WO2025030300A1 - Information indication method, first api invoker, first network function, and storage medium - Google Patents

Abstract

Embodiments of the present disclosure provide an information indication method, a first API invoker, a first network function, a communication system, and a storage medium. The method is executed by a first API invoker. The method comprises: receiving first information sent by a first network function, wherein the first information indicates an authorization mode, and the authorization mode is an authorization mode used by the first API invoker. According to the technical solution provided in the embodiments of the present disclosure, an authorization mode can be specified.

Description

Information indication method, first API caller, first network function and storage medium Technical Field

The present disclosure relates to the field of communication technology, and in particular to an information indication method, a first API caller, a first network function and a storage medium.

Background Art

In the field of communication technology, in the SNAAPPY or RNAA scenario (a scenario that requires user participation in authorization), in order to enable resource owners (for example, end users, subscribers, etc.) to authorize application programming interface (API) callers, the Common API Framework (CAPIF) needs to support new security methods.

Summary of the invention

During the authorization process, the authorization method is not clear.

The embodiments of the present disclosure provide an information indication method, a first API caller, a first network function and a storage medium.

According to a first aspect of an embodiment of the present disclosure, there is provided an information indication method, the method being executed by a first application programming interface API caller, the method comprising:

receiving first information sent by a first network function;

Among them, the first information indicates an authorization method, and the authorization method is the authorization method used by the first API caller.

According to a second aspect of an embodiment of the present disclosure, an information indication method is provided, the method being performed by a first network function, the method comprising:

Determine the authorization method;

Among them, the authorization method is the authorization method used by the first API caller.

According to a third aspect of an embodiment of the present disclosure, there is provided an information indication method, which is applied to a communication system, and the method includes:

The first network function sends a first message to the first API caller;

The first API caller receives the first information sent by the first network function;

Among them, the first information indicates an authorization method, and the authorization method is the authorization method used by the first API caller.

According to a fourth aspect of an embodiment of the present disclosure, a first API caller is provided, wherein the first API caller includes:

The transceiver module is configured as follows:

receiving first information sent by a first network function;

Among them, the first information indicates an authorization method, and the authorization method is the authorization method used by the first API caller.

According to a fifth aspect of an embodiment of the present disclosure, a first network function is provided, wherein the first network function includes:

The processing module is configured as follows:

Determine the authorization method;

Among them, the authorization method is the authorization method used by the first API caller.

According to a sixth aspect of an embodiment of the present disclosure, a communication system is provided, wherein the communication system includes a first API caller and a first network function, the first API caller is configured to implement the information indication method provided by the first aspect, and the first network function is configured to implement the information indication method provided by the second aspect.

According to a seventh aspect of an embodiment of the present disclosure, a first API caller is provided, wherein the first API caller includes:

one or more processors;

Among them, the processor is used to call instructions so that the first API caller executes the information indication method provided by the first aspect.

According to an eighth aspect of an embodiment of the present disclosure, a first network function is provided, wherein the first network function includes:

one or more processors;

Among them, the processor is used to call instructions to enable the first network function to execute the information indication method provided by the second aspect.

According to a ninth aspect of an embodiment of the present disclosure, a storage medium is provided, wherein the storage medium stores instructions, and when the instructions are executed on a communication device, the communication device executes the information indication method provided by the first aspect, the second aspect or the third aspect.

The technical solution provided by the embodiments of the present disclosure can clarify the authorization method.

It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the embodiments of the present disclosure.

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present invention and, together with the description, serve to explain the principles of the embodiments of the present invention.

FIG1 is a schematic diagram showing an architecture of a communication system according to an exemplary embodiment;

FIG2a is a schematic flow chart of an information indication method according to an exemplary embodiment;

FIG3a is a schematic flow chart of an information indication method according to an exemplary embodiment;

FIG3b is a schematic flow chart of an information indication method according to an exemplary embodiment;

FIG4a is a schematic flow chart of an information indication method according to an exemplary embodiment;

FIG4b is a schematic flow chart of an information indication method according to an exemplary embodiment;

FIG5a is a schematic flow chart of an information indication method according to an exemplary embodiment;

Fig. 6a is a schematic flow chart of an information indication method according to an exemplary embodiment;

Fig. 7a is a schematic diagram showing the structure of a first API caller according to an exemplary embodiment;

FIG7b is a schematic structural diagram of a first network function according to an exemplary embodiment;

FIG8a is a schematic structural diagram of a UE according to an exemplary embodiment;

Fig. 8b is a schematic structural diagram of a communication device according to an exemplary embodiment.

DETAILED DESCRIPTION

The embodiments of the present disclosure provide an information indication method, a first API caller, a first network function and a storage medium.

In a first aspect, an embodiment of the present disclosure provides an information indication method, the method being executed by a first application programming interface API caller, the method comprising:

receiving first information sent by a first network function;

Among them, the first information indicates an authorization method, and the authorization method is the authorization method used by the first API caller.

In the above embodiment, after receiving the first information, the first API caller can use the authorization method indicated by the first information to perform authorization.

In combination with some embodiments of the first aspect, in some embodiments, the method further includes:

sending second information to the first network function;

The second information indicates a client type of the first API caller, and the client type is used by the first network function to determine an authorization method used by the first API caller.

In the above embodiment, after the first network function receives the second information indicating the client type of the first API caller, the authorization method used by the first API caller can be determined based on the client type, so that the authorization method used can be clarified.

In combination with some embodiments of the first aspect, in some embodiments, the method further includes:

receiving third information sent by the first network function;

Among them, the third information includes the first identifier configured by the first network function for the first API caller, the first API caller is set with a mapping relationship between the first identifier and the client type and/or the first network function is set with a mapping relationship between the first identifier and the client type.

In the above embodiment, after receiving the third information including the first identifier configured by the first network function for the first API caller, the first API caller may report the client type of the first API caller based on the first identifier.

In combination with some embodiments of the first aspect, in some embodiments, the mapping relationship is created by the first network function.

In the above embodiment, since the first network function creates the mapping relationship, the first API caller can determine the first identifier corresponding to the client type based on the mapping relationship.

In combination with some embodiments of the first aspect, in some embodiments, the method further includes:

sending fourth information to the first network function;

The fourth information includes the first identifier.

In the above embodiment, since the fourth information includes the first identifier, the first network function can determine the authorization method corresponding to the fourth information after receiving the fourth information, and send the determined authorization method information to the first network function based on the request of the first API caller.

In conjunction with some embodiments of the first aspect, in some embodiments, the first information indicates the authorization method determined by the first network function based on the first identifier. In the above embodiments, after receiving the first information, the first network function can clearly determine the authorization method to be used.

In combination with some embodiments of the first aspect, in some embodiments, the method further includes:

The corresponding authorization process is started based on the authorization method.

In the above embodiment, the corresponding authorization process can be started based on the clearly determined authorization method, and the authorization mechanism is more complete and reliable.

In combination with some embodiments of the first aspect, in some embodiments, the authorization mode is authorization code authorization, and the method further includes:

sending fifth information to the first network function;

The fifth information includes information that the response type is code and/or the authorization type is authorization code, and the fifth information is used to obtain the authorization code and/or token.

In the above embodiment, the authorization code and/or token may be obtained by sending the fifth information.

In combination with some embodiments of the first aspect, in some embodiments, the authorization method is PKCE-based authorization or authorization code authorization supporting PKCE, and the method further includes:

sending sixth information to the first network function;

The sixth information includes information of code challenge and/or code verification, and the sixth information is used to obtain an authorization code and/or a token.

In the above embodiment, the authorization code and/or token may be obtained by sending the sixth information.

In conjunction with some embodiments of the first aspect, in some embodiments, the client type includes one of the following:

public client;

Confidential client.

In conjunction with some embodiments of the first aspect, in some embodiments, the authorization method includes one of the following:

Authorization code authorization code) authorization;

Supports Authorization code grant with the Proof Key of Code Exchange (PKCE);

Authorization based on Proof Key of Code Exchange (PKCE);

Client Credentials Grant.

In a second aspect, an embodiment of the present disclosure provides an information indication method, the method being performed by a first network function, the method comprising:

Determine the authorization method;

The authorization method is the authorization method used by the first API caller.

In the above embodiment, the authorization method can be clearly determined, which improves the authorization mechanism and makes the authorization more reliable compared to the situation where the authorization method cannot be clearly determined.

In conjunction with some embodiments of the second aspect, in some embodiments, determining the authorization method includes:

Determining the authorization method based on the first policy and/or a determination result of whether the first resource owner needs to participate in the authorization in real time;

The first policy is an authorization policy related to the first resource owner.

In the above embodiment, the authorization method can be determined based on the first policy and/or the result of determining whether the first resource owner needs to participate in the authorization in real time, and the determination method is more flexible.

In combination with some embodiments of the second aspect, in some embodiments, determining the authorization mode based on the first policy and/or a determination result of whether the first resource owner needs to participate in the authorization in real time includes one of the following:

If the first network function locally stores the first policy and it is determined that the first resource owner does not need to participate in authorization in real time, determining that the authorization method is a client credential authorization method;

If the first resource owner is required to participate in the authorization in real time, the authorization method is determined to be authorization code authorization, PKCE-based authorization, or authorization code authorization supporting PKCE.

In the above embodiment, different authorization modes may be determined based on the first policy and/or the determination result of whether the first resource owner is required to participate in the authorization in real time.

In conjunction with some embodiments of the second aspect, in some embodiments, the method further includes:

Receiving second information sent by the first API caller;

The second information indicates a client type of the first API caller, and the client type is used by the first network function to determine an authorization method used by the first API caller.

In conjunction with some embodiments of the second aspect, in some embodiments, the method further includes:

Sending third information to the first API caller;

Among them, the third information includes the first identifier configured by the first network function for the first API caller; the first API caller is set with a mapping relationship between the first identifier and the client type and/or the first network function is set with a mapping relationship between the first identifier and the client type.

In conjunction with some embodiments of the second aspect, in some embodiments, the method further includes:

The mapping relationship is created.

In conjunction with some embodiments of the second aspect, in some embodiments, the method further includes:

Receiving fourth information sent by the first API;

The fourth information includes the first identifier.

In conjunction with some embodiments of the second aspect, in some embodiments, the method further includes:

Determine the client type corresponding to the first identifier;

The determination of the authorization method;

The authorization method is determined based on the client type.

In conjunction with some embodiments of the second aspect, in some embodiments, determining the authorization method based on the client type includes at least one of the following:

If the client type is a public client, determine that the authorization method is a PKCE-based authorization or an authorization code authorization method that supports PKCE;

If the client type is a public client, determining that the authorization method is not an authorization code authorization method;

If the client type is a public client, determining that the authorization method is not a client single credential authorization method;

If the client type is a confidential client, determining that the authorization method is a PKCE-based authorization or an authorization code authorization method that supports PKCE;

If the client type is a confidential client, determining that the authorization method is an authorization code authorization method;

If the client type is a confidential client, determine that the authorization method is a client credential authorization method.

In the above embodiment, different authorization methods may be determined based on different client types.

In combination with some embodiments of the second aspect, in some embodiments, if the client type is a confidential client, determining that the authorization method is a PKCE-based authorization or an authorization code authorization method that supports PKCE includes:

If the client type is a confidential client and the first network function does not locally store a first policy related to the first resource owner, determine that the authorization method is a PKCE-based authorization or an authorization code authorization method that supports PKCE;

If the client type is a confidential client and the first resource owner needs to participate in the authorization in real time, the authorization method is determined to be a PKCE-based authorization or an authorization code authorization method that supports PKCE.

In the above embodiments, different authorization modes may be determined.

In conjunction with some embodiments of the second aspect, in some embodiments, if the client type is a confidential client, determining that the authorization method is an authorization code authorization method includes:

If the client type is a confidential client and the first network function does not locally store a first policy related to the first resource owner, determining that the authorization method is an authorization code authorization method;

If the client type is a confidential client and the first resource owner needs to participate in the authorization in real time, the authorization method is determined to be an authorization code authorization method.

In conjunction with some embodiments of the second aspect, in some embodiments, if the client type is a confidential client, determining that the authorization method is a client credential authorization method includes:

If the client type is a confidential client, the first network function locally stores a first policy related to the first resource owner and the first resource owner does not need to participate in authorization in real time, the authorization mode is determined to be a client credential authorization mode.

In conjunction with some embodiments of the second aspect, in some embodiments, the method further includes:

Sending a first message to a first API caller;

The first information indicates the authorization method.

In conjunction with some embodiments of the second aspect, in some embodiments, the authorization mode is authorization code authorization, and the method further includes:

receiving fifth information sent by the first API caller;

The fifth information includes information that the authorization code and/or the authorization type is an authorization code, and the fifth information is used to obtain the authorization code and/or token.

In conjunction with some embodiments of the second aspect, in some embodiments, the authorization method is PKCE-based authorization or authorization code authorization supporting PKCE, and the method further includes:

receiving sixth information sent by the first API caller;

The sixth information includes information of code challenge and/or code verification, and the sixth information is used to obtain an authorization code and/or a token.

In conjunction with some embodiments of the second aspect, in some embodiments, the client type includes one of the following:

Public Client;

Confidential Client.

In conjunction with some embodiments of the second aspect, in some embodiments, the authorization method includes one of the following:

Authorization code grant;

Supports authorization code authorization for code exchange proof key PKCE;

Authorization based on code exchange proof key PKCE;

Client Credentials Grant.

In a third aspect, an embodiment of the present disclosure provides an information indication method, which is applied to a communication system, and the method includes:

The first network function sends a first message to the first API caller;

The first API caller receives the first information sent by the first network function;

Among them, the first information indicates an authorization method, and the authorization method is the authorization method used by the first API caller.

In a fourth aspect, an embodiment of the present disclosure provides a first API caller, characterized in that the first API caller includes:

The transceiver module is configured as follows:

receiving first information sent by a first network function;

Among them, the first information indicates an authorization method, and the authorization method is the authorization method used by the first API caller.

In a fifth aspect, an embodiment of the present disclosure provides a first network function, characterized in that the first network function includes:

The processing module is configured as follows:

Determine the authorization method;

Among them, the authorization method is the authorization method used by the first API caller.

In a sixth aspect, an embodiment of the present disclosure provides a communication system, wherein the communication system includes a first API caller and a first network function, the first API caller is configured to implement the information indication method described in the optional implementation manner of the first aspect, and the first network function is configured to implement the information indication method described in the optional implementation manner of the second aspect.

In a seventh aspect, an embodiment of the present disclosure provides a first API caller, wherein the first API caller includes:

one or more processors;

The processor is used to call instructions so that the first API caller executes the information indication method described in the optional implementation manner of the first aspect.

In an eighth aspect, an embodiment of the present disclosure provides a first network function, wherein the first network function includes:

one or more processors;

The processor is used to call instructions to enable the first network function to execute the information indication method described in the optional implementation manner of the first aspect.

In a ninth aspect, an embodiment of the present disclosure provides a storage medium, wherein the storage medium stores instructions, and when the instructions are executed on a communication device, the communication device executes the information indication method described in the optional implementation manner of the first aspect, the second aspect or the third aspect.

In an eleventh aspect, an embodiment of the present disclosure provides a program product. When the program product is executed by a communication device, the communication device executes the information indication method described in the optional implementation manner of the first aspect, the second aspect, or the third aspect.

In a twelfth aspect, an embodiment of the present disclosure provides a computer program, which, when executed on a computer, enables the computer to execute the information indication method described in the optional implementation manner of the first aspect, the second aspect, or the third aspect.

It is understandable that the first API caller, the first network function, the communication system, the storage medium, the program product, and the computer program are all used to execute the method provided by the embodiment of the present disclosure. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding method, which will not be repeated here.

The disclosed embodiment provides an information indication method, a first API caller, a first network function, a communication system and a storage medium. In some embodiments, the information indication method and the information processing method, the information transmission method and other terms can be interchangeable.

The embodiments of the present disclosure are not exhaustive, but are only illustrative of some embodiments, and are not intended to be a specific limitation on the scope of protection of the present disclosure. In the absence of contradiction, each step in a certain embodiment can be implemented as an independent embodiment, and the steps can be arbitrarily combined. For example, a solution after removing some steps in a certain embodiment can also be implemented as an independent embodiment, and the order of the steps in a certain embodiment can be arbitrarily exchanged. In addition, the optional implementation methods in a certain embodiment can be arbitrarily combined; in addition, the embodiments can be arbitrarily combined, for example, some or all of the steps of different embodiments can be arbitrarily combined, and a certain embodiment can be arbitrarily combined with the optional implementation methods of other embodiments.

In each embodiment of the present disclosure, unless otherwise specified or there is a logical conflict, the terms and/or descriptions between the embodiments are consistent and can be referenced to each other, and the technical features in different embodiments can be combined to form a new embodiment based on their internal logical relationships.

The terms used in the embodiments of the present disclosure are only for the purpose of describing specific embodiments and are not intended to limit the present disclosure.

In the embodiments of the present disclosure, unless otherwise specified, elements expressed in the singular form, such as "a", "an", "the", "above", "said", "aforementioned", "this", etc., may mean "one and only one", or "one or more", "at least one", etc. For example, when using articles such as "a", "an", "the" in English in translation, the noun after the article may be understood as a singular expression or a plural expression.

In the embodiments of the present disclosure, “plurality” refers to two or more.

In some embodiments, the terms "at least one (at least one of), "one or more (one or more)", "a plurality of (a plurality of)", "multiple (multiple)", etc. can be used interchangeably.

In some embodiments, "at least one of A and B", "A and/or B", "A in one case, B in another case", "A in one case, B in another case", etc., may include the following technical solutions according to the situation: in some embodiments, A (A is executed independently of B); in some embodiments, B (B is executed independently of A); in some embodiments, execution is selected from A and B (A and B are selectively executed); in some embodiments, A and B (both A and B are executed). When there are more branches such as A, B, C, etc., the above is also similar.

In some embodiments, the recording method of "A or B" may include the following technical solutions according to the situation: in some embodiments, A (A is executed independently of B); in some embodiments, B (B is executed independently of A); in some embodiments, execution is selected from A and B (A and B are selectively executed). When there are more branches such as A, B, C, etc., the above is also similar.

The prefixes such as "first" and "second" in the embodiments of the present disclosure are only used to distinguish different description objects, and do not constitute restrictions on the position, order, priority, quantity or content of the description objects. The statement of the description object refers to the description in the context of the claims or embodiments, and should not constitute unnecessary restrictions due to the use of prefixes. For example, if the description object is a "field", the ordinal number before the "field" in the "first field" and the "second field" does not limit the position or order between the "fields", and the "first" and "second" do not limit whether the "fields" they modify are in the same message, nor do they limit the order of the "first field" and the "second field". For another example, if the description object is a "level", the ordinal number before the "level" in the "first level" and the "second level" does not limit the priority between the "levels". For another example, the number of description objects is not limited by the ordinal number, and can be one or more. Taking the "first device" as an example, the number of "devices" can be one or more. In addition, the objects modified by different prefixes may be the same or different. For example, if the description object is "device", then the "first device" and the "second device" may be the same device or different devices, and their types may be the same or different. For another example, if the description object is "information", then the "first information" and the "second information" may be the same information or different information, and their contents may be the same or different.

In some embodiments, “including A”, “comprising A”, “used to indicate A”, and “carrying A” can be interpreted as directly carrying A or indirectly indicating A.

In some embodiments, terms such as “…”, “determine…”, “in the case of…”, “at the time of…”, “when…”, “if…”, “if…”, etc. can be used interchangeably.

In some embodiments, terms such as "greater than", "greater than or equal to", "not less than", "more than", "more than or equal to", "not less than", "higher than", "higher than or equal to", "not lower than", and "above" can be replaced with each other, and terms such as "less than", "less than or equal to", "not greater than", "less than", "less than or equal to", "no more than", "lower than", "lower than or equal to", "not higher than", and "below" can be replaced with each other.

In some embodiments, devices, etc. can be interpreted as physical or virtual, and their names are not limited to the names recorded in the embodiments. Terms such as "device", "equipment", "device", "circuit", "network element", "node", "function", "unit", "section", "system", "network", "chip", "chip system", "entity", and "subject" can be used interchangeably.

In some embodiments, "network" may be interpreted as devices included in the network (eg, access network equipment, core network equipment, etc.).

In some embodiments, the terms "access network device (AN device), "radio access network device (RAN device)", "base station (BS)", "radio base station (radio base station)", "fixed station (fixed station)", "node", "access point (access point)", "transmission point (TP)", "reception point (RP)", "transmission/reception point (TRP)", "panel", "antenna panel (antenna panel)", "antenna array (antenna array)", "cell", "macro cell", "small cell (small cell)", "femto cell (femto cell)", "pico cell (pico cell)", "sector (sector)", "cell group (cell)", "serving cell", "carrier (carrier)", "component carrier (component carrier)", "bandwidth part (bandwidth part (BWP))" and so on can be used interchangeably.

In some embodiments, the terms "terminal", "terminal device", "user equipment (UE)", "user terminal" "mobile station (MS)", "mobile terminal (MT)", subscriber station, mobile unit, subscriber unit, wireless unit, remote unit, mobile device, wireless device, wireless communication device, remote device, mobile subscriber station, access terminal, mobile terminal, wireless terminal, remote terminal, handset, user agent, mobile client, client and the like can be used interchangeably.

In some embodiments, the access network device, the core network device, or the network device may be replaced by a terminal. For example, the communication between the access network device, the core network device, or the network device and the terminal is replaced by the communication between multiple terminals (for example, the device to the device). The embodiments of the present disclosure may also be applied to structures such as device-to-device (D2D), vehicle-to-everything (V2X), etc. In this case, it may also be configured that the terminal has all or part of the functions of the access network device. In addition, terms such as "uplink" and "downlink" may also be replaced with terms corresponding to terminal-to-terminal communication (for example, "side"). For example, an uplink channel, a downlink channel, etc. may be replaced with a side channel, and an uplink, a downlink, etc. may be replaced with a side link.

In some embodiments, the terminal may be replaced by an access network device, a core network device, or a network device. In this case, the access network device, the core network device, or the network device may also be configured to have a structure that has all or part of the functions of the terminal.

In some embodiments, acquisition of data, information, etc. may comply with the laws and regulations of the country where the data is obtained.

In some embodiments, data, information, etc. may be obtained with the user's consent.

In addition, each element, each row, or each column in the table of the embodiments of the present disclosure may be implemented as an independent embodiment, and the combination of any elements, any rows, and any columns may also be implemented as an independent embodiment.

FIG1 is a schematic diagram of the architecture of a communication system according to an embodiment of the present disclosure.

As shown in Figure 1, the communication system 100 includes a first API caller 101 and a first network function 102. The network function may be a network element. Of course, the communication system 100 of the present disclosure may also include a terminal and an access network device, etc., which are not limited here.

In some embodiments, the first network function 102 may be a CAPIF core function (CCF).

Of course, the communication system may also include a second network function, a third network function, a fourth network function, and the like.

In some embodiments, the second network function may be a network exposure function (NEF) or an application programming interface (API) exposure function (AEF).

In some embodiments, the third network function may be Unified Data Management (UDM).

In some embodiments, the fourth network function may be a Gateway Mobile Location Center (GMLC) or a sensing function.

In some embodiments, the terminal includes, for example, a mobile phone, a wearable device, an Internet of Things device, a car with communication function, a smart car, a tablet computer (Pad), a computer with wireless transceiver function, a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a wireless terminal device in industrial control (industrial control), a wireless terminal device in self-driving, a wireless terminal device in remote medical surgery, a wireless terminal device in a smart grid (smart grid), a wireless terminal device in transportation safety (transportation safety), a wireless terminal device in a smart city (smart city), and at least one of a wireless terminal device in a smart home (smart home), but is not limited to these.

In some embodiments, the access network device may be, for example, a node or device that accesses a terminal to a wireless network. The access network device may include an evolved Node B (eNB), a next generation evolved Node B (ng-eNB), a next generation Node B (gNB), a node B (NB), a home node B (HNB), a home evolved node B (HeNB), a wireless backhaul device, a radio network controller (RNC), a base station controller (BSC), a base transceiver station (BTS), a base band unit (BBU), a mobile switching center, a base station in a 6G communication system, an open base station (Open RAN), a cloud base station (Cloud RAN), a base station in other communication systems, and at least one of an access node in a Wi-Fi system, but is not limited thereto.

In some embodiments, the technical solution of the present disclosure may be applicable to the Open RAN architecture. In this case, the interfaces between access network devices or within access network devices involved in the embodiments of the present disclosure may become internal interfaces of Open RAN, and the processes and information interactions between these internal interfaces may be implemented through software or programs.

In some embodiments, the access network device may be composed of a centralized unit (central unit, CU) and a distributed unit (distributed unit, DU), wherein the CU may also be called a control unit (control unit). The CU-DU structure may be used to split the protocol layer of the access network device, with some functions of the protocol layer being centrally controlled by the CU, and the remaining part or all of the functions of the protocol layer being distributed in the DU, and the DU being centrally controlled by the CU, but not limited to this.

In some embodiments, the core network device may be a device including a first network element, etc., or may be a plurality of devices or a group of devices, each including a first network element. The network element may be virtual or physical. The core network may include, for example, at least one of an Evolved Packet Core (EPC), a 5G Core Network (5GCN), and a Next Generation Core (NGC).

It can be understood that the communication system described in the embodiment of the present disclosure is for the purpose of more clearly illustrating the technical solution of the embodiment of the present disclosure, and does not constitute a limitation on the technical solution provided by the embodiment of the present disclosure. A person skilled in the art can know that with the evolution of the system architecture and the emergence of new business scenarios, the technical solution provided by the embodiment of the present disclosure is also applicable to similar technical problems.

The following embodiments of the present disclosure may be applied to the communication system 100 shown in FIG1 , or a part of the main body thereof, but are not limited thereto. The subjects are examples. The communication system may include all or part of the subjects in Figure 1, and may also include other subjects outside Figure 1. The number and form of the subjects are arbitrary. The connection relationship between the subjects is an example. The subjects may be connected or disconnected, and the connection may be in any way, which may be direct or indirect, and may be wired or wireless.

The embodiments of the present disclosure may be applied to Long Term Evolution (LTE), LTE-Advanced (LTE-A), LTE-Beyond (LTE-B), SUPER 3G, IMT-Advanced, the fourth generation mobile communication system (4G), the fifth generation mobile communication system (5G), 5G new radio (NR), Future Radio Access (FRA), New-Radio Access Technology (RAT), New Radio (NR), New radio access (NX), Future generation radio access ... The present invention relates to wireless communication systems such as LTE, Wi-Fi (X), Global System for Mobile communications (GSM (registered trademark)), CDMA2000, Ultra Mobile Broadband (UMB), IEEE 802.11 (Wi-Fi (registered trademark)), IEEE 802.16 (WiMAX (registered trademark)), IEEE 802.20, Ultra-WideBand (UWB), Bluetooth (registered trademark), Public Land Mobile Network (PLMN) network, Device to Device (D2D) system, Machine to Machine (M2M) system, Internet of Things (IoT) system, Vehicle to Everything (V2X), systems using other communication methods, and next-generation systems expanded based on them. In addition, a combination of multiple systems (for example, a combination of LTE or LTE-A with 5G, etc.) may also be applied.

In some embodiments, API callers can be authorized to request services, and CAPIF supports security methods such as Transport Layer Security Pre-Shared Key Cipher Suite (TLS-PSK), Public Key Infrastructure (PKI), and Transport Layer Security (TLS) with Open Authentication Application Programming Interface OAuth token.

In some embodiments, in SNAAPPY or RNAA scenarios, in order to enable resource owners (e.g., end users, subscribers, etc.) to authorize API callers, CAPIF needs to support new security methods, including authorization code authorization and authorization code authorization with proof key exchange (PKCE). Both of these new security methods are implemented based on OAuth tokens.

In some embodiments, since client credentials authorization, authorization code authorization, and PKCE authorization code authorization are security methods based on OAuth tokens, CAPIF should inform the API caller of the selected security method that it should trigger before the API caller initiates the security process. However, CAPIF does not have a related mechanism to select an OAuth token-based security method for the API caller.

FIG2a is an interactive schematic diagram of an information indication method according to an embodiment of the present disclosure. As shown in FIG2a, the present disclosure embodiment relates to an information indication method, which is used in a communication system 100, and the method includes:

Step S2101: The first API caller sends second information to the first network function.

In some embodiments, the first network function receives second information sent by the first API caller.

In some embodiments, the second information indicates a client type of the first API caller.

In some embodiments, the client type includes one of the following:

public client;

Confidential client.

In some embodiments, the client type is used by the first network function to determine an authorization method used by the first API caller.

In some embodiments, the authorization method includes one of the following:

Authorization code authorization;

Support PKCE authorization code authorization (Authorization code grant with the Proof Key of Code Exchange);

PKCE-based authorization;

Client credentials authorization (client credentials).

In some embodiments, PKCE-based authorization and PKCE-enabled authorization code authorization are consistent at the PKCE level.

In some embodiments, the first API caller can be authorized to process the resources of the first resource owner (Resource owner).

In some embodiments, the first resource owner may be one of: an end user, a subscriber, or a terminal (UE).

In some embodiments, the first API caller (API invoker) can be one of the following: an application function, a terminal, an application running on the terminal (Application residing on UE), or a client running on the terminal (client in the UE).

Step S2102: The first network function sends third information to the first API caller.

In some embodiments, the first API caller receives third information sent by the first network function.

In some embodiments, the third information includes a first identifier configured by the first network function for the first API caller.

In some embodiments, the first identifier may be one of the following:

API caller identifier (API invoker identifier or API invoker ID);

The assigned API invoker ID.

In some embodiments, the first API caller can report the client type, the first network function (e.g., CCF) can assign an API invoker identifier to the first API caller, and create a mapping relationship between the two on the first network function side.

In some embodiments, the first API caller is provided with a mapping relationship between the first identifier and the client type.

In some embodiments, the first network function is provided with a mapping relationship between the first identifier and the client type.

In some embodiments, the first network function creates the mapping relationship.

Step S2103: The first API caller sends fourth information to the first network function.

In some embodiments, the first network function receives fourth information sent by the first API caller.

In some embodiments, the fourth information includes the first identification.

In some embodiments, the fourth information is used to request the first network function to determine an authorization method based on the first identifier.

Step S2104: The first network function determines the authorization method.

In some embodiments, the first network function determines an authorization method, wherein the authorization method is an authorization method used by the first API caller.

In some embodiments, the first network function determines the authorization method based on the first policy and/or the result of determining whether the first resource owner needs to participate in the authorization in real time. It should be noted that in this scenario, steps S2101, S2102 and S2103 may not be performed.

It should be noted that real-time authorization means that the resource owner needs to participate in the authorization process online in real time (for example, by clicking on a pop-up window on the terminal side to authorize), rather than performing non-real-time authorization by presetting relevant policies in the CAPIF framework (i.e., the first policy in the authority).

In some embodiments, the first policy is an authorization policy associated with the first resource owner.

In some embodiments, if the first network function locally stores the first policy and determines that the first resource owner does not need to participate in authorization in real time, the authorization method is determined to be a client credential authorization method.

In some embodiments, if the first resource owner is required to participate in the authorization in real time, the authorization method is determined to be authorization code authorization, PKCE-based authorization, or authorization code authorization supporting PKCE.

In some embodiments, the client type corresponding to the first identifier is determined.

In some embodiments, the authorization method is determined based on the client type.

In some embodiments, if the client type is a public client, the authorization method is determined to be a PKCE-based authorization or an authorization code authorization method that supports PKCE.

In some embodiments, if the client type is a public client, it is determined that the authorization method is not an authorization code authorization method.

In some embodiments, if the client type is a public client, it is determined that the authorization method is not a client single credential authorization method.

In some embodiments, if the client type is a confidential client, the authorization method is determined to be a PKCE-based authorization or an authorization code authorization method that supports PKCE.

In some embodiments, if the client type is a confidential client, the authorization method is determined to be an authorization code authorization method.

In some embodiments, if the client type is a confidential client, the authorization method is determined to be a client credential authorization method.

In some embodiments, if the client type is a confidential client and the first network function does not locally store a first policy related to the first resource owner, determining that the authorization method is a PKCE-based authorization or an authorization code authorization method that supports PKCE;

In some embodiments, if the client type is a confidential client and the first resource owner is required to participate in the authorization in real time, the authorization method is determined to be a PKCE-based authorization or an authorization code authorization method that supports PKCE.

In some embodiments, if the client type is a confidential client and the first network function does not locally store a first policy related to the first resource owner, determining that the authorization method is an authorization code authorization method;

In some embodiments, if the client type is a confidential client and the first resource owner needs to participate in the authorization in real time, the authorization method is determined to be an authorization code authorization method.

In some embodiments, if the client type is a confidential client, the first network function locally stores a first policy related to the first resource owner and the first resource owner does not need to participate in authorization in real time, the authorization method is determined to be a client credential authorization method.

Step S2105: The first network function sends the first information to the first API caller.

In some embodiments, the first API caller receives first information sent by the first network function.

In some embodiments, the first information indicates the authorization method.

In some embodiments, the authorization method includes one of the following:

Authorization code grant;

Support PKCE authorization code authorization;

PKCE-based authorization;

Client Credentials Grant.

In some embodiments, the first API caller initiates a corresponding authorization process based on the authorization method.

Step S2106: The first API caller sends fifth information to the first network function.

In some embodiments, the first network function receives fifth information sent by the first API caller.

In some embodiments, the authorization method is authorization code authorization, and the first API caller sends fifth information to the first network function.

In some embodiments, the fifth information includes information that the response type is code (response_type'code') and/or the grant type is authorization code (grant type'authorization_code'), and the fifth information is used to obtain the authorization code and/or token.

Step S2107: The first API caller sends sixth information to the first network function.

In some embodiments, the first network function receives sixth information sent by the first API caller.

In some embodiments, the authorization method is PKCE-based authorization or authorization code authorization supporting PKCE, and the first API caller sends sixth information to the first network function.

In some embodiments, the sixth information includes code challenge (code_challenge) and/or code verification (code_verifier) information, and the sixth information is used to obtain an authorization code and/or a token.

In some embodiments, the term "information" can be interchangeably with terms such as "message", "signal", "signaling", "report", "configuration", "indication", "instruction", "command", "channel", "parameter", "field", and "data".

In some embodiments, the term "send" can be interchangeable with terms such as "transmit", "report", and "transmit".

The information indication method involved in the embodiments of the present disclosure may include at least one of steps S2101 to S2107. For example, step S2101 may be implemented as an independent embodiment, step S2102 may be implemented as an independent embodiment, step S2103 may be implemented as an independent embodiment, step S2104 may be implemented as an independent embodiment, step S2105 may be implemented as an independent embodiment, step S2106 may be implemented as an independent embodiment, and step S2107 may be implemented as an independent embodiment. For example, step S2104 may be implemented as an independent embodiment in combination with step S2105, but is not limited thereto.

FIG3a is a flow chart of an information indication method according to an embodiment of the present disclosure. As shown in FIG3a, the present disclosure embodiment relates to an information indication method, which is executed by a first API caller, and the method includes:

Step S3101: Send the second information.

In some embodiments, the optional implementation of step S3101 can refer to the optional implementation of step S2101 in Figure 2a and other related parts of the embodiment involved in Figure 2a, which will not be repeated here.

Step S3102: Obtain third information.

In some embodiments, the first API caller obtains the third information sent by the first network function, but is not limited thereto, and the third information sent by other entities may also be received.

In some embodiments, the first API caller obtains third information specified by the protocol.

In some embodiments, the first API caller obtains the third information from an upper layer(s).

In some embodiments, the first API caller performs processing to obtain the third information.

In some embodiments, the optional implementation of step S3102 can refer to the optional implementation of step S2102 in Figure 2a and other related parts of the embodiment involved in Figure 2a, which will not be repeated here.

Step S3103: Send the fourth information.

In some embodiments, the optional implementation of step S3103 can refer to the optional implementation of step S2103 in Figure 2a and other related parts of the embodiment involved in Figure 2a, which will not be repeated here.

Step S3104: Obtain first information.

In some embodiments, the first API caller obtains the first information sent by the first network function, but is not limited thereto, and the first information sent by other entities may also be received.

In some embodiments, the first API caller obtains first information specified by the protocol.

In some embodiments, the first API caller obtains the first information from an upper layer(s).

In some embodiments, the first API caller performs processing to obtain the first information.

In some embodiments, the optional implementation of step S3104 can refer to the optional implementation of step S2105 in Figure 2a and other related parts of the embodiment involved in Figure 2a, which will not be repeated here.

Step S3105: Send the fifth information.

In some embodiments, the optional implementation of step S3105 can refer to the optional implementation of step S2106 in Figure 2a and other related parts of the embodiment involved in Figure 2a, which will not be repeated here.

Step S3106: Send the sixth information.

In some embodiments, the optional implementation of step S3106 can refer to the optional implementation of step S2107 in Figure 2a and other related parts of the embodiment involved in Figure 2a, which will not be repeated here.

The information indication method involved in the embodiment of the present disclosure may include at least one of steps S3101 to S3106. For example, step S3101 may be implemented as an independent embodiment, step S3102 may be implemented as an independent embodiment, step S3103 may be implemented as an independent embodiment, step S3104 may be implemented as an independent embodiment, step S3105 may be implemented as an independent embodiment, and step S3106 may be implemented as an independent embodiment, which is not limited here.

FIG3b is a flow chart of an information indication method according to an embodiment of the present disclosure. As shown in FIG3b, the present disclosure embodiment relates to an information indication method, which is executed by a first API caller, and the method includes:

Step S3201: Receive first information.

In some embodiments, the first information indicates an authorization method, and the authorization method is the authorization method used by the first API caller.

In some embodiments, the optional implementation of step S3201 can refer to the optional implementation of step S2104 in Figure 2a and other related parts of the embodiment involved in Figure 2a, which will not be repeated here.

In some embodiments, sending the second information to the first network function;

The second information indicates the client type of the first API caller, and the client type is used by the first network function to determine the authorization method.

In some embodiments, the method further comprises:

receiving third information sent by the first network function;

Among them, the third information includes the first identifier configured by the first network function for the first API caller, the first API caller is set with a mapping relationship between the first identifier and the client type and/or the first network function is set with a mapping relationship between the first identifier and the client type.

In some embodiments, the mapping relationship is created by the first network function.

In some embodiments, the method further comprises:

sending fourth information to the first network function;

The fourth information includes the first identifier.

In some embodiments,

The first information indicates the authorization method determined by the first network function based on the first identifier.

In some embodiments, the method further comprises:

The corresponding authorization process is started based on the authorization method.

In some embodiments, the authorization method is authorization code authorization, and the method further includes:

sending fifth information to the first network function;

The fifth information includes information that the response type is code and/or the authorization type is authorization code, and the fifth information is used to obtain the authorization code and/or token.

In some embodiments, the authorization method is PKCE-based authorization or authorization code authorization supporting PKCE, and the method further includes:

sending sixth information to the first network function;

The sixth information includes information of code challenge and/or code verification, and the sixth information is used to obtain an authorization code and/or a token.

In some embodiments, the client type includes one of the following:

Public Client;

Confidential Client.

In some embodiments, the authorization method includes one of the following:

Authorization code grant;

Supports authorization code authorization for code exchange proof key PKCE;

Authorization based on code exchange proof key PKCE;

Client Credentials Grant.

FIG4a is a flow chart of an information indication method according to an embodiment of the present disclosure. As shown in FIG4a, the present disclosure embodiment relates to an information indication method, which is executed by a first network function, and the method includes:

Step S4101: Obtain second information.

In some embodiments, the first network function obtains the second information sent by the first API caller, but is not limited thereto and may also receive the second information sent by other entities.

In some embodiments, the first network function obtains second information specified by the protocol.

In some embodiments, the first network function obtains the second information from an upper layer(s).

In some embodiments, the first network function performs processing to obtain the second information.

In some embodiments, the optional implementation of step S4101 can refer to the optional implementation of step S2101 in Figure 2a and other related parts of the embodiment involved in Figure 2a, which will not be repeated here.

Step S4102: Send the third information.

In some embodiments, the optional implementation of step S4102 can refer to the optional implementation of step S2102 in Figure 2a and other related parts of the embodiment involved in Figure 2a, which will not be repeated here.

Step S4103: Obtain the fourth information.

In some embodiments, the first network function obtains the fourth information sent by the first API caller, but is not limited thereto, and the fourth information sent by other entities may also be received.

In some embodiments, the first network function obtains fourth information specified by the protocol.

In some embodiments, the first network function obtains the fourth information from an upper layer(s).

In some embodiments, the first network function performs processing to obtain the fourth information. In some embodiments, the optional implementation of step S4103 can refer to the optional implementation of step S2103 in FIG2a and other related parts in the embodiment involved in FIG2a, which will not be repeated here.

Step S4104: Determine the authorization method.

In some embodiments, the optional implementation of step S4104 can refer to the optional implementation of step S2104 in Figure 2a and other related parts of the embodiment involved in Figure 2a, which will not be repeated here.

Step S4105: Send the first information.

In some embodiments, the optional implementation of step S4105 can refer to the optional implementation of step S2105 in Figure 2a and other related parts of the embodiment involved in Figure 2a, which will not be repeated here.

Step S4106: Obtain the fifth information.

In some embodiments, the first network function obtains the fifth information sent by the first API caller, but is not limited thereto, and the fifth information sent by other entities may also be received.

In some embodiments, the first network function obtains fifth information specified by the protocol.

In some embodiments, the first network function obtains the fifth information from an upper layer(s).

In some embodiments, the first network function performs processing to obtain the fifth information.

In some embodiments, the optional implementation of step S4106 can refer to the optional implementation of step S2106 in Figure 2a and other related parts of the embodiment involved in Figure 2a, which will not be repeated here.

Step S4107: Obtain sixth information.

In some embodiments, the first network function obtains the sixth information sent by the first API caller, but is not limited thereto, and the sixth information sent by other entities may also be received.

In some embodiments, the first network function obtains sixth information specified by the protocol.

In some embodiments, the first network function obtains the sixth information from an upper layer(s).

In some embodiments, the first network function performs processing to obtain the sixth information.

In some embodiments, the optional implementation of step S4107 can refer to the optional implementation of step S2107 in Figure 2a and other related parts of the embodiment involved in Figure 2a, which will not be repeated here.

The information indication method involved in the embodiment of the present disclosure may include at least one of steps S4101 to S4107. For example, step S4101 may be implemented as an independent embodiment, step S4102 may be implemented as an independent embodiment, step S4103 may be implemented as an independent embodiment, step S4104 may be implemented as an independent embodiment, and step S4105 may be implemented as an independent embodiment. Step S4106 can be implemented as an independent embodiment, and step S4107 can be implemented as an independent embodiment. For example, step S4104 combined with step S4105 can be implemented as an independent embodiment, but it is not limited thereto.

FIG4b is a flow chart of an information indication method according to an embodiment of the present disclosure. As shown in FIG4b, the present disclosure embodiment relates to an information indication method, which is executed by a first network function, and the method includes:

Step S4201: Determine the authorization method.

In some embodiments, the authorization method is the authorization method used by the first API caller.

In some embodiments, the optional implementation of step S4201 can refer to the optional implementation of step S2104 in Figure 2a and other related parts of the embodiment involved in Figure 2a, which will not be repeated here.

In some embodiments, determining the authorization method includes:

Determining the authorization method based on the first policy and/or a determination result of whether the first resource owner needs to participate in the authorization in real time;

The first policy is an authorization policy related to the first resource owner.

In some embodiments, determining the authorization method based on the first policy and/or the result of determining whether the first resource owner needs to participate in the authorization in real time includes one of the following:

If the first network function locally stores the first policy and it is determined that the first resource owner does not need to participate in authorization in real time, determining that the authorization method is a client credential authorization method;

If the first resource owner is required to participate in the authorization in real time, the authorization method is determined to be authorization code authorization, PKCE-based authorization, or authorization code authorization supporting PKCE.

In some embodiments, the method further comprises:

Receiving second information sent by the first API caller;

The second information indicates a client type of the first API caller, and the client type is used by the first network function to determine an authorization method used by the first API caller.

In some embodiments, the method further comprises:

Sending third information to the first API caller;

Among them, the third information includes the first identifier configured by the first network function for the first API caller; the first API caller is set with a mapping relationship between the first identifier and the client type and/or the first network function is set with a mapping relationship between the first identifier and the client type.

In some embodiments, the method further comprises:

The mapping relationship is created.

In some embodiments, the method further comprises:

Receiving fourth information sent by the first API;

The fourth information includes the first identifier.

In some embodiments, the method further comprises:

Determine the client type corresponding to the first identifier;

The determination of the authorization method;

The authorization method is determined based on the client type.

In some embodiments, determining the authorization method based on the client type includes at least one of the following:

If the client type is a public client, determine that the authorization method is a PKCE-based authorization or an authorization code authorization method that supports PKCE;

If the client type is a public client, determining that the authorization method is not an authorization code authorization method;

If the client type is a public client, determining that the authorization method is not a client single credential authorization method;

If the client type is a confidential client, determining that the authorization method is a PKCE-based authorization or an authorization code authorization method that supports PKCE;

If the client type is a confidential client, determining that the authorization method is an authorization code authorization method;

If the client type is a confidential client, determine that the authorization method is a client credential authorization method.

In some embodiments, if the client type is a confidential client, determining that the authorization method is a PKCE-based authorization or an authorization code authorization method that supports PKCE includes:

If the client type is a confidential client and the first network function does not locally store a first policy related to the first resource owner, determine that the authorization method is a PKCE-based authorization or an authorization code authorization method that supports PKCE;

If the client type is a confidential client and the first resource owner needs to participate in the authorization in real time, the authorization method is determined to be a PKCE authorization code authorization method.

In some embodiments, if the client type is a confidential client, determining that the authorization method is an authorization code authorization method includes:

If the client type is a confidential client and the first network function does not locally store a first policy related to the first resource owner, determining that the authorization method is an authorization code authorization method;

If the client type is a confidential client and the first resource owner needs to participate in the authorization in real time, the authorization method is determined to be an authorization code authorization method.

In some embodiments, if the client type is a confidential client, determining that the authorization method is a client credential authorization method includes:

If the client type is a confidential client, the first network function locally stores a first policy related to the first resource owner and the first resource owner does not need to participate in the authorization in real time, the authorization mode is determined to be a client credential authorization mode.

In some embodiments, the method further comprises:

Sending a first message to a first API caller;

The first information indicates the authorization method.

In some embodiments, the authorization method is authorization code authorization, and the method further includes:

receiving fifth information sent by the first API caller;

The fifth information includes information that the response type is code and/or the authorization type is authorization code, and the fifth information is used to obtain the authorization code and/or token.

In some embodiments, the authorization method is PKCE-based authorization or authorization code authorization supporting PKCE, and the method further includes:

receiving sixth information sent by the first API caller;

The sixth information includes information of code challenge and/or code verification, and the sixth information is used to obtain an authorization code and/or a token.

In some embodiments, the client type includes one of the following:

Public Client;

Confidential Client.

In some embodiments, the authorization method includes one of the following:

Authorization code grant;

Supports authorization code authorization for code exchange proof key PKCE;

Authorization based on code exchange proof key PKCE;

Client Credentials Grant.

FIG5a is an interactive schematic diagram of an information indication method according to an embodiment of the present disclosure. As shown in FIG5a, the present disclosure embodiment relates to an information indication method, which is used in a communication system 100, and the method includes one of the following steps:

Step S5101: The first network function sends first information to the first API caller.

In some embodiments, the first API caller receives the first information sent by the first network function.

In some embodiments, the first information indicates an authorization method, and the authorization method is the authorization method used by the first API caller.

The optional implementation of step S5101 can refer to the optional implementation of step S2101 in FIG. 2a and other related parts in the embodiment involved in FIG. 2a, which will not be described in detail here.

In some embodiments, the above method may include the methods of the above-mentioned communication system side, the first API caller side, the first network function side, etc., which will not be repeated here.

FIG6a is an interactive schematic diagram of an information indication method according to an embodiment of the present disclosure. As shown in FIG6a, the embodiment of the present disclosure relates to an information indication method, and the method includes:

Step S6101: The API caller (first API caller) sends the client type (e.g., public client or confidential client) to the CCF (first network function) during the login process (onboarding process). The CCF then sends the API caller's identifier (first identifier) to the caller. The CCF creates an association between each API caller's identifier and client type.

Step S6102: In order to obtain the authorization method to be used between the API caller, AEF/NEF and CCF, the API caller sends the identifier of the API caller to the CCF.

Step S6103: The CCF selects an authorization method for the API caller based on the association between the API caller's identifier and the API caller's client type.

Exemplarily, if the client type of the API caller is a public client, CCF selects PKCE-based authorization or authorization code authorization that supports PKCE.

Exemplarily, if the client type of the API caller is a confidential client, CCF selects authorization code authorization or client credentials authorization.

Step S6104: CCF notifies the API caller of information about the authorization method (eg, authorization code authorization, authorization code authorization supporting PKCE, PKCE-based authorization, or client credential authorization).

Step S6105: The API calling program triggers the security process according to the selected authorization method.

Exemplarily, if the selected authorization method is authorization code grant, the API caller should send response type 'code' (response_type'code') and grant type 'authorization_code' (grant type'authorization_code') to CCF to obtain the authorization code and token respectively.

Exemplarily, if the selected authorization method is to use PKCE-based authorization or authorization code authorization supporting PKCE, the API caller should send a code challenge code_challenge and a code verification code_verifier to CCF to obtain an authorization code and a token respectively.

The information indication method involved in the embodiment of the present disclosure may include at least one of steps S6101 to S6105. For example, step S6101 may be implemented as an independent embodiment, step S6102 may be implemented as an independent embodiment, step S6103 may be implemented as an independent embodiment, and step S6104 may be implemented as an independent embodiment, but is not limited thereto.

The embodiments of the present disclosure also provide a device for implementing any of the above methods, for example, a device is provided, the above device includes a unit or module for implementing each step performed by the terminal in any of the above methods. For another example, another device is provided, including a unit or module for implementing each step performed by a network device (for example, an access network device, or a core network device, etc.) in any of the above methods.

It should be understood that the division of the units or modules in the above device is only a division of logical functions, which can be fully or partially integrated into one physical entity or physically separated in actual implementation. In addition, the units or modules in the device can be implemented in the form of a processor calling software: for example, the device includes a processor, the processor is connected to a memory, and instructions are stored in the memory. The processor calls the instructions stored in the memory to implement any of the above methods or implement the functions of the units or modules of the above device, wherein the processor is, for example, a general-purpose processor, such as a central processing unit (CPU) or a microprocessor, and the memory is a memory inside the device or a memory outside the device. Alternatively, the units or modules in the device may be implemented in the form of hardware circuits, and the functions of some or all of the units or modules may be implemented by designing the hardware circuits. The hardware circuits may be understood as one or more processors; for example, in one implementation, the hardware circuits are application-specific integrated circuits (ASICs), and the functions of some or all of the above units or modules may be implemented by designing the logical relationship of the components in the circuits; for another example, in another implementation, the hardware circuits may be implemented by programmable logic devices (PLDs), and Field Programmable Gate Arrays (FPGAs) may be used as an example, which may include a large number of logic gate circuits, and the connection relationship between the logic gate circuits may be configured by configuring the configuration files, thereby implementing the functions of some or all of the above units or modules. All units or modules of the above devices may be implemented in the form of software called by the processor, or in the form of hardware circuits, or in the form of software called by the processor, and the remaining part may be implemented in the form of hardware circuits.

In the disclosed embodiments, the processor is a circuit with signal processing capability. In one implementation, the processor may be a circuit with instruction reading and running capability, such as a central processing unit (CPU), a microprocessor, a graphics processing unit (GPU) (which may be understood as a microprocessor), or a digital signal processor (DSP); in another implementation, the processor may implement certain functions through the logical relationship of a hardware circuit, and the logical relationship of the above hardware circuit may be fixed or reconfigurable, such as a hardware circuit implemented by an application-specific integrated circuit (ASIC) or a programmable logic device (PLD), such as an FPGA. In a reconfigurable hardware circuit, the process of the processor loading a configuration document to implement the hardware circuit configuration may be understood as the process of the processor loading instructions to implement the functions of some or all of the above units or modules. In addition, it can also be a hardware circuit designed for artificial intelligence, which can be understood as an ASIC, such as a neural network processing unit (NPU), a tensor processing unit (TPU), a deep learning processing unit (DPU), etc.

FIG7a is a schematic diagram of the structure of the first API caller provided in an embodiment of the present disclosure. As shown in FIG7a, the first API caller 7100 includes: a transceiver module 7101 and a processing module 7102; the transceiver module 7101 is configured to send the first information; the processing module 7102 is configured to perform processing operations. Optionally, the transceiver module 7101 is used to execute the steps related to information reception and transmission performed by the first API caller 7100 in any of the above information indication methods, which are not repeated here. Optionally, the processing module 7102 is used to execute the steps related to information processing performed by the first API caller in any of the above information indication methods, which are not repeated here.

FIG7b is a schematic diagram of the structure of the first network function provided by an embodiment of the present disclosure. As shown in FIG7b, the first network function 7200 includes: a transceiver module 7201 and a processing module 7202; the transceiver module 7201 is configured to receive the first information; the processing module 7202 is configured to perform processing operations. Optionally, the transceiver module 7201 is used to execute the steps related to information transceiving performed by the first network function 7100 in any of the above information indication methods, which are not repeated here. Optionally, the processing module 7202 is used to execute the steps related to information processing performed by the first network function in any of the above information indication methods, which are not repeated here.

FIG8a is a schematic diagram of the structure of a communication device 8100 provided in an embodiment of the present disclosure. The communication device 8100 may be a network device (e.g., an access network device or a core network device, etc.), or a terminal (e.g., a user device, etc.), or a chip, a chip system, or a processor, etc. that supports a network device to implement any of the above methods, or a chip, a chip system, or a processor, etc. that supports a terminal to implement any of the above information indication methods. The communication device 8100 may be used to implement the information indication method described in the above method embodiment, and the details may refer to the description in the above method embodiment.

As shown in FIG8a, the communication device 8100 includes one or more processors 8101. The processor 8101 may be a general-purpose processor or a dedicated processor, for example, a baseband processor or a central processing unit. The baseband processor may be used to process the communication protocol and the communication data, and the central processing unit may be used to control the communication device (such as a base station, a baseband chip, a terminal device, a terminal device chip, a DU or a CU, etc.), execute a program, and process the data of the program. The processor 8101 is used to call instructions so that the communication device 8100 executes any of the above communication methods.

In some embodiments, the communication device 8100 further includes one or more memories 8102 for storing instructions. Optionally, all or part of the memory 8102 may also be outside the communication device 8100.

In some embodiments, the communication device 8100 further includes one or more transceivers 8103. When the communication device 8100 includes one or more transceivers 8103, the communication steps such as sending and receiving in the above method are executed by the transceiver 8103, and the other steps are executed by the processor 8101.

In some embodiments, the transceiver may include a receiver and a transmitter, and the receiver and the transmitter may be separate or integrated. Optionally, the terms such as transceiver, transceiver unit, transceiver, transceiver circuit, etc. may be replaced with each other, the terms such as transmitter, transmission unit, transmitter, transmission circuit, etc. may be replaced with each other, and the terms such as receiver, receiving unit, receiver, receiving circuit, etc. may be replaced with each other.

Optionally, the communication device 8100 further includes one or more interface circuits 8104, which are connected to the memory 8102. The interface circuit 8104 can be used to receive signals from the memory 8102 or other devices, and can be used to send signals to the memory 8102 or other devices. For example, the interface circuit 8104 can read instructions stored in the memory 8102 and send the instructions to the processor 8101.

The communication device 8100 described in the above embodiments may be a network device or a terminal, but the scope of the communication device 8100 described in the present disclosure is not limited thereto, and the structure of the communication device 8100 may not be limited by FIG. 8a. The communication device may be an independent device or may be part of a larger device. For example, the communication device may be: (1) an independent integrated circuit IC, or a chip, or a chip system or subsystem; (2) a collection of one or more ICs, optionally, the above IC collection may also include a storage component for storing data and programs; (3) an ASIC, such as a modem; (4) a module that can be embedded in other devices; (5) a receiver, a terminal device, an intelligent terminal device, a cellular phone, a wireless device, a handheld device, a mobile unit, a vehicle-mounted device, a network device, a cloud device, an artificial intelligence device, etc.; (6) others, etc.

Fig. 8b is a schematic diagram of the structure of a chip 8200 provided in an embodiment of the present disclosure. In the case where the communication device 8100 may be a chip or a chip system, reference may be made to the schematic diagram of the structure of the chip 8200 shown in Fig. 8b, but the present invention is not limited thereto.

The chip 8200 includes one or more processors 8201, and the processor 8201 is used to call instructions so that the chip 8200 executes any of the above communication methods.

In some embodiments, the chip 8200 further includes one or more interface circuits 8202, which are connected to the memory 8203. The interface circuit 8202 can be used to receive signals from the memory 8203 or other devices, and the interface circuit 8202 can be used to send signals to the memory 8203 or other devices. For example, the interface circuit 8202 can read the instructions stored in the memory 8203 and send the instructions to the processor 8201. Optionally, the terms such as interface circuit, interface, transceiver pin, and transceiver can be replaced with each other.

In some embodiments, the chip 8200 further includes one or more memories 8203 for storing instructions. Optionally, all or part of the memory 8203 may be outside the chip 8200.

The present disclosure also provides a storage medium, on which instructions are stored, and when the instructions are executed on the communication device 8100, the communication device 8100 executes any of the above methods. Optionally, the storage medium is an electronic storage medium. Optionally, the storage medium is a computer-readable storage medium, but it can also be a storage medium readable by other devices. Optionally, the storage medium can be a non-transitory storage medium, but it can also be a temporary storage medium.

The present disclosure also provides a program product, and when the program product is executed by the communication device 8100, the communication device 8100 executes any one of the above communication methods. Optionally, the program product is a computer program product.

The present disclosure also provides a computer program, which, when executed on a computer, enables the computer to execute any one of the above communication methods.

Those skilled in the art will readily appreciate other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses or adaptations of the present invention that follow the general principles of the present invention and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The description and examples are to be considered exemplary only, and the true scope and spirit of the present invention are indicated by the following claims.

It should be understood that the present invention is not limited to the exact construction that has been described above and shown in the drawings and that various modifications and changes may be made without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims (35)

An information indication method, characterized in that the method is executed by a first application programming interface API caller, and the method comprises: receiving first information sent by a first network function; Among them, the first information indicates an authorization method, and the authorization method is the authorization method used by the first API caller. The method according to claim 1, characterized in that the method further comprises: sending second information to the first network function; The second information indicates the client type of the first API caller, and the client type is used by the first network function to determine the authorization method. The method according to claim 1 or 2, characterized in that the method further comprises: receiving third information sent by the first network function; Among them, the third information includes the first identifier configured by the first network function for the first API caller, the first API caller is set with a mapping relationship between the first identifier and the client type and/or the first network function is set with a mapping relationship between the first identifier and the client type. The method according to claim 3 is characterized in that the mapping relationship is created by the first network function. The method according to claim 3, characterized in that the method further comprises: sending fourth information to the first network function; The fourth information includes the first identification fourth information. The method according to claim 1 or 5 is characterized in that the first information indicates the authorization method determined by the first network function based on the first identifier. The method according to claim 1, characterized in that the method further comprises: The corresponding authorization process is started based on the authorization method. The method according to claim 1, characterized in that the authorization method is authorization code authorization, and the method further comprises: sending fifth information to the first network function; The fifth information includes information that the response type is code and/or the authorization type is authorization code, and the fifth information is used to obtain the authorization code and/or token. The method according to claim 1, characterized in that the authorization method is PKCE-based authorization or authorization code authorization supporting PKCE, and the method further comprises: sending sixth information to the first network function; The sixth information includes information of code challenge and/or code verification, and the sixth information is used to obtain an authorization code and/or a token. The method according to any one of claims 1 to 9, wherein the client type includes one of the following: Public Client; Confidential Client. The method according to any one of claims 1 to 10, characterized in that the authorization method includes one of the following: Authorization code grant; Supports authorization code authorization for code exchange proof key PKCE; Authorization based on code exchange proof key PKCE; Client Credentials Grant. An information indication method, characterized in that the method is performed by a first network function, and the method comprises: Determine the authorization method; The authorization method is the authorization method used by the first API caller. The indication method according to claim 12, characterized in that the determining of the authorization mode comprises: Determining the authorization method based on the first policy and/or a determination result of whether the first resource owner needs to participate in the authorization in real time; The first policy is an authorization policy related to the first resource owner. The indication method according to claim 13, characterized in that the determining of the authorization mode based on the first policy and/or the determination result of whether the first resource owner needs to participate in the authorization in real time comprises one of the following: If the first network function locally stores the first policy and it is determined that the first resource owner does not need to participate in authorization in real time, determining that the authorization method is a client credential authorization method; If the first resource owner is required to participate in the authorization in real time, the authorization method is determined to be authorization code authorization, PKCE-based authorization, or authorization code authorization supporting PKCE. The method according to claim 12, characterized in that the method further comprises: Receiving a first message sent by a first API caller; The first information indicates a client type of the first API caller, and the client type is used by the first network function to determine an authorization method used by the first API caller. The method according to claim 15, characterized in that the method further comprises: Sending second information to the first API caller; Among them, the second information includes the first identifier configured by the first network function for the first API caller; the first API caller is set with a mapping relationship between the first identifier and the client type and/or the first network function is set with a mapping relationship between the first identifier and the client type. The method according to claim 16, characterized in that the method further comprises: The mapping relationship is created. The method according to claim 12, characterized in that the method further comprises: Receiving fourth information sent by the first API; Wherein, the fourth information includes the first identifier. The method according to claim 18, characterized in that the method further comprises: Determine the client type corresponding to the first identifier; The determination of the authorization method; The authorization method is determined based on the client type. The method according to claim 19, wherein determining the authorization method based on the client type comprises at least one of the following: If the client type is a public client, determine that the authorization method is a PKCE-based authorization or an authorization code authorization method that supports PKCE; If the client type is a public client, determining that the authorization method is not an authorization code authorization method; If the client type is a public client, determining that the authorization method is not a client single credential authorization method; If the client type is a confidential client, determining that the authorization method is a PKCE-based authorization or an authorization code authorization method that supports PKCE; If the client type is a confidential client, determining that the authorization method is an authorization code authorization method; If the client type is a confidential client, determine that the authorization method is a client credential authorization method. The method according to claim 20, characterized in that if the client type is a confidential client, determining that the authorization method is a PKCE-based authorization or an authorization code authorization method that supports PKCE includes: If the client type is a confidential client and the first network function does not locally store a first policy related to the first resource owner, determine that the authorization method is a PKCE-based authorization or an authorization code authorization method that supports PKCE; If the client type is a confidential client and the first resource owner needs to participate in the authorization in real time, the authorization method is determined to be a PKCE-based authorization or an authorization code authorization method that supports PKCE. The method according to claim 20, characterized in that if the client type is a confidential client, determining that the authorization method is an authorization code authorization method comprises: If the client type is a confidential client and the first network function does not locally store a first policy related to the first resource owner, determining that the authorization method is an authorization code authorization method; If the client type is a confidential client and the first resource owner needs to participate in the authorization in real time, the authorization method is determined to be an authorization code authorization method. The method according to claim 20, characterized in that if the client type is a confidential client, determining that the authorization method is a client credential authorization method comprises: If the client type is a confidential client, the first network function locally stores a first policy related to the first resource owner and the first resource owner does not need to participate in authorization in real time, the authorization mode is determined to be a client credential authorization mode. The method according to claim 12, characterized in that the method further comprises: Sending a first message to a first API caller; The first information indicates the authorization method. The method according to claim 12, characterized in that the authorization method is authorization code authorization, and the method further comprises: receiving fifth information sent by the first API caller; The fifth information includes information that the response type is code and/or the authorization type is authorization code, and the fifth information is used to Get an authorization code and/or token. The method according to claim 12, characterized in that the authorization method is PKCE-based authorization or authorization code authorization supporting PKCE, and the method further comprises: receiving sixth information sent by the first API caller; The sixth information includes information of code challenge and/or code verification, and the sixth information is used to obtain an authorization code and/or a token. The method according to any one of claims 12 to 26, wherein the client type comprises one of the following: Public Client; Confidential Client. The method according to any one of claims 12 to 27, wherein the authorization method comprises one of the following: Authorization code grant; Supports authorization code authorization for code exchange proof key PKCE; Authorization based on code exchange proof key PKCE; Client Credentials Grant. An information indication method, characterized in that it is applied to a communication system, the method comprising: The first network function sends a first message to the first API caller; The first API caller receives the first information sent by the first network function; Among them, the first information indicates an authorization method, and the authorization method is the authorization method used by the first API caller. A first API caller, characterized in that the first API caller includes: The transceiver module is configured as follows: receiving first information sent by a first network function; Among them, the first information indicates an authorization method, and the authorization method is the authorization method used by the first API caller. A first network function, characterized in that the first network function includes: The processing module is configured as follows: Determine the authorization method; The authorization method is the authorization method used by the first API caller. A communication system, characterized in that the communication system includes a first API caller and a first network function; the first API caller is configured to implement the information indication method described in any one of claims 1 to 11, and the first network function is configured to implement the information indication method described in any one of claims 12 to 28. A first API caller, characterized in that the first API caller includes: memory, including executable instructions; one or more processors; When the executable instruction is executed by the processor, the first API caller executes the information indication method according to any one of claims 1 to 11. A first network device, characterized in that the first network device comprises: memory, including executable instructions; one or more processors; When the executable instruction is executed by the processor, the first network device executes the information indication method according to any one of claims 12 to 28. A storage medium, wherein the storage medium stores instructions, and when the instructions are executed on a communication device, the communication device executes the information indication method according to any one of claims 1 to 11 or claims 12 to 28.