WO2021164125A1 - 会话创建方法及相关设备 - Google Patents

会话创建方法及相关设备 Download PDF

Info

Publication number
WO2021164125A1
WO2021164125A1 PCT/CN2020/087044 CN2020087044W WO2021164125A1 WO 2021164125 A1 WO2021164125 A1 WO 2021164125A1 CN 2020087044 W CN2020087044 W CN 2020087044W WO 2021164125 A1 WO2021164125 A1 WO 2021164125A1
Authority
WO
WIPO (PCT)
Prior art keywords
application
signature certificate
descriptors
signature
network
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2020/087044
Other languages
English (en)
French (fr)
Inventor
付志伟
白一帆
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Beijing Ziguang Zhanrui Communication Technology Co Ltd
Original Assignee
Beijing Ziguang Zhanrui Communication Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Beijing Ziguang Zhanrui Communication Technology Co Ltd filed Critical Beijing Ziguang Zhanrui Communication Technology Co Ltd
Priority to KR1020227032299A priority Critical patent/KR102908112B1/ko
Priority to EP20920074.0A priority patent/EP4109839A4/en
Priority to JP2022550863A priority patent/JP7457144B2/ja
Priority to US17/801,026 priority patent/US12192382B2/en
Publication of WO2021164125A1 publication Critical patent/WO2021164125A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H04L9/3268—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/44—Program or device authentication
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/51—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/16—Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
    • H04L69/164—Adaptation or special uses of UDP protocol
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/0643—Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/40—Security arrangements using identity modules
    • H04W12/48—Security arrangements using identity modules using secure binding, e.g. securely binding identity modules to devices, services or applications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H04W76/12—Setup of transport tunnels
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/80—Wireless
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/14—Session management
    • H04L67/141—Setup of application sessions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/79—Radio fingerprint

Definitions

  • This application relates to the field of communication technology, and in particular to a session creation method and related equipment.
  • the uplink data is created in the way of session creation in the 3rd Generation Partnership Project (3rd Generation Partnership Project, 3GPP) protocol user equipment routing strategy (English: UE route selection policy, abbreviated as: URSP) rules
  • 3rd Generation Partnership Project 3rd Generation Partnership Project
  • URSP UE route selection policy
  • the application identifier (English: Application descriptor) option is defined in the traffic descriptor (English: Trafficdescriptor).
  • the Application descriptors can match the 5GC network configuration, but the existing Application descriptors may be tampered with or forged, causing confusion in session creation and affecting network reliability.
  • the embodiment of the application discloses a session creation method, which can realize effective management of Application descriptors, realize session creation, and improve network reliability.
  • the first aspect of the embodiments of the present application discloses a session creation method, including:
  • the UE matches the signature certificate of the first application or the digital fingerprint of the signature certificate with the application descriptors in the URSP rule of the user equipment routing policy issued by the network side, and the UE creates a session of the first application.
  • the second aspect of the embodiments of the present application discloses a session communication method, and the method includes the following steps:
  • the network device sends a user equipment routing policy URSP policy message containing application descriptors corresponding to the first application to the user equipment UE,
  • the network device receives the session request sent by the UE, and creates a session of the first application program through the session request.
  • the third aspect of the embodiments of the present application discloses a terminal, including a processor, a memory, a communication interface, and one or more programs.
  • the one or more programs are stored in the memory and configured by the Executed by the processor, the program includes instructions for executing the steps in the method described in the first aspect or the method described in the second aspect.
  • the fourth aspect of the embodiments of the present application discloses a computer-readable storage medium, which is characterized by storing a computer program for electronic data exchange, wherein the computer program causes a computer to execute the method described in the first aspect or the second aspect. The method described in the method.
  • the fifth aspect of the embodiments of the present application discloses a computer program product, wherein the above-mentioned computer program product includes a non-transitory computer-readable storage medium storing a computer program, and the above-mentioned computer program is operable to cause a computer to execute operations as in the embodiments of the present application. Part or all of the steps described in the method described in the first aspect or the second aspect.
  • the computer program product may be a software installation package.
  • the technical solution provided by this application reads the signature certificate of the first application program or the digital fingerprint of the signature certificate during session creation, and the UE matches the signature certificate of the first application program or the digital fingerprint of the signature certificate with
  • the application descriptors in the URSP rules of the user equipment routing policy issued by the network side the UE creates the session of the first application, and the application descriptors are managed by the operator, which prevents other applications or programs from interacting with each other.
  • Application descriptors are tampered to ensure the security of Application descriptors and the stability of the network.
  • the technical solution of this application has no hardware dependency.
  • Application developers register with the operator, and the operator’s management and control application signature certificate is used as Application descriptors, which can realize the operator’s authorization management of the application and provide users with differentiated value-added services to provide technical guarantee; the terminal system implementation complexity is very low, and the current
  • the certificate signing mechanism of the smart device can be used directly.
  • the application program distribution and installation phase eliminates the risk of application descriptors being tampered with or forged; before the application program uses data services, it does not need to access the network to complete the application descriptors guaranteed by authentication.
  • FIG. 1 is a schematic structural diagram of a communication system provided by an embodiment of the present application.
  • Figure 2 is a session creation and sending method provided by an embodiment of the present application
  • Figure 3 is a session communication sending method provided by an embodiment of the present application.
  • FIG. 4 is a method for creating and sending a session provided by an embodiment of the present application.
  • FIG. 5 is a user equipment sending method provided by an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of a network device provided by an embodiment of the present application.
  • Fig. 7 is a schematic structural diagram of a device provided by an embodiment of the present application.
  • the "plurality” appearing in the embodiments of the present application refers to two or more than two.
  • the descriptions of the first, second, etc. appearing in the embodiments of this application are only used for illustration and distinguishing the description objects, and there is no order, and it does not mean that the number of devices in the embodiments of this application is particularly limited, and does not constitute a reference to this application. Any limitations of the embodiment.
  • the "connection” appearing in the embodiments of this application refers to various connection modes such as direct connection or indirect connection to realize communication between devices, which is not limited in the embodiments of this application.
  • FIG. 1 is a schematic structural diagram of a communication system provided by an embodiment of the present application.
  • the communication system includes a base station 10 and a UE 20.
  • the base station and the UE are connected through wireless communication.
  • the wireless communication includes but is not limited to: LTE Connection, new radio (English: new radio, abbreviated: NR) connection; of course, in actual applications, other connection methods may also be used, and this application does not limit the specific connection methods described above.
  • the above-mentioned base station may be an eNodeB, or may be an NR base station or an access point (English: access point, AP for short).
  • the terminal in the embodiments of this application may refer to various forms of UE, access terminal, user unit, user station, mobile station, MS (English: mobile station, Chinese: mobile station), remote station, remote terminal, mobile device, User terminal, terminal equipment (English: terminal equipment), wireless communication equipment, user agent, or user device.
  • Terminal devices can also be cellular phones, cordless phones, SIP (English: session initiation protocol, Chinese: Session Initiation Protocol) phones, WLL (English: wireless local loop, Chinese: wireless local loop) stations, PDA (English: personal digital) assistant, Chinese: personal digital processing), handheld devices with wireless communication functions, computing devices or other processing devices connected to wireless modems, in-vehicle devices, wearable devices, terminal devices in the future 5G network or future evolution of PLMN (English : Public land mobile network, Chinese: public land mobile communication network), which is not limited in this embodiment of the application.
  • the 5GC network requires the terminal to match and select the uplink transmission data route through the URSP rules issued by the network.
  • the established PDU session can be reused, or a new PDU Session can be established.
  • the Application descriptors option is defined in Traffic descriptors, and the terminal matches the uplink data route through the application identifier according to the URSP rules issued by the network.
  • the application identifier in the URSP rule can be used by the network operator to provide differentiated QoS service quality for unwanted applications, thereby generating differentiated traffic control strategies or payment services.
  • the 3GPP protocol defines URSP rules and the optional Application descriptors application identifier option, but does not specify how application identifiers are allocated and obtained. How does the operator control the app ID of the assigned application to match the 5GC network configuration, how the terminal obtains the app ID of the app when evaluating and selecting URSP routing rules, and how to prevent the app ID of the app from being used in app distribution, app installation, and terminal operating systems Has been tampered with or forged.
  • PDU session creation will be based on the terminal's application descriptors (such as APP ID) when evaluating and selecting URSP routing rules. If the application descriptors of the application are forged or tampered with, it will cause confusion in session establishment and affect the reliability of the network. .
  • FIG. 2 is a session creation method provided by an embodiment of the present application. The method is executed in the communication system as shown in FIG. 1. The method includes but is not limited to the following steps:
  • Step S200 When the UE performs network connection, obtain the signature certificate of the first application program or the digital fingerprint of the signature certificate.
  • the above-mentioned session is a protocol data unit session (English: PDU session).
  • the Application descriptors provided in this application may specifically be Application descriptors defined by Traffic descriptors in the 3GPP protocol.
  • the aforementioned Application descriptors include: an operating system identifier OSId and an operating system application identifier OSAppId.
  • OSId operating system identifier
  • OSAppId operating system application identifier
  • Step S201 The UE matches the signature certificate of the first application or the digital fingerprint of the signature certificate with the application descriptors in the URSP rule of the user equipment routing policy issued by the network side, and the UE conducts the session of the first application create.
  • the UE matches Application descriptors 1 as the Application descriptors in the user equipment routing policy URSP rule, and then creates or multiplexes the user routing protocol data unit PDU session.
  • the above method may further include:
  • the UE obtains a first application, where the first application includes: a signature certificate of the first application.
  • the UE may obtain the first application program locally, for example, receive the first application program from other devices (including but not limited to: personal computers, other UEs, etc.) in a wired or wireless manner. program.
  • the above-mentioned UE acquiring the first application program may also be acquired through a network method.
  • the UE sends a request message for acquiring the first application program to the network device, and receives the information of the first application program returned by the network device. Installation file or installation package.
  • the above method may further include:
  • the UE receives the Application descriptors in the UPSP rules issued by the operator server.
  • the digital fingerprint of the first application signature certificate is a character string encrypted by a one-way encryption algorithm.
  • the aforementioned one-way encryption algorithms include, but are not limited to: hash algorithms, SHA-1 or SHA-256 algorithms, and so on.
  • the UE matches the signature certificate of the first application program or the digital fingerprint of the signature certificate and the application descriptor Application descriptors Otherwise, it is determined that the UE does not match the signature certificate of the first application or the digital fingerprint of the signature certificate and Application descriptors.
  • the technical solution provided by this application reads the signature certificate of the first application program or the digital fingerprint of the signature certificate during session creation, and the UE matches the signature certificate of the first application program or the digital fingerprint of the signature certificate with the user equipment issued by the network side Application descriptors in the URSP rule of the routing strategy, the UE creates the session of the first application, and the Application descriptors are managed by the operator, which prevents other applications or programs from tampering with the Application descriptors and ensures The security of Application descriptors ensures the stability of the network.
  • the technical solution of this application has no hardware dependency.
  • Application developers register with the operator, and the operator’s management and control application signature certificate is used as Application descriptors, which can realize the operator’s authorization management of the application and provide users with differentiated value-added services to provide technical guarantee; the terminal system implementation complexity is very low, and the current
  • the certificate signing mechanism of the smart device can be used directly.
  • the application program distribution and installation stage eliminates the risk of application descriptors being tampered with or forged; before the application program uses the data service, it does not need to access the network to complete the application descriptors guaranteed by authentication.
  • Figure 3 provides a session communication method, which is implemented in the network system shown in Figure 1.
  • the UE described in Figure 1 may be the UE of an application developer; the method is shown in Figure 3 Show, including the following steps:
  • Step S300 The network device sends a user equipment routing policy URSP policy message containing application descriptors corresponding to the first application to the user equipment UE.
  • Step S301 The network device receives the session request sent by the UE, and creates a session of the first application program through the session request.
  • the network device receives the signature certificate of the first application program or the digital fingerprint of the signature certificate sent by the application development user; the network device sends the signature certificate of the first application program or the digital fingerprint of the signature certificate Digital fingerprints are used as Application descriptors in URSP rules.
  • the network device receives a first application program sent by an application development user, where the first application program includes a signature certificate of the developer;
  • the network device performs a second signature on the first application to obtain the network signature of the first application, the network signature includes the first application network signature certificate or the digital fingerprint of the network signature certificate, and the network signature
  • the digital fingerprint of the signature certificate or network signature certificate is used as Application descriptors in the UPSP rules.
  • the network device receives the signature certificate of the application developer sent by the application developer, and the network device performs a secondary signature on the signature certificate to obtain a secondary signature certificate, and sends the secondary signature certificate to the application developer , And instruct the application developer to carry the secondary signature certificate as the signature certificate of the application developer in the first application as Application descriptors in the UPSP rules.
  • the network device receives a registration request sent by an application development user, where the registration request includes: the first application signing certificate or the digital fingerprint of the signing certificate;
  • the network device completes the registration of the first application signature certificate or the digital fingerprint of the signature certificate according to the registration request.
  • the technical solution provided by this application supports the realization of the session creation method as shown in FIG. 2 and improves the stability of the network.
  • Figure 4 is a session creation method provided by an embodiment of the present application.
  • the method is implemented under the network architecture shown in Figure 1.
  • the UE in the method has two UEs.
  • UE1 is used here. Different from UE2, where UE1 can be a user UE, and UE2 can be a UE of an application developer.
  • the method provided in Figure 4 specifically includes the following steps:
  • Step S400 UE2 sends the signature certificate of the first application program or the digital fingerprint of the signature certificate.
  • Step S401 The network device receives the first application signature certificate or the digital fingerprint of the signature certificate, and uses the first application signature certificate or the digital fingerprint of the signature certificate as Application descriptors in the URSP rule.
  • Step S402 UE2 publishes a first application program, and the first application program includes: a signature certificate of the first application program or a digital fingerprint of the signature certificate.
  • Step S403 UE1 obtains the first application, and installs the first application.
  • Step S404 UE1 receives Application descriptors in the URSP rule issued by the network device.
  • Step S405 The UE1 obtains the signature certificate of the first application program or the digital fingerprint of the signature certificate from the first application program.
  • Step S406 Match the signature certificate of the first application or the digital fingerprint of the signature certificate with the application descriptors in the URSP rule of the user equipment routing policy issued by the network side. After the matching is successful, the UE performs the first application Session creation of the program.
  • the technical solution provided by this application reads the signature certificate of the first application program or the digital fingerprint of the signature certificate during session creation, and the UE matches the signature certificate of the first application program or the digital fingerprint of the signature certificate with the user equipment issued by the network side Application descriptors in the URSP rule of the routing strategy, the UE creates the session of the first application, and the Application descriptors are managed by the operator, which prevents other applications or programs from tampering with the Application descriptors and ensures The security of Application descriptors ensures the stability of the network.
  • the technical solution of this application has no hardware dependency.
  • Application developers register with the operator, and the operator’s management and control application signature certificate is used as Application descriptors, which can realize the operator’s authorization management of the application and provide users with differentiated value-added services to provide technical guarantee; the terminal system implementation complexity is very low, and the current
  • the certificate signing mechanism of the smart device can be used directly.
  • the application program distribution and installation stage eliminates the risk of application descriptors being tampered with or forged; before the application program uses the data service, it does not need to access the network to complete the application descriptors guaranteed by authentication.
  • step S401 in the embodiment shown in FIG. 4 can be replaced by the following steps.
  • Step S401-1 The network device performs a second signature on the first application to obtain the network signature of the first application, and the network signature includes the first application network signature certificate or the digital fingerprint of the network signature certificate , Use the network signature certificate or the digital fingerprint of the network signature certificate as Application descriptors in the UPSP rule.
  • step S400 and step S401 in the embodiment shown in FIG. 4 can be replaced by the following steps.
  • Step S400-2 The network device receives the signature certificate of the application developer sent by the application developer user;
  • step S401-2 the network device performs a secondary signature on the signature certificate to obtain a secondary signature certificate, sends the secondary signature certificate to the application development user, and instructs the application development user to
  • the signature certificate is carried in the first application as the signature certificate of the application developer and serves as Application descriptors in the UPSP rules.
  • FIG. 5 provides a user equipment UE50, and the foregoing UE may include:
  • the obtaining unit 501 is configured to obtain the signature certificate of the first application program or the digital fingerprint of the signature certificate when the network connection is performed;
  • the processing unit 502 is configured to match the signature certificate of the first application or the digital fingerprint of the signature certificate with the application descriptors in the URSP rule of the user equipment routing policy issued by the network side, and the UE performs the first application The session was created.
  • the session is a protocol data unit session PDU session.
  • the Application descriptors are Application descriptors defined by Traffic descriptors in the 3GPP protocol.
  • the application descriptors include: operating system identifier OSId and operating system application identifier OSAppId.
  • the UE further includes:
  • the communication unit 503 is configured to receive the issued first application program, where the first application program includes: a signature certificate of the first application program.
  • the digital fingerprint of the signature certificate of the first application program is a character string encrypted by a one-way encryption algorithm.
  • the communication unit 503 may also be used to receive application descriptors in the UPSP rules issued by the operator server.
  • the processing unit 502 is specifically configured to determine that the UE matches the signature certificate of the first application program or the digital fingerprint of the signature certificate if the signature certificate of the first application program or the digital fingerprint of the signature certificate is consistent with the application program descriptor Application descriptors And Application descriptors, otherwise, it is determined that the UE does not match the signature certificate of the first application or the digital fingerprint of the signature certificate and Application descriptors.
  • the technical solution provided by this application reads the signature certificate of the first application program or the digital fingerprint of the signature certificate during session creation, and the UE matches the signature certificate of the first application program or the digital fingerprint of the signature certificate with the user equipment issued by the network side Application descriptors in the URSP rule of the routing strategy, the UE creates the session of the first application, and the Application descriptors are managed by the operator, which prevents other applications or programs from tampering with the Application descriptors and ensures The security of Application descriptors ensures the stability of the network.
  • the technical solution of this application has no hardware dependency.
  • Application developers register with the operator, and the operator’s management and control application signature certificate is used as Application descriptors, which can realize the operator’s authorization management of the application and provide users with differentiated value-added services to provide technical support; the terminal system implementation complexity is very low, and the current The certificate signing mechanism of the smart device can be used directly.
  • the application program distribution and installation phase eliminates the risk of application descriptors being tampered with or forged; before the application program uses data services, it does not need to access the network to complete the application descriptors guaranteed by authentication.
  • FIG. 6 provides a network device 60.
  • the foregoing network device may include:
  • the communication unit 601 is configured to send a user equipment routing policy URSP policy message containing application descriptors corresponding to the first application to the user equipment UE; receive a session request sent by the UE;
  • the processing unit 602 is configured to create a session of the first application program through a session request.
  • the communication unit 601 is also configured to receive the signature certificate of the first application program or the digital fingerprint of the signature certificate sent by the application development user;
  • the processing unit 602 is further configured for the network device to use the first application signature certificate or the digital fingerprint of the signature certificate as Application descriptors in the URSP rule.
  • the communication unit 601 is further configured to receive a first application program sent by an application program development user, where the first application program includes a signature certificate of the developer;
  • the processing unit 602 is further configured to perform a second signature on the first application to obtain a network signature of the first application, where the network signature includes the first application network signature certificate or the digital fingerprint of the network signature certificate , Use the network signature certificate or the digital fingerprint of the network signature certificate as Application descriptors in the UPSP rule.
  • the communication unit 601 is further configured to receive the application developer's signature certificate sent by the application developer;
  • the processing unit 602 is further configured to perform a secondary signature on the signature certificate to obtain a secondary signature certificate, send the secondary signature certificate to the application development user, and instruct the application development user to
  • the signature certificate is carried in the first application as the signature certificate of the application developer and serves as Application descriptors in the UPSP rules.
  • the communication unit 601 is further configured to receive a registration request sent by an application development user, where the registration request includes: the first application signing certificate or the digital fingerprint of the signing certificate;
  • the processing unit 602 is further configured to complete the registration of the first application signature certificate or the digital fingerprint of the signature certificate according to the registration request.
  • FIG. 7 is a device 70 provided by an embodiment of the present application.
  • the device 70 includes a processor 701, a memory 702, and a communication interface 703.
  • the processor 701, the memory 702, and the communication interface 703 communicate with each other through a bus 704. connect.
  • the memory 702 includes, but is not limited to, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), or Portable read-only memory (compact disc read-only memory, CD-ROM), the memory 702 is used for related computer programs and data.
  • the communication interface 703 is used to receive and send data.
  • the processor 701 may be one or more central processing units (CPUs). When the processor 701 is a CPU, the CPU may be a single-core CPU or a multi-core CPU.
  • CPUs central processing units
  • the processor 701 in the device 70 is configured to read the computer program code stored in the memory 702, and perform the following operations:
  • the UE creates a session of the first application.
  • each operation may also correspond to the corresponding description of the method embodiments shown in FIG. 2, FIG. 3, and FIG. 4.
  • An embodiment of the present application also provides a chip system.
  • the chip system includes at least one processor, a memory, and an interface circuit.
  • the memory, the transceiver, and the at least one processor are interconnected by wires, and the at least one memory
  • a computer program is stored therein; when the computer program is executed by the processor, the method flow shown in FIG. 2, FIG. 3, and FIG. 4 is realized.
  • the embodiment of the present application also provides a computer-readable storage medium in which a computer program is stored. When it is run on a network device, the method flow shown in FIG. 2, FIG. 3, and FIG. 4 can be accomplish.
  • the embodiment of the present application also provides a computer program product.
  • the computer program product runs on a terminal, the method flow shown in FIG. 2, FIG. 3, and FIG. 4 can be realized.
  • An embodiment of the present application also provides a terminal, including a processor, a memory, a communication interface, and one or more programs, the one or more programs are stored in the memory and configured to be executed by the processor
  • the program includes instructions for executing the steps in the method of the embodiments shown in FIG. 2, FIG. 3, and FIG. 4.
  • an electronic device includes hardware structures and/or software modules corresponding to each function.
  • this application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed by hardware or computer software-driven hardware depends on the specific application and design constraint conditions of the technical solution. Professionals and technicians can use different methods for each specific application to implement the described functions, but such implementation should not be considered beyond the scope of this application.
  • the embodiment of the present application may divide the electronic device into functional units according to the foregoing method examples.
  • each functional unit may be divided corresponding to each function, or two or more functions may be integrated into one processing unit.
  • the above-mentioned integrated unit can be implemented in the form of hardware or software functional unit. It should be noted that the division of units in the embodiments of the present application is illustrative, and is only a logical function division, and there may be other division methods in actual implementation.
  • An embodiment of the present application also provides a computer storage medium, wherein the computer storage medium stores a computer program for electronic data exchange, and the computer program enables a computer to execute part or all of the steps of any method as recorded in the above method embodiment ,
  • the above-mentioned computer includes electronic equipment.
  • the embodiments of the present application also provide a computer program product.
  • the above-mentioned computer program product includes a non-transitory computer-readable storage medium storing a computer program. Part or all of the steps of the method.
  • the computer program product may be a software installation package, and the above-mentioned computer includes electronic equipment.
  • the disclosed device may be implemented in other ways.
  • the device embodiments described above are only illustrative, for example, the division of the above-mentioned units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components can be combined or integrated. To another system, or some features can be ignored, or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical or other forms.
  • the units described above as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.
  • the functional units in the various embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit can be implemented in the form of hardware or software functional unit.
  • the above integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable memory.
  • the technical solution of the present application essentially or the part that contributes to the existing technology or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a memory.
  • a number of instructions are included to enable a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the foregoing methods of the various embodiments of the present application.
  • the aforementioned memory includes: U disk, Read-Only Memory (ROM, Read-Only Memory), Random Access Memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.
  • the program can be stored in a computer-readable memory, and the memory can include: a flash disk , Read-only memory (English: Read-Only Memory, abbreviated as: ROM), random access device (English: Random Access Memory, abbreviated as: RAM), magnetic disk or optical disc, etc.
  • ROM Read-Only Memory
  • RAM Random Access Memory

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Computing Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Power Engineering (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)
  • Computer And Data Communications (AREA)

Abstract

本申请实施例提供一种会话创建方法及相关产品，包括：用户设备UE执行网路连接时，获取第一应用程序的签名证书或签名证书的数字指纹；UE匹配第一应用程序的签名证书或签名证书的数字指纹与网络侧下发的用户设备路由选择策略URSP规则中的应用程序描述符Application descriptors，UE进行所述第一应用程序的会话创建。采用本申请实施例提供的方法，能够提高网络可靠性。

Description

会话创建方法及相关设备 技术领域
本申请涉及通信技术领域，尤其涉及一种会话创建方法及相关设备。
背景技术
现有的通信系统中上行数据通过采用会话创建的方式，在第三代合作计划(3rd Generation Partnership Project，简称3GPP)协议用户设备路由选择策略(英文：UE route selection policy，简称：URSP)规则中在流量描述符(英文：Traffic descriptor)中定义了应用程序标识符(英文：Application descriptors)选项。该Application descriptors可以实现匹配5GC网络配置，但是现有的Application descriptors可能被篡改或者伪造，导致会话创建的混乱，影响网络可靠性。
发明内容
本申请实施例公开了一种会话创建方法，能够实现对Application descriptors的有效管理，实现会话创建，提高网络可靠性。
本申请实施例第一方面公开了一种会话创建方法，包括：
用户设备UE执行网路连接时，获取第一应用程序的签名证书或签名证书的数字指纹；
UE匹配第一应用程序的签名证书或签名证书的数字指纹与网络侧下发的用户设备路由选择策略URSP规则中的应用程序描述符Application descriptors，UE进行所述第一应用程序的会话创建。
本申请实施例第二方面公开了一种会话通信方法，所述方法包括如下步骤：
网络设备向用户设备UE发送包含第一应用程序对应的应用程序描述符application descriptors的用户设备路由选择策略URSP策略消息，
网路设备接收所述UE发送的会话请求，通过会话请求创建所述第一应用程序的会话。
本申请实施例第三方面公开了一种终端，包括处理器、存储器、通信接口，以及一个或多个程序，所述一个或多个程序被存储在所述存储器中，并且被配置由所述处理器执行，所述程序包括用于执行第一方面所述的方法或第二方面所述的方法中的步骤的指令。
本申请实施例第四方面公开了一种计算机可读存储介质，其特征在于，存储用于电子数据交换的计算机程序，其中，所述计算机程序使得计算机执行第一方面或第二方面所述的方法中所述的方法。
本申请实施例第五方面公开了一种计算机程序产品，其中，上述计算机程序产品包括存储了计算机程序的非瞬时性计算机可读存储介质，上述计算机程序可操作来使计算机执行如本申请实施例第一方面或第二方面所述的方法中所描述的部分或全部步骤。该计算机程序产品可以为一个软件安装包。
通过实施本申请实施例，本申请提供的技术方案进行会话创建时读取第一应用程序签名证书或所述签名证书的数字指纹，UE匹配第一应用程序的签名证书或签名证书的数字指纹与网络侧下发的用户设备路由选择策略URSP规则中的应用程序描述符Application descriptors，UE进行所述第一应用程序的会话创建，而Application descriptors由运营商来管理，这样避免了其他应用或程序对Application descriptors进行篡改，保证了Application descriptors的安全性，保证了网络的稳定性。本申请的技术方案无硬件依赖。应用开发者向运营商注册，运营商管控应用程序签名证书作为Application descriptors，可以实现运营商对于应用程序的授权管理，为用户提供差异性增值服务提供技术保障；终端系统实现复杂度很低，当前智能设备的证书签名机制可以直接使用。应用程序分发、安装阶段杜绝了 Application descriptors被篡改或者伪造的风险；应用程序使用数据业务之前，无需访问网络即可完成经过鉴权保障的Application descriptors。
附图说明
为了更清楚地说明本申请实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本申请实施例提供的一种通信系统的结构示意图；
图2是本申请实施例提供的一种会话创建发送方法；
图3是本申请实施例提供的一种会话通信发送方法；
图4是本申请实施例提供的一种会话创建发送方法；
图5是本申请实施例提供的一种用户设备发送方法；
图6是本申请实施例提供的一种网络设备的结构示意图；
图7是本申请实施例提供的一种设备的结构示意图。
具体实施方式
本申请的实施方式部分使用的术语仅用于对本申请的具体实施例进行解释，而非旨在限定本申请。本申请的说明书和权利要求书及所述附图中的术语“第一”、“第二”、“第三”和“第四”等是用于区别不同对象，而不是用于描述特定顺序。此外，术语“包括”和“具有”以及它们任何变形，意图在于覆盖不排他的包含。
下面结合本申请实施例中的附图对本申请实施例进行描述。
本申请中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字符“/“，表示前后关联对象是一种“或”的关系。
本申请实施例中出现的“多个”是指两个或两个以上。本申请实施例中出现的第一、第二等描述，仅作示意与区分描述对象之用，没有次序之分，也不表示本申请实施例中对设备个数的特别限定，不能构成对本申请实施例的任何限制。本申请实施例中出现的“连接”是指直接连接或者间接连接等各种连接方式，以实现设备间的通信，本申请实施例对此不做任何限定。
请参见图1，图1是本申请实施例提供的一种通信系统的结构示意图，该通信系统包括：基站10和UE20，其中基站与UE通过无线通信连接，该无线通信包括但不限于：LTE连接、新空口(英文：new radio，简称：NR)连接；当然在实际应用中，还可以是其他的连接方式，本申请并不限制上述连接的具体方式。上述基站可以为eNodeB，也可以为NR基站或接入点(英文：access point，简称：AP)。
本申请实施例中的终端可以指各种形式的UE、接入终端、用户单元、用户站、移动站、MS(英文：mobile station，中文：移动台)、远方站、远程终端、移动设备、用户终端、终端设备(英文：terminal equipment)、无线通信设备、用户代理或用户装置。终端设备还可以是蜂窝电话、无绳电话、SIP(英文：session initiation protocol，中文：会话启动协议)电话、WLL(英文：wireless local loop，中文：无线本地环路)站、PDA(英文：personal digital assistant，中文：个人数字处理)、具有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它处理设备、车载设备、可穿戴设备，未来5G网络中的终端设备或者未来演进的PLMN(英文：public land mobile network，中文：公用陆地移动通信网络)中的终端设备等，本申请实施例对此并不限定。
5GC网络要求终端通过网络下发的URSP规则进行上行发送数据路由匹配和选择，根据URSP规则可以复用已建立的PDU会话，或者新建立PDU Session。在3GPP协议URSP规则中在Traffic descriptor中定义了Application descriptors选项，终端根据网络下发的URSP规则通过应用程序标识符匹配上行数据路由。URSP规则中的应用标识符可以被网络运营商针对不要应用程序提供有区别的QoS服务质量，进而产生有区别的流量控制策略或者付费业务。3GPP协议中定义了URSP规则以及可选的Application descriptors应用标识符选项，并没有具体规定应用标识符如何分配和获取。运营商如何控制分配应用程序的APP ID去匹配5GC网络配置，终端在评估和选择URSP路由规则时候如何获取应用程序APP ID以及如何防止应用程序的APP ID在应用分发、应用安装和终端操作系统中被篡改或者伪造。
具体地，在3GPP网络连接中，根据不同的技术场景会对不同的应用程序创建不同的PDU会话，因为不同的应用程序可能具有不同的服务质量(英文：Quality of Service，简称：Qos)，针对PDU会话创建，会依据终端在评估和选择URSP路由规则时候会获取APP的Application descriptors(例如APP ID)，如果应用程序的Application descriptors伪造或篡改，会导致会话建立的混乱，进而影响网络的可靠性。
请参见图2，图2是本申请实施例提供的一种会话创建方法，该方法在如图1所示的通信系统内执行，该方法包括但不限于如下步骤：
步骤S200、UE执行网路连接时，获取第一应用程序的签名证书或签名证书的数字指纹。
具体地，在一种可选的方案中，上述会话为协议数据单元会话(英文：PDU session)。
在本申请提供的Application descriptors具体可以为3GPP协议中Traffic descriptor定义的Application descriptors。
具体地，上述Application descriptors包括：操作系统标识符OSId和操作系统应用标识符OSAppId。在一种可选的方案中，上述操作系统应用标识符为多个时，其也可以表示为OSAppId(s)。
步骤S201、UE匹配第一应用程序的签名证书或签名证书的数字指纹与网络侧下发的用户设备路由选择策略URSP规则中的应用程序描述符Application descriptors，UE进行所述第一应用程序的会话创建。
具体地，在一种可选的方案中，UE将Application descriptors1作为用户设备路由选择策略URSP规则中Application descriptors进行匹配，之后进行用户路由选择协议数据单元PDU会话的创建或复用。
具体地，上述方法在步骤S200之前还可以包括：
UE获取第一应用程序，所述第一应用程序包括：第一应用程序的签名证书。
在一种可选的方案中，上述UE获取第一应用程序可以通过本地方式获取，例如通过有线或无线的方式从其他设备(包括但不限于：个人电脑、其他UE等)接收该第一应用程序。
在另一种可选的方案中，上述UE获取第一应用程序还可以通过网络方式获取，例如，UE向网络设备发送获取第一应用程序的请求消息，接收网络设备返回的第一应用程序的安装文件或安装包。
具体地，上述方法还可以包括：
UE接收运营商服务器下发的UPSP规则中的应用程序描述符Application descriptors。
在本申请实施例中，上述第一应用程序签名证书的数字指纹为单向加密算法加密后的字符串。上述单向加密算法包括但不限于：哈希算法、SHA-1或SHA-256算法等等。
具体地，在一种可选方案中。如果所述第一应用程序的签名证书或者签名证书的数字 指纹与所述应用程序描述符Application descriptors一致，确定UE匹配第一应用程序的签名证书或者签名证书的数字指纹与应用程序描述符Application descriptors，否则，确定UE不匹配第一应用程序的签名证书或者签名证书的数字指纹与应用程序描述符Application descriptors。
本申请提供的技术方案进行会话创建时读取第一应用程序签名证书或所述签名证书的数字指纹，UE匹配第一应用程序的签名证书或签名证书的数字指纹与网络侧下发的用户设备路由选择策略URSP规则中的应用程序描述符Application descriptors，UE进行所述第一应用程序的会话创建，而Application descriptors由运营商来管理，这样避免了其他应用或程序对Application descriptors进行篡改，保证了Application descriptors的安全性，保证了网络的稳定性。本申请的技术方案无硬件依赖。应用开发者向运营商注册，运营商管控应用程序签名证书作为Application descriptors，可以实现运营商对于应用程序的授权管理，为用户提供差异性增值服务提供技术保障；终端系统实现复杂度很低，当前智能设备的证书签名机制可以直接使用。应用程序分发、安装阶段杜绝了Application descriptors被篡改或者伪造的风险；应用程序使用数据业务之前，无需访问网络即可完成经过鉴权保障的Application descriptors。
参阅图3，图3提供了一种会话通信方法，该方法在如图1所示的网络系统中实现，如图1所述的UE可以为应用程序开发者的UE；该方法如图3所示，包括如下步骤：
步骤S300、网络设备向用户设备UE发送包含第一应用程序对应的应用程序描述符application descriptors的用户设备路由选择策略URSP策略消息。
步骤S301、网络设备接收所述UE发送的会话请求，通过会话请求创建所述第一应用程序的会话。
具体地，在一种可选的方案中，网络设备接收应用程序开发用户发送的第一应用程序的签名证书或者签名证书的数字指纹；网络设备将所述第一应用程序签名证书或者签名证书的数字指纹作为URSP规则中的Application descriptors。
可选的，在一种可选的方案中，
网络设备接收应用程序开发用户发送的第一应用程序，所述第一应用程序包括开发者的签名证书；
网络设备对所述第一应用程序进行二次签名得到所述第一应用程序的网络签名，所述网络签名包括所述第一应用程序网络签名证书或者网络签名证书的数字指纹，将所述网络签名证书或者网络签名证书的数字指纹作为UPSP规则中Application descriptors。
具体地，在一种可选方案中，
网络设备接收应用程序开发用户发送的所述应用程序开发者的签名证书，网络设备对所述签名证书进行二次签名后得到二次签名证书，将所述二次签名证书发送给应用程序开发用户，并指示所述应用程序开发用户将所述二次签名证书作为所述应用程序开发者的签名证书携带在第一应用程序内，作为UPSP规则中Application descriptors。
具体地，在一种可选的方案中，
网络设备接收应用程序开发用户发送注册请求，所述注册请求包括：第一应用程序签名证书或签名证书的数字指纹；
网络设备依据所述注册请求完成对所述第一应用程序签名证书或签名证书的数字指纹的注册。
本申请提供的技术方案支持了如图2所示的会话创建方法的实现，提高了网络的稳定性。
参阅图4，图4是本申请实施例提供的一种会话创建方法，该方法在如图1所示的网络构架下实现，该方法中的UE具有两个UE，为了方便说明，这里以UE1和UE2区分，其中，UE1可以为使用者UE，UE2可以为应用程序开发者的UE。参阅图4，图4提供的方法具体包括如下步骤：
步骤S400、UE2发送第一应用程序的签名证书或者签名证书的数字指纹。
步骤S401、网络设备接收第一应用程序签名证书或者签名证书的数字指纹，将所述第一应用程序签名证书或者签名证书的数字指纹作为URSP规则中的Application descriptors。
步骤S402、UE2发布第一应用程序，该第一应用程序包括：第一应用程序的签名证书或者签名证书的数字指纹。
步骤S403、UE1获取第一应用程序，安装第一应用程序。
步骤S404、UE1接收网络设备下发的URSP规则中的应用程序描述符Application descriptors。
步骤S405、UE1从第一应用程序获取第一应用程序的签名证书或者签名证书的数字指纹。
步骤S406、匹配第一应用程序的签名证书或签名证书的数字指纹与网络侧下发的用户设备路由选择策略URSP规则中的应用程序描述符Application descriptors，匹配成功之后，UE进行所述第一应用程序的会话创建。
本申请提供的技术方案进行会话创建时读取第一应用程序签名证书或所述签名证书的数字指纹，UE匹配第一应用程序的签名证书或签名证书的数字指纹与网络侧下发的用户设备路由选择策略URSP规则中的应用程序描述符Application descriptors，UE进行所述第一应用程序的会话创建，而Application descriptors由运营商来管理，这样避免了其他应用或程序对Application descriptors进行篡改，保证了Application descriptors的安全性，保证了网络的稳定性。本申请的技术方案无硬件依赖。应用开发者向运营商注册，运营商管控应用程序签名证书作为Application descriptors，可以实现运营商对于应用程序的授权管理，为用户提供差异性增值服务提供技术保障；终端系统实现复杂度很低，当前智能设备的证书签名机制可以直接使用。应用程序分发、安装阶段杜绝了Application descriptors被篡改或者伪造的风险；应用程序使用数据业务之前，无需访问网络即可完成经过鉴权保障的Application descriptors。
具体地，在一种可选的方案中，如图4所示实施例中的步骤S401可以由下述步骤替换。
步骤S401-1、网络设备对所述第一应用程序进行二次签名得到所述第一应用程序的网络签名，所述网络签名包括所述第一应用程序网络签名证书或者网络签名证书的数字指纹，将所述网络签名证书或者网络签名证书的数字指纹作为UPSP规则中Application descriptors。
具体地，在另一种可选的方案中，如图4所示实施例中的步骤S400和步骤S401可以由下述步骤替换。
步骤S400-2、网络设备接收应用程序开发用户发送的所述应用程序开发者的签名证书；
步骤S401-2中网络设备对所述签名证书进行二次签名后得到二次签名证书，将所述二次签名证书发送给应用程序开发用户，并指示所述应用程序开发用户将所述二次签名证书作为所述应用程序开发者的签名证书携带在第一应用程序内，作为UPSP规则中Application descriptors。
此种技术方案对应用程序开发用户进行签名，这样只要开发用户不改变，其签名就可以不变化，避免了同一个开发用户开发多个应用程序需要多次进行签名鉴权的过程。
参阅图5，图5提供了一种用户设备UE50，上述UE可以包括：
获取单元501，用于执行网路连接时，获取第一应用程序的签名证书或签名证书的数字指纹；
处理单元502，用于匹配第一应用程序的签名证书或签名证书的数字指纹与网络侧下发的用户设备路由选择策略URSP规则中的应用程序描述符Application descriptors，UE进行所述第一应用程序的会话创建。
具体地，在一种可选的方法中，所述会话为协议数据单元会话PDU session。
具体地，在一种可选的方法中，所述应用程序描述符Application descriptors为3GPP协议中Traffic descriptor定义的Application descriptors。
具体地，在一种可选的方法中，所述应用程序描述符Application descriptors包括：操作系统标识符OSId和操作系统应用标识符OSAppId。
具体地，在一种可选的方法中，所述UE还包括：
通信单元503，用于接收下发的第一应用程序，所述第一应用程序包括：第一应用程序的签名证书。
具体地，在一种可选的方法中，所述第一应用程序的签名证书的数字指纹为单向加密算法加密后的字符串。
具体地，在一种可选的方法中，
通信单元503，还可以用于接收运营商服务器下发的UPSP规则中的应用程序描述符Application descriptors。
具体地，在一种可选的方法中，
处理单元502，具体用于如果所述第一应用程序的签名证书或者签名证书的数字指纹与所述应用程序描述符Application descriptors一致，确定UE匹配第一应用程序的签名证书或者签名证书的数字指纹与应用程序描述符Application descriptors，否则，确定UE不匹配第一应用程序的签名证书或者签名证书的数字指纹与应用程序描述符Application descriptors。
本申请提供的技术方案进行会话创建时读取第一应用程序签名证书或所述签名证书的数字指纹，UE匹配第一应用程序的签名证书或签名证书的数字指纹与网络侧下发的用户设备路由选择策略URSP规则中的应用程序描述符Application descriptors，UE进行所述第一应用程序的会话创建，而Application descriptors由运营商来管理，这样避免了其他应用或程序对Application descriptors进行篡改，保证了Application descriptors的安全性，保证了网络的稳定性。本申请的技术方案无硬件依赖。应用开发者向运营商注册，运营商管控应用程序签名证书作为Application descriptors，可以实现运营商对于应用程序的授权管理，为用户提供差异性增值服务提供技术保障；终端系统实现复杂度很低，当前智能设备的证书签名机制可以直接使用。应用程序分发、安装阶段杜绝了Application descriptors被篡改或者伪造的风险；应用程序使用数据业务之前，无需访问网络即可完成经过鉴权保障的Application descriptors。
参阅图6，图6提供了一种网络设备60，上述网络设备可以包括：
通信单元601，用于向用户设备UE发送包含第一应用程序对应的应用程序描述符application descriptors的用户设备路由选择策略URSP策略消息；接收所述UE发送的会话请求；
处理单元602，用于通过会话请求创建所述第一应用程序的会话。
具体地，在一种可选方案中，
通信单元601，还用于接收应用程序开发用户发送的第一应用程序的签名证书或者签名证书的数字指纹；
处理单元602，还用于网络设备将所述第一应用程序签名证书或者签名证书的数字指纹作为URSP规则中的Application descriptors。
具体地，在一种可选方案中，
通信单元601，还用于接收应用程序开发用户发送的第一应用程序，所述第一应用程序包括开发者的签名证书；
处理单元602，还用于对所述第一应用程序进行二次签名得到所述第一应用程序的网络签名，所述网络签名包括所述第一应用程序网络签名证书或者网络签名证书的数字指纹，将所述网络签名证书或者网络签名证书的数字指纹作为UPSP规则中Application descriptors。
具体地，在一种可选方案中，
通信单元601，还用于接收应用程序开发用户发送的所述应用程序开发者的签名证书；
处理单元602，还用于对所述签名证书进行二次签名后得到二次签名证书，将所述二次签名证书发送给应用程序开发用户，并指示所述应用程序开发用户将所述二次签名证书作为所述应用程序开发者的签名证书携带在第一应用程序内，作为UPSP规则中Application descriptors。
具体地，在一种可选方案中，
通信单元601，还用于接收应用程序开发用户发送注册请求，所述注册请求包括：第一应用程序签名证书或签名证书的数字指纹；
处理单元602，还用于依据所述注册请求完成对所述第一应用程序签名证书或签名证书的数字指纹的注册。
请参见图7，图7是本申请实施例提供的一种设备70，该设备70包括处理器701、存储器702和通信接口703，所述处理器701、存储器702和通信接口703通过总线704相互连接。
存储器702包括但不限于是随机存储记忆体(random access memory，RAM)、只读存储器(read-only memory，ROM)、可擦除可编程只读存储器(erasable programmable read only memory，EPROM)、或便携式只读存储器(compact disc read-only memory，CD-ROM)，该存储器702用于相关计算机程序及数据。通信接口703用于接收和发送数据。
处理器701可以是一个或多个中央处理器(central processing unit，CPU)，在处理器701是一个CPU的情况下，该CPU可以是单核CPU，也可以是多核CPU。
该设备70中的处理器701用于读取所述存储器702中存储的计算机程序代码，执行以下操作：
执行网路连接时，获取第一应用程序的签名证书或签名证书的数字指纹；
匹配第一应用程序的签名证书或签名证书的数字指纹与网络侧下发的用户设备路由选择策略URSP规则中的应用程序描述符Application descriptors，UE进行所述第一应用程序的会话创建。
需要说明的是，各个操作的实现还可以对应参照图2、图3、图4所示的方法实施例的相应描述。
本申请实施例还提供一种芯片系统，所述芯片系统包括至少一个处理器，存储器和接口电路，所述存储器、所述收发器和所述至少一个处理器通过线路互联，所述至少一个存储器中存储有计算机程序；所述计算机程序被所述处理器执行时，图2、图3、图4所示的方法流程得以实现。
本申请实施例还提供一种计算机可读存储介质，所述计算机可读存储介质中存储有计算机程序，当其在网络设备上运行时，图2、图3、图4所示的方法流程得以实现。
本申请实施例还提供一种计算机程序产品，当所述计算机程序产品在终端上运行时，图2、图3、图4所示的方法流程得以实现。
本申请实施例还提供一种终端，包括处理器、存储器、通信接口，以及一个或多个程序，所述一个或多个程序被存储在所述存储器中，并且被配置由所述处理器执行，所述程序包括用于执行图2、图3、图4所示实施例的方法中的步骤的指令。
上述主要从方法侧执行过程的角度对本申请实施例的方案进行了介绍。可以理解的是，电子设备为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本文中所提供的实施例描述的各示例的单元及算法步骤，本申请能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
本申请实施例可以根据上述方法示例对电子设备进行功能单元的划分，例如，可以对应各个功能划分各个功能单元，也可以将两个或两个以上的功能集成在一个处理单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。需要说明的是，本申请实施例中对单元的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
本申请实施例还提供一种计算机存储介质，其中，该计算机存储介质存储用于电子数据交换的计算机程序，该计算机程序使得计算机执行如上述方法实施例中记载的任一方法的部分或全部步骤，上述计算机包括电子设备。
本申请实施例还提供一种计算机程序产品，上述计算机程序产品包括存储了计算机程序的非瞬时性计算机可读存储介质，上述计算机程序可操作来使计算机执行如上述方法实施例中记载的任一方法的部分或全部步骤。该计算机程序产品可以为一个软件安装包，上述计算机包括电子设备。
需要说明的是，对于前述的各方法实施例，为了简单描述，故将其都表述为一系列的动作组合，但是本领域技术人员应该知悉，本申请并不受所描述的动作顺序的限制，因为依据本申请，某些步骤可以采用其他顺序或者同时进行。其次，本领域技术人员也应该知悉，说明书中所描述的实施例均属于优选实施例，所涉及的动作和模块并不一定是本申请所必须的。
在上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详述的部分，可以参见其他实施例的相关描述。
在本申请所提供的几个实施例中，应该理解到，所揭露的装置，可通过其它的方式实 现。例如，以上所描述的装置实施例仅仅是示意性的，例如上述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性或其它的形式。
上述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
上述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储器中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储器中，包括若干指令用以使得一台计算机设备(可为个人计算机、服务器或者网络设备等)执行本申请各个实施例上述方法的全部或部分步骤。而前述的存储器包括：U盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。
本领域普通技术人员可以理解上述实施例的各种方法中的全部或部分步骤是可以通过程序来指令相关的硬件来完成，该程序可以存储于一计算机可读存储器中，存储器可以包括：闪存盘、只读存储器(英文：Read-Only Memory，简称：ROM)、随机存取器(英文：Random Access Memory，简称：RAM)、磁盘或光盘等。
以上对本申请实施例进行了详细介绍，本文中应用了具体个例对本申请的原理及实施方式进行了阐述，以上实施例的说明只是用于帮助理解本申请的方法及其核心思想；同时，对于本领域的一般技术人员，依据本申请的思想，在具体实施方式及应用范围上均会有改变之处，综上所述，本说明书内容不应理解为对本申请的限制。

Claims (18)

  1. 一种会话创建方法，其特征在于，包括：
    用户设备UE执行网路连接时，获取第一应用程序的签名证书或签名证书的数字指纹；
    UE匹配第一应用程序的签名证书或签名证书的数字指纹与网络侧下发的用户设备路由选择策略URSP规则中的应用程序描述符Application descriptors，UE进行所述第一应用程序的会话创建。
  2. 根据权利要求1所述的方法，其特征在于，
    所述会话为协议数据单元会话PDU session。
  3. 根据权利要求1所述的方法，其特征在于，
    所述应用程序描述符Application descriptors为3GPP协议中Traffic descriptor定义的Application descriptors。
  4. 根据权利要求1所述的方法，其特征在于，
    所述应用程序描述符Application descriptors包括：操作系统标识符OSId和操作系统应用标识符OSAppId。
  5. 根据权利要求1-2任意一项所述的方法，其特征在于，所述方法UE执行网路连接之前还包括：
    UE接收下发的第一应用程序，所述第一应用程序包括：第一应用程序的签名证书。
  6. 根据权利要求5所述的方法，其特征在于，
    所述第一应用程序的签名证书的数字指纹为单向加密算法加密后的字符串。
  7. 根据权利要求1所述的方法，其特征在于，所述方法还包括：UE接收运营商服务器下发的UPSP规则中的应用程序描述符Application descriptors。
  8. 根据权利要求7所述的方法，其特征在于，所述UE匹配第一应用程序的签名证书或者签名证书的数字指纹与网络侧下发的用户设备路由选择策略URSP规则中的应用程序描述符Application descriptors，具体包括：
    如果所述第一应用程序的签名证书或者签名证书的数字指纹与所述应用程序描述符Application descriptors一致，确定UE匹配第一应用程序的签名证书或者签名证书的数字指纹与应用程序描述符Application descriptors，否则，确定UE不匹配第一应用程序的签名证书或者签名证书的数字指纹与应用程序描述符Application descriptors。
  9. 一种会话通信方法，其特征在于，所述方法包括如下步骤：
    网络设备向用户设备UE发送包含第一应用程序对应的应用程序描述符application descriptors的用户设备路由选择策略URSP策略消息，
    网路设备接收所述UE发送的会话请求，通过会话请求创建所述第一应用程序的会话。
  10. 根据权利要求9所述的方法，其特征在于，
    网络设备接收应用程序开发用户发送的第一应用程序的签名证书或者签名证书的数字 指纹；
    网络设备将所述第一应用程序签名证书或者签名证书的数字指纹作为URSP规则中的Application descriptors。
  11. 根据权利要求9所述的方法，其特征在于，
    网络设备接收应用程序开发用户发送的第一应用程序，所述第一应用程序包括开发者的签名证书；
    网络设备对所述第一应用程序进行二次签名得到所述第一应用程序的网络签名，所述网络签名包括所述第一应用程序网络签名证书或者网络签名证书的数字指纹，将所述网络签名证书或者网络签名证书的数字指纹作为UPSP规则中Application descriptors。
  12. 根据权利要求7所述的方法，其特征在于，所述方法还包括：
    网络设备接收应用程序开发用户发送的所述应用程序开发者的签名证书，网络设备对所述签名证书进行二次签名后得到二次签名证书，将所述二次签名证书发送给应用程序开发用户，并指示所述应用程序开发用户将所述二次签名证书作为所述应用程序开发者的签名证书携带在第一应用程序内，作为UPSP规则中Application descriptors。
  13. 根据权利要求7所述的方法，其特征在于，所述方法还包括：
    网络设备接收应用程序开发用户发送注册请求，所述注册请求包括：第一应用程序签名证书或签名证书的数字指纹；
    网络设备依据所述注册请求完成对所述第一应用程序签名证书或签名证书的数字指纹的注册。
  14. 一种用户设备UE，其特征在于，所述UE包括：
    获取单元，用于执行网路连接时，获取第一应用程序的签名证书或签名证书的数字指纹；
    处理单元，用于匹配第一应用程序的签名证书或签名证书的数字指纹与网络侧下发的用户设备路由选择策略URSP规则中的应用程序描述符Application descriptors，UE进行所述第一应用程序的会话创建。
  15. 一种网络设备，其特征在于，所述网络设备包括：
    通信单元，用于向用户设备UE发送包含第一应用程序对应的应用程序描述符application descriptors的用户设备路由选择策略URSP策略消息；接收所述UE发送的会话请求；
    处理单元，用于通过会话请求创建所述第一应用程序的会话。
  16. 一种终端，其特征在于，包括处理器、存储器、通信接口，以及一个或多个程序，所述一个或多个程序被存储在所述存储器中，并且被配置由所述处理器执行，所述程序包括用于执行如权利要求1-8任一项或如权利要求9-13任意一项所述的方法中的步骤的指令。
  17. 一种计算机可读存储介质，其特征在于，存储用于电子数据交换的计算机程序，其中，所述计算机程序使得计算机执行如权利要求1-8任一项或如权利要求9-13任意一项所述的方法。
  18. 一种计算机程序产品，其特征在于，所述计算机程序产品包括存储了计算机程序的非瞬时性计算机可读存储介质，所述计算机程序可操作来使计算机执行如权利要求1-8任一项或如权利要求9-13任意一项所述的方法。
PCT/CN2020/087044 2020-02-21 2020-04-26 会话创建方法及相关设备 Ceased WO2021164125A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
KR1020227032299A KR102908112B1 (ko) 2020-02-21 2020-04-26 세션 생성 방법 및 관련 장치
EP20920074.0A EP4109839A4 (en) 2020-02-21 2020-04-26 SESSION CREATION METHOD AND RELATED DEVICE
JP2022550863A JP7457144B2 (ja) 2020-02-21 2020-04-26 セッション確立方法及び関連装置
US17/801,026 US12192382B2 (en) 2020-02-21 2020-04-26 Method for session creation and related equipment

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010110499.7 2020-02-21
CN202010110499.7A CN111314475B (zh) 2020-02-21 2020-02-21 会话创建方法及相关设备

Publications (1)

Publication Number Publication Date
WO2021164125A1 true WO2021164125A1 (zh) 2021-08-26

Family

ID=71147668

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/087044 Ceased WO2021164125A1 (zh) 2020-02-21 2020-04-26 会话创建方法及相关设备

Country Status (6)

Country Link
US (1) US12192382B2 (zh)
EP (1) EP4109839A4 (zh)
JP (1) JP7457144B2 (zh)
KR (1) KR102908112B1 (zh)
CN (1) CN111314475B (zh)
WO (1) WO2021164125A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2023147888A1 (en) * 2022-02-04 2023-08-10 Lenovo (Singapore) Pte. Ltd Updating route selection policy rules having digital certificate information therein

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111314474B (zh) * 2020-02-21 2021-02-26 北京紫光展锐通信技术有限公司 会话创建方法及相关设备
CN114080054B (zh) * 2020-08-13 2024-09-24 华为技术有限公司 一种pdu会话建立方法、终端设备和芯片系统
CN114630316B (zh) * 2020-12-10 2024-12-20 中国电信股份有限公司 终端外发业务数据的路由选择方法、系统和终端
WO2022148533A1 (en) * 2021-01-05 2022-07-14 Lenovo (Singapore) Pte. Ltd. Selecting a data connection based on digital certificate information
KR20220125503A (ko) 2021-03-05 2022-09-14 삼성전자주식회사 네트워크 슬라이스와 데이터 세션을 수립하는 전자 장치 및 그 동작 방법
CN116033429B (zh) * 2021-03-09 2025-08-19 中国联合网络通信集团有限公司 切片路由规则防篡改方法、网元及介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2019028837A1 (zh) * 2017-08-11 2019-02-14 华为技术有限公司 Pdu类型的设置方法、ue策略的设置方法及相关实体
CN110149670A (zh) * 2018-02-13 2019-08-20 华为技术有限公司 一种数据路由选择的方法及装置
CN110474840A (zh) * 2018-05-09 2019-11-19 华为技术有限公司 数据传输方法、装置和可读存储介质
US20190394279A1 (en) * 2018-06-22 2019-12-26 Huawei Technologies Co., Ltd. Optimizing user equipment operation by conditioning multiple policies on information elements

Family Cites Families (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101980232A (zh) * 2010-10-13 2011-02-23 中兴通讯股份有限公司 Java应用程序的试用方法、系统和装置
KR102046323B1 (ko) * 2012-03-08 2019-11-19 삼성전자주식회사 무선 통신 시스템에서 무선 억세스 네트워크의 트래픽 제어 방법 및 장치
US9270674B2 (en) * 2013-03-29 2016-02-23 Citrix Systems, Inc. Validating the identity of a mobile application for mobile application management
US9717004B2 (en) * 2015-03-17 2017-07-25 Qualcomm Incorporated Apparatus and method for sponsored connectivity to wireless networks using application-specific network access credentials
US9755837B2 (en) * 2015-03-17 2017-09-05 Qualcomm Incorporated Apparatus and method for sponsored connectivity to wireless networks using application-specific network access credentials
CN104778393A (zh) * 2015-04-16 2015-07-15 电子科技大学 一种智能终端的安全指纹识别方法
US11039369B2 (en) * 2018-08-10 2021-06-15 Mediatek Inc. Handling 5G QoS rules on QoS operation errors
KR20200031900A (ko) * 2018-09-17 2020-03-25 삼성전자주식회사 Pdu 세션 제어 방법 및 장치
CN109286587B (zh) 2018-11-01 2021-12-10 陕西齐腾电子科技有限公司 一种多有源广义空间调制检测方法
CN109286567B (zh) * 2018-11-23 2020-07-28 腾讯科技（深圳）有限公司 路由选择策略的获取方法、装置及设备
CN110166577B (zh) * 2019-07-01 2022-02-08 中国工商银行股份有限公司 分布式应用群组会话处理系统及方法
KR20210099406A (ko) * 2020-02-04 2021-08-12 삼성전자주식회사 무선 통신 시스템에서 서비스 수요 정보 분석을 통한 자원 관리 방법 및 장치

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2019028837A1 (zh) * 2017-08-11 2019-02-14 华为技术有限公司 Pdu类型的设置方法、ue策略的设置方法及相关实体
CN110149670A (zh) * 2018-02-13 2019-08-20 华为技术有限公司 一种数据路由选择的方法及装置
CN110474840A (zh) * 2018-05-09 2019-11-19 华为技术有限公司 数据传输方法、装置和可读存储介质
US20190394279A1 (en) * 2018-06-22 2019-12-26 Huawei Technologies Co., Ltd. Optimizing user equipment operation by conditioning multiple policies on information elements

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
See also references of EP4109839A4 *
ZTE: "Clarification on Policy Control Request Triggers", 3GPP DRAFT; S2-1911398, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG2, no. Reno, USA; 20191118 - 20191122, 8 November 2019 (2019-11-08), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France, XP051821490 *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2023147888A1 (en) * 2022-02-04 2023-08-10 Lenovo (Singapore) Pte. Ltd Updating route selection policy rules having digital certificate information therein

Also Published As

Publication number Publication date
KR102908112B1 (ko) 2026-01-05
US12192382B2 (en) 2025-01-07
KR20230026982A (ko) 2023-02-27
EP4109839A4 (en) 2023-08-02
CN111314475A (zh) 2020-06-19
JP7457144B2 (ja) 2024-03-27
JP2023515139A (ja) 2023-04-12
EP4109839A1 (en) 2022-12-28
CN111314475B (zh) 2021-05-04
US20230099322A1 (en) 2023-03-30

Similar Documents

Publication Publication Date Title
WO2021164125A1 (zh) 会话创建方法及相关设备
US12022571B2 (en) Profile between devices in wireless communication system
US11678176B1 (en) Electronic subscriber identity module (eSIM) transfer via activation code
US20170161721A1 (en) Method and system for opening account based on euicc
CN111954208B (zh) 一种安全通信方法和装置
WO2019011203A1 (zh) 设备接入方法、设备及系统
EP4199475A1 (en) Data offloading method and device
CN111919458A (zh) 用于协商euicc版本的方法和装置
CN109246769A (zh) 一种pdu会话建立方法及装置
CN110944319A (zh) 5g通信身份验证方法、设备及存储介质
CN113938880B (zh) 一种应用的验证方法及装置
CN105357771A (zh) 连接建立方法和用户终端
JP7403676B2 (ja) セッション確立方法及び関連装置
CN106940776A (zh) 一种敏感数据操作方法和移动终端
CN118354312A (zh) 核心网接入方法、系统及电子设备
WO2025007511A1 (zh) 分配网络切片的方法、数据处理方法、系统及电子设备
CN116389323A (zh) 吞吐量测试方法、设备及存储介质
CN118614095A (zh) 边缘计算中用于认证过程的协商机制
CN116600289B (zh) 应用密钥获取方法、装置、通信设备、存储介质
US20250338109A1 (en) System and method to restore esim profile on sm-dp+ platform
CN108848493A (zh) 更换电子sim卡的方法和设备
WO2024140038A1 (zh) 一种通信方法及装置
CN115643582A (zh) 一种用于云sim通信的终端设备和方法
CN108684034A (zh) 数据传输方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20920074

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2022550863

Country of ref document: JP

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 20227032299

Country of ref document: KR

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2020920074

Country of ref document: EP

Effective date: 20220921