RU2849843C2 - Method/apparatus/device for authorising role of subscriber device (au) and data carrier - Google Patents

Abstract

FIELD: data carriers.

SUBSTANCE: invention proposes a method/device/apparatus for role authorisation for a subscriber device (AU) and a data carrier. The method includes the steps of: receiving a discovery request message sent by the first SU and/or the second SU, wherein the discovery request message serves to request role authorisation for the first SU and/or the second SU; and sending a detection response message to the first AU and/or the second AU, wherein the detection response message contains a role defined for the first AU and/or the second AU by a network device. The invention proposes a method for authorising an AU for a role in a service whose detection is requested by the AU.

EFFECT: method allows the role for the AU to be correctly authorised, thereby improving the accuracy of service provision and information security.

1 cl

Description

AREA OF TECHNOLOGY

[01] The proposed invention relates in general to the field of communications technology, in particular to a method/device/device for authorizing a role for an automated control system and to a data carrier.

PREREQUISITES FOR THE CREATION OF THE INVENTION

[02] When providing a range determination service and/or a sidelink (SL) positioning service in a communication system, the participation of several subscriber units (SU) is usually required to perform different roles in the service, and the SU roles may include the roles of a reference SU in the SL, a target SU, an auxiliary SU, a detected SU, a SU positioning server for the sidelink, and a SU positioning client for the SL.

[03] A single UE may simultaneously support multiple roles for the ranging service and/or the sidelink positioning service. For example, if a UE is capable of sending a position signal, it may serve as a reference UE. If this UE is also capable of calculating position, it may serve as a UE server. In practice, a situation may arise in which a UE performs an inappropriate role in the service, i.e., the UE cannot perform or does not have the capability to perform this role in the service. For example, a UE has the capability of ranging, but it cannot perform the role of a reference UE in the ranging service 1. When it performs the role of a reference UE in the ranging service 1, the accuracy of the ranging service may be affected and a security issue, in particular, information leakage, may arise.

ESSENCE OF THE INVENTION

[04] The invention proposes a method/device/device for authorizing a role for an automated control system and a data carrier for correctly authorizing a role for an automated control system in various services in order to ensure the accuracy of service execution and information protection.

[05] According to a first aspect, in one embodiment of the proposed invention, a method is proposed for authorizing a role for an AU, performed by a network device and including the steps of: receiving a discovery request message sent by a first AU and/or a second AU, wherein the discovery request message serves to request an authorized role for the first AU and/or the second AU; and sending a discovery response message to the first AU and/or the second AU, wherein the discovery response message contains a role determined by the network device for the first AU and/or the second AU.

[06] According to the proposed invention, a network device receives a discovery request message sent by a first AU and/or a second AU, wherein the discovery request message is used to request an authorized role for the first AU and/or the second AU. The network device sends a discovery response message to the first AU and/or the second AU, wherein the discovery response message contains a role determined by the network device for the first AU and/or the second AU. From the above it follows that the invention proposes a method for authorizing a role for an AU in a service requested by the AU to be discovered, wherein the AU role can be determined by the network device based on the AU capability and the AU contract information in order to ensure correct authorization of the role for the AU, as well as to ensure the accuracy of service execution. In addition, the subscriber device is sent a security tool corresponding to the service requested by the AU for detection, wherein the security tool can serve to ensure protection during the subsequent process of detection by the subscriber device of another AU, to prevent the possibility of tracking by an outside AU the role of this AU or an unauthorized change by it of the role of this AU when this AU transmits its role to it in the subsequent detection process and, thereby, to prevent an outside AU from performing the role of this AU, impersonating it, to prevent interference by an outside AU during the subsequent process of service execution, to increase the accuracy of service execution and to strengthen the protection of information.

[07] According to a second aspect, in one embodiment of the proposed invention, a method is proposed for authorizing a role for a AU, performed by a first AU and comprising the steps of: sending a discovery request message to a network device, wherein the discovery request message serves to request an authorized role for the first AU; and receiving a discovery response message sent by the network device, wherein the discovery response message contains a role determined by the network device for the first AU.

[08] According to a third aspect, in one embodiment of the proposed invention, a method is proposed for authorizing a role for a AU, performed by a second AU and including the steps of: sending a discovery request message to a network device, wherein the discovery request message serves to request an authorized role for the second AU; and receiving a discovery response message sent by the network device, wherein the discovery response message contains a role determined by the network device for the second AU.

[09] According to a fourth aspect, in one embodiment of the proposed invention, a method is proposed for authorizing a role for an AU, performed by a direct discovery name management function (DDNMF) network element or a proximity service key management function (PKMF) network element of a first AU, and comprising the steps of: receiving a discovery request message sent by the first AU, wherein the discovery request message is used to request an authorized role in a service requested to be discovered by the first AU; sending a first authorization request message to a unified data management (UDM) server or network element according to the discovery request message; receiving a first authorization response message sent by the UDM server or network element, wherein the first authorization response message contains a role of the first AU determined by the UDM server or network element; and sending a discovery response message to the first AU, wherein the discovery response message contains the role of the first AU.

[010] According to a fifth aspect, in one embodiment of the proposed invention, a method for authorizing a role for an AU is proposed, performed by a DDNMF network element or a PKMF network element of a second AU and comprising the steps of: receiving a discovery request message sent by the second AU, wherein the discovery request message is used to request an authorized role in a service requested to be discovered by the second AU; sending a first authorization request message to the UDM server or network element according to the discovery request message; receiving a first authorization response message sent by the UDM server or network element, wherein the first authorization response message contains the role of the second AU determined by the UDM server or network element; determining a security means corresponding to the service requested to be discovered by the second AU; and sending a discovery response message to the second AU, wherein the discovery response message contains the role of the second AU.

[011] According to a sixth aspect, in one embodiment of the proposed invention, a method for authorizing a role for an AU is proposed, performed by a server or a UDM and comprising the steps of: receiving a first authorization request message sent by a network element of the DDNMF function or a network element of the PKMF function of a first AU and/or a second AU, wherein the first authorization request message serves to request an authorized role in a service requested to be discovered by the first AU and/or the second AU; determining the role of the first AU and/or the second AU according to the first authorization request message; and sending a first authorization response message to the network element of the DDNMF function or the network element of the PKMF function of the first AU and/or the second AU, wherein the first authorization response message contains the role of the first AU and/or the second AU.

[012] According to a seventh aspect, in one embodiment of the proposed invention, a communication device is proposed, comprising: a transmitting and receiving module configured to: receive a discovery request message sent by a first AU and/or a second AU, wherein the discovery request message serves to request an authorized role for the first AU and/or the second AU; and send a discovery response message to the first AU and/or the second AU, wherein the discovery response message contains a role determined by the network device for the first AU and/or the second AU.

[013] According to an eighth aspect, in one embodiment of the proposed invention, a communication device is proposed, comprising: a transmitting and receiving module configured to: send a discovery request message to a network device, wherein the discovery request message serves to request an authorized role for a first AU; and receive a discovery response message sent by the network device, wherein the discovery response message contains a role determined by the network device for the first AU.

[014] According to a ninth aspect, in one embodiment of the proposed invention, a communication device is proposed, comprising: a transmitting and receiving module configured to: send a discovery request message to a network device, wherein the discovery request message serves to request an authorized role for a second AU; and receive a discovery response message sent by the network device, wherein the discovery response message contains a role determined by the network device for the second AU.

[015] According to a tenth aspect, in one embodiment of the proposed invention, a communication device is proposed, comprising: a transmitting and receiving module configured to: receive a discovery request message sent by a first AU, wherein the discovery request message serves to request an authorized role in a service requested to be discovered by the first AU; send a first authorization request message to a unified data management (UDM) server or network element according to the discovery request message; receive a first authorization response message sent by the UDM server or network element, wherein the first authorization response message contains a role of the first AU determined by the UDM server or network element; and send a discovery response message to the first AU, wherein the discovery response message contains the role of the first AU.

[016] According to an eleventh aspect, in one embodiment of the proposed invention, a communication device is proposed, comprising: a transmitting and receiving module configured to: receive a discovery request message sent by a second AU, wherein the discovery request message serves to request an authorized role in a service requested to be discovered by the second AU, send a first authorization request message to a unified data management (UDM) server or network element according to the discovery request message, receive a first authorization response message sent by the UDM server or network element, wherein the first authorization response message contains a role of the second AU determined by the UDM server or network element; and a processing module configured to determine a security means corresponding to the service requested to be discovered by the second AU. The transmitting and receiving module is further configured to send a discovery response message to the second AU, wherein the discovery response message contains the role of the second AU.

[017] According to a twelfth aspect, in one embodiment of the proposed invention, a communication device is proposed, comprising: a transmitting and receiving module configured to receive a first authorization request message sent by a DDNMF function network element or a PKMF function network element of a first AU and/or a second AU, wherein the first authorization request message serves to request an authorized role in a service requested to be discovered by the first AU and/or the second AU; and a processing module configured to determine the role of the first AU and/or the second AU according to the first authorization request message. The transmitting and receiving module is further configured to send a first authorization response message to the DDNMF function network element or the PKMF function network element of the first AU and/or the second AU, wherein the first authorization response message contains the role of the first AU and/or the second AU.

[018] According to a thirteenth aspect, in one embodiment of the present invention, a communication device is provided comprising a processor. When the processor calls up a computer program from a memory device, the method according to any one of the first to sixth aspects is implemented.

[019] According to a fourteenth aspect, in one embodiment of the proposed invention, a communication device is proposed, comprising a processor and a memory device with a computer program stored therein. The processor is configured to execute the computer program stored in the memory device and, thereby, to activate the communication device to implement the method according to any of the first to sixth aspects disclosed above.

[020] According to a fifteenth aspect, in one embodiment of the proposed invention, a communication device is proposed, comprising a processor and an interface circuit. The interface circuit is configured to receive a code instruction and transmit this code instruction to the processor, wherein the processor is configured to execute the code instruction and, thereby, activate the device to implement the method according to any of the first to sixth aspects disclosed above.

[021] According to a sixteenth aspect, in one embodiment of the present invention, a communication system is provided, including a communication device according to the seventh to twelfth aspects disclosed above, or a communication device according to the thirteenth, fourteenth or fifteenth aspect.

[022] According to a seventeenth aspect, in one embodiment of the proposed invention, a computer-readable data carrier is proposed for storing therein instructions used by the above-mentioned base station. The result of executing these instructions is the implementation by the terminal device of the method according to any of the first to sixth aspects disclosed above.

[023] Furthermore, according to an eighteenth aspect, the invention provides a software product for a computer, comprising a program for a computer, when executed in a computer, the computer implements the method according to any one of the first to sixth aspects disclosed above.

[024] According to a nineteenth aspect, the invention provides an integrated system comprising at least one processor and an interface for enabling a base station to implement the functions provided by the method according to any one of the first to sixth aspects, for example, determining or processing data and/or information provided by the method disclosed above. In one possible design embodiment, the integrated system further comprises a memory device configured to store therein computer programs and data of a secondary source node. The integrated system may consist of microcircuits or contain microcircuits and other discrete devices.

[025] According to a twentieth aspect, the invention provides a computer program, which, when executed in a computer, implements the method according to any one of the first to fifth aspects disclosed above.

[026] According to a twenty-first aspect, the invention provides a communication system including: a first AU configured to send a discovery request message; a second AU configured to send the discovery request message; a network device configured to send a discovery response message, wherein the discovery response message comprises a role determined by the network device for the first AU and/or the second AU. The first AU, in turn, is configured to receive the discovery response message, wherein the discovery response message comprises a role determined by the network device for the first AU. The second AU, in turn, is configured to receive the discovery response message, wherein the discovery response message comprises a role determined by the network device for the second AU.

BRIEF DESCRIPTION OF DRAWINGS

[027] A clearer understanding of the above disclosed and/or additional aspects and advantages of the present invention can be obtained from the following descriptions of embodiments with reference to the following drawings.

Fig. 1a and Fig. 1b are schematic diagrams of the architecture of communication systems according to one embodiment of the proposed invention.

Fig. 2a-2L are sequence diagrams of a method for authorizing a role for an AU according to one embodiment of the proposed invention.

Fig. 3 is a diagram of the sequence of the method for authorizing a role for an AU according to another embodiment of the proposed invention.

Fig. 4 is a diagram of the sequence of the method for authorizing a role for an AU according to another embodiment of the proposed invention.

Fig. 5 is a diagram of the sequence of the method for authorizing a role for an AU according to another embodiment of the proposed invention.

Fig. 6 is a flow chart of a method for authorizing a role for an AU according to another embodiment of the proposed invention.

Fig. 7 is a flow chart of a method for authorizing a role for an AU according to another embodiment of the proposed invention.

Fig. 8 is a flow chart of a method for authorizing a role for an AU according to another embodiment of the proposed invention.

Fig. 9 is a flow chart of a method for authorizing a role for an AU according to another embodiment of the proposed invention.

Fig. 10 is a flow chart of a method for authorizing a role for an AU according to another embodiment of the proposed invention.

Fig. 11 is a flow chart of a method for authorizing a role for an AU according to another embodiment of the proposed invention.

Fig. 12 is a flow chart of a method for authorizing a role for an AU according to another embodiment of the proposed invention.

Fig. 13 is a flow chart of a method for authorizing a role for an AU according to another embodiment of the proposed invention.

Fig. 14 is a flow chart of a method for authorizing a role for an AU according to another embodiment of the proposed invention.

Fig. 15 is a flow chart of a method for authorizing a role for an AU according to another embodiment of the proposed invention.

Fig. 16 is a diagram of the sequence of the method for authorizing a role for an AU according to another embodiment of the proposed invention.

Fig. 17 is a block diagram of a communication device according to one embodiment of the proposed invention.

Fig. 18 is a block diagram of a communication device according to one embodiment of the proposed invention.

Fig. 19 is a block diagram of a communication device according to one embodiment of the proposed invention.

Fig. 20 is a block diagram of a communication device according to one embodiment of the proposed invention.

Fig. 21a is a block diagram of a communication device according to one embodiment of the present invention.

Fig. 21b is a block diagram of a communication device according to one embodiment of the present invention.

Fig. 22 is a block diagram of a communication system according to one embodiment of the proposed invention.

Fig. 23 is a block diagram of a communication device according to one embodiment of the proposed invention.

Fig. 24 is a block diagram of a microcircuit according to one embodiment of the proposed invention.

IMPLEMENTATION OF THE INVENTION

[028] Illustrative embodiments will now be described in detail using the accompanying drawings as an example. The following description refers to the accompanying drawings, and unless otherwise indicated, identical or similar elements in different drawings are designated by the same reference numerals. The illustrative embodiments described in the following description do not represent all embodiments corresponding to embodiments of the proposed invention. On the contrary, they are no more than examples of devices and methods related to some of the aspects of the embodiments of the proposed invention listed in the appended claims.

[029] The terms used in the embodiments of the present invention serve solely to describe particular embodiments, but should not be construed as limiting the embodiments of the present invention. The singular forms of the words "a/an" and "the" in the embodiments of the present invention and the appended claims also imply plural meanings, unless the context clearly dictates otherwise. It should also be understood that the "and/or" feature in this document implies the presence of any or all possible combinations of the listed objects that it links.

[030] It should be understood that features such as "first," "second," and "third," which may be used in embodiments of the proposed invention when describing a number of parameters, do not limit these parameters. These features serve solely to distinguish parameters of the same type from each other. For example, a "first parameter" may also be referred to as a "second parameter," and a "second parameter" may also be referred to as a "first parameter" without departing from the scope of embodiments of the proposed invention. The conjunction "if" in this document may be understood to mean "when," "after," or "if it is determined that," depending on the context.

[031] Embodiments of the present invention will now be described in detail, examples of which are illustrated in the accompanying drawings, wherein identical or similar elements are designated by identical or similar reference numerals throughout the drawings. The embodiments described below are examples serving to explain the present invention, which should not be construed as limiting the present invention.

[032] To facilitate understanding, the concepts used in the description of the proposed invention will first be explained.

[033] 1. A unified data management (UDM) network element is a network element that provides management of subscriber identification data, contract data, authentication data, and service registration management network element for subscribers (in particular, an access and mobility management function (AMF) network element or a session management function (SMF) network element that is currently providing service(s) to a terminal). For example, when a subscriber switches to another AMF whose service area he or she intends to visit, the UDM issues a deregistration message to the old AMF containing a request to the old AMF to delete the subscriber-related information).

[034] In order to provide a clearer understanding of the method for authorizing a role for an AU disclosed in the embodiments of the proposed invention, a communication system in which the embodiments of the proposed invention can be used will now be described.

[035] Let us consider Fig. 1a, a schematic diagram of the architecture of a communication system according to one embodiment of the proposed invention. As can be seen in Fig. 1a, the communication system may include, among other things, one network device 13 and at least two AUs (in particular, a first AU 11 and a second AU 12).

[036] It should be noted that the technical solutions for the embodiments of the disclosed invention may find application in various communication systems, in particular in the Long Term Evolution (LTE) communication system, in the 5th generation mobile communication system (5G), in the 5G New Radio (NR) system or other new mobile communication systems in the future.

[037] The network device 13 may be, for example, an access network device (in particular, a base station) and a core network device. A core network device is a device deployed in a core network, and a core network element is a network element deployed in a core network. Their functions consist of providing subscriber connection, subscriber management, service placement, and also providing interfacing with an external network as an information delivery network.

[038] The first AU11 and the second AU12 in the embodiments of the proposed invention represent an object on the subscriber side for receiving or transmitting signals, in particular a mobile telephone. The terminal device may also be called a "terminal", "subscriber unit" (SU), "mobile station" (MS) or "mobile terminal" (MT). The terminal device may be a device with a communication function, in particular, a car, a smart car, a mobile phone, a wearable device, a tablet computer, a computer with wireless transmission/reception functions, a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a wireless terminal device in an industrial control system, a wireless terminal device in an automatic driving system, a wireless terminal device in a remote surgery system, a wireless terminal device in a smart power grid, a wireless terminal device in a transport security system, a wireless terminal device in a smart city system, a wireless terminal device in a smart home system, etc. The embodiments of the proposed invention do not limit the terminal device to any particular technologies or types.

[039] As can be seen in Fig. 1b, the core network device in the communication system may include, for example, a direct discovery name management function (DDNMF) network element/ProSe key management function (PKMF) network element of the first AU, a DDNMF network element/PKMF network element of the second AU, and a UDM server/network element.

[040] The DDNMF function network element/PKMF function network element of the first AU and the DDNMF function network element/PKMF function network element of the second AU may be the same or different.

[041] It should be understood that the communication system in the embodiments of the proposed invention is described in order to more clearly illustrate the technical solutions of the embodiments of the proposed invention, but not in order to limit these technical solutions. Those skilled in the art will understand that the technical solutions of the embodiments of the proposed invention can also find application in solving similar technical problems that will arise as the system architecture evolves and new service scenarios emerge.

[042] The method/device/device for authorizing a role for an AU and a data carrier according to embodiments of the proposed invention will now be described in detail with reference to the attached drawings.

[043] It should be noted that the names of the messages discussed below (including “request message,” “response message,” etc.) are for convenience only and do not limit the function of the message.

[044] Fig. 2a is a flow chart of a method for authorizing a role for an AU according to one embodiment of the present invention. The method is performed by a network device. As can be seen in Fig. 2a, the method for authorizing a role for an AU may include the following steps.

[045] At step 201a, a discovery request message sent by the first AU and/or the second AU is received, wherein the discovery request message serves to request an authorized role for the first AU and/or the second AU.

[046] In one embodiment of the present invention, the discovery request message sent by the first AU contains at least one of: an application user identifier (RAUID) corresponding to the first AU; an identifier of a service requested to be discovered by the first AU; or a capability of the first AU.

[047] In one embodiment of the proposed invention, a discovery request message sent by the second AU contains at least one of: a RAUID corresponding to the second AU; a service requested to be discovered by the second AU; or a capability of the second AU.

[048] RAUID is used to identify the AU so that the network device can know which AU is sending the discovery request message.

[049] The service requested by the AU to be detected may be, for example, a ranging service and/or a lateral link positioning service.

[050] The above-mentioned capability of the UE may be, for example, the capability of the UE to support a ranging service and/or the capability of the UE to support a lateral link positioning service. If the UE has various capabilities, the UE may support and perform various roles. The roles of the UE may include, for example, a reference UE (in particular, a reference UE in the SL), a target UE, an auxiliary UE, a discoverable UE acting as a UE server (in particular, an UE positioning server over the SL), a UE client (in particular, an UE positioning client over the SL), and a ranging UE. The above-mentioned target UE may be a UE that is an object of positioning or measurement. The above-mentioned discoverable UE may be a UE for which it is necessary to determine the location of the target UE. The above-mentioned ranging UE may be a UE requesting to obtain the ranging distance to the target UE. Depending on the location of the aforementioned reference AU or the distance between the aforementioned reference AU and the target AU, the location or ranging distance of the target AU is determined. The aforementioned auxiliary AU may be a AU that assists in forwarding messages in the ranging service or the lateral link positioning service. The aforementioned AU acting as a server may be a AU that has the capability of calculating for positioning or the capability of calculating for ranging. The aforementioned client AU may be a AU that can act as a client in the ranging service or the lateral link positioning service.

[051] Taking into account the above, for example, if the AU has the ability to process data (i.e., the ability to calculate data), the AU may support an executable role, in particular, the role of acting as a server of the AU. If the AU does not have the ability to process data, but has the ability to send and receive positioning information and/or ranging information, the AU may support such a role of the AU as a reference AU or a target AU.

[052] At step 202a: a discovery response message is sent to the first AU and/or the second AU, wherein the discovery response message comprises a role determined by the network device for the first AU and/or the second AU.

[053] The above-mentioned UE role is a role authorized by the network device for the given UE. The UE role can be determined by the network device based on the capability of the UE and the contract information of the UE. The contract information may be a service agreement and/or a UE subscription, and the contract information specifies the roles allowed for each UE in the ranging service and/or the lateral link positioning service. Based on this, when the network device determines the role according to the contract information of the UE, it can verify that the authorized role determined for the UE is a valid role, thereby ensuring the correct authorization of the role for the UE, and also ensuring the accuracy of the UE in executing the service depending on the UE role.

[054] Furthermore, in one embodiment of the proposed invention, the discovery response message may further comprise a security feature generated by the network device for the service requested to be discovered by the first AU and/or the second AU. The security feature corresponding to the service requested to be discovered by the first AU is identical to the security feature corresponding to the service requested to be discovered by the second AU. The security feature serves to ensure security in the subsequent process of discovery of the second AU by the first AU, to prevent an outside AU from tracking the role of the first AU or from unauthorizedly changing the role of the first AU when the first AU transfers the role of the first AU in the subsequent discovery process and, thereby, to prevent an outside AU from performing the role of the first AU, impersonating it, in order to mislead the partner AU (i.e. the second AU) of the first AU, to prevent interference by other outside AUs in the subsequent process of service execution, and to improve the accuracy of service execution and enhance information security. An outside AU may be, for example, an AU requesting a service different from the service requested for discovery by the first AU and the second AU, an AU not requesting a service, an AU whose role is not authorized by the network device, an AU that has not received a security measure from the network device, etc.

[055] Thus, according to the method of authorizing a role for an AU according to the embodiments of the proposed invention, a network device receives a discovery request message sent by a first AU and/or a second AU, wherein the discovery request message serves to request an authorized role for the first AU and/or the second AU. The network device sends a discovery response message to the first AU and/or the second AU, wherein the discovery response message contains a role determined by the network device for the first AU and/or the second AU. From the above it follows that the invention proposes a method of authorizing a role for an AU in a service requested by the AU to be discovered, wherein the role of the AU can be determined by the network device based on the capability of the AU and the contract information of the AU in order to ensure correct authorization of the role for the AU, as well as to ensure the accuracy of the service execution. In addition, the subscriber device is sent a security tool corresponding to the service requested by the AU for detection, wherein the security tool can serve to ensure protection during the subsequent process of detection by the subscriber device of another AU, to prevent the possibility of tracking by an outside AU the role of this AU or an unauthorized change by it of the role of this AU when this AU transmits its role to it in the subsequent detection process and, thereby, to prevent an outside AU from performing the role of this AU, impersonating it, to prevent interference by an outside AU during the subsequent process of service execution, to increase the accuracy of service execution and to strengthen the protection of information.

[056] Fig. 2b is a flow chart of a method for authorizing a role for an AU according to one embodiment of the present invention. The method is performed by a network device. As can be seen in Fig. 2b, the method for authorizing a role for an AU may include the following steps.

[057] At step 201b, the role of the first AU and/or the second AU is determined based on the capability of the first AU and/or the second AU and the contract information of the first AU and/or the second AU stored in the network device.

[058] As disclosed above, the contract information specifies the roles that are allowed for individual AUs in the ranging service and/or the lateral link positioning service. Based on this, the network device can determine the roles that are allowed for one AU in the ranging service and/or the lateral link positioning service by searching the contract information, and determine, taking into account the capability of the AU, the role of the AU from the roles that are allowed for the AU, wherein the capability of the AU ensures the ability to perform the role thus determined.

[059] Taking into account the above, the method for determining the role of the first AU by the network device is given as an example, while the method for determining the role of the second AU is similar.

[060] In particular, for example, if the service requested to be discovered by these two AUs is a ranging service, the network device may learn, from the service protocol, from the identifier of the first AU that the roles allowed for the first AU in the ranging service are the target AU and the AU server, and/or the network device may determine, from the identifier of the first AU, one or more subscriptions of the first AU and learn from these one or more subscriptions of the first AU that the roles allowed for the first AU in the sidelink positioning service are the target AU and the AU server. In this case, if the network device determines that the roles supported by the first AU in the ranging service are the target AU and the discovered AU, based on the capability of the first AU, the network device may authorize the role of the target AU for the first AU.

[061] It should also be noted that in one embodiment of the proposed invention, if the capabilities of the first AU support a plurality of roles from among the roles allowed for the first AU, the network device can define all of this plurality of roles as roles of the first AU, that is, the first AU can have a plurality of roles.

[062] Thus, according to the method of authorizing a role for an AU according to the embodiments of the proposed invention, a network device receives a discovery request message sent by a first AU and/or a second AU, wherein the discovery request message serves to request an authorized role for the first AU and/or the second AU. The network device sends a discovery response message to the first AU and/or the second AU, wherein the discovery response message contains a role determined by the network device for the first AU and/or the second AU. From the above it follows that the invention proposes a method for authorizing a role for an AU in a service requested by the AU to be discovered, wherein the role of the AU can be determined by the network device based on the capability of the AU and the contract information of the AU in order to ensure correct authorization of the role for the AU, as well as to ensure the accuracy of the service execution. In addition, the subscriber device is sent a security tool corresponding to the service requested by the AU for detection, wherein the security tool can serve to ensure protection during the subsequent process of detection by the subscriber device of another AU, to prevent the possibility of tracking by an outside AU the role of this AU or an unauthorized change by it of the role of this AU when this AU transmits its role to it in the subsequent detection process and, thereby, to prevent an outside AU from performing the role of this AU, impersonating it, to prevent interference by an outside AU during the subsequent process of service execution, to increase the accuracy of service execution and to strengthen the protection of information.

[063] Fig. 2c is a flow chart of a method for authorizing a role for an AU according to one embodiment of the present invention. The method is performed by the first AU. As can be seen in Fig. 2c, the method for authorizing a role for an AU may include the following steps.

[064] At step 201c, a discovery request message is sent to the network device. The discovery request message is used to request an authorized role for the first AU.

[065] At step 202c, a discovery response message sent by the network device is received. The discovery response message contains a role defined by the network device for the first AU.

[066] A detailed description of steps 201c - 202c can be found in the description of the embodiments disclosed above.

[067] Thus, according to the method of authorizing a role for an AU according to the embodiments of the proposed invention, a first AU may send a discovery request message to a network device. The discovery request message serves to request an authorized role for the first AU. The first AU may receive a discovery response message sent by the network device. The discovery response message contains a role determined by the network device for the first AU. From the above, it follows that the invention proposes a method of authorizing a role for an AU in a service requested by the AU to be discovered, wherein the AU role may be determined by the network device based on the AU capability and the AU contract information in order to ensure correct authorization of the role for the AU and to ensure the accuracy of service execution. In addition, the subscriber device is sent a security tool corresponding to the service requested by the AU for detection, wherein the security tool can serve to ensure protection during the subsequent process of detection by the subscriber device of another AU, to prevent the possibility of tracking by an outside AU the role of this AU or an unauthorized change by it of the role of this AU when this AU transmits its role to it in the subsequent detection process and, thereby, to prevent an outside AU from performing the role of this AU, impersonating it, to prevent interference by an outside AU during the subsequent process of service execution, to increase the accuracy of service execution and to strengthen the protection of information.

[068] Fig. 2d is a flow chart of a method for authorizing a role for an AU according to one embodiment of the present invention. The method is performed by the first AU. As can be seen in Fig. 2d, the method for authorizing a role for an AU may include the following steps.

[069] At step 201d, a first discovery message is broadcast. The first discovery message is protected by a security mechanism corresponding to the service requested to be discovered by the first AU, wherein the first discovery message contains the role of the first AU.

[070] In one embodiment of the proposed invention, the first UE will broadcast a first discovery message protected by a security mechanism corresponding to the service requested to be discovered by the first UE. Based on the fact that the security mechanism corresponding to the service requested to be discovered by the second UE is identical to the security mechanism corresponding to the service requested to be discovered by the first UE, the second UE can use the identical security mechanism to successfully verify the first discovery message broadcast by the first UE and, as a result, successfully discover each other with the first UE. The second UE can then check whether the role of the second UE matches the role of the first UE in order to subsequently verify that the connection is established with the first UE.

[071] Thus, according to the method of authorizing a role for an AU according to the embodiments of the proposed invention, a first AU will send a discovery request message to a network device, wherein the discovery request message serves to request an authorized role for the first AU. Then, the first AU will receive a discovery response message sent by the network device, wherein the discovery response message contains a role determined by the network device for the first AU. From the above, it follows that the invention proposes a method of authorizing a role for an AU in a service requested by the AU to be discovered, wherein the role of the AU can be determined by the network device based on the capability of the AU and the contract information of the AU in order to ensure correct authorization of the role for the AU, as well as to ensure the accuracy of the service execution. In addition, the subscriber device is sent a security tool corresponding to the service requested by the AU for detection, wherein the security tool can serve to ensure protection during the subsequent process of detection by the subscriber device of another AU, to prevent the possibility of tracking by an outside AU the role of this AU or an unauthorized change by it of the role of this AU when this AU transmits its role to it in the subsequent detection process and, thereby, to prevent an outside AU from performing the role of this AU, impersonating it, to prevent interference by an outside AU during the subsequent process of service execution, to increase the accuracy of service execution and to strengthen the protection of information.

[072] Fig. 2e is a flow chart of a method for authorizing a role for an AU according to one embodiment of the present invention. The method is performed by the first AU. As can be seen in Fig. 2e, the method for authorizing a role for an AU may include the following steps.

[073] At step 201e, a second discovery message broadcast by a second AU is received. The second discovery message is protected by a security mechanism corresponding to the service requested to be discovered by the second AU, wherein the second discovery message contains a role for the second AU.

[074] At step 202e, the second discovery message is decoded and verified and, if the verification is successful, it is determined whether the role of the second AU is related to the role of the first AU.

[075] The security means may serve to verify the second discovery message, using the principle described in the embodiments disclosed above.

[076] Furthermore, it should be noted that in the case where the service requested for discovery by the second UE is the same as the service requested for discovery by the first UE, if the role of the first UE is matched with the role of the second UE, this indicates that the first UE and the second UE are capable of performing the service requested by these two UEs. Based on this, after the first UE decodes and verifies the second discovery message, it can determine whether the role of the first UE is matched with the role of the second UE, to find out whether the first UE and the second UE can perform the service requested by these two UEs. If the service is performed, these two UEs can perform the discovery process to establish a connection. If the service cannot be performed, the discovery process is skipped.

[077] Furthermore, in one embodiment of the proposed invention, the above-mentioned role of the first UE is related to the role of the second UE in the service requested to be discovered by these two UEs, which may mean that the first UE and the second UE in their roles cooperate with each other to perform the service requested to be discovered by these two UEs. For the ranging service, the two roles in which the UEs can cooperate with each other to perform the ranging service are typically the target UE and the reference UE. For the sidelink positioning service, the two roles in which the UEs can cooperate with each other to perform the sidelink positioning service are typically the discovered UE and the target UE. Thus, when the service requested to be discovered by these two AUs is the ranging service 1, if the role of the first AU is the target AU and the role of the second AU is the reference AU, this indicates that the role of the first AU is related to the role of the second AU in the service requested to be discovered by these two AUs.

[078] In another embodiment of the proposed invention, the role of the first AU does not correlate with the role of the second AU in the service requested to be discovered by these two AUs. This may mean that the first AU and the second AU in their roles cannot cooperate with each other to perform the service requested by these two AUs. For example, if the service requested to be discovered by these two AUs is the ranging service 1, the role of the first AU is the target AU, and the role of the second AU is also the target AU, this indicates that the role of the first AU does not correlate with the role of the second AU in the service requested to be discovered by these two AUs.

[079] At step 203e, a first response message is sent to a second AU in the case where the role of the first AU is related to the role of the second AU. The first response message is protected by a security mechanism corresponding to the service requested to be discovered by the first AU, wherein the first response message contains the role of the first AU.

[080] The steps 201e-203e disclosed above constitute a process of discovering a first AU and a second AU. After these two AUs discover each other, they can establish a connection to implement a service.

[081] Thus, according to the method of authorizing a role for an AU according to the embodiments of the proposed invention, a first AU sends a discovery request message to a network device, wherein the discovery request message serves to request an authorized role for the first AU. Then, the first AU receives a discovery response message sent by the network device, wherein the discovery response message contains a role determined by the network device for the first AU. From the above, it follows that the invention proposes a method of authorizing a role for an AU in a service requested by the AU to be discovered, wherein the role of the AU can be determined by the network device based on the capability of the AU and the contract information of the AU in order to ensure correct authorization of the role for the AU, as well as to ensure the accuracy of the service execution. In addition, the subscriber device is sent a security tool corresponding to the service requested by the AU for detection, wherein the security tool can serve to ensure protection during the subsequent process of detection by the subscriber device of another AU, to prevent the possibility of tracking by an outside AU the role of this AU or an unauthorized change by it of the role of this AU when this AU transmits its role to it in the subsequent detection process and, thereby, to prevent an outside AU from performing the role of this AU, impersonating it, to prevent interference by an outside AU during the subsequent process of service execution, to increase the accuracy of service execution and to strengthen the protection of information.

[082] Fig. 2f is a flow chart of a method for authorizing a role for an AU according to one embodiment of the present invention. The method is performed by a second AU. As can be seen in Fig. 2f, the method for authorizing a role for an AU may include the following steps.

[083] At step 201f, a discovery request message is sent to the network device. The discovery request message is used to request an authorized role for the second AU.

[084] At step 202f, a discovery response message sent by the network device is received. The discovery response message contains a role defined by the network device for the second AU.

[085] Thus, according to the method of authorizing a role for an AU according to the embodiments of the proposed invention, a second AU may send a discovery request message to a network device. The discovery request message serves to request an authorized role for the second AU. The second AU may receive a discovery response message sent by the network device. The discovery response message contains a role determined by the network device for the second AU. From the above, it follows that the invention proposes a method of authorizing a role for an AU in a service requested by the AU to be discovered, wherein the AU role may be determined by the network device based on the AU capability and the AU contract information in order to ensure correct authorization of the role for the AU and to ensure the accuracy of service execution. In addition, the subscriber device is sent a security tool corresponding to the service requested by the AU for detection, wherein the security tool can serve to ensure protection during the subsequent process of detection by the subscriber device of another AU, to prevent the possibility of tracking by an outside AU the role of this AU or an unauthorized change by it of the role of this AU when this AU transmits its role to it in the subsequent detection process and, thereby, to prevent an outside AU from performing the role of this AU, impersonating it, to prevent interference by an outside AU during the subsequent process of service execution, to increase the accuracy of service execution and to strengthen the protection of information.

[086] Fig. 2g is a flow chart of a method for authorizing a role for an AU according to one embodiment of the present invention. The method is performed by a second AU. As can be seen in Fig. 2g, the method for authorizing a role for an AU may include the following steps.

[087] At step 201g, a first discovery message broadcast by a first AU is received. The first discovery message is protected by a security mechanism corresponding to the service requested to be discovered by the first AU, wherein the first discovery message contains the role of the first AU.

[088] At step 202g, the first discovery message is decoded and verified and, if the verification is successful, it is determined whether the role of the second AU is related to the role of the first AU.

[089] Thus, according to the method of authorizing a role for an AU according to the embodiments of the proposed invention, a second AU sends a discovery request message to a network device, wherein the discovery request message serves to request an authorized role for the second AU. Then, the second AU receives a discovery response message sent by the network device, wherein the discovery response message contains a role determined by the network device for the second AU. From the above, it follows that the invention proposes a method of authorizing a role for an AU in a service requested by the AU to be discovered, wherein the role of the AU can be determined by the network device based on the capability of the AU and the contract information of the AU in order to ensure correct authorization of the role for the AU, as well as to ensure the accuracy of the service execution. In addition, the subscriber device is sent a security tool corresponding to the service requested by the AU for detection, wherein the security tool can serve to ensure protection during the subsequent process of detection by the subscriber device of another AU, to prevent the possibility of tracking by an outside AU the role of this AU or an unauthorized change by it of the role of this AU when this AU transmits its role to it in the subsequent detection process and, thereby, to prevent an outside AU from performing the role of this AU, impersonating it, to prevent interference by an outside AU during the subsequent process of service execution, to increase the accuracy of service execution and to strengthen the protection of information.

[090] Fig. 2h is a flow chart of a method for authorizing a role for an AU according to one embodiment of the present invention. The method is performed by a second AU. As can be seen in Fig. 2h, the method for authorizing a role for an AU may include the following steps.

[091] At step 201h, a second discovery message is broadcast. The second discovery message is protected by a security mechanism corresponding to the service requested to be discovered by the second AU, wherein the second discovery message contains the role of the second AU.

[092] At step 202h, a first response message sent by the first AU is received. The first response message is protected by a security mechanism corresponding to the service requested to be discovered by the first AU, wherein the first response message contains the role of the first AU.

[093] Thus, according to the method of authorizing a role for an AU according to the embodiments of the proposed invention, a second AU will send a discovery request message to a network device, wherein the discovery request message serves to request an authorized role for the second AU. Then, the second AU will receive a discovery response message sent by the network device, wherein the discovery response message contains a role determined by the network device for the second AU. From the above, it follows that the invention proposes a method of authorizing a role for an AU in a service requested by the AU to be discovered, wherein the role of the AU can be determined by the network device based on the capability of the AU and the contract information of the AU in order to ensure correct authorization of the role for the AU, as well as to ensure the accuracy of the service execution. In addition, the subscriber device is sent a security tool corresponding to the service requested by the AU for detection, wherein the security tool can serve to ensure protection during the subsequent process of detection by the subscriber device of another AU, to prevent the possibility of tracking by an outside AU the role of this AU or an unauthorized change by it of the role of this AU when this AU transmits its role to it in the subsequent detection process and, thereby, to prevent an outside AU from performing the role of this AU, impersonating it, to prevent interference by an outside AU during the subsequent process of service execution, to increase the accuracy of service execution and to strengthen the protection of information.

[094] Furthermore, in one embodiment of the proposed invention, the above-mentioned network device includes: a first network element, a second network element, and a third network element. The first network element is a direct discovery name management function (DDNMF) network element or a key management function (PKMF) network element of the first AC. The second network element is a DDNMF network element or a PKMF network element of the second AC. The third network element is a proximity service server or a unified data management (UDM) network element. Based on this, particular cases of steps for interactions between the first network element, the second network element, the third network element, the first AC, and the second AC are described below.

[095] Fig. 2i is a sequence of interactions during the execution of a method for authorizing a role for an AU according to one embodiment of the present invention. The method for authorizing a role for an AU may include the following steps.

[096] At step 201i, the first network element receives a discovery request message sent by the first AU.

[097] At step 202i, the first network element sends a first authorization request message to the third network element.

[098] At step 203i, the third network element sends a first authorization response message to the first network element, wherein the first authorization response message comprises a role of the first AU determined by the third network element.

[099] At step 204i, the first network element sends a discovery response message to the first AU.

[0100] The above-disclosed steps will be described in detail in the following embodiments.

[0101] Thus, the invention provides a method for authorizing a role for a UE in a service requested by the UE to be discovered, wherein the role of the UE can be determined by a network device based on the capability of the UE and the contract information of the UE in order to ensure correct authorization of the role for the UE, as well as to ensure the accuracy of the service execution. In addition, a security tool corresponding to the service requested by the UE to be discovered is sent to the subscriber device, wherein the security tool can serve to ensure protection during the subsequent process of discovery of another UE by the subscriber device, to prevent the possibility of tracking the role of this UE by an outside UE or an unauthorized change by it of the role of this UE when this UE transmits its role in the subsequent discovery process and, thereby, to prevent an outside UE from performing the role of this UE, impersonating it, preventing interference from an outside UE during the subsequent process of service execution, improving the accuracy of service execution and strengthening the security of information.

[0102] Fig. 2j is a sequence of interactions during the execution of a method for authorizing a role for an AU according to one embodiment of the proposed invention. The method for authorizing a role for an AU may include the following steps.

[0103] At step 201j, the second network element receives a discovery request message sent by the second AU.

[0104] At step 202j, the second network element sends a first authorization request message to the third network element.

[0105] At step 203j, the third network element sends a first authorization response message to the second network element, wherein the first authorization response message contains a role of the second AU determined by the third network element.

[0106] At step 204j, the second network element sends a discovery response message to the second AU.

[0107] The above-disclosed steps will be described in detail in the following embodiments.

[0108] Thus, the invention provides a method for authorizing a role for a UE in a service requested by a UE to be discovered, wherein the role of the UE can be determined by a network device based on the capability of the UE and the contract information of the UE in order to ensure correct authorization of the role for the UE, as well as to ensure the accuracy of the service execution. In addition, a security tool corresponding to the service requested by the UE to be discovered is sent to the subscriber device, wherein the security tool can serve to ensure protection during the subsequent process of discovery of another UE by the subscriber device, to prevent the possibility of tracking the role of this UE by an outside UE or an unauthorized change by it of the role of this UE when this UE transmits its role in the subsequent discovery process and, thereby, to prevent an outside UE from performing the role of this UE, impersonating it, preventing interference from an outside UE during the subsequent process of service execution, increasing the accuracy of service execution and strengthening the security of information.

[0109] Fig. 2k is a sequence of interactions during the execution of a method for authorizing a role for an AU according to one embodiment of the proposed invention. The method for authorizing a role for an AU may include the following steps.

[0110] In step 201k, the second network element sends a control request message to the first network element. The control request message contains a role of the second AU, wherein the control request message serves to request a determination of whether the role of the second AU is related to the role of the first AU.

[0111] At step 202k, the first network element sends a second authorization request message to the third network element. The second authorization response message contains the role of the first AU and the role of the second AU.

[0112] In step 203k, the third network element determines whether the role of the second AU is related to the role of the first AU, and sends a second authorization response message to the first network element. The second authorization response message serves to indicate whether the role of the first AU is related to the role of the second AU in the service requested to be discovered by these two AUs.

[0113] In step 204k, in the case where the role of the first AU is related to the role of the second AU, the first network element sends a security means generated depending on the service requested to be discovered by the second AU to the second network element.

[0114] At step 205k, the second network device sends the generated security means corresponding to the service requested to be discovered by the second AU to the second AU.

[0115] The above-disclosed steps will be described in detail in the following embodiments.

[0116] Thus, the invention provides a method for authorizing a role for a UE in a service requested by a UE to be discovered, wherein the role of the UE can be determined by a network device based on the capability of the UE and the contract information of the UE in order to ensure correct authorization of the role for the UE, as well as to ensure the accuracy of the service execution. In addition, a security tool corresponding to the service requested by the UE to be discovered is sent to the subscriber device, wherein the security tool can serve to ensure protection during the subsequent process of discovery of another UE by the subscriber device, to prevent the possibility of tracking the role of this UE by an outside UE or an unauthorized change by it of the role of this UE when this UE transmits its role in the subsequent discovery process and, thereby, to prevent an outside UE from performing the role of this UE, impersonating it, preventing interference from an outside UE during the subsequent process of service execution, improving the accuracy of service execution and strengthening the security of information.

[0117] Furthermore, the above-disclosed method for authorizing a role for an AU is described in relation to a network device, a first AU, and a second AU. It follows from the above that the network device may comprise a DDNMF function network element or a PKMF function network element of the first AU, a DDNMF function network element or a PKMF function network element of the second AU, and a third network element, which is a proximity determination service server or a UDM network element. Based on this, the proposed method will be further described in relation to each of the DDNMF function network element or the PKMF function network element of the first AU, the DDNMF function network element or the PKMF function network element of the second AU, the UDM server or network element, as well as in the context of the interaction of the first AU with the DDNMF function network element / PKMF function network element and the interaction of the second AU with the DDNMF function network element / PKMF function network element of the execution of the role authorization method for the AU.

[0118] Fig. 2L is a flow chart of a method for authorizing a role for an AU according to one embodiment of the present invention. The method is performed by a network element of the DDNMF function or a network element of the PKMF function of the first AU. As can be seen in Fig. 2, the method for authorizing a role for an AU may include the following steps.

[0119] At step 201L, a discovery request message sent by the first AU is received. The discovery request message is used to request an authorized role in the service requested to be discovered by the first AU.

[0120] In one embodiment of the present invention,

[0121] At step 202L, a first authorization request message is sent to a server or a unified data management (UDM) network element according to the discovery request message.

[0122] In particular, in one embodiment of the proposed invention, at the step of sending a first authorization request message to the UDM server or network element according to the discovery request message: converting a ranging application user identifier (RAUID) corresponding to a first AU into a first identifier that can be recognized by the UDM server or network element, wherein the first identifier serves to indicate the first AU; and sending a first authorization request message containing at least one of the first identifier, the service requested to be discovered by the first AU, and the capability of the first AU, to the UDM server or network element.

[0123] Furthermore, in one embodiment of the present invention, the server may be, for example, a range or position determination server over a lateral communication link.

[0124] At step 203L, a first authorization response message sent by the UDM server or network element is received. The first authorization response message contains the role of the first AU determined by the UDM server or network element.

[0125] For example, the role of the first AU may be determined by the UDM server or network element based on the capability of the first AU and the role(s) allowed for the first AU in the service requested to be discovered by the first AU. In particular, the role of the first AU may be, for example, a role from among one or more roles allowed for the first AU in the service requested to be discovered by the first AU, determined based on the capability of the first AU. For example, if the first AU has the capability to support the roles of the target AU and the AU server, the role allowed for the first AU in the service requested to be discovered by the first AU is the target AU, and in this case, the role of the first AU is the target AU. Detailed introductory information on how the UDM server or network element determines the role of the first AU at this stage will be given in the following examples of the implementation of the UDM server or network element.

[0126] It should be noted that, in one embodiment of the proposed invention, when the server or the UDM network element cannot determine the role of the first AU based on the capability of the first AU and one or more roles allowed for the first AU in the service requested to be discovered by the first AU (i.e., the one or more roles allowed for the first AU in the service requested to be discovered by the first AU does not include a role supported by the capability of the first AU), the first authorization response message may serve to indicate an authorization failure and/or the reason for the authorization failure by the server or the UDM network element.

[0127] At step 204L, a discovery response message is sent to the first AU. The discovery response message contains the role of the first AU.

[0128] In one embodiment of the proposed invention, the discovery response message may further comprise a security feature (i.e., a discovery security feature) generated by the network element of the DDNMF function of the first AU or the network element of the PKMF function of the first AU for the service requested to be discovered by the first AU. The security feature serves to ensure security in the subsequent process of discovering other AUs performed by the first AU, to prevent an outside AU from tracking the role of the first AU or from unauthorizedly changing the role of the first AU when the first AU transfers the role of the first AU in the subsequent discovery process and, thereby, to prevent an outside AU from performing the role of the first AU, impersonating it, in order to mislead the AU - the partner AU of the AU of the first AU, to prevent interference from other outside AUs in the subsequent process of executing the service, as well as to improve the accuracy of executing the service and to strengthen the security of the information.

[0129] Furthermore, in one embodiment of the proposed invention, when the DDNMF function network element of the first AU or the PKMF function network element of the first AU assumes the role of the first AU, the DDNMF function network element of the first AU or the PKMF function network element of the first AU will further determine an application code corresponding to the service to be performed by the first AU, include the application code corresponding to the service to be performed by the first AU in the discovery response message and send it to the first AU. The first AU can use this application code to discover other AUs performing the same service as the first AU, according to this application code.

[0130] Furthermore, in one embodiment of the proposed invention, if the first authorization response message received by the DDNMF function network element of the first AU or the PKMF function network element of the first AU indicates an authorization failure, the DDNMF function network element of the first AU or the PKMF function network element of the first AU will not generate a security tool and an application code, but will send a discovery response message to the first AU to indicate that the discovery request from the first AU is rejected.

[0131] Thus, according to the method for authorizing a role for an AU according to the embodiments of the proposed invention, the DDNMF network element or the PKMF network element of the first AU may receive a discovery request message sent by the first AU. The discovery request message serves to request an authorized role in the service requested to be discovered by the first AU. Then, the DDNMF network element or the PKMF network element of the first AU may send a first authorization request message to the UDM server or network element according to the discovery request message and receive a first authorization response message sent by the UDM server or network element. The first authorization response message contains the role of the first AU determined by the UDM server or network element. Finally, the DDNMF network element or the PKMF network element of the first AU may send a discovery response message to the first AU. The discovery response message contains the role of the first AU and the security feature generated by the DDNMF network element or the PKMF network element of the first AU for the service requested for discovery by the first AU. From the above, it follows that the invention proposes a method for authorizing a role in a service requested for discovery by the first AU, wherein the role of the first AU can be determined by the UDM server or network element based on the capability of the first AU and one or more roles allowed for the first AU in the service requested for discovery by the first AU, in order to ensure the correct authorization of the role for the first AU and to ensure the accuracy of service execution. In addition, the first AU is sent a security tool corresponding to the service requested for detection by the first AU, wherein the security tool can serve to ensure protection during the subsequent process of detection of another AU performed by the first AU, to prevent the possibility of an outside AU tracking the role of the first AU or an unauthorized change by it of the role of the first AU when the first AU transfers the role of the first AU in the subsequent detection process and, thereby, to prevent the possibility of an outside AU performing the role of the first AU, impersonating it, to prevent interference from an outside AU during the subsequent process of service execution, to increase the accuracy of service execution and to strengthen the protection of information.

[0132] Fig. 3 is a flow chart of a method for authorizing a role for an AU according to one embodiment of the present invention. The method is performed by a network element of the DDNMF function or a network element of the PKMF function of the first AU. As can be seen in Fig. 3, the method for authorizing a role for an AU may include the following steps.

[0133] At step 301, a control request message sent by a network element of the DDNMF function or a network element of the PKMF function of the second AU is received.

[0134] In one embodiment of the proposed invention, a control request message may be sent to a network element of the DDNMF function or a network element of the PKMF function of the first AU after the network element of the DDNMF function or the network element of the PKMF function of the second AU receives the role of the second AU determined by the UDM server or network element. The control request message contains at least one of the role of the second AU, the service requested to be discovered by the second AU, and a second identifier used to indicate the second AU. A particular case of the process of obtaining by a network element of the DDNMF function or by a network element of the PKMF function of the second AU the role of the second AU, determined by a server or a UDM network element, is similar to a particular case of the process of obtaining by a network element of the DDNMF function or by a network element of the PKMF function of the first AU the role of the first AU and will be described in the following examples of the implementation of a network element of the DDNMF function or a network element of the PKMF function of the second AU.

[0135] In step 302, in the case where the service requested to be discovered by the second AU is the same as the service requested to be discovered by the first AU, a second authorization request message is sent to the UDM server or network element, wherein the second authorization request message contains the role of the first AU, the role of the second AU, and the service requested to be discovered by both AUs.

[0136] In one embodiment of the proposed invention, in the case where the service requested to be discovered by the second AU is the same as the service requested to be discovered by the first AU, if the role of the first AU is related to the role of the second AU, this indicates that the first AU and the second AU can perform the service requested to be discovered by these two AUs. Based on this, when the DDNMF network element or the PKMF network element of the first AU determines that the service requested to be discovered by the second AU is the same as the service requested to be discovered by the first AU, a second authorization request message is sent to the UDM server or network element, whereby the UDM server or network element can determine whether the role of the first AU is related to the role of the second AU, in order to find out whether the first AU and the second AU can perform the service requested by these two AUs. If the service is fulfilled, the two AUs can perform a discovery process to establish a connection. If the service cannot be fulfilled, the discovery process is skipped.

[0137] Furthermore, in one embodiment of the proposed invention, the above-mentioned role of the first UE is related to the role of the second UE in the service requested to be discovered by these two UEs, which may mean that the first UE and the second UE in their roles cooperate with each other to perform the service requested to be discovered by these two UEs. For the ranging service, the two roles in which the UEs can cooperate with each other to perform the ranging service are typically the target UE and the reference UE. For the sidelink positioning service, the two roles in which the UEs can cooperate with each other to perform the sidelink positioning service are typically the discovered UE and the target UE. Thus, when the service requested to be discovered by these two AUs is the ranging service 1, if the role of the first AU is the target AU and the role of the second AU is the reference AU, this indicates that the role of the first AU is related to the role of the second AU in the service requested to be discovered by these two AUs.

[0138] In another embodiment of the proposed invention, the role of the first AU does not correlate with the role of the second AU in the service requested to be discovered by these two AUs. This may mean that the first AU and the second AU in their roles cannot cooperate with each other to perform the service requested by these two AUs. For example, if the service requested to be discovered by these two AUs is the ranging service 1, the role of the first AU is the target AU, and the role of the second AU is also the target AU, this indicates that the role of the first AU does not correlate with the role of the second AU in the service requested to be discovered by these two AUs.

[0139] At step 303, a second authorization response message sent by the UDM server or network element is received. The second authorization response message serves to indicate whether the role of the first AU is related to the role of the second AU in the service requested to be discovered by these two AUs.

[0140] In step 304, if the second authorization response message indicates that the role of the first AU is related to the role of the second AU, a control response message is sent to the DDNMF network element or the PKMF network element of the second AU.

[0141] In one embodiment of the proposed invention, the control response message contains a security tool generated by the network element of the DDNMF function or the network element of the PKMF function of the first AU for the same service requested to be discovered by the first AU, so that the security tool corresponding to the service requested to be discovered by the second AU is identical to the security tool corresponding to the service requested to be discovered by the first AU.

[0142] It should be noted that, in one embodiment of the proposed invention, if the role of the first AU is related to the role of the second AU, this indicates that the first AU and the second AU can cooperate with each other to perform the service requested to be discovered by these two AUs. In this case, the DDNMF network element or the PKMF network element of the first AU must generate a discovery protection measure for the service requested to be discovered by the second AU, which is identical to the discovery protection measure generated for the service requested to be discovered by the first AU, so that the second AU can subsequently successfully verify the information transmitted by the first AU during the discovery process, based on the identical discovery protection measure, thereby ensuring that these two AUs can successfully discover each other and successfully perform the service requested to be discovered by these two AUs.

[0143] Furthermore, in one embodiment of the proposed invention, if the second authorization response message received by the DDNMF function network element or the PKMF function network element of the first AU from the UDM server or network element indicates that the role of the first AU does not correspond to the role of the second AU in the service requested to be discovered by these two AUs, the DDNMF function network element or the PKMF function network element of the first AU must send a control response message indicating that the control request is rejected to the DDNMF function network element or the PKMF function network element of the second AU.

[0144] Thus, according to the method for authorizing a role for an AU according to the embodiments of the proposed invention, the DDNMF network element or the PKMF network element of the first AU may receive a discovery request message sent by the first AU. The discovery request message serves to request an authorized role in the service requested to be discovered by the first AU. Then, the DDNMF network element or the PKMF network element of the first AU may send a first authorization request message to the UDM server or network element according to the discovery request message and receive a first authorization response message sent by the server or the UDM network element. The first authorization response message contains the role of the first AU determined by the UDM server or network element. Finally, the DDNMF network element or the PKMF network element of the first AU may send a discovery response message to the first AU. The discovery response message contains the role of the first AU and the security feature generated by the DDNMF network element or the PKMF network element of the first AU for the service requested for discovery by the first AU. From the above, it follows that the invention proposes a method for authorizing a role in a service requested for discovery by the first AU, wherein the role of the first AU can be determined by the UDM server or network element based on the capability of the first AU and one or more roles allowed for the first AU in the service requested for discovery by the first AU, in order to ensure the correct authorization of the role for the first AU and to ensure the accuracy of service execution. In addition, the first AU is sent a security tool corresponding to the service requested for detection by the first AU, wherein the security tool can serve to ensure protection during the subsequent process of detection of another AU performed by the first AU, to prevent the possibility of an outside AU tracking the role of the first AU or an unauthorized change by it of the role of the first AU when the first AU transfers the role of the first AU in the subsequent detection process and, thereby, to prevent the possibility of an outside AU performing the role of the first AU, impersonating it, to prevent interference from an outside AU during the subsequent process of service execution, to increase the accuracy of service execution and to strengthen the protection of information.

[0145] Fig. 4 is a flow chart of a method for authorizing a role for an AU according to one embodiment of the present invention. The method is performed by a network element of the DDNMF function or a network element of the PKMF function of a second AU. As can be seen in Fig. 4, the method for authorizing a role for an AU may include the following steps.

[0146] At step 401, a discovery request message sent by the second AU is received. The discovery request message is used to request an authorized role in the service requested to be discovered by the second AU.

[0147] In one embodiment of the proposed invention, the discovery request message optionally contains at least one of a RAUID corresponding to the second AU; a service requested to be discovered by the second AU; or a capability of the second AU.

[0148] RAUID is used to identify the AU so that the network device can know which AU is sending the discovery request message.

[0149] At step 402, a first authorization request message is sent to a server or a network unified data management (UDM) element according to the discovery request message.

[0150] In the step of sending the first authorization request message to the UDM server or network element according to the discovery request message, it is optional: converting the RAUID corresponding to the second AU into a second identifier that can be recognized by the UDM server or network element, wherein the second identifier serves to indicate the second AU; and sending the authorization request message containing at least one of the second identifier, the service requested to be discovered by the second AU, and the capability of the second AU, to the UDM server or network element.

[0151] At step 403, a first authorization response message sent by the UDM server or network element is received. The first authorization response message contains the role of the second AU determined by the UDM server or network element.

[0152] In one embodiment of the present invention, the role of the second AU is not necessarily determined by the UDM server or network element based on the capability of the second AU and one or more roles allowed for the second AU in the service requested to be discovered by the second AU.

[0153] At step 404, a security means corresponding to the service requested to be discovered by the second AU is determined.

[0154] The security means corresponding to the service requested to be discovered by the second AU must be identical to the security means corresponding to the service requested to be discovered by the first AU. Information on determining the security means corresponding to the service requested to be discovered by the second AU at this stage can be found in the description of the following embodiments.

[0155] At step 405, a discovery response message is sent to the second AU. The discovery response message contains the role of the second AU.

[0156] The discovery response message may further comprise a security means generated by the DDNMF network element or the PKMF network element of the second AU for the service requested to be discovered by the second AU.

[0157] The above-disclosed steps 401-403 and 405 are based on a principle similar to the principle of steps 201-204 of the above-disclosed embodiments of Fig. 2, and other information can be found in the description of the above-disclosed embodiments.

[0158] Thus, according to the method for authorizing a role for an AU according to the embodiments of the proposed invention, a DDNMF function network element or a PKMF function network element of a second AU may receive a discovery request message sent by the second AU. The discovery request message serves to request an authorized role in a service requested to be discovered by the second AU. Then, the DDNMF function network element or the PKMF function network element of the second AU may send a first authorization request message to the UDM server or network element according to the discovery request message and receive a first authorization response message sent by the UDM server or network element. The first authorization response message contains the role of the second AU determined by the UDM server or network element. The DDNMF function network element or the PKMF function network element of the second AU may determine the generated security means corresponding to the service requested to be discovered by the second AU. Finally, the DDNMF network element or the PKMF network element of the second AU may send a discovery response message to the second AU. The discovery response message contains the role of the second AU and a security feature corresponding to the service requested for discovery by the second AU. From the above, it follows that the invention proposes a method for authorizing a role in a service requested for discovery by a second AU, wherein the role of the second AU can be determined by a UDM server or network element based on the capability of the second AU and one or more roles allowed for the second AU in the service requested for discovery by the second AU, in order to ensure the correct authorization of the role for the second AU and to ensure the accuracy of service execution. In addition, the second AU is sent a security tool corresponding to the service requested for discovery by the second AU. This security tool can be used to successfully verify the information transmitted by the first AU during the discovery process, based on an identical security tool during discovery. This ensures the ability of these two AUs to successfully discover each other and successfully execute the service requested for discovery by these two AUs. The inability of other AUs to learn the security tool prevents interference by unauthorized AUs during subsequent service execution, thereby increasing the accuracy of service execution and strengthening information security.

[0159] Fig. 5 is a flow chart of a method for authorizing a role for an AU according to one embodiment of the present invention. The method is performed by a network element of the DDNMF function or a network element of the PKMF function of a second AU. As can be seen in Fig. 5, the method for authorizing a role for an AU may include the following steps.

[0160] In step 501, a control response message is sent to the network element of the DDNMF function or the network element of the PKMF function of the first AU. The control response message contains at least one of the role of the second AU, the service requested to be discovered by the second AU, or a second identifier indicating the second AU.

[0161] It should be noted that, in one embodiment of the proposed invention, the second AU actually knows which AU is the partner AU (i.e., the first AU). Based on this, when the second AU sends a discovery request message to the DDNMF function network element or the PKMF function network element of the second AU, it may additionally include indication information indicating the first AU or indicating the DDNMF function network element or the PKMF function network element of the first AU in the discovery request message, so that the DDNMF function network element or the PKMF function network element of the second AU could determine, according to the indication information, to which AU the DDNMF function network element or the PKMF function network element should send a control request message, thereby ensuring the possibility of sending the DDNMF function network element or the PKMF function network element of the second AU a control request message to the DDNMF function network element or the PKMF function network element of the first AU.

[0162] At step 502, a control response message sent by the DDNMF network element or the PKMF network element of the first AU is received.

[0163] In one embodiment of the proposed invention, the control response message contains a security means corresponding to the service requested to be discovered by the second AU. The security means are sent to the DDNMF function network element or the PKMF function network element of the second AU after the DDNMF function network element or the PKMF function network element of the first AU receives the second authorization response message (indicating that the role of the first AU is related to the role of the second AU) sent by the UDM server or network element, wherein the security means corresponding to the service requested to be discovered by the second AU is identical to the security key corresponding to the service requested to be discovered by the first AU.

[0164] A detailed description of steps 501 - 502 can be found in the embodiments disclosed above, so they will not be discussed in detail again.

[0165] Thus, according to the method for authorizing a role for an AU according to the embodiments of the proposed invention, a DDNMF function network element or a PKMF function network element of a second AU may receive a discovery request message sent by the second AU. The discovery request message serves to request an authorized role in a service requested to be discovered by the second AU. Then, the DDNMF function network element or the PKMF function network element of the second AU may send a first authorization request message to the UDM server or network element according to the discovery request message and receive a first authorization response message sent by the UDM server or network element. The first authorization response message contains the role of the second AU determined by the UDM server or network element. The DDNMF function network element or the PKMF function network element of the second AU may determine the generated security means corresponding to the service requested to be discovered by the second AU. Finally, the DDNMF network element or the PKMF network element of the second AU may send a discovery response message to the second AU. The discovery response message contains the role of the second AU and a security feature corresponding to the service requested for discovery by the second AU. From the above, it follows that the invention proposes a method for authorizing a role in a service requested for discovery by a second AU, wherein the role of the second AU can be determined by a UDM server or network element based on the capability of the second AU and one or more roles allowed for the second AU in the service requested for discovery by the second AU, in order to ensure the correct authorization of the role for the second AU and to ensure the accuracy of service execution. In addition, the second AU is sent a security tool corresponding to the service requested for discovery by the second AU. This security tool can be used to successfully verify the information transmitted by the first AU during the discovery process, based on an identical security tool during discovery. This ensures the ability of these two AUs to successfully discover each other and successfully execute the service requested for discovery by these two AUs. The inability of other AUs to learn the security tool prevents interference by unauthorized AUs during subsequent service execution, thereby increasing the accuracy of service execution and strengthening information security.

[0166] Fig. 6 is a flow chart of a method for authorizing a role for an AU according to one embodiment of the present invention. The method is performed by a server or a UDM. As can be seen in Fig. 6, the method for authorizing a role for an AU may include the following steps.

[0167] At step 601, a first authorization request message sent by a network element of the DDNMF function or a network element of the PKMF function of the first AU and/or the second AU is received. The first authorization request message is used to request an authorized role in the service requested to be discovered by the first AU and/or the second AU.

[0168] The first authorization request message optionally contains at least one of an identifier used to indicate the first AU and/or the second AU; a service requested to be detected by the first AU and/or the second AU; or a capability of the first AU and/or the second AU.

[0169] At step 602, the role of the first AU and/or the second AU is determined according to the first authorization request message.

[0170] Basic information on how the roles of the first AU and/or the second AU are determined at this stage can be found in the description of the following embodiments.

[0171] At step 603, a first authorization response message is sent to the DDNMF network element or the PKMF network element of the first AU and/or the second AU. The first authorization response message contains the role of the first AU and/or the second AU.

[0172] The basic information about steps 601 - 603 can be found in the description of the embodiments disclosed above.

[0173] Thus, according to the method of authorizing a role for an AU according to the embodiments of the proposed invention, the UDM server or network element may receive a first authorization request message sent by a DDNMF function network element or a PKMF function network element of a first AU and/or a second AU, wherein the first authorization request message serves to request an authorized role in a service requested to be discovered by the first AU and/or the second AU. The role of the first AU and/or the second AU may be determined according to the first authorization request message. Then, the UDM server or network element may send a first authorization response message to the DDNMF function network element or the PKMF function network element of the first AU and/or the second AU, wherein the first authorization response message contains the role of the first AU and/or the second AU. From the above it follows that the invention proposes a method for authorizing a role for a first AU and/or a second AU in a service requested for discovery, wherein the role of the first AU and/or the second AU can be determined by a server or a UDM network element based on the capability of the first AU and/or the second AU and one or more roles acceptable for the first AU and/or the second AU in the service requested for discovery by the first AU and/or the second AU, which ensures the possibility of correct authorization of the role for the first AU and/or the second AU and the accuracy of service execution.

[0174] Fig. 7 is a flow chart of a method for authorizing a role for an AU according to one embodiment of the present invention. The method is performed by a server or a UDM. As can be seen in Fig. 7, the method for authorizing a role for an AU may include the following steps.

[0175] At step 701, a role allowed for the first AU and/or the second AU in the service requested to be discovered by the first AU and/or the second AU is determined based on an identifier used to indicate the first AU and/or the second AU and depending on the service requested to be discovered by the first AU and/or the second AU.

[0176] It should be noted that in one embodiment of the proposed invention, the role allowed for each UE in the ranging service and/or the lateral positioning service may be fixed in the service protocol on the server, or the role allowed for the corresponding UE in the ranging service and/or the lateral positioning service may be fixed in each UE subscription in the UDM. Based on this, the server may determine the roles allowed for each UE in the ranging service and/or the lateral positioning service by searching the service protocol, and the UDM may determine the roles allowed for each UE in the ranging service and/or the lateral positioning service by searching the UE subscription.

[0177] The above is an example of a method for determining the role of the first AU by the server or UDM, while the method related to the second AU is similar.

[0178] In particular, for example, the service requested to be discovered by these two AUs is a ranging service. In this case, the server learns from the service protocol by the identifier of the first AU that the roles valid for the first AU in the ranging service are the target AU and the AU server, and/or the UDM can determine the subscription of the first AU by the identifier of the first AU and learn from the subscription of the first AU that the roles valid for the first AU in the lateral link positioning service are the target AU and the AU server.

[0179] At step 702, from among one or more roles valid for the first AU and/or the second AU, a role supported by the capability of the first AU and/or the second AU is determined as the role of the first AU and/or the second AU.

[0180] Continuing the explanation with the example of the first AU, if the UDM server or network element determines, based on the capability of the first AU, that the roles supported by the first AU in the ranging service are the target AU and the discovered AU, and the roles allowed by the first AU in the ranging service, as determined in step 701, are the target AU and the AU server, the UDM server or network element can determine that the role of the first AU is the target AU.

[0181] It should also be noted that in one embodiment of the proposed invention, from among the roles allowed for the first AU, if the capabilities of the first AU support multiple roles, the UDM server or network element may define all of the given set of roles as roles of the first AU, that is, the first AU may have multiple roles.

[0182] Thus, according to the method for authorizing a role for an AU according to the embodiments of the proposed invention, the UDM server or network element may receive a first authorization request message sent by a DDNMF function network element or a PKMF function network element of a first AU and/or a second AU, wherein the first authorization request message serves to request an authorized role in a service requested to be discovered by the first AU and/or the second AU. The role of the first AU and/or the second AU may be determined according to the first authorization request message. Then, the UDM server or network element may send a first authorization response message to the DDNMF function network element or the PKMF function network element of the first AU and/or the second AU, wherein the first authorization response message contains the role of the first AU and/or the second AU. From the above it follows that the invention proposes a method for authorizing a role for a first AU and/or a second AU in a service requested for discovery, wherein the role of the first AU and/or the second AU can be determined by a server or a UDM network element based on the capability of the first AU and/or the second AU and one or more roles acceptable for the first AU and/or the second AU in the service requested for discovery by the first AU and/or the second AU, which ensures the possibility of correct authorization of the role for the first AU and/or the second AU and the accuracy of service execution.

[0183] Fig. 8 is a flow chart of a method for authorizing a role for an AU according to one embodiment of the present invention. The method is performed by a server or a UDM. As can be seen in Fig. 8, the method for authorizing a role for an AU may include the following steps.

[0184] At step 801, a second authorization request message sent by the DDNMF network element or the PKMF network element of the first AU is received. The second authorization request message contains the role of the first AU, the role of the second AU, and the service requested to be discovered by these two AUs.

[0185] At step 802, it is determined whether the role of the first AU is related to the role of the second AU in the service requested to be discovered by these two AUs.

[0186] In step 803, a second authorization response message is sent to the DDNMF network element or the PKMF network element of the first AU. The second authorization response message is used to indicate whether the role of the first AU is related to the role of the second AU.

[0187] A detailed description of steps 801 - 803 can be found in the embodiments disclosed above.

[0188] Thus, according to the method for authorizing a role for an AU according to the embodiments of the proposed invention, the UDM server or network element may receive a first authorization request message sent by a DDNMF function network element or a PKMF function network element of a first AU and/or a second AU, wherein the first authorization request message serves to request an authorized role in a service requested to be discovered by the first AU and/or the second AU. The role of the first AU and/or the second AU may be determined according to the first authorization request message. Then, the UDM server or network element may send a first authorization response message to the DDNMF function network element or the PKMF function network element of the first AU and/or the second AU, wherein the first authorization response message contains the role of the first AU and/or the second AU. From the above it follows that the invention proposes a method for authorizing a role for a first AU and/or a second AU in a service requested for discovery, wherein the role of the first AU and/or the second AU can be determined by a server or a UDM network element based on the capability of the first AU and/or the second AU and one or more roles acceptable for the first AU and/or the second AU in the service requested for discovery by the first AU and/or the second AU, which ensures the possibility of correct authorization of the role for the first AU and/or the second AU and the accuracy of service execution.

[0189] Fig. 9 is a flow chart of a method for authorizing a role for an AU according to one embodiment of the present invention. The method is performed by the first AU. As can be seen in Fig. 9, the method for authorizing a role for an AU may include the following steps.

[0190] In step 901, a discovery request message is sent to the DDNMF network element or the PKMF network element of the first AU. The discovery request message is used to request an authorized role in the service requested to be discovered by the first AU.

[0191] At step 902, a discovery response message sent by a network element of the DDNMF function or a network element of the PKMF function of the first AU is received. The discovery response message contains the role of the first AU and the security tool corresponding to the service requested to be discovered by the first AU.

[0192] Thus, according to the method for authorizing a role for an AU according to embodiments of the proposed invention, the first AU may send a discovery request message to the DDNMF network element or the PKMF network element of the first AU. The discovery request message serves to request an authorized role in the service requested to be discovered by the first AU. The first AU may receive a discovery response message sent by the DDNMF network element or the PKMF network element of the first AU. The discovery response message contains the role of the first AU and a security measure corresponding to the service requested to be discovered by the first AU. From the above it follows that the invention proposes a method for authorizing a role in a service requested for discovery by a first AU, wherein the role of the first AU can be determined by a UDM server or network element based on the capability of the first AU and one or more roles allowed for the first AU in the service requested for discovery by the first AU, in order to ensure the possibility of correct authorization of the role for the first AU, as well as to ensure the accuracy of service execution. In addition, a security tool corresponding to the service requested for discovery by the first AU is sent to the first AU, wherein the security tool can serve to ensure protection during the subsequent process of discovery of another AU performed by the first AU, to prevent the possibility of an outside AU tracking the role of the first AU when the first AU transfers the role of the first AU in the subsequent discovery process and, thereby, to prevent the possibility of an outside AU performing the role of the first AU, impersonating it, preventing interference from an outside AU during the subsequent process of service execution, increasing the accuracy of service execution and enhancing information security.

[0193] Fig. 10 is a flow chart of a method for authorizing a role for an AU according to one embodiment of the present invention. The method is performed by the first AU. As can be seen in Fig. 10, the method for authorizing a role for an AU may include the following step.

[0194] At step 1001, a first discovery message is broadcast. The first discovery message is protected by a security means corresponding to a service requested to be discovered by the first AU, wherein the first discovery message contains a role of the first AU and an application code corresponding to the service requested to be discovered by the first AU.

[0195] In one embodiment of the proposed invention, the first UE will broadcast a first discovery message protected by a security mechanism corresponding to the service requested to be discovered by the first UE. Based on the fact that the security mechanism corresponding to the service requested to be discovered by the second UE is identical to the security mechanism corresponding to the service requested to be discovered by the first UE, the second UE can use the identical security mechanism to successfully verify the first discovery message broadcast by the first UE and, as a result, successfully discover each other with the first UE. The second UE can then check whether the role of the second UE matches the role of the first UE in order to subsequently verify that the connection is established with the first UE.

[0196] Thus, according to the method for authorizing a role for an AU according to embodiments of the proposed invention, the first AU may send a discovery request message to the DDNMF network element or the PKMF network element of the first AU. The discovery request message serves to request an authorized role in the service requested to be discovered by the first AU. The first AU may receive a discovery response message sent by the DDNMF network element or the PKMF network element of the first AU. The discovery response message contains the role of the first AU and a security measure corresponding to the service requested to be discovered by the first AU. From the above it follows that the invention proposes a method for authorizing a role in a service requested for discovery by a first AU, wherein the role of the first AU can be determined by a UDM server or network element based on the capability of the first AU and one or more roles allowed for the first AU in the service requested for discovery by the first AU, in order to ensure the possibility of correct authorization of the role for the first AU, as well as to ensure the accuracy of service execution. In addition, a security tool corresponding to the service requested for discovery by the first AU is sent to the first AU, wherein the security tool can serve to ensure protection during the subsequent process of discovery of another AU performed by the first AU, to prevent the possibility of an outside AU tracking the role of the first AU or an unauthorized change by it of the role of the first AU when the first AU transfers the role of the first AU in the subsequent discovery process and, thereby, to prevent the possibility of an outside AU performing the role of the first AU, impersonating it, preventing interference from an outside AU during the subsequent process of service execution, increasing the accuracy of service execution and enhancing information security.

[0197] Fig. 11 is a flow chart of a method for authorizing a role for an AU according to one embodiment of the present invention. The method is performed by the first AU. As can be seen in Fig. 11, the method for authorizing a role for an AU may include the following steps.

[0198] At step 1101, a second discovery message broadcast by a second AU is received. The second discovery message is protected by a security mechanism corresponding to the service requested to be discovered by the second AU, wherein the second discovery message contains a role of the second AU and an application code corresponding to the service requested to be discovered by the second AU.

[0199] At step 1102, the second discovery message is decoded and verified based on the security means corresponding to the service requested to be discovered by the second AU and, if the verification is successful, it is determined whether the application code corresponding to the service requested to be discovered by the second AU matches the application code corresponding to the service requested to be discovered by the first AU, and, if they match, it is determined whether the role of the second AU is related to the role of the first AU.

[0200] The principle of using the security means for verifying the second discovery message by the first AU can be learned from the description of the embodiments disclosed above. If the application code corresponding to the service requested to be discovered by the second AU matches the application code corresponding to the service requested to be discovered by the first AU, this indicates that the services requested to be discovered by these two AUs are the same service. In this case, it can then be determined whether the roles of these two AUs correspond to each other. If they correspond, this indicates that these two AUs can cooperate to execute the service requested to be discovered by these two AUs. If they do not correspond, this indicates that these two AUs cannot execute the service requested to be discovered by these two AUs.

[0201] At step 1103, a first response message is sent to a second AU in the case where the role of the first AU is related to the role of the second AU. The first response message is protected by a security means corresponding to the service requested to be discovered by the first AU, wherein the first response message contains the role of the first AU and an application code corresponding to the service requested to be discovered by the first AU.

[0202] The steps 1101-1103 disclosed above constitute a process of discovering a first AU and a second AU. After these two AUs discover each other, they can establish a connection to implement a service.

[0203] Thus, according to the method for authorizing a role for an AU according to embodiments of the proposed invention, the first AU may send a discovery request message to the DDNMF network element or the PKMF network element of the first AU. The discovery request message is used to request an authorized role in the service requested to be discovered by the first AU. The first AU may receive a discovery response message sent by the DDNMF network element or the PKMF network element of the first AU. The discovery response message contains the role of the first AU and a security measure corresponding to the service requested to be discovered by the first AU. From the above it follows that the invention proposes a method for authorizing a role in a service requested for discovery by a first AU, wherein the role of the first AU can be determined by a UDM server or network element based on the capability of the first AU and one or more roles allowed for the first AU in the service requested for discovery by the first AU, in order to ensure the possibility of correct authorization of the role for the first AU, as well as to ensure the accuracy of service execution. In addition, a security tool corresponding to the service requested for discovery by the first AU is sent to the first AU, wherein the security tool can serve to ensure protection during the subsequent process of discovery of another AU performed by the first AU, to prevent the possibility of an outside AU tracking the role of the first AU when the first AU transfers the role of the first AU in the subsequent discovery process and, thereby, to prevent the possibility of an outside AU performing the role of the first AU, impersonating it, preventing interference from an outside AU during the subsequent process of service execution, increasing the accuracy of service execution and enhancing information security.

[0204] Fig. 12 is a flow chart of a method for authorizing a role for an AU according to one embodiment of the present invention. The method is performed by a second AU. As can be seen in Fig. 12, the method for authorizing a role for an AU may include the following steps.

[0205] At step 1201, a discovery request message is sent to the DDNMF network element or the PKMF network element of the second AU. The discovery request message is used to request an authorized role in the service requested for discovery by the second AU.

[0206] At step 1202, a discovery response message sent by a network element of the DDNMF function or a network element of the PKMF function of the second AU is received. The discovery response message contains the role of the second AU and the security means corresponding to the service requested for discovery by the second AU.

[0207] Thus, according to the method for authorizing a role for an AU according to embodiments of the proposed invention, a second AU may send a discovery request message to a DDNMF function network element or a PKMF function network element of the second AU. The discovery request message is used to request an authorized role in a service requested to be discovered by the second AU. The second AU may receive a discovery response message sent by the DDNMF function network element or the PKMF function network element of the second AU. The discovery response message contains the role of the second AU and a security measure corresponding to the service requested to be discovered by the second AU. From the above, it follows that the invention proposes a method for authorizing a role in a service requested for discovery by a second AU, wherein the role of the second AU can be determined by a UDM server or network element based on the capability of the second AU and one or more roles permitted for the second AU in the service requested for discovery by the second AU, in order to ensure the possibility of correct role authorization for the second AU, as well as to ensure the accuracy of service execution. Furthermore, a security tool corresponding to the service requested for discovery by the second AU is sent to the second AU, wherein the security tool can serve to successfully verify the information transmitted by the first AU during the discovery process, based on an identical security tool during discovery, which ensures the possibility of successful mutual discovery by these two AUs and the successful execution of the service requested for discovery by these two AUs. The inability of other AUs to learn the security tool prevents interference from unauthorized AUs during subsequent service execution, thereby increasing the accuracy of service execution and strengthening information security.

[0208] Fig. 13 is a flow chart of a method for authorizing a role for an AU according to one embodiment of the present invention. The method is performed by a second AU. As can be seen in Fig. 13, the method for authorizing a role for an AU may include the following steps.

[0209] At step 1301, a first discovery message broadcast by a first AU is received. The first discovery message is protected by a security mechanism corresponding to a service requested to be discovered by the first AU, wherein the first discovery message contains a role of the first AU and an application code corresponding to the service requested to be discovered by the first AU.

[0210] At step 1302, the first discovery message is decoded and verified based on the security means corresponding to the service requested to be discovered by the second AU and, if the verification is successful, it is determined whether the application code corresponding to the service requested to be discovered by the first AU matches the application code corresponding to the service requested to be discovered by the second AU, and, if they match, it is determined whether the role of the second AU is related to the role of the first AU.

[0211] Thus, according to the method for authorizing a role for an AU according to embodiments of the proposed invention, a second AU may send a discovery request message to a DDNMF function network element or a PKMF function network element of the second AU. The discovery request message is used to request an authorized role in a service requested to be discovered by the second AU. The second AU may receive a discovery response message sent by the DDNMF function network element or the PKMF function network element of the second AU. The discovery response message contains the role of the second AU and a security measure corresponding to the service requested to be discovered by the second AU. From the above, it follows that the invention proposes a method for authorizing a role in a service requested for discovery by a second AU, wherein the role of the second AU can be determined by a UDM server or network element based on the capability of the second AU and one or more roles permitted for the second AU in the service requested for discovery by the second AU, in order to ensure the possibility of correct role authorization for the second AU, as well as to ensure the accuracy of service execution. Furthermore, a security tool corresponding to the service requested for discovery by the second AU is sent to the second AU, wherein the security tool can serve to successfully verify the information transmitted by the first AU during the discovery process, based on an identical security tool during discovery, which ensures the possibility of successful mutual discovery by these two AUs and the successful execution of the service requested for discovery by these two AUs. The inability of other AUs to learn the security tool prevents interference from unauthorized AUs during subsequent service execution, thereby increasing the accuracy of service execution and strengthening information security.

[0212] Fig. 14 is a flow chart of a method for authorizing a role for an AU according to one embodiment of the present invention. The method is performed by a second AU. As can be seen in Fig. 14, the method for authorizing a role for an AU may include the following steps.

[0213] At step 1401, a second discovery message is broadcast. The second discovery message is protected by a security mechanism corresponding to the service requested to be discovered by the second AU, wherein the second discovery message contains a role of the second AU and an application code corresponding to the service requested to be discovered by the second AU.

[0214] At step 1402, a first response message sent by a first AU is received. The first response message is protected by a security mechanism corresponding to the service requested to be discovered by the first AU, wherein the first response message contains a role of the first AU and an application code corresponding to the service requested to be discovered by the first AU.

[0215] Thus, according to the method for authorizing a role for an AU according to embodiments of the proposed invention, a second AU may send a discovery request message to a DDNMF function network element or a PKMF function network element of the second AU. The discovery request message serves to request an authorized role in a service requested to be discovered by the second AU. The second AU may receive a discovery response message sent by the DDNMF function network element or the PKMF function network element of the second AU. The discovery response message contains the role of the second AU and a security measure corresponding to the service requested to be discovered by the second AU. From the above, it follows that the invention proposes a method for authorizing a role in a service requested for discovery by a second AU, wherein the role of the second AU can be determined by a UDM server or network element based on the capability of the second AU and one or more roles permitted for the second AU in the service requested for discovery by the second AU, in order to ensure the possibility of correct role authorization for the second AU, as well as to ensure the accuracy of service execution. Furthermore, a security tool corresponding to the service requested for discovery by the second AU is sent to the second AU, wherein the security tool can serve to successfully verify the information transmitted by the first AU during the discovery process, based on an identical security tool during discovery, which ensures the possibility of successful mutual discovery by these two AUs and the successful execution of the service requested for discovery by these two AUs. The inability of other AUs to learn the security tool prevents interference from unauthorized AUs during subsequent service execution, thereby increasing the accuracy of service execution and strengthening information security.

[0216] Fig. 15 is a sequence of interactions of a method for authorizing a role for an AU according to one embodiment of the proposed invention. As can be seen in Fig. 15, the method includes the following steps.

[0217] 1. The A-AU (which may be the first AU in the embodiments disclosed above) sends a discovery request message containing the RAUID to its DDNMF/PKMF function of the 5G network to obtain the ranging application code in order to report it and obtain the corresponding protection means. In addition, the A-AU must include its AU capability with respect to the ranging service (i.e., the “capability of the first AU” in the embodiments disclosed above, for example, the capability to act as a target AU/AU server) in the discovery request message.

[0218] 2. The DDNMF/PKMF function of the 5G network of the A-AU sends a first authorization request message to the ranging/location server via the SL or UDM of the A-AU for an authorization message containing the capability of the AU regarding the ranging service received from the A-AU.

[0219] 3. The SL Ranging/Location Server verifies, in accordance with the service agreement, or the A-AU UDM verifies, in accordance with the A-AU subscription, whether the given A-AU is permitted to perform one or more roles corresponding to its capability (for example, whether the A-AU can act as a target AU/AU server).

[0220] 4. If there is a match between the AU capability and one or more valid roles (e.g., the A-AU can act as a target AU or the A-AU can act as both a target AU and an AU server), the SL or UDM ranging/location server of the A-AU responds with a first authorization response message containing the role of the A-AU, the DDNMF function/PKMF function of the 5G network. If there is no match between the AU capability and one or more valid roles (e.g., the A-AU cannot act as either a target AU or an AU server), the SL or UDM ranging/location server of the A-AU responds with a first authorization response message containing the cause of the failure.

[0221] 5. If the A-AU is successfully authorized by the SL or UDM ranging/location server, the 5G DDNMF/PKMF function of the A-AU responds with a ranging application code and a corresponding security measure in a discovery response message. The security measure provides the A-AU with the necessary information to protect the transmission of the ranging application code and is stored together with the ranging application code. The 5G DDNMF/PKMF function of the A-AU also contains one or more A-AU roles received from the SL or UDM ranging/location server of the A-AU in the discovery response message. If the A-AU is not authorized by the SL or UDM ranging/location server, the 5G DDNMF/PKMF function of the A-AU does not generate a security measure and rejects the discovery request from the A-AU.

[0222] 6. The M-AU (which may be the second AU in the embodiments disclosed above) sends a discovery request message containing the RAUID to its DDNMF/PKMF of the 5G network to obtain the ranging application code in order to report it and obtain the corresponding protection means. In addition, the M-AU must include its AU capability with respect to the ranging service (i.e., the “second AU capability” in the embodiments disclosed above, for example, the capability to act as a reference/discovered AU) in the discovery request message.

[0223] 7. The DDNMF/PKMF function of the 5G network of the M-AU sends to the ranging/location server via the SL or UDM of the M-AU a first authorization request message containing the capability of the AU for the ranging service received from the M-AU.

[0224] 8. The SL Ranging/Location Server checks the service agreement or the M-AU UDM checks the M-AU subscription to determine whether the M-AU can perform a role consistent with its capability (e.g., whether the M-AU can act as a reference/discoverable AU).

[0225] 9. If there is a match between the AU capability and one or more valid roles (for example, the M-AU can act as an anchor AU or the A-AU can act as both an anchor AU and a discoverable AU), the M-AU SL or UDM ranging/location server responds to the 5G network DDNMF/PKMF function with a first authorization response message containing the M-AU role. If there is no match between the AU capability and one or more valid roles (for example, the M-AU cannot act as either an anchor AU or a discoverable AU), the M-AU SL or UDM ranging/location server responds with a first authorization response message containing the failure reason.

[0226] 10. If the A-AU is successfully authorized by the SL or UDM ranging/location server, the 5G DDNMF/PKMF of the M-AU establishes contact with the 5G DDNMF/PKMF of the A-AU by sending a control request message. If the A-AU is not authorized by the SL or UDM ranging/location server, the 5G DDNMF/PKMF of the M-AU rejects the M-AU discovery request and does not perform the following steps.

[0227] 11. The 5G A-AU DDNMF/PKMF sends a second authorization request message to the SL ranging/location server containing the M-AU and A-AU roles.

[0228] 12. The SL ranging/location server checks whether the roles of the M-AU and the A-AU in the requested service are related to each other (e.g., for the ranging service between two AUs, whether the roles of these two AUs are the target AU and the reference AU, respectively, or whether they are the detected AU and the target AU, respectively. If so, they are used in the SL ranging/location service between these two AUs).

[0229] 13. The SL ranging/location server responds with a second authorization response message indicating whether the authorization was successful.

[0230] 14. In case of successful authorization by the ranging/location server over the SL, the 5G DDNMF/PKMF function of the A-AU responds to the 5G DDNMF/PKMF function of the M-AU with a control response message containing the ranging application code and the corresponding security measure (the security measure is identical to the security measure sent by the A-AU via feedback). The security measure provides the information necessary for the M-AU to cancel the security measure applied by the A-AU (i.e., the information necessary to verify the message transmitted from the A-AU). If the SL ranging/location server fails to authorize, the 5G A-AU DDNMF/PKMF function rejects the control request message from the 5G M-AU DDNMF/PKMF function and does not perform the following steps.

[0231] 15. The DDNMF/PKMF function of the 5G M-AU network responds with a security feature in a discovery response message, as well as the M-AU role received from the ranging/location server over the SL or UDM of the M-AU.

[0232] 16. The A-AU initiates the first discovery message message. The A-AU generates the first discovery message and protects it with a security mechanism. The first discovery message additionally contains the authorized role of the A-AU.

[0233] 17. The M-AU listens for the first detection message and verifies the message using the security tool.

[0234] 18. The M-AU checks the role of the A-AU in the first discovery message and determines whether the role of the A-AU checked in the first discovery message is the role it is monitoring. For example, if the role of the A-AU is the target AU, the M-AU, as a reference AU, may determine that it has found an object that matches it.

[0235] Fig. 16 is a sequence of interactions of a method for authorizing a role for an AU according to one embodiment of the proposed invention. As can be seen in Fig. 16, the method includes the following steps.

[0236] Steps 1-15 of the embodiment of Fig. 16 are identical to steps 1-15 of Fig. 15. The R-AU in Fig. 16 may be the second AU discussed above, and the E-AU may be the first AU discussed above.

[0237] 16. The R-AU generates a second discovery message and protects it with a security tool. The second discovery message additionally contains the R-AU role.

[0238] 17. The E-AU listens for the second discovery message and verifies the second discovery message using the security mechanism. The E-AU then checks the role of the R-AU in the second discovery message and determines whether the role of the R-AU in the second discovery message matches the role of the E-AU. If the role of the R-AU is the target AU, the E-AU, as the AU being discovered, can determine that it has found an object that matches it.

[0239] 18. E-AU sends to R-AU in response the first response message containing the role of R-AU.

[0240] Fig. 17 is a block diagram of a communication device according to one embodiment of the proposed invention. As can be seen in Fig. 17, the communication device comprises: a transmitting and receiving module configured to: receive a discovery request message sent by a first AU and/or a second AU, wherein the discovery request message serves to request an authorized role for the first AU and/or the second AU; and send a discovery response message to the first AU and/or the second AU, wherein the discovery response message contains a role determined by the network device for the first AU and/or the second AU.

[0241] Thus, when using a communication device according to embodiments of the proposed invention, a network device receives a discovery request message sent by a first AU and/or a second AU, wherein the discovery request message serves to request an authorized role for the first AU and/or the second AU. The network device sends a discovery response message to the first AU and/or the second AU, wherein the discovery response message contains a role determined by the network device for the first AU and/or the second AU. From the above it follows that the invention provides a method for authorizing a role for an AU in a service requested by the AU to be discovered, wherein the role of the AU can be determined by the network device based on the capability of the AU and the contract information of the AU in order to ensure correct authorization of the role for the AU, as well as to ensure the accuracy of the service execution. In addition, the subscriber device is sent a security tool corresponding to the service requested by the AU for detection, wherein the security tool can serve to ensure protection during the subsequent process of detection by the subscriber device of another AU, to prevent the possibility of tracking by an outside AU the role of this AU or an unauthorized change by it of the role of this AU when this AU transmits its role to it in the subsequent detection process and, thereby, to prevent an outside AU from performing the role of this AU, impersonating it, to prevent interference by an outside AU during the subsequent process of service execution, to increase the accuracy of service execution and to strengthen the protection of information.

[0242] In one embodiment of the present invention, the discovery request message optionally comprises at least one of: a ranging application user identifier (RAUID); a service identifier; or a capability of the first AU and/or the second AU.

[0243] In one embodiment of the proposed invention, the device is optionally further configured to determine the role of the first AU and/or the second AU based on the capability of the first AU and/or the second AU and contract information of the first AU and/or the second AU stored in the network device.

[0244] In one embodiment of the proposed invention, the discovery response message optionally further comprises a security measure generated by the network device for the service requested to be discovered by the first AU and/or the second AU. The security measure corresponding to the service requested to be discovered by the first AU is identical to the security measure corresponding to the service requested to be discovered by the second AU.

[0245] In one embodiment of the present invention, the service is not necessarily a ranging service and/or a lateral link positioning service.

[0246] In one embodiment of the proposed invention, the network device optionally comprises: a first network element, a second network element, and a third network element. The first network element is a direct discovery name management function (DDNMF) network element of the first AS or a key management function (PKMF) network element of the first AS, the second network element is a DDNMF network element of the second AS or a PKMF network element of the second AS, and the third network element is a proximity service server or a unified data management (UDM) network element.

[0247] In one optional embodiment of the proposed invention, a first network element receives a discovery request message sent by a first AU. The first network element sends a discovery response message to the first AU. The first network element sends a first authorization request message to a third network element, and the third network element sends a first authorization response message to the first network element. The first authorization response message contains the role of the first AU determined by the third network element.

[0248] In one optional embodiment of the proposed invention, a second network element receives a discovery request message sent by a second AU. The second network element sends a discovery response message to the second AU. The second network element sends a first authorization request message to a third network element, and the third network element sends a first authorization response message to the second network element. The first authorization response message contains the role of the second AU determined by the third network element.

[0249] In one optional embodiment of the invention, the second network element sends a control request message to the first network element. The control request message contains the role of the second AU, wherein the control request message is used to request a determination of whether the role of the second AU is related to the role of the first AU. The first network element sends a second authorization request message to a third network element. The second authorization response message contains the role of the first AU and the role of the second AU. The third network element determines whether the role of the second AU is related to the role of the first AU and sends a second authorization response message to the first network element. The second authorization response message is used to indicate whether the role of the first AU is related to the role of the second AU in the service requested to be discovered by these two AUs. In the case where the role of the first AU is related to the role of the second AU, the first network element sends to the second network element a security tool generated depending on the service requested for discovery by the second AU.

[0250] Fig. 18 is a block diagram of a communication device according to one embodiment of the proposed invention. As can be seen in Fig. 18, the communication device comprises: a transmitting and receiving module configured to: send a discovery request message to a network device, wherein the discovery request message serves to request an authorized role for a first AU; and receive a discovery response message sent by the network device, wherein the discovery response message contains a role determined by the network device for the first AU.

[0251] Thus, when using a communication device according to embodiments of the proposed invention, a first AU can send a discovery request message to a network device. The discovery request message serves to request an authorized role for the first AU. The first AU can receive a discovery response message sent by the network device. The discovery response message contains a role determined by the network device for the first AU. From the above, it follows that the invention proposes a method for authorizing a role for an AU in a service requested by the AU to be discovered, wherein the AU role can be determined by the network device based on the AU capability and the AU contract information in order to ensure correct authorization of the role for the AU and also to ensure the accuracy of service execution. In addition, the subscriber device is sent a security tool corresponding to the service requested by the AU for detection, wherein the security tool can serve to ensure protection during the subsequent process of detection by the subscriber device of another AU, to prevent the possibility of tracking by an outside AU the role of this AU or an unauthorized change by it of the role of this AU when this AU transmits its role to it in the subsequent detection process and, thereby, to prevent an outside AU from performing the role of this AU, impersonating it, to prevent interference by an outside AU during the subsequent process of service execution, to increase the accuracy of service execution and to strengthen the protection of information.

[0252] In one embodiment of the proposed invention, the device is optionally further configured to broadcast a first discovery message. The first discovery message is protected by a security means corresponding to the service requested to be discovered by the first AU, wherein the first discovery message contains the role of the first AU.

[0253] In one embodiment of the proposed invention, the device is optionally further configured to receive a second discovery message broadcast by a second AU, wherein the second discovery message is protected by a security means corresponding to a service requested to be discovered by the second AU, wherein the second discovery message contains a role of the second AU; decoding and verifying the second discovery message and determining whether the role of the second AU corresponds to the role of the first AU in case of successful verification; and sending a first response message to the second AU in case when the role of the first AU corresponds to the role of the second AU, wherein the first response message is protected by a security means corresponding to the service requested to be discovered by the first AU, wherein the first response message contains the role of the first AU.

[0254] Fig. 19 is a block diagram of a communication device according to one embodiment of the proposed invention. As can be seen in Fig. 19, the communication device comprises: a transmitting and receiving module configured to: send a discovery request message to a network device, wherein the discovery request message serves to request an authorized role for a second AU; and receive a discovery response message sent by the network device, wherein the discovery response message contains a role determined by the network device for the second AU.

[0255] Thus, when using a communication device according to embodiments of the proposed invention, a second AU can send a discovery request message to a network device. The discovery request message serves to request an authorized role for the second AU. The second AU can receive a discovery response message sent by the network device. The discovery response message contains a role determined by the network device for the second AU. From the above, it follows that the invention proposes a method for authorizing a role for an AU in a service requested by the AU to be discovered, wherein the AU role can be determined by the network device based on the AU capability and the AU contract information in order to ensure correct authorization of the role for the AU and also to ensure the accuracy of service execution. In addition, the subscriber device is sent a security tool corresponding to the service requested by the AU for detection, wherein the security tool can serve to ensure protection during the subsequent process of detection by the subscriber device of another AU, to prevent the possibility of tracking by an outside AU the role of this AU or an unauthorized change by it of the role of this AU when this AU transmits its role to it in the subsequent detection process and, thereby, to prevent an outside AU from performing the role of this AU, impersonating it, to prevent interference by an outside AU during the subsequent process of service execution, to increase the accuracy of service execution and to strengthen the protection of information.

[0256] In one embodiment of the proposed invention, the device is optionally further configured to: receive a first discovery message broadcast by a first AU, wherein the first discovery message is protected by a security means corresponding to a service requested to be discovered by the first AU, wherein the first discovery message comprises a role of the first AU; and decoding and verifying the first discovery message, and determining whether the role of the second AU corresponds to the role of the first AU in case of successful verification.

[0257] In one embodiment of the proposed invention, the device is optionally further configured to: broadcast a second discovery message, wherein the second discovery message is protected by a security means corresponding to the service requested to be discovered by the second AU, wherein the second discovery message comprises the role of the second AU; and receive a first response message sent by the first AU, wherein the first response message is protected by a security means corresponding to the service requested to be discovered by the first AU, wherein the first response message comprises the role of the first AU.

[0258] Fig. 20 is a block diagram of a communication device according to one embodiment of the proposed invention. As can be seen in Fig. 20, the communication device comprises: a transmitting and receiving module configured to: receive a discovery request message sent by a first AU, wherein the discovery request message serves to request an authorized role in a service requested to be discovered by the first AU; send a first authorization request message to a unified data management (UDM) server or network element according to the discovery request message; receive a first authorization response message sent by the UDM server or network element, wherein the first authorization response message contains a role of the first AU determined by the UDM server or network element; and send a discovery response message to the first AU, wherein the discovery response message contains the role of the first AU.

[0259] Thus, when using the communication device according to the embodiments of the proposed invention, the DDNMF network element or the PKMF network element of the first AU may receive a discovery request message sent by the first AU. The discovery request message serves to request an authorized role in the service requested to be discovered by the first AU. Then, the DDNMF network element or the PKMF network element of the first AU may send a first authorization request message to the UDM server or network element according to the discovery request message and receive a first authorization response message sent by the UDM server or network element. The first authorization response message contains the role of the first AU determined by the UDM server or network element. Finally, the DDNMF network element or the PKMF network element of the first AU may send a discovery response message to the first AU. The discovery response message contains the role of the first AU and the security feature generated by the DDNMF network element or the PKMF network element of the first AU for the service requested for discovery by the first AU. From the above, it follows that the invention proposes a method for authorizing a role in a service requested for discovery by the first AU, wherein the role of the first AU can be determined by the UDM server or network element based on the capability of the first AU and one or more roles allowed for the first AU in the service requested for discovery by the first AU, in order to ensure the correct authorization of the role for the first AU and to ensure the accuracy of service execution. In addition, the first AU is sent a security tool corresponding to the service requested for detection by the first AU, wherein the security tool can serve to ensure protection during the subsequent process of detection of another AU performed by the first AU, to prevent the possibility of an outside AU tracking the role of the first AU or an unauthorized change by it of the role of the first AU when the first AU transfers the role of the first AU in the subsequent detection process and, thereby, to prevent the possibility of an outside AU performing the role of the first AU, impersonating it, to prevent interference from an outside AU during the subsequent process of service execution, to increase the accuracy of service execution and to strengthen the protection of information.

[0260] In one of the optional embodiments of the proposed invention, the transmitting and receiving module is further configured to: convert a RAUID corresponding to the first AU into a first identifier that can be recognized by the UDM server or network element, wherein the first identifier serves to indicate the first AU; and send a first authorization request message containing at least one of the first identifier, the service requested to be discovered by the first AU, or the capability of the first AU, to the UDM server or network element.

[0261] Fig. 21a is a block diagram of a communication device according to one embodiment of the proposed invention. As can be seen in Fig. 21a, the communication device comprises: a transmitting and receiving module configured to: receive a discovery request message sent by a second AU, wherein the discovery request message serves to request an authorized role in a service requested to be discovered by the second AU, send a first authorization request message to a unified data management (UDM) server or network element according to the discovery request message, receive a first authorization response message sent by the UDM server or network element, wherein the first authorization response message contains a role of the second AU determined by the UDM server or network element; and a processing module configured to determine a security means corresponding to the service requested to be discovered by the second AU. The transmitting and receiving module is further configured to send a detection response message to the second AU, wherein the detection response message contains the role of the second AU.

[0262] Thus, when using the communication device according to the embodiments of the proposed invention, the DDNMF function network element or the PKMF function network element of the second AU can receive a discovery request message sent by the second AU. The discovery request message serves to request an authorized role in the service requested to be discovered by the second AU. Then, the DDNMF function network element or the PKMF function network element of the second AU can send a first authorization request message to the UDM server or network element according to the discovery request message and receive a first authorization response message sent by the UDM server or network element. The first authorization response message contains the role of the second AU determined by the UDM server or network element. The DDNMF function network element or the PKMF function network element of the second AU can determine the generated security means corresponding to the service requested to be discovered by the second AU. Finally, the DDNMF network element or the PKMF network element of the second AU may send a discovery response message to the second AU. The discovery response message contains the role of the second AU and a security feature corresponding to the service requested for discovery by the second AU. From the above, it follows that the invention proposes a method for authorizing a role in a service requested for discovery by a second AU, wherein the role of the second AU can be determined by a UDM server or network element based on the capability of the second AU and one or more roles allowed for the second AU in the service requested for discovery by the second AU, in order to ensure the correct authorization of the role for the second AU and to ensure the accuracy of service execution. In addition, the second AU is sent a security tool corresponding to the service requested for discovery by the second AU. This security tool can be used to successfully verify the information transmitted by the first AU during the discovery process, based on an identical security tool during discovery. This ensures the ability of these two AUs to successfully discover each other and successfully execute the service requested for discovery by these two AUs. The inability of other AUs to learn the security tool prevents interference by unauthorized AUs during subsequent service execution, thereby increasing the accuracy of service execution and strengthening information security.

[0263] In one of the optional embodiments of the proposed invention, the transmitting and receiving module is further configured to: convert the RAUID corresponding to the second AU into a second identifier that can be recognized by the UDM server or network element, wherein the second identifier serves to indicate the second AU; and send an authorization request message containing at least one of the second identifier, the service requested to be discovered by the second AU, or the capability of the second AU, to the UDM server or network element.

[0264] In one embodiment of the proposed invention, the device is optionally further configured to: send a control response message to the network element of the DDNMF function or the network element of the PKMF function of the first AU, wherein the control response message contains the role of the second AU, wherein the control response message serves to request a determination of whether the role of the second AU corresponds to the role of the first AU; and receive a control response message sent by the network element of the DDNMF function or the network element of the PKMF function of the first AU, wherein the control response message contains a security means corresponding to the service requested to be discovered by the second AU, wherein the security means corresponding to the service requested to be discovered by the second AU is identical to the security means corresponding to the service requested to be discovered by the first AU.

[0265] Fig. 21b is a block diagram of a communication device according to one embodiment of the proposed invention. As can be seen in Fig. 21b, the communication device comprises: a transmitting and receiving module configured to receive a first authorization request message sent by a network element of the DDNMF function or a network element of the PKMF function of the first AU and/or the second AU, wherein the first authorization request message serves to request an authorized role in a service requested to be discovered by the first AU and/or the second AU; and a processing module configured to determine the role of the first AU and/or the second AU according to the first authorization request message. The transmitting and receiving module is additionally configured to send a first authorization response message to the network element of the DDNMF function or the network element of the PKMF function of the first AU and/or the second AU, wherein the first authorization response message contains the role of the first AU and/or the second AU.

[0266] Thus, when using a communication device according to embodiments of the proposed invention, the UDM server or network element may receive a first authorization request message sent by a DDNMF function network element or a PKMF function network element of a first AU and/or a second AU, wherein the first authorization request message serves to request an authorized role in a service requested to be discovered by the first AU and/or the second AU. The role of the first AU and/or the second AU may be determined according to the first authorization request message. Then, the UDM server or network element may send a first authorization response message to the DDNMF function network element or the PKMF function network element of the first AU and/or the second AU, wherein the first authorization response message contains the role of the first AU and/or the second AU. From the above it follows that the invention proposes a method for authorizing a role for a first AU and/or a second AU in a service requested for discovery, wherein the role of the first AU and/or the second AU can be determined by a server or a UDM network element based on the capability of the first AU and/or the second AU and one or more roles acceptable for the first AU and/or the second AU in the service requested for discovery by the first AU and/or the second AU, which ensures the possibility of correct authorization of the role for the first AU and/or the second AU and the accuracy of service execution.

[0267] In one of the optional embodiments of the proposed invention, the processing module is further configured to determine, based on contract information of the first AU and/or the second AU, a role that is allowed for the first AU and/or the second AU in the service that is requested to be discovered by the first AU and/or the second AU; and to determine, from among the roles that are allowed for the first AU and/or the second AU, a role supported by the capability of the first AU and/or the second AU, as a role of the first AU and/or the second AU.

[0268] In one embodiment of the proposed invention, the device is optionally further configured to receive a second authorization request message sent by a network element of the DDNMF function or a network element of the PKMF function of the first AU, wherein the second authorization request message contains a role of the first AU, a role of the second AU and a service requested to be discovered by these two AUs; determine whether the role of the first AU is related to the role of the second AU in the service requested to be discovered by these two AUs; and send a second authorization response message to the network element of the DDNMF function or the network element of the PKMF function of the first AU, wherein the second authorization response message serves to indicate whether the role of the first AU is related to the role of the second AU.

[0269] Fig. 22 is a block diagram of a communication system according to one embodiment of the proposed invention. As can be seen in Fig. 22, the communication system may include: a first AU configured to send a discovery request message; a second AU configured to send a discovery request message; a network device configured to send a discovery response message, wherein the discovery response message contains a role determined by the network device for the first AU and/or the second AU. The first AU, in turn, is configured to receive the discovery response message, wherein the discovery response message contains a role determined by the network device for the first AU. The second AU, in turn, is configured to receive the discovery response message, wherein the discovery response message contains a role determined by the network device for the second AU.

[0270] Let us consider Fig. 23 - a block diagram of a communication device 2300 according to one of the embodiments of the proposed invention, wherein the communication device 2300 can be a base station, as well as an end device, as well as a microcircuit, integrated system or processor that provides the ability to implement the above-disclosed methods by the base station, and it can also be a microcircuit, integrated system or processor that provides the ability to implement the above-disclosed methods by the end device. The device can be configured to implement the methods according to the above-disclosed embodiments of the methods, in the description of which information about it can be found.

[0271] The communication device 2300 may comprise at least one processor 2301. The processor 2301 may be a general-purpose processor or a special-purpose processor. For example, the processor 2301 may be a baseband processor or a central processor. The baseband processor is configured to process a communication protocol and communication data, and the central processor is configured to control the communication device (in particular, a base station, a radio modem chip, an end device, an end device chip, a distributed unit (DU), a central unit (CU), or the like), execute computer programs, and process computer program data.

[0272] The communication device 2300 may optionally further comprise at least one memory device 2302 with a computer program 2304 stored therein. The processor 2301 executes the computer program 2304, thereby causing the communication device 2300 to implement the methods according to the embodiments of the methods disclosed above. If necessary, the memory device 2302 may contain data stored therein. The communication device 2300 and the memory device 2302 may be installed separately or implemented integrally with each other.

[0273] If necessary, the communication device 2300 may further comprise a transceiver 2305 and an antenna 2306. The transceiver 2305 may be referred to as a "transceiver element," "transceiver apparatus," "transceiver circuit," and the like, for implementing a receiving and transmitting function. The transceiver 2305 may comprise a receiver and a transmitter. The receiver may be referred to as a "receiving apparatus," "receiving circuit," and the like, for implementing a receiving function. The transmitter may be referred to as a "transmitting apparatus," "transmitting circuit," and the like, for implementing a sending function.

[0274] If necessary, the communication device 2300 may further comprise at least one interface circuit 2307. The interface circuit 2307 is configured to receive a code instruction and transmit this code instruction to the processor 2301. The processor 2301 executes the code instruction, which results in the communication device 2300 performing the methods according to the embodiments of the methods disclosed above.

[0275] In one embodiment, the processor 2301 may comprise a transceiver configured to implement receiving and sending functions. For example, the transceiver may be a transceiver circuit, an interface, or an interface circuit. The transceiver circuit, interface, or interface circuit configured to implement receiving and sending functions may be separate or integral with one another. The aforementioned transceiver circuit, interface, or interface circuit may be configured to read or write codes/data, or to send or transmit signals.

[0276] In one embodiment, the processor 2301 may contain a computer program 2303 stored therein, the result of which, when run in the processor 2301, is the implementation by the communication device 2300 of the methods according to the embodiments of the methods disclosed above. The computer program 2303 may be programmed into the processor 2301, in which case the processor 2301 may be implemented in hardware.

[0277] In one embodiment, the communication device 2300 may comprise a circuit, wherein the circuit is configured to implement the sending, receiving, or communication function according to the embodiments of the method disclosed above. The processor and transceiver in the proposed invention may be implemented based on an integrated circuit (IC), an analog IC, a radio-frequency integrated circuit (RFIC), a combined IC, an application-specific integrated circuit (ASIC), a printed circuit board (PCB), an electronic device, etc. The processor and transceiver can be manufactured using a variety of IC technologies, in particular, based on the complementary metal-oxide-semiconductor (CMOS) structure, N-channel metal-oxide-semiconductor (N-MOS), P-channel metal-oxide-semiconductor (P-MOS), bipolar junction transistor (BJT), bipolar CMOS (BiCMOS), silicon germanium alloy (SiGe), gallium arsenide (GaAs), etc.

[0278] The communication device in the embodiments disclosed above may be a base station or a terminal device, and the scope of protection of the communication device according to the proposed invention is not limited thereto, just as the structure of the communication device may not be limited to that shown in Fig. 23. The communication device may be a separate device or be part of a larger device. For example, the communication device may be: (1) a separate integrated circuit (IC), a microcircuit, an integrated system or a subsystem; (2) a set of one or more ICs, wherein the set of ICs may, if necessary, additionally include a storage component for storing data and computer programs therein; (3) an ASIC, in particular a modem; (4) a module that can be built into other devices; (5) a receiver, a terminal device, an intelligent terminal device, a cellular telephone, a wireless device, a portable installation, a mobile object, a vehicle-mounted device, a network device, a cloud device, a device with artificial intelligence, etc.; (6) other devices.

[0279] A possible case in which the communication device is a microcircuit or an integrated system is illustrated in the circuit diagram of the microcircuit in Fig. 24. The microcircuit in Fig. 24 comprises a processor 2401 and an interface 2402. In the microcircuit, the number of processors 2401 may be one or more, while there may be several interfaces 2402.

[0280] If necessary, the microcircuit additionally contains a storage device 2403 for storing the necessary computer programs and data in it.

[0281] Those skilled in the art will also understand that the various illustrative logical blocks and steps listed in the embodiments of the proposed invention may be implemented using electronic hardware, computer software, or a combination of both. Whether such functions are implemented using hardware or software depends on the specific application and the design requirements of the system as a whole. For each specific application, those skilled in the art may use a variety of methods to implement the disclosed functions, and such implementation should not be considered a departure from the scope of protection of the embodiments of the proposed invention.

[0282] Furthermore, the present invention provides a readable data carrier with instructions stored therein, the result of the execution of which by the computer is the implementation of functions according to any of the embodiments of the method disclosed above.

[0283] Furthermore, the present invention provides a software product for a computer, the result of the execution of which by the computer is the implementation of functions according to any of the above-disclosed embodiments of the method.

[0284] All or part of the embodiments disclosed above may be implemented using software, hardware, firmware, or any combination thereof. If implemented using software, all or part of the embodiments disclosed above may be implemented as a computer software product. The computer software product includes at least one computer program. The result of loading and executing this computer program in the computer is the implementation of all or part of the processes or functions according to the embodiments of the proposed invention. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer program may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, a computer program may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center by wire (e.g., coaxial cable, optical fiber, or digital subscriber line (DSL)) or wirelessly (e.g., infrared, wireless, microwave, etc.). A computer-readable storage medium may be any known storage medium capable of being accessed by an electronic computer or a data storage device, in particular, a server and data center combined with one or more known storage media. A known storage medium may be a magnetic medium (e.g., a floppy disk, hard disk, or magnetic tape), an optical medium (e.g., a high-density digital video disc (DVD)), a semiconductor medium (e.g., a solid-state disk (SSD)) or the like.

[0285] Those of ordinary skill in the art will understand that such features as “first,” “second,” and other numerical designations in the description of the proposed invention serve solely for convenience of distinction during the description and should not be considered as limiting the scope of embodiments of the proposed invention or reflecting the order.

[0286] The expression "at least one" in the description of the proposed invention may mean "one or more", and the feature "plurality" may mean two, three, four, etc., without any limitations in the proposed invention. In the embodiments of the proposed invention, the words "first", "second", "third", "A", "B", "C" and "D", etc. are used to distinguish between the same type of technical features, without establishing any order of priority or order of magnitude of the technical features with the definitions "first", "second", "third", "A", "B", "C" and "D".

[0287] The correspondence presented in any of the tables of the proposed invention may be configured or predetermined. The values of the parameters in any of the tables are no more than examples, while other values may be configured without limiting the proposed invention. When configuring the correspondence between data and various parameters, it is not necessary to configure all the correspondences presented in the tables. For example, the correspondences in some rows of the tables of the proposed invention may not be configured. As another example, taking the above-mentioned tables as a basis, it is possible to make appropriate changes or adjustments (in particular, by splitting, merging, etc.). The parameters in the headings of the above-mentioned tables may also have other names understandable in relation to the communication device, while the parameters may have other values and be presented in other forms understandable in relation to the communication device. The above mentioned tables can also be implemented using other data structures such as arrays, queues, containers, stacks, linear tables, pointers, chained lists, trees, graphs, structured bodies, classes, unordered arrays, or randomized tables.

[0288] The term “preliminary determination” in the context of the present invention may be understood to mean “determination,” “preliminary determination,” “input into memory,” “preliminary input into memory,” “preliminary agreement,” “preliminary configuration,” “fixation,” or “preliminary activation.”

[0289] Those of ordinary skill in the art will understand that the blocks and steps of the algorithms in the various examples described in connection with the embodiments disclosed herein may be implemented by electronic hardware or a combination of computing software and electronic hardware. Whether such functions are implemented by hardware or software depends on the specific application cases and the design limitations of the technical solution. For each specific application, those skilled in the art may use a variety of methods to implement the disclosed functions, and such implementation should not be considered a departure from the scope of the proposed invention.

[0290] Those skilled in the art will readily understand that a detailed description of the operating process of the system, device and unit disclosed above can be found in the description of the corresponding embodiments of the method, therefore, for convenience and brevity of the description, it is not given again.

[0291] The above are only particular embodiments of the proposed invention, the scope of protection of which is not limited by them. Changes or substitutions without deviating from the technical scope of the disclosed invention, which may occur to specialists in the given field of technology without deviating from the scope of the technical solution of the proposed invention, must be included in the scope of protection of the proposed invention. Thus, the scope of protection of the proposed invention should be determined based on the scope of protection of the claims.

Claims (67)

1. A method for authorizing a role for a subscriber device (SD), performed by a network device, which includes the following steps: receiving a discovery request message sent by a first AU or a second AU, wherein the discovery request message comprises at least one of a ranging application user identifier (RAUID), a service identifier, or a capability of the first AU or the second AU, wherein the capability of the first AU or the second AU indicates a role of the first AU or the second AU, or indicates a role supported by the first AU or the second AU; and sending a discovery response message to the first AU or the second AU, wherein the discovery response message contains a role determined by the network device for the first AU or the second AU. 2. The method according to paragraph 1, further comprising the step of: determine the role of the first AU or the second AU based on the capability of the first AU or the second AU and the contract information of the first AU or the second AU stored in the network device. 3. The method according to claim 1 or 2, wherein the discovery response message further comprises a security measure generated by the network device for the service requested to be discovered by the first AU or the second AU, wherein the security measure corresponding to the service requested to be discovered by the first AU is identical to the security measure corresponding to the service requested to be discovered by the second AU, wherein the service does not necessarily represent a ranging service and/or a lateral link positioning service. 4. The method according to any one of paragraphs 1 to 3, wherein the network device comprises: a first network element and a third network element, wherein the first network element is a direct discovery name management function (DDNMF) network element of the first AU or a key management function (PKMF) network element of the first AU, and the third network element is a proximity service server or a unified data management (UDM) network element, and at the stage at which the network device receives the discovery request message sent by the first AU: the first network element receives a discovery request message sent by the first AE; at the stage where the network device sends a discovery response message to the first AU: the first network element sends a discovery response message to the first AE; the method further includes the steps of: the first network element sends a first authorization request message to the third network element and the third network element sends a first authorization response message to the first network element, wherein the first authorization response message contains the role of the first AU determined by the third network element. 5. The method according to any one of paragraphs 1-3, wherein the network device comprises: a second network element and a third network element, wherein the second network element is a DDNMF network element of the second AU or a PKMF network element of the second AU, wherein the third network element is a proximity service server or a UDM network element, and at the stage at which the network device receives the discovery request message sent by the second AU: the second network element receives a discovery request message sent by the second AE; at the stage where the network device sends a discovery response message to the second AU: the second network element sends a discovery response message to the second AE; in doing so, the method further includes the steps of: the second network element sends the first authorization request message to the third network element, and the third network element sends a first authorization response message to the second network element, wherein the first authorization response message contains the role of the second AU determined by the third network element; wherein the network device optionally further comprises: a first network element, which is a network element of the DDNMF function of the first AU or a network element of the PKMF function of the first AU, wherein the method further includes the steps of: the second network element sends a control request message to the first network element, wherein the control request message contains the role of the second AU, wherein the control request message serves to request a determination of whether the role of the second AU is related to the role of the first AU; the first network element sends a second authorization request message to the third network element, wherein the second authorization request message contains the role of the first AU and the role of the second AU; and the third network element determines whether the role of the second AU is related to the role of the first AU, and the third network element sends a second authorization response message to the first network element, wherein the second authorization response message serves to indicate whether the role of the first AU is related to the role of the second AU in the service requested to be discovered by these two AUs; and the first network element sends to the second network element a security tool generated depending on the service requested for discovery by the second AU, in the case where the role of the first AU is related to the role of the second AU. 6. The method according to paragraph 4, wherein at the stage in which the first network element sends the first authorization request message to the third network element: the first network element converts the RAUID corresponding to the first AU into a first identifier that can be recognized by the third network element, wherein the first identifier serves to indicate the first AU; and the first network element sends a first authorization request message containing at least one of a first identifier, a service requested to be discovered by the first AU, or a capability of the first AU, to a third network element. 7. The method according to claim 1, wherein the network device comprises a network element of the DDNMF function or a network element of the PKMF function of the second AU, wherein the method includes the steps of: a network element of the DDNMF function or a network element of the PKMF function of the second AU receives a discovery request message sent by the second AU, wherein the discovery request message contains at least one of a ranging application user identifier (RAUID), a service identifier, or a capability of the second AU, wherein the capability of the second AU indicates a role of the second AU, or indicates a role supported by the second AU; the DDNMF network element or the PKMF network element of the second AU sends the first authorization request message to the server or the unified data management (UDM) network element according to the discovery request message; the network element of the DDNMF function or the network element of the PKMF function of the second AU receives the first authorization response message sent by the server or the UDM network element, wherein the first authorization response message contains the role of the second AU determined by the server or the UDM network element; the DDNMF network element or the PKMF network element of the second AU determines the security means corresponding to the service requested to be discovered by the second AU; and sending a detection response message to the second AU, wherein the detection response message contains the role of the second AU. 8. The method according to paragraph 7, wherein at the stage in which the network element of the DDNMF function or the network element of the PKMF function of the second AU sends the first authorization request message to the server or the UDM network element according to the discovery request message: the DDNMF network element or the PKMF network element of the second AU converts the RAUID corresponding to the second AU into a second identifier that can be recognized by the server or the UDM network element, wherein the second identifier serves to indicate the second AU; and the DDNMF network element or the PKMF network element of the second AU sends a first authorization request message containing at least one of the second identifier, the service requested to be discovered by the second AU, or the capability of the second AU, to the UDM server or network element. 9. The method according to paragraph 7, further comprising the steps of: the network element of the DDNMF function or the network element of the PKMF function of the second AU sends a control response message to the network element of the DDNMF function or the network element of the PKMF function of the first AU, wherein the control response message contains the role of the second AU, wherein the control response message serves to request a determination of whether the role of the second AU is related to the role of the first AU; and a network element of the DDNMF function or a network element of the PKMF function of the second AU receives a control response message sent by a network element of the DDNMF function or a network element of the PKMF function of the first AU, wherein the control response message contains a security tool corresponding to the service requested to be discovered by the second AU, wherein the security tool corresponding to the service requested to be discovered by the second AU is identical to the security tool corresponding to the service requested to be discovered by the first AU. 10. The method according to claim 1, wherein the network device comprises a server or a network element of unified data management (UDM), and the method includes the steps of: the server or UDM receives a first authorization request message sent by a network element of a direct discovery name management function (DDNMF) or a network element of a key management function (PKMF) of a first AU or a second AU, wherein the first authorization request message is used to request an authorized role in a service requested to be discovered by the first AU or the second AU; the server or UDM determines the role of the first AU or the second AU according to the first authorization request message; and the server or UDM sends a first authorization response message to the network element of the DDNMF function or the network element of the PKMF function of the first AU or the second AU, wherein the first authorization response message contains the role of the first AU or the second AU. 11. The method according to paragraph 10, wherein at the stage at which the server or UDM determines the role of the first AU or the second AU according to the first authorization request message: the server or UDM determines, from the contract information of the first AU or the second AU, a role permitted for the first AU or the second AU in the service requested to be discovered by the first AU or the second AU; and the server or UDM determines, from among the roles valid for the first AU or the second AU, a role supported by the capability of the first AU or the second AU as the role of the first AU or the second AU; wherein the method optionally further includes the steps of: receiving a second authorization request message sent by the network element of the DDNMF function or the network element of the PKMF function of the first AU, wherein the second authorization request message contains the role of the first AU, the role of the second AU and the service requested to be discovered by these two AUs; determine whether the role of the first AU is related to the role of the second AU in the service requested to be discovered by these two AUs; and sending a second authorization response message to the network element of the DDNMF function or the network element of the PKMF function of the first AU, wherein the second authorization response message serves to indicate whether the role of the first AU is related to the role of the second AU. 12. A method for authorizing a role for a subscriber device (SD), performed by the first SD or the second SD, comprising the steps of: sending a discovery request message to a network device, wherein the discovery request message comprises at least one of a ranging application user identifier (RAUID), a service identifier, or a capability of a first AU or a second AU, wherein the capability of the first AU indicates a role of the first AU or the second AU, or indicates a role supported by the first AU or the second AU; and receiving a discovery response message sent by the network device, wherein the discovery response message contains a role determined by the network device for the first AU or the second AU. 13. The method of claim 12, further comprising the step of performing at least one of the following actions: the first AU broadcasts a first discovery message, wherein the first discovery message is protected by a security measure corresponding to the service requested to be discovered by the first AU, wherein the first discovery message contains the role of the first AU; or the first AU receives a second discovery message broadcast by the second AU, wherein the second discovery message is protected by a security measure corresponding to the service requested for discovery by the second AU, wherein the second discovery message contains the role of the second AU, the first AU decodes and verifies the second discovery message, wherein the first AU determines whether the role of the second AU matches the role of the first AU, in case of successful verification, and the first AU sends a first response message to the second AU in the case where the role of the first AU is related to the role of the second AU, wherein the first response message is protected by a security means corresponding to the service requested for detection by the first AU, wherein the first response message contains the role of the first AU. 14. The method of claim 12, further comprising the step of performing at least one of the following actions: the second AU receives a first discovery message broadcast by the first AU, wherein the first discovery message is protected by a security measure corresponding to the service requested to be discovered by the first AU, wherein the first discovery message contains the role of the first AU, and decoding and verifying the first discovery message and determining whether the role of the second AU matches the role of the first AU, if verification is successful; or the second AU broadcasts a second discovery message, wherein the second discovery message is protected by a security measure corresponding to the service requested to be discovered by the second AU, wherein the second discovery message contains the role of the second AU, and the second AU receives the first response message sent by the first AU, wherein the first response message is protected by a security measure corresponding to the service requested for detection by the first AU, wherein the first response message contains the role of the first AU.