Access control method and communication device

Abstract

An embodiment of the present invention provides an access control method and a communication device, the access control method comprising: sending first information; the first information comprising at least one of the following: information of a first NPN, index information of a second network, first indication information, second indication information, third indication information, fourth indication information, indication information for requesting certificate download, indication information for requesting a first access method, type information of the first access method, type information of the certificate download method; the information of the first NPN is used for at least one of the following: requesting permission to access the first NPN, requesting access to the first NPN through a second certificate, requesting permission to access an NPN type network; the first indication information is used to request permission to access the first NPN; the second indication information is used to request a certificate of the first NPN; the third indication information is used to request permission to access the first NPN through the second certificate; the fourth indication information is used to request permission to access the NPN type network through the second certificate.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of wireless communication technology, and in particular to an access control method and communication equipment. Background Art

[0002] At present, enterprises can deploy non-public networks (NPN) through communication network technology for internal business of the enterprise or for employees in the enterprise. Non-public networks are different from public network services provided by operators to public users. Since the deployment range of NPN is small and the services may also be exclusive, there are many NPNs that terminals can access. Generally speaking, a terminal needs to have a certificate that can pass the authentication of the network to access a network. It would be a complicated task to configure certificates for all NPNs that the terminal can access. In addition, NPN may not be able to pre-configure a universal subscriber identity module (USIM) for the terminal like an operator and save the certificate for accessing the network in the USIM. Therefore, how to effectively implement certificate configuration and network access control for the terminal is a technical problem that needs to be solved urgently. Summary of the invention

[0003] The embodiment of the present invention provides an access control method and a communication device, which are used to solve the problem of how to effectively implement certificate configuration and network access control for a terminal.

[0004] In order to solve the above-mentioned technical problems, the present invention is achieved as follows:

[0005] In a first aspect, an embodiment of the present invention provides an access control method, applied to a first communication device, including:

[0006] Sending the first message;

[0007] The first information includes at least one of the following: information of the non-public network NPN of the first independent network, index information of the second network, first indication information, second indication information, third indication information, fourth indication information, indication information for requesting certificate download, indication information for requesting the first access method, type information of the first access method, and type information of the certificate download method;

[0008] The information of the first NPN can be used for at least one of the following: requesting permission to access the first NPN, requesting a certificate of the first NPN, requesting access to the first NPN through a second certificate, and requesting permission to access a network of the NPN type;

[0009] The first indication information is used to request permission to access the first NPN, or to request permission to access the current network, or to request permission to access an NPN type network;

[0010] The second indication information is used to request a certificate of the first NPN, or to request a certificate of the currently accessed network, or to request a certificate for accessing an NPN type network;

[0011] The third indication information is used to request permission to access the first NPN through the second certificate, or to request permission to access the first NPN through the certificate of the current access network;

[0012] The fourth indication information is used to request permission to access an NPN type network through a second certificate, or to request permission to access an NPN type network through a certificate currently accessing the network;

[0013] The second certificate includes a certificate that the first communication device already has;

[0014] The first access method includes: an access method for accessing the first network in order to download a certificate for accessing the second network; the first network and the second network are the same network or different networks;

[0015] The type information of the first access method indicates at least one of the following: a first access method of a control plane type, a first access method of a user plane type;

[0016] The type information of the certificate downloading method indicates at least one of the following items: a control plane type certificate downloading method, a user plane type certificate downloading method.

[0017] In a second aspect, an embodiment of the present invention provides an access control method, applied to a second communication device, including:

[0018] Obtaining first information;

[0019] Perform a first operation according to the first information;

[0020] The performing of the first operation includes at least one of the following:

[0021] Confirming the terminal's request for permission to access the first NPN;

[0022] Confirm whether the terminal is allowed to obtain permission to access the first NPN;

[0023] Confirm whether to allow the terminal to configure the certificate information of the first NPN;

[0024] Confirm whether to allow the terminal to add permission to access the first NPN through the second certificate;

[0025] Confirm whether to allow the terminal to access the NPN type network through the second certificate;

[0026] Confirm that the certificate information of the second NPN is configured for the terminal, or confirm that the terminal is given permission to access the third NPN through the second certificate, or confirm that the terminal is given permission to access the NPN type network through the second certificate;

[0027] determining a first server;

[0028] determining a second server;

[0029] determining second information;

[0030] Initiating a certificate configuration request or configuration update request of the terminal to the first server and / or the second server;

[0031] Sending second information to the first server and / or the second server;

[0032] Among them, the first server is one of the following: a configuration server for configuring a certificate of a second NPN for the terminal, a configuration server for configuring a certificate for accessing the NPN for the terminal, and a server that the terminal needs to access in order to download a certificate for accessing the NPN; the second server is a configuration server for configuring a second certificate for the terminal; the second information includes all or part of the information in the first information.

[0033] In a third aspect, an embodiment of the present invention provides an access control method, applied to a third communication device, including:

[0034] obtaining first information or second information;

[0035] Perform a second operation according to the first information or the second information;

[0036] The performing of the second operation includes at least one of the following:

[0037] Confirming the terminal's request for permission to access the first NPN;

[0038] Confirm whether to allow the terminal to configure the certificate information of the first NPN;

[0039] Confirm whether to allow the terminal to configure the certificate information of the first NPN;

[0040] Confirm whether to allow the terminal to add permission to access the first NPN through the second certificate;

[0041] Confirm whether to allow the terminal to access the NPN type network through the second certificate;

[0042] Configuring the certificate information of the second NPN for the terminal, or adding the authority for the terminal to access the third NPN through the second certificate, or adding the authority for the terminal to access the NPN type network through the second certificate;

[0043] Send the certificate information of the second NPN, or send the update information of the second certificate;

[0044] Wherein, the second certificate includes a certificate already possessed by the terminal;

[0045] The second NPN is all the NPNs in the first NPN, or a part of the NPNs in the first NPN;

[0046] The third NPN is all the NPNs in the first NPN, or a part of the NPNs in the first NPN;

[0047] The second NPN is the same as or different from the third NPN.

[0048] In a fourth aspect, an embodiment of the present invention provides an access control method, applied to a fourth communication device, including:

[0049] Acquire third information; wherein the third information includes at least one of certificate information of the second NPN and update information of the second certificate; the second certificate includes a certificate already possessed by the first communication device; the second NPN is one or more NPNs;

[0050] According to the third information, performing an operation of accessing the second NPN or the fourth network;

[0051] The fourth network is one of the following: another network different from the second NPN, another network different from the second network;

[0052] The certificate information of the second NPN includes at least one of the following: a certificate of the second NPN, information of a network that is allowed to be accessed through the certificate of the second NPN, and permission to access an NPN type network through the certificate of the second NPN;

[0053] The certificate information of the current access network includes at least one of the following: information of a network that is allowed to be accessed through the certificate of the current access network, indication information of allowing access to the requested NPN through the certificate of the current access network, and indication information of allowing access to a network of the NPN type through the certificate of the current access network;

[0054] The update information of the second certificate includes at least one of the following: information about the network allowed to be accessed through the second certificate, permission to access the NPN type network through the second certificate, indication information allowing access to the requested NPN through the second certificate, and indication information allowing access to the NPN type network through the second certificate.

[0055] In a fifth aspect, an embodiment of the present invention provides a communication device, where the communication device is a first communication device, including:

[0056] A sending module, used for sending first information;

[0057] The first information includes at least one of the following: information of the non-public network NPN of the first independent network, index information of the second network, first indication information, second indication information, third indication information, fourth indication information, indication information for requesting certificate download, indication information for requesting the first access method, type information of the first access method, and type information of the certificate download method;

[0058] The information of the first NPN can be used for at least one of the following: requesting permission to access the first NPN, requesting a certificate of the first NPN, requesting access to the first NPN through a second certificate, and requesting permission to access a network of the NPN type;

[0059] The first indication information is used to request permission to access the first NPN, or to request permission to access the current network, or to request permission to access an NPN type network;

[0060] The second indication information is used to request a certificate of the first NPN, or to request a certificate of the currently accessed network, or to request a certificate for accessing an NPN type network;

[0061] The third indication information is used to request permission to access the first NPN through the second certificate, or to request permission to access the first NPN through the certificate of the current access network;

[0062] The fourth indication information is used to request permission to access an NPN type network through a second certificate, or to request permission to access an NPN type network through a certificate currently accessing the network;

[0063] The second certificate includes a certificate that the first communication device already has;

[0064] The first access method includes: an access method for accessing the first network in order to download a certificate for accessing the second network; the first network and the second network are the same network or different networks;

[0065] The type information of the first access method indicates at least one of the following: a first access method of a control plane type, a first access method of a user plane type;

[0066] The type information of the certificate downloading method indicates at least one of the following items: a control plane type certificate downloading method, a user plane type certificate downloading method.

[0067] In a sixth aspect, an embodiment of the present invention provides a communication device, where the communication device is a second communication device, including:

[0068] A first acquisition module, used to acquire first information;

[0069] A first execution module, configured to execute a first operation according to the first information;

[0070] The performing of the first operation includes at least one of the following:

[0071] Confirming the terminal's request for permission to access the first NPN;

[0072] Confirm whether the terminal is allowed to obtain permission to access the first NPN;

[0073] Confirm whether to allow the terminal to configure the certificate information of the first NPN;

[0074] Confirm whether to allow the terminal to add permission to access the first NPN through the second certificate;

[0075] Confirm whether to allow the terminal to access the NPN type network through the second certificate;

[0076] Confirm that the certificate information of the second NPN is configured for the terminal, or confirm that the terminal is given permission to access the third NPN through the second certificate, or confirm that the terminal is given permission to access the NPN type network through the second certificate;

[0077] determining a first server;

[0078] determining a second server;

[0079] determining second information;

[0080] Initiating a certificate configuration request or configuration update request of the terminal to the first server and / or the second server;

[0081] Sending second information to the first server and / or the second server;

[0082] Among them, the first server is one of the following: a configuration server for configuring a certificate of a second NPN for the terminal, a configuration server for configuring a certificate for accessing the NPN for the terminal, and a server that the terminal needs to access in order to download a certificate for accessing the NPN; the second server is a configuration server for configuring a second certificate for the terminal; the second information includes all or part of the information in the first information.

[0083] In a seventh aspect, an embodiment of the present invention provides a communication device, where the communication device is a third communication device, including:

[0084] A second acquisition module, used to acquire the first information or the second information;

[0085] A second execution module, configured to execute a second operation according to the first information or the second information;

[0086] The performing of the second operation includes at least one of the following:

[0087] Confirming the terminal's request for permission to access the first NPN;

[0088] Confirm whether to allow the terminal to configure the certificate information of the first NPN;

[0089] Confirm whether to allow the terminal to configure the certificate information of the first NPN;

[0090] Confirm whether to allow the terminal to add permission to access the first NPN through the second certificate;

[0091] Confirm whether to allow the terminal to access the NPN type network through the second certificate;

[0092] Configuring the certificate information of the second NPN for the terminal, or adding the authority for the terminal to access the third NPN through the second certificate, or adding the authority for the terminal to access the NPN type network through the second certificate;

[0093] Send the certificate information of the second NPN, or send the update information of the second certificate;

[0094] Wherein, the second certificate includes a certificate already possessed by the terminal;

[0095] The second NPN is all the NPNs in the first NPN, or a part of the NPNs in the first NPN;

[0096] The third NPN is all the NPNs in the first NPN, or a part of the NPNs in the first NPN;

[0097] The second NPN is the same as or different from the third NPN.

[0098] In an eighth aspect, an embodiment of the present invention provides a communication device, where the communication device is a fourth communication device, including:

[0099] A third acquisition module is used to acquire third information; wherein the third information includes at least one of the certificate information of the second NPN and the update information of the second certificate; the second certificate includes the certificate already possessed by the first communication device; the second NPN is one or more NPNs;

[0100] A third execution module, configured to execute an operation of accessing the second NPN or the fourth network according to the third information;

[0101] The fourth network is one of the following: another network different from the second NPN, another network different from the second network;

[0102] The certificate information of the second NPN includes at least one of the following: a certificate of the second NPN, information of a network that is allowed to be accessed through the certificate of the second NPN, and permission to access an NPN type network through the certificate of the second NPN;

[0103] The certificate information of the current access network includes at least one of the following: information of a network that is allowed to be accessed through the certificate of the current access network, indication information of allowing access to the requested NPN through the certificate of the current access network, and indication information of allowing access to a network of the NPN type through the certificate of the current access network;

[0104] The update information of the second certificate includes at least one of the following: information about the network allowed to be accessed through the second certificate, permission to access the NPN type network through the second certificate, indication information allowing access to the requested NPN through the second certificate, and indication information allowing access to the NPN type network through the second certificate.

[0105] In the ninth aspect, an embodiment of the present invention provides a communication device, comprising a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the access control method provided in the first aspect, or implements the steps of the access control method provided in the second aspect, or implements the steps of the access control method provided in the third aspect, or implements the steps of the access control method provided in the fourth aspect.

[0106] In the tenth aspect, an embodiment of the present invention provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the access control method provided in the first aspect are implemented, or the steps of the access control method provided in the second aspect are implemented, or the steps of the access control method provided in the third aspect are implemented, or the steps of the access control method provided in the fourth aspect are implemented.

[0107] In the embodiment of the present invention, when requesting the permission to access the NPN, the network can decide to allocate the certificate of the corresponding NPN or add the access permission of the requested NPN network to the existing certificate of the terminal; when requesting the permission to access multiple NPNs, the network can only allocate the certificate of one NPN, but can access multiple NPNs through the certificate of the NPN or the network can add the access permission of the requested NPN network to the existing certificate of the terminal. In this way, the certificate configuration and network access control of the terminal can be effectively realized. BRIEF DESCRIPTION OF THE DRAWINGS

[0108] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0109] Figure 1 A schematic diagram of a flow chart of an access control method according to an embodiment of the present invention;

[0110] Figure 2 A schematic diagram of a flow chart of an access control method according to another embodiment of the present invention;

[0111] Figure 3 A schematic diagram of a flow chart of an access control method according to another embodiment of the present invention;

[0112] Figure 4 A schematic diagram of a flow chart of an access control method according to another embodiment of the present invention;

[0113] Figure 5 A schematic flow chart of an access control method according to a specific embodiment of the present invention;

[0114] Figure 6 A structural diagram of a communication device provided by the present invention;

[0115] Figure 7 A structural diagram of another communication device provided by the present invention;

[0116] Figure 8 A structural diagram of another communication device provided by the present invention;

[0117] Fig. 9 A structural diagram of another communication device provided by the present invention;

[0118] Fig.10 A structural diagram of another communication device provided by the present invention. DETAILED DESCRIPTION

[0119] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0120] The term "comprise" and any variation thereof in the specification and claims of the present application are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units need not be limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices. In addition, the use of "and / or" in the specification and claims to indicate at least one of the connected objects, such as A and / or B, means that A alone, B alone, and A and B exist in three cases.

[0121] In the embodiments of the present invention, words such as "exemplary" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present invention should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0122] In the embodiment of the present invention, optionally, obtaining can be understood as obtaining from configuration, receiving, receiving after request, obtaining through self-learning, obtaining by deduction based on information not received, or obtaining after processing received information, which can be determined according to actual needs and is not limited in the embodiment of the present invention.

[0123] Optionally, the sending may include broadcasting, broadcasting in system messages, and returning after responding to requests.

[0124] In one embodiment of the present invention, non-public network is an abbreviation of non-public network. Non-public network can be referred to as one of the following: non-public communication network. Non-public network can include at least one of the following deployment methods: physical non-public network, virtual non-public network, non-public network implemented on the public network. In one implementation, the non-public network is an NPN of non-independent networking PNI, by supporting closed access group (Closed Access Group, CAG) in the operator PLMN network. A CAG can be composed of a group of terminals. In another implementation, the non-public network is an NPN of independent networking (abbreviated as SNPN). The network identifier of SNPN can be composed of PLMN ID and NID.

[0125] In one embodiment of the present invention, non-public network service is the abbreviation of non-public network service. Non-public network service can also be called one of the following: network service of non-public network, non-public communication service, non-public network communication service, network service of non-public network or other naming. It should be noted that in the embodiment of the present invention, there is no specific limitation on the naming method. In one implementation mode, the non-public network is a closed access group. In this case, the non-public network service is a network service of the closed access group.

[0126] In one embodiment of the present invention, a non-public network may include or be referred to as a private network. A private network may be referred to as one of the following: a private communication network, a private network, a local area network (LAN), a private virtual network (PVN), an isolated communication network, a dedicated communication network, or other names. It should be noted that in the embodiment of the present invention, no specific limitation is made to the naming method.

[0127] In one embodiment of the present invention, the non-public network service may include or be referred to as a private network service. The private network service may be referred to as one of the following: a network service of a private network, a private communication service, a private network service, a private network service, a local area network (LAN) service, a private virtual network (PVN) service, an isolated communication network service, a dedicated communication network service, a dedicated network service or other names. It should be noted that in the embodiment of the present invention, no specific limitation is made to the naming method.

[0128] In an embodiment of the present invention, the public network is an abbreviation of a public network. The public network can be called one of the following: a public communication network or other names. It should be noted that the naming method is not specifically limited in the embodiment of the present invention.

[0129] In one embodiment of the present invention, public network service is the abbreviation of public network service. Public network service can also be called one of the following: network service of public network, public communication service, public network communication service, network service of public network or other naming. It should be noted that in the embodiment of the present invention, there is no specific limitation on the naming method.

[0130] In order to effectively support the terminal to access multiple NPNs, a certificate for accessing NPN can access multiple NPNs. One way is direct access, such as accessing NPN1 through the certificate of NPN1; another way is indirect access, such as accessing NPN1 through the certificate of NPN2 or PLMN.

[0131] In order to effectively implement terminal network access control, the following problems must be solved:

[0132] Question 1: When a UE wants to access NPN1, but has not been configured with a certificate for NPN1, the UE can request permission from the network to access NPN1. When the UE already has a certificate for NPN2 or PLMN, the UE can request additional permission to access other networks such as NPN1, or the network can decide whether to configure the UE with a certificate for NPN1 or to increase the permission for the network to which the UE already has a certificate. However, this requires the network to provide authorization and / or update the UE's contract. Currently, the network does not know which NPNs the UE wants to obtain access rights to, or the network does not know which networks the UE wants to add to which it already has a certificate to access.

[0133] Question 2: When a UE wants to access NPN1 and NPN2, but has not been configured with certificates for NPN1 and NPN2, when the UE requests authorization to access the network or the certificate of the current network under NPN1, the network currently does not know that in addition to the access authorization request for NPN1, the UE also has access authorization requests for other NPNs (such as NPN2). In addition, the certificate configuration servers corresponding to different NPNs may be different. For the control plane method, the network element in the network, such as AMF, directly or indirectly obtains the certificate configuration of the UE's access network from the certificate configuration server after receiving the request from the UE. If the UE wants to obtain the certificate or access authority of an NPN different from the NPN currently accessed, the network does not know how to select the configuration server for the certificate of the NPN for the UE.

[0134] One solution is that when the UE requests a contract with the NPN, it provides a list of NPN networks it wants to access. For the control plane method, the network (such as AMF) requests the NPN certificate from the configuration server on behalf of the UE. When the configuration servers of different NPNs are different, the configuration server can also be selected based on the network list of the NPN that the UE requests to access. The certificate configured by the network for the UE contains a list of NPNs that the certificate can access. For the user plane method, the terminal can directly request the NPN certificate from the configuration service.

[0135] In an optional embodiment of the present invention, NPN includes but is not limited to one of the following: SNPN (standalone networking NPN), PNI SNPN (public network integrated NPN). In an optional embodiment of the present invention, the network type of the second network may include but is not limited to one of the following: PLMN, SNPN, NPN (such as SNPN, or PNI NPN), etc.

[0136] In an optional embodiment of the present invention, the certificate may be referred to as a contract certificate. The network certificate may be referred to as a contract certificate of the network. A terminal configured with the certificate also has the contract certificate in the network.

[0137] In an optional embodiment of the present invention, the network certificate (such as the certificate of the first NPN, the certificate of the second NPN, the certificate of the second network, the certificate of the NPN) is a certificate of the network configured for the terminal. The network certificate enables the terminal to pass the authentication of the network.

[0138] In an optional embodiment of the present invention, the certificate of the network may include at least one of the following: the contract information of the terminal in the network, a long-term key (s), also called a root key, and a contract identifier (such as SUPI). The contract identifier is used to uniquely identify the contract. The certificate of the network can be used for mutual authentication between the terminal and the network. After the terminal obtains the contract identifier, the contract identifier is used as or generated as the identifier of the terminal in the network when accessing the network. The contract identifier includes the identifier of the network and the terminal identifier. The network includes at least one of the following: NPN, PLMN. The certificate of the first NPN, the certificate of the second NPN, and the certificate of the second network in this article meet the definition of the certificate of the network. In an embodiment of the present invention, the network includes but is not limited to one of the following: the first NPN, the second NPN, the second network, and the NPN. For example, the certificate of the first NPN, the certificate of the second NPN, the certificate of the second network, and the certificate of the NPN.

[0139] In an optional embodiment of the present invention, the third-party certificate is a certificate of other types configured for the terminal in addition to the network certificate. The third party may be a terminal manufacturer, or an application, etc. For example, a certificate configured by the terminal manufacturer for the terminal, or a certificate of an application (APP). The third-party certificate may include but is not limited to at least one of the following: the terminal's contract information with the third party, a long-term key (s), also called a root key) or a password, and the terminal's contract identifier with the third party (such as IMSI, or PEI, or a user name and / or key).

[0140] In an optional embodiment of the present invention, requesting permission to access a network (first NPN) includes requesting a certificate that enables the terminal to be authenticated by the network, and the certificate may be a certificate of the terminal in the network or a certificate outside the network (such as a certificate of a service provider, a certificate of other networks outside the network, or a certificate of a third party).

[0141] In an optional embodiment of the present invention, the information of the network allowed to be accessed through the certificate of the first NPN includes that the certificate of the first NPN enables the terminal to pass the authentication of the network and / or enables the terminal to authenticate the network. The network is a network allowed to be accessed through the certificate of the first NPN, including the first NPN.

[0142] In an optional embodiment of the present invention, the information of the network allowed to be accessed through the certificate of the second NPN includes that the certificate of the second NPN enables the terminal to pass the authentication of the network and / or enables the terminal to authenticate the network. The network is a network allowed to be accessed through the certificate of the second NPN, including the second NPN.

[0143] In an optional embodiment of the present invention, the information of the network allowed to be accessed through the certificate of the NPN includes that the certificate of the NPN enables the terminal to pass the authentication of the network and / or enables the terminal to authenticate the network. The network is a network allowed to be accessed through the certificate of the NPN, including the NPN.

[0144] In an optional embodiment of the present invention, the information of the network allowed to be accessed through the certificate of the second network includes that the second certificate enables the terminal to pass the authentication of the network and / or enables the terminal to authenticate the network. The network is a network allowed to be accessed through the certificate of the second network, including the second network.

[0145] In an optional embodiment of the present invention, the information of the NPN includes identification information of the NPN.

[0146] In an optional embodiment of the present invention, the information of the network includes identification information of the network.

[0147] In an optional embodiment of the present invention, the communication device may include at least one of the following: a communication network element and a terminal.

[0148] In one embodiment of the present invention, the communication network element may include at least one of the following: a core network element and a radio access network element.

[0149] In an embodiment of the present invention, a core network network element (CN network element) may include but is not limited to at least one of the following: a core network device, a core network node, a core network function, a core network network element, a mobility management entity (Mobility Management Entity, MME), an access mobility management function (Access Management Function, AMF), a session management function (Session Management Function, SMF), a user plane function (User Plane Function, UPF), a serving gateway (serving GW, SGW), a PDN gateway (PDN Gate Way, PDN Gateway), a policy control function (Policy Control Function, PCF), a policy and charging rules function unit (Policy and Charging Rules Function, PCRF), a GPRS service support node (Serving GPRS Support Node, SGSN), a gateway GPRS support node (Gateway GPRS Support Node, GGSN), a unified data management (Unified Data Management, UDM), a unified data storage (Unified Data Repository, UDR), a home subscriber server (Home Subscriber Server, HSS) and an application function (Application Function, AF).

[0150] In an embodiment of the present invention, a RAN network element may include but is not limited to at least one of the following: a radio access network device, a radio access network node, a radio access network function, a radio access network unit, a 3GPP radio access network, a non-3GPP radio access network, a centralized unit (CU), a distributed unit (DU), a base station, an evolved base station (evolved Node B, eNB), a 5G base station (gNB), a radio network controller (RNC), a base station (NodeB), a non-3GPP interworking function (Non-3GPP Inter Working Function, N3IWF), an access control (AC) node, an access point (AP) device or a wireless local area network (WLAN) node, and an N3IWF.

[0151] In the embodiment of the present invention, the terminal may include a relay supporting a terminal function and / or a terminal supporting a relay function. The terminal may also be referred to as a terminal device or a user terminal (User Equipment, UE), and the terminal may be a terminal side device such as a mobile phone, a tablet computer (Tablet Personal Computer), a laptop computer (Laptop Computer), a personal digital assistant (Personal Digital Assistant, PDA), a mobile Internet device (Mobile Internet Device, MID), a wearable device (Wearable Device) or a vehicle-mounted device. It should be noted that the specific type of the terminal is not limited in the embodiment of the present invention.

[0152] In an optional embodiment of the present invention, the first access method includes: an access method for accessing the first network in order to download a certificate for accessing the second network. The first access method of the control plane type includes: an access method for accessing the first network in order to download a certificate for accessing the second network, and the method for downloading the certificate for accessing the second network is a certificate download method of the control plane type. The first access method of the user plane type includes: an access method for accessing the first network in order to download a certificate for accessing the second network, and the method for downloading the certificate for accessing the second network is a certificate download method of the user plane type; the first network and the second network are the same network or different networks.

[0153] In an optional embodiment of the present invention, "authority for requesting access to the first NPN" includes a certificate for requesting the first NPN, and the certificate of the first NPN is used to access the first NPN.

[0154] In an optional embodiment of the present invention, the type information of the first access method includes type information of the first access method supported and / or requested by the terminal.

[0155] In an optional embodiment of the present invention, the type information of the certificate downloading mode includes the type information of the certificate downloading mode supported and / or requested by the terminal.

[0156] In an optional embodiment of the present invention, the address information of the first server includes at least one of the following: an IP address of the first server, a MAC address of the first server, and a port number of the first server.

[0157] In an optional embodiment of the present invention, the certificate for accessing the NPN includes a certificate of the NPN.

[0158] The access control method according to the embodiment of the present invention is described in detail below.

[0159] Please refer to Figure 1 The embodiment of the present invention provides an access control method, which is applied to a first communication device; the first communication device includes but is not limited to: a terminal; the method includes:

[0160] Step 11: Send the first message.

[0161] The first information may include at least one of the following: information of the first NPN, index information of the second network, first indication information, second indication information, third indication information, and fourth indication information.

[0162] The information of the first NPN may include identifications of one or more NPNs.

[0163] The information of the first NPN can be used for at least one of the following: requesting permission to access the first NPN, requesting a certificate of the first NPN, requesting access to the first NPN through a second certificate, and requesting permission to access an NPN type network.

[0164] The first indication information is used to request permission to access the first NPN, or to request permission to access the current network, or to request permission to access an NPN type network.

[0165] The second indication information is used to request a certificate of the first NPN, or to request a certificate of a currently accessed network, or to request a certificate for accessing an NPN type network.

[0166] The third indication information is used to request permission to access the first NPN through the second certificate, or to request permission to access the first NPN through the certificate currently accessing the network.

[0167] The fourth indication information is used to request permission to access an NPN type network through a second certificate, or to request permission to access an NPN type network through a certificate currently used to access a network.

[0168] The second certificate may include a certificate that the first communication device already has;

[0169] The first access method includes: an access method for accessing the first network in order to download a certificate for accessing the second network; the first network and the second network are the same network or different networks;

[0170] The type information of the first access method indicates at least one of the following: a first access method of a control plane type, a first access method of a user plane type;

[0171] The type information of the certificate download method indicates at least one of the following items: a control plane type certificate download method, a user plane type certificate download method. The certificate that the first communication device already has may include one of the following: a certificate of the second network that the first communication device already has, a third-party certificate that the first communication device already has, and a service provider certificate that the first communication device already has. The third-party certificate is a certificate of other types that is different from the network certificate, such as a terminal manufacturer's certificate, or an application (APP) certificate. The service provider includes but is not limited to one of the following: a second network (such as PLMN, or NPN (such as SNPN, or PNI NPN), etc.), a third party.

[0172] Optionally, the index information of the second network may include: identification information of the second network. The identification information of the second network may be included in the terminal identification of the terminal in the second network and sent to the network.

[0173] In one implementation, the first NPN requested may be one of the following: all NPNs, one NPN, or multiple NPNs.

[0174] In one implementation, the second network may be a network different from the first NPN. The second network may include but is not limited to: an NPN other than the first NPN, a PLMN, and a PNI NPN.

[0175] In one implementation, the first information is sent to a target end. The target end includes: a core network element (such as AMF). The core network element may be one of the following: a core network element of a first NPN, a core network element of a second network, or a core network element of a third network.

[0176] In one implementation, requesting permission to access the first NPN includes requesting a certificate that enables the first communication device to pass the authentication of the first NPN, and the certificate may be a certificate of the first NPN or a certificate of a third party outside the first NPN, such as a certificate of the second network. When there are multiple NPNs in the first NPN, the certificate may be a certificate of a part of the NPNs in the first NPN. For example, the first NPN includes NPN1 and NPN2. The certificate of NPN1 may be configured for the first communication device, and the certificate of NPN1 may enable the first communication device to pass the authentication of NPN1 and NPN2.

[0177] Optionally, the current access network is a network that receives the first information. In one implementation, the current access network may be one of the following: a first NPN, a second network, or a third network. When the first NPN includes multiple NPNs, the current access network may be one of the first NPNs.

[0178] The combination of items included in the first information includes but is not limited to the following implementation methods:

[0179] 1) In one implementation manner, the first information only includes: information of the first NPN.

[0180] 2) In another implementation, the first information includes: first indication information. It is not difficult to understand that when the first indication information is used to request permission to access the current network or to request permission to access an NPN type network, it may not include information about the first NPN.

[0181] 3) In another implementation, the first information includes: second indication information. It is not difficult to understand that the second indication information may not include the information of the first NPN when it is used to request a certificate for the current access network or a certificate for accessing an NPN type network.

[0182] 4) In another implementation, the first information includes: fourth indication information. It is not difficult to understand that when the fourth indication information is used to request permission to access an NPN type network through a certificate of a current access network, the information of the first NPN may not be included.

[0183] 5) In another implementation manner, the first information includes: information of the first NPN and first indication information. It is not difficult to understand that the first indication information is used to request permission to access the first NPN, and the information of the first NPN needs to be provided.

[0184] 6) In another implementation, the first information includes: information of the first NPN and second indication information. It is not difficult to understand that the second indication information is used to request the certificate of the first NPN, and the information of the first NPN needs to be provided.

[0185] 7) In another implementation, the first information includes: information of the first NPN and third indication information. It is not difficult to understand that the third indication information is used to request permission to access the first NPN through the second certificate, or to request permission to access the first NPN through the certificate of the current access network, and the information of the first NPN needs to be provided.

[0186] 8) In another implementation, the first information includes: third indication information and index information of the second network. It is not difficult to understand that the third indication information can be used to request permission to access the first NPN through the second certificate; if the currently accessed network is not the second network, the index information of the second network needs to be provided.

[0187] 9) In another implementation, the first information includes: fourth indication information and index information of the second network. It is not difficult to understand that the fourth indication information can be used to request permission to access an NPN type network through the second certificate; if the currently accessed network is not the second network, the index information of the second network needs to be provided.

[0188] 10) In another implementation, the first information includes: information of the first NPN, third indication information, and index information of the second network. It is not difficult to understand that the third indication information can be used to request permission to access the first NPN through the second certificate; if the currently accessed network is the third network, the index information of the second network and the information of the first NPN need to be provided.

[0189] Optionally, the information of the first NPN may include identification information of the first NPN. When the NPN is a SNPN, the identification information of the first NPN may consist of a PLMN ID and a NID. When the NPN is a PNI NPN, the identification information of the first PNI NPN may consist of a PLMN ID.

[0190] 1) In one implementation, the terminal may request permission to access the first NPN, and the network may determine whether to configure the terminal with a certificate of the first NPN, or to increase the permission to access the first NPN through the second certificate based on the second certificate already possessed by the terminal.

[0191] 2) In another implementation, the terminal may request a certificate of the first NPN to request permission to access the first NPN.

[0192] 3) In another implementation, the terminal may request to access the first NPN through the second certificate to request to obtain the permission to access the first NPN.

[0193] 4) In another implementation, the terminal may send first information when accessing the second network, and the first information may be identification information of the first NPN. In this case, the first information may not include information of the second network.

[0194] 5) In another implementation, the terminal may send first information when accessing the first NPN, where the first information may be, for example, first indication information, used to request permission to access the first NPN; or, the first information may be, for example, second indication information, used to request a certificate of the first NPN; or, the first information may be, for example, third indication information, used to request access to the first NPN through a second certificate.

[0195] 6) In another implementation manner, when accessing an NPN type network, the terminal may send first information, such as fourth indication information, for requesting permission to access the NPN type network.

[0196] 7) In another implementation, the terminal may send first information when accessing a third network, the first information being, for example, identification information of the first NPN. The third network may be different from the second network and the first NPN.

[0197] Optionally, after sending the first information, the method may further include:

[0198] Acquire third information; the third information includes at least one of the certificate information of the second NPN and the update information of the second certificate;

[0199] An operation of accessing the second NPN or the fourth network is performed according to the third information.

[0200] The fourth network may be one of the following: other networks different from the second NPN (such as other NPNs different from the first NPN, or PLMN), other networks different from the second network.

[0201] In one embodiment, the second NPN is equivalent to the first NPN, that is, all NPNs in the first NPN. In another embodiment, when the first NPN includes multiple NPNs, the second NPN is a subset of the first NPN, that is, the second NPN is a part of the first NPN.

[0202] In one implementation, the network only authorizes access to some NPNs in the first NPN (i.e., the second NPN), and only configures the certificates of the said part of NPNs for the first communication device. For example, the terminal requests access rights to NPN1, NPN2, and NPN3. It is not difficult to understand that the network may only allow the terminal to obtain access rights to NPN1 and NPN2, and configure the terminal with the certificate of NPN1 and the certificate of NPN2. The terminal can only access NPN1 through the certificate of NPN1. The terminal can only access NPN2 through the certificate of NPN2.

[0203] In another implementation, the network authorizes access to multiple NPNs in the first NPN, but only configures the certificates of some NPNs (i.e., the second NPN) for the first communication device, and multiple NPNs can be accessed through the certificates of some NPNs. For example, the terminal requests access rights to NPN1, NPN2, and NPN3. It is not difficult to understand that the network may allow the terminal to access NPN1 and NPN2. The network may only configure the certificate of NPN2 for the terminal, but through the certificate of NPN2, not only NPN2 can be accessed, but also NPN1. At this time, the NPN1 that can be accessed through the certificate of NPN2 can be called the equivalent NPN of NPN2, the NPN that the terminal of NPN2 allows roaming, or the NPN that can provide access to NPN2. NPN2 can be called the service provider of NPN1.

[0204] Optionally, the certificate information of the second NPN includes at least one of the following: the certificate of the second NPN, information about the network that is allowed to be accessed through the certificate of the second NPN (such as network identification information), and permission to access the NPN type network through the certificate of the second NPN. Among them, the network that is allowed to be accessed through the certificate of the second NPN may include other networks except the second NPN. The other networks except the second NPN include at least one of the following: other NPNs except the second NPN, PLMN, PNI NPN. The second NPN may be referred to as the service provider of the other networks. The other networks may be referred to as equivalent networks of the second NPN, networks on which the terminals of the second NPN are allowed to roam, or networks that can provide access to the second NPN.

[0205] Optionally, the certificate information of the current access network may include at least one of the following: information about networks that are allowed to be accessed through the certificate of the current access network (such as network identification information (such as network identification information of NPN)), indication information that allows access to the requested NPN through the certificate of the current access network, and indication information that allows access to NPN-type networks through the certificate of the current access network. Among them, the networks that are allowed to be accessed through the certificate of the current access network may include other networks except the current access network. The other networks except the current access network may include at least one of the following: NPN, PLMN, PNI NPN except the current access network. The current access network may be referred to as the service provider of the other networks. The other networks may be referred to as equivalent networks of the current access network, networks on which the terminal of the current access network is allowed to roam, or networks that can provide access to the current access network.

[0206] Optionally, the update information of the second certificate may include at least one of the following: information about the network that is allowed to be accessed through the second certificate (such as network identification information (such as identification information of the NPN)), indication information that allows access to the requested NPN through the second certificate, and indication information that allows access to the NPN type network through the second certificate. Among them, the network that is allowed to be accessed through the second certificate may include other networks except the second network. The other networks except the second network include at least one of the following: NPN, PLMN, PNI NPN except the second network. The second network can be referred to as the service provider of the other network. The other network can be referred to as an equivalent network of the second network, a network on which the terminal of the second network is allowed to roam, or a network that can provide access to the second network.

[0207] In one implementation, the network that is allowed to be accessed through the certificate of the second NPN includes a fourth network.

[0208] In one implementation, the network that is allowed to be accessed through the second certificate includes a fourth network.

[0209] In one implementation, the update information of the second certificate includes network identification information of all networks that are allowed to be accessed through the second certificate. That is, for networks that the terminal does not request access permission to, the network also sends the network identification information of the networks that are allowed to be accessed through the second certificate to the terminal.

[0210] In another implementation manner, the update information of the second certificate only includes identification information of the NPNs that are allowed to access in the requested first NPN.

[0211] In one implementation, when the network identification information of the network allowed to be accessed through the certificate of the second NPN includes the identification information of the fourth network, the terminal can access the fourth network through the certificate of the second NPN. And the access to the fourth network through the certificate of the second NPN may include: when accessing the fourth network, the UE identification provided is the UE identification (such as SUPI, SUCI, or NAI, etc.) corresponding to the certificate of the second NPN, and the UE identification may include the identification information of the second NPN. For example, the UE identification is provided through a registration request.

[0212] In one implementation, when the network identification information of the network allowed to be accessed through the second certificate includes the identification of the fourth network, the terminal can access the fourth network through the second certificate. And the access to the fourth network through the second certificate includes: when accessing the fourth network, the UE identification provided is the UE identification corresponding to the second certificate (such as SUPI, SUCI, or NAI, etc.), and the UE identification may include the identification information of the second network.

[0213] Optionally, after the step of sending the first information, at least one of the following is received: address information of the first server, identification information of the NPN corresponding to the first server.

[0214] In one implementation, the NPN corresponding to the first server includes: a certificate for accessing the NPN that can be configured by the first server. The certificate for accessing the NPN includes a certificate of the NPN.

[0215] In one implementation, the address information of the first server and / or the identification information of the NPN corresponding to the first server is obtained from a network (such as a second communication device). The network may be a network accessed by the terminal through a first access method (such as onboarding, such as O-SNPN).

[0216] Optionally, when the fourth condition is met, the address information of the first server and / or the identification information of the NPN corresponding to the first server is ignored or discarded.

[0217] The fourth condition includes at least one of the following:

[0218] The terminal supports and / or requests the certificate download method of the control plane type;

[0219] The terminal supports and / or requests a first access mode of a control plane type;

[0220] The terminal does not support and / or does not request the certificate download method of the user plane type;

[0221] The terminal does not support and / or does not request a first access mode of the user plane type;

[0222] The first server is not a configuration server for the certificate of the first NPN.

[0223] It is not difficult to understand that the address of the first server is used for the certificate download method of the user plane type or the first access method of the user plane type. For a terminal that does not support the certificate download method of the user plane type or the first access method of the user plane type, the relevant information of the first server (such as the address information of the first server and / or the identification information of the NPN corresponding to the first server) sent by the network can be ignored or discarded.

[0224] The terminal supporting and / or requesting a control plane type certificate downloading mode may include the terminal only supporting and / or requesting a control plane type certificate downloading mode.

[0225] The first access mode of the control plane type supported and / or requested by the terminal may include the first access mode of the control plane type only supported and / or requested by the terminal.

[0226] It is not difficult to understand that through this embodiment, when requesting the right to access the NPN, the network can decide to allocate the certificate of the corresponding NPN or add the access right of the requested NPN network to the existing certificate of the terminal; when requesting the right to access multiple NPNs, the network can only allocate the certificate of one NPN, but can access multiple NPNs through the certificate of the NPN or the network can add the access right of the requested NPN network to the existing certificate of the terminal. For example, the first NPN includes NPN1 and NPN2, the network can only allocate the certificate of NPN1, and the first communication device, such as the terminal, can access NPN1 and NPN2 through the certificate of NPN1. NPN2 can be an equivalent NPN of NPN1 or an NPN that allows roaming. At this time, the second NPN is NPN1. In this way, the certificate configuration and network access control of the terminal can be effectively implemented.

[0227] Please refer to Figure 2 The embodiment of the present invention provides an access control method, which is applied to a second communication device; the second communication device includes but is not limited to a core network element (such as AMF), and the core network element may be one of the following: a core network element of a first NPN, a core network element of a second network, or a core network element of a third network; the method includes:

[0228] Step 21: Obtain first information.

[0229] It should be noted that the first information obtained in this step is as follows Figure 1 As described in the illustrated embodiment, details will not be repeated here.

[0230] In one implementation, the second communication device may obtain the first information from the terminal.

[0231] Step 22: Execute a first operation according to the first information.

[0232] The performing of the first operation may include at least one of the following:

[0233] Confirming the terminal's request for permission to access the first NPN;

[0234] Confirm whether the terminal is allowed to obtain permission to access the first NPN;

[0235] Confirm whether to allow the terminal to be configured with the certificate information of the first NPN; confirm whether to allow the terminal to be given the permission to access the first NPN through the second certificate;

[0236] Confirm whether to allow the terminal to access the NPN type network through the second certificate;

[0237] Confirm that the certificate information of the second NPN is configured for the terminal, or confirm that the terminal is given permission to access the third NPN through the second certificate, or confirm that the terminal is given permission to access the NPN type network through the second certificate;

[0238] determining a first server;

[0239] Sending address information of the first server and / or identification information of the NPN corresponding to the first server;

[0240] determining a second server;

[0241] determining second information;

[0242] Initiating a certificate configuration request or configuration update request of the terminal to the first server and / or the second server;

[0243] Sending second information to the first server and / or the second server;

[0244] Send the certificate information of the second NPN or send the second certificate update information to the first communication device.

[0245] Among them, the first server is one of the following: a configuration server for configuring a certificate of a second NPN for the terminal, a configuration server for configuring a certificate for accessing the NPN for the terminal, and a server that the terminal needs to access in order to download a certificate for accessing the NPN; the second server is a configuration server for configuring a second certificate for the terminal.

[0246] Optionally, the second NPN may be all or part of the NPNs in the first NPN. In one embodiment, the second NPN is an NPN in the first NPN that allows the configuration of certificates for the terminal. It is not difficult to understand that all or only part of the requested first NPNs may allow the configuration of corresponding certificates for the terminal. It is not difficult to understand that, for example, the terminal requests access rights to NPN1, NPN2, and NPN3, but only NPN1 and NPN2 are allowed to access. In one embodiment, the network may configure certificates for NPN1 and NPN2 for the terminal. In another embodiment, the network may configure a certificate for NPN1 for the terminal and may access NPN2 through the certificate of NPN1. It is not difficult to understand that when the number of NPNs allowed to be accessed by the terminal is large, the certificate of the configured NPN can be saved by this method. It is not difficult to understand that the second NPN may be a subset of the NPNs that allow the terminal to obtain access rights.

[0247] Optionally, the third NPN may be all or part of the NPNs in the first NPN. In one implementation, the third NPN is the NPN in the first NPN that allows the terminal to obtain access rights. It is not difficult to understand that only part of the requested first NPNs may allow the terminal to obtain access rights. It is not difficult to understand that, for example, the terminal requests access rights for NPN1, NPN2, and NPN3, but only NPN1 and NPN2 are allowed to access. In one implementation, the network may update the second certificate for the terminal, adding the right to access NPN1 and NPN2 through the second certificate.

[0248] Optionally, the second information may include at least one of the following: information of the NPN, index information of the second network (such as identification information of the second network), first indication information, second indication information, third indication information, and fourth indication information. The NPN in the second information may be all or part of the first NPN in the first information. It is not difficult to understand that for the NPN requested to obtain access authority, only part of the NPN may be allowed or confirmed to obtain access authority.

[0249] In one embodiment, the NPN may include one of the following: a first NPN, a second NPN, and a third NPN. Figure 1 In the embodiment, the second NPN is as described in the above embodiment, which will not be described again. The third NPN is as described in the above embodiment, which will not be described again. The second NPN and the third NPN can be the same or different.

[0250] The information of the NPN can be used for at least one of the following: requesting permission to access the NPN, requesting a certificate of the NPN, requesting access to the NPN through a second certificate, and requesting permission to access a network of the NPN type.

[0251] The first indication information is used to request permission to access the NPN, or to request permission to currently access a network, or to request permission to access an NPN type network.

[0252] The second indication information is used to request a certificate of the NPN, or to request a certificate of a currently accessed network, or to request a certificate for accessing an NPN type network.

[0253] The third indication information is used to request permission to access the NPN through the second certificate, or to request permission to access the NPN through the certificate currently used to access the network.

[0254] The fourth indication information is used to request permission to access an NPN type network through a second certificate, or to request permission to access an NPN type network through a certificate currently used to access a network.

[0255] In one embodiment, when an agreement exists between the network receiving the first information and one or more NPNs, access to the NPN is allowed through the certificate of the network. When obtaining the first indication information (such as for requesting permission to access an NPN type network), the second indication information (such as for requesting a certificate to access an NPN type network), the third indication information (such as for requesting permission to access the NPN through the certificate of the current access network), or the fourth indication information (such as for requesting permission to access the NPN type network through the second certificate, or for requesting permission to access the NPN type network through the certificate of the current access network), the network can update the certificate information of the network for the terminal, including the access permission of the NPN type network.

[0256] For example, NPN1 has an agreement with NPN2 and NPN3, allowing the terminal to access NPN2 and NPN3 using the certificate information of NPN1. When the terminal requests NPN1 for access permission to the NPN type network. NPN1 can open the permission for the terminal and indicate it to the terminal. In one implementation, NPN2 and NPN3 are added to the information of the network that is allowed to be accessed through the certificate of NPN1. In another implementation, it is indicated in the certificate information of NPN1 that access to the NPN type network is allowed.

[0257] Exemplarily, for example, the second network has an agreement with NPN1, NPN2 and NPN3, allowing the terminal to access NPN1, NPN2 and NPN3 using the certificate information of the second network. The terminal sends the first information to the second network. When the terminal requests access permission to the NPN type network from the second network. The second network can open the permission for the terminal and indicate it to the terminal. One implementation method is to add NPN1, NPN2 and NPN3 to the information of the network that is allowed to be accessed through the certificate of the second network. Another implementation method is to indicate in the certificate information of the second network that access to the NPN type network is allowed.

[0258] The second certificate may include a certificate that the first communication device already has. The certificate that the first communication device already has may include one of the following: a certificate of the second network that the first communication device already has, a certificate of a third party that the first communication device already has, and a certificate of a service provider that the first communication device already has. The third-party certificate is a certificate of another type different from the network certificate, such as a terminal manufacturer's certificate, or an application (APP) certificate. The service provider includes but is not limited to one of the following: a second network (such as PLMN, or NPN (such as SNPN, or PNI NPN), etc.), a third party.

[0259] In one implementation, the second information may include all the information in the first information, that is, the obtained first information. In another implementation, the second information may include part of the information in the first information, that is, part of the information in the obtained first information. It is not difficult to understand that part of the information in the first information can be used only to index the certificate configuration server, and does not need to be sent to the relevant server.

[0260] In one embodiment, the second communication device can perform at least one of the following by obtaining the terminal's contract information, the network's policy and / or the NPN's allowed device list: confirming whether the terminal is allowed to obtain permission to access the first NPN, confirming whether the certificate information of the first NPN is allowed to be configured for the terminal, and confirming whether it is allowed to add permission for the terminal to access the first NPN through a second certificate.

[0261] Optionally, the contract information of the terminal may include at least one of the following: information of the NPN that allows the terminal to obtain access rights (such as identification information of the NPN); information of the NPN that allows the terminal to be configured with a certificate (such as identification information of the NPN); information of the NPN that allows the terminal to add access rights based on an existing certificate (such as identification information of the NPN).

[0262] Optionally, the network policy (which may be referred to as the operator policy) may include one of the following: when confirming that the terminal is allowed to obtain the right to access a certain NPN, configuring the certificate information of the NPN for the terminal; when confirming that the terminal is allowed to obtain the right to access a certain NPN, adding the right to access the NPN to the terminal based on the existing certificate.

[0263] 1) In one implementation, the second communication device may directly add (or append) permission for the terminal to access the third NPN through the second certificate, or configure the certificate of the second NPN for the terminal.

[0264] 2) In one implementation, the second communication device may request the second server to add permission for the terminal to access the third NPN through the second certificate.

[0265] 3) In one implementation, the second communication device may request the first server to configure a certificate of the second NPN for the terminal.

[0266] The method of obtaining the first information may include but is not limited to one of the following implementations:

[0267] 1) In one implementation, the terminal may request the first NPN for permission to access the first NPN by sending the first information. It is not difficult to understand that in this manner, the first information may not include information about the first NPN, but may include first indication information. The first indication information may be understood as being used to request permission to access the current network.

[0268] 2) In one implementation, when the first NPN includes multiple NPNs, the terminal may request permission to access the first NPN from one of the first NPNs. The access permission of the first NPN may be achieved by obtaining the certificate information of the first NPN or by adding permission to access the first NPN through a second certificate.

[0269] 3) In one implementation, the terminal may request the second network to access the first NPN by sending the first information. It is not difficult to understand that in this manner, the first information needs to include the information of the first NPN. In this manner, the first information may not include the index information of the second network.

[0270] 4) In one implementation, the terminal may send a third indication message to request permission to access the first NPN through the second certificate, or to request permission to access the first NPN through the certificate of the current access network. When the terminal currently accesses the second network, the third indication message may be understood as requesting permission to access the first NPN through the certificate of the current access network.

[0271] 5) In one implementation, the terminal may request the first NPN or the third network to add the permission to access the first NPN through the second certificate by sending the first information. It is not difficult to understand that in this manner, the first information needs to include the index information of the second network. The index information of the second network can be used to index the second server.

[0272] Optionally, the second communication device may determine the first server (such as determining the address of the first server) according to at least one of the following:

[0273] Information of the first NPN in the first information;

[0274] The terminal is currently connected to the network.

[0275] In one implementation, the terminal accesses the first NPN and sends the first information to the first NPN. It is not difficult to understand that in this case, the second communication device is a device in the first NPN, and the first server can be determined according to the mapping relationship between the current access network and the first server address and the current access network.

[0276] In one implementation, the terminal accesses the second NPN and sends the first information to the second NPN. It is easy to understand that in this case, the second communication device is a device in the second NPN, and the first server can be determined according to the mapping relationship between the current access network and the first server address and the current access network.

[0277] In another implementation, the first server may be determined according to the information of the first NPN and a mapping relationship between the first server address and the identification information of the NPN.

[0278] The type information of the first access method indicates at least one of the following: a first access method of a control plane type, a first access method of a user plane type;

[0279] The type information of the certificate downloading method indicates at least one of the following: a control plane type certificate downloading method, a user plane type certificate downloading method.

[0280] In one implementation, the address information of the first server and / or the identification information of the NPN corresponding to the first server is sent to the terminal.

[0281] Optionally, sending the address information of the first server and / or the identification information of the NPN corresponding to the first server includes: when a third condition is met, sending the address information of the first server and / or the identification information of the NPN corresponding to the first server.

[0282] The third condition includes:

[0283] The type information of the first access mode indicates a first access mode of a user plane type;

[0284] The type information of the certificate downloading method indicates a certificate downloading method of a user plane type.

[0285] It is not difficult to understand that the address information of the first server is used for the certificate download method of the user plane type or the first access method of the user plane type. For a terminal that does not support and / or does not request the certificate download method of the user plane type or the first access method of the user plane type, the network may not send the relevant information of the first server (such as the address information of the first server and / or the identification information of the NPN corresponding to the first server). In other words, for a terminal that supports and / or requests the certificate download method of the user plane type or the first access method of the user plane type, the network may send the relevant information of the first server.

[0286] In one implementation, the second communication device may, when a first condition is met, perform an operation of determining the first server, determine the second information, and / or perform an operation of sending the second information to the first server. The first condition may include at least one of the following:

[0287] Confirm that the terminal is allowed to obtain permission to access the first NPN;

[0288] Confirm the certificate information that allows the first NPN to be configured for the terminal;

[0289] Confirm the certificate information of the second NPN configured for the terminal;

[0290] Obtaining first indication information in the first information;

[0291] Obtaining second indication information in the first information;

[0292] The information of the first NPN in the first information is obtained.

[0293] The second NPN is all the NPNs in the first NPN, or is a part of the NPNs in the first NPN.

[0294] In one implementation, the confirmation that the terminal is allowed to obtain the right to access the first NPN may include confirmation that the terminal is allowed to obtain the right to access a portion of the NPNs in the first NPN. In one implementation, the confirmation that the certificate information allowing the first NPN to be configured for the terminal may include confirmation that the certificate information allowing the terminal to be configured for a portion of the NPNs in the first NPN.

[0295] Optionally, the second communication device may determine the second server (such as determining an address of the second server) according to at least one of the following:

[0296] Information about the second network in the first information;

[0297] Information of the first NPN in the first information;

[0298] The terminal is currently connected to the network.

[0299] In one implementation, the second communication device is a device in the second network, and the second server can be confirmed through the network currently accessed by the terminal and / or the second server address corresponding to the currently accessed network.

[0300] In another implementation manner, the second server may be determined according to the information of the first NPN and a mapping relationship between the second server address and the NPN identification information.

[0301] In another implementation, the second server may be determined according to the index information of the second network and a mapping relationship between the second server address and the network identification information.

[0302] In one implementation, the second communication device may, when a second condition is met, perform an operation of determining a second server, determine the second information, and / or perform an operation of sending the second information to the second server. The second condition may include at least one of the following:

[0303] Confirm that the terminal is allowed to obtain permission to access the first NPN;

[0304] Confirm that permission to add access to the first NPN through the second certificate is allowed for the terminal;

[0305] Confirm that the terminal is given the permission to access the third NPN through the second certificate;

[0306] Obtaining first indication information in the first information;

[0307] Obtaining third indication information in the first information;

[0308] Obtain fourth indication information in the first information;

[0309] Obtain information of the first NPN in the first information;

[0310] The index information of the second network in the first information is obtained.

[0311] The third NPN is all the NPNs in the first NPN, or is a part of the NPNs in the first NPN.

[0312] In one embodiment, the confirmation that the terminal is allowed to obtain the right to access the first NPN may include confirmation that the terminal is allowed to obtain the right to access a portion of the NPNs in the first NPN. In one embodiment, the confirmation that the terminal is allowed to add the right to access the first NPN through the second certificate may include confirmation that the terminal is allowed to add the right to access a portion of the NPNs in the first NPN through the second certificate.

[0313] Optionally, after the step of sending the second information to the first server, the method may further include:

[0314] Get the certificate information of the second NPN;

[0315] Send the obtained certificate information of the second NPN.

[0316] For example, the certificate information of the second NPN is obtained from the first server. At this time, the certificate information of the second NPN may be sent to at least one of the following: the first communication device (including the terminal), the user data management device (such as UDM, HSS and / or UDR).

[0317] Optionally, after the step of sending the second information to the second server, the method may further include:

[0318] Obtaining update information of the second certificate;

[0319] Send the acquired update information of the second certificate.

[0320] For example, the update information of the second certificate is obtained from the second server. At this time, the update information of the second certificate can be sent to at least one of the following: the first communication device (including the terminal), the user data management device (such as UDM, HSS and / or UDR).

[0321] It is not difficult to understand that through this embodiment, the second communication device can confirm whether the terminal is allowed to obtain the authority to access the NPN, or confirm whether to configure the certificate information of the corresponding NPN for the terminal, or determine the certificate configuration server required by the terminal, etc., based on the first information obtained, thereby effectively realizing the certificate configuration and network access control of the terminal.

[0322] Please refer to Figure 3 The embodiment of the present invention provides an access control method, which is applied to a third communication device; the third communication device includes but is not limited to: a first server, a second server, or a core network element (such as AMF). The core network network can be one of the following: a core network element of a first NPN, a core network element of a second network, or a core network element of a third network. The method includes:

[0323] Step 31: Obtain the first information or the second information.

[0324] The first information may include at least one of the following: information about the first NPN, index information about the second network, first indication information, second indication information, third indication information, and fourth indication information. The information about the first NPN, index information about the second network, first indication information, second indication information, third indication information, and fourth indication information in the first information may be specifically as follows: Figure 1 As described in the illustrated embodiment, details will not be repeated here.

[0325] The second information may include at least one of the following: information of the NPN, index information of the second network (such as identification information of the second network), first indication information, second indication information, third indication information, and fourth indication information.

[0326] The information of the NPN can be used for at least one of the following: requesting permission to access the NPN, requesting a certificate of the NPN, requesting access to the NPN through a second certificate, and requesting permission to access a network of the NPN type.

[0327] The first indication information is used to request permission to access the NPN, or to request permission to currently access a network, or to request permission to access an NPN type network.

[0328] The second indication information is used to request a certificate of the NPN, or to request a certificate of a currently accessed network, or to request a certificate for accessing an NPN type network.

[0329] The third indication information is used to request permission to access the NPN through the second certificate, or to request permission to access the NPN through the certificate currently used to access the network.

[0330] The fourth indication information is used to request permission to access an NPN type network through a second certificate, or to request permission to access an NPN type network through a certificate currently used to access a network.

[0331] The second certificate may include a certificate that the first communication device already has. The certificate that the first communication device already has may include one of the following: a certificate of the second network that the first communication device already has, a certificate of a third party that the first communication device already has, and a certificate of a service provider that the first communication device already has. The third-party certificate is a certificate of another type different from the network certificate, such as a terminal manufacturer's certificate, or an application (APP) certificate. The service provider includes but is not limited to one of the following: a second network (such as PLMN, or NPN (such as SNPN, or PNI NPN), etc.), a third party.

[0332] In one implementation, the first information may be obtained from a first communication device, or from a second communication device. For example, the first communication device sends the first information to the second communication device, and the second communication device sends the first information to a third communication device.

[0333] In one implementation, the second information may be obtained from a second communication device. For example, the first communication device sends the first information to the second communication device, and the second communication device generates the second information based on the first information, and then sends the second information to the third communication device. The NPN of the second information may be all or part of the NPN of the first NPN in the first information.

[0334] In one embodiment, the NPN may include one of the following: a first NPN, a second NPN, and a third NPN. Figure 1 As described in the embodiment, the second NPN is as follows Figure 2 The third NPN is as described in the embodiment, which will not be described again here. Figure 2 The second NPN and the third NPN may be the same or different.

[0335] Step 32: Perform a second operation according to the first information or the second information.

[0336] The performing of the second operation may include at least one of the following:

[0337] Confirming the terminal's request for permission to access the first NPN;

[0338] Confirm whether to allow the terminal to configure the certificate information of the first NPN;

[0339] Confirm whether to allow the terminal to configure the certificate information of the first NPN;

[0340] Confirm whether to allow the terminal to add permission to access the first NPN through the second certificate;

[0341] Confirm whether to allow the terminal to access the NPN type network through the second certificate;

[0342] Configuring the certificate information of the second NPN for the terminal, or adding the authority for the terminal to access the third NPN through the second certificate, or adding the authority for the terminal to access the NPN type network through the second certificate;

[0343] Send the certificate information of the second NPN, or send the update information of the second certificate.

[0344] The second certificate may include a certificate that the first communication device already has. The certificate that the first communication device already has may include one of the following: a certificate of the second network that the first communication device already has, a certificate of a third party that the first communication device already has. The third-party certificate is a certificate of another type different from the network certificate, such as a terminal manufacturer's certificate, or an application (APP) certificate.

[0345] The second network may include but is not limited to one of the following: PLMN, NPN (such as SNPN, or PNI NPN), etc.

[0346] Optionally, the second NPN may be all or part of the NPNs in the first NPN. In one embodiment, the second NPN is an NPN in the first NPN that allows the configuration of certificates for the terminal. It is not difficult to understand that all or only part of the requested first NPNs may allow the configuration of corresponding certificates for the terminal. It is not difficult to understand that, for example, the terminal requests access rights to NPN1, NPN2, and NPN3, but only NPN1 and NPN2 are allowed to access. In one embodiment, the network may configure certificates for NPN1 and NPN2 for the terminal. In another embodiment, the network may configure a certificate for NPN1 for the terminal and may access NPN2 through the certificate of NPN1. It is not difficult to understand that when the number of NPNs allowed to be accessed by the terminal is large, the certificate of the configured NPN can be saved by this method. It is not difficult to understand that the second NPN may be a subset of the NPNs that allow the terminal to obtain access rights.

[0347] Optionally, the third NPN may be all or part of the NPNs in the first NPN. In one implementation, the third NPN is the NPN in the first NPN that allows the terminal to obtain access rights. It is not difficult to understand that only part of the requested first NPNs may allow the terminal to obtain access rights. It is not difficult to understand that, for example, the terminal requests access rights for NPN1, NPN2, and NPN3, but only NPN1 and NPN2 are allowed to access. In one implementation, the network may update the second certificate for the terminal, adding the right to access NPN1 and NPN2 through the second certificate.

[0348] The certificate information of the second NPN may include at least one of the following: the certificate of the second NPN, information of the network that is allowed to be accessed through the certificate of the second NPN (such as network identification information), and the authority to access the NPN type network through the certificate of the second NPN. The network that is allowed to be accessed through the certificate of the second NPN may include other networks except the second NPN, and the other networks except the second NPN include at least one of the following: other NPNs except the second NPN, PLMN, PNINPN. The second NPN may be referred to as the service provider of the other network. The other network may be referred to as the equivalent network of the second NPN, the network that the terminal of the second NPN is allowed to roam, or the network that can provide access to the second NPN.

[0349] The second NPN is a subset of the first NPN when the first NPN includes a plurality of NPNs.

[0350] Optionally, the update information of the second certificate may include at least one of the following: information about the network that is allowed to be accessed through the second certificate (such as network identification information), permission to access the NPN type network through the second certificate, indication information that allows access to the requested NPN through the second certificate, and indication information that allows access to the NPN type network through the second certificate. Among them, the network that is allowed to be accessed through the second certificate may include other networks except the second network. The other networks except the second network include at least one of the following: NPN, PLMN, PNINPN except the second network. The second network can be referred to as the service provider of the other network. The other network can be referred to as an equivalent network of the second network, a network that the terminal of the second network is allowed to roam on, or a network that can provide access to the second network.

[0351] In one implementation, the network allowed to be accessed through the second certificate includes at least one requested NPN (eg, at least one NPN in the first NPN, the second NPN, or the third NPN).

[0352] In one embodiment, the update information of the second certificate sent includes network identification information of all networks allowed to be accessed through the second certificate, not just the identification information of the requested NPN (such as identification information of at least one NPN in the identification information of the first NPN, the second NPN, or the third NPN).

[0353] In one implementation, the update information of the second certificate includes network identification information of all networks that are allowed to be accessed through the second certificate. That is, for networks that the terminal does not request access permission to, the network also sends the network identification information of the networks that are allowed to be accessed through the second certificate to the terminal.

[0354] In another implementation manner, the update information of the second certificate only includes identification information of the NPNs that are allowed to access in the requested first NPN.

[0355] Optionally, the first information is obtained from a first source end, where the first source end includes one of the following: a first communication device (including a terminal).

[0356] Optionally, the second information is obtained from a second source end, where the second source end includes: a second communication device, a network to which the terminal sends the first information, and a network to which the terminal accesses.

[0357] Optionally, the certificate information of the second NPN is sent to the target end, or the update information of the second certificate is sent, and the target end includes at least one of the following: a first communication device (including a terminal), a second communication device, a network receiving the first information (such as a UDM or UDR in the network receiving the first information), a user management device in the second network, a network device in the second NPN (such as a user management device), and a network currently accessed by the terminal. It is not difficult to understand that when a new network certificate is configured or updated, it needs to be synchronized to the first communication device (including the terminal) and the network at the same time, so that when the terminal accesses the network, the network can authenticate the terminal. When the terminal allows the second network accessed through the first network certificate, the second network can also request the first network to authenticate the terminal.

[0358] It is not difficult to understand that through this embodiment, the third communication device can configure the required certificate information for the terminal based on the acquired second information, thereby effectively implementing certificate configuration and network access control for the terminal.

[0359] Please refer to Figure 4 The embodiment of the present invention provides an access control method, which is applied to a first communication device; the first communication device includes but is not limited to: a terminal; the method includes:

[0360] Step 41: Obtain third information.

[0361] Step 42: Execute an operation of accessing the second NPN or the fourth network according to the third information.

[0362] The third information may include at least one of certificate information of the second NPN and update information of the second certificate.

[0363] In one embodiment, the second NPN may refer to one or more NPNs. In one embodiment, the certificate of the second NPN may be obtained directly; in another embodiment, the certificate of the second NPN may be obtained by requesting the first NPN. In this case, in one embodiment, the second NPN is equivalent to the first NPN; in another embodiment, the second NPN is a subset of the first NPN, for example, when the first NPN includes multiple NPNs, the second NPN may be a part of the first NPN.

[0364] Optionally, the certificate information of the second NPN includes at least one of the following: the certificate of the second NPN, information about the network that is allowed to be accessed through the certificate of the second NPN (such as network identification information), and permission to access the NPN type network through the certificate of the second NPN. The network that is allowed to be accessed through the certificate of the second NPN may include other networks except the second NPN, and the other networks except the second NPN include at least one of the following: other NPNs except the second NPN, PLMN, PNI NPN. The second NPN may be referred to as the service provider of the other network. The other network may be referred to as an equivalent network of the second NPN, a network that the terminal of the second NPN is allowed to roam on, or a network that can provide access to the second NPN.

[0365] In one implementation, the currently accessed network is a network that sends the first information or a network that acquires the third information. The fourth network may be different from the currently accessed network.

[0366] The first information is specifically as follows: Figure 1 As described in the embodiments.

[0367] Optionally, the certificate information of the currently accessed network may include at least one of the following: information about networks that are allowed to be accessed through the certificate of the currently accessed network (such as network identification information (such as network identification information of an NPN)), indication information that allows access to a requested NPN through the certificate of the currently accessed network, and indication information that allows access to an NPN-type network through the certificate of the currently accessed network. Among them, the information about networks that are allowed to be accessed through the certificate of the currently accessed network may include other networks except the currently accessed network. The other networks except the currently accessed network include at least one of the following: an NPN, PLMN, PNI NPN except the currently accessed network. The currently accessed network may be referred to as the service provider of the other networks. The other networks may be referred to as equivalent networks of the currently accessed network, networks that the terminal of the currently accessed network allows roaming on, or networks that can provide access to the currently accessed network.

[0368] Optionally, the update information of the second certificate may include at least one of the following: information about the network that is allowed to be accessed through the second certificate (such as network identification information (such as identification information of the NPN)), permission to access the NPN type network through the second certificate, indication information that allows access to the requested NPN through the second certificate, and indication information that allows access to the NPN type network through the second certificate. Among them, the network that is allowed to be accessed through the second certificate may include other networks except the second network, and the other networks except the second network include at least one of the following: NPN, PLMN, PNI NPN except the second network. The second network can be referred to as the service provider of the other network. The other network can be referred to as an equivalent network of the second network, a network that the terminal of the second network is allowed to roam on, or a network that can provide access to the second network.

[0369] In one implementation, the network that is allowed to be accessed through the certificate of the second NPN includes a fourth network.

[0370] In one implementation, the network that is allowed to be accessed through the second certificate includes a fourth network.

[0371] In one implementation, the update information of the second certificate includes network identification information of all networks that are allowed to be accessed through the second certificate. That is, for networks that the terminal does not request access permission to, the network also sends the network identification information of the networks that are allowed to be accessed through the second certificate to the terminal.

[0372] In another implementation manner, the update information of the second certificate only includes identification information of the NPNs that are allowed to access in the requested first NPN.

[0373] The fourth network may be one of the following: other networks different from the second NPN (such as other NPNs different from the second NPN, or PLMN), other networks different from the network requesting access authority to the first NPN, or other networks different from the second network.

[0374] In one implementation, when the network identification information of the network allowed to be accessed through the certificate of the second NPN includes the identification information of the fourth network, the terminal can access the fourth network through the certificate of the second NPN. And the access to the fourth network through the certificate of the second NPN may include: when accessing the fourth network, the UE identification provided is the UE identification (such as SUPI, SUCI, or NAI, etc.) corresponding to the certificate of the second NPN, and the UE identification may include the identification information of the second NPN. For example, the UE identification is provided through a registration request.

[0375] In one implementation, when the network identification information of the network allowed to be accessed through the second certificate includes the identification of the fourth network, the terminal can access the fourth network through the second certificate. And the access to the fourth network through the second certificate includes: when accessing the fourth network, the UE identification provided is the UE identification corresponding to the second certificate (such as SUPI, SUCI, or NAI, etc.), and the UE identification may include the identification information of the second network.

[0376] In one implementation, when the network identification information of the network allowed to be accessed through the certificate of the first NPN includes the identification information of the fourth network, the terminal can access the fourth network through the certificate of the first NPN. And the access to the fourth network through the certificate of the first NPN may include: when accessing the fourth network, the UE identification provided is the UE identification (such as SUPI, SUCI, or NAI, etc.) corresponding to the certificate of the first NPN, and the UE identification may include the identification information of the first NPN.

[0377] Optionally, before the above step 41, the method may further include: sending the first information. The content of the first information may be as follows: Figure 1 As described in the illustrated embodiment, details will not be repeated here.

[0378] Optionally, in this case, in one implementation, the second NPN is equivalent to the first NPN; in another implementation, the second NPN is a subset of the first NPN, for example, when the first NPN includes multiple NPNs, the second NPN may be a partial NPN in the first NPN.

[0379] In one implementation, the network only authorizes access to some NPNs in the first NPN (i.e., the second NPN), and only configures the certificates of the said part of NPNs for the first communication device. For example, the terminal requests access rights to NPN1, NPN2, and NPN3. It is not difficult to understand that the network may only allow the terminal to obtain access rights to NPN1 and NPN2, and configure the terminal with the certificate of NPN1 and the certificate of NPN2. The terminal can only access NPN1 through the certificate of NPN1. The terminal can only access NPN2 through the certificate of NPN2.

[0380] In another implementation, the network authorizes access to multiple NPNs in the first NPN, but only configures the certificates of some NPNs (i.e., the second NPN) for the first communication device, and multiple NPNs can be accessed through the certificates of some NPNs. For example, the terminal requests access rights to NPN1, NPN2, and NPN3. It is not difficult to understand that the network may allow the terminal to access NPN1 and NPN2. The network may only configure the certificate of NPN2 for the terminal, but through the certificate of NPN2, not only NPN2 can be accessed, but also NPN1. At this time, the NPN1 that can be accessed through the certificate of NPN2 can be called the equivalent NPN of NPN2, the NPN that the terminal of NPN2 allows roaming, or the NPN that can provide access to NPN2. NPN2 can be called the service provider of NPN1.

[0381] In one implementation, the third information is obtained from a source end, where the source end includes one of the following: a first communication device, a second communication device, a network receiving the first information, and a currently accessed network.

[0382] It is not difficult to understand that, through this embodiment, when requesting permission to access multiple NPNs, the network may only allocate a certificate of one NPN, but multiple NPNs may be accessed through the certificate of the NPN. Thus, network access control of the terminal may be effectively implemented.

[0383] The method provided by the embodiment of the present invention is described below in conjunction with specific embodiments.

[0384] In this embodiment, Figure 5 As shown, the UE's NPN certificate configuration process may include the following steps:

[0385] Step 51: The UE initiates a registration request to the AMF of the first network through the NG-RAN. Optionally, the registration request includes a list of NPNs for which the UE requests to obtain an access credential.

[0386] In one implementation, the UE already has the credetial of NPN1 and requests to add the certificate of NPN2. At this time, the AMF can authenticate the UE by accessing the certificate of NPN1.

[0387] In another implementation, the UE does not have a certificate for NPN1 and requests certificates for both NPN1 and NPN2. In this case, the UE needs to be authenticated by a default credential or a UDM corresponding to a SUPI provided by the UE.

[0388] Step 52: AMF selects a configuration server according to the NPN list and sends a certificate configuration request to the configuration server.

[0389] Step 53: If the UE has not been authenticated in the above steps, optionally, the configuration server authenticates the UE through an authentication server.

[0390] Step 54: After authentication, the configuration server sends a configuration response to the UE through the AMF to configure the UE.

[0391] In one implementation, when the NPN list of the certificate request includes NPN2, the configuration server of NPN1 can update the certificate of NPN1 and add NPN2 that allows roaming, or the configuration server of NPN2 can configure the certificate of NPN2 for the UE separately.

[0392] In addition, optionally, the configuration server may synchronize the UE's certificate to the UDM.

[0393] Please refer to Figure 6 , an embodiment of the present invention provides a communication device, wherein the communication device is a first communication device, such as Figure 6 As shown, the communication device 60 includes:

[0394] A sending module 61, configured to send first information;

[0395] The first information includes at least one of the following: information of the non-public network NPN of the first independent network, index information of the second network, first indication information, second indication information, third indication information, fourth indication information, indication information for requesting certificate download, indication information for requesting the first access method, type information of the first access method, and type information of the certificate download method;

[0396] The information of the first NPN can be used for at least one of the following: requesting permission to access the first NPN, requesting a certificate of the first NPN, requesting access to the first NPN through a second certificate, and requesting permission to access a network of the NPN type;

[0397] The first indication information is used to request permission to access the first NPN, or to request permission to access the current network, or to request permission to access an NPN type network;

[0398] The second indication information is used to request a certificate of the first NPN, or to request a certificate of the currently accessed network, or to request a certificate for accessing an NPN type network;

[0399] The third indication information is used to request permission to access the first NPN through the second certificate, or to request permission to access the first NPN through the certificate of the current access network;

[0400] The fourth indication information is used to request permission to access an NPN type network through a second certificate, or to request permission to access an NPN type network through a certificate currently accessing the network;

[0401] The second certificate may include a certificate that the first communication device already has. The certificate that the first communication device already has includes: a certificate of the second network that the first communication device already has, and a certificate of a third party that the first communication device already has. The third-party certificate is a certificate of another type different from the network certificate, such as a certificate of a terminal manufacturer, or a certificate of an application (APP).

[0402] Optionally, the communication device 60 may further include:

[0403] A third acquisition module, configured to acquire third information; wherein the third information includes at least one of the certificate information of the second NPN and the update information of the second certificate;

[0404] A third execution module, configured to execute an operation of accessing the second NPN or the fourth network according to the third information;

[0405] The fourth network is one of the following: another network different from the second NPN, another network different from the second network;

[0406] The second NPN is all the NPNs in the first NPNs, or is a part of the NPNs in the first NPNs.

[0407] Optionally, the certificate information of the second NPN includes at least one of the following: a certificate of the second NPN, information of a network allowed to be accessed through the certificate of the second NPN, and permission to access an NPN type network through the certificate of the second NPN;

[0408] And / or, the update information of the second certificate includes at least one of the following: information about the network allowed to be accessed through the second certificate, permission to access the NPN type network through the second certificate, indication information allowing access to the requested NPN through the second certificate, and indication information allowing access to the NPN type network through the second certificate.

[0409] Optionally, the network allowed to be accessed through the certificate of the second NPN includes the fourth network;

[0410] And / or, the network allowed to be accessed through the second certificate includes the fourth network.

[0411] Optionally, after the step of sending the first information, at least one of the following is received: address information of the first server, identification information of the NPN corresponding to the first server.

[0412] In one implementation, the NPN corresponding to the first server includes a certificate that can be configured by the first server and is used to access the NPN. The certificate used to access the NPN includes a certificate of the NPN.

[0413] In one implementation, the address information of the first server and / or the identification information of the NPN corresponding to the first server is obtained from a network. The network may be a network accessed by the terminal through a first access method (such as onboarding, such as O-SNPN).

[0414] Optionally, when the fourth condition is met, the address information of the first server and / or the identification information of the NPN corresponding to the first server is ignored or discarded.

[0415] The fourth condition includes at least one of the following:

[0416] The terminal supports and / or requests the certificate download method of the control plane type;

[0417] The terminal supports and / or requests a first access mode of a control plane type;

[0418] The terminal does not support and / or does not request the certificate download method of the user plane type;

[0419] The terminal does not support and / or does not request a first access mode of the user plane type;

[0420] The first server is not a configuration server for the certificate of the first NPN.

[0421] It is not difficult to understand that the address of the first server is used for the certificate download mode of the user plane type or the first access mode of the user plane type. For a terminal that does not support the certificate download mode of the user plane type or the first access mode of the user plane type, the relevant information of the first server sent by the network can be ignored or discarded.

[0422] The terminal supporting and / or requesting a control plane type certificate downloading mode may include the terminal only supporting and / or requesting a control plane type certificate downloading mode.

[0423] The first access mode of the control plane type supported and / or requested by the terminal may include the first access mode of the control plane type only supported and / or requested by the terminal.

[0424] In this embodiment, the communication device 60 can implement the present invention. Figure 1 The various processes implemented in the illustrated method embodiment and the same beneficial effects achieved are not described again here to avoid repetition.

[0425] Please refer to Figure 7 , an embodiment of the present invention provides a communication device, wherein the communication device is a second communication device, such as Figure 7 As shown, the communication device 70 includes:

[0426] A first acquisition module 71, used to acquire first information;

[0427] A first execution module 72, configured to execute a first operation according to the first information;

[0428] The performing of the first operation includes at least one of the following:

[0429] Confirming the terminal's request for permission to access the first NPN;

[0430] Confirm whether the terminal is allowed to obtain permission to access the first NPN;

[0431] Confirm whether to allow the terminal to configure the certificate information of the first NPN;

[0432] Confirm whether to allow the terminal to add permission to access the first NPN through the second certificate;

[0433] Confirm whether to allow the terminal to access the NPN type network through the second certificate;

[0434] Confirm that the certificate information of the second NPN is configured for the terminal, or confirm that the terminal is given permission to access the third NPN through the second certificate, or confirm that the terminal is given permission to access the NPN type network through the second certificate;

[0435] determining a first server;

[0436] Sending address information of the first server and / or identification information of the NPN corresponding to the first server;

[0437] determining a second server;

[0438] determining second information;

[0439] Initiating a certificate configuration request or configuration update request of the terminal to the first server and / or the second server;

[0440] Sending second information to the first server and / or the second server;

[0441] Among them, the first server is one of the following: a configuration server for configuring a certificate of a second NPN for the terminal, a configuration server for configuring a certificate for accessing the NPN for the terminal, and a server that the terminal needs to access in order to download a certificate for accessing the NPN; the second server is a configuration server for configuring a second certificate for the terminal; the second information includes all or part of the information in the first information.

[0442] Optionally, the first information includes at least one of the following: information of the first NPN, index information of the second network, first indication information, second indication information, third indication information, fourth indication information, indication information for requesting certificate download, indication information for requesting the first access method, type information of the first access method, and type information of the certificate download method;

[0443] The information of the first NPN can be used for at least one of the following: requesting permission to access the first NPN, requesting a certificate of the first NPN, requesting access to the first NPN through a second certificate, and requesting permission to access a network of the NPN type;

[0444] The first indication information is used to request permission to access the first NPN, or to request permission to access the current network, or to request permission to access an NPN type network;

[0445] The second indication information is used to request a certificate of the first NPN, or to request a certificate of the currently accessed network, or to request a certificate for accessing an NPN type network;

[0446] The third indication information is used to request permission to access the first NPN through the second certificate, or to request permission to access the first NPN through the certificate of the current access network;

[0447] The fourth indication information is used to request permission to access an NPN type network through a second certificate, or to request permission to access an NPN type network through a certificate currently accessing the network;

[0448] The second certificate may include a certificate that the first communication device already has. The certificate that the first communication device already has may include one of the following: a certificate of the second network that the first communication device already has, a certificate of a third party that the first communication device already has. The third-party certificate is a certificate of another type different from the network certificate, such as a terminal manufacturer's certificate, or an application (APP) certificate.

[0449] The type information of the first access method indicates at least one of the following: a first access method of a control plane type, a first access method of a user plane type;

[0450] The type information of the certificate downloading method indicates at least one of the following: a control plane type certificate downloading method, a user plane type certificate downloading method.

[0451] In one implementation, the address information of the first server and / or the identification information of the NPN corresponding to the first server is sent to the terminal.

[0452] Optionally, the first execution module 72 sends the address information of the first server and / or the identification information of the NPN corresponding to the first server when the third condition is met.

[0453] The third condition includes:

[0454] The type information of the first access mode indicates a first access mode of a user plane type;

[0455] The type information of the certificate downloading method indicates a certificate downloading method of a user plane type.

[0456] It is not difficult to understand that the address information of the first server is used for the certificate download method of the user plane type or the first access method of the user plane type. For a terminal that does not support and / or does not request the certificate download method of the user plane type or the first access method of the user plane type, the network may not send the relevant information of the first server (such as the address information of the first server and / or the identification information of the NPN corresponding to the first server). In other words, for a terminal that supports and / or requests the certificate download method of the user plane type or the first access method of the user plane type, the network may send the relevant information of the first server.

[0457] Optionally, the first execution module 72 may perform an operation of determining the first server, determining the second information, and / or performing an operation of sending the second information to the first server when a first condition is met; wherein the first condition includes at least one of the following:

[0458] Confirm that the terminal is allowed to obtain permission to access the first NPN;

[0459] Confirm the certificate information that allows the first NPN to be configured for the terminal;

[0460] Confirm the certificate information of the second NPN configured for the terminal;

[0461] Obtaining first indication information in the first information;

[0462] Obtaining second indication information in the first information;

[0463] Obtain information of the first NPN in the first information;

[0464] The second NPN is all the NPNs in the first NPN, or is a part of the NPNs in the first NPN.

[0465] Optionally, the first execution module 72 may perform an operation of determining the second server, determining the second information, and / or performing an operation of sending the second information to the first server when a second condition is met; wherein the second condition includes at least one of the following:

[0466] Confirm that the terminal is allowed to obtain permission to access the first NPN;

[0467] Confirm that permission to add access to the first NPN through the second certificate is allowed for the terminal;

[0468] Confirm that the terminal is given the permission to access the third NPN through the second certificate;

[0469] Obtaining first indication information in the first information;

[0470] Obtaining third indication information in the first information;

[0471] Obtain fourth indication information in the first information;

[0472] Obtain information of the first NPN in the first information;

[0473] Obtaining index information of the second network in the first information;

[0474] The third NPN is all the NPNs in the first NPN, or is a part of the NPNs in the first NPN.

[0475] In this embodiment, the communication device 70 can implement the present invention. Figure 2 The various processes implemented in the illustrated method embodiment and the same beneficial effects achieved are not described again here to avoid repetition.

[0476] Please refer to Figure 8 , an embodiment of the present invention provides a communication device, wherein the communication device is a third communication device, such as Figure 8 As shown, the communication device 80 includes:

[0477] A second acquisition module 81, used to acquire the first information or the second information;

[0478] A second execution module 82, configured to execute a second operation according to the first information or the second information;

[0479] The performing of the second operation includes at least one of the following:

[0480] Confirming the terminal's request for permission to access the first NPN;

[0481] Confirm whether to allow the terminal to configure the certificate information of the first NPN;

[0482] Confirm whether to allow the terminal to configure the certificate information of the first NPN;

[0483] Confirm whether to allow the terminal to add permission to access the first NPN through the second certificate;

[0484] Confirm whether to allow the terminal to access the NPN type network through the second certificate;

[0485] Configuring the certificate information of the second NPN for the terminal, or adding the authority for the terminal to access the third NPN through the second certificate, or adding the authority for the terminal to access the NPN type network through the second certificate;

[0486] Send the certificate information of the second NPN, or send the update information of the second certificate;

[0487] Wherein, the second certificate includes a certificate already possessed by the terminal;

[0488] The second NPN is all the NPNs in the first NPN, or a part of the NPNs in the first NPN;

[0489] The third NPN is all the NPNs in the first NPN, or a part of the NPNs in the first NPN;

[0490] The second NPN is the same as or different from the third NPN.

[0491] Optionally, the first information includes at least one of the following: information of the first NPN, index information of the second network, first indication information, second indication information, third indication information, fourth indication information, indication information for requesting certificate download, indication information for requesting the first access method, type information of the first access method, and type information of the certificate download method;

[0492] The information of the first NPN can be used for at least one of the following: requesting permission to access the first NPN, requesting a certificate of the first NPN, requesting access to the first NPN through a second certificate, and requesting permission to access a network of the NPN type;

[0493] The first indication information is used to request permission to access the first NPN, or to request permission to access the current network, or to request permission to access an NPN type network;

[0494] The second indication information is used to request a certificate of the first NPN, or to request a certificate of the currently accessed network, or to request a certificate for accessing an NPN type network;

[0495] The third indication information is used to request permission to access the first NPN through the second certificate, or to request permission to access the first NPN through the certificate of the current access network;

[0496] The fourth indication information is used to request permission to access an NPN type network through a second certificate, or to request permission to access an NPN type network through a certificate currently used to access a network.

[0497] Optionally, the second information includes at least one of the following: information of the NPN, index information of the second network, first indication information, second indication information, third indication information, and fourth indication information;

[0498] The information of the NPN can be used for at least one of the following: requesting permission to access the NPN, requesting a certificate of the NPN, requesting access to the NPN through a second certificate, and requesting permission to access a network of the NPN type;

[0499] The first indication information is used to request permission to access the NPN, or to request permission to access the current network, or to request permission to access an NPN type network;

[0500] The second indication information is used to request a certificate of the NPN, or to request a certificate of a currently accessed network, or to request a certificate for accessing an NPN type network;

[0501] The third indication information is used to request permission to access the NPN through the second certificate, or to request permission to access the NPN through the certificate of the current access network;

[0502] The fourth indication information is used to request permission to access an NPN type network through a second certificate, or to request permission to access an NPN type network through a certificate currently used to access a network.

[0503] Optionally, the certificate information of the first NPN includes at least one of the following: a certificate of the first NPN, information of a network allowed to be accessed through the certificate of the first NPN, and permission to access an NPN type network through the certificate of the first NPN;

[0504] And / or, the certificate information of the second NPN includes at least one of the following: a certificate of the second NPN, information of a network allowed to be accessed through the certificate of the second NPN, and permission to access an NPN type network through the certificate of the second NPN;

[0505] And / or, the update information of the second certificate includes at least one of the following: information of a network allowed to be accessed through the second certificate, permission to access an NPN type network through the second certificate, indication information allowing access to a requested NPN through the second certificate, and indication information allowing access to an NPN type network through the second certificate;

[0506] The second NPN is all the NPNs in the first NPN, or is a part of the NPNs in the first NPN.

[0507] In this embodiment, the communication device 80 can implement the present invention. Figure 3 The various processes implemented in the illustrated method embodiment and the same beneficial effects achieved are not described again here to avoid repetition.

[0508] Please refer to Fig. 9 , an embodiment of the present invention provides a communication device, wherein the communication device is a fourth communication device, such as Fig. 9 As shown, the communication device 90 includes:

[0509] A third acquisition module 91 is used to acquire third information; wherein the third information includes at least one of the certificate information of the second NPN and the update information of the second certificate; the second certificate includes the certificate already possessed by the first communication device; the second NPN is one or more NPNs;

[0510] A third execution module 92, configured to execute an operation of accessing the second NPN or the fourth network according to the third information;

[0511] The fourth network is one of the following: another network different from the second NPN, another network different from the second network;

[0512] The certificate information of the second NPN includes at least one of the following: a certificate of the second NPN, information of a network that is allowed to be accessed through the certificate of the second NPN, and permission to access an NPN type network through the certificate of the second NPN;

[0513] The certificate information of the current access network includes at least one of the following: information of a network that is allowed to be accessed through the certificate of the current access network, indication information of allowing access to the requested NPN through the certificate of the current access network, and indication information of allowing access to a network of the NPN type through the certificate of the current access network;

[0514] The update information of the second certificate includes at least one of the following: information about the network allowed to be accessed through the second certificate, permission to access the NPN type network through the second certificate, indication information allowing access to the requested NPN through the second certificate, and indication information allowing access to the NPN type network through the second certificate.

[0515] In this embodiment, the communication device 90 can implement the present invention. Figure 4 The various processes implemented in the illustrated method embodiment and the same beneficial effects achieved are not described again here to avoid repetition.

[0516] See also Fig.10 , Fig.10 is a schematic diagram of the structure of another communication device provided by an embodiment of the present invention, such as Fig.10 As shown, the communication device 100 includes: a processor 101, a memory 102, and a computer program stored in the memory 102 and executable on the processor. The various components in the communication device 100 are coupled together via a bus interface 103. When the computer program is executed by the processor 101, the above Figure 1 The various processes implemented in the method embodiment shown, or the implementation of the above Figure 2 The various processes implemented in the method embodiment shown, or the implementation of the above Figure 3 The various processes implemented in the method embodiment shown, or the implementation of the above Figure 4 The various processes implemented in the method embodiment shown can achieve the same technical effect, and will not be described again here to avoid repetition.

[0517] The embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the above Figure 1 The various processes implemented in the method embodiment shown, or the implementation of the above Figure 2 The various processes implemented in the method embodiment shown, or the implementation of the above Figure 3 The various processes implemented in the method embodiment shown, or the implementation of the above Figure 4 The various processes implemented in the method embodiments shown can achieve the same technical effect, and are not described here to avoid repetition. The computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0518] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0519] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0520] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation modes, which are merely illustrative rather than restrictive. Under the guidance of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the present invention and the claims, all of which are within the protection of the present invention.

Claims

1. An access control method, applied to a first communication device, characterized in that: include: Sending first information to the second communication device or the third communication device; The first information includes at least one of the following: information of the first non-public network NPN, first indication information, second indication information, third indication information, and fourth indication information; The information of the first NPN can be used for at least one of the following: requesting permission to access the first NPN, requesting a certificate of the first NPN, and requesting access to the first NPN through a second certificate; The first indication information is used to request permission to access the first NPN, or to request permission to currently access the network; The second indication information is used to request a certificate of the first NPN, or to request a certificate of the current access network; The third indication information is used to request permission to access the first NPN through the second certificate, or to request permission to access the first NPN through the certificate of the current access network; The fourth indication information is used to request permission to access an NPN type network through a second certificate, or to request permission to access an NPN type network through a certificate currently accessing the network; The second certificate includes a certificate that the first communication device already has; The first communication device includes a terminal; the current access network is one of the first NPNs; The second communication device includes one of the following: a core network element of the first NPN, a core network element of the second network, or a core network element of the third network; The third communication device includes one of the following: a first server, a second server; in, The first server is a configuration server that configures a certificate of the second NPN for the terminal; The second server is a configuration server that configures a second certificate for the terminal.

2. The method according to claim 1, characterized in that The first information also includes index information of the second network.

3. The method according to claim 1 or 2, characterized in that: After sending the first information, the method further includes: Acquire third information; wherein the third information includes at least one of the certificate information of the second NPN and the update information of the second certificate; According to the third information, performing an operation of accessing the second NPN or the fourth network; The fourth network is one of the following: other networks different from the second NPN, other networks different from the second network; the second NPN is all NPNs in the first NPN, or a part of NPNs in the first NPN.

4. The method according to claim 3, characterized in that The certificate information of the second NPN includes at least one of the following: a certificate of the second NPN, information of a network that is allowed to be accessed through the certificate of the second NPN, and permission to access an NPN type network through the certificate of the second NPN; And / or, the update information of the second certificate includes at least one of the following: information about the network allowed to be accessed through the second certificate, permission to access the NPN type network through the second certificate, indication information allowing access to the requested NPN through the second certificate, and indication information allowing access to the NPN type network through the second certificate.

5. The method according to claim 4, characterized in that The network allowed to be accessed through the certificate of the second NPN includes the fourth network; and / or The network that is allowed to be accessed through the second certificate includes the fourth network.

6. The method according to claim 1, characterized in that After the step of sending the first information, at least one of the following items is received: address information of the first server, identification information of the NPN corresponding to the first server.

7. The method according to claim 6, characterized in that When the fourth condition is met, ignoring or discarding the address information of the first server and / or the identification information of the NPN corresponding to the first server; The fourth condition includes at least one of the following: The terminal supports and / or requests the certificate download method of the control plane type The terminal supports and / or requests a first access mode of a control plane type; The terminal does not support and / or does not request the certificate download method of the user plane type The terminal does not support and / or does not request a first access mode of the user plane type; The first server is not a configuration server for the certificate of the first NPN.

8. An access control method, applied to a second communication device, characterized in that: include: Acquiring at least one of the first information and the fourth information; Perform a first operation according to at least one of the first information and the fourth information; The performing of the first operation includes at least one of the following: Confirm the certificate information of the second NPN configured for the terminal; the second NPN is all the NPNs in the first NPN, or a part of the NPNs in the first NPN; Determine the first server, and send the address information of the first server and / or the identification information of the NPN corresponding to the first server to the terminal; or initiate a certificate configuration request or configuration update request of the terminal to the first server; Confirming that the terminal is given permission to access a third NPN through a second certificate, or confirming that the terminal is given permission to access an NPN type network through a second certificate; the third NPN is all NPNs in the first NPN, or a part of the NPNs in the first NPN; wherein the second certificate includes a certificate that the terminal already has; Initiating a certificate configuration request or configuration update request of the terminal to the second server; Sending second information to the second server; The first server is one of the following: a configuration server for configuring a certificate of a second NPN for the terminal, a configuration server for configuring a certificate for accessing the NPN for the terminal, and a server that the terminal needs to access in order to download a certificate for accessing the NPN; The second server is a configuration server for configuring a second certificate for the terminal; the second information includes all or part of the information in the first information; The second communication device includes one of the following: a core network element of the first NPN, a core network element of the second network, or a core network element of the third network.

9. The method according to claim 8, characterized in that The performing of the first operation further includes at least one of the following: Confirming the terminal's request for permission to access the first NPN; Confirm whether the terminal is allowed to obtain permission to access the first NPN; Confirm whether to allow the terminal to configure the certificate information of the first NPN; Confirm whether to allow the terminal to add permission to access the first NPN through the second certificate; Confirm whether to allow the terminal to access the NPN type network through the second certificate; Initiating a certificate configuration request or configuration update request of the terminal to the first server; Sending second information to the first server; determining a second server; The second information is determined.

10. The method according to claim 8, characterized in that The fourth information includes at least one of the following: instruction information for requesting certificate download, instruction information for requesting the first access method, type information of the first access method, and type information of the certificate download method; The first information includes at least one of the following: information of the first NPN, index information of the second network, first indication information, second indication information, third indication information, and fourth indication information; The information of the first NPN is used for at least one of the following: requesting permission to access the first NPN, requesting a certificate of the first NPN, and requesting access to the first NPN through a second certificate; The first indication information is used to request permission to access the first NPN, or to request permission to currently access the network; The second indication information is used to request a certificate of the first NPN, or to request a certificate of the current access network; The third indication information is used to request permission to access the first NPN through the second certificate, or to request permission to access the first NPN through the certificate of the current access network; The fourth indication information is used to request permission to access an NPN type network through a second certificate, or to request permission to access an NPN type network through a certificate currently accessing the network; The type information of the first access method indicates at least one of the following: a first access method of a control plane type, a first access method of a user plane type; The type information of the certificate downloading method indicates at least one of the following: a control plane type certificate downloading method, a user plane type certificate downloading method.

11. The method according to claim 10, characterized in that Sending the address information of the first server and / or the identification information of the NPN corresponding to the first server includes: when the third condition is met, sending the address information of the first server and / or the identification information of the NPN corresponding to the first server; Wherein, the third condition includes: The type information of the first access mode indicates a first access mode of a user plane type; The type information of the certificate downloading method indicates a certificate downloading method of a user plane type.

12. The method according to claim 9, characterized in that The second communication device performs an operation of determining the first server, determining the second information, and / or performing an operation of sending the second information to the first server when a first condition is met; wherein the first condition includes at least one of the following: Confirm that the terminal is allowed to obtain permission to access the first NPN; Confirm the certificate information that allows the first NPN to be configured for the terminal; Confirm the certificate information of the second NPN configured for the terminal; Obtaining first indication information in the first information; Obtaining second indication information in the first information; The information of the first NPN in the first information is obtained.

13. The method according to claim 9, characterized in that The second communication device performs an operation of determining a second server, determining second information, and / or performing an operation of sending second information to the first server when a second condition is met; wherein the second condition includes at least one of the following: Confirm that the terminal is allowed to obtain permission to access the first NPN; Confirm that permission to add access to the first NPN through the second certificate is allowed for the terminal; Confirm that the terminal is given the permission to access the third NPN through the second certificate; Obtaining first indication information in the first information; Obtaining third indication information in the first information; Obtain fourth indication information in the first information; Obtain information of the first NPN in the first information; The index information of the second network in the first information is obtained.

14. The method according to claim 9, characterized in that After the step of sending the second information to the first server, the method further includes: Get the certificate information of the second NPN; Sending the obtained certificate information of the second NPN; and / or After the step of sending the second information to the second server, the method further includes: Obtaining update information of the second certificate; Send update information of the second certificate.

15. An access control method, applied to a third communication device, characterized in that: include: obtaining first information or second information; Perform a second operation according to the first information or the second information; The performing of the second operation includes at least one of the following: Confirming the terminal's request for permission to access the first NPN; Confirm whether to allow the terminal to configure the certificate information of the first NPN; Confirm whether to allow the terminal to configure the certificate information of the first NPN; Confirm whether to allow the terminal to add permission to access the first NPN through the second certificate; Confirm whether to allow the terminal to access the NPN type network through the second certificate; Configure the second NPN certificate information for the terminal; Adding permission for the terminal to access a third NPN through the second certificate, or adding permission for the terminal to access an NPN type network through the second certificate; Send the certificate information of the second NPN, or send the update information of the second certificate; Wherein, the second certificate includes a certificate already possessed by the terminal; The second NPN is all the NPNs in the first NPN, or a part of the NPNs in the first NPN; The third NPN is all the NPNs in the first NPN, or a part of the NPNs in the first NPN; The second NPN is the same as or different from the third NPN; The third communication device includes one of the following: a first server, a second server; in, The first server is a configuration server that configures a certificate of the second NPN for the terminal; The second server is a configuration server that configures a second certificate for the terminal.

16. The method according to claim 15, characterized in that The first information includes at least one of the following: information of the first NPN, index information of the second network, first indication information, second indication information, third indication information, and fourth indication information; The information of the first NPN can be used for at least one of the following: requesting permission to access the first NPN, requesting a certificate of the first NPN, and requesting access to the first NPN through a second certificate; The first indication information is used to request permission to access the first NPN, or to request permission to currently access the network; The second indication information is used to request a certificate of the first NPN, or to request a certificate of the current access network; The third indication information is used to request permission to access the first NPN through the second certificate, or to request permission to access the first NPN through the certificate of the current access network; The fourth indication information is used to request permission to access an NPN type network through a second certificate, or to request permission to access an NPN type network through a certificate currently used to access a network.

17. The method according to claim 15, characterized in that The second information includes at least one of the following: information of the NPN, index information of the second network, first indication information, second indication information, third indication information, and fourth indication information; The information of the NPN can be used for at least one of the following: requesting permission to access the NPN, requesting a certificate of the NPN, and requesting access to the NPN through a second certificate; The first indication information is used to request permission to access the NPN, or to request permission to currently access the network; The second indication information is used to request a certificate of the NPN, or to request a certificate of a currently accessed network; The third indication information is used to request permission to access the NPN through the second certificate, or to request permission to access the NPN through the certificate of the current access network; The fourth indication information is used to request permission to access an NPN type network through a second certificate, or to request permission to access an NPN type network through a certificate currently used to access a network.

18. The method according to claim 15, characterized in that The certificate information of the first NPN includes at least one of the following: a certificate of the first NPN, information of a network that is allowed to be accessed through the certificate of the first NPN, and permission to access an NPN type network through the certificate of the first NPN; And / or, the certificate information of the second NPN includes at least one of the following: a certificate of the second NPN, information of a network allowed to be accessed through the certificate of the second NPN, and permission to access an NPN type network through the certificate of the second NPN; And / or, the update information of the second certificate includes at least one of the following: information of a network allowed to be accessed through the second certificate, permission to access an NPN type network through the second certificate, indication information allowing access to a requested NPN through the second certificate, and indication information allowing access to an NPN type network through the second certificate; The second NPN is all the NPNs in the first NPN, or is a part of the NPNs in the first NPN.

19. A communication device, the communication device being a first communication device, characterized in that: include: A sending module, used to send the first information to the second communication device or the third communication device; The first information includes at least one of the following: information of the first non-public network NPN, first indication information, second indication information, third indication information, and fourth indication information; The information of the first NPN can be used for at least one of the following: requesting permission to access the first NPN, requesting a certificate of the first NPN, and requesting access to the first NPN through a second certificate; The first indication information is used to request permission to access the first NPN, or to request permission to currently access the network; The second indication information is used to request a certificate of the first NPN, or to request a certificate of the current access network; The third indication information is used to request permission to access the first NPN through the second certificate, or to request permission to access the first NPN through the certificate of the current access network; The fourth indication information is used to request permission to access an NPN type network through a second certificate, or to request permission to access an NPN type network through a certificate currently accessing the network; The second certificate includes a certificate that the first communication device already has; The first communication device includes a terminal; the current access network is one of the first NPNs; The second communication device includes one of the following: a core network element of the first NPN, a core network element of the second network, or a core network element of the third network; The third communication device includes one of the following: a first server, a second server; in, The first server is a configuration server that configures a certificate of the second NPN for the terminal; The second server is a configuration server that configures a second certificate for the terminal.

20. A communication device, the communication device being a second communication device, characterized in that: include: A first acquisition module, used to acquire at least one of the first information and the fourth information; A first execution module, configured to execute a first operation according to at least one of the first information and the fourth information; The performing of the first operation includes at least one of the following: Confirm the certificate information of the second NPN configured for the terminal; the second NPN is all the NPNs in the first NPN, or a part of the NPNs in the first NPN; Determine the first server, and send the address information of the first server and / or the identification information of the NPN corresponding to the first server to the terminal; or initiate a certificate configuration request or configuration update request of the terminal to the first server; Confirming that the terminal has added the authority to access a third NPN through the second certificate, or confirming that the terminal has added the authority to access an NPN type network through the second certificate; the third NPN is all NPNs in the first NPN, or a part of the NPNs in the first NPN; wherein the second certificate includes a certificate that the terminal already has; Initiating a certificate configuration request or configuration update request of the terminal to the second server; Sending second information to the second server; The first server is one of the following: a configuration server for configuring a certificate of a second NPN for the terminal, a configuration server for configuring a certificate for accessing the NPN for the terminal, and a server that the terminal needs to access in order to download a certificate for accessing the NPN; the second server is a configuration server for configuring a second certificate for the terminal; the second information includes all or part of the information in the first information; The second communication device includes one of the following: a core network element of the first NPN, a core network element of the second network, or a core network element of the third network.

21. A communication device, the communication device being a third communication device, characterized in that: include: A second acquisition module, used to acquire the first information or the second information; A second execution module, configured to execute a second operation according to the first information or the second information; The performing of the second operation includes at least one of the following: Confirming the terminal's request for permission to access the first NPN; Confirm whether to allow the terminal to configure the certificate information of the first NPN; Confirm whether to allow the terminal to configure the certificate information of the first NPN; Confirm whether to allow the terminal to add permission to access the first NPN through the second certificate; Confirm whether to allow the terminal to access the NPN type network through the second certificate; Configuring the certificate information of the second NPN for the terminal, or adding the authority for the terminal to access the third NPN through the second certificate, or adding the authority for the terminal to access the NPN type network through the second certificate; Send the certificate information of the second NPN, or send the update information of the second certificate; Wherein, the second certificate includes a certificate already possessed by the terminal; The second NPN is all the NPNs in the first NPN, or a part of the NPNs in the first NPN; The third NPN is all the NPNs in the first NPN, or a part of the NPNs in the first NPN; The second NPN is the same as or different from the third NPN; The third communication device includes one of the following: a first server, a second server; in, The first server is a configuration server that configures a certificate of the second NPN for the terminal; The second server is a configuration server that configures a second certificate for the terminal.

22. A communication device, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the access control method according to any one of claims 1 to 7, or implements the steps of the access control method according to any one of claims 8 to 14, or implements the steps of the access control method according to any one of claims 15 to 18.

23. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, it implements the steps of the access control method as described in any one of claims 1 to 7, or implements the steps of the access control method as described in any one of claims 8 to 14, or implements the steps of the access control method as described in any one of claims 15 to 18.

Images