Data network authentication mode adaptation method, device and readable storage medium

Abstract

The embodiments of the present application provide a method, device and readable storage medium for adapting a data network authentication method, which belongs to the field of communication technology. The method includes: receiving the authentication capability of the UE from the terminal UE during the session establishment process; determining that the user needs to perform data network authentication during the session establishment process based on the user's contract data; determining the authentication method for performing data network authentication during the session establishment process; and sending a first request message related to data network authentication to the authentication server according to the authentication method, wherein the first request message carries the user's authentication information. By adopting the method of the embodiments of the present application, the 5G network and 5G UE are capable of adapting to a variety of data network authentication methods, the requirements for the UE upper layer implementation and the transformation requirements for the authentication servers of vertical industries provided by the 5G network for data network authentication are reduced, and the multiple authentication method requirements of the authentication server can be flexibly adapted.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of communication technology, and specifically to a data network authentication mode adaptation method, device and readable storage medium. Background Art

[0002] Mobile operators previously provided 4G network coverage for customers in the same vertical industry. After providing 5G network coverage, the data network authentication algorithm changed, requiring their authentication, authorization, and accounting services (Authentication Authorization Accounting server, AAA-server) to be upgraded in order to provide data network authentication for their registered 5G users.

[0003] In addition, Extensible Authentication Protocol (EAP) authentication has high requirements for the UE upper layer, requiring EAP authentication process, EAP message processing and other logic. Currently, UE support is not ideal. Summary of the invention

[0004] The purpose of the embodiments of the present application is to provide a data network authentication method adaptation method, device and readable storage medium, which can solve the problem that UE does not support the existing data network authentication method well.

[0005] In order to solve the above technical problems, this application is implemented as follows:

[0006] In a first aspect, an embodiment of the present application provides a data network authentication mode adaptation method, which is applied to SMF, and the method includes:

[0007] receiving authentication capabilities of the UE from the terminal UE during session establishment;

[0008] Determine, based on the user's contract data, that the user needs to perform data network authentication during the session establishment process;

[0009] Determine the authentication method for data network authentication during session establishment;

[0010] A first request message related to data network authentication is sent to an authentication server according to the authentication method, wherein the first request message carries the user's authentication information.

[0011] Optionally, the method further comprises:

[0012] A response message to the first request message is received from the authentication server, and subsequent processing is performed according to the response message to the first request message.

[0013] Optionally, receiving authentication capabilities of the UE from the UE during session establishment includes:

[0014] receiving, through an access and mobility management function AMF, a second request message from the UE, where the second request message includes authentication information, where the authentication information indicates an authentication capability of the UE;

[0015] Alternatively, sending a third request message to the UE for requesting the UE to send authentication information, and receiving a first response message from the UE in response to the third request message, wherein the first response message includes the authentication information;

[0016] The authentication information includes:

[0017] A user identification for a user to perform data network authentication; and / or verification information of the user corresponding to the user identification.

[0018] Optionally, the determining of an authentication method for performing data network authentication during session establishment includes:

[0019] An authentication method for performing data network authentication during the session establishment process is determined according to the second request message and / or the user's subscription data.

[0020] Optionally, the method further comprises:

[0021] When receiving the authentication information from the UE during the session establishment process, receiving session information, the session information including information of the slice requested by the UE and / or a data network name DNN;

[0022] Obtain the user's contract data from the unified data management (UDM);

[0023] An authentication server for authenticating the UE is determined according to the session information and the user subscription data.

[0024] Optionally, the method further comprises:

[0025] The authentication capability of the authentication server is obtained through configuration or interface message.

[0026] Optionally, different authentication methods use different first request messages of the same interface protocol;

[0027] Alternatively, different authentication methods use the same first request message;

[0028] Alternatively, different authentication methods use different interface protocols.

[0029] Optionally, the performing subsequent processing according to the response message of the first request message includes:

[0030] receiving a second response message from the authentication server, the second response message indicating that an interface protocol or the first request message is not supported;

[0031] determining, according to the authentication capability of the UE, whether to resend the first request message to request another authentication method;

[0032] or,

[0033] A third response message is received from the authentication server, wherein the third response message includes an authentication result or a message related to authentication.

[0034] Optionally, the method further comprises:

[0035] If the UE does not have other authentication capabilities or the authentication server does not support other authentication methods, a session establishment rejection message is sent to the UE.

[0036] In a second aspect, an embodiment of the present application provides a data network authentication mode adaptation method, which is applied to an authentication server, and the method includes:

[0037] Receiving a first request message related to data network authentication from the SMF, wherein the first request message carries authentication information of the user;

[0038] Determine whether the authentication method is supported;

[0039] Based on the determination result, a response message to the first request message is returned.

[0040] Optionally, the method further comprises:

[0041] The authentication mode is distinguished by the interface protocol between the SMF and the authentication server or the first request message.

[0042] Optionally, returning a response message in response to the first request message according to the judgment result includes:

[0043] If it is determined that the authentication method is not supported, a second response message is sent to the SMF, where the second response message indicates that the interface protocol or the first request message is not supported;

[0044] If it is determined that the authentication method is supported, authentication is performed and a third response message is sent to the SMF. The third response message includes an authentication result or a message related to the authentication.

[0045] In a third aspect, an embodiment of the present application provides a data network authentication mode adaptation method, which is applied to a UE, and the method includes:

[0046] The authentication capabilities of the UE are sent to the SMF during the session establishment process.

[0047] Optionally, the sending the authentication capability of the UE to the SMF during the session establishment process includes:

[0048] Sending a second request message to the SMF through the AMF, where the second request message includes authentication information, where the authentication information indicates the authentication capability of the UE;

[0049] Alternatively, receiving a third request message from the SMF for requesting the UE to send authentication information, and sending a first response message in response to the third request message to the SMF, wherein the first response message includes the authentication information

[0050] The authentication information includes:

[0051] A user identification for a user to perform data network authentication; and / or verification information of the user corresponding to the user identification.

[0052] Optionally, the method further comprises:

[0053] The authentication information is encrypted and protected between the UE and the network by encrypting the signaling message between the UE and the network, and the signaling message encryption is enabled according to the user's contract.

[0054] In a fourth aspect, an embodiment of the present application provides a data network authentication mode adaptation device, applied to SMF, the device comprising:

[0055] A first receiving module, configured to receive the authentication capability of the UE from the terminal UE during the session establishment process;

[0056] A first determination module, used to determine, based on the user's contract data, that the user needs to perform data network authentication during the session establishment process;

[0057] A second determination module is used to determine an authentication method for performing data network authentication during session establishment;

[0058] The first sending module is used to send a first request message related to data network authentication to an authentication server according to the authentication method, wherein the first request message carries the user's authentication information.

[0059] Optionally, the device further comprises:

[0060] A second receiving module, configured to receive a response message in response to the first request message from the authentication server;

[0061] The first processing module is used to perform subsequent processing according to the response message of the first request message.

[0062] Optionally, the first determining module is further configured to:

[0063] receiving, through an access and mobility management function AMF, a second request message from the UE, where the second request message includes authentication information, where the authentication information indicates an authentication capability of the UE;

[0064] Alternatively, sending a third request message to the UE for requesting the UE to send authentication information, and receiving a first response message from the UE in response to the third request message, wherein the first response message includes the authentication information;

[0065] The authentication information includes:

[0066] A user identification for a user to perform data network authentication; and / or verification information of the user corresponding to the user identification.

[0067] Optionally, the second determining module is further configured to:

[0068] An authentication method for performing the data network authentication during the session establishment process is determined according to the second request message and / or the user's subscription data.

[0069] Optionally, the device further comprises:

[0070] A third receiving module is used to receive session information when receiving authentication information from the UE during the session establishment process, where the session information includes information of the slice requested by the UE and / or the DNN;

[0071] A first acquisition module, used to acquire the user's contract data from the UDM;

[0072] The third determination module is used to determine the authentication server for authenticating the UE according to the session information and the user subscription data.

[0073] Optionally, the device further comprises:

[0074] The second acquisition module is used to acquire the authentication capability of the authentication server through configuration or interface message.

[0075] Optionally, different authentication methods use different first request messages of the same interface protocol;

[0076] Alternatively, different authentication methods use the same first request message;

[0077] Alternatively, different authentication methods use different interface protocols.

[0078] Optionally, the third processing module is further used to:

[0079] receiving a second authentication response message from the authentication server, the second authentication response message indicating that an interface protocol or an authentication request message is not supported;

[0080] Determining whether to re-initiate a fourth request message to the authentication server according to the authentication capability of the UE;

[0081] or,

[0082] A third response message is received from the authentication server, wherein the third response message includes an authentication result or a message related to authentication.

[0083] Optionally, the device further comprises:

[0084] The second sending module is used to send a session establishment rejection message to the UE if the UE does not have other authentication capabilities or the authentication server does not support other authentication methods.

[0085] In a fifth aspect, an embodiment of the present application provides a data network authentication mode adaptation device, which is applied to an authentication server, and the device includes:

[0086] A fourth receiving module, configured to receive a first request message related to data network authentication from the SMF, wherein the first request message carries user authentication information;

[0087] A judgment module, used to judge whether the authentication method is supported;

[0088] The fourth processing module is used to return a response message to the first request message according to the judgment result.

[0089] Optionally, the device further comprises:

[0090] A distinguishing module is used to distinguish the authentication mode through the interface protocol between the SMF and the authentication server or the first request message.

[0091] Optionally, the second processing module is further used for:

[0092] If it is determined that the authentication method is not supported, a second response message is sent to the SMF, wherein the second response message indicates that the interface protocol or the authentication request message is not supported;

[0093] If it is determined that the authentication method is supported, authentication is performed and a third response message is sent to the SMF. The third response message includes an authentication result or a message related to the authentication.

[0094] In a sixth aspect, an embodiment of the present application provides a data network authentication mode adaptation device, applied to a UE, the device comprising:

[0095] The third sending module is used to send the authentication capability of the UE to the SMF during the session establishment process.

[0096] Optionally, the third sending module is further used for:

[0097] Sending a second request message to the SMF through the AMF, where the second request message includes authentication information, where the authentication information indicates the authentication capability of the UE;

[0098] Alternatively, receiving a third request message from the SMF for requesting the UE to send authentication information, and sending a first response message in response to the third request message to the SMF, wherein the first response message includes the authentication information

[0099] The authentication information includes:

[0100] A user identification for a user to perform data network authentication; and / or verification information of the user corresponding to the user identification.

[0101] Optionally, the device further comprises:

[0102] The encryption module is used to encrypt and protect the authentication information between the UE and the network by encrypting the signaling message between the UE and the network, and the signaling message encryption is enabled according to the user contract.

[0103] In the seventh aspect, an embodiment of the present application provides an SMF entity, including a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the data network authentication mode adaptation method as described in the first aspect.

[0104] In an eighth aspect, an embodiment of the present application provides an authentication server, comprising a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the data network authentication mode adaptation method as described in the second aspect.

[0105] In the ninth aspect, an embodiment of the present application provides a UE, comprising a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the data network authentication mode adaptation method as described in the third aspect.

[0106] In the tenth aspect, an embodiment of the present application provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of the data network authentication method adaptation method as described in the first aspect, or the steps of the data network authentication method adaptation method as described in the second aspect, or the steps of the data network authentication method adaptation method as described in the third aspect are implemented.

[0107] In the embodiment of the present application, SMF determines the authentication method for data network authentication during session establishment, and sends an authentication request to the authentication server according to the authentication method, and the authentication request carries the user's authentication information. Enhance the ability of 5G network and 5GUE to adapt to a variety of data network authentication methods, reduce the requirements of 5G network to provide data network authentication for UE upper layer implementation and the transformation requirements for vertical industry authentication servers, and can also flexibly adapt to the various authentication method requirements of the authentication server. BRIEF DESCRIPTION OF THE DRAWINGS

[0108] Figure 1 This is a schematic diagram of the architecture for intercommunication between existing 5G and data networks;

[0109] Figure 2 One of the flow diagrams of the data network authentication mode adaptation method provided in the embodiment of the present application;

[0110] Figure 3 The second flowchart of the data network authentication mode adaptation method provided in the embodiment of the present application;

[0111] Figure 4 The third flowchart of the data network authentication mode adaptation method provided in the embodiment of the present application;

[0112] Figure 5a One of the application scenario schematic diagrams provided in the embodiment of the present application;

[0113] Figure 5b The second schematic diagram of the application scenario provided in the embodiment of the present application;

[0114] Figure 5c The third schematic diagram of the application scenario provided in the embodiment of the present application;

[0115] Figure 6 One of the structural diagrams of the data network authentication mode adaptation device provided in the embodiment of the present application;

[0116] Figure 7 The second structural diagram of the data network authentication mode adaptation device provided in the embodiment of the present application;

[0117] Figure 8 The third structural diagram of the data network authentication mode adaptation device provided in the embodiment of the present application;

[0118] Fig. 9 A schematic diagram of the structure of the SMF entity provided in the embodiment of the present application;

[0119] Fig.10 A schematic diagram of the structure of the authentication server provided in the embodiment of the present application;

[0120] Fig.11 A schematic diagram of the structure of a UE provided in an embodiment of the present application. DETAILED DESCRIPTION

[0121] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0122] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0123] The data network authentication mode adaptation method provided in the embodiment of the present application is described in detail below with reference to the accompanying drawings through specific embodiments and their application scenarios.

[0124] The technology described in this article is not limited to the fifth-generation mobile communication (5th-generation, 5G) system and subsequent evolution communication systems, and is not limited to the evolution (LTE-Advanced, LTE-A) system of LTE / LTE, and can also be used in various wireless communication systems, such as Code Division Multiple Access (Code Division Multiple Access, CDMA), Time Division Multiple Access (Time Division Multiple Access, TDMA), Frequency Division Multiple Access (Frequency Division Multiple Access, FDMA), Orthogonal Frequency Division Multiple Access (Orthogonal Frequency Division Multiple Access, OFDMA), Single-carrier Frequency Division Multiple Access (Single-carrier Frequency-Division Multiple Access, SC-FDMA) and other systems.

[0125] The terms "system" and "network" are often used interchangeably. A CDMA system may implement radio technologies such as CDMA2000, Universal Terrestrial Radio Access (UTRA). UTRA includes Wideband Code Division Multiple Access (WCDMA) and other CDMA variants. A TDMA system may implement radio technologies such as Global System for Mobile Communication (GSM). An OFDMA system may implement radio technologies such as Ultra Mobile Broadband (UMB), Evolution-UTRA (E-UTRA), IEEE 802.11 (Wi-Fi), IEEE802.16 (WiMAX), IEEE802.20, Flash-OFDM, etc. UTRA and E-UTRA are parts of Universal Mobile Telecommunications System (UMTS). LTE and more advanced LTE (such as LTE-A) are new UMTS versions that use E-UTRA. UTRA, E-UTRA, UMTS, LTE, LTE-A, and GSM are described in documents from an organization named "3rd Generation Partnership Project" (3GPP). CDMA2000 and UMB are described in documents from an organization named "3rd Generation Partnership Project 2" (3GPP2). The techniques described herein may be used for the systems and radio technologies mentioned above as well as for other systems and radio technologies.

[0126] In order to better understand the solution of the embodiment of the present application, the following technical contents are first introduced:

[0127] 1. Intercommunication between 5G and data networks

[0128] 5G operators provide exclusive, differentiated and quality-assured private network services to vertical industry customers through slicing and NPN features defined by 5G networks.

[0129] Vertical industry customers deploy registration servers and application servers on the data network (DN) to provide application services to users who register applications, and deploy authentication servers to authenticate users on the data network. Figure 1 As shown, DN-AAAserver is located in the external data network and performs secondary authentication on 5G users using data services.

[0130] 2. Differences in 5G and 4G data network authentication

[0131] Considering the differences between 5G and 4G in security requirements, session management, and algorithm flexibility, 5G networks have made some modifications to the data network authentication features:

[0132] (1) Algorithm change: Password Authentication Protocol (PAP) authentication / Challenge Handshake Authentication Protocol (CHAP) authentication is changed to EAP authentication, that is, PAP / CHAP=》EAP authentication;

[0133] (2) Changes in authentication process: one-time submission of username / password verification => multiple interactions, AAA initiation request;

[0134] (3) Verify information security: Encrypt IE to ensure security at the application layer;

[0135] (4) Authentication during the attachment process to establish the default bearer => Authentication is performed only when the Protocol Data Unit (PDU) session is established;

[0136] (5) Support re-authentication: authentication after PDU session is established.

[0137] See also Figure 2 The embodiment of the present application provides a data network authentication mode adaptation method, which is applied to a session management function (SMF), and the method includes:

[0138] Step 201: receiving the UE's authentication capability from the UE during the session establishment process;

[0139] In the embodiment of the present application, the authentication method of the data network authentication is determined by the SMF. During the session establishment process, the UE reports its own authentication capability to the SMF, so that the SMF learns the authentication capability of the UE.

[0140] In some implementations, receiving the authentication capability of the UE from the UE specifically includes:

[0141] A second request message is received from the UE through an access and mobility management function (AMF). Optionally, the second request message may be a session establishment request message, which is not specifically limited in the embodiment of the present application. The second request message includes authentication information, which indicates the authentication capability of the UE. The authentication information includes: a user identifier for data authentication by the user; and / or verification information of the user corresponding to the user identifier.

[0142] In some implementations, receiving the authentication capability of the UE from the UE specifically includes:

[0143] The SMF sends a third request message to the UE for requesting the UE to send authentication information, and receives a first response message from the UE in response to the third request message, wherein the first response message includes the authentication information, and the authentication information includes: a user identifier for the user to perform data network authentication; and / or verification information of the user corresponding to the user identifier;

[0144] In the embodiment of the present application, the network can learn the authentication capability of the UE through the authentication information. The authentication information can be one or more. For example, the UE carries an authentication information including an identification (ID) of the data network for user authentication, indicating that the user supports EAP authentication; for another example, the UE carries an authentication information including a user name and password for the data network to authenticate the user, indicating that the user supports PAP or CHAP authentication. For another example, the UE carries the above authentication information at the same time, indicating that the user supports the above authentication methods.

[0145] Step 202: Determine, based on the user's contract data, that the user needs to perform data network authentication during the session establishment process;

[0146] In the embodiment of the present application, the SMF receives a session establishment request from the UE and obtains the user's session subscription data. The SMF determines whether the data network related to the session requested by the user needs to be authenticated based on the session subscription data, and whether the user is not authenticated. If so, it decides to initiate data network authentication.

[0147] In some implementations, the subscription data of the user is obtained from Unified Data Management (UDM).

[0148] In some embodiments, when receiving authentication information from the UE during the session establishment process, session information is received, and the session information includes the slice requested by the UE, the data network name (Data Network Name, DNN), etc., that is, in addition to the authentication information, the session establishment request message received from the UE also carries session information (DNN, slice, session type, etc.).

[0149] Furthermore, in some implementations, the authentication server (also referred to as AAA-server or DN-AAA for short) for authenticating the UE is determined based on the above-mentioned session information and user contract data, and the SMF can map the AAA-server for data network authentication of the UE based on the slice requested by the UE, DNN, authentication capabilities of the UE and other information.

[0150] For example, the user's contract data contains information about which DNNs the user has signed up for, such as DNN1, DNN2, etc. Which DNNs require data network authentication? The contract data can also contain the identifier of the authentication server that performs data network authentication. The UE's session establishment request will carry session information, which will contain the DNN corresponding to the session. The authentication server can be mapped through the DNN.

[0151] Furthermore, the SMF can determine the authentication capability of the AAA-server through configuration or through interface messages, and determine whether to trigger the authentication process through the signaling plane or the user plane through the connection with the AAA-server.

[0152] Step 203: Determine the authentication method for data network authentication during session establishment;

[0153] In the embodiment of the present application, the SMF determines the authentication method according to the authentication capabilities of the UE and the AAA-server. The embodiment of the present application does not limit the specific authentication method, and the authentication method can be EAP, PAP / CHAP or other methods.

[0154] Step 204: Send a first request message related to data network authentication to an authentication server according to the authentication method, where the first request message carries the user's authentication information.

[0155] In an embodiment of the present application, after the authentication method is determined, the SMF sends a first request message related to data network authentication to the AAA-server. The first request message carries the user's authentication information. Optionally, the first request message can be called an authentication request message, or can also be called a message with other names. The embodiment of the present application does not specifically limit the name of the first request message.

[0156] In some implementations, different authentication methods use different first request messages of the same interface protocol; or, different authentication methods use the same first request message; or, different authentication methods use different interface protocols. The interface protocol may be a RADIUS protocol or a Diameter protocol.

[0157] Specifically, if you request PAP / CHAP authentication, you can submit your username and password to the AAA server in the authentication request. If you request EAP authentication, you can submit your user authentication ID to the AAA server in the authentication request.

[0158] In some implementations, the method further includes: receiving a response message to the first request message from the authentication server, and performing subsequent processing according to the response message to the first request message.

[0159] In the embodiment of the present application, subsequent processing means that after the AAA-server receives the authentication request, it will determine whether the authentication method is supported, and return different responses to the SMF according to the judgment result. The SMF performs corresponding processing based on the received response.

[0160] In some implementations, performing subsequent processing according to the response message to the first request message includes:

[0161] receiving a second response message from the authentication server, the second response message indicating that the interface protocol or the first request message is not supported;

[0162] Determining whether to re-initiate a fourth request message to the authentication server according to the authentication capability of the UE;

[0163] In an embodiment of the present application, if the response indicates that the protocol or the message is not supported, the SMF determines whether to re-initiate the authentication request based on the UE capabilities and requests another authentication method.

[0164] Furthermore, if the UE does not have other authentication capabilities or the AAA-server supports other authentication methods, a session establishment rejection message is sent to the UE. For example, the UE only supports the EAP authentication capability but not other authentication capabilities except EAP, or the AAA-server supports other authentication methods except EAP.

[0165] In some implementations, performing subsequent processing according to the response message to the first request message includes:

[0166] A third response message is received from the authentication server, where the third response message includes an authentication result or a message related to authentication.

[0167] Specifically:

[0168] 1) If the response contains the authentication result and is successful, send a session establishment success response to the UE, including the authentication result.

[0169] 2) If the response contains the authentication result and it fails, send a session establishment rejection response to the UE, including the authentication result.

[0170] 3) If the response includes an (EAP) authentication message sent to the UE, the (EAP) authentication message is transmitted to the UE.

[0171] In the embodiment of the present application, SMF obtains the user's contract data from the session establishment request sent by the UE, SMF determines the authentication method for data network authentication during the session establishment process, and sends an authentication request to the authentication server according to the authentication method, and the authentication request carries the user's authentication information. Enhance the ability of 5G network and 5G UE to adapt to a variety of data network authentication methods, reduce the requirements of 5G network to provide data network authentication for UE upper layer implementation and the transformation requirements for vertical industry authentication servers, and can also flexibly adapt to the various authentication method requirements of the authentication server.

[0172] See also Figure 3 The embodiment of the present application provides a data network authentication mode adaptation method, which is applied to AAA-server, and the method includes:

[0173] Step 301: receiving a first request message related to data network authentication from the SMF, where the first request message carries an authentication method;

[0174] In the embodiment of the present application, the authentication mode is distinguished through the interface protocol between the SMF and the AAA-server or the first request message.

[0175] In some implementations, different authentication methods use different first request messages of the same interface protocol; or, different authentication methods use the same first request message; or, different authentication methods use different interface protocols. The interface protocol may be a RADIUS protocol or a Diameter protocol.

[0176] Specifically, if you request PAP / CHAP authentication, you can submit your username and password to the AAA server in the authentication request. If you request EAP authentication, you can submit your user authentication ID to the AAA server in the authentication request.

[0177] Step 302: Determine whether the authentication method is supported;

[0178] Step 303: According to the determination result, a response message to the first request message is returned.

[0179] In the embodiment of the present application, the AAA-server determines whether the authentication method is supported;

[0180] In some implementations, according to the determination result, returning a response message to the first request message includes:

[0181] If it is determined that the authentication method is not supported, a second response message is sent to the SMF, where the second response message indicates that the interface protocol or the authentication request message is not supported;

[0182] If it is determined that the authentication method is supported, authentication is performed and a third response message is sent to the SMF. The third response message includes the authentication result or a message related to authentication, such as authentication data indexed by the authentication ID or user name, to perform authentication. After the authentication is completed, the authentication response returned by the AAA-server carries the authentication result (success or failure). If EAP authentication is requested, the returned authentication response carries the EAP authentication message sent by the AAA-server to the UE.

[0183] In the embodiment of the present application, SMF sends an authentication request to the authentication server according to the authentication method, and the authentication request carries the user's authentication information. The 5G network and 5G UE are enhanced to adapt to a variety of data network authentication methods, reduce the requirements of the 5G network for providing data network authentication for the UE upper layer implementation and the transformation requirements for the vertical industry authentication server, and can also flexibly adapt to the various authentication method requirements of the authentication server.

[0184] See also Figure 4 The embodiment of the present application provides a data network authentication mode adaptation method, which is applied to a UE, and the method includes:

[0185] Step 401: Send the UE's authentication capabilities to the SMF during session establishment.

[0186] In an embodiment of the present application, during the session establishment process, the UE reports its own authentication capabilities to the SMF, so that the SMF can learn the authentication capabilities possessed by the UE.

[0187] In some implementations, sending the authentication capability of the UE to the SMF specifically includes:

[0188] Sending a second request message to SMF through AMF, the second request message including authentication information, the authentication information indicating the authentication capability of the UE, the authentication information including: a user identifier for data authentication by the user; and / or verification information of the user corresponding to the user identifier;

[0189] In some implementations, sending the authentication capability of the UE to the SMF specifically includes:

[0190] receiving from the SMF a third request message for requesting the UE to send authentication information, and sending to the SMF a first response message in response to the third request message, the first response message including the authentication information, the authentication information including: a user identifier for data network authentication by the user; and / or verification information of the user corresponding to the user identifier;

[0191] In the embodiment of the present application, the network can learn the authentication capability of the UE through the authentication information. The authentication information can be one or more. For example, the UE carries an authentication information including an identification (ID) of the data network for user authentication, indicating that the user supports EAP authentication; for another example, the UE carries an authentication information including a user name and password for the data network to authenticate the user, indicating that the user supports PAP or CHAP authentication. For another example, the UE carries the above authentication information at the same time, indicating that the user supports the above authentication methods.

[0192] In some implementations, the method further includes: encrypting and protecting the authentication information between the UE and the network by encrypting signaling messages between the UE and the network, wherein the signaling message encryption is enabled based on the user's contract.

[0193] Specifically, the UE sends a registration request to the AMF. The AMF decides to enable NAS encryption based on the DNN or Tracking Area (TA) signed by the user, and encrypts the signaling messages between the UE and the AMF. In this way, NAS encryption is started according to the data network authentication requirements, avoiding the introduction of an additional process for obtaining encryption verification information.

[0194] The specific application scenarios of the method provided in the embodiments of the present application are described below with reference to the accompanying drawings.

[0195] See also Figure 5a , the figure shows an authentication process:

[0196] 1.UE requests SMF to establish a session, and the request carries authentication information and session information;

[0197] 2.SMF requests the user's contract data from UDM;

[0198] 3. SMF determines that the user needs to perform data authentication for the session;

[0199] 4.SMF determines the UE authentication capability and the DN-AAA authentication capability, and determines the authentication method;

[0200] For authentication request situation 1: UE carries verification information when requesting session establishment;

[0201] 5. SMF sends authentication request 1 to DN-AAA, which carries user verification information;

[0202] For authentication request situation 2: UE does not carry verification information when requesting session establishment;

[0203] 6.SMF sends a request message to UE;

[0204] 7. The UE returns a response message to the SMF, which carries the user authentication information;

[0205] 8. SMF sends authentication request 2 to DN-AAA, which carries user verification information;

[0206] For authentication request situation 3: DN-AAA does not support the authentication method selected by the network, the network can select another authentication method based on the UE capability;

[0207] 9. SMF sends an authentication request 3 to DN-AAA, which carries user verification information 1

[0208] 10. DN-AAA returns a response message to SMF, where the cause value indicates that the authentication method is not supported;

[0209] 11.SMF sends a request message to UE;

[0210] 12. The UE returns a response message to the SMF, which carries the user authentication information 2;

[0211] 13.SMF sends an authentication request 4 to DN-AAA, which carries the user verification information 2.

[0212] See also Figure 5b The figure shows the authentication process for the same user with different DNs, different DN-AAAs, and different authentication methods:

[0213] 1. UE requests SMF1 to establish session 1. The request carries authentication information and session information, and the session information includes DNN1.

[0214] 2.SMF1 requests the user's contract data from UDM;

[0215] 3. SMF1 determines that the user needs to perform data authentication for the session;

[0216] 4. SMF1 determines the UE authentication capability and the DN1-AAA authentication capability, and determines the authentication method;

[0217] Data network authentication for establishing a session for DN1: The UE carries verification information when requesting session establishment;

[0218] 5. SMF1 sends authentication request 1 to DN1-AAA, which carries user verification information;

[0219] 6. UE requests SMF2 to establish session 2. The request carries authentication information and session information. The session information includes DNN2.

[0220] 7.SMF2 requests the user's contract data from UDM;

[0221] 8. SMF2 determines that the user needs to perform data authentication for the session;

[0222] 9. SMF2 determines the UE authentication capability and the DN2-AAA authentication capability, and determines the authentication method;

[0223] Data network authentication for establishing a session for DN2: The UE does not carry verification information when requesting session establishment;

[0224] 10.SMF2 sends a request message to UE;

[0225] 11. The UE returns a response message to SMF2, which carries the user authentication information;

[0226] See also Figure 5c The figure shows the authentication process for different UEs, different DNs, successful DN authentication and unsupported DN authentication methods:

[0227] 1. UE1 requests SMF1 to establish session 1. The request carries authentication information and session information, and the session information includes DNN1.

[0228] 2.SMF1 requests the user's contract data from UDM;

[0229] 3. SMF1 determines that the user needs to perform data authentication for the session;

[0230] 4. SMF1 determines the authentication capability of UE1 and DN1-AAA, and determines authentication method 1;

[0231] UE1 establishes data network authentication for DN1:

[0232] 5. SMF1 sends authentication request 1 to DN1-AAA, which carries user verification information 1;

[0233] 6. DN1-AAA returns authentication response 1 to SMF1;

[0234] 7.SMF1 determines to allow session establishment based on session information;

[0235] 8. SMF1 sends a message to UE1 that session 1 is established successfully;

[0236] 9. UE2 requests SMF2 to establish session 21. The request carries authentication information and session information. The session information includes DNN2.

[0237] 10.SMF2 requests the user's contract data from UDM;

[0238] 11. SMF2 determines that the user needs to perform data authentication for the session;

[0239] 12. SMF2 determines the authentication capability of UE2 and DN2-AAA, and determines authentication method 1;

[0240] UE1 establishes data network authentication for DN2 session:

[0241] 13. SMF2 sends authentication request 2 to DN2-AAA, which carries user verification information 2;

[0242] 14. DN2-AAA returns an authentication response 2 to SMF2, where the cause value indicates that the authentication method is not supported;

[0243] 15. SMF2 determines that another authentication method can be used based on the authentication capabilities of UE2 and DN2-AAA;

[0244] 16.SMF2 sends a request message to UE2;

[0245] 17.UE2 returns a response message to SMF2, which carries user authentication information 3;

[0246] 18. SMF2 sends an authentication request 3 to DN2-AAA, which carries user verification information 3;

[0247] The interaction process can be executed once or multiple times, depending on the specific authentication method;

[0248] 19. DN2-AAA returns an authentication response 3 to SMF2, which indicates that the authentication is successful;

[0249] 20.SMF2 determines that the session establishment is allowed based on the session information;

[0250] 21.SMF2 sends a message to UE2 that session 2 has been established successfully.

[0251] See also Figure 6 The embodiment of the present application provides a data network authentication mode adaptation device 600, which is applied to SMF, and the device includes:

[0252] The first receiving module 601 is used to receive the authentication capability of the UE from the terminal UE during the session establishment process;

[0253] A first determination module 602, configured to determine, based on the user's contract data, that a user needs to perform data network authentication during a session establishment process;

[0254] The second determination module 603 is used to determine the authentication method for data network authentication during session establishment;

[0255] The first sending module 604 is used to send a first request message related to data network authentication to the authentication server according to the authentication method, where the first request message carries the user's authentication information.

[0256] Optionally, the device further comprises:

[0257] A second receiving module, configured to receive a response message in response to the first request message from the authentication server;

[0258] A first processing module, configured to perform subsequent processing according to a response message to the first request message

[0259] Optionally, the first determining module is further configured to:

[0260] receiving, through the AMF, a second request message from the UE, where the second request message includes authentication information, where the authentication information indicates an authentication capability of the UE;

[0261] Alternatively, sending a third request message to the UE for requesting the UE to send authentication information, and receiving a first response message from the UE in response to the third request message, wherein the first response message includes the authentication information;

[0262] The authentication information includes:

[0263] A user identification for a user to perform data network authentication; and / or verification information of the user corresponding to the user identification.

[0264] Optionally, the second determining module is further configured to:

[0265] An authentication method for performing the data network authentication during the session establishment process is determined according to the second request message and / or the user's subscription data.

[0266] Optionally, the device further comprises:

[0267] A third receiving module is used to receive session information when receiving authentication information from the UE during the session establishment process, where the session information includes information of the slice requested by the UE and / or the DNN;

[0268] A first acquisition module, used to acquire the user's contract data from the UDM;

[0269] The third determination module is used to determine the authentication server for authenticating the UE according to the session information and the user subscription data.

[0270] Optionally, the device further comprises:

[0271] The second acquisition module is used to acquire the authentication capability of the authentication server through configuration or interface message.

[0272] Optionally, different authentication methods use different first request messages of the same interface protocol;

[0273] Alternatively, different authentication methods use the same first request message;

[0274] Alternatively, different authentication methods use different interface protocols.

[0275] Optionally, the first processing module is further used for:

[0276] receiving a second authentication response message from the authentication server, the second authentication response message indicating that an interface protocol or an authentication request message is not supported;

[0277] Determining whether to re-initiate a fourth request message to the authentication server according to the authentication capability of the UE;

[0278] or,

[0279] A third response message is received from the authentication server, wherein the third response message includes an authentication result or a message related to authentication.

[0280] Optionally, the device further comprises:

[0281] The second sending module is used to send a session establishment rejection message to the UE if the UE does not have other authentication capabilities or the authentication server does not support other authentication methods.

[0282] See also Figure 7 The embodiment of the present application provides a data network authentication mode adaptation device 700, which is applied to an authentication server, and the device includes:

[0283] The fourth receiving module 701 is used to receive a first request message related to data network authentication from the SMF, where the first request message carries the user's authentication information;

[0284] A determination module 702 is used to determine whether the authentication method is supported;

[0285] The second processing module 703 is used to return a response message to the first request message according to the judgment result.

[0286] Optionally, the device further comprises:

[0287] A distinguishing module is used to distinguish the authentication mode through the interface protocol between the SMF and the authentication server or the first request message.

[0288] Optionally, the second processing module is further used for:

[0289] If it is determined that the authentication method is not supported, a second response message is sent to the SMF, wherein the second response message indicates that the interface protocol or the authentication request message is not supported;

[0290] If it is determined that the authentication method is supported, authentication is performed and a third response message is sent to the SMF. The third response message includes an authentication result or a message related to the authentication.

[0291] See also Figure 8 The embodiment of the present application provides a data network authentication mode adaptation device 800, which is applied to a UE, and the device includes:

[0292] The third sending module 801 is used to send the authentication capability of the UE to the SMF during the session establishment process.

[0293] Optionally, the third sending module is further used for:

[0294] Sending a second request message to the SMF through the AMF, where the second request message includes authentication information, where the authentication information indicates the authentication capability of the UE;

[0295] Alternatively, receiving a third request message from the SMF for requesting the UE to send authentication information, and sending a first response message in response to the third request message to the SMF, wherein the first response message includes the authentication information

[0296] The authentication information includes:

[0297] A user identification for a user to perform data network authentication; and / or verification information of the user corresponding to the user identification.

[0298] Optionally, the device further comprises:

[0299] The encryption module is used to encrypt and protect the authentication information between the UE and the network by encrypting the signaling message between the UE and the network, and the signaling message encryption is enabled according to the user contract.

[0300] See also Fig. 9 An embodiment of the present invention provides a SMF entity 900, including: a processor 901, a transceiver 902, a memory 903 and a bus interface.

[0301] The processor 901 may be responsible for managing the bus architecture and general processing. The memory 903 may store data used by the processor 901 when performing operations.

[0302] In the embodiment of the present invention, the SMF entity 900 may further include: a program stored in the memory 903 and executable on the processor 901, which implements the steps of the method provided in the embodiment of the present invention when executed by the processor 901.

[0303] exist Fig. 9In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically linking various circuits of one or more processors represented by processor 901 and memory represented by memory 903. The bus architecture may also link various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described in the embodiments of the present invention. The bus interface provides an interface. The transceiver 902 may be a plurality of components, namely, a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium.

[0304] See also Fig.10 , an embodiment of the present invention provides an authentication server 1000, including: a processor 1001, a transceiver 1002, a memory 1003 and a bus interface.

[0305] The processor 1001 may be responsible for managing the bus architecture and general processing. The memory 1003 may store data used by the processor 1001 when performing operations.

[0306] In the embodiment of the present invention, the authentication server 1000 may further include: a program stored in the memory 1003 and executable on the processor 1001, which implements the steps of the method provided in the embodiment of the present invention when executed by the processor 1001.

[0307] exist Fig.10 In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically linking various circuits of one or more processors represented by processor 1001 and memory represented by memory 1003. The bus architecture may also link various other circuits such as peripherals, voltage regulators, and power management circuits together, which are well known in the art and are therefore not further described in the embodiments of the present invention. The bus interface provides an interface. The transceiver 1002 may be a plurality of components, namely, a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium.

[0308] See also Fig.11 The embodiment of the present invention provides a UE 1100, including: at least one processor 1101, a memory 1102, a user interface 1103 and at least one network interface 1104. The various components in the UE 1100 are coupled together via a bus system 1105.

[0309] It is understood that the bus system 1105 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 1105 also includes a power bus, a control bus, and a status signal bus. Fig.11 Various buses are labeled as bus system 1105.

[0310] The user interface 1103 may include a display, a keyboard, or a pointing device (eg, a mouse, a trackball, a touch pad, or a touch screen, etc.).

[0311] It is understood that the memory 1102 in the embodiment of the present invention may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct memory bus random access memory (DRRAM). The memory 1102 described in the embodiments of the present invention is intended to include, but is not limited to, these and any other suitable types of memory.

[0312] In some embodiments, the memory 1102 stores the following elements, executable modules or data structures, or a subset thereof, or an extended set thereof: an operating system 11021 and an application program 11022 .

[0313] The operating system 11021 includes various system programs, such as a framework layer, a core library layer, a driver layer, etc., which are used to implement various basic services and process hardware-based tasks. The application 11022 includes various application programs, such as a media player, a browser, etc., which are used to implement various application services. The program for implementing the method of the embodiment of the present invention can be included in the application 11022.

[0314] In the embodiment of the present invention, the UE 1100 may further include: a program stored in the memory 1102 and executable on the processor 1101, and the program, when executed by the processor 1101, implements the steps of the method provided in the embodiment of the present invention.

[0315] The method disclosed in the above embodiment of the present invention can be applied to the processor 1101, or implemented by the processor 1101. The processor 1101 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit in the processor 1101 or the instruction in the form of software. The above processor 1101 can be a general processor, a digital signal processor (Digital Signal Processor, DSP), an application specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array (Field Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present invention can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiment of the present invention can be directly embodied as a hardware decoding processor to execute, or the hardware and software modules in the decoding processor can be executed. The software module can be located in a computer-readable storage medium mature in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The computer-readable storage medium is located in the memory 1102. The processor 1101 reads the information in the memory 1102 and completes the steps of the above method in combination with its hardware. Specifically, a computer program is stored on the computer-readable storage medium.

[0316] It is to be understood that the embodiments described in the embodiments of the present invention may be implemented by hardware, software, firmware, middleware, microcode or a combination thereof. For hardware implementation, the processing unit may be implemented in one or more ASICs, DSPs, digital signal processing devices (DSP Device, DSPD), programmable logic devices (Programmable Logic Device, PLD), FPGAs, general-purpose processors, controllers, microcontrollers, microprocessors, other electronic units for performing the functions described in the present application or a combination thereof.

[0317] An embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, each process of the above-mentioned data network authentication mode adaptation method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0318] The processor is a processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0319] It should be noted that, in this article, the terms "comprise", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0320] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0321] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims

1. A data network authentication mode adaptation method, applied to a session management function SMF, characterized in that: The method comprises: receiving authentication capabilities of the UE from the terminal UE during the session establishment process; Determine, based on the user's contract data, that the user needs to perform data network authentication during the session establishment process; Determine the authentication capabilities of the UE and the authentication server, and determine the authentication method for data network authentication during session establishment; A first request message related to data network authentication is sent to an authentication server according to the authentication method, wherein the first request message carries the user's authentication information.

2. The method according to claim 1, characterized in that The method further comprises: A response message to the first request message is received from the authentication server, and subsequent processing is performed according to the response message to the first request message.

3. The method according to claim 1, characterized in that Receiving authentication capabilities of the UE from the UE during session establishment, including: receiving, through an access and mobility management function AMF, a second request message from the UE, where the second request message includes authentication information, where the authentication information indicates an authentication capability of the UE; Alternatively, sending a third request message to the UE for requesting the UE to send authentication information, and receiving a first response message from the UE in response to the third request message, wherein the first response message includes the authentication information; The authentication information includes: a user identification for a user to perform data network authentication; and / or verification information of the user corresponding to the user identification.

4. The method according to claim 3, characterized in that The method of determining the authentication method for performing data network authentication during the session establishment process includes: An authentication method for performing data network authentication during the session establishment process is determined according to the second request message and / or the user's subscription data.

5. The method according to claim 3, characterized in that: The method further comprises: When receiving the authentication information from the UE during the session establishment process, receiving session information, the session information including: information of the slice requested by the UE and / or a data network name DNN; Obtain the user's contract data from the unified data management (UDM); An authentication server for authenticating the UE is determined according to the session information and the user subscription data.

6. The method according to claim 5, characterized in that The method further comprises: The authentication capability of the authentication server is obtained through configuration or interface message.

7. The method according to claim 1, characterized in that Different authentication methods use different first request messages of the same interface protocol; Alternatively, different authentication methods use the same first request message; Alternatively, different authentication methods use different interface protocols.

8. The method according to claim 2, characterized in that: The performing subsequent processing according to the response message of the first request message includes: receiving a second response message from the authentication server, the second response message indicating that an interface protocol or the first request message is not supported; Determining whether to re-initiate a fourth request message to the authentication server according to the authentication capability of the UE; or, A third response message is received from the authentication server, wherein the third response message includes an authentication result or a message related to authentication.

9. The method according to claim 8, characterized in that The method further comprises: If the UE does not have other authentication capabilities or the authentication server does not support other authentication methods, a session establishment rejection message is sent to the UE.

10. A data network authentication mode adaptation method, applied to an authentication server, characterized in that: The method comprises: Receiving a first request message related to data network authentication from the SMF, wherein the first request message carries authentication information of the user; Determine whether the authentication method is supported; According to the judgment result, a response message of the first request message is returned; Wherein, the method further comprises: The authentication mode is distinguished by the interface protocol between the SMF and the authentication server or the first request message.

11. The method according to claim 10, characterized in that The returning a response message in response to the first request message according to the judgment result includes: If it is determined that the authentication method is not supported, a second response message is sent to the SMF, where the second response message indicates that the interface protocol or the first request message is not supported; If it is determined that the authentication method is supported, authentication is performed and a third response message is sent to the SMF. The third response message includes an authentication result or a message related to the authentication.

12. A data network authentication mode adaptation method, applied to UE, characterized in that: The method comprises: Sending the authentication capabilities of the UE to the SMF during session establishment; The sending of the authentication capability of the UE to the SMF during the session establishment process includes: Sending a second request message to the SMF through the AMF, where the second request message includes authentication information, where the authentication information indicates the authentication capability of the UE; Alternatively, receiving from the SMF a third request message for requesting the UE to send authentication information, and sending to the SMF a first response message in response to the third request message, wherein the first response message includes the authentication information; The authentication information includes: a user identification for a user to perform data network authentication; and / or verification information of the user corresponding to the user identification.

13. The method according to claim 12, characterized in that The method further comprises: The authentication information is encrypted and protected between the UE and the network by encrypting the signaling message between the UE and the network, and the signaling message encryption is enabled according to the user's contract.

14. A data network authentication mode adaptation device, applied to SMF, characterized in that: The device comprises: A first receiving module, configured to receive the authentication capability of the UE from the terminal UE during the session establishment process; A first determination module, used to determine, based on the user's contract data, that the user needs to perform data network authentication during the session establishment process; A second determination module is used to determine the authentication capability of the UE and the authentication capability of the authentication server, and determine the authentication method for performing data network authentication during session establishment; The first sending module is used to send a first request message related to data network authentication to an authentication server according to the authentication method, wherein the first request message carries the user's authentication information.

15. The device according to claim 14, characterized in that The device also includes: A second receiving module, configured to receive a response message in response to the first request message from the authentication server; The first processing module is used to perform subsequent processing according to the response message of the first request message.

16. The device according to claim 14, characterized in that The first receiving module is further used for: receiving, through an access and mobility management function AMF, a second request message from the UE, where the second request message includes authentication information, where the authentication information indicates an authentication capability of the UE; Alternatively, sending a third request message to the UE for requesting the UE to send authentication information, and receiving a first response message from the UE in response to the third request message, wherein the first response message includes the authentication information; The authentication information includes: a user identification of a user for data network authentication; and / or, verification information of the user corresponding to the user identification.

17. The device according to claim 16, characterized in that The second determining module is further used for: An authentication method for performing the data network authentication during the session establishment process is determined according to the second request message and / or the user's subscription data.

18. The device according to claim 16, characterized in that The device also includes: A third receiving module is used to receive session information when receiving authentication information from the UE during the session establishment process, where the session information includes information of the slice requested by the UE and / or the DNN; A first acquisition module, used to acquire the user's contract data from the UDM; The third determination module is used to determine the authentication server for authenticating the UE according to the session information and the user subscription data.

19. The device according to claim 14, characterized in that The device also includes: The second acquisition module is used to acquire the authentication capability of the authentication server through configuration or interface message.

20. The device according to claim 14, characterized in that Different authentication methods use different first request messages of the same interface protocol; Alternatively, different authentication methods use the same first request message; Alternatively, different authentication methods use different interface protocols.

21. The device according to claim 15, characterized in that The first processing module is further configured to: receiving a second authentication response message from the authentication server, the second authentication response message indicating that an interface protocol or an authentication request message is not supported; Determining whether to re-initiate a fourth request message to the authentication server according to the authentication capability of the UE; or, A third response message is received from the authentication server, wherein the third response message includes an authentication result or a message related to authentication.

22. The device according to claim 21, characterized in that The device also includes: The second sending module is used to send a session establishment rejection message to the UE if the UE does not have other authentication capabilities or the authentication server does not support other authentication methods.

23. A data network authentication mode adaptation device, applied to an authentication server, characterized in that: The device comprises: A fourth receiving module, configured to receive a first request message related to data network authentication from the SMF, wherein the first request message carries user authentication information; A judgment module, used to judge whether the authentication method is supported; A second processing module, used for returning a response message to the first request message according to the judgment result; Wherein, the device further comprises: A distinguishing module is used to distinguish the authentication mode through the interface protocol between the SMF and the authentication server or the first request message.

24. The device according to claim 23, characterized in that The second processing module is further used for: If it is determined that the authentication method is not supported, a second response message is sent to the SMF, where the second response message indicates that the interface protocol or the first request message is not supported; If it is determined that the authentication method is supported, authentication is performed and a third response message is sent to the SMF. The third response message includes an authentication result or a message related to the authentication.

25. A data network authentication mode adaptation device, applied to UE, characterized in that: The device comprises: A third sending module is used to send the authentication capability of the UE to the SMF during the session establishment process; Wherein, the third sending module is further used for: Sending a second request message to the SMF through the AMF, where the second request message includes authentication information, where the authentication information indicates the authentication capability of the UE; Alternatively, receiving a third request message from the SMF for requesting the UE to send authentication information, and sending a first response message in response to the third request message to the SMF, wherein the first response message includes the authentication information The authentication information includes: A user identification for a user to perform data network authentication; and / or verification information of the user corresponding to the user identification.

26. The device according to claim 25, characterized in that The device also includes: The encryption module is used to encrypt and protect the authentication information between the UE and the network by encrypting the signaling message between the UE and the network, and the signaling message encryption is enabled according to the user contract.

27. A SMF entity, characterized in that: It comprises a processor, a memory and a program or instruction stored in the memory and executable on the processor, wherein when the program or instruction is executed by the processor, the steps of the data network authentication mode adaptation method as claimed in any one of claims 1 to 9 are implemented.

28. An authentication server, characterized in that: It comprises a processor, a memory and a program or instruction stored in the memory and executable on the processor, wherein when the program or instruction is executed by the processor, the steps of the data network authentication mode adaptation method as claimed in any one of claims 10 to 11 are implemented.

29. A UE, characterized in that: It comprises a processor, a memory and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the data network authentication mode adaptation method as claimed in any one of claims 12 to 13.

30. A readable storage medium, characterized in that: The readable storage medium stores a program or instruction, and when the program or instruction is executed by the processor, it implements the steps of the data network authentication method adaptation method as described in any one of claims 1 to 9, or the steps of the data network authentication method adaptation method as described in any one of claims 10 to 11, or the steps of the data network authentication method adaptation method as described in any one of claims 12 to 13.

Images