WO2020221219A1 - 通信方法和通信设备 - Google Patents

通信方法和通信设备 Download PDF

Info

Publication number
WO2020221219A1
WO2020221219A1 PCT/CN2020/087336 CN2020087336W WO2020221219A1 WO 2020221219 A1 WO2020221219 A1 WO 2020221219A1 CN 2020087336 W CN2020087336 W CN 2020087336W WO 2020221219 A1 WO2020221219 A1 WO 2020221219A1
Authority
WO
WIPO (PCT)
Prior art keywords
service
token
request
scp
producer
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2020/087336
Other languages
English (en)
French (fr)
Inventor
赵绪文
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Priority to EP25172319.3A priority Critical patent/EP4611350A3/en
Priority to EP20798381.8A priority patent/EP3955538B1/en
Publication of WO2020221219A1 publication Critical patent/WO2020221219A1/zh
Priority to US17/513,895 priority patent/US12335114B2/en
Anticipated expiration legal-status Critical
Priority to US19/204,658 priority patent/US20250274359A1/en
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/50—Network service management, e.g. ensuring proper service fulfilment according to agreements
    • H04L41/5041—Network service management, e.g. ensuring proper service fulfilment according to agreements characterised by the time relationship between creation and deployment of a service
    • H04L41/5051—Service on demand, e.g. definition and deployment of services in real time
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/40—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks using virtualisation of network functions or resources, e.g. SDN or NFV entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/50—Network service management, e.g. ensuring proper service fulfilment according to agreements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0807—Network architectures or network communication protocols for network security for authentication of entities using tickets, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/51—Discovery or management thereof, e.g. service location protocol [SLP] or web services
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
    • H04L9/3213—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority using tickets or tokens, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/28—Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication

Definitions

  • This application relates to the field of communication technology, and in particular to communication methods and communication equipment.
  • SCP Service Communication Proxy
  • NF Network Function
  • SCP Service Communication Proxy
  • the embodiments of the present application provide a communication method and a communication device.
  • the first aspect of this application provides a communication method, which may include:
  • the network storage function receives a token request from a service requester (Service Consumer).
  • the NRF sends a response to the Token request to the service requester, where the response to the Token request carries a Token, and the Token includes an NF collection identifier or an NF service collection identifier of a service provider (Service Producer).
  • Service Producer a service provider
  • the Token containing the NF collection identifier of the service provider can be regarded as the Token for the NF collection of the service provider, which is the Token of the NF collection granularity.
  • the Token that contains the NF service set identifier of the service provider can be regarded as the Token for the NF service set and the Token of the NF service set granularity.
  • the token request may carry the service requester's identity (the service requester's identity is, for example, the service requester's NF instance ID (NF Instance ID), etc.).
  • the Token request may also carry one or more of the following information: the service provider's identity, the service provider's NF set identity, and the service provider's NF service set identity.
  • the NRF generates a Token based on the request of the service requester.
  • the Token contains the NF set identifier or NF service set identifier of the service provider, that is, the Token is for the NF set or NF service set to which the service provider belongs.
  • Token that is, this Token is a Token of aggregate granularity. Utilizing the Token of this aggregate granularity is conducive to the realization of service control based on the NF Set granularity, which in turn is conducive to solving the problem of Token verification by different Producers in the Producer Set, and is conducive to the realization of convenient authorization in the eSBA aggregation scenario.
  • the method may further include: the NRF performs service authorization on the service requester, and generating the Token when the service authorization of the service requester is successful.
  • Generating the Token may include: if the Token request carries the identifier of the service provider, the NRF obtains the NF set identifier of the service provider according to the identifier of the service provider, and generates the NF set identifier that includes the service provider. Or, if the Token request carries the NF collection ID of the service provider, the NRF generates a Token containing the NF collection ID of the service provider.
  • the audience claim (Audience Claim) of the Token includes the NF set identifier of the service provider.
  • the Scope Claim of the Token includes the NF service set identifier of the service provider.
  • the second aspect of the present application provides a network storage function NRF, including:
  • the receiving unit is used to receive the token request from the service requester
  • the sending unit is configured to send a response to the Token request to the service requester, where the response to the Token request carries a Token, and the Token contains the NF set identifier of the service provider.
  • the Token request carries one or more of the following information: the identity of the service provider or the NF collection identity of the service provider.
  • the NRF may further include a processing unit, where the processing unit is configured to, if the Token request carries the identification of the service provider, obtain the NF set identification of the service provider according to the identification of the service provider, Generate a Token containing the NF set identifier of the service provider; or, if the Token request carries the NF set identifier of the service provider, generate a Token containing the NF set identifier of the service provider.
  • the audience claim (Audience Claim) of the Token includes the NF set identifier of the service provider.
  • the Scope Claim of the Token includes the NF service set identifier of the service provider.
  • the third aspect of the present application provides an NRF, which includes a processor and a memory coupled to each other.
  • the processor invokes a program stored in the memory to execute part or all of the steps of any communication method provided in the first aspect.
  • a fourth aspect of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement any communication method provided in the first aspect Some or all of the steps.
  • the fifth aspect of the present application provides a communication method, including:
  • the service communication agent SCP receives a service request from a service requester, the service request carries a Token (this Token can be generated by NRF), and the Token contains the NF set identifier or the NF service set identifier of the service provider.
  • the SCP sends the service request to a service provider selected from the NF set or the NF service set of the service provider.
  • the audience claim (Audience Claim) of the Token includes the NF set identifier of the service provider.
  • the Scope Claim of the Token includes the NF service set identifier of the service provider.
  • the service request from the service requester in the above solution carries a Token.
  • the Token contains the NF collection ID or NF service collection ID of the service provider, that is, the Token is the Token for the NF collection or NF service collection to which the service provider belongs. , That is, this Token is a Token of aggregate granularity. Utilizing the Token of this aggregate granularity is conducive to realizing service control based on NF Set granularity or NF Service Set granularity, thereby helping to solve the problem of verifying Tokens by different Producers in Producer Set, and facilitating convenient authorization in eSBA aggregation scenarios.
  • the SCP may select a service provider from the NF set of the service provider or the NF service set based on the local policy and/or other information (for example, may include selection parameters carried in the service request, etc.).
  • the method before sending the service request to the service provider in the NF set indicated by the NF set identifier, the method further includes: SCP verifying the Token included in the service request;
  • the SCP sending the service request to the service provider in the NF set indicated by the NF set identifier includes: in the case that the Token verification succeeds, the SCP sends the NF set identifier indicated The service provider in the NF set sends the service request.
  • the verification of the Token may include the integrity verification of the Token and/or the declaration verification of the Token.
  • the statement verification of the Token may include: verifying whether the NF set identification of the service provider contained in the reader statement in the Token is consistent with the NF set identification of the selected service provider, and if they are consistent
  • the reader of the Token stated that the verification was successful. For example, in the case of inconsistency, it means that the reader of the Token declares that the verification has failed.
  • the verification of the Token statement may include: verifying whether the NF service set identifier of the service provider contained in the scope statement in the Token is consistent with the NF service set identifier of the selected service provider. The following indicates that the scope of the Token has been successfully verified. For example, in the case of inconsistency, it indicates that the verification of the scope of the Token has failed.
  • the service request carries a service provider identifier or a service provider type
  • the NF set identifier of the selected service provider is obtained according to the service provider identifier or the service provider type.
  • the sixth aspect of this application provides an SCP, including:
  • the receiving unit is configured to receive a service request from a service requester, the service request carrying a Token (this Token can be generated by NRF), and the Token contains the NF set identifier or the NF service set identifier of the service provider.
  • the sending unit is used to send the service request from the service provider selected from the NF set of the service provider or the NF service set.
  • the audience claim (Audience Claim) of the Token includes the NF set identifier of the service provider.
  • the Scope Claim of the Token includes the NF service set identifier of the service provider.
  • the service provider may be selected from the NF set of the service provider or the NF service set based on the local policy and/or other information (for example, it may include selection parameters carried in the service request, etc.).
  • the SCP further includes a processing unit configured to check the Token included in the service request before sending the service request to the service provider in the NF set indicated by the NF set identifier.
  • a processing unit configured to check the Token included in the service request before sending the service request to the service provider in the NF set indicated by the NF set identifier.
  • the sending unit is specifically configured to send the service request to the service provider in the NF set indicated by the NF set identifier when the Token verification succeeds.
  • the seventh aspect of the present application provides an SCP, which includes a processor and a memory coupled to each other.
  • the processor invokes a program stored in the memory to execute part or all of the steps of any communication method provided in the fifth aspect.
  • An eighth aspect of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement any communication method provided in the fifth aspect Some or all of the steps.
  • the ninth aspect of the present application provides a communication method, including:
  • the service provider receives the service request sent by the service communication agent SCP, the service request carries a Token, and the Token contains the NF set identifier of the service provider; the service provider verifies the Token; the service provider sends the The response to the service request.
  • the audience claim (Audience Claim) of the Token includes the NF set identifier of the service provider.
  • the Scope Claim of the Token includes the NF service set identifier of the service provider.
  • the verification of the Token may include the integrity verification of the Token and/or the declaration verification of the Token.
  • the statement verification of the Token may include: verifying whether the NF set identification of the service provider contained in the reader statement in the Token is consistent with the NF set identification of the selected service provider, and if they are consistent
  • the reader of the Token stated that the verification was successful. For example, in the case of inconsistency, it means that the reader of the Token declares that the verification has failed.
  • the verification of the Token statement may include: verifying whether the NF service set identifier of the service provider contained in the scope statement in the Token is consistent with the NF service set identifier of the selected service provider. The following indicates that the scope of the Token has been successfully verified. For example, in the case of inconsistency, it indicates that the verification of the scope of the Token has failed.
  • the response to the service request sent by the service provider may carry the Token verification success indication.
  • the response to the service request sent by the service provider may carry a Token verification failure indication.
  • the tenth aspect of the present application provides a service provider, including: a receiving unit configured to receive a service request sent by a service communication agent SCP, the service request carrying a Token, and the Token includes the NF set identifier of the service provider.
  • the processing unit is used to verify the Token.
  • the sending unit is used to send a response to the service request.
  • the audience claim (Audience Claim) of the Token includes the NF set identifier of the service provider.
  • the Scope Claim of the Token includes the NF service set identifier of the service provider.
  • the verification of the Token may include the integrity verification of the Token and/or the declaration verification of the Token.
  • the statement verification of the Token may include: verifying whether the NF set identification of the service provider contained in the reader statement in the Token is consistent with the NF set identification of the selected service provider, and if they are consistent
  • the reader of the Token stated that the verification was successful. For example, in the case of inconsistency, it means that the reader of the Token declares that the verification has failed.
  • the verification of the Token statement may include: verifying whether the NF service set identifier of the service provider contained in the scope statement in the Token is consistent with the NF service set identifier of the selected service provider. The following indicates that the scope of the Token has been successfully verified. For example, in the case of inconsistency, it indicates that the verification of the scope of the token has failed.
  • the response to the service request sent by the service provider may carry the Token verification success indication.
  • the response sent by the service provider to the service request may carry a Token verification failure indication.
  • the eleventh aspect of the present application provides a service provider, which includes a processor and a memory coupled with each other.
  • the processor calls a program stored in the memory to execute part or all of the steps of any communication method provided in the ninth aspect.
  • a twelfth aspect of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement any communication provided in the ninth aspect Part or all of the steps of the method.
  • the thirteenth aspect of the present application provides a communication method, including: a service communication agent SCP receives a service request from a service requester; the SCP grants service authorization to the service requester or the SCP requests an NRF to request the service If the service authorization of the service requester is successful, the SCP sends the service request to a service provider selected from the set of service providers.
  • the method further includes: the SCP generates a Token when the service authorization of the service requester is successful.
  • the service request sent by the SCP to the service provider carries the Token, where the Token includes the NF collection identifier or the NF service collection identifier of the service provider.
  • the audience claim (Audience Claim) of the Token includes the NF set identifier of the service provider.
  • the Scope Claim of the Token includes the NF service set identifier of the service provider.
  • SCP requesting NRF to authorize the service requester includes:
  • the SCP sends an authorization request to the NRF, and the authorization request is used to request the NRF to authorize the service requester; the SCP receives a response to the authorization request sent by the NRF, and the authorization The response of the request carries the service authorization result of the NRF to the service requester, and the service authorization result is service authorization success or service authorization failure.
  • the service request carries the service identifier of the requested service
  • the service authorization of the service requester by the SCP includes: determining the service requester according to the authorization policy or authorization information configured locally by the SCP Whether it has the authority to access the service indicated by the service identifier provided by the service provider.
  • the fourteenth aspect of this application provides an SCP, including:
  • the receiving unit is used to receive the service request from the service requester
  • a processing unit configured to perform service authorization on the service requester or the SCP requests the NRF to perform service authorization on the service requester;
  • the sending unit is configured to send the service request to the service provider in the service provider NF set when the service authorization of the service requester is successful.
  • the method further includes: the SCP generates a Token when the service authorization of the service requester is successful.
  • the service request sent by the SCP to the service provider carries the Token, where the Token includes the NF collection identifier or the NF service collection identifier of the service provider.
  • the audience claim (Audience Claim) of the Token includes the NF set identifier of the service provider.
  • the Scope Claim of the Token includes the NF service set identifier of the service provider.
  • the processing unit requesting the NRF to authorize the service requester includes:
  • the authorization request is used to request the NRF to authorize the service requester; receive a response to the authorization request sent by the NRF, the response to the authorization request carries the A result of the service authorization of the NRF to the service requester, where the result of the service authorization is the success of the service authorization or the failure of the service authorization.
  • the service request carries the service identifier of the requested service
  • the processing unit authorizing the service requester includes: determining whether the service requester is based on the authorization policy or authorization information configured locally by the SCP Have the authority to access the service indicated by the service identifier provided by the service provider.
  • the fifteenth aspect of the present application provides an SCP, which includes a processor and a memory coupled to each other.
  • the processor invokes a program stored in the memory to execute part or all of the steps of any communication method provided in the thirteenth aspect.
  • a sixteenth aspect of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement any one of the methods provided in the thirteenth aspect Part or all of the steps of the communication method.
  • the seventeenth aspect of the present application provides a communication method, including: a network storage function NRF receives an authorization request carrying a service requester identifier from a service communication agent SCP; the NRF responds to the service requester indicated by the service requester identifier Perform service authorization; the NRF sends a response to the authorization request to the SCP, and the response to the authorization request carries the service authorization result of the NRF to the service requester, and the service authorization result is the successful authorization of the service or Service authorization failed.
  • a network storage function NRF receives an authorization request carrying a service requester identifier from a service communication agent SCP; the NRF responds to the service requester indicated by the service requester identifier Perform service authorization; the NRF sends a response to the authorization request to the SCP, and the response to the authorization request carries the service authorization result of the NRF to the service requester, and the service authorization result is the successful authorization of the service or Service authorization failed.
  • the authorization request carries the service identifier of the requested service.
  • Authorizing the service requester indicated by the service requester identifier includes: determining whether the service requester has access to the service provided by the service provider according to the authorization policy or authorization information configured locally by the NRF Identifies the authority of the service represented.
  • the eighteenth aspect of this application provides a network storage function, including:
  • the receiving unit is used to receive the authorization request carrying the service requester identifier from the service communication agent SCP;
  • a processing unit configured to perform service authorization on the service requester indicated by the service requester identifier
  • the sending unit is configured to send a response to the authorization request to the SCP, wherein the response to the authorization request carries the service authorization result of the NRF to the service requester, and the service authorization result is the successful authorization of the service or Service authorization failed.
  • the authorization request carries the service identifier of the requested service.
  • Authorizing the service requester indicated by the service requester identifier includes: determining whether the service requester has access to the service provided by the service provider according to the authorization policy or authorization information configured locally by the NRF Identifies the authority of the service represented.
  • the nineteenth aspect of the present application provides a network storage function, including a processor and a memory coupled with each other.
  • the processor invokes the program stored in the memory to execute part or all of the steps of any communication method provided in the seventeenth aspect.
  • the twentieth aspect of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement any one of the seventeenth aspect. Part or all of the steps of the communication method.
  • the twenty-first aspect of the present application provides a communication method, including:
  • the Service Consumer sends a token request to NRF;
  • the service requester receives a response to the Token request sent by the NRF, and the response to the Token request carries a Token, where the Token includes the NF collection identification or the NF service collection identification of the service provider;
  • the service requester sends a service request carrying the Token to the service communication agent SCP, and the service request is used by the SCP or the service provider to verify the Token;
  • the service requester receives the response to the service request sent by the SCP.
  • the twenty-second aspect of this application provides a service requester, including:
  • the sending unit is used to send a token request to NRF;
  • a receiving unit configured to receive a response to the Token request sent by the NRF, where the response to the Token request carries a Token, and the Token contains the NF collection identifier or the NF service collection identifier of the service provider;
  • the sending unit is further configured to send a service request carrying the Token to the service communication agent SCP, and the service request is used by the SCP or the service provider to verify the Token;
  • the receiving unit is further configured to receive a response to the service request sent by the SCP.
  • the twenty-third aspect of the present application provides a service requester, including a processor and a memory coupled with each other.
  • the processor invokes a program stored in the memory to execute part or all of the steps of any communication method provided in the twenty-first aspect.
  • the twenty-fourth aspect of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement any of the provisions provided in the twenty-first aspect. Part or all of the steps of a communication method.
  • the twenty-fifth aspect of the present application provides a communication method, including: a service requester sends a service request to a service communication agent SCP, wherein the service request includes the NF set identifier or the NF service set identifier of the service provider.
  • the service request is used by the SCP or the network storage function NRF to authorize the service requester.
  • the service requester receives the service response of the service request sent by the SCP.
  • the twenty-sixth aspect of this application provides a service requester, including:
  • the sending unit is used for the service requester to send a service request to the service communication agent SCP, and the service request includes the NF set identifier or the NF service set identifier of the service provider.
  • the service request is used by the SCP or the network storage function NRF to authorize the service requester.
  • the receiving unit is configured to receive the service response of the service request sent by the SCP.
  • the twenty-seventh aspect of the present application provides a service requester, including a processor and a memory coupled with each other.
  • the processor invokes a program stored in the memory to execute part or all of the steps of any communication method provided in the twenty-fifth aspect.
  • a twenty-eighth aspect of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement any of the methods provided in the twenty-fifth aspect. Part or all of the steps of a communication method.
  • An embodiment of the application further provides a communication device, the communication device includes a coupled processor and a memory; the processor is used to call a program stored in the memory to complete any execution of any device provided in the embodiments of the application Part or all of the steps of a method.
  • the embodiments of the present application also provide a computer-readable storage medium, and a program stored in the computer-readable storage medium is executed by a processor to complete any method executed by any device provided in the embodiments of the present application Some or all of the steps.
  • the embodiment of the application also provides a computer program product of instructions, which when the computer program product runs on a computer device, causes the computer device to execute a part of any method executed by any device provided in the embodiments of the application Or all steps.
  • Fig. 1-A is a schematic structural diagram of a communication system provided by an embodiment of the present application.
  • Fig. 1-B to Fig. 1-E are schematic diagrams of the architecture of other communication systems provided by embodiments of the present application.
  • FIGS 12 to 13 are schematic diagrams of the architecture of two network storage functions provided by embodiments of the present application.
  • 14 to 15 are schematic diagrams of the architecture of two SCPs provided by embodiments of the present application.
  • 16 to 17 are schematic diagrams of the architecture of two service providers provided by embodiments of the present application.
  • FIGS 18 to 19 are schematic diagrams of the architecture of two other SCPs provided by embodiments of the present application.
  • 20 to 21 are schematic diagrams of the architecture of two other network storage functions provided by embodiments of the present application.
  • FIGS 22 to 23 are schematic diagrams of the architecture of two service requesters provided by embodiments of the present application.
  • FIGS 24 to 25 are schematic diagrams of another two service requesters provided by embodiments of the present application.
  • FIG. 1-A is a schematic diagram of a 5G network architecture exemplified in an embodiment of the present application.
  • the 5G network splits certain functional network elements of the 4G network (such as mobility management entities (MME, Mobility Management Entity), etc.), and defines an architecture based on a service-oriented architecture.
  • MME mobility management entities
  • MMF Access and Mobility Management Entity
  • SMF Session Management Function
  • UE User Equipment
  • DN Data Network
  • the Access and Mobility Management Function is a control plane network element in the 3GPP network, which is mainly responsible for the access control and mobility management of the UE accessing the operator's network.
  • the security anchor function SEAF, Security Anchor Function
  • SEAF may be deployed in the AMF, or the SEAF may also be deployed in another device different from the AMF.
  • the SEAF is deployed in the AMF as an example.
  • SEAF and AMF can be collectively referred to as AMF.
  • the session management function is a control plane network element in the 3GPP network. Among them, the SMF is mainly used to manage the data packet (PDU, Packet Data Unit) session of the UE.
  • the PDU session is a channel used to transmit PDUs, and the UE can send PDUs to each other through the PDU session and the DN.
  • SMF is responsible for management work such as establishment, maintenance and deletion of PDU sessions.
  • the data network (DN, Data Network) is also called the Packet Data Network (PDN, Packet Data Network), which is a network outside the 3GPP network.
  • the 3GPP network can access multiple DNs, and multiple services provided by operators or third parties can be deployed on the DN.
  • a certain DN is a private network of a smart factory, sensors installed on the smart factory workshop play the role of UE, and the sensor control server is deployed in the DN.
  • the UE communicates with the control server. After the UE obtains an instruction from the control server, it can transmit the collected data to the control server according to the instruction.
  • a DN is a company's internal office network, and the terminal used by the company's employees can play the role of a UE, and this UE can access the company's internal information and other resources.
  • the unified data management network element (UDM, Unified Data Management) is also a control plane network element in the 3GPP network.
  • UDM is mainly responsible for storing the subscription data, credentials and persistent identities of the subscribers (UE) in the 3GPP network.
  • Identity SUPI, Subscriber Permanent Identifier, etc. These data can be used to authenticate and authorize the UE to access the operator's 3GPP network.
  • the authentication server function (AUSF, Authentication Server Function) is also a control plane network element in the 3GPP network, and the AUSF is mainly used for the first level authentication (that is, the 3GPP network authenticates its subscribers).
  • the Network Exposure Function is also a control plane network element in the 3GPP network.
  • NEF is mainly responsible for opening the external interface of the 3GPP network to third parties in a safe manner.
  • NEF can be used as a communication relay.
  • when relaying, NEF can translate internal and external logos. For example, when sending the SUPI of the UE to a third party from the 3GPP network, the NEF can translate the SUPI into its corresponding external identity (ID, Identity). Conversely, NEF can translate the external identity ID into the corresponding SUPI when it is sent to the 3GPP network.
  • ID external identity
  • the network storage function (NRF, Network Repository Function) is also a control plane network element in the 3GPP network. It is mainly responsible for storing the configuration service profile of the accessible network function (NF) and providing it for other network elements. Discovery service for network functions.
  • User Plane Function is the gateway for the communication between the 3GPP network and the DN.
  • the Policy Control Function (PCF, Policy Control Function) is a control plane function in the 3GPP network, which is used to provide the SMF with the policy of the PDU session.
  • Policies can include billing, quality of service (QoS, Quality of Service), authorization-related policies, etc.
  • the access network (AN, Access Network) is a sub-network of the 3GPP network. To access the 3GPP network, the UE first needs to go through the AN. In the radio access scenario, AN is also called Radio Access Network (RAN, Radio Access Network), so the two terms RAN and AN are often mixed without distinction.
  • RAN Radio Access Network
  • 3GPP network refers to a network that complies with 3GPP standards. Among them, the part other than UE and DN in Figure 1-A can be regarded as a 3GPP network.
  • 3GPP networks are not limited to 5G networks defined by 3GPP, but can also include 2G, 3G, and 4G networks. Usually 3GPP networks are operated by operators.
  • N1, N2, N3, N4, N6, etc. in the architecture shown in FIG. 1-A respectively represent reference points between related network elements/network functions. Nausf, Namf... etc. respectively represent service-oriented interfaces of related network functions.
  • 3GPP networks and non-3GPP networks may coexist, and some network elements in the 5G network may also be used in some non-5G networks.
  • the solutions of the embodiments of the present application involve roaming scenarios and non-roaming scenarios.
  • the roaming scenario there are a home network and a visited network, and the architecture of the home network and the visited network may be the same or different.
  • the home network can also be called home domain or home network or home domain.
  • Visited network can also be called visited domain, etc.
  • Figure 1-B to Figure 1-E illustrate some possible network architectures with or without SCP under the eSBA architecture.
  • Figure 1-B and Figure 1-C are some possible network architectures that have not introduced SCP.
  • Figure 1-D and Figure 1-E are some possible network architectures for introducing SCP.
  • some messages (such as service requests and service responses) between the service requester (Service Consumer) and the service provider (Service Producer) can be forwarded through the SCP.
  • the service requester is sometimes also referred to as Consumer for short
  • the service provider is sometimes referred to as Producer for short
  • a service provider set (Service Producer Set) is sometimes also referred to as a Producer Set for short, for example.
  • the method of the embodiment of the present application can be implemented in detail based on the network architecture shown in the example of FIG. 1-D (Option C) to FIG. 1-E (Option D).
  • the service provider (Service Producer) in the architecture shown in the examples shown in FIGS. 1-B to 1-E may specifically be some NFs (network functions) in the core network.
  • the NFs in the core network can be service-oriented interfaces, and the communication between the NFs can be carried out by means of service invocation.
  • the network storage function (NRF, Network Repository Function) can be used to complete NF registration, discover and save the registration information of each NF in the same public land mobile network (PLMN, Public Land Mobile Network), etc.
  • NRF can also be used as an authorization server to complete service authorization, and NRF can also have the function of generating tokens or verifying tokens.
  • the service communication agent SCP is mainly used to implement communication forwarding between NFs, and can also be used to implement load balancing and NF selection, and SCP can also have functions such as NF registration, discovery, and service authorization.
  • the solution of the embodiment of the present application is mainly applied to a system with enhanced service architecture in the second stage of 5G.
  • the SCP may select other NF/NF services from the Set (the selected NF is not necessarily the one requested by the Consumer That NF) acts as a Producer.
  • the Consumer can use the authorization information of other instances in the same Set as the Producer to access the Producer's services. For example: Consumer was previously authorized to access NF_A in the NF Set, but NF_A cannot work due to failures or performance issues.
  • the SCP can directly select NF_B in the same NF Set without initiating a new authorization process. At this time, the Consumer can Is authorized to access NF_B services.
  • the solution of the embodiment of this application may be applicable to the scenario where the Producer is located in the NF Set or the NF Service Set, or the Producer is the NF Set or the NF Service Set.
  • the following embodiments are mainly introduced by taking the Producer in the NF Set as an example.
  • a communication method may include:
  • the service requester sends a token request to the NRF, and the NRF receives the token request from the service requester.
  • the NRF sends a response to the Token request to the service requester, where the response to the Token request carries a Token, and the Token contains the NF set identifier or NF service set identifier of a service provider (Service Producer) .
  • Service Producer Service Producer
  • the service requester receives the response to the Token request from the NRF, and sends a service request to the SCP.
  • the service request carries a Token (this Token can be generated by the NRF), and the Token contains the NF set identification of the service provider or the NF service Collection ID.
  • the SCP receives a service request from a service requester, and the SCP sends the service request to a service provider selected from the NF set or the NF service set of the service provider.
  • the SCP receives the response to the service request from the service provider, and the SCP forwards the response to the service request from the service provider to the service requester.
  • the Token containing the NF collection identifier of the service provider can be regarded as the Token for the NF collection of the service provider, which is the Token of the NF collection granularity.
  • the Token that contains the NF service set identifier of the service provider can be regarded as the Token for the NF service set and the Token of the NF service set granularity.
  • the token request may carry the service requester's identity (the service requester's identity is, for example, the service requester's NF instance ID (NF Instance ID), etc.).
  • the Token request may also carry one or more of the following information: the service provider's identity, the service provider's NF set identity, and the service provider's NF service set identity.
  • the method may further include: the NRF performs service authorization on the service requester, and generating the Token when the service authorization of the service requester is successful.
  • Generating the Token may include: if the Token request carries the identifier of the service provider, the NRF obtains the NF set identifier of the service provider according to the identifier of the service provider, and generates the NF set identifier that includes the service provider. Or, if the Token request carries the NF set identity of the service provider, the NRF generates a Token containing the NF set identity of the service provider.
  • the audience claim (Audience Claim) of the Token includes the NF set identifier of the service provider.
  • the Scope Claim of the Token includes the NF service set identifier of the service provider.
  • the SCP may select a service provider from the NF set or NF service set of the service provider based on local policies and/or other information (for example, may include selection parameters carried in the service request, etc.).
  • the method before sending the service request to the service provider in the NF set indicated by the NF set identifier, the method further includes: SCP verifying the Token included in the service request;
  • the SCP sending the service request to the service provider in the NF set indicated by the NF set identifier includes: in the case that the Token verification succeeds, the SCP sends the NF set identifier indicated The service provider in the NF set sends the service request.
  • the verification of the Token may include the integrity verification of the Token and/or the declaration verification of the Token.
  • the statement verification of the Token may include: verifying whether the NF set identification of the service provider contained in the reader statement in the Token is consistent with the NF set identification of the selected service provider, and if they are consistent
  • the reader of the Token stated that the verification was successful. For example, in the case of inconsistency, it means that the reader of the Token declares that the verification has failed.
  • the verification of the Token statement may include: verifying whether the NF service set identifier of the service provider contained in the scope statement in the Token is consistent with the NF service set identifier of the selected service provider. The following indicates that the scope of the Token has been successfully verified. For example, in the case of inconsistency, it indicates that the verification of the scope of the token has failed.
  • the service request carries a service provider identifier or a service provider type
  • the NF set identifier of the selected service provider is obtained according to the service provider identifier or the service provider type.
  • the NRF generates a Token based on the request of the service requester.
  • the Token contains the NF set identifier or NF service set identifier of the service provider, that is, the Token is for the NF set or NF service set to which the service provider belongs.
  • Token that is, this Token is a Token of aggregate granularity. Utilizing the Token of this aggregate granularity is conducive to the realization of service control based on the NF Set granularity, which in turn is conducive to solving the problem of Token verification by different Producers in the Producer Set, and is conducive to the realization of convenient authorization in the eSBA aggregation scenario.
  • FIG. 3 is a schematic flowchart of another communication method provided by an embodiment of the application.
  • Another communication method may include:
  • the service requester sends a service request to the SCP.
  • the SCP receives a service request from a service requester; the SCP performs service authorization on the service requester or the SCP requests the NRF to perform service authorization on the service requester.
  • the SCP sends the service request to a service provider selected from a set of service providers.
  • the SCP receives the response to the service request from the service provider, and the SCP forwards the response to the service request from the service provider to the service requester.
  • the method further includes: the SCP generates a Token when the service authorization of the service requester is successful.
  • the service request sent by the SCP to the service provider carries the Token, where the Token includes the NF collection identifier or the NF service collection identifier of the service provider.
  • the audience claim (Audience Claim) of the Token includes the NF set identifier of the service provider.
  • the Scope Claim of the Token includes the NF service set identifier of the service provider.
  • the service provider can verify the Token or request the NRF to verify the Token.
  • SCP requesting NRF to authorize the service requester includes:
  • the SCP sends an authorization request to the NRF, and the authorization request is used to request the NRF to authorize the service requester; the SCP receives a response to the authorization request sent by the NRF, and the authorization The response of the request carries the service authorization result of the NRF to the service requester, and the service authorization result is service authorization success or service authorization failure.
  • the service request carries the service identifier of the requested service
  • the service authorization of the service requester by the SCP includes: determining the service requester according to the authorization policy or authorization information configured locally by the SCP Whether it has the authority to access the service indicated by the service identifier provided by the service provider.
  • the SCP can generate a Token in the above solution.
  • the Token contains the NF collection ID or NF service collection ID of the service provider. That is, the Token is the Token for the NF collection or NF service collection to which the service provider belongs, that is, the Token is Token of aggregate granularity. Utilizing the Token of this aggregate granularity is conducive to the realization of service control based on the NF Set granularity, which in turn is conducive to solving the problem of Token verification by different Producers in the Producer Set, and is conducive to the realization of convenient authorization in the eSBA aggregation scenario.
  • another communication method may include:
  • Service Consumer_A sends a Token request to NRF.
  • Service Consumer_A may be, for example, NF_A (at this time, Service Consumer_A of the service requester is specifically NF).
  • the token request may carry the identifier of Service Consumer_A (the identifier of Service Consumer_A may be, for example, the NF identifier of Service Consumer_A, specifically, for example, the NF Instance ID) and the service identifier of the requested service.
  • Service Consumer can also be referred to as Consumer.
  • the Service Producer in the embodiment of the present application may be NF or NF Service, that is, Service Producer may be NF granular, and Service Producer may also be NF Service granular. Service Producer can be referred to as Producer.
  • the Service Producer set includes one or more Service Producers.
  • the Service Producer set at this time can also be called the Service Producer NF set.
  • the Service Producer set at this time can also be called the Service Producer NF Service set.
  • the Service Producer can belong to a certain Service Producer set.
  • the Service Producer set may be referred to as the Producer set, the Producer set to which the Service Producer belongs, or the set to which the Service Producer belongs, that is, in the description of the embodiment of the present application, the set to which the Service Producer belongs refers to the set of Producer to which the Service Producer belongs.
  • the set to which Service Producer belongs is NF Set (NF set), and the identifier of NF Set is NF Set ID.
  • the NF Set ID of the Service Producer is the NF Set ID of the NF Set to which the Service Producer belongs.
  • the Producer set to which the Service Producer belongs is NF Service Set (NF Service Set), where the identifier of NF Service Set is NF Service Set ID.
  • the NF Service Set ID of the Service Producer is the NF Service Set ID of the NF Service Set to which the Service Producer belongs.
  • the Set to which the Service Producer belongs refers to the NF Set to which the Service Producer belongs; the identification of the NF Set to which the Service Producer belongs refers to the NF Set ID of the NF Set to which it belongs.
  • the Set to which the Service Producer belongs refers to the NF Service Set to which the Service Producer belongs, and the identification of the NF Set to which the Service Producer belongs refers to the NF Service Set ID of the NF Service Set to which it belongs.
  • the Token request can also carry Service Producer (service requester) related information.
  • the Token request may also carry Service Producer type and/or Service Producer_B identifier (Service Producer_B identifier may be, for example, Service Consumer_B NF identifier, specifically, for example, NF Instance ID).
  • the identifier of Service Producer_B may be the NF identifier of Service Producer_B (the NF identifier is, for example, NF Instance ID). If Service Producer_B is NF Service, the identifier of Service Producer_B may be the NF Service identifier of Service Producer_B (the NF Service identifier is specifically, for example, NF Service Instance ID).
  • the Token request may carry: the identifier of Service Consumer_A (for example, the NF Instance ID) and the service identifier of the requested service. And the Token request may also carry one or more of the following information: NF type of Service Producer_B, NF Set ID of Service Producer_B (NF Set ID), ID of Service Producer_B (for example, NF Instance ID of Service Producer_B) and other information.
  • the NF Set ID of Service Producer_B is the NF Set ID of the NF Set to which Service Producer_B belongs.
  • the Token request may carry: Service Consumer_A identification (for example, NF Instance ID) and the service identification of the requested service.
  • the Token request can also carry one or more of the following information: Service Producer_B service type, Service Producer_B identifier (for example, Service Producer_B NF Service Instance ID), Service Producer_B NF Service Set ID (NF service set ID) ) And other information.
  • the NF Service Set ID of Service Producer_B is the NF Service Set ID of the NF Service Set to which Service Producer_B belongs.
  • NRF receives the Token request from Service Consumer_A, and NRF authorizes Service Consumer_A.
  • the service authorization for Service Consumer_A may specifically include: obtaining information such as the identification of Service Consumer_A from the Token request, and may combine with locally configured authorization policies and/or authorization information, etc., to perform service authorization for Service Consumer_A.
  • NRF can query the NF to which it belongs according to the identifier of Service Producer_B Set the NF Set ID of the Set, and generate a Token containing the NF Set ID of Service Producer_B.
  • the Audience Claim of Token may include the NF Set ID of Service Producer_B.
  • the step of querying the NF Set ID of the NF Set to which it belongs according to the identifier of Service Producer_B can be omitted.
  • the Audience Claim of Token may include the NF Set ID of Service Producer_B.
  • the Audience Claim of the Token contains the NF Set ID of the NF Set to which the Service Producer belongs, it means that this Token is a NF Set granular token, and this Token can be used to access the services of each Producer in the NF Set to which the Service Producer belongs.
  • Service Producer_B when Service Producer_B is NF Service, then if the Token request carries the Service Producer ID (not carrying NF Service Set ID), after the service authorization is successful, NRF can find it according to the Service Producer_B ID.
  • the NF Service Set ID of the belonging NF Service Set, and a Token containing the NF Service Set ID of Service Producer_B is generated.
  • the scope claim of the token may include the NF Service Set ID of Service Producer_B.
  • the step of querying the NF Service Set ID of the NF Service Set to which it belongs according to the identifier of Service Producer_B can be omitted.
  • the scope claim of the token may include the NF Service Set ID of Service Producer_B.
  • the Scope Claim of the Token contains the NF Service Set ID of the NF Service Set to which Service Producer_B belongs, it means that this Token is a NF Service Set granular token, and this Token can be used to access the services of each Producer in the NF Service Set to which Service Producer_B belongs .
  • the NRF sends the response to the Token request carrying the Token to the Service Consumer_A (the response to the Token request may be referred to as Token response, for example).
  • Service Consumer_A receives the response to the Token request from NRF, and Service Consumer_A sends a service request to SCP.
  • the service request sent by Service Consumer_A carries the Token, the identifier of Service Consumer_A (for example, the NF Instance ID of Service Consumer_A), the identifier of Service Producer_B (for example, the NF Instance ID or NF Service Instance ID of Service Producer_B) and the service identifier of the requested service.
  • the service request sent by Service Consumer_A may also carry selection parameters.
  • the SCP receives the service request from Service Consumer_A.
  • the SCP selects Service Producer_C from the Producer Set to which Service Producer_B belongs (Service Producer_C may be the same as Service Producer_B, or may be different from Service Producer_B).
  • selecting Service Producer_C from the Producer Set may specifically include: if the service request carries selection parameters, the SCP may select Service Producer_C from the Producer Set according to the selection parameters carried in the service request. In addition, if the service request does not carry selection parameters, the SCP can select Service Producer_C from the Producer Set according to the relevant policies configured locally, for example.
  • the Service Producer_C selected by the SCP from the Producer set can be called NF Service_C.
  • Service Producer when Service Producer is NF, the Service Producer_C that SCP may select from the Producer set can be called NF_C.
  • the SCP sends a service request carrying the Token to Service Producer_C.
  • the SCP may add, delete, and/or replace the information carried in the service request from Service Consumer_A, and then send it to Service Producer_C (for example, the selection parameters carried in the service request may be deleted).
  • Service Producer_C for example, the selection parameters carried in the service request may be deleted.
  • the SCP may also directly send to Service Producer_C without any modification to the information carried in the service request from Service Consumer_A.
  • Service Producer_C receives the service request carrying the Token forwarded by the SCP.
  • Token verification operations specifically includes: Token integrity verification and Token declaration verification.
  • the Token integrity verification may include: using the public key of the NRF or the shared key of the NRF to verify the integrity of the Token.
  • the Token statement verification may include: Audience Claim verification of the Token.
  • the Audit Claim verification of the Token may include: verifying whether the NF Set ID contained in the Audience Claim of the Token is consistent with the NF set ID of the NF set of the Service Producer_C that is queried based on the Service Producer_C identifier, and if it is consistent The following indicates that the Audience Claim verification is successful. In the case of inconsistencies, it may indicate that the Audience Claim verification failed.
  • the Token statement verification may also include: Scope Claim verification of the Token.
  • the Scope Claim verification of the token may include: verifying whether the NF Service Set ID contained in the Scope Claim of the Token is consistent with the NF Service Set ID of the NF Service set to which the Service Producer_C belongs based on the service Producer_C identification query , In the case of consistency, it means that the Scope Claim verification is successful, and in the case of inconsistency, it means that the Scope Claim verification has failed.
  • Service Producer_C can also request NRF to verify the Token carried in the service request.
  • Service Producer_C can send the Token carried in the service request to NRF, requesting NRF to verify the Token, and after NRF verifies the Token, it returns the Token verification result to Service Producer_C (the result is Token verification success or Token verification failure).
  • the Service Producer_C sends a response to the service request to the Service Consumer_A (the response to the service request may be referred to as service response, for example).
  • the response can carry a service request success indication (in this case, it means that Service Producer_C agrees to provide services for Service Consumer_A).
  • the response can carry a service request failure indication (in this case, it means that Service Producer_C does not agree to provide services for Service Consumer_A).
  • the SCP After the SCP receives the above service response from Service Producer_C, the SCP can forward the received service response to Service Consumer_A.
  • FIG. 5 is a schematic flowchart of a communication method provided by an embodiment of the application.
  • the process shown in FIG. 5 is a roaming scenario corresponding to the process in FIG. 4.
  • a communication method may include:
  • vNRF is the NRF of the visited network.
  • Service Consumer_A When Service Consumer_A roams to the visited network, Service Consumer_A can send a token request to vNRF (vNRF is the NRF of the visited network).
  • vNRF is the NRF of the visited network.
  • step 401 For the information carried in the Token request, please refer to the relevant description of step 401, which will not be repeated here
  • the vNRF forwards the Token request from NF_A to hNRF (hNRF is the NRF of the home network).
  • hNRF receives the Token request from vNRF, and hNRF authorizes Service Consumer_A and generates Token.
  • the manner in which hNRF performs service authorization on Service Consumer_A and generates Token can refer to the manner in which NRF performs service authorization on Service Consumer_A and generates Token in step 402, which will not be repeated here.
  • the hNRF sends the response to the Token request carrying the Token to the NF_A through the vNRF (the response to the Token request may be referred to as the Token response, for example).
  • Service Consumer_A receives the response to the Token request from hNRF forwarded by hNRF, and Service Consumer_A sends a service request to vSCP (vSCP is the SCP of the visited network).
  • the service request sent by Service Consumer_A carries the Token, the identifier of Service Consumer_A (for example, the NF Instance ID of Service Consumer_A), the identifier of Service Producer_B (for example, the NF Instance ID or NF Service Instance ID of Service Producer_B) and the service identifier of the requested service.
  • the service request sent by Service Consumer_A may also carry selection parameters.
  • vSCP receives the service request from Service Consumer_A, and vSCP forwards the service request from Service Consumer_A to hSCP (hSCP is the SCP of the home network).
  • hSCP receives the service request from Service Consumer_A forwarded by vSCP.
  • hSCP selects Service Producer_C from the Producer Set to which Service Producer_B belongs (Service Producer_C may be the same as Service Producer_B, or may be different from Service Producer_B).
  • selecting Service Producer_C from Producer Set may specifically include: if the service request carries selection parameters, then hSCP may select Service Producer_C from Producer Set according to the selection parameters carried in the service request. In addition, if the service request does not carry selection parameters, the hSCP can select Service Producer_C from the Producer Set, for example, according to the relevant policies configured locally.
  • Service Producer is NF Service
  • the Service Producer_C selected by hSCP from the Producer set can be called NF Service_C.
  • Service Producer_C that hSCP may select from the Producer set can be called NF_C.
  • hSCP sends a service request carrying Token to Service Producer_C.
  • the hSCP may add, delete and/or replace the information carried in the service request from Service Consumer_A, and then send it to Service Producer_C (for example, the selection parameters carried in the service request may be deleted).
  • Service Producer_C for example, the selection parameters carried in the service request may be deleted.
  • the hSCP can also directly send to Service Producer_C without any modification to the information carried in the service request from Service Consumer_A.
  • Service Producer_C receives the service request carrying Token forwarded by hSCP.
  • Service Producer_C performs the token verification operation.
  • Token verification please refer to the related description in step 407, which will not be repeated here.
  • Service Producer_C can also request NRF to verify the Token carried in the service request.
  • the target Service Producer_C can send the Token carried in the service request to NRF, requesting NRF to verify the Token, and after NRF verifies the Token, it returns the Token verification result to Service Producer_C (the result is Token verification success or Token verification failure) .
  • the Service Producer_C sends a response to the service request to the Service Consumer_A (the response to the service request may be referred to as service response, for example).
  • the response can carry a service request success indication (in this case, it means that Service Producer_C agrees to provide services for Service Consumer_A).
  • the response can carry a service request failure indication (in this case, it means that Service Producer_C does not agree to provide services for Service Consumer_A).
  • hSCP After hSCP receives the service response from Service Producer_C, hSCP forwards the received service response to Service Consumer_A through vSCP.
  • the Token Claims in the embodiments of this application also contain other information, for example, it may also contain one or more of the following information: Service Type of the provider, Service Type of the consumer, S-NSSAI, NF Set ID, Service Instance Set ID, Service Zone ID, Service Area, DNN, TAI, PLMN ID, Location Information of the target NF or NF Service, etc.
  • the information contained in the Token Claims in the following embodiments can also be the same, and the details are not described in the following embodiments.
  • NRF can query the Producer's NF Set ID and generate a Token based on the Producer's NF Set ID.
  • the SCP selects the Producer, it sends the token to the selected Producer_C (for example, NF_C ), Producer_C can verify the NF Set ID of Audience Claim in the Token. It realizes authorization based on the granularity of NF Set, and solves the problem of verifying Tokens by different Producers in NF Set, and realizes authorization in the set scenario in eSBA.
  • NRF performs authorization based on local configuration policies or authorization information
  • the Token is sent to the service provider NF_C selected by the SCP along with the service request, the NF_C verifies the Set ID contained in the Token Audience Claim.
  • FIG. 6 is a schematic flowchart of another communication method provided by an embodiment of this application.
  • the Token verification operation can be performed by SCP (or NRF) in the scheme shown in FIG. 6 as an example.
  • a communication method may include:
  • Service Consumer_A sends a Token request to NRF.
  • NRF receives the Token request from Service Consumer_A, and NRF authorizes Service Consumer_A for service and generates Token.
  • the NRF sends a response to the Token request carrying the Token to the Service Consumer_A (the response to the Token request may be referred to as Token response, for example).
  • Service Consumer_A receives the response to the Token request from the NRF, and Service Consumer_A sends a service request to the SCP.
  • steps 601-604 please refer to the detailed description of steps 401-404, which will not be repeated here.
  • the SCP receives the service request from Service Consumer_A.
  • SCP performs Token verification operation.
  • Token verification operations specifically includes: Token integrity verification and Token declaration verification.
  • the Token integrity verification may include: using the public key of the NRF or the shared key of the NRF to verify the integrity of the Token.
  • the Token statement verification may include: Audience Claim verification of the Token.
  • the Audit Claim verification of the Token may include: verifying whether the NF Set ID contained in the Audience Claim of the Token is consistent with the NF set ID of the NF set of the Service Producer_C that is queried based on the Service Producer_C identifier, and if it is consistent The following indicates that the Audience Claim verification is successful. In the case of inconsistencies, it may indicate that the Audience Claim verification failed.
  • the Token statement verification may also include: Scope Claim verification of the Token.
  • the Scope Claim verification of the token may include: verifying whether the NF Service Set ID contained in the Scope Claim of the Token is consistent with the NF Service Set ID of the NF Service set to which the Service Producer_C belongs based on the service Producer_C identification query , In the case of consistency, it means that the Scope Claim verification is successful, and in the case of inconsistency, it means that the Scope Claim verification has failed.
  • the SCP can also request the NRF to verify the Token carried in the service request.
  • the SCP can send the Token carried in the service request to the NRF, requesting the NRF to verify the Token. After the NRF verifies the Token, the SCP returns the Token verification result (the result is Token verification success or Token verification failure).
  • the SCP obtains the Token verification result by performing the Token verification operation, or the SCP requests the NRF to perform the Token verification operation, and learns the Token verification result according to the relevant feedback of the NRF
  • the SCP obtains the Token verification result from ServiceProducer_B Select Service Producer_C in the belonging Producer Set (Service Producer_C may be the same as Service Producer_B or different from Service Producer_B).
  • selecting Service Producer_C from the Producer Set may specifically include: if the service request carries selection parameters, the SCP may select Service Producer_C from the Producer Set according to the selection parameters carried in the service request. In addition, if the service request does not carry selection parameters, the SCP can select Service Producer_C from the Producer Set according to the relevant policies configured locally, for example.
  • the Service Producer_C selected by the SCP from the Producer set can be called NF Service_C.
  • Service Producer when Service Producer is NF, the Service Producer_C that SCP may select from the Producer set can be called NF_C.
  • the SCP can send a response to the service request to Consumer_A, and the response can carry a service request failure indication (in this case, Service Producer_C does not agree to provide services for Consumer_A).
  • the service request failure indication here may specifically indicate that the reason for the failure is a token verification failure.
  • the SCP sends a service request to Service Producer_C (the service request may or may not carry the Token).
  • the SCP can add, delete and/or replace the information carried in the service request from Service Consumer_A and then forward it to the NF_C (for example, the selection parameters carried in the service request can be deleted).
  • the SCP may also directly forward to Service Producer_C without any modification to the information carried in the service request from Service Consumer_A.
  • Service Producer_C receives the service request forwarded by SCP.
  • the Service Producer_C sends a response to the service request to the Service Consumer_A (the response to the service request may be referred to as service response, for example).
  • the response may carry a service request success indication (in this case, Service Producer_C agrees to provide services for Service Consumer_A) or the response may carry a service request failure indication (in this case, Service Producer_C does not agree to provide services for Service Consumer_A).
  • Service Producer_C agrees to provide services for Service Consumer_A
  • Service Producer_C does not agree to provide services for Service Consumer_A
  • the SCP After the SCP receives the above service response from Service Producer_C, the SCP can forward the received service response to Service Consumer_A.
  • SCP performs Token verification (or SCP entrusts a third party (such as NRF) to perform Token verification), but NF_C does not perform Token verification.
  • NF_C is trusted SCP, that is, SCP is trusted SCP of NF_C.
  • the mechanism for establishing trust between NF_C and SCP will not be repeated here.
  • the Token verification is completed on the SCP in advance, and the SCP determines whether to select the Producer and forward the service request according to the Token verification result, which is beneficial to further simplify the process.
  • FIG. 7 is a schematic flowchart of a communication method according to an embodiment of the application.
  • the process shown in FIG. 7 is a roaming scenario corresponding to the process in FIG. 6.
  • a communication method may include:
  • a communication method may include:
  • Service Consumer_A sends a token request to vNRF.
  • the vNRF receives the Token request from Service Consumer_A, and forwards the Token request to hNRF.
  • the hNRF receives the Token request from Service Consumer_A forwarded by the vNRF, and the hNRF performs the service authorization operation and generates the Token.
  • the hNRF sends the response to the Token request carrying the Token to Service Consumer_A through the vNRF (the response to the Token request may be referred to as Token response, for example).
  • Service Consumer_A receives the response to the above Token request from hNRF forwarded by vNRF, and Service Consumer_A sends a service request carrying the Token to vSCP.
  • the vSCP receives the service request carrying the token from Service Consumer_A, and the vSCP forwards the service request carrying the token from Service Consumer_A to hSCP.
  • hSCP receives the service request carrying Token from Service Consumer_A forwarded by vSCP.
  • Token verification operations specifically includes: Token integrity verification and Token declaration verification.
  • the SCP obtains the Token verification result by performing the Token verification operation, or the SCP requests the NRF to perform the Token verification operation, and learns the Token verification result according to the relevant feedback of the NRF
  • the SCP obtains the Token verification result from ServiceProducer_B Select Service Producer_C in the belonging Producer Set (Service Producer_C may be the same as Service Producer_B or different from Service Producer_B).
  • selecting Service Producer_C from the Producer Set may specifically include: if the service request carries selection parameters, the SCP may select Service Producer_C from the Producer Set according to the selection parameters carried in the service request. In addition, if the service request does not carry selection parameters, the SCP can select Service Producer_C from the Producer Set according to the relevant policies configured locally, for example.
  • the Service Producer_C selected by the SCP from the Producer set can be called NF Service_C.
  • Service Producer when Service Producer is NF, the Service Producer_C that SCP may select from the Producer set can be called NF_C.
  • the SCP can send a response to the service request to Consumer_A, and the response can carry a service request failure indication (in this case, Service Producer_C does not agree to provide services for Consumer_A).
  • the service request failure indication here may specifically indicate that the reason for the failure is a token verification failure.
  • hSCP forwards the service request to Service Producer_C (the service request may or may not carry the Token).
  • Service Producer_C receives the service request forwarded by hSCP.
  • Service Producer_C can send a response to a service request to Service Consumer_A through hSCP and vSCP (the response to the service request may be referred to as service response, for example).
  • the response may carry a service request success indication (in this case, Service Producer_C agrees to provide services for Service Consumer_A) or the response may carry a service request failure indication (in this case, Service Producer_C does not agree to provide services for Service Consumer_A).
  • Service Producer_C agrees to provide services for Service Consumer_A
  • Service Producer_C does not agree to provide services for Service Consumer_A
  • hSCP After hSCP receives the above service response from Service Producer_C, hSCP forwards the received service response to Service Consumer_A through vSCP.
  • hSCP performs Token verification (or hSCP entrusts a third party (such as hNRF) to perform Token verification), while NF_C does not perform Token verification.
  • NF_C trusts SCP , That is, SCP is the trusted SCP of NF_C.
  • the mechanism for establishing trust between NF_C and SCP will not be repeated here.
  • the Token verification is completed on the SCP in advance, and the SCP determines whether to select the Producer and forward the service request according to the Token verification result, which is beneficial to further simplify the process.
  • FIG. 8 is a schematic flowchart of another communication method provided by an embodiment of this application.
  • a communication method may include:
  • Service Consumer_A sends a service request to SCP.
  • the service request sent by Service Consumer_A carries the identifier of Service Consumer_A (for example, the NF Instance ID of Service Consumer_A), the identifier of Service Producer_B (for example, the NF Instance ID or NF Service Instance ID of Service Producer_B) and the service identifier of the requested service.
  • Service Consumer_A for example, the NF Instance ID of Service Consumer_A
  • Service Producer_B for example, the NF Instance ID or NF Service Instance ID of Service Producer_B
  • the service request sent by Service Consumer_A may also carry selection parameters.
  • the SCP receives the service request from Service Consumer_A, and the SCP performs service authorization operations on Service Consumer_A.
  • the service authorization for Service Consumer_A may specifically include: obtaining information such as the identification of Service Consumer_A from the Token request, and may combine with locally configured authorization policies and/or authorization information, etc., to perform service authorization for Service Consumer_A.
  • the SCP selects Service Producer_C from the Producer Set to which Service Producer_B belongs (Service Producer_C may be the same as Service Producer_B, or may be different from Service Producer_B).
  • selecting Service Producer_C from the Producer Set may specifically include: if the service request carries selection parameters, the SCP may select Service Producer_C from the Producer Set according to the selection parameters carried in the service request. In addition, if the service request does not carry selection parameters, the SCP can select Service Producer_C from the Producer Set according to the relevant policies configured locally, for example.
  • the Service Producer_C selected by the SCP from the Producer set can be called NF Service_C.
  • Service Producer when Service Producer is NF, the Service Producer_C that SCP may select from the Producer set can be called NF_C.
  • the SCP forwards the service request to Service Producer_C.
  • Service Producer_C receives the service request forwarded by SCP.
  • the Service Producer_C sends a response to the service request to the Service Consumer_A (the response to the service request may be referred to as service response, for example).
  • the response may carry a service request success indication (in this case, Service Producer_C agrees to provide services for Service Consumer_A) or the response may carry a service request failure indication (in this case, Service Producer_C does not agree to provide services for Service Consumer_A).
  • Service Producer_C agrees to provide services for Service Consumer_A
  • Service Producer_C does not agree to provide services for Service Consumer_A
  • the SCP can forward the received service response to Service Consumer_A.
  • Service Producer_C trusts the SCP, so the service authorization for the SCP is considered trustworthy.
  • FIG. 9 is a schematic flowchart of another communication method provided by an embodiment of this application.
  • the process shown in FIG. 9 is a roaming scenario corresponding to the process in FIG. 8.
  • a communication method may include:
  • Service Consumer_A sends a service request to vSCP.
  • the service request sent by Service Consumer_A carries the identifier of Service Consumer_A (for example, the NF Instance ID of Service Consumer_A), the identifier of Service Producer_B (for example, the NF Instance ID or NF Service Instance ID of Service Producer_B) and the service identifier of the requested service.
  • Service Consumer_A for example, the NF Instance ID of Service Consumer_A
  • Service Producer_B for example, the NF Instance ID or NF Service Instance ID of Service Producer_B
  • the service request sent by Service Consumer_A may also carry selection parameters.
  • vSCP receives the service request from Service Consumer_A, and vSCP forwards the service request from Service Consumer_A to hSCP.
  • hSCP receives the service request from Service Consumer_A forwarded by vSCP, and hSCP performs service authorization operations.
  • the service authorization for Service Consumer_A may specifically include: obtaining information such as the identification of Service Consumer_A from the Token request, and may combine with locally configured authorization policies and/or authorization information, etc., to perform service authorization for Service Consumer_A.
  • hSCP selects Service Producer_C from the Producer Set to which Service Producer_B belongs (Service Producer_C may be the same as Service Producer_B, or may be different from Service Producer_B).
  • selecting Service Producer_C from Producer Set may specifically include: if the service request carries selection parameters, then hSCP may select Service Producer_C from Producer Set according to the selection parameters carried in the service request. In addition, if the service request does not carry selection parameters, the hSCP can select Service Producer_C from the Producer Set, for example, according to the relevant policies configured locally.
  • Service Producer is NF Service
  • the Service Producer_C selected by hSCP from the Producer set can be called NF Service_C.
  • Service Producer_C that hSCP may select from the Producer set can be called NF_C.
  • Service Producer_C receives the service request forwarded by hSCP.
  • the Service Producer_C sends a response to the service request to the Service Consumer_A through hSCP and vSCP (the response to the service request may be referred to as service response, for example).
  • the response may carry a service request success indication (in this case, Service Producer_C agrees to provide services for Service Consumer_A) or the response may carry a service request failure indication (in this case, Service Producer_C does not agree to provide services for Service Consumer_A).
  • Service Producer_C agrees to provide services for Service Consumer_A
  • Service Producer_C does not agree to provide services for Service Consumer_A
  • hSCP After hSCP receives the above service response from Service Producer_C, hSCP forwards the received service response to Service Consumer_A through vSCP.
  • a communication method may include:
  • Service Consumer_A sends a service request to SCP.
  • the service request sent by Service Consumer_A carries the identifier of Service Consumer_A (for example, the NF Instance ID of Service Consumer_A), the identifier of Service Producer_B (for example, the NF Instance ID or NF Service Instance ID of Service Producer_B) and the service identifier of the requested service.
  • Service Consumer_A for example, the NF Instance ID of Service Consumer_A
  • Service Producer_B for example, the NF Instance ID or NF Service Instance ID of Service Producer_B
  • the service request sent by Service Consumer_A may also carry selection parameters.
  • the SCP receives the service request from Service Consumer_A, and the SCP performs service authorization operations on Service Consumer_A and generates Token.
  • the service authorization for Service Consumer_A may specifically include: obtaining information such as the identification of Service Consumer_A from the Token request, and may combine with locally configured authorization policies and/or authorization information, etc., to perform service authorization for Service Consumer_A.
  • the SCP selects Service Producer_C from the Producer Set to which Service Producer_B belongs (Service Producer_C may be the same as Service Producer_B, or may be different from Service Producer_B).
  • selecting Service Producer_C from the Producer Set may specifically include: if the service request carries selection parameters, the SCP may select Service Producer_C from the Producer Set according to the selection parameters carried in the service request. In addition, if the service request does not carry selection parameters, the SCP can select Service Producer_C from the Producer Set according to the relevant policies configured locally, for example.
  • the Service Producer_C selected by the SCP from the Producer set can be called NF Service_C.
  • Service Producer when Service Producer is NF, the Service Producer_C that SCP may select from the Producer set can be called NF_C.
  • the SCP may send a service request response to Service Consumer_A, and the response may carry a service request failure indication (in this case, Service Producer_C does not agree to provide services for Service Consumer_A).
  • the service request failure indication may specifically indicate that the reason for the failure is service authorization failure.
  • the SCP forwards the service request carrying the Token to Service Producer_C.
  • the SCP can add (such as Token), delete and/or replace information carried in the service request from Service Consumer_A and then forward it to Service Producer_C (for example, the selection parameters carried in the service request can be deleted).
  • Token such as Token
  • Service Producer_C for example, the selection parameters carried in the service request can be deleted.
  • the Service Producer_C receives the service request carrying the Token forwarded by the SCP.
  • Service Producer_C performs Token verification operation.
  • Service Producer_C can also request NRF to verify the Token carried in the service request.
  • Service Producer_C can send the Token carried in the service request to NRF, requesting NRF to verify the Token, and after NRF verifies the Token, it returns the Token verification result to Service Producer_C (the result is Token verification success or Token verification failure).
  • the Service Producer_C sends a response to the service request to the Service Consumer_A (the response to the service request may be referred to as service response, for example).
  • the response can carry a service request success indication (in this case, it means that Service Producer_C agrees to provide services for Service Consumer_A).
  • the response can carry a service request failure indication (in this case, it means that Service Producer_C does not agree to provide services for Service Consumer_A).
  • the SCP After the SCP receives the above service response from Service Producer_C, the SCP can forward the received service response to Service Consumer_A.
  • FIG. 11 is a schematic flowchart of another communication method provided by an embodiment of this application.
  • the process shown in FIG. 11 is a roaming scenario corresponding to the process in FIG. 10.
  • a communication method may include:
  • Service Consumer_A sends a service request to vSCP.
  • the service request sent by Service Consumer_A carries the identifier of Service Consumer_A (for example, the NF Instance ID of Service Consumer_A), the identifier of Service Producer_B (for example, the NF Instance ID or NF Service Instance ID of Service Producer_B) and the service identifier of the requested service.
  • Service Consumer_A for example, the NF Instance ID of Service Consumer_A
  • Service Producer_B for example, the NF Instance ID or NF Service Instance ID of Service Producer_B
  • the service request sent by Service Consumer_A may also carry selection parameters.
  • vSCP receives the service request from Service Consumer_A, and vSCP forwards the service request from Service Consumer_A to hSCP.
  • hSCP receives the service request from Service Consumer_A forwarded by vSCP, and hSCP performs service authorization operations and generates Token.
  • the service authorization for Service Consumer_A may specifically include: obtaining information such as the identification of Service Consumer_A from the Token request, and may combine with locally configured authorization policies and/or authorization information, etc., to perform service authorization for Service Consumer_A.
  • hSCP selects Service Producer_C from the Producer Set to which Service Producer_B belongs (Service Producer_C may be the same as Service Producer_B, or may be different from Service Producer_B).
  • selecting Service Producer_C from Producer Set may specifically include: if the service request carries selection parameters, then hSCP may select Service Producer_C from Producer Set according to the selection parameters carried in the service request. In addition, if the service request does not carry selection parameters, the hSCP can select Service Producer_C from the Producer Set, for example, according to the relevant policies configured locally.
  • Service Producer is NF Service
  • the Service Producer_C selected by hSCP from the Producer set can be called NF Service_C.
  • Service Producer_C that hSCP may select from the Producer set can be called NF_C.
  • hSCP may send a response to the service request to Service Consumer_A, and the response may carry a service request failure indication (in this case, it means that Service Producer_C does not agree to provide services for Service Consumer_A).
  • the service request failure indication may specifically indicate that the reason for the failure is service authorization failure.
  • hSCP forwards the service request carrying the token to Service Producer_C.
  • hSCP can add (such as Token), delete and/or replace the information carried in the service request from Service Consumer_A and then forward it to Service Producer_C (for example, the selection parameters carried in the service request can be deleted).
  • Token such as Token
  • Service Producer_C for example, the selection parameters carried in the service request can be deleted.
  • Service Producer_C receives the service request carrying the Token forwarded by hSCP. Service Producer_C performs the token verification operation.
  • Service Producer_C performs Token verification operation.
  • Service Producer_C can also request NRF to verify the Token carried in the service request.
  • Service Producer_C can send the Token carried in the service request to NRF, requesting NRF to verify the Token, and after NRF verifies the Token, it returns the Token verification result to Service Producer_C (the result is Token verification success or Token verification failure).
  • the Service Producer_C sends a response to the service request to the Service Consumer_A (the response to the service request may be referred to as service response, for example).
  • the response can carry a service request success indication (in this case, it means that Service Producer_C agrees to provide services for Service Consumer_A).
  • the response can carry a service request failure indication (in this case, it means that Service Producer_C does not agree to provide services for Service Consumer_A).
  • hSCP After hSCP receives the above service response from Service Producer_C, hSCP forwards the received service response to Service Consumer_A through vSCP.
  • NRF or SCP can perform service authorization operations, and NRF or SCP can also perform Token generation operations, and the generated Token can be set granular, which can implement eSBA architecture
  • the Producer is located in the NF/NF service set, or the Producer is authorized when the NF/NF service set is used.
  • the Consumer can use the authorization information of other Instances in the same Set as the Producer to access the Producer's services.
  • the authorization of the above interactive mode in roaming scenarios can be realized.
  • an embodiment of the present application also provides a network storage function NRF1200, including:
  • the receiving unit 1210 is configured to receive a token request from a service requester.
  • the sending unit 1220 is configured to send a response to the Token request to the service requester, where the response to the Token request carries a Token, and the Token contains the NF set identifier of the service provider.
  • the Token request carries one or more of the following information: the identity of the service provider or the NF collection identity of the service provider.
  • the NRF may further include a processing unit 1230, where the processing unit is configured to obtain the NF set identifier of the service provider according to the service provider’s identifier if the Token request carries the identifier of the service provider , Generate a Token containing the NF set identification of the service provider; or, if the Token request carries the NF set identification of the service provider, generate a Token containing the NF set identification of the service provider.
  • the audience claim (Audience Claim) of the Token includes the NF set identifier of the service provider.
  • the Scope Claim of the Token includes the NF service set identifier of the service provider.
  • an embodiment of the present application also provides an NRF, including:
  • the processor 1310 and the memory 1320 are coupled to each other.
  • the processor calls the program stored in the memory to perform the following steps: receiving a token (Token) request from a service requester; sending a response to the Token request to the service requester, where the Token requested The response carries a Token, and the Token contains the NF collection identifier or the NF service collection identifier of the service provider (Service Producer).
  • Token a token
  • Service Producer Service Producer
  • an embodiment of the present application also provides an SCP 1400, including:
  • the receiving unit 1410 is configured to receive a service request from a service requester, the service request carrying a Token (this Token can be generated by NRF), and the Token contains the NF collection identifier or the NF service collection identifier of the service provider.
  • the sending unit 1420 is configured to send the service request from the service provider selected from the NF set or the NF service set of the service provider.
  • the audience claim (Audience Claim) of the Token includes the NF set identifier of the service provider.
  • the Scope Claim of the Token includes the NF service set identifier of the service provider.
  • the service provider may be selected from the NF set of the service provider or the NF service set based on the local policy and/or other information (for example, it may include selection parameters carried in the service request, etc.).
  • the SCP further includes a processing unit 1430, configured to perform processing on the Token included in the service request before sending the service request to the service provider in the NF set indicated by the NF set identifier check;
  • the sending unit is specifically configured to send the service request to the service provider in the NF set indicated by the NF set identifier when the Token verification succeeds.
  • an embodiment of the present application also provides an SCP 1500, including:
  • the processor 1510 and the memory 1520 are coupled to each other.
  • the processor 1510 calls the program stored in the memory 1520 to perform the following steps:
  • a service request from a service requester is received, where the service request carries a Token (this Token can be generated by NRF), and the Token contains the NF collection identification or the NF service collection identification of the service provider.
  • the service provider selected from the NF set or the NF service set of the service provider sends the service request.
  • an embodiment of the present application also provides a service provider 1600, including: a receiving unit 1610, configured to receive a service request sent by a service communication agent SCP, the service request carries a Token, and the Token contains the service provider’s NF collection identifier.
  • the processing unit 1630 is configured to verify the Token.
  • the sending unit 1620 is configured to send a response to the service request.
  • the audience claim (Audience Claim) of the Token includes the NF set identifier of the service provider.
  • the Scope Claim of the Token includes the NF service set identifier of the service provider.
  • the verification of the Token may include the integrity verification of the Token and/or the declaration verification of the Token.
  • the statement verification of the Token may include: verifying whether the NF set identification of the service provider contained in the reader statement in the Token is consistent with the NF set identification of the selected service provider, and if they are consistent
  • the reader of the Token stated that the verification was successful. For example, in the case of inconsistency, it means that the reader of the Token declares that the verification has failed.
  • the verification of the Token statement may include: verifying whether the NF service set identifier of the service provider contained in the scope statement in the Token is consistent with the NF service set identifier of the selected service provider. The following indicates that the scope of the Token has been successfully verified. For example, in the case of inconsistency, it indicates that the verification of the scope of the token has failed.
  • the response to the service request sent by the service provider may carry the Token verification success indication.
  • the response to the service request sent by the service provider may carry a Token verification failure indication.
  • an embodiment of the present application also provides a service provider 1700 including a processor 1710 and a memory 1720 that are coupled to each other.
  • the processor invokes the program stored in the memory to perform the following steps: receiving a service request sent by the service communication agent SCP, wherein the service request carries a Token, and the Token contains the NF set identifier of the service provider. Verify the Token. Send a response to the service request.
  • an embodiment of the present application also provides an SCP 1800, including:
  • the receiving unit 1810 is used to receive a service request from a service requester
  • the processing unit 1830 is configured to perform service authorization on the service requester or the SCP requests the NRF to perform service authorization on the service requester;
  • the sending unit 1820 is configured to send the service request to the service provider in the service provider NF set by the SCP when the service authorization of the service requester is successful.
  • the method further includes: the SCP generates a Token when the service authorization of the service requester is successful.
  • the service request sent by the SCP to the service provider carries the Token, where the Token includes the NF set identifier or the NF service set identifier of the service provider.
  • the audience claim (Audience Claim) of the Token includes the NF set identifier of the service provider.
  • the Scope Claim of the Token includes the NF service set identifier of the service provider.
  • the processing unit requesting the NRF to authorize the service requester includes:
  • the authorization request is used to request the NRF to authorize the service requester; receive a response to the authorization request sent by the NRF, the response to the authorization request carries the A result of the service authorization of the NRF to the service requester, where the result of the service authorization is the success of the service authorization or the failure of the service authorization.
  • the service request carries the service identifier of the requested service
  • the processing unit authorizing the service requester includes: determining whether the service requester is based on the authorization policy or authorization information configured locally by the SCP Have the authority to access the service indicated by the service identifier provided by the service provider.
  • an embodiment of the present application also provides an SCP 1900, which includes a processor 1910 and a memory 1920 coupled to each other.
  • the processor 1910 calls the program stored in the memory to perform the following steps: receiving a service request from a service requester; performing service authorization on the service requester or the SCP requesting NRF to perform the service request on the service requester Service authorization; in the case that the service authorization of the service requester is successful, the SCP sends the service request to the service provider in the service provider set.
  • an embodiment of the present application further provides a network storage function 2000, including:
  • the receiving unit 2010 is configured to receive the authorization request carrying the service requester identifier from the service communication agent SCP.
  • the processing unit 2030 is configured to perform service authorization on the service requester indicated by the service requester identifier.
  • the sending unit 2020 is configured to send a response to the authorization request to the SCP, where the response to the authorization request carries the service authorization result of the NRF to the service requester, and the service authorization result is a successful service authorization Or service authorization failed.
  • the authorization request carries the service identifier of the requested service.
  • Authorizing the service requester indicated by the service requester identifier includes: determining whether the service requester has access to the service provided by the service provider according to the authorization policy or authorization information configured locally by the NRF Identifies the authority of the service represented.
  • an embodiment of the present application further provides a network storage function 2100, including a processor 2110 and a memory 2120 coupled to each other.
  • the processor calls the program stored in the memory to perform the following steps: receiving an authorization request carrying a service requester identifier from the service communication agent SCP; performing service authorization on the service requester indicated by the service requester identifier Sending the response to the authorization request to the SCP, wherein the response to the authorization request carries the result of the service authorization of the NRF to the service requester, wherein the result of the service authorization is the success of the service authorization or the service authorization failure.
  • an embodiment of the present application also provides a service requester 2200, including:
  • the sending unit 2210 is configured to send a token request to the NRF
  • the receiving unit 2220 is configured to receive a response to the Token request sent by the NRF, where the response to the Token request carries a Token, and the Token contains the NF collection identifier or the NF service collection identifier of the service provider;
  • the sending unit 2210 is further configured to send a service request carrying the Token to the service communication agent SCP, and the service request is used by the SCP or the service provider to verify the Token;
  • the receiving unit 2220 is further configured to receive a response to the service request sent by the SCP.
  • an embodiment of the present application further provides a service requester 2300, including: a processor 2310 and a memory 2320 coupled to each other.
  • the processor 2310 calls the program stored in the memory to perform the following steps: send a token request to the NRF; receive a response to the Token request sent by the NRF, wherein the response to the Token request carries a token ,
  • the Token includes the NF set identifier or the NF service set identifier of the service provider; and sends a service request carrying the Token to the service communication agent SCP, and the service request is used by the SCP or the service provider to request the Token Perform verification; receive the response to the service request sent by the SCP.
  • an embodiment of the present application also provides a service requester 2400, including:
  • the sending unit 2410 is configured to send a service request to the service communication agent SCP, where the service request includes the NF set identifier or the NF service set identifier of the service provider.
  • the service request is used by the SCP or the network storage function NRF to authorize the service requester.
  • the receiving unit 2420 is configured to receive the service response of the service request sent by the SCP.
  • an embodiment of the present application further provides a service requester 2500, including: a processor 2510 and a memory 2520 coupled to each other.
  • the processor 2510 invokes the program stored in the memory to perform the following steps: send a service request to the service communication agent SCP, the service request includes the NF set identifier or the NF service set identifier of the service provider.
  • the service request is used by the SCP or the network storage function NRF to authorize the service requester. Receiving the service response of the service request sent by the SCP.
  • the embodiment of the present application also provides a computer-readable storage medium, the computer-readable storage medium stores a computer program, the computer program is executed by hardware (such as a processor, etc.), and is executed by any device in the embodiment of the present application Part or all of the steps of any method.
  • the embodiments of the present application also provide a computer program product including instructions, which when the computer program product runs on a computer device, cause the computer device to execute part or all of the steps of any one of the above aspects.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website, computer, server, or data center.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or data center integrated with one or more available media.
  • the usable medium may be a magnetic medium (such as a floppy disk, a hard disk, and a magnetic tape), an optical medium (such as an optical disk), or a semiconductor medium (such as a solid state hard disk).
  • the disclosed device may also be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components can be combined or integrated. To another system, or some features can be ignored or not implemented.
  • the displayed or discussed indirect coupling or direct coupling or communication connection between each other may be through some interfaces, indirect coupling or communication connection between devices or units, and may be in electrical or other forms.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed to multiple network units. . Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • the functional units in the embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit may be implemented in the form of hardware, or may also be implemented in the form of software functional unit.
  • the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium.
  • the technical solution of the application essentially or the part that contributes to the existing technology or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium,
  • a number of instructions are included to enable a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application.
  • the aforementioned storage medium may include, for example: U disk, mobile hard disk, Read-Only Memory (ROM), Random Access Memory (RAM, Random Access Memory), magnetic disks or optical disks and other storable program codes. Medium.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

一些通信方法和通信设备。通信方法可包括：服务通信代理SCP接收来自服务请求者的服务请求，所述服务请求携带Token，所述Token包含服务提供者的NF集合标识；所述SCP向从服务提供者的NF集合中选择的服务提供者发送所述服务请求。其中，本申请实施例方案有利于解决NF Set内不同Producer校验Token的问题，有利于实现eSBA中集合场景下的便捷授权。

Description

通信方法和通信设备 技术领域
本申请涉及通信技术领域，尤其涉及通信方法和通信设备。
背景技术
第三代合作伙伴项目(3GPP,3rd Generation Partnership Project)的SA2工作组提出针对5G核心网的服务化架构增强(eSBA,Enhancement of Service Based Architecture)项目，其中引入服务通信代理(SCP,Service Communication Proxy)等，SCP可以用于网络功能(NF,Network Function)之间的间接通信。NF之间的服务调用可通过SCP转发，SCP还可具有NF发现和负载均衡等功能。
目前，在eSBA架构下引入SCP之后的针对相关NF的授权实现机制，是业内需要研究的一个重要技术问题。
发明内容
本申请实施例提供通信方法和通信设备。
本申请第一方面提供一种通信方法，可包括：
网络存储功能(NRF,Network Repository Function)接收来自服务请求者(Service Consumer)的令牌(Token)请求。
所述NRF向所述服务请求者发送所述Token请求的响应，其中，所述Token请求的响应携带Token，所述Token包含服务提供者(Service Producer)的NF集合标识或NF服务集合标识。
其中，包含服务提供者的NF集合标识的Token，可看作是针对服务提供者的NF集合的Token，是NF集合粒度的Token。包含服务提供者的NF服务集合标识的Token，可看作是针对NF服务集合的Token，是NF服务集合粒度的Token。
其中，令牌请求可以携带服务请求者的标识(服务请求者的标识例如为服务请求者的NF实例标识(NF Instance ID)等)。
所述Token请求还可携带如下信息中的一种或多种：服务提供者的标识、服务提供者的NF集合标识、服务提供者的NF服务集合标识。
可以看出，上述方案中由NRF来基于服务请求者的请求生成Token，所述Token包含服务提供者的NF集合标识或NF服务集合标识，即Token是针对服务提供者所属NF集合或NF服务集合的Token，即这个Token是集合粒度的Token。利用这个集合粒度的Token有利于实现基于NF Set粒度的服务控制，进而有利于解决Producer Set内不同Producer校验Token的问题，有利于实现eSBA中集合场景下的便捷授权。
举例来说，方法还可包括：所述NRF对所述服务请求者进行服务授权，在所述服务请求者的服务授权成功的情况下生成所述Token。
生成所述Token可包括：若所述Token请求中携带所述服务提供者的标识，所述NRF根据所述服务提供者的标识得到所述服务提供者的NF集合标识，生成包含所述服务提供者的NF集合标识的Token；或者,若所述Token请求中携带所述服务提供者的NF集合标识， 则所述NRF生成包含所述服务提供者的NF集合标识的Token。
举例来说，当服务提供者为NF，所述Token的读者申明(Audience Claim)中包含所述服务提供者的NF集合标识。
或者，当服务提供者为NF Service，所述Token的范围申明(Scope Claim)中包含所述服务提供者的NF服务集合标识。
本申请第二方面提供一种网络存储功能NRF，包括：
接收单元，用于接收来自服务请求者的令牌Token请求；
发送单元，用于向所述服务请求者发送所述Token请求的响应，其中，所述Token请求的响应携带Token，所述Token包含服务提供者的NF集合标识。
举例来说，所述Token请求携带如下信息中的一种或者多种：服务提供者的标识或服务提供者的NF集合标识。
例如所述NRF还可包括处理单元，其中，处理单元用于若所述Token请求中携带所述服务提供者的标识，根据所述服务提供者的标识得到所述服务提供者的NF集合标识，生成包含所述服务提供者的NF集合标识的Token；或者,若所述Token请求中携带所述服务提供者的NF集合标识，生成包含所述服务提供者的NF集合标识的Token。
举例来说，当服务提供者为NF，所述Token的读者申明(Audience Claim)中包含所述服务提供者的NF集合标识。
或者，当服务提供者为NF Service，所述Token的范围申明(Scope Claim)中包含所述服务提供者的NF服务集合标识。
本申请第三方面提供一种NRF，包括相互耦合的处理器和存储器。所述处理器调用所述存储器中存储的程序，以执行第一方面提供的任意一种通信方法的部分或全部步骤。
本申请第四方面提供一种计算机可读存储介质，其中，所述计算机可读存储介质存储有计算机程序，所述计算机程序被处理器执行，以实现执行第一方面提供的任意一种通信方法的部分或全部步骤。
本申请第五方面提供一种通信方法，包括：
服务通信代理SCP接收来自服务请求者的服务请求，所述服务请求携带Token(这个Token可由NRF生成)，所述Token包含服务提供者的NF集合标识或NF服务集合标识。所述SCP向从服务提供者的NF集合或NF服务集合中选择的服务提供者发送所述服务请求。
举例来说，当服务提供者为NF，所述Token的读者申明(Audience Claim)中包含所述服务提供者的NF集合标识。
或者，当服务提供者为NF Service，所述Token的范围申明(Scope Claim)中包含所述服务提供者的NF服务集合标识。
可以看出，上述方案中来自服务请求者的服务请求携带Token，所述Token包含服务提供者的NF集合标识或NF服务集合标识，即Token是针对服务提供者所属NF集合或NF服务集合的Token，即这个Token是集合粒度的Token。利用这个集合粒度的Token有利于实现基于NF Set粒度或NF Service Set粒度的服务控制，进而有利于解决Producer Set内不同Producer校验Token的问题，有利于实现eSBA中集合场景下的便捷授权。
其中，SCP可以基于本地策略和/或其它信息(例如可包括携带于服务请求的selection  parameters等)来从服务提供者的NF集合或NF服务集合中选择服务提供者。
举例来说，所述向所述NF集合标识所表示的NF集合中的服务提供者发送所述服务请求之前还包括：SCP对所述服务请求包含的所述Token进行校验；
其中，所述SCP向所述NF集合标识所表示的NF集合中的服务提供者发送所述服务请求包括：在所述Token校验成功的情况下，所述SCP向所述NF集合标识所表示的NF集合中的服务提供者发送所述服务请求。
举例来说，所述Token的校验可包括Token的完整性校验和/或Token的申明校验。
例如Token的申明校验可以包括：校验Token中的读者申明包含的所述服务提供者的NF集合标识，与所述选择的服务提供者的NF集合标识是否一致，在一致的情况下表示所述Token的读者申明校验成功。例如在不一致的情况下表示所述Token的读者申明校验失败。
又例如Token的申明校验可以包括：校验Token中的范围申明包含的所述服务提供者的NF服务集合标识，与所述选择的服务提供者的NF服务集合标识是否一致，在一致的情况下表示所述Token的范围申明校验成功。例如在不一致的情况下表示所述Token的范围申明校验失败。
举例来说，所述服务请求携带服务提供者标识或者服务提供者类型,所述选择的服务提供者的NF集合标识根据所述服务提供者标识或者所述服务提供者类型得到。
本申请第六方面提供一种SCP，包括：
接收单元，用于接收来自服务请求者的服务请求，所述服务请求携带Token(这个Token可由NRF生成)，所述Token包含服务提供者的NF集合标识或NF服务集合标识。
发送单元，用于从服务提供者的NF集合或NF服务集合中选择的服务提供者发送所述服务请求。
举例来说，当服务提供者为NF，所述Token的读者申明(Audience Claim)中包含所述服务提供者的NF集合标识。
或者，当服务提供者为NF Service，所述Token的范围申明(Scope Claim)中包含所述服务提供者的NF服务集合标识。
其中，可基于本地策略和/或其它信息(例如可包括携带于服务请求的selection parameters等)来从服务提供者的NF集合或NF服务集合中选择服务提供者。
举例来说，所述SCP还包括处理单元，用于在向所述NF集合标识所表示的NF集合中的服务提供者发送所述服务请求之前，对所述服务请求包含的所述Token进行校验；
其中，所述发送单元具体用于在所述Token校验成功的情况下，向所述NF集合标识所表示的NF集合中的服务提供者发送所述服务请求。
本申请第七方面提供一种SCP，包括相互耦合的处理器和存储器。所述处理器调用所述存储器中存储的程序，以执行第五方面提供的任意一种通信方法的部分或全部步骤。
本申请第八方面提供一种计算机可读存储介质，其中，所述计算机可读存储介质存储有计算机程序，所述计算机程序被处理器执行，以实现执行第五方面提供的任意一种通信方法的部分或全部步骤。
本申请第九方面提供一种通信方法，包括：
服务提供者接收服务通信代理SCP发送的服务请求，所述服务请求携带Token，所述Token包含服务提供者的NF集合标识；所述服务提供者校验所述Token；所述服务提供者发送所述服务请求的响应。
举例来说，当服务提供者为NF，所述Token的读者申明(Audience Claim)中包含所述服务提供者的NF集合标识。
或者，当服务提供者为NF Service，所述Token的范围申明(Scope Claim)中包含所述服务提供者的NF服务集合标识。
举例来说，所述Token的校验可包括Token的完整性校验和/或Token的申明校验。
例如Token的申明校验可以包括：校验Token中的读者申明包含的所述服务提供者的NF集合标识，与所述选择的服务提供者的NF集合标识是否一致，在一致的情况下表示所述Token的读者申明校验成功。例如在不一致的情况下表示所述Token的读者申明校验失败。
又例如Token的申明校验可以包括：校验Token中的范围申明包含的所述服务提供者的NF服务集合标识，与所述选择的服务提供者的NF服务集合标识是否一致，在一致的情况下表示所述Token的范围申明校验成功。例如在不一致的情况下表示所述Token的范围申明校验失败。
例如当所述Token校验成功，所述服务提供者发送所述服务请求的响应可携带Token校验成功指示。当所述Token校验失败，所述服务提供者发送所述服务请求的响应可携带Token校验失败指示。
本申请第十方面提供一种服务提供者，包括：接收单元，用于接收服务通信代理SCP发送的服务请求，所述服务请求携带Token，所述Token包含服务提供者的NF集合标识。
处理单元，用于校验所述Token。
发送单元，用于发送所述服务请求的响应。
举例来说，当服务提供者为NF，所述Token的读者申明(Audience Claim)中包含所述服务提供者的NF集合标识。
或者，当服务提供者为NF Service，所述Token的范围申明(Scope Claim)中包含所述服务提供者的NF服务集合标识。
举例来说，所述Token的校验可包括Token的完整性校验和/或Token的申明校验。
例如Token的申明校验可以包括：校验Token中的读者申明包含的所述服务提供者的NF集合标识，与所述选择的服务提供者的NF集合标识是否一致，在一致的情况下表示所述Token的读者申明校验成功。例如在不一致的情况下表示所述Token的读者申明校验失败。
又例如Token的申明校验可以包括：校验Token中的范围申明包含的所述服务提供者的NF服务集合标识，与所述选择的服务提供者的NF服务集合标识是否一致，在一致的情况下表示所述Token的范围申明校验成功。例如在不一致的情况下表示所述Token的范围申明校验失败。
例如当所述Token校验成功，所述服务提供者发送所述服务请求的响应可携带Token校验成功指示。当所述Token校验失败，所述服务提供者发送所述服务请求的响应可携带 Token校验失败指示。
本申请第十一方面提供一种服务提供者，包括相互耦合的处理器和存储器。所述处理器调用所述存储器中存储的程序，以执行第九方面提供的任意一种通信方法的部分或全部步骤。
本申请第十二方面提供一种计算机可读存储介质，其中，所述计算机可读存储介质存储有计算机程序，所述计算机程序被处理器执行，以实现执行第九方面提供的任意一种通信方法的部分或全部步骤。
本申请第十三方面提供一种通信方法，包括：服务通信代理SCP接收来自服务请求者的服务请求；所述SCP对所述服务请求者进行服务授权或者所述SCP请求NRF对所述服务请求者进行服务授权；在所述服务请求者的服务授权成功的情况下，所述SCP向从服务提供者集合中选择的服务提供者发送所述服务请求。
举例来说，所述方法还包括：所述SCP在所述服务请求者服务授权成功的情况下生成Token。所述SCP向所述服务提供者发送的所述服务请求中携带所述Token，其中，所述Token包含所述服务提供者的NF集合标识或NF服务集合标识。
举例来说，当服务提供者为NF，所述Token的读者申明(Audience Claim)中包含所述服务提供者的NF集合标识。
或者，当服务提供者为NF Service，所述Token的范围申明(Scope Claim)中包含所述服务提供者的NF服务集合标识。
例如SCP请求NRF对所述服务请求者进行服务授权包括：
所述SCP向所述NRF发送授权请求，所述授权请求用于请求所述NRF对所述服务请求者进行服务授权；所述SCP接收所述NRF发送的所述授权请求的响应，所述授权请求的响应携带所述NRF对所述服务请求者的服务授权结果，所述服务授权结果为服务授权成功或服务授权失败。
举例来说，所述服务请求携带请求服务的服务标识，其中，所述SCP对所述服务请求者进行服务授权包括：根据所述SCP本地配置的授权策略或者授权信息，确定所述服务请求者是否具有访问所述服务提供者提供的所述服务标识所表示服务的权限。
本申请第十四方面提供一种SCP，包括：
接收单元，用于接收来自服务请求者的服务请求；
处理单元，用于对所述服务请求者进行服务授权或者所述SCP请求NRF对所述服务请求者进行服务授权；
发送单元，用于在所述服务请求者的服务授权成功的情况下，所述SCP向服务提供者NF集合中的服务提供者发送所述服务请求。
举例来说，所述方法还包括：所述SCP在所述服务请求者服务授权成功的情况下生成Token。所述SCP向所述服务提供者发送的所述服务请求中携带所述Token，其中，所述Token包含所述服务提供者的NF集合标识或NF服务集合标识。
举例来说，当服务提供者为NF，所述Token的读者申明(Audience Claim)中包含所述服务提供者的NF集合标识。
或者，当服务提供者为NF Service，所述Token的范围申明(Scope Claim)中包含 所述服务提供者的NF服务集合标识。
例如处理单元请求NRF对所述服务请求者进行服务授权包括：
向所述NRF发送授权请求，所述授权请求用于请求所述NRF对所述服务请求者进行服务授权；接收所述NRF发送的所述授权请求的响应，所述授权请求的响应携带所述NRF对所述服务请求者的服务授权结果，所述服务授权结果为服务授权成功或服务授权失败。
举例来说，所述服务请求携带请求服务的服务标识，其中，处理单元对所述服务请求者进行服务授权包括：根据所述SCP本地配置的授权策略或者授权信息，确定所述服务请求者是否具有访问所述服务提供者提供的所述服务标识所表示服务的权限。
本申请第十五方面提供一种SCP，包括相互耦合的处理器和存储器。所述处理器调用所述存储器中存储的程序，以执行第十三方面提供的任意一种通信方法的部分或全部步骤。
本申请第十六方面提供一种计算机可读存储介质，其中，所述计算机可读存储介质存储有计算机程序，所述计算机程序被处理器执行，以实现执行第十三方面提供的任意一种通信方法的部分或全部步骤。
本申请第十七方面提供一种通信方法，包括：网络存储功能NRF接收来自服务通信代理SCP的携带服务请求者标识的授权请求；所述NRF对所述服务请求者标识所表示的服务请求者进行服务授权；所述NRF向所述SCP发送所述授权请求的响应，所述授权请求的响应携带所述NRF对所述服务请求者的服务授权结果，所述服务授权结果为服务授权成功或服务授权失败。
举例来说，所述授权请求携带请求服务的服务标识。对所述服务请求者标识所表示的服务请求者进行服务授权包括：根据所述NRF本地配置的授权策略或者授权信息，确定所述服务请求者是否具有访问所述服务提供者提供的所述服务标识所表示服务的权限。
本申请第十八方面提供一种网络存储功能，包括：
接收单元，用于接收来自服务通信代理SCP的携带服务请求者标识的授权请求；
处理单元，用于对所述服务请求者标识所表示的服务请求者进行服务授权；
发送单元，用于向所述SCP发送所述授权请求的响应，其中，所述授权请求的响应携带所述NRF对所述服务请求者的服务授权结果，所述服务授权结果为服务授权成功或服务授权失败。
举例来说，所述授权请求携带请求服务的服务标识。对所述服务请求者标识所表示的服务请求者进行服务授权包括：根据所述NRF本地配置的授权策略或者授权信息，确定所述服务请求者是否具有访问所述服务提供者提供的所述服务标识所表示服务的权限。
本申请第十九方面提供一种网络存储功能，包括相互耦合的处理器和存储器。所述处理器调用所述存储器中存储的程序，以执行第十七方面提供的任意一种通信方法的部分或全部步骤。
本申请第二十方面提供一种计算机可读存储介质，其中，所述计算机可读存储介质存储有计算机程序，所述计算机程序被处理器执行，以实现执行第十七方面提供的任意一种通信方法的部分或全部步骤。
本申请第二十一方面提供一种通信方法，包括：
服务请求者Service Consumer向NRF发送令牌token请求；
所述服务请求者接收所述NRF发送的所述Token请求的响应，所述Token请求的响应携带Token，其中，所述Token包含服务提供者的NF集合标识或NF服务集合标识；
所述服务请求者向服务通信代理SCP发送携带所述Token的服务请求，所述服务请求被所述SCP或者服务提供者用于对所述Token进行校验；
所述服务请求者接收所述SCP发送的所述服务请求的响应。
本申请第二十二方面提供一种服务请求者，包括：
发送单元，用于向NRF发送令牌token请求；
接收单元，用于接收所述NRF发送的所述Token请求的响应，其中，所述Token请求的响应携带Token，所述Token包含服务提供者的NF集合标识或NF服务集合标识；
所述发送单元还用于，向服务通信代理SCP发送携带所述Token的服务请求，所述服务请求被所述SCP或者服务提供者用于对所述Token进行校验；
所述接收单元还用于，接收所述SCP发送的所述服务请求的响应。
本申请第二十三方面提供一种服务请求者，包括相互耦合的处理器和存储器。所述处理器调用所述存储器中存储的程序，以执行第二十一方面提供的任意一种通信方法的部分或全部步骤。
本申请第二十四方面提供一种计算机可读存储介质，其中，所述计算机可读存储介质存储有计算机程序，所述计算机程序被处理器执行，以实现执行第二十一方面提供的任意一种通信方法的部分或全部步骤。
本申请第二十五方面提供一种通信方法，包括：服务请求者向服务通信代理SCP发送服务请求，其中，所述服务请求中包含服务提供者的NF集合标识或NF服务集合标识。所述服务请求被所述SCP或者网络存储功能NRF用于对所述服务请求者进行服务授权。所述服务请求者接收所述SCP发送的所述服务请求的服务响应。
本申请第二十六方面提供一种服务请求者，包括：
发送单元，用于服务请求者向服务通信代理SCP发送服务请求，所述服务请求中包含服务提供者的NF集合标识或NF服务集合标识。所述服务请求被所述SCP或者网络存储功能NRF用于对所述服务请求者进行服务授权。
接收单元，用于接收所述SCP发送的所述服务请求的服务响应。
本申请第二十七方面提供一种服务请求者，包括相互耦合的处理器和存储器。所述处理器调用所述存储器中存储的程序，以执行第二十五方面提供的任意一种通信方法的部分或全部步骤。
本申请第二十八方面提供一种计算机可读存储介质，其中，所述计算机可读存储介质存储有计算机程序，所述计算机程序被处理器执行，以实现执行第二十五方面提供的任意一种通信方法的部分或全部步骤。
本申请实施例还提供一种通信装置，所述通信装置包括耦合的处理器和存储器；所处理器用于调用所述存储器中存储的程序，以完成本申请实施例提供的任意一个设备执行的任意一种方法的部分或全部步骤。
本申请实施例还提供一种计算机可读存储介质，所述计算机可读存储介质存储的程序，所述程序被处理器执行，以完成本申请实施例提供的任意一个设备执行的任意一种方法的部分或全部步骤。
本申请实施例还提供一种指令的计算机程序产品，当所述计算机程序产品在计算机设备上运行时，使得所述计算机设备执行本申请实施例提供的任意一个设备执行的任意一种方法的部分或全部步骤。
附图说明
下面将对本申请实施例涉及的一些附图进行说明。
图1-A是本申请实施例提供的一种通信系统的架构示意图。
图1-B至图1-E是本申请实施例提供的另几种通信系统的架构示意图。
图2至图11是本申请实施例提供的几一种通信方法的流程示意图。
图12至图13是本申请实施例提供的两种网络存储功能的架构示意图。
图14至图15是本申请实施例提供的两种SCP的架构示意图。
图16至图17是本申请实施例提供的两种服务提供者的架构示意图。
图18至图19是本申请实施例提供的另两种SCP的架构示意图。
图20至图21是本申请实施例提供的另两种网络存储功能的架构示意图。
图22至图23是本申请实施例提供的两种服务请求者的架构示意图。
图24至图25是本申请实施例提供的另两种服务请求者的架构示意图。
具体实施方式
下面结合本申请实施例中的附图对本申请实施例进行描述。
参见图1-A，图1-A是本申请实施例举例的一种5G网络架构的示意图。5G网络对4G网络的某些功能网元(例如移动性管理实体(MME,Mobility Management Entity)等等)进行了一定拆分，并定义了基于服务化架构的架构。在图1-A所示网络架构中，类似4G网络中的MME的功能，被拆分成了接入与移动性管理功能(AMF,Access and Mobility Management Function)和会话管理功能(SMF,Session Management Function)等等。
下面对其他一些相关网元/实体进行介绍。
用户设备(UE，User Equipment)通过接入运营商网络来访问数据网络(DN，Data Network)等等，使用DN上的由运营商或第三方提供的业务。
接入与移动性管理功能(AMF)是3GPP网络中的一种控制面网元，主要负责UE接入运营商网络的接入控制和移动性管理。其中，安全锚点功能(SEAF,Security Anchor Function)可以部署于AMF之中，或SEAF也可能部署于不同于AMF的另一设备中，图1-A中以SEAF被部署于AMF中为例。当SEAF被部署于AMF中时，SEAF和AMF可合称AMF。
会话管理功能(SMF)是3GPP网络中的一种控制面网元，其中，SMF主要用于负责管理UE的数据包(PDU,Packet Data Unit)会话。PDU会话是一个用于传输PDU的通道，UE可以通过PDU会话与DN互相发送PDU。SMF负责PDU会话的建立、维护和删除等管理工作。
数据网络(DN,Data Network)也称为分组数据网络(PDN,Packet Data Network)，它是位于3GPP网络之外的网络。其中，3GPP网络可接入多个DN，DN上可部署运营商或第三方 提供的多种业务。例如，某个DN是一个智能工厂的私有网络，安装在智能工厂车间的传感器扮演UE的角色，DN中部署了传感器的控制服务器。UE与控制服务器通信，UE在获取控制服务器的指令之后，可根据这个指令将采集的数据传递给控制服务器。又例如，DN是一个公司的内部办公网络，该公司员工所使用的终端则可扮演UE的角色，这个UE可以访问公司内部的信息和其他资源。
其中，统一数据管理网元(UDM,Unified Data Management)也是3GPP网络中的一种控制面网元，UDM主要负责存储3GPP网络中签约用户(UE)的签约数据、信任状(credential)和持久身份标识(SUPI,Subscriber Permanent Identifier)等。这些数据可以被用于UE接入运营商3GPP网络的认证和授权。
认证服务器功能(AUSF,Authentication Server Function)也是3GPP网络中的一种控制面网元，AUSF主要用于第一级认证(即3GPP网络对其签约用户的认证)。
其中，网络开放功能(NEF,Network Exposure Function)也是3GPP网络之中的一种控制面网元。NEF主要负责以安全的方式对第三方开放3GPP网络的对外接口。其中，在SMF等网元需要与第三方网元通信时，可以以NEF为通信的中继。其中，中继时，NEF可进行内外部标识的翻译。比如，将UE的SUPI从3GPP网络发送到第三方时，NEF可将SUPI翻译成其对应的外部身份标识(ID,Identity)。反之，NEF可将外部身份ID在发送到3GPP网络时，将其翻译成对应的SUPI。
其中，网络存储功能(NRF,Network Repository Function)也是3GPP网络中的一种控制面网元，主要负责存储可被访问的网络功能(NF)的配置额服务资料(profile)，为其他网元提供网络功能的发现服务。
用户面功能(UPF,User Plane Function)是3GPP网络与DN通信的网关。
策略控制功能(PCF,Policy Control Function)是3GPP网络中的一种控制面功能，用于向SMF提供PDU会话的策略。策略可包括计费、服务质量(QoS,Quality of Service)、授权相关策略等。
接入网(AN,Access Network)是3GPP网络的一个子网络，UE要接入3GPP网络，首先需要经过AN。在无线接入场景下AN也称无线接入网(RAN,Radio Access Network),因此RAN和AN这两个术语经常不做区分的混用。
3GPP网络是指符合3GPP标准的网络。其中，图1-A中除了UE和DN以外的部分可看作是3GPP网络。3GPP网络不只局限于3GPP定义的5G网络，还可包括2G、3G、4G网络。通常3GPP网络由运营商来运营。此外，在图1-A所示架构中的N1、N2、N3、N4、N6等分别代表相关网元/网络功能之间的参照点(Reference Point)。Nausf、Namf...等分别代表相关网络功能的服务化接口。
当然，3GPP网络和非3GPP网络可能共存，5G网络的中的一些网元也可能被运用到一些非5G网络中。
其中，本申请实施例方案涉及漫游场景和非漫游场景，在漫游场景下存在归属网络和拜访网络，归属网络和拜访网络的架构可能相同或不同。归属网络也可称为归属域或家乡网络或家乡域等。拜访网络也可称为拜访域等
参见图1-B至图1-E，图1-B至图1-E举例示出了在eSBA架构下引入SCP或未引入SCP的一 些可能网络架构。其中，图1-B和图1-C是未引入SCP的一些可能网络架构。图1-D和图1-E是引入SCP的一些可能网络架构。
当引入SCP之后，服务请求者(Service Consumer)和服务提供者(Service Producer)之间的一些消息(例如服务请求和服务相应等)可通过SCP转发。
其中，本申请一些实施例描述中，服务请求者有时候也简称为Consumer，服务提供者有时候也简称为Producer。服务提供者集合(Service Producer Set)有时候例如也简称为Producer Set。
本申请实施例的方法可基于图1-D(Option C)至图1-E(Option D)举例所示网络架构来具体实施。
图1-B至图1-E举例所示架构中的服务提供者(Service Producer)具体可为核心网内的一些NF(网络功能)。核心网内的NF之间可以是服务化接口，NF相互间的通信可采用服务调用的方式进行。
网络存储功能(NRF,Network Repository Function)可用于完成NF的注册、发现和保存同一公共陆地移动网络(PLMN,Public Land Mobile Network)内各NF的注册信息等。NRF也可作为授权服务器完成服务授权，NRF还可具有生成Token或校验Token的功能。
服务通信代理SCP主要用于实现NF之间通信转发，还可用于实现负载均衡和NF选择，并且SCP还可具有NF注册、发现和服务授权等功能。
本申请实施例的方案主要应用于5G第二阶段对服务化架构有增强的系统。
例如在Option C和Option D架构中，如果服务提供者(Producer)为Set中的某一NF/NF service，SCP可能会从Set中选择其他NF/NF service(选择的NF不一定就是Consumer请求的那个NF)作为Producer。此场景下，Consumer可使用与Producer所在同一Set内其他instance的授权信息来访问Producer的服务。例如：Consumer之前被授权访问NF Set内的NF_A，但NF_A因为故障或者性能问题等原因无法工作，此时，SCP可以不发起新的授权流程，直接选择同一NF Set内的NF_B，此时Consumer可以被授权访问NF_B的服务。
本申请实施例方案可适用于Producer位于NF Set或者NF Service Set，或者Producer为NF Set或者NF Service Set的场景。以下各实施例主要以Producer位于NF Set内为例进行介绍。
参见图2，图2为本申请实施例提供的一种通信方法的流程示意图。一种通信方法可以包括：
201.服务请求者向NRF发送Token请求，NRF接收来自服务请求者的Token请求。
202.所述NRF向所述服务请求者发送所述Token请求的响应，其中，所述Token请求的响应携带Token，所述Token包含服务提供者(Service Producer)的NF集合标识或NF服务集合标识。
203.服务请求者接收来自NRF的所述Token请求的响应，向SCP发送服务请求，所述服务请求携带Token(这个Token可由NRF生成)，所述Token包含服务提供者的NF集合标识或NF服务集合标识。
204.SCP接收来自服务请求者的服务请求，所述SCP向从服务提供者的NF集合或NF服务集合中选择的服务提供者发送所述服务请求。
205.SCP接收来自服务提供者的所述服务请求的响应，SCP向服务请求者转发来自服务提供者的所述服务请求的响应。
其中，包含服务提供者的NF集合标识的Token，可看作是针对服务提供者的NF集合的Token，是NF集合粒度的Token。包含服务提供者的NF服务集合标识的Token，可看作是针对NF服务集合的Token，是NF服务集合粒度的Token。
其中，令牌请求可以携带服务请求者的标识(服务请求者的标识例如为服务请求者的NF实例标识(NF Instance ID)等)。
所述Token请求还可携带如下信息中的一种或多种：服务提供者的标识、服务提供者的NF集合标识、服务提供者的NF服务集合标识。
举例来说，方法还可包括：所述NRF对所述服务请求者进行服务授权，在所述服务请求者的服务授权成功的情况下生成所述Token。
生成所述Token可包括：若所述Token请求中携带所述服务提供者的标识，所述NRF根据所述服务提供者的标识得到所述服务提供者的NF集合标识，生成包含所述服务提供者的NF集合标识的Token；或者,若所述Token请求中携带所述服务提供者的NF集合标识，则所述NRF生成包含所述服务提供者的NF集合标识的Token。
举例来说，当服务提供者为NF，所述Token的读者申明(Audience Claim)中包含所述服务提供者的NF集合标识。
或者，当服务提供者为NF Service，所述Token的范围申明(Scope Claim)中包含所述服务提供者的NF服务集合标识。
其中，SCP可以基于本地策略和/或其它信息(例如可包括携带于服务请求的selection parameters等)来从服务提供者的NF集合或NF服务集合中选择服务提供者。
举例来说，所述向所述NF集合标识所表示的NF集合中的服务提供者发送所述服务请求之前还包括：SCP对所述服务请求包含的所述Token进行校验；
其中，所述SCP向所述NF集合标识所表示的NF集合中的服务提供者发送所述服务请求包括：在所述Token校验成功的情况下，所述SCP向所述NF集合标识所表示的NF集合中的服务提供者发送所述服务请求。
举例来说，所述Token的校验可包括Token的完整性校验和/或Token的申明校验。
例如Token的申明校验可以包括：校验Token中的读者申明包含的所述服务提供者的NF集合标识，与所述选择的服务提供者的NF集合标识是否一致，在一致的情况下表示所述Token的读者申明校验成功。例如在不一致的情况下表示所述Token的读者申明校验失败。
又例如Token的申明校验可以包括：校验Token中的范围申明包含的所述服务提供者的NF服务集合标识，与所述选择的服务提供者的NF服务集合标识是否一致，在一致的情况下表示所述Token的范围申明校验成功。例如在不一致的情况下表示所述Token的范围申明校验失败。
举例来说，所述服务请求携带服务提供者标识或者服务提供者类型,所述选择的服务提供者的NF集合标识根据所述服务提供者标识或者所述服务提供者类型得到。
可以看出，上述方案中由NRF来基于服务请求者的请求生成Token，所述Token包含 服务提供者的NF集合标识或NF服务集合标识，即Token是针对服务提供者所属NF集合或NF服务集合的Token，即这个Token是集合粒度的Token。利用这个集合粒度的Token有利于实现基于NF Set粒度的服务控制，进而有利于解决Producer Set内不同Producer校验Token的问题，有利于实现eSBA中集合场景下的便捷授权。
参见图3，图3为本申请实施例提供的另一种通信方法的流程示意图。另一种通信方法可包括：
301.服务请求者向SCP发送服务请求。
302.SCP接收来自服务请求者的服务请求；所述SCP对所述服务请求者进行服务授权或者所述SCP请求NRF对所述服务请求者进行服务授权。
303.在所述服务请求者的服务授权成功的情况下，所述SCP向从服务提供者集合中选择的服务提供者发送所述服务请求。
304.SCP接收来自服务提供者的所述服务请求的响应，SCP向服务请求者转发来自服务提供者的所述服务请求的响应。
举例来说，所述方法还包括：所述SCP在所述服务请求者服务授权成功的情况下生成Token。所述SCP向所述服务提供者发送的所述服务请求中携带所述Token，其中，所述Token包含所述服务提供者的NF集合标识或NF服务集合标识。
举例来说，当服务提供者为NF，所述Token的读者申明(Audience Claim)中包含所述服务提供者的NF集合标识。
或者，当服务提供者为NF Service，所述Token的范围申明(Scope Claim)中包含所述服务提供者的NF服务集合标识。
当所述SCP向所述服务提供者发送的所述服务请求中携带所述Token，那么服务提供者可以所述Token进行校验或请求NRF对所述Token进行校验。
例如SCP请求NRF对所述服务请求者进行服务授权包括：
所述SCP向所述NRF发送授权请求，所述授权请求用于请求所述NRF对所述服务请求者进行服务授权；所述SCP接收所述NRF发送的所述授权请求的响应，所述授权请求的响应携带所述NRF对所述服务请求者的服务授权结果，所述服务授权结果为服务授权成功或服务授权失败。
举例来说，所述服务请求携带请求服务的服务标识，其中，所述SCP对所述服务请求者进行服务授权包括：根据所述SCP本地配置的授权策略或者授权信息，确定所述服务请求者是否具有访问所述服务提供者提供的所述服务标识所表示服务的权限。
可以看出，上述方案中可由SCP生成Token，所述Token包含服务提供者的NF集合标识或NF服务集合标识，即Token是针对服务提供者所属NF集合或NF服务集合的Token，即这个Token是集合粒度的Token。利用这个集合粒度的Token有利于实现基于NF Set粒度的服务控制，进而有利于解决Producer Set内不同Producer校验Token的问题，有利于实现eSBA中集合场景下的便捷授权。
参见图4，图4为本申请实施例提供的另一种通信方法的流程示意图。其中，另一种 通信方法可包括：
401.Service Consumer_A向NRF发送Token(令牌)请求。
其中，Service Consumer_A例如可以为NF_A(此时服务请求者Service Consumer_A具体为NF)。
其中，Token请求中可携带Service Consumer_A的标识(Service Consumer_A的标识例如可为Service Consumer_A的NF标识，具体例如可为NF Instance ID)和请求服务的服务标识。Service Consumer也可简称Consumer。
本申请实施例中的Service Producer可以是NF或NF Service，即：Service Producer可以是NF粒度的，Service Producer也以是NF Service粒度的。Service Producer可简称Producer。
本申请实施例方案中，Service Producer集合包括一个或多个Service Producer。
而当Service Producer集合中的Service Producer为NF，那么此时Service Producer集合也可称为Service Producer NF集合。而当Service Producer集合中的Service Producer为NF Service，那么此时Service Producer集合也可称为Service Producer NF Service集合。
Service Producer可归属于某Service Producer集合。Service Producer集合可简称Producer集合，Service Producer所属Producer集合，也可简称Service Producer所属集合(Set)，即，本申请实施例的描述中，Service Producer所属集合，指的是Service Producer所属Producer集合。
例如当Service Producer为NF，Service Producer所属集合为NF Set(NF集合)，NF Set的标识为NF Set ID。Service Producer的NF Set ID，即为Service Producer所属NF Set的NF Set ID。
又例如，当Service Producer为NF Service，那么Service Producer所属Producer集合则为NF Service Set(NF Service集合),其中，NF Service Set的标识为NF Service Set ID。Service Producer的NF Service Set ID，即为Service Producer所属NF Service Set的NF Service Set ID。
因此，当Service Producer为NF，那么Service Producer所属Set，指的就是Service Producer所属的NF Set；Service Producer所属NF Set的标识，指的就是其所属的NF Set的NF Set ID。此外，当Service Producer为NF Service，那么，Service Producer所属Set指的就是Service Producer所属NF Service Set，Service Producer所属的NF Set的标识，指的就是其所属的NF Service Set的NF Service Set ID。
Token请求中还可携带Service Producer(服务请求者)的相关信息。例如Token请求中还可以携带Service Producer类型和/或Service Producer_B的标识(Service Producer_B的标识例如可为Service Consumer_B的NF标识，具体例如可为NF Instance ID)。
其中，若Service Producer为NF，则Service Producer_B的标识可为Service Producer_B的NF标识(NF标识例如为NF Instance ID)。若Service Producer_B为NF Service，那么Service Producer_B的标识可为Service Producer_B的NF Service标识 (NF Service标识具体例如为NF Service Instance ID)。
在一些可能的实施方式中，如果Service Producer属于NF Set(此时Service Producer为NF)，则Token请求可携带：Service Consumer_A的标识(例如NF Instance ID)和请求服务的服务标识。且Token请求还可携带如下信息中的一种或多种：Service Producer_B的NF类型、Service Producer_B的NF Set ID(NF集合标识)、Service Producer_B的标识(例如Service Producer_B的NF Instance ID)等信息。其中，Service Producer_B的NF Set ID为Service Producer_B所属的NF Set的NF Set ID。
在另一些可能的实施方式之中，如果Service Producer_B属于NF Service Set(此时Service Producer_B为NF Service)，则Token请求可携带：Service Consumer_A的标识(例如NF Instance ID)和请求服务的服务标识。并且，Token请求还可以携带如下信息中的一种或者多种：Service Producer_B的服务类型、Service Producer_B的标识(例如Service Producer_B的NF Service Instance ID)、Service Producer_B的NF Service Set ID(NF服务集合标识)等信息。Service Producer_B的NF Service Set ID为Service Producer_B所属NF Service Set的NF Service Set ID。
402.NRF接收来自Service Consumer_A的Token请求，NRF对Service Consumer_A进行服务授权。
对Service Consumer_A进行服务授权具体可包括：从Token请求获取Service Consumer_A的标识等信息，可以结合本地配置的授权策略和/或授权信息等,对Service Consumer_A进行服务授权。
在一些可能实施方式中，当Service Producer_B为NF，那么若Token请求携带了Service Producer_B的标识(未携带NF Set ID)，那么在服务授权成功之后，NRF可根据Service Producer_B的标识查询到其所属NF Set的NF Set ID，并生成一个包含Service Producer_B的NF Set ID的Token。具体例如，Token的读者申明(Audience Claim)可包含Service Producer_B的NF Set ID。
若Token请求中携带了Service Producer_B的NF Set ID，则可省略根据Service Producer_B的标识查询到其所属NF Set的NF Set ID的步骤。直接生成一个包含Service Producer_B的NF Set ID的Token。具体例如，Token的读者申明(Audience Claim)可包含Service Producer_B的NF Set ID。
当Token的Audience Claim包含Service Producer所属NF Set的NF Set ID，这就表示这个Token是NF Set粒度的Token，这个Token可用于访问Service Producer所属NF Set中的各Producer的服务。
在另一些可能实施方式中，当Service Producer_B为NF Service，那么若Token请求携带了Service Producer的标识(未携带NF Service Set ID)，在服务授权成功后，NRF可根据Service Producer_B的标识查询到其所属NF Service Set的NF Service Set ID，并生成包含Service Producer_B的NF Service Set ID的Token。例如Token的范围申明(Scope Claim)可包含Service Producer_B的NF Service Set ID。
若Token请求中携带了Service Producer_B的NF Service Set ID，则可省略根据Service Producer_B的标识查询到其所属NF Service Set的NF Service Set ID的步骤。 直接生成包含Service Producer_B的NF Service Set ID的Token。例如Token的范围申明(Scope Claim)可包含Service Producer_B的NF Service Set ID。
其中，当Token的Scope Claim包含Service Producer_B所属NF Service Set的NF Service Set ID，这就表示这个Token是NF Service Set粒度的Token，这个Token可用于访问Service Producer_B所属NF Service Set中的各Producer的服务。
403.NRF向Service Consumer_A发送携带Token的Token请求的响应(Token请求的响应例如可简称Token响应)。
404.Service Consumer_A接收来自NRF的Token请求的响应，Service Consumer_A向SCP发送服务请求。
其中，Service Consumer_A发送的服务请求携带Token、Service Consumer_A的标识(例如Service Consumer_A的NF Instance ID)、Service Producer_B的标识(例如Service Producer_B的NF Instance ID或NF Service Instance ID)和请求服务的服务标识。
其中，Service Consumer_A发送的服务请求还可携带selection parameters。
405.SCP接收来自Service Consumer_A的服务请求。SCP从Service Producer_B所属Producer Set中选择Service Producer_C(Service Producer_C可能与Service Producer_B相同，也可能不同于Service Producer_B)。
其中，从Producer Set中选择Service Producer_C具体可包括：若服务请求携带有selection parameters，那么SCP可根据服务请求中携带的selection parameters从Producer Set中选择Service Producer_C。此外，若服务请求未携带有selection parameters，那么SCP例如可根据本地配置的相关策略从Producer Set中选择Service Producer_C。
例如当Service Producer为NF Service，SCP从Producer集合中选择的Service Producer_C可称NF Service_C。
例如当Service Producer为NF，SCP可能从Producer集合中选择的Service Producer_C可称NF_C。
406.SCP向Service Producer_C发送携带Token的服务请求。
其中，SCP可以将来自Service Consumer_A的服务请求携带的信息进行增加、删除和/或替换操作之后，再向Service Producer_C发送(例如可删除服务请求携带的selection parameters等)。当然SCP也可以不对来自Service Consumer_A的服务请求携带的信息做任何修改而直接向Service Producer_C发送。
407.Service Producer_C接收SCP转发的携带Token的服务请求。
Service Producer_C执行Token校验操作。
其中，执行Token校验操作具体包括：Token完整性校验和Token申明校验。
其中，Token完整性校验可以包括：使用NRF的公钥或与NRF的共享密钥校验Token完整性。
其中，在Token完整性校验通过之后，Token申明校验可包括：Token的Audience Claim校验。
其中，Token的Audience Claim校验可以包括：校验Token的Audience Claim中包 含的NF Set ID，是否与基于Service Producer_C的标识查询到的Service Producer_C所属NF集合的NF集合ID是否一致，在一致的情况下表示Audience Claim校验成功，在不一致的情况下可表示Audience Claim校验失败。
其中，在Token完整性校验通过之后，Token申明校验也可包括：Token的Scope Claim校验。
其中，Token的Scope Claim校验可以包括：校验Token的Scope Claim中包含的NF Service Set ID，是否与基于Service Producer_C的标识查询到的所述Service Producer_C所属NF Service集合的NF Service Set ID是否一致，在一致的情况下表示Scope Claim校验成功，在不一致的情况下可表示Scope Claim校验失败。
此外，Service Producer_C也可请求NRF来对服务请求携带的Token进行校验。例如Service Producer_C可将服务请求携带的Token发送给NRF，请求NRF对这个Token进行校验，NRF校验Token后向Service Producer_C返回Token校验结果(结果为Token校验成功或Token校验失败)。
408.Service Producer_C向Service Consumer_A发送服务请求的响应(服务请求的响应例如可简称服务响应)。
若Token校验成功，响应中可以携带服务请求成功指示(此时表示Service Producer_C同意为Service Consumer_A提供服务)。
若Token校验失败，响应中可以携带服务请求失败指示(此时表示Service Producer_C不同意为Service Consumer_A提供服务)。
409.SCP接收到来自Service Producer_C的上述服务响应之后，SCP则可向Service Consumer_A转发接收到的上述服务响应。
参见图5，图5为本申请实施例提供的一种通信方法的流程示意图。图5举例所示的流程为对应图4流程的漫游场景。其中，一种通信方法可包括：
501.Service Consumer_A向vNRF(vNRF为拜访网络的NRF)发送Token(令牌)请求。
当Service Consumer_A漫游到了拜访网络，那么Service Consumer_A可向vNRF(vNRF为拜访网络的NRF)发送Token(令牌)请求。
其中，Token请求携带的信息参见步骤401的相关描述，此处不再赘述
502.vNRF向hNRF(hNRF为归属网络的NRF)转发来自NF_A的Token请求。
503.hNRF接收来自vNRF的Token请求，hNRF对Service Consumer_A进行服务授权和生成Token。
其中，hNRF对Service Consumer_A进行服务授权和生成Token的方式，可参考步骤402中NRF对Service Consumer_A进行服务授权和生成Token的方式，此处不再赘述。
504.hNRF通过vNRF向NF_A发送携带Token的Token请求的响应(Token请求的响应例如可简称Token响应)。
505.Service Consumer_A接收经hNRF转发的来自hNRF的Token请求的响应，Service Consumer_A向vSCP(vSCP为拜访网络的SCP)发送服务请求。
其中，Service Consumer_A发送的服务请求携带Token、Service Consumer_A的标识 (例如Service Consumer_A的NF Instance ID)、Service Producer_B的标识(例如Service Producer_B的NF Instance ID或NF Service Instance ID)和请求服务的服务标识。
其中，Service Consumer_A发送的服务请求还可携带selection parameters。
506.vSCP接收来自Service Consumer_A的服务请求，vSCP向hSCP(hSCP为归属网络的SCP)转发来自Service Consumer_A的服务请求。
507.hSCP接收由vSCP转发的来自Service Consumer_A的服务请求。
hSCP从Service Producer_B所属Producer Set中选择Service Producer_C(Service Producer_C可能与Service Producer_B相同，也可能不同于Service Producer_B)。
其中，从Producer Set中选择Service Producer_C具体可包括：若服务请求携带有selection parameters，那么hSCP可根据服务请求中携带的selection parameters从Producer Set中选择Service Producer_C。此外，若服务请求未携带有selection parameters，那么hSCP例如可根据本地配置的相关策略从Producer Set中选择Service Producer_C。
例如当Service Producer为NF Service，hSCP从Producer集合中选择的Service Producer_C可称NF Service_C。
例如当Service Producer为NF，hSCP可能从Producer集合中选择的Service Producer_C可称NF_C。
508.hSCP向Service Producer_C发送携带Token的服务请求。
其中，hSCP可以将来自Service Consumer_A的服务请求携带的信息进行增加、删除和/或替换操作之后，再向Service Producer_C发送(例如可删除服务请求携带的selection parameters等)。当然hSCP也可以不对来自Service Consumer_A的服务请求携带的信息做任何修改而直接向Service Producer_C发送。
509.Service Producer_C接收hSCP转发的携带Token的服务请求。
Service Producer_C执行Token校验操作。Token校验的具体方式可参考步骤407中的相关描述，此处不再赘述。
此外，Service Producer_C也可请求NRF来对服务请求携带的Token进行校验。例如目标Service Producer_C可将服务请求携带的Token发送给NRF，请求NRF对这个Token进行校验，NRF校验Token后向Service Producer_C返回Token校验结果(结果为Token校验成功或Token校验失败)。
510.Service Producer_C向Service Consumer_A发送服务请求的响应(服务请求的响应例如可简称服务响应)。
若Token校验成功，响应中可以携带服务请求成功指示(此时表示Service Producer_C同意为Service Consumer_A提供服务)。
若Token校验失败，响应中可以携带服务请求失败指示(此时表示Service Producer_C不同意为Service Consumer_A提供服务)。
511.hSCP接收到来自Service Producer_C的服务响应之后，hSCP通过vSCP向Service Consumer_A转发接收到的服务响应。
可以理解，本申请各实施例中的Token Claims中还包含其他信息，比如还可包含如下 信息中的一种或多种：Service Type of the provider、Service Type of the consumer、S-NSSAI、NF Set ID、Service Instance Set ID、Service Zone ID、Service Area、DNN、TAI、PLMN ID、Location Information of the target NF or NF Service等。以下实施例的Token Claims中包含的信息也可如此，后面实施例不再赘述。
图4和图5举例所示方案中，NRF在服务授权后可查询Producer的NF Set ID，并生成基于Producer的NF Set ID的Token，SCP选择Producer后，将Token发送给选择的Producer_C(例如NF_C)，Producer_C可校验Token中Audience Claim的NF Set ID。实现了基于NF Set粒度的授权，并可解决了NF Set内不同Producer校验Token的问题，实现了eSBA中集合场景下的授权。
在图4和图5举例所示方案中：NRF根据本地配置策略或授权信息进行授权后，查询Producer是否位于某一Set，并生成Set粒度的Token，Token Audience Claim里面包含Set ID。Token随服务请求发送给SCP选择的服务提供者NF_C后，NF_C校验Token Audience Claim里面包含的Set ID。
参见图6，图6为本申请实施例提供的另一种通信方法的流程示意图。图6举例所示的方案中可由SCP(或NRF)来执行Token校验操作。
其中，如图6举例所示，一种通信方法可包括：
601.Service Consumer_A向NRF发送Token(令牌)请求。
602.NRF接收来自Service Consumer_A的Token请求，NRF对Service Consumer_A进行服务授权和生成Token。
603.NRF向Service Consumer_A发送携带Token的Token请求的响应(Token请求的响应例如可简称Token响应)。
604.Service Consumer_A接收来自NRF的Token请求的响应，Service Consumer_A向SCP发送服务请求。
其中，步骤601-604的相关细节描述，可参考步骤401-404的的相关细节描述，此处不在赘述。
605.SCP接收来自Service Consumer_A的服务请求。
SCP执行Token校验操作。其中，执行Token校验操作具体包括：Token完整性校验和Token申明校验。
其中，Token完整性校验可以包括：使用NRF的公钥或与NRF的共享密钥校验Token完整性。
其中，在Token完整性校验通过之后，Token申明校验可包括：Token的Audience Claim校验。
其中，Token的Audience Claim校验可以包括：校验Token的Audience Claim中包含的NF Set ID，是否与基于Service Producer_C的标识查询到的Service Producer_C所属NF集合的NF集合ID是否一致，在一致的情况下表示Audience Claim校验成功，在不一致的情况下可表示Audience Claim校验失败。
其中，在Token完整性校验通过之后，Token申明校验也可包括：Token的Scope Claim 校验。
其中，Token的Scope Claim校验可以包括：校验Token的Scope Claim中包含的NF Service Set ID，是否与基于Service Producer_C的标识查询到的所述Service Producer_C所属NF Service集合的NF Service Set ID是否一致，在一致的情况下表示Scope Claim校验成功，在不一致的情况下可表示Scope Claim校验失败。
此外，SCP也可请求NRF来对服务请求携带的Token进行校验。例如SCP可将服务请求携带的Token发送给NRF，请求NRF对这个Token进行校验，NRF校验Token后SCP返回Token校验结果(结果为Token校验成功或Token校验失败)。
其中，若Token校验成功(SCP通过执行Token校验操作来得到Token校验结果，或SCP请求NRF执行Token校验操作，并根据NRF的相关反馈来获悉Token校验结果)，SCP从Service Producer_B所属Producer Set中选择Service Producer_C(Service Producer_C可能与Service Producer_B相同，也可能不同于Service Producer_B)。
其中，从Producer Set中选择Service Producer_C具体可包括：若服务请求携带有selection parameters，那么SCP可根据服务请求中携带的selection parameters从Producer Set中选择Service Producer_C。此外，若服务请求未携带有selection parameters，那么SCP例如可根据本地配置的相关策略从Producer Set中选择Service Producer_C。
例如当Service Producer为NF Service，SCP从Producer集合中选择的Service Producer_C可称NF Service_C。
例如当Service Producer为NF，SCP可能从Producer集合中选择的Service Producer_C可称NF_C。
此外，若Token校验失败，SCP可向Consumer_A发送服务请求的响应，响应中可携带服务请求失败指示(此时表示Service Producer_C不同意为Consumer_A提供服务)。此处服务请求失败指示可具体指示失败原因为Token校验失败。
606.SCP向Service Producer_C发送服务请求(服务请求可携带或不携带Token)。
其中，SCP可以将来自Service Consumer_A的服务请求携带的信息进行增加、删除和/或替换操作之后再向NF_C转发(例如可删除服务请求携带的selection parameters等)。当然SCP也可以不对来自Service Consumer_A的服务请求携带的信息做任何修改而直接向Service Producer_C转发。
607.Service Producer_C接收SCP转发的服务请求。Service Producer_C向Service Consumer_A发送服务请求的响应(服务请求的响应例如可简称服务响应)。
响应中可携带服务请求成功指示(此时表示Service Producer_C同意为Service Consumer_A提供服务)或响应中可携带服务请求失败指示(此时表示Service Producer_C不同意为Service Consumer_A提供服务)。
608.SCP接收到来自Service Producer_C的上述服务响应之后，SCP则可向Service Consumer_A转发接收到的上述服务响应。
其中，本实施例方案中，由SCP来执行Token校验(或由SCP委托第三方(如NRF)来执行Token校验)，而NF_C则不执行Token校验，这种场景下，NF_C是信任SCP的， 即SCP为NF_C的信任SCP。其中，NF_C和SCP之间建立信任的机制，此处不再赘述。
其中，本实施例将Token校验提前到SCP上完成，SCP根据Token检验结果来决定是否选择Producer和转发服务请求，有利于进一步简化流程。
参见图7，图7为本申请实施例提供的一种通信方法的流程示意图。图7举例所示的流程为对应图6流程的漫游场景。其中，一种通信方法可包括：
其中，如图7举例所示，一种通信方法可包括：
701.Service Consumer_A向vNRF发送Token(令牌)请求。
702、vNRF接收来自Service Consumer_A的Token请求，向hNRF转发Token请求。
703、hNRF接收经vNRF转发的来自Service Consumer_A的Token请求，hNRF执行服务授权操作和生成Token。
704.hNRF通过vNRF向Service Consumer_A发送携带有Token的Token请求的响应(Token请求的响应例如可简称Token响应)。
705.Service Consumer_A接收经vNRF转发的来自hNRF的上述Token请求的响应，Service Consumer_A向vSCP发送携带Token的服务请求。
706.vSCP接收来自Service Consumer_A的携带Token的服务请求，vSCP向hSCP转发来自Service Consumer_A的携带Token的服务请求。
707.hSCP接收经vSCP转发的来自Service Consumer_A的携带Token的服务请求。
hSCP执行Token校验操作。其中，执行Token校验操作具体包括：Token完整性校验和Token申明校验。
其中，若Token校验成功(SCP通过执行Token校验操作来得到Token校验结果，或SCP请求NRF执行Token校验操作，并根据NRF的相关反馈来获悉Token校验结果)，SCP从Service Producer_B所属Producer Set中选择Service Producer_C(Service Producer_C可能与Service Producer_B相同，也可能不同于Service Producer_B)。
其中，从Producer Set中选择Service Producer_C具体可包括：若服务请求携带有selection parameters，那么SCP可根据服务请求中携带的selection parameters从Producer Set中选择Service Producer_C。此外，若服务请求未携带有selection parameters，那么SCP例如可根据本地配置的相关策略从Producer Set中选择Service Producer_C。
例如当Service Producer为NF Service，SCP从Producer集合中选择的Service Producer_C可称NF Service_C。
例如当Service Producer为NF，SCP可能从Producer集合中选择的Service Producer_C可称NF_C。
此外，若Token校验失败，SCP可向Consumer_A发送服务请求的响应，响应中可携带服务请求失败指示(此时表示Service Producer_C不同意为Consumer_A提供服务)。此处服务请求失败指示可具体指示失败原因为Token校验失败。
708.hSCP向Service Producer_C转发服务请求(服务请求可携带或不携带Token)。
709.Service Producer_C接收hSCP转发的服务请求。Service Producer_C可通过hSCP 和vSCP向Service Consumer_A发送服务请求的响应(服务请求的响应例如可简称服务响应)。
响应中可携带服务请求成功指示(此时表示.Service Producer_C同意为Service Consumer_A提供服务)或响应中可携带服务请求失败指示(此时表示.Service Producer_C不同意为Service Consumer_A提供服务)。
710.hSCP接收到来自.Service Producer_C的上述服务响应之后，hSCP则通过vSCP向Service Consumer_A转发接收到的上述服务响应。
其中，本实施例方案中，由hSCP来执行Token校验(或由hSCP委托第三方(如hNRF)来执行Token校验)，而NF_C则不执行Token校验，这种场景下NF_C是信任SCP的，即SCP为NF_C的信任SCP。其中，NF_C和SCP之间建立信任的机制，此处不再赘述。
其中，本实施例将Token校验提前到SCP上完成，SCP根据Token检验结果来决定是否选择Producer和转发服务请求，有利于进一步简化流程。
参见图8，图8为本申请实施例提供的另一种通信方法的流程示意图。其中，一种通信方法可包括：
801.Service Consumer_A向SCP发送服务请求。
其中，Service Consumer_A发送的服务请求携带Service Consumer_A的标识(例如Service Consumer_A的NF Instance ID)、Service Producer_B的标识(例如Service Producer_B的NF Instance ID或NF Service Instance ID)和请求服务的服务标识。
其中，Service Consumer_A发送的服务请求还可携带selection parameters。
802.SCP接收来自Service Consumer_A的服务请求，SCP对Service Consumer_A进行服务授权操作。
对Service Consumer_A进行服务授权具体可包括：从Token请求获取Service Consumer_A的标识等信息，可以结合本地配置的授权策略和/或授权信息等,对Service Consumer_A进行服务授权。
SCP从Service Producer_B所属Producer Set中选择Service Producer_C(Service Producer_C可能与Service Producer_B相同，也可能不同于Service Producer_B)。
其中，从Producer Set中选择Service Producer_C具体可包括：若服务请求携带有selection parameters，那么SCP可根据服务请求中携带的selection parameters从Producer Set中选择Service Producer_C。此外，若服务请求未携带有selection parameters，那么SCP例如可根据本地配置的相关策略从Producer Set中选择Service Producer_C。
例如当Service Producer为NF Service，SCP从Producer集合中选择的Service Producer_C可称NF Service_C。
例如当Service Producer为NF，SCP可能从Producer集合中选择的Service Producer_C可称NF_C。
803.SCP向Service Producer_C转发服务请求。
804.Service Producer_C接收SCP转发的服务请求。Service Producer_C向Service  Consumer_A发送服务请求的响应(服务请求的响应例如可简称服务响应)。
响应中可携带服务请求成功指示(此时表示Service Producer_C同意为Service Consumer_A提供服务)或响应中可携带服务请求失败指示(此时表示Service Producer_C不同意为Service Consumer_A提供服务)。
805.SCP接收到来自Service Producer_C的上述服务响应之后，SCP则可向Service Consumer_A转发接收到的上述服务响应。
本实施例中，Service Producer_C对SCP是信任的，故而对于SCP的服务授权是认为可信的。
参见图9，图9为本申请实施例提供的另一种通信方法的流程示意图。图9举例所示的流程为对应图8流程的漫游场景。其中，一种通信方法可包括：
901.Service Consumer_A向vSCP发送服务请求。
其中，Service Consumer_A发送的服务请求携带Service Consumer_A的标识(例如Service Consumer_A的NF Instance ID)、Service Producer_B的标识(例如Service Producer_B的NF Instance ID或NF Service Instance ID)和请求服务的服务标识。
其中，Service Consumer_A发送的服务请求还可携带selection parameters。
902.vSCP接收来自Service Consumer_A的服务请求，vSCP向hSCP转发来自Service Consumer_A的服务请求。
903.hSCP接收经vSCP转发的来自Service Consumer_A的服务请求，hSCP执行服务授权操作。
对Service Consumer_A进行服务授权具体可包括：从Token请求获取Service Consumer_A的标识等信息，可以结合本地配置的授权策略和/或授权信息等,对Service Consumer_A进行服务授权。
hSCP从Service Producer_B所属Producer Set中选择Service Producer_C(Service Producer_C可能与Service Producer_B相同，也可能不同于Service Producer_B)。
其中，从Producer Set中选择Service Producer_C具体可包括：若服务请求携带有selection parameters，那么hSCP可根据服务请求中携带的selection parameters从Producer Set中选择Service Producer_C。此外，若服务请求未携带有selection parameters，那么hSCP例如可根据本地配置的相关策略从Producer Set中选择Service Producer_C。
例如当Service Producer为NF Service，hSCP从Producer集合中选择的Service Producer_C可称NF Service_C。
例如当Service Producer为NF，hSCP可能从Producer集合中选择的Service Producer_C可称NF_C。
904.hSCP向Service Producer_C转发服务请求。
905.Service Producer_C接收hSCP转发的服务请求。
906.Service Producer_C通过hSCP和vSCP向Service Consumer_A发送服务请求的响应(服务请求的响应例如可简称服务响应)。
响应中可携带服务请求成功指示(此时表示Service Producer_C同意为Service Consumer_A提供服务)或响应中可携带服务请求失败指示(此时表示Service Producer_C不同意为Service Consumer_A提供服务)。
907.hSCP接收到来自Service Producer_C的上述服务响应之后，hSCP通过vSCP向Service Consumer_A转发接收到的上述服务响应。
参见图10，图10为本申请实施例提供的另一种通信方法的流程示意图。其中，一种通信方法可包括：
1001.Service Consumer_A向SCP发送服务请求。
其中，Service Consumer_A发送的服务请求携带Service Consumer_A的标识(例如Service Consumer_A的NF Instance ID)、Service Producer_B的标识(例如Service Producer_B的NF Instance ID或NF Service Instance ID)和请求服务的服务标识。
其中，Service Consumer_A发送的服务请求还可携带selection parameters。
1002.SCP接收来自Service Consumer_A的服务请求，SCP对Service Consumer_A进行服务授权操作和生成Token。
对Service Consumer_A进行服务授权具体可包括：从Token请求获取Service Consumer_A的标识等信息，可以结合本地配置的授权策略和/或授权信息等,对Service Consumer_A进行服务授权。
SCP生成Token的具体方式可参考NRF生成Token的方式，此处不再赘述。
SCP从Service Producer_B所属Producer Set中选择Service Producer_C(Service Producer_C可能与Service Producer_B相同，也可能不同于Service Producer_B)。
其中，从Producer Set中选择Service Producer_C具体可包括：若服务请求携带有selection parameters，那么SCP可根据服务请求中携带的selection parameters从Producer Set中选择Service Producer_C。此外，若服务请求未携带有selection parameters，那么SCP例如可根据本地配置的相关策略从Producer Set中选择Service Producer_C。
例如当Service Producer为NF Service，SCP从Producer集合中选择的Service Producer_C可称NF Service_C。
例如当Service Producer为NF，SCP可能从Producer集合中选择的Service Producer_C可称NF_C。
此外，若服务授权失败，SCP可向Service Consumer_A发送服务请求的响应，响应中可携带服务请求失败指示(此时表示Service Producer_C不同意为Service Consumer_A提供服务)。此处，服务请求失败指示可具体指示失败原因为服务授权失败。
1003.SCP向Service Producer_C转发携带Token的服务请求。
其中，SCP可以将来自Service Consumer_A的服务请求携带的信息进行增加(如Token)、删除和/或替换操作之后再向Service Producer_C转发(例如可删除服务请求携带的selection parameters等)。
1004.Service Producer_C接收SCP转发的携带Token的服务请求。
其中，Service Producer_C执行Token校验操作。
其中，Service Producer_C执行Token校验操作的具体方式可参考图4所示实施例中的相关描述，此处不再赘述。
此外，Service Producer_C也可请求NRF来对服务请求携带的Token进行校验。例如Service Producer_C可将服务请求携带的Token发送给NRF，请求NRF对这个Token进行校验，NRF校验Token后向Service Producer_C返回Token校验结果(结果为Token校验成功或Token校验失败)。
1005.Service Producer_C向Service Consumer_A发送服务请求的响应(服务请求的响应例如可简称服务响应)。
若Token校验成功，响应中可以携带服务请求成功指示(此时表示Service Producer_C同意为Service Consumer_A提供服务)。
若Token校验失败，响应中可以携带服务请求失败指示(此时表示Service Producer_C不同意为Service Consumer_A提供服务)。
1006.SCP接收到来自Service Producer_C的上述服务响应之后，SCP则可向Service Consumer_A转发接收到的上述服务响应。
参见图11，图11为本申请实施例提供的另一种通信方法的流程示意图。图11举例所示的流程为对应图10流程的漫游场景。其中，一种通信方法可包括：
1101.Service Consumer_A向vSCP发送服务请求。
其中，Service Consumer_A发送的服务请求携带Service Consumer_A的标识(例如Service Consumer_A的NF Instance ID)、Service Producer_B的标识(例如Service Producer_B的NF Instance ID或NF Service Instance ID)和请求服务的服务标识。
其中，Service Consumer_A发送的服务请求还可携带selection parameters。
1102.vSCP接收来自Service Consumer_A的服务请求，vSCP向hSCP转发来自Service Consumer_A的服务请求。
1103.hSCP接收经vSCP转发的来自Service Consumer_A的服务请求，hSCP执行服务授权操作和生成Token。
对Service Consumer_A进行服务授权具体可包括：从Token请求获取Service Consumer_A的标识等信息，可以结合本地配置的授权策略和/或授权信息等,对Service Consumer_A进行服务授权。
hSCP生成Token的具体方式可参考NRF生成Token的方式，此处不再赘述。
hSCP从Service Producer_B所属Producer Set中选择Service Producer_C(Service Producer_C可能与Service Producer_B相同，也可能不同于Service Producer_B)。
其中，从Producer Set中选择Service Producer_C具体可包括：若服务请求携带有selection parameters，那么hSCP可根据服务请求中携带的selection parameters从Producer Set中选择Service Producer_C。此外，若服务请求未携带有selection parameters，那么hSCP例如可根据本地配置的相关策略从Producer Set中选择Service Producer_C。
例如当Service Producer为NF Service，hSCP从Producer集合中选择的Service Producer_C可称NF Service_C。
例如当Service Producer为NF，hSCP可能从Producer集合中选择的Service Producer_C可称NF_C。
此外，若服务授权失败，hSCP可向Service Consumer_A发送服务请求的响应，响应中可携带服务请求失败指示(此时表示Service Producer_C不同意为Service Consumer_A提供服务)。此处，服务请求失败指示可具体指示失败原因为服务授权失败。
1104.hSCP向Service Producer_C转发携带Token的服务请求。
其中，hSCP可以将来自Service Consumer_A的服务请求携带的信息进行增加(如Token)、删除和/或替换操作之后再向Service Producer_C转发(例如可删除服务请求携带的selection parameters等)。
1105.Service Producer_C接收hSCP转发的携带Token的服务请求。Service Producer_C执行Token校验操作。
其中，Service Producer_C执行Token校验操作。
其中，Service Producer_C执行Token校验操作的具体方式可参考图4所示实施例中的相关描述，此处不再赘述。
此外，Service Producer_C也可请求NRF来对服务请求携带的Token进行校验。例如Service Producer_C可将服务请求携带的Token发送给NRF，请求NRF对这个Token进行校验，NRF校验Token后向Service Producer_C返回Token校验结果(结果为Token校验成功或Token校验失败)。
1006.Service Producer_C向Service Consumer_A发送服务请求的响应(服务请求的响应例如可简称服务响应)。
若Token校验成功，响应中可以携带服务请求成功指示(此时表示Service Producer_C同意为Service Consumer_A提供服务)。
若Token校验失败，响应中可以携带服务请求失败指示(此时表示Service Producer_C不同意为Service Consumer_A提供服务)。
1107.hSCP接收到来自Service Producer_C的上述服务响应之后，hSCP通过vSCP向Service Consumer_A转发接收到的上述服务响应。
可以看出，本申请一些实施例的方案中，可由NRF或SCP来执行服务授权操作，也可由NRF或SCP来执行Token生成操作，并且，所生成的Token可以是Set粒度的，可以实现eSBA架构中SCP参与的indirect模式下，Producer位于NF/NF service set中，或Producer为NF/NF service set时的授权。使得Consumer可以使用与Producer所在同一Set内其他Instance的授权信息来访问Producer的服务。同时，可以实现以上交互模式在漫游场景下的授权。
下面还提供相关设备实施例。
参见图12，本申请实施例还提供一种网络存储功能NRF1200，包括：
接收单元1210，用于接收来自服务请求者的令牌Token请求。
发送单元1220，用于向所述服务请求者发送所述Token请求的响应，所述Token请求的响应携带Token，所述Token包含服务提供者的NF集合标识。
举例来说，所述Token请求携带如下信息中的一种或者多种：服务提供者的标识或服务提供者的NF集合标识。
例如所述NRF还可包括处理单元1230，其中，处理单元用于若所述Token请求中携带所述服务提供者的标识，根据所述服务提供者的标识得到所述服务提供者的NF集合标识，生成包含所述服务提供者的NF集合标识的Token；或者,若所述Token请求中携带所述服务提供者的NF集合标识，生成包含所述服务提供者的NF集合标识的Token。
举例来说，当服务提供者为NF，所述Token的读者申明(Audience Claim)中包含所述服务提供者的NF集合标识。
或者，当服务提供者为NF Service，所述Token的范围申明(Scope Claim)中包含所述服务提供者的NF服务集合标识。
参见图13，本申请实施例还提供一种NRF，包括：
相互耦合的处理器1310和存储器1320。处理器调用所述存储器中存储的程序，以执行如下步骤：接收来自服务请求者的令牌(Token)请求；向所述服务请求者发送所述Token请求的响应，其中，所述Token请求的响应携带Token，所述Token包含服务提供者(Service Producer)的NF集合标识或NF服务集合标识。
参见图14，本申请实施例还提供一种SCP 1400，包括：
接收单元1410，用于接收来自服务请求者的服务请求，所述服务请求携带Token(这个Token可由NRF生成)，所述Token包含服务提供者的NF集合标识或NF服务集合标识。
发送单元1420，用于从服务提供者的NF集合或NF服务集合中选择的服务提供者发送所述服务请求。
举例来说，当服务提供者为NF，所述Token的读者申明(Audience Claim)中包含所述服务提供者的NF集合标识。
或者，当服务提供者为NF Service，所述Token的范围申明(Scope Claim)中包含所述服务提供者的NF服务集合标识。
其中，可基于本地策略和/或其它信息(例如可包括携带于服务请求的selection parameters等)来从服务提供者的NF集合或NF服务集合中选择服务提供者。
举例来说，所述SCP还包括处理单元1430，用于在向所述NF集合标识所表示的NF集合中的服务提供者发送所述服务请求之前，对所述服务请求包含的所述Token进行校验；
其中，所述发送单元具体用于在所述Token校验成功的情况下，向所述NF集合标识所表示的NF集合中的服务提供者发送所述服务请求。
参见图15，本申请实施例还提供一种SCP 1500，包括：
相互耦合的处理器1510和存储器1520。所述处理器1510调用所述存储器1520中存储的程序，以执行如下步骤：
接收来自服务请求者的服务请求，其中，所述服务请求携带Token(这个Token可由NRF生成)，所述Token包含服务提供者的NF集合标识或NF服务集合标识。从服务提供者的NF集合或NF服务集合中选择的服务提供者发送所述服务请求。
参见图16，本申请实施例还提供一种服务提供者1600，包括：接收单元1610，用于接收服务通信代理SCP发送的服务请求，所述服务请求携带Token，所述Token包含服务提供者的NF集合标识。
处理单元1630，用于校验所述Token。
发送单元1620，用于发送所述服务请求的响应。
举例来说，当服务提供者为NF，所述Token的读者申明(Audience Claim)中包含所述服务提供者的NF集合标识。
或者，当服务提供者为NF Service，所述Token的范围申明(Scope Claim)中包含所述服务提供者的NF服务集合标识。
举例来说，所述Token的校验可包括Token的完整性校验和/或Token的申明校验。
例如Token的申明校验可以包括：校验Token中的读者申明包含的所述服务提供者的NF集合标识，与所述选择的服务提供者的NF集合标识是否一致，在一致的情况下表示所述Token的读者申明校验成功。例如在不一致的情况下表示所述Token的读者申明校验失败。
又例如Token的申明校验可以包括：校验Token中的范围申明包含的所述服务提供者的NF服务集合标识，与所述选择的服务提供者的NF服务集合标识是否一致，在一致的情况下表示所述Token的范围申明校验成功。例如在不一致的情况下表示所述Token的范围申明校验失败。
例如当所述Token校验成功，所述服务提供者发送所述服务请求的响应可携带Token校验成功指示。当所述Token校验失败，所述服务提供者发送所述服务请求的响应可携带Token校验失败指示。
参见图17，本申请实施例还提供一种服务提供者1700包括相互耦合的处理器1710和存储器1720。所述处理器调用所述存储器中存储的程序，以执行如下步骤：接收服务通信代理SCP发送的服务请求，其中，所述服务请求携带Token，所述Token包含服务提供者的NF集合标识。校验所述Token。发送所述服务请求的响应。
参见图18，本申请实施例还提供一种SCP 1800，包括：
接收单元1810，用于接收来自服务请求者的服务请求；
处理单元1830，用于对所述服务请求者进行服务授权或者所述SCP请求NRF对所述服务请求者进行服务授权；
发送单元1820，用于在所述服务请求者的服务授权成功的情况下，所述SCP向服务提供者NF集合中的服务提供者发送所述服务请求。
举例来说，所述方法还包括：所述SCP在所述服务请求者服务授权成功的情况下生成Token。所述SCP向所述服务提供者发送的所述服务请求中携带所述Token，其中，所述Token 包含所述服务提供者的NF集合标识或NF服务集合标识。
举例来说，当服务提供者为NF，所述Token的读者申明(Audience Claim)中包含所述服务提供者的NF集合标识。
或者，当服务提供者为NF Service，所述Token的范围申明(Scope Claim)中包含所述服务提供者的NF服务集合标识。
例如处理单元请求NRF对所述服务请求者进行服务授权包括：
向所述NRF发送授权请求，所述授权请求用于请求所述NRF对所述服务请求者进行服务授权；接收所述NRF发送的所述授权请求的响应，所述授权请求的响应携带所述NRF对所述服务请求者的服务授权结果，所述服务授权结果为服务授权成功或服务授权失败。
举例来说，所述服务请求携带请求服务的服务标识，其中，处理单元对所述服务请求者进行服务授权包括：根据所述SCP本地配置的授权策略或者授权信息，确定所述服务请求者是否具有访问所述服务提供者提供的所述服务标识所表示服务的权限。
参见图19，本申请实施例还提供一种SCP 1900，包括相互耦合的处理器1910和存储器1920。所述处理器1910调用所述存储器中存储的程序，以执行如下步骤：接收来自服务请求者的服务请求；对所述服务请求者进行服务授权或者所述SCP请求NRF对所述服务请求者进行服务授权；在所述服务请求者的服务授权成功的情况下，所述SCP向服务提供者集合中的服务提供者发送所述服务请求。
参见图20，本申请实施例还提供一种网络存储功能2000，包括：
接收单元2010，用于接收来自服务通信代理SCP的携带服务请求者标识的授权请求。
处理单元2030，用于对所述服务请求者标识所表示的服务请求者进行服务授权。
发送单元2020，用于向所述SCP发送所述授权请求的响应，其中，所述授权请求的响应携带所述NRF对所述服务请求者的服务授权结果，所述服务授权结果为服务授权成功或服务授权失败。
举例来说，所述授权请求携带请求服务的服务标识。对所述服务请求者标识所表示的服务请求者进行服务授权包括：根据所述NRF本地配置的授权策略或者授权信息，确定所述服务请求者是否具有访问所述服务提供者提供的所述服务标识所表示服务的权限。
参见图21，本申请实施例还提供一种网络存储功能2100，包括相互耦合的处理器2110和存储器2120。所述处理器调用所述存储器中存储的程序，以执行如下步骤：接收来自服务通信代理SCP的携带服务请求者标识的授权请求；对所述服务请求者标识所表示的服务请求者进行服务授权；向所述SCP发送所述授权请求的响应，其中，所述授权请求的响应携带所述NRF对所述服务请求者的服务授权结果，其中，所述服务授权结果为服务授权成功或服务授权失败。
参见图22，本申请实施例还提供一种服务请求者2200，包括：
发送单元2210，用于向NRF发送令牌token请求；
接收单元2220，用于接收所述NRF发送的所述Token请求的响应，其中，所述Token请求的响应携带Token，所述Token包含服务提供者的NF集合标识或NF服务集合标识；
所述发送单元2210还用于，向服务通信代理SCP发送携带所述Token的服务请求，所述服务请求被所述SCP或者服务提供者用于对所述Token进行校验；
所述接收单元2220还用于，接收所述SCP发送的所述服务请求的响应。
参见图23，本申请实施例还提供一种服务请求者2300，包括：相互耦合的处理器2310和存储器2320。所述处理器2310调用所述存储器中存储的程序，以执行如下步骤：向NRF发送令牌token请求；接收所述NRF发送的所述Token请求的响应，其中，所述Token请求的响应携带Token，所述Token包含服务提供者的NF集合标识或NF服务集合标识；向服务通信代理SCP发送携带所述Token的服务请求，所述服务请求被所述SCP或者服务提供者用于对所述Token进行校验；接收所述SCP发送的所述服务请求的响应。
参见图24，本申请实施例还提供一种服务请求者2400，包括：
发送单元2410，用于向服务通信代理SCP发送服务请求，所述服务请求中包含服务提供者的NF集合标识或NF服务集合标识。所述服务请求被所述SCP或者网络存储功能NRF用于对所述服务请求者进行服务授权。
接收单元2420，用于接收所述SCP发送的所述服务请求的服务响应。
参见图25，本申请实施例还提供一种服务请求者2500，包括：相互耦合的处理器2510和存储器2520。所述处理器2510调用所述存储器中存储的程序，以执行如下步骤：向服务通信代理SCP发送服务请求，所述服务请求中包含服务提供者的NF集合标识或NF服务集合标识。所述服务请求被所述SCP或者网络存储功能NRF用于对所述服务请求者进行服务授权。接收所述SCP发送的所述服务请求的服务响应。
本申请实施例还提供一种计算机可读存储介质，所述计算机可读存储介质存储有计算机程序，所述计算机程序被硬件(例如处理器等)执行，以本申请实施例中由任意设备执行的任意一种方法的部分或全部步骤。
本申请实施例还提供了一种包括指令的计算机程序产品，当所述计算机程序产品在计算机设备上运行时，使得所述这个计算机设备执行以上各方面的任意一种方法的部分或者全部步骤。
在上述实施例中，可全部或部分地通过软件、硬件、固件、或其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线)或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如软盘、硬盘、磁带)、光介质(例如光盘)、或者半导体介质(例如固态硬盘)等。在上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详述的部分，可以参见其他实施例的相关描述。
在上述实施例中，对各实施例的描述都各有侧重，某个实施例中没有详述的部分，可以参见其他实施例的相关描述。
在本申请所提供的几个实施例中，应该理解到，所揭露的装置，也可以通过其它的方式实现。例如以上所描述的装置实施例仅仅是示意性的，例如所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可结合或者可以集成到另一个系统，或一些特征可以忽略或不执行。另一点，所显示或讨论的相互之间的间接耦合或者直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者，也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例的方案的目的。
另外，在本申请各实施例中的各功能单元可集成在一个处理单元中，也可以是各单元单独物理存在，也可两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，或者也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可为个人计算机、服务器或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质例如可包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或光盘等各种可存储程序代码的介质。

Claims (35)

  1. 一种通信方法，其特征在于，包括：
    网络存储功能NRF接收来自服务请求者的令牌Token请求；
    所述NRF向所述服务请求者发送所述Token请求的响应，其中，所述Token请求的响应携带Token，所述Token包含服务提供者的NF集合标识。
  2. 根据权利要求1所述的方法，其特征在于，所述Token请求携带如下信息中的一种或者多种：服务提供者的标识或服务提供者的NF集合标识。
  3. 根据权利要求1-2任意一项所述的方法，其特征在于，所述方法还包括：若所述Token请求中携带所述服务提供者的标识，所述NRF根据所述服务提供者的标识得到所述服务提供者的NF集合标识，生成包含所述服务提供者的NF集合标识的Token；
    或者,若所述Token请求中携带所述服务提供者的NF集合标识，则所述NRF生成包含所述服务提供者的NF集合标识的Token。
  4. 根据权利要求1-3任意一项所述的方法，其特征在于，
    所述Token的读者申明Audience Claim中包含所述服务提供者的NF集合标识。
  5. 一种通信方法，其特征在于，包括：
    服务通信代理SCP接收来自服务请求者的服务请求，所述服务请求携带Token，所述Token包含服务提供者的NF集合标识；
    所述SCP向从服务提供者的NF集合中选择的服务提供者发送所述服务请求。
  6. 根据权利要求5所述的方法，其特征在于，所述Token的读者申明Audience Claim中包含所述服务提供者的NF集合标识。
  7. 根据权利要求5或6所述的方法，其特征在于，所述向所述NF集合标识所表示的NF集合中的服务提供者发送所述服务请求之前还包括：SCP对所述服务请求包含的所述Token进行校验；
    其中，所述SCP向所述NF集合标识所表示的NF集合中的服务提供者发送所述服务请求包括：在所述Token校验成功的情况下，所述SCP向所述NF集合标识所表示的NF集合中的服务提供者发送所述服务请求。
  8. 根据权利要求7所述的方法，其特征在于，所述Token的校验包括：校验Token中的读者申明包含的所述服务提供者的NF集合标识，与所述选择的服务提供者的NF集合标识是否一致，在一致的情况下表示所述Token的读者申明校验成功。
  9. 根据权利要求8所述的方法，其特征在于，所述服务请求携带服务提供者标识或者服务提供者类型,所述选择的服务提供者的NF集合标识根据所述服务提供者标识或者所述服务提供者类型得到。
  10. 一种通信方法，其特征在于，包括：
    服务提供者接收服务通信代理SCP发送的服务请求，所述服务请求携带Token，所述Token包含服务提供者的NF集合标识；
    所述服务提供者校验所述Token；
    所述服务提供者发送所述服务请求的响应。
  11. 根据权利要求10所述的方法，其特征在于，所述Token的读者申明Audience Claim 中包含所述服务提供者的NF集合标识。
  12. 根据权利要求11所述的方法，其特征在于，所述Token的校验包括：校验Token中的读者申明包含的所述服务提供者的NF集合标识，与所述服务提供者自身的NF集合标识是否一致，在一致的情况下表示所述Token的读者申明校验成功。
  13. 一种通信方法，其特征在于，包括：
    服务通信代理SCP接收来自服务请求者的服务请求；
    所述SCP对所述服务请求者进行服务授权或者所述SCP请求NRF对所述服务请求者进行服务授权；
    在所述服务请求者的服务授权成功的情况下，所述SCP向从服务提供者的NF集合中选择的服务提供者发送所述服务请求。
  14. 根据权利要求13所述的方法，其特征在于，所述方法还包括：
    所述SCP在所述服务请求者服务授权成功的情况下生成Token，所述SCP向所述服务提供者发送的所述服务请求中携带所述Token，其中，所述Token包含所述服务提供者的NF集合标识。
  15. 根据权利要求14所述的方法，其特征在于，所述Token的读者申明Audience Claim中包含所述服务提供者的NF集合标识。
  16. 根据权利要求13至15任意一项所述的方法，其特征在于，
    所述SCP请求NRF对所述服务请求者进行服务授权包括：
    所述SCP向所述NRF发送授权请求，所述授权请求用于请求所述NRF对所述服务请求者进行服务授权；所述SCP接收所述NRF发送的所述授权请求的响应，所述授权请求的响应携带所述NRF对所述服务请求者的服务授权结果，所述服务授权结果为服务授权成功或服务授权失败。
  17. 根据权利要求13至15任意一项所述的方法，其特征在于，
    所述服务请求携带请求服务的服务标识，其中，所述SCP对所述服务请求者进行服务授权包括：根据所述SCP本地配置的授权策略或者授权信息，确定所述服务请求者是否具有访问所述服务提供者提供的所述服务标识所表示服务的权限。
  18. 一种通信方法，其特征在于，包括：
    网络存储功能NRF接收来自服务通信代理SCP的携带服务请求者标识的授权请求；
    所述NRF对所述服务请求者标识所表示的服务请求者进行服务授权；
    所述NRF向所述SCP发送所述授权请求的响应，所述授权请求的响应携带所述NRF对所述服务请求者的服务授权结果，所述服务授权结果为服务授权成功或服务授权失败。
  19. 根据权利要求18所述的方法，其特征在于，
    所述授权请求携带请求服务的服务标识，其中，对所述服务请求者标识所表示的服务请求者进行服务授权包括：根据所述NRF本地配置的授权策略或者授权信息，确定所述服务请求者是否具有访问所述服务提供者提供的所述服务标识所表示服务的权限。
  20. 一种通信方法，其特征在于，包括：
    服务请求者Service Consumer向网络存储功能NRF发送令牌token请求；
    所述服务请求者接收所述NRF发送的所述Token请求的响应，所述Token请求的响应 携带Token，其中，所述Token包含服务提供者的NF集合标识；
    所述服务请求者向服务通信代理SCP发送携带所述Token的服务请求，所述服务请求被所述SCP或者服务提供者用于对所述Token进行校验；
    所述服务请求者接收所述SCP发送的所述服务请求的响应。
  21. 一种通信方法，其特征在于，包括：
    服务请求者向服务通信代理SCP发送服务请求，其中，所述服务请求中包含服务提供者的NF集合标识，所述服务请求被所述SCP或者网络存储功能NRF用于对所述服务请求者进行服务授权；
    所述服务请求者接收所述SCP发送的所述服务请求的服务响应。
  22. 一种网络存储功能NRF，其特征在于，包括相互耦合的处理器和存储器；
    其中，所述处理器调用所述存储器中存储的程序，以执行权利要求1至4任意一项所述的方法。
  23. 一种计算机可读存储介质，其特征在于，
    所述计算机可读存储介质存储有计算机程序，所述计算机程序被处理器执行以实现权利要求1至4任意一项所述的方法。
  24. 一种服务通信代理SCP，其特征在于，包括相互耦合的处理器和存储器；
    其中，所述处理器调用所述存储器中存储的程序，以执行权利要求5至9任意一项所述的方法。
  25. 一种计算机可读存储介质，其特征在于，
    所述计算机可读存储介质存储有计算机程序，所述计算机程序被处理器执行以实现权利要求5至9任意一项所述的方法。
  26. 一种服务通信代理SCP，其特征在于，包括相互耦合的处理器和存储器；
    其中，所述处理器调用所述存储器中存储的程序，以执行权利要求10至12任意一项所述的方法。
  27. 一种计算机可读存储介质，其特征在于，
    所述计算机可读存储介质存储有计算机程序，所述计算机程序被处理器执行以实现权利要求10至12任意一项所述的方法。
  28. 一种服务通信代理SCP，其特征在于，包括相互耦合的处理器和存储器；
    其中，所述处理器调用所述存储器中存储的程序，以执行权利要求13至17任意一项所述的方法。
  29. 一种计算机可读存储介质，其特征在于，
    所述计算机可读存储介质存储有计算机程序，所述计算机程序被处理器执行以实现权利要求13至17任意一项所述的方法。
  30. 一种服务通信代理SCP，其特征在于，包括相互耦合的处理器和存储器；
    其中，所述处理器调用所述存储器中存储的程序，以执行权利要求18至19任意一项所述的方法。
  31. 一种计算机可读存储介质，其特征在于，
    所述计算机可读存储介质存储有计算机程序，所述计算机程序被处理器执行以实现权利要求18至19任意一项所述的方法。
  32. 一种服务通信代理SCP，其特征在于，包括相互耦合的处理器和存储器；
    其中，所述处理器调用所述存储器中存储的程序，以执行权利要求20所述的方法。
  33. 一种计算机可读存储介质，其特征在于，
    所述计算机可读存储介质存储有计算机程序，所述计算机程序被处理器执行以实现权利要求20所述的方法。
  34. 一种服务通信代理SCP，其特征在于，包括相互耦合的处理器和存储器；所述处理器调用所述存储器中存储的程序，以执行权利要求21所述的方法。
  35. 一种计算机可读存储介质，其特征在于，
    所述计算机可读存储介质存储有计算机程序，所述计算机程序被处理器执行以实现权利要求21所述的方法。
PCT/CN2020/087336 2019-04-29 2020-04-27 通信方法和通信设备 Ceased WO2020221219A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
EP25172319.3A EP4611350A3 (en) 2019-04-29 2020-04-27 Communication method and communications device
EP20798381.8A EP3955538B1 (en) 2019-04-29 2020-04-27 Communication method and communication device
US17/513,895 US12335114B2 (en) 2019-04-29 2021-10-29 Communication method and communications device
US19/204,658 US20250274359A1 (en) 2019-04-29 2025-05-12 Communication method and communications device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910357702.8A CN111865597B (zh) 2019-04-29 2019-04-29 通信方法和通信设备
CN201910357702.8 2019-04-29

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/513,895 Continuation US12335114B2 (en) 2019-04-29 2021-10-29 Communication method and communications device

Publications (1)

Publication Number Publication Date
WO2020221219A1 true WO2020221219A1 (zh) 2020-11-05

Family

ID=72965540

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/087336 Ceased WO2020221219A1 (zh) 2019-04-29 2020-04-27 通信方法和通信设备

Country Status (4)

Country Link
US (2) US12335114B2 (zh)
EP (2) EP4611350A3 (zh)
CN (2) CN115065476B (zh)
WO (1) WO2020221219A1 (zh)

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2022144231A1 (en) * 2020-12-31 2022-07-07 Telefonaktiebolaget Lm Ericsson (Publ) Method and system for data access authorization via a data collection coordination function
CN114765622A (zh) * 2021-01-13 2022-07-19 诺基亚技术有限公司 网络功能请求错误处置
WO2022204841A1 (en) 2021-03-29 2022-10-06 Huawei Technologies Co., Ltd. Method, apparatus and system of charging management
WO2022225295A1 (en) * 2021-04-20 2022-10-27 Samsung Electronics Co., Ltd. Method and apparatus for authentication between core network devices in mobile communication system
WO2022238161A1 (en) * 2021-05-10 2022-11-17 Telefonaktiebolaget Lm Ericsson (Publ) Data collection coordination function (dccf) data access authorization without messaging framework
CN115396892A (zh) * 2021-05-09 2022-11-25 华为技术有限公司 一种通信方法及装置
US12192359B2 (en) 2020-12-16 2025-01-07 Nokia Technologies Oy Authorization of network request

Families Citing this family (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US12238076B2 (en) * 2018-10-02 2025-02-25 Arista Networks, Inc. In-line encryption of network data
US20220240089A1 (en) * 2019-06-15 2022-07-28 Nokia Technologies Oy Authorization for network function sets in communication system
WO2020260187A1 (en) * 2019-06-24 2020-12-30 Nokia Technologies Oy Apparatuses and methods relating to authorisation of network functions
WO2021144379A1 (en) * 2020-01-16 2021-07-22 Telefonaktiebolaget Lm Ericsson (Publ) Handling of token audience mismatch
US20230283470A1 (en) * 2020-07-31 2023-09-07 Telefonaktiebolaget Lm Ericsson (Publ) Service Request Handling
US20240107299A1 (en) * 2021-01-11 2024-03-28 Nokia Technologies Oy Access token handling for indirect communication
WO2022174433A1 (zh) * 2021-02-21 2022-08-25 华为技术有限公司 服务授权方法、系统及通信装置
CN113825134A (zh) * 2021-09-29 2021-12-21 新华三技术有限公司 一种网络服务授权方法、装置及设备
EP4181465B1 (en) * 2021-11-12 2026-02-18 Nokia Technologies Oy Network security
US20260039650A1 (en) * 2022-07-21 2026-02-05 Nokia Technologies Oy Access token verification
US12598237B2 (en) * 2024-06-20 2026-04-07 Oracle International Corporation Methods, systems, and computer readable media for communicating and using network function (NF) set identifiers in hierarchical NF repository function (NRF) deployments

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2018171316A1 (zh) * 2017-03-20 2018-09-27 中国移动通信有限公司研究院 网络功能信息交互方法及装置、计算机存储介质
CN108632216A (zh) * 2017-03-20 2018-10-09 电信科学技术研究院 网络功能授权方法、装置、可读存储介质及实体设备

Family Cites Families (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3238057A1 (en) * 2014-12-24 2017-11-01 Koninklijke KPN N.V. Method for controlling on-demand service provisioning
JP6679751B2 (ja) * 2016-04-01 2020-04-15 アイディーエーシー ホールディングス インコーポレイテッド サービススライス選択および分離のための方法
KR102633995B1 (ko) * 2016-08-22 2024-02-06 삼성전자 주식회사 무선 통신 시스템에서, 단말과 써드 파티 서버 간의 인증 요청 방법 및, 이를 위한 단말 및 네트워크 슬라이스 인스턴스 관리 장치
AU2017364118A1 (en) * 2016-11-28 2019-05-02 Visa International Service Association Access identifier provisioning to application
CN109428874B (zh) * 2017-08-31 2020-10-09 华为技术有限公司 基于服务化架构的注册方法及装置
CN109688586B (zh) * 2017-10-19 2021-12-07 中兴通讯股份有限公司 一种网络功能认证的方法、装置及计算机可读存储介质
US10645583B2 (en) * 2018-02-15 2020-05-05 Nokia Technologies Oy Security management for roaming service authorization in communication systems with service-based architecture
US10963553B2 (en) * 2018-02-15 2021-03-30 Nokia Technologies Oy Security management for service authorization in communication systems with service-based architecture
US20220095111A1 (en) * 2019-01-04 2022-03-24 Telefonaktiebolaget Lm Ericsson (Publ) Flexible authorization in 5g service based core network
US11509476B2 (en) * 2020-02-12 2022-11-22 Verizon Patent And Licensing Inc. System and method for enabling secure service-based communications via 5G proxies
US12015923B2 (en) * 2021-12-21 2024-06-18 Oracle International Corporation Methods, systems, and computer readable media for mitigating effects of access token misuse

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2018171316A1 (zh) * 2017-03-20 2018-09-27 中国移动通信有限公司研究院 网络功能信息交互方法及装置、计算机存储介质
CN108632216A (zh) * 2017-03-20 2018-10-09 电信科学技术研究院 网络功能授权方法、装置、可读存储介质及实体设备

Non-Patent Citations (3)

* Cited by examiner, † Cited by third party
Title
DEUTSCHE TELEKOM AG ET AL.: "Introduction of indirect communication between NF services, and implicit discovery", S2-1901515, 19 February 2019 (2019-02-19), XP051597550 *
HUAWEI ET AL.: "New solution for service access authorization within a NF Set", S3-191416, 29 April 2019 (2019-04-29), XP051721579 *
See also references of EP3955538A4 *

Cited By (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US12192359B2 (en) 2020-12-16 2025-01-07 Nokia Technologies Oy Authorization of network request
WO2022144231A1 (en) * 2020-12-31 2022-07-07 Telefonaktiebolaget Lm Ericsson (Publ) Method and system for data access authorization via a data collection coordination function
US12342168B2 (en) 2020-12-31 2025-06-24 Telefonaktiebolaget Lm Ericsson (Publ) Method and system for data access authorization via a data collection coordination function
CN114765622A (zh) * 2021-01-13 2022-07-19 诺基亚技术有限公司 网络功能请求错误处置
US12407561B2 (en) 2021-01-13 2025-09-02 Nokia Technologies Oy Network function request error handling
CN114765622B (zh) * 2021-01-13 2025-01-03 诺基亚技术有限公司 网络功能请求错误处置
WO2022204841A1 (en) 2021-03-29 2022-10-06 Huawei Technologies Co., Ltd. Method, apparatus and system of charging management
WO2022225295A1 (en) * 2021-04-20 2022-10-27 Samsung Electronics Co., Ltd. Method and apparatus for authentication between core network devices in mobile communication system
US12256318B2 (en) 2021-04-20 2025-03-18 Samsung Electronics Co., Ltd. Method and apparatus for authentication between core network devices in mobile communication system
CN115396892B (zh) * 2021-05-09 2025-08-12 华为技术有限公司 一种通信方法及装置
EP4325918A4 (en) * 2021-05-09 2024-10-16 Huawei Technologies Co., Ltd. COMMUNICATION METHOD AND APPARATUS
CN115396892A (zh) * 2021-05-09 2022-11-25 华为技术有限公司 一种通信方法及装置
KR20240005819A (ko) * 2021-05-10 2024-01-12 텔레폰악티에볼라겟엘엠에릭슨(펍) 메시징 프레임워크 없는 데이터 수집 코디네이션 기능(dccf) 데이터 액세스 인가
WO2022238161A1 (en) * 2021-05-10 2022-11-17 Telefonaktiebolaget Lm Ericsson (Publ) Data collection coordination function (dccf) data access authorization without messaging framework
KR102888779B1 (ko) 2021-05-10 2025-11-20 텔레폰악티에볼라겟엘엠에릭슨(펍) 메시징 프레임워크 없는 데이터 수집 코디네이션 기능(dccf) 데이터 액세스 인가
US12495029B2 (en) 2021-05-10 2025-12-09 Telefonaktiebolaget Lm Ericsson (Publ) Data collection coordination function (DCCF) data access authorization without messaging framework

Also Published As

Publication number Publication date
EP4611350A3 (en) 2025-10-08
EP3955538C0 (en) 2025-06-11
EP3955538B1 (en) 2025-06-11
US20250274359A1 (en) 2025-08-28
CN111865597A (zh) 2020-10-30
EP4611350A2 (en) 2025-09-03
CN111865597B (zh) 2022-05-17
EP3955538A4 (en) 2022-05-04
US20220052989A1 (en) 2022-02-17
CN115065476A (zh) 2022-09-16
US12335114B2 (en) 2025-06-17
CN115065476B (zh) 2025-03-07
EP3955538A1 (en) 2022-02-16

Similar Documents

Publication Publication Date Title
US12335114B2 (en) Communication method and communications device
US12470930B2 (en) Service authorization method, apparatus, and system
CN113748699B (zh) 用于通信系统中的间接通信的服务授权
US11296877B2 (en) Discovery method and apparatus based on service-based architecture
WO2024149148A1 (zh) 一种通信方法、通信装置和通信系统
US20230396602A1 (en) Service authorization method and system, and communication apparatus
CN113676904B (zh) 切片认证方法及装置
TW202245442A (zh) 一種通訊方法及裝置
US20250184731A1 (en) Communication method and communication apparatus
JP7485788B2 (ja) 安全な通信方法と関連する装置及びシステム
WO2020151677A1 (zh) 通信方法和相关产品
JP2023527193A (ja) サービス取得方法、装置、通信機器及び可読記憶媒体
CN114024664B (zh) 安全通信方法、相关装置及系统
WO2019242467A1 (zh) 一种防止流量欺诈的方法及装置
US20250358200A1 (en) Communication methods and apparatuses, device, chip and storage medium
CN113382410B (zh) 通信方法和相关装置及计算机可读存储介质
US12483892B2 (en) Methods, systems, and computer readable media for authentication between network function repository functions across different networks
WO2020215272A1 (zh) 通信方法、通信装置和通信系统
WO2023216274A1 (zh) 密钥管理方法、装置、设备和存储介质
WO2023216273A1 (zh) 密钥管理方法、装置、设备及存储介质
US20250392582A1 (en) Communication method and communication apparatus
KR20260059574A (ko) 서비스 api 호출 방법 및 장치
WO2018120150A1 (zh) 网络功能实体之间的连接方法及装置
WO2025261152A1 (zh) 通信方法以及通信装置
WO2025026205A1 (zh) 服务api调用的方法和装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20798381

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2020798381

Country of ref document: EP

Effective date: 20211109

WWG Wipo information: grant in national office

Ref document number: 2020798381

Country of ref document: EP