接入网设备、无线接入网(Radio Access Network,RAN)、无线接入网功能或无线接入网单元。接入网设备可以包括基站、无线局域网(Wireless Local Area Network，WLAN)接入点或WiFi节点等，基站可被称为节点B、演进节点B(eNB)、接入点、基收发机站(Base Transceiver Station，BTS)、无线电基站、无线电收发机、基本 服务集(Basic Service Set，BSS)、扩展服务集(Extended Service Set，ESS)、家用B节点、家用演进型B节点、发送接收点(Transmitting Receiving Point，TRP)或所述领域中其他某个合适的术语，只要达到相同的技术效果，所述基站不限于特定技术词汇，需要说明的是，在本申请实施例中仅以NR系统中的基站为例进行介绍，并不限定基站的具体类型。
为了方便理解，以下对本申请实施例涉及的一些内容进行说明：
一、通信感知一体化：
通信感知一体化即在同一系统中通过频谱共享与硬件共享，实现通信、感知功能一体化设计，系统在进行信息传递的同时，能够感知方位、距离、速度等信息，对目标设备或事件进行检测、跟踪、识别，通信系统与感知系统相辅相成，实现整体性能上的提升并带来更好的服务体验。
未来移动通信系统，例如，超5代(Beyond 5G，B5G)移动通信系统或6G移动通信系统等，除了具备通信能力外，还将具备感知能力。感知能力，即具备感知能力的一个或多个设备，能够通过无线信号的发送和接收，来感知目标物体的方位、距离、速度等信息，或者对目标物体、事件或环境等进行检测、跟踪、识别、成像等。未来随着毫米波、太赫兹等具备高频段大带宽能力的小基站在6G网络的部署，感知的分辨率相比厘米波将明显提升，从而使得6G网络能够提供更精细的感知服务。典型的感知功能与应用场景如表1所示。
上述感知业务的服务质量要求的表述各不相同，例如智能交通、高精地图等感知通常以感知范围、距离分辨率、角度分辨率、速度分辨率和时延等来表达；飞行入侵检测感知通常以覆盖高度、感知精度、感知时延来表达；呼吸监测以感知距离、感知实时性、感知分辨率和感知精度来表达；室内入侵检测以感知距离、感知实时性、检测概率和虚警概率来表达；手势/姿态识别以感知距离、感知实时性、感知精度来表达。
上述感知业务的服务请求方式各不相同，例如基于静态区域的服务请求，以某个坐标系表示需感知内容的地理位置区域；基于动态区域的服务请求，以某个用户设备(User Equipment，UE)周围M米表示需要感知内容的地理位置范围，M为正数；某个动态目标的连续感知服务请求，以某个已检测和持续位置追踪的目标表示需要感知内容的感知目标。
表1

二、通信过程中UE注册和鉴权
在UE和网络的注册过程中，如果需要进行鉴权(authentication)，那么接入和移动管理功能(Access and Mobility Management Function，AMF)请求鉴权服务功能(Authentication Server Function，AUSF)进行鉴权。基于AMF的请求信息，AUSF执行UE鉴权。AUSF选择统一数据管理实体(Unified Data Management，UDM)，并从UDM获取鉴权数据。其中UDM选择主要根据如下至少一项：
1.签约加密标识(Subscription Concealed Identifier，SUCI)/签约永久标识(Subscription Permanent Identifier，SUPI)的归属网络标识符(如移动网络码(Mobile Network Code，MNC)和移动国家码(Mobile Country Code，MCC))，以及独立非公共网络(Stand-alone Non-Public Network，SNPN)的网络标识(Network identifier，NID)(由下一代无线接入网(Next Generation Radio Access Network，NG-RAN)提供)和UE的路由指示符。
2.终端的SUPI的UDM组ID。
3.SUPI或内部组ID；UDM NF消费者根据UE的SUPI所属的SUPI范围或基于使用UE的SUPI或内部组ID作为UDM发现输入的网络存储功能(Network Repository Function，NRF)的发现过程的结果选择UDM实例。
4.GPSI或外部组ID；当UDM NF消费者不知道SUPI/SUCI(例如NEF)时，UDM NF消费者根据UE的一般公共签约标识(Generic Public Subscription Identifier，GPSI)或外部组ID所属的GPSI或外部组ID范围选择UDM实例，或基于使用UE的GPSI或外部组ID作为UDM发现输入的NRF的发现过程的结果。
AUSF从UDM获取的数据包括：
SUCI或SUPI；
服务网络名称；
如果从安全锚功能(Security Anchor Functionality，SEAF)收到，灾难漫游服务指示。；
AUSF将鉴权结果发送给UDM，包括SUPI、鉴权时间/类型的时间戳和服务网络名称，进而UDM存储UE的上述(SUPI，认证结果，时间戳，服务网络名称)鉴权状态信息。
三、鉴权方式说明
1.凭据(Token)鉴权(认证)过程：
用户输入登陆凭据；
服务器验证凭据是否正确，然后返回一个经过签名的令牌(token)；
客户端负责存储token，可以存在本地存储，或者cookie中
对服务器的请求带上这个token；
服务器对JWT进行解码，如果token有效，则处理该请求；
一旦用户登出，客户端销毁token。
2.开放授权协议(Open Authorization，OAuth)鉴权(认证)和授权过程主要包括获取未授权的Request Token(请求Token)；获取用户授权的Request Token；用授权的Request Token换取Access Token(访问Token)，具体阐述如下：
客户端(第三方软件)向OAuth服务提供商请求未授权的RequestToken。即向RequestToken URL发起请求；
OAuth服务提供商同意使用者的请求，并向其颁发未经用户授权的oauth_token与对应的oauth_token_secret，并返回给使用者；
使用者向OAuth服务提供商请求用户授权的RequestToken。即向UserAuthorization URL发起请求并在请求中携带上一步服务提供商颁发的未授权的token与其密钥；
OAuth服务提供商通过网页要求用户登录并引导用户完成授权；
RequestToken授权后，使用者将向AccessToken URL发起请求，将上步授权的RequestToken换取成AccessToken。请求的参数比第一步多了一个参数就是RequestToken；
OAuth服务提供商同意使用者的请求，并向其颁发AccessToken与对应的密钥，并返回给使用者；
使用者以后就可以使用上步返回的AccessToken访问用户授权的资源。
下面结合附图，通过一些实施例及其应用场景对本申请实施例提供的感知鉴权方法进行详细地说明。
对于感知而言，如果感知信号的收或发设备是UE等，那么授权和鉴权需要在通信基础上进行感知的双向鉴权。感知除了涉及前述感知信号发送或接收外，还涉及感知辅助节点(例如提供地理位置信息等感知辅助信息)、感知结果生成节点(将感知测量结果转换为请求方所需的感知结果)等。不同的感知设备可能支持不同的功能，甚至是基于条件支持某些或全部功能。因此，需要进一步解决感知设备的所执行感知功能的授权(authorization)和鉴权。
同时，感知授权和鉴权还可能涉及感知目标和/或感知区域。如果感知目标具备通信能力(如UE，标签tag等)，那么通常称为基于设备的(device-based)感知。此外，感知还包括无设备(device-free)感知。例如在飞行路径管理、基站和终端波束管理中，其感知目标分别是无人机和终端，他们均是具备信号发送或接收能力的用户设备时，属于基于设备通感场景。在天气监测和呼吸监测中，其感知目标分别是降雨和人，他们均是不具备信号发送或接收能力的目标，属于无设备通感场景。感知还包括指定区域的感知，面向指定区域的感知可以感知某一类感知目标也可以没有感知目标，例如高速公路区域的车辆速度感知，感知目标类型是车辆速度；高铁周界入侵检测没有指定的某一类感知目标，典型的入侵异物类型可以包括地址灾害(如塌方、滑坡、落石等)、车辆(如列车、机动车辆等)和人/动物(如行人、牛、羊等)。
因此，感知鉴权需解决感知区域、感知目标和感知设备中至少一项的鉴权，作为感知安全隐私的基本保障。
如图2所示，本申请实施例提供一种感知鉴权方法，包括：
步骤201，第一节点获取感知请求以及所述感知请求对应的感知授权信息；
步骤202，所述第一节点根据所述感知授权信息，进行感知鉴权；其中，所述感知鉴权的鉴权结果用于指示是否执行所述感知请求所请求的感知；
其中，所述感知授权信息包括：感知区域授权信息，感知目标授权信息以及感知设备授权信息中的至少一项信息。
可选地，若鉴权结果为通过或成功或有效等，则确定执行所述感知请求所请求的感知；否则，确定不执行所述感知请求所请求的感知。
可选地，第一节点为网络功能节点，如网络开放功能(Network Exposure Function，NEF)节点、感知功能(Sensing Function，SF)节点、接入和移动管理功能(Access and Mobility Management Function，AMF)节点、鉴权服务功能(Authentication Server Function，AUSF)节点中至少一项。
可选地，感知区域是网络进行感知的区域，例如高速路区域或某个房屋区域等。感知区域授权信息可以由感知区域所有者和/或感知区域的管理者提供。
可选地，感知目标是网络进行感知的对象，例如无人机终端等。当感知目标具有网络可识别标识时，更适合于网络对感知目标进行授权和鉴权。感知目标授权信息可以由感知目标和/或感知目标所有者和/或感知目标的管理者提供。
可选地，感知设备是进行感知信号发送、感知信号接收、感知信号测量、感知辅助和感知结果生成中至少一项功能的设备。感知设备可以是UE、基站、网络功能等。感知设备授权信息可以由感知设备和/或感知设备所有者提供。
在本申请实施例中，第一节点获取感知请求以及所述感知请求对应的感知区域授权信息，感知目标授权信息以及感知设备授权信息中的至少一项，进行感知鉴权，从而确定是否执行所述感知请求所请求的感知；从而解决感知中涉及的感知区域、感知目标或感知设备的授权和鉴权。本实施例能够保障感知的安全和隐私，防止未经授权对某个区域或某个目标进行感知，防止未经授权指定感知设备引起感知设备被追踪或捕获。
在本申请的至少一个实施例中，所述感知区域授权信息包括以下至少一项：
指示第一区域允许感知的第一指示信息；
所述第一区域允许感知的范围；
指示第一区域禁止感知的第二指示信息；
所述第一区域禁止感知的范围；
具有所述第一区域授权权限的设备的通信信息。
例如，具有所述第一区域授权权限的设备的通信信息为该设备的设备标识；当该区域感知授权信息更新或者每次感知请求询问是否授权时，该设备标识用于网络接收该区域感 知授权更新信息或与其交互感知授权信息。例如该区域管理者的用户设备(UE)标识(如SUPI或电话号码)等，该区域管理者的服务器访问地址(如互联网协议(Internet Protocol，IP)地址和/或端口号)等。
可选地，所述第一区域允许感知的范围包括以下至少一项：
所述第一区域允许被感知的内容；也可以称为该第一区域允许被感知的感知结果，是网络基于感知测量数据计算出感知业务所需的感知结果。潜在的感知内容包括距离、速度、朝向、位置、轨迹、是否存在目标、环境重构、呼吸监测、心跳监测、动作识别、天气监测、空气质量检测、物质成分分析等；
所述第一区域允许被感知的感知测量数据，所述感知测量数据包括下述感知测量量的第一级测量量和第二级测量量中的至少一项；
所述第一区域允许的感知请求发送节点，也可以称为感知请求方、感知请求的发起者、感知请求的发送设备等；例如通过IP地址、端口号、UE ID(如用户永久标识符SUPI、电话号码等)中的至少一项指示感知请求发送节点；
所述第一区域允许的感知结果接收节点，也可以称为感知结果使用者、感知结果的接收设备等，例如通过IP地址、端口号、UE ID(如用户永久标识符SUPI、电话号码等)中的至少一项指示感知结果接收节点；
所述第一区域允许的感知设备，所述感知设备是进行感知信号发送、感知信号接收、感知信号测量、感知辅助数据上报和感知结果生成中至少一项的设备；
所述第一区域允许感知的时间；
所述第一区域允许的感知服务质量(Quality of service，QoS)，所述感知服务质量QoS至少包括表2感知性能指标中的一项。例如精度低于某一数值情况下允许，所述精度可以是感知精度或感知分辨率等。
可选地，所述第一区域禁止感知的范围包括以下至少一项：
所述第一区域禁止被感知的内容；也可以称为该第一区域禁止被感知的感知结果，潜在的感知内容包括距离、速度、朝向、位置、轨迹、是否存在目标、环境重构、呼吸监测、心跳监测、动作识别、天气监测、空气质量检测、物质成分分析等；
所述第一区域禁止被感知的感知测量数据；
所述第一区域禁止的感知请求发送节点，也可以称为感知请求方、感知请求的发起者、感知请求的发送设备等；例如通过IP地址、端口号、UE ID(如用户永久标识符SUPI、电话号码等)中的至少一项指示感知请求发送节点；
所述第一区域禁止的感知结果接收节点，也可以称为感知结果使用者、感知结果的接收设备等，例如通过IP地址、端口号、UE ID(如用户永久标识符SUPI、电话号码等)中的至少一项指示感知结果接收节点；
所述第一区域禁止的感知设备，所述感知设备是进行感知信号发送、感知信号接收、感知信号测量、感知辅助数据上报和感知结果生成中至少一项的设备；
所述第一区域禁止感知的时间；
所述第一区域禁止的感知服务质量QoS,例如精度高于某一数值情况下禁止。
在本申请的至少一个实施例中，所述感知目标授权信息包括以下至少一项：
指示第一目标允许被感知的第三指示信息；
所述第一目标允许被感知的范围；
指示所述第一目标禁止被感知的第四指示信息；
所述第一目标禁止被感知的范围；
具有所述第一目标授权权限的设备的通信信息。
例如，具有所述第一目标授权权限的设备的通信信息为该设备的设备标识；当该目标感知授权信息更新或者每次感知请求询问是否授权时，该设备标识用于网络接收该目标感知授权更新信息或与其交互感知授权信息。如果感知目标为UE时，那么该通信信息可以是UE的SUPI/IMSI等ID。
可选地，所述第一目标允许被感知的范围包括以下至少一项：
所述第一目标允许被感知的内容；也可以称为该第一目标允许被感知的感知结果，是网络基于感知测量数据计算出感知业务所需的感知结果。潜在的感知内容包括距离、速度、朝向、位置、轨迹、是否存在目标、环境重构、呼吸监测、心跳监测、动作识别、天气监测、空气质量检测、物质成分分析等；
所述第一目标允许被感知的感知测量数据；所述感知测量数据包括下述感知测量量的第一级测量量和第二级测量量中的至少一项；
所述第一目标允许的感知请求发送节点，也可以称为感知请求方、感知请求的发起者、感知请求的发送设备等；例如通过IP地址、端口号、UE ID(如用户永久标识符SUPI、电话号码等)中的至少一项指示感知请求发送节点；
所述第一目标允许的感知结果接收节点，也可以称为感知结果使用者、感知结果的接收设备等，例如通过IP地址、端口号、UE ID(如用户永久标识符SUPI、电话号码等)中的至少一项指示感知结果接收节点；
所述第一目标允许的感知设备，所述感知设备是进行感知信号发送、感知信号接收、感知信号测量、感知辅助数据上报和感知结果生成中至少一项的设备；
所述第一目标允许感知的时间；
所述第一目标允许被感知的区域；
所述第一目标允许的感知服务质量QoS，所述感知服务质量QoS至少包括表2感知性能指标中的一项。例如精度低于某一数值情况下允许，所述精度可以是感知精度或感知分辨率等。
可选地，所述第一目标禁止被感知的范围包括以下至少一项：
所述第一目标禁止被感知的内容；也可以称为该第一目标禁止被感知的感知结果，是网络基于感知测量数据计算出感知业务所需的感知结果。潜在的感知内容包括距离、速度、 朝向、位置、轨迹、是否存在目标、环境重构、呼吸监测、心跳监测、动作识别、天气监测、空气质量检测、物质成分分析等；
所述第一目标禁止被感知的感知测量数据，所述感知测量数据包括下述感知测量量的第一级测量量和第二级测量量中的至少一项；
所述第一目标禁止许的感知请求发送节点，也可以称为感知请求方、感知请求的发起者、感知请求的发送设备等；例如通过IP地址、端口号、UE ID(如用户永久标识符SUPI、电话号码等)中的至少一项指示感知请求发送节点；
所述第一目标禁止的感知结果接收节点，也可以称为感知结果使用者、感知结果的接收设备等，例如通过IP地址、端口号、UE ID(如用户永久标识符SUPI、电话号码等)中的至少一项指示感知结果接收节点；
所述第一目标禁止许的感知设备，所述感知设备是进行感知信号发送、感知信号接收、感知信号测量、感知辅助数据上报和感知结果生成中至少一项的设备；
所述第一目标禁止感知的时间；
所述第一目标禁止被感知的区域；
所述第一目标禁止的感知服务质量QoS,所述感知服务质量QoS至少包括表2感知性能指标中的一项。例如精度高于某一数值情况下禁止，所述精度可以是感知精度或感知分辨率等。
在本申请的至少一个实施例中，所述感知设备授权信息包括以下至少一项：
指示第一设备允许参与感知的第五指示信息；
所述第一设备允许参与感知的范围；
指示第一设备禁止参与感知的第六指示信息；
所述第一设备禁止参与感知的范围。
可选地，所述第一设备允许参与感知的范围包括以下至少一项：
所述第一设备允许参与的感知功能，所述感知功能包括感知信号发送、感知信号接收、感知信号测量、感知辅助数据上报和感知结果生成中至少一项；
指示所述第一设备允许被感知请求发送节点确定参与感知的第七指示信息；
指示允许确定所述第一设备参与感知的感知请求发送节点的第八指示信息；
所述第一设备允许的感知测量量，所述感知测量量包括下述感知测量量中至少一项；
所述第一设备允许的感知辅助数据，所述感知辅助数据包括位置信息、时间信息、速度信息、目标标识信息中至少一项。
其中，位置信息为全球卫星定位系统(Global Positioning System，GPS)位置、基于某一参照物的相对位置等；时间信息为绝对时间或相对时间等；速度信息为静止、低速、高速或者某一速度数值等；目标标识信息是包含车牌等目标标识的摄像头图像，或者当目标为UE时，该目标UE的SUPI等永久标识；在此不做具体限定。
可选地，所述第一设备禁止参与感知的范围包括以下至少一项：
指示所述第一设备禁止被感知请求发送节点确定参与感知的第九指示信息；
指示禁止确定所述第一设备参与感知的感知请求发送节点的第十指示信息；
所述第一设备禁止的感知测量量，所述感知测量量包括下述感知测量量中至少一项；
所述第一设备禁止的感知辅助数据，所述感知辅助数据包括位置信息、时间信息、速度信息、目标标识信息中至少一项。
其中，位置信息为GPS位置、基于某一参照物的相对位置等；时间信息为绝对时间或相对时间等；速度信息为静止、低速、高速或者某一速度数值等；目标标识信息是包含车牌等目标标识的摄像头图像，或者当目标为UE时，该目标UE的SUPI等永久标识；在此不做具体限定。
需要说明的是，所述感知QoS包括如表2所示的至少一项性能指标和对应的信息(如数值要求等)。
表2，感知性能指标的定义
需要说明的是，一种潜在的分类方式是将感知测量量分为以下4类(本说明侧重于说明测量量，也可以分为3类或不分类等，4类仅做示意)。根据感知测量量与感知业务的关系，下方第三和四级测量量通常也被称为感知结果。第二级和/或第一级测量量被称为感知测量数据。
a)第一级测量量(接收信号/原始信道信息)，包括：接收信号/信道响应复数结果，幅度/相位，I路/Q路及其运算结果(运算包括加减乘除、矩阵加减乘、矩阵转置、三角关系运算、平方根运算和幂次运算等，以及上述运算结果的门限检测结果、最大/最小值提取结果等；运算还包括快速傅里叶变换(Fast Fourier Transform，FFT)/快速傅里叶逆变 换(Inverse Fast Fourier Transform，IFFT)、离散傅里叶变换(Discrete Fourier Transform，DFT)/离散傅里叶逆变换(Inverse Discrete Fourier Transform，IDFT)、2D-FFT、3D-FFT、匹配滤波、自相关运算、小波变换和数字滤波等，以及上述运算结果的门限检测结果、最大/最小值提取结果等)；
b)第二级测量量(基本测量量)，包括：时延、多普勒、角度、信号强度，及其多维组合表示；
c)第三级测量量(基本属性/状态)，包括：距离、速度、角度/朝向、雷达散射截面(Radar Cross section，RCS)、加速度；
d)第四级测量量(进阶属性/状态)，包括：空间位置、目标是否存在、轨迹、动作、表情、生命体征、数量、成像结果、天气、空气质量、形状、材质、成分。
需要说明的是，感知功能节点包括如下至少一项功能：
接收感知服务请求，根据感知服务请求确定所需的感知测量量。
接收感知测量结果(即感知测量量的值)，其中感知测量量为第一级测量量和/或第二级测量量，产生感知结果(第三级测量量)，响应感知服务请求，在本申请中将这一功能称为基础感知功能节点
接收所述第三级测量量的感知测量结果，产生感知结果(第四级测量量)，响应感知服务请求，在本申请中将这一功能从称为衍生感知功能节点
接收感知测量结果(即感知测量量的值)，其中感知测量量为第一级测量量和/或第二级测量量和/或第三级测量量，产生感知结果(第四级测量量)，响应感知服务请求，在本申请中将这一功能称为综合感知功能节点
感知服务质量(QoS)的控制，即面向感知服务质量要求，对感知相关节点的进行控制，从而满足感知服务QoS要求。
确定感知信号发送或接收节点或感知辅助节点，移动通信系统中的感知信号发送或接收节点包括网络设备(如基站)和用户设备UE(如手机)。其中感知辅助节点指用于提供感知辅助的信息如其它传感器等的感知信息，地理位置信息等用于提升无线感知的性能。
确定感知链路或感知方式，其中感知链路可以包括Uu链路(基站发/UE收或基站收/UE发)，侧链路sidelink(UE间收发)，回波链路(基站自发自收，UE自发自收)，基站间收发链路(基站间收发)；感知方式可以包括基站发UE收，UE发基站收，基站自发自收，UE间收发，基站间收发，UE自发自收。
确定感知信号，潜在的感知信号包括参考信号和数据信号，其中参考信号可以为通信参考信号或感知专用参考信号。
确定感知所使用的时频资源，潜在的感知资源包括通信中未使用的时频资源(如保护带)，共用通信中已使用的时频资源(如参考信号或数据信号)，感知专用的时频资源。进一步还需确定感知信号的配置，潜在的配置包括感知信号的时、频和空域资源信息。如果确定感知时频资源的节点不是感知信号的发送节点，那么向感知信号发送节点发送感知信 号配置。
确定感知测量量的配置，潜在的配置包括需测量的感知信号指示、需测量的感知信号数量或时间、测量结果的上报指示等。如果确定感知测量量配置的节点不是感知信号的接收和测量节点，那么向感知信号接收节点发送感知测量量配置。
确定和配置感知测量结果上报的传输通道，包括建立、修改或释放传输通道等。
确定AMF，当网络侧根据所请求感知服务的地理范围和感知功能节点所提供感知服务的地理范围确定了感知功能节点后，在如下至少一种情况下感知功能解节点需确定AMF：1)当UE为感知信号发送节点或感知信号接收节点或感知辅助节点时感知目标为某个UE时，感知功能节点基于所需感知的地理区域，以及根据从网络存储功能(Network Repository Function，NRF)请求的AMF的跟踪区识别码(Tracking Area identity，TAI)，和/或AMF ID/位置等选择AMF；2)当感知数据需经AMF传输(例如定义为非接入层NAS消息或者NAS层作为感知数据的传输承载协议层)时，感知功能节点基于所需传输数据的感知节点地理位置信息(如跟踪区(Tracking Area，TA)等)，以及根据从NRF请求的AMF的TAI，和/或，AMF ID/位置等选择AMF；3)当感知目标是3GPP UE时，感知功能节点根据UE标识等确定AMF。
在本申请的至少一个实施例中，所述方法还包括以下至少一项：
所述第一节点通过签约信息，获取所述感知授权信息；可简称为选项1；
所述第一节点向目标设备发送询问信息，并接收目标设备发送的感知授权信息；可简称为选项2；
所述第一节点接收目标设备发送的感知授权信息；可简称为选项3。
其中，所述目标设备包括以下至少一项：
具有感知区域授权权限的设备；
具有感知目标授权权限的设备；
感知设备。
本申请实施例的授权方案还包括过上述多种选项获得不同的感知授权信息，或者通过上述多种方式获得感知授权信息和/或更新感知授权信息。例如选项1+选项2，签约信息包括允许感知或禁止感知，如果允许感知，那么网络接收到与其相关的感知请求，询问是否执行感知。又例如选项1+选项3，在签约信息的基础上，设备通过方式3来更新感知授权信息。
在本申请的至少一个实施例中，所述感知请求携带以下至少一项信息：
感知类型；
指示是否指定感知设备的第十一指示信息；
指定感知设备的信息；如果指定感知设备，则感知请求还包括指定感知设备的列表信息，如感知设备1，用于感知信号发送；感知设备2，用于感知信号的接收和测量；感知设备3，用于感知结果生成。
感知区域；
感知目标；
感知请求发送节点的标识，也可以称为感知请求方的标识，或感知请求发起者的标识；
感知结果接收节点的标识，也可以称为感知结果使用者的标识；
感知内容，也可以理解为感知业务类型，潜在的感知内容包括距离、速度、朝向、位置、轨迹、是否存在目标、环境重构、呼吸监测、心跳监测、动作识别、天气监测、空气质量检测、物质成分分析等；
感知执行的时间信息，可以是绝对时间信息(周一，13:00-19:00)或者相对时间信息(如未来一个月内)。该时间信息可以包括起始时间、结束时间或持续时长等；
感知服务质量QoS；
鉴权凭据，也可以称为授权凭据，如令牌(token)等。
可选地，所述感知类型基于感知授权或鉴权需求来进行定义。一种潜在的定义方式是：
类型1：感知无需感知区域授权并且无需感知目标授权，感知内容属于公共信息。例如天气监测，这一类别对安全隐私要求低，通常鉴权的结果是继续执行感知。
类型2：感知区域需鉴权，并且无需感知目标授权。考虑感知区域的动态变化、区域重叠或区域包含/被包含等情况，为了更好地保障感知安全隐私，类型2可进一步分为单重鉴权或双重鉴权。单重鉴权指网络进行一次鉴权，双重鉴权指网络进行至少两次鉴权。
类型3：感知目标需鉴权，感知区域既可以需要授权也可以不需要授权。
可选地，指定感知设备的含义包括指定进行感知信号发送、感知信号接收、感知信号测量、感知辅助和感知结果生成中至少一项的感知设备。如果指定了上述一项或多项，那么则指示指定感知设备。如果没有指定上述任意一项，那么则指示不指定感知设备。
作为一个可选实施例，在所述感知请求携带鉴权凭据的情况下，所述方法还包括：
所述第一节点获取所述鉴权凭据的鉴权方式；
所述第一节点利用获取的所述鉴权方式对所述感知请求中的鉴权凭据进行鉴权验证，确定是否执行所述感知请求所请求的感知。如果鉴权凭据有效，那么执行感知。如果鉴权凭据无效，那么拒绝感知。
需要说明的是，通常鉴权凭据是具有时效性的，因此本申请实施例中建议每次都对鉴权凭据进行鉴权验证。
可选的，在第一节点根据感知授权信息确定是否执行感知前，还可以对感知请求的发送者和/或感知结果的接收者进行鉴权。防止非法感知请求发送者占用网络资源，防止被非法感知就接收者骗取关键信息。如前所述当感知目标或感知请求发送者或感知结果接收者为UE时，网络易于基于感知目标/感知请求发送者/感知结果接收者与UE的关联联系进行授权或鉴权。当感知请求发送者/感知结果接收者为非UE时，网络需要获得感知目标/感知请求发送者/感知结果接收者的通信信息(如IP地址与端口号)与身份信息(授权的感知目标/区域的所有者或管理者)的关联关系，以便于接收到感知请求或发送感知结果 时，可以对感知请求的发送者或接收者进行鉴权，确定是否与感知授权信息匹配；在与感知授权信息匹配的情况下再根据感知授权信息进行感知鉴权。
为了更完整的描述本申请实施例提供的感知鉴权方法，下面结合几个示例，进行说明。
示例一
一种感知的授权方案是前述感知区域所有者/管理者，感知目标/感知目标所有者/管理者或感知设备通过签约信息提供前述对感知区域、感知目标或感知设备的感知授权信息。网络根据签约信息可以确定是否执行所请求的感知。
AF(应用功能)或内部网络功能(如AMF等)或UE可以发送感知请求，网络功能(如NEF、AMF、SF或AUSF)对感知请求进行授权/鉴权检查。感知授权信息可以由所述进行授权/鉴权的网络功能存储，也可以由用于存储授权信息的网络功能(例如UDM)存储。如果由用于存储授权信的网络功能存储，那么所述进行授权/鉴权的网络功能向其请求授权/鉴权信息，并反馈授权/鉴权结果。根据授权/鉴权结果，网络确定是否执行感知。一种基于5G网络的流程简述如下。
步骤1，AF向NEF发送感知请求信息，或者内部网络功能(如SMF等)向SF发送感知请求，或者UE向AMF发送感知请求，感知请求携带的内容详见上述实施例。
步骤2，如果需要进行感知授权/鉴权，那么与前述感知请求接收方对应的NEF、SF或AMF可进行感知授权/鉴权，也可以NEF/SF/AMF向AUSF请求进行授权/鉴权。如技术方案所述，如果是举例的感知类型1(感知无需感知区域授权/鉴权并且无需感知目标授权/鉴权，感知内容属于公共信息。例如天气监测，这一类别对安全隐私要求低),那么可以无需面向感知区域和感知目标进行感知授权/鉴权。当NEF/SF/AMF/AUSF进行感知授权/鉴权时：
获取所需的感知授权信息，举例如下(至少包括感知区域、感知目标或感知设备中的一项)。当感知请求中指定了感知设备时，那么需要感知设备授权信息。否则此处不需要感知设备的授权信息，当感知功能SF确定执行各感知功能的感知设备时才需要感知设备的授权信息。
感知区域标识或感知区域名称或感知区域坐标范围；
感知区域的感知服务网络名称，例如公共陆地移动网络(Public Land Mobile Network，PLMN)；
感知区域的授权信息，所述感知区域授权信息携带的内容详见上述实施例。
感知目标标识；
感知目标的感知服务网络名称，例如PLMN；
感知目标的授权信息，所述感知区域授权信息携带的内容详见上述实施例。
感知设备标识；
感知设备的服务网络名称，例如PLMN；
感知设备的授权信息，所述感知设备授权信息携带的内容详见上述实施例。
获取感知授权信息的一种方法是向UDM请求所需的感知授权信息。关于UDM选择，相比于通信中基于UE相关标识进行选择，感知需根据感知区域、感知目标和感知设备中至少一项选择UDM。例如基于感知区域标识或感知区域名称或感知区域坐标范围等，根据感知目标标识或感知设备标识等选择存储所需感知区域、感知目标或感知设备的授权/鉴权信息；另一种方法是所需NEF/SF/AMF/AUSF本地存储所需感知区域、感知目标或感知设备的授权/鉴权信息，该信息可以是UDM预先将感知授权信息发送给执行授权/鉴权的NEF/SF/AMF/AUSF，也可以是通过感知区域所有者/管理者，感知目标/感知目标所有者/感知目标管理者，感知设备将所述感知授权信息预先发送和存储在NEF/SF/AMF/AUSF。
根据感知请求以及对应的感知授权信息确定授权/鉴权结果。例如感知请求是对某一段道路区域进行车速感知，感知需求发起者和感知结果使用者相同均为交通管理部门。那么根据签约信息中该区域的管理者，即交通管理部门对该感知区域授权信息确定授权/鉴权通过，可以执行感知。例如感知请求是对某一个房屋区域进行呼吸监测感知，感知需求发起者为该房屋所有者，感知结果使用者为该房屋所有者的子女。那么根据签约信息中该区域所有者即房屋所有者对该感知区域授权信息确定授权/鉴权通过，可以执行感知。如果感知结果使用者不在感知授权的感知结果使用者范围内，那么则不通过。如果不通过，那么NEF/SF/AMF拒绝感知请求，不执行感知。
NEF/SF/AMF/AUSF将鉴权结果发送给UDM；
考虑感知效率和感知时延，NEF/SF/AMF/AUSF/UDM存储鉴权状态，包括感知区域标识、感知目标标识和感知设备标识中至少一项，还包括鉴权结果、时间戳和服务网络名称。可选的，还包括感知需求的发起方、感知结果的使用方、感知内容、感知时间和感知QoS中的一项或多项。对于相同的感知请求，在授权信息不变的情况下避免重复鉴权。同时NEF/SF/AMF/AUSF/可订阅感知授权信息，一旦发生感知授权信息更新那么UDM或其它网络功能发生更新信息。
步骤3，授权/鉴权通过后，在一种方式中，NEF选择合适的AMF，并向AMF发送感知业务请求消息。当内部网元触发时，由内部网元选择合适的AMF，并向AMF发送感知业务请求消息。
如果是面向区域的感知，NEF依据AF请求中的区域信息选择服务该区域的AMF。
如果是面向目标的感知，NEF依据AF请求中的目标位置信息选择服务该区域的AMF；如果目标本身拥有UE通信模块而具备UE能力，例如车辆，则可以认为面向目标感知是对UE周边进行感知，此时可以选择该UE的服务AMF作为AMF，且NEF通过查询UDM获得服务该UE的AMF信息。
在另一种方式中，NEF可以先选择SF，再由SF选择AMF。当内部网元触发时，由内部网元选择SF，再有SF选择AMF。
如果是面向区域的感知，NEF依据AF请求中的区域信息选择服务该区域的SF。
如果是面向目标感知，NEF依据AF请求中的目标位置信息选择服务该区域的SF； 如果目标本身拥有UE通信模块而具备UE能力，例如车辆，则可以认为面向目标感知是对UE周边进行感知，此时可以选择该UE的服务SF作为SF，且NEF通过查询UDM获得服务该UE的AMF ID，再根据AMF ID选择合适的SF。
步骤4，AMF将感知请求发送给SF。
步骤5，如果SF根据感知请求确定感知方式和感知基站/UE，从感知信号发送节点和接收节点角度划分感知方式包括基站自发自收、基站间收发、UE发基站收，基站发UE收，UE自发自收，UE间收发。
如果基站和终端能够执行感知操作，则向SF返回感知响应，携带成功指示，否则携带失败指示。感知网元进而向请求业务的第三方应用返回感知响应。
步骤6，SF根据基站反馈的感知测量数据进行感知计算，并得到最终感知结果。
步骤7，SF将感知结果返回给AMF。对于区域感知场景，SF可以通过AMF和NEF返回给AF，或者直接将感知结果通过NEF返回给AF。
步骤8，AMF将感知结果通过NEF返回给AF。当内部网元触发时，AMF将感知结果发送给内部网元。
示例二
一种感知的授权和鉴权方案是接收到感知请求时，网络根据感知请求(感知区域、感知目标或指定的感知设备至少一项)询问对应的具有该区域授权权限的设备、具有该目标授权权限的设备或感知设备是否允许执行感知。
AF(应用功能)或内部网络功能(如AMF等)或UE可以发送感知请求，网络功能(如NEF、AMF、SF或AUSF)对感知请求进行授权/鉴权检查。网络功能根据感知请求确定具有所涉及的感知区域和/或感知目标的授权权限的设备。网络功能通过询问具有授权权限的设备进行感知授权/鉴权。如果感知请求中指定感知设备，那么网络功能需询问所指定的感知设备进行感知授权/鉴权。一种基于5G网络的流程简述如下。
发送和接收感知请求，以及授权/鉴权通过后的感知流程同示例一，本示例不再赘述。
步骤1，如果需要进行感知授权/鉴权，那么与前述感知请求接收方对应的NEF、SF或AMF可进行感知授权/鉴权，也可以NEF/SF/AMF向AUSF请求进行授权/鉴权。如技术方案所述，如果是举例的感知类型1(感知无需感知区域授权/鉴权并且无需感知目标授权/鉴权，感知内容属于公共信息。例如天气监测，这一类别对安全隐私要求低),那么可以无需面向感知区域和感知目标进行感知授权/鉴权。当NEF/SF/AMF/AUSF进行感知授权/鉴权时：
根据感知请求和签约信息确定具有所涉及的感知区域和/或感知目标的授权权限的设备。
NEF/SF/AMF/AUSF向具有感知区域授权权限的设备、具有感知目标授权权限的设备或感知设备中的至少一项发送感知授权/鉴权请求。所述感知授权/鉴权请求信息与本技术提案的感知请求信息相同。
所述具有感知区域授权权限的设备、具有感知目标授权权限的设备或感知设备相应地确定感知区域、感知目标或感知设备的授权/鉴权结果，并发送感知授权/鉴权响应。感知授权/鉴权响应至少包括是否通过指示，可选的还可以包括鉴权结果的时间戳，用于防止该授权/鉴权结果被重放等方式滥用；鉴权结果有效时长，用于避免相同的感知授权/鉴权被频繁重复请求。需要说明的是具有感知区域授权权限的设备、具有感知目标授权权限的设备或感知设备可以是三个不同设备，也可以是其中任意两个是同一设备，或者三个是同一设备。
NEF/SF/AMF/AUSF根据所接收的感知授权/鉴权响应确定授权/鉴权是否通过。如果通过，那么可以执行感知。如果不通过，那么NEF/SF/AMF/AUSF拒绝感知请求，不执行感知。
考虑感知效率和感知时延，NEF/SF/AMF/AUSF/UDM存储鉴权状态，包括感知区域标识、感知目标标识和感知设备标识中至少一项，还包括鉴权结果、时间戳和服务网络名称。可选的，还包括感知需求的发起方、感知结果的使用方、感知内容、感知时间和感知QoS中的一项或多项。对于相同的感知请求，在授权信息不变的情况下避免重复鉴权。
示例三
一种感知的授权和鉴权方案是感知需求的发起者(感知请求方)向其所需的感知区域、感知目标或感知设备获取感知授权凭据。发送感知请求时需携带所获得的感知授权凭据。负责进行感知授权/鉴权的网络功能获取鉴权凭据鉴权的方法，或者负责感知授权/鉴权的网络功能通过离线或消息交互与感知区域/感知目标/感知设备的授权方约定鉴权凭据的鉴权方式。因此，当网络接收到带有鉴权凭证的感知请求时，基于所知的鉴权方法鉴权，确定是否允许执行感知。基于凭据的感知授权和鉴权方法，一方面网络可无需与感知区域/目标/设备交互感知授权信息，另一方面感知授权由感知区域/目标/设备直接授权而无需网络代理，从而感知区域/目标/设备具有完全授权范围，便于随时更新授权信息。并且凭据的解决方案可以有多种，例如哈希算法(哈希算法也叫散列算法，一般来说满足这样的关系：f(data)＝key，输入任意长度的data数据，经过哈希算法处理后输出一个定长的数据key。同时这个过程是不可逆的，无法由key逆推出data。本方案中函数f()为鉴权方法，凭据可以data和key)、令牌等，具有较好的扩展性。
发送和接收感知请求，以及授权/鉴权通过后的感知流程同示例一，本示例不再赘述。当感知凭据是令牌(token)时，一种基于令牌(token)机制的感知授权/鉴权方案简述如下。
步骤1，感知需求的发起者(感知请求方)获取所需的感知区域、感知目标或感知设备的授权token。一种获取方式是与该感知区域和/或感知目标所有者/管理者离线协商获得，另一种发送感知授权请求给具有感知区域授权权限的设备、具有感知目标授权权限的设备或感知设备请求token。
步骤2，负责感知鉴权的网络功能获取所负责的感知区域、感知目标或感知设备的鉴 权方式(即解码token，判断token是否有效的方法)。一种获取方式是与该感知区域和/或感知目标所有者/管理者离线协商获得，另一种发送感知鉴权请求给具有感知区域鉴权权限的设备、具有感知目标鉴权权限的设备或感知设备请求鉴权方式。
其中，步骤1和步骤2没有绝对顺序关系，可以先执行步骤1再执行步骤2，也可以先执行步骤2再执行步骤1，还可以同时执行步骤1和步骤2。
步骤3，感知需求的发起者发送感知请求时携带所获得的token信息
步骤4，网络基于所获得的鉴权方式对感知请求中的token信息进行验证，如果token有效，那么执行感知。如果token无效，那么拒绝感知。
其中，通常token是具有时效性的，因此本方案中建议每次都对token进行鉴权验证。
示例四
前述感知区域授权信息、感知目标授权信息、感知设备授权信息可能因为授权者的意愿或者其他原因而发生变化。当发生变化时潜在的更新方式包括通过线下的方式更改所签订的合同或授权协议，基于消息交互的授权/鉴权信息更新。本实施提供一种感知授权信息的更新方法，侧重于基于消息交互的授权信息更新。
当感知区域、感知目标或感知设备因为授权者意愿、电量或一些突发情况等原因需要更改感知授权信息时，上述感知区域、感知目标或感知设备的管理者/所有者可通过具有感知区域授权权限的设备、具有感知目标授权权限的设备或感知设备的操作系统界面感知开关/设置选项，或者具有感知区域授权权限的设备、具有感知目标授权权限的设备或感知设备的物理开关按键，或者发送短消息，或者通过约定的应用功能(该应用功能可部署与具有感知区域授权权限的设备、具有感知目标授权权限的设备或感知设备上，或者该应用功能部署在其他位置均可)消息的方式更新，或者。对应地，感知授权信息更新的交互流程简述如下。
步骤1，具有感知区域授权权限的设备、具有感知目标授权权限的设备或感知设备或应用功能中的至少一项发送感知区域授权信息、感知目标授权信息、感知设备授权信息中的至少一项，所述授权信息用于更新对应的感知授权信息和/或感知鉴权信息。所述感知授权信息详见技术方案，所述感知鉴权信息主要包括是否允许执行某一感知。
步骤2，负责维护感知授权和/鉴权信息的网络功能节点(如UDM/NEF/SF/AMF/AUSF等)接收所述感知授权/鉴权更新信息后，根据该感知授权/鉴权的订阅，发送消息通知对应订阅的节点感知授权/鉴权信息更新。
步骤3，订阅感知授权/鉴权信息的节点感知授权和/或鉴权的网络功能节点(如NEF/SF/AMF/AUSF)获取更新的授权/鉴权信息，根据更新的授权/鉴权信息执行感知授权/鉴权，如果感知授权/鉴权结果与上一次授权/鉴权的结果不同，那么发送更新的感知授权/鉴权结果给感知请求方。
如果感知区域、感知目标或感知设备的授权/鉴权更新是基于凭据的方式，指示是对后续的感知应用还是对当前进行的感知及后续感知应用。如果对后续的感知应用，那么负 责进行感知授权/鉴权的网络功能对新接收到的感知请求采用更新信息进行鉴权。如果对当前的感知应用，那么网络功能需要对正在进行的感知进行鉴权，如果鉴权结果为不执行那么需要通知感知请求方新的感知结果。或者如果鉴权结果为不执行通知感知请求方更新感知授权/鉴权信息(如token)，对更新的根据更新的凭据信息进行感知鉴权，不再并通知接收所述感知授权/鉴权更新的授权/鉴权信息进行鉴权。
综上，在本申请实施例中，第一节点获取感知请求以及所述感知请求对应的感知区域授权信息，感知目标授权信息以及感知设备授权信息中的至少一项，进行感知鉴权，从而确定是否执行所述感知请求所请求的感知；从而解决感知中涉及的感知区域、感知目标或感知设备的授权和鉴权。本实施例能够保障感知的安全和隐私，防止未经授权对某个区域或某个目标进行感知，防止未经授权指定感知设备引起感知设备被追踪或捕获。
本申请实施例提供的感知鉴权方法，执行主体可以为感知鉴权装置。本申请实施例中以感知鉴权装置执行感知鉴权方法为例，说明本申请实施例提供的感知鉴权装置。
如图3所示，本申请实施例还提供一种感知鉴权装置300，包括：
第一获取模块301，用于获取感知请求以及所述感知请求对应的感知授权信息；
感知鉴权模块302，用于根据所述感知授权信息，进行感知鉴权；其中，所述感知鉴权的鉴权结果用于指示是否执行所述感知请求所请求的感知；
其中，所述感知授权信息包括：感知区域授权信息，感知目标授权信息以及感知设备授权信息中的至少一项信息。
作为一个可选实施例，所述感知区域授权信息包括以下至少一项：
指示第一区域允许感知的第一指示信息；
所述第一区域允许感知的范围；
指示第一区域禁止感知的第二指示信息；
所述第一区域禁止感知的范围；
具有所述第一区域授权权限的设备的通信信息。
作为一个可选实施例，所述第一区域允许感知的范围包括以下至少一项：
所述第一区域允许被感知的内容；
所述第一区域允许被感知的感知测量数据；
所述第一区域允许的感知请求发送节点；
所述第一区域允许的感知结果接收节点；
所述第一区域允许的感知设备，所述感知设备是进行感知信号发送、感知信号接收、感知信号测量、感知辅助数据上报和感知结果生成中至少一项的设备；
所述第一区域允许感知的时间；
所述第一区域允许的感知服务质量QoS。
作为一个可选实施例，所述第一区域禁止感知的范围包括以下至少一项：
所述第一区域禁止被感知的内容；
所述第一区域禁止被感知的感知测量数据；
所述第一区域禁止的感知请求发送节点；
所述第一区域禁止的感知结果接收节点；
所述第一区域禁止的感知设备，所述感知设备是进行感知信号发送、感知信号接收、感知信号测量、感知辅助数据上报和感知结果生成中至少一项的设备；
所述第一区域禁止感知的时间；
所述第一区域禁止的感知服务质量QoS。
作为一个可选实施例，所述感知目标授权信息包括以下至少一项：
指示第一目标允许被感知的第三指示信息；
所述第一目标允许被感知的范围；
指示所述第一目标禁止被感知的第四指示信息；
所述第一目标禁止被感知的范围；
具有所述第一目标授权权限的设备的通信信息。
作为一个可选实施例，所述第一目标允许被感知的范围包括以下至少一项：
所述第一目标允许被感知的内容；
所述第一目标允许被感知的感知测量数据；
所述第一目标允许的感知请求发送节点；
所述第一目标允许的感知结果接收节点；
所述第一目标允许的感知设备，所述感知设备是进行感知信号发送、感知信号接收、感知信号测量、感知辅助数据上报和感知结果生成中至少一项的设备；
所述第一目标允许感知的时间；
所述第一目标允许被感知的区域；
所述第一目标允许的感知服务质量QoS。
作为一个可选实施例，所述第一目标禁止被感知的范围包括以下至少一项：
所述第一目标禁止被感知的内容；
所述第一目标禁止被感知的感知测量数据；
所述第一目标禁止许的感知请求发送节点；
所述第一目标禁止的感知结果接收节点；
所述第一目标禁止许的感知设备，所述感知设备是进行感知信号发送、感知信号接收、感知信号测量、感知辅助数据上报和感知结果生成中至少一项的设备；
所述第一目标禁止感知的时间；
所述第一目标禁止被感知的区域；
所述第一目标禁止的感知服务质量QoS。
作为一个可选实施例，所述感知设备授权信息包括以下至少一项：
指示第一设备允许参与感知的第五指示信息；
所述第一设备允许参与感知的范围；
指示第一设备禁止参与感知的第六指示信息；
所述第一设备禁止参与感知的范围。
作为一个可选实施例，所述第一设备允许参与感知的范围包括以下至少一项：
所述第一设备允许参与的感知功能，所述感知功能包括感知信号发送、感知信号接收、感知信号测量、感知辅助数据上报和感知结果生成中至少一项；
指示所述第一设备允许被感知请求发送节点确定参与感知的第七指示信息；
指示允许确定所述第一设备参与感知的感知请求发送节点的第八指示信息；
所述第一设备允许的感知测量量；
所述第一设备允许的感知辅助数据，所述感知辅助数据包括位置信息、时间信息、速度信息、目标标识信息中至少一项。
作为一个可选实施例，所述第一设备禁止参与感知的范围包括以下至少一项：
指示所述第一设备禁止被感知请求发送节点确定参与感知的第九指示信息；
指示禁止确定所述第一设备参与感知的感知请求发送节点的第十指示信息；
所述第一设备禁止的感知测量量；
所述第一设备禁止的感知辅助数据，所述感知辅助数据包括位置信息、时间信息、速度信息、目标标识信息中至少一项。
作为一个可选实施例，所述装置还包括以下至少一个模块：
第二获取模块，用于通过签约信息，获取所述感知授权信息；
第三获取模块，用于向目标设备发送询问信息，并接收目标设备发送的感知授权信息；
第四获取模块，用于接收目标设备发送的感知授权信息
作为一个可选实施例，所述目标设备包括以下至少一项：
具有感知区域授权权限的设备；
具有感知目标授权权限的设备；
感知设备。
作为一个可选实施例，所述感知请求携带以下至少一项信息：
感知类型；
指示是否指定感知设备的第十一指示信息；
指定感知设备的信息；
感知区域；
感知目标；
感知请求发送节点的标识；
感知结果接收节点的标识；
感知内容；
感知执行的时间信息；
感知服务质量QoS；
鉴权凭据。
作为一个可选实施例，在所述感知请求携带鉴权凭据的情况下，所述装置还包括：
第五获取模块，用于获取所述鉴权凭据的鉴权方式；
鉴权模块，用于利用获取的所述鉴权方式对所述感知请求中的鉴权凭据进行鉴权验证，确定是否执行所述感知请求所请求的感知。
在本申请实施例中，第一节点获取感知请求以及所述感知请求对应的感知区域授权信息，感知目标授权信息以及感知设备授权信息中的至少一项，进行感知鉴权，从而确定是否执行所述感知请求所请求的感知；从而解决感知中涉及的感知区域、感知目标或感知设备的授权和鉴权。本实施例能够保障感知的安全和隐私，防止未经授权对某个区域或某个目标进行感知，防止未经授权指定感知设备引起感知设备被追踪或捕获。
需要说明的是，本申请实施例提供的感知鉴权装置是能够执行上述感知鉴权方法的装置，则上述感知鉴权方法的所有实施例均适用于该装置，且均能达到相同或相似的有益效果，在此不做重复赘述。
本申请实施例中的感知鉴权装置可以是电子设备，例如具有操作系统的电子设备，也可以是电子设备中的部件，例如集成电路或芯片。该电子设备可以是终端，也可以为除终端之外的其他设备。示例性的，终端可以包括但不限于上述所列举的终端11的类型，其他设备可以为服务器、网络附属存储器(Network Attached Storage，NAS)等，本申请实施例不作具体限定。
本申请实施例提供的感知鉴权装置能够实现图1至图2的方法实施例实现的各个过程，并达到相同的技术效果，为避免重复，这里不再赘述。
可选的，如图4所示，本申请实施例还提供一种通信设备400，包括处理器401和存储器402，存储器402上存储有可在所述处理器401上运行的程序或指令，例如，该通信设备400为第一节点时，该程序或指令被处理器401执行时实现上述感知鉴权方法实施例的各个步骤，且能达到相同的技术效果，为避免重复，这里不再赘述。
本申请实施例还提供一种网络侧设备，包括处理器和通信接口，所述通信接口用于获取感知请求以及所述感知请求对应的感知授权信息；所述处理器用于根据所述感知授权信息，进行感知鉴权确定是否执行所述感知请求所请求的感知；其中，所述感知授权信息包括：感知区域授权信息，感知目标授权信息以及感知设备授权信息中的至少一项信息。网络侧设备实施例与上述第一节点侧方法实施例对应，上述方法实施例的各个实施过程和实现方式均可适用于该网络侧设备实施例中，且能达到相同的技术效果。
具体地，本申请实施例还提供了一种网络侧设备。如图5所示，该网络侧设备500包括：天线51、射频装置52、基带装置53、处理器54和存储器55。天线51与射频装置52连接。在上行方向上，射频装置52通过天线51接收信息，将接收的信息发送给基带装置53进行处理。在下行方向上，基带装置53对要发送的信息进行处理，并发送给射频 装置52，射频装置52对收到的信息进行处理后经过天线51发送出去。
以上实施例中网络侧设备执行的方法可以在基带装置53中实现，该基带装置53包括基带处理器。
基带装置53例如可以包括至少一个基带板，该基带板上设置有多个芯片，如图5所示，其中一个芯片例如为基带处理器，通过总线接口与存储器55连接，以调用存储器55中的程序，执行以上方法实施例中所示的网络设备操作。
该网络侧设备还可以包括网络接口56，该接口例如为通用公共无线接口(common public radio interface，CPRI)。
具体地，本申请实施例的网络侧设备500还包括：存储在存储器55上并可在处理器54上运行的指令或程序，处理器54调用存储器55中的指令或程序执行图3所示各模块执行的方法，并达到相同的技术效果，为避免重复，故不在此赘述。
本申请实施例还提供一种可读存储介质，所述可读存储介质上存储有程序或指令，该程序或指令被处理器执行时实现上述感知鉴权方法实施例的各个过程，且能达到相同的技术效果，为避免重复，这里不再赘述。
其中，所述处理器为上述实施例中所述的终端中的处理器。所述可读存储介质，包括计算机可读存储介质，如计算机只读存储器ROM、随机存取存储器RAM、磁碟或者光盘等。
本申请实施例另提供了一种芯片，所述芯片包括处理器和通信接口，所述通信接口和所述处理器耦合，所述处理器用于运行程序或指令，实现上述感知鉴权方法实施例的各个过程，且能达到相同的技术效果，为避免重复，这里不再赘述。
应理解，本申请实施例提到的芯片还可以称为系统级芯片，系统芯片，芯片系统或片上系统芯片等。
本申请实施例另提供了一种计算机程序/程序产品，所述计算机程序/程序产品被存储在存储介质中，所述计算机程序/程序产品被至少一个处理器执行以实现上述感知鉴权方法实施例的各个过程，且能达到相同的技术效果，为避免重复，这里不再赘述。
需要说明的是，在本文中，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者装置不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者装置所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括该要素的过程、方法、物品或者装置中还存在另外的相同要素。此外，需要指出的是，本申请实施方式中的方法和装置的范围不限按示出或讨论的顺序来执行功能，还可包括根据所涉及的功能按基本同时的方式或按相反的顺序来执行功能，例如，可以按不同于所描述的次序来执行所描述的方法，并且还可以添加、省去、或组合各种步骤。另外，参照某些示例所描述的特征可在其他示例中被组合。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到上述实施例方法可 借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分可以以计算机软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端(可以是手机，计算机，服务器，空调器，或者网络设备等)执行本申请各个实施例所述的方法。
上面结合附图对本申请的实施例进行了描述，但是本申请并不局限于上述的具体实施方式，上述的具体实施方式仅仅是示意性的，而不是限制性的，本领域的普通技术人员在本申请的启示下，在不脱离本申请宗旨和权利要求所保护的范围情况下，还可做出很多形式，均属于本申请的保护之内。

Claims (30)

  1. 一种感知鉴权方法，包括：
    第一节点获取感知请求以及所述感知请求对应的感知授权信息；
    所述第一节点根据所述感知授权信息，进行感知鉴权；其中，所述感知鉴权的鉴权结果用于指示是否执行所述感知请求所请求的感知；
    其中，所述感知授权信息包括：感知区域授权信息，感知目标授权信息以及感知设备授权信息中的至少一项信息。
  2. 根据权利要求1所述的方法，其中，所述感知区域授权信息包括以下至少一项：
    指示第一区域允许感知的第一指示信息；
    所述第一区域允许感知的范围；
    指示第一区域禁止感知的第二指示信息；
    所述第一区域禁止感知的范围；
    具有所述第一区域授权权限的设备的通信信息。
  3. 根据权利要求2所述的方法，其中，所述第一区域允许感知的范围包括以下至少一项：
    所述第一区域允许被感知的内容；
    所述第一区域允许被感知的感知测量数据；
    所述第一区域允许的感知请求发送节点；
    所述第一区域允许的感知结果接收节点；
    所述第一区域允许的感知设备，所述感知设备是进行感知信号发送、感知信号接收、感知信号测量、感知辅助数据上报和感知结果生成中至少一项的设备；
    所述第一区域允许感知的时间；
    所述第一区域允许的感知服务质量QoS。
  4. 根据权利要求2所述的方法，其中，所述第一区域禁止感知的范围包括以下至少一项：
    所述第一区域禁止被感知的内容；
    所述第一区域禁止被感知的感知测量数据；
    所述第一区域禁止的感知请求发送节点；
    所述第一区域禁止的感知结果接收节点；
    所述第一区域禁止的感知设备，所述感知设备是进行感知信号发送、感知信号接收、感知信号测量、感知辅助数据上报和感知结果生成中至少一项的设备；
    所述第一区域禁止感知的时间；
    所述第一区域禁止的感知服务质量QoS。
  5. 根据权利要求1所述的方法，其中，所述感知目标授权信息包括以下至少一项：
    指示第一目标允许被感知的第三指示信息；
    所述第一目标允许被感知的范围；
    指示所述第一目标禁止被感知的第四指示信息；
    所述第一目标禁止被感知的范围；
    具有所述第一目标授权权限的设备的通信信息。
  6. 根据权利要求5所述的方法，其中，所述第一目标允许被感知的范围包括以下至少一项：
    所述第一目标允许被感知的内容；
    所述第一目标允许被感知的感知测量数据；
    所述第一目标允许的感知请求发送节点；
    所述第一目标允许的感知结果接收节点；
    所述第一目标允许的感知设备，所述感知设备是进行感知信号发送、感知信号接收、感知信号测量、感知辅助数据上报和感知结果生成中至少一项的设备；
    所述第一目标允许感知的时间；
    所述第一目标允许被感知的区域；
    所述第一目标允许的感知服务质量QoS。
  7. 根据权利要求5所述的方法，其中，所述第一目标禁止被感知的范围包括以下至少一项：
    所述第一目标禁止被感知的内容；
    所述第一目标禁止被感知的感知测量数据；
    所述第一目标禁止许的感知请求发送节点；
    所述第一目标禁止的感知结果接收节点；
    所述第一目标禁止许的感知设备，所述感知设备是进行感知信号发送、感知信号接收、感知信号测量、感知辅助数据上报和感知结果生成中至少一项的设备；
    所述第一目标禁止感知的时间；
    所述第一目标禁止被感知的区域；
    所述第一目标禁止的感知服务质量QoS。
  8. 根据权利要求1所述的方法，其中，所述感知设备授权信息包括以下至少一项：
    指示第一设备允许参与感知的第五指示信息；
    所述第一设备允许参与感知的范围；
    指示第一设备禁止参与感知的第六指示信息；
    所述第一设备禁止参与感知的范围。
  9. 根据权利要求8所述的方法，其中，所述第一设备允许参与感知的范围包括以下至少一项：
    所述第一设备允许参与的感知功能，所述感知功能包括感知信号发送、感知信号接收、 感知信号测量、感知辅助数据上报和感知结果生成中至少一项；
    指示所述第一设备允许被感知请求发送节点确定参与感知的第七指示信息；
    指示允许确定所述第一设备参与感知的感知请求发送节点的第八指示信息；
    所述第一设备允许的感知测量量；
    所述第一设备允许的感知辅助数据，所述感知辅助数据包括位置信息、时间信息、速度信息、目标标识信息中至少一项。
  10. 根据权利要求8所述的方法，其中，所述第一设备禁止参与感知的范围包括以下至少一项：
    指示所述第一设备禁止被感知请求发送节点确定参与感知的第九指示信息；
    指示禁止确定所述第一设备参与感知的感知请求发送节点的第十指示信息；
    所述第一设备禁止的感知测量量；
    所述第一设备禁止的感知辅助数据，所述感知辅助数据包括位置信息、时间信息、速度信息、目标标识信息中至少一项。
  11. 根据权利要求1-10任一项所述的方法，其中，所述方法还包括以下至少一项：
    所述第一节点通过签约信息，获取所述感知授权信息；
    所述第一节点向目标设备发送询问信息，并接收目标设备发送的感知授权信息；
    所述第一节点接收目标设备发送的感知授权信息。
  12. 根据权利要求11所述的方法，其中，所述目标设备包括以下至少一项：
    具有感知区域授权权限的设备；
    具有感知目标授权权限的设备；
    感知设备。
  13. 根据权利要求1所述的方法，其中，所述感知请求携带以下至少一项信息：
    感知类型；
    指示是否指定感知设备的第十一指示信息；
    指定感知设备的信息；
    感知区域；
    感知目标；
    感知请求发送节点的标识；
    感知结果接收节点的标识；
    感知内容；
    感知执行的时间信息；
    感知服务质量QoS；
    鉴权凭据。
  14. 根据权利要求13所述的方法，其中，在所述感知请求携带鉴权凭据的情况下，所述方法还包括：
    所述第一节点获取所述鉴权凭据的鉴权方式；
    所述第一节点利用获取的所述鉴权方式对所述感知请求中的鉴权凭据进行鉴权验证，确定是否执行所述感知请求所请求的感知。
  15. 一种感知鉴权装置，包括：
    第一获取模块，用于获取感知请求以及所述感知请求对应的感知授权信息；
    感知鉴权模块，用于根据所述感知授权信息，进行感知鉴权；其中，所述感知鉴权的鉴权结果用于指示是否执行所述感知请求所请求的感知；
    其中，所述感知授权信息包括：感知区域授权信息，感知目标授权信息以及感知设备授权信息中的至少一项信息。
  16. 根据权利要求15所述的装置，其中，所述感知区域授权信息包括以下至少一项：
    指示第一区域允许感知的第一指示信息；
    所述第一区域允许感知的范围；
    指示第一区域禁止感知的第二指示信息；
    所述第一区域禁止感知的范围；
    具有所述第一区域授权权限的设备的通信信息。
  17. 根据权利要求16所述的装置，其中，所述第一区域允许感知的范围包括以下至少一项：
    所述第一区域允许被感知的内容；
    所述第一区域允许被感知的感知测量数据；
    所述第一区域允许的感知请求发送节点；
    所述第一区域允许的感知结果接收节点；
    所述第一区域允许的感知设备，所述感知设备是进行感知信号发送、感知信号接收、感知信号测量、感知辅助数据上报和感知结果生成中至少一项的设备；
    所述第一区域允许感知的时间；
    所述第一区域允许的感知服务质量QoS。
  18. 根据权利要求16所述的装置，其中，所述第一区域禁止感知的范围包括以下至少一项：
    所述第一区域禁止被感知的内容；
    所述第一区域禁止被感知的感知测量数据；
    所述第一区域禁止的感知请求发送节点；
    所述第一区域禁止的感知结果接收节点；
    所述第一区域禁止的感知设备，所述感知设备是进行感知信号发送、感知信号接收、感知信号测量、感知辅助数据上报和感知结果生成中至少一项的设备；
    所述第一区域禁止感知的时间；
    所述第一区域禁止的感知服务质量QoS。
  19. 根据权利要求15所述的装置，其中，所述感知目标授权信息包括以下至少一项：
    指示第一目标允许被感知的第三指示信息；
    所述第一目标允许被感知的范围；
    指示所述第一目标禁止被感知的第四指示信息；
    所述第一目标禁止被感知的范围；
    具有所述第一目标授权权限的设备的通信信息。
  20. 根据权利要求19所述的装置，其中，所述第一目标允许被感知的范围包括以下至少一项：
    所述第一目标允许被感知的内容；
    所述第一目标允许被感知的感知测量数据；
    所述第一目标允许的感知请求发送节点；
    所述第一目标允许的感知结果接收节点；
    所述第一目标允许的感知设备，所述感知设备是进行感知信号发送、感知信号接收、感知信号测量、感知辅助数据上报和感知结果生成中至少一项的设备；
    所述第一目标允许感知的时间；
    所述第一目标允许被感知的区域；
    所述第一目标允许的感知服务质量QoS。
  21. 根据权利要求19所述的装置，其中，所述第一目标禁止被感知的范围包括以下至少一项：
    所述第一目标禁止被感知的内容；
    所述第一目标禁止被感知的感知测量数据；
    所述第一目标禁止许的感知请求发送节点；
    所述第一目标禁止的感知结果接收节点；
    所述第一目标禁止许的感知设备，所述感知设备是进行感知信号发送、感知信号接收、感知信号测量、感知辅助数据上报和感知结果生成中至少一项的设备；
    所述第一目标禁止感知的时间；
    所述第一目标禁止被感知的区域；
    所述第一目标禁止的感知服务质量QoS。
  22. 根据权利要求15所述的装置，其中，所述感知设备授权信息包括以下至少一项：
    指示第一设备允许参与感知的第五指示信息；
    所述第一设备允许参与感知的范围；
    指示第一设备禁止参与感知的第六指示信息；
    所述第一设备禁止参与感知的范围。
  23. 根据权利要求22所述的装置，其中，所述第一设备允许参与感知的范围包括以下至少一项：
    所述第一设备允许参与的感知功能，所述感知功能包括感知信号发送、感知信号接收、感知信号测量、感知辅助数据上报和感知结果生成中至少一项；
    指示所述第一设备允许被感知请求发送节点确定参与感知的第七指示信息；
    指示允许确定所述第一设备参与感知的感知请求发送节点的第八指示信息；
    所述第一设备允许的感知测量量；
    所述第一设备允许的感知辅助数据，所述感知辅助数据包括位置信息、时间信息、速度信息、目标标识信息中至少一项。
  24. 根据权利要求22所述的装置，其中，所述第一设备禁止参与感知的范围包括以下至少一项：
    指示所述第一设备禁止被感知请求发送节点确定参与感知的第九指示信息；
    指示禁止确定所述第一设备参与感知的感知请求发送节点的第十指示信息；
    所述第一设备禁止的感知测量量；
    所述第一设备禁止的感知辅助数据，所述感知辅助数据包括位置信息、时间信息、速度信息、目标标识信息中至少一项。
  25. 根据权利要求15-24任一项所述的装置，其中，所述装置还包括以下至少一个模块：
    第二获取模块，用于通过签约信息，获取所述感知授权信息；
    第三获取模块，用于向目标设备发送询问信息，并接收目标设备发送的感知授权信息；
    第四获取模块，用于接收目标设备发送的感知授权信息。
  26. 根据权利要求25所述的装置，其中，所述目标设备包括以下至少一项：
    具有感知区域授权权限的设备；
    具有感知目标授权权限的设备；
    感知设备。
  27. 根据权利要求15所述的装置，其中，所述感知请求携带以下至少一项信息：
    感知类型；
    指示是否指定感知设备的第十一指示信息；
    指定感知设备的信息；
    感知区域；
    感知目标；
    感知请求发送节点的标识；
    感知结果接收节点的标识；
    感知内容；
    感知执行的时间信息；
    感知服务质量QoS；
    鉴权凭据。
  28. 根据权利要求27所述的装置，其中，在所述感知请求携带鉴权凭据的情况下，所述装置还包括：
    第五获取模块，用于获取所述鉴权凭据的鉴权方式；
    鉴权模块，用于利用获取的所述鉴权方式对所述感知请求中的鉴权凭据进行鉴权验证，确定是否执行所述感知请求所请求的感知。
  29. 一种第一节点，包括处理器和存储器，所述存储器存储可在所述处理器上运行的程序或指令，其中，所述程序或指令被所述处理器执行时实现如权利要求1至14任一项所述的感知鉴权方法的步骤。
  30. 一种可读存储介质，所述可读存储介质上存储程序或指令，其中，所述程序或指令被处理器执行时实现如权利要求1-14任一项所述的感知鉴权方法的步骤。
PCT/CN2023/124482 2022-10-20 2023-10-13 感知鉴权方法、装置及节点 WO2024083040A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202211289252.1A CN117956453A (zh) 2022-10-20 2022-10-20 感知鉴权方法、装置及节点
CN202211289252.1 2022-10-20

Publications (1)

Publication Number Publication Date
WO2024083040A1 true WO2024083040A1 (zh) 2024-04-25

Family

ID=90736906

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/124482 WO2024083040A1 (zh) 2022-10-20 2023-10-13 感知鉴权方法、装置及节点

Country Status (2)

Country Link
CN (1) CN117956453A (zh)
WO (1) WO2024083040A1 (zh)

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113115341A (zh) * 2021-04-15 2021-07-13 成都极米科技股份有限公司 一种协商无线感知进程的方法、装置、设备及存储介质
CN113207092A (zh) * 2018-02-14 2021-08-03 华为技术有限公司 一种定位操作的方法、装置和系统
US20220044564A1 (en) * 2020-12-25 2022-02-10 Apollo Intelligent Connectivity (Beijing) Technology Co., Ltd. Vehicle control method, vehicle-road coordination system, roadside device and automatic driving vehicle

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113207092A (zh) * 2018-02-14 2021-08-03 华为技术有限公司 一种定位操作的方法、装置和系统
US20220044564A1 (en) * 2020-12-25 2022-02-10 Apollo Intelligent Connectivity (Beijing) Technology Co., Ltd. Vehicle control method, vehicle-road coordination system, roadside device and automatic driving vehicle
CN113115341A (zh) * 2021-04-15 2021-07-13 成都极米科技股份有限公司 一种协商无线感知进程的方法、装置、设备及存储介质

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
VIVO CHINA TELECOM CHINA UNICOM: "Introduction of network based Sensing in 5G Advanced ", 3GPP DRAFT; S2-2106008, 10 August 2021 (2021-08-10), pages 1 - 17, XP052053654 *
VIVO: "Network based Sensing in R18", 3GPP DRAFT; SP-211051, no. 20210908, 8 September 2021 (2021-09-08), pages 1 - 10, XP052052500 *

Also Published As

Publication number Publication date
CN117956453A (zh) 2024-04-30

Similar Documents

Publication Publication Date Title
US20170263092A1 (en) Systems and methods for threat monitoring
WO2020042911A1 (zh) 终端设备识别方法及通信装置
WO2023001184A1 (zh) 感知信号测量方法、装置、网络设备及终端
US20240155394A1 (en) Sensing method and apparatus, terminal, and network device
CN115516934A (zh) 设备感知能力的注册方法、设备感知的应用方法及装置
WO2024083040A1 (zh) 感知鉴权方法、装置及节点
WO2024083045A1 (zh) 鉴权确定方法、鉴权方法、装置及节点
WO2024083038A1 (zh) 侦听方法、装置及相关设备
WO2023061412A1 (zh) 一种传输信息的方法、装置以及系统
EP4380259A1 (en) Sensing device registration method and apparatus, and device
WO2024083044A1 (zh) 侦听方法、装置及相关设备
WO2023231839A1 (zh) 感知数据传输方式的协商方法、装置及通信设备
WO2023143569A1 (zh) 一种无线通信的方法以及装置
WO2024099152A1 (zh) 信息传输方法、装置及通信设备
WO2023083131A1 (zh) 感知方法、装置及通信设备
WO2024131760A1 (zh) 移动性管理方法、装置、通信设备及可读存储介质
WO2024192774A1 (zh) 通信方法、装置、设备、存储介质、芯片、产品及程序
CN118118888B (zh) 一种无人机的身份识别方法、装置及身份获取方法
WO2024022422A1 (zh) 通信感知方法和装置
WO2023051401A1 (zh) 用户相关的数据服务的处理方法、装置及网元
WO2024140572A1 (zh) 感知通道建立方法及装置
WO2024099153A1 (zh) 信息传输方法、装置及通信设备
WO2024032460A1 (zh) 数据收集方法、装置及通信设备
CN117499865A (zh) 定位方法、装置、设备、系统及存储介质
CN116939547A (zh) 服务开放处理方法、装置及相关设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23879031

Country of ref document: EP

Kind code of ref document: A1