Slice access authentication method, UPF, application server, PCF and terminal

Abstract

An embodiment of the present invention provides a slice access authentication method, UPF, application server, PCF and terminal, the method comprising: completing session establishment with an SMF entity, and receiving a slice identifier of a first slice sent by the SMF entity; the embodiment of the present invention transmits the slice identifier of the first slice through the interface between the SMF and the UPF, and the UPF forwards the uplink data packet sent by the terminal and the slice identifier of the first slice to the application server, and the application server performs authentication based on the login mobile phone number in the received data packet and the slice identifier of the received first slice. On the one hand, it can authenticate the login mobile phone number of the application to determine whether to provide services, and on the other hand, it also authenticates the access network of the link to ensure the rights and interests of the APP application provider who has subscribed to the slice, and also protects the due rights and interests of the user who has subscribed to the slice, so that VIP users can also enjoy slice services using different terminal devices.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a slice access authentication method, UPF, application server, PCF and terminal. Background Art

[0002] A network slice is an end-to-end logical private network that provides specific network capabilities, and a virtualized "private network" in a 5G network. A network slice instance is a collection of network functions and required physical / virtual resources, which may include access networks, core networks, transport bearers, and applications.

[0003] CSMF (Communication Service Management Function) completes the ordering and processing of user business communication service needs, and converts communication service needs into network slicing requirements for NSMF.

[0004] NSMF (Network Slice Management Function) is responsible for the end-to-end life cycle management of network slices. It receives network slice deployment requests issued by CSMF, decomposes the SLA requirements of network slices into SLA (Service Level Agreement) requirements of network sub-slices, and sends network sub-slice deployment requests to NSSMF.

[0005] NSSMF (Network Slice Subnet Management Function) is responsible for the lifecycle management of network slice subnets. It receives network slice subnet deployment requirements issued by NSMF, maps the SLA requirements of network slice subnets to QoS (Quality of Service) requirements of network services, and issues network service deployment requests to the NFVO system in the NFV (Network Functions Virtualization) domain.

[0006] The existing technology does not define the terminal side slice selection process and mechanism. The network side authenticates the terminal by the S-NSSAI (Single-Network Slice Selection Assistance Information) and 5G-GUTI (5G-Globally Unique Temporary UE Identity) reported by the terminal. The 5G-GUTI is obtained through the SIM (Subscriber Identification Module) card. Figure 1 As shown, taking the game application scenario as an example, the existing technology has the following problems:

[0007] Question 1: The game orders slices to accelerate VIP member users. For example, user A is a VIP member of the game, and user B is not a member. User A and user B both log in using their mobile phone numbers. User B can still use the slice acceleration service when playing games using user A's phone, but this communication link should not exist.

[0008] Question 2: Game subscription slices are accelerated for VIP member users. For example, user A is a VIP member of the game, and user B is not a member. User A and user B both log in using their mobile phone numbers. Because the acceleration communication link of user B is not connected, user A cannot use the slice acceleration service using user B's mobile phone.

[0009] In summary, the existing technology has loopholes in the slice access authentication system when applied. Summary of the invention

[0010] The purpose of the embodiments of the present invention is to provide a slice access authentication method, UPF, application server, PCF and terminal to solve the loopholes in the existing slice access authentication system.

[0011] In order to solve the above problem, an embodiment of the present invention provides a slice access authentication method, which is applied to a user plane function UPF entity, including:

[0012] Complete session establishment with the session management function SMF entity, and receive the slice identifier of the first slice sent by the SMF entity.

[0013] Wherein, the method further comprises:

[0014] Receiving a first uplink data packet sent by a terminal, wherein the first uplink data packet carries a login mobile phone number of a target application of the terminal;

[0015] The first uplink data packet and the slice identifier of the first slice are forwarded to the application server, so that the application server determines whether to provide network acceleration service for the terminal based on the login mobile phone number and the slice identifier of the first slice.

[0016] An embodiment of the present invention further provides a slice access authentication method, which is applied to an application server, including:

[0017] Receive a first uplink data packet and a slice identifier of a first slice forwarded by a user plane function UPF entity; the first uplink data packet is sent by the terminal to the UPF entity; the slice identifier of the first slice is sent by the session management function SMF entity to the UPF entity; the first uplink data packet carries a login mobile phone number of a target application of the terminal;

[0018] Determine whether to provide network acceleration service for the terminal based on the login mobile phone number and the slice identifier of the first slice.

[0019] The determining whether to provide a network acceleration service for the terminal according to the login mobile phone number and the slice identifier of the first slice includes:

[0020] If the login mobile phone number has not subscribed to the second slice of the target application, refusing to provide the terminal with network acceleration service;

[0021] If the logged-in mobile phone number has subscribed to the second slice of the target application, determining whether the slice identifier of the second slice subscribed to the logged-in mobile phone number is consistent with the slice identifier of the first slice;

[0022] If the slice identifier of the second slice subscribed to the logged-in mobile phone number is consistent with the slice identifier of the first slice, a network acceleration service is provided for the terminal.

[0023] Wherein, the method further comprises:

[0024] If the slice identifier of the second slice subscribed by the logged-in mobile phone number is inconsistent with the slice identifier of the first slice, a slice redirection request is sent to the policy control function PCF entity, and the slice redirection request carries the slice identifier of the second slice subscribed by the logged-in mobile phone number.

[0025] Among them, after sending the slice redirection request to the policy control function PCF entity, the method includes:

[0026] Receive a second uplink data packet and a slice identifier of the second slice forwarded by the UPF entity; the second uplink data packet is sent by the terminal to the UPF entity; the slice identifier of the second slice is sent by the SMF entity to the UPF entity; the second uplink data packet carries the login mobile phone number of the target application of the terminal;

[0027] Based on the login mobile phone number and the slice identifier of the second slice, determine to provide network acceleration service for the terminal.

[0028] An embodiment of the present invention further provides a slice access authentication method, which is applied to a policy control function PCF entity, including:

[0029] Receive a slice redirection request sent by an application server, where the slice redirection request carries a slice identifier of a second slice subscribed to by a login mobile phone number of a target application of the terminal;

[0030] According to the slice redirection request, redirection indication information for instructing the terminal to redirect to the second slice is sent to the terminal; wherein the redirection indication information carries a slice identifier of the second slice.

[0031] The sending, according to the slice redirection request, to the terminal redirection indication information for instructing the terminal to redirect to the second slice includes:

[0032] Generate a slice selection strategy according to the slice redirection request; the slice selection strategy is used to trigger the terminal to initiate a network registration process;

[0033] The slice selection strategy is sent to the terminal, wherein the slice selection strategy includes the redirection indication information.

[0034] An embodiment of the present invention further provides a slice access authentication method, which is applied to a terminal, including:

[0035] receiving redirection indication information sent by a policy control function PCF entity, where the redirection indication information is used to instruct the terminal to redirect to the second slice; wherein the redirection indication information carries a slice identifier of the second slice;

[0036] Redirect to the second slice according to the redirection indication information.

[0037] Among them, the second slice is the slice subscribed to the login mobile phone number of the terminal's target application.

[0038] The receiving redirection indication information sent by the PCF entity includes:

[0039] Receive a slice selection policy sent by a PCF entity, where the slice selection policy includes the redirection indication information.

[0040] The redirecting to the second slice according to the redirection indication information includes:

[0041] Generate a redirection strategy according to the slice selection strategy; wherein the redirection strategy includes: a binding relationship between an identifier of a target application and the second slice, and / or a binding relationship between an IP address of an application server and the second slice;

[0042] According to the redirection strategy, a network registration process is initiated to attach to the access and mobility management function AMF entity; the network registration process carries the slice identifier of the second slice; and the AMF entity sends the slice identifier of the second slice to the session management function SMF entity.

[0043] An embodiment of the present invention further provides a slice access authentication device, which is applied to a user plane function UPF entity, including:

[0044] The first receiving module is used to complete session establishment with the session management function SMF entity and receive the slice identifier of the first slice sent by the SMF entity.

[0045] An embodiment of the present invention further provides a user plane function UPF entity, including a processor and a transceiver, wherein the transceiver receives and sends data under the control of the processor, and the processor is used to perform the following operations:

[0046] Complete session establishment with the session management function SMF entity, and receive the slice identifier of the first slice sent by the SMF entity.

[0047] The processor is further configured to perform the following operations:

[0048] Receiving a first uplink data packet sent by a terminal, wherein the first uplink data packet carries a login mobile phone number of a target application of the terminal;

[0049] The first uplink data packet and the slice identifier of the first slice are forwarded to the application server, so that the application server determines whether to provide network acceleration service for the terminal based on the login mobile phone number and the slice identifier of the first slice.

[0050] An embodiment of the present invention further provides a slice access authentication device, which is applied to an application server, including:

[0051] The second receiving module is used to receive a first uplink data packet and a slice identifier of a first slice forwarded by a user plane function UPF entity; the first uplink data packet is sent by the terminal to the UPF entity; the slice identifier of the first slice is sent by the session management function SMF entity to the UPF entity; the first uplink data packet carries a login mobile phone number of a target application of the terminal;

[0052] A judgment module is used to determine whether to provide network acceleration service for the terminal based on the login mobile phone number and the slice identifier of the first slice.

[0053] An embodiment of the present invention further provides an application server, comprising a processor and a transceiver, wherein the transceiver receives and sends data under the control of the processor, and the processor is configured to perform the following operations:

[0054] Receive a first uplink data packet and a slice identifier of a first slice forwarded by a user plane function UPF entity; the first uplink data packet is sent by the terminal to the UPF entity; the slice identifier of the first slice is sent by the session management function SMF entity to the UPF entity; the first uplink data packet carries a login mobile phone number of a target application of the terminal;

[0055] Determine whether to provide network acceleration service for the terminal based on the login mobile phone number and the slice identifier of the first slice.

[0056] The processor is further configured to perform the following operations:

[0057] If the login mobile phone number has not subscribed to the second slice of the target application, refusing to provide the terminal with network acceleration service;

[0058] If the logged-in mobile phone number has subscribed to the second slice of the target application, determining whether the slice identifier of the second slice subscribed to the logged-in mobile phone number is consistent with the slice identifier of the first slice;

[0059] If the slice identifier of the second slice subscribed to the logged-in mobile phone number is consistent with the slice identifier of the first slice, a network acceleration service is provided for the terminal.

[0060] The processor is further configured to perform the following operations:

[0061] If the slice identifier of the second slice subscribed by the logged-in mobile phone number is inconsistent with the slice identifier of the first slice, a slice redirection request is sent to the policy control function PCF entity, and the slice redirection request carries the slice identifier of the second slice subscribed by the logged-in mobile phone number.

[0062] The processor is further configured to perform the following operations:

[0063] Receive a second uplink data packet and a slice identifier of the second slice forwarded by the UPF entity; the second uplink data packet is sent by the terminal to the UPF entity; the slice identifier of the second slice is sent by the SMF entity to the UPF entity; the second uplink data packet carries the login mobile phone number of the target application of the terminal;

[0064] Based on the login mobile phone number and the slice identifier of the second slice, determine to provide network acceleration service for the terminal.

[0065] An embodiment of the present invention further provides a slice access authentication device, which is applied to a policy control function PCF entity, including:

[0066] A third receiving module is used to receive a slice redirection request sent by the application server, where the slice redirection request carries a slice identifier of a second slice subscribed to by a login mobile phone number of a target application of the terminal;

[0067] The first sending module is used to send redirection indication information to the terminal according to the slice redirection request, which is used to instruct the terminal to redirect to the second slice; wherein the redirection indication information carries the slice identifier of the second slice.

[0068] The embodiment of the present invention further provides a policy control function PCF entity, including a processor and a transceiver, wherein the transceiver receives and sends data under the control of the processor, and the processor is used to perform the following operations:

[0069] Receive a slice redirection request sent by an application server, where the slice redirection request carries a slice identifier of a second slice subscribed to by a login mobile phone number of a target application of the terminal;

[0070] According to the slice redirection request, redirection indication information for instructing the terminal to redirect to the second slice is sent to the terminal; wherein the redirection indication information carries a slice identifier of the second slice.

[0071] The processor is further configured to perform the following operations:

[0072] Generate a slice selection strategy according to the slice redirection request; the slice selection strategy is used to trigger the terminal to initiate a network registration process;

[0073] The slice selection strategy is sent to the terminal, wherein the slice selection strategy includes the redirection indication information.

[0074] An embodiment of the present invention further provides a slice access authentication device, which is applied to a terminal, including:

[0075] a fourth receiving module, configured to receive redirection indication information sent by a policy control function PCF entity, wherein the redirection indication information is used to instruct the terminal to redirect to the second slice; wherein the redirection indication information carries a slice identifier of the second slice;

[0076] A redirection module is used to redirect to the second slice according to the redirection indication information.

[0077] An embodiment of the present invention further provides a terminal, including a processor and a transceiver, wherein the transceiver receives and sends data under the control of the processor, and the processor is configured to perform the following operations:

[0078] receiving redirection indication information sent by a policy control function PCF entity, where the redirection indication information is used to instruct the terminal to redirect to the second slice; wherein the redirection indication information carries a slice identifier of the second slice;

[0079] Redirect to the second slice according to the redirection indication information.

[0080] Among them, the second slice is the slice subscribed to the login mobile phone number of the terminal's target application.

[0081] The processor is further configured to perform the following operations:

[0082] Receive a slice selection policy sent by a PCF entity, where the slice selection policy includes the redirection indication information.

[0083] The processor is further configured to perform the following operations:

[0084] Generate a redirection strategy according to the slice selection strategy; wherein the redirection strategy includes: a binding relationship between an identifier of a target application and the second slice, and / or a binding relationship between an IP address of an application server and the second slice;

[0085] According to the redirection strategy, a network registration process is initiated to attach to the access and mobility management function AMF entity; the network registration process carries the slice identifier of the second slice; and the AMF entity sends the slice identifier of the second slice to the session management function SMF entity.

[0086] An embodiment of the present invention also provides a communication device, including a memory, a processor, and a program stored in the memory and executable on the processor, wherein the processor implements the slice access authentication method as described above when executing the program.

[0087] An embodiment of the present invention also provides a computer-readable storage medium on which a computer program is stored, which, when executed by a processor, implements the steps in the slice access authentication method as described above.

[0088] The above technical solution of the present invention has at least the following beneficial effects:

[0089] In the slice access authentication method, UPF, application server, PCF and terminal of the embodiment of the present invention, the slice identifier of the first slice is transmitted through the interface between SMF and UPF, and the UPF forwards the uplink data packet sent by the terminal and the slice identifier of the first slice to the application server. The application server performs authentication based on the login mobile phone number in the received data packet and the slice identifier of the received first slice. On the one hand, it can authenticate the login mobile phone number of the application to determine whether to provide services. On the other hand, it also authenticates the access network of the link to ensure the rights and interests of the APP application provider who has subscribed to the slice, prevent "freeloading" behavior, and protect the due rights and interests of users who have subscribed to the slice, so that VIP users can also enjoy slice services using different terminal devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0090] Figure 1 A schematic diagram showing an application scenario in the prior art;

[0091] Figure 2 Represents the network structure of the 5G core network provided by an embodiment of the present invention;

[0092] Figure 3 A schematic diagram showing one of the steps of the slice access authentication method provided in an embodiment of the present invention;

[0093] Figure 4 A second schematic diagram showing the steps of the slice access authentication method provided by an embodiment of the present invention;

[0094] Figure 5 A schematic diagram showing the structure of an application server provided by an embodiment of the present invention;

[0095] Figure 6 A schematic diagram showing a flow chart of an application server provided by an embodiment of the present invention;

[0096] Figure 7 A third step diagram showing the slice access authentication method provided by an embodiment of the present invention;

[0097] Figure 8 A schematic diagram showing the structure of a PCF entity provided in an embodiment of the present invention;

[0098] Fig. 9 A fourth step diagram showing the slice access authentication method provided by an embodiment of the present invention;

[0099] Fig.10 A complete interactive example diagram showing a slice access authentication method provided by an embodiment of the present invention;

[0100] Fig.11 One of the structural diagrams of the slice access authentication device provided in an embodiment of the present invention is shown;

[0101] Fig.12 A schematic diagram showing the structure of a communication device provided by an embodiment of the present invention;

[0102] Fig.13 A second structural diagram showing a slice access authentication device provided in an embodiment of the present invention;

[0103] Fig.14 A third structural diagram showing a slice access authentication device provided in an embodiment of the present invention;

[0104] Fig.15 The fourth structural diagram of the slice access authentication device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0105] In order to make the technical problems, technical solutions and advantages to be solved by the present invention more clear, a detailed description will be given below with reference to the accompanying drawings and specific embodiments.

[0106] The slice access authentication method provided in the embodiment of the present invention is mainly reflected in the network session establishment stage. The 5GC (5G core network) network structure is as follows: Figure 2 As shown, the network elements and application systems involved in the slice selection session establishment process mainly include the terminal (UE), AMF (access and mobility management function), SMF (session management function), PCF (policy control function), UPF (user plane function), and application server.

[0107] At the system architecture level, the embodiment of the present invention modifies the interface (N4) between SMF and UPF, and the interface (N6) between UPF and application server; modifies the application server to add a network service authentication mechanism; modifies the PCF to add a new policy generation and triggering mechanism; modifies the interface (N15) between PCF and AMF, and the interface (N1) between AMF and UE to add a network slice redirection interface function, and the terminal needs to cooperate with the network to issue the policy to update the policy; and the slice session establishment process is also modified.

[0108] In the slice selection process of the embodiment of the present invention, when the user plane session is established, the UPF sends the slice identifier of the current session (i.e., the slice identifier of the first slice) to the application server, and the application server compares the login mobile phone number in the received data packet with the received slice identifier to determine whether the login mobile phone number has subscribed to the slice. If not subscribed, the service is rejected. If it has been subscribed but the subscribed slice is inconsistent with the current session slice, the application server requests to initiate slice redirection; on the one hand, it can authenticate the login mobile phone number of the application to determine whether to provide the service. On the other hand, it can also authenticate the access network of the link to ensure the rights and interests of the APP application provider that has subscribed to the slice, prevent "freeloading", and protect the due rights and interests of users who have subscribed to the slice, so that VIP users can also enjoy the slice service using different terminal devices.

[0109] like Figure 3 As shown, an embodiment of the present invention provides a slice access authentication method, which is applied to a user plane function UPF entity, including:

[0110] Step 31, complete session establishment with the session management function SMF entity, and receive the slice identifier of the first slice sent by the SMF entity.

[0111] The embodiment of the present invention transforms the interface (N4) between the SMF and the UPF, and transmits the slice identifier of the first slice selected by the terminal to the UPF through the N4 interface.

[0112] In an embodiment of the present invention, the terminal selects a suitable slice identifier of the first slice according to the information of the target application (such as the ID of the target application, the IP address, etc.). If the slice identifier of the first slice is an allowed slice identifier, the terminal initiates a PDU (protocol data unit) session creation request to the AMF, carrying the session ID, the slice identifier, and the 5G-GUTI; the AMF initiates the control plane slice selection signaling process, completes the AMF selection of the SMF, and implements the PDU session authentication. The SMF determines which UPF to select based on the slice identifier, the slice instance identifier (NSI ID), the DNN (data packet network), etc. The SMF completes the session establishment with the selected UPF. During or after the session establishment is completed, the SMF sends the slice identifier of the first slice to the UPF. For example, the SMF sends a PFCP (packet forwarding control protocol) session establishment request message to the UPF through the N4 interface to establish a new PFCP session context in the UPF, and adds a "current session S-NSSAI" resource in the PFCP session establishment request message to carry the slice identifier of the current session. UPF can add a slice identifier storage module. After UPF has the slice identifier, it opens business capabilities to the application server and carries the slice identifier of the current session to the application server through the N6 interface.

[0113] The first slice is a slice selected by the terminal. The slice identifier may specifically be S-NSSAI (Single Network Slice Selection Assistance Information).

[0114] Optionally, after the session between SMF and UPF is established, SMF also needs to establish a user plane session through a standard user plane session creation process to complete the network channel establishment. After the network channel is established, as an optional embodiment of the present invention, the method further includes:

[0115] Receiving a first uplink data packet sent by a terminal, wherein the first uplink data packet carries a login mobile phone number of a target application of the terminal;

[0116] The first uplink data packet and the slice identifier of the first slice are forwarded to the application server, so that the application server determines whether to provide network acceleration service for the terminal based on the login mobile phone number and the slice identifier of the first slice.

[0117] The embodiment of the present invention also transforms the interface (N6) between the UPF and the application server, and sends the first uplink data packet and the slice identifier of the first slice to the application server through the N6 interface. That is, in the embodiment of the present invention, the network side assists in providing the slice identifier and the login mobile phone number, and the application server implements authentication.

[0118] In summary, the embodiment of the present invention transmits the slice identifier of the first slice through the interface between SMF and UPF, and UPF forwards the uplink data packet sent by the terminal and the slice identifier of the first slice to the application server. The application server performs authentication based on the login mobile phone number in the received data packet and the slice identifier of the received first slice. On the one hand, it can authenticate the login mobile phone number of the application to determine whether to provide services. On the other hand, it also authenticates the access network of the link to ensure the rights and interests of the APP application provider who has subscribed to the slice, prevent "freeloading", and protect the due rights and interests of users who have subscribed to the slice, so that VIP users can also enjoy slice services using different terminal devices.

[0119] like Figure 4 As shown, an embodiment of the present invention also provides a slice access authentication method, which is applied to an application server, including:

[0120] Step 41, receiving a first uplink data packet and a slice identifier of a first slice forwarded by a user plane function UPF entity; the first uplink data packet is sent by the terminal to the UPF entity; the slice identifier of the first slice is sent by the session management function SMF entity to the UPF entity; the first uplink data packet carries a login mobile phone number of a target application of the terminal;

[0121] Step 42, determine whether to provide network acceleration service for the terminal based on the login mobile phone number and the slice identifier of the first slice.

[0122] In an embodiment of the present invention, the UPF sends the first uplink data packet sent by the terminal and the slice identifier of the first slice to the application server, and the application server adds a network service authentication mechanism, so that the application server implements authentication.

[0123] Since 5G introduces slicing technology, different business applications can use networks with different characteristics and performance to provide services, forming a three-level service system of network-application-user. Therefore, the subscription relationship between applications and different networks is a new function that the application system in the 5G era needs to manage. Correspondingly, the authentication of user services also needs to be upgraded. In addition to authenticating the identity of the user, it is also necessary to authenticate whether the network of the service matches. In the embodiment of the present invention, based on the original application server account management system (user account management module, business management module, user and business subscription relationship management module), a new network-industry collaborative service authentication module is added, which includes a user service authentication management submodule and a business and network subscription relationship management submodule.

[0124] The service and network subscription relationship management submodule is used for: after users order network slices from operators, they need to specify which services use the slices (for example, after Tencent orders a slice, it specifies which game or games under its umbrella use the slices), and migrates the card users who have signed up for the service to the slices. This module is responsible for storing and managing the subscription relationship between services and networks, including the addition, modification, and deletion of subscription relationships.

[0125] User service authentication management submodule: responsible for storing the authentication processing mechanism and performing logical judgment, that is, authenticating users and network services, determining whether the user has subscribed to the application, whether the application has subscribed to the sliced ​​network service, and whether the network service currently used by the user matches the network slice subscribed to the application.

[0126] As an optional embodiment, step 42 includes:

[0127] If the login mobile phone number has not subscribed to the second slice of the target application, refusing to provide the terminal with network acceleration service;

[0128] If the logged-in mobile phone number has subscribed to the second slice of the target application, determining whether the slice identifier of the second slice subscribed to the logged-in mobile phone number is consistent with the slice identifier of the first slice;

[0129] If the slice identifier of the second slice subscribed to the logged-in mobile phone number is consistent with the slice identifier of the first slice, a network acceleration service is provided for the terminal.

[0130] For example, the second slice is a VIP slice, and applications that have subscribed to the VIP slice can enjoy network acceleration services.

[0131] Optionally, the method further comprises:

[0132] If the slice identifier of the second slice subscribed by the logged-in mobile phone number is inconsistent with the slice identifier of the first slice, a slice redirection request is sent to the policy control function PCF entity, and the slice redirection request carries the slice identifier of the second slice subscribed by the logged-in mobile phone number.

[0133] Further, after sending the slice redirection request to the policy control function PCF entity, the method includes:

[0134] Receive a second uplink data packet and a slice identifier of the second slice forwarded by the UPF entity; the second uplink data packet is sent by the terminal to the UPF entity; the slice identifier of the second slice is sent by the SMF entity to the UPF entity; the second uplink data packet carries the login mobile phone number of the target application of the terminal;

[0135] Based on the login mobile phone number and the slice identifier of the second slice, determine to provide network acceleration service for the terminal.

[0136] In an embodiment of the present invention, after the application server sends a slice redirection request to the PCF, the PCF notifies the terminal to redirect to the second slice through the AMF to which the terminal is currently attached, carrying the slice identifier of the second slice; the terminal side updates the slice selection policy, triggers the network registration process, and determines whether the AMF needs to be reselected (based on whether the second slice contains the current AMF to determine whether the AMF needs to be reselected); the terminal initiates a PDU session establishment request to the AMF after the reselection or the previous AMF, and the PDU session establishment request carries the slice identifier of the second slice; the AMF initiates the control plane slice selection signaling process, completes the AMF selection of the SMF, and implements the PDU session authentication. The SMF determines which UPF to select based on the slice identifier, slice instance identifier (NSI ID), DNN (data packet network), etc. of the second slice. The session establishment is completed between the SMF and the selected UPF. During the session establishment process or after the session establishment is completed, the SMF sends the slice identifier of the second slice to the UPF.

[0137] Optionally, after the session between SMF and UPF is established, SMF also needs to establish a user plane session through a standard user plane session creation process to complete the network channel establishment. After the network channel is established, as an optional embodiment of the present invention, the method further includes:

[0138] The terminal sends a second uplink data packet to the UPF, where the second uplink data packet carries the login mobile phone number of the target application of the terminal;

[0139] The UPF forwards the second uplink data packet and the slice identifier of the second slice to the application server;

[0140] The application server determines to provide network acceleration service to the terminal based on the login mobile phone number and the slice identifier of the second slice.

[0141] like Figure 6 As shown in the figure, the processing flow of the application server includes:

[0142] Step 61: User access request arrives;

[0143] Step 62: The user and service subscription relationship module queries user registration information and service subscription information (e.g., network slicing acceleration service subscription information);

[0144] Step 63: The user service authentication management submodule determines whether the user is a registered user of the application. If yes, the process proceeds to step 64. If not, the service is rejected and the process ends.

[0145] Step 64: The user service authentication management submodule determines whether the application is a registered user and whether the user subscribes to the network slicing acceleration service;

[0146] Step 65, the service and network subscription relationship management submodule queries the network slice subscription information of the network slice acceleration service (for example, queries the slice identifier S-NSSAI corresponding to the acceleration service);

[0147] Step 6: The user service authentication management submodule determines whether the currently used network slice service matches the subscription information. If so, proceed to step 67; if not, proceed to step 68.

[0148] Step 67: Return a user access authentication success response;

[0149] Step 68, request network redirection, request redirection to the subscribed slice. If the user is currently using the default slice of the large network and has subscribed to the high-level slice acceleration service, redirect to the high-level slice. If the user is currently using a high-level slice network but has not subscribed to the high-level slice acceleration service, redirect to the default slice of the large network.

[0150] In summary, the embodiment of the present invention transmits the slice identifier of the first slice through the interface between SMF and UPF, and UPF forwards the uplink data packet sent by the terminal and the slice identifier of the first slice to the application server. The application server performs authentication based on the login mobile phone number in the received data packet and the slice identifier of the received first slice. On the one hand, it can authenticate the login mobile phone number of the application to determine whether to provide services. On the other hand, it also authenticates the access network of the link to ensure the rights and interests of the APP application provider who has subscribed to the slice, prevent "freeloading", and protect the due rights and interests of users who have subscribed to the slice, so that VIP users can also enjoy slice services using different terminal devices.

[0151] like Figure 7 As shown, an embodiment of the present invention further provides a slice access authentication method, which is applied to a policy control function PCF entity, including:

[0152] Step 71, receive a slice redirection request sent by the application server, wherein the slice redirection request carries the slice identifier of the second slice subscribed to the login mobile phone number of the target application of the terminal; for example, the application server sends a slice redirection request through the N5 interface, carrying the slice identifier of the second slice.

[0153] Step 72: According to the slice redirection request, redirection indication information is sent to the terminal to instruct the terminal to redirect to the second slice; wherein the redirection indication information carries the slice identifier of the second slice.

[0154] The embodiment of the present invention transforms PCF and adds a new strategy generation and triggering mechanism. Figure 8 As shown, the embodiment of the present invention adds an application request redirection policy management module based on the original PCF subscription relationship policy management module, which is responsible for receiving redirection requests from application servers for access to terminal networks, generating redirection NSSP policies, and issuing them to the terminal through the terminal access AMF.

[0155] Optionally, step 72 includes:

[0156] Generate a slice selection strategy according to the slice redirection request; the slice selection strategy is used to trigger the terminal to initiate a network registration process;

[0157] The slice selection strategy is sent to the terminal, wherein the slice selection strategy includes the redirection indication information.

[0158] In an embodiment of the present invention, after the application server sends a slice redirection request to the PCF, the PCF notifies the terminal to redirect to the second slice through the AMF to which the terminal is currently attached, carrying the slice identifier of the second slice; the terminal side updates the slice selection policy, triggers the network registration process, and determines whether the AMF needs to be reselected (based on whether the second slice contains the current AMF to determine whether the AMF needs to be reselected); the terminal initiates a PDU session establishment request to the AMF after the reselection or the previous AMF, and the PDU session establishment request carries the slice identifier of the second slice; the AMF initiates the control plane slice selection signaling process, completes the AMF selection of the SMF, and implements the PDU session authentication. The SMF determines which UPF to select based on the slice identifier, slice instance identifier (NSI ID), DNN (data packet network), etc. of the second slice. The session establishment is completed between the SMF and the selected UPF. During the session establishment process or after the session establishment is completed, the SMF sends the slice identifier of the second slice to the UPF.

[0159] Optionally, after the session between SMF and UPF is established, SMF also needs to establish a user plane session through a standard user plane session creation process to complete the network channel establishment. After the network channel is established, as an optional embodiment of the present invention, the method further includes:

[0160] The terminal sends a second uplink data packet to the UPF, where the second uplink data packet carries the login mobile phone number of the target application of the terminal;

[0161] The UPF forwards the second uplink data packet and the slice identifier of the second slice to the application server;

[0162] The application server determines to provide network acceleration service to the terminal based on the login mobile phone number and the slice identifier of the second slice.

[0163] In summary, the embodiment of the present invention transmits the slice identifier of the first slice through the interface between SMF and UPF, and UPF forwards the uplink data packet sent by the terminal and the slice identifier of the first slice to the application server. The application server performs authentication based on the login mobile phone number in the received data packet and the slice identifier of the received first slice. On the one hand, it can authenticate the login mobile phone number of the application to determine whether to provide services. On the other hand, it also authenticates the access network of the link to ensure the rights and interests of the APP application provider who has subscribed to the slice, prevent "freeloading", and protect the due rights and interests of users who have subscribed to the slice, so that VIP users can also enjoy slice services using different terminal devices.

[0164] like Fig. 9 As shown, an embodiment of the present invention also provides a slice access authentication method, which is applied to a terminal, including:

[0165] Step 91: receiving redirection indication information sent by a policy control function PCF entity, where the redirection indication information is used to instruct the terminal to redirect to the second slice; wherein the redirection indication information carries a slice identifier of the second slice;

[0166] Step 92: redirect to the second slice according to the redirection indication information.

[0167] Based on the original terminal, the embodiment of the present invention adds a redirection policy update module, which is responsible for receiving the slice redirection instruction from the PCF, generating the redirection NSSP policy, and triggering the network redirection registration process. The redirection NSSP policy contains the binding relationship between the APP ID / APP application server IP address and the redirection network slice identifier. The terminal initiates the redirection registration process with the slice identifier of the second slice, reattaches to the AMF, and when the terminal initiates a PDU session establishment request, it searches for the corresponding slice identifier in the redirection NSSP and sends it to the network side.

[0168] Optionally, in the above embodiment of the present invention, the second slice is a slice subscribed to the login mobile phone number of the target application of the terminal.

[0169] As an optional embodiment, step 91 includes:

[0170] Receive a slice selection policy sent by a PCF entity, where the slice selection policy includes the redirection indication information.

[0171] Accordingly, step 92 includes:

[0172] Generate a redirection strategy according to the slice selection strategy; wherein the redirection strategy includes: a binding relationship between an identifier of a target application and the second slice, and / or a binding relationship between an IP address of an application server and the second slice;

[0173] According to the redirection strategy, a network registration process is initiated to attach to the access and mobility management function AMF entity; the network registration process carries the slice identifier of the second slice; and the AMF entity sends the slice identifier of the second slice to the session management function SMF entity.

[0174] In an embodiment of the present invention, after the application server sends a slice redirection request to the PCF, the PCF notifies the terminal to redirect to the second slice through the AMF to which the terminal is currently attached, carrying the slice identifier of the second slice; the terminal side updates the slice selection policy, triggers the network registration process, and determines whether the AMF needs to be reselected (based on whether the second slice contains the current AMF to determine whether the AMF needs to be reselected); the terminal initiates a PDU session establishment request to the AMF after the reselection or the previous AMF, and the PDU session establishment request carries the slice identifier of the second slice; the AMF initiates the control plane slice selection signaling process, completes the AMF selection of the SMF, and implements the PDU session authentication. The SMF determines which UPF to select based on the slice identifier, slice instance identifier (NSI ID), DNN (data packet network), etc. of the second slice. The session establishment is completed between the SMF and the selected UPF. During the session establishment process or after the session establishment is completed, the SMF sends the slice identifier of the second slice to the UPF.

[0175] Optionally, after the session between SMF and UPF is established, SMF also needs to establish a user plane session through a standard user plane session creation process to complete the network channel establishment. After the network channel is established, as an optional embodiment of the present invention, the method further includes:

[0176] The terminal sends a second uplink data packet to the UPF, where the second uplink data packet carries the login mobile phone number of the target application of the terminal;

[0177] The UPF forwards the second uplink data packet and the slice identifier of the second slice to the application server;

[0178] The application server determines to provide network acceleration service to the terminal based on the login mobile phone number and the slice identifier of the second slice.

[0179] In summary, the embodiment of the present invention transmits the slice identifier of the first slice through the interface between SMF and UPF, and UPF forwards the uplink data packet sent by the terminal and the slice identifier of the first slice to the application server. The application server performs authentication based on the login mobile phone number in the received data packet and the slice identifier of the received first slice. On the one hand, it can authenticate the login mobile phone number of the application to determine whether to provide services. On the other hand, it also authenticates the access network of the link to ensure the rights and interests of the APP application provider who has subscribed to the slice, prevent "freeloading", and protect the due rights and interests of users who have subscribed to the slice, so that VIP users can also enjoy slice services using different terminal devices.

[0180] like Fig.10 As shown, the complete process of the slice access authentication method provided by the embodiment of the present invention specifically includes:

[0181] 0. The terminal selects the appropriate S-NSSAI in the NSSP according to the APP information (APP ID / destination IP address), and checks whether it exists in the allowed NSSAI. If it exists, it enters the following process;

[0182] Step 1: The terminal initiates a PDU session creation request, carrying the session ID, slice identifier S-NSSAI, and 5G-GUTI;

[0183] Step 2: The network side initiates the control plane slice selection signaling process to complete the AMF selection of SMF;

[0184] Step 3: PDU session authentication;

[0185] Step 4: SMF determines which UPF to select based on the slice identifier S-NSSAI, slice instance identifier NSI ID, DNN, etc.

[0186] Step 5: SMF and UPF complete session establishment, carrying the slice identifier S-NSSAI;

[0187] Step 6, step 7, step 8, and step 9 are standard user plane session creation processes;

[0188] Step 10: The network channel is established and data packets can be sent;

[0189] Step 11: The application sends an uplink data packet, carrying the login mobile phone number used to log in to the application on the APP side;

[0190] Step 12: UPF forwards the data packet to the application server, carrying the slice identifier S-NSSAI;

[0191] Step 13: The application server determines whether the mobile phone number has subscribed to the VIP slice of the application. If so, it proceeds to step 14a; if not, it proceeds to step 14b;

[0192] Step 14a, continue to determine whether the slice identifier subscribed by the mobile phone number is consistent with the slice identifier currently uploaded, if so, proceed to step 15a, if not, proceed to step 15b;

[0193] Step 14b: The application server refuses to provide services to the user, and the terminal side APP prompts that the network acceleration service is interrupted or the acceleration service access fails;

[0194] Step 15a: Continue communication, send downlink data packets, and the terminal user continues to use the network acceleration service;

[0195] Step 15b: Notify the PCF of the VIP slice ID subscribed to the mobile phone number and request slice redirection;

[0196] Step 16: PCF generates a new slice selection strategy;

[0197] Step 17: The PCF notifies the UE terminal to redirect to the target slice through the AMF to which the current terminal is attached, carrying the target slice identifier S-NSSAI;

[0198] Step 18: The terminal side updates the slice selection strategy and triggers the network registration process;

[0199] Step 19: The terminal initiates a network registration process to determine whether AMF needs to be reselected (because the new slice does not necessarily contain the current AMF network element);

[0200] Step 20: Re-initiate the PDU session establishment process, that is, enter step 1, carrying the slice identifier of the target slice.

[0201] In summary, the embodiment of the present invention transmits the slice identifier of the first slice through the interface between SMF and UPF, and UPF forwards the uplink data packet sent by the terminal and the slice identifier of the first slice to the application server. The application server performs authentication based on the login mobile phone number in the received data packet and the slice identifier of the received first slice. On the one hand, it can authenticate the login mobile phone number of the application to determine whether to provide services. On the other hand, it also authenticates the access network of the link to ensure the rights and interests of the APP application provider who has subscribed to the slice, prevent "freeloading", and protect the due rights and interests of users who have subscribed to the slice, so that VIP users can also enjoy slice services using different terminal devices.

[0202] like Fig.11 As shown, an embodiment of the present invention also provides a slice access authentication device, which is applied to a user plane function UPF entity, including:

[0203] The first receiving module 101 is used to complete session establishment with a session management function SMF entity and receive a slice identifier of a first slice sent by the SMF entity.

[0204] Optionally, as an optional embodiment of the present invention, the device further includes:

[0205] An eleventh receiving module, configured to receive a first uplink data packet sent by a terminal, wherein the first uplink data packet carries a login mobile phone number of a target application of the terminal;

[0206] The first forwarding module is used to forward the first uplink data packet and the slice identifier of the first slice to the application server, so that the application server determines whether to provide network acceleration service for the terminal according to the login mobile phone number and the slice identifier of the first slice.

[0207] In summary, the embodiment of the present invention transmits the slice identifier of the first slice through the interface between SMF and UPF, and UPF forwards the uplink data packet sent by the terminal and the slice identifier of the first slice to the application server. The application server performs authentication based on the login mobile phone number in the received data packet and the slice identifier of the received first slice. On the one hand, it can authenticate the login mobile phone number of the application to determine whether to provide services. On the other hand, it also authenticates the access network of the link to ensure the rights and interests of the APP application provider who has subscribed to the slice, prevent "freeloading", and protect the due rights and interests of users who have subscribed to the slice, so that VIP users can also enjoy slice services using different terminal devices.

[0208] It should be noted that the slice access authentication device provided in the embodiment of the present invention is a device capable of executing the above-mentioned slice access authentication method. All embodiments of the above-mentioned slice access authentication method are applicable to the device and can achieve the same or similar beneficial effects.

[0209] like Fig.12 As shown, an embodiment of the present invention further provides a user plane function UPF entity, including a processor 200 and a transceiver 210, wherein the transceiver 210 receives and sends data under the control of the processor 200, and the processor 200 is used to perform the following operations:

[0210] Complete session establishment with the session management function SMF entity, and receive the slice identifier of the first slice sent by the SMF entity.

[0211] Optionally, as an optional embodiment of the present invention, the processor 200 is further configured to perform the following operations:

[0212] Receiving a first uplink data packet sent by a terminal, wherein the first uplink data packet carries a login mobile phone number of a target application of the terminal;

[0213] The first uplink data packet and the slice identifier of the first slice are forwarded to the application server, so that the application server determines whether to provide network acceleration service for the terminal based on the login mobile phone number and the slice identifier of the first slice.

[0214] In summary, the embodiment of the present invention transmits the slice identifier of the first slice through the interface between SMF and UPF, and UPF forwards the uplink data packet sent by the terminal and the slice identifier of the first slice to the application server. The application server performs authentication based on the login mobile phone number in the received data packet and the slice identifier of the received first slice. On the one hand, it can authenticate the login mobile phone number of the application to determine whether to provide services. On the other hand, it also authenticates the access network of the link to ensure the rights and interests of the APP application provider who has subscribed to the slice, prevent "freeloading", and protect the due rights and interests of users who have subscribed to the slice, so that VIP users can also enjoy slice services using different terminal devices.

[0215] It should be noted that the UPF entity provided in the embodiment of the present invention is a UPF capable of executing the above-mentioned slice access authentication method. Then all embodiments of the above-mentioned slice access authentication method are applicable to the UPF entity and can achieve the same or similar beneficial effects.

[0216] like Fig.13 As shown, an embodiment of the present invention further provides a slice access authentication device, which is applied to an application server, including:

[0217] The second receiving module 130 is used to receive a first uplink data packet and a slice identifier of a first slice forwarded by a user plane function UPF entity; the first uplink data packet is sent by the terminal to the UPF entity; the slice identifier of the first slice is sent by the session management function SMF entity to the UPF entity; the first uplink data packet carries a login mobile phone number of a target application of the terminal;

[0218] The judgment module 131 is used to determine whether to provide network acceleration service for the terminal according to the login mobile phone number and the slice identifier of the first slice.

[0219] Optionally, as an optional embodiment of the present invention, the judgment module includes:

[0220] The first submodule is used to refuse to provide the network acceleration service for the terminal if the login mobile phone number does not subscribe to the second slice of the target application;

[0221] The second submodule is used to determine whether the slice identifier of the second slice subscribed by the login mobile phone number is consistent with the slice identifier of the first slice if the login mobile phone number has subscribed to the second slice of the target application;

[0222] The third submodule is used to provide network acceleration service for the terminal if the slice identifier of the second slice subscribed by the logged-in mobile phone number is consistent with the slice identifier of the first slice.

[0223] Optionally, as an optional embodiment of the present invention, the device further includes:

[0224] The fourth submodule is used to send a slice redirection request to the policy control function PCF entity if the slice identifier of the second slice subscribed by the login mobile phone number is inconsistent with the slice identifier of the first slice, and the slice redirection request carries the slice identifier of the second slice subscribed by the login mobile phone number.

[0225] Optionally, as an optional embodiment of the present invention, the device includes:

[0226] A twelfth receiving module, configured to receive a second uplink data packet and a slice identifier of the second slice forwarded by the UPF entity; the second uplink data packet is sent by the terminal to the UPF entity; the slice identifier of the second slice is sent by the SMF entity to the UPF entity; the second uplink data packet carries a login mobile phone number of the target application of the terminal;

[0227] A determination module is used to determine whether to provide network acceleration service for the terminal based on the login mobile phone number and the slice identifier of the second slice.

[0228] In summary, the embodiment of the present invention transmits the slice identifier of the first slice through the interface between SMF and UPF, and UPF forwards the uplink data packet sent by the terminal and the slice identifier of the first slice to the application server. The application server performs authentication based on the login mobile phone number in the received data packet and the slice identifier of the received first slice. On the one hand, it can authenticate the login mobile phone number of the application to determine whether to provide services. On the other hand, it also authenticates the access network of the link to ensure the rights and interests of the APP application provider who has subscribed to the slice, prevent "freeloading", and protect the due rights and interests of users who have subscribed to the slice, so that VIP users can also enjoy slice services using different terminal devices.

[0229] It should be noted that the slice access authentication device provided in the embodiment of the present invention is a device capable of executing the above-mentioned slice access authentication method. All embodiments of the above-mentioned slice access authentication method are applicable to the device and can achieve the same or similar beneficial effects.

[0230] like Fig.12 As shown, an embodiment of the present invention further provides an application server, including a processor 200 and a transceiver 210, wherein the transceiver 210 receives and sends data under the control of the processor 200, and the processor 200 is used to perform the following operations:

[0231] Receive a first uplink data packet and a slice identifier of a first slice forwarded by a user plane function UPF entity; the first uplink data packet is sent by the terminal to the UPF entity; the slice identifier of the first slice is sent by the session management function SMF entity to the UPF entity; the first uplink data packet carries a login mobile phone number of a target application of the terminal;

[0232] Determine whether to provide network acceleration service for the terminal based on the login mobile phone number and the slice identifier of the first slice.

[0233] Optionally, as an optional embodiment of the present invention, the processor is further configured to perform the following operations:

[0234] If the login mobile phone number has not subscribed to the second slice of the target application, refusing to provide the terminal with network acceleration service;

[0235] If the logged-in mobile phone number has subscribed to the second slice of the target application, determining whether the slice identifier of the second slice subscribed to the logged-in mobile phone number is consistent with the slice identifier of the first slice;

[0236] If the slice identifier of the second slice subscribed to the logged-in mobile phone number is consistent with the slice identifier of the first slice, a network acceleration service is provided for the terminal.

[0237] Optionally, as an optional embodiment of the present invention, the processor is further configured to perform the following operations:

[0238] If the slice identifier of the second slice subscribed by the logged-in mobile phone number is inconsistent with the slice identifier of the first slice, a slice redirection request is sent to the policy control function PCF entity, and the slice redirection request carries the slice identifier of the second slice subscribed by the logged-in mobile phone number.

[0239] Optionally, as an optional embodiment of the present invention, the processor is further configured to perform the following operations:

[0240] Receive a second uplink data packet and a slice identifier of the second slice forwarded by the UPF entity; the second uplink data packet is sent by the terminal to the UPF entity; the slice identifier of the second slice is sent by the SMF entity to the UPF entity; the second uplink data packet carries the login mobile phone number of the target application of the terminal;

[0241] Based on the login mobile phone number and the slice identifier of the second slice, determine to provide network acceleration service for the terminal.

[0242] In summary, the embodiment of the present invention transmits the slice identifier of the first slice through the interface between SMF and UPF, and UPF forwards the uplink data packet sent by the terminal and the slice identifier of the first slice to the application server. The application server performs authentication based on the login mobile phone number in the received data packet and the slice identifier of the received first slice. On the one hand, it can authenticate the login mobile phone number of the application to determine whether to provide services. On the other hand, it also authenticates the access network of the link to ensure the rights and interests of the APP application provider who has subscribed to the slice, prevent "freeloading", and protect the due rights and interests of users who have subscribed to the slice, so that VIP users can also enjoy slice services using different terminal devices.

[0243] It should be noted that the application server provided in the embodiment of the present invention is an application server capable of executing the above-mentioned slice access authentication method. All embodiments of the above-mentioned slice access authentication method are applicable to the application server and can achieve the same or similar beneficial effects.

[0244] like Fig.14 As shown, an embodiment of the present invention further provides a slice access authentication device, which is applied to a policy control function PCF entity, including:

[0245] The third receiving module 140 is used to receive a slice redirection request sent by the application server, where the slice redirection request carries a slice identifier of a second slice subscribed to by a login mobile phone number of a target application of the terminal;

[0246] The first sending module 141 is used to send redirection indication information to the terminal according to the slice redirection request, which is used to instruct the terminal to redirect to the second slice; wherein the redirection indication information carries the slice identifier of the second slice.

[0247] Optionally, as an optional embodiment of the present invention, the first sending module includes:

[0248] A generating submodule, configured to generate a slice selection strategy according to the slice redirection request; the slice selection strategy is used to trigger the terminal to initiate a network registration process;

[0249] The sending submodule is used to send the slice selection strategy to the terminal, and the slice selection strategy includes the redirection indication information.

[0250] In summary, the embodiment of the present invention transmits the slice identifier of the first slice through the interface between SMF and UPF, and UPF forwards the uplink data packet sent by the terminal and the slice identifier of the first slice to the application server. The application server performs authentication based on the login mobile phone number in the received data packet and the slice identifier of the received first slice. On the one hand, it can authenticate the login mobile phone number of the application to determine whether to provide services. On the other hand, it also authenticates the access network of the link to ensure the rights and interests of the APP application provider who has subscribed to the slice, prevent "freeloading", and protect the due rights and interests of users who have subscribed to the slice, so that VIP users can also enjoy slice services using different terminal devices.

[0251] It should be noted that the slice access authentication device provided in the embodiment of the present invention is a device capable of executing the above-mentioned slice access authentication method. All embodiments of the above-mentioned slice access authentication method are applicable to the device and can achieve the same or similar beneficial effects.

[0252] like Fig.12 As shown, the embodiment of the present invention further provides a policy control function PCF entity, including a processor 200 and a transceiver 210, wherein the transceiver 210 receives and sends data under the control of the processor 200, and the processor 200 is used to perform the following operations:

[0253] Receive a slice redirection request sent by an application server, where the slice redirection request carries a slice identifier of a second slice subscribed to by a login mobile phone number of a target application of the terminal;

[0254] According to the slice redirection request, redirection indication information for instructing the terminal to redirect to the second slice is sent to the terminal; wherein the redirection indication information carries a slice identifier of the second slice.

[0255] Optionally, as an optional embodiment of the present invention, the processor is further configured to perform the following operations:

[0256] Generate a slice selection strategy according to the slice redirection request; the slice selection strategy is used to trigger the terminal to initiate a network registration process;

[0257] The slice selection strategy is sent to the terminal, wherein the slice selection strategy includes the redirection indication information.

[0258] In summary, the embodiment of the present invention transmits the slice identifier of the first slice through the interface between SMF and UPF, and UPF forwards the uplink data packet sent by the terminal and the slice identifier of the first slice to the application server. The application server performs authentication based on the login mobile phone number in the received data packet and the slice identifier of the received first slice. On the one hand, it can authenticate the login mobile phone number of the application to determine whether to provide services. On the other hand, it also authenticates the access network of the link to ensure the rights and interests of the APP application provider who has subscribed to the slice, prevent "freeloading", and protect the due rights and interests of users who have subscribed to the slice, so that VIP users can also enjoy slice services using different terminal devices.

[0259] It should be noted that the PCF entity provided in the embodiment of the present invention is a PCF entity capable of executing the above-mentioned slice access authentication method. All embodiments of the above-mentioned slice access authentication method are applicable to the PCF entity and can achieve the same or similar beneficial effects.

[0260] like Fig.15 As shown, an embodiment of the present invention further provides a slice access authentication device, which is applied to a terminal, including:

[0261] The fourth receiving module 150 is used to receive redirection indication information sent by the policy control function PCF entity, where the redirection indication information is used to instruct the terminal to redirect to the second slice; wherein the redirection indication information carries a slice identifier of the second slice;

[0262] The redirection module 151 is used to redirect to the second slice according to the redirection indication information.

[0263] Optionally, as an optional embodiment of the present invention, the second slice is a slice subscribed to the login mobile phone number of the target application of the terminal.

[0264] Optionally, as an optional embodiment of the present invention, the fourth receiving module includes:

[0265] The sixth submodule is used to receive the slice selection strategy sent by the PCF entity, and the slice selection strategy includes the redirection indication information.

[0266] Optionally, as an optional embodiment of the present invention, the redirection module includes:

[0267] A seventh submodule is used to generate a redirection strategy according to the slice selection strategy; wherein the redirection strategy includes: a binding relationship between an identifier of a target application and the second slice, and / or a binding relationship between an IP address of an application server and the second slice;

[0268] The eighth sub-module is used to initiate a network registration process to attach to the access and mobility management function AMF entity according to the redirection strategy; the network registration process carries the slice identifier of the second slice; and the AMF entity sends the slice identifier of the second slice to the session management function SMF entity.

[0269] In summary, the embodiment of the present invention transmits the slice identifier of the first slice through the interface between SMF and UPF, and UPF forwards the uplink data packet sent by the terminal and the slice identifier of the first slice to the application server. The application server performs authentication based on the login mobile phone number in the received data packet and the slice identifier of the received first slice. On the one hand, it can authenticate the login mobile phone number of the application to determine whether to provide services. On the other hand, it also authenticates the access network of the link to ensure the rights and interests of the APP application provider who has subscribed to the slice, prevent "freeloading", and protect the due rights and interests of users who have subscribed to the slice, so that VIP users can also enjoy slice services using different terminal devices.

[0270] It should be noted that the slice access authentication device provided in the embodiment of the present invention is a device capable of executing the above-mentioned slice access authentication method. All embodiments of the above-mentioned slice access authentication method are applicable to the device and can achieve the same or similar beneficial effects.

[0271] like Fig.12 As shown, an embodiment of the present invention further provides a terminal, including a processor 200 and a transceiver 210, wherein the transceiver 210 receives and sends data under the control of the processor 200, and the processor 200 is used to perform the following operations:

[0272] receiving redirection indication information sent by a policy control function PCF entity, where the redirection indication information is used to instruct the terminal to redirect to the second slice; wherein the redirection indication information carries a slice identifier of the second slice;

[0273] Redirect to the second slice according to the redirection indication information.

[0274] Optionally, as an optional embodiment of the present invention, the second slice is a slice subscribed to the login mobile phone number of the target application of the terminal.

[0275] Optionally, as an optional embodiment of the present invention, the processor is further configured to perform the following operations:

[0276] Receive a slice selection policy sent by a PCF entity, where the slice selection policy includes the redirection indication information.

[0277] Optionally, as an optional embodiment of the present invention, the processor is further configured to perform the following operations:

[0278] Generate a redirection strategy according to the slice selection strategy; wherein the redirection strategy includes: a binding relationship between an identifier of a target application and the second slice, and / or a binding relationship between an IP address of an application server and the second slice;

[0279] According to the redirection strategy, a network registration process is initiated to attach to the access and mobility management function AMF entity; the network registration process carries the slice identifier of the second slice; and the AMF entity sends the slice identifier of the second slice to the session management function SMF entity.

[0280] In summary, the embodiment of the present invention transmits the slice identifier of the first slice through the interface between SMF and UPF, and UPF forwards the uplink data packet sent by the terminal and the slice identifier of the first slice to the application server. The application server performs authentication based on the login mobile phone number in the received data packet and the slice identifier of the received first slice. On the one hand, it can authenticate the login mobile phone number of the application to determine whether to provide services. On the other hand, it also authenticates the access network of the link to ensure the rights and interests of the APP application provider who has subscribed to the slice, prevent "freeloading", and protect the due rights and interests of users who have subscribed to the slice, so that VIP users can also enjoy slice services using different terminal devices.

[0281] It should be noted that the terminal provided in the embodiment of the present invention is a terminal capable of executing the above-mentioned slice access authentication method, then all embodiments of the above-mentioned slice access authentication method are applicable to the terminal and can achieve the same or similar beneficial effects.

[0282] An embodiment of the present invention also provides a communication device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the various processes in the slice access authentication method embodiment as described above are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0283] The embodiment of the present invention also provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, each process in the slice access authentication method embodiment described above is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. The computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0284] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to disk storage and optical storage, etc.) containing computer-usable program code.

[0285] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A device that specifies functions in one or more processes and / or one or more blocks.

[0286] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable storage medium produce a paper product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0287] These computer program instructions may also be loaded onto a computer or other programmable data processing device so that the computer or other programmable device executes a series of operating steps to produce a computer-implemented process, thereby providing instructions executed on the computer or other programmable device for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0288] The above is a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A slice access authentication method, applied to a user plane function UPF entity, characterized in that: include: Complete session establishment with the session management function SMF entity, and receive the slice identifier of the first slice sent by the SMF entity; Wherein, the method further comprises: Receiving a first uplink data packet sent by a terminal, wherein the first uplink data packet carries a login mobile phone number of a target application of the terminal; The first uplink data packet and the slice identifier of the first slice are forwarded to the application server, so that the application server determines whether to provide network acceleration service for the terminal based on the login mobile phone number and the slice identifier of the first slice.

2. A slice access authentication method, applied to an application server, characterized in that: include: Receive a first uplink data packet and a slice identifier of a first slice forwarded by a user plane function UPF entity; The first uplink data packet is sent by the terminal to the UPF entity; the slice identifier of the first slice is sent by the session management function SMF entity to the UPF entity; the first uplink data packet carries the login mobile phone number of the target application of the terminal; Determine whether to provide network acceleration service for the terminal based on the login mobile phone number and the slice identifier of the first slice.

3. The method according to claim 2, characterized in that The determining whether to provide a network acceleration service for the terminal according to the login mobile phone number and the slice identifier of the first slice includes: If the login mobile phone number has not subscribed to the second slice of the target application, refusing to provide the terminal with network acceleration service; If the logged-in mobile phone number has subscribed to the second slice of the target application, determining whether the slice identifier of the second slice subscribed to the logged-in mobile phone number is consistent with the slice identifier of the first slice; If the slice identifier of the second slice subscribed to the logged-in mobile phone number is consistent with the slice identifier of the first slice, a network acceleration service is provided for the terminal.

4. The method according to claim 3, characterized in that The method further comprises: If the slice identifier of the second slice subscribed by the logged-in mobile phone number is inconsistent with the slice identifier of the first slice, a slice redirection request is sent to the policy control function PCF entity, and the slice redirection request carries the slice identifier of the second slice subscribed by the logged-in mobile phone number.

5. The method according to claim 4, characterized in that After sending the slice redirection request to the policy control function PCF entity, the method includes: Receive a second uplink data packet and a slice identifier of the second slice forwarded by the UPF entity; the second uplink data packet is sent by the terminal to the UPF entity; the slice identifier of the second slice is sent by the SMF entity to the UPF entity; the second uplink data packet carries the login mobile phone number of the target application of the terminal; Based on the login mobile phone number and the slice identifier of the second slice, determine to provide network acceleration service for the terminal.

6. A slice access authentication method, applied to a policy control function PCF entity, characterized in that: include: Receive a slice redirection request sent by an application server, where the slice redirection request carries a slice identifier of a second slice subscribed to by a login mobile phone number of a target application of the terminal; According to the slice redirection request, redirection indication information for instructing the terminal to redirect to the second slice is sent to the terminal; wherein the redirection indication information carries a slice identifier of the second slice.

7. The method according to claim 6, characterized in that The sending, according to the slice redirection request, to the terminal redirection indication information for instructing the terminal to redirect to the second slice includes: Generate a slice selection strategy according to the slice redirection request; the slice selection strategy is used to trigger the terminal to initiate a network registration process; The slice selection strategy is sent to the terminal, wherein the slice selection strategy includes the redirection indication information.

8. A slice access authentication method, applied to a terminal, characterized in that: include: receiving redirection indication information sent by a policy control function PCF entity, where the redirection indication information is used to instruct the terminal to redirect to a second slice; wherein the redirection indication information carries a slice identifier of the second slice; According to the redirection indication information, redirect to the second slice; the second slice is the slice subscribed to the login mobile phone number of the terminal's target application; the application server can determine to provide network acceleration service for the terminal based on the login mobile phone number and the slice identifier of the second slice.

9. The method according to claim 8, characterized in that The receiving redirection indication information sent by the PCF entity includes: Receive a slice selection policy sent by a PCF entity, where the slice selection policy includes the redirection indication information.

10. The method according to claim 9, characterized in that Redirecting to the second slice according to the redirection indication information includes: Generate a redirection strategy according to the slice selection strategy; wherein the redirection strategy includes: a binding relationship between an identifier of a target application and the second slice, and / or a binding relationship between an IP address of an application server and the second slice; According to the redirection strategy, a network registration process is initiated to attach to the access and mobility management function AMF entity; the network registration process carries the slice identifier of the second slice; and the AMF entity sends the slice identifier of the second slice to the session management function SMF entity.

11. A slice access authentication device, applied to a user plane function UPF entity, characterized in that: include: A first receiving module is used to complete session establishment with a session management function SMF entity and receive a slice identifier of a first slice sent by the SMF entity; Wherein, the device further comprises: An eleventh receiving module, configured to receive a first uplink data packet sent by a terminal, wherein the first uplink data packet carries a login mobile phone number of a target application of the terminal; The first forwarding module is used to forward the first uplink data packet and the slice identifier of the first slice to the application server, so that the application server determines whether to provide network acceleration service for the terminal according to the login mobile phone number and the slice identifier of the first slice.

12. A user plane function (UPF) entity, comprising a processor and a transceiver, wherein the transceiver receives and sends data under the control of the processor, characterized in that: The processor is configured to perform the following operations: Complete session establishment with the session management function SMF entity, and receive the slice identifier of the first slice sent by the SMF entity; The processor is further configured to perform the following operations: Receiving a first uplink data packet sent by a terminal, wherein the first uplink data packet carries a login mobile phone number of a target application of the terminal; The first uplink data packet and the slice identifier of the first slice are forwarded to the application server, so that the application server determines whether to provide network acceleration service for the terminal based on the login mobile phone number and the slice identifier of the first slice.

13. A slice access authentication device, applied to an application server, characterized in that: include: A second receiving module, used to receive a first uplink data packet and a slice identifier of a first slice forwarded by a user plane function UPF entity; The first uplink data packet is sent by the terminal to the UPF entity; the slice identifier of the first slice is sent by the session management function SMF entity to the UPF entity; the first uplink data packet carries the login mobile phone number of the target application of the terminal; A judgment module is used to determine whether to provide network acceleration service for the terminal based on the login mobile phone number and the slice identifier of the first slice.

14. An application server, comprising a processor and a transceiver, wherein the transceiver receives and sends data under the control of the processor, characterized in that: The processor is configured to perform the following operations: Receive a first uplink data packet and a slice identifier of a first slice forwarded by a user plane function UPF entity; the first uplink data packet is sent by the terminal to the UPF entity; the slice identifier of the first slice is sent by the session management function SMF entity to the UPF entity; the first uplink data packet carries a login mobile phone number of a target application of the terminal; Determine whether to provide network acceleration service for the terminal based on the login mobile phone number and the slice identifier of the first slice.

15. The application server according to claim 14, characterized in that: The processor is further configured to perform the following operations: If the login mobile phone number has not subscribed to the second slice of the target application, refusing to provide the terminal with network acceleration service; If the logged-in mobile phone number has subscribed to the second slice of the target application, determining whether the slice identifier of the second slice subscribed to the logged-in mobile phone number is consistent with the slice identifier of the first slice; If the slice identifier of the second slice subscribed to the logged-in mobile phone number is consistent with the slice identifier of the first slice, a network acceleration service is provided for the terminal.

16. The application server according to claim 15, characterized in that: The processor is further configured to perform the following operations: If the slice identifier of the second slice subscribed by the logged-in mobile phone number is inconsistent with the slice identifier of the first slice, a slice redirection request is sent to the policy control function PCF entity, and the slice redirection request carries the slice identifier of the second slice subscribed by the logged-in mobile phone number.

17. The application server according to claim 16, characterized in that: The processor is further configured to perform the following operations: Receive a second uplink data packet and a slice identifier of the second slice forwarded by the UPF entity; the second uplink data packet is sent by the terminal to the UPF entity; the slice identifier of the second slice is sent by the SMF entity to the UPF entity; the second uplink data packet carries the login mobile phone number of the target application of the terminal; Based on the login mobile phone number and the slice identifier of the second slice, determine to provide network acceleration service for the terminal.

18. A slice access authentication device, applied to a policy control function PCF entity, characterized in that: include: A third receiving module is used to receive a slice redirection request sent by the application server, where the slice redirection request carries a slice identifier of a second slice subscribed to by a login mobile phone number of a target application of the terminal; The first sending module is used to send redirection indication information to the terminal according to the slice redirection request, which is used to instruct the terminal to redirect to the second slice; wherein the redirection indication information carries the slice identifier of the second slice.

19. A policy control function (PCF) entity, comprising a processor and a transceiver, wherein the transceiver receives and sends data under the control of the processor, characterized in that: The processor is configured to perform the following operations: Receive a slice redirection request sent by an application server, where the slice redirection request carries a slice identifier of a second slice subscribed to by a login mobile phone number of a target application of the terminal; According to the slice redirection request, redirection indication information for instructing the terminal to redirect to the second slice is sent to the terminal; wherein the redirection indication information carries a slice identifier of the second slice.

20. The PCF entity according to claim 19, characterized in that: The processor is further configured to perform the following operations: Generate a slice selection strategy according to the slice redirection request; the slice selection strategy is used to trigger the terminal to initiate a network registration process; The slice selection strategy is sent to the terminal, wherein the slice selection strategy includes the redirection indication information.

21. A slice access authentication device, applied to a terminal, characterized in that: include: a fourth receiving module, configured to receive redirection indication information sent by a policy control function PCF entity, wherein the redirection indication information is used to instruct the terminal to redirect to a second slice; wherein the redirection indication information carries a slice identifier of the second slice; A redirection module is used to redirect to the second slice according to the redirection indication information; the second slice is the slice subscribed to the login mobile phone number of the target application of the terminal; so that the application server can determine to provide network acceleration service for the terminal according to the login mobile phone number and the slice identifier of the second slice.

22. A terminal comprising a processor and a transceiver, wherein the transceiver receives and sends data under the control of the processor, characterized in that: The processor is configured to perform the following operations: receiving redirection indication information sent by a policy control function PCF entity, where the redirection indication information is used to instruct the terminal to redirect to a second slice; wherein the redirection indication information carries a slice identifier of the second slice; According to the redirection indication information, redirect to the second slice; the second slice is the slice subscribed to the login mobile phone number of the terminal's target application; the application server can determine to provide network acceleration service for the terminal based on the login mobile phone number and the slice identifier of the second slice.

23. The terminal according to claim 22, characterized in that: The processor is further configured to perform the following operations: Receive a slice selection policy sent by a PCF entity, where the slice selection policy includes the redirection indication information.

24. The terminal according to claim 23, characterized in that The processor is further configured to perform the following operations: Generate a redirection strategy according to the slice selection strategy; wherein the redirection strategy includes: a binding relationship between an identifier of a target application and the second slice, and / or a binding relationship between an IP address of an application server and the second slice; According to the redirection strategy, a network registration process is initiated to attach to the access and mobility management function AMF entity; the network registration process carries the slice identifier of the second slice; and the AMF entity sends the slice identifier of the second slice to the session management function SMF entity.

25. A communication device comprising a memory, a processor, and a program stored in the memory and executable on the processor; characterized in that: When the processor executes the program, the slice access authentication method according to claim 1 is implemented; or, when the processor executes the program, the slice access authentication method according to any one of claims 2 to 5 is implemented; Alternatively, when the processor executes the program, the slice access authentication method according to claim 6 or 7 is implemented; Alternatively, when the processor executes the program, it implements the slice access authentication method as described in any one of claims 8-10.

26. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, it implements the steps in the slice access authentication method as described in claim 1; or, when the program is executed by a processor, it implements the steps in the slice access authentication method as described in any one of claims 2-5; or, when the program is executed by a processor, it implements the steps in the slice access authentication method as described in claim 6 or 7; or, when the program is executed by a processor, it implements the steps in the slice access authentication method as described in any one of claims 8-10.

Images