Method and apparatus for allocating EBI

Abstract

The present application provides a method and device for allocating EBI. When it is necessary to allocate EBI for the EPS bearer mapped by QoS Flow in EPS, it is determined whether the user plane security execution information of the PDU session and the user plane encryption protection information of EPS match, that is, whether the user plane capability of EPS can meet the user plane security requirement of the PDU session. If so, EBI is allocated to the EPS bearer. Otherwise, EBI is not allocated to the EPS bearer or the EBI is released if it has been allocated. This prevents the EPS bearer from using EBI that does not meet the user plane security requirement for data transmission when the UE moves from 5GS to EPS.

Description

Technical Field

[0001] The present invention relates to the field of communications, and in particular to a method and device for allocating EBI. Background Art

[0002] In the fifth generation mobile communication system (5GS), in order to ensure the end-to-end service quality of the service, a Figure 1A The fifth generation mobile communication technology service quality (5th Generation quality of service, 5GQoS) model based on service quality flow (quality of service flow, QoS flow) is shown. The 5G QoS model supports QoS flow with guaranteed bit rate (guaranteed bit rate, GBR) and QoS flow with non-guaranteed bit rate (non GBR). Data flows controlled by the same QoS flow have the same QoS guarantee. For a user equipment (user equipment, UE), the UE can establish one or more PDU sessions with 5GS. Each packet data unit (packet data unit, PDU) session can establish one or more QoS Flows. Each QoS Flow is identified by a QoS data flow identifier (QoS Flow identifier, QFI). QFI uniquely represents the identity of the QoS Flow in the PDU session.

[0003] In the network architecture that supports intercommunication between 5GS and evolved packet system (EPS), the PDU session in 5GS can be migrated to EPS, and the packet data network (PDN) connection corresponding to the PDU session is established in EPS. Accordingly, the QoS Flow in the PDU session will map an EPS bearer in the PDN connection. In the PDU session establishment process that supports intercommunication in 5GS, the core network element in 5GS needs to allocate an EBI to the EPS bearer mapped by the QoS Flow in EPS. However, how to allocate EBI to the EPS bearer is currently under discussion. Summary of the invention

[0004] The technical problem to be solved by the embodiments of the present invention is to provide a method and device for allocating EBI, so as to allocate EBI that meets the requirements to EPS, avoid allocating EBI that does not meet the user plane security requirements to EPS bearer, and save signaling overhead and waste of EBI resources.

[0005] In a first aspect, the present application provides a method for allocating EBI, comprising: when the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS match, the transmission management device sends an EBI allocation request information to the access management device, wherein the EBI allocation request information is used to request that the EPS bearer mapped by the QoS Flow in the EPS be allocated with the EBI allocation request information, and the PDU session includes at least one QoS Flow.

[0006] In an embodiment of the present invention, the transmission management device will send an EBI allocation request message to the access management device only when the user plane security execution information of the PDU session matches the user plane encryption protection information of the EPS. In this way, the EBI allocation will be requested only when the user plane security of the EPS meets the security requirements of the PDU session, thereby avoiding allocating EBI that does not meet the user plane security requirements to the EPS bearer.

[0007] When it is necessary to allocate EBI for the EPS bearer mapped by QoS Flow in EPS, SMF+PGW-C obtains the user plane security execution information associated with the PDU session and the user plane encryption protection information of EPS, and the QoS Flow is located in the PDU session; when the user plane security execution information and the user plane encryption protection information match, the transmission management device sends an EBI allocation request to the access management device, and the EBI allocation request carries a PDU session identifier, and the PDU session identifier is the identity identifier of the PDU session.

[0008] Wherein, in any of the following cases, it indicates that the EPS bearer mapped in EPS for QoS Flow needs to be allocated EBI when the UE initiates a PDU session establishment request in a non-roaming or local grooming scenario; it indicates that the ESP bearer mapped in EPS for QoS Flow needs to be allocated EBI; or

[0009] The UE initiates a PDU session modification in a non-roaming scenario or a roaming scenario based on local breakout, and the PDU session supports interworking between 5GS and EPS; or

[0010] The UE or network device initiates a PDU session modification based on the routing home roaming scenario, and the PDU session supports interworking between 5GS and EPS; or

[0011] The UE or the network requested the PDU session modification procedure.

[0012] In one possible design, the user plane security execution information of the PDU session includes: integrity protection requirement information and encryption requirement information, and the user plane encryption protection information of the EPS includes user plane encryption activation information;

[0013] When the integrity protection information indicates that the PDU session is not integrity protected and the encryption requirement information indicates that the PDU session is not encrypted, the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS match; or

[0014] When the integrity protection information indicates that the PDU session is not integrity protected, the encryption requirement information indicates that the PDU session is encrypted, and the user plane encryption activation information indicates that the EPS has activated user plane encryption, then the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS match.

[0015] In one possible design, the user plane security execution information of the PDU session includes: integrity protection requirement information and encryption requirement information, and the user plane encryption protection information of the EPS includes user plane encryption activation information;

[0016] When the integrity protection requirement information indicates that the PDU session is integrity protected, the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS do not match.

[0017] In one possible design, when the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS do not match, the transmission management device does not send an EBI allocation request to the access management device.

[0018] In one possible design, the transmission management device obtains user plane security execution information based on the subscription information or receives user plane security execution information of the PDU session from the PCF.

[0019] In the second aspect, the present application provides a method for allocating EBI, including: an access management device receives EBI allocation request information from a transmission management device, the EBI allocation request information is used to request the allocation of EBI for the EPS bearer mapped by the QoS Flow in the EPS; when the user plane security execution information of the PDU session where the QoS Flow is located matches the user plane encryption protection information of the EPS, the access management device sends an EBI allocation response to the transmission management device, and the EBI allocation response carries the EBI allocated by the access management device to the EPS bearer.

[0020] According to the above description, when the access management device receives the EBI allocation request information, the access management device will allocate EBI to the EPS bearer mapped by QoS Flow in EPS only when the user plane security execution information of the PDU session and the user plane encryption protection information of EPS match, so as to avoid allocating EBI that does not meet the user plane security requirements to the EPS bearer.

[0021] In one possible design, the user plane security execution information of the PDU session includes integrity protection requirement information and encryption requirement information, and the user plane encryption protection information of the EPS includes: user plane encryption activation information;

[0022] The integrity protection requirement information indicates that the PDU session is not integrity protected, and the encryption requirement information indicates that the PDU session is not encrypted, then the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS match; or

[0023] The integrity protection requirement information indicates that the PDU session is not integrity protected, the encryption requirement information indicates that the PDU session is encrypted, and the user plane encryption activation information indicates that the user plane encryption of EPS is activated. Then the user plane security execution information of the PDU session and the user plane encryption protection information of EPS match.

[0024] In one possible design, the user plane security execution information of the PDU session includes integrity protection requirement information and encryption requirement information, and the user plane encryption protection information of the EPS includes: user plane encryption activation information; when the integrity protection requirement information indicates that the PDU session is integrity protected, the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS do not match.

[0025] In one possible design, when the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS do not match, the access management device sends an EBI allocation response message to the transmission management device, and the EBI allocation response message carries the reason information for the EBI allocation failure.

[0026] In a third aspect, the present application provides a method for releasing an EBI, comprising:

[0027] The access management device obtains user plane security execution information of a PDU session; wherein the PDU session includes at least one QoS Flow, the QoS Flow is associated with an EPS bearer, and the EPS bearer has been allocated with an EBI;

[0028] When the user plane security execution information of the PDU session and the pre-stored or pre-configured user plane encryption protection information of the EPS do not match, the access management device sends an EBI release request message to the transmission management device serving the EPS bearer, and the EBI release request message is used to indicate that the EPS bearer needs to be released.

[0029] According to the above description, when the access management device has allocated EBI for the EPS mapped in the EPS for the QoS Flow, it determines whether the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS match. If they do not match, the EBI previously allocated to the EPS is released to prevent the EPS bearer from using EBI that does not meet the user plane security requirements when the UE moves from the 5GS to the EPS.

[0030] In one possible design, the user plane security execution information of the PDU session includes: integrity protection requirement information and encryption requirement information, and the user plane encryption protection information of the EPS includes: user plane encryption activation information;

[0031] When the integrity protection requirement information indicates that the PDU session is integrity protected, the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS do not match.

[0032] In one possible design, the user plane security execution information of the PDU session includes integrity protection requirement information and encryption requirement information, and the user plane encryption protection information of the EPS includes user plane encryption activation information;

[0033] The integrity protection requirement information indicates that the PDU session is not integrity protected, the encryption requirement information indicates that the PDU session is encrypted, and the user plane encryption activation information indicates that the user plane encryption of the EPS is activated, then the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS match; or

[0034] The integrity protection requirement information indicates that the PDU session is not integrity protected, and the encryption requirement information indicates that the PDU session is not encrypted. Then the user plane security execution information of the PDU session and the user plane encryption protection information of EPS match.

[0035] In a possible design, when the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS match, the access management device does not release the EBI carried by the EPS.

[0036] In a possible design, before the access management device obtains the user plane security execution information of the PDU session, the following steps are also included:

[0037] During the establishment or modification process of the PDU session, the access management device receives the PDU session identifier and the user plane security execution information corresponding to the PDU session identifier from the transmission management device.

[0038] In a possible design, the user plane encryption protection information of EPS comes from the mobility management device in EPS.

[0039] In another aspect, the present application provides a device for allocating EBI, which is used to implement the functions of the transmission management device behavior in each possible design of the first aspect. The functions can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions.

[0040] In one possible design, the structure of the transmission management device includes a processor and a transceiver, and the processor is configured to determine whether the user plane security execution information of the PDU session matches the user plane encryption protection information of the EPS. The transceiver is configured to send EBI allocation request information to the access management device when the judgment result of the processor is yes, and the EBI allocation request information is used to request the allocation of EBI for the EPS bearer mapped in the EPS for the QoS Flow, and the PDU session includes at least one QoS Flow. The transmission management device may also include a memory, which is used to couple with the processor and store program instructions and data necessary for the network device.

[0041] In another aspect, the present application provides a device for allocating EBI, which has the function of implementing the access management device behavior in each possible design of the second aspect. The function can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions. The module can be software and / or hardware.

[0042] In one possible design, the structure of the access management device includes a transceiver and a processor, the transceiver is used to receive EBI allocation request information from the transmission management device; wherein the EBI allocation request is used to request the allocation of EBI for the EPS bearer mapped in the EPS by the QoS Flow. The processor is used to determine whether the user plane security execution information of the PDU session where the QoS Flow is located matches the user plane encryption protection information of the EPS. The transceiver is also used to send EBI allocation response information to the transmission management device when the judgment result of the processing unit is yes; wherein the EBI allocation response information carries the EBI allocated by the access management device to the EPS bearer. The access management device may also include a memory, which is used to couple with the processor and store program instructions and data necessary for the network device.

[0043] In another aspect, the present application provides a device for allocating EBI, which has the function of implementing the access management device behavior in each possible design of the third aspect. The function can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions. The module can be software and / or hardware.

[0044] In one possible design, the structure of the access management device includes a transceiver and a processor, the processor is used to obtain user plane security execution information of the PDU session; wherein the PDU session includes at least one QoS Flow, the QoS Flow is associated with the EPS bearer, and the EPS bearer has been allocated with an EBI. The processor is also used to determine whether the user plane security execution information of the PDU session matches the pre-stored or pre-configured user plane encryption protection information of the EPS; the transceiver is used to send an EBI release request to the transmission management device serving the EPS bearer when the judgment result of the processing unit is no, the EBI release request is used to indicate that the EBI of the EPS bearer needs to be released. The access management device may also include a memory, the memory is used to couple with the processor, and stores program instructions and data necessary for the network device.

[0045] On the other hand, the present application provides a computer storage medium, including instructions, which, when executed on a computer, enables the computer to execute the method described in any one of the possible implementation modes of the first aspect to the first aspect.

[0046] On another aspect, the present application provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute a method as described in any one of the possible implementations of the first aspect to the first aspect.

[0047] On the other hand, the present application provides a computer storage medium, including instructions, which, when executed on a computer, enables the computer to execute a method as described in any one of the possible implementations of the second aspect to the second aspect.

[0048] Yet another aspect of the present application provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute a method as described in any one of the possible implementations of the second aspect to the third aspect.

[0049] On the other hand, the present application provides a computer storage medium, including instructions, which, when executed on a computer, enables the computer to execute a method as described in any one of the possible implementations of the third aspect to the third aspect.

[0050] On another aspect, the present application provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute a method as described in any one of the possible implementations of the third aspect to the third aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1A It is a schematic diagram of mapping of QoS Flow in 5GS provided by an embodiment of the present invention;

[0052] Figure 1B is another structural schematic diagram of a communication system provided by an embodiment of the present invention;

[0053] Figure 1C is another structural schematic diagram of a communication system provided by an embodiment of the present invention;

[0054] Figure 1D is another structural schematic diagram of a communication system provided by an embodiment of the present invention;

[0055] Figure 1E It is a schematic diagram of the process of establishing a PDU session provided by an embodiment of the present invention;

[0056] Figure 1F is a flow chart of a method for allocating EBI provided by an embodiment of the present invention;

[0057] Figure 2 is another flowchart of the method for allocating EBI provided by an embodiment of the present invention;

[0058] Figure 3 is another flowchart of the method for allocating EBI provided by an embodiment of the present invention;

[0059] Figure 4 is another flow chart of the method for allocating EBI provided by an example of the present invention;

[0060] Figure 5 is a schematic diagram of the structure of a device provided by an embodiment of the present invention;

[0061] Figure 6 It is another structural schematic diagram of a device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0062] Figure 1B This is an architecture diagram of a communication system based on a non-roaming scenario (Non-roaming architecture for interworking between 5GS and EPC / E-UTRAN) of an embodiment of the present invention. Figure 1BThe communication system includes: unified data management+home subscriber server (UDM+HSS), policy and charging function+policy and charging rules function (PCF+PCRF), session management function+PDN gateway control plane (SMF+PGW-C), user plane function+PDN gateway user plane (UPF+PGW-U), serving gateway (SGW), mobility management entity (MME), evolved universal terrestrial radio access network (E-UTRAN), user equipment (UE) 1, access and mobility management function (AMF), next generation radio access network (NG-RAN) and UE2. Among them, UDM+HSS is a network element formed by HSS in EPS and UDM in 5GS, PCF+PCRF is a network element formed by PCRF in EPS and PCF in 5GS, SMF+PGW-C is a network element formed by PGW-C in EPS and SMF in 5GS, and UPF+PGW-U is a network element formed by PGW-U in EPS and UPF in 5GS. MME and E-UTRAN are network elements in EPS, AMF and NG-RAN are network elements in 5GS, UE1 accesses (core network) through E-UTRAN, UE2 accesses (core network) through NG-RAN, and UE1 and UE2 can refer to the same UE.

[0063] Below Figure 1B The various interfaces in the communication system are described as follows:

[0064] The S6a interface represents the communication interface between MME and HSS+UDM. The S11 interface represents the communication interface between MME and SGW. The S1-MME interface represents the communication interface between MME and E-UTRAN. The S1-U interface represents the communication interface between E-UTRAN and SGW. The N10 interface represents the communication interface between HSS+UDM and SMF+PGW-C. The S5-C interface represents the communication interface of the control plane between SGW and SMF+PGW-C. The S5-U interface represents the communication interface of the user plane between SGW and UPF+PGW-U. The N7 interface represents the communication interface between PCF+PCRF and SMF+PGW-C. N4 represents the communication interface between SMF+PGW-C and UPF+PGW-U. The N8 interface represents the communication interface between HSS+UDM and AMF. The N15 interface represents the communication interface between PCF+PCRF and AMF. The N11 interface represents the communication interface between SMF+PGW-C and AMF. The N3 interface represents the communication interface between UPF+PGW-U and NG-RAN. The N2 interface represents the communication interface between NG-RAN and AMF. The N1 interface represents the communication interface between AMF and UE.

[0065] Figure 1C It is an architecture diagram of a communication system for a local breakout roaming scenario based on 5GS and EPS interworking (Localbreakout roaming architecture for interworking between 5GS and EPC / E-UTRAN) involved in an embodiment of the present invention. Figure 1CThe communication system includes UDM+HSS, home policy and charge function+home policy and charging rules function (h-PCF+h-PCRF), roaming policy and charging function+visited policy and charging rules function (v-PCF+v-PCRF), SMF+PGW-C, UPF+PGW-U, SGW, MME, E-UTRAN, UE1, AMF, NG-RAN and UE2. Among them, UDM+HSS is a network element formed by the HSS in EPS and the UDM in 5GS, h-PCF+h-PCRF and v-PCF+v-PCRF are network elements formed by the PCRF in EPS and the PCF in 5GS, SMF+PGW-C is a network element formed by the PGW-C in EPS and the SMF in 5GS, and UPF+PGW-U is a network element formed by the PGW-U in EPS and the UPF in 5GS. MME and E-UTRAN are network elements in EPS, AMF and NG-RAN are network elements in 5GS, UE1 resides in E-UTRAN, and UE2 resides in NG-RAN. HSS+UDM is located in the home public land mobile network (HPLMN), and other network elements in the communication system are located in the visited public land mobile network VPLMN (VPLMN).

[0066] Below Figure 1C The various interfaces in the communication system are described as follows:

[0067] The S6a interface represents the communication interface between the MME and HSS+UDM. The S11 interface represents the communication interface between the MME and the SGW. The S1-MME interface represents the communication interface between the MME and the E-UTRAN. The S1-U interface represents the communication interface between the E-UTRAN and the SGW. The N10 interface represents the communication interface between the HSS+UDM and the SMF+PGW-C. The S5-C interface represents the control plane communication interface between the SGW and the SMF+PGW-C. The S5-U interface represents the user plane communication interface between the SGW and the UPF+PGW-U. The N24 interface represents the communication interface between the h-PCF+h-PCRF and the v-PCF+v-PCRF, and the N7 interface represents the communication interface between the v-PCF+v-PCRF and the SMF+PGW-C. The N4 represents the communication interface between the SMF+PGW-C and the UPF+PGW-U. The N8 interface represents the communication interface between the HSS+UDM and the AMF. The N15 interface represents the communication interface between the v-PCF+v-PCRF and the AMF. The N11 interface represents the communication interface between SMF+PGW-C and AMF. The N3 interface represents the communication interface between UPF+PGW-U and NG-RAN. The N2 interface represents the communication interface between NG-RAN and AMF. The N1 interface represents the communication interface between AMF and UE.

[0068] Figure 1D It is an architecture diagram of a communication system for a home-routed roaming scenario based on 5GS and EPS interworking (Home-routed roaming architecture for interworking between 5GS and EPC / E-UTRAN) involved in an embodiment of the present invention. Figure 1D The communication system includes: HSS+UDM, h-PCF+h-PCRF, SMF+PGW-C, UPF+PGW-U, SGW, MME, E-UTRAN, UE1, v-PCF, v-SMF, UPF, AMF, NG-RAN and UE2. Among them, HSS+UDM is a network element formed by the HSS in EPS and the UDM in 5GS. h-PCF+h-PCRF is a network element formed by the PCF in 5GS and the PCRF in EPS. SMF+PGW-C is a network element formed by the SMG in 5GS and the PGW-C in EPS. UPF+PGW-U is a network element formed by the UPF in 5GS and the PGW-U in EPS. HSS+UDM, h-PCF+h-PCRF, SMF+PGW-C, UPF+PGW-U are located in the HPLMN, and other network elements in the communication system are located in the VPLMN.

[0069] Below Figure 1DThe following describes each interface in the communication system:

[0070] The S6a interface represents the communication interface between the MME and HSS+UDM. The S11 interface represents the communication interface between the MME and the SGW. The S1-MME interface represents the communication interface between the MME and the E-UTRAN. The S1-U interface represents the communication interface between the E-UTRAN and the SGW. The N10 interface represents the communication interface between the HSS+UDM and the SMF+PGW-C. The N7 interface represents the communication interface between the h-PCF+h-PCRF and the SMF+PGW-C. The N4 interface represents the communication interface between the SMF+PGW-C and the UPF+PGW-U. The S8-C interface represents the communication interface of the control plane between the SMF+PGW-C and the SGW. The S8-U interface represents the communication interface of the user plane between the SGW and the UPF+PGW-U. N26 represents the communication interface between the MME and the AMF. N10 represents the communication interface between the HSS+UDM and the v-SMF. The N24 interface represents the communication interface between the h-PCF+h-PCRF and the v-PCF. The N16 interface represents the communication interface between SMF+PGW-C and v-SMF. The N9 interface represents the communication interface between UPF+PGW-U and UPF. The N15 interface represents the communication interface between v-PCF and AMF. The N11 interface represents the communication interface between v-SMF and AMF. The N4 interface represents the communication interface between UPF and v-SMF. The N3 interface represents the communication interface between UPF and NG-RAN. The N2 interface represents the communication interface between AMF and NG-RAN. The N1 interface represents the communication interface between UE and AMF.

[0071] Among them, the following Figure 1B , Figure 1C and Figure 1D The functions of each network element are introduced as follows:

[0072] UPF+PGW-U: used for transmission management of user data. In the EPS and EGS intercommunication architecture, this network element can be used for EPS data transmission and provide 5G data transmission function.

[0073] SMF+PGW-C: used for session establishment, deletion, and modification management. In the interoperability architecture, this network element can provide both EPS and 5G session management functions.

[0074] PCF+PCRF: used for policy and charging control entity. In the interoperability architecture, this network element can provide both EPS policy and charging control for terminal devices and 5G policy and charging control.

[0075] HSS+UDM: used to store user subscription data. In the intercommunication architecture, this network element stores both the EPS subscription information and the 5G subscription information of the terminal device.

[0076] 5G radio access network (RAN): provides wireless air interface access to the core network for terminal devices to obtain corresponding services.

[0077] Evolved universal terrestrial radio access network (E-UTRAN): used for radio resource management, establishing, modifying or deleting air interface resources for terminal devices, providing data and signaling transmission for terminal devices, etc.

[0078] AMF: used for user access and mobility management, mainly including user registration management, reachability management, mobility management, paging management, access authentication and authorization, encryption and integrity protection of non-access layer signaling, etc.

[0079] MME: used for user mobility management. For example, it mainly includes user attachment management, reachability management, mobility management, paging management, access authentication and authorization, encryption and integrity protection of non-access layer signaling, etc.

[0080] SGW: User plane gateway, user plane termination point with E-UTRAN. Serves as a local mobility anchor for handover between base stations. Manages routing and transmission of data packets, adds transport layer packet labels, etc.

[0081] The UE in this application is a device with wireless communication function, which can be deployed on land, including indoors or outdoors, handheld, wearable or vehicle-mounted; it can also be deployed on the water surface (such as ships, etc.); it can also be deployed in the air (such as airplanes, balloons and satellites, etc.). The terminal device can be a mobile phone, a tablet computer (Pad), a computer with wireless transceiver function, a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a wireless terminal in industrial control, a wireless terminal in self-driving, a wireless terminal in remote medical, a wireless terminal in smart grid, a wireless terminal in transportation safety, a wireless terminal in smart city, a wireless terminal in smart home, etc. The terminal device can also be a handheld device with wireless communication function, a vehicle-mounted device, a wearable device, a computing device or other processing device connected to a wireless modem. Terminal devices may be called different names in different networks, such as: terminal equipment, access terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication equipment, user agent or user device, cellular phone, cordless phone, session initiation protocol (SIP) phone, wireless local loop (WLL) station, personal digital assistant (PDA), terminal equipment in 5G network or future evolution network, etc.

[0082] See also Figure 1E , Figure 1E : is a schematic diagram of a process for establishing a PDU session in 5GS provided by an embodiment of the present invention, the process including:

[0083] 1. The UE sends a PDU session establishment request to the AMF, and the AMF receives the PDU session establishment request from the UE. The PDU session establishment request is used to establish a PDU session in the EGS.

[0084] 2. AMF selects SMF.

[0085] 3a. AMF sends a PDU session establishment request to SMF, and SMF receives the PDU session establishment request from AMF. SMF can send a PDU session establishment request to AMF through the Nsmf interface.

[0086] 4a and 4b, SMF registers with UDM and obtains subscription information from UDM. The subscription information includes user plane security policy.

[0087] 5. SMF sends a PDU session establishment response to AMF, and AMF receives the PDU session establishment response from SMF. SMF may reject the establishment of the PDU session in this step and carry the reason value for rejection in the PDU session establishment response.

[0088] 6. Authentication / authorization of PDU sessions.

[0089] 7a and 7b, SMF selects PCF. SMF requests policy rules from PCF. SMF may obtain the dynamic user plane security policy of the PDU session from PCF to update the user plane security policy in the subscription information.

[0090] 8. SMF selects UPF.

[0091] 9. SMF sends PDU session related information (for example, UE's IP address / prefix, trigger status, etc.) to PCF, and PCF receives PDU session related information reported by SMF.

[0092] 10a and 10b, SMF sends tunnel information and rule information to UPF, and UPF receives tunnel information and rule information from SMF.

[0093] 11. SMF sends the PDU session identifier, the session management information (SM information) and the session management container (SM container) associated with the PDU session identifier to AMF.

[0094] 12. AMF sends a PDU session request to NG-RAN, and RAN receives the PDU session request from AMF. The PDU session request includes SM information and NAS message. AMF sends SM Information to RAN through the N2 interface, and the NAS message includes SM container to RAN, that is, AMF sends SM container to RAN in a transparent way. SM information protects the user plane policy enforcement of PDU session.

[0095] 13. AN specific resource setup is performed between NG-RAN and UE. During this process, NR-RAN sends a PDU session establishment accept to the UE.

[0096] 14. NG-RAN sends a PDU session request ACK to AMF, and AMF accepts the PDU session request ACK from NG-RAN.

[0097] 15. AMF sends a session management context update request (PDU session update SM context request) to SMF, and SMF accepts the session management context update request from AMF. This request can be sent through the Nsmf interface.

[0098] 16a. SMF sends a session modification request to UPF, and UPF receives the session modification request from SMF. The request can be sent through the N4 interface.

[0099] 16b. UPF sends a session modification response to SMF, and SMF receives the session modification response from SMF. The response can be sent via the N4 interface.

[0100] 17. SMF sends an update session management context response (PDU session update SM contextresponse) to AMF, and AMF receives the update session management context response from SMF.

[0101] 18. SMF sends a session management context status notification (PDU session SM context statusnotify) to AMF, and AMF receives the session management context status notification from SMF.

[0102] 19. SMF configures IPv6 addresses for UPF and UE.

[0103] 20. The unsubscription / deregistration process is carried out between SMF and UDM.

[0104] See also Figure 1F , Figure 1F The EBI allocation process provided by the embodiment of the present invention includes:

[0105] 1. During the creation of the default QoS Flow or GBR QoS Flow, PGW-C+SMF will request EBI from AMF for the corresponding default EPS bearer / dedicated GBR EPS bearer.

[0106] In 5GS, the creation process of the default QoS Flow is during the PDU Session establishment process initiated by the UE, while the creation process of the GBR QoS Flow is during the PDU Session modification process initiated by the UE or the network side.

[0107] 2. SMF sends an EBI allocation request to AMF. The EBI allocation request carries the PDU session identifier and the allocation and retention priority list (ARP list) Namf_Communication_EBIAssignment service request, requesting the EBI allocated by AMF. The service request carries the PDU Session ID and ARP list.

[0108] Steps 3-6 are only used when the AMF needs to release a previously allocated EBI (Note: the number of EBIs in EPS is limited).

[0109] 3. If the AMF does not have an available EBI, the AMF may cancel the previously allocated EBI based on ARP and S-NSSAI, and send a request to update the session management context to the SMF+PGW-C serving the EPS bearer. (Note: AMF can allocate EBI to multiple SMFs, so the SMF in this step may not be the same as the SMF that sends the request to the AMF in step 2.)

[0110] 4. SMF sends the session management container (N1 SM container) and session management information (N2 SMinformation) to AMF to notify UE and RAN of the released EBI respectively.

[0111] 5. If the UE is in CM_IDLE state, the AMF first pages the UE, and then the UE initiates the Service Request process. The N2 SM information element and the N1 SM container element in the N2 Session message in the Service Request process are brought to the RAN and the UE.

[0112] If the UE is in CM_CONNECTED state, the AMF sends the N2 SM information element and the N1 SM container information element in the N2 Session Request message to the RAN and the UE.

[0113] 6. UE triggers the PDU session modification process.

[0114] 7. If AMF successfully allocates EBI, AMF sends EBI allocation response to SMF+PGW-C. If AMF successfully allocates EBI, the EBI allocation response carries the allocated EBI. If AMF fails to allocate EBI, the EBI allocation response carries the failure reason value. For example, if the failure reason value is insufficient EBI quantity, AMF responds to SMF with the allocated EBI. If the allocation is unsuccessful, AMF responds with a reason value indicating that the EBI allocation failed.

[0115] 8. SMF+PGW-C modifies the tunnel information of the user plane.

[0116] 9. SMF sends N1 SM container and N2 SM information to AMF to notify UE and RAN of the released EBI respectively.

[0117] 10. AMF sends the allocated EBI to UE and RAN. UE, RAN and network side modify the tunnel information.

[0118] from Figure 1FIt can be seen from the EBI allocation process that after receiving the EBI allocation request from SMF+PGW-C, AMF will allocate EBI for the EPS bearer. Since the user plane security requirements of 5GS are higher than the user plane security capabilities of EPS, after the PDU session that supports EPS migration is migrated to EPS, the user plane security capabilities of EPS may not meet the user plane security requirements of the PDU session. In this way, the EBI pre-allocated to the EPS bearer mapped in the EPS for the QoS Flow in the PDU session is unavailable, resulting in a waste of limited EBI resources in EPS and increasing unnecessary signaling overhead. In order to solve the above problems, this application proposes Figures 2 to 4 solution.

[0119] See also Figure 2 , Figure 2 : is a flow chart of a method for allocating EBI provided by an embodiment of the present invention. In the embodiment of the present invention, the method includes:

[0120] S201. The transmission management device determines whether the user plane security execution information of the PDU session and the user plane security protection information of the EPS match.

[0121] Specifically, one or more QoS Flows can be established in a PDU session. The PDU session supports migration to EPS, that is, the PDU session supports establishing a corresponding PDN connection in EPS. For one QoS Flow, the QoS Flow maps an EPS bearer in EPS; wherein, the EPS bearer mapped by the QoS Flow represents the EPS bearer corresponding to the QoS Flow in the 5GS in EPS. After the UE moves from the 5GS to the EPS, the UE establishes a PDN connection corresponding to the PDU session in EPS. Accordingly, the QoS Flow in the PDU session will map the EPS bearer in the PDN connection. After the PDN connection is successfully established, the UE will initiate a process of releasing the PDU session, and one or more QoS Flows in the corresponding PDU session will also be released. In an embodiment of the present invention, when any of the following situations occurs, it indicates that an EBI needs to be allocated for the EPS bearer mapped by the QoS Flow in EPS: 1. Figure 1B Non-roaming and Figure 1C In the roaming scenario of local guidance, the UE initiates the establishment of a PDU session; 2. Figure 1D In the roaming scenario of home routing, the UE initiates the establishment of a PDU session; 3. Figure 1B Non-roaming and Figure 1C In the local roaming scenario, the UE or the network initiates a PDU session modification; 4. Figure 1DIn the scenario of home roaming, the UE or the network initiates the modification of the PDU session. The transmission management device in this embodiment is used to manage the PDU session in 5GS and the PDN connection in EPS, including being responsible for the establishment, modification and deletion of PDU sessions and the establishment, modification and deletion of PDN connections. The transmission management device can be composed of two devices, SMF and PGW-C, or a device with the functions of SMF and PGW-C.

[0122] Among them, the non-roaming scenario means that the home network provides services for the UE. The home-roaming scenario means that the gateway (h-SMF+PGW-C and h-UPF+PGW-U) of the home network roams and accesses, which means that the roaming user obtains the services provided by the home network through the gateway H-PGW of the home network. The local-guided roaming scenario means that the roaming user obtains the corresponding services through the gateway (v-SMF+PGW-C and v-UPF+PGW-U) of the visited network. The service provider can be the home network or the visited network.

[0123] In a possible implementation, the transmission management device obtains the session management policy of the PDU session from the PCF, and the PDU session management policy includes a field indicating whether migration to EPS is supported, for example: the session management policy includes an EPS support indication field, and the value of the EPS support indication is "1" indicating that the PDU session supports migration to EPS; the value of the EPS support indication is "0" indicating that the PDU session does not support migration to EPS.

[0124] In a possible implementation, the transmission management device obtains the user plane security execution information of the PDU session, including: SMF+PGW-C pre-stores or pre-configures a mapping relationship between the PDU session identifier and the user plane security execution information, and SMF+PGW-C determines the user plane security execution information corresponding to the PDU session identifier based on the mapping relationship; or SMF+PGW-C obtains the signed user plane security policy in the UDM, and the user plane security policy includes the user plane security execution information; or SMF+PGW-C obtains the corresponding user plane security execution information from the PCF.

[0125] In a possible implementation, the transmission management device obtains the user plane encryption protection information of the EPS, including: the transmission management device pre-stores or pre-configures the user plane encryption protection information of the EPS, and the SMF obtains the user plane encryption protection information of the EPS locally; or the transmission management device receives the user plane encryption protection information of the EPS sent by the MME in the EPS; or the transmission management device receives the user plane encryption protection information of the EPS from the PCRF.

[0126] Among them, the transmission management device determines whether the user plane security execution information of the PDU session matches the user plane encryption protection information of the EPS. The essence of this is whether the user plane security capability of the EPS can meet the user plane security requirements of the PDU session. If the user plane security execution information of the PDU session matches the user plane encryption protection information of the EPS, it means that the user plane security capability of the EPS meets the user plane security requirements of the PDU session; if the user plane security execution information of the PDU session does not match the user plane encryption protection information of the EPS, it means that the user plane security capability of the EPS does not meet the user plane security requirements of the PDU session.

[0127] In a possible implementation manner, the user plane security execution information of the PDU session includes integrity protection requirement information and encryption requirement information, and the user plane encryption protection information of the EPS includes: user plane encryption activation information.

[0128] When the user plane security requirement information of the PDU session indicates that the PDU session is not integrity protected, and the user plane encryption protection information of the EPS indicates that the EPS has activated user plane encryption, the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS match.

[0129] For example: the integrity protection requirement information includes three forms: required, preferred and not needed. Required means that the PDU session needs to be integrity protected, preferred means that the PDU session is given priority to be integrity protected, and not needed means that the PDU session does not need integrity protection. The integrity protection requirement information can be represented by bits, and different bit values ​​correspond to different integrity protection requirement information. The encryption protection requirement information includes three forms: required, preferred and not needed. Required means that the PDU session needs to be encrypted, preferred means that the PDU session is given priority to be encrypted, and not needed means that the PDU session does not need to be encrypted. The encryption requirement information can be represented by bits, and different bit values ​​are used to represent different encryption requirement information. The user plane encryption activation information includes two forms: activated and unactivated. When the transmission management device determines that the integrity protection requirement information is not needed and the encryption requirement information is not needed, the transmission management device does not need to parse the user plane encryption protection information, that is, regardless of whether the user plane encryption activation information is activated or unactivated, the transmission management device can directly determine whether the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS match.

[0130] In another possible implementation, when the integrity protection requirement information indicates that the PDU session is not integrity protected, the encryption requirement information indicates that the PDU session is encrypted, and the user encryption activation information indicates that EPS has activated user plane encryption, the user plane security execution information of the PDU session and the user plane encryption protection information of EPS match.

[0131] For example: the integrity protection requirement information includes three forms: required, preferred and not needed. Required means that the PDU session needs to be integrity protected, preferred means that the PDU session is given priority to be integrity protected, and not needed means that the PDU session does not need integrity protection. The integrity protection requirement information can be represented by bits, and different bit values ​​correspond to different integrity protection requirement information. The encryption protection requirement information includes three forms: required, preferred and not needed. Required means that the PDU session needs to be encrypted, preferred means that the PDU session is given priority to be encrypted, and not needed means that the PDU session does not need to be encrypted. The encryption requirement information can be represented by bits, and different bit values ​​are used to represent different encryption requirement information. The user plane encryption activation information includes two forms: activated and unactivated. When the transmission management device determines that the integrity protection requirement information is not needed, the encryption requirement information is required, and the user plane encryption activation information is activated, the transmission management device determines that the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS match.

[0132] In yet another possible implementation, the user plane security execution information of the PDU session includes: integrity protection requirement information;

[0133] When the integrity requirement information indicates that the PDU session is integrity protected, the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS do not match.

[0134] For example: the integrity protection requirement information includes three forms: required, preferred and not needed. Required means that the PDU session needs to be integrity protected, preferred means that the PDU session is given priority to be integrity protected, and not needed means that the PDU session does not need integrity protection. The integrity protection requirement information can be represented by bits, and different bit values ​​correspond to different integrity protection requirement information. The encryption protection requirement information includes three forms: required, preferred and not needed. Required means that the PDU session needs to be encrypted, preferred means that the PDU session is given priority to be encrypted, and not needed means that the PDU session does not need to be encrypted. The encryption requirement information can be represented by bits, and different bit values ​​are used to represent different encryption requirement information. The user plane encryption activation information includes two forms: activated and unactivated. Since the user plane of EPS does not support integrity protection, when the integrity protection requirement information is required, the transmission management device does not need to parse the encryption protection requirement information and the user plane encryption activation information, and can directly determine that the user plane security execution information of the PDU session and the user plane encryption protection information of EPS do not match.

[0135] S203: The transmission management device sends EBI allocation request information to the access management device, and the access management device receives the EBI allocation request information from the transmission management device.

[0136] Specifically, when the transmission management device determines that the user plane security execution information of the PDU session matches the user plane encryption protection information of the EPS, the transmission management device sends an EBI allocation request message to the access management device. The EBI allocation request message carries the PDU session identifier, which indicates the identity identifier of the PDU session. The access management device receives the EBI allocation request message sent by the transmission management device. When the access management device determines that there is an available EBI in the EPS, the available EBI is allocated to the EPS bearer; when there is no available EBI in the EPS, the access management device initiates an EBI release process, releases the previously allocated EBI, and then allocates the EBI to the EPS bearer. The access management device sends an EBI allocation response to the SMF+PGW-C. If the EBI is successfully allocated to the EPS bearer, the EBI allocation response carries the allocated EBI; if the EBI is not successfully allocated to the EPS, the EBI allocation response carries the reason value for the allocation failure. The access management device can be the AMF in the 5GS.

[0137] Among them, in this embodiment, the judgment condition for the transmission management device to send the EBI allocation request information to the access management device is not limited to the judgment condition described in S201, but may also include one or more other judgment conditions, for example: the other judgment condition is that the data network name (data network name, DNN) of the PDU session is the local data network (local area data network, LADN), that is, the user plane security execution information of the PDU session and the user plane security protection information of the EPS are matched, and the DNN of the PDU session is LADN, the transmission management device will send the EBI allocation request information to the access management device.

[0138] In one possible implementation, when the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS do not match, the transmission management device does not send an EBI allocation request to the access management device, that is, the transmission management device sends an EBI allocation request to the access management device only when the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS match, thereby avoiding the situation where the user plane security capability of the EPS does not meet the requirements of the PDU session, resulting in waste of EBI resources and overhead of the signaling process.

[0139] See also Figure 3 , Figure 3 is another flow chart of an EBI allocation method provided by an embodiment of the present invention. In the embodiment of the present invention, the method includes:

[0140] S301. The access management device receives EBI allocation request information sent from the transmission management device. The access management device receives EBI allocation request information sent from the transmission management device.

[0141] Specifically, the access management device is used to manage the access and mobility of UE in 5GS, and the access management device may be AMF. The transmission management device is used to manage PDU sessions in 5GS, and manage PDN connections in EPS, including being responsible for the establishment, modification and deletion of PDU sessions, and the establishment, modification and deletion of PDN connections. The transmission management device may be composed of two devices, SMF and PGW-C, or may be a device having the functions of SMF and PGW-C. The access management device may be AMF in 5GS. In the case where it is necessary to allocate EBI for the EPS bearer mapped by QoS Flow in EPS, the transmission management device sends EBI allocation request information to the access management device. The EBI allocation request information carries the PDU session identifier, which is the identity identifier of the PDU session. The PDU session includes the QoS Flow, and the PDU session supports migration to EPS. After receiving the EBI allocation request information from the transmission management device, the access management device determines that it is necessary to allocate EBI for the EPS bearer. The access management device determines whether there is an available EBI in the EPS. If so, S302 is executed. If there is no available EBI in the EPS, the access management device initiates an EBI release process to release the previously allocated EBI. When there is an available EBI in the EPS, S302 is executed.

[0142] S302: The access management device determines whether the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS match.

[0143] Specifically, the access management device obtains the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS. The match between the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS indicates that the user plane security capability of the EPS meets the security requirements of the PDU session.

[0144] In a possible implementation, the access management device obtains the user plane security execution information of the PDU session, including: the access management device pre-stores or pre-configures a mapping relationship between the PDU session identifier and the user plane security execution information, and the AMF determines the corresponding user plane security execution information according to the PDU session identifier in the EBI allocation request; or the AMF obtains the user plane security execution information corresponding to the PDU session identifier from the PCF; or the AMF obtains the user plane security execution information corresponding to the PDU session identifier from the SMF.

[0145] In a possible implementation manner, the access management device obtains the user plane encryption protection information of the EPS, including: the access management device pre-stores or pre-configures the user plane encryption protection information of the EPS; or the access management device receives the user plane encryption protection information of the EPS sent from the MME.

[0146] Among them, the access management device determines whether the user plane security execution information of the PDU session matches the user plane encryption protection information of the EPS. The essence of this is whether the user plane security capability of the EPS can meet the user plane security requirements of the PDU session. If the user plane security execution information of the PDU session matches the user plane encryption protection information of the EPS, it means that the user plane security capability of the EPS meets the user plane security requirements of the PDU session; if the user plane security execution information of the PDU session does not match the user plane encryption protection information of the EPS, it means that the user plane security capability of the EPS does not meet the user plane security requirements of the PDU session.

[0147] In a possible implementation manner, the user plane security execution information of the PDU session includes integrity protection requirement information and encryption requirement information, and the user plane encryption protection information of the EPS includes: user plane encryption activation information.

[0148] When the user plane security requirement information of the PDU session indicates that the PDU session is not integrity protected, and the user plane encryption protection information of the EPS indicates that the EPS has activated user plane encryption, the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS match.

[0149] For example: the integrity protection requirement information includes three forms: required, preferred and not needed. Required means that the PDU session needs to be integrity protected, preferred means that the PDU session is given priority to be integrity protected, and not needed means that the PDU session does not need integrity protection. The integrity protection requirement information can be represented by bits, and different bit values ​​correspond to different integrity protection requirement information. The encryption protection requirement information includes three forms: required, preferred and not needed. Required means that the PDU session needs to be encrypted, preferred means that the PDU session is given priority to be encrypted, and not needed means that the PDU session does not need to be encrypted. The encryption requirement information can be represented by bits, and different bit values ​​are used to represent different encryption requirement information. The user plane encryption activation information includes two forms: activated and unactivated. When the transmission management device determines that the integrity protection requirement information is not needed and the encryption requirement information is not needed, the transmission management device does not need to parse the user plane encryption protection information, that is, regardless of whether the user plane encryption activation information is activated or unactivated, the transmission management device can directly determine whether the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS match.

[0150] In another possible implementation, when the integrity protection requirement information indicates that the PDU session is not integrity protected, the encryption requirement information indicates that the PDU session is encrypted, and the user encryption activation information indicates that EPS has activated user plane encryption, the user plane security execution information of the PDU session and the user plane encryption protection information of EPS match.

[0151] For example: the integrity protection requirement information includes three forms: required, preferred and not needed. Required means that the PDU session needs to be integrity protected, preferred means that the PDU session is given priority to be integrity protected, and not needed means that the PDU session does not need integrity protection. The integrity protection requirement information can be represented by bits, and different bit values ​​correspond to different integrity protection requirement information. The encryption protection requirement information includes three forms: required, preferred and not needed. Required means that the PDU session needs to be encrypted, preferred means that the PDU session is given priority to be encrypted, and not needed means that the PDU session does not need to be encrypted. The encryption requirement information can be represented by bits, and different bit values ​​are used to represent different encryption requirement information. The user plane encryption activation information includes two forms: activated and unactivated. When the transmission management device determines that the integrity protection requirement information is not needed, the encryption requirement information is required, and the user plane encryption activation information is activated, the transmission management device determines that the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS match.

[0152] In yet another possible implementation, the user plane security execution information of the PDU session includes: integrity protection requirement information;

[0153] When the integrity requirement information indicates that the PDU session is integrity protected, the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS do not match.

[0154] For example: the integrity protection requirement information includes three forms: required, preferred and not needed. Required means that the PDU session needs to be integrity protected, preferred means that the PDU session is given priority to be integrity protected, and not needed means that the PDU session does not need integrity protection. The integrity protection requirement information can be represented by bits, and different bit values ​​correspond to different integrity protection requirement information. The encryption protection requirement information includes three forms: required, preferred and not needed. Required means that the PDU session needs to be encrypted, preferred means that the PDU session is given priority to be encrypted, and not needed means that the PDU session does not need to be encrypted. The encryption requirement information can be represented by bits, and different bit values ​​are used to represent different encryption requirement information. The user plane encryption activation information includes two forms: activated and unactivated. Since the user plane of EPS does not support integrity protection, when the integrity protection requirement information is required, the transmission management device does not need to parse the encryption protection requirement information and the user plane encryption activation information, and can directly determine that the user plane security execution information of the PDU session and the user plane encryption protection information of EPS do not match.

[0155] S303: The access management device sends EBI allocation response information to the transmission management device, and the access management device receives the EBI allocation response information from the transmission management device.

[0156] Specifically, when the user plane security execution information of the PDU session matches the user plane encryption protection information of the EPS, the access management device allocates an EBI for the EPS bearer, and the access management device sends an EBI allocation response to the SMF+PGW-C, and the EBI allocation response carries the EBI allocated for the EPS bearer.

[0157] In one possible implementation, when the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS do not match, the access management device does not allocate EBI for the EPS bearer, and the access management device sends an EBI allocation response to the transmission management device. The EBI allocation response information carries a reason value for the allocation failure, which indicates that the user plane security requirements of the PDU session are not met.

[0158] Among them, in this embodiment, the judgment condition for the access management device to send the EBI allocation response information carrying the allocated EBI to the transmission management device is not limited to only including the judgment condition described in S302, but may also include one or more other judgment conditions, for example: the other judgment condition is that the data network name (data network name, DNN) of the PDU session is the local data network (local area data network, LADN), that is, the user plane security execution information of the PDU session and the user plane security protection information of the EPS are matched, and the DNN of the PDU session is LADN, the access management device will send the EBI allocation response information carrying the allocated EBI to the transmission management device.

[0159] In implementing an embodiment of the present invention, when the access management device receives EBI allocation request information, the access management device will allocate EBI to the EPS bearer mapped by QoSFlow in EPS only when the user plane security execution information of the PDU session and the user plane encryption protection information of EPS match, thereby avoiding allocating EBI that does not meet the user plane security requirements to the EPS bearer.

[0160] See also Figure 4 , Figure 4 : is a flow chart of an EBI release method provided by an embodiment of the present invention. In the embodiment of the present invention, the method includes:

[0161] S401. The access management device obtains user plane security execution information of the PDU session and user plane encryption protection information of the EPS.

[0162] Specifically, the access management device is used to manage the access and mobility of the UE in the 5GS, and the access management device may be an AMF. Figure 1E The method for allocating EBI is to allocate EBI to the EPS bearer mapped by Qos Flow in EPS, and then the access management device obtains the user plane security execution information of the PDU session and obtains the user plane encryption protection information of EPS. The access management device can be the AMF in 5GS.

[0163] In a possible implementation, the access management device obtains the user plane security execution information of the PDU session, including: the access management device pre-stores or pre-configures a mapping relationship between the PDU session identifier and the user plane security execution information, and the access management device determines the corresponding user plane security execution information according to the PDU session identifier in the EBI allocation request; or the access management device obtains the user plane security execution information corresponding to the PDU session identifier from the PCF.

[0164] In a possible implementation manner, the access management device obtains the user plane encryption protection information of the EPS, including: the access management device pre-stores or pre-configures the user plane encryption protection information of the EPS; or the access management device receives the user plane encryption protection information of the EPS sent from the MME.

[0165] S402: The access management device determines that the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS do not match.

[0166] Specifically, the access management device determines whether the user plane security execution information of the PDU session matches the user plane encryption protection information of the EPS. The essence of this is whether the user plane security capability of the EPS can meet the user plane security requirements of the PDU session. If the user plane security execution information of the PDU session matches the user plane encryption protection information of the EPS, it means that the user plane security capability of the EPS meets the user plane security requirements of the PDU session; if the user plane security execution information of the PDU session does not match the user plane encryption protection information of the EPS, it means that the user plane security capability of the EPS does not meet the user plane security requirements of the PDU session.

[0167] In a possible implementation manner, the user plane security execution information of the PDU session includes integrity protection requirement information and encryption requirement information, and the user plane encryption protection information of the EPS includes: user plane encryption activation information.

[0168] When the user plane security requirement information of the PDU session indicates that the PDU session is not integrity protected, and the user plane encryption protection information of the EPS indicates that the EPS has activated user plane encryption, the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS match.

[0169] For example: the integrity protection requirement information includes three forms: required, preferred and not needed. Required means that the PDU session needs to be integrity protected, preferred means that the PDU session is given priority to be integrity protected, and not needed means that the PDU session does not need integrity protection. The integrity protection requirement information can be represented by bits, and different bit values ​​correspond to different integrity protection requirement information. The encryption protection requirement information includes three forms: required, preferred and not needed. Required means that the PDU session needs to be encrypted, preferred means that the PDU session is given priority to be encrypted, and not needed means that the PDU session does not need to be encrypted. The encryption requirement information can be represented by bits, and different bit values ​​are used to represent different encryption requirement information. The user plane encryption activation information includes two forms: activated and unactivated. When the transmission management device determines that the integrity protection requirement information is not needed and the encryption requirement information is not needed, the transmission management device does not need to parse the user plane encryption protection information, that is, regardless of whether the user plane encryption activation information is activated or unactivated, the transmission management device can directly determine whether the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS match.

[0170] In another possible implementation, when the integrity protection requirement information indicates that the PDU session is not integrity protected, the encryption requirement information indicates that the PDU session is encrypted, and the user encryption activation information indicates that EPS has activated user plane encryption, the user plane security execution information of the PDU session and the user plane encryption protection information of EPS match.

[0171] For example: the integrity protection requirement information includes three forms: required, preferred and not needed. Required means that the PDU session needs to be integrity protected, preferred means that the PDU session is given priority to be integrity protected, and not needed means that the PDU session does not need integrity protection. The integrity protection requirement information can be represented by bits, and different bit values ​​correspond to different integrity protection requirement information. The encryption protection requirement information includes three forms: required, preferred and not needed. Required means that the PDU session needs to be encrypted, preferred means that the PDU session is given priority to be encrypted, and not needed means that the PDU session does not need to be encrypted. The encryption requirement information can be represented by bits, and different bit values ​​are used to represent different encryption requirement information. The user plane encryption activation information includes two forms: activated and unactivated. When the transmission management device determines that the integrity protection requirement information is not needed, the encryption requirement information is required, and the user plane encryption activation information is activated, the transmission management device determines that the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS match.

[0172] In yet another possible implementation, the user plane security execution information of the PDU session includes: integrity protection requirement information;

[0173] When the integrity requirement information indicates that the PDU session is integrity protected, the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS do not match.

[0174] For example: the integrity protection requirement information includes three forms: required, preferred and not needed. Required means that the PDU session needs to be integrity protected, preferred means that the PDU session is given priority to be integrity protected, and not needed means that the PDU session does not need integrity protection. The integrity protection requirement information can be represented by bits, and different bit values ​​correspond to different integrity protection requirement information. The encryption protection requirement information includes three forms: required, preferred and not needed. Required means that the PDU session needs to be encrypted, preferred means that the PDU session is given priority to be encrypted, and not needed means that the PDU session does not need to be encrypted. The encryption requirement information can be represented by bits, and different bit values ​​are used to represent different encryption requirement information. The user plane encryption activation information includes two forms: activated and unactivated. Since the user plane of EPS does not support integrity protection, when the integrity protection requirement information is required, the transmission management device does not need to parse the encryption protection requirement information and the user plane encryption activation information, and can directly determine that the user plane security execution information of the PDU session and the user plane encryption protection information of EPS do not match.

[0175] S403: The access management device sends EBI release request information to the transmission management device, and the transmission management device receives the EBI release request information from the access management device.

[0176] Specifically, the transmission management device is used to manage the PDU session in 5GS and the PDN connection in EPS, including the establishment, modification and deletion of PDU sessions and the establishment, modification and deletion of PDN connections. The transmission management device can be composed of two devices, SMF and PGW-C, or a device with the functions of SMF and PGW-C. In the case that the user plane encryption execution information of the PDU session and the user plane encryption protection information of EPS do not match, the access management device determines that the EBI previously allocated to the EPS bearer needs to be released. The access management device sends an EBI release request message to the transmission management device corresponding to the ESP bearer. The EBI release request message carries the EBI to be released and the release reason value. The release reason value indicates that the user plane security requirements of the PDU session are not met.

[0177] In implementing an embodiment of the present invention, the access management device, when having allocated EBI for EPS mapped in EPS for QoS Flow, determines whether the user plane security execution information of the PDU session and the user plane encryption protection information of EPS match. If they do not match, the EBI previously allocated to EPS is released to prevent the EPS bearer from using EBI that does not meet the user plane security requirements when the UE moves from 5GS to EPS.

[0178] The method of the embodiment of the present invention is described in detail above, and the device of the embodiment of the present invention is provided below.

[0179] See also Figure 5 , Figure 5 is a schematic diagram of the structure of a device provided by an embodiment of the present invention. The device 5 may include a processing unit 501 and a transceiver unit 502.

[0180] Embodiment 1: The processing unit 501 is used to determine whether the user plane security execution information of the PDU session matches the user plane encryption protection information of the EPS. Figure 2 S201 in.

[0181] The transceiver unit 502 is configured to send an EBI allocation request message to the access management device when the judgment result of the processing unit is yes, wherein the EBI allocation request message is used to request to allocate an EBI for the EPS bearer mapped by the QoS Flow in the EPS, and the PDU session includes at least one QoS Flow. Figure 2 S202 in.

[0182] In a possible implementation manner, the user plane security execution information of the PDU session includes: integrity protection requirement information and encryption requirement information, and the user plane encryption protection information of the EPS includes: user plane encryption activation information;

[0183] The integrity protection requirement information indicates that the PDU session is not integrity protected, the encryption requirement information indicates that the PDU session is not encrypted, and the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS match; or

[0184] The integrity protection requirement information indicates that the PDU session is not integrity protected, the encryption requirement information indicates that the PDU session is encrypted, the user plane encryption activation information indicates that the user plane encryption of the EPS is activated, and the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS match.

[0185] In a possible implementation manner, the user plane security execution information of the PDU session includes integrity protection requirement information and encryption requirement information, and the user plane encryption protection information of the EPS includes user plane encryption activation information;

[0186] The integrity protection requirement information indicates that integrity protection is performed, and the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS do not match.

[0187] In a possible implementation, the processing unit 501 is further configured to, when the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS do not match, the transmission management device does not send an EBI allocation request to the access management device.

[0188] The device 5 may be a transmission management device, for example, the transmission management device is composed of two devices, SMF and PGW-C, or may be a device having the functions of SMF and PGW-C. The device 5 may also be a field-programmable gate array (FPGA), a dedicated integrated chip, a system on chip (SoC), a central processor unit (CPU), a network processor (NP), a digital signal processing circuit, a microcontroller unit (MCU), a programmable logic device (PLD) or other integrated chips that implement relevant functions.

[0189] Embodiments of the present invention and Figure 2 The method embodiments are based on the same concept, and the technical effects they bring are also the same. The specific process can be referred to Figure 2 The description of the method embodiment will not be repeated here.

[0190] Embodiment 2: The transceiver unit 502 is used to receive EBI allocation request information from the transmission management device; wherein the EBI allocation request is used to request the allocation of EBI for the EPS bearer mapped in the EPS by the QoS Flow; for example: the transceiver unit 502 is used to perform Figure 3 S301 in.

[0191] Processing unit 501 is used to determine whether the user plane security execution information of the PDU session where the Qos Flow is located matches the user plane encryption protection information of the EPS; for example: processing unit 501 is used to execute Figure 3 S302 in.

[0192] The transceiver unit 502 is further configured to send an EBI allocation response message to the transmission management device when the judgment result of the processing unit is yes; wherein the EBI allocation response message carries the EBI allocated by the EPS bearer. Figure 3 S303 in.

[0193] In a possible implementation manner, the user plane security execution information of the PDU session includes: integrity protection requirement information and encryption requirement information, and the user plane encryption protection information of the EPS includes: user plane encryption activation information;

[0194] The integrity protection requirement information indicates that integrity protection is not performed, the encryption requirement information indicates that encryption is not performed, and the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS match; or

[0195] The integrity protection requirement information indicates that integrity protection is not performed, the encryption requirement information indicates that encryption is performed, the user plane encryption capability information indicates that user plane encryption is supported, and the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS match.

[0196] In one possible implementation, the user plane security execution information of the PDU session includes: integrity protection requirement information and encryption requirement information, and the user plane encryption protection information of the EPS includes: user plane encryption activation information; the integrity protection requirement information indicates that the PDU session is integrity protected, and the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS do not match.

[0197] In a possible implementation manner, the transceiver unit 502 is further configured to send EBI allocation response information to the transmission management device when the judgment result of the processing unit 501 is no, and the EBI allocation response information carries the reason information of the EBI allocation failure.

[0198] In a possible implementation, the transceiver unit 502 is further configured to receive the PDU session identifier and user plane security execution information corresponding to the PDU session identifier from the transmission management device during the establishment or modification process of the PDU session.

[0199] The device 5 may be an access management device, for example, the access management device may be the AMF in the 5GS. The device 5 may also be a field-programmable gate array (FPGA), a dedicated integrated chip, a system on chip (SoC), a central processor unit (CPU), a network processor (NP), a digital signal processing circuit, a microcontroller unit (MCU), or a programmable logic device (PLD) or other integrated chips that implement relevant functions.

[0200] Embodiments of the present invention and Figure 3 The method embodiments are based on the same concept, and the technical effects they bring are also the same. The specific process can be referred to Figure 3 The description of the method embodiment will not be repeated here.

[0201] Embodiment 3: Processing unit 501 is used to obtain user plane security execution information of a PDU session; wherein the PDU session includes at least one QoS Flow, the QoS Flow is associated with an EPS bearer, and the EPS bearer has been allocated with an EBI; for example: processing unit 501 is used to execute Figure 4 S401 in.

[0202] The processing unit 501 is further configured to determine whether the user plane security execution information of the PDU session matches the pre-stored or pre-configured user plane encryption protection information of the EPS; for example: the processing unit 501 is configured to execute Figure 4 S402 in.

[0203] The transceiver unit 502 is configured to send an EBI release request to the transmission management device serving the EPS bearer when the judgment result of the processing unit is no, wherein the EBI release request is used to indicate that the EBI of the EPS bearer needs to be released. Figure 4 S403 in.

[0204] In a possible implementation manner, the user plane security execution information of the PDU session includes: integrity protection requirement information and encryption requirement information, and the user plane encryption protection information of the EPS includes: user plane encryption capability information;

[0205] The integrity protection requirement information indicates that integrity protection is performed, and the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS do not match.

[0206] In a possible implementation, the user plane security execution information of the PDU session includes integrity protection requirement information and encryption requirement information, and the user plane encryption protection information of the EPS includes: user plane encryption activation information;

[0207] The integrity protection requirement information indicates that the PDU session is not integrity protected, the encryption requirement information indicates that the PDU session is not encrypted, and the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS match; or

[0208] The integrity protection requirement information indicates that integrity protection is not performed, the encryption requirement information indicates that the PDU session is encrypted, the user plane encryption capability information indicates that user plane encryption is supported, and the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS match.

[0209] In a possible implementation, the processing unit 501 is further configured to not release the EBI carried by the EPS when the user plane security execution information of the PDU session matches the user plane encryption protection information of the EPS.

[0210] In a possible implementation, the transceiver unit 502 is further configured to receive the PDU session identifier and user plane security execution information corresponding to the PDU session identifier from the transmission management device during the establishment or modification process of the PDU session.

[0211] In a possible implementation manner, the user plane encryption protection information of the EPS comes from a mobility management entity MME, and the MME is the MME to which the PDU session is to be migrated.

[0212] The device 5 may be an access management device, for example, the access management device may be the AMF in the 5GS. The device 5 may also be a field-programmable gate array (FPGA), a dedicated integrated chip, a system on chip (SoC), a central processor unit (CPU), a network processor (NP), a digital signal processing circuit, a microcontroller unit (MCU), or a programmable logic device (PLD) or other integrated chips that implement relevant functions.

[0213] Embodiments of the present invention and Figure 4The method embodiments are based on the same concept, and the technical effects they bring are also the same. The specific process can be referred to Figure 4 The description of the method embodiment will not be repeated here.

[0214] Figure 6 A schematic diagram of a device structure provided in an embodiment of the present invention, hereinafter referred to as device 6, can be integrated into the aforementioned transmission management device or access management device, such as Figure 6 As shown, the device includes: a memory 602 , a processor 601 , and a transceiver 603 .

[0215] The memory 602 may be an independent physical unit, and may be connected to the processor 601 and the transceiver 603 via a bus. The memory 602, the processor 601, and the transceiver 603 may also be integrated together and implemented via hardware.

[0216] The memory 602 is used to store programs for implementing the above method embodiments or various modules of the device embodiments, and the processor 601 calls the program to execute the operations of the above method embodiments.

[0217] Optionally, when part or all of the method for allocating EBI in the above embodiment is implemented by software, the device 6 may also only include a processor. The memory for storing programs is located outside the device 6, and the processor 601 is connected to the memory through circuits / wires to read and execute the programs stored in the memory.

[0218] The processor may be a central processing unit (CPU), a network processor (NP), or a combination of a CPU and a NP.

[0219] The processor may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof. The PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof.

[0220] The memory may include volatile memory, such as random-access memory (RAM); the memory may also include non-volatile memory, such as flash memory, hard disk drive (HDD) or solid-state drive (SSD); the memory may also include a combination of the above types of memory.

[0221] In the above embodiments, the sending module or transmitter performs the sending steps of the above methods, the receiving module or receiver performs the receiving steps of the above methods, and other steps are performed by other modules or processors. The sending module and the receiving module can form a transceiver module, and the receiver and the transmitter can form a transceiver.

[0222] An embodiment of the present application further provides a computer storage medium storing a computer program, wherein the computer program is used to execute the method for allocating EBI provided in the above embodiment.

[0223] The embodiment of the present application also provides a computer program product including instructions, which, when executed on a computer, enables the computer to execute the allocation of EBI provided in the above embodiment.

[0224] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0225] The present application is described with reference to the flowchart and / or block diagram of the method, device (system) and computer program product according to the embodiment of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, and the combination of the process and / or box in the flowchart and / or block diagram can be realized by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for realizing the function specified in one process or multiple processes in the flowchart and / or one box or multiple boxes in the block diagram.

[0226] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0227] These computer program instructions may also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

Claims

1. A method for allocating an Evolved Packet System Bearer Identifier (EBI), characterized in that: include: The transmission management device obtains user plane security execution information of a packet data unit PDU session; During the creation process of the service quality flow in the PDU session, the transmission management device determines whether to send EBI allocation request information to the access management device based on the user plane security execution information of the PDU session, and the EBI allocation request information is used to request the allocation of EBI for the bearer mapped in the evolved packet system EPS for the service quality flow.

2. The method according to claim 1, characterized in that The transmission management device obtains user plane security execution information of the PDU session, including: The transmission management device pre-stores or pre-configures a correspondence between the PDU session identifier and the user plane security execution information.

3. The method according to claim 1, characterized in that The transmission management device obtains user plane security execution information of the PDU session, including: During the creation of the quality of service flow in the PDU session, the transmission management device obtains a user plane security policy from a unified data management (UDM), wherein the user plane security policy includes user plane security execution information of the PDU session.

4. The method according to any one of claims 1 to 3, characterized in that: The user plane security execution information of the PDU session includes: integrity protection requirement information, The transmission management device determines whether to send EBI allocation request information to the access management device according to the user plane security execution information of the PDU session, including: When the integrity protection requirement information indicates that the PDU session requires user plane integrity protection, the transmission management device does not send the EBI allocation request information to the access management device.

5. The method according to any one of claims 1 to 3, characterized in that: The user plane security execution information of the PDU session includes: integrity protection requirement information and encryption requirement information, The transmission management device determines whether to send EBI allocation request information to the access management device according to the user plane security execution information of the PDU session, including: When the integrity protection requirement information indicates that the PDU session is not integrity protected by the user plane and the encryption requirement information indicates that the PDU session does not require user plane encryption, the transmission management device sends the EBI allocation request information to the access management device.

6. The method according to any one of claims 1 to 3, characterized in that: The user plane security execution information of the PDU session includes: integrity protection requirement information and encryption requirement information, and the method further includes: The transmission management device obtains user plane encryption protection information of the EPS, where the user plane encryption protection information of the EPS includes user plane encryption activation information; The transmission management device determines whether to send EBI allocation request information to the access management device according to the user plane security execution information of the PDU session, including: When the integrity protection requirement information indicates that the PDU session is not integrity protected, the encryption requirement information indicates that the PDU session is encrypted, and the user plane encryption activation information indicates that the user plane encryption of the EPS is activated, the transmission management device sends the EBI allocation request information to the access management device.

7. The method according to claim 5, characterized in that The method further comprises: The transmission management device receives the EBI allocation response message sent by the access management device, where the EBI allocation response message includes the EBI allocated by the access management device.

8. The method according to claim 6, characterized in that The method further comprises: The transmission management device receives the EBI allocation response message sent by the access management device, where the EBI allocation response message includes the EBI allocated by the access management device.

9. The method according to any one of claims 1 to 3, characterized in that: The quality of service flow includes a default quality of service flow, and the creation process of the quality of service flow in the PDU session includes a PDU session establishment process initiated by a user equipment; or The quality of service flow includes a guaranteed bit rate quality of service flow, and the creation process of the quality of service flow in the PDU session includes a PDU session modification process initiated by the user equipment or initiated by the network side.

10. The method according to any one of claims 1 to 3, characterized in that: The transmission management device is a session management function + control plane packet data network gateway SMF + PGW-C, and the access management device is an access and mobility management function AMF.

11. A transmission management device, characterized in that: include: a memory for storing computer program instructions; A processor is used to run the computer program instructions so that the transmission management device executes the method according to any one of claims 1 to 10.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, and when the computer program instructions are executed by a computer, the computer is caused to perform the method according to any one of claims 1 to 10.

13. A communication system, characterized in that: include: A transmission management device, configured to execute the method according to any one of claims 1 to 10; as well as The access management device is used to receive the evolved packet system bearer identifier EBI allocation request information sent by the transmission management device.

Images