Network slice authentication method and communications apparatus
A service authorization method includes receiving, by a server from a client, a request requesting an access token, where the request includes slice information, performing, by the server, authentication on the client, adding, by the server, the slice information to the access token, and sending, by the server, a response message to the client when the client is authenticated, where the response message comprises the access token.
1. A service authorization method comprising:
receiving, by a first server, a first request from a client that is a network element for performing a network function in a core network deployed using a service-based architecture, wherein the first request requests an access token, and wherein the first request comprises first slice information, and wherein the first slice information comprises a network slice instance (NSI) identifier (ID) list or a single network slice selection assistance information (S-NSSAI) list;
performing, by the first server, authentication on the client;
sending, by the first server, a first response message to the client when the client is authenticated, wherein the first response message comprises the access token, and wherein the access token comprises the first slice information;
receiving, by a second server, a second request from the client, wherein the second request requests a function service, and wherein the second request comprises the access token;
verifying, by the second server, the first slice information to obtain a verification result; and
replying, by the second server, to the client based on the verification result.
2. The service authorization method of claim 1 , wherein the access token further comprises an expected service name and type, a client identifier, and a client type.
3. The service authorization method of claim 1 , wherein verifying the first slice information comprises determining, by the second server, whether the first slice information matches second slice information stored in the second server.
4. A service authorization system comprising:
a first server configured to:
receive, from a client that is a network element for performing a network function in a core network deployed using a service-based architecture, a first request requesting an access token, wherein the first request comprises first slice information, and wherein the first slice information comprises a network slice instance (NSI) identifier (ID) list or a single network slice selection assistance information (S-NSSAI) list;
perform authentication on the client; and
send a first response message to the client when the client is authenticated, wherein the first response message comprises the access token, and wherein the access token comprises the first slice information;
a second server in communication with the first server and configured to:
receive, from the client, a second request requesting a function service, wherein the second request comprises the access token;
verify the first slice information to obtain a verification result; and
reply to the client based on the verification result; and
a hardware processor configured to implement the first server or the second server.
5. The service authorization system of claim 4 , wherein the access token further comprises an expected service name and type, a client identifier, and a client type.
6. The service authorization system of claim 4 , wherein the second server is further configured to verify the first slice information by determining whether the first slice information matches second slice information stored in the second server.
7. A service authorization method implemented by a server and comprising:
receiving, from a client that is a network element for performing a network function in a core network deployed using a service-based architecture, a request requesting an access token, wherein the request comprises slice information, and wherein the slice information comprises a network slice instance (NSI) identifier (ID) list or a single network slice selection assistance information (S-NSSAI) list;
performing authentication on the client; and
sending a response message to the client when the client is authenticated,
wherein the response message comprises the access token, and
wherein the access token comprises the slice information.
8. The service authorization method of claim 7 , wherein the access token further comprises an expected service name and type, a client identifier, and a client type.
9. A service request method implemented by a server and comprising:
receiving, from a client that is a network element for performing a network function in a core network deployed using a service-based architecture, a request requesting a function service, wherein the request comprises an access token, wherein the access token comprises first slice information, and wherein the first slice information comprises a network slice instance (NSI) identifier (ID) list or a single network slice selection assistance information (S-NSSAI) list;
verifying the first slice information to obtain a verification result; and
replying to the client based on the verification result.
10. The service request method of claim 9 , wherein verifying the first slice information comprises determining whether the first slice information matches second slice information stored in the server.
11. A server comprising:
a receiver configured to receive a request from a client that is a network element for performing a network function in a core network deployed using a service-based architecture, wherein the request requests an access token, wherein the request comprises slice information, and wherein the slice information comprises a network slice instance (NSI) identifier (ID) list or a single network slice selection assistance information (S-NSSAI) list;
a processor coupled to the receiver and configured to authenticate the client; and
a transmitter coupled to the processor and configured to send a response message to the client when the client is authenticated,
wherein the response message comprises the access token, and
wherein the access token comprises the slice information.
12. The server of claim 11 , wherein the access token further comprises an expected service name and type, a client identifier, and a client type.
13. A server comprising:
a receiver configured to receive a request from a client that is a network element for performing a network function in a core network deployed using a service-based architecture, wherein the request requests a function service, wherein the request comprises an access token, wherein the access token comprises first slice information, and wherein the first slice information comprises a network slice instance (NSI) identifier (ID) list or a single network slice selection assistance information (S-NSSAI) list;
a processor coupled to the receiver and configured to verify the first slice information to obtain a verification result; and
a transmitter coupled to the processor and configured to reply to the client based on the verification result.
14. The server of claim 13 , wherein the processor is further configured to verify the first slice information by determining whether the first slice information matches second slice information stored in the server.
15. The service authorization method of claim 1 , wherein the NSI ID list comprises at least one slice.
16. The service authorization method of claim 1 , wherein the S-NSSAI list comprises at least one slice type granularity.
17. The service authorization system of claim 4 , wherein the NSI ID list comprises at least one slice.
18. The service authorization system of claim 4 , wherein the S-NSSAI list comprises at least one slice type granularity.
19. The service authorization method of claim 7 , wherein the NSI ID list comprises at least one slice.
20. The service authorization method of claim 7 , wherein the S-NSSAI list comprises at least one slice type granularity.