WO2024235111A1 - 一种通信方法和通信装置 - Google Patents

一种通信方法和通信装置 Download PDF

Info

Publication number
WO2024235111A1
WO2024235111A1 PCT/CN2024/092241 CN2024092241W WO2024235111A1 WO 2024235111 A1 WO2024235111 A1 WO 2024235111A1 CN 2024092241 W CN2024092241 W CN 2024092241W WO 2024235111 A1 WO2024235111 A1 WO 2024235111A1
Authority
WO
WIPO (PCT)
Prior art keywords
address
terminal device
request message
port number
private
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2024/092241
Other languages
English (en)
French (fr)
Inventor
吴义壮
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Priority to EP24806463.6A priority Critical patent/EP4697649A4/en
Publication of WO2024235111A1 publication Critical patent/WO2024235111A1/zh
Priority to US19/388,207 priority patent/US20260075111A1/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0807—Network architectures or network communication protocols for network security for authentication of entities using tickets, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H04L61/2514—Translation of Internet protocol [IP] addresses between local and global IP addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/14—Session management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/10—Mapping addresses of different types
    • H04L61/103—Mapping addresses of different types across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H04L61/2517—Translation of Internet protocol [IP] addresses using port numbers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/45—Network directories; Name-to-address mapping
    • H04L61/4541—Directories for service discovery
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/45—Network directories; Name-to-address mapping
    • H04L61/4588—Network directories; Name-to-address mapping containing mobile subscriber information, e.g. home subscriber server [HSS]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/50—Address allocation
    • H04L61/5007—Internet protocol [IP] addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W24/00—Supervisory, monitoring or testing arrangements
    • H04W24/02—Arrangements for optimising operational condition
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2101/00—Indexing scheme associated with group H04L61/00
    • H04L2101/60—Types of network addresses
    • H04L2101/618—Details of network addresses
    • H04L2101/663—Transport layer addresses, e.g. aspects of transmission control protocol [TCP] or user datagram protocol [UDP] ports

Definitions

  • the present application relates to the field of communications, and more specifically, to a communication method and a communication device.
  • the architecture In order to enable edge applications on the 3rd Generation Partnership Project (3GPP) network, the architecture, processes and information flows for enabling edge applications are defined. Specifically, in order to obtain an identifier that uniquely identifies a terminal device, the edge enabler server (EES) in the architecture that enables edge applications opens a terminal device identifier application programming interface (API) to the edge application server (EAS) and the edge enabler client (EEC).
  • the terminal device identifier API is used by EAS or EEC to obtain the identification of the terminal device from EES.
  • EEC calling the terminal device identifier API can be used in the following scenario: EAS directly calls the terminal device identifier API to EES. When the terminal device identifier fails to be obtained, EAS can choose to send signaling to the application client (AC) to enable AC to initiate a terminal device identifier query to EEC. Further, EEC uses the Internet Protocol (IP) address allocated by the core network to call the terminal device identifier API of EES to obtain the terminal device identifier, and sends the obtained terminal device identifier to EAS through AC.
  • IP Internet Protocol
  • the present application provides a communication method and a communication device, in order to improve the security of EEC obtaining terminal device identifiers.
  • the present application provides a communication method.
  • the method may be executed by an edge enabling server, or by a component (such as a chip or circuit) of the edge enabling server, and the present application does not limit this.
  • the communication method includes: receiving a first request message from a terminal device, the first request message is used to obtain an identifier of the terminal device, and the first request message includes a first private address of the terminal device; obtaining a public address and a port number of the terminal device, and sending a second request message to a network open function network element, the second request message is used to obtain an identifier of the terminal device, and the second request message includes the first private address, the public address and the port number; receiving first indication information from the network open function network element or the identifier of the terminal device, the first indication information is used to indicate that the identifier of the terminal device has failed to be obtained.
  • the request message for obtaining the terminal device sent to the network open function network element carries the first private address received from the terminal device, as well as the obtained public address and port number.
  • This enables the network open function network element to determine whether the first private address provided by the terminal device is accurate based on the received public address and port number, so as to decide whether to provide the terminal device with an identifier of the terminal device, and avoid providing the terminal device with an identifier of the terminal device when the first private address provided by the terminal device is inaccurate, thereby improving the security of the terminal device obtaining the identifier of the terminal device.
  • the receiving a first request message from the terminal device includes: receiving an Internet Protocol IP data packet from a user plane function network element, wherein a payload portion of the IP data packet includes the first request message from the terminal device;
  • the obtaining of the public address and the port number comprises: determining the public address and the port number according to the source address and the source port number of the IP data packet, wherein the source address is used to characterize the public address, and the source port number is used to characterize the port number.
  • the obtaining the public address and the port number further includes: obtaining the public address and the port number from an edge application server.
  • the edge enabling server can obtain the required public address and the port number in different ways, thereby improving the flexibility of the solution and meeting different application scenarios.
  • the method when receiving the terminal device from the network open function network element
  • the method further includes: receiving a cause value of the terminal device from the network open function network element, the cause value being used to indicate a reason why the terminal device failed to obtain an identifier.
  • the first indication information and the cause value may be carried in the second response message.
  • the reason for the failure to acquire the terminal device identifier can be indicated by carrying a reason value in the first response message, so that the edge enabling server can correctly process the EEC request according to the reason value.
  • the method when receiving the identifier of the terminal device from the network open function network element, the method also includes: sending a first response message to the terminal device, the first response message including the identifier of the terminal device.
  • sending the second request message to the network open function network element includes: sending the second request message to the network open function network element when the terminal device is not authenticated.
  • the present application provides a communication method.
  • the method may be executed by a network open function network element, or by a component (such as a chip or circuit) of the network open function network element, and the present application does not limit this.
  • the communication method includes: receiving a second request message from an edge enabling server, the second request message is used to obtain an identifier of a terminal device, the second request message includes a first private address of the terminal device, a public address and a port number of the terminal device; when it is determined that the first private address is valid based on the public address and the port number, obtaining the identifier of the terminal device, and sending the identifier of the terminal device to the edge enabling server.
  • the edge enabling server sends a request message for obtaining the terminal device to the network open function network element, which carries the first private address received from the terminal device, as well as the public address and port number obtained by itself.
  • This allows the network open function network element to determine whether the first private address provided by the terminal device is accurate based on the received public address and port number, so as to decide whether to provide the terminal device with an identifier of the terminal device, and avoid providing the terminal device with an identifier of the terminal device when the first private address provided by the terminal device is inaccurate, thereby improving the security of the terminal device in obtaining the terminal device identifier.
  • first indication information is sent to the edge enabling server, where the first indication information is used to indicate that the identifier acquisition of the terminal device failed.
  • the method further includes: determining whether the first private address is valid according to the public address and the port number.
  • determining whether the first private address is valid based on the public address and the port number includes: whether the first private address is the same as the second private address, wherein the second private address is determined based on the public address and the port number.
  • the method also includes: sending a third request message to the user plane function network element, the third request message including the public address and the port number; receiving a third response message from the user plane function network element, the third response message including the second private address.
  • the method also includes: the method also includes: obtaining at least one private address corresponding to the public network address, and a port number corresponding to the at least one private address; obtaining the second private address based on the at least one private address and the port number corresponding to the at least one private address obtained, and the port number in the second request message.
  • the method further includes: sending a fourth request message to a user plane function network element, the fourth request message including the public address; receiving a fourth response message from the user plane function network element, the fourth response message including at least one private address corresponding to the public address, and a port number corresponding to the at least one private address.
  • sending a fourth request message to a user plane function network element querying at least one private address corresponding to the public network address and a port number corresponding to the at least one private address that are not stored locally.
  • the method further includes: sending a subscription request message to a user plane function network element, the subscription request message including the public address; receiving one or more subscription response messages from the user plane function network element, the one or more subscription response messages including at least one private address corresponding to the public address, and a port number corresponding to the at least one private address.
  • sending a subscription request message to a user plane function network element the subscription request message including the public address
  • receiving one or more subscription response messages from the user plane function network element the one or more subscription response messages including at least one private address corresponding to the public address, and a port number corresponding to the at least one private address.
  • the method also includes: sending a fifth request message to the user plane function network element, the fifth request message including the first private address, the public address and the port number, the fifth request message being used to request the user plane function network element to determine whether the first private address is valid; receiving a fifth response message from the user plane function network element, the fifth response message being used to indicate whether the first private address is valid.
  • the network open function network element can verify the first private address provided by the terminal device in different ways. For example, it can query the user plane function network element based on the received public address and port number to obtain the second private address corresponding to the public address and port number, and then verify the first private address based on the second private address obtained from the user plane function network element; for another example, it can obtain at least one private address corresponding to the public address and the port number corresponding to the at least one private address from the user plane function network element based on the received public address, and then verify the first private address based on the at least one private address obtained from the user plane function network element and the port number corresponding to the at least one private address; for another example, the received first private address, public address and port number can be provided to the user plane function network element, and the user plane function network element verifies the first private address and provides the verification result to the network open function network element. Providing different verification methods improves the flexibility of the scheme.
  • the method also includes: sending a discovery request message to a network function repository function network element, the discovery request message including the public address, and the discovery request message being used to obtain the address of a user plane function network element that implements an address conversion function; receiving a discovery response message from the network function repository function network element, the discovery response message including the address of the user plane function network element.
  • the method when sending the first indication information to the edge enabling server, the method further includes: sending a reason value to the edge enabling server, where the reason value is used to indicate a reason for failure to obtain an identifier of the terminal device.
  • the present application provides a communication method, which can be executed by a user plane functional network element or by a component of the user plane functional network element (such as a chip or circuit), and the present application does not limit this.
  • the communication method includes: receiving a third request message from a network open function network element, the third request message is used to obtain a second private Internet Protocol address of a terminal device, the third request message includes a public address and a port number of the terminal device; determining the second private address of the terminal device according to the public address and the port number; and sending a third response message to the network open function network element, the third response message includes the second private address.
  • the present application provides a communication method.
  • the method may be executed by a user plane function network element, or by a component (such as a chip or circuit) of the user plane function network element, and the present application does not limit this.
  • receiving a subscription request message from the network open function network element the subscription request message including a first public Internet interconnection protocol address of the terminal device; sending one or more subscription response messages to the network open function network element, the one or more subscription response messages including at least one private address corresponding to the public address, and a port number corresponding to the at least one private address.
  • the present application provides a communication method.
  • the method may be executed by a user plane function network element, or by a component (such as a chip or circuit) of the user plane function network element, and the present application does not limit this.
  • the communication method includes: receiving a fifth request message from a network open function network element, the fifth request message including a first private Internet interconnection protocol address of a terminal device, a public address and a port number of the terminal device, the fifth request message being used to request the user plane function network element to determine whether the first private address is valid; determining whether the first private address is valid according to a correspondence relationship among a locally stored private address, a public address and a port number; and sending a fifth response message to the network open function network element, the fifth response message being used to indicate whether the first private address is valid.
  • determining whether the first private address is valid based on the correspondence between the locally stored private address, public address and port number includes: determining the public address and port number corresponding to the first private address based on the correspondence and the first private address; if the public address and port number corresponding to the first private address are the same as the public address and port number, the fifth response message is used to indicate that the first private address is valid; otherwise, the fifth response message is used to indicate that the first private address is invalid.
  • the private address, public address and port number stored locally The fifth response message is used to indicate that the first private address is invalid.
  • determining whether the first private address is valid based on the correspondence between the locally stored private address, public address and port number includes: determining the private address corresponding to the public address and the port number based on the correspondence, the public address and the port number; if the private address corresponding to the public address and the port number is the same as the first private address and port number, the fifth response message is used to indicate that the first private address is valid; otherwise, the fifth response message is used to indicate that the first private address is invalid.
  • a communication device which is used to implement the method shown in the first aspect.
  • the device includes: a transceiver unit and a processing unit, wherein the transceiver unit is used to send and receive information, and the processing unit is used to perform internal processing actions.
  • a communication device which is used to implement the method shown in the second aspect.
  • the device includes: a transceiver unit and a processing unit, wherein the transceiver unit is used to send and receive information, and the processing unit is used to perform internal processing actions.
  • a communication device which is used to implement the methods shown in the third to fifth aspects above.
  • the device includes: a transceiver unit and a processing unit, wherein the transceiver unit is used to send and receive information, and the processing unit is used to perform internal processing actions.
  • the present application provides a communication method.
  • the method may be executed by an edge application server, or by a component (such as a chip or circuit) of the edge application server, and the present application does not limit this.
  • the communication method includes: receiving second indication information from an edge enabling server, the second indication information being used to indicate whether an edge enabling client in a terminal device and/or the terminal device are authenticated; in a case where the edge enabling client and/or the terminal device are not authenticated, sending a sixth request message to the edge enabling server, the sixth request message being used to obtain an identifier of the terminal device, the sixth request message including a public address and a port number of the terminal device.
  • the method before receiving the second indication information from the edge enabling server, the method also includes: sending a seventh request message to the edge enabling server, the seventh request message being used to obtain an identifier of the terminal device, the seventh request message including the public address of the terminal device; the receiving the second indication information from the edge enabling server includes: receiving a seventh response message from the edge enabling server, the seventh response message being used to indicate that the identifier of the terminal device has failed to be obtained, and the seventh response message including the second indication information.
  • the seventh request message includes third indication information, and the third indication information is used to indicate that the edge application server has the ability to obtain the identifier of the terminal device through the edge enabling client.
  • the present application provides a communication method.
  • the method may be executed by an edge enabling server, or by a component (such as a chip or circuit) of the edge enabling server, and the present application does not limit this.
  • the communication method includes: sending second indication information to an edge application server, wherein the second indication information is used to indicate whether an edge-enabled client in a terminal device and/or the terminal device is authenticated; when the edge-enabled client and/or the terminal device is not authenticated, receiving a sixth request message from the edge application server, wherein the sixth request message is used to obtain an identifier of the terminal device, and the sixth request message includes a public address and a port number of the terminal device.
  • the method before sending the second indication information to the edge application server, the method also includes: receiving a seventh request message from the edge application server, the seventh request message being used to obtain an identifier of the terminal device, the seventh request message including a public address of the terminal device; sending the second indication information to the edge application server includes: sending a seventh response message to the edge application server, the seventh response message being used to indicate that the identifier of the terminal device has failed to be obtained, and the seventh response message including the second indication information.
  • the seventh request message includes third indication information, and the third indication information is used to indicate that the edge application server has the ability to obtain the identifier of the terminal device through the edge enabling client.
  • the method before determining whether the edge enabling client in the terminal device and/or the terminal device is authenticated, the method further includes: determining whether the edge application server has the ability to obtain the authentication information through the edge enabling client; The ability to obtain the identifier of the terminal device.
  • a communication device which is used to implement the method shown in the ninth aspect.
  • the device includes: a transceiver unit and a processing unit, wherein the transceiver unit is used to send and receive information, and the processing unit is used to perform internal processing actions.
  • a communication device which is used to implement the method shown in the tenth aspect.
  • the device includes: a transceiver unit and a processing unit, wherein the transceiver unit is used to send and receive information, and the processing unit is used to perform internal processing actions.
  • the present application provides a communication method.
  • the method can be executed by an edge enabling server, or by a component (such as a chip or circuit) of the edge enabling server, and the present application does not limit this.
  • the communication method includes: receiving a first request message from a terminal device, the first request message being used to obtain an identifier of the terminal device, the first request message including a first private address of the terminal device; determining whether an edge-enabled client of the terminal device and/or the terminal device is authenticated; and if the edge-enabled client and/or the terminal device are not authenticated, obtaining a public address and a port number of the terminal device, and obtaining an identifier of the terminal device based on the public address and the port number.
  • the method further includes: sending a first response message to the terminal device, the first response message including an identifier of the terminal device.
  • a communication device which is used to implement the method shown in the above thirteenth aspect.
  • the device includes: a transceiver unit and a processing unit, wherein the transceiver unit is used to send and receive information, and the processing unit is used to perform internal processing actions.
  • a communication system including an edge enabling server, a network open function network element and a user plane function network element, wherein the edge enabling server is used to execute the method shown in the first aspect above, the network open function network element executes the method shown in the second aspect above, and the user plane function network element executes the method shown in the third aspect above.
  • a communication system comprising an edge application server and an edge enabling server, wherein the edge application server is used to execute the method shown in the above ninth aspect, and the edge enabling server is used to execute the method shown in the above tenth aspect.
  • a communication device which includes: a memory for storing programs; a processor for executing the programs stored in the memory, and when the programs stored in the memory are executed, the processor is used to execute the methods provided in the above aspects.
  • the present application provides a processor for executing the methods provided in the above aspects.
  • the process of sending the above information and obtaining/receiving the above information in the above methods can be understood as the process of the processor outputting the above information and the process of the processor receiving the input above information.
  • the processor When outputting the above information, the processor outputs the above information to the transceiver so that it can be transmitted by the transceiver. After being output by the processor, the above information may also need to be processed otherwise before reaching the transceiver.
  • the transceiver obtains/receives the above information and inputs it into the processor. Furthermore, after the transceiver receives the above information, the above information may need to be processed otherwise before being input into the processor.
  • the receiving request message mentioned in the above method can be understood as the processor receiving input information.
  • the processor may be a processor specifically used to execute these methods, or may be a processor that executes computer instructions in a memory to execute these methods, such as a general-purpose processor.
  • the memory may be a non-transitory memory, such as a read-only memory (ROM), which may be integrated with the processor on the same chip or may be separately arranged on different chips.
  • ROM read-only memory
  • a computer-readable storage medium which stores a program code for execution by a device, wherein the program code includes a method for executing the methods provided in the above aspects.
  • a computer program product comprising instructions is provided.
  • the computer program product is run on a computer, the computer is used to execute the methods provided in the above aspects.
  • a chip which includes a processor and a communication interface, and the processor reads instructions stored in a memory through the communication interface to execute the methods provided in the above aspects.
  • the chip may further include a memory, in which instructions are stored, and the processor is used to execute the instructions stored in the memory.
  • the processor is used to execute the methods provided by the above aspects.
  • FIG1 is a schematic diagram of the architecture of a communication system 100 used in an embodiment of the present application.
  • FIG2 is a schematic diagram of the architecture of a communication system 200 used in an embodiment of the present application.
  • FIG. 3 is a schematic flow chart of the EEC calling the UE identifier API.
  • FIG. 4 is a schematic flow chart of an EES acquiring a UE identifier.
  • FIG5 is a schematic flow chart of an EEC providing IP address verification provided by the present application.
  • FIG6 is a schematic flow chart of a communication method provided in the present application.
  • FIG. 7 is a schematic diagram of the UPF performing NAT provided by this application.
  • FIG. 7 is a schematic flowchart of another communication method provided in the present application.
  • FIG8 is a schematic flow chart of yet another communication method provided in the present application.
  • FIG. 9 is a schematic block diagram of a communication device 10 provided in an embodiment of the present application.
  • FIG. 10 is a schematic diagram of another communication device 20 provided in an embodiment of the present application.
  • FIG. 11 is a schematic diagram of a chip system 30 provided in an embodiment of the present application.
  • the technical solutions of the embodiments of the present application can be applied to various communication systems, for example: the fifth generation ( 5th generation, 5G) mobile communication system, the new radio access technology (new radio access technology, NR) system, the long term evolution (long term evolution, LTE) system, the LTE frequency division duplex (frequency division duplex, FDD) system, the LTE time division duplex (time division duplex, TDD), the universal mobile telecommunication system (universal mobile telecommunication system, UMTS), or the world-wide interoperability for microwave access (worldwide interoperability for microwave access, WiMAX) communication system.
  • the mobile communication system may include non-standalone (NSA) and/or standalone (SA).
  • SA standalone
  • the technical solutions provided in the present application may be applied to future communication systems, such as the sixth generation mobile communication system.
  • the present application is not limited to this.
  • the technical solution provided in the present application can also be applied to machine type communication (MTC), Long Term Evolution-machine (LTE-M), device-to-device (D2D) network, machine-to-machine (M2M) network, Internet of Things (IoT) network or other networks.
  • MTC machine type communication
  • LTE-M Long Term Evolution-machine
  • D2D device-to-device
  • M2M machine-to-machine
  • IoT Internet of Things
  • IoT network can include vehicle networking, for example.
  • the communication mode in the vehicle networking system is collectively referred to as vehicle to other devices (vehicle to X, V2X, X can represent anything), for example, the V2X can include: vehicle to vehicle (vehicle to vehicle, V2V) communication, vehicle to infrastructure (vehicle to infrastructure, V2I) communication, vehicle to pedestrian (vehicle to pedestrian, V2P) communication or vehicle to network (vehicle to network, V2N) communication, etc.
  • vehicle to vehicle vehicle to vehicle, V2V
  • V2I vehicle to infrastructure
  • V2P vehicle to pedestrian
  • V2N vehicle to network
  • MEC mobile edge computing
  • FIG1 is a schematic diagram of the architecture of a communication system 100 used in an embodiment of the present application.
  • the communication system includes a terminal 110, a core network 120, an edge data network (EDN) 130, and an edge configuration server (ECS) 140.
  • the terminal 110 can be deployed with one or more application clients (AC) 111 and one or more edge enabler clients (EEC) 112, and the EDN 130 can be deployed with one or more edge application servers (EAS) 131 and one or more edge enabler servers (EES) 132.
  • AC application clients
  • EEC edge enabler clients
  • EAS edge application servers
  • EAS edge enabler servers
  • the EDGE-1 interface is the interface between EES132 and EEC112
  • the EDGE-2 interface is the interface between EES132 and the core network 120
  • the EDGE-3 interface is the interface between EAS131 and EES132
  • the EDGE-4 interface is the interface between EEC112 and ECS140
  • the EDGE-5 interface is the interface between AC111 and EEC112
  • the EDGE-6 interface is the interface between EES132 and ECS140
  • the EDGE-7 interface is the interface between EAS131 and the core network 120
  • the EDGE-8 interface is the interface between ECS140 and the core network 120
  • the EDGE-9 interface is the interface between EES132.
  • Figure 1 is only a schematic diagram, and the communication system may also include other network devices, which are not drawn in Figure 1.
  • the application user signs a service agreement with the application provider, so that the application user can be provided with services.
  • the application user can log in to AC111 on the terminal 110 and communicate with EAS131 through AC111.
  • EEC112 is a middleware layer, which is generally located in the operating system, or between AC111 and the operating system.
  • AC111 can be used in the form of application programming interface (API). Get edge enabling services from EEC112.
  • the architecture shown in Figure 1 can be used for terminal devices in the 3rd Generation Partnership Project (3GPP) network to discover edge applications deployed at the near end.
  • 3GPP 3rd Generation Partnership Project
  • the functional entities in the architecture are briefly described as follows:
  • EDN It is a local data network that includes EES and EAS.
  • EDN corresponds to only one data network, which is a special local data network that includes edge enabling functions. It can be identified by the data network access identifier (DNAI) and the data network name (DNN), and is a network logical concept.
  • DNAI data network access identifier
  • DNN data network name
  • EDN is the equivalent concept of the central cloud, which can be understood as a local data center (geographical location concept), which can be identified by DNAI and can contain one or more local data networks.
  • EAS An application deployed in EDN can be called EAS.
  • EAS can refer to an instance of a server application (e.g., social media software, augmented reality (AR), virtual reality (VR)) deployed and running in EDN.
  • a server application e.g., social media software, augmented reality (AR), virtual reality (VR) deployed and running in EDN.
  • AR augmented reality
  • VR virtual reality
  • One application can deploy one or more EAS in one or more EDNs.
  • EAS deployed and running in different EDNs can be considered as different EAS of one application, which can share a domain name, use a single IP address, or use different IP addresses.
  • EAS can also be called edge application, edge application server, application instance, edge application instance, MEC application, MEC application server, EAS function, etc., which is not limited in this application. For the convenience of description, it is uniformly referred to as edge application server below.
  • AC It is the peer entity of the application server on the terminal side, used by the application user to obtain application services from the application server.
  • AC can be a client program applied on the terminal side, which can connect to the application server on the cloud to obtain application services, or it can connect to the EAS deployed and running in one or more EDNs to obtain application services.
  • AC can also be called an application client, which is not limited in this application.
  • EES Provides the necessary functions for ECS and EAS, such as providing configuration information to EEC, enabling UE to exchange application data with EAS, supporting the transmission of application context, etc.
  • EES can interact directly or indirectly with the 3GPP network.
  • EAS can initiate a registration process to EES and register EAS information to EES, or EAS information can be registered to EES through the management system, and EES manages the EAS registered on the EES.
  • EES can support the registration of edge application servers, authentication and authorization of terminals, and provide IP address information of edge application servers to terminals.
  • EES can also support obtaining the identification and IP address information of edge application servers, and support further sending the obtained identification and IP address information to ECS.
  • EES is deployed in EDN.
  • an EAS is registered on an EES, or the information of an EAS is configured on an EES through a management system.
  • the EES is called the EES associated with the EAS, or the EAS is called the EAS associated with the EES.
  • the EES controls or manages the EAS registered or configured on the EES.
  • the EAS associated with EES may also be replaced with the EAS corresponding to the EES, and the EES associated with EAS may also be replaced with the EES corresponding to the EAS, which is not limited in this application.
  • EEC used to discover available EAS in the EDN network. It is the peer entity of EES on the terminal side. EEC can be used to register EEC information and AC information with EES, perform security authentication and authorization, obtain EAS IP address from EES, provide edge computing enabling capabilities to AC, etc. For example, EEC can return EAS IP address to AC through EAS discovery service.
  • ECS used to provide EES information to EEC, which can be deployed by operators or third parties.
  • Application users communicate through the connection between the application client and EAS.
  • the edge enabling client is a middleware layer, which is generally located in the operating system, or between the application client and the operating system.
  • AC can obtain edge enabling services from EEC in the form of API.
  • ECS is mainly responsible for the configuration of EDN.
  • ECS can provide EES information to the terminal.
  • ECS can also interact with the application's DNS to obtain EAS information, and provide EAS information directly to the terminal.
  • ECS can also obtain and save EAS and IP address information from other functional entities.
  • Terminal It can also be called terminal device, user equipment (UE), mobile station, mobile terminal, etc.
  • Terminals can be widely used in various scenarios, such as device-to-device (D2D), vehicle to everything (V2X) communication, machine-type communication (MTC), Internet of Things (IoT), virtual reality, augmented reality, industrial control, automatic driving, telemedicine, smart grid, smart furniture, smart office, smart wear, smart transportation, smart city, etc.
  • the terminal can be a mobile phone, a tablet computer, a computer with wireless transceiver function, a wearable device, a vehicle, a drone, a helicopter, an airplane, a ship, a robot, a mechanical arm, a smart home device, etc.
  • the embodiments of the present application do not limit the specific technology and specific device form adopted by the terminal.
  • the core network 120 shown in FIG. 1 may be a system architecture of a 5G core network (5G core, 5GC).
  • 5G core 5G core
  • 5GC 5G core network
  • the system architecture of 5GC is briefly introduced below in conjunction with FIG. 2 .
  • FIG2 is a schematic diagram of a network architecture 200 provided by the present application, taking the 5G network architecture based on a service-oriented architecture in a non-roaming scenario defined in the 3GPP standardization process as an example.
  • the network architecture may include three parts, namely, a terminal device part, a DN, and an operator network public land mobile network (PLMN) part.
  • PLMN public land mobile network
  • the terminal device part may include a terminal device 210.
  • the terminal device 210 is described with reference to the description of the terminal 110 in FIG. 1 above, and will not be described again here.
  • the PLMN part of the operator network may include but is not limited to the (radio) access network ((radio) access network, (R)AN) 220 and the core network (core network, CN).
  • (radio) access network (radio) access network, (R)AN) 220
  • core network core network, CN
  • (R)AN 220 can be regarded as a sub-network of the operator network, and is an implementation system between the service nodes (e.g., network elements providing services) in the operator network and the terminal device 210.
  • the terminal device 210 To access the operator network, the terminal device 210 first passes through (R)AN 220, and then can be connected to the service nodes of the operator network through (R)AN 220.
  • the access network device (RAN device) in the embodiment of the present application is a device that provides wireless communication functions for the terminal device 210, and can also be called a network device.
  • the RAN device includes but is not limited to: the next generation node base station (gNB) in the 5G system, the evolved node B (eNB) in the long term evolution (LTE), the radio network controller (RNC), the node B (NB), the base station controller (BSC), the base transceiver station (BTS), the home base station (e.g., home evolved node B, or home node B, HNB), the base band unit (BBU), the transmission point (TRP), the transmitting point (TP), the small base station device (pico), the mobile switching center, or the network device in the future network.
  • the name of the device with the access network device function may be different.
  • the above-mentioned device providing wireless communication function for the terminal device 210 is collectively referred to as access network equipment or RAN or AN for short. It should be understood that the specific type of access network equipment is not limited herein.
  • the CN part may include but is not limited to the following NFs: user plane function (UPF) 230, network exposure function (NEF) 231, network function repository function (NRF) 232, policy control function (PCF) 233, unified data management function (UDM) 234, unified data repository function (UDR) 235, binding support function (BSF) 236, authentication server function (AUSF) 237, access and mobility management function (AMF) 238, session management function (SMF) 239.
  • UPF user plane function
  • NEF network exposure function
  • NRF network function repository function
  • PCF policy control function
  • UDM unified data management function
  • UDR unified data repository function
  • BSF binding support function
  • AUSF authentication server function
  • AMF access and mobility management function
  • SMSF session management function
  • the data network DN 240 which may also be referred to as a packet data network (PDN), is usually a network located outside the operator network, such as a third-party network.
  • the DN may also be deployed by the operator. This application does not restrict whether the DN is deployed by the operator.
  • the operator network PLMN may access multiple data networks DN 240, and multiple services may be deployed on the data network DN 240, which may provide data and/or voice services to the terminal device 210.
  • the data network DN 240 may be a private network of a smart factory, and the sensors installed in the workshop of the smart factory may be the terminal devices 210.
  • the control server of the sensors is deployed in the data network DN 240, and the control server may provide services for the sensors.
  • the sensors may communicate with the control server, obtain instructions from the control server, and transmit the collected sensor data to the control server according to the instructions.
  • the data network DN 240 may be an internal office network of a company, and the mobile phones or computers of the company's employees may be the terminal devices 210, and the employees' mobile phones or computers may access information, data resources, etc. on the company's internal office network.
  • the terminal device 210 can establish a connection with the operator network through an interface (such as N1, etc.) provided by the operator network and use data and/or voice services provided by the operator network.
  • the terminal device 210 can also access the data network DN 240 through the operator network and use the operator services deployed on the data network DN 240 and/or services provided by a third party.
  • UPF It is a gateway provided by the operator and is the gateway for the operator network to communicate with the data network DN 240.
  • UPF includes functions related to the user plane, such as packet routing and transmission, packet detection, service usage reporting, quality of service (QoS) processing, legal monitoring, uplink packet detection, and downlink packet storage.
  • QoS quality of service
  • NEF It is a control plane function provided by the operator, which mainly enables third parties to use the services provided by the network, supports the network to open its capabilities, event and data analysis, converts the security configuration information from external applications to PLMN, and the interactive information inside and outside the PLMN, provides the operator network with an open API interface, and provides it for the interaction between external servers and internal operator networks.
  • NRF It is a control plane function provided by the operator, which can be used to maintain real-time information of network functions and services in the network. For example, it supports network service discovery, maintains the NF configuration data (NF profile) of NF instances, supports service discovery of communication agents (service communication proxy, SCP), maintains the SCP configuration data (SCP profile) of SCP instances, sends information about newly registered Registration, deregistration, and update of NF and SCP notifications, and maintenance of the healthy status of NF and SCP operations.
  • NF profile NF configuration data
  • SCP service communication proxy
  • PCF It is a control plane function provided by the operator. It supports a unified policy framework to govern network behavior, provide policy rules to other control functions, and contract information related to policy decisions.
  • UDM It is a control plane function provided by the operator, responsible for storing the subscriber permanent identifier (SUPI), generic public subscription identifier (GPSI), credentials and other information of the subscribers in the operator network.
  • the SUPI will be encrypted during transmission, and the encrypted SUPI is called the hidden subscriber subscription identifier (SUCI).
  • the information stored in UDM can be used for authentication and authorization of terminal equipment to access the operator network.
  • the subscribers of the above-mentioned operator network can specifically be users who use the services provided by the operator network, such as users who use China Telecom's subscriber identity module (SIM) card, or users who use China Mobile's SIM card.
  • SIM subscriber identity module
  • the credentials of the above-mentioned subscribers can be a small file storing long-term keys stored in the SIM card or information related to SIM card encryption, which is used for authentication and/or authorization. It should be noted that permanent identifiers, credentials, security contexts, authentication data (cookies), and tokens are equivalent to verification/authentication and authorization-related information. In the embodiments of the present application, no distinction or restriction is made for the sake of convenience of description.
  • UDR It is a control plane function provided by the operator. It provides the functions of storing and retrieving contract data for UDM, storing and retrieving policy data for PCF, and storing and retrieving user’s NF group ID (group ID) information.
  • BSF Mainly used to store the internal information corresponding to the selected PCF. Specifically, for a protocol data unit (PDU) session, the internal information stored by BSF includes user identification (such as SUPI), DNN, UE address (IP address or MAC address), etc. For a UE, the internal information stored by BSF includes user identification, selected PCF address, etc.
  • PDU protocol data unit
  • BSF is mainly responsible for session information binding. Therefore, in this application, BSF can also be understood as a network element with session information binding function.
  • the network element with session information binding function is called BSF only as an example. There may be other network element names in the future, and this application does not limit this.
  • AUSF It is a control plane function provided by the operator, usually used for primary authentication, that is, authentication between the terminal device 110 (subscriber) and the operator network. After receiving the authentication request initiated by the subscriber, AUSF can authenticate and/or authorize the subscriber through the authentication information and/or authorization information stored in the UDM, or generate the authentication and/or authorization information of the subscriber through the UDM. AUSF can feedback the authentication information and/or authorization information to the subscriber.
  • AMF It is a control plane network function provided by the operator network, responsible for the access control and mobility management of terminal devices accessing the operator network, such as mobile state management, allocation of user temporary identity, authentication and authorization of users, etc.
  • AMF is used to establish NAS connection with UE and has the same 5G NAS security context as UE.
  • 5G NAS security context includes K AMF , key identification information with the same NAS layer key, UE security capability, and uplink and downlink NAS COUNT values.
  • NAS layer keys include NAS encryption keys and NAS integrity protection keys, which are used for confidentiality protection and integrity protection of NAS messages respectively.
  • SMF It is a control plane network function provided by the operator network, responsible for managing the PDU session of the terminal device.
  • the PDU session is a channel for transmitting PDU.
  • the terminal device needs to transmit PDU to and from the data network DN through the PDU session.
  • the PDU session is established, maintained and deleted by SMF.
  • SMF includes session management (such as session establishment, modification and release, including tunnel maintenance between the user plane function UPF 130 and (R)AN 120), UPF selection and control, service and session continuity (SSC) mode selection, roaming and other session-related functions.
  • AF It is a control plane network function provided by the operator network, which is used to provide application layer information. It can interact with the policy framework through network open function elements or directly interact with the policy framework to make policy decision requests, etc. It can be located inside or outside the operator network.
  • network elements or functions can be physical entities in hardware devices, software instances running on dedicated hardware, or virtualized functions instantiated on a shared platform (e.g., a cloud platform).
  • a shared platform e.g., a cloud platform.
  • an NF can be implemented by hardware or software.
  • Nnef, Nnrf, Npcf, Nudm, Nudr, Nnwdaf, Nausf, Namf, Nsmf, N1, N2, N3, N4, and N6 are interface serial numbers.
  • the meaning of the above interface serial numbers can be found in the meaning defined in the 3GPP standard protocol, and this application does not limit the meaning of the above interface serial numbers.
  • the interface name between the various network functions in the figure is only an example.
  • the interface name of the system architecture may also be other names, which is not limited in this application.
  • the name of the message (or signaling) transmitted between the above network elements is only an example and does not constitute any limitation on the function of the message itself.
  • network functions (such as NEF...SMF, etc.) are collectively referred to as NFs, that is, the NFs described later in the embodiments of the present application can be replaced by any network function.
  • FIG. 2 only schematically describes some network functions, and the NFs described later are not limited to the network functions shown in FIG. 2.
  • the above-mentioned network architecture applied to the embodiment of the present application is only a network architecture described from the perspective of a service-oriented architecture, and the network architecture applicable to the embodiment of the present application is not limited to this. Any network architecture that can realize the functions of the above-mentioned network elements is applicable to the embodiment of the present application.
  • AMF, SMF, UPF, NEF, AUSF, NRF, PCF, and UDM shown in the figure can be understood as network elements used to implement different functions in the core network, for example, they can be combined into network slices as needed.
  • These core network network elements can be independent devices or integrated into the same device to implement different functions. This application does not limit the specific form of the above network elements.
  • Local data network It can be an access point of a data network very close to the user's attachment point.
  • Application context It can refer to the running status information related to one or a group of users, such as game progress, historical data of ML, etc.
  • the application context can also include the subscription context of the one or more users in EAS and the core network, such as the transaction identifier of the subscription, etc.
  • the application context can also include the context of the one or more users on EES, such as the transaction identifier of the subscription of the one or more users by EAS.
  • UE Identifier API In order to obtain the identifier that uniquely identifies the UE (or UE ID), EES opens the UE Identifier API to EAS and EEC. The UE Identifier API is used by EAS or EEC to obtain the UE identifier from EES. The EEC calling the UE Identifier API can be used in the following scenarios:
  • EAS can choose to send signaling to AC to enable AC to initiate a UE ID query to EEC.
  • EEC uses the IP address allocated by the core network (such as IPv4 and/or IPv6) to call the UE identifier API of EES to obtain the UE identifier, and sends the obtained UE identifier to EAS through AC.
  • FIG. 3 is a schematic flow chart of EEC calling UE identifier API, including the following steps:
  • EEC sends a UE identifier API request to EES.
  • the UE identifier API request includes the UE private IP address, which is the IP address provided by the core network to the UE (it can be an IPv4 address or an IPv6 address).
  • the EES obtains a UE identifier.
  • the EES obtains the UE identifier from the core network according to the UE private IP address in the UE identifier API request. How the EES obtains the UE identifier (Identifier, ID) will be described in detail below in conjunction with FIG. 4 , and will not be repeated here.
  • EES sends a UE identifier API response to EEC.
  • the UE identifier API response includes a UE identifier, which is the UE identifier obtained in the above step S320.
  • FIG4 is a schematic flow chart of an EES obtaining a UE identifier, including the following steps:
  • Request message #A is used to request UE ID. For example, AF requests UE ID through Nnef_UEId_Get service operation.
  • the request message #A should include the UE address (such as IP address or MAC address) and AF identifier, and may also include the port number associated with the IP address, application port ID, IP domain, etc.
  • AF can also provide the corresponding data network name (Data Network Name, DNN) and/or single network slice selection assistance information (S-NSSAI).
  • Data Network Name DNN
  • S-NSSAI single network slice selection assistance information
  • NEF authorizes the AF request.
  • NEF If NEF does not authorize the AF request, NEF replies a result value to AF, indicating that the authorization failed; otherwise, NEF continues to perform the following steps.
  • the NEF determines the corresponding DNN and/or S-NSSAI information: the DNN and/or S-NSSAI may be provided by the AF, or may be determined by the NEF based on the AF identifier in the request message #A.
  • the NEF can identify whether the received address is a different IP address from the actual private UE IP address assigned by the 5GC. If they are different IP addresses, the NEF executes steps S430 to S460. Otherwise, steps S430 to S460 are skipped.
  • NEF sends a request message #B to NRF.
  • Request message #B is used to obtain the address of the UPF that implements the NAT function for the UE (public) IP address.
  • the NEF uses the Nnrf_NFDiscovery service operation to obtain the address of the UPF that implements the NAT function.
  • the request message #B includes the UE (public network) IP address, and may also include the DNN and S-NSSAI associated with the AF ID, as well as the IP domain, etc.
  • NRF sends a response message #B to NEF.
  • the response message #B responds to the request message #B, and the response message #B includes the address of the UPF that implements the NAT function for the UE (public) IP address.
  • the NRF sends a Nnrf_NFDiscovery response message to the NEF.
  • NEF sends a request message #C to UPF.
  • Request message #C is used to obtain the UE (private) IP address.
  • NEF sends the Nupf_GetPrivateUEIP_Get service operation to UPF.
  • the request message #C includes the UE (public) IP address and port number, and optionally the IP domain, DNN and S-NSSAI associated with the AF ID.
  • UPF sends a response message #C to NEF.
  • the UE IP address returned by UPF is the UE's private IP address.
  • the request message #D contains the UE address and IP domain and/or DNN and/or S-NSSAI to retrieve the UE's session binding information.
  • the NEF sends the Nbsf_Management_Discovery service operation to the BSF.
  • the response message #D responds to the request message #D above. If the response message #D does not carry SUPI, the NEF replies a Result value to the AF, indicating that the UE ID is unavailable.
  • NEF sends a request message #E to UDM.
  • the NEF interacts with the UDM, for example, to retrieve the AF-specific UE identifier via the Nudm_SDM_Get service operation.
  • the request message #E includes at least one of the SUPI, the Application Port ID or the AF identifier.
  • UDM sends a response message #E to NEF.
  • the NEF responds to the AF with the information received from the UDM, including the external identifier.
  • used for indication may include being used for direct indication and being used for indirect indication.
  • indication information When describing that a certain indication information is used for indicating A, it may include that the indication information directly indicates A or indirectly indicates A, but it does not mean that A must be included in the indication information.
  • the information indicated by the indication information is called the information to be indicated.
  • the information to be indicated can be sent as a whole, or divided into multiple sub-information and sent separately, and the sending period and/or sending time of these sub-information can be the same or different.
  • the specific sending method is not limited in this application. Among them, the sending period and/or sending time of these sub-information can be pre-defined, for example, pre-defined according to the protocol, or can be configured by the transmitting end device by sending configuration information to the receiving end device.
  • the “save” involved in the embodiments of the present application may refer to saving in one or more memories.
  • the memory may be a separate setting or integrated in an encoder or decoder, a processor, or a communication device.
  • the one or more memories may also be partially set separately and partially integrated in a decoder, a processor, or a communication device.
  • the type of memory may be any form of storage medium, which is not limited in this application.
  • the “protocol” involved in the embodiments of the present application may refer to a standard protocol in the communication field, for example, it may include an LTE protocol, an NR protocol, and related protocols used in future communication systems, which is not limited in the present application.
  • RRC radio resource control
  • the term "and/or" in this article is only a description of the association relationship of the associated objects, indicating that there can be three relationships.
  • a and/or B can mean: A exists alone, A and B exist at the same time, and B exists alone.
  • the character "/" in this article generally indicates that the associated objects before and after are in an "or" relationship.
  • FIG5 is a schematic flow chart of an EEC providing IP address verification provided by the present application, comprising the following steps:
  • the SMF or UPF during the PDU session establishment, the SMF or UPF generates a random ticket value during the UE IP address allocation process, sends the ticket value to the PCF, and then stores it in the BSF as part of the PDU session binding information.
  • the ticket value is also sent to the UE.
  • the message #1 includes the above-mentioned ticket value and private IP address.
  • EES calls the UE identifier.
  • EES calls the Nnef_UEId GET service operation with the ticket value and the private network IP address.
  • NEF sends the received ticket value to BSF in the Nbsf_Management_Discovery service operation, and BSF verifies it by checking the mapping relationship between the ticket value and the IP address. If the verification is successful, NEF provides EES with the AF-specific GPSI.
  • the present application provides a communication method, which can be applied in the communication system shown in FIG. 1 , in order to achieve security protection for the EEC to call the UE identifier API without affecting the PDU session establishment process.
  • the embodiments shown below do not particularly limit the specific structure of the execution subject of the method provided in the embodiments of the present application, as long as it is possible to communicate according to the method provided in the embodiments of the present application by running a program that records the code of the method provided in the embodiments of the present application.
  • the execution subject of the method provided in the embodiments of the present application may be a network element, or a functional module in the network element that can call and execute the program.
  • FIG6 is a schematic flow chart of a communication method provided by the present application. The method comprises the following steps:
  • S601 Establish a connection between the edge application server and the application client.
  • one possible way to establish a connection between the edge application server and the application client in this embodiment is: when the terminal user needs to obtain a service, the application client in the terminal device can be operated (e.g., click the application client) so that the application client sends a connection establishment request to the application server providing the service, thereby establishing a connection with the application server. If the application server providing the service obtained by the terminal device is an edge application server, the application client establishes a connection with the edge application server.
  • the edge application server may be the EAS shown in FIG. 1 above. It should be understood that the name of the edge application server is not limited in this embodiment, and any device that can implement the functions of the edge application server in this embodiment may be considered as the edge application server involved in this embodiment. For ease of description, the edge application server is an EAS as an example for explanation below.
  • the application client may be the AC shown in FIG. 1 above. It should be understood that the name of the application client is not limited in this embodiment, and any device that can implement the functions of the application client in this embodiment may be considered as the application client involved in this embodiment. For ease of description, the following description is given by taking the application client as AC as an example.
  • S602 A connection is established between the edge-enabled client and the edge-enabled server.
  • a possible way to establish a connection between the edge usage client and the edge enabling server in this embodiment is: when the application client in the terminal device in step 601 needs to discover the application server providing the service, the application client sends a message to the edge enabling client, so that the edge enabling client interacts with the edge configuration function to obtain the information of the edge enabling server, and further establishes a connection between the edge enabling client and the edge enabling server.
  • the connection can be a connection based on transport layer security, wherein the establishment of the secure connection can be established based on a one-way authentication of a certificate of the edge enabling server, or based on Generic Bootstrapping Architecture (GBA), or based on Authentication and Key Management for Applications (AKMA).
  • GBA Generic Bootstrapping Architecture
  • AKMA Authentication and Key Management for Applications
  • the edge enabling client may be the EEC shown in FIG. 1 above. It should be understood that the name of the edge enabling client is not limited in this embodiment, and any device that can implement the functions of the edge enabling client in this embodiment may be considered as the edge enabling client involved in this embodiment. For ease of description, the following description takes the edge enabling client as an example of EEC.
  • the edge enabling server may be the EES shown in FIG. 1 above. It should be understood that the name of the edge enabling server is not limited in this embodiment, and any device that can implement the functions of the edge enabling server in this embodiment may be considered as the edge enabling server involved in this embodiment. For ease of description, the edge enabling server is an EES as an example for explanation below.
  • the EAS sends a request message #1 to the AC, or in other words, the AC receives the request message #1 from the EAS.
  • EAS when EAS determines to obtain the UE identifier through EEC, EAS sends a request message #1 to AC, and the request message #1 is used to obtain the UE identifier.
  • EAS can choose to send a signal to AC so that AC initiates a UE ID query to EEC, and further EEC calls the UE identifier API of EES to obtain the UE identifier, and sends the obtained UE identifier to EAS through AC.
  • EAS can also initiate a request to AC to obtain the UE identifier in other scenarios.
  • EAS is configured to obtain the UE identifier through AC, which will not be explained one by one here.
  • AC sends request message #2 to EEC, or in other words, EEC receives request message #2 from AC.
  • AC sends a request message #2 to EEC for obtaining UE ID according to request message #1 from EAS, and request message #2 includes the identifier (ID) of EAS.
  • ID the identifier
  • the definition of request message #2 can be found in the current protocol (e.g., section 8.14.2.6 of 3GPP TS 23.558) about the request message sent by AC to EEC for obtaining UE ID, which will not be described in detail in this embodiment.
  • the EEC After the EEC receives the request message #2 for obtaining the UE ID sent by the AC, it sends a first UE identifier API request message to the edge enabling server, and the method shown in FIG6 further includes:
  • the EEC sends a first request message to the EES, or the EES receives the first request message from the EEC, wherein the first request message is used to obtain an identifier of the terminal device.
  • the first request message is a first UE identifier API request message.
  • the following text takes the first request message as an example of a first UE identifier API request message.
  • the specific form of the first request message is not limited in the embodiment of the present application. It can also be a message sent by other EECs to the edge enabling server that can be used to obtain the identifier of the terminal device.
  • the EEC is a terminal device, so the above-mentioned EEC sending the first request message to the EES can also be understood as the terminal device sending the first request message to the EES.
  • the first UE identifier API request message includes the first private address and EAS ID of the terminal device.
  • the first private address of the terminal device can be used to identify the terminal device in the 5GC network, including but not limited to the first private IP address of the terminal device.
  • the first private address of the terminal device is taken as the first private IP address as an example for explanation below, but the specific form of the first private address is not limited in the embodiment of the present application, and it can also be other addresses that can identify the terminal device in the 5GC network (such as MAC address, etc.).
  • the first UE identifier API request message is sent to EES via UPF. If UPF performs NAT processing, the first private IP address of the received IP data packet containing the first UE identifier API request message will be replaced with the public IP address of the UE, and the port number will be set to the port number identifying the terminal device under the public IP address.
  • UPF can receive IP packets containing UE identifier API request messages from different EECs or UEs (e.g., UE/EEC 1 and UE/EEC 2 shown in (a) in FIG7 ), wherein the private IP address of IP packet #1 sent by UE/EEC 1 is the private IP address #1, the private IP address of the IP data packet sent by UE/EEC 2 is private IP address #2.
  • EECs or UEs e.g., UE/EEC 1 and UE/EEC 2 shown in (a) in FIG7 .
  • IP data packet #1 sent by UE/EEC 1 After UPF receives IP data packet #1 sent by UE/EEC 1, if NAT processing is performed, the private IP address #1 of IP data packet #1 is replaced by the public IP address #1 and port number #1 of UE1, and IP data packet #1' is obtained; after UPF receives IP data packet #2 sent by UE/EEC 2, if NAT processing is performed, the private IP address #2 of IP data packet #2 is replaced by the public IP address #2 and port number #2 of UE2, and IP data packet #2' is obtained.
  • UPF then sends IP data packet #1' and IP data packet #2' after NAT processing to EES, and IP data packet #1' and IP data packet #2' are received on the EES side, and the source IP address of IP data packet #1' is public IP address #1, and the source port number is port number #1, and the source IP address of IP data packet #2' is public IP address #2, and the source port number is port number #2.
  • the EES after the EES receives the first UE identifier API request message, it can determine whether the EEC and/or the UE is authenticated, and the method flow shown in FIG. 6 can also include:
  • the EES determines whether the EEC and/or the UE are authenticated.
  • the EES may determine whether the EEC and/or the UE is authenticated in the following implementations:
  • step 602 if a secure connection is established between EEC and EES using a two-way authentication mechanism (such as Generic Bootstrapping Architecture (GBA) or Authentication and Key Management for Applications (AKMA)), EES determines that the terminal device is authenticated.
  • GBA Generic Bootstrapping Architecture
  • AKMA Authentication and Key Management for Applications
  • step 602 if the EEC and the EES perform authentication based on the EES certificate, it indicates that the UE is not authenticated.
  • EES determines whether EEC and/or UE are authenticated, and do not constitute any limitation on the scope of protection of this application. EES can also determine whether EEC and/or UE are authenticated in other possible ways, which are not illustrated one by one here.
  • Step 1 EES sends an IP address acquisition message to EAS based on the EAS identifier in the UE identifier API request message;
  • Step 2 EAS obtains the public IP address and port number of the UE based on the IP data packet interacting with the UE (such as AC); or EAS obtains the public IP address and port number of the UE locally, where the locally stored public IP address and port number of the UE can be obtained and stored during the interaction between EAS and the UE before step 1.
  • the UE such as AC
  • EAS obtains the public IP address and port number of the UE locally, where the locally stored public IP address and port number of the UE can be obtained and stored during the interaction between EAS and the UE before step 1.
  • Step 3 EAS sends the public IP address and port number of the UE to EES.
  • S660 EES sends a second request message to the network open function network element, or the network open function network element receives the second request message from EES.
  • the network open function network element may be the NEF shown in FIG. 2 above. It should be understood that the name of the network open function network element is not limited in this embodiment, and any network element that can realize the functions of the network open function network element in this embodiment may be considered as the network open function network element involved in this embodiment. For ease of description, the following description takes the network open function network element as an example of NEF.
  • the first request message includes the first private IP address of the terminal device, the public IP address and the port number of the terminal device.
  • the second request message is a Nnrf_UEId_Get request.
  • the NEF queries the network function repository function network element for the address of the UPF that implements the NAT function.
  • the method flow shown in FIG6 further includes:
  • the NEF sends a discovery request message to the network function repository functional network element, or in other words, the network function repository functional network element receives the discovery request message from the NEF.
  • the network function repository function network element may be the NRF shown in FIG. 2 above. It should be understood that the name of the network function repository function network element is not limited in this embodiment, and any network element that can realize the functions possessed by the network function repository function network element in this embodiment may be considered as the network function repository function network element involved in this embodiment. For ease of description, the following description takes the network function repository function network element as NRF as an example.
  • the discovery request message includes the public IP address of the terminal device.
  • the discovery request message is a Nnrf_NFDiscovery request.
  • the NEF determines to send a Nnrf_NFDiscovery request to the NRF according to the port number included in the first request message, where the request is used to obtain the address of the UPF implementing the NAT function.
  • the NRF sends a discovery response message to the NEF, or in other words, the NEF receives a discovery response message from the NRF.
  • the response message includes the address of the UPF that implements the NAT function for the UE (public) IP address.
  • the response message includes the address of UPF#1, which can implement NAT for the UE (public) IP address.
  • the discovery response message is a Nnrf_NFDiscovery response.
  • the NEF after the NEF obtains the address of the UPF that implements the NAT function for the UE (public) IP address from the NRF, it can obtain information from the UPF for determining whether the first private IP address provided by the EEC is valid, or it can also request the UPF to determine whether the first private IP address is valid. Exemplarily, it can be determined whether the first private IP address is valid based on the public IP address and port number of the UE, for example, by obtaining the second private IP address corresponding to the public IP address and port number. If the first private IP address and the second private IP address are the same, the first private IP address is valid.
  • the validity of the first private IP address can be understood as the first private IP address provided by the EEC is legal or accurate or correct or is assigned to the terminal device belonging to the EEC or corresponds to the public address and port of the terminal device;
  • the invalidity of the first private IP address can be understood as the first private IP address provided by the EEC is illegal or inaccurate or incorrect or is not assigned to the terminal device of the EEC or does not correspond to the public address and port number of the terminal device.
  • determining whether the first private IP address is valid includes but is not limited to the following implementations:
  • Implementation #1 The NEF requests the UPF for a second private IP address of the terminal device for verifying the first private IP address provided by the EEC.
  • the method flow shown in FIG6 further includes:
  • NEF sends a third request message to UPF, or in other words, UPF receives the third request message from NEF.
  • the third request message is used to obtain the second private address of the terminal device.
  • the third request message includes the public IP address and port number of the terminal device.
  • UPF sends a third response message to NEF, or in other words, NEF receives the third response message from UPF.
  • the third response message includes the second private address of the terminal device.
  • the NEF determines whether the first private IP address is valid.
  • the NEF determines that the first private IP address is valid and executes subsequent steps S690 to S698. It should be understood that in this implementation, the NEF determines to execute subsequent steps S690 to S698 by the fact that the second private IP address of the terminal device is the same as the first private IP address of the terminal device.
  • the NEF determines that the first private IP address is invalid.
  • the NEF may indicate through a second response message that the EES failed to obtain the UE identifier, such as the second response message carries first indication information, and the first indication information indicates that the UE identifier failed to be obtained.
  • the second response message may also carry a reason value for the failure, such as the IP address provided by the EEC is not authorized or is wrong.
  • Implementation #2 The NEF requests the UPF to verify at least one private IP address of the first private IP address provided by the EEC, and a port number corresponding to at least one private IP address.
  • the method flow shown in FIG. 6 further includes:
  • NEF sends a fourth request message to UPF, or in other words, UPF receives the fourth request message from NEF.
  • the fourth request message is used to obtain at least one private IP address corresponding to the public IP address and a port number corresponding to the at least one private IP address.
  • the fourth request message includes the public IP address of the terminal device.
  • the at least one private IP address corresponding to the public IP address, and the port number corresponding to the at least one private IP address can be understood as: the public IP address corresponds to: port number 1, private IP address 1, port number 2, private IP address 2... etc.
  • a public IP address can correspond to one or more private IP addresses, and each private IP address corresponds to a port number.
  • the fourth response message includes at least one private IP address corresponding to the public IP address, and a port number corresponding to the at least one private IP address.
  • the NEF determines whether the first private IP address is valid.
  • NEF obtains the second private IP address based on the port number received from EES, at least one private IP address corresponding to the public IP address received from UPF, and the port number corresponding to at least one private IP address.
  • the at least one private IP address corresponding to the public IP address is: private IP address 1 and private IP address 2, private IP address 1 corresponds to port number 1, and private IP address 2 corresponds to port number 2. If the port number received from EES is port number 2, the second private IP address obtained is private IP address 2.
  • the NEF determines whether the first private IP address is valid according to whether the first private IP address and the second private IP address are the same.
  • the NEF determines that the at least one private IP address does not include the first private IP address, and determines that the first private IP address is invalid.
  • the NEF may indicate through a second response message that the EES fails to obtain the UE identifier, such as the second response message carries the first indication information, and the first indication information indicates that the UE identifier fails to be obtained.
  • the second response message may also carry a reason value for the failure, such as the IP address provided by the EEC is not authorized or is wrong.
  • the at least one private address includes the first private address, and the port number corresponding to the first private address is the same as the port number, it is determined that the first private address is valid, and subsequent steps S690 to S698 are executed.
  • the NEF when the NEF locally stores at least one private IP address corresponding to the public IP address, and the port number corresponding to the at least one private IP address, the NEF may not execute the above steps S621 and S622, and only execute the above step S623 (for example, before executing the above step S621, query that there is no at least one private IP address corresponding to the public IP address, and the port number corresponding to the at least one private IP address locally).
  • the NEF has obtained the at least one private IP address corresponding to the above public IP address, and the port number corresponding to the at least one private IP address before receiving the second request message.
  • the NEF may also subscribe to the relationship list with the UPF, which may also include:
  • NEF sends a subscription request message to UPF, or in other words, UPF receives a subscription request message from NEF.
  • NEF sends a Nupf_PrivateUEIP_Subscribe message to UPF, which is used to instruct UPF to notify NEF of the new list when the private IP address and port number information corresponding to the public IP address changes (including adding a new UE private IP address, port number, or deleting a private IP address and port number).
  • UPF sends a subscription response message to NEF, or in other words, NEF receives a subscription response message from UPF.
  • the UPF When the UPF receives a Nupf_PrivateUEIP_Get message containing only the UE public IP address, it notifies the NEF of the new list by default when the private IP address and port number information corresponding to the UE public IP address changes.
  • the UPF may provide the NEF with at least one private IP address corresponding to the above public IP address and the port number corresponding to at least one private IP address through one or more subscription response messages.
  • NEF sends a fifth request message to UPF, or in other words, UPF receives the fifth request message from NEF.
  • the fifth request message is used to request the UPF to verify the first private IP address provided by the EEC.
  • the fifth request message includes the public IP address of the terminal device, the first private IP address of the terminal device, and the port number.
  • UPF determines whether the first private IP address is valid.
  • UPF obtains the corresponding UE public IP address and port number based on the first private IP address of the terminal device received, and compares them with the public IP address and port number of the terminal device received. If they are the same, the first private IP address is determined to be valid; if they are different, the first private IP address is determined to be invalid.
  • the UPF if the UPF cannot obtain corresponding information based on the first private IP address of the terminal device, it determines that the first private IP address is invalid.
  • UPF obtains the corresponding second private IP address based on the received public IP address and port number of the terminal device, and verifies whether the second private IP address is the same as the first private IP address of the terminal device. If they are the same, the first private IP address is determined to be valid; if they are different, the first private IP address is determined to be invalid.
  • UPF sends a fifth response message to NEF, or in other words, NEF receives the fifth response message from UPF.
  • the fifth response message is used to indicate whether the first private IP address is valid.
  • the NEF may indicate to the EES that the acquisition of the UE identifier fails through a second response message, such as the second response message carries first indication information indicating that the acquisition of the UE identifier fails.
  • the second response message may also carry a failure reason value, such as the IP address provided by the EEC is not authorized or is wrong.
  • the NEF sends a search request message to the binding support function network element, or in other words, the binding support function network element receives the search request message from the NEF.
  • the binding support function network element may be the BSF shown in FIG. 2 above. It should be understood that the name of the binding support function network element is not limited in this embodiment, and any device that can implement the functions of the binding support function network element in this embodiment may be considered as the binding support function network element involved in this embodiment. For ease of description, the following description takes the binding support function network element as BSF as an example.
  • the retrieval request message includes the first private IP address of the terminal device.
  • the retrieval request message is used to retrieve the session binding information of the UE.
  • the retrieval request message is a Nbsf_Management_Discovery service operation.
  • the BSF sends a retrieval response message to the NEF, or in other words, the NEF receives a retrieval response message from the BSF.
  • the retrieval response message includes session binding information.
  • NEF replies a result value to EES, indicating that UE ID is not available.
  • step S693 is performed.
  • the NEF sends a request message #3 to the unified data management function network element, or in other words, the unified data management function network element receives the request message #3 from the NEF.
  • the unified data management function network element may be the UDM shown in FIG. 2 above. It should be understood that the name of the unified data management function network element is not limited in this embodiment, and any device that can implement the functions of the unified data management function network element in this embodiment may be considered as the unified data management function network element involved in this embodiment. For ease of description, the following description takes the unified data management function network element as UDM as an example.
  • the request message #3 includes at least one of SUPI, application port ID, EES identifier, and EAS identifier.
  • UDM sends a response message #3 to NEF, or in other words, NEF receives a response message #3 from UDM.
  • the response message #3 includes the UE identifier, and the UE identifier may be GPSI.
  • NEF sends a second response message to EES, or in other words, EES receives the second response message from NEF.
  • the second response message includes an identifier of the UE, and the identifier of the UE may be a GPSI.
  • EES sends a first response message to EEC, the first response message including the UE identifier.
  • the first response message is a first UE identifier API response message
  • EEC sends a response message #2 to AC, where the response message #2 includes the identifier of the UE.
  • the AC sends a response message #1 to the EAS, where the response message #1 includes the identifier of the UE.
  • the request message for obtaining the terminal device sent to NEF carries the first private address received from EEC, as well as the public address and port number obtained by itself. This enables NEF to determine whether the first private address provided by EEC is accurate based on the received public address and port number, so as to decide whether to provide the identifier of the terminal device to EEC, and avoid providing the identifier of the terminal device to EEC when the first private address provided by EEC is inaccurate, thereby improving the security of EEC obtaining the identifier of the terminal device.
  • the present application also provides a communication method, and the EAS can determine how to obtain the UE identifier through the EEC based on whether the UE/EEC is authenticated.
  • the communication method is described in detail below in conjunction with (b) in Figure 7.
  • FIG7( b ) is a schematic flow chart of a communication method provided by the present application, which includes the following steps:
  • S701 A connection is established between the EAS and the AC.
  • step S601 in FIG6 Please refer to the description of step S601 in FIG6 , which will not be repeated here.
  • S702 Establish a connection between EEC and EES.
  • step S602 in FIG6 Please refer to the description of step S602 in FIG6 , which will not be repeated here.
  • the EES sends second indication information to the EAS, or the EAS receives second indication information from the EES.
  • the second indication information is used to indicate whether the EEC in the terminal device and/or the terminal device is authenticated.
  • the EES determines whether the EEC and/or the terminal device is authenticated, and provides the second indication information indicating whether the EEC and/or the terminal device is authenticated to the EAS.
  • the manner in which the EES determines whether the EEC and/or the terminal device is authenticated can refer to the description in step S640 in the embodiment shown in FIG. 6, which will not be repeated here.
  • the EAS determines a process for obtaining an identifier of the terminal device according to the second indication information.
  • the EES before the EES sends the second indication information to the EAS, the EES receives the acquisition terminal device of the EAS The seventh request message for the identifier of the terminal device is received, and obtaining the identifier of the terminal device based on the public IP address of the terminal device carried in the seventh request message fails.
  • the EES sending the second indication information to the EAS may be: the EES sending the seventh response message to the EAS, the seventh response message is used to indicate that the identifier acquisition of the terminal device fails, and the seventh response message includes the second indication information.
  • the method flow shown in (b) of FIG. 7 may further include:
  • EAS sends the seventh request message to EES, or EES receives the seventh request message from EAS.
  • the EAS may obtain the identifier of the terminal device in different ways.
  • the second indication information indicates that the EEC or the terminal device is authenticated, and the EAS determines, according to the second indication information, that the process of obtaining the identifier of the terminal device based on the private address of the terminal device is process #1.
  • process #1 includes the following steps:
  • EAS sends a request message #1 to AC, or in other words, AC receives a request message #1 from EAS.
  • AC sends request message #2 to EEC, or in other words, EEC receives request message #2 from AC.
  • the EEC sends a first request message to the EES, or in other words, the EES receives the first request message from the EEC.
  • steps S711 to S713 For the description of steps S711 to S713, reference may be made to the description of steps S610 to S630 in the embodiment shown in FIG6 , which will not be repeated here.
  • the EES after receiving the first request message from the EEC, the EES obtains the identifier of the terminal device based on the first private address of the terminal device carried in the first request message, and the method flow shown in (b) of FIG. 7 further includes:
  • EES sends a request message #A1 to NEF.
  • the request message #A1 is used to obtain the identifier of the terminal device, and the request message #A1 includes the first private address of the terminal device.
  • NEF sends a request message #D1 to BSF.
  • the request message #D1 includes the first private address, and the BSF retrieves the session binding information of the UE.
  • BSF sends a response message #D1 to NEF.
  • the response message #D1 responds to the request message #D1. If the response message #D1 does not carry SUPI, the NEF replies a Result value to the EES, indicating that the terminal device identifier acquisition fails.
  • NEF sends a request message #E1 to UDM.
  • the NEF retrieves the UE identifier specific to the AF through the Nudm_SDM_Get service operation.
  • the request message #E1 includes at least one of the SUPI, the Application Port ID or the AF identifier.
  • UDM sends a response message #E1 to NEF.
  • the UDM responds to the NEF with an AF-specific UE identifier, which is represented as an external identifier of the UE that is uniquely associated with the application port ID, MTC provider information and/or AF identifier.
  • NEF sends a response message #A1 to EES.
  • the response message #A1 is used to obtain the identifier of the terminal device, and the response message #A1 includes the identifier of the terminal device.
  • EES sends a first response message to EEC, the first response message including the identifier of the terminal device.
  • the first response message is a first UE identifier API response message
  • EEC sends a response message #2 to AC, and the response message #2 includes an identifier of the terminal device.
  • AC sends a response message #1 to EAS, and the response message #1 includes an identifier of the terminal device.
  • the second indication information indicates that the EEC and/or the terminal device is not authenticated, and the EAS determines, based on the second indication information, that the process of obtaining the identifier of the terminal device based on the public address and port number of the terminal device is process #2.
  • process #2 includes the following steps:
  • EAS obtains the public IP address and port number of the terminal device.
  • the EAS obtains the public IP address and port number of the UE according to the IP data packets interacting with the UE (eg, AC).
  • the UE eg, AC
  • the EAS sends a sixth request message to the EES, or in other words, the EES receives the sixth request message from the EAS.
  • the sixth request message is used to obtain the identifier of the terminal device, and the sixth request message includes the public address and port number of the terminal device.
  • the sixth request message is a sixth UE identifier API request message
  • EES sends a request message #A2 to NEF.
  • the request message #A2 is used to obtain the identifier of the terminal device, and the request message #A2 includes the public address and port number of the terminal device.
  • NEF sends a request message #B2 to NRF.
  • Request message #B2 is used to obtain the address of the UPF that implements the NAT function for the UE (public) IP address.
  • the NEF uses the Nnrf_NFDiscovery service operation to obtain the address of the UPF that implements the NAT function.
  • the request message #B2 includes the UE public address and port number.
  • NRF sends a response message #B2 to NEF.
  • the response message #B2 responds to the above-mentioned request message #B2, and the response message #B2 includes the address of the UPF that implements the NAT function for the UE public address.
  • NEF sends a request message #C2 to UPF.
  • the request message #C2 is used to obtain the private address of the UE.
  • the request message #C2 includes the UE public address and port number.
  • UPF sends a response message #C2 to NEF.
  • the response message #C2 responds to the above-mentioned request message #C2, and the response message #C2 includes the private address of the UE.
  • NEF sends a request message #D2 to BSF.
  • the request message #D2 contains the private address of the UE, and the BSF retrieves the session binding information of the UE.
  • BSF sends a response message #D2 to NEF.
  • the response message #D2 responds to the request message #D2 above. If the response message #D2 does not carry SUPI, the NEF replies a Result value to the AF, indicating that the UE ID is unavailable.
  • NEF sends a request message #E2 to UDM.
  • the NEF retrieves the UE identifier specific to the AF through the Nudm_SDM_Get service operation.
  • the request message #E2 includes at least one of the SUPI, the Application Port ID or the AF identifier.
  • UDM sends a response message #E2 to NEF.
  • the UDM responds to the NEF with an AF-specific UE identifier, which is represented as an external identifier of the UE that is uniquely associated with the application port ID, MTC provider information and/or AF identifier.
  • NEF sends a response message #A2 to EES.
  • the response message #A2 includes the identifier of the terminal device.
  • EES sends a sixth response message to EAS, where the sixth response message includes an identifier of the terminal device.
  • the sixth response message is a sixth UE identifier API response message.
  • EAS obtains information from EES on whether the UE and/or EEC are authenticated, and when the UE is authenticated and/or the EEC is authenticated, obtains the identifier of the terminal device through the EEC.
  • the identifier of the terminal device can also be obtained based on the public address and port number of the terminal device.
  • the identifier of the terminal device is obtained based on the public address and port number of the terminal device.
  • the present application also provides another communication method. After receiving a request message for obtaining the UE identifier from the EEC, the EES can determine the subsequent method for obtaining the UE identifier based on whether the EEC and/or the UE are authenticated. For ease of understanding, this is explained in conjunction with Figure 8.
  • FIG8 is a schematic flow chart of another communication method provided by the present application, comprising the following steps:
  • S801 A connection is established between the EAS and the AC.
  • step S601 in FIG6 Please refer to the description of step S601 in FIG6 , which will not be repeated here.
  • step S602 in FIG6 Please refer to the description of step S602 in FIG6 , which will not be repeated here.
  • EAS sends a request message #1 to AC, or in other words, AC receives a request message #1 from EAS.
  • the AC sends a request message #2 to the edge enable client, or in other words, the edge enable client receives the request message #2 from the AC.
  • the EEC sends a first request message to the EES, or in other words, the EES receives the first request message from the EEC.
  • the EES determines whether the EEC and/or the UE are authenticated.
  • the EES no longer executes the implementation methods #1 to #3 in the embodiment shown in FIG. 6 to determine whether the first private IP address provided by the EEC is valid, but determines the method to be used to obtain the UE identifier according to whether the EEC and/or the UE is authenticated. Specifically, in this embodiment, the EES obtains the UE identifier in the following two ways:
  • Method #3 EES uses the private IP address provided by EEC to interact with 5GC to obtain UE ID.
  • Method 8 The method flow shown also includes the following steps:
  • EES sends a request message #A1 to NEF.
  • the request message #A1 is used to obtain the identifier of the terminal device, and the request message #A1 includes the first private address of the terminal device.
  • NEF sends a request message #D1 to BSF.
  • the request message #D1 includes the first private address, and the BSF retrieves the session binding information of the UE.
  • BSF sends a response message #D1 to NEF.
  • the response message #D1 responds to the request message #D1. If the response message #D1 does not carry SUPI, the NEF replies a Result value to the EES, indicating that the terminal device identifier acquisition fails.
  • NEF sends a request message #E1 to UDM.
  • UDM sends a response message #E1 to NEF.
  • NEF sends a response message #A1 to EES.
  • the response message #A1 is used to obtain the identifier of the terminal device, and the response message #A1 includes the identifier of the terminal device.
  • step S811 to step S816, please refer to the description of step S714 to step S719 in embodiment mode #1 shown in (b) of Figure 7, and will not be repeated here.
  • Method #4 uses the UE's public IP address and port number to interact with 5GC to obtain the UE ID.
  • the method flow shown in Figure 8 also includes the following steps:
  • EES sends a request message #A2 to NEF.
  • the request message #A2 is used to obtain the identifier of the terminal device, and the request message #A2 includes the public address and port number of the terminal device.
  • NEF sends a request message #B2 to NRF.
  • Request message #B2 is used to obtain the address of the UPF that implements the NAT function for the UE (public) IP address.
  • the NEF uses the Nnrf_NFDiscovery service operation to obtain the address of the UPF that implements the NAT function.
  • the request message #B2 includes the UE public address and port number.
  • NRF sends a response message #B2 to NEF.
  • the response message #B2 responds to the above-mentioned request message #B2, and the response message #B2 includes the address of the UPF that implements the NAT function for the UE public address.
  • NEF sends a request message #C2 to UPF.
  • the request message #C2 is used to obtain the private address of the UE.
  • the request message #C2 includes the UE public address and port number.
  • UPF sends a response message #C2 to NEF.
  • the response message #C2 responds to the above-mentioned request message #C2, and the response message #C2 includes the private address of the UE.
  • NEF sends a request message #D2 to BSF.
  • the request message #D2 contains the private address of the UE, and the BSF retrieves the session binding information of the UE.
  • BSF sends a response message #D2 to NEF.
  • the response message #D2 responds to the request message #D2 above. If the response message #D2 does not carry SUPI, the NEF replies a Result value to the AF, indicating that the UE ID is unavailable.
  • NEF sends a request message #E2 to UDM.
  • UDM sends a response message #E2 to NEF.
  • NEF sends a response message #A2 to EES.
  • the response message #A2 includes the identifier of the terminal device.
  • step S821 to step S8291 please refer to the description of step S723 to step S7293 in embodiment mode #3 shown in (b) of Figure 7, and will not be repeated here.
  • the method flow shown in FIG8 further includes:
  • EES sends a first response message to EEC, where the first response message includes an identifier of the UE.
  • the EEC sends a response message #2 to the AC, where the response message #2 includes an identifier of the UE.
  • the AC sends a response message #1 to the EAS, where the response message #1 includes the identifier of the UE.
  • EES determines the actual method of obtaining the identifier of the terminal device according to whether the UE and/or EEC are authenticated, thereby avoiding obtaining the identifier of the terminal device based on the first private address of the terminal device when the UE and/or EEC are not authenticated, thereby improving security.
  • the devices in the existing network architecture are mainly used as examples for exemplary description (such as AMF, etc.), and it should be understood that the specific form of the device is not limited in the embodiments of the present application. For example, devices that can achieve the same function in the future are applicable to the embodiments of the present application.
  • the methods and operations implemented by the device can also be implemented by components of the device (such as chips or circuits).
  • the communication method provided by the embodiment of the present application is described in detail above in conjunction with Figures 6 to 8.
  • the above communication method is mainly introduced from the perspective of interaction between various protocol layers of the terminal device. It is understandable that in order to implement the above functions, the terminal device includes a hardware structure and/or software module corresponding to each function.
  • the embodiment of the present application can divide the functional modules of the transmitting end device or the receiving end device according to the above method example.
  • each functional module can be divided corresponding to each function, or two or more functions can be integrated into one processing module.
  • the above integrated module can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiment of the present application is schematic and is only a logical functional division. There may be other division methods in actual implementation. The following is an example of dividing each functional module corresponding to each function.
  • FIG9 is a schematic block diagram of a communication device 10 provided in an embodiment of the present application.
  • the device 10 includes a transceiver module 11 and a processing module 12.
  • the transceiver module 11 can implement corresponding communication functions, and the processing module 12 is used to perform data processing, or in other words, the transceiver module 11 is used to perform operations related to receiving and sending, and the processing module 12 is used to perform other operations besides receiving and sending.
  • the transceiver module 11 can also be called a communication interface or a communication unit.
  • the device 10 may further include a storage module 13, which may be used to store instructions and/or data.
  • the processing module 12 may read the instructions and/or data in the storage module so that the device implements the actions of the devices in the aforementioned method embodiments.
  • the device 10 may correspond to the EES in the above method embodiments, or be a component of the EES (such as a chip).
  • the device 10 can implement the steps or processes corresponding to the EES execution in the above method embodiment, wherein the transceiver module 11 can be used to perform the operations related to the transceiver of the EES in the above method embodiment, and the processing module 12 can be used to perform the operations related to the processing of the EES in the above method embodiment.
  • the transceiver module 11 is used to receive a first request message from a terminal device, the first request message is used to obtain an identifier of the terminal device, and the first request message includes a first private address of the terminal device.
  • the transceiver module 11 is also used to obtain a public address and a port number of the terminal device, and send a second request message to a network open function network element, the second request message is used to obtain an identifier of the terminal device, and the second request message includes the first private address, the public address, and the port number.
  • the transceiver module 11 is also used to receive first indication information from the network open function network element or an identifier of the terminal device, the first indication information is used to indicate that the identifier of the terminal device has failed to be obtained.
  • the transceiver module 11 is used to send a second indication message to the edge application server, wherein the second indication message is used to indicate whether the edge enabling client in the terminal device and/or the terminal device is authenticated.
  • the transceiver module 11 is also used to receive a sixth request message from the edge application server when the edge enabling client and/or the terminal device is not authenticated, wherein the sixth request message is used to obtain an identifier of the terminal device, and the sixth request message includes a public address and a port number of the terminal device.
  • the transceiver module 11 can be used to execute the steps of sending and receiving information in the method, such as steps S630, S660, S692, S695 and S696; the processing module 12 can be used to execute the processing steps in the method, such as steps S640 and S650.
  • the transceiver module 11 can be used to execute the steps of sending and receiving information in the method, such as steps S703, S710, S714, S719, S723, S7293 and S7294; the processing module 12 can be used to execute the processing steps in the method.
  • the transceiver module 11 can be used to execute the steps of sending and receiving information in the method, such as steps S830, S811, S816, S821, S8291 and S850; the processing module 12 can be used to execute the processing steps in the method, such as step S840.
  • the device 10 may correspond to the NEF in the above method embodiment, or be a component (such as a chip) of the NEF.
  • the device 10 can implement the steps or processes corresponding to the NEF execution in the above method embodiment, wherein the transceiver module 11 can be used to perform the NEF transceiver related operations in the above method embodiment, and the processing module 12 can be used to perform the NEF processing related operations in the above method embodiment.
  • the transceiver module 11 is used to receive a second request message from an edge enabling server, where the second request message is used to obtain an identifier of a terminal device, and the second request message includes a first private address of the terminal device, a public address of the terminal device, and a port number; the transceiver module 11 is used to obtain the identifier of the terminal device when it is determined that the first private address is valid based on the public address and the port number, and send the identifier of the terminal device to the edge enabling server.
  • the transceiver module 11 can be used to execute the steps of sending and receiving information in the method, such as steps S660, S670, S680, S611, S612, S621, S622, S624, S625, S631, S633, S690, S691, S692, S693, S694 and S695;
  • the processing module 12 can be used to execute the processing steps in the method, such as steps S613 and S623.
  • the transceiver module 11 can be used to execute the steps of sending and receiving information in the method, such as steps S714, S715, S716, S717, S718, S719, S723, S724, S725, S726, S727, S728, S729, S7291, S7292 and S7293; the processing module 12 can be used to execute the processing steps in the method.
  • the transceiver module 11 can be used to execute the steps of sending and receiving information in the method, such as steps S811, S812, S813, S814, S815, S816, S821, S822, S823, S824, S825, S826, S827, S828, S829 and S8291; the processing module 12 can be used to execute the processing steps in the method.
  • the device 10 may correspond to the UPF in the above method embodiment, or be a component of the UPF (such as a chip).
  • the device 10 can implement the steps or processes corresponding to the UPF execution in the above method embodiment, wherein the transceiver module 11 can be used to execute the UPF's transceiver related operations in the above method embodiment, and the processing module 12 can be used to execute the UPF's processing related operations in the above method embodiment.
  • the transceiver module 11 is used to receive a third request message from a network open function network element, wherein the third request message is used to obtain a second private Internet Protocol address of a terminal device, and the third request message includes a public address and a port number of the terminal device; the processing module 12 is used to determine the second private address of the terminal device based on the public address and the port number; the transceiver module 11 is used to send a third response message to the network open function network element, and the third response message includes the second private address.
  • the transceiver module 11 is used to receive a fourth request message from a network open function network element, wherein the fourth request message includes a first public Internet interconnection protocol address of a terminal device; the processing module 12 is used to determine, based on the public address, at least one private address corresponding to the public address, and a port number corresponding to the at least one private address; the transceiver module 11 sends a fourth response message to the network open function network element, wherein the fourth response message includes at least one private address corresponding to the public address, and a port number corresponding to the at least one private address.
  • the transceiver module 11 is used to receive a fifth request message from a network open function network element, wherein the fifth request message includes a first private Internet interconnection protocol address of a terminal device, a public address and a port number of the terminal device, and the fifth request message is used to request the user plane function network element to determine whether the first private address is valid; the processing module 12 is used to determine whether the first private address is valid based on a correspondence between a locally stored private address, a public address and a port number; the transceiver module 11 sends a fifth response message to the network open function network element, and the fifth response message is used to indicate whether the first private address is valid.
  • the transceiver module 11 can be used to execute the steps of sending and receiving information in the method, such as steps S611, S612, S621, S622, S624, S625, S631 and S633; the processing module 12 can be used to execute the processing steps in the method, such as step S632.
  • the transceiver module 11 may be used to execute the steps of sending and receiving information in the method, such as steps S726 and S727 ; the processing module 12 may be used to execute the processing steps in the method.
  • the transceiver module 11 may be used to execute the steps of sending and receiving information in the method, such as steps S824 and S825 ; and the processing module 12 may be used to execute the processing steps in the method.
  • the device 10 may correspond to the EAS in the above method embodiment, or be a component (such as a chip) of the EAS.
  • the device 10 can implement the steps or processes corresponding to the EAS execution in the above method embodiment, wherein the transceiver module 11 can be used to perform the EAS transceiver related operations in the above method embodiment, and the processing module 12 can be used to perform the EAS processing related operations in the above method embodiment.
  • the transceiver module 11 is used to receive second indication information from the edge enabling server, where the second indication information is used to indicate whether the edge enabling client in the terminal device and/or the terminal device is authenticated; the transceiver module 11 sends a sixth request message to the edge enabling server when the edge enabling client and/or the terminal device are not authenticated, where the sixth request message is used to obtain an identifier of the terminal device, and the sixth request message includes a public address and port number of the terminal device.
  • the transceiver module 11 may be used to execute the steps of sending and receiving information in the method, such as steps S610 and S698 ; and the processing module 12 may be used to execute the processing steps in the method.
  • the transceiver module 11 can be used to execute the steps of sending and receiving information in the method, such as steps S711, S7193, S703, S710, S722 and S7294; the processing module 12 can be used to execute the processing steps in the method, such as steps S720 and S721.
  • the transceiver module 11 may be used to execute the steps of sending and receiving information in the method, such as steps S810 and S870 ; and the processing module 12 may be used to execute the processing steps in the method.
  • module here may refer to an application specific integrated circuit (ASIC), an electronic circuit, a processor (such as a shared processor, a dedicated processor or a group processor, etc.) and a memory for executing one or more software or firmware programs, a merged logic circuit and/or other suitable components that support the described functions.
  • ASIC application specific integrated circuit
  • processor such as a shared processor, a dedicated processor or a group processor, etc.
  • memory for executing one or more software or firmware programs, a merged logic circuit and/or other suitable components that support the described functions.
  • the device 10 can be specifically the mobile management network element in the above-mentioned embodiment, and can be used to execute the various processes and/or steps corresponding to the mobile management network element in the above-mentioned method embodiments; or, the device 10 can be specifically the terminal device in the above-mentioned embodiment, and can be used to execute the various processes and/or steps corresponding to the terminal device in the above-mentioned method embodiments. To avoid repetition, it will not be repeated here.
  • the device 10 of each of the above schemes has the function of implementing the corresponding steps performed by the device (such as terminal device, network device) in the above method.
  • This function can be implemented by hardware, or by hardware executing the corresponding software implementation.
  • the hardware or software includes one or more modules corresponding to the above functions; for example, the transceiver module can be replaced by a transceiver (for example, the sending unit in the transceiver module can be replaced by a transmitter, and the receiving unit in the transceiver module can be replaced by a receiver), and other units, such as processing modules, can be replaced by processors to respectively perform the transceiver operations and related processing operations in each method embodiment.
  • the transceiver module 11 may also be a transceiver circuit (for example, may include a receiving circuit and a sending circuit), and the processing module may be a processing circuit.
  • FIG10 is a schematic diagram of another communication device 20 provided in an embodiment of the present application.
  • the device 20 includes a processor 21, and the processor 21 is used to execute a computer program or instruction stored in a memory 22, or read data/signaling stored in the memory 22 to execute the method in each method embodiment above.
  • the processor 21 is used to execute a computer program or instruction stored in a memory 22, or read data/signaling stored in the memory 22 to execute the method in each method embodiment above.
  • the device 20 further includes a memory 22, and the memory 22 is used to store computer programs or instructions and/or data.
  • the memory 22 can be integrated with the processor 21, or can also be separately arranged.
  • the memory 22 is one or more.
  • the device 20 further includes a transceiver 23, and the transceiver 23 is used for receiving and/or sending signals.
  • the processor 21 is used to control the transceiver 23 to receive and/or send signals.
  • the device 20 is used to implement the operations performed by the EES in the above various method embodiments.
  • the device 20 is used to implement the operations performed by the NEF in the above method embodiments.
  • the device 20 is used to implement the operations performed by the UPF in the above method embodiments.
  • the device 20 is used to implement the operations performed by the EAS in the above various method embodiments.
  • processors mentioned in the embodiments of the present application may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.
  • DSP digital signal processors
  • ASIC application-specific integrated circuits
  • FPGA field programmable gate arrays
  • a general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.
  • the memory mentioned in the embodiments of the present application may be a volatile memory and/or a non-volatile memory.
  • the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory.
  • the volatile memory may be a random access memory (RAM).
  • a RAM may be used as an external cache.
  • RAM includes the following forms: static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct rambus RAM (DR RAM).
  • SRAM static RAM
  • DRAM dynamic RAM
  • SDRAM synchronous DRAM
  • DDR SDRAM double data rate synchronous dynamic random access memory
  • ESDRAM enhanced synchronous dynamic random access memory
  • SLDRAM synchronous link dynamic random access memory
  • DR RAM direct rambus RAM
  • the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, the memory (storage module) can be integrated into the processor.
  • memory described herein is intended to include, but is not limited to, these and any other suitable types of memory.
  • FIG11 is a schematic diagram of a chip system 30 provided in an embodiment of the present application.
  • the chip system 30 (or also referred to as a processing system) includes a logic circuit 31 and an input/output interface 32.
  • the logic circuit 31 can be a processing circuit in the chip system 30.
  • the logic circuit 31 can be coupled to the storage unit and call the instructions in the storage unit so that the chip system 30 can implement the methods and functions of each embodiment of the present application.
  • the input/output interface 32 can be an input/output circuit in the chip system 30, outputting information processed by the chip system 30, or inputting data or signaling information to be processed into the chip system 30 for processing.
  • the chip system 30 is used to implement the operations performed by the EES, EAS, NEF or UPF in the above various method embodiments.
  • the logic circuit 31 is used to implement the processing-related operations performed by EES, EAS, NEF or UPF in the above method embodiments;
  • the input/output interface 32 is used to implement the sending and/or receiving-related operations performed by EES, EAS, NEF or UPF in the above method embodiments.
  • the embodiments of the present application also provide a computer-readable storage medium on which are stored computer instructions for implementing the methods performed by the EES, EAS, NEF and UPF in the above-mentioned method embodiments.
  • the computer program when executed by a computer, the computer can implement the methods performed by EES, EAS, NEF or UPF in each of the above method embodiments.
  • the embodiment of the present application also provides a computer program product, comprising instructions, which, when executed by a computer, implement the methods performed by EES, EAS, NEF and UPF in the above-mentioned method embodiments.
  • An embodiment of the present application also provides a communication system, including the aforementioned EES, EAS, NEF and UPF.
  • the disclosed devices and methods can be implemented in other ways.
  • the device embodiments described above are only schematic.
  • the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.
  • all or part of the embodiments may be implemented by software, hardware, firmware or any combination thereof. At present, it can be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part.
  • the computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
  • the computer can be a personal computer, a server, or a network device, etc.
  • the computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions can be transmitted from a website site, a computer, a server, or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server, or data center.
  • the computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server, a data center, etc. that contains one or more available media integrated.
  • the available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid state disk (SSD), etc.
  • the aforementioned available medium includes, but is not limited to, various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Power Engineering (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

提供了一种通信方法，包括：EES接收终端设备的获取终端设备标识符的第一请求消息，该第一请求消息中包括该终端设备的私有IP地址，EES获取终端设备的公共IP地址和端口号并向NEF发送用于请求该终端设备的标识符的第二请求消息，该第二请求消息中包括该私有IP地址、该终端设备的公共IP地址和端口号，接收来自NEF的响应消息，该响应消息包括该终端设备的标识符，或者该响应消息指示获取失败。通过在请求消息中携带终端设备的公共IP地址和端口号，以便于网络侧基于该公共IP地址和端口号验证终端设备提供的私有IP地址的准确性，避免终端设备使用其他终端设备的私有IP地址获取到其他终端设备的标识符，提高安全性。

Description

一种通信方法和通信装置
本申请要求在2023年05月14日提交中国国家知识产权局、申请号为202310541737.3、发明名称为“一种通信方法和通信装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信领域，并且更具体地，涉及一种通信方法和通信装置。
背景技术
为了在第三代合作伙伴计划(3rd Generation Partnership Project，3GPP)网络上启用边缘应用，定义了使能边缘应用的架构、流程和信息流。具体地，为了获取唯一识别终端设备的标识符，使能边缘应用的架构中的边缘使能服务器(Edge Enabler Server，EES)向边缘应用服务器(Edge Application Server，EAS)和边缘使能客户端(Edge Enabler Client，EEC)开放了终端设备标识符应用编程接口(Application programinterface，API)。终端设备标识符API用于EAS或EEC从EES获取终端设备的标识。
示例性地，EEC调用终端设备标识符API可以用于下述场景：即EAS直接向EES调用终端设备标识符API，获取终端设备标识符失败时，EAS可以选择向应用客户端(Application client，AC)发送信令以使得AC向EEC发起终端设备标识符查询，进一步的EEC使用核心网分配的网际互连协议(Internet Protocol，IP)地址调用EES的终端设备标识符API获取终端设备标识符，并将获取的终端设备标识符通过AC发送给EAS。
但是，如何提高EAS通过EEC获取终端设备标识符的安全性成为亟待解决的问题。
发明内容
本申请提供了一种通信方法和通信装置，以期提高EEC获取终端设备标识符的安全性。
第一方面，本申请提供了一种通信方法。该方法可以由边缘使能服务器执行，也可以由边缘使能服务器的组成部件(例如芯片或者电路)执行，本申请对此不作限定。
该通信方法包括：接收来自终端设备的第一请求消息，所述第一请求消息用于获取所述终端设备的标识符，所述第一请求消息包括所述终端设备的第一私有地址；获取所述终端设备的公共地址和端口号，向网络开放功能网元发送第二请求消息，所述第二请求消息用于获取所述终端设备的标识符，所述第二请求消息包括所述第一私有地址、所述公共地址和端口号；接收来自所述网络开放功能网元的第一指示信息或所述终端设备的标识符，所述第一指示信息用于指示所述终端设备的标识符获取失败。
基于上述方案，边缘使能服务器接收到终端设备的获取终端设备的请求消息之后，向网络开放功能网元发送的获取终端设备的请求消息中携带从终端设备接收到的第一私有地址，以及获取的公共地址和端口号。以使得网络开放功能网元能够根据接收到的公共地址和端口号确定终端设备提供的第一私有地址是否准确，以便于决定是否向终端设备提供终端设备的标识符，避免终端设备提供的第一私有地址不准确的情况下，仍然向终端设备提供终端设备的标识符，提高终端设备获取终端设备的标识符的安全性。
结合第一方面，在第一方面的某些实现方式中，所述接收来自终端设备的第一请求消息，包括：接收来自用户面功能网元的网际协议IP数据包，所述IP数据包的载荷部分包括来自所述终端设备的所述第一请求消息；
所述获取所述公共地址和所述端口号，包括：根据所述IP数据包的源地址和源端口号，确定所述公共地址和所述端口号，其中，所述源地址用于表征所述公共地址，所述源端口号用于表征所述端口号。
示例性地，所述获取所述公共地址和所述端口号，还包括：从边缘应用服务器获取所述公共地址和所述端口号。
基于上述方案，边缘使能服务器可以通过不同的方式获取所需的公共地址和所述端口号，提高方案的灵活性，满足不同的应用场景。
结合第一方面，在第一方面的某些实现方式中，在接收来自所述网络开放功能网元的所述终端设备 的所述第一指示信息的情况下，所述方法还包括：接收来自所述网络开放功能网元的所述终端设备的原因值，所述原因值用于指示所述终端设备的标识符获取失败的原因。其中，第一指示信息和原因值可以携带在第二响应消息中。
基于上述方案，当第二响应消息指示终端设备的标识符获取失败时，可以通过在第一响应消息中携带原因值，指示终端设备的标识符获取失败的原因，以使得边缘使能服务器根据原因值进行对EEC的请求进行正确的处理。
结合第一方面，在第一方面的某些实现方式中，在接收来自所述网络开放功能网元的所述终端设备的标识符的情况下，所述方法还包括：向所述终端设备发送第一响应消息，所述第一响应消息包括所述终端设备的标识符。
结合第一方面，在第一方面的某些实现方式中，所述向网络开放功能网元发送第二请求消息，包括：在所述终端设备未被认证的情况下，向所述网络开放功能网元发送所述第二请求消息。
第二方面，本申请提供了一种通信方法。该方法可以由网络开放功能网元执行，也可以由网络开放功能网元的组成部件(例如芯片或者电路)执行，本申请对此不作限定。
该通信方法包括：接收来自边缘使能服务器的第二请求消息，所述第二请求消息用于获取终端设备的标识符，所述第二请求消息包括所述终端设备的第一私有地址、所述终端设备的公共地址和端口号；在根据所述公共地址和所述端口号确定所述第一私有地址有效的情况下，获取所述终端设备的标识符，并向所述边缘使能服务器发送所述终端设备的标识符。
基于上述方案，边缘使能服务器向网络开放功能网元发送的获取终端设备的请求消息中携带从终端设备接收到的第一私有地址，以及自行获取的公共地址和端口号。以使得网络开放功能网元能够根据接收到的公共地址和端口号确定终端设备提供的第一私有地址是否准确，以便于决定是否向终端设备提供终端设备的标识符，避免终端设备提供的第一私有地址不准确的情况下，仍然向终端设备提供终端设备的标识符，提高终端设备获取终端设备标识符的安全性。
结合第二方面，在第二方面的某些实现方式中，在根据所述公共地址和所述端口号确定所述第一私有地址无效的情况下，向所述边缘使能服务器发送第一指示信息，所述第一指示信息用于指示所述终端设备的标识符获取失败。
结合第二方面，在第二方面的某些实现方式中，所述方法还包括：根据所述公共地址和所述端口号确定所述第一私有地址是否有效。
结合第二方面，在第二方面的某些实现方式中，所述根据所述公共地址和所述端口号确定所述第一私有地址是否有效，包括：所述第一私有地址是否与第二私有地址相同，其中，所述第二私有地址是基于所述公共地址和所述端口号确定的。
示例性地，所述方法还包括：向用户面功能网元发送第三请求消息，所述第三请求消息中包括所述公共地址和所述端口号；接收来自所述用户面功能网元的第三响应消息，所述第三响应消息包括所述第二私有地址。
示例性地，所述方法还包括：所述方法还包括：获取所述公网地址对应的至少一个私有地址，以及与所述至少一个私有地址对应的端口号；根据获取到的所述至少一个私有地址和与所述至少一个私有地址对应的端口号，以及所述第二请求消息中的所述端口号，获取所述第二私有地址。
示例性地，所述方法还包括：向用户面功能网元发送第四请求消息，所述第四请求消息包括所述公共地址；接收来自所述用户面功能网元的第四响应消息，所述第四响应消息包括所述公共地址对应的至少一个私有地址，以及与所述至少一个私有地址对应的端口号。可选地，在向用户面功能网元发送第四请求消息之前，查询本地未保存所述公网地址对应的至少一个私有地址以及与所述至少一个私有地址对应的端口号。
示例性地，所述方法还包括：向用户面功能网元发送订阅请求消息，所述订阅请求消息包括所述公共地址；接收来自所述用户面功能网元的一个或多个订阅响应消息，所述一个或多个订阅响应消息包括所述公共地址对应的至少一个私有地址，以及与所述至少一个私有地址对应的端口号。可选地，在向用户面功能网元发送第四请求消息之前，查询本地未保存所述公网地址对应的至少一个私有地址以及与所述至少一个私有地址对应的端口号。
若所述至少一个私有地址不包含所述第一私有地址，确定所述第一私有地址无效；或者，若所述至少一个私有地址包含所述第一私有地址，且所述第一私有地址对应的端口号与所述端口号相同，确定所 述第一私有地址有效。
示例性地，所述方法还包括：向用户面功能网元发送第五请求消息，所述第五请求消息包括所述第一私有地址、所述公共地址和端口号，所述第五请求消息用于请求所述用户面功能网元确定所述第一私有地址是否有效；接收来自所述用户面功能网元的第五响应消息，所述第五响应消息用于指示所述第一私有地址是否有效。
基于上述方案，网络开放功能网元可以通过不同的方式对终端设备提供的第一私有地址进行校验，例如，可以是自身基于接收到的公共地址和端口号从用户面功能网元查询得到公共地址和端口号对应的第二私有地址，然后基于从用户面功能网元查询得到的第二私有地址校验第一私有地址；还例如，可以是基于接收到的公共地址从用户面功能网元得到公共地址对应的至少一个私有地址，以及所述至少一个私有地址对应的端口号，然后基于从用户面功能网元查询得到的至少一个私有地址，以及所述至少一个私有地址对应的端口号校验第一私有地址；又例如，可以是将接收到的第一私有地址、公共地址和端口号提供给用户面功能网元，由用户面功能网元对第一私有地址进行校验，并将校验结果提供给网络开放功能网元。提供不同的验证方式，提高方案的灵活性。
结合第二方面，在第二方面的某些实现方式中，所述方法还包括：向网络功能存储库功能网元发送发现请求消息，所述发现请求消息包括所述公共地址，所述发现请求消息用于获取实现地址转换功能的用户面功能网元的地址；接收来自所述网络功能存储库功能网元的发现响应消息，所述发现响应消息包括所述用户面功能网元的地址。
结合第二方面，在第二方面的某些实现方式中，在向所述边缘使能服务器发送所述第一指示信息的情况下，所述方法还包括：向所述边缘使能服务器发送原因值，所述原因值用于指示所述终端设备的标识符获取失败的原因。
第三方面，本申请提供了一种通信方法，该方法可以由用户面功能网元执行，也可以由用户面功能网元的组成部件(例如芯片或者电路)执行，本申请对此不作限定。
该通信方法包括：接收来自网络开放功能网元的第三请求消息，所述第三请求消息用于获取终端设备的第二私有网际协议地址，所述第三请求消息包括所述终端设备的公共地址和端口号；根据所述公共地址和所述端口号确定所述终端设备的第二私有地址；向所述网络开放功能网元发送第三响应消息，所述第三响应消息包括所述第二私有地址。
第四方面，本申请提供了一种通信方法。该方法可以由用户面功能网元执行，也可以由用户面功能网元的组成部件(例如芯片或者电路)执行，本申请对此不作限定。
该通信方法包括：接收来自网络开放功能网元的第四请求消息，所述第四请求消息包括终端设备的第一公共网际互连协议地址；根据所述公共地址确定与所述公共地址对应的至少一个私有地址，以及所述至少一个私有地址对应的端口号；向所述网络开放功能网元发送第四响应消息，所述第四响应消息包括所述至少一个私有地址，以及所述至少一个私有地址对应的端口号。
或者，接收来自所述网络开放功能网元的订阅请求消息，所述订阅请求消息包括终端设备的第一公共网际互连协议地址；向所述网络开放功能网元发送一个或者多个订阅响应消息，所述一个或者多个订阅响应消息包括所述公共地址对应的至少一个私有地址，以及所述至少一个私有地址对应的端口号。
第五方面，本申请提供了一种通信方法。该方法可以由用户面功能网元执行，也可以由用户面功能网元的组成部件(例如芯片或者电路)执行，本申请对此不作限定。
该通信方法包括：接收来自网络开放功能网元的第五请求消息，所述第五请求消息包括终端设备的第一私有网际互连协议地址、所述终端设备的公共地址和端口号，所述第五请求消息用于请求所述用户面功能网元确定所述第一私有地址是否有效；根据本地保存的私有地址、公共地址和端口号之间的对应关系确定所述第一私有地址是否有效；向所述网络开放功能网元发送第五响应消息，所述第五响应消息用于指示所述第一私有地址是否有效。
结合第五方面，在第五方面的某些实现方式中，所述根据本地保存的私有地址、公共地址和端口号之间的对应关系确定所述第一私有地址是否有效，包括：根据所述对应关系和所述第一私有地址，确定所述第一私有地址对应的公共地址和端口号；若所述第一私有地址对应的公共地址和端口号，与所述公共地址和端口号相同，所述第五响应消息用于指示所述第一私有地址有效；否则所述第五响应消息用于指示所述第一私有地址无效。
结合第五方面，在第五方面的某些实现方式中，所述根据本地保存的私有地址、公共地址和端口号 之间的对应关系确定所述第一私有地址是否有效，包括：根据所述对应关系和所述第一私有地址，确定无法获取所述第一私有地址对应的公共地址和端口号，则所述第五响应消息用于指示所述第一私有地址无效。
结合第五方面，在第五方面的某些实现方式中，所述根据本地保存的私有地址、公共地址和端口号之间的对应关系确定所述第一私有地址是否有效，包括：根据所述对应关系、所述公共地址和所述端口号，确定所述公共地址和所述端口号对应的私有地址；若所述公共地址和所述端口号对应的私有地址，与所述第一私有地址和端口号相同，则所述第五响应消息用于指示所述第一私有地址有效，否则所述第五响应消息用于指示所述第一私有地址无效。
第六方面，提供了一种通信装置，用于实现上述第一方面所示的方法。该装置包括：收发单元和处理单元，其中，收发单元用于收发信息，处理单元用于执行内部处理动作。
第七方面，提供了一种通信装置，用于实现上述第二方面所示的方法。该装置包括：收发单元和处理单元，其中，收发单元用于收发信息，处理单元用于执行内部处理动作。
第八方面，提供了一种通信装置，用于实现上述第三至第五方面所示的方法。该装置包括：收发单元和处理单元，其中，收发单元用于收发信息，处理单元用于执行内部处理动作。
第九方面，本申请提供了一种通信方法。该方法可以由边缘应用服务器执行，也可以由边缘应用服务器的组成部件(例如芯片或者电路)执行，本申请对此不作限定。
该通信方法包括：接收来自边缘使能服务器的第二指示信息，所述第二指示信息用于指示终端设备中的边缘使能客户端和/或所述终端设备是否被认证；在边缘使能客户端和/或终端设备未被认证的情况下，向边缘使能服务器发送第六请求消息，所述第六请求消息用于获取终端设备的标识符，所述第六请求消息包括所述终端设备的公共地址和端口号。
基于上述方案，边缘应用服务器在向边缘使能服务器获取终端设备的标识符之前，可以根据从边缘使能服务器接收到的第二指示信息确定边缘使能客户端和/或终端设备是否被认证过，若边缘使能客户端和/或所述终端设备未被认证，则边缘应用服务器可以在获取终端设备的标识符的请求消息中携带终端设备的公共地址和端口号，以便于边缘使能服务器基于终端设备的公共地址和端口号获取终端设备的标识符，避免在边缘使能客户端和/或所述终端设备未被认证的情况下基于终端设备的私有地址获取终端设备的标识符失败或者避免获取错误的终端设备的标识符。
结合第九方面，在第九方面的某些实现方式中，在接收来自边缘使能服务器的第二指示信息之前，所述方法还包括：向边缘使能服务器发送第七请求消息，所述第七请求消息用于获取终端设备的标识符，所述第七请求消息包括所述终端设备的公共地址；所述接收来自边缘使能服务器的第二指示信息，包括：接收来自边缘使能服务器的第七响应消息，所述第七响应消息用于指示所述终端设备的标识符获取失败，所述第七响应消息中包括所述第二指示信息。
结合第九方面，在第九方面的某些实现方式中，所述第七请求消息包括第三指示信息，所述第三指示信息用于指示边缘应用服务器具备通过所述边缘使能客户端获取所述终端设备的标识符的能力。
第十方面，本申请提供了一种通信方法。该方法可以由边缘使能服务器执行，也可以由边缘使能服务器的组成部件(例如芯片或者电路)执行，本申请对此不作限定。
该通信方法包括：向边缘应用服务器发送第二指示信息，所述第二指示信息用于指示终端设备中的边缘使能客户端和/或所述终端设备是否被认证；在边缘使能客户端和/或终端设备未被认证的情况下，接收来自边缘应用服务器的第六请求消息，所述第六请求消息用于获取终端设备的标识符，所述第六请求消息包括所述终端设备的公共地址和端口号。
结合第十方面，在第十方面的某些实现方式中，在向边缘应用服务器发送第二指示信息之前，所述方法还包括：接收来自边缘应用服务器的第七请求消息，所述第七请求消息用于获取终端设备的标识符，所述第七请求消息包括所述终端设备的公共地址；所述向边缘应用服务器发送第二指示信息，包括：向边缘应用服务器发送第七响应消息，所述第七响应消息用于指示所述终端设备的标识符获取失败，所述第七响应消息中包括所述第二指示信息。
结合第十方面，在第十方面的某些实现方式中，所述第七请求消息包括第三指示信息，所述第三指示信息用于指示边缘应用服务器具备通过所述边缘使能客户端获取所述终端设备的标识符的能力。
结合第十方面，在第十方面的某些实现方式中，在确定所述终端设备中的边缘使能客户端和/或所述终端设备是否被认证之前，所述方法还包括：确定所述边缘应用服务器具备通过所述边缘使能客户端获 取所述终端设备的标识符的能力。
第十一方面，提供了一种通信装置，用于实现上述第九方面所示的方法。该装置包括：收发单元和处理单元，其中，收发单元用于收发信息，处理单元用于执行内部处理动作。
第十二方面，提供了一种通信装置，用于实现上述第十方面所示的方法。该装置包括：收发单元和处理单元，其中，收发单元用于收发信息，处理单元用于执行内部处理动作。
第十三方面，本申请提供了一种通信方法。该方法可以由边缘使能服务器执行，也可以由边缘使能服务器的组成部件(例如芯片或者电路)执行，本申请对此不作限定。
该通信方法包括：接收来自终端设备的第一请求消息，所述第一请求消息用于获取所述终端设备的标识符，所述第一请求消息包括所述终端设备的第一私有地址；确定所述终端设备的边缘使能客户端和/或所述终端设备是否被认证；在所述边缘使能客户端和/或所述终端设备未被认证的情况下，获取所述终端设备的公共地址和端口号，并基于所述公共地址和端口号获取所述终端设备的标识符。
基于上述方案，边缘使能服务器在接收到来自终端设备的获取所述终端设备的标识符的第一请求消息之后，可以确定终端设备的边缘使能客户端和/或所述终端设备是否被认证，在未被认证的情况下，边缘使能服务器可以获取终端设备的公共地址和端口号，并基于公共地址和端口号获取终端设备的标识符，避免在未被认证的情况下仍然基于终端设备的第一私有地址获取终端设备的标识符，提高安全性。
结合第十三方面，在第十三方面的某些实现方式中，所述方法还包括：向所述终端设备发送第一响应消息，所述第一响应消息包括所述终端设备的标识符。
第十四方面，提供了一种通信装置，用于实现上述第十三方面所示的方法。该装置包括：收发单元和处理单元，其中，收发单元用于收发信息，处理单元用于执行内部处理动作。
第十五方面，提供了一种通信系统，包括边缘使能服务器、网络开放功能网元和用户面功能网元，其中，边缘使能服务器用于执行上述第一方面所示的方法，所述网络开放功能网元执行上述第二方面所示的方法，所述用户面功能网元执行上述第三方面所示的方法。
第十六方面，提供了一种通信系统，包括边缘应用服务器和边缘使能服务器，其中，边缘应用服务器用于执行上述第九方面所示的方法，边缘使能服务器用于执行上述第十方面所示的方法。
第十七方面，提供一种通信装置，该装置包括：存储器，用于存储程序；处理器，用于执行存储器存储的程序，当存储器存储的程序被执行时，处理器用于执行上述各方面提供的方法。
第十八方面，本申请提供一种处理器，用于执行上述各方面提供的方法。在执行这些方法的过程中，上述方法中有关发送上述信息和获取/接收上述信息的过程，可以理解为由处理器输出上述信息的过程，以及处理器接收输入的上述信息的过程。在输出上述信息时，处理器将该上述信息输出给收发器，以便由收发器进行发射。该上述信息在由处理器输出之后，还可能需要进行其他的处理，然后再到达收发器。类似的，处理器接收输入的上述信息时，收发器获取/接收该上述信息，并将其输入处理器。更进一步的，在收发器收到该上述信息之后，该上述信息可能需要进行其他的处理，然后再输入处理器。
基于上述原理，举例来说，前述方法中提及的接收请求消息可以理解为处理器接收输入的信息。
对于处理器所涉及的发射、发送和获取/接收等操作，如果没有特殊说明，或者，如果未与其在相关描述中的实际作用或者内在逻辑相抵触，则均可以更加一般性的理解为处理器输出和接收、输入等操作，而不是直接由射频电路和天线所进行的发射、发送和接收操作。
在实现过程中，上述处理器可以是专门用于执行这些方法的处理器，也可以是执行存储器中的计算机指令来执行这些方法的处理器，例如通用处理器。上述存储器可以为非瞬时性(non-transitory)存储器，例如只读存储器(read only memory，ROM)，其可以与处理器集成在同一块芯片上，也可以分别设置在不同的芯片上，本申请实施例对存储器的类型以及存储器与处理器的设置方式不做限定。
第十九方面，提供一种计算机可读存储介质，该计算机可读介质存储用于设备执行的程序代码，该程序代码包括用于执行上述各方面提供的方法。
第二十方面，提供一种包含指令的计算机程序产品，当该计算机程序产品在计算机上运行时，使得计算机用于执行上述各方面提供的方法。
第二十一方面，提供一种芯片，该芯片包括处理器与通信接口，该处理器通过该通信接口读取存储器上存储的指令，用于执行上述各方面提供的方法。
可选地，作为一种实现方式，该芯片还可以包括存储器，该存储器中存储有指令，该处理器用于执行该存储器上存储的指令，当该指令被执行时，该处理器用于执行上述各方面提供的方法。
附图说明
图1是本申请的实施例应用的通信系统100的架构示意图。
图2是本申请的实施例应用的通信系统200的架构示意图。
图3是EEC调用UE标识符API的示意性流程图。
图4是一种EES获取UE标识符的示意性流程图。
图5是本申请提供的一种EEC提供IP地址验证的示意性流程图。
图6是本申请提供的一种通信方法的示意性流程图。
图7中的(a)是本申请提供的UPF执行NAT的示意图。
图7中的(b)是本申请提供的另一种通信方法的示意性流程图。
图8是本申请提供的又一种通信方法的示意性流程图。
图9是本申请实施例提供的通信装置10的示意性框图。
图10是本申请实施例提供另一种通信装置20的示意图。
图11是本申请实施例提供一种芯片系统30的示意图。
具体实施方式
下面将结合附图，对本申请中的技术方案进行描述。
本申请实施例的技术方案可以应用于各种通信系统，例如：第五代(5th generation，5G)移动通信系统、新无线接入技术(new radio access technology，NR)系统、长期演进(long term evolution，LTE)系统、LTE频分双工(frequency division duplex，FDD)系统、LTE时分双工(time division duplex，TDD)、通用移动通信系统(universal mobile telecommunication system，UMTS)、或者全球互联微波接入(worldwide interoperability for microwave access，WiMAX)通信系统。其中，移动通信系统可以包括非独立组网(non-standalone，NSA)和/或独立组网(standalone，SA)。或者，本申请提供的技术方案可以应用于未来的通信系统，如第六代移动通信系统等。本申请对此不作限定。
本申请提供的技术方案还可以应用于机器类通信(machine type communication，MTC)、机器间通信长期演进技术(Long Term Evolution-machine，LTE-M)、设备到设备(device-to device，D2D)网络、机器到机器(machine to machine，M2M)网络、物联网(internet of things，IoT)网络或者其他网络。其中，IoT网络例如可以包括车联网。其中，车联网系统中的通信方式统称为车到其他设备(vehicle to X，V2X，X可以代表任何事物)，例如，该V2X可以包括：车辆到车辆(vehicle to vehicle，V2V)通信，车辆与基础设施(vehicle to infrastructure，V2I)通信、车辆与行人之间的通信(vehicle to pedestrian，V2P)或车辆与网络(vehicle to network，V2N)通信等。
本申请的技术方案可以应用于各种通信场景中，例如服务连续性场景、移动边缘计算(mobile edge computing，MEC)场景等，本申请不予限制。其中，MEC可利用无线接入网络就近提供电信用户所需服务和云端计算功能，而创造出一个具备高性能、低延迟与高带宽的电信级服务环境，加速网络中各项内容、服务及应用的快速下载，让消费者享有不间断的高质量网络体验。
图1是本申请的实施例应用的通信系统100的架构示意图。如图1所示，该通信系统包括终端110、核心网120、边缘数据网络(edge data network，EDN)130和边缘配置服务器(edge configuration server，ECS)140。其中，终端110可以部署有一个或多个应用客户端(Application client，AC)111和一个或多个边缘使能客户端(Edge Enabler Client，EEC)112，EDN130中可以部署有一个或多个边缘应用服务器(Edge Application Server，EAS)131和一个或多个边缘使能服务器(Edge Enabler Server，EES)132。
其中，EDGE-1接口是EES132与EEC112之间的接口，EDGE-2接口是EES132与核心网120之间的接口，EDGE-3接口是EAS131与EES132之间的接口，EDGE-4接口是EEC112与ECS140之间的接口，EDGE-5接口是AC111与EEC112之间的接口，EDGE-6接口是EES132与ECS140之间的接口，EDGE-7接口是EAS131与核心网120之间的接口，EDGE-8接口是ECS140与核心网120之间的接口，EDGE-9接口是EES132之间的接口。图1只是示意图，该通信系统中还可以包括其它网络设备，在图1中未画出。
应用用户与应用的提供商签订服务协议，从而为应用用户提供服务。而应用用户可以登录终端110上的AC111，并通过AC111与EAS131的进行通信。EEC112为中间件层，一般位于操作系统中，或者位于AC111与操作系统中间。AC111可以以应用编程接口(Application programinterface，API)的方式 从EEC112获取边缘使能服务。
图1所示的架构可以用于第三代合作伙伴计划(3rd Generation Partnership Project，3GPP)网络中的终端设备发现部署在近端的边缘应用，该架构中的功能实体简介如下：
1、EDN：是一个本地的数据网络，网络中包含EES和EAS。
一种理解为，EDN只对应一个数据网络，是一个特别的本地数据网络，包含边缘使能功能，可以使用数据网络接入标识符(data network access identifier，DNAI)和数据网络名称(data network name，DNN)标识，是网络逻辑概念。
另一种理解为，EDN是中心云的对等概念，可以理解为是一个本地的数据中心(地理位置概念)，可以使用DNAI来标识，可以包含一个或多个本地数据网络。
2、EAS：部署在EDN中的应用可以称为EAS。具体地，EAS可以是指一个服务器应用程序(例如，社交媒体软件、增强现实(augmented reality，AR)、虚拟现实(virtual reality，VR))部署运行在EDN的实例(instance)。
一个应用可在一个或多个EDN中部署一个或多个EAS。部署运行在不同的EDN中的EAS可以认为是一个应用的不同的EAS，可以共享一个域名，可以使用一个IP地址，也可以使用不同的IP地址。
EAS也可以称为边缘应用、边缘应用服务器、应用实例、边缘应用实例、MEC应用、MEC应用服务器、EAS功能等，本申请不予限制。为了描述方便，下文统一称为边缘应用服务器。
3、AC：是应用服务器在终端侧的对等实体，用于应用用户(user)从应用服务器获取应用业务。AC可以是应用在终端侧的客户端程序，可以连接到云上的应用服务器获取应用业务，也可以连接到部署运行在一个或多个EDN中的EAS以获取应用业务。AC也可以称为应用程序客户端，本申请不予限制。
4、EES：为ECS和EAS提供需要的功能，如向EEC提供配置信息，使能UE与EAS交互应用数据，支持应用上下文的传输等。EES可以与3GPP网络直接交互或间接交互。EAS可以向EES发起注册流程，将EAS的信息注册到EES，或者，EAS的信息可以通过管理系统注册到EES上，EES管理注册在该EES上的EAS。
还可以为部署在EDN中的EAS提供一些使能能力。EES可以支持边缘应用服务器的注册、对终端的认证和鉴权、为终端提供边缘应用服务器的IP地址信息等。EES还可以支持获取边缘应用服务器的标识和IP地址信息，并支持进一步将获取的标识和IP地址信息发送给ECS。EES部署在EDN中。
一般情况下，EAS注册到一个EES上，或者，通过管理系统将一个EAS的信息配置在一个EES上，该EES称为该EAS关联的EES，或者，该EAS称为该EES关联的EAS，EES控制或管理注册或配置在该EES上的EAS。
EES关联的EAS也可以替换为EES对应的EAS，EAS关联的EES也可以替换为EAS对应的EES，本申请不予限制。
5、EEC：用于发现EDN网络中可用的EAS。是EES在终端侧的对等实体。EEC可以用于向EES注册EEC的信息及AC的信息、执行安全认证和鉴权、从EES获取EAS的IP地址、向AC提供边缘计算使能能力等，例如EEC可以通过EAS发现服务，将EAS的IP地址返回给AC。
6、ECS：用于向EEC提供EES的信息，可以由运营商部署或者第三方部署。应用用户通过应用客户端与EAS的连接进行通信。边缘使能客户端为中间件层，一般位于操作系统中，或者位于应用客户端与操作系统中间。AC可以以API的方式从EEC获取边缘使能服务。ECS主要负责EDN的配置。例如，ECS可以向终端提供EES的信息。又例如，ECS还可以与应用的DNS交互获取EAS的信息，并直接向终端提供EAS的信息。ECS还可以从其他功能实体获取并保存EAS和IP地址的信息。
7、终端：也可以称为终端设备、用户设备(user equipment，UE)、移动台、移动终端等。终端可以广泛应用于各种场景，例如，设备到设备(device-to-device，D2D)、车物(vehicle to everything，V2X)通信、机器类通信(machine-type communication，MTC)、物联网(internet of things，IoT)、虚拟现实、增强现实、工业控制、自动驾驶、远程医疗、智能电网、智能家具、智能办公、智能穿戴、智能交通、智慧城市等。终端可以是手机、平板电脑、带无线收发功能的电脑、可穿戴设备、车辆、无人机、直升机、飞机、轮船、机器人、机械臂、智能家居设备等。本申请的实施例对终端所采用的具体技术和具体设备形态不做限定。
图1所示的核心网120可以为5G核心网(5G core，5GC)的系统架构，下面结合图2简单介绍5GC的系统架构。
图2是本申请提供的网络架构200的示意图，以3GPP标准化过程中定义的非漫游场景下，基于服务化架构的5G网络架构为例。如图所示，该网络架构可以包括三部分，分别是终端设备部分、DN和运营商网络公共陆地移动网络(public land mobile network，PLMN)部分。下面对各部分的网元的功能进行简单说明。
终端设备部分可以包括终端设备210，该终端设备210参考上述的图1中终端110的描述，这里不再赘述。
运营商网络PLMN部分可以包括但不限于(无线)接入网((radio)access network，(R)AN)220和核心网(core network，CN)部分。
(R)AN220可以看作是运营商网络的子网络，是运营商网络中业务节点(如，提供业务的网元)与终端设备210之间的实施系统。终端设备210要接入运营商网络，首先是经过(R)AN 220，进而可通过(R)AN 220与运营商网络的业务节点连接。本申请实施例中的接入网设备(RAN设备)，是一种为终端设备210提供无线通信功能的设备，也可以称为网络设备，RAN设备包括但不限于：5G系统中的下一代基站节点(next generation node base station，gNB)、长期演进(long term evolution，LTE)中的演进型节点B(evolved node B，eNB)、无线网络控制器(radio network controller，RNC)、节点B(node B，NB)、基站控制器(base station controller，BSC)、基站收发台(base transceiver station，BTS)、家庭基站(例如，home evolved nodeB，或home node B，HNB)、基带单元(base band unit，BBU)、传输点(transmitting and receiving point，TRP)、发射点(transmitting point，TP)、小基站设备(pico)、移动交换中心，或者未来网络中的网络设备等。采用不同无线接入技术的系统中，具备接入网设备功能的设备的名称可能会有所不同。为方便描述，本申请所有实施例中，上述为终端设备210提供无线通信功能的装置统称为接入网设备或简称为RAN或AN。应理解，本文对接入网设备的具体类型不作限定。
CN部分可以包括但不限于如下NF：用户面功能(user plane function，UPF)230、网络开放功能(network exposure function，NEF)231、网络功能存储库功能(network function repository function，NRF)232、策略控制功能(policy control function，PCF)233、统一数据管理功能(unified data management，UDM)234、统一数据存储库功能(unified data repository，UDR)235、绑定支持功能(Binding Support Function，BSF)236、认证服务器功能(authentication server function，AUSF)237、接入与移动性管理功能(access and mobility management function，AMF)238、会话管理功能(session management function，SMF)239。
数据网络DN 240，也可以称为分组数据网络(packet data network，PDN)，通常是位于运营商网络之外的网络，例如第三方网络。当然，在一些实现方式中，DN也可以由运营商进行部署。本申请对DN是否由运营商部署不做限制。运营商网络PLMN可以接入多个数据网络DN 240，数据网络DN 240上可部署多种业务，可为终端设备210提供数据和/或语音等服务。例如，数据网络DN 240可以是某智能工厂的私有网络，智能工厂安装在车间的传感器可以是终端设备210，数据网络DN 240中部署了传感器的控制服务器，控制服务器可为传感器提供服务。传感器可与控制服务器通信，获取控制服务器的指令，根据指令将采集的传感器数据传送给控制服务器等。又例如，数据网络DN 240可以是某公司的内部办公网络，该公司员工的手机或者电脑可为终端设备210，员工的手机或者电脑可以访问公司内部办公网络上的信息、数据资源等。终端设备210可通过运营商网络提供的接口(例如N1等)与运营商网络建立连接，使用运营商网络提供的数据和/或语音等服务。终端设备210还可通过运营商网络访问数据网络DN 240，使用数据网络DN 240上部署的运营商业务，和/或第三方提供的业务。
下面对CN包含的NF功能进行进一步简要说明。
1、UPF：是由运营商提供的网关，是运营商网络与数据网络DN 240通信的网关。UPF包括数据包路由和传输、数据包检测、业务用量上报、服务质量(quality of service，QoS)处理、合法监听、上行数据包检测、下行数据包存储等用户面相关的功能。
2、NEF：是由运营商提供的控制面功能，主要使能第三方使用网络提供的服务，支持网络开放其能力、事件及数据分析、从外部应用给PLMN安全配备信息、PLMN内外交互信息的转换，提供运营商网络对外开放的API接口，提供给外部服务端与内部运营商网络的交互等。
3、NRF：是由运营商提供的控制面功能，可用于维护网络中网络功能、服务的实时信息。例如支持网络服务发现、维护NF实例的NF配置数据(NF profile)支持的服务、支持通信代理(service communication proxy，SCP)的服务发现、维护SCP实例的SCP配置数据(SCP profile)、发送有关新注 册、去注册、更新的NF和SCP的通知、维护NF和SCP运行的健康状态等。
4、PCF：是由运营商提供的控制面功能，它支持统一的策略框架来治理网络行为、向其他控制功能提供策略规则、策略决策相关的签约信息等。
5、UDM：是由运营商提供的控制面功能，负责存储运营商网络中签约用户的用户永久标识符(subscriber permanent identifier，SUPI)、签约用户的公开使用的签约标识(generic public subscription identifier，GPSI)，信任状(credential)等信息。其中SUPI在传输过程中会先进行加密，加密后的SUPI被称为隐藏的用户签约标识符(subscription concealed identifier，SUCI)。UDM所存储的这些信息可用于终端设备接入运营商网络的认证和授权。其中，上述运营商网络的签约用户具体可为使用运营商网络提供的业务的用户，例如使用中国电信的用户识别模块(subscriber identity module，SIM)卡的用户，或者使用中国移动的SIM卡的用户等。上述签约用户的信任状可以是SIM卡中存储的长期密钥或者跟SIM卡加密相关的信息等存储的小文件，用于认证和/或授权。需要说明的是，永久标识符、信任状、安全上下文、认证数据(cookie)、以及令牌等同验证/认证、授权相关的信息，在本申请实施例中，为了描述方便起见不做区分、限制。
6、UDR：是由运营商提供的控制面功能，为UDM提供存储和获取签约数据的功能、为PCF提供存储和获取策略数据、存储和获取用户的NF群组ID(group ID)信息等。
7、BSF：主要用于存储选择的PCF对应的内部信息，具体的，如针对一个协议数据单元(Protocol Data Unit,PDU)会话，BSF存储的内部信息包含用户标识(如SUPI)，DNN，UE地址(IP地址或MAC地址)等。针对一个UE，BSF存储的内部信息包含用户标识，选择的PCF地址等。在本申请中，BSF主要负责会话信息绑定，因此在本申请中BSF也可以理解为具有会话信息绑定功能的网元，该具有会话信息绑定功能的网元称为BSF只是一种示例，后续还可以有其他的网元名称，本申请对此不作限定。
8、AUSF：是由运营商提供的控制面功能，通常用于主认证，即终端设备110(签约用户)与运营商网络之间的认证。AUSF接收到签约用户发起的认证请求之后，可通过UDM中存储的认证信息和/或授权信息对签约用户进行认证和/或授权，或者通过UDM生成签约用户的认证和/或授权信息。AUSF可向签约用户反馈认证信息和/或授权信息。
9、AMF：是由运营商网络提供的控制面网络功能，负责终端设备接入运营商网络的接入控制和移动性管理，例如包括移动状态管理，分配用户临时身份标识，认证和授权用户等功能。
AMF用于与UE进行NAS连接，拥有与UE相同的5G NAS安全上下文。5G NAS安全上下文包括KAMF、NAS层级密钥与其相同的密钥标识信息、UE安全能力，以及上下行NAS COUNT值。NAS层级密钥包括NAS加密密钥和NAS完整性保护密钥，分别用于NAS消息的机密性保护和完整性保护。
10、SMF：是由运营商网络提供的控制面网络功能，负责管理终端设备的PDU会话。PDU会话是一个用于传输PDU的通道，终端设备需要通过PDU会话与数据网络DN互相传送PDU。PDU会话由SMF负责建立、维护和删除等。SMF包括会话管理(例如会话建立、修改和释放，包含用户面功能UPF 130和(R)AN 120之间的隧道维护)、UPF的选择和控制、业务和会话连续性(service and session continuity，SSC)模式选择、漫游等会话相关的功能。
11、AF：是由运营商网络提供的控制面网络功能，用于提供应用层信息，可以通过网络开放功能网元，与策略框架交互或直接与策略框架交互进行策略决策请求等。可以位于运营商网络内，或位于运营商网络外。
可以理解的是，上述网元或者功能既可以是硬件设备中的物理实体，也可以是在专用硬件上运行的软件实例，或者是共享平台(例如，云平台)上实例化的虚拟化功能。简单来说，一个NF可以由硬件来实现，也可以由软件来实现。
图2中Nnef、Nnrf、Npcf、Nudm、Nudr、Nnwdaf、Nausf、Namf、Nsmf、N1、N2、N3、N4，以及N6为接口序列号。示例性的，上述接口序列号的含义可参见3GPP标准协议中定义的含义，本申请对于上述接口序列号的含义不做限制。需要说明的是，图中的各个网络功能之间的接口名称仅仅是一个示例，在具体实现中，该系统架构的接口名称还可能为其他名称，本申请对此不作限定。此外，上述各个网元之间的所传输的消息(或信令)的名称也仅仅是一个示例，对消息本身的功能不构成任何限定。
为方便说明，本申请实施例中将网络功能(如NEF…SMF等)统称/简称为NF，即本申请实施例中后文所描述的NF可替换为任一个网络功能。另外，图2仅示意性地描述了部分网络功能，后文所描述的NF不局限于图2中示出的网络功能。
应理解，上述应用于本申请实施例的网络架构仅是从服务化架构的角度描述的网络架构，适用本申请实施例的网络架构并不局限于此，任何能够实现上述各个网元的功能的网络架构都适用于本申请实施例。
还应理解，图中所示的AMF、SMF、UPF、NEF、AUSF、NRF、PCF、UDM可以理解为核心网中用于实现不同功能的网元，例如可以按需组合成网络切片。这些核心网网元可以各自独立的设备，也可以集成于同一设备中实现不同的功能，本申请对于上述网元的具体形态不作限定。
还应理解，上述命名仅为便于区分不同的功能而定义，不应对本申请构成任何限定。本申请并不排除在5G网络以及未来其它的网络中采用其他命名的可能。例如，在6G网络中，上述各个网元中的部分或全部可以沿用5G中的术语，也可能采用其他名称等。
为便于理解本申请实施例，对本申请涉及的一些基本概念做简要说明。
1、本地数据网络(local DN)：可以是距离用户的附着点(attachment point)很近的一个数据网络的接入点(access point)。
2、应用上下文(application context)：可以指和一个或一组用户相关的运行状态信息，例如，游戏进程、ML的历史数据等。可选地，应用上下文还可以包含该一个或多个用户在EAS与核心网的订阅的上下文，例如订阅的事务标识等。可选地，应用上下文还可以包括该一个或多个用户在EES上的上下文，例如，EAS对该一个或多个用户的订阅的事务标识。
3、UE标识符API：为了获取唯一识别UE的标识符(或者称为UE ID)，EES向EAS和EEC开放了UE标识符API。UE标识符API用于EAS或EEC从EES获取UE的标识。其中EEC调用UE标识API可以用于下述场景：
EAS直接向EES调用UE标识符API时由于网络地址转化(Network Address Translation，NAT)的使用导致获取UE ID失败时，EAS可以选择向AC发送信令以使得AC向EEC发起UE ID查询，进一步的EEC使用核心网分配的IP地址(如，IPv4和/或IPv6)调用EES的UE标识符API获取UE的标识符，并将获取的UE的标识符通过AC发送给EAS。
为了便于理解，下面结合图3简单介绍EEC调用UE标识符API的流程。图3是EEC调用UE标识符API的示意性流程图，包括以下步骤：
S310，EEC向EES发送UE标识符API请求。
UE标识符API请求中包含UE私有IP地址，该UE私有IP地址为核心网络提供给UE的IP地址(可以为IPv4地址或IPv6地址)。
S320，EES获取UE标识符。
具体的，EES根据UE标识符API请求中的UE私有IP地址从核心网络获取UE标识符。下面将结合图4详细说明EES如何获取UE标识符(Identifier，ID)，这里不进行赘述。
S330，EES向EEC发送UE标识符API响应。
UE标识符API响应中包含UE标识符。该UE标识符为上述的步骤S320中获取的UE标识符。
图4是一种EES获取UE标识符的示意性流程图，包括以下步骤：
S410，AF向NEF发送请求消息#A。
请求消息#A用于请求UE ID。例如，AF通过Nnef_UEId_Get服务操作请求UE ID。
其中，请求消息#A应包括UE地址(如，IP地址或MAC地址)和AF标识符，还可以包括与IP地址关联的端口号、应用端口ID、IP域等。
可选地，AF还可以提供相应的数据网络名称(Data Network Name，DNN)和/或单个网络切片选择辅助信息(Single network slice selection assistance information，S-NSSAI)。
S420，NEF授权AF请求。
如果NEF未授权AF请求，NEF向AF回复结果值，指示授权失败；否则，NEF继续执行以下步骤。
可选地，NEF确定相应的DNN和/或S-NSSAI信息：DNN和/或S-NSSAI可以是由AF提供的，也可以是由NEF根据请求消息#A中的AF标识符确定的。
如果NEF在步骤S410中收到了端口号，则根据配置，NEF可以识别接收到的地址与5GC分配的实际私有UE IP地址是否为不同的IP地址。如果是不同的IP地，NEF执行步骤S430至S460。否则，跳过步骤S430至S460。
S430，NEF向NRF发送请求消息#B。
请求消息#B用于获取为UE(公共)IP地址实现NAT功能的UPF的地址。例如，NEF使用Nnrf_NFDiscovery服务操作获取实现NAT功能的UPF的地址。
请求消息#B中包括UE(公网)IP地址，还可以包括与AF ID关联的DNN和S-NSSAI，以及IP域等。
S440，NRF向NEF发送响应消息#B。
响应消息#B响应于上述的请求消息#B，响应消息#B中包括为UE(公共)IP地址实现NAT功能的UPF的地址。例如，NRF向NEF发送Nnrf_NFDiscovery响应消息。
S450，NEF向UPF发送请求消息#C。
请求消息#C用于获取UE(私有)IP地址。例如，NEF向UPF发送Nupf_GetPrivateUEIP_Get服务操作。
该请求消息#C包括UE(公共)IP地址和端口号，以及可选的与AF ID关联的IP域、DNN和S-NSSAI。
S460，UPF向NEF发送响应消息#C。
响应消息#C响应于上述的请求消息#C，响应消息#C中包括UE的IP地址和可选的IP域。例如，UPF向NEF发送响应Nupf_GetPrivateUEIP_Get响应消息。
如果UPF应用了NAT功能，则UPF返回的UE IP地址为UE的私有IP地址。
S470，NEF向BSF发送请求消息#D。
请求消息#D中包含UE地址和IP域和/或DNN和/或S-NSSAI，检索UE的会话绑定信息。例如，NEF向BSF发送Nbsf_Management_Discovery服务操作。
S480，BSF向NEF发送响应消息#D。
响应消息#D响应于上述的请求消息#D，如果响应消息#D中没有携带SUPI。NEF向AF回复Result值，指示UE ID不可用。
S490，NEF向UDM发送请求消息#E。
NEF与UDM交互，例如，通过Nudm_SDM_Get服务操作检索AF特定的UE标识符。请求消息#E包括SUPI，应用端口ID或AF标识符中的至少一个。
S491，UDM向NEF发送响应消息#E。
UDM以AF特定的UE标识符响应NEF，该标识符表示为UE的外部标识符，该标识符与应用端口ID、MTC提供商信息和/或AF标识符唯一关联。
S492，NEF向AF发送响应消息#A。
NEF使用从UDM接收的信息(包括外部标识符)响应AF。
此外，为了便于理解本申请实施例，做出以下几点说明。
第一，在本申请中，“用于指示”可以包括用于直接指示和用于间接指示。当描述某一指示信息用于指示A时，可以包括该指示信息直接指示A或间接指示A，而并不代表该指示信息中一定包括有A。
将指示信息所指示的信息称为待指示信息，则具体实现过程中，对待指示信息进行指示的方式有很多种。待指示信息可以作为一个整体一起发送，也可以分成多个子信息分开发送，而且这些子信息的发送周期和/或发送时机可以相同，也可以不同。具体发送方法本申请不进行限定。其中，这些子信息的发送周期和/或发送时机可以是预先定义的，例如根据协议预先定义的，也可以是发射端设备通过向接收端设备发送配置信息来配置的。
第二，在本申请中示出的“至少一个”是指一个或者多个，“多个”是指两个或两个以上。另外，在本申请的实施例中，“第一”、“第二”以及各种数字编号(例如，“#1”、“#2”等)只是为了描述方便进行的区分，并不用来限制本申请实施例的范围。下文各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定，应该理解这样描述的对象在适当情况下可以互换，以便能够描述本申请的实施例以外的方案。此外，在本申请实施例中，“510”、“520”等字样仅为了描述方便作出的标识，并不是对执行步骤的次序进行限定。
第三，在本申请中，“示例性的”或者“例如”等词用于表示作例子、例证或说明。本申请中被描述为“示例性的”或者“例如”的任何实施例或设计方案不应被解释为比其他实施例或设计方案更优选或更具优势。确切而言，使用“示例性的”或者“例如”等词旨在以具体方式呈现相关概念。
第四，本申请实施例中涉及的“保存”，可以是指的保存在一个或者多个存储器中。所述一个或者多个 存储器，可以是单独的设置，也可以是集成在编码器或者译码器，处理器、或通信装置中。所述一个或者多个存储器，也可以是一部分单独设置，一部分集成在译码器、处理器、或通信装置中。存储器的类型可以是任意形式的存储介质，本申请并不对此限定。
第五，本申请实施例中涉及的“协议”可以是指通信领域的标准协议，例如可以包括LTE协议、NR协议以及应用于未来的通信系统中的相关协议，本申请对此不做限定。
第六，在本申请实施例中，“在…情况下”、“当…时”、“若…”有时可以混用，应当指出的是，在不强调其区别时，其所要表达的含义是一致的。
第七，在本申请实施例中，各术语及英文缩略语，如无线资源控制(RRC)等，均为方便描述而给出的示例性举例，不应对本申请构成任何限定。本申请并不排除在已有或未来的协议中定义其它能够实现相同或相似功能的术语的可能。
第八，本文中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系。
上文结合图1简单介绍了本申请实施例提供的通信方法能够应用的场景，以及介绍了本申请实施例中可能涉及到的基本概念，并在基本概念中结合图3和图4介绍了EEC调用UE标识符API的流程，目前协议中规定：针对EEC调用UE标识符API的流程，提出若EEC提供的私有IP地址没有被验证或者EEC未被授权使用提供的私有IP地址，则恶意的EEC可以使用IP地址欺骗攻击获取其他UE的标识。为了避免恶意的EEC可以使用IP地址欺骗攻击获取其他UE的标识，一种解决方案是EEC提供IP地址验证，下面结合图5简单介绍该解决方案。
图5是本申请提供的一种EEC提供IP地址验证的示意性流程图，包括以下步骤：
S510，PDU会话建立。
该实施例中，在PDU会话建立中，SMF或UPF在UE IP地址分配过程中生成随机票证值，将票证值发送给PCF，然后作为PDU会话绑定信息的一部分存储在BSF中。除了私网IP地址外，还将票证值发送给UE。
S520，UE向EES发送消息#1。
该消息#1中包括上述的票证值和私网IP地址。
S530，EES调用UE标识符。
具体地，EES使用票证值和私网IP地址调用Nnef_UEId GET服务操作。NEF在Nbsf_Management_Discovery业务操作中将接收到的票证值发送给BSF,BSF通过检查票证值与IP地址的映射关系进行校验。如果验证成功，则NEF向EES提供AF特定的GPSI。
但是图5所示的解决方案需要修改现有的PDU会话建立流程，影响UE、SMF和BSF网元。
本申请提供一种通信方法，可以应用在图1所示的通信系统中，以期在不影响PDU会话建立流程的前提下，实现EEC调用UE标识符API的安全保护。
应理解，下文示出的实施例并未对本申请实施例提供的方法的执行主体的具体结构特别限定，只要能够通过运行记录有本申请实施例的提供的方法的代码的程序，以根据本申请实施例提供的方法进行通信即可。例如，本申请实施例提供的方法的执行主体可以是网元，或者，是网元中能够调用程序并执行程序的功能模块。
图6是本申请提供的一种通信方法的示意性流程图。包括以下步骤：
S601，边缘应用服务器和应用客户端之间建立连接。
示例性地，该实施例中边缘应用服务器和应用客户端之间建立连接的一种可能的方式为：当终端用户需要获取业务时，可以对终端设备中的应用客户端进行操作(如，点击应用客户端)，以使得应用客户端向提供业务的应用服务器发送连接建立请求，从而与应用服务器建立连接。若提供终端设备获取的提供业务的应用服务器为边缘应用服务器时，则应用客户端与边缘应用服务器建立连接。
边缘应用服务器可以是前文图1中所示的EAS。应理解，该实施例中对于边缘应用服务器的名称不做限定，能够实现该实施例中边缘应用服务器具备的功能的设备均可以认为是该实施例中涉及的边缘应用服务器。为了便于描述，下文中以边缘应用服务器为EAS为例进行说明。
另外，应用客户端可以是前文图1中所示的AC。应理解，该实施例中对于应用客户端的名称不做限定，能够实现该实施例中应用客户端具备的功能的设备均可以认为是该实施例中涉及的应用客户端。为 了便于描述，下文中以应用客户端为AC为例进行说明。
S602，边缘使能客户端和边缘使能服务器之间建立连接。
示例性地，该实施例中边缘使用客户端和边缘使能服务器之间建立连接的一种可能的方式为：在步骤601中的终端设备中的应用客户端需要发现提供业务的应用服务器时，应用客户端向边缘使能客户端向发送消息，以使得边缘使能客户端与边缘配置功能交互获取边缘使能服务器的信息，进一步的边缘使能客户端与边缘使能服务器之间建立连接。示例性地，该连接可以是基于传输层安全的连接，其中安全连接的建立可以是基于边缘使能服务器的证书的单向认证建立的，或者基于通用引导体系结构(Generic Bootstrapping Architecture，GBA)建立的，或者基于应用认证和密钥管理(Authentication and Key Management for Applications，AKMA)建立的。
边缘使能客户端可以是前文图1中所示的EEC。应理解，该实施例中对于边缘使能客户端的名称不做限定，能够实现该实施例中边缘使能客户端具备的功能的设备均可以认为是该实施例中涉及的边缘使能客户端。为了便于描述，下文中以边缘使能客户端为EEC为例进行说明。
边缘使能服务器可以是前文图1中所示的EES。应理解，该实施例中对于边缘使能服务器的名称不做限定，能够实现该实施例中边缘使能服务器具备的功能的设备均可以认为是该实施例中涉及的边缘使能服务器。为了便于描述，下文中以边缘使能服务器为EES为例进行说明。
S610，EAS向AC发送请求消息#1，或者说，AC接收来自EAS的请求消息#1。
具体地，在该实施例中EAS确定通过EEC获取UE的标识符时，EAS向AC发送请求消息#1，该请求消息#1用于获取UE的标识符。例如，EAS直接向EES调用UE标识符API时，由于NAT的使用导致EAS获取UE ID失败时，EAS可以选择向AC发送信令以使得AC向EEC发起UE ID查询，进一步的EEC调用EES的UE的标识符API获取UE的标识符，并将获取的UE的标识符通过AC发送给EAS。
需要说明的是，该实施例中对于EAS基于何种原因向AC发起UE的标识符获取请求不做限定，上述的EAS直接向EES调用UE标识符API获取UE ID失败只是一种示例，对本申请的保护范围不构成任何的限定，EAS还可以在其他场景下向AC发起UE的标识符获取请求，例如，EAS被配置为通过AC获取UE的标识符，这里不在一一举例说明。
S620，AC向EEC发送请求消息#2，或者说，EEC接收来自AC的请求消息#2。
具体地，AC根据来自EAS的请求消息#1向EEC发送获取UE ID的请求消息#2，请求消息#2中包含EAS的标识(identifier，ID)。其中，请求消息#2相关的定义可参见目前协议中(如，3GPP TS 23.558中章节8.14.2.6)关于AC向EEC发送获取UE ID的请求消息的描述，该实施例中对此不进行详述。
进一步地，EEC接收到AC发送的获取UE ID的请求消息#2之后，向边缘使能服务器发送第一UE标识符API请求消息，则图6所示的方法还包括：
S630，EEC向EES发送第一请求消息，或者说，EES接收来自EEC的第一请求消息。其中，第一请求消息用于获取终端设备的标识符。
可选地，第一请求消息为第一UE标识符API请求消息，为了便于描述，下文中以第一请求消息为第一UE标识符API请求消息为例进行说明，但是本申请实施例中对于第一请求消息的具体形式不做限定，还可以是其他EEC向边缘使能服务器发送的能够用于获取终端设备的标识符的消息。
另外，需要说明的是EEC属于终端设备，所以上述的EEC向EES发送第一请求消息，也可以理解为终端设备向EES发送第一请求消息。
具体地，该第一UE标识符API请求消息中包括终端设备的第一私有地址和EAS ID。其中，终端设备的第一私有地址可用于在5GC网络中标识终端设备，包括但不限于终端设备的第一私有IP地址，为了便于描述，下文中以终端设备的第一私有地址为第一私有IP地址为例进行说明，但是本申请实施例中对于第一私有地址的具体形式不做限定，还可以是其他能够在5GC网络中标识终端设备的地址(如，MAC地址等)。
需要说明的是，该第一UE标识符API请求消息经由UPF发送至EES，若UPF进行NAT处理，则将接收到的包含第一UE标识符API请求消息的IP数据包的第一私有IP地址替换为UE的公共IP地址，并且将端口号设置为该公共IP地址下标识该终端设备的端口号。
为了便于理解，结合图7中的(a)简单介绍UPF如何进行NAT处理。从图7中的(a)可以看出，UPF可以接收来自不同的EEC或者说UE(如，图7中的(a)所示的UE/EEC 1和UE/EEC 2)的包含UE标识符API请求消息的IP数据包，其中，UE/EEC 1发送的IP数据包#1的私有IP地址为私有IP地址 #1，UE/EEC 2发送的IP数据包的私有IP地址为私有IP地址#2，UPF接收到UE/EEC 1发送的IP数据包#1之后，若进行NAT处理，则IP数据包#1的私有IP地址#1替换为UE1的公共IP地址#1和端口号#1，得到IP数据包#1’；UPF接收到UE/EEC 2发送的IP数据包#2之后，若进行NAT处理，则IP数据包#2的私有IP地址#2替换为UE2的公共IP地址#2和端口号#2，得到IP数据包#2’。UPF再将执行NAT处理之后的IP数据包#1’和IP数据包#2’发送给EES，则在EES侧接收到IP数据包#1’和IP数据包#2’，且该IP数据包#1’的源IP地址为公共IP地址#1，源端口号为端口号#1，该IP数据包#2’的源IP地址为公共IP地址#2，源端口号为端口号#2。
可选地，在该实施例中EES接收到上述的第一UE标识符API请求消息之后，可以确定EEC和/或UE是否被认证，则图6所示的方法流程还可以包括：
S640，EES确定EEC和/或UE是否被认证。
示例性地，EES可以通过如下几种实现方式确定EEC和/或UE是否被认证：
作为一种可能的实现方式，步骤602中，若EEC与EES之间使用双向认证机制(如，通用引导体系结构(Generic Bootstrapping Architecture，GBA)或应用认证和密钥管理(Authentication and Key Management for Applications，AKMA))建立安全连接，则EES确定所述终端设备被认证。
作为另一种可能的实现方式，步骤602中，若EEC与EES之间基于EES的证书进行认证，则表明UE未被认证。
作为又一种可能的实现方式，步骤602中，若EES基于令牌对EEC进行认证，则表明EEC被认证。
可选地，上述的EES确定EEC和/或UE是否被认证所需的信息(如，EEC与EES之间安全连接建立方式、认证方式等)可以存储在EES本地，如，作为EEC和/或UE的上下文存储在EES本地。
应理解，上述几种实现方式只是举例说明EES如何确定EEC和/或UE是否被认证，对本申请的保护范围不构成任何的限定，EES还可以通过其他可能的方式确定EEC和/或UE是否被认证，这里不再一一举例说明。
还应理解，该实施例中上述的步骤S640可以不执行，也就是说在该实施例中EES可以不确定EEC和/或UE是否被认证。S650，EES获取终端设备的公共地址和端口号。
作为一种可能的实现方式，EES可根据接收到封装第一UE标识符API请求消息的IP数据包头中源地址位和源端口号位获取UE的公共地址和端口号。其中，IP数据包的源地址为该UE的公共地址，该IP数据包的源端口号为该UE的端口号，UE的公共地址和关联的端口号可用于UPF下唯一标识一个终端设备，包括但不限于终端设备的公共IP地址，为了便于描述，下文中以终端设备的公共地址为公共IP地址为例进行说明，但是本申请实施例中对于公共地址的具体形式不做限定，还可以是其他能够和关联的端口号在UPF下唯一标识一个终端设备的地址。
作为另一种可能的实现方式，EES根据接收到的第一UE标识符API请求消息中的EAS ID，请求EAS提供UE的公共IP地址和端口号。
示例性地，EES从EAS获取UE的公共IP地址和端口号的流程，包括以下步骤一至三：
步骤一：EES根据UE标识API请求消息中EAS标识，向EAS发送IP地址获取消息；
步骤二：EAS根据与UE(如，AC)交互的IP数据包获取UE的公共IP地址和端口号；或者EAS从本地获取UE的公共IP地址和端口号，其中本地存储的UE的公共IP地址和端口号可以被步骤一之前，EAS与UE交互的过程中获取并存储的。
步骤三：EAS向EES发送UE的公共IP地址和端口号。S660，EES向网络开放功能网元发送第二请求消息，或者说，网络开放功能网元接收来自EES的第二请求消息。
网络开放功能网元可以是前文图2中所示的NEF。应理解，该实施例中对于网络开放功能网元的名称不做限定，能够实现该实施例中网络开放功能网元具备的功能的网元均可以认为是该实施例中涉及的网络开放功能网元。为了便于描述，下文中以网络开放功能网元为NEF为例进行说明。
具体地，该第一请求消息中包括终端设备的第一私有IP地址、终端设备的公共IP地址和端口号。
可选地，第二请求消息为Nnrf_UEId_Get请求。
进一步地，NEF接收到上述的第二请求消息之后，向网络功能存储库功能网元查询实现NAT功能的UPF的地址，则图6所示的方法流程还包括：
S670，NEF向网络功能存储库功能网元发送发现请求消息，或者说，网络功能存储库功能网元接收来自NEF的发现请求消息。
网络功能存储库功能网元可以是前文图2中所示的NRF。应理解，该实施例中对于网络功能存储库功能网元的名称不做限定，能够实现该实施例中网络功能存储库功能网元具备的功能的网元均可以认为是该实施例中涉及的网络功能存储库功能网元。为了便于描述，下文中以网络功能存储库功能网元为NRF为例进行说明。
具体地，发现请求消息中包括终端设备的公共IP地址。
可选地，发现请求消息为Nnrf_NFDiscovery请求。该实施例中，NEF根据第一请求消息中包含的端口号，确定向NRF发送Nnrf_NFDiscovery请求，该请求用于获取实现NAT功能的UPF的地址。
S680，NRF向NEF发送发现响应消息，或者说，NEF接收来自NRF的发现响应消息。
该响应消息中包括为UE(公共)IP地址实现NAT功能的UPF的地址。例如，响应消息中包括UPF#1的地址，该UPF#1能够为UE(公共)IP地址实现NAT。
可选地，发现响应消息为Nnrf_NFDiscovery响应。
该实施例中，NEF从NRF获取到为UE(公共)IP地址实现NAT功能的UPF的地址之后，可以从UPF获取用于判断EEC提供的第一私有IP地址是否有效的信息，或者，还可以请求该UPF判断该第一私有IP地址是否有效。示例性地，可以根据UE的公共IP地址和端口号判断第一私有IP地址是否有效，例如，获取公共IP地址和端口号对应的第二私有IP地址，若第一私有IP地址和第二私有IP地址相同，则第一私有IP地址有效。
其中，第一私有IP地址有效可以理解为EEC提供的第一私有IP地址是合法的或者是准确的或者正确的或者是被分配给EEC所属的终端设备或者是与终端设备的公共地址和端口对应的，第一私有IP地址无效可以理解为EEC提供的第一私有IP地址是不合法或者说不准确的或者不正确的或者不是被分配给EEC的终端设备或者与终端设备的公共地址和端口号不对应。
该实施例中，判断第一私有IP地址是否有效，包括但不限于以下几种实现方式：
实现方式#1：NEF向该UPF请求用于验证EEC提供的第一私有IP地址的终端设备的第二私有IP地址，则在该实现方式#1所示的情况下，图6所示的方法流程还包括：
S611，NEF向UPF发送第三请求消息，或者说，UPF接收来自NEF的第三请求消息。
该第三请求消息用于获取终端设备的第二私有地址。具体地，第三请求消息中包括终端设备的公共IP地址和端口号。
S612，UPF向NEF发送第三响应消息，或者说，NEF接收来自UPF的第三响应消息。
该第三响应消息中包括终端设备的第二私有地址。
S613，NEF确定第一私有IP地址是否有效。
作为一种可能的实现方式，若终端设备的第二私有IP地址和终端设备的第一私有IP地址相同，则NEF确定第一私有IP地址有效，执行后续的步骤S690至S698。应理解，在该实现方式下，NEF通过终端设备的第二私有IP地址和终端设备的第一私有IP地址相同，确定执行后续的步骤S690至S698。
作为另一种可能的实现方式，若终端设备的第二私有IP地址和终端设备的第一私有IP地址不相同，则NEF确定第一私有IP地址无效。NEF可以通过第二响应消息指示EES获取UE的标识符失败，如，第二响应消息中携带第一指示信息，该第一指示信息指示获取UE的标识符失败。可选地，第二响应消息还可以携带失败的原因值，如EEC提供的IP地址未被授权或错误。
实现方式#2：NEF向该UPF请求用于验证EEC提供的第一私有IP地址的至少一个私有IP地址，以及至少一个私有IP地址对应的端口号，则在该实现方式#2所示的情况下，图6所示的方法流程还包括：
S621，NEF向UPF发送第四请求消息，或者说，UPF接收来自NEF的第四请求消息。
该第四请求消息用于获取公共IP地址对应的至少一个私有IP地址，以及该至少一个私有IP地址对应的端口号。具体地，第四请求消息中包括终端设备的公共IP地址。
其中，公共IP地址对应的至少一个私有IP地址，以及该至少一个私有IP地址对应的端口号可以理解为：公共IP地址对应有：端口号1，私有IP地址1、，端口号2，私有IP地址2…等，一个公共IP地址可以对应一个或者多个私有IP地址，每个私有IP地址与一个端口号对应。
S622，UPF向NEF发送第四响应消息，或者说，NEF接收来自UPF的第四响应消息。
该第四响应消息中包括公共IP地址对应的至少一个私有IP地址，以及至少一个私有IP地址对应的端口号。
S623，NEF确定第一私有IP地址是否有效。
作为一种可能的实现方式，NEF根据从EES接收到的端口号，从UPF接收到的公共IP地址对应的至少一个私有IP地址和至少一个私有IP地址对应的端口号获取第二私有IP地址，例如，公共IP地址对应的至少一个私有IP地址为：私有IP地址1和私有IP地址2，私有IP地址1对应端口号1，私有IP地址2对应端口号2，若从EES接收到的端口号为端口号2，则获取到的第二私有IP地址为私有IP地址2。
在该实现方式下，NEF根据第一私有IP地址和第二私有IP地址是否相同，确定第一私有IP地址是否有效。
若终端设备的第二私有IP地址和终端设备的第一私有IP地址相同，则执行后续的步骤S690至S698。
作为另一种可能的实现方式，NEF判断至少一个私有IP地址不包含第一私有IP地址，确定所述第一私有IP地址无效。
在该实现方式下，NEF可以通过第二响应消息指示EES获取UE的标识符失败，如，第二响应消息中携带第一指示信息，该第一指示信息指示获取UE的标识符失败。可选地，第二响应消息还可以携带失败的原因值，如EEC提供的IP地址未被授权或错误。
作为又一种可能的实现方式，若所述至少一个私有地址包含所述第一私有地址，且所述第一私有地址对应的端口号与所述端口号相同，确定所述第一私有地址有效，执行后续的步骤S690至S698。
需要说明的是，当NEF本地保存有公共IP地址对应的至少一个私有IP地址，以及至少一个私有IP地址对应的端口号时，NEF可以不执行上述的步骤S621和S622，执行上述的S623即可(例如，在执行上述的步骤S621之前，查询本地未保存有公共IP地址对应的至少一个私有IP地址，以及至少一个私有IP地址对应的端口号)。示例性地，NEF在接收到第二请求消息之前已经获取到上述的公共IP地址对应的至少一个私有IP地址，以及至少一个私有IP地址对应的端口号。
可选地，在该实现方式#2所示的情况下，NEF还可以向UPF订阅关系列表，则还可以包括：
S624，NEF向UPF发送订阅请求消息，或者说，UPF接收来自NEF的订阅请求消息。
具体地，NEF向UPF发送Nupf_PrivateUEIP_Subscribe消息，用于指示UPF在公共IP地址对应的私有IP地址和端口号信息发生变更(包含新增UE私有IP地址，端口号，或者删除私有IP地址和端口号)时，通知NEF新的列表。
S625，UPF向NEF发送订阅响应消息，或者说，NEF接收来自UPF的订阅响应消息。
当UPF接收到仅仅包含UE公共IP地址的Nupf_PrivateUEIP_Get消息时，默认在UE公共IP地址对应的私有IP地址和端口号信息发生变更时，通知NEF新的列表。示例性地，UPF可以通过一个或者多个订阅响应消息向NEF提供上述的公共IP地址对应的至少一个私有IP地址，以及至少一个私有IP地址对应的端口号。
实现方式#3：NEF向该UPF请求验证EEC提供的第一私有IP地址，则在该实现方式#3所示的情况下，图6所示的方法流程还包括：
S631，NEF向UPF发送第五请求消息，或者说，UPF接收来自NEF的第五请求消息。
该第五请求消息用于请求UPF验证EEC提供的第一私有IP地址。该第五请求消息中包括终端设备的公共IP地址、终端设备的第一私有IP地址和端口号。
S632，UPF确定第一私有IP地址是否有效。
作为一种可能的实现方式，UPF根据接收到的终端设备的第一私有IP地址获取对应的UE公共IP地址和端口号，并与接收到终端设备的公共IP地址和端口号进行对比，相同则确定第一私有IP地址有效，不同则确定第一私有IP地址无效。
作为另一种可能的实现方式，UPF根据终端设备的第一私有IP地址无法获取对应的信息，则确定第一私有IP地址无效。
作为又一种可能的实现方式，UPF根据接收到的终端设备的公共IP地址和端口号获取对应的第二私有IP地址，验证第二私有IP地址与终端设备的第一私有IP地址是否相同，相同则确定第一私有IP地址有效，不同则确定第一私有IP地址无效。
S633，UPF向NEF发送第五响应消息，或者说，NEF接收来自UPF的第五响应消息。
该第五响应消息用于指示第一私有IP地址是否有效。
作为一种可能的实现方式，若第一私有IP地址有效，执行后续的步骤S690至S698。
作为另一种可能的实现方式，若第一私有IP地址无效，NEF可以通过第二响应消息指示EES获取UE的标识符失败，如，第二响应消息中携带第一指示信息，该第一指示信息指示获取UE的标识符失败。 可选地，第二响应消息还可以携带失败的原因值，如EEC提供的IP地址未被授权或错误。
S690，NEF向绑定支持功能网元发送检索请求消息，或者说，绑定支持功能网元接收来自NEF的检索请求消息。
绑定支持功能网元可以是前文图2中所示的BSF。应理解，该实施例中对于绑定支持功能网元的名称不做限定，能够实现该实施例中绑定支持功能网元具备的功能的设备均可以认为是该实施例中涉及的绑定支持功能网元。为了便于描述，下文中以绑定支持功能网元为BSF为例进行说明。
具体地，检索请求消息中包括终端设备的第一私有IP地址。检索请求消息用于检索UE的会话绑定信息。
可选地，检索请求消息为Nbsf_Management_Discovery服务操作。
S691，BSF向NEF发送检索响应消息，或者说，NEF接收来自BSF的检索响应消息。
具体地，检索响应消息中包括会话绑定信息。
作为一种可能的实现方式，如果BSF发送的会话绑定信息中没有收到SUPI，执行下述的步骤S692。
S692，NEF向EES回复结果(Result)值，指示UE ID不可用。
作为另一种可能的实现方式，如果BSF发送的会话绑定信息中包含SUPI，执行下述的步骤S693。
S693，NEF向统一数据管理功能网元发送请求消息#3，或者说，统一数据管理功能网元接收来自NEF的请求消息#3。
统一数据管理功能网元可以是前文图2中所示的UDM。应理解，该实施例中对于统一数据管理功能网元的名称不做限定，能够实现该实施例中统一数据管理功能网元具备的功能的设备均可以认为是该实施例中涉及的统一数据管理功能网元。为了便于描述，下文中以统一数据管理功能网元为UDM为例进行说明。
具体地，请求消息#3中包括SUPI，应用端口ID、EES标识符、EAS标识符中的至少一个。
S694，UDM向NEF发送响应消息#3，或者说，NEF接收来自UDM的响应消息#3。
具体地，响应消息#3中包括UE的标识符，UE的标识符可以为GPSI。
S695，NEF向EES发送第二响应消息，或者说，EES接收来自NEF的第二响应消息。
具体地，第二响应消息中包括UE的标识符，UE的标识符可以为GPSI。
S696，EES向EEC发送第一响应消息，第一响应消息中包含UE的标识符。可选地，第一响应消息为第一UE标识符API响应消息
S697，EEC向AC发送响应消息#2，响应消息#2中包含UE的标识符。
S698，AC向EAS发送响应消息#1，响应消息#1中包含UE的标识符。
图6所示的通信方法中，EES接收到EEC的获取终端设备的请求消息之后，向NEF发送的获取终端设备的请求消息中携带从EEC接收到的第一私有地址，以及自行获取的公共地址和端口号。以使得NEF能够根据接收到的公共地址和端口号确定EEC提供的第一私有地址是否准确，以便于决定是否向EEC提供终端设备的标识符，避免EEC提供的第一私有地址不准确的情况下，仍然向EEC提供终端设备的标识符，提高EEC获取终端设备的标识符的安全性。
本申请还提供一种通信方法，EAS可以根据UE/EEC是否被认证确定如何通过EEC获取UE的标识符，为了便于理解下面结合图7中的(b)详细介绍该通信方法。
图7中的(b)是本申请提供的一种通信方法的示意性流程图。包括以下步骤：
S701，EAS和AC建立之间建立连接。
参考图6中步骤S601的描述，这里不再赘述。
S702，EEC和EES之间建立连接。
参考图6中步骤S602的描述，这里不再赘述。
S710，EES向EAS发送第二指示信息，或者说EAS接收来自EES的第二指示信息。
该第二指示信息用于指示终端设备中的EEC和/或终端设备是否被认证。
在该实施例中，EES确定EEC和/或终端设备是否被认证，并将指示EEC和/或终端设备是否被认证的第二指示信息提供给EAS。其中，EES确定EEC和/或终端设备是否被认证的方式可以参考图6所示的实施例中步骤S640中的介绍，这里不再赘述。
S720，EAS根据第二指示信息确定获取终端设备的标识符的流程。
作为一种可能的实现方式，EES在向EAS发送第二指示信息之前，EES接收到EAS的获取终端设备 的标识符的第七请求消息，且基于第七请求消息中携带的终端设备的公共IP地址获取终端设备的标识符失败。
在该实现方式下，EES向EAS发送第二指示信息可以是：EES向EAS发送第七响应消息，第七响应消息用于指示终端设备的标识符获取失败，第七响应消息中包括第二指示信息。
在该实现方式下，图7中的(b)所示的方法流程还可以包括：
S703，EAS向EES发送第七请求消息，或者说EES接收来自EAS第七请求消息。
进一步地，该实施例中EAS获知EEC和/或终端设备是否被认证之后，可以采用不同的方式获取终端设备的标识符。
方式#1：第二指示信息指示EEC或终端设备被认证，EAS根据第二指示信息确定基于终端设备的私有地址获取终端设备的标识符的流程为流程#1。
在该方式#1下，流程#1包括以下步骤：
S711，EAS向AC发送请求消息#1，或者说，AC接收来自EAS的请求消息#1。
S712，AC向EEC送请求消息#2，或者说，EEC接收来自AC的请求消息#2。
S713，EEC向EES发送第一请求消息，或者说，EES接收来自EEC的第一请求消息。
步骤S711至步骤S713相关描述可以参考图6所示的实施例中步骤S610至步骤S630的描述，这里不再赘述。
在该方式#1下，EES接收到来自EEC的第一请求消息之后，基于该第一请求消息中携带的终端设备的第一私有地址获取终端设备的标识符，图7中的(b)所示的方法流程还包括：
S714，EES向NEF发送请求消息#A1。
请求消息#A1用于获取终端设备的标识符，请求消息#A1中包括终端设备的第一私有地址。
S715，NEF向BSF发送请求消息#D1。
请求消息#D1中包含第一私有地址，BSF检索UE的会话绑定信息。
S716，BSF向NEF发送响应消息#D1。
响应消息#D1响应于上述的请求消息#D1，如果响应消息#D1中没有携带SUPI。NEF向EES回复Result值，指示终端设备的标识符获取失败。
S717，NEF向UDM发送请求消息#E1。
NEF通过Nudm_SDM_Get服务操作检索AF特定的UE的标识符。请求消息#E1包括SUPI，应用端口ID或AF标识符中的至少一个。
S718，UDM向NEF发送响应消息#E1。
UDM以AF特定的UE的标识符响应NEF，该标识符表示为UE的外部标识符，该标识符与应用端口ID、MTC提供商信息和/或AF标识符唯一关联。
S719，NEF向EES发送响应消息#A1。
响应消息#A1用于获取终端设备的标识符，响应消息#A1中包括终端设备的标识符。
S7191，EES向EEC发送第一响应消息，第一响应消息中包含终端设备的标识符。可选地，第一响应消息为第一UE标识符API响应消息
S7192，EEC向AC发送响应消息#2，响应消息#2中包含终端设备的标识符。
S7193，AC向EAS发送响应消息#1，响应消息#1中包含终端设备的标识符。
方式#2：第二指示信息指示EEC和/或终端设备未被认证，EAS根据第二指示信息确定基于终端设备的公共地址和端口号获取终端设备的标识符的流程为流程#2。
在该方式#2下，流程#2包括以下步骤：
S721，EAS获取终端设备的公共IP地址和端口号。
具体地，EAS根据与UE(如，AC)交互的IP数据包获取UE的公共IP地址和端口号。
S722，EAS向EES发送第六请求消息，或者说，EES接收来自EAS的第六请求消息。
第六请求消息用于获取终端设备的标识符，第六请求消息包括终端设备的公共地址和端口号。可选地，第六请求消息为第六UE标识符API请求消息
S723，EES向NEF发送请求消息#A2。
请求消息#A2用于获取终端设备的标识符，请求消息#A2中包括终端设备的公共地址和端口号。
S724，NEF向NRF发送请求消息#B2。
请求消息#B2用于获取为UE(公共)IP地址实现NAT功能的UPF的地址。例如，NEF使用Nnrf_NFDiscovery服务操作获取实现NAT功能的UPF的地址。请求消息#B2中包括UE公共地址和端口号。
S725，NRF向NEF发送响应消息#B2。
响应消息#B2响应于上述的请求消息#B2，响应消息#B2中包括为UE公共地址实现NAT功能的UPF的地址。
S726，NEF向UPF发送请求消息#C2。
请求消息#C2用于获取UE的私有地址。该请求消息#C2包括UE公共地址和端口号。
S727，UPF向NEF发送响应消息#C2。
响应消息#C2响应于上述的请求消息#C2，响应消息#C2中包括UE的私有地址。
S728，NEF向BSF发送请求消息#D2。
请求消息#D2中包含UE的私有地址，BSF检索UE的会话绑定信息。
S729，BSF向NEF发送响应消息#D2。
响应消息#D2响应于上述的请求消息#D2，如果响应消息#D2中没有携带SUPI。NEF向AF回复Result值，指示UE ID不可用。
S7291，NEF向UDM发送请求消息#E2。
NEF通过Nudm_SDM_Get服务操作检索AF特定的UE的标识符。请求消息#E2包括SUPI，应用端口ID或AF标识符中的至少一个。
S7292，UDM向NEF发送响应消息#E2。
UDM以AF特定的UE的标识符响应NEF，该标识符表示为UE的外部标识符，该标识符与应用端口ID、MTC提供商信息和/或AF标识符唯一关联。
S7293，NEF向EES发送响应消息#A2。
响应消息#A2中包括终端设备的标识符。
S7294，EES向EAS发送第六响应消息，第六响应消息中包含终端设备的标识符。可选地，第六响应消息为第六UE标识符API响应消息
图7中的(b)所示的通信方法中，EAS在发起UE ID获取流程前，从EES获取UE和/或EEC是否被认证的信息，在UE被认证和/或EEC被认证时，通过EEC获取终端设备的标识符。可选的，在UE被认证和/或EEC被认证时，也可以基于终端设备的公共地址和端口号获取终端设备的标识符。在UE和/或EEC未被认证时，基于终端设备的公共地址和端口号获获取终端设备的标识符。以便于EES基于终端设备的公共地址和端口号获取终端设备的标识符，避免在UE和/或EEC未被认证的情况下基于终端设备的私有地址获取终端设备的标识符失败或者避免获取错误的终端设备的标识符。
本申请还提供又一种通信方法，EES可以在接收到来自EEC的获取UE的标识符的请求消息之后根据EEC和/或UE是否被认证确定后续的获取UE标识的方式，为了便于理解结合图8进行说明。
图8是本申请提供的又一种通信方法的示意性流程图。包括以下步骤：
S801，EAS和AC建立之间建立连接。
参考图6中步骤S601的描述，这里不再赘述。
S802，EEC和EES之间建立连接。
参考图6中步骤S602的描述，这里不再赘述。
S810，EAS向AC发送请求消息#1，或者说，AC接收来自EAS的请求消息#1。
S820，AC向边缘使能客户端发送请求消息#2，或者说，边缘使能客户端接收来自AC的请求消息#2。
S830，EEC向EES发送第一请求消息，或者说，EES接收来自EEC的第一请求消息。
S840，EES确定EEC和/或UE是否被认证。
该实施例中S810至S840相关描述可以参考图6中步骤S601至S640相关描述，这里不再赘述。
该实施例和图6所示的实施例不同点在于：
在该实施例中EES不再执行上述图6所示的实施例中的实现方式#1至实现方式#3判断EEC提供的第一私有IP地址是否有效，而是根据EEC和/或UE是否被认证确定采用什么方式获取UE标识，具体地，该实施例中EES获取UE标识包括以下两种方式：
方式#3：EES是使用EEC提供的私有IP地址与5GC交互获取UE ID，方式#1所示的情况下，图8 所示的方法流程还包括以下步骤：
S811，EES向NEF发送请求消息#A1。
请求消息#A1用于获取终端设备的标识符，请求消息#A1中包括终端设备的第一私有地址。
S812，NEF向BSF发送请求消息#D1。
请求消息#D1中包含第一私有地址，BSF检索UE的会话绑定信息。
S813，BSF向NEF发送响应消息#D1。
响应消息#D1响应于上述的请求消息#D1，如果响应消息#D1中没有携带SUPI。NEF向EES回复Result值，指示终端设备的标识符获取失败。
S814，NEF向UDM发送请求消息#E1。
S815，UDM向NEF发送响应消息#E1。
S816，NEF向EES发送响应消息#A1。
响应消息#A1用于获取终端设备的标识符，响应消息#A1中包括终端设备的标识符。
步骤S811至步骤S816相关描述可以参考图7中的(b)所示的实施例方式#1中步骤S714至步骤S719的描述，这里不再赘述。
方式#4：EES使用UE的公共IP地址和端口号与5GC交互获取UE ID，方式#4所示的情况下，图8所示的方法流程还包括以下步骤：
S821，EES向NEF发送请求消息#A2。
请求消息#A2用于获取终端设备的标识符，请求消息#A2中包括终端设备的公共地址和端口号。
S822，NEF向NRF发送请求消息#B2。
请求消息#B2用于获取为UE(公共)IP地址实现NAT功能的UPF的地址。例如，NEF使用Nnrf_NFDiscovery服务操作获取实现NAT功能的UPF的地址。请求消息#B2中包括UE公共地址和端口号。
S823，NRF向NEF发送响应消息#B2。
响应消息#B2响应于上述的请求消息#B2，响应消息#B2中包括为UE公共地址实现NAT功能的UPF的地址。
S824，NEF向UPF发送请求消息#C2。
请求消息#C2用于获取UE的私有地址。该请求消息#C2包括UE公共地址和端口号。
S825，UPF向NEF发送响应消息#C2。
响应消息#C2响应于上述的请求消息#C2，响应消息#C2中包括UE的私有地址。
S826，NEF向BSF发送请求消息#D2。
请求消息#D2中包含UE的私有地址，BSF检索UE的会话绑定信息。
S827，BSF向NEF发送响应消息#D2。
响应消息#D2响应于上述的请求消息#D2，如果响应消息#D2中没有携带SUPI。NEF向AF回复Result值，指示UE ID不可用。
S828，NEF向UDM发送请求消息#E2。
S829，UDM向NEF发送响应消息#E2。
S8291，NEF向EES发送响应消息#A2。
响应消息#A2中包括终端设备的标识符。
步骤S821至步骤S8291相关描述可以参考图7中的(b)所示的实施例方式#3中步骤S723至步骤S7293的描述，这里不再赘述。
EES通过上述的方式#和方式#4获取终端设备的标识符之后，图8所示的方法流程还包括：
S850，EES向EEC发送第一响应消息，第一响应消息中包含UE的标识符。
S860，EEC向AC发送响应消息#2，响应消息#2中包含UE的标识符。
S870，AC向EAS发送响应消息#1，响应消息#1中包含UE的标识符。
图8所示的通信方法中，EES根据UE和/或EEC是否被认证，确定实际获取终端设备的标识符的方式，避免在UE和/或EEC未被认证的情况下仍然基于终端设备的第一私有地址获取终端设备的标识符，提高安全性。
应理解，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内 在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
还应理解，在本申请的各个实施例中，如果没有特殊说明以及逻辑冲突，不同的实施例之间的术语和/或描述具有一致性、且可以相互引用，不同的实施例中的技术特征根据其内在的逻辑关系可以组合形成新的实施例。
还应理解，在上述一些实施例中，主要以现有的网络架构中的设备为例进行了示例性说明(如AMF等)，应理解，对于设备的具体形式本申请实施例不作限定。例如，在未来可以实现同样功能的设备都适用于本申请实施例。
可以理解的是，上述各个方法实施例中，由设备(如AMF)实现的方法和操作，也可以由设备的部件(例如芯片或者电路)实现。
以上，结合图6至图8详细说明了本申请实施例提供的通信方法。上述通信方法主要从终端设备各个协议层之间交互的角度进行了介绍。可以理解的是，终端设备为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。
本领域技术人员应该可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，本申请能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
以下结合图9至图11详细说明本申请提供的通信装置。应理解，装置实施例的描述与方法实施例的描述相互对应。因此，未详细描述的内容可以参见上文方法实施例，为了简洁，部分内容不再赘述。
本申请实施例可以根据上述方法示例对发射端设备或者接收端设备进行功能模块的划分，例如，可以对应各个功能划分各个功能模块，也可以将两个或两个以上的功能集成在一个处理模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。需要说明的是，本申请实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。下面以采用对应各个功能划分各个功能模块为例进行说明。
图9是本申请实施例提供的通信装置10的示意性框图。该装置10包括收发模块11和处理模块12。收发模块11可以实现相应的通信功能，处理模块12用于进行数据处理，或者说该收发模块11用于执行接收和发送相关的操作，该处理模块12用于执行除了接收和发送以外的其他操作。收发模块11还可以称为通信接口或通信单元。
可选地，该装置10还可以包括存储模块13，该存储模块13可以用于存储指令和/或数据，处理模块12可以读取存储模块中的指令和/或数据，以使得装置实现前述各个方法实施例中设备的动作。
在一种设计中，该装置10可对应于上文方法实施例中的EES，或者是EES的组成部件(如芯片)。
该装置10可实现对应于上文方法实施例中的EES执行的步骤或者流程，其中，收发模块11可用于执行上文方法实施例中EES的收发相关的操作，处理模块12可用于执行上文方法实施例中EES的处理相关的操作。
在一种可能的实现方式，收发模块11，用于接收来自终端设备的第一请求消息，所述第一请求消息用于获取所述终端设备的标识符，所述第一请求消息包括所述终端设备的第一私有地址。收发模块11，还用于获取所述终端设备的公共地址和端口号，向网络开放功能网元发送第二请求消息，所述第二请求消息用于获取所述终端设备的标识符，所述第二请求消息包括所述第一私有地址、所述公共地址和端口号。收发模块11，还用于接收来自所述网络开放功能网元的第一指示信息或所述终端设备的标识符，所述第一指示信息用于指示所述终端设备的标识符获取失败。
在另一种可能的实现方式，收发模块11，用于向边缘应用服务器发送第二指示信息，所述第二指示信息用于指示终端设备中的边缘使能客户端和/或所述终端设备是否被认证。收发模块11，还用于在边缘使能客户端和/或终端设备未被认证的情况下，接收来自边缘应用服务器的第六请求消息，所述第六请求消息用于获取终端设备的标识符，所述第六请求消息包括所述终端设备的公共地址和端口号。
在又一种可能的实现方式，收发模块11，用于接收来自终端设备的第一请求消息，所述第一请求消息用于获取所述终端设备的标识符，所述第一请求消息包括所述终端设备的第一私有地址。处理模块12，用于确定所述终端设备的边缘使能客户端和/或所述终端设备是否被认证。处理模块12，用于在所述边缘使能客户端和/或所述终端设备未被认证的情况下，获取所述终端设备的公共地址和端口号，并基于所述公共地址和端口号获取所述终端设备的标识符。
其中，当该装置6用于执行图3中的方法时，收发模块11可用于执行方法中的收发信息的步骤，如步骤S630、S660、S692、S695和S696；处理模块12可用于执行方法中的处理步骤，如步骤S640和S650。
当该装置10用于执行图7中的(b)中的方法时，收发模块11可用于执行方法中的收发信息的步骤，如步骤S703、S710、S714、S719、S723、S7293和S7294；处理模块12可用于执行方法中的处理步骤。
当该装置10用于执行图8中的方法时，收发模块11可用于执行方法中的收发信息的步骤，如步骤S830、S811、S816、S821、S8291和S850；处理模块12可用于执行方法中的处理步骤，如步骤S840。
应理解，各单元执行上述相应步骤的具体过程在上述方法实施例中已经详细说明，为了简洁，在此不再赘述。
在另一种设计中，该装置10可对应于上文方法实施例中的NEF，或者是NEF的组成部件(如芯片)。
该装置10可实现对应于上文方法实施例中的NEF执行的步骤或者流程，其中，收发模块11可用于执行上文方法实施例中NEF的收发相关的操作，处理模块12可用于执行上文方法实施例中NEF的处理相关的操作。
在一种可能的实现方式，收发模块11，用于接收来自边缘使能服务器的第二请求消息，所述第二请求消息用于获取终端设备的标识符，所述第二请求消息包括所述终端设备的第一私有地址、所述终端设备的公共地址和端口号；所述收发模块11，用于在根据所述公共地址和所述端口号确定所述第一私有地址有效的情况下，获取所述终端设备的标识符，并向所述边缘使能服务器发送所述终端设备的标识符。
其中，当该装置10用于执行图6中的方法时，收发模块11可用于执行方法中的收发信息的步骤，如步骤S660、S670、S680、S611、S612、S621、S622、S624、S625、S631、S633、S690、S691、S692、S693、S694和S695；处理模块12可用于执行方法中的处理步骤，如步骤S613和S623。
当该装置10用于执行图7中的(b)中的方法时，收发模块11可用于执行方法中的收发信息的步骤，如步骤S714、S715、S716、S717、S718、S719、S723、S724、S725、S726、S727、S728、S729、S7291、S7292和S7293；处理模块12可用于执行方法中的处理步骤。
当该装置10用于执行图8中的方法时，收发模块11可用于执行方法中的收发信息的步骤，如步骤S811、S812、S813、S814、S815、S816、S821、S822、S823、S824、S825、S826、S827、S828、S829和S8291；处理模块12可用于执行方法中的处理步骤。
应理解，各单元执行上述相应步骤的具体过程在上述方法实施例中已经详细说明，为了简洁，在此不再赘述。
在另一种设计中，该装置10可对应于上文方法实施例中的UPF，或者是UPF的组成部件(如芯片)。
该装置10可实现对应于上文方法实施例中的UPF执行的步骤或者流程，其中，收发模块11可用于执行上文方法实施例中UPF的收发相关的操作，处理模块12可用于执行上文方法实施例中UPF的处理相关的操作。
在一种可能的实现方式，收发模块11，用于接收来自网络开放功能网元的第三请求消息，所述第三请求消息用于获取终端设备的第二私有网际协议地址，所述第三请求消息包括所述终端设备的公共地址和端口号；处理模块12，用于根据所述公共地址和所述端口号确定所述终端设备的第二私有地址；所述收发模块11，用于向所述网络开放功能网元发送第三响应消息，所述第三响应消息包括所述第二私有地址。
在另一种可能的实现方式，收发模块11，用于接收来自网络开放功能网元的第四请求消息，所述第四请求消息包括终端设备的第一公共网际互连协议地址；处理模块12，用于根据所述公共地址确定与所述公共地址对应的至少一个私有地址，以及所述至少一个私有地址对应的端口号；所述收发模块11，向所述网络开放功能网元发送第四响应消息，所述第四响应消息包括所述公共地址对应的至少一个私有地址，以及所述至少一个私有地址对应的端口号。
在又一种可能的实现方式，收发模块11，用于接收来自网络开放功能网元的第五请求消息，所述第五请求消息包括终端设备的第一私有网际互连协议地址、所述终端设备的公共地址和端口号，所述第五请求消息用于请求所述用户面功能网元确定所述第一私有地址是否有效；处理模块12，用于根据本地保存的私有地址、公共地址和端口号之间的对应关系确定所述第一私有地址是否有效；所述收发模块11，向所述网络开放功能网元发送第五响应消息，所述第五响应消息用于指示所述第一私有地址是否有效。
其中，当该装置10用于执行图6中的方法时，收发模块11可用于执行方法中的收发信息的步骤，如步骤S611、S612、S621、S622、S624、S625、S631和S633；处理模块12可用于执行方法中的处理步骤，如步骤S632。
当该装置10用于执行图7中的(b)中的方法时，收发模块11可用于执行方法中的收发信息的步骤，如步骤S726和S727；处理模块12可用于执行方法中的处理步骤。
当该装置10用于执行图8中的方法时，收发模块11可用于执行方法中的收发信息的步骤，如步骤S824和S825；处理模块12可用于执行方法中的处理步骤。
应理解，各单元执行上述相应步骤的具体过程在上述方法实施例中已经详细说明，为了简洁，在此不再赘述。
在另一种设计中，该装置10可对应于上文方法实施例中的EAS，或者是EAS的组成部件(如芯片)。
该装置10可实现对应于上文方法实施例中的EAS执行的步骤或者流程，其中，收发模块11可用于执行上文方法实施例中EAS的收发相关的操作，处理模块12可用于执行上文方法实施例中EAS的处理相关的操作。
在一种可能的实现方式，收发模块11，用于接收来自边缘使能服务器的第二指示信息，所述第二指示信息用于指示终端设备中的边缘使能客户端和/或所述终端设备是否被认证；所述收发模块11，在边缘使能客户端和/或终端设备未被认证的情况下，向边缘使能服务器发送第六请求消息，所述第六请求消息用于获取终端设备的标识符，所述第六请求消息包括所述终端设备的公共地址和端口号。
其中，当该装置10用于执行图6中的方法时，收发模块11可用于执行方法中的收发信息的步骤，如步骤S610和S698；处理模块12可用于执行方法中的处理步骤。
当该装置10用于执行图7中的(b)中的方法时，收发模块11可用于执行方法中的收发信息的步骤，如步骤S711、S7193、S703、S710、S722和S7294；处理模块12可用于执行方法中的处理步骤，如步骤S720和S721。
当该装置10用于执行图8中的方法时，收发模块11可用于执行方法中的收发信息的步骤，如步骤S810和S870；处理模块12可用于执行方法中的处理步骤。
应理解，各单元执行上述相应步骤的具体过程在上述方法实施例中已经详细说明，为了简洁，在此不再赘述。
还应理解，这里的装置10以功能模块的形式体现。这里的术语“模块”可以指应用特有集成电路(application specific integrated circuit，ASIC)、电子电路、用于执行一个或多个软件或固件程序的处理器(例如共享处理器、专有处理器或组处理器等)和存储器、合并逻辑电路和/或其它支持所描述的功能的合适组件。在一个可选例子中，本领域技术人员可以理解，装置10可以具体为上述实施例中的移动管理网元，可以用于执行上述各方法实施例中与移动管理网元对应的各个流程和/或步骤；或者，装置10可以具体为上述实施例中的终端设备，可以用于执行上述各方法实施例中与终端设备对应的各个流程和/或步骤，为避免重复，在此不再赘述。
上述各个方案的装置10具有实现上述方法中的设备(如终端设备、网络设备)所执行的相应步骤的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块；例如收发模块可以由收发机替代(例如，收发模块中的发送单元可以由发送机替代，收发模块中的接收单元可以由接收机替代)，其它单元，如处理模块等可以由处理器替代，分别执行各个方法实施例中的收发操作以及相关的处理操作。
此外，上述收发模块11还可以是收发电路(例如可以包括接收电路和发送电路)，处理模块可以是处理电路。
图10是本申请实施例提供另一种通信装置20的示意图。该装置20包括处理器21，处理器21用于执行存储器22存储的计算机程序或指令，或读取存储器22存储的数据/信令，以执行上文各方法实施例中的方法。可选地，处理器21为一个或多个。
可选地，如图10所示，该装置20还包括存储器22，存储器22用于存储计算机程序或指令和/或数据。该存储器22可以与处理器21集成在一起，或者也可以分离设置。可选地，存储器22为一个或多个。
可选地，如图10所示，该装置20还包括收发器23，收发器23用于信号的接收和/或发送。例如，处理器21用于控制收发器23进行信号的接收和/或发送。
作为一种方案，该装置20用于实现上文各个方法实施例中由EES执行的操作。
作为另一种方案，该装置20用于实现上文各个方法实施例中由NEF执行的操作。
作为另一种方案，该装置20用于实现上文各个方法实施例中由UPF执行的操作。
作为另一种方案，该装置20用于实现上文各个方法实施例中由EAS执行的操作。
应理解，本申请实施例中提及的处理器可以是中央处理单元(central processing unit，CPU)，还可以是其他通用处理器、数字信号处理器(digital signal processor，DSP)、专用集成电路(application specific integrated circuit，ASIC)、现成可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
还应理解，本申请实施例中提及的存储器可以是易失性存储器和/或非易失性存储器。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)。例如，RAM可以用作外部高速缓存。作为示例而非限定，RAM包括如下多种形式：静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(dynamic RAM，DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(doubledata rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(direct rambus RAM，DR RAM)。
需要说明的是，当处理器为通用处理器、DSP、ASIC、FPGA或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件时，存储器(存储模块)可以集成在处理器中。
还需要说明的是，本文描述的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
图11是本申请实施例提供一种芯片系统30的示意图。该芯片系统30(或者也可以称为处理系统)包括逻辑电路31以及输入/输出接口(input/output interface)32。
其中，逻辑电路31可以为芯片系统30中的处理电路。逻辑电路31可以耦合连接存储单元，调用存储单元中的指令，使得芯片系统30可以实现本申请各实施例的方法和功能。输入/输出接口32，可以为芯片系统30中的输入输出电路，将芯片系统30处理好的信息输出，或将待处理的数据或信令信息输入芯片系统30进行处理。
作为一种方案，该芯片系统30用于实现上文各个方法实施例中由EES、EAS、NEF或UPF执行的操作。
例如，逻辑电路31用于实现上文方法实施例中由EES、EAS、NEF或UPF执行的处理相关的操作；输入/输出接口32用于实现上文方法实施例中由EES、EAS、NEF或UPF执行的发送和/或接收相关的操作。
本申请实施例还提供一种计算机可读存储介质，其上存储有用于实现上述各方法实施例中由EES、EAS、NEF和UPF执行的方法的计算机指令。
例如，该计算机程序被计算机执行时，使得该计算机可以实现上述方法各实施例中由EES、EAS、NEF或UPF执行的方法。
本申请实施例还提供一种计算机程序产品，包含指令，该指令被计算机执行时以实现上述各方法实施例中由EES、EAS、NEF和UPF执行的方法。
本申请实施例还提供了一种通信系统，包括前述的EES、EAS、NEF和UPF。
上述提供的任一种装置中相关内容的解释及有益效果均可参考上文提供的对应的方法实施例，此处不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。此外，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实 现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。例如，所述计算机可以是个人计算机，服务器，或者网络设备等。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘(solid state disk，SSD)等。例如，前述的可用介质包括但不限于：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (34)

  1. 一种通信方法，其特征在于，包括：
    接收来自终端设备的第一请求消息，所述第一请求消息用于获取所述终端设备的标识符，所述第一请求消息包括所述终端设备的第一私有地址；
    获取所述终端设备的公共地址和端口号，向网络开放功能网元发送第二请求消息，所述第二请求消息用于获取所述终端设备的标识符，所述第二请求消息包括所述第一私有地址、所述公共地址和端口号；
    接收来自所述网络开放功能网元的第一指示信息或所述终端设备的标识符，所述第一指示信息用于指示所述终端设备的标识符获取失败。
  2. 根据权利要求1所述的方法，其特征在于，所述接收来自终端设备的第一请求消息，包括：
    接收来自用户面功能网元的网际协议IP数据包，所述IP数据包的载荷部分包括来自所述终端设备的所述第一请求消息；
    所述获取所述公共地址和所述端口号，包括：
    根据所述IP数据包的源地址和源端口号，确定所述公共地址和所述端口号，其中，所述源地址用于表征所述公共地址，所述源端口号用于表征所述端口号。
  3. 根据权利要求1所述的方法，其特征在于，所述获取所述公共地址和所述端口号，包括：从边缘应用服务器获取所述公共地址和所述端口号。
  4. 根据权利要求1至3中任一项所述的方法，其特征在于，在接收来自所述网络开放功能网元的所述终端设备的所述第一指示信息的情况下，所述方法还包括：
    接收来自所述网络开放功能网元的所述终端设备的原因值，所述原因值用于指示所述终端设备的标识符获取失败的原因。
  5. 根据权利要求1至4中任一项所述的方法，其特征在于，在接收来自所述网络开放功能网元的所述终端设备的标识符的情况下，所述方法还包括：
    向所述终端设备发送第一响应消息，所述第一响应消息包括所述终端设备的标识符。
  6. 根据权利要求1至5中任一项所述的方法，其特征在于，所述向网络开放功能网元发送第二请求消息，包括：
    在所述终端设备或所述终端设备中的边缘使能客户端未被认证的情况下，向所述网络开放功能网元发送所述第二请求消息。
  7. 一种通信方法，其特征在于，包括：
    接收来自边缘使能服务器的第二请求消息，所述第二请求消息用于获取终端设备的标识符，所述第二请求消息包括所述终端设备的第一私有地址、所述终端设备的公共地址和端口号；
    在根据所述公共地址和所述端口号确定所述第一私有地址有效的情况下，获取所述终端设备的标识符，并向所述边缘使能服务器发送所述终端设备的标识符。
  8. 根据权利要求7所述的方法，其特征在于，在根据所述公共地址和所述端口号确定所述第一私有地址无效的情况下，向所述边缘使能服务器发送第一指示信息，所述第一指示信息用于指示所述终端设备的标识符获取失败。
  9. 根据权利要求7或8所述的方法，其特征在于，所述方法还包括：
    根据所述公共地址和所述端口号确定所述第一私有地址是否有效。
  10. 根据权利要求9所述的方法，其特征在于，所述根据所述公共地址和所述端口号确定所述第一私有地址是否有效，包括：
    所述第一私有地址是否与第二私有地址相同，其中，所述第二私有地址是基于所述公共地址和所述端口号确定的。
  11. 根据权利要求10所述的方法，其特征在于，所述方法还包括：
    向用户面功能网元发送第三请求消息，所述第三请求消息中包括所述公共地址和所述端口号；
    接收来自所述用户面功能网元的第三响应消息，所述第三响应消息包括所述第二私有地址。
  12. 根据权利要求10所述的方法，其特征在于，所述方法还包括：
    获取所述公网地址对应的至少一个私有地址以及与所述至少一个私有地址对应的端口号；
    根据获取到的所述至少一个私有地址和与所述至少一个私有地址对应的端口号，以及所述第二请求消息中的所述端口号，获取所述第二私有地址。
  13. 根据权利要求12所述的方法，其特征在于，所述方法还包括：
    向用户面功能网元发送第四请求消息，所述第四请求消息包括所述公共地址；
    接收来自所述用户面功能网元的第四响应消息，所述第四响应消息包括所述公共地址对应的至少一个私有地址，以及与所述至少一个私有地址对应的端口号。
  14. 根据权利要求12所述的方法，其特征在于，所述方法还包括：
    向用户面功能网元发送订阅请求消息，所述订阅请求消息包括所述公共地址；
    接收来自所述用户面功能网元的一个或多个订阅响应消息，所述一个或多个订阅响应消息包括所述公共地址对应的至少一个私有地址，以及与所述至少一个私有地址对应的端口号。
  15. 根据权利要求13或14所述的方法，其特征在于，所述方法还包括：
    查询本地未保存所述公网地址对应的至少一个私有地址以及与所述至少一个私有地址对应的端口号。
  16. 根据权利要求13至15中任一项所述的方法，其特征在于，所述方法还包括：
    若所述至少一个私有地址不包含所述第一私有地址，确定所述第一私有地址无效；或者，
    若所述至少一个私有地址包含所述第一私有地址，且所述第一私有地址对应的端口号与所述端口号相同，确定所述第一私有地址有效。
  17. 根据权利要求9所述的方法，其特征在于，所述根据所述公共地址和所述端口号确定所述第一私有地址是否有效，包括：
    向用户面功能网元发送第五请求消息，所述第五请求消息包括所述第一私有地址、所述公共地址和端口号，所述第五请求消息用于请求所述用户面功能网元确定所述第一私有地址是否有效；
    接收来自所述用户面功能网元的第五响应消息，所述第五响应消息用于指示所述第一私有地址是否有效。
  18. 根据权利要求7至17中任一项所述的方法，其特征在于，所述方法还包括：
    向网络功能存储库功能网元发送发现请求消息，所述发现请求消息包括所述公共地址，所述发现请求消息用于获取实现地址转换功能的用户面功能网元的地址；
    接收来自所述网络功能存储库功能网元的发现响应消息，所述发现响应消息包括所述用户面功能网元的地址。
  19. 根据权利要求8所述的方法，其特征在于，在向所述边缘使能服务器发送所述第一指示信息的情况下，所述方法还包括：
    向所述边缘使能服务器发送原因值，所述原因值用于指示所述终端设备的标识符获取失败的原因。
  20. 一种通信方法，其特征在于，包括：
    接收来自网络开放功能网元的第三请求消息，所述第三请求消息用于获取终端设备的第二私有网际协议地址，所述第三请求消息包括所述终端设备的公共地址和端口号；
    根据所述公共地址和所述端口号确定所述终端设备的第二私有地址；
    向所述网络开放功能网元发送第三响应消息，所述第三响应消息包括所述第二私有地址。
  21. 一种通信方法，其特征在于，包括：
    接收来自网络开放功能网元的第四请求消息，所述第四请求消息包括终端设备的第一公共网际互连协议地址；
    根据所述公共地址确定所述公共地址对应的至少一个私有地址，以及所述至少一个私有地址对应的端口号；
    向所述网络开放功能网元发送第四响应消息，所述第四响应消息包括所述公共地址对应的至少一个私有地址，以及所述至少一个私有地址对应的端口号。
  22. 一种通信方法，其特征在于，包括：
    接收来自所述网络开放功能网元的订阅请求消息，所述订阅请求消息包括终端设备的第一公共网际互连协议地址；
    向所述网络开放功能网元发送一个或者多个订阅响应消息，所述一个或者多个订阅响应消息包括所述公共地址对应的至少一个私有地址，以及所述至少一个私有地址对应的端口号。
  23. 一种通信方法，其特征在于，包括：
    接收来自网络开放功能网元的第五请求消息，所述第五请求消息包括终端设备的第一私有网际互连协议地址、所述终端设备的公共地址和端口号，所述第五请求消息用于请求所述用户面功能网元确定所述第一私有地址是否有效；
    根据本地保存的私有地址、公共地址和端口号之间的对应关系确定所述第一私有地址是否有效；
    向所述网络开放功能网元发送第五响应消息，所述第五响应消息用于指示所述第一私有地址是否有效。
  24. 根据权利要求23所述的方法，其特征在于，所述根据本地保存的私有地址、公共地址和端口号之间的对应关系确定所述第一私有地址是否有效，包括：
    根据所述对应关系和所述第一私有地址，确定所述第一私有地址对应的公共地址和端口号；
    若所述第一私有地址对应的公共地址和端口号，与所述公共地址和端口号相同，所述第五响应消息用于指示所述第一私有地址有效；否则所述第五响应消息用于指示所述第一私有地址无效。
  25. 根据权利要求23所述的方法，其特征在于，所述根据本地保存的私有地址、公共地址和端口号之间的对应关系确定所述第一私有地址是否有效，包括：
    根据所述对应关系和所述第一私有地址，确定无法获取所述第一私有地址对应的公共地址和端口号，则所述第五响应消息用于指示所述第一私有地址无效。
  26. 根据权利要求23所述的方法，其特征在于，所述根据本地保存的私有地址、公共地址和端口号之间的对应关系确定所述第一私有地址是否有效，包括：
    根据所述对应关系、所述公共地址和所述端口号，确定所述公共地址和所述端口号对应的私有地址；
    若所述公共地址和所述端口号对应的私有地址，与所述第一私有地址和端口号相同，则所述第五响应消息用于指示所述第一私有地址有效，否则所述第五响应消息用于指示所述第一私有地址无效。
  27. 一种通信系统，其特征在于，包括边缘使能服务器和网络开放功能网元：
    边缘使能服务器用于接收来自终端设备的第一请求消息，所述第一请求消息用于获取所述终端设备的标识符，所述第一请求消息包括所述终端设备的第一私有地址；
    所述边缘使能服务器还用于获取所述终端设备的公共地址和端口号；
    所述边缘使能服务器还用于向网络开放功能网元发送第二请求消息，所述第二请求消息用于获取所述终端设备的标识符，所述第二请求消息包括所述第一私有地址、所述公共地址和所述端口号；
    在根据所述公共地址和所述端口号确定所述第一私有地址有效的情况下，所述网络开放功能网元用于向所述边缘使能服务器发送所述终端设备的标识符。
  28. 根据权利要求27所述的系统，其特征在于，在根据所述公共地址和所述端口号确定所述第一私有地址无效的情况下，所述网络开放功能网元还用于向所述边缘使能服务器发送第一指示信息，所述第一指示信息用于指示所述通信装置的标识符获取失败。
  29. 一种通信装置，其特征在于，所述装置包括用于执行如权利要求1至6中任一项所述的方法的单元。
  30. 一种通信装置，其特征在于，所述装置包括用于执行如权利要求7至19中任一项所述的方法的单元。
  31. 一种通信装置，其特征在于，所述装置包括用于执行如权利要求20至26中任一项所述的方法的单元。
  32. 一种通信装置，其特征在于，包括：
    存储器，用于存储计算机程序；
    处理器，用于执行所述存储器中存储的计算机程序，以使得所述通信装置执行权利要求1至26中任一项所述的方法。
  33. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有计算机指令，当所述计算机指令在计算机上运行时，如权利要求1至26中任一项所述的方法。
  34. 一种计算机程序产品，其特征在于，所述计算机程序产品包括用于执行如权利要求1至26中任一项所述的方法中所述存储功能网元执行的步骤的指令。
PCT/CN2024/092241 2023-05-14 2024-05-10 一种通信方法和通信装置 Ceased WO2024235111A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP24806463.6A EP4697649A4 (en) 2023-05-14 2024-05-10 COMMUNICATION METHOD AND COMMUNICATION APPARATUS
US19/388,207 US20260075111A1 (en) 2023-05-14 2025-11-13 Communication method and communication apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202310541737.3 2023-05-14
CN202310541737.3A CN118972078A (zh) 2023-05-14 2023-05-14 一种通信方法和通信装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US19/388,207 Continuation US20260075111A1 (en) 2023-05-14 2025-11-13 Communication method and communication apparatus

Publications (1)

Publication Number Publication Date
WO2024235111A1 true WO2024235111A1 (zh) 2024-11-21

Family

ID=93382317

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2024/092241 Ceased WO2024235111A1 (zh) 2023-05-14 2024-05-10 一种通信方法和通信装置

Country Status (4)

Country Link
US (1) US20260075111A1 (zh)
EP (1) EP4697649A4 (zh)
CN (1) CN118972078A (zh)
WO (1) WO2024235111A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111770207A (zh) * 2019-03-31 2020-10-13 华为技术有限公司 一种获取终端设备互联网协议ip地址方法、设备及系统
WO2022039835A1 (en) * 2020-08-19 2022-02-24 Intel Corporation Ue identification using its source ip address
WO2022151830A1 (en) * 2021-01-12 2022-07-21 Telefonaktiebolaget Lm Ericsson (Publ) Ue id exposure
CN116114234A (zh) * 2020-08-13 2023-05-12 华为技术有限公司 一种网络能力开放的方法、装置及系统

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20240348575A1 (en) * 2021-08-13 2024-10-17 Qualcomm Incorporated Identification of an edge enabler client (eec) in an edge application server (eas) and an edge enabler server (ees) in an edge data network

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111770207A (zh) * 2019-03-31 2020-10-13 华为技术有限公司 一种获取终端设备互联网协议ip地址方法、设备及系统
CN116114234A (zh) * 2020-08-13 2023-05-12 华为技术有限公司 一种网络能力开放的方法、装置及系统
WO2022039835A1 (en) * 2020-08-19 2022-02-24 Intel Corporation Ue identification using its source ip address
WO2022151830A1 (en) * 2021-01-12 2022-07-21 Telefonaktiebolaget Lm Ericsson (Publ) Ue id exposure

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4697649A4

Also Published As

Publication number Publication date
EP4697649A4 (en) 2026-03-25
US20260075111A1 (en) 2026-03-12
EP4697649A1 (en) 2026-02-18
CN118972078A (zh) 2024-11-15

Similar Documents

Publication Publication Date Title
US12445837B2 (en) Key obtaining method and communication apparatus
CN115552992B (zh) 用于在上线期间调配专用网络设备的方法和装置
CN115299168B (zh) 用于切换的方法和装置
EP4406208A1 (en) Restricting onboard traffic
JP2017123667A (ja) 通信ハンドオフのシナリオのための認証およびセキュアチャネルの設定
WO2023280121A1 (zh) 一种获取边缘服务的方法和装置
US20250184731A1 (en) Communication method and communication apparatus
US11496894B2 (en) Method and apparatus for extensible authentication protocol
WO2021063298A1 (zh) 实现外部认证的方法、通信装置及通信系统
EP4614874A1 (en) Communication method and communication apparatus
WO2023016160A1 (zh) 一种会话建立方法和相关装置
WO2024094047A1 (zh) 通信方法和通信装置
WO2023143212A1 (zh) 一种通信方法及装置
US20250338123A1 (en) Communication method and communication apparatus
US20250088424A1 (en) Systems and methods for automated secure network function provisioning in a wireless network
WO2024032218A1 (zh) 通信方法和通信装置
WO2024235111A1 (zh) 一种通信方法和通信装置
WO2025171639A1 (en) Method, device and system for akma roaming control in communication networks
WO2025156496A1 (en) Method, device and system for ue identity privacy in communication networks
US20250358618A1 (en) Systems and methods for network-based ue service authorization
US20250279885A1 (en) Communication method and communication apparatus
US20250119732A1 (en) Encryption key transfer method and device for roaming users in communication networks
EP4590006A1 (en) Enhanced generic bootstrapping architecture
WO2025161525A1 (zh) 通信方法及通信装置
WO2026016607A1 (zh) 一种通信方法和通信装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 24806463

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2025566913

Country of ref document: JP

Kind code of ref document: A

WWE Wipo information: entry into national phase

Ref document number: 2024806463

Country of ref document: EP

Ref document number: 2025566913

Country of ref document: JP

ENP Entry into the national phase

Ref document number: 2024806463

Country of ref document: EP

Effective date: 20251113

ENP Entry into the national phase

Ref document number: 2024806463

Country of ref document: EP

Effective date: 20251113

ENP Entry into the national phase

Ref document number: 2024806463

Country of ref document: EP

Effective date: 20251113

ENP Entry into the national phase

Ref document number: 2024806463

Country of ref document: EP

Effective date: 20251113

ENP Entry into the national phase

Ref document number: 2024806463

Country of ref document: EP

Effective date: 20251113

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2024806463

Country of ref document: EP

Effective date: 20251113

ENP Entry into the national phase

Ref document number: 2024806463

Country of ref document: EP

Effective date: 20251113

ENP Entry into the national phase

Ref document number: 2024806463

Country of ref document: EP

Effective date: 20251113

ENP Entry into the national phase

Ref document number: 2024806463

Country of ref document: EP

Effective date: 20251113

WWP Wipo information: published in national office

Ref document number: 2024806463

Country of ref document: EP