WO2023178686A1 - 安全实现方法、装置、终端设备、网元、及凭证生成设备 - Google Patents

安全实现方法、装置、终端设备、网元、及凭证生成设备 Download PDF

Info

Publication number
WO2023178686A1
WO2023178686A1 PCT/CN2022/083164 CN2022083164W WO2023178686A1 WO 2023178686 A1 WO2023178686 A1 WO 2023178686A1 CN 2022083164 W CN2022083164 W CN 2022083164W WO 2023178686 A1 WO2023178686 A1 WO 2023178686A1
Authority
WO
WIPO (PCT)
Prior art keywords
network element
terminal device
authorization
certificate
information
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2022/083164
Other languages
English (en)
French (fr)
Inventor
甘露
刘雪峰
邹继鹏
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Guangdong Oppo Mobile Telecommunications Corp Ltd
Original Assignee
Guangdong Oppo Mobile Telecommunications Corp Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Guangdong Oppo Mobile Telecommunications Corp Ltd filed Critical Guangdong Oppo Mobile Telecommunications Corp Ltd
Priority to EP22932747.3A priority Critical patent/EP4503505A4/en
Priority to PCT/CN2022/083164 priority patent/WO2023178686A1/zh
Priority to CN202280093802.4A priority patent/CN118872233A/zh
Publication of WO2023178686A1 publication Critical patent/WO2023178686A1/zh
Priority to US18/891,734 priority patent/US20250016006A1/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/33—User authentication using certificates
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/44—Program or device authentication
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6209—Protecting access to data via a platform, e.g. using keys or access control rules to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6245—Protecting personal data, e.g. for financial or medical purposes
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/50—Address allocation
    • H04L61/5007—Internet protocol [IP] addresses
    • H04L61/503—Internet protocol [IP] addresses using an authentication, authorisation and accounting [AAA] protocol, e.g. remote authentication dial-in user service [RADIUS] or Diameter
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0807—Network architectures or network communication protocols for network security for authentication of entities using tickets, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3239—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H04L9/3249—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures using RSA or related signature schemes, e.g. Rabin scheme
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/50—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using hash chains, e.g. blockchains or hash trees
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2141—Access rights, e.g. capability lists, access control lists, access tables, access matrices

Definitions

  • the embodiments of the present application relate to the field of mobile communication technology, and specifically relate to a security implementation method, device, terminal equipment, network element, and certificate generation device.
  • Synesthesia integration technology refers to technology that integrates the two functions of communication and perception.
  • communication is the transmission of information between two or more points; perception is the detection of physical environment information, such as speed measurement, target positioning, etc.
  • Synesthesia integration technology can enable future communication systems to have both communication and perception functions. While transmitting information over wireless channels, it can actively recognize and analyze the characteristics of the channel to perceive the physical characteristics of the surrounding environment and enhance communication and perception. Function.
  • the communication system can use user equipment, wearable devices, base stations and other sensing devices to sense physical environment information, and digitize the physical environment information to obtain sensing data (such as location data, temperature data, speed, human heart rate, blood pressure, etc. ), in this way, the sensing server can provide corresponding services based on the sensing data transmitted by the sensing device, such as positioning services, speed measurement services, health calling services, etc.
  • sensing data such as location data, temperature data, speed, human heart rate, blood pressure, etc.
  • sensing data is usually personal data or sensitive data, and there is currently no clear solution on how to ensure that sensing data is not leaked or stolen.
  • Embodiments of the present application provide a security implementation method, device, terminal equipment, network element, and certificate generation equipment.
  • the embodiment of this application provides a security implementation method, including:
  • the terminal device obtains the authorization certificate of the first network element; the authorization certificate is used by the terminal equipment to verify whether the transmission of sensing data is authorized; the authorization certificate includes a first digital signature;
  • the terminal device authorizes transmission of the sensing data.
  • the embodiment of this application also provides a security implementation method, including:
  • the first network element sends first request information to the terminal device; the first request information is used to request authorization from the terminal device to transmit sensing data; the first request information includes the authorization certificate of the first network element ; The authorization voucher is used by the terminal device to verify whether the transmission of sensing data is authorized; the authorization voucher is verified through the first digital signature it includes.
  • the embodiment of this application also provides another security implementation method, including:
  • the voucher issuance device receives the fourth request information sent by the first network element; the fourth request information is used to request the authorization voucher of the first network element; the authorization voucher is used by the terminal device to verify whether the transmission of sensing data is authorized;
  • the certificate issuance device generates the authorization certificate of the first network element.
  • the embodiment of this application provides a security implementation device, which is applied to terminal equipment and includes:
  • the first acquisition unit is configured to obtain the authorization certificate of the first network element; the authorization certificate is used by the terminal device to verify whether the transmission of sensing data is authorized; the authorization certificate includes a first digital signature;
  • the authorization unit is configured to authorize the transmission of the sensing data if the authorization certificate is verified based on the first digital signature.
  • the embodiment of the present application also provides a security implementation device, which is applied to the first network element and includes:
  • the second sending unit is configured to send first request information to the terminal device; the first request information is used to request authorization of the terminal device to transmit sensing data; the first request information includes the first network
  • the authorization certificate is used by the terminal device to verify whether the transmission of sensing data is authorized; the authorization certificate is verified by the first digital signature it includes.
  • the embodiment of the present application also provides a security implementation device, which is applied to a voucher issuance device, including:
  • the third receiving unit is configured to receive the fourth request information sent by the first network element; the fourth request information is used to request the authorization certificate of the first network element; the authorization certificate is used by the terminal device to verify whether it is authorized. transmit sensing data;
  • a credential generating unit is configured as an authorization credential for the first network element.
  • the terminal device provided by the embodiment of the present application includes a processor and a memory.
  • the memory is used to store computer programs, and the processor is used to call and run the computer programs stored in the memory to execute the above security implementation method.
  • the first network element provided by the embodiment of the present application includes a processor and a memory.
  • the memory is used to store computer programs, and the processor is used to call and run the computer programs stored in the memory to execute the above security implementation method.
  • the credential generation device provided by the embodiment of the present application includes a processor and a memory.
  • the memory is used to store computer programs, and the processor is used to call and run the computer programs stored in the memory to execute the above security implementation method.
  • the chip provided by the embodiment of this application is used to implement the above security implementation method.
  • the chip includes: a processor, configured to call and run a computer program from the memory, so that the device installed with the chip executes the above-mentioned security implementation method.
  • the computer-readable storage medium provided by the embodiment of the present application is used to store a computer program.
  • the computer program causes the computer to execute the above security implementation method.
  • the computer program product provided by the embodiment of the present application includes computer program instructions, which cause the computer to execute the above security implementation method.
  • the computer program provided by the embodiment of the present application when run on a computer, causes the computer to execute the above security implementation method.
  • the terminal device can verify the authorization certificate of the network element on the network side. If the verification passes, the terminal device can authorize the transmission of sensing data.
  • the authorization direction changes from the network side authorizing the terminal side in related technologies to the terminal side authorizing the network side, thereby ensuring that sensing data is not leaked or stolen.
  • Figure 1 is a schematic diagram of the network architecture of an exemplary communication system provided by an embodiment of the present application
  • FIG. 2 is a schematic flowchart 1 of a security implementation method provided by an embodiment of the present application.
  • Figure 3 is a schematic flow chart 2 of a security implementation method provided by an embodiment of the present application.
  • Figure 4 is a schematic flow chart 3 of a security implementation method provided by an embodiment of the present application.
  • Figure 5 is a schematic flow chart 4 of a security implementation method provided by an embodiment of the present application.
  • Figure 6 is a schematic flowchart of the security implementation method in application scenario one provided by the embodiment of the present application.
  • Figure 7 is a schematic flowchart of the security implementation method in application scenario two provided by the embodiment of the present application.
  • Figure 8 is a schematic flowchart of the security implementation method in application scenario three provided by the embodiment of the present application.
  • Figure 9 is a schematic flowchart of the security implementation method in application scenario four provided by the embodiment of the present application.
  • Figure 10 is a schematic structural diagram of a security implementation device 1000 provided by an embodiment of the present application.
  • Figure 11 is a schematic structural diagram of a security implementation device 1100 provided by an embodiment of the present application.
  • Figure 12 is a schematic structural diagram of a security implementation device 1200 provided by an embodiment of the present application.
  • Figure 13 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • Figure 14 is a schematic structural diagram of a chip according to an embodiment of the present application.
  • Figure 15 is a schematic block diagram of a communication system provided by an embodiment of the present application.
  • Figure 1 is a schematic diagram of the network architecture of a communication system provided by an embodiment of the present application.
  • the communication system 100 may include terminal equipment, access network equipment, a core network, and a third-party application network.
  • the terminal equipment is connected to the core network through the access network equipment. Supports multi-service transmission between terminal equipment and network equipment.
  • LTE Long Term Evolution
  • TDD Time Division Duplex
  • UMTS Universal Mobile Telecommunication System
  • IoT Internet of Things
  • NB-IoT Narrow Band Internet of Things
  • eMTC enhanced Machine-Type Communications
  • 5G communication system also known as New Radio (NR) communication system
  • 6G sixth generation communication system
  • future communication system etc.
  • the access network device can provide communication coverage for a specific geographical area and can communicate with terminal devices located in the coverage area.
  • the access network equipment can be an evolutionary base station (Evolutional Node B, eNB or eNodeB) in the Long Term Evolution (LTE) system, or a base station (gNB) in the NR system, or a 6G base station, or a downstream Next Generation Radio Access Network (NG RAN) equipment, or a wireless controller in a Cloud Radio Access Network (CRAN), or the network equipment 120 can be a relay station or access point , vehicle equipment, wearable devices, hubs, switches, bridges, routers, or network equipment in the future evolved Public Land Mobile Network (Public Land Mobile Network, PLMN), etc.
  • Evolutional Node B, eNB or eNodeB in the Long Term Evolution (LTE) system
  • gNB base station
  • NG RAN Next Generation Radio Access Network
  • CRAN Cloud Radio Access Network
  • the terminal device may be any terminal device, including but not limited to terminal devices that are wired or wirelessly connected to network devices or other terminal devices.
  • the terminal equipment may refer to an access terminal, user equipment (User Equipment, UE), user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication equipment , user agent or user device.
  • Access terminals can be cellular phones, cordless phones, Session Initiation Protocol (SIP) phones, IoT devices, satellite handheld terminals, Wireless Local Loop (WLL) stations, Personal Digital Assistants (Personal Digital Assistant) , PDA), handheld devices with wireless communication capabilities, computing devices or other processing devices connected to wireless modems, vehicle-mounted devices, wearable devices, drones, unmanned vehicles, robots, terminal devices in 5G networks, 6G networks or terminal equipment in future evolution networks, etc.
  • SIP Session Initiation Protocol
  • WLL Wireless Local Loop
  • PDA Personal Digital Assistants
  • handheld devices with wireless communication capabilities computing devices or other processing devices connected to wireless modems
  • vehicle-mounted devices wearable devices, drones, unmanned vehicles, robots, terminal devices in 5G networks
  • Terminal devices can also be used for device-to-device (D2D) communication.
  • D2D device-to-device
  • the core network can be used as a bearer network, providing interfaces to external third-party application networks, providing communication connections, authentication, management, policy control, and carrying of data services for terminal devices.
  • the core network may be a 5G core network (5G Core, 5GC), or an LTE evolved packet core network (Evolved Packet Core, EPC), which is not limited in the embodiments of this application.
  • the core network may include the following network elements: Access and Mobility Management Function (AMF), Authentication Server Function (AUSF), and Application Function (Application Function, AF), Network Exposure Function (NEF), Perception Control Network Element, and Perception Collection Network Element.
  • the core network 130 may also include other network elements not shown in Figure 1, such as user plane function network element (User Plane Function, UPF), session management function network element (Session Management Function, SMF), and unified data management network element (Unified Data Manager, UDM), Network Application Function (NAF), etc.
  • AMF is a control plane network element provided by the operator. It is responsible for access control and mobility management of terminal devices accessing the operator's network. AMF serves as the termination point of non-access layer signaling and processes network signaling.
  • AUSF is also a control plane network element provided by operators and is used for authentication of terminal equipment. AF is used to store business security requirements and provide information for policy determination. NEF is used to expose functions and events to other systems, providing openness while ensuring system security.
  • the sensing control network element can be a control plane network element provided by the operator, and mainly manages and controls sensing services.
  • the sensing collection entity which can be a user plane network element, is used to collect sensing data sent by different devices and manage the sensing data.
  • the network elements in the core network may also be called other names, or new network entities may be formed by dividing the functions of the core network.
  • each of the above network elements can be deployed individually, or two or more network elements can be integrated and deployed in one entity.
  • the perception control network element and the perception collection entity can be deployed in one entity, or the perception control network element and the perception collection entity can also be deployed in different entities respectively.
  • the embodiments of this application do not limit this.
  • FIG. 1 only illustrates the system to which the present application is applicable in the form of an example.
  • the method shown in the embodiment of the present application can also be applied to other systems.
  • system and “network” are often used interchangeably herein.
  • the term “and/or” in this article is just an association relationship that describes related objects, indicating that three relationships can exist. For example, A and/or B can mean: A exists alone, A and B exist simultaneously, and they exist alone. B these three situations.
  • the character "/" in this article generally indicates that the related objects are an "or” relationship.
  • the "instruction” mentioned in the embodiments of this application may be a direct instruction, an indirect instruction, or an association relationship.
  • A indicates B, which can mean that A directly indicates B, for example, B can be obtained through A; it can also mean that A indirectly indicates B, for example, A indicates C, and B can be obtained through C; it can also mean that there is an association between A and B. relation.
  • the "correspondence" mentioned in the embodiments of this application can mean that there is a direct correspondence or indirect correspondence between the two, it can also mean that there is an associated relationship between the two, or it can mean indicating and being instructed. , configuration and configured relationship.
  • predefined can refer to what is defined in the protocol.
  • protocol may refer to a standard protocol in the communication field, which may include, for example, LTE protocol, NR protocol, and related protocols applied in future communication systems. This application does not limit this. .
  • Synesthesia integration refers to a new information processing technology that simultaneously realizes the coordination of perception and communication functions based on software and hardware resource sharing or information sharing, which can effectively improve system spectrum efficiency, hardware efficiency, and information processing efficiency.
  • the intelligent agent needs to recognize the person's posture, movement and expression recognition to enhance the performance of the human-machine interface. It needs to identify the action status between multiple agents and improve the collaborative performance of the intelligent agent. Micro distance requires identifying target attributes inside the human body, products and items, and providing remote, artificial intelligence-based and unmanned physical examination, quality inspection and security inspection services.
  • the authorization mechanism in 5G security technology usually refers to the service network authorizing access to the terminal device, allowing the terminal device to use network resources, and the home network authorizing the service network to provide services for the terminal device.
  • 5GC performs identity authentication and access authorization based on the subscription configuration file in UDM.
  • the service network should authorize the terminal device through the subscription configuration file of the terminal device obtained from the home network.
  • the authorization of the terminal device is based on the authenticated user permanent identifier (Subscription Permanent Identifie, SUPI). It is understandable that current security technology can better meet the access authentication issues of terminal devices in 5G security technology, and has defined some key generation functions and processes.
  • an embodiment of the present application provides a security implementation method, as shown in Figure 2.
  • the method includes but is not limited to the following steps:
  • Step 210 The terminal device obtains the authorization certificate of the first network element; the authorization certificate is used by the terminal equipment to verify whether the transmission of sensing data is authorized; the authorization certificate includes the first digital signature.
  • Step 220 If the authorization certificate is verified based on the first digital signature, the terminal device authorizes the transmission of sensing data.
  • the terminal device can be a device that supports synaesthesia integration technology, and the terminal device can obtain sensing data by detecting physical environment information.
  • the sensing data can be position data, altitude data, temperature data, speed, human heart rate, respiratory rate, blood pressure, etc.
  • the sensing data can come from sensing signals obtained using sensing technology, and the embodiments of this application do not limit this.
  • the terminal device in the embodiment of this application can be understood as a provider of sensing data.
  • the first network element may be a core network element (such as a base station), an access network element (such as a sensing control network element), a network element in a third-party application network (such as a sensing server), etc.
  • the embodiments of this application are There is no restriction on this.
  • the sensing server may be an application server that provides sensing services (such as positioning, speed measurement, and health calling services).
  • the terminal device needs to verify the recipient of the sensing data or the requester of the sensing data to determine the legitimacy of their identity and whether they have the authority to obtain the sensing data to avoid sensing data be compromised or stolen by an attacker.
  • the terminal device can use the authorization certificate of the first network element to verify whether it is authorized to transmit sensing data to the network element on the network side.
  • the authorization certificate of the first network element may include a first digital signature, and the terminal device may use the first digital signature to verify the authorization certificate to determine whether the network element on the network side has the authority to obtain the sensing data of the terminal device.
  • the terminal device can verify the authorization credentials of the network-side network element. If the verification passes, the terminal device can authorize the transmission of sensing data.
  • the authorization direction changes from the network side authorizing the terminal side in related technologies to the terminal side authorizing the network side, thereby ensuring that sensing data is not leaked or stolen.
  • the first digital signature may be a signature of the certificate issuance device. That is to say, the first digital signature may be obtained by using the private key of the certificate issuance device to sign other information in the authorization certificate. It should be understood that the certificate issuance device is a device that generates the first network element authorization certificate.
  • the authorization credentials may also include at least one of the following information:
  • the public key of the certificate issuance device
  • the identification information of the first network element is the identification information of the first network element
  • the service identification information may be used to indicate the service type of the sensing data to be authorized.
  • the service types may include positioning services, speed measurement services, health calling services, environmental monitoring services, etc., which are not limited in the embodiments of this application.
  • the service identification information may be a fixed length of bit data, where different bit data correspond to different service types.
  • the terminal device determines the service type corresponding to the bit data by looking up the table.
  • the service identification information may be identification information of a sensing server that provides sensing services.
  • a sensing server may provide one or more sensing services, so the required sensing service types are different.
  • the identification information of the sensing server can be used to characterize the service type of the sensing data to be authorized.
  • the RSA accumulator parameter corresponding to the first network element is used to verify whether the authorization certificate of the first network element has been revoked. It should be understood that in actual applications, the authorization certificate may be revoked. Therefore, the authorization certificate needs to carry the RSA parameters of the authorization certificate so that the terminal device can verify whether the authorization certificate has been revoked.
  • the data identification information can be used to indicate the data type of the sensing data.
  • the sensing data can come from sensing signals obtained using sensing technology, and the data type includes one or more types.
  • the sensing service is a health call service
  • the data type may include heart rate data, body temperature data, exercise data, blood pressure data, respiratory frequency data, etc.
  • the sensing service is an environment monitoring service
  • the data type may include location data, Wind speed data, temperature data, insolation data, altitude data, etc.
  • the embodiments of this application do not impose restrictions on data types.
  • the certificate issuance device can generate an authorization certificate for the first network element at the request of the first network element.
  • the certificate issuance device may be an application provider certificate authority (Certificate Authority, CA), a perception server, or an operator CA. This application embodiment does not limit this.
  • CA application provider certificate authority
  • This application embodiment does not limit this.
  • the relevant content of the first network element requesting the certificate issuance device to generate the authorization certificate is described in detail below. For the sake of brevity, details will not be described here.
  • the first digital signature may be obtained by signing all or part of the above information using the private key of the certificate issuance device.
  • the terminal device's verification process of the authorization certificate based on the first digital signature can be implemented through the following steps:
  • Step 230 The terminal device verifies the first digital signature using the public key of the certificate issuance device to obtain the first verification information
  • Step 240 If the first verification information is consistent with other information in the authorization certificate except the first digital signature, it is determined that the authorization certificate has been verified.
  • the terminal device can use the public key of the certificate issuance device to verify the first digital signature to obtain the first verification information. Only when the first verification information is consistent with other information in the authorization certificate, the terminal device is authorized to transmit the sensing data to the network element. Otherwise, the terminal device does not perform further processing.
  • the terminal device can obtain the public key of the certificate issuance device from the authorization certificate and verify the first digital signature.
  • the terminal device can also store the public key of the certificate issuance device in advance, and use the pre-stored public key to verify the first digital signature.
  • the embodiment of this application does not limit the source of the public key of the certificate issuance device.
  • the terminal device needs to determine whether the terminal device supports the service identification information indicated in the authorization voucher.
  • Business type, and/or data type indicated by data identification information are examples of service identification information and/or data identification information.
  • the service identification information carried in the authorization voucher can be used to characterize the service type of sensing data that the network element needs to obtain.
  • the data identification information carried in the authorization voucher can be used to characterize the data type of sensing data required by the network element on the network side. Therefore, after the terminal device obtains the authorization certificate of the first network element, it needs to first determine whether it supports the service type and/or data type required by the network side.
  • the terminal device may maintain a service identification information list, which may store service identification information corresponding to all service types supported by the terminal device.
  • a service identification information list which may store service identification information corresponding to all service types supported by the terminal device.
  • the terminal device can compare the service identification information in the authorization certificate with the content in the above list, thereby determining whether the terminal equipment supports the service identification information indication carried in the authorization certificate. business type.
  • the terminal device can also maintain a data identification information list, which can store data identification information corresponding to the data types supported by the terminal device. After obtaining the authorization voucher of the first network element, the terminal device can compare the data identification information in the authorization voucher with the content in the list to determine whether the terminal device supports the data type indicated by the data identification information in the authorization voucher.
  • the terminal device can verify the authorization voucher based on the first digital signature. Otherwise, the terminal device ignores the authorization certificate and does not perform further processing.
  • the terminal device can verify the authorization certificate based on the first digital signature. Otherwise, the terminal device ignores the authorization certificate and does not perform further processing.
  • the terminal device will base the first digital signature only when the terminal device supports the service type indicated by the service identification information and the terminal device supports the data type indicated by the data identification information. Verify authorization credentials.
  • the terminal equipment ignores the authorization certificate and does not perform further processing.
  • the terminal device may send sensing data corresponding to the service type and/or data type indicated by the service identification information. That is to say, the service type of the sensing data sent by the terminal device is the service type indicated by the service identification information in the authorization certificate, and the data type is the data type indicated by the data identification information in the authorization certificate. In this way, it can be ensured that the sensing data sent by the terminal device matches the sensing data required by the first network element, thereby improving transmission efficiency.
  • the terminal device authorizes the transmission awareness Data
  • the authorization voucher includes the RSA accumulator parameter corresponding to the first network element
  • the terminal device verifies whether the authorization certificate of the first network element has been revoked based on the RSA accumulator parameter;
  • the terminal device If the authorization certificate has not been revoked, the terminal device is authorized to transmit sensing data.
  • the terminal device can also verify whether the authorization credential has been revoked based on the RSA accumulator parameter. If the authorization certificate of the first network element has not been revoked, the terminal device is authorized to transmit sensing data. If the authorization certificate of the first network element is revoked, the terminal device determines that the first network element does not have the authority to obtain sensing data. In this way, the authorization efficiency of the sensing data by the terminal device can be improved.
  • step 210 the terminal device obtains the authorization certificate of the first network element, which can be achieved through the following steps:
  • Step 2101 The terminal device receives the first request information sent by the first network element.
  • the first request information is used to request authorization from the terminal device to transmit sensing data to the terminal device; the first request information includes the authorization certificate;
  • Step 2102 The terminal device obtains the authorization certificate from the first request information.
  • the first network element when the first network element needs the terminal device to send sensing data to it, it can send the first request information to the terminal device to trigger the sensing service request.
  • the first network element may carry the authorization certificate of the first network element in the first request information.
  • the terminal device after receiving the first request information, the terminal device can obtain the authorization certificate of the first network element from the first request information, and verify the authorization certificate based on the first digital signature in the authorization certificate to determine whether it is authorized. Transmit sensing data.
  • the first network element locally stores its authorization credentials.
  • the locally stored authorization credentials can be sent to the terminal device through the first request information.
  • the authorization credentials may not be stored locally on the first network element, but may be distributed and stored in blockchain nodes through decentralized identity (Decentralized Identity, DID).
  • DID Decentralized Identity
  • the first network element needs to transmit a sensing service request, it can first obtain the authorization certificate of the first network element from the storage block of the blockchain node. Referring to the schematic flow chart shown in Figure 3 (the dotted lines in Figure 3 indicate optional steps), before the first network element sends the first request information to the terminal device, the following steps can also be performed:
  • Step 2001 The first network element sends third request information to the blockchain node; the third request information is used to request the authorization certificate of the first network element; the third request information includes the storage location information of the authorization certificate in the blockchain node;
  • Step 2002 The first network element receives the authorization certificate of the first network element sent by the blockchain node.
  • the first network element before the first network element needs to trigger a sensing service request, it can request the blockchain node to obtain the authorization certificate of the first network element based on the storage location information of the first network element's authorization certificate. After receiving the authorization voucher fed back by the blockchain node, the first network element may carry the obtained authorization voucher in the first request information and send it to the terminal device, so that the terminal device is authorized to transmit the sensing data.
  • the authorization certificate includes the first digital signature of the certificate issuance device
  • the first network element can use the public key of the certificate issuance device to sign the first digital signature. Verification is performed to determine the authenticity of the authorization credentials. After passing the verification of the first digital signature, the first network element carries the authorization certificate in the first request information and sends it to the terminal device.
  • the authorization certificate of the first network element can be generated in advance by the certificate issuance device.
  • the certificate issuance device can return the authorization certificate to the first network element, or upload the authorization certificate to the blockchain node for distributed storage.
  • the first network element needs to obtain sensing data, it can obtain the authorization certificate from the local storage space, or request the authorization certificate from the blockchain node, and send the obtained authorization certificate to the terminal device through the first request information. . In this way, the flexibility of the terminal device in perceptual data authorization is improved.
  • the terminal device may first perform identity verification on the first network element that sent the first request information, determine whether the first network element is a trusted network element, and determine whether the first network element is a trusted network element. Whether the request information has been tampered with. Only when the identity verification of the first network element is passed, the terminal device obtains the authorization certificate based on the first request information and verifies the authorization certificate, thereby ensuring that the sensing data is not leaked or stolen during subsequent transmission.
  • the terminal device can use the shared secret key with the first network element to authenticate the first network element, and the terminal device can also use the public key of the first network element to authenticate the first network element.
  • the application examples do not limit this.
  • the first request information may include at least one of the following information:
  • the identification information of the first network element is the identification information of the first network element
  • Channel parameters are used to establish a trusted channel between the first network element and the terminal device;
  • the second digital signature is obtained by signing other information in the first request information with the private key of the first network element.
  • the terminal device can use the second digital signature to authenticate the first network element.
  • the method for the terminal device to authenticate the first network element includes the following:
  • the terminal device uses the public key of the first network element to verify the above-mentioned second digital signature to obtain the second verification information; if the second verification information is consistent with other information in the first request information except the second digital signature, then The terminal device determines that the identity verification of the first network element has passed.
  • the terminal device can maintain a public key list, which stores the identification information of multiple network elements and the public key corresponding to each network element. After receiving the first request information sent by the first network element, the terminal device can search for the public key corresponding to the identification information of the first network element from the above public key list. Then, the terminal device verifies the second digital signature based on the public key to obtain the second verification information.
  • the terminal device can also verify the second digital signature based on the public key carried in the first request information to obtain the second verification information.
  • the embodiment of this application does not limit the identity verification method of the first network element.
  • the terminal device when the second verification information is consistent with other information in the first request information except the second digital signature, the terminal device confirms that the first network element is a trusted network element, and the first request information has not been tamper. In the case where the second verification information is inconsistent with other information except the second digital signature in the first request information, the terminal device may consider the first network element to be an untrusted network element, and/or the first request information Tampered by a third party. In this case, the terminal device may ignore the first request information without further processing.
  • the network element on the network side can request the terminal device for authorized transmission of sensing data, and the terminal device can, after receiving the request from the network element on the network side, perform a request on the network side. Verify the identity and permissions of the network element on the side. Moreover, after passing the verification, the terminal device can be authorized to transmit the sensing data to ensure that the sensing data is not leaked or stolen.
  • step 210 the terminal device obtains the authorization certificate of the first network element, which can be achieved through the following steps:
  • Step 2103 The terminal device sends the second request information to the blockchain node.
  • the second request information is used to request the authorization certificate of the first network element; the authorization certificate is stored in the block of the blockchain node; the second request information includes all The storage location information of the authorization certificate in the blockchain node;
  • Step 2104 The terminal device receives the authorization certificate sent by the blockchain node.
  • the authorization certificate of the first network element can be distributed and stored in the blocks of the blockchain node through the decentralized identity (Decentralized Identity, DID) method.
  • the terminal device actively requests the blockchain node for the authorization certificate of the first network element.
  • the terminal device may request the blockchain node to obtain the authorization certificate of the first network element based on the storage location information of the authorization certificate of the first network element.
  • the storage location information of the first network element authorization certificate can be obtained by the terminal device from an access network element (such as a base station) or a core network element, and the embodiment of the present application does not limit this.
  • the terminal device actively requests the blockchain node for the authorization certificate of the first network element for verification and authorization, which may be triggered according to the interactive instructions received on the user interface, or may be triggered by the application program of the terminal device, or may be It is actively triggered after the sensing data is obtained, and the embodiment of the present application does not limit this.
  • the terminal device can be triggered to periodically upload sensing data.
  • the periodic uploading of sensing data may be actively initiated by the terminal device, or may be triggered by user interface interaction, triggered by an application program of the terminal device, etc. This embodiment of the present application does not limit this.
  • the terminal device After the terminal device is triggered to upload sensing data periodically, it can actively request the authorization certificate of the first network element from the blockchain node. After verifying the requested authorization certificate, it can send the sensing data according to the preset time period. .
  • the terminal device can also actively request the authorization certificate of the first network element from the blockchain node first, and then trigger the periodic uploading of sensing data. This application does not impose restrictions on the order of the two.
  • the terminal device can actively obtain the authorization credentials of the network side network element and verify them. If the verification is passed, the terminal device can authorize the transmission of sensing data to ensure that the sensing data is not transmitted. Leaked and stolen.
  • distributed verification authorization close to the terminal device that is, the same type of business in different geographical locations, can authorize sensory data in parallel, improving the efficiency of sensory data authorization.
  • the security implementation method provided by the embodiment of the present application may include the following steps:
  • Step 510 The certificate issuance device receives the fourth request information sent by the first network element; the fourth request information is used to request the authorization certificate of the first network element; the authorization certificate is used by the terminal device to verify whether the transmission of sensing data is authorized.
  • Step 520 The certificate issuance device generates the authorization certificate of the first network element.
  • the certificate issuance device may be an application provider CA, a perception server, or an operator CA, which is not limited in the embodiments of this application.
  • the first network element may initiate a voucher request to the voucher issuance device. Specifically, the first network element may send the fourth request information to the credential issuance device through a secure channel to request the credential issuance device to generate an authorization credential of the first network element so that the terminal device can perform verification based on the authorization credential.
  • the credential issuance device may first perform identity verification on the first network element that sent the fourth request information, determine whether the first network element is a trusted network element, and determine whether the first network element is a trusted network element. 4. Whether the request information has been tampered with. Only when the identity verification of the first network element passes, the certificate issuance device can generate an authorization certificate for the first network element.
  • the fourth request information may include at least one of the following information:
  • the identification information of the first network element is the identification information of the first network element
  • the third digital signature is obtained by signing other information in the fourth request information with the private key of the first network element.
  • the certificate issuance device can use the third digital signature to perform identity verification on the first network element.
  • the method by which the certificate issuance device authenticates the first network element includes the following:
  • the certificate issuance device uses the public key of the first network element to verify the third digital signature to obtain the third verification information; if the third verification information is consistent with other information in the fourth request information except the third digital signature, then The certificate issuance device determines that the identity verification of the first network element has passed.
  • the certificate issuance device can maintain a public key list, which stores the identification information of multiple network elements and the public key corresponding to each network element. After receiving the fourth request information sent by the first network element, the certificate issuance device can search for the public key corresponding to the identification information of the first network element from the above public key list. Then, the certificate issuance device verifies the third digital signature based on the public key to obtain the third verification information.
  • the certificate issuance device can also verify the third digital signature based on the public key carried in the fourth request information to obtain the third verification information.
  • the embodiment of this application does not limit the identity verification method of the first network element.
  • the certificate issuance device confirms that the first network element is a trusted network element, and the fourth request information has not been been tampered with.
  • the certificate issuance device may consider the first network element to be an untrusted network element, and/or the fourth request Information has been tampered with by a third party. In this case, the certificate issuance device may ignore the fourth request information without further processing.
  • an RSA accumulator parameter ⁇ may be generated for the first network element, and the RSA accumulator parameter ⁇ of the first network element may be used to prove the first network element. Whether the authorization certificate has been revoked.
  • the authorization credential generated by the credential issuance device may include at least one of the following information:
  • the public key of the certificate issuance device
  • the identification information of the first network element is the identification information of the first network element
  • the first digital signature may be obtained by the certificate issuing device using its own private key to sign other information in the authorization certificate.
  • the voucher issuance device may also perform steps 530 and 540.
  • Step 530 The certificate issuance device sends the authorization certificate of the first network element to the blockchain node;
  • Step 540 The certificate issuance device receives the storage location information of the authorization certificate sent by the blockchain node.
  • the certificate issuance device can send the generated authorization certificate of the first network element to the blockchain node, and perform an on-chain operation on the authorization certificate of the first network element to achieve distributed storage of the authorization certificate. Further, after the blockchain node receives the authorization certificate, it can store the authorization certificate in the storage block of the blockchain and feed back the storage location information to the certificate issuance device.
  • step 540 the following steps may also be included after step 540:
  • Step 550 The voucher issuance device sends the authorization voucher to the first network element and/or stores the location information.
  • the certificate issuance device can send the generated authorization certificate to the requesting party, that is, the first network element.
  • the certificate issuance device can also send the storage location information of the authorization certificate in the storage block to the first network element, and the first network element can request the authorization certificate from the blockchain node based on the storage location information when needed.
  • the voucher generation device can generate an authorization voucher for the first network element according to the request of the first network element, and perform distributed storage of the authorization voucher.
  • the first network element or terminal device can request the authorization voucher from the blockchain node for distributed verification. That is to say, the same type of business in different geographical locations can be authorized for sensory data in parallel, improving the perception data authorization. s efficiency.
  • the first network element may be the perception server Server
  • the certificate issuance device may be the application provider CA.
  • Step 601 The perception server Server sends the certificate request information to the application provider CA.
  • the credential request information is used to request the authorization credential of the sensing server Server.
  • the credential request information may include at least one of ID server , pk server , ID SP , Type server , and Sig server .
  • ID server is the identification information of the perception server Server
  • pk server is the public key of the perception server Server
  • ID SP is the business identification information
  • Type server is the data identification information
  • Sig server is the digital signature of the perception server Server. Sig server is obtained by the sensing server Server using its own private key to sign one or more of the ID server , pk server , ID SP , and Type server .
  • Step 602 The application provider CA generates an authorization certificate for the perception server Server.
  • the application provider CA can authenticate the awareness server that sends the requested information.
  • the application provider CA can maintain a public key list, which is used to store all server IDs and corresponding public keys using the service type corresponding to the ID sp .
  • the application provider CA can check whether the ID server in the certificate request information is in the public key list. If it is in the public key list, obtain the public key corresponding to the ID server .
  • the application provider CA uses the public key corresponding to the ID server to verify the Sig server in the certificate request information. If the verification result is consistent with other information in the credential request information, it is determined that the awareness server server authentication is passed.
  • the application provider CA can generate an authorization certificate for the sensing server Server based on the content in the certificate request information.
  • the authorization certificate can be represented by Cert sp->server .
  • Cert sp->server may include at least one of ID server , pk server , ID SP , Type server , pk SP , ⁇ server , and Sig sp->server .
  • pk SP is the public key of the application provider CA
  • ⁇ server is the RSA accumulator parameter generated by the application provider CA for the sensing server sever
  • Sig sp->server is the application provider CA using its own private key to ID server .
  • Step 603 The application provider CA sends the authorization certificate Cert sp->server to the blockchain node.
  • Step 604 The application provider CA receives the storage location information BlockNum Cert sent by the blockchain node.
  • Step 605 The application provider CA sends the storage location information BlockNum Cert of the authorization certificate to the perception server Server.
  • the application provider CA can also send the authorization certificate Cert sp->server directly to the awareness server Server.
  • Step 606 The sensing server Server obtains the authorization certificate Cert sp->server from the blockchain node according to the storage location information BlockNum Cert .
  • the perception server Server can verify the authenticity of the obtained authorization certificate through the public key pk SP of the application provider CA. Specifically, the perception server Server uses pk SP to verify the Sig sp->server in the authorization certificate Cert sp->server . If the verification result is consistent with other information in the authorization certificate Cert sp->server , it is determined that the authorization certificate is a real certificate. .
  • Step 607 The sensing server Server sends a sensing data request to the UE.
  • the sensing data request may include at least one of ID server , ID UE , pk server , g, Cert sp->server , and Sig server '.
  • ID UE is the identification information of the UE
  • g is the channel parameter, which is used to establish a trusted channel between the sensing server Server and the UE.
  • Sig server ' is obtained by the sensing server Server using its own private key to sign one or more of ID server , ID UE , pk server , g, Cert sp->server .
  • Step 608 The UE verifies the identity of the sensing server Server.
  • the UE may maintain a public key list, which stores the identification information of multiple sensing servers and the public key corresponding to each sensing server. After receiving the sensing data request sent by the sensing server Server, the UE can search for the public key pk server corresponding to the ID server from the above public key list. Then the UE verifies the Sig server ' based on the pk server . If the verification result obtained by the UE based on the pk server 's verification of the Sig server is consistent with other information in the sensing data request, the sensing server Server is determined to be a trusted device. Otherwise, the UE determines that the verification fails and does not perform further processing.
  • Step 609 After the UE authenticates the identity of the sensing server Server, it verifies the Cert sp->server , and authorizes the transmission of sensing data after passing the verification.
  • the UE after the UE successfully verifies the identity of the sensing server Server, it further verifies Cert sp->server . Specifically, the UE uses the public key pk SP of the certificate issuance device to verify the digital signature Sig sp->server in Cert sp->server . If the verification result is consistent with other information in Cert sp->server , the perception is determined Server Server has the authority to obtain UE sensing data. If the verification result is inconsistent with other information in Cert sp->server , no further processing will be performed.
  • the terminal device can use ⁇ server to verify whether the Cert sp->server has been revoked. If it is revoked, no further processing will be performed. . If it is not revoked, the UE may continue to perform step 610.
  • Step 610 The UE sends sensing data to the sensing server Server.
  • steps 601 to 605 in application scenario 1 can be implemented individually, steps 606 to 610 can also be implemented individually, and steps 601 to 610 can be implemented together.
  • steps 601 to 610 can be implemented together.
  • the embodiments of the present application do not limit this.
  • the first network element may be a base station
  • the certificate issuance device may be an application provider CA.
  • the certificate issuance device can independently issue authorization certificates for the base station. Referring to the flow diagram shown in Figure 7, the process of the application provider CA issuing authorization certificates for the base station can be implemented through the following steps:
  • Step 701 The base station sends certificate request information to the application provider CA.
  • the voucher request information is used to request the authorization voucher of the base station.
  • the credential request information may include at least one of ID bs , pk bs , ID SP , Type bs , and Sig bs .
  • ID bs is the identification information of the base station
  • pk bs is the public key of the base station
  • ID SP is the service identification information
  • Type bs is the data identification information
  • Sig bs is the digital signature of the base station. Sig bs is obtained by the base station using its own private key to sign one or more of ID bs , pk bs , ID SP and Type bs .
  • Step 702 The application provider CA generates an authorization certificate for the base station.
  • the application provider CA can authenticate the base station sending the requested information.
  • the application provider CA can maintain a public key list, which is used to store all base station IDs and corresponding public keys using the service type corresponding to the ID sp .
  • the application provider CA can check whether ID bs in the certificate request information is in the public key list, and if it is in the public key list, obtain the public key corresponding to ID bs .
  • the application provider CA uses the public key corresponding to the ID bs to verify the Sig bs in the certificate request information. If the verification result is consistent with other information in the credential request information, it is determined that the base station identity verification is passed.
  • the application provider CA can generate an authorization certificate for the base station based on the content in the certificate request information.
  • the authorization certificate can be represented by Cert sp->bs .
  • Cert sp->bs may include at least one of ID bs , pk bs , ID SP , Type sbs , pk SP , ⁇ bs , and Sig sp->bs .
  • pk SP is the public key of the application provider CA
  • ⁇ bs is the RSA accumulator parameter generated by the application provider CA for the base station
  • Sig sp->bs is the ID bs and pk bs used by the application provider CA with its own private key.
  • ID SP , Type sbs , pk SP , ⁇ bs one or more signatures are obtained.
  • Step 703 The application provider CA sends the authorization certificate Cert sp->bs to the blockchain node.
  • Step 704 The application provider CA receives the storage location information BlockNum Cert sent by the blockchain node.
  • Step 705 The application provider CA sends the storage location information BlockNum Cert of the authorization certificate to the base station.
  • the application provider CA can also directly send the authorization certificate Cert sp->bs to the base station.
  • the base station in the above embodiment can also be replaced by a sensing control network element.
  • the first network element may be a perception control network element
  • the certificate issuance device may be an application provider CA.
  • the perception control network element can request the terminal device to authorize the transmission of sensing data.
  • the method for the sensing control network element to request the terminal device to authorize the transmission of sensing data in the embodiment of the present application can be implemented through the following steps:
  • Step 801 The perception control network element obtains the authorization certificate Cert sp->server of the perception control network element from the blockchain node according to the storage location information BlockNum Cert .
  • the perception control network element can verify the authenticity of the obtained authorization certificate through the public key pk SP of the application provider CA. Specifically, the sensing control network element can use pk SP to verify Sig sp->server in the authorization certificate Cert sp->server . If the verification result is consistent with other information in the authorization certificate Cert sp->server , it is determined that the authorization certificate is Authentic credentials.
  • Step 802 The sensing control network element sends a sensing data request to the UE.
  • the sensing data request may include at least one of ID server , ID UE , pk server , g, Cert sp->server , and Sig server '.
  • ID server is the identification information of the perception control network element
  • ID UE is the identification information of the UE
  • pk server can be the public key of the perception control network element
  • g is the channel parameter, which is used to establish the connection between the perception control network element and the UE. Trusted channel.
  • Sig server ' is obtained by the sensing control network element using its own private key to sign one or more of ID server , ID UE , pk server , g, Cert sp->server .
  • the sensing control network element can directly send the sensing data request to the UE, or it can forward the sensing data request to the UE through the AMF network element/AUSF network element.
  • the embodiments of this application do not limit this.
  • Step 803 The UE verifies the identity of the sensing control network element.
  • the UE may maintain a public key list, which stores the identification information of multiple network elements and the public key corresponding to each network element.
  • the UE can search for the public key pk server corresponding to the ID server from the above public key list. Then the UE verifies the Sig server ' based on the pk server . If the verification result obtained by the UE based on the pk server 's verification of the Sig server is consistent with other information in the sensing data request, the sensing control network element is determined to be a trusted device. Otherwise, the UE determines that the verification fails and does not perform further processing.
  • Step 804 After the UE authenticates the identity of the sensing control network element and passes the verification, it verifies the Cert sp->server and authorizes the transmission of sensing data after passing the verification.
  • the UE after the UE successfully verifies the identity of the sensing control network element, it further verifies Cert sp->server . Specifically, the UE uses the public key pk SP of the certificate issuance device to verify the digital signature Sig sp->server in Cert sp->server . If the verification result is consistent with other information in Cert sp->server , the perception is determined The control network element has the authority to obtain UE sensing data. If the verification result is inconsistent with other information in Cert sp->server , no further processing will be performed.
  • the UE can use the ⁇ server to verify whether the Cert sp->server has been revoked. If it is revoked, no further processing will be performed. . If it is not revoked, the UE can continue to perform step 805.
  • Step 805 The UE sends sensing data to the sensing collection entity.
  • the UE may directly send the sensing data to the sensing collection entity, or the UE may forward the sensing data to the sensing collection entity through UPF, which is not limited in the embodiments of this application.
  • the first network element may be the perception server Sever
  • the certificate issuance device may be the application provider CA.
  • the terminal device can actively obtain the authorization credentials of the perception server Sever for verification. Refer to the flow diagram shown in Figure 9, which can include the following steps:
  • Step 901 The UE obtains the authorization certificate Cert sp->server of the sensing control network element from the blockchain node according to the storage location information BlockNum Cert .
  • the UE can verify the authenticity of the obtained authorization certificate by applying the public key pk SP of the provider CA. Specifically, the UE can use pk SP to verify Sig sp->server in the authorization certificate Cert sp->server . If the verification result is consistent with other information in the authorization certificate Cert sp->server , it is determined that the authorization certificate is a real certificate.
  • Step 902 The UE is triggered to upload periodic sensing data.
  • step 901 may be executed before step 902 or after step 902.
  • the embodiment of the present application does not limit the execution order of the two steps.
  • Step 903 The UE authenticates Cert sp->server , and authorizes the transmission of sensing data after passing the authentication.
  • the UE can use the public key pk SP of the certificate issuance device to verify the digital signature Sig sp->server in Cert sp->server . If the verification result is consistent with other information in Cert sp->server , it is determined that the The perception control network element has the authority to obtain UE perception data. If the verification result is inconsistent with other information in Cert sp->server , no further processing will be performed.
  • the UE can use the ⁇ server to verify whether the Cert sp->server has been revoked. If it is revoked, no further processing will be performed. . If it is not revoked, the UE may continue to perform step 904.
  • Step 904 The UE sends sensing data to the sensing server.
  • the above-mentioned sensing server can be replaced by a base station, and accordingly, Cert sp->server can be replaced by Cert sp->bs .
  • the size of the sequence numbers of the above-mentioned processes does not mean the order of execution.
  • the execution order of each process should be determined by its functions and internal logic, and should not be used in this application.
  • the implementation of the examples does not constitute any limitations.
  • the term "and/or" is only an association relationship describing associated objects, indicating that three relationships can exist. Specifically, A and/or B can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone.
  • the character "/" in this article generally indicates that the related objects are an "or" relationship.
  • FIG 10 is a schematic structural diagram of the security implementation device 1000 provided by the embodiment of the present application, which is applied to terminal equipment. As shown in Figure 10, the security implementation device 1000 includes:
  • the first receiving unit 1001 is configured to obtain the authorization certificate of the first network element; the authorization certificate is used for the terminal device to verify whether the transmission of sensing data is authorized; the authorization certificate includes a first digital signature;
  • the authorization unit 1002 is configured to authorize the transmission of the sensing data if the authorization certificate is successfully verified based on the first digital signature.
  • the authorization credentials also include at least one of the following:
  • the public key of the certificate issuance device
  • the identification information of the first network element is the identification information of the first network element
  • the first digital signature is signed using the private key of the certificate issuance device; the security implementation device 1000 further includes a first verification unit configured to use the public key of the certificate issuance device to verify the first digital signature.
  • the digital signature is verified to obtain the first verification information; if the first verification information is consistent with other information in the authorization certificate except the first digital signature, it is determined that the authorization certificate has passed the verification.
  • the authorization certificate also includes the RSA accumulator parameter corresponding to the first network element
  • the authorization unit 1002 is also configured to, when the authorization certificate is verified by using the public key of the certificate issuance device, the terminal device verifies the first network element based on the RSA accumulator parameter. Whether the authorization voucher has been revoked; if the authorization voucher has not been revoked, the terminal device is authorized to transmit the sensing data.
  • the authorization voucher also includes service identification information; the service identification information is used to indicate the service type of the sensing data to be authorized; the first verification unit is also configured to perform all authentication tasks when the terminal device supports In the case of the above-mentioned service type, the authorization certificate is verified based on the first digital signature.
  • the security implementation device 1000 further includes a first sending unit configured to send sensing data corresponding to the sensing service type.
  • the first receiving unit 1001 is further configured to receive first request information sent by the first network element, where the first request information is used to request authorization from the terminal device to transmit the sensing Data; the first request information includes the authorization credential; and the authorization credential is obtained from the first request information.
  • the first receiving unit 1001 is further configured to obtain the authorization credential from the first request information when the identity verification of the first network element passes.
  • the first request information also includes a second digital signature signed by the private key of the first network element; the verification unit is also configured to use the public key of the first network element. Verify the second digital signature to obtain second verification information; if the second verification information is consistent with other information in the first request information authorization certificate except the second digital signature, it is determined The identity verification of the first network element passes.
  • the first sending unit is configured to send second request information to the blockchain node, the second request information is used to request the authorization certificate of the first network element; the authorization certificate is stored in In the block of the blockchain node; the second request information includes the storage location information of the authorization certificate in the blockchain node;
  • the first sending unit is further configured to send the sensing data according to a preset time period.
  • FIG 11 is a schematic structural diagram of the security implementation device 1100 provided by the embodiment of the present application, which is applied to the first network element. As shown in Figure 11, the security implementation device 1100 includes:
  • the second sending unit 1101 is configured to send first request information to the terminal device; the first request information is used to request authorization from the terminal device to transmit sensing data; the first request information includes the first The authorization certificate of the network element; the authorization certificate is used by the terminal device to verify whether the transmission of sensing data is authorized; the authorization certificate is verified by the first digital signature it includes.
  • the first request information also includes at least one of the following:
  • the identification information of the first network element is the identification information of the first network element
  • the identification information of the terminal device is the identification information of the terminal device.
  • Channel parameters are used to establish a trusted channel between the first network element and the terminal device;
  • the second digital signature is used by the terminal device to verify the identity of the first network element; the second digital signature uses the private key of the first network element to authenticate the first request information Other information can be obtained by signing.
  • the second sending unit 1101 is also configured to send third request information to the blockchain node; the third request information is used to request the authorization certificate of the first network element; the authorization certificate Stored in the block of the blockchain node; the third request information includes the storage location information of the authorization certificate in the blockchain node;
  • the security implementation device 1101 also includes a second receiving unit configured to receive the authorization certificate sent by the blockchain node.
  • the second sending unit 1101 is further configured to send fourth request information to the certificate issuance device; the fourth request information is used to request the authorization certificate of the first network element.
  • the fourth request information includes at least one of the following:
  • the identification information of the first network element is the identification information of the first network element
  • the third digital signature is obtained by signing other information in the fourth request information with the private key of the first network element.
  • the second receiving unit is further configured to receive the authorization voucher sent by the voucher issuance device, and/or the storage location information of the authorization voucher.
  • FIG 12 is a schematic structural diagram of the security implementation device 1200 provided by the embodiment of the present application, which is applied to the certificate issuance equipment. As shown in Figure 12, the security implementation device 1200 includes:
  • the third receiving unit 1201 is configured to receive the fourth request information sent by the first network element; the fourth request information is used to request the authorization certificate of the first network element; the authorization certificate is used for the terminal device to verify whether Authorization to transmit sensing data;
  • the voucher generation unit 1202 is configured to generate an authorization voucher for the first network element.
  • the authorization credentials include at least one of the following:
  • the identification information of the voucher issuance device
  • the public key of the certificate issuance device
  • the identification information of the first network element is the identification information of the first network element
  • the credential generation unit 1202 is further configured to generate an authorization credential for the first network element by the credential issuance device when the identity verification of the first network element is passed.
  • the fourth request information includes a third digital signature; the third digital signature is signed using the private key of the first network element.
  • the security implementation device 1200 further includes a second verification unit configured to verify the third digital signature based on the public key of the first network element to obtain third verification information; if the third If the third verification information is consistent with other information in the fourth request information except the third digital signature, it is determined that the identity verification of the first network element has passed.
  • a second verification unit configured to verify the third digital signature based on the public key of the first network element to obtain third verification information; if the third If the third verification information is consistent with other information in the fourth request information except the third digital signature, it is determined that the identity verification of the first network element has passed.
  • the security implementation device 1200 further includes a third sending unit configured to send the authorization certificate to the blockchain node;
  • the third receiving unit 1201 is also configured to receive the storage location information of the authorization certificate sent by the blockchain node.
  • the third sending unit is further configured to send the authorization voucher and/or the storage location information to the first network element.
  • Figure 13 is a schematic structural diagram of a communication device 1300 provided by an embodiment of the present application.
  • the communication device may be a terminal device, a first network element, or a voucher issuance device.
  • the communication device 1300 shown in Figure 13 includes a processor 1310.
  • the processor 1310 can call and run a computer program from the memory to implement the method in the embodiment of the present application.
  • the communication device 1300 may further include a memory 1320.
  • the processor 1310 can call and run the computer program from the memory 1320 to implement the method in the embodiment of the present application.
  • the memory 1320 may be a separate device independent of the processor 1310, or may be integrated into the processor 1810.
  • the communication device 1300 can also include a transceiver 1330, and the processor 1310 can control the transceiver 1330 to communicate with other devices. Specifically, it can send information or data to other devices, or receive other devices. Information or data sent by the device.
  • the transceiver 1330 may include a transmitter and a receiver.
  • the transceiver 1330 may further include an antenna, and the number of antennas may be one or more.
  • the communication device 1300 may specifically be a terminal device according to the embodiment of the present application, and the communication device 1300 may implement the corresponding processes implemented by the terminal device in each method of the embodiment of the present application. For the sake of brevity, details will not be repeated here. .
  • the communication device 1300 may specifically be the first network element in the embodiment of the present application, and the communication device 1300 may implement the corresponding processes implemented by the first network element in the various methods of the embodiment of the present application. For simplicity, in This will not be described again.
  • the communication device 1300 can be specifically the voucher issuance device of the embodiment of the present application, and the communication device 1300 can implement the corresponding processes implemented by the voucher issuance device in the various methods of the embodiment of the present application. For the sake of brevity, they are not mentioned here. Again.
  • Figure 14 is a schematic structural diagram of a chip according to an embodiment of the present application.
  • the chip 1400 shown in Figure 14 includes a processor 1410.
  • the processor 1410 can call and run a computer program from the memory to implement the method in the embodiment of the present application.
  • the chip 1400 may also include a memory 1420.
  • the processor 1410 can call and run the computer program from the memory 1420 to implement the method in the embodiment of the present application.
  • the memory 1420 may be a separate device independent of the processor 1410, or may be integrated into the processor 1410.
  • the chip 1400 may also include an input interface 1430.
  • the processor 1410 can control the input interface 1430 to communicate with other devices or chips. Specifically, it can obtain information or data sent by other devices or chips.
  • the chip 1400 may also include an output interface 1440.
  • the processor 1410 can control the output interface 1440 to communicate with other devices or chips. Specifically, it can output information or data to other devices or chips.
  • the chip can be applied to the terminal device in the embodiment of the present application, and the chip can implement the corresponding processes implemented by the terminal device in each method of the embodiment of the present application.
  • the chip can implement the corresponding processes implemented by the terminal device in each method of the embodiment of the present application.
  • the chip can be applied to the first network element in the embodiment of the present application, and the chip can implement the corresponding processes implemented by the first network element in the various methods of the embodiment of the present application. For the sake of brevity, they will not be described here. Repeat.
  • the chip can be applied to the voucher issuance device in the embodiment of the present application, and the chip can implement the corresponding processes implemented by the voucher issuance device in the various methods of the embodiment of the present application. For the sake of brevity, details will not be repeated here.
  • chips mentioned in the embodiments of this application may also be called system-on-chip, system-on-a-chip, system-on-chip or system-on-chip, etc.
  • Figure 15 is a schematic block diagram of a communication system 1500 provided by an embodiment of the present application.
  • the communication system 1500 includes a terminal device 1510, a first network element 1520, and a voucher issuance device 1530.
  • the terminal device 1510 can be used to implement the corresponding functions implemented by the terminal device in the above method
  • the first network element 1520 can be used to implement the corresponding functions implemented by the first network element in the above method
  • the voucher issuance device 1530 It can be used to implement the corresponding functions implemented by the voucher issuance device in the above method. For the sake of simplicity, they will not be described again here.
  • the processor in the embodiment of the present application may be an integrated circuit chip and has signal processing capabilities.
  • each step of the above method embodiment can be completed through an integrated logic circuit of hardware in the processor or instructions in the form of software.
  • the above-mentioned processor can be a general-purpose processor, a digital signal processor (Digital Signal Processor, DSP), an application specific integrated circuit (Application Specific Integrated Circuit, ASIC), an off-the-shelf programmable gate array (Field Programmable Gate Array, FPGA) or other available processors.
  • DSP Digital Signal Processor
  • ASIC Application Specific Integrated Circuit
  • FPGA Field Programmable Gate Array
  • a general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.
  • the steps of the method disclosed in conjunction with the embodiments of the present application can be directly implemented by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, registers and other mature storage media in this field.
  • the storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.
  • non-volatile memory can be read-only memory (Read-Only Memory, ROM), programmable read-only memory (Programmable ROM, PROM), erasable programmable read-only memory (Erasable PROM, EPROM), electrically removable memory. Erase programmable read-only memory (Electrically EPROM, EEPROM) or flash memory. Volatile memory may be Random Access Memory (RAM), which is used as an external cache.
  • RAM Random Access Memory
  • RAM static random access memory
  • DRAM dynamic random access memory
  • DRAM synchronous dynamic random access memory
  • SDRAM double data rate synchronous dynamic random access memory
  • Double Data Rate SDRAM DDR SDRAM
  • enhanced SDRAM ESDRAM
  • Synchlink DRAM SLDRAM
  • Direct Rambus RAM Direct Rambus RAM
  • the memory in the embodiment of the present application can also be a static random access memory (static RAM, SRAM), a dynamic random access memory (dynamic RAM, DRAM), Synchronous dynamic random access memory (synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (double data rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous connection Dynamic random access memory (synch link DRAM, SLDRAM) and direct memory bus random access memory (Direct Rambus RAM, DR RAM) and so on. That is, memories in embodiments of the present application are intended to include, but are not limited to, these and any other suitable types of memories.
  • Embodiments of the present application also provide a computer-readable storage medium for storing computer programs.
  • the computer-readable storage medium can be applied to the terminal device in the embodiment of the present application, and the computer program causes the computer to execute the corresponding processes implemented by the terminal device in each method of the embodiment of the present application. For the sake of simplicity, here No longer.
  • the computer-readable storage medium can be applied to the first network element in the embodiment of the present application, and the computer program causes the computer to execute the corresponding processes implemented by the first network element in the various methods of the embodiment of the present application, in order to It’s concise and I won’t go into details here.
  • the computer-readable storage medium can be applied to the voucher issuance device in the embodiment of the present application, and the computer program causes the computer to execute the corresponding processes implemented by the voucher issuance device in each method of the embodiment of the present application.
  • I won’t go into details here.
  • An embodiment of the present application also provides a computer program product, including computer program instructions.
  • the computer program product can be applied to the terminal device in the embodiment of the present application, and the computer program instructions cause the computer to execute the corresponding processes implemented by the terminal device in the various methods of the embodiment of the present application.
  • the computer program instructions cause the computer to execute the corresponding processes implemented by the terminal device in the various methods of the embodiment of the present application.
  • the terminal device in the embodiment of the present application
  • the computer program instructions cause the computer to execute the corresponding processes implemented by the terminal device in the various methods of the embodiment of the present application.
  • the computer program product can be applied to the first network element in the embodiment of the present application, and the computer program instructions cause the computer to execute the corresponding processes implemented by the first network element in the various methods of the embodiment of the present application.
  • the computer program instructions cause the computer to execute the corresponding processes implemented by the first network element in the various methods of the embodiment of the present application.
  • the computer program product can be applied to the voucher issuance device in the embodiment of the present application, and the computer program instructions cause the computer to execute the corresponding processes implemented by the voucher issuance device in each method of the embodiment of the present application.
  • the computer program instructions cause the computer to execute the corresponding processes implemented by the voucher issuance device in each method of the embodiment of the present application. For simplicity, in This will not be described again.
  • An embodiment of the present application also provides a computer program.
  • the computer program can be applied to the terminal device in the embodiment of the present application.
  • the computer program When the computer program is run on the computer, it causes the computer to execute the corresponding processes implemented by the terminal device in each method of the embodiment of the present application.
  • the computer program For the sake of simplicity, , which will not be described in detail here.
  • the computer program can be applied to the first network element in the embodiment of the present application.
  • the computer program When the computer program is run on the computer, it causes the computer to execute the corresponding steps implemented by the first network element in the various methods of the embodiment of the present application. The process, for the sake of brevity, will not be repeated here.
  • the computer program can be applied to the voucher issuance device in the embodiment of the present application.
  • the computer program When the computer program is run on the computer, it causes the computer to execute the corresponding processes implemented by the voucher issuance device in each method of the embodiment of the present application.
  • the computer program When the computer program is run on the computer, it causes the computer to execute the corresponding processes implemented by the voucher issuance device in each method of the embodiment of the present application.
  • the disclosed systems, devices and methods can be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or can be integrated into another system, or some features can be ignored, or not implemented.
  • the coupling or direct coupling or communication connection between each other shown or discussed may be through some interfaces, and the indirect coupling or communication connection of the devices or units may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or they may be distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application can be integrated into one processing unit, each unit can exist physically alone, or two or more units can be integrated into one unit.
  • the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium.
  • the technical solution of the present application is essentially or the part that contributes to the existing technology or the part of the technical solution can be embodied in the form of a software product.
  • the computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of this application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (Read-Only Memory,) ROM, random access memory (Random Access Memory, RAM), magnetic disk or optical disk and other media that can store program code. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Computing Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Medical Informatics (AREA)
  • Databases & Information Systems (AREA)
  • Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请实施例提供一种安全实现方法、装置、终端设备、网元、及凭证生成设备，该方法包括：终端设备获取第一网元的授权凭证；所述授权凭证用于所述终端设备验证是否授权传输感知数据；所述授权凭证包括第一数字签名；在基于所述第一数字签名对所述授权凭证验证通过的情况下，所述终端设备授权传输所述感知数据。

Description

安全实现方法、装置、终端设备、网元、及凭证生成设备 技术领域
本申请实施例涉及移动通信技术领域，具体涉及一种安全实现方法、装置、终端设备、网元、及凭证生成设备。
背景技术
随着通信技术的不断发展，能够实现万物感知、万物互联、万物智能的通感一体化技术成为业界关注的焦点。通感一体化技术，是指通信和感知两个功能融合在一起的技术。其中，通信即两点或多点之间信息传输；感知即探测物理环境信息，例如测速、目标定位等。通感一体化技术可以使得未来的通信系统同时具有通信和感知两个功能，在无线信道传输信息的同时通过主动认知并分析信道的特性，从而去感知周围环境的物理特征，增强通信与感知功能。例如，通信系统可以利用用户设备、可穿戴设备、基站等感知设备来感知物理环境信息，并对物理环境信息进行数字化处理，得到感知数据(如位置数据、温度数据、速度、人体心率、血压等)，这样，感知服务器可以根据感知设备传输的感知数据提供相应的服务，如定位服务、测速服务、健康呼救服务等。
然而，感知数据通常是个人数据或敏感数据，如何保证感知数据不被泄露或窃取，目前并没有明确的解决方案。
发明内容
本申请实施例提供一种安全实现方法、装置、终端设备、网元、及凭证生成设备。
本申请实施例提供一种安全实现方法，包括：
终端设备获取第一网元的授权凭证；所述授权凭证用于所述终端设备验证是否授权传输感知数据；所述授权凭证包括第一数字签名；
在基于所述第一数字签名对所述授权凭证验证通过的情况下，所述终端设备授权传输所述感知数据。
本申请实施例还提供一种安全实现方法，包括：
第一网元向终端设备发送第一请求信息；所述第一请求信息用于请求所述终端设备授权，以传输感知数据；所述第一请求信息中包括所述第一网元的授权凭证；所述授权凭证用于所述终端设备验证是否授权传输感知数据；所述授权凭证通过其包括的第一数字签名进行验证。
本申请实施例还提供另一种安全实现方法，包括：
凭证发放设备接收第一网元发送的第四请求信息；所述第四请求信息用于请求所述第一网元的授权凭证；所述授权凭证用于终端设备验证是否授权传输感知数据；
所述凭证发放设备生成所述所述第一网元的授权凭证。
本申请实施例提供一种安全实现装置，应用于终端设备，包括：
第一获取单元，被配置为获取第一网元的授权凭证；所述授权凭证用于所述终端设备验证是否授权传输感知数据；所述授权凭证包括第一数字签名；
授权单元，被配置为在基于所述第一数字签名对所述授权凭证验证通过的情况下，授权传输所述感知数据。
本申请实施例还提供一种安全实现装置，应用于第一网元，包括：
第二发送单元，被配置为向终端设备发送第一请求信息；所述第一请求信息用于请求所述终端设备授权，以传输感知数据；所述第一请求信息中包括所述第一网元的授权凭证；所述授权凭证用于所述终端设备验证是否授权传输感知数据；所述授权凭证通过其包括的第一数字签名进行验证。
本申请实施例还提供一种安全实现装置，应用于凭证发放设备，包括：
第三接收单元，被配置为接收第一网元发送的第四请求信息；所述第四请求信息用于请求所述第一网元的授权凭证；所述授权凭证用于终端设备验证是否授权传输感知数据；
凭证生成单元，被配置为所述所述第一网元的授权凭证。
本申请实施例提供的终端设备，包括处理器和存储器。该存储器用于存储计算机程序，该处理器用于调用并运行该存储器中存储的计算机程序，执行上述的安全实现方法。
本申请实施例提供的第一网元，包括处理器和存储器。该存储器用于存储计算机程序，该处理器用于调用并运行该存储器中存储的计算机程序，执行上述的安全实现方法。
本申请实施例提供的凭证生成设备，包括处理器和存储器。该存储器用于存储计算机程序，该处理器用于调用并运行该存储器中存储的计算机程序，执行上述的安全实现方法。
本申请实施例提供的芯片，用于实现上述的安全实现方法。
具体地，该芯片包括：处理器，用于从存储器中调用并运行计算机程序，使得安装有该芯片的设备执行上述的安全实现方法。
本申请实施例提供的计算机可读存储介质，用于存储计算机程序，该计算机程序使得计算机执行上述的安全实现方法。
本申请实施例提供的计算机程序产品，包括计算机程序指令，该计算机程序指令使得计算机执行上述的安全实现方法。
本申请实施例提供的计算机程序，当其在计算机上运行时，使得计算机执行上述的安全实现方法。
本申请实施例提供的安全实现方法中，终端设备可以对网络侧网元的授权凭证进行验证，在验证通过的情况下，终端设备可以授权传输感知数据。也就是说，授权方向由相关技术中的网络侧授权终端侧，转变为终端侧授权网络侧，从而保证感知数据不被泄露和窃取。
附图说明
此处所说明的附图用来提供对本申请的进一步理解，构成本申请的一部分，本申请的示意性实施例及其说明用于解释本申请，并不构成对本申请的不当限定。在附图中：
图1是本申请实施例提供的一种示例性的通信系统的网络架构示意图；
图2是本申请实施例提供的一种安全实现方法流程示意图一；
图3是本申请实施例提供的一种安全实现方法流程示意图二；
图4是本申请实施例提供的一种安全实现方法流程示意图三；
图5是本申请实施例提供的一种安全实现方法流程示意图四；
图6是本申请实施例提供的在应用场景一中的安全实现方法流程示意图；
图7是本申请实施例提供的在应用场景二中的安全实现方法流程示意图；
图8是本申请实施例提供的在应用场景三中的安全实现方法流程示意图；
图9是本申请实施例提供的在应用场景四中的安全实现方法流程示意图；
图10是本申请实施例提供的一种安全实现装置1000的结构组成示意图；
图11是本申请实施例提供的一种安全实现装置1100的结构组成示意图；
图12是本申请实施例提供的一种安全实现装置1200的结构组成示意图；
图13是本申请实施例提供的一种通信设备示意性结构图；
图14是本申请实施例的芯片的示意性结构图；
图15是本申请实施例提供的一种通信系统的示意性框图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行描述，显然，所描述的实施例是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
为便于理解，首先结合相关附图介绍本申请实施例提供的安全实现方法可能应用到的网络架构。图1是本申请实施例提供的通信系统的网络架构示意图。如图1所示，通信系统100可以包括终端设备、接入网设备、核心网、以及第三方应用网络。终端设备通过接入网设备接入核心网。终端设备和网络设备之间支持多业务传输。
应理解，本申请实施例仅以通信系统100进行示例性说明，但本申请实施例不限定于此。也就是说，本申请实施例的技术方案可以应用于各种通信系统，例如：长期演进(Long Term Evolution，LTE)系统、LTE时分双工(Time Division Duplex，TDD)、通用移动通信系统(Universal Mobile  Telecommunication System，UMTS)、物联网(Internet of Things，IoT)系统、窄带物联网(Narrow Band Internet of Things，NB-IoT)系统、增强的机器类型通信(enhanced Machine-Type Communications，eMTC)系统、第五代通信系统(即5G通信系统，也称为新无线(New Radio，NR)通信系统)、第六代通信系统(6G)、或未来的通信系统等。
在图1所示的通信系统100中，接入网设备可以为特定的地理区域提供通信覆盖，并且可以与位于该覆盖区域内的终端设备进行通信。
接入网设备可以是长期演进(Long Term Evolution，LTE)系统中的演进型基站(Evolutional Node B，eNB或eNodeB)，或者是NR系统中的基站(gNB)，或者是6G基站，或者是下一代无线接入网(Next Generation Radio Access Network，NG RAN)设备，或者是云无线接入网络(Cloud Radio Access Network，CRAN)中的无线控制器，或者该网络设备120可以为中继站、接入点、车载设备、可穿戴设备、集线器、交换机、网桥、路由器，或者未来演进的公共陆地移动网络(Public Land Mobile Network，PLMN)中的网络设备等。
终端设备可以是任意终端设备，其包括但不限于与网络设备或其它终端设备采用有线或者无线连接的终端设备。
例如，所述终端设备可以指接入终端、用户设备(User Equipment，UE)、用户单元、用户站、移动站、移动台、远方站、远程终端、移动设备、用户终端、终端、无线通信设备、用户代理或用户装置。接入终端可以是蜂窝电话、无绳电话、会话启动协议(Session Initiation Protocol，SIP)电话、IoT设备、卫星手持终端、无线本地环路(Wireless Local Loop，WLL)站、个人数字处理(Personal Digital Assistant，PDA)、具有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它处理设备、车载设备、可穿戴设备、无人机、无人车、机器人、5G网络中的终端设备、6G网络中的终端设备或者未来演进网络中的终端设备等。
终端设备还可以用于设备到设备(Device to Device，D2D)的通信。
核心网可以作为承载网络，能够提供到外部第三方应用网络的接口，为终端设备提供通信连接、认证、管理、策略控制以及对数据业务完成承载等。核心网可以是5G核心网(5G Core，5GC)，也可以是LTE的分组核心演进网络(Evolved Packet Core，EPC)，本申请实施例对此不做限制。
参考图1所示，核心网可以包括以下网元：接入与移动性管理功能网元(Access and Mobility Management Function，AMF)，认证服务器功能网元(Authentication Server Function，AUSF)，应用功能网元(Application Function，AF)，网络开放功能网元(Network Exposure Function，NEF)，感知控制网元，以及感知收集网元。核心网130还可以包括未在图1示出的其他网元，例如用户面功能网元(User Plane Function，UPF)，会话管理功能网元(Session Management Function，SMF)，以及统一数据管理网元(Unified Data Manager，UDM)，网络应用功能网元(Network Application Function，NAF)等。
其中，AMF是由运营商提供的控制面网元，负责终端设备接入运营商网络的接入控制和移动性管理，AMF作为非接入层信令的终结点，处理网络信令。AUSF也是由运营商提供的控制面网元，用于终端设备的认证。AF用于存储业务安全需求，提供策略判定的信息。NEF用于向其他系统公开功能和事件，既提供开放性，又能保障系统的安全。感知控制网元，可以是运营商提供的控制面网元，主要对感知业务进行管理和控制。感知收集实体，可以是用户面网元，用于收集不同的设备发送的感知数据，对感知数据进行管理。
需要说明的是，图1中实线箭头表征控制消息的传输方向，虚线箭头表征IP路由数据的传输方向。
应理解，在网络演进过程中，上述核心网中的网元也有可能叫其它名字，或者通过对核心网的功能进行划分形成新的网络实体，对此本申请实施例不做限制。其中，上述各个网元可以单独部署，也可以两两或多个网元集成部署在一个实体中。例如，感知控制网元和感知收集实体可部署在一个实体中，或者感知控制网元和感知收集实体也可分别部署在不同的实体中，本申请实施例对此不做限制。
需要说明的是，图1只是以示例的形式示意本申请所适用的系统，当然，本申请实施例所示的方法还可以适用于其它系统。此外，本文中术语“系统”和“网络”在本文中常被可互换使用。本文中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系。还应理解，在本申请的实施例中提到的“指示”可以是直接指示，也可以是间接指示，还可以是表示具有关联关系。举例说明，A指示B，可以表示A 直接指示B，例如B可以通过A获取；也可以表示A间接指示B，例如A指示C，B可以通过C获取；还可以表示A和B之间具有关联关系。还应理解，在本申请的实施例中提到的“对应”可表示两者之间具有直接对应或间接对应的关系，也可以表示两者之间具有关联关系，也可以是指示与被指示、配置与被配置等关系。还应理解，在本申请的实施例中提到的“预定义”或“预定义规则”可以通过在设备(例如，包括终端设备和网络设备)中预先保存相应的代码、表格或其他可用于指示相关信息的方式来实现，本申请对于其具体的实现方式不做限定。比如预定义可以是指协议中定义的。还应理解，本申请实施例中，所述“协议”可以指通信领域的标准协议，例如可以包括LTE协议、NR协议以及应用于未来的通信系统中的相关协议，本申请对此不做限定。
为便于理解本申请实施例的技术方案，以下对本申请实施例的相关技术进行说明，以下相关技术作为可选方案与本申请实施例的技术方案可以进行任意结合，其均属于本申请实施例的保护范围。
通感一体化：是指基于软硬件资源共享或信息共享同时实现感知与通信功能协同的新型信息处理技术，可以有效提升系统频谱效率、硬件效率和信息处理效率。
同时具有通信和感知功能将是未来通信系统中基站和终端设备的能力趋势。未来的终端设备将升级为智能体，无人车、无人机、机器人以及其他智能化设备系统能力不断增强。近距离上，智能体需要识别人的位姿、动作和表情识别，增强人机接口性能，需要识别多智能体之间的动作状态，提升智能体协作性能。微观距离需要识别人体内部、产品内部和物品内部的目标属性，提供远程、基于人工智能和无人化的体检、质检和安检服务。
由于通信与感知系统因系统功能及规格等需求的差异，在带宽、功率输出能力、接收检测灵敏度、系统的动态范围、双工能力和性能，以及射频通道的频偏、相噪、非线性等指标需求均有较大的差异，因此传统的硬件架构中分别按照通信和感知的需求来进行硬件设计。然而，通感一体化技术希望架构和硬件系统能同时实现感知和通信功能，因此系统在设计之初就要平衡好通信和感知需求，新增共享频谱资源、高动态范围、全双工及自干扰消除、高通道性能等特性要求，此外还需兼顾低实现复杂度、低功耗、高集成的目标。示例性的，通感一体化的终端设备通信和感知共享新增的频谱资源。
目前，5G安全技术中的授权机制通常是指服务网络对终端设备进行访问授权，允许终端设备使用网络的资源，归属网络授权服务网络为终端设备进行服务。具体的，在终端设备注册过程中，5GC基于UDM中的订阅配置文件进行身份认证和访问授权，可以理解的是，服务网络应通过从归属网络获取的终端设备的订阅配置文件对终端设备进行授权。其中，终端设备的授权是基于经过认证的用户永久标识符(Subscription Permanent Identifie，SUPI)。可以理解的是，目前的安全技术能够较好的满足5G安全技术中终端设备的接入认证问题，并定义了一些密钥生成功能和流程。
在未来通信技术中的通感一体化场景中，感知数据通常是个人数据或者敏感数据，这就需要保护感知数据不被泄露和窃取。然而，目前的安全技术仅对网络资源进行授权，并且是由网络侧对终端侧进行授权，不满足对感知数据进行授权，并且是由终端侧或接入侧对网络侧进行授权的需求。
为了提高网络安全性，本申请一实施例提供一种安全实现方法，参见图2所示，该方法包括但不限于以下步骤：
步骤210、终端设备获取第一网元的授权凭证；该授权凭证用于终端设备验证是否授权传输感知数据；授权凭证包括第一数字签名。
步骤220、在基于第一数字签名对授权凭证验证通过的情况下，终端设备授权传输感知数据。
其中，终端设备可以是支持通感一体化技术的设备，终端设备可以通过探测物理环境信息来得到感知数据。感知数据可以是位置数据、高度数据、温度数据、速度、人体心率、呼吸频率、血压等，感知数据可以来自利用感知技术获取的感知信号，本申请实施例对此不做限制。本申请实施例中的终端设备可以理解为是感知数据的提供方。
另外，第一网元可以是核心网网元(如基站)、接入网网元(如感知控制网元)、第三方应用网络中的网元(如感知服务器)等，本申请实施例对此不做限制。其中，感知服务器可以是提供感知服务(例如定位、测速、健康呼救服务)的应用服务器。
实际应用中，由于感知数据属于个人数据或敏感数据，终端设备需要对感知数据的接收方或者感知数据的请求方进行验证，确定其身份的合法性以及是否具有获取感知数据的权限，避免感知数据被泄露或被攻击者窃取。
本申请实施例中，终端设备可以通过第一网元的授权凭证，来验证是否授权向网络侧的网元传输感知数据。其中，第一网元的授权凭证可以包括第一数字签名，终端设备可以利用第一数字签名来对授权凭证进行验证，以确定网络侧的网元是否具有获取终端设备感知数据的权限。
综上所述，本申请实施例提供的安全实现方法中，终端设备可以对网络侧网元的授权凭证进行验证，在验证通过的情况下，终端设备可以授权传输感知数据。也就是说，授权方向由相关技术中的网络侧授权终端侧，转变为终端侧授权网络侧，从而保证感知数据不被泄露和窃取。
可选地，第一数字签名可以是凭证发放设备的签名，也就是说，第一数字签名可以是利用凭证发放设备的私钥对授权凭证中的其他信息进行签名得到的。应理解，凭证发放设备是生成第一网元授权凭证的设备。
可选地，授权凭证还可以包括以下信息中的至少一项：
业务标识信息；
凭证发放设备的标识信息；
凭证发放设备的公钥；
第一网元的标识信息；
第一网元的公钥；
第一网元对应的RSA累加器参数；
数据标识信息。
其中，业务标识信息可以用于指示待授权的感知数据的业务类型。业务类型可以包括定位业务、测速业务、健康呼救业务、环境监测业务等，本申请实施例对此不做限制。
可选地，业务标识信息可以是一固定长度的比特数据，其中，不同比特数据对应不同的业务类型。终端设备通过查表的方式确定该比特数据对应的业务类型。
可选地，业务标识信息可以是提供感知业务的感知服务器的标识信息，一般来说，感知服务器可以提供一种或多种感知业务，因此所需的感知业务类型不同。基于此，本申请实施例中可以通过感知服务器的标识信息来表征待授权的感知数据的业务类型。
其中，第一网元对应的RSA累加器参数用于验证第一网元的授权凭证是否被撤销。应理解，实际应用中存在授权凭证被撤销的情况，因此，在授权凭证中需要携带该授权凭证的RSA参数，以供终端设备验证该授权凭证是否被撤销。
另外，数据标识信息可以用于指示感知数据的数据类型，感知数据可以来自利用感知技术获取的感知信号，该数据类型包括一种或多种。示例性的，如果感知业务为健康呼救业务，那么数据类型可以包括心率数据、体温数据、运动量数据、血压数据、呼吸频率数据等，如果感知业务为环境监测业务，那么数据类型可以包括位置数据、风速数据、温度数据、日晒数据、高度数据等。本申请实施例对数据类型不做限制。
需要说明的是，凭证发放设备可以在第一网元的请求下，为第一网元生成授权凭证。凭证发放设备可以是应用提供商证书颁发机构(Certificate Authority，CA)，也可以是感知服务器，也可以是运营商CA，本申请实施例对此不做限制。另外，第一网元请求凭证发放设备生成授权凭证的相关内容详见下文描述，为了简洁，此处不做赘述。
可选地，第一数字签名可以是利用凭证发放设备的私钥对上述信息中的全部内容或部分内容进行签名得到。对应的，终端设备基于第一数字签名对授权凭证进行验证过程可以通过以下步骤实现：
步骤230、终端设备利用凭证发放设备的公钥对第一数字签名进行验证，得到第一验证信息；
步骤240、若第一验证信息与授权凭证中除第一数字签名之外的其他信息一致，则确定授权凭证验证通过。
可以理解的是，既然第一数字签名是利用凭证发放设备的私钥签名得到，那么终端设备可以利用凭证发放设备的公钥对第一数字签名进行验证，得到第一验证信息。只有在第一验证信息与授权凭证中的其他信息一致，终端设备才授权向网络侧网元传输感知数据，否则，终端设备不进行进一步处理。
需要说明的是，终端设备可以从授权凭证中获取凭证发放设备的公钥，对第一数字签名进行验证。终端设备也可以提前存储凭证发放设备的公钥，利用预先存储的公钥对第一数字签名进行验证，本申请实施例对凭证发放设备的公钥来源不做限制。
可选地，在一些实施例中，若授权凭证中包括业务标识信息和/或数据标识信息，则在对授权凭证进行验证之前，终端设备需要判断终端设备是否支持授权凭证中业务标识信息指示的业务类型，和/或数据标识信息指示的数据类型。
其中，授权凭证中携带的业务标识信息，可以用来表征网络侧网元需要获取的感知数据的业务类型。授权凭证中携带的数据标识信息，可以用来表征网络侧网元需要的感知数据的数据类型。因此，终端设备获取到第一网元的授权凭证之后，需要先判断自己是否支持网络侧所需的业务类型和/ 或数据类型。
可选地，终端设备可以维护一份业务标识信息列表，该列表可以存储终端设备支持的所有的业务类型对应的业务标识信息。这样，终端设备在获取到第一网元的授权凭证之后，可以将授权凭证中的业务标识信息与上述列表中的内容进行对比，从而确定终端设备是否支持该授权凭证中携带的业务标识信息指示的业务类型。
可选地，终端设备还可以维护一份数据标识信息列表，该列表可以存储终端设备支持的数据类型对应的数据标识信息。终端设备在获取到第一网元的授权凭证之后，可以将授权凭证中的数据标识信息与该列表中的内容进行对比，从而确定终端设备是否支持授权凭证中数据标识信息指示的数据类型。
示例性的，在授权凭证中仅包括业务标识信息的场景中，若终端设备支持该业务标识信息指示的业务类型，则终端设备可以基于第一数字签名对授权凭证进行验证。否则，终端设备忽略该授权凭证，不做进一步的处理。
在授权凭证中仅包括数据标识信息的场景中，若终端设备支持该数据标识信息指示的数据类型，则终端设备可以基于第一数字签名对授权凭证进行验证。否则，终端设备忽略该授权凭证，不做进一步的处理。
在授权凭证中包括业务标识信息和数据标识信息的场景中，只有在终端设备支持业务标识信息指示的业务类型，且终端设备支持数据标识信息指示的数据类型时，终端设备才基于第一数字签名对授权凭证进行验证。反之，当终端设备不支持业务标识信息指示的业务类型，或者终端设备不支持数据标识信息指示的数据类型，则终端设备忽略该授权凭证，不进行进一步处理。
在本申请实施例中，终端设备授权传输感知数据之后，终端设备可以发送与该业务标识信息指示的业务类型和/或数据类型对应的感知数据。也就是说，终端设备发送的感知数据的业务类型均为授权凭证中业务标识信息指示的业务类型，数据类型均为授权凭证中数据标识信息指示的数据类型。如此，可以保证终端设备发送的感知数据与第一网元所需的感知数据匹配，提高传输效率。
可选地，在一些实施例中，授权凭证包括第一网元对应的RSA累加器参数时，步骤220中在基于第一数字签名对所述授权凭证验证通过的情况下，终端设备授权传输感知数据，还可以通过以下方式实现：
在基于第一数字签名对授权凭证验证通过的情况下，终端设备基于RSA累加器参数，验证第一网元的授权凭证是否被撤销；
若授权凭证未被撤销，则终端设备授权传输感知数据。
可以理解的是，在对授权凭证验证通过之后，终端设备还可以根据RSA累加器参数验证该授权凭证是否被撤销。若第一网元的授权凭证未被撤销，则终端设备授权传输感知数据。若第一网元的授权凭证被撤销，则终端设备确定第一网元不具有获取感知数据的权限。如此，可以提高终端设备对感知数据的授权效率。
本申请实施例中，终端设备获取第一网元的授权凭证的方式包括多种，下面详细介绍其中的两种。
方式一、
在本申请一实施例中，参考图3所示，步骤210中终端设备获取第一网元的授权凭证，可以通过以下步骤实现：
步骤2101、终端设备接收第一网元发送的第一请求信息，第一请求信息用于请求终端设备授权，以向传输感知数据；第一请求信息中包括授权凭证；
步骤2102、终端设备从第一请求信息中获取授权凭证。
其中，第一网元需要终端设备向其发送感知数据时，可以向终端设备发送第一请求信息，以触发感知业务请求。这里，第一网元可以在第一请求信息中携带第一网元的授权凭证。这样，终端设备在接收到第一请求信息之后，可以从第一请求信息中获取第一网元的授权凭证，并基于授权凭证中的第一数字签名对该授权凭证进行验证，以确定是否授权传输感知数据。
可选地，在一些实施例中，第一网元本地存储有其授权凭证，第一网元触发感知业务请求时，可以将本地存储的授权凭证通过第一请求信息发送给终端设备。
可选地，在一些实施例中，授权凭证可以不存储在第一网元的本地，而是通过去中心化身份(Decentralized Identity，DID)方式，分布式存储于区块链节点中。当第一网元需要传输感知业务请求时，可以先从区块链节点的存储区块中获取第一网元的授权凭证。其中，参考图3所示的流程示意图(图3中的虚线表示可选步骤)，第一网元向终端设备发送第一请求信息之前，还可以执行以下 步骤：
步骤2001、第一网元向区块链节点发送第三请求信息；第三请求信息用于请求第一网元的授权凭证；第三请求信息包括授权凭证在区块链节点的存储位置信息；
步骤2002、第一网元接收区块链节点发送的该第一网元的授权凭证。
也就是说，第一网元需要触发感知业务请求之前，可以根据第一网元授权凭证的存储位置信息，向区块链节点请求获取第一网元的授权凭证。在接收到区块链节点反馈的授权凭证之后，第一网元可以将获取到的授权凭证携带在第一请求信息中发送给终端设备，以使终端设备授权传输感知数据。
可选地，由于授权凭证中包括凭证发放设备的第一数字签名，基于此，第一网元接收到区块链节点发送的授权凭证之后，可以使用凭证发放设备的公钥对第一数字签名进行验证，以确定授权凭证的真实性。第一网元在对第一数字签名验证通过后，将该授权凭证携带在第一请求信息中发送给终端设备。
应理解，第一网元的授权凭证可以预先通过凭证发放设备生成。这里，凭证发放设备生成授权凭证之后，可以将授权凭证回传给第一网元，或者将授权凭证上传到区块链节点进行分布式存储。进一步地，当第一网元需要获取感知数据时，可以从本地存储空间获取授权凭证，或者从区块链节点中请求授权凭证，并将获取到的授权凭证通过第一请求信息发送给终端设备。如此，提高终端设备进行感知数据授权的灵活性。
可选地，终端设备在接收到第一请求信息之后，可以先对发送第一请求信息的第一网元进行身份验证，确定该第一网元是否为受信任的网元，以及确定第一请求信息是否被篡改。只有在对第一网元的身份验证通过的情况下，终端设备才基于第一请求信息获取授权凭证并对该授权凭证进行验证，以此保证后续传输过程中，感知数据不被泄露和窃取。
可选地，终端设备可以使用与第一网元之间的共享秘钥对第一网元进行身份验证，终端设备也可以使用第一网元的公钥对第一网元进行身份验证，本申请实施例对此不做限制。
可选地，第一请求信息中可以包括以下信息中的至少一项：
第一网元的标识信息；
终端设备的标识信息；
信道参数；信道参数用于建立第一网元与终端设备之间的可信信道；
第一网元的公钥；
第二数字签名；第二数字签名通过第一网元的私钥对第一请求信息中的其他信息进行签名得到。
应理解，在第一请求信息中包括第二数字签名时，终端设备可以利用第二数字签名对第一网元进行身份验证。其中，终端设备对第一网元进行身份验证的方式包括如下内容：
终端设备利用第一网元的公钥对上述第二数字签名进行验证处理，得到第二验证信息；若第二验证信息与第一请求信息中除第二数字签名之外的其他信息一致，则终端设备确定第一网元身份验证通过。
可选地，终端设备可以维护一份公钥列表，该列表中存储了多个网元的标识信息，以及每个网元对应的公钥。终端设备接收到第一网元发送的第一请求信息后，可以从上述公钥列表中查找第一网元的标识信息对应的公钥。进而终端设备基于该公钥对第二数字签名进行验证，得到第二验证信息。
可选地，若第一请求信息中包括第一网元的公钥时，终端设备也可以基于第一请求信息中携带的公钥对第二数字签名进行验证，得到第二验证信息。本申请实施例对第一网元的身份验证方式不做限制。
应理解，在第二验证信息与第一请求信息中除第二数字签名之外的其他信息一致的情况下，终端设备确认第一网元为受信任的网元，并且第一请求信息未被篡改。在第二验证信息与第一请求信息中除第二数字签名之外的其他信息不一致的情况下，终端设备可以认为第一网元为不受信任的网元，和/或，第一请求信息被第三方篡改。在此情况下，终端设备可以忽略该第一请求信息，不进行进一步处理。
综上所述，本申请实施例提供的安全实现方法中，网络侧的网元可以向终端设备请求感知数据的授权传输，而终端设备可以在接收到网元侧网元的请求后，对网络侧的网元的身份以及其权限进行验证。并且，在验证通过后，终端设备可以授权传输感知数据，保证感知数据不被泄露和窃取。
方式二、
在本申请一实施例中，参考图4所示的流程示意图，步骤210中终端设备获取第一网元的授权凭证，可以通过以下步骤实现：
步骤2103、终端设备向区块链节点发送第二请求信息，第二请求信息用于请求第一网元的授权凭证；授权凭证存储于区块链节点的区块中；第二请求信息包括所述授权凭证在所述区块链节点的存储位置信息；
步骤2104、终端设备接收区块链节点发送的授权凭证。
应理解，第一网元的授权凭证可以通过去中心化身份(Decentralized Identity，DID)方式，分布式存储于区块链节点的区块中。终端设备主动向区块链节点请求第一网元的授权凭证。具体地，终端设备可以根据第一网元授权凭证的存储位置信息，向区块链节点请求获取第一网元的授权凭证。
需要说明的是，第一网元授权凭证的存储位置信息可以是终端设备从接入网网元(例如基站)、或者核心网网元处获取，本申请实施例对此不做限制。
可选地，终端设备主动向区块链节点请求第一网元的授权凭证进行验证授权，可以是根据在用户界面接收到的交互指令触发的，也可以是终端设备的应用程序触发，也可以是获取到感知数据后主动触发，本申请实施例对此不做限制。
可选地，本申请实施例中，终端设备可以被触发周期性上传感知数据。该周期性上传感知数据可以是终端设备主动发起，也可以通过用户界面交互触发，终端设备的应用程序触发等，本申请实施例对此不做限制。
基于此，终端设备被触发周期性上传感知数据后，可以主动向区块链节点请求第一网元的授权凭证，对请求到的授权凭证进行验证通过后，按照预设时间周期，发送感知数据。当然，终端设备也可以先主动向区块链节点请求第一网元的授权凭证，后触发周期性上传感知数据，本申请对两者的先后顺序不做限制。
由此可见，本申请实施例提供的安全实现方法中，终端设备可以主动获取网络侧网元的授权凭证并进行验证，在验证通过的情况下，终端设备可以授权传输感知数据，保证感知数据不被泄露和窃取。另外，靠近终端设备的分布式验证授权，即不同地理位置的同一类业务，可以并行进行感知数据的授权，提高了感知数据授权的效率。
以下详细介绍授权凭证的生成过程。
在本申请一实施例中，参考图5所示的流程示意图，本申请实施例提供的安全实现方法可以包括以下步骤：
步骤510、凭证发放设备接收第一网元发送的第四请求信息；第四请求信息用于请求第一网元的授权凭证；授权凭证用于终端设备验证是否授权传输感知数据。
步骤520、凭证发放设备生成第一网元的授权凭证。
其中，凭证发放设备可以是应用提供商CA，也可以是感知服务器，还可以是运营商CA，本申请实施例对此不做限制。
可以理解的是，第一网元在确定要收集感知数据之前，可以向凭证发放设备发起凭证请求。具体地，第一网元可以通过安全的信道向凭证发放设备发送第四请求信息，以请求凭证发放设备生成第一网元的授权凭证，以使得终端设备可以根据该授权凭证进行验证。
可选地，凭证发放设备在接收到第四请求信息之后，可以先对发送第四请求信息的第一网元进行身份验证，确定该第一网元是否为受信任的网元，以及确定第四请求信息是否被篡改。只有在对第一网元的身份验证通过的情况下，凭证发放设备才可以为第一网元生成授权凭证。
可选地，第四请求信息中可以包括以下信息中的至少一项：
业务标识信息；
第一网元的标识信息；
第一网元的公钥；
数据标识信息；
第三数字签名；第三数字签名通过第一网元的私钥对第四请求信息中的其他信息进行签名得到。
应理解，在第四请求信息中包括第三数字签名时，凭证发放设备可以利用第三数字签名对第一网元进行身份验证。其中，凭证发放设备对第一网元进行身份验证的方式包括如下内容：
凭证发放设备利用第一网元的公钥对第三数字签名进行验证处理，得到第三验证信息；若第三验证信息与第四请求信息中除第三数字签名之外的其他信息一致，则凭证发放设备确定第一网元身份验证通过。
可选地，凭证发放设备可以维护一份公钥列表，该列表中存储了多个网元的标识信息，以及每个网元对应的公钥。凭证发放设备接收到第一网元发送的第四请求信息后，可以从上述公钥列表中查找第一网元的标识信息对应的公钥。进而凭证发放设备基于该公钥对第三数字签名进行验证，得 到第三验证信息。
可选地，若第四请求信息中包括第一网元的公钥时，凭证发放设备也可以基于第四请求信息中携带的公钥对第三数字签名进行验证，得到第三验证信息。本申请实施例对第一网元的身份验证方式不做限制。
应理解，在第三验证信息与第四请求信息中除第三数字签名之外的其他信息一致的情况下，凭证发放设备确认第一网元为受信任的网元，并且第四请求信息未被篡改。在第三验证信息与第四请求信息中除第三数字签名之外的其他信息不一致的情况下，凭证发放设备可以认为第一网元为不受信任的网元，和/或，第四请求信息被第三方篡改。在此情况下，凭证发放设备可以忽略该第四请求信息，不做进一步处理。
可选地，在凭证发放设备生成第一网元的授权凭证之前，可以为第一网元生成RSA累加器参数α，第一网元的RSA累加器参数α可以用于证明该第一网元的授权凭证是否被撤销。
可选地，凭证发放设备生成的授权凭证中可以包括以下信息中的至少一项：
业务标识信息；
凭证发放设备的标识信息；
凭证发放设备的公钥；
第一网元的标识信息；
第一网元的公钥；
第一网元对应的RSA累加器参数；
数据标识信息；
第一数字签名。
其中，第一数字签名可以是凭证发放设备利用自己的私钥对上述授权凭证中的其他信息进行签名得到。
可选地，参考图5所示的流程示意图，本申请实施例中，凭证发放设备在生成第一网元的授权凭证之后，还可以执行步骤530和步骤540。
步骤530、凭证发放设备向区块链节点发送第一网元的授权凭证；
步骤540、凭证发放设备接收区块链节点发送的授权凭证的存储位置信息。
可以理解的是，凭证发放设备可以向区块链节点发送所生成的第一网元的授权凭证，对第一网元的授权凭证进行上链操作，以实现对该授权凭证进行分布式存储。进一步地，区块链节点接收到授权凭证后，可以将该授权凭证存储于区块链的存储区块中，并将存储位置信息反馈给凭证发放设备。
可选地，参考图5所示，步骤540之后还可以包括以下步骤：
步骤550、凭证发放设备向第一网元发送授权凭证，和/或，存储位置信息。
可以理解的是，凭证发放设备在生成授权凭证之后，可以将生成的授权凭证发送给请求方，即第一网元。凭证发放设备也可以将授权凭证在存储区块中的存储位置信息发送给第一网元，第一网元可以在需要时根据该存储位置信息向区块链节点请求授权凭证。
综上所述，本申请实施例提供的安全实现方法中，凭证生成设备可以根据第一网元的请求，为其生成授权凭证，并对该授权凭证进行分布式存储。这样，第一网元或者终端设备可以从区块链节点请求该授权凭证进行分布式验证，也就是说，在不同地理位置的同一类业务，可以并行进行感知数据的授权，提高了感知数据授权的效率。
以下结合具体应用场景，对本申请实施例进行阐述。
应用场景一：
在应用场景一中，第一网元可以是感知服务器Server，凭证发放设备可以是应用提供商CA。参考图6所示的流程示意图，本申请实施例提供的安全实现方法可以通过以下步骤实现：
步骤601、感知服务器Server向应用提供商CA发送凭证请求信息。
本实施例中，凭证请求信息用于请求感知服务器Server的授权凭证。凭证请求信息中可以包括ID server、pk server、ID SP、Type server、以及Sig server中的至少一项。
其中，ID server为感知服务器Server的标识信息，pk server为感知服务器Server的公钥，ID SP为业务标识信息，Type server为数据标识信息，Sig server为感知服务器Server的数字签名。Sig server是感知服务器Server利用自己的私钥对ID server、pk server、ID SP、Type server中的一项或多项签名得到。
步骤602、应用提供商CA为感知服务器Server生成授权凭证。
可选地，应用提供商CA可以对发送请求信息的感知服务器Server进行身份验证。
具体地，应用提供商CA可以维护一份公钥列表，该列表用于存储使用ID sp对应的业务类型的所有服务器ID以及对应的公钥。应用提供商CA可以检查凭证请求信息中的ID server是否在公钥列表中，若在该公钥列表中，则获取ID server对应的公钥。
进一步地，应用提供商CA利用ID server对应的公钥对凭证请求信息中的Sig server进行验证。若验证结果与凭证请求信息中的其他信息一致，则确定感知服务器Server身份验证通过。
需要说明的是，本申请实施例对获取公钥列表的方式不做限制。
本实施例中，应用提供商CA可以基于凭证请求信息中的内容，生成感知服务器Server的授权凭证，该授权凭证可以使用Cert sp->server表示。
具体地，Cert sp->server可以包括ID server、pk server、ID SP、Type server、pk SP、α server、和Sig sp->server中的至少一项。其中，pk SP为应用提供商CA的公钥，α server为应用提供商CA为感知服务器sever生成的RSA累加器参数，Sig sp->server为应用提供商CA用自己的私钥对ID server、pk server、ID SP、Type server、pk SP、α server中的一项或多项签名得到。
步骤603、应用提供商CA向区块链节点发送授权凭证Cert sp->server。
步骤604、应用提供商CA接收区块链节点发送的存储位置信息BlockNum Cert。
步骤605、应用提供商CA向感知服务器Server发送授权凭证的存储位置信息BlockNum Cert。
可选地，应用提供商CA也可以将授权凭证Cert sp->server直接发送给感知服务器Server。
步骤606、感知服务器Server根据存储位置信息BlockNum Cert从区块链节点获取授权凭证Cert sp->server。
可选地，感知服务器Server可以通过应用提供商CA的公钥pk SP验证获取到的授权凭证的真实性。具体地，感知服务器Server利用pk SP对授权凭证Cert sp->server中的Sig sp->server进行验证，若验证结果与授权凭证Cert sp->server中其他信息一致，则确定授权凭证为真实凭证。
步骤607、感知服务器Server向UE发送感知数据请求。
本实施例中，感知数据请求可以包括ID server、ID UE、pk server、g、Cert sp->server、Sig server’中的至少一项。其中，ID UE为UE的标识信息，g为信道参数，用于建立感知服务器Server和UE之间的可信信道。Sig server’是感知服务器Server利用自己的私钥对ID server、ID UE、pk server、g、Cert sp->server中的一项或多项签名得到。
步骤608、UE对感知服务器Server的身份进行验证。
具体地，UE可以维护一份公钥列表，该列表中存储了多个感知服务器的标识信息，以及每个感知服务器对应的公钥。UE接收到感知服务器Server发送的感知数据请求后，可以从上述公钥列表中查找ID server对应的公钥pk server。进而UE基于pk server对Sig server’进行验证。若UE基于pk server对Sig server’验证得到的验证结果与感知数据请求中其他信息一致，则确定感知服务器Server为受信任的设备。否则，UE确定验证不通过，不进行进一步处理。
步骤609、UE对感知服务器Server的身份进行验证通过后，对Cert sp->server进行验证，并在验证通过后授权传输感知数据。
本实施例中，UE对感知服务器Server的身份进行验证通过后，进一步验证Cert sp->server。具体地，UE使用凭证发放设备的公钥pk SP对Cert sp->server中的数字签名Sig sp->server进行验证，若验证结果与Cert sp->server中的其他信息一致，则确定该感知服务器Server拥有获取UE感知数据的权限。若验证结果与Cert sp->server中的其他信息不一致，则不进行进一步处理。
可选地，若Cert sp->server中包括感知服务器Server的RSA累加器参数α server，则终端设备可以利用α server验证该Cert sp->server是否被撤销，若被撤销，则不进行进一步处理。若未被撤销，则UE可以继续执行步骤610。
步骤610、UE向感知服务器Server发送感知数据。
需要说明的是，应用场景一中步骤601至步骤605可以单独实施，步骤606至步骤610也可以单独实施，步骤601至步骤610可以一起实施，本申请实施例对此不做限制。
应用场景二、
在应用场景二中，第一网元可以是基站，凭证发放设备可以是应用提供商CA。凭证发放设备可以单独为基站发放授权凭证，参考图7所示的流程示意图，应用提供商CA为基站发放授权凭证的过程可以通过以下步骤实现：
步骤701、基站向应用提供商CA发送凭证请求信息。
本实施例中，凭证请求信息用于请求基站的授权凭证。凭证请求信息中可以包括ID bs、pk bs、ID SP、Type bs、以及Sig bs中的至少一项。
其中，ID bs为基站的标识信息，pk bs为基站的公钥，ID SP为业务标识信息，Type bs为数据标识信息，Sig bs为基站的数字签名。Sig bs是基站利用自己的私钥对ID bs、pk bs、ID SP、Type bs中的一项或多项签名得到。
步骤702、应用提供商CA为基站生成授权凭证。
可选地，应用提供商CA可以对发送请求信息的基站进行身份验证。
具体地，应用提供商CA可以维护一份公钥列表，该列表用于存储使用ID sp对应的业务类型的所有基站ID以及对应的公钥。应用提供商CA可以检查凭证请求信息中的ID bs是否在公钥列表中，若在该公钥列表中，则获取ID bs对应的公钥。
进一步地，应用提供商CA利用ID bs对应的公钥对凭证请求信息中的Sig bs进行验证。若验证结果与凭证请求信息中的其他信息一致，则确定基站身份验证通过。
需要说明的是，本申请实施例对获取公钥列表的方式不做限制。
本实施例中，应用提供商CA可以基于凭证请求信息中的内容，生成基站的授权凭证，该授权凭证可以使用Cert sp->bs表示。
具体地，Cert sp->bs可以包括ID bs、pk bs、ID SP、Type sbs、pk SP、α bs、和Sig sp->bs中的至少一项。其中，pk SP为应用提供商CA的公钥，α bs为应用提供商CA为基站生成的RSA累加器参数，Sig sp->bs为应用提供商CA用自己的私钥对ID bs、pk bs、ID SP、Type sbs、pk SP、α bs中的一项或多项签名得到。
步骤703、应用提供商CA向区块链节点发送授权凭证Cert sp->bs。
步骤704、应用提供商CA接收区块链节点发送的存储位置信息BlockNum Cert。
步骤705、应用提供商CA向基站发送授权凭证的存储位置信息BlockNum Cert。
可选地，应用提供商CA也可以将授权凭证Cert sp->bs直接发送给基站。
需要说明的是，上述实施例中的基站也可以替换为感知控制网元。
应用场景三
在应用场景三中，第一网元可以是感知控制网元，凭证发放设备可以是应用提供商CA。感知控制网元可以请求终端设备授权传输感知数据，参考图8所示的流程示意图，本申请实施例中感知控制网元请求终端设备授权传输感知数据的方法可以通过以下步骤实现：
步骤801、感知控制网元根据存储位置信息BlockNum Cert从区块链节点获取感知控制网元的授权凭证Cert sp->server。
可选地，感知控制网元可以通过应用提供商CA的公钥pk SP验证获取到的授权凭证的真实性。具体地，感知控制网元可以利用pk SP对授权凭证Cert sp->server中的Sig sp->server进行验证，若验证结果与授权凭证Cert sp->server中其他信息一致，则确定授权凭证为真实凭证。
步骤802、感知控制网元向UE发送感知数据请求。
本实施例中，感知数据请求可以包括ID server、ID UE、pk server、g、Cert sp->server、Sig server’中的至少一项。其中，ID server为感知控制网元的标识信息，ID UE为UE的标识信息，pk server可以为感知控制网元的公钥，g为信道参数，用于建立感知控制网元和UE之间的可信信道。Sig server’是感知控制网元利用自己的私钥对ID server、ID UE、pk server、g、Cert sp->server中的一项或多项签名得到。
可选地，感知控制网元可以直接将感知数据请求发送给UE，也可以通过AMF网元/AUSF网元向UE转发感知数据请求，本申请实施例对此不做限制。
步骤803、UE对感知控制网元的身份进行验证。
具体地，UE可以维护一份公钥列表，该列表中存储了多个网元的标识信息，以及每个网元对应的公钥。UE接收到感知控制网元发送的感知数据请求后，可以从上述公钥列表中查找ID server对应的公钥pk server。进而UE基于pk server对Sig server’进行验证。若UE基于pk server对Sig server’验证得到的验证结果与感知数据请求中其他信息一致，则确定感知控制网元为受信任的设备。否则，UE确定验证不通过，不进行进一步处理。
步骤804、UE对感知控制网元的身份进行验证通过后，对Cert sp->server进行验证，并在验证通过后授权传输感知数据。
本实施例中，UE对感知控制网元的身份进行验证通过后，进一步验证Cert sp->server。具体地，UE使用凭证发放设备的公钥pk SP对Cert sp->server中的数字签名Sig sp->server进行验证，若验证结果与Cert sp->server中的其他信息一致，则确定该感知控制网元拥有获取UE感知数据的权限。若验证结果与Cert sp->server中的其他信息不一致，则不进行进一步处理。
可选地，若Cert sp->server中包括感知控制网元的RSA累加器参数α server，则UE可以利用α server验证该Cert sp->server是否被撤销，若被撤销，则不进行进一步处理。若未被撤销，则UE可以继续 执行步骤805。
步骤805、UE向感知收集实体发送感知数据。
可选地，UE可以之间将感知数据直接发送给感知收集实体，UE也可以通过UPF向感知收集实体转发感知数据，本申请实施例对此不做限制。
应用场景四：
在应用场景四中，第一网元可以是感知服务器Sever，凭证发放设备可以是应用提供商CA。终端设备可以主动获取感知服务器Sever的授权凭证进行验证，参考图9所示的流程示意图，可以包括以下步骤：
步骤901、UE根据存储位置信息BlockNum Cert从区块链节点获取感知控制网元的授权凭证Cert sp->server。
可选地，UE可以通过应用提供商CA的公钥pk SP验证获取到的授权凭证的真实性。具体地，UE可以利用pk SP对授权凭证Cert sp->server中的Sig sp->server进行验证，若验证结果与授权凭证Cert sp->server中其他信息一致，则确定授权凭证为真实凭证。
步骤902、UE被触发周期性感知数据上传。
需要说明的是，步骤901可以在步骤902之前执行，也可以在步骤902之后执行，本申请实施例对两个步骤的执行顺序不做限制。
步骤903、UE对Cert sp->server进行验证，并在验证通过后授权传输感知数据。
具体地，UE可以使用凭证发放设备的公钥pk SP对Cert sp->server中的数字签名Sig sp->server进行验证，若验证结果与Cert sp->server中的其他信息一致，则确定该感知控制网元拥有获取UE感知数据的权限。若验证结果与Cert sp->server中的其他信息不一致，则不进行进一步处理。
可选地，若Cert sp->server中包括感知控制网元的RSA累加器参数α server，则UE可以利用α server验证该Cert sp->server是否被撤销，若被撤销，则不进行进一步处理。若未被撤销，则UE可以继续执行步骤904。
步骤904、UE向感知服务器发送感知数据。
可选地，上述感知服务器可以替换为基站，相应的，Cert sp->server可以替换为Cert sp->bs。
以上结合附图详细描述了本申请的优选实施方式，但是，本申请并不限于上述实施方式中的具体细节，在本申请的技术构思范围内，可以对本申请的技术方案进行多种简单变型，这些简单变型均属于本申请的保护范围。例如，在上述具体实施方式中所描述的各个具体技术特征，在不矛盾的情况下，可以通过任何合适的方式进行组合，为了避免不必要的重复，本申请对各种可能的组合方式不再另行说明。又例如，本申请的各种不同的实施方式之间也可以进行任意组合，只要其不违背本申请的思想，其同样应当视为本申请所公开的内容。又例如，在不冲突的前提下，本申请描述的各个实施例和/或各个实施例中的技术特征可以和现有技术任意的相互组合，组合之后得到的技术方案也应落入本申请的保护范围。
还应理解，在本申请的各种方法实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。另外，本申请实施例中，术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系。具体地，A和/或B可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系。
图10是本申请实施例提供的安全实现装置1000的结构组成示意图，应用于终端设备，如图10所示，所述安全实现装置1000包括：
第一接收单元1001，被配置为获取第一网元的授权凭证；所述授权凭证用于所述终端设备验证是否授权传输感知数据；所述授权凭证包括第一数字签名；
授权单元1002，被配置为在基于所述第一数字签名对所述授权凭证验证通过的情况下，授权传输所述感知数据。
可选地，所述授权凭证还包括以下中的至少一项：
业务标识信息；
凭证发放设备的标识信息；
所述凭证发放设备的公钥；
所述第一网元的标识信息；
所述第一网元的公钥；
所述第一网元对应的RSA累加器参数；
数据标识信息。
可选地，所述第一数字签名通过凭证发放设备的私钥进行签名；所述安全实现装置1000还包括第一验证单元，被配置为利用所述凭证发放设备的公钥对所述第一数字签名进行验证，得到第一验证信息；若所述第一验证信息与所述授权凭证中除所述第一数字签名之外的其他信息一致，则确定所述授权凭证验证通过。
可选地，所述授权凭证中还包括所述第一网元对应的RSA累加器参数；
所述授权单元1002，还被配置为在利用所述凭证发放设备的公钥对所述授权凭证验证通过的情况下，所述终端设备基于所述RSA累加器参数，验证所述第一网元的所述授权凭证是否被撤销；若所述授权凭证未被撤销，则所述终端设备授权传输所述感知数据。
可选地，所述授权凭证中还包括业务标识信息；所述业务标识信息用于指示待授权的感知数据的业务类型；所述第一验证单元，还被配置为在所述终端设备支持所述业务类型的情况下，基于所述第一数字签名对所述授权凭证进行验证。
可选地，所述安全实现装置1000还包括第一发送单元，被配置为发送与所述感知业务类型对应的感知数据。
可选地，所述第一接收单元1001，还被配置为接收所述第一网元发送的第一请求信息，所述第一请求信息用于请求所述终端设备授权，以传输所述感知数据；所述第一请求信息中包括所述授权凭证；从所述第一请求信息中获取所述授权凭证。
可选地，所述第一接收单元1001，还被配置为在对所述第一网元的身份验证通过的情况下，从所述第一请求信息中获取所述授权凭证。
可选地，所述第一请求信息中还包括通过所述第一网元的私钥进行签名的第二数字签名；所述一验证单元，还配置为利用所述第一网元的公钥对所述第二数字签名进行验证处理，得到第二验证信息；若所述第二验证信息与所述第一请求信息授权凭证中除所述第二数字签名之外的其他信息一致，则确定所述第一网元身份验证通过。
可选地，所述第一发送单元，被配置为向区块链节点发送第二请求信息，所述第二请求信息用于请求所述第一网元的授权凭证；所述授权凭证存储于所述区块链节点的区块中；所述第二请求信息包括所述授权凭证在所述区块链节点的存储位置信息；
可选地，所述第一发送单元，还被配置为按照预设时间周期，发送所述感知数据。
图11是本申请实施例提供的安全实现装置1100的结构组成示意图，应用于第一网元，如图11所示，所述安全实现装置1100包括：
第二发送单元1101，被配置为向终端设备发送第一请求信息；所述第一请求信息用于请求所述终端设备授权，以传输感知数据；所述第一请求信息中包括所述第一网元的授权凭证；所述授权凭证用于所述终端设备验证是否授权传输感知数据；所述授权凭证通过其包括的第一数字签名进行验证。
可选地，所述第一请求信息还包括以下中的至少一项：
所述第一网元的标识信息；
所述终端设备的标识信息；
信道参数；所述信道参数用于建立所述第一网元与所述终端设备之间的可信信道；
所述第一网元的公钥；
第二数字签名；所述第二数字签名用于终端设备验证所述第一网元的身份；所述第二数字签名通过所述第一网元的私钥对所述第一请求信息中的其他信息进行签名得到。
可选地，所述第二发送单元1101，还被配置为向区块链节点发送第三请求信息；所述第三请求信息用于请求所述第一网元的授权凭证；所述授权凭证存储于所述区块链节点的区块中；所述第三请求信息包括所述授权凭证在所述区块链节点的存储位置信息；
所述安全实现装置1101还包括第二接收单元，被配置为接收所述区块链节点发送的所述授权凭证。
可选地，所述第二发送单元1101，还被配置为向凭证发放设备发送第四请求信息；所述第四请求信息用于请求所述第一网元的授权凭证。
可选地，所述第四请求信息包括以下中的至少一项：
业务标识信息；
所述第一网元的标识信息；
所述第一网元的公钥；
数据标识信息；
第三数字签名，第三数字签名通过第一网元的私钥对第四请求信息中的其他信息进行签名得到。
可选地，所述第二接收单元，还被配置为接收所述凭证发放设备发送的所述授权凭证，和/或，所述授权凭证的存储位置信息。
图12是本申请实施例提供的安全实现装置1200的结构组成示意图，应用于凭证发放设备，如图12所示，所述安全实现装置1200包括：
第三接收单元1201，被配置为接收第一网元发送的第四请求信息；所述第四请求信息用于请求所述第一网元的授权凭证；所述授权凭证用于终端设备验证是否授权传输感知数据；
凭证生成单元1202，被配置为生成所述所述第一网元的授权凭证。
可选地，所述授权凭证包括以下中的至少一项：
业务标识信息；
所述凭证发放设备的标识信息；
所述凭证发放设备的公钥；
所述第一网元的标识信息；
所述第一网元的公钥；
所述第一网元对应的RSA累加器参数；
数据标识信息；
第一数字签名。
可选地，所述凭证生成单元1202，还被配置为在对所述第一网元身份验证通过的情况下，所述凭证发放设备生成所述第一网元的授权凭证。
可选地，所述第四请求信息包括第三数字签名；所述第三数字签名通过所述第一网元的私钥进行签名。
可选地，所述安全实现装置1200还包括第二验证单元，被配置为基于所述第一网元的公钥对所述第三数字签名进行验证，得到第三验证信息；若所述第三验证信息与所述第四请求信息中除所述第三数字签名之外的其他信息一致，则确定所述第一网元的身份验证通过。
可选地，所述安全实现装置1200还包括第三发送单元，被配置为向区块链节点发送所述授权凭证；
所述第三接收单元1201，还被配置为接收所述区块链节点发送的所述授权凭证的存储位置信息。
可选地，所述第三发送单元，还被配置为向所述第一网元发送所述授权凭证，和/或，所述存储位置信息。
本领域技术人员应当理解，本申请实施例的上述安全实现装置的相关描述可以参照本申请实施例的安全实现方法的相关描述进行理解。
图13是本申请实施例提供的一种通信设备1300示意性结构图。该通信设备可以终端设备，也可以是第一网元，也可以是凭证发放设备。图13所示的通信设备1300包括处理器1310，处理器1310可以从存储器中调用并运行计算机程序，以实现本申请实施例中的方法。
可选地，如图13所示，通信设备1300还可以包括存储器1320。其中，处理器1310可以从存储器1320中调用并运行计算机程序，以实现本申请实施例中的方法。
其中，存储器1320可以是独立于处理器1310的一个单独的器件，也可以集成在处理器1810中。
可选地，如图13所示，通信设备1300还可以包括收发器1330，处理器1310可以控制该收发器1330与其他设备进行通信，具体地，可以向其他设备发送信息或数据，或接收其他设备发送的信息或数据。
其中，收发器1330可以包括发射机和接收机。收发器1330还可以进一步包括天线，天线的数量可以为一个或多个。
可选地，该通信设备1300具体可为本申请实施例的终端设备，并且该通信设备1300可以实现本申请实施例的各个方法中由终端设备实现的相应流程，为了简洁，在此不再赘述。
可选地，该通信设备1300具体可为本申请实施例的第一网元，并且该通信设备1300可以实现本申请实施例的各个方法中由第一网元实现的相应流程，为了简洁，在此不再赘述。
可选地，该通信设备1300具体可为本申请实施例的凭证发放设备，并且该通信设备1300可以实现本申请实施例的各个方法中由凭证发放设备实现的相应流程，为了简洁，在此不再赘述。
图14是本申请实施例的芯片的示意性结构图。图14所示的芯片1400包括处理器1410，处理器1410可以从存储器中调用并运行计算机程序，以实现本申请实施例中的方法。
可选地，如图14所示，芯片1400还可以包括存储器1420。其中，处理器1410可以从存储器1420中调用并运行计算机程序，以实现本申请实施例中的方法。
其中，存储器1420可以是独立于处理器1410的一个单独的器件，也可以集成在处理器1410中。
可选地，该芯片1400还可以包括输入接口1430。其中，处理器1410可以控制该输入接口1430与其他设备或芯片进行通信，具体地，可以获取其他设备或芯片发送的信息或数据。
可选地，该芯片1400还可以包括输出接口1440。其中，处理器1410可以控制该输出接口1440与其他设备或芯片进行通信，具体地，可以向其他设备或芯片输出信息或数据。
可选地，该芯片可应用于本申请实施例中的终端设备，并且该芯片可以实现本申请实施例的各个方法中由终端设备实现的相应流程，为了简洁，在此不再赘述。
可选地，该芯片可应用于本申请实施例中的第一网元，并且该芯片可以实现本申请实施例的各个方法中由第一网元实现的相应流程，为了简洁，在此不再赘述。
可选地，该芯片可应用于本申请实施例中的凭证发放设备，并且该芯片可以实现本申请实施例的各个方法中由凭证发放设备实现的相应流程，为了简洁，在此不再赘述。
应理解，本申请实施例提到的芯片还可以称为系统级芯片，系统芯片，芯片系统或片上系统芯片等。
图15是本申请实施例提供的一种通信系统1500的示意性框图。如图15所示，该通信系统1500包括终端设备1510、第一网元1520、和凭证发放设备1530。
其中，该终端设备1510可以用于实现上述方法中由终端设备实现的相应的功能，该第一网元1520可以用于实现上述方法中由第一网元实现的相应的功能，凭证发放设备1530可以用于实现上述方法中由凭证发放设备实现的相应的功能，为了简洁，在此不再赘述。
应理解，本申请实施例的处理器可能是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法实施例的各步骤可以通过处理器中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器可以是通用处理器、数字信号处理器(Digital Signal Processor，DSP)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现成可编程门阵列(Field Programmable Gate Array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器，处理器读取存储器中的信息，结合其硬件完成上述方法的步骤。
可以理解，本申请实施例中的存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(Read-Only Memory，ROM)、可编程只读存储器(Programmable ROM，PROM)、可擦除可编程只读存储器(Erasable PROM，EPROM)、电可擦除可编程只读存储器(Electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(Random Access Memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(Static RAM，SRAM)、动态随机存取存储器(Dynamic RAM，DRAM)、同步动态随机存取存储器(Synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(Double Data Rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(Enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(Synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(Direct Rambus RAM，DR RAM)。应注意，本文描述的系统和方法的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
应理解，上述存储器为示例性但不是限制性说明，例如，本申请实施例中的存储器还可以是静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(dynamic RAM，DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synch link DRAM，SLDRAM)以及直接内存总线随机存取存储器(Direct Rambus RAM，DR RAM)等等。也就是说，本申请实施例中的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
本申请实施例还提供了一种计算机可读存储介质，用于存储计算机程序。
可选地，该计算机可读存储介质可应用于本申请实施例中的终端设备，并且该计算机程序使得计算机执行本申请实施例的各个方法中由终端设备实现的相应流程，为了简洁，在此不再赘述。
可选的，该计算机可读存储介质可应用于本申请实施例中的第一网元，并且该计算机程序使得计算机执行本申请实施例的各个方法中由第一网元实现的相应流程，为了简洁，在此不再赘述。
可选的，该计算机可读存储介质可应用于本申请实施例中的凭证发放设备，并且该计算机程序使得计算机执行本申请实施例的各个方法中由凭证发放设备实现的相应流程，为了简洁，在此不再赘述。
本申请实施例还提供了一种计算机程序产品，包括计算机程序指令。
可选地，该计算机程序产品可应用于本申请实施例中的终端设备，并且该计算机程序指令使得计算机执行本申请实施例的各个方法中由终端设备实现的相应流程，为了简洁，在此不再赘述。
可选的，该计算机程序产品可应用于本申请实施例中的第一网元，并且该计算机程序指令使得计算机执行本申请实施例的各个方法中由第一网元实现的相应流程，为了简洁，在此不再赘述。
可选的，该计算机程序产品可应用于本申请实施例中的凭证发放设备，并且该计算机程序指令使得计算机执行本申请实施例的各个方法中由凭证发放设备实现的相应流程，为了简洁，在此不再赘述。
本申请实施例还提供了一种计算机程序。
可选地，该计算机程序可应用于本申请实施例中的终端设备，当该计算机程序在计算机上运行时，使得计算机执行本申请实施例的各个方法中由终端设备实现的相应流程，为了简洁，在此不再赘述。
可选的，该计算机程序可应用于本申请实施例中的第一网元，当该计算机程序在计算机上运行时，使得计算机执行本申请实施例的各个方法中由第一网元实现的相应流程，为了简洁，在此不再赘述。
可选的，该计算机程序可应用于本申请实施例中的凭证发放设备，当该计算机程序在计算机上运行时，使得计算机执行本申请实施例的各个方法中由凭证发放设备实现的相应流程，为了简洁，在此不再赘述。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，)ROM、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应所述以权利要求的保护范围为准。

Claims (42)

  1. 一种安全实现方法，所述方法包括：
    终端设备获取第一网元的授权凭证；所述授权凭证用于所述终端设备验证是否授权传输感知数据；所述授权凭证包括第一数字签名；
    在基于所述第一数字签名对所述授权凭证验证通过的情况下，所述终端设备授权传输所述感知数据。
  2. 根据权利要求1所述的方法，其中，所述授权凭证还包括以下中的至少一项：
    业务标识信息；
    凭证发放设备的标识信息；
    所述凭证发放设备的公钥；
    所述第一网元的标识信息；
    所述第一网元的公钥；
    所述第一网元对应的RSA累加器参数；
    数据标识信息。
  3. 根据权利要求1或2所述的方法，其中，所述第一数字签名通过凭证发放设备的私钥进行签名；所述方法还包括：
    所述终端设备利用所述凭证发放设备的公钥对所述第一数字签名进行验证，得到第一验证信息；
    若所述第一验证信息与所述授权凭证中除所述第一数字签名之外的其他信息一致，则所述终端设备确定所述授权凭证验证通过。
  4. 根据权利要求1-3任一项所述的方法，其中，所述授权凭证中还包括所述第一网元对应的RSA累加器参数；
    所述在基于所述第一数字签名对所述授权凭证验证通过的情况下，所述终端设备授权传输所述感知数据，包括：
    在基于所述第一数字签名对所述授权凭证验证通过的情况下，所述终端设备基于所述RSA累加器参数，验证所述第一网元的所述授权凭证是否被撤销；
    若所述授权凭证未被撤销，则所述终端设备授权传输所述感知数据。
  5. 根据权利要求1-4任一项所述的方法，其中，所述授权凭证中包括业务标识信息和/或数据标识信息；所述业务标识信息用于指示待授权的感知数据的业务类型；所述数据标识信息用于指示所述感知数据的数据类型；
    所述方法还包括：
    在所述终端设备支持所述业务类型和/或所述数据类型的情况下，所述终端设备基于所述第一数字签名对所述授权凭证进行验证。
  6. 根据权利要求5所述的方法，其中，所述终端设备授权传输所述感知数据之后，所述方法还包括：
    所述终端设备发送与所述感知业务类型对应的感知数据。
  7. 根据权利要求1-6任一项所述的方法，其中，所述终端设备获取第一网元的授权凭证，包括：
    所述终端设备接收所述第一网元发送的第一请求信息，所述第一请求信息用于请求所述终端设备授权，以传输所述感知数据；所述第一请求信息中包括所述授权凭证；
    所述终端设备从所述第一请求信息中获取所述授权凭证。
  8. 根据权利要求7所述的方法，其中，所述第一请求信息还包括以下中的至少一项：
    所述第一网元的标识信息；
    所述终端设备的标识信息；
    信道参数；所述信道参数用于建立所述第一网元与所述终端设备之间的可信信道；
    所述第一网元的公钥；
    第二数字签名；所述第二数字签名用于终端设备验证所述第一网元的身份；所述第二数字签名通过所述第一网元的私钥对所述第一请求信息中的其他信息进行签名得到。
  9. 根据权利要求7或8所述的方法，其中，所述终端设备从所述第一请求信息中获取所述授权凭证，包括：
    在对所述第一网元的身份验证通过的情况下，所述终端设备从所述第一请求信息中获取所述授权凭证。
  10. 根据权利要求9所述的方法，其中，所述第一请求信息中还包括通过所述第一网元的私钥进行签名的第二数字签名；
    所述方法还包括：
    所述终端设备利用所述第一网元的公钥对所述第二数字签名进行验证，得到第二验证信息；
    若所述第二验证信息与所述第一请求信息中除所述第二数字签名之外的其他信息一致，则确定所述第一网元身份验证通过。
  11. 根据权利要求1-6任一项所述的方法，其中，所述终端设备获取授权凭证，包括：
    所述终端设备向区块链节点发送第二请求信息，所述第二请求信息用于请求所述第一网元的授权凭证；所述授权凭证存储于所述区块链节点的区块中；所述第二请求信息包括所述授权凭证在所述区块链节点的存储位置信息；
    所述终端设备接收所述区块链节点发送的所述授权凭证。
  12. 根据权利要求11所述的方法，其中，所述方法还包括：
    所述终端设备按照预设时间周期，发送所述感知数据。
  13. 一种安全实现方法，包括：
    第一网元向终端设备发送第一请求信息；所述第一请求信息用于请求所述终端设备授权，以传输感知数据；所述第一请求信息中包括所述第一网元的授权凭证；所述授权凭证用于所述终端设备验证是否授权传输感知数据；所述授权凭证通过其包括的第一数字签名进行验证。
  14. 根据权利要求13所述的方法，其中，所述第一请求信息还包括以下中的至少一项：
    所述第一网元的标识信息；
    所述终端设备的标识信息；
    信道参数；所述信道参数用于建立所述第一网元与所述终端设备之间的可信信道；
    所述第一网元的公钥；
    第二数字签名；所述第二数字签名用于终端设备验证所述第一网元的身份；所述第二数字签名通过所述第一网元的私钥对所述第一请求信息中的其他信息进行签名得到。
  15. 根据权利要求13或14所述的方法，其中，所述第一网元向终端设备发送第一请求信息之前，还包括：
    所述第一网元向区块链节点发送第三请求信息；所述第三请求信息用于请求所述第一网元的授权凭证；所述授权凭证存储于所述区块链节点的区块中；所述第三请求信息包括所述授权凭证在所述区块链节点的存储位置信息；
    所述第一网元接收所述区块链节点发送的所述授权凭证。
  16. 根据权利要求15所述的方法，其中，所述第一网元向区块链节点发送第三请求之前，还包括：
    所述第一网元向凭证发放设备发送第四请求信息；所述第四请求信息用于请求所述第一网元的授权凭证。
  17. 根据权利要求16所述的方法，其中，所述第四请求信息包括以下中的至少一项：
    业务标识信息；
    所述第一网元的标识信息；
    所述第一网元的公钥；
    数据标识信息；
    第三数字签名，第三数字签名通过第一网元的私钥对第四请求信息中的其他信息进行签名得到。
  18. 根据权利要求16或17所述的方法，其中，还包括：
    所述第一网元接收所述凭证发放设备发送的所述授权凭证，和/或，所述授权凭证的存储位置信息。
  19. 一种安全实现方法，包括：
    凭证发放设备接收第一网元发送的第四请求信息；所述第四请求信息用于请求所述第一网元的授权凭证；所述授权凭证用于终端设备验证是否授权传输感知数据；
    所述凭证发放设备生成所述所述第一网元的授权凭证。
  20. 根据权利要求19所述的方法，其中，所述授权凭证包括以下中的至少一项：
    业务标识信息；
    所述凭证发放设备的标识信息；
    所述凭证发放设备的公钥；
    所述第一网元的标识信息；
    所述第一网元的公钥；
    所述第一网元对应的RSA累加器参数；
    数据标识信息；
    第一数字签名。
  21. 根据权利要求19或20所述的方法，其中，还包括：
    在对所述第一网元身份验证通过的情况下，所述凭证发放设备生成所述第一网元的授权凭证。
  22. 根据权利要求21所述的方法，其中，所述第四请求信息包括第三数字签名；所述第三数字签名通过所述第一网元的私钥进行签名；所述方法还包括：
    所述凭证发放设备基于所述第一网元的公钥对所述第三数字签名进行验证，得到第三验证信息；
    若所述第三验证信息与所述第四请求信息中除所述第三数字签名之外的其他信息一致，则凭证发放设备确定所述第一网元的身份验证通过。
  23. 根据权利要求19-22任一项所述的方法，其中，还包括：
    所述凭证发放设备向区块链节点发送所述授权凭证；
    所述凭证发放设备接收所述区块链节点发送的所述授权凭证的存储位置信息。
  24. 根据权利要求23所述的方法，其中，还包括：
    所述凭证发放设备向所述第一网元发送所述授权凭证，和/或，所述存储位置信息。
  25. 一种安全实现装置，应用于终端设备，包括：
    第一获取单元，被配置为获取第一网元的授权凭证；所述授权凭证用于所述终端设备验证是否授权传输感知数据；所述授权凭证包括第一数字签名；
    授权单元，被配置为在基于所述第一数字签名对所述授权凭证验证通过的情况下，授权传输所述感知数据。
  26. 一种安全实现装置，应用于第一网元，包括：
    第二发送单元，被配置为向终端设备发送第一请求信息；所述第一请求信息用于请求所述终端设备授权，以传输感知数据；所述第一请求信息中包括所述第一网元的授权凭证；所述授权凭证用于所述终端设备验证是否授权传输感知数据；所述授权凭证通过其包括的第一数字签名进行验证。
  27. 一种安全实现装置，应用于凭证发放设备，包括：
    第三接收单元，被配置为接收第一网元发送的第四请求信息；所述第四请求信息用于请求所述第一网元的授权凭证；所述授权凭证用于终端设备验证是否授权传输感知数据；
    凭证生成单元，被配置为所述所述第一网元的授权凭证。
  28. 一种终端设备，包括：处理器和存储器，该存储器用于存储计算机程序，所述处理器用于调用并运行所述存储器中存储的计算机程序，执行如权利要求1至11中任一项所述的方法。
  29. 一种第一网元，包括：处理器和存储器，该存储器用于存储计算机程序，所述处理器用于调用并运行所述存储器中存储的计算机程序，执行如权利要求12至17中任一项所述的方法。
  30. 一种凭证发放设备，包括：处理器和存储器，该存储器用于存储计算机程序，所述处理器用于调用并运行所述存储器中存储的计算机程序，执行如权利要求18至24中任一项所述的方法。
  31. 一种芯片，包括：处理器，用于从存储器中调用并运行计算机程序，使得安装有所述芯片的设备执行如权利要求1至12中任一项所述的方法。
  32. 一种芯片，包括：处理器，用于从存储器中调用并运行计算机程序，使得安装有所述芯片的设备执行如权利要求13至18中任一项所述的方法。
  33. 一种芯片，包括：处理器，用于从存储器中调用并运行计算机程序，使得安装有所述芯片的设备执行如权利要求19至24中任一项所述的方法。
  34. 一种计算机可读存储介质，用于存储计算机程序，所述计算机程序使得计算机执行如权利要求1至12中任一项所述的方法。
  35. 一种计算机可读存储介质，用于存储计算机程序，所述计算机程序使得计算机执行如权利要求13至18中任一项所述的方法。
  36. 一种计算机可读存储介质，用于存储计算机程序，所述计算机程序使得计算机执行如权 利要求19至24中任一项所述的方法。
  37. 一种计算机程序产品，包括计算机程序指令，该计算机程序指令使得计算机执行如权利要求1至12中任一项所述的方法。
  38. 一种计算机程序产品，包括计算机程序指令，该计算机程序指令使得计算机执行如权利要求13至18中任一项所述的方法。
  39. 一种计算机程序产品，包括计算机程序指令，该计算机程序指令使得计算机执行如权利要求19至24中任一项所述的方法。
  40. 一种计算机程序，所述计算机程序使得计算机执行如权利要求1至12中任一项所述的方法。
  41. 一种计算机程序，所述计算机程序使得计算机执行如权利要求13至18中任一项所述的方法。
  42. 一种计算机程序，所述计算机程序使得计算机执行如权利要求19至24中任一项所述的方法。
PCT/CN2022/083164 2022-03-25 2022-03-25 安全实现方法、装置、终端设备、网元、及凭证生成设备 Ceased WO2023178686A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
EP22932747.3A EP4503505A4 (en) 2022-03-25 2022-03-25 SAFETY IMPLEMENTATION METHOD AND APPARATUS, TERMINAL DEVICE, NETWORK ELEMENT AND CERTIFICATE GENERATION DEVICE
PCT/CN2022/083164 WO2023178686A1 (zh) 2022-03-25 2022-03-25 安全实现方法、装置、终端设备、网元、及凭证生成设备
CN202280093802.4A CN118872233A (zh) 2022-03-25 2022-03-25 安全实现方法、装置、终端设备、网元、及凭证生成设备
US18/891,734 US20250016006A1 (en) 2022-03-25 2024-09-20 Security implementation method and apparatus, terminal device, network element and credential generating device

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2022/083164 WO2023178686A1 (zh) 2022-03-25 2022-03-25 安全实现方法、装置、终端设备、网元、及凭证生成设备

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/891,734 Continuation US20250016006A1 (en) 2022-03-25 2024-09-20 Security implementation method and apparatus, terminal device, network element and credential generating device

Publications (1)

Publication Number Publication Date
WO2023178686A1 true WO2023178686A1 (zh) 2023-09-28

Family

ID=88099618

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/083164 Ceased WO2023178686A1 (zh) 2022-03-25 2022-03-25 安全实现方法、装置、终端设备、网元、及凭证生成设备

Country Status (4)

Country Link
US (1) US20250016006A1 (zh)
EP (1) EP4503505A4 (zh)
CN (1) CN118872233A (zh)
WO (1) WO2023178686A1 (zh)

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105764057A (zh) * 2016-04-21 2016-07-13 北京元心科技有限公司 移动终端的注册方法及服务器平台
CN107924437A (zh) * 2015-06-17 2018-04-17 瑞典爱立信有限公司 用于使得能够实现凭证的安全供应的方法以及相关无线装置和服务器
CN108512846A (zh) * 2018-03-30 2018-09-07 北京邮电大学 一种终端与服务器之间的双向认证方法和装置
CN111131300A (zh) * 2019-12-31 2020-05-08 上海移为通信技术股份有限公司 通信方法、终端及服务器
CN111526159A (zh) * 2020-05-25 2020-08-11 普联技术有限公司 建立数据连接的方法、装置、终端设备及存储介质
CN112508578A (zh) * 2021-02-04 2021-03-16 支付宝(杭州)信息技术有限公司 基于区块链的资源转移请求验证、发送方法及装置

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9600676B1 (en) * 2014-06-16 2017-03-21 Verily Life Sciences Llc Application-level wireless security for wearable devices
US11888965B2 (en) * 2019-12-10 2024-01-30 Mastercard Asia/Pacific Pte. Ltd. Method and system for IOT device digital asset permission transfer system using blockchain network

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107924437A (zh) * 2015-06-17 2018-04-17 瑞典爱立信有限公司 用于使得能够实现凭证的安全供应的方法以及相关无线装置和服务器
CN105764057A (zh) * 2016-04-21 2016-07-13 北京元心科技有限公司 移动终端的注册方法及服务器平台
CN108512846A (zh) * 2018-03-30 2018-09-07 北京邮电大学 一种终端与服务器之间的双向认证方法和装置
CN111131300A (zh) * 2019-12-31 2020-05-08 上海移为通信技术股份有限公司 通信方法、终端及服务器
CN111526159A (zh) * 2020-05-25 2020-08-11 普联技术有限公司 建立数据连接的方法、装置、终端设备及存储介质
CN112508578A (zh) * 2021-02-04 2021-03-16 支付宝(杭州)信息技术有限公司 基于区块链的资源转移请求验证、发送方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4503505A4 *

Also Published As

Publication number Publication date
US20250016006A1 (en) 2025-01-09
CN118872233A (zh) 2024-10-29
EP4503505A4 (en) 2025-11-26
EP4503505A1 (en) 2025-02-05

Similar Documents

Publication Publication Date Title
US20250350946A1 (en) Communication method, communication apparatus, and communication system
US10848970B2 (en) Network authentication method, and related device and system
CN114268943B (zh) 授权方法及装置
CN112438041B (zh) 用于执行接入的方法与装置
TWI820696B (zh) 通訊方法、裝置及電腦可讀儲存介質
KR20160078426A (ko) 무선 직접통신 네트워크에서 비대칭 키를 사용하여 아이덴티티를 검증하기 위한 방법 및 장치
WO2023159603A1 (zh) 一种安全实现方法及装置、终端设备、网元
WO2018076377A1 (zh) 一种数据传输方法、终端、节点设备以及系统
WO2024093923A1 (zh) 通信方法和通信装置
CN114339688A (zh) 用于ue与边缘数据网络的认证的装置和方法
WO2023178691A1 (zh) 安全实现方法、装置、设备及网元
CN117812590A (zh) 一种通信方法及装置、计算机可读存储介质和通信系统
CN114930769B (zh) 本地通信的方法、装置和系统
CN113472714A (zh) 认证终端设备的方法及装置
CN115412911A (zh) 一种鉴权方法、通信装置和系统
CN116528234B (zh) 一种虚拟机的安全可信验证方法及装置
WO2023178686A1 (zh) 安全实现方法、装置、终端设备、网元、及凭证生成设备
WO2023178689A1 (zh) 安全实现方法及装置、设备、网元
CN118487746A (zh) 一种通信方法及通信装置
US20250284814A1 (en) Trustworthiness measurement method and apparatus, and system
EP4362516B1 (en) Wireless communication method and apparatus
CN119031363B (zh) 一种基于数据安全的应急管理方法及系统
CN117715040B (zh) Dplc模组的配网通信方法及装置
CN121312170A (zh) 基于应用认证和密钥管理（akma）的静默双因素认证
KR20260059574A (ko) 서비스 api 호출 방법 및 장치

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22932747

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 202280093802.4

Country of ref document: CN

WWE Wipo information: entry into national phase

Ref document number: 2022932747

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2022932747

Country of ref document: EP

Effective date: 20241025