A data transmission method, related network equipment and storage medium

Abstract

The embodiment of the present invention discloses a data transmission method, related network equipment and storage medium. The method comprises: an authentication service function (AUSF) sends a first request message for requesting registration to a network storage function (NRF), wherein the first request message includes a first identifier, and the first identifier is used to indicate an authentication method supported by the AUSF; and the AUSF receives a first response message sent by the NRF indicating a registration result.

Description

Technical Field

[0001] The present invention relates to the field of wireless communication technology, and in particular to a data transmission method, related network equipment and a storage medium. Background Art

[0002] The authentication methods used in 5G networks may include, for example, Authentication and Key Agreement (AKA) and Improved Extensible Authentication Protocol-Authentication and Key Agreement (EAP-AKA'). At present, the authentication method used by the user equipment (UE) is pre-configured in the Unified Data Management (UDM). For the UE side, the secret key is also pre-written before the card is issued, and the secret key is activated when the user first accesses the network, thereby performing encrypted communication.

[0003] With the development of 5G, it needs to be deeply integrated with more vertical industries. There will be a demand for various authentication methods, requiring the core network to provide support for different authentication methods. Summary of the invention

[0004] In order to solve the existing technical problems, an embodiment of the present invention provides a data transmission method, related network equipment and storage medium.

[0005] To achieve the above object, the technical solution of the embodiment of the present invention is implemented as follows:

[0006] In a first aspect, an embodiment of the present invention provides a data transmission method, the method comprising:

[0007] An authentication service function (AUSF) sends a first request message for requesting registration to a network repository function (NRF) NF Repository Function, wherein the first request message includes a first identifier, and the first identifier is used to indicate an authentication method supported by the AUSF;

[0008] The AUSF receives a first response message sent by the NRF representing a registration result.

[0009] In the above scheme, the method further includes: the AUSF receives a second message sent by a mobility management function (AMF, Access and Mobility Management Function) for UE first access authentication, wherein the second message includes at least identity information of the UE;

[0010] The AUSF performs the authentication process with the UE according to the supported authentication method.

[0011] In the above solution, the second message also includes a second identifier, and the second identifier is used to indicate the authentication method supported by the UE;

[0012] The AUSF performs an authentication process with the UE according to the supported authentication method, including:

[0013] After the AUSF determines that the authentication method represented by the first identifier is consistent with the authentication method represented by the second identifier, it performs the authentication process with the UE according to the authentication method.

[0014] In a second aspect, an embodiment of the present invention further provides a data transmission method, the method comprising:

[0015] The AMF receives a first message sent by the UE for initial access authentication, where the first message includes identity information of the UE and a second identifier; the second identifier is used to indicate an authentication method supported by the UE;

[0016] The AMF sends a second message to the AUSF to which the UE belongs; the second message includes at least the identity information of the UE and the second identifier.

[0017] In the above scheme, before the AMF sends the second message to the AUSF to which the UE belongs, the method also includes: the AMF determines the AUSF to which the UE belongs based on the identity information of the UE, the information of the public land mobile network PLMN and the second identifier.

[0018] In the above solution, the AMF determines the AUSF to which the UE belongs according to the identity information of the UE, the information of the PLMN and the second identifier, including:

[0019] The AMF queries the NRF based on the identity information of the UE, the information of the PLMN and the second identifier to obtain an AUSF configuration file matching the second identifier;

[0020] The AMF sends a second message to the AUSF to which the UE belongs, including: the AMF sends the second message to the AUSF corresponding to the AUSF profile.

[0021] In the above scheme, the method also includes: the AMF caches the AUSF configuration file that matches the second identifier.

[0022] In the above solution, the method further includes: the AMF receives a third message for access authentication sent by the UE, where the third message includes the identity information of the UE and the second identifier;

[0023] The AMF queries the cached AUSF configuration file according to the second identifier;

[0024] The AMF sends a fourth message to the AUSF corresponding to the queried AUSF profile matching the second identifier; the fourth message includes at least the identity information of the UE and the second identifier.

[0025] In a third aspect, an embodiment of the present invention further provides an AUSF, the AUSF comprising: a first sending unit and a first receiving unit; wherein,

[0026] The first sending unit is used to send a first request message for requesting registration to the NRF, where the first request message includes a first identifier, and the first identifier is used to indicate an authentication method supported by the AUSF;

[0027] The first receiving unit is used to receive a first response message sent by the NRF and representing a registration result.

[0028] In the above solution, the AUSF further includes a first processing unit;

[0029] The first receiving unit is further used to receive a second message sent by the AMF for the first access authentication of the UE, where the second message includes at least the identity information of the UE;

[0030] The first processing unit is further used to perform an authentication process with the UE according to the supported authentication method.

[0031] In the above solution, the second message also includes a second identifier, and the second identifier is used to indicate the authentication method supported by the UE;

[0032] The first processing unit is further configured to, after determining that the authentication method represented by the first identifier is consistent with the authentication method represented by the second identifier, perform an authentication process with the UE according to the authentication method.

[0033] In a fourth aspect, an embodiment of the present invention further provides an AMF, wherein the AMF includes: a second receiving unit and a second sending unit; wherein:

[0034] The second receiving unit is used to receive a first message sent by the UE for initial access authentication, where the first message includes identity information of the UE and a second identifier; the second identifier is used to indicate an authentication method supported by the UE;

[0035] The second sending unit is used to send a second message to the AUSF to which the UE belongs; the second message includes at least the identity information of the UE and the second identifier.

[0036] In the above scheme, the AMF also includes a second processing unit, which is used to determine the AUSF to which the UE belongs based on the identity information of the UE, the information of the PLMN and the second identifier before the second sending unit sends the second message to the AUSF to which the UE belongs.

[0037] In the above solution, the second processing unit is further used to query the NRF based on the identity information of the UE, the information of the PLMN and the second identifier to obtain the AUSF configuration file matching the second identifier;

[0038] The second sending unit is used to send the second message to the AUSF corresponding to the AUSF configuration file.

[0039] In the above scheme, the second processing unit is also used to cache the AUSF configuration file matching the second identifier.

[0040] In the above solution, the second receiving unit is further used to receive a third message sent by the UE for access authentication, wherein the third message includes the identity information and the second identifier of the UE;

[0041] The second processing unit is further used to query the cached AUSF configuration file according to the second identifier;

[0042] The second sending unit is also used to send a fourth message to the AUSF corresponding to the queried AUSF profile matching the second identifier; the fourth message includes at least the identity information of the UE and the second identifier.

[0043] In a fifth aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in the first aspect or the second aspect of the embodiment of the present invention.

[0044] In a sixth aspect, an embodiment of the present invention further provides a network device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the method described in the first aspect or the second aspect of the embodiment of the present invention are implemented.

[0045] The data transmission method, related network equipment and storage medium provided in the embodiment of the present invention include: AUSF sends a first request message for requesting registration to NRF, the first request message includes a first identifier, and the first identifier is used to indicate the authentication method supported by the AUSF; the AUSF receives a first response message sent by the NRF indicating the registration result. By adopting the technical solution of the embodiment of the present invention, the AUSF adds the first identifier representing the authentication method supported by the AUSF to the message during the registration process with the NRF, thereby supporting registration according to the authentication type during the AUSF registration process, and enabling the core network device to provide support for different authentication methods, that is, supporting the negotiation and selection of the authentication method during the authentication process of the UE, thereby enriching the authentication method. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 The data transmission method according to the embodiment of the present invention is shown in FIG. Figure 1 ;

[0047] Figure 2 The data transmission method according to the embodiment of the present invention is shown in FIG. Figure 2 ;

[0048] Figure 3 The interactive process diagram of the data transmission method according to the embodiment of the present invention is as follows Figure 1 ;

[0049] Figure 4 The interactive process diagram of the data transmission method according to the embodiment of the present invention is as follows Figure 2 ;

[0050] Figure 5 The interactive process diagram of the data transmission method according to the embodiment of the present invention is as follows Figure 3 ;

[0051] Figure 6 A schematic diagram of the composition structure of the AUSF according to an embodiment of the present invention;

[0052] Figure 7 A schematic diagram of the composition structure of the AMF according to an embodiment of the present invention;

[0053] Figure 8 The figure is a schematic diagram of the hardware structure of the network device according to the embodiment of the present invention. DETAILED DESCRIPTION

[0054] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0055] An embodiment of the present invention provides a data transmission method. Figure 1 The data transmission method according to the embodiment of the present invention is shown in FIG. Figure 1;like Figure 1 As shown, the method includes:

[0056] Step 101: The AUSF sends a first request message for registering to the NRF, where the first request message includes a first identifier, and the first identifier is used to indicate an authentication method supported by the AUSF;

[0057] Step 102: The AUSF receives a first response message representing a registration result sent by the NRF.

[0058] In this embodiment, each core network device must complete NRF registration before providing services, and can provide corresponding services only after registration is completed.

[0059] In this embodiment, the AUSF sends a first request message to the NRF for requesting registration; the first request message includes a first identifier for indicating an authentication method supported by the AUSF; optionally, the first request message includes an AUSF configuration file; the AUSF configuration file includes the first identifier. Optionally, the first request message may also include an identifier of the AUSF.

[0060] Exemplarily, AUSF may send a PUT request message to NRF, and the PUT request message carries a variable {nfInstanceID}, which can be used to identify the identifier of AUSF, which is a unique identifier in the public land mobile network (PLMN). The PUT request message also includes a profile, or it can also be called a network function profile (NF Profile). When the network function is not AUSF, the profile can also be called an AUSF profile (AUSF Profile).

[0061] In some optional embodiments, regardless of whether the registration is successful or not, the NRF will send a response message (i.e., a first response message) to the AUSF. If the registration is successful, the NRF sends a first response message indicating the successful registration (the first response message indicating the successful registration may be a "201 Created" message), identifying the resources of the AUSF that have been created in the NRF; the created resources may indicate the creation of a complete configuration file, or may indicate a configuration file that only contains mandatory attributes of the configuration file and attributes added or changed by the NRF; accordingly, the AUSF receives the first response message indicating the successful registration sent by the NRF; if the registration fails, the NRF sends a first response message indicating the failed registration, and accordingly, the AUSF receives the first response message indicating the failed registration sent by the NRF.

[0062] In other optional embodiments, if the registration is successful, the NRF sends a first response message indicating the successful registration, and accordingly, the AUSF receives the first response message sent by the NRF indicating the successful registration; if the registration fails, the NRF may not send a response message; the AUSF may determine that the registration has failed if it does not receive a response message within a preset time period.

[0063] In this embodiment, AUSF carries a first identifier representing the authentication method supported by AUSF in the first request message sent to NRF. Exemplarily, the first identifier can be indicated by a specific field in the first request message, and different values ​​of the first identifier correspond to different authentication methods; that is, different binary values ​​in the specific field can represent different authentication methods. For example, the binary identifier "001" can represent the 5G AKA authentication method, the binary identifier "010" can represent the EAP-AKA' authentication method, and so on.

[0064] In this embodiment, the NF Profile field in the first request message is set to "AUSF", which means that the first request message is a registration request of AUSF.

[0065] In this embodiment, the definition of the NF profile (NFProfile) type or the content included can refer to the definition of the NF profile (NFProfile) type in the request message sent in the registration process of each network function (NF) in the relevant technical solution, and will not be repeated here.

[0066] Optionally, the first request message also includes the identity information of the AUSF; exemplarily, the identity information of the AUSF can be represented by an identifier uniquely identified in the PLMN.

[0067] In some optional embodiments of the present invention, the method also includes: the AUSF receives a second message sent by the AMF for the UE's first access authentication, the second message including at least the identity information of the UE; the AUSF performs the authentication process with the UE according to the supported authentication method.

[0068] The data transmission method of this embodiment is applicable to the UE access authentication process. The UE sends a data packet carrying identity information. The AMF finds the UE's home network through the identity information and sends the identity information and service network information to the corresponding AUSF. The AUSF matches the access authentication method according to the UE's identity and starts the corresponding authentication process from the network side.

[0069] In this embodiment, AUSF starts to execute the corresponding authentication process according to the authentication method it supports.

[0070] In some optional embodiments of the present invention, the second message also includes a second identifier, and the second identifier is used to indicate the authentication method supported by the UE; the AUSF performs the authentication process with the UE according to the supported authentication method, including: after the AUSF determines that the authentication method represented by the first identifier is consistent with the authentication method represented by the second identifier, the AUSF performs the authentication process with the UE according to the authentication method.

[0071] In this embodiment, AUSF can match the authentication method supported by the UE with the authentication method supported by itself, and after the match is consistent, execute the authentication process with the UE according to the authentication method.

[0072] Optionally, the second message may also include the identity information of the UE and the information of the serving network (SN, Serving Network); the information of the SN may be, for example, a serving network name (SNN, Serving Network Name). Exemplarily, the identity information of the UE includes but is not limited to a subscription concealed identifier (SUCI, SUbscription Concealed Identifier), a subscription permanent identifier (SUPI, SUbscription Permanent Identifier), and the like.

[0073] Based on the above embodiments, an embodiment of the present invention further provides a data transmission method. Figure 2 The data transmission method according to the embodiment of the present invention is shown in FIG. Figure 2 ;like Figure 2 As shown, the method includes:

[0074] Step 201: AMF receives a first message sent by a UE for initial access authentication, where the first message includes identity information and a second identifier of the UE; the second identifier is used to indicate an authentication method supported by the UE;

[0075] Step 202: The AMF sends a second message to the AUSF to which the UE belongs; the second message includes at least the identity information of the UE and the second identifier.

[0076] The data transmission method of this embodiment is applicable to the UE access authentication process. The UE sends a data packet carrying identity information. The AMF finds the UE's home network through the identity information and sends the identity information and service network information to the corresponding AUSF. The AUSF matches the access authentication method according to the UE's identity and starts the corresponding authentication process from the network side.

[0077] In some optional embodiments of the present invention, before the AMF sends a second message to the AUSF to which the UE belongs, the method also includes: the AMF determines the AUSF to which the UE belongs based on the identity information of the UE, information of the public land mobile network PLMN and the second identifier.

[0078] In some optional embodiments of the present invention, the AMF determines the AUSF to which the UE belongs based on the identity information of the UE, the information of the PLMN and the second identifier, including: the AMF queries the NRF based on the identity information of the UE, the information of the PLMN and the second identifier to obtain an AUSF profile matching the second identifier; the AMF sends a second message to the AUSF to which the UE belongs, including: the AMF sends the second message to the AUSF corresponding to the AUSF profile.

[0079] In this embodiment, the data packet sent by the UE to the AMF includes identity information and a second identifier for indicating the authentication method supported by the UE; after the AMF receives the first message sent by the UE for the first access authentication, the AMF can query the NRF based on the UE's identity information (such as SUPI or SUCI, etc.), PLMN information (such as PLMN identifier) ​​and the second identifier in the first message to determine the network to which the UE belongs, that is, determine the AUSF to which the UE belongs; then the AMF sends a second message to the AUSF to which the UE belongs, and the second message includes at least the identity information of the UE and the second identifier; optionally, the second message also includes SN information; the SN information can be, for example, SNN.

[0080] In this embodiment, when AMF queries NRF about the home network of UE, AMF can obtain AUSF configuration file, and the AUSF configuration file may include the authentication method supported by the AUSF. In the process of querying the home network of each UE, AMF can obtain the configuration file of each AUSF. Optionally, AMF can cache the configuration file of each AUSF.

[0081] In some optional embodiments of the present invention, the method further includes: the AMF caches the AUSF configuration file that matches the second identifier.

[0082] Exemplarily, AMF may determine whether the obtained AUSF configuration file has been cached (i.e., whether it already exists). If it is determined that the obtained AUSF configuration file has been cached (i.e., already exists), there is no need to cache the AUSF configuration file again; if it is determined that the obtained AUSF configuration file has not been cached (i.e., does not exist), the AUSF configuration file is cached.

[0083] Optionally, AMF sets the number of cacheable AUSF profiles to identify the maximum value of cacheable AUSF profiles.

[0084] In some optional embodiments of the present invention, the method also includes: the AMF receives a third message sent by the UE for access authentication, the third message including the identity information and the second identifier of the UE; the AMF queries the cached AUSF profile according to the second identifier; the AMF sends a fourth message to the AUSF corresponding to the queried AUSF profile matching the second identifier; the fourth message includes at least the identity information of the UE and the second identifier.

[0085] In this embodiment, when the AMF receives the third message for access authentication from the UE again, or receives a message for access authentication from another UE, the cached AUSF configuration file can be queried according to the identity information of the UE and the second identifier carried in the third message (or message); if the corresponding AUSF configuration file is queried, the fourth message is directly sent to the corresponding AUSF; if the corresponding AUSF configuration file is not queried, the corresponding AUSF is obtained from the NRF query in a conventional manner. In this way, the query operation of the NRF can be reduced, which can reduce signaling or data interaction on the one hand, and reduce the authentication delay on the other hand.

[0086] By adopting the technical solution of the embodiment of the present invention, AUSF adds a first identifier representing the authentication method supported by AUSF in the message during the registration process with NRF, thereby supporting registration according to the authentication type during the AUSF registration process, and enabling the core network equipment to provide support for different authentication methods, that is, supporting the negotiation and selection of authentication methods during the authentication process of the UE, thereby enriching the authentication methods. In addition, by informing AUSF of the supported authentication methods through the UE, the network side performs authentication according to the authentication methods supported by the UE.

[0087] The data transmission method according to the embodiment of the present invention is described below with reference to specific examples.

[0088] Figure 3 The interactive process diagram of the data transmission method according to the embodiment of the present invention is as follows Figure 1 ;like Figure 3 As shown, the method includes:

[0089] Step 301: AUSF sends a PUT request (ie, the first request message in the aforementioned embodiment) to the NRF.

[0090] The first request message includes an AUSF configuration file (e.g., NFProfile), and the AUSF configuration file includes a first identifier for indicating an authentication method supported by the AUSF; wherein the "NFType" field in the AUSF configuration file is set to "AUSF". The variable {nfInstanceID} contained in the first request message represents an identifier of the AUSF, which is globally unique in the PLMN of the NRF that registers the AUSF.

[0091] Step 302: NRF sends a first response message to AUSF; illustratively, the first response message may be "201 Created", used to indicate successful registration, and the payload of the first response message includes an identifier of the created resource.

[0092] Step 303: When the UE first accesses authentication, it sends a first message to the AMF, wherein the first message includes identity information and a second identifier. Exemplarily, the second identifier may be represented by the Au_Type field; the Au_Type field indicates the authentication method supported by the UE; the identity information may be SUCI or SUPI.

[0093] Step 304 to step 305: AMF starts the NRF process according to the identity information carried in the first message, the PLMN information (such as PLMNID) and the second identifier (such as Au_Type), finds the AUSF configuration file that matches the second identifier from the NRF, determines the network to which the UE belongs, and obtains the AUSF configuration file that matches the second identifier from the NRF.

[0094] Step 306: After AMF finds the AUSF to which the UE belongs, AMF sends a second message to the AUSF, where the second message includes: UE identity information and SN information.

[0095] Step 307 to step 308: AUSF finds the corresponding authentication method according to the identity information of the UE, and AUSF starts to execute the authentication process according to the corresponding authentication method (the authentication method is the authentication method corresponding to the identity information of the UE and is also the authentication method supported by AUSF).

[0096] Figure 4 The interactive process diagram of the data transmission method according to the embodiment of the present invention is as follows Figure 2 ;like Figure 4 As shown, the method includes:

[0097] Step 401: When the UE first accesses authentication, it sends a first message to the AMF, wherein the first message includes identity information and a second identifier. Exemplarily, the second identifier may be represented by the Au_Type field; the Au_Type field indicates the authentication method supported by the UE; the identity information may be SUCI or SUPI.

[0098] Step 402 to step 403: AMF starts the NRF process according to the identity information carried in the first message, the PLMN information (e.g., PLMNID) and the second identifier (e.g., Au_Type), finds the AUSF configuration file that matches the second identifier from the NRF, determines the network to which the UE belongs, and obtains the AUSF configuration file that matches the second identifier from the NRF.

[0099] Among them, AUSF has informed NRF of the authentication methods it supports when registering with NRF.

[0100] Step 404: After AMF finds the AUSF to which the UE belongs, AMF sends a second message to the AUSF, where the second message includes: UE identity information, a second identifier (such as Au_Type) and SN information.

[0101] Steps 405 to 406: AUSF performs verification based on the second identifier (such as Au_Type) to determine whether the second identifier is consistent with the authentication method supported by itself; when it is determined that the second identifier is consistent with the authentication method supported by itself, that is, after the verification is passed, AUSF starts to execute the authentication process according to the corresponding authentication method.

[0102] Figure 5 The interactive process diagram of the data transmission method according to the embodiment of the present invention is as follows Figure 3 ;like Figure 5 As shown, the method includes:

[0103] Step 501: When the UE first accesses authentication, it sends a first message to the AMF, wherein the first message includes identity information and a second identifier. Exemplarily, the second identifier may be represented by the Au_Type field; the Au_Type field indicates the authentication method supported by the UE; the identity information may be SUCI or SUPI.

[0104] Steps 502 to 503: AMF starts the NRF process based on the identity information carried in the first message, the PLMN information (e.g., PLMNID) and the second identifier (e.g., Au_Type), finds the AUSF configuration file that matches the second identifier from the NRF, determines the network to which the UE belongs, and obtains the AUSF configuration file that matches the second identifier from the NRF.

[0105] Among them, AUSF has informed NRF of the authentication methods it supports when registering with NRF.

[0106] Step 504: AMF caches the AUSF configuration file obtained from NRF.

[0107] It should be noted that AMF sets the number of cacheable AUSF configuration files to identify the maximum value of cacheable AUSF configuration files.

[0108] Among them, different AUSFs may correspond to different authentication methods; what is cached in AMF are AUSF configuration files corresponding to different authentication methods, which can be understood as one AUSF configuration file corresponding to each authentication method. Exemplarily, if the authentication method corresponding to the AUSF configuration file obtained by AMF from NRF is not in the AMF cache, the AMF caches the AUSF configuration file; correspondingly, if the authentication method corresponding to the AUSF configuration file obtained by AMF from NRF already exists in the AMF cache, the AMF discards the AUSF configuration file.

[0109] Step 505: When the UE accesses authentication again, it sends a third message to the AMF, and the third message includes identity information and a second identifier. Exemplarily, the second identifier can be represented by the Au_Type field; the Au_Type field indicates the authentication method supported by the UE; the identity information can be SUCI or SUPI.

[0110] Step 506: AMF searches the cached information according to the identity information, PLMN information (e.g., PLMN ID) and the second identifier (e.g., Au_Type) carried in the first message, obtains the AUSF configuration file that matches the second identifier from the cached information, determines the network to which the UE belongs, and obtains the AUSF configuration file that matches the second identifier from the cache.

[0111] Step 507: AMF sends a fourth message to the AUSF to which the UE belongs, and the fourth message includes: UE identity information, a second identifier (such as Au_Type) and SN information.

[0112] Steps 508 to 509: AUSF performs verification based on the second identifier (such as Au_Type) to determine whether the second identifier is consistent with the authentication method supported by itself; when it is determined that the second identifier is consistent with the authentication method supported by itself, that is, after the verification is passed, AUSF starts to execute the authentication process according to the corresponding authentication method.

[0113] The technical solution of this embodiment does not need to repeat the NRF discovery process, but directly determines the AUSF to which the UE belongs from the information cached by the AMF and obtains the corresponding AUSF configuration file; on the one hand, it reduces signaling or data interaction, and on the other hand, it can reduce the authentication delay.

[0114] The embodiment of the present invention also provides an AUSF. Figure 6 FIG. 1 is a schematic diagram of the composition structure of the AUSF according to an embodiment of the present invention; Figure 6 As shown, the AUSF includes: a first sending unit 11 and a first receiving unit 12; wherein,

[0115] The first sending unit 11 is used to send a first request message for requesting registration to the NRF, where the first request message includes a first identifier, and the first identifier is used to indicate an authentication method supported by the AUSF;

[0116] The first receiving unit 12 is configured to receive a first response message sent by the NRF and indicating a registration result.

[0117] In some optional embodiments of the present invention, the AUSF further includes a first processing unit 13;

[0118] The first receiving unit 12 is further used to receive a second message sent by the AMF for the first access authentication of the UE, where the second message includes at least the identity information of the UE;

[0119] The first processing unit 13 is further configured to perform an authentication process with the UE according to the supported authentication method.

[0120] In some optional embodiments of the present invention, the second message further includes a second identifier, where the second identifier is used to indicate an authentication method supported by the UE;

[0121] The first processing unit 13 is further configured to, after determining that the authentication method represented by the first identifier is consistent with the authentication method represented by the second identifier, perform an authentication process with the UE according to the authentication method.

[0122] In an embodiment of the present invention, the first processing unit 13 in the AUSF can be implemented by a central processing unit (CPU), a digital signal processor (DSP), a microcontroller unit (MCU) or a programmable gate array (FPGA) in the AUSF in actual applications; the first sending unit 11 and the first receiving unit 12 in the AUSF can be implemented by a communication module (including: basic communication kit, operating system, communication module, standardized interface and protocol, etc.) and a transceiver antenna in actual applications.

[0123] An embodiment of the present invention also provides an AMF. Figure 7 Schematic diagram of the composition structure of the AMF of an embodiment of the present invention; Figure 7 As shown, the AMF includes: a second receiving unit 21 and a second sending unit 22; wherein,

[0124] The second receiving unit 21 is used to receive a first message sent by the UE for initial access authentication, wherein the first message includes identity information of the UE and a second identifier; the second identifier is used to indicate an authentication method supported by the UE;

[0125] The second sending unit 22 is used to send a second message to the AUSF to which the UE belongs; the second message includes at least the identity information of the UE and the second identifier.

[0126] In some optional embodiments of the present invention, the AMF also includes a second processing unit 23, which is used to determine the AUSF to which the UE belongs based on the identity information of the UE, the information of the PLMN and the second identifier before the second sending unit 22 sends the second message to the AUSF to which the UE belongs.

[0127] In some optional embodiments of the present invention, the second processing unit 23 is further configured to query the NRF based on the identity information of the UE, the information of the PLMN and the second identifier to obtain an AUSF configuration file matching the second identifier;

[0128] The second sending unit 22 is used to send the second message to the AUSF corresponding to the AUSF profile.

[0129] In some optional embodiments of the present invention, the second processing unit 23 is further used to cache the AUSF configuration file matching the second identifier.

[0130] In some optional embodiments of the present invention, the second receiving unit 21 is further configured to receive a third message for access authentication sent by the UE, wherein the third message includes the identity information and the second identifier of the UE;

[0131] The second processing unit 23 is further configured to query the cached AUSF configuration file according to the second identifier;

[0132] The second sending unit 22 is further used to send a fourth message to the AUSF corresponding to the queried AUSF profile matching the second identifier; the fourth message includes at least the identity information of the UE.

[0133] In an embodiment of the present invention, the second processing unit 23 in the AMF can be implemented by the CPU, DSP, MCU or FPGA in the AMF in actual applications; the second receiving unit 21 and the second sending unit 22 in the AMF can be implemented by a communication module (including: basic communication kit, operating system, communication module, standardized interface and protocol, etc.) and a transceiver antenna in actual applications.

[0134] An embodiment of the present invention also provides a network device, which may be the AUSF or AMF in the aforementioned embodiment. Figure 8 FIG. 1 is a schematic diagram of the hardware structure of the network device according to an embodiment of the present invention. Figure 8 As shown, the network device includes a memory 32, a processor 31, and a computer program stored in the memory 32 and executable on the processor 31. When the processor 31 executes the program, the steps of the data transmission method applied to AUSF or AMF as described above in the embodiment of the present invention are implemented.

[0135] Optionally, the network device further includes one or more network interfaces 33. The various components in the network device are coupled together via a bus system 34. It is understood that the bus system 34 is used to achieve connection and communication between these components. In addition to the data bus, the bus system 34 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, Figure 8 Various buses are labeled as bus system 34 .

[0136] It can be understood that the memory 32 can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disk, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM, SyncLink Dynamic Random Access Memory), and direct RAM bus random access memory (DRRAM, Direct Rambus Random Access Memory).The memory 32 described in the embodiments of the present invention is intended to include, but is not limited to, these and any other suitable types of memory.

[0137] The method disclosed in the above embodiment of the present invention can be applied to the processor 31, or implemented by the processor 31. The processor 31 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit in the processor 31 or the instruction in the form of software. The above processor 31 can be a general-purpose processor, a DSP, or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The processor can implement or execute the methods, steps and logic block diagrams disclosed in the embodiment of the present invention. The general-purpose processor can be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present invention, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium, which is located in the memory 32. The processor 31 reads the information in the memory 32 and completes the steps of the above method in combination with its hardware.

[0138] In an exemplary embodiment, the network device may be implemented by one or more application specific integrated circuits (ASIC), DSP, programmable logic device (PLD), complex programmable logic device (CPLD), FPGA, general purpose processor, controller, MCU, microprocessor, or other electronic components to execute the aforementioned method.

[0139] In an exemplary embodiment, the present invention also provides a computer-readable storage medium, such as a memory 32 including a computer program, and the computer program can be executed by a processor 31 of a network device to complete the steps of the aforementioned method. The computer-readable storage medium can be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disk, or CD-ROM; or it can be various devices including one or any combination of the above memories.

[0140] An embodiment of the present invention also provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps of the data transmission method applied in AMF or AUSF by the embodiment of the present invention are implemented.

[0141] The methods disclosed in several method embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments.

[0142] The features disclosed in several product embodiments provided in this application can be arbitrarily combined without conflict to obtain new product embodiments.

[0143] The features disclosed in several method or device embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments or device embodiments.

[0144] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0145] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0146] In addition, all functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may be separately used as a unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0147] A person of ordinary skill in the art can understand that: all or part of the steps of implementing the above-mentioned method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium, which, when executed, executes the steps of the above-mentioned method embodiment; and the aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROM, RAM, disks or optical disks.

[0148] Alternatively, if the above-mentioned integrated unit of the present invention is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present invention can be essentially or partly reflected in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROM, RAM, magnetic disks or optical disks.

[0149] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A data transmission method, characterized in that: The method comprises: The authentication service function AUSF sends a first request message for requesting registration to the network storage function NRF, wherein the first request message includes a first identifier, and the first identifier is used to indicate an authentication method supported by the AUSF; The AUSF receives a first response message representing a registration result sent by the NRF; The AUSF receives a second message sent by the mobility management function AMF for first access authentication of the user equipment UE, where the second message includes at least identity information and a second identifier of the UE; the second identifier is used to indicate an authentication method supported by the UE; After the AUSF determines that the authentication method represented by the first identifier is consistent with the authentication method represented by the second identifier, the AUSF performs the authentication process with the UE according to the authentication method supported by the AUSF.

2. A data transmission method, characterized in that: The method comprises: The AMF receives a first message sent by the UE for initial access authentication, where the first message includes identity information of the UE and a second identifier; the second identifier is used to indicate an authentication method supported by the UE; The AMF sends a second message to the AUSF to which the UE belongs; the second message includes at least the identity information of the UE and the second identifier; The second identifier and the first identifier are used together by the AUSF to perform the authentication process with the UE according to the authentication method supported by the AUSF after the AUSF determines that the authentication method represented by the first identifier is consistent with the authentication method represented by the second identifier; the first identifier is included in the first request message sent by the AUSF to the NRF for requesting registration; the first identifier is used to represent the authentication method supported by the AUSF.

3. The method according to claim 2, characterized in that Before the AMF sends the second message to the AUSF to which the UE belongs, the method further includes: The AMF determines the AUSF to which the UE belongs based on the identity information of the UE, information of the public land mobile network PLMN and the second identifier.

4. The method according to claim 3, characterized in that The AMF determines, according to the identity information of the UE, the information of the PLMN and the second identifier, the AUSF to which the UE belongs, including: The AMF queries the NRF based on the identity information of the UE, the information of the PLMN and the second identifier to obtain an AUSF configuration file matching the second identifier; The AMF sends a second message to the AUSF to which the UE belongs, including: the AMF sends the second message to the AUSF corresponding to the AUSF profile.

5. The method according to claim 4, characterized in that The method further comprises: The AMF caches the AUSF configuration file that matches the second identifier.

6. The method according to claim 5, characterized in that The method further comprises: The AMF receives a third message for access authentication sent by the UE, where the third message includes identity information and a second identifier of the UE; The AMF queries the cached AUSF configuration file according to the second identifier; The AMF sends a fourth message to the AUSF corresponding to the queried AUSF profile matching the second identifier; the fourth message includes at least the identity information of the UE and the second identifier.

7. An AUSF, characterized in that: The AUSF comprises: a first sending unit, a first receiving unit and a first processing unit; wherein, The first sending unit is used to send a first request message for requesting registration to the NRF, where the first request message includes a first identifier, and the first identifier is used to indicate an authentication method supported by the AUSF; The first receiving unit is configured to receive a first response message sent by the NRF and representing a registration result; The first receiving unit is further used to receive a second message sent by the AMF for the first access authentication of the UE, where the second message includes at least the identity information and the second identifier of the UE; the second identifier is used to indicate the authentication method supported by the UE; The first processing unit is used to determine that the authentication method represented by the first identifier is consistent with the authentication method represented by the second identifier, and then perform the authentication process with the UE according to the authentication method supported by the AUSF.

8. An AMF, characterized in that: The AMF comprises: a second receiving unit and a second sending unit; wherein, The second receiving unit is used to receive a first message sent by the UE for initial access authentication, wherein the first message includes identity information of the UE and a second identifier; the second identifier is used to indicate an authentication method supported by the UE; The second sending unit is used to send a second message to the AUSF to which the UE belongs; the second message includes at least the identity information of the UE and the second identifier; the second identifier and the first identifier are used together by the AUSF to perform the authentication process with the UE according to the authentication method supported by the AUSF after the AUSF determines that the authentication method represented by the first identifier is consistent with the authentication method represented by the second identifier; the first identifier is included in the first request message sent by the AUSF to the NRF for requesting registration; the first identifier is used to indicate the authentication method supported by the AUSF.

9. The AMF according to claim 8, characterized in that The AMF also includes a second processing unit, which is used to determine the AUSF to which the UE belongs based on the identity information of the UE, the information of the PLMN and the second identifier before the second sending unit sends a second message to the AUSF to which the UE belongs.

10. The AMF according to claim 9, characterized in that The second processing unit is further configured to query the NRF based on the identity information of the UE, the information of the PLMN and the second identifier to obtain an AUSF configuration file matching the second identifier; The second sending unit is used to send the second message to the AUSF corresponding to the AUSF configuration file.

11. The AMF according to claim 10, characterized in that The second processing unit is also used to cache the AUSF configuration file matching the second identifier.

12. The AMF according to claim 11, characterized in that The second receiving unit is further configured to receive a third message sent by the UE for access authentication, wherein the third message includes identity information and a second identifier of the UE; The second processing unit is further used to query the cached AUSF configuration file according to the second identifier; The second sending unit is also used to send a fourth message to the AUSF corresponding to the queried AUSF profile matching the second identifier; the fourth message includes at least the identity information of the UE and the second identifier.

13. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method according to claim 1 are implemented; or When the program is executed by a processor, the steps of the method according to any one of claims 2 to 6 are implemented.

14. A network device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the method according to claim 1 are implemented; or, when the processor executes the program, the steps of the method according to any one of claims 2 to 6 are implemented.

Images