WO2018120150A1 - Method and apparatus for connection between network entities - Google Patents

Abstract

Disclosed are a method and device for connection between network entities. The method comprises: a second network function (NF) entity receives a communication connection request from a first network function (NF) entity, the communication connection request comprising an identifier of the first NF entity and a security information identifier; obtain security information corresponding to the security information identifier from an NF storage entity; and if the security information comprises the identifier of the first NF entity, the second NF entity establishes a communication connection with the first NF entity. In the method, the NF storage entity controls the discovery of an NF entity and provides security information to a peer-end NF entity discovered by the NF, so that the NF entity can verify the authenticity of the identity of the opposite end party and establishes a secure connection, and accordingly, the security and reliability of access between the NFs are achieved, and unauthorized access between the NFs is avoided.

Description

Connection method and device between network functional entities Technical field

The present application relates to the field of wireless communications, and in particular, to a method and apparatus for connecting between network functional entities.

Background technique

Currently, a network element (NE) architecture is adopted in an evolved packet core (EPC). The typical NE included in the architecture includes: a mobility management entity (MME) and a service. A gateway (S-GW) and a packet data network gateway (P-GW). Current EPC network functions (eg, mobility management, bearer management, location management, etc.) are implemented through service features and processing logic solidified in the NE and flow messages between the NEs. For example, the access service of the user needs the MME, the S-GW, the P-GW, and other NEs in the network, for example, the policy and charging rules function (PCRF) and the home subscriber, as shown in FIG. The home subscriber server (HSS), etc. work together and are standardized by the defined business process logic, so the characteristics of the network function (NF) service that the current EPC can provide are solidified.

With the continuous expansion of business models and the continuous development of technology, users' business needs will also change. The user's business will require more service modes and better service features, such as the demand for ultra-low latency communication and the need for high-reliability communication, and thus the demand for new NF. The NF service provided by the EPC is solidified and distributed among the various NEs. Therefore, if a new NF needs to be introduced to support the user's needs, the EPC needs to redefine and design the NE's processing logic and process interaction. Such redesign means that the development cycle is long and costly for the equipment manufacturer, which means that the network operator cannot release the new network service in time.

The general NF management method is as follows: the core network part can adopt a service oriented architecture. The NE (for example, MME or S-GW) in the original network architecture is defined as different NF components according to the functional category, for example: Authentication and security functions (AuF), session management function (SM NF), mobility management and mobility management function (MM NF), policy control function (PCF) And so on, these functions are implemented by the corresponding NF components, each of which provides services to other NF components or functions through a defined service interface.

During the execution of the network service, the network functions need to be exchanged to complete the related network service. For example, the MM NF sends the SM message to the SMNF after receiving the message of the SM category sent by the user equipment (UE), and is performed by the SMNF. The processing of the session.

When establishing communication between the NFs, the NF first obtains the network address of the peer NF, and then establishes a communication connection with the peer NF, and further sends a message such as a service request to the peer NF for processing. A security problem exists: due to an exception or NF itself, it will send an incorrect service request message to other NFs. For example, the authentication and security functions do not need to send the user's session request message to the packet data session management function according to the business logic. The session request message includes the establishment, update, and deletion of the session, but when an abnormality or an attack occurs between the authentication and security functions, the request message for deleting the data session connection of the user is sent to the packet data session management function, and the packet data is After the session management function agrees to the service request and performs the corresponding session connection deletion operation, the affected user terminal cannot receive and send data, which causes the service to be abnormal. Therefore, communication security issues between NFs need to be addressed to avoid unauthorized access between NFs.

Summary of the invention

The embodiments of the present application provide a connection method and device between network function entities to solve the communication security problem between network function entities.

In a first aspect, the application provides a network function entity connection method, which is applied to a network function NF entity that receives a communication connection request, the method includes: the second network function NF entity receives a communication connection request from the first network function NF entity, The communication connection request includes an identifier of the first NF entity and a security information identifier; obtaining security information corresponding to the security information identifier from the NF storage function entity; if the security information includes an identifier of the first NF entity And the second NF entity establishes a communication connection with the first NF entity.

The method provided by the present aspect, the NF storage function module pre-stores the identifiers of the respective NF entities, and when accessing one of the NF entities, for example, the second NF entity, the NF storage function entity controls the NF connection access to obtain security information, and Providing the security information to the second NF entity, so that the second NF entity can verify the authenticity and security of the requesting connection identity according to the security information, thereby implementing a secure connection between the NFs and avoiding the NF between the NFs. Authorized access.

With reference to the first aspect, in an implementation manner, if the security information includes the identifier of the first NF entity, establishing a communication connection with the first NF entity includes: the security information includes at least one NF entity And the identifier, if the at least one identifier of the security information is the same as the identifier of the first NF entity in the communication connection request, the second NF entity establishes a communication connection with the first NF entity.

With reference to the first aspect, in an implementation manner, the communication connection request further includes a first challenge random number, and the second NF entity establishing a communication connection with the first NF entity includes: the second NF entity Obtaining a first key from the NF storage function entity, and a first encrypted ciphertext from the first NF entity, using the first key to decrypt the first encrypted ciphertext to generate a second Challenge a random number; if at least one of the security information is the same as an identifier of the first NF entity in the communication connection request, and the first challenge random number is the same as the second challenge random number, then The first NF entity establishes a communication connection.

With reference to the first aspect, in an implementation, the method further includes: if the second NF entity establishes a communication connection with the first NF entity, the second NF entity generates a third challenge random number, where The third challenge random number and the first key generate a second encrypted ciphertext, and send the second encrypted ciphertext and the third challenge random number to the first NF entity.

In combination with the first aspect, in an implementation manner, the security information further includes an effective time of the security information, and is used to check whether the security information is valid.

In a second aspect, the present application provides a network function entity connection method, which is applied to an NF entity that initiates a communication connection request, where the method includes: the first NF entity sends the identifier of the first NF entity and the requested NF to the NF storage function entity. Type information; receiving a security information identifier from the NF storage function entity and an identifier of a second NF entity corresponding to the NF type; sending a communication connection request to the second NF entity, where the communication connection request includes An identifier of the NF entity and the security information identifier.

With reference to the second aspect, in an implementation, the method further includes: the first NF entity receiving a communication connection response from the second NF entity, the communication connection response being used to indicate the second NF Whether the entity allows a communication connection to be established with the first NF entity.

With reference to the second aspect, in an implementation manner, the method further includes: the first NF entity receiving a first key from the NF storage function entity; and the first NF entity acquiring a first challenge random number Generating a first encrypted ciphertext according to the first challenge random number and the first key, and sending the first encrypted ciphertext and the first challenge random number to the second NF entity.

With reference to the second aspect, in an implementation, the method further includes: if the communication connection response indicates that a communication connection is allowed to be established, the first NF entity receives a second encryption key from the second NF entity And a third challenge random number; the first NF entity decrypts the second encrypted ciphertext using the first key, and generates a fourth challenge random number, if the fourth challenge random number and the The third challenge random number is the same, and a session connection is established with the second NF entity.

With reference to the second aspect, in an implementation manner, the method further includes: receiving, by the first NF entity At least one piece of security information sent from the NF storage function entity, wherein each of the security information includes an identifier of the first NF entity and an identifier of an NF entity that satisfies the NF type condition; the first The NF entity selects one of the at least one security information as the second NF entity.

In a third aspect, the present application provides a security information sending method, where the method is applied to an NF storage function entity, the method comprising: the NF storage function entity receiving an identifier of a first NF entity from a first NF entity and a requested NF type Obtaining, according to the identifier of the first NF entity and the NF type information, a security information identifier and an identifier of a second NF entity corresponding to the NF type; and the security information identifier and the second NF entity The identity is sent to the first NF entity. Further, the step of obtaining includes internally generating the NF storage function entity or acquiring from other entities.

With reference to the third aspect, in an implementation manner, the NF storage function entity obtains the security information identifier and the identifier of the second NF entity corresponding to the NF type, including: the NF storage function entity according to the first Determining, by the identifier of the NF entity and the NF type information, at least one NF entity that satisfies the NF type condition, and generating at least one security information, wherein the security information includes an identifier of the first NF entity and satisfies the NF The identity of an NF entity of the type condition.

With reference to the third aspect, in an implementation manner, the NF storage function entity receives the identifier of the first NF entity from the first NF entity and the requested NF type information, including: the NF storage function entity receives the first NF storage The identity of the first NF entity from the first NF entity forwarded by the functional entity and the requested NF type information.

With reference to the third aspect, in an implementation manner, if the NF discovery request further includes an identifier of the deployed PLMN, the NF storage function entity acquires a security information identifier and a second NF entity corresponding to the NF type. And the first NF storage function entity determines the second NF storage function entity according to the identifier of the deployed PLMN, and sends the identifier of the first NF entity and the requested NF type information to the a second NF storage function entity; receiving at least one security information returned from the second NF storage function entity, where the security information includes an identifier of the first NF entity and an NF entity that satisfies an NF type condition Logo.

The second NF entity is configured to obtain, according to the identifier of the first NF entity and the NF type information, a security information identifier and an identifier of a second NF entity corresponding to the NF type, and the security The information identifier and the identifier of the second NF entity are sent to the first NF storage function entity. And, the first NF storage function entity and the first NF entity belong to the first PLMN, and the second NF storage function entity and the second NF entity belong to the second PLMN.

The method provided by the present aspect, the first NF storage function entity in the first PLMN interacts with the second NF storage function entity in the second PLMN, and the second NF storage function entity in the second PLMN performs the second NF entity The information and corresponding security information and keys are provided to the second NF entity, thereby enabling control of communication between NF entities located in different PLMNs, and secure communication connections between NF entities.

With reference to the third aspect, in an implementation manner, the method further includes: sending, by the NF storage function entity, the security information and the identifier of the second NF entity to the second NF by using any one of the following manners: Entity; the NF storage function entity actively sends the security information and the identifier of the second NF entity; or, after the NF storage function entity receives the security information identifier from the second NF entity, to the The second NF entity sends.

With reference to the third aspect, in an implementation manner, after the NF storage function entity receives the security information identifier sent by the second NF entity, the method further includes: the NF storage function entity to the first NF entity and The second NF entity sends a first key, where the first key is used to decrypt the first encrypted ciphertext obtained by the second NF entity from the first NF entity.

With reference to the third aspect, in an implementation manner, after the NF storage function entity receives the identifier of the first NF entity from the first NF entity and the requested NF type information, the method further includes: the NF storage function entity detecting whether The first NF entity is allowed to initiate a communication connection request to the second NF entity.

With reference to the third aspect, in an implementation manner, the NF storage function entity stores an NF type list of the first NF entity, and the NF storage function entity detects whether to allow a communication connection request to be initiated, including: determining a location Whether the NF type corresponding to the identifier of the second NF entity is in the NF type list of the first NF entity; if yes, the communication connection request is allowed to be initiated; otherwise, the communication connection request is not allowed to be sent.

The method provided by the present invention controls the NF entity discovery by the NF storage function module, and provides the security information and the key information to the peer NF entity discovered by the NF, so that the NF entity can verify the other party according to the security information and the key. The authenticity of the identity and the establishment of a communication connection, thereby achieving the security and reliability of inter-NF access and avoiding unauthorized access between NFs.

In a fourth aspect, the present application further provides a network function NF entity, configured to receive a request for a communication connection initiated by a requester, for example, applied to a second network function NF entity, including: a transceiver unit, configured to receive from the first network a communication connection request of the function NF entity, where the communication connection request includes an identifier of the first NF entity and a security information identifier; and is further configured to acquire security information corresponding to the security information identifier from the NF storage function entity; Used to determine that if the security information includes an identifier of the first NF entity, The second NF entity establishes a communication connection with the first NF entity. Furthermore, the transceiver unit and the processing unit are also used to implement the method steps of the various implementations of the aforementioned first aspect.

In a fifth aspect, the present application further provides another network function NF entity, configured to initiate a communication connection request, for example, applied to a first network function NF entity, and a transceiver unit, configured to send a first NF entity to the NF storage function entity. The identifier and the requested NF type information; and is further configured to receive the security information identifier from the NF storage function entity and the identifier of the second NF entity corresponding to the NF type; and is further configured to send to the second NF entity And a communication connection request, where the communication connection request includes an identifier of the first NF entity and the security information identifier. Furthermore, the NF entity may further comprise a processing unit, the transceiver unit and the processing unit being further for implementing the method steps of the various implementations of the aforementioned second aspect.

In a sixth aspect, the application further provides a security information sending apparatus, configured to control the discovery of the NF, for example, to the NF storage function entity, including: a transceiver unit, configured to receive the first from the first NF entity An identifier of the NF entity and the requested NF type information; the processing unit, configured to acquire, according to the identifier of the first NF entity and the NF type information, a security information identifier and an identifier of a second NF entity corresponding to the NF type The transceiver unit is further configured to send the security information identifier and the identifier of the second NF entity to the first NF entity. Furthermore, the transceiver unit and the processing unit are also used to implement the method steps of the various implementations of the aforementioned third aspect.

In a seventh aspect, the present application further provides an NF entity device, including a transceiver and a processor for performing the method steps in the implementations of the first aspect or the fourth aspect. The transceiver may be implemented by a transceiver unit in the NF entity device, or may be implemented by the processor to control the transceiver.

In an eighth aspect, the present application further provides an NF entity device, including a transceiver and a processor for performing the method steps in the implementations of the second aspect or the fifth aspect. The transceiver may be implemented by a transceiver unit in the NF entity device, or may be implemented by the processor to control the transceiver.

In a ninth aspect, the present application further provides an NF storage function entity device, including a transceiver and a processor for performing the method steps in the implementation manners of the third aspect or the sixth aspect. The transceiver may be implemented by a transceiver unit in the NF storage function module device, or may be implemented by the processor to control the transceiver.

In a tenth aspect, the present application further provides an NF entity connection system, including the NF entity device described in the foregoing seventh aspect and the eighth aspect implementation manner, and the NF storage function entity device described in the ninth aspect implementation manner.

In an eleventh aspect, the present application further provides a computer storage medium, wherein the computer storage medium can store a program, and when the program is executed, the present application can provide a network function entity connection method and a security information transmission method. Some or all of the steps in the way.

DRAWINGS

In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings to be used in the embodiments or the prior art description will be briefly described below.

1 is a schematic structural diagram of a network including an EPC network element provided by the present application;

2 is a schematic structural diagram of a network including NF provided by the present application;

FIG. 3 is a schematic flowchart of a method for connecting an NF entity according to an embodiment of the present application;

FIG. 4 is a schematic flowchart of another NF entity connection method according to an embodiment of the present disclosure;

FIG. 5 is a schematic flowchart of still another NF entity connection method according to an embodiment of the present application;

FIG. 6 is a schematic structural diagram of a second NF entity according to an embodiment of the present application;

FIG. 7 is a schematic structural diagram of a first NF entity according to an embodiment of the present application;

FIG. 8 is a schematic structural diagram of an NF storage function entity according to an embodiment of the present disclosure;

FIG. 9 is a schematic structural diagram of an NF entity according to an embodiment of the present disclosure;

FIG. 10 is a schematic structural diagram of an NF storage function entity according to an embodiment of the present disclosure;

FIG. 11 is a schematic structural diagram of another NF storage function entity according to an embodiment of the present disclosure.

detailed description

The method provided by each embodiment of the present application, based on virtualization and the like, splits N network slices on a common network infrastructure of the core network, and the network slice may also be referred to as a private network, a dedicated network. A network service used to implement one or some business needs.

As shown in FIG. 2, a service oriented architecture may be adopted in the network slice. The NE (for example, MME or S-GW) in the original network architecture is defined as different NF according to the type of the function, for example, authentication and security. Functions, packet data session management functions, mobility management functions and access control functions, policy control functions, etc., are implemented by corresponding NF components, each of which provides services to other NF components or functions through a defined service interface. Multiple network slices (sliceA, sliceB, and sliceC) of the same carrier use the same public land mobile network (PLMN) and can be deployed in the carrier's infrastructure through cloud technologies and virtualization technologies. The operator's technical facilities include the operator's cloud computing and transmission infrastructure.

The NF entities in various embodiments of the present application include, but are not limited to, an authentication and security function entity, a packet data session management function entity, a mobility management function entity, an access control function entity, a policy control function entity, etc., and the NF entities are corresponding NF component implementations, each NF component serving other NF components or functions through a defined service interface.

During the execution of the network service, the NFs need to interact with each other to complete related network services. For example, the MM NF sends the SM message to the SM NF for processing by the SM NF. When establishing communication between NFs, NF should verify whether the communication connection between NFs is permitted, and verify the authenticity of the other party's identity, and avoid unauthorized access between NFs. To achieve identity verification and secure connection between NFs, The embodiment of the application provides a network function entity connection method and device, and the method provided by the present application is described in detail below:

Embodiment 1

Taking two network function entity connections as an example, the two NF entities are respectively a first NF entity and a second NF entity, wherein the first NF entity sends a communication connection request to the second NF entity to make it and the second NF. The entity establishes a communication connection.

In this embodiment, the NF storage function (English: NF repository function) entity is configured to store an identifier of the NF entity in the network, and provide information such as security information and a key to the communication connection request sender. .

Specifically, as shown in FIG. 3, the network function entity connection method includes the following steps:

Step 301: When the first NF entity needs to access the second NF entity, the first NF entity sends the identifier of the first NF entity and the requested NF type information to the NF storage function entity.

The identifier of the first NF entity and the requested NF type information may be sent by using an NF discovery request, where the NF type information is used to indicate that the first NF entity requests the NF type that needs to provide the service. Specifically, the NF type includes an authentication and security function (AuF), a packet data management function (SM NF), a mobility management, and a mobility management function (MM NF), a policy. Control function (PCF), etc.

Specifically, the identifier of the NF entity is used to identify an NF entity, for example, may include a PLMN ID, a combination of an NF type and a sequence number, a network address of the NF entity, or any other form of information that can identify the NF entity.

Step 302: After receiving the NF discovery request from the first NF entity, the NF storage function entity determines at least one NF entity that satisfies the condition according to the identifier of the first NF entity and the NF type, and generates at least one security information and An identifier of the second NF entity corresponding to the NF type; the corresponding information in the security information includes A security information identifier for an NF entity.

The security information may be a security token or a security evidence. Correspondingly, the security information identifier may be a security token ID or a security evidence identifier.

The NF storage function entity searches for the NF entity having the NF type according to the request, and the NF storage function entity searches for the NF with the PCF type in the pre-stored NF entity. An entity may find an NF entity or multiple NF entities with PCF functionality. For example, suppose the first NF entity is a session management function (SMF NF) entity, the SMF NF entity needs to discover the PCF NF entity, and if the NF storage function entity finds that two PCF NF entities meet the requirements, the NF storage The functional entity generates two pieces of security information. The first security information includes the SMF NF entity identifier and the PCF_1 NF entity identifier. The second security information includes the SMF NF entity identifier and the PCF_2 NF entity identifier, and the two security information are sent. The SMF NF entity is sent, and the first security information is sent to the PCF_1 NF entity, and the second security information is sent to the PCF_2 NF entity.

The security information is used to verify the authenticity of the identity of the first NF entity and the NF entity to be connected, and each security information further includes an identifier of the NF entity to be connected. Specifically, the security information includes: an identifier of the first NF entity, and an identifier of the (second) NF entity to be connected, for example, the NF type of the first NF entity located in a certain PLMN network is a packet data session management function. The SM NF, the identifier of the first NF entity may be a combination of a PLMN ID, an NF type, and a sequence number: PLMN ID.SMF.001, so that the NF entity may be uniquely identified, and optionally, a network of the NF entity may also be used. The address is the identifier of the NF entity.

The NF storage function entity also generates an NF discovery response.

Step 303: The NF storage function entity sends the identifier of the at least one security information that meets the NF type and the identifier of the second NF entity that is corresponding to the NF type to the first NF entity by using the NF discovery response.

Optionally, before the NF storage function entity sends the NF discovery response, the method further includes:

The NF storage function entity detects whether the first NF entity is allowed to initiate a communication connection request, or detects whether the NF discovery request allows access. By setting a detection mechanism, the NF function entity may be discovered as early as possible to achieve access. The access between the NF entities is controlled to reduce the load of the accessed NF entity and enhance the security of access between the NF entities.

Specifically, the process of the NF storage function entity detecting whether the communication connection request is allowed to be established includes: storing, by the NF storage function entity, a list of NF types accessible by the first NF entity, and the NF storage function entity may determine, according to the service logic, for example, It is determined whether the NF type corresponding to the NF entity to be connected is in the NF type list accessible by the first NF entity. If it is determined that the NF type corresponding to the NF entity to be connected is in the first NF In the list of NF types that the entity can access, access is allowed; if not in the list of NF types, the access connection is denied.

Step 304: The first NF entity receives the security information identifier (or security information) sent by the NF storage function entity and the identifier of the second NF entity corresponding to the NF type.

Optionally, the first NF entity sends the response through the NF discovery. The first NF entity selects one of the security information identifiers, and identifies the selected NF entity as the second NF entity, and establishes a session connection.

The NF storage function module can send the security information (partial or all) satisfying the NF type condition to the first NF entity, so that the first NF entity can select a preferred NF entity as the second NF entity, and the second The NF entity establishes a communication connection, thereby providing multiple possibilities for the first NF entity to select a good quality second NF entity, further improving the reliability and security of the communication connection; of course, the NF storage function module is also the first NF. The entity selects a preferred NF entity as the second NF entity, and sends the security information of the second NF entity to the first NF entity.

Step 305: The first NF entity generates a communication connection request, and sends the identifier of the first NF entity and the security information identifier to the second NF entity by using the communication connection request. The security information identifies a piece of security information that can uniquely correspond.

Step 306: The second NF entity receives a communication connection request from the first NF entity, where the communication connection request includes an identifier of the first NF entity and a security information identifier, and sends the verification that carries the security information identifier to the NF storage function entity. request.

Step 307: The NF storage function entity receives the verification request sent by the second NF entity, and determines the corresponding security information according to the security information identifier of the first NF entity, where the security information includes the identifier of the first NF entity.

Step 308: The NF storage function entity sends the security information to the second NF entity by using a verification response.

Step 309: The second NF entity acquires security information sent by the NF storage function entity, and determines, according to the security information, whether a communication connection is established with the first NF entity.

Specifically, the second NF entity determines whether the identifier of the first NF entity in the security information is the same as the identifier of the first NF entity in the communication connection request, or determines the first of the converted security information. Whether the identifier of the NF entity is the same as the identifier of the first NF entity in the communication connection request, for example, determining whether the information such as the PLMN ID, SMF.001, etc. sent by the NF storage function entity is converted into an IP address, etc., is sent with the first NF. The IP address is the same. If the same, the first NF entity is allowed to access the second NF entity, ie The second NF entity establishes a communication connection with the first NF entity; if not, the access is denied.

Optionally, in order to further improve the security of the communication connection, the communication connection request of step 305 further includes a first challenge random number (English: challenge) and a first encrypted ciphertext (English: encrypted text).

In step 302, the NF storage function entity generates at least one piece of security information, and also generates a first key (English: key) and a valid time of each of the security information, the first key being used to decrypt the The first encrypted ciphertext obtained by the second NF entity from the first NF entity, and the valid time of the security information is a set period of time for checking whether the security information is valid. If the time when the second NF entity verifies the identity of the first NF entity exceeds the valid time of the security information, the security information is invalid, and the connection access is denied; if it is valid, access is allowed.

The method further includes, in step 308, the NF storage function entity transmitting the first key and the valid time of the security information to the second NF entity.

In step 309, the second NF entity determines whether to establish a communication connection with the first NF entity according to the security information, and further includes: the second NF entity acquiring the first key from the NF storage function entity, And a first encrypted ciphertext from the first NF entity; the second NF entity decrypting the first encrypted ciphertext using the first key to generate the second challenge random number.

Determining whether the identifier of the first NF entity in the security information is the same as the identifier of the first NF entity in the communication connection request, and whether the first random number and the second random number are also the same, if both Similarly, the second NF entity establishes a communication connection with the first NF entity; if at least one of them is different, the connection is refused.

Optionally, the NF storage function entity further includes the first key in an NF discovery response sent by the first NF entity.

Optionally, after the second NF entity determines that the communication connection with the first NF entity is allowed, the method further includes:

Step 310: The second NF entity generates a third challenge random number, generates a second encrypted ciphertext by using the third challenge random number and the first key, and uses the second encrypted ciphertext and the third A challenge random number is sent to the first NF entity. Optionally, the second encrypted ciphertext and the third challenge random number may or may not be carried in the communication connection response. And if the communication connection response carries only information indicating that the first NF entity allows to establish a communication connection, the second NF entity may further send the second encrypted ciphertext and the third challenge random number by using a data packet.

Step 311: If the communication connection response indicates that the communication connection is allowed to be established, the first NF entity obtains the second encrypted ciphertext and the third challenge random number sent by the second NF entity by using the communication connection response; The NF entity decrypts the second encrypted ciphertext to generate a fourth challenge random number. And judge the fourth pick Whether the battle random number is the same as the third challenge random number, and if they are the same, establish a session connection with the second NF entity.

The second key for decrypting the second encrypted ciphertext may be obtained by the NF storage function entity. For example, in step 303, the NF storage function entity sends the first key by using the NF discovery response. Give the first NF entity. If the second key decrypting the second encrypted ciphertext is the same as the first key, the generated fourth challenge random number is the same as the third challenge random number if the second key is not from the And the first NF entity refuses to establish a connection with the second NF entity, if the NF storage function entity is different from the first key, and the first NF entity cannot decrypt the second encrypted ciphertext.

In the NF entity connection method provided by the embodiment, the first NF entity initiates a communication connection request to the second NF entity, and the NF storage function entity performs NF discovery control, and identifies the security information corresponding to the security information of the first NF entity. Provided to the second NF entity to be connected, so that the second NF entity can verify the authenticity and security of the access requester, the identity of the first NF entity according to the security information, and avoid unauthorized access between the NFs.

In addition, the NF storage function entity stores the identity of the NF entity in the network, generates security information, and sends a key to both ends of the NF entity requesting the communication connection, providing a basis and credentials for the access connection between the NF entities.

Optionally, after the second NF entity verifies the first NF entity identity security of the sending the communication connection request, sending the second encrypted ciphertext and the third challenge random number to the first NF entity, so that the first NF entity can be based on the NF The key provided by the storage function entity verifies the security of the second NF entity, further enhancing the security of the communication data between the NF entities.

Embodiment 2

This embodiment is the same as the application scenario of the first embodiment, and is a process for describing the first NF entity to discover and access the second NF entity. The difference from the first embodiment is that the NF storage function entity detects that the first NF entity is allowed to be the second. After the NF entity accesses, at least one security information and a key are actively sent to the second NF entity. Specifically, as shown in FIG.

For the steps 401 to 404, reference may be made to steps 301 to 304 in the first embodiment, and details are not described herein.

Step 405: The NF storage function module actively sends the generated at least one security information to an NF entity that satisfies the NF type condition, where the security information includes an identifier of the first NF entity.

Optionally, if the NF storage function entity finds that two PCF NF entities meet the connection requirement, the NF storage function entity generates two security information, where the first security information includes the SMF NF entity identifier and the PCF_1 NF entity identifier, and the second The security information includes the SMF NF entity identifier and the PCF_2 NF entity identifier, and The first security information is sent to the PCF_1 NF entity, and the second security information is sent to the PCF_2 NF entity.

The first NF entity receives the SMF NF entity identifier sent by the NF storage function entity, the PCF_1 NF entity identifier and the PCF_2 NF entity identifier, and selects one of the PCF_NF entities as the second NF entity, for example, selecting the PCF_1 NF entity as the connection object, A communication connection request is sent to the PCF_1 NF entity.

Step 406: The first NF entity sends a communication connection request to the selected second NF entity, where the communication connection request includes a security information identifier and an identifier of the first NF entity. Optionally, the communication connection request further includes The first challenge random number and the first encrypted ciphertext.

It should be noted that, in this embodiment, the execution order of the step 405 and the step 406 is not in a sequential relationship, that is, the second NF entity may first obtain the communication connection request sent by the first NF entity, and then obtain the security information sent by the NF storage function entity. Alternatively, the second NF entity simultaneously acquires the security information and the communication connection request.

Step 407: Receive an NF entity (second NF entity) of the communication connection request sent by the first NF entity, and determine, according to the security information and the identifier of the first NF entity, whether the first NF entity is Establish a communication connection.

Specifically, the steps 407 to 409 are the same as the steps 309 to 311 of the embodiment, and are not described again.

In the method provided by the embodiment, the NF storage function module sends the security information, the key, and the like to the second NF entity, thereby preventing the second NF entity from sending a separate request to the NF storage function module to obtain the corresponding security. Information saves the verification process and improves the efficiency of verification between NFs.

Embodiment 3

A connection method between NF entities provided in this embodiment is applied to a system of two or more PLMNs, where the system includes: a first NF entity, a second NF entity, and a first NF storage function entity, and a second The NF storage function entity, wherein the first NF entity and the first NF storage function entity are deployed in a first mobile network, configured as a first PLMN or a local PLMN (local PLMN), and the second NF entity and the second NF storage The function entity is deployed in the second mobile network, and is configured as a second PLMN or a remote PLMN. The process of establishing a communication connection specifically includes the following steps:

As shown in FIG. 5, step 501: The first NF entity sends an NF discovery request to the first NF storage function entity, where the NF discovery request includes an identifier of the first NF entity, and an NF type of the NF entity to be accessed (NF type , the type of network function) and the information such as the deployed PLMN identity.

Step 502: The first NF storage function entity receives the NF discovery request, determines a second NF storage function entity in the second PLMN according to the PLMN identifier in the NF discovery request, and stores the functional entity to the second NF. Send the NF request.

Step 503: The second NF storage function entity receives the NF discovery request, and determines at least one NF entity that satisfies the condition according to the identifier of the first NF entity and the NF type, and generates at least one security information, where each One of the security information corresponds to an identifier of an NF entity.

Optionally, after receiving the NF discovery request sent by the first NF storage function, the second NF storage function entity detects whether to allow access to the first NF entity to access other NF entities, and the process of detecting is the same as that in Embodiment 1, and is no longer Narration. If access is allowed, security information and keys with at least one NF entity are generated.

Step 504: The second NF storage function entity sends the generated at least one security information and the key to the first NF storage function entity by using the NF discovery response.

Step 505: The first NF storage function entity receives the NF discovery response sent by the second NF storage function entity, and sends the NF discovery response to the first NF entity, where the NF discovery response includes at least one NF to be connected. The security information of the entity, or it may also include the key. Some or all of the security information includes: an identifier of the first NF entity, an identifier of the NF entity to be connected to the second, and a valid time of the security information.

Optionally, in step 506, the first NF entity receives the NF discovery response sent by the first NF storage function entity, and selects an NF entity as the second NF entity according to the content in the NF discovery response.

Specifically, the first NF storage function entity determines the second NF storage function entity according to the identifier of the deployed PLMN in the NF discovery request, and sends the NF discovery request to the second NF storage function entity.

Step 507: The first NF entity sends a communication connection request to the determined second NF entity, where the communication connection request includes an identifier of the first NF entity, a first challenge random number, and a first encrypted ciphertext encrypted by the key.

Step 508: The second NF entity receives the communication connection request sent by the first NF entity, and sends the security information identifier in the communication connection request to the second NF storage function entity.

Step 509: The second NF storage function entity receives the security information identifier, searches for the security information corresponding thereto, and the key, and sends the security information and the key to the second NF entity, or the second NF storage function entity. After receiving the NF discovery request forwarded by the first NF storage function entity, the security information and the key are actively sent to the second NF entity.

Step 510: The second NF entity receives the communication connection request sent by the first NF entity and the security information and the key sent by the second NF storage function entity, and determines the identifier and the communication connection request of the first NF entity in the security information. Whether the identifiers of the first NF entities are the same, and whether the first challenge random number is the same as the second challenge random number generated after decrypting the first encrypted ciphertext, and if the identifiers are the same and the challenge random numbers are also the same, Determine the identity is true, establish a communication connection with the first NF entity.

Optionally, in step 511, if the first NF entity is allowed to establish a communication connection, the second NF entity sends a communication connection response to the first NF entity, where the communication connection response includes a third challenge random number and a second encrypted ciphertext. .

Step 512: The first NF entity receives the communication connection response, and a second key from the second NF storage function entity, and decrypts the second encrypted ciphertext by using the second key to generate a fourth challenge random number. And determining, if the fourth challenge random number is the same as the acquired third challenge random number, establishing a communication connection with the second NF entity.

The embodiment provides a connection method and system, where a first NF storage function entity in a first PLMN interacts with a second NF storage function entity in a second PLMN, and a second NF storage function entity in the second PLMN The two NF entity information and the corresponding security information and the key are provided to the second NF entity, thereby implementing control of communication between the NF entities located in different PLMNs, and secure communication connections between the NF entities.

As shown in FIG. 6 to FIG. 8 , the embodiment of the present application further provides a second NF entity, a first NF entity, and an NF storage function entity device.

Referring to FIG. 6, a schematic structural diagram of an NF entity is applied to a second NF entity for receiving a communication connection request from a transmitting end. Further, the entity includes: a transceiver unit 601 and a processing unit 602.

The transceiver unit 601 is configured to receive a communication connection request from the first network function NF entity, where the communication connection request includes an identifier of the first NF entity and a security information identifier, and the security information identifier is obtained from the NF storage function entity. Corresponding security information;

The processing unit 602 is configured to determine, if the security information includes the identifier of the first NF entity, establish a communication connection with the first NF entity.

Optionally, the security information includes an identifier of the first NF entity, and the processing unit 602 is further configured to determine, if the at least one identifier in the security information is the first NF entity in the communication connection request. If the identifiers are the same, a communication connection is established with the first NF entity.

Optionally, the communication connection request further includes a first challenge random number, and the transceiver unit 601 is further configured to acquire a first key from the NF storage function entity, and a first from the first NF entity. Encrypting the ciphertext, the processing unit 602 is further configured to: decrypt the first encrypted ciphertext by using the first key to generate a second challenge random number, and further configured to determine, if the at least one identifier in the security information is connected to the communication The identifier of the first NF entity in the request is the same, and the first challenge random number is the same as the second challenge random number, and a communication connection is established with the first NF entity.

Optionally, the processing unit 602 is further configured to: if a communication connection is established with the first NF entity, generate a third challenge random number, and generate a second using the third challenge random number and the first key Encrypting the ciphertext; the transceiver unit 601 is further configured to send the second encrypted ciphertext and the third challenge random number to the first NF entity.

The security information further includes an effective time of the security information, and the effective time of the security information is used to check whether the security information is valid.

Further, the transceiver unit 601 and the processor 602 are further configured to perform the steps of performing part or all of the functions of the first NF entity in steps 301 to 311 in FIG. 3; and executing the first NF in steps 401 to 409 in FIG. The steps of some or all of the functions of the entity; and the steps of some or all of the functions of the first NF entity in steps 501 through 512 of FIG.

Referring to FIG. 7, a schematic structural diagram of another NF entity is applied to a first NF entity for a communication connection request initiated by a second NF entity, the entity including: a transceiver unit 701 and a processing unit 702.

The transceiver unit 701 is configured to send, to the NF storage function entity, the identifier of the first NF entity and the requested NF type information, and receive the security information identifier from the NF storage function entity and the second NF corresponding to the NF type. The identity of the entity.

The transceiver unit 701 is further configured to send a communication connection request to the second NF entity, where the communication connection request includes an identifier of the first NF entity and the security information identifier.

Optionally, the transceiver unit 701 is further configured to receive a communication connection response from the second NF entity, where the communication connection response is used to indicate whether the second NF entity is allowed to establish a communication connection with the second NF entity.

Optionally, the entity further includes a processing unit 702, the transceiver unit 701 is further configured to receive a first key from the NF storage function entity, and obtain a first challenge random number, and a processing unit 702, configured to The first challenge random number and the first key generate a first encrypted ciphertext; the transceiver unit 701 is further configured to send the first encrypted ciphertext and the first challenge random number to the second NF entity.

Optionally, the transceiver unit 701 is further configured to: if the communication connection response indication indicates that the communication connection is allowed to be established, receive the second encrypted ciphertext and the third challenge random number from the second NF entity; and the processing unit 702, And is further configured to decrypt the second encrypted ciphertext by using the first key, and generate a fourth challenge random number, and determine that if the fourth challenge random number is the same as the third challenge random number, The second NF entity establishes a session connection.

Further, the transceiver unit 701 and the processor 702 are further configured to perform the steps of performing part or all of the functions of the second NF entity in steps 301 to 311 in FIG. 3; and performing the second step 401 to 409 in FIG. The steps of some or all of the functions of the NF entity, and the steps of some or all of the functions of the second NF entity in steps 501 through 512 of FIG.

It should be noted that the NF entity in this embodiment can serve as a transmitting end, for example, a first NF entity, and has a request for initiating a communication connection and a function, and can also serve as a receiving end, for example, a second NF entity, and receive a communication connection from the sending end. Request and verify the identity of the sender.

Referring to FIG. 8, a schematic structural diagram of an NF storage function entity for controlling discovery of an NF entity and generating security information and a key is shown.

Specifically, the entity includes: a transceiver unit 801 and a processing unit 802.

The transceiver unit 801 is configured to receive the identifier of the first NF entity from the first NF entity and the requested NF type information.

The processing unit 802 is configured to obtain, according to the identifier of the first NF entity and the NF type information, a security information identifier and an identifier of a second NF entity corresponding to the NF type.

The transceiver unit 801 is further configured to send the security information identifier and the identifier of the second NF entity to the first NF entity.

Optionally, the processing unit 802 is further configured to determine, according to the identifier of the first NF entity and the NF type information, at least one NF entity that satisfies an NF type condition, and generate at least one security information, where the security The information includes an identifier of the first NF entity and an identifier of an NF entity that satisfies the NF type condition.

Optionally, the transceiver unit 801 is further configured to receive the identifier of the first NF entity from the first NF entity forwarded by the first NF storage function entity and the requested NF type information.

Optionally, the transceiver unit 801 is further configured to: send the security information and the identifier of the second NF entity to the second NF entity, and actively send the security information and the second The identifier of the NF entity, or sent after receiving the security information identifier from the second NF entity.

Optionally, the transceiver unit 801 is further configured to send, to the first NF entity and the second NF entity, a first key, where the first key is used to decrypt the second NF entity from the first The first encrypted ciphertext obtained by an NF entity.

Optionally, the processing unit 802 is further configured to detect whether the first NF entity is allowed to initiate a communication connection request to the second NF entity. Further, the processing unit 802 is further configured to determine whether the NF type corresponding to the identifier of the second NF entity is in the NF type list of the first NF entity, and if yes, allow the communication connection request to be initiated, Otherwise, the communication connection request is not allowed to be sent.

In addition, the transceiver unit 801 and the processor 802 are further configured to perform the steps of performing part or all of the functions of the NF storage function entity in steps 301 to 311 in FIG. 3; and performing the NF storage function in steps 401 to 409 in FIG. The steps of some or all of the functions of the entity.

In a possible implementation, as shown in FIG. 11, the first NF storage function entity and the second NF storage function entity are included, and the first NF storage function entity and the first NF entity belong to the first mobile network, The second NF storage function entity and the second NF entity belong to the second mobile network, wherein the transceiver unit 801 includes a first transceiver unit 8011 and a second transceiver unit 8012, and the processing unit 802 includes a first processing unit 8021 and a second processing unit. 8022. The first transceiver unit 8011 and the first processing unit 8021 are both located in the first NF storage function entity, and the second transceiver unit 8012 and the second processing unit 8022 are both located in the second NF storage function entity.

The first transceiver unit 8011 is configured to receive an NF discovery request sent by the first NF entity, where the NF discovery request includes an identifier of the deployed PLMN.

The first processing unit 8021 is configured to receive the identifier of the deployed PLMN sent by the first transceiver unit 8011, determine the second NF storage function entity according to the identifier of the deployed PLMN, and pass the NF discovery request The first transceiver unit 8011 is sent to the second transceiver unit 8012;

The second transceiver unit 8012 is configured to receive the NF discovery request sent by the first transceiver unit 8011.

The second processing unit 8022 is configured to determine, according to the identifier of the first NF entity and the NF type in the NF discovery request, at least one NF entity that satisfies the condition, and generate at least one security information;

The second transceiver unit 8012 is further configured to send the at least one security information to the first transceiver unit 8011;

The first transceiver unit 8011 is further configured to receive the at least one security information, and send the at least one security information to the first NF entity.

Further, the first NF storage function entity and the second NF storage function entity are configured to perform the steps of performing some or all of the functions of the NF storage function entity in steps 301 to 311 of FIG. 3; and performing steps 401 to 141 in FIG. The step of 409 storing some or all of the functions of the functional entity in 409.

In this embodiment, the NF storage function entity controls the discovery of the NF entity, and provides the security information and the key information to the peer NF entity discovered by the NF, so that the NF entity can verify the other party according to the security information and the key. The authenticity of the identity and the establishment of a secure connection enable secure authentication of inter-NF access and avoid unauthorized access to the NF entity.

As shown in FIG. 9 and FIG. 10, the present application further provides a network function NF entity and an NF storage function entity. The NF entity and the NF storage function entity may be software deployed on a general-purpose computing platform or may be separate hardware devices. The NF entity may be an NF entity in any of the foregoing embodiments for implementing the method steps in the foregoing embodiments.

Referring to FIG. 9, the NF entity device includes a transceiver 901, a processor 902, and a memory 903. The transceiver 901 includes at least one communication interface and an I/O interface for implementing data transmission and reception with different NF entities and NF storage function entities. The transceiver 901 can include components such as a receiver, a transmitter, and an antenna. The NF entity may also include more or fewer components, or a combination of certain components, or different component arrangements, which is not limited in this application.

The processor 902 is a control center of the NF entity for implementing the various method step functions in the foregoing embodiments, connecting various parts of the entire device by using various interfaces and lines, by running or executing a software program stored in the memory 903 and/or Or module, and recalling data stored in the memory to perform various functions of the terminal device and/or process data. The processor 903 may be composed of an integrated circuit (IC), for example, may be composed of a single packaged IC, or may be composed of a plurality of packaged ICs that have the same function or different functions. For example, the processor 903 may include only a central processing unit (CPU), or may be a GPU, a digital signal processor (DSP), and a control chip (for example, a baseband chip) in the transceiver module. combination. In the embodiment of the present application, the CPU may be a single operation core, and may also include a multi-operation core.

In various embodiments of the present application, various transceiver modules in the transceiver 901 are generally in the form of integrated circuit chips, and can be selectively combined without including all transceiver modules and corresponding antenna groups. . For example, the transceiver module can include only a baseband chip, a radio frequency chip, and a corresponding antenna to provide communication functionality in a cellular communication system. The terminal device can be connected to a cellular network or the internet via a wireless communication connection established by the transceiver module, such as wireless local area network access or WCDMA access. In some optional implementations of the present application, a communication module, such as a baseband module, in the transceiver module may be integrated into the processor, typically an APQ+MDM series platform such as that provided by Qualcomm. The radio frequency circuit is used for receiving and transmitting signals during information transmission and reception or during a call. Generally, the radio frequency circuit includes well-known circuits for performing these functions, including but not limited to an antenna system, a radio frequency transceiver, one or more amplifiers, a tuner, one or more oscillators, a digital signal processor, a codec. (codec) chipset, Subscriber Identity Module (SIM) card, memory, etc. In addition, the RF circuit can communicate with the network and other devices through wireless communication. The wireless communication may use any communication standard or protocol, including but not limited to global system of mobile communication (GSM), general packet radio service (gprs), code division multiple access (code) Division multiple Access, CDMA), wideband code division multiple access (WCDMA), high speed uplink packet access (HSUPA), long term evolution (LTE), electronic Mail, short message service (SMS), etc.

Processor 902 also performs the processes of FIGS. 3 through 5 relating to the first NF entity and second NF entity processing and/or for the techniques described herein. For example, the processor/controller 902 is configured to support the first NF entity and/or the second NF entity to perform step 301 to step 311 in FIG. 3, step 401 to step 409 in FIG. 4, step 501 in FIG. Step 512, and/or other processes for the techniques described herein.

In the embodiment of the present application, the function to be implemented by the transceiver 901 may be implemented by the transceiver unit 601 or the transceiver unit 701, or may be implemented by the processor 902 to control the transceiver 901; the function to be implemented by the processor 902 may be performed by the processing unit. 602 or processing unit 702 is implemented.

Referring to FIG. 10, it is a schematic structural diagram of an NF storage function entity according to the present application. The NF storage function entity may be the security information generating device in any of the foregoing embodiments for implementing the method steps in the foregoing embodiments.

The NF storage function entity may be composed of a transceiver 1001, a processor 1002, a memory 1003, and the like. The transceiver 1001 includes at least one communication interface and an I/O interface.

The processor 1002 is a control center of the NF storage function entity, which connects various parts of the entire device by using various interfaces and lines, by running or executing software programs and/or modules stored in the memory, and calling data stored in the memory, To perform various functions and/or process data of the NF storage function module. The processor may be a central processing unit (CPU), a network processor (NP) or a combination of a CPU and an NP. The processor may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a general array logic (GAL), or any combination thereof.

The processor 1002 also performs other processes in FIG. 3 through FIG. 5 that relate to the NF storage functional entity process and/or for the techniques described herein. For example, the processor/controller 1002 is configured to support the NF storage function entity to perform step 301 to step 311 in FIG. 3, step 401 to step 409 in FIG. 4, step 501 to step 512 in FIG. 5, and/or Other processes of the techniques described herein.

The memory 1003 may include a volatile memory, such as a random access memory (RAM), and may also include a non-volatile memory, such as a flash memory. A hard disk drive (HDD) or a solid state drive (SSD); the memory may also include a combination of the above types of memories. A program or code may be stored in the memory, and the processor in the network element may implement the function of the NF storage function module by executing the program or code.

The transceiver 1001 can be configured to receive or transmit data, and the transceiver can transmit data to the first NF physical device or other NF physical device under the control of the processor.

In the embodiment of the present application, the transceiver may be used to implement the method steps of receiving the discovery request, sending the discovery response, and receiving the security information identifier and the feedback security information sent by the second NF entity in the foregoing embodiment. The functions to be implemented by the receiver 1001 may be implemented by the transceiver unit of the NF storage function entity, or by the processor 1002 to control the transceiver 1001; the functions to be implemented by the processor 1002 may be implemented by the processing unit 802.

In a specific implementation, the present application further provides a computer storage medium, wherein the computer storage medium may store a program, where the program may include a part of each embodiment of a connection method between network function entities provided by the application. Or all steps. The storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

Those skilled in the art can clearly understand that the technology in the embodiments of the present application can be implemented by means of software plus a necessary general hardware platform. Based on such understanding, the technical solution in the embodiments of the present application may be embodied in the form of a software product in essence or in the form of a software product, and the computer software product may be stored in a storage medium such as a ROM/RAM. , a diskette, an optical disk, etc., including instructions for causing a computer device (which may be a personal computer, server, or network device, etc.) to perform the methods described in various embodiments of the present application or portions of the embodiments.

The same and similar parts between the various embodiments in this specification can be referred to each other. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant points can be referred to the description in the method embodiment.

The embodiments of the present application described above are not intended to limit the scope of the present application.

Claims (32)

A network function entity connection method, the method comprising: The second network function NF entity receives a communication connection request from the first network function NF entity, where the communication connection request includes an identifier of the first NF entity and a security information identifier; Obtaining, by the second NF entity, security information corresponding to the security information identifier from an NF storage function entity; And if the security information includes an identifier of the first NF entity, the second NF entity establishes a communication connection with the first NF entity. The method according to claim 1, wherein if the security information includes an identifier of the first NF entity, establishing a communication connection with the first NF entity comprises: The security information includes an identifier of at least one NF entity, And if the at least one identifier of the security information is the same as the identifier of the first NF entity in the communication connection request, the second NF entity establishes a communication connection with the first NF entity. The method according to claim 2, wherein the communication connection request further includes a first challenge random number, The establishing, by the second NF entity, the communication connection with the first NF entity includes: The second NF entity acquires a first key from the NF storage function entity, and a first encrypted ciphertext from the first NF entity, using the first key pair to the first encrypted ciphertext Decrypting to generate a second challenge random number; And if the at least one identifier of the security information is the same as the identifier of the first NF entity in the communication connection request, and the first challenge random number is the same as the second challenge random number, The NF entity establishes a communication connection. The method according to any one of claims 1 to 3, wherein the method further comprises: And if the second NF entity establishes a communication connection with the first NF entity, the second NF entity generates a third challenge random number, and generates a second using the third challenge random number and the first key Encrypting the ciphertext and transmitting the second encrypted ciphertext and the third challenge random number to the first NF entity. A network function entity connection method, the method comprising: The first NF entity sends the identifier of the first NF entity and the requested NF type information to the NF storage function entity; The first NF entity receives a security information identifier from the NF storage function entity and an identifier of a second NF entity corresponding to the NF type; The first NF entity sends a communication connection request to the second NF entity, where the communication connection request includes an identifier of the first NF entity and the security information identifier. The method of claim 5, wherein the method further comprises: The first NF entity receives a communication connection response from the second NF entity, the communication connection response indicating whether the second NF entity is allowed to establish a communication connection with the first NF entity. The method of claim 5, wherein the method further comprises: The first NF entity receives a first key from the NF storage function entity; Obtaining, by the first NF entity, a first challenge random number, generating a first encrypted ciphertext according to the first challenge random number and the first key, and using the first encrypted ciphertext and the first challenge random number Send to the second NF entity. The method according to claims 6 and 7, wherein the method further comprises: The first NF entity receives a second encrypted ciphertext and a third challenge random number from the second NF entity if the communication connection response indicates that a communication connection is allowed to be established; The first NF entity decrypts the second encrypted ciphertext by using the first key, and generates a fourth challenge random number, if the fourth challenge random number is the same as the third challenge random number, And establishing a session connection with the second NF entity. A method for transmitting a security information, characterized in that the method comprises: The NF storage function entity receives the identifier of the first NF entity from the first NF entity and the requested NF type information; Obtaining, by the NF storage function entity, the security information identifier and the identifier of the second NF entity corresponding to the NF type, according to the identifier of the first NF entity and the NF type information; The NF storage function entity sends the security information identifier and the identifier of the second NF entity to the first NF entity. The method according to claim 9, wherein the NF storage function entity obtains the security information identifier and the identifier of the second NF entity corresponding to the NF type, including: Determining, by the NF storage function entity, at least one NF entity that satisfies the NF type condition according to the identifier of the first NF entity and the NF type information, and generating at least one security information, where the security information includes the The identity of the first NF entity and the identity of an NF entity that satisfies the conditions of the NF type. The method according to claim 9, wherein the NF storage function entity receives the identifier of the first NF entity from the first NF entity and the requested NF type information includes: The NF storage function entity receives the identifier of the first NF entity from the first NF entity forwarded by the first NF storage function entity and the requested NF type information. The method according to claim 9, wherein if the NF discovery request further includes an identifier of the deployed PLMN, the NF storage function entity acquires a security information identifier and a second NF corresponding to the NF type. The identity of the entity, including: Determining, by the first NF storage function entity, the second NF storage function entity according to the identifier of the deployed PLMN, and sending the identifier of the first NF entity and the requested NF type information to the second NF storage Functional entity Receiving, by the first NF storage function entity, at least one piece of security information returned by the second NF storage function entity, where the security information includes an identifier of the first NF entity and an NF entity that satisfies an NF type condition Logo. The method according to any one of claims 9 to 12, wherein the method further comprises: The NF storage function entity sends the security information and the identifier of the second NF entity to the second NF entity in any one of the following manners; The NF storage function entity actively sends the security information and an identifier of the second NF entity; Or sending, after the NF storage function entity receives the security information identifier from the second NF entity, to the second NF entity. The method according to claim 13, wherein after the NF storage function entity receives the security information identifier sent by the second NF entity, the method further includes: The NF storage function entity sends the first secret to the first NF entity and the second NF entity And the first key is used to decrypt the first encrypted ciphertext obtained by the second NF entity from the first NF entity. The method according to any one of claims 9 to 14, wherein after the NF storage function entity receives the identifier of the first NF entity from the first NF entity and the requested NF type information, the method further includes: The NF storage function entity detects whether the first NF entity is allowed to initiate a communication connection request to the second NF entity. The method according to claim 15, wherein the NF storage function entity stores a list of NF types of the first NF entity, The NF storage function entity detects whether to allow a communication connection request to be initiated, including: Determining whether the NF type corresponding to the identifier of the second NF entity is in the NF type list of the first NF entity; If so, the communication connection request is allowed to be initiated, otherwise the communication connection request is not allowed to be sent. A network function entity is applied to a second network function NF entity, and is characterized by: a transceiver unit, configured to receive a communication connection request from the first network function NF entity, where the communication connection request includes an identifier of the first NF entity and a security information identifier; The transceiver unit is further configured to acquire, from the NF storage function entity, security information corresponding to the security information identifier; And a processing unit, configured to determine, if the security information includes an identifier of the first NF entity, establish a communication connection with the first NF entity. The entity according to claim 17, wherein the security information includes an identifier of at least one NF entity, The processing unit is further configured to determine, if the at least one identifier of the security information is the same as the identifier of the first NF entity in the communication connection request, establish a communication connection with the first NF entity. The entity according to claim 18, wherein the communication connection request further includes a first challenge random number, The transceiver unit is further configured to acquire a first key from the NF storage function entity, and a first encrypted ciphertext from the first NF entity, The processing unit is further configured to decrypt the first encrypted ciphertext by using the first key to generate a second challenge random number; The processing unit is further configured to determine that if at least one identifier in the security information is the same as an identifier of a first NF entity in the communication connection request, and the first challenge random number and the second challenge are random If the numbers are the same, a communication connection is established with the first NF entity. An entity according to any one of claims 17 to 19, characterized in that The processing unit is further configured to: if a communication connection is established with the first NF entity, generate a third challenge random number, and generate a second encrypted ciphertext by using the third challenge random number and the first key ; The transceiver unit is further configured to send the second encrypted ciphertext and the third challenge random number to the first NF entity. A network function entity is applied to a first network function NF entity, and is characterized by: a transceiver unit, configured to send, to the NF storage function entity, the identifier of the first NF entity and the requested NF type information; The transceiver unit is further configured to receive a security information identifier from the NF storage function entity and an identifier of a second NF entity corresponding to the NF type; The transceiver unit is further configured to send a communication connection request to the second NF entity, where the communication connection request includes an identifier of the first NF entity and the security information identifier. The entity of claim 21, wherein The transceiver unit is further configured to receive a communication connection response from the second NF entity, where the communication connection response is used to indicate whether the second NF entity is allowed to establish a communication connection with the second NF entity. The entity of claim 21, wherein the entity further comprises a processing unit, The transceiver unit is further configured to receive a first key from the NF storage function entity, and acquire a first challenge random number; The processing unit is configured to generate a first encrypted ciphertext according to the first challenge random number and the first key; The transceiver unit is further configured to send the first encrypted ciphertext and the first challenge random number to the first Two NF entities. The entity of claim 21, wherein The transceiver unit is further configured to: if the communication connection response indication indicates that the communication connection is allowed to be established, receive the second encrypted ciphertext and the third challenge random number from the second NF entity; The processing unit is further configured to decrypt the second encrypted ciphertext by using the first key, and generate a fourth challenge random number, and determine, if the fourth challenge random number and the third challenge are random If the numbers are the same, a session connection is established with the second NF entity. A network function storage function entity, comprising: a transceiver unit, configured to receive an identifier of the first NF entity from the first NF entity and the requested NF type information; a processing unit, configured to acquire, according to the identifier of the first NF entity and the NF type information, a security information identifier and an identifier of a second NF entity corresponding to the NF type; The transceiver unit is further configured to send the security information identifier and the identifier of the second NF entity to the first NF entity. The entity of claim 25, wherein The processing unit is further configured to determine, according to the identifier of the first NF entity and the NF type information, at least one NF entity that satisfies an NF type condition, and generate at least one security information, where the security information includes An identifier of the first NF entity and an identifier of an NF entity that satisfies the NF type condition. The entity of claim 25, wherein The transceiver unit is further configured to receive an identifier of the first NF entity from the first NF entity forwarded by the first NF storage function entity and the requested NF type information. The entity according to claim 25, wherein the NF discovery request further includes an identifier of the deployed PLMN, The processing unit is further configured to determine, according to the identifier of the deployed PLMN, the second NF storage function entity, and send the identifier of the first NF entity and the requested NF type information to the second NF storage. Functional entity The transceiver unit is further configured to receive at least one piece of security information returned by the second NF storage function entity, where the security information includes an identifier of the first NF entity and an NF entity that satisfies an NF type condition. Logo. An entity according to any one of claims 25-28, characterized in that The transceiver unit is further configured to send the security information and the identifier of the second NF entity to the second NF entity in any one of the following manners; The security information and the identifier of the second NF entity are actively sent, or are sent after receiving the security information identifier from the second NF entity. The entity of claim 29, wherein The transceiver unit is further configured to send a first key to the first NF entity and the second NF entity, where the first key is used to decrypt the second NF entity from the first NF entity The first encrypted ciphertext obtained. An entity according to any one of claims 25-30, characterized in that The processing unit is further configured to detect whether the first NF entity is allowed to initiate a communication connection request to the second NF entity. The entity according to claim 31, wherein the NF storage function entity stores a list of NF types of the first NF entity, The processing unit is further configured to determine whether the NF type corresponding to the identifier of the second NF entity is in the NF type list of the first NF entity, and if yes, allow the communication connection request to be initiated; otherwise, The communication connection request is not allowed to be sent.

Images