Access method, system and network intercommunication functional entity for NSA users roaming to SA

Abstract

The present disclosure relates to an access method, system and network intercommunication functional entity for NSA users roaming to SA, and relates to the field of communication technology. The method of the present disclosure includes: the network intercommunication functional entity receives a user authentication request sent by AMF in SA, wherein the user authentication request is sent by AMF in response to the NSA user roaming to the SA coverage area and initiating an access request; the network intercommunication functional entity obtains a 4G authentication vector from the HSS of the NSA network to which the NSA user belongs; the network intercommunication functional entity converts the 4G authentication vector into a 5G authentication vector, and generates a user authentication response based on the 5G authentication vector and returns it to AMF, so that AMF and NSA users complete mutual authentication based on the authentication response; the network intercommunication functional entity receives an authentication proof request sent by AMF, wherein the authentication proof request includes: RES* generated by the NSA user during the mutual authentication process between AMF and NSA users; the network intercommunication functional entity authenticates the NSA user based on RES*, and returns the authentication result to AMF.

Description

Technical Field

[0001] The present disclosure relates to the field of communication technology, and in particular to an access method, system and network intercommunication functional entity for an NSA user to roam to an SA. Background Art

[0002] At present, the construction of domestic 5G networks has been fully launched, and the subsequent network coverage will be mainly based on SA (standalone networking), while foreign operators mostly deploy networks based on NSA (non-standalone networking). Therefore, in the early stage of 5G network international roaming services, especially in the process of domestic NSA roaming services, there are a large number of NSA users roaming to SA networks.

[0003] When an NSA roaming user accesses the SA network of the roaming area, the access network element needs to send a 5G SA-based service authentication to the home network through the service-oriented interface, and then access the NSA user after the authentication is passed. Summary of the invention

[0004] The inventors discovered that currently when NSA users roam to an SA network, the access network element sends an SA-based service authentication to the home network. If the home network is deployed with an NSA-based 5G core network, the signaling layer authentication fails, resulting in the authentication failing and the NSA user being unable to access.

[0005] A technical problem to be solved by the present disclosure is: how to achieve smooth authentication of NSA users when the NSA users roam to the SA network.

[0006] According to some embodiments of the present disclosure, a method for accessing a non-standalone network NSA user roaming to an independent network SA is provided, comprising: a network interoperability function entity receiving a user authentication request sent by an access and mobility management function entity AMF in SA, wherein the user authentication request is sent by AMF in response to an access request initiated by the NSA user roaming to an SA coverage area; the network interoperability function entity obtains a 4G authentication vector from an HSS, a home subscriber server of an NSA network to which the NSA user belongs; the network interoperability function entity converts the 4G authentication vector into a 5G authentication vector, and generates a user authentication response based on the 5G authentication vector and returns it to AMF, so that the AMF and the NSA user complete mutual authentication based on the authentication response; the network interoperability function entity receives an authentication proof request sent by AMF, wherein the authentication proof request includes: RES* generated by the NSA user during the mutual authentication process between the AMF and the NSA user; the network interoperability function entity authenticates the NSA user based on RES*, and returns the authentication result to AMF.

[0007] In some embodiments, the user authentication request is sent by AMF to the network interoperability function entity after AMF queries the network storage function entity NRF to find out that the authentication service function AUSF is a network interoperability function entity; wherein, NRF identifies that the NSA network to which the NSA user belongs only provides NSA roaming services based on the NSA user's number segment information, and determines that AUSF is the network interoperability function entity.

[0008] In some embodiments, the network interoperability function entity obtains a 4G authentication vector from a home subscriber server HSS of an NSA network to which an NSA user belongs, including: the network interoperability function entity sends an authentication information request message to the HSS of the NSA network to which the NSA user belongs, wherein the authentication information request message includes the IMSI of the NSA user; the network interoperability function entity receives an authentication information response message returned by the HSS, wherein the authentication information response message includes the 4G authentication vector corresponding to the NSA user; wherein the 4G authentication vector includes: RAND, AUTN, RES, CK and IK.

[0009] In some embodiments, the network interworking function entity converts the 4G authentication vector into a 5G authentication vector, and according to the 5G authentication vector includes: the network interworking function entity uses RAND and AUTN in the 4G authentication vector as RAND and AUTN in the 5G authentication vector, derives HXRES* in the 5G authentication vector according to RES, and derives K in the 5G authentication vector according to CK and IK SEAF .

[0010] In some embodiments, the AMF and the NSA user complete mutual authentication based on the authentication response, including: the AMF generates an authentication request based on the user authentication response and sends it to the NSA user, wherein the user authentication response includes RAND, AUTN and HXRES*, and the authentication request includes RAND and AUTN; the NSA user authenticates the AMF based on the authentication request and calculates RES*; the AMF receives the authentication response sent by the NSA user, wherein the authentication response includes RES*; the AMF determines HRES* based on RES*, and compares HRES* with HXRES*. If they are consistent, the authentication is successful.

[0011] In some embodiments, the network interoperability function entity authenticates the NSA user based on RES*, including: the network interoperability function entity queries whether the 5G authentication vector corresponding to the NSA user is within the validity period. If not, the authentication fails. If it is within the validity period, RES* is compared with XRES*. If they are consistent, the authentication is successful, otherwise the authentication fails, wherein XRES* is derived based on RES in the 4G authentication vector.

[0012] In some embodiments, the method also includes: when the NSA user is successfully authenticated, the network interoperability function entity receives a registration request sent by the AMF; the network interoperability function entity obtains the contract data of the NSA user from the HSS of the NSA network to which the NSA user belongs, and the contract data includes an identifier of whether the NSA user supports 5G roaming access; the network interoperability function entity converts the contract data of the NSA user into a format supported by the AMF, and sends the converted contract data to the AMF, so that the AMF determines whether the NSA user supports 5G roaming access based on the converted contract data, and accesses the NSA user if the NSA user supports 5G roaming access.

[0013] In some embodiments, the network interoperability function entity obtains the subscription data of an NSA user from the HSS of the NSA network to which the NSA user belongs, including: the network interoperability function entity sends an update location request ULR message to the HSS of the NSA network to which the NSA user belongs, the ULR message including: the IMSI of the NSA user; the network interoperability function entity receives an update location answer ULA message returned by the HSS, the ULA message including the subscription data of the NSA user obtained by searching based on the IMSI of the NSA user.

[0014] In some embodiments, the network interoperability function entity converts the contract data of the NSA user into a format supported by the AMF, and sends the converted contract data to the AMF, including: the network interoperability function entity caches the contract data of the NSA user and the IMSI of the NSA user in correspondence; the network interoperability function entity sends a registration success response message to the AMF; the network interoperability function entity receives a contract data acquisition message sent by the AMF, and the contract data acquisition message includes: the IMSI of the NSA user; the network interoperability function entity searches for the contract data of the NSA user according to the IMSI of the NSA user, converts the contract data of the NSA user into a format supported by the AMF, and sends the converted contract data to the AMF.

[0015] According to some other embodiments of the present disclosure, a network intercommunication functional entity is provided, including: a first receiving module, used to receive a user authentication request sent by an access and mobility management functional entity AMF in an independent network SA, wherein the user authentication request is sent by the AMF in response to an access request initiated by a non-independent network NSA user roaming to an SA coverage area; an acquisition module, used to obtain a 4G authentication vector from an HSS, a home subscriber server of an NSA network to which the NSA user belongs; a conversion module, used to convert the 4G authentication vector into a 5G authentication vector, and generate a user authentication response based on the 5G authentication vector and return it to the AMF, so that the AMF and the NSA user complete mutual authentication based on the authentication response. A second receiving module, used to receive an authentication proof request sent by the AMF, wherein the authentication proof request includes: RES* generated by the NSA user during the mutual authentication process between the AMF and the NSA user; an authentication module, used to authenticate the NSA user based on RES*, and return the authentication result to the AMF.

[0016] According to some other embodiments of the present disclosure, a network intercommunication functional entity is provided, including: a processor; and a memory coupled to the processor, for storing instructions, which, when executed by the processor, causes the processor to execute an access method for an NSA user roaming to an SA as in any of the aforementioned embodiments.

[0017] According to some further embodiments of the present disclosure, a non-transitory computer-readable storage medium is provided, on which a computer program is stored, wherein the program, when executed by a processor, implements the steps of any of the aforementioned method embodiments.

[0018] According to some other embodiments of the present disclosure, an access system for NSA users roaming to SA is provided, comprising: a network interoperability function entity of any of the aforementioned embodiments; and an AMF, used to send a user authentication request to the network interoperability function entity, receive a user authentication response sent by the network interoperability function entity, and complete mutual authentication with the NSA user based on the authentication response; send an authentication proof request to the network interoperability function entity, and receive an authentication result returned by the network interoperability function entity; a home subscriber server HSS, which is the HSS of the NSA network to which the NSA user belongs, and is used to send a 4G authentication vector to the network interoperability function entity.

[0019] In some embodiments, the system further includes: an NSA user, a network storage function entity NRF; the NSA user is used to initiate an access request to the AMF when roaming to the SA coverage area; the AMF is also used to receive the access request sent by the NSA user, query the NRF for the authentication service function AUSF as a network interoperability function entity, and then send a user authentication request to the network interoperability function entity. The NRF is used to identify that the NSA network to which the NSA user belongs only opens the NSA roaming service based on the number segment information of the NSA user, and determine that the AUSF is a network interoperability function entity.

[0020] In some embodiments, the HSS is used to receive an authentication information request message sent by a network interoperability function entity, wherein the authentication information request message includes the IMSI of the NSA user, generate a 4G authentication vector corresponding to the NSA user based on the IMSI of the NSA user, and send an authentication information response message to the network interoperability function entity, wherein the authentication information response message includes the 4G authentication vector corresponding to the NSA user; wherein the 4G authentication vector includes: RAND, AUTN, RES, CK and IK.

[0021] In some embodiments, the AMF is used to generate an authentication request based on the user authentication response and send it to the NSA user, wherein the user authentication response includes RAND, AUTN and HXRES*, and the authentication request includes RAND and AUTN; receive the authentication response sent by the NSA user, wherein the authentication response includes RES*; determine HRES* based on RES*, and compare HRES* with HXRES*. If they are consistent, the authentication is successful. The NSA user is used to authenticate the AMF based on the authentication request and calculate RES*.

[0022] In some embodiments, the AMF is also used to send a registration request to the network interoperability function entity when the NSA user authentication is successful; receive the converted contract data sent by the network interoperability function entity, determine whether the NSA user supports 5G roaming access based on the converted contract data, and access the NSA user when the NSA user supports 5G roaming access; the HSS is also used to send the contract data of the NSA user to the network interoperability function entity, the contract data including an identifier of whether the NSA user supports 5G roaming access.

[0023] In some embodiments, the HSS is used to receive an update location request ULR message sent by a network interoperability function entity, the ULR message including: the IMSI of the NSA user; searching for the contract data of the NSA user based on the IMSI of the NSA user, and sending an update location answer ULA message to the network interoperability function entity, the ULA message including the contract data of the NSA user obtained based on the IMSI of the NSA user.

[0024] In some embodiments, the AMF is also used to receive a registration success response message sent by a network interoperability function entity; send a contract data acquisition message to the network interoperability function entity, the contract data acquisition message includes: the IMSI of the NSA user, and receive the converted contract data sent by the network interoperability function entity.

[0025] The disclosed method realizes the access of the SA network in the roaming area to the NSA network in the home area by adding a new network intercommunication function entity, thereby solving the problem of cross-standard roaming service access authentication during service network deployment. It greatly improves the user's roaming experience when the 5G network standards at home and abroad are different and the network coverage of the same standard is insufficient; at the same time, it can also expand the service coverage while saving the cost of network upgrade construction. It can reduce the network transformation and equipment investment during 5G roaming inter-network intercommunication, and provide a solution for inter-network intercommunication in the transition stage.

[0026] Other features and advantages of the present disclosure will become apparent from the following detailed description of exemplary embodiments of the present disclosure with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0028] Figure 1 A flowchart of an access method for an NSA user roaming to an SA according to some embodiments of the present disclosure is shown.

[0029] Figure 2 A flowchart of an access method for an NSA user roaming to an SA according to some other embodiments of the present disclosure is shown.

[0030] Figure 3 A schematic diagram showing the structure of network intercommunication functional entities of some embodiments of the present disclosure.

[0031] Figure 4 A schematic diagram showing the structure of network intercommunication functional entities according to other embodiments of the present disclosure.

[0032] Figure 5 A schematic diagram showing the structure of network intercommunication functional entities according to some further embodiments of the present disclosure.

[0033] Figure 6 A schematic diagram showing the structure of an access system for an NSA user roaming to an SA according to some further embodiments of the present disclosure. DETAILED DESCRIPTION

[0034] The technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all of the embodiments. The following description of at least one exemplary embodiment is actually only illustrative and is by no means intended to limit the present disclosure and its application or use. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure.

[0035] The present disclosure provides an access method for NSA users to roam to SA. Figures 1-2 Give a description.

[0036] Figure 1 The following is a flow chart of some embodiments of the access method of the NSA user roaming to the SA disclosed in the present invention. Figure 1 As shown, the method of this embodiment includes: steps S102 to S112.

[0037] In step S102, the network interworking function entity receives a user authentication request sent by the AMF (Access and Mobility Management Function) in the SA.

[0038] The network interworking function entity can be called Network Interworking Function (NIWF), which can be set up in the international bureau to realize the international network interworking function, internally complete the home AUSF (Authentication Server Function) and UDM (Unified Data Management) for roaming SA access, and externally complete the roaming SGSN (Serving GPRS Support Node) and MME (Mobility Management Entity) functions for home database access. Through the conversion and adaptation of signaling functions, the service access authentication function of NSA users after roaming into the SA network is completed.

[0039] The user authentication request is sent by AMF to the network interoperability function entity after AMF queries NRF (NF Repository Function) to determine whether AUSF is a network interoperability function entity in response to an access request initiated by an NSA user roaming to an SA coverage area. NRF identifies the NSA network to which the NSA user belongs based on the number segment information of the NSA user and only opens NSA roaming services. It determines that AUSF is a network interoperability function entity. The user authentication request is, for example, Nudm_UECM_Registration, including: SUCI (Subscription Concealed Identifier) ​​or SUPI (Subscription Permanent Identifier). This signaling is the signaling in the existing 5G standard, and you can refer to the existing technology and will not go into details here.

[0040] In step S104, the network interworking function entity obtains a 4G authentication vector from an HSS (Home Subscriber Server) of the NSA network to which the NSA user belongs.

[0041] In some embodiments, the network interoperability function entity sends an authentication information request message to the HSS of the NSA network to which the NSA user belongs, wherein the authentication information request message includes the IMSI of the NSA user; the network interoperability function entity receives an authentication information response message returned by the HSS, wherein the authentication information response message includes the 4G authentication vector corresponding to the NSA user. The 4G authentication vector (Authentication Vector, AV) includes, for example: RAND (random number), AUTN (authentication value), RES, CK and IK. The authentication information request message is, for example, MAP_Send_Authentication_Info, and the authentication information response message is, for example, MAP_Send_Authentication_Info_Ack. The generation process of the 4G authentication vector can refer to the prior art and will not be repeated here. After receiving the user authentication request from the AMF, the network interoperability function entity converts the user authentication request into an authentication information request message and sends it to the HSS to request a 4G authentication vector.

[0042] In step S106, the network interworking function entity converts the 4G authentication vector into a 5G authentication vector, and generates a user authentication response based on the 5G authentication vector and returns it to the AMF.

[0043] In some embodiments, the network interworking function entity uses RAND and AUTN in the 4G authentication vector as RAND and AUTN in the 5G authentication vector, derives HXRES* in the 5G authentication vector based on RES, and derives K in the 5G authentication vector based on CK and IK. SEAF Specific HXRES* and K SEAF The derivation process of can refer to the prior art, and will not be repeated here. The user authentication response is, for example, Nausf_UEAuthentication_Authenticate_Response, including RAND, AUTN and HXRES*

[0044] In step S108, the AMF and the NSA user complete mutual authentication based on the authentication response.

[0045] In some embodiments, AMF generates an authentication request based on the user authentication response and sends it to the NSA user, where the authentication request includes RAND and AUTN; the NSA user authenticates the AMF based on the authentication request and calculates RES*; AMF receives the authentication response sent by the NSA user, where the authentication response includes RES*; AMF determines HRES* based on RES* and compares HRES* with HXRES*. If they are consistent, the authentication is successful.

[0046] The authentication request is, for example, Authentication Request. The user card (e.g., USIM card) of the NSA user verifies AUTH, MAC, and returns RES, CK, and IK to the terminal. The terminal calculates RES* based on RES, and generates an authentication response and returns it to AMF. The authentication response is, for example, Authentication Response. AMF calculates HRES* based on RES*, and compares HRES* with HXRES*. If they are consistent, the authentication is successful, otherwise the authentication fails. The mutual authentication process between AMF and NSA users can refer to the prior art.

[0047] In step S110, the network interworking function entity receives the authentication request sent by the AMF.

[0048] The authentication proof request is, for example, Nausf_UEAuthentication_Authenticate_Request, which includes: RES* generated by the NSA user during the mutual authentication process between the AMF and the NSA user, and may also include the SUCI or SUPI of the NSA user.

[0049] In step S112, the network interworking function entity authenticates the NSA user according to RES* and returns the authentication result to the AMF.

[0050] In some embodiments, the network intercommunication function entity queries whether the 5G authentication vector corresponding to the NSA user is within the validity period. If not, the authentication fails. If it is within the validity period, RES* is compared with XRES*. If they are consistent, the authentication is successful, otherwise the authentication fails, where XRES* is derived based on the RES in the 4G authentication vector.

[0051] The network interoperability function entity may calculate XRES* in step S106 according to the process of converting the 4G authentication vector into the 5G authentication vector. The specific calculation method may refer to the existing standard. The network interoperability function entity saves XRES* and saves the validity period corresponding to the 5G authentication vector.

[0052] In the method of the above embodiment, the network interoperability functional entity executes AUSF / UDM capabilities towards AMF, executes MME capabilities towards NSA network, cooperates with the home operator to accept user authentication, and completes user service authentication. By deploying a new network interoperability functional entity on the international bureau side, the roaming SA network can access the home NSA network, thereby solving the problem of cross-standard roaming service access authentication during service network deployment. This greatly improves the user's roaming experience when the current 5G network standards at home and abroad are different and the coverage of the same standard network is insufficient; at the same time, it can also expand the service coverage while saving the cost of network upgrade construction. It can reduce network transformation and equipment investment during 5G roaming and interoperability among different networks, and provide a solution for interoperability among different networks in the transition stage.

[0053] Combine the following Figure 2 Other embodiments of the access method for an NSA user roaming to an independent network SA of the present disclosure are described.

[0054] Figure 2 Flowcharts of other embodiments of the access method for NSA users roaming to SA disclosed in the present invention. Figure 2 As shown, the method of this embodiment includes: steps S202 to S212.

[0055] In step S202, the network interworking function entity receives a registration request sent by the AMF when the NSA user authentication is successful.

[0056] The registration request is, for example, a Nudm_UECM_Registration message, which may include the IMSI of the NSA user.

[0057] In step S204, the network interworking function entity obtains the subscription data of the NSA user from the HSS of the NSA network to which the NSA user belongs.

[0058] In some embodiments, the network interoperability function entity sends a ULR (Update Location Request) message to the HSS of the NSA network to which the NSA user belongs. The ULR message includes: the IMSI of the NSA user; the network interoperability function entity receives a ULA (Update Location Answer) message returned by the HSS. The ULA message includes the contract data of the NSA user obtained by searching the IMSI of the NSA user. The network interoperability function entity interacts with the HSS according to the S6a interface. After receiving the ULR message, the HSS searches for the contract data of the NSA user according to the IMSI. The contract data includes an identification of whether the NSA user supports 5G roaming access. For example, NC-NR (Network Capability-New radio) is used to identify whether the NSA user supports 5G roaming access.

[0059] In step S206, the network interworking function entity converts the subscription data of the NSA user into a format supported by AMF, and sends the converted subscription data to AMF.

[0060] In some embodiments, the network interoperability function entity caches the subscription data of the NSA user in correspondence with the IMSI of the NSA user, and may also cache it in correspondence with the SUPI or SUCI of the NSA user; the network interoperability function entity sends a registration success response message to the AMF; the network interoperability function entity receives the subscription data acquisition message sent by the AMF, and the subscription data acquisition message indicates the IMSI of the NSA user; the network interoperability function entity searches for the subscription data of the NSA user according to the IMSI of the NSA user, converts the subscription data of the NSA user into a format supported by the AMF, and sends the converted subscription data to the AMF.

[0061] The registration success response message is, for example, Nudm_UECM_Registration response. The subscription data acquisition message is, for example, Nudm_SDM_Get. The network interworking function entity may send a Nudm_SDM_Get response message to the AMF, which carries the converted subscription data. The formats and contents of the above-mentioned various messages may refer to existing standards and will not be described in detail here.

[0062] In step S208, AMF determines whether the NSA user supports 5G roaming access based on the converted subscription data. If so, execute step S210, otherwise execute step S212.

[0063] The AMF can determine whether the NSA user supports 5G roaming access based on the NC-NR identifier.

[0064] In step S210, the AMF sends an access success response to the NSA user and accesses the NSA user.

[0065] In step S212, the AMF sends an access failure response to the NSA user, denying the NSA user access.

[0066] In the method of the above embodiment, the network intercommunication function entity executes the UDM capability towards the AMF, executes the SGSN capability towards the NSA network, and cooperates with the home operator to complete the access of NSA users. For the NC-NR information sent by the home operator, the NIWF can identify it and provide user access based on the instructions, thereby realizing the access of NSA users to the SA network in the roaming area.

[0067] The present disclosure also provides a network interworking function entity (NIWF), Figure 3 Give a description.

[0068] Figure 3 FIG. 1 is a structural diagram of some embodiments of the network intercommunication functional entity disclosed in the present invention. Figure 3 As shown, the NIWF 30 of this embodiment includes: a first receiving module 310 , an acquisition module 320 , a conversion module 330 , a second receiving module 340 , and an authentication module 350 .

[0069] The first receiving module 310 is used to receive a user authentication request sent by an access and mobility management function entity AMF in an independent network SA, wherein the user authentication request is sent by the AMF in response to an access request initiated by a non-independent network NSA user roaming to an SA coverage area.

[0070] In some embodiments, the user authentication request is sent by AMF to the network interoperability function entity after AMF queries the network storage function entity NRF to find out that the authentication service function AUSF is a network interoperability function entity; wherein, NRF identifies that the NSA network to which the NSA user belongs only provides NSA roaming services based on the NSA user's number segment information, and determines that AUSF is the network interoperability function entity.

[0071] The acquisition module 320 is used to obtain a 4G authentication vector from a home subscriber server HSS of an NSA network to which the NSA user belongs.

[0072] In some embodiments, the acquisition module 320 is used to send an authentication information request message to the HSS of the NSA network to which the NSA user belongs, wherein the authentication information request message includes the IMSI of the NSA user; receive an authentication information response message returned by the HSS, wherein the authentication information response message includes the 4G authentication vector corresponding to the NSA user; wherein the 4G authentication vector includes: RAND, AUTN, RES, CK and IK.

[0073] The conversion module 330 is used to convert the 4G authentication vector into a 5G authentication vector, and generate a user authentication response based on the 5G authentication vector and return it to the AMF, so that the AMF and the NSA user complete mutual authentication based on the authentication response.

[0074] In some embodiments, the conversion module 330 is used to use RAND and AUTN in the 4G authentication vector as RAND and AUTN in the 5G authentication vector, derive HXRES* in the 5G authentication vector according to RES, and derive K in the 5G authentication vector according to CK and IK. SEAF .

[0075] The second receiving module 340 is used to receive the authentication proof request sent by the AMF, wherein the authentication proof request includes: RES* generated by the NSA user during the mutual authentication process between the AMF and the NSA user.

[0076] The authentication module 350 is used to authenticate the NSA user according to RES* and return the authentication result to the AMF.

[0077] In some embodiments, the authentication module 350 is used to query whether the 5G authentication vector corresponding to the NSA user is within the validity period. If it is not within the validity period, the authentication fails. If it is within the validity period, RES* is compared with XRES*. If they are consistent, the authentication is successful, otherwise the authentication fails, where XRES* is derived based on the RES in the 4G authentication vector.

[0078] In some embodiments, NIWF30 further includes: a third receiving module 360, configured to receive a registration request sent by AMF when NSA user authentication is successful.

[0079] The acquisition module 320 is used to obtain the subscription data of the NSA user from the HSS of the NSA network to which the NSA user belongs, and the subscription data includes an identifier of whether the NSA user supports 5G roaming access.

[0080] In some embodiments, the acquisition module 320 is used to send an update location request ULR message to the HSS of the NSA network to which the NSA user belongs, the ULR message including: the IMSI of the NSA user; and receive an update location answer ULA message returned by the HSS, the ULA message including the contract data of the NSA user obtained by searching based on the IMSI of the NSA user.

[0081] The conversion module 330 is used to convert the subscription data of the NSA user into a format supported by the AMF, and send the converted subscription data to the AMF, so that the AMF determines whether the NSA user supports 5G roaming access based on the converted subscription data, and accesses the NSA user if the NSA user supports 5G roaming access.

[0082] In some embodiments, the conversion module 330 is used to cache the contract data of the NSA user and the IMSI of the NSA user; send a registration success response message to the AMF; receive a contract data acquisition message sent by the AMF, the contract data acquisition message including: the IMSI of the NSA user; search for the contract data of the NSA user according to the IMSI of the NSA user, convert the contract data of the NSA user into a format supported by the AMF, and send the converted contract data to the AMF.

[0083] The network intercommunication functional entities in the embodiments of the present disclosure can be implemented by various computing devices or computer systems. Figure 4 as well as Figure 5 Give a description.

[0084] Figure 4 FIG. 1 is a structural diagram of some embodiments of the network intercommunication functional entity disclosed in the present invention. Figure 4 As shown, the network intercommunication functional entity 40 of this embodiment includes: a memory 410 and a processor 420 coupled to the memory 410, and the processor 420 is configured to execute the access method of NSA users roaming to SA in any some of the embodiments of the present disclosure based on instructions stored in the memory 410.

[0085] The memory 410 may include, for example, a system memory, a fixed non-volatile storage medium, etc. The system memory may store, for example, an operating system, an application program, a boot loader, a database, and other programs.

[0086] Figure 5 FIG. 1 is a structural diagram of some other embodiments of the network intercommunication function entity disclosed in the present invention. Figure 5 As shown, the network intercommunication function entity 50 of this embodiment includes: a memory 510 and a processor 520, which are similar to the memory 410 and the processor 420 respectively. It can also include an input and output interface 530, a network interface 540, a storage interface 550, etc. These interfaces 530, 540, 550 and the memory 510 and the processor 520 can be connected, for example, through a bus 560. Among them, the input and output interface 530 provides a connection interface for input and output devices such as a display, a mouse, a keyboard, and a touch screen. The network interface 540 provides a connection interface for various networked devices, for example, it can be connected to a database server or a cloud storage server. The storage interface 550 provides a connection interface for external storage devices such as SD cards and USB flash drives.

[0087] The present disclosure also provides an access system for NSA users to roam to SA. Figure 6 Give a description.

[0088] Figure 6FIG. 1 is a structural diagram of some embodiments of the access system for NSA users roaming to SA in the present disclosure. Figure 6 As shown, the system 6 of this embodiment includes: the network intercommunication function entity 30 / 40 / 50 of any of the above embodiments; and

[0089] AMF62, used to send a user authentication request to the network interworking function entity 30 / 40 / 50, receive a user authentication response sent by the network interworking function entity 30 / 40 / 50, and complete mutual authentication with the NSA user according to the authentication response; send an authentication proof request to the network interworking function entity, and receive an authentication result returned by the network interworking function entity;

[0090] HSS64 is the HSS of the NSA network to which the NSA user belongs, and is used to send a 4G authentication vector to the network interworking function entity 30 / 40 / 50.

[0091] In some embodiments, the system 6 further includes: an NSA user 66 and an NRF 68. The NSA user 66 is used to initiate an access request to the AMF 62 when roaming to the SA coverage area; the AMF 62 is also used to receive the access request sent by the NSA user 66, query the NRF 68 to determine whether the authentication service function AUSF is the network interoperability function entity 30 / 40 / 50, and then send a user authentication request to the network interoperability function entity 30 / 40 / 50. The NRF 68 is used to identify that the NSA network to which the NSA user 66 belongs only opens the NSA roaming service based on the number segment information of the NSA user 66, and determine that the AUSF is the network interoperability function entity 30 / 40 / 50.

[0092] In some embodiments, HSS64 is used to receive an authentication information request message sent by the network interoperability function entity 30 / 40 / 50, wherein the authentication information request message includes the IMSI of the NSA user 66, generate a 4G authentication vector corresponding to the NSA user 66 based on the IMSI of the NSA user 66, and send an authentication information response message to the network interoperability function entity 30 / 40 / 50, wherein the authentication information response message includes the 4G authentication vector corresponding to the NSA user 66; wherein the 4G authentication vector includes: RAND, AUTN, RES, CK and IK.

[0093] In some embodiments, AMF62 is used to generate an authentication request according to the user authentication response and send it to NSA user 66, wherein the user authentication response includes RAND, AUTN and HXRES*, and the authentication request includes RAND and AUTN; receive the authentication response sent by the NSA user, wherein the authentication response includes RES*; determine HRES* according to RES*, and compare HRES* with HXRES*, if they are consistent, the authentication is successful. NSA user 66 is used to authenticate AMF62 according to the authentication request and calculate RES*.

[0094] In some embodiments, the AMF 62 is further configured to send a registration request to the network interworking function entity 30 / 40 / 50 when the NSA user 66 is successfully authenticated; receive the converted contract data sent by the network interworking function entity 30 / 40 / 50, determine whether the NSA user 66 supports 5G roaming access according to the converted contract data, and access the NSA user 66 when the NSA user 66 supports 5G roaming access;

[0095] HSS64 is also used to send the subscription data of NSA user 66 to the network interworking function entity 30 / 40 / 50, and the subscription data includes an identifier of whether the NSA user 66 supports 5G roaming access.

[0096] In some embodiments, HSS64 is used to receive an update location request ULR message sent by the network interoperability function entity 30 / 40 / 50, the ULR message including: the IMSI of NSA user 66; searching for the contract data of NSA user 66 according to the IMSI of NSA user 66, and sending an update location answer ULA message to the network interoperability function entity 30 / 40 / 50, the ULA message including the contract data of NSA user 66 obtained according to the IMSI of NSA user 66.

[0097] In some embodiments, AMF62 is also used to receive a registration success response message sent by the network interoperability function entity 30 / 40 / 50; send a contract data acquisition message to the network interoperability function entity 30 / 40 / 50, the contract data acquisition message includes: the IMSI of the NSA user 66, and receive the converted contract data sent by the network interoperability function entity 30 / 40 / 50.

[0098] Those skilled in the art will appreciate that the embodiments of the present disclosure may be provided as methods, systems, or computer program products. Therefore, the present disclosure may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present disclosure may take the form of a computer program product implemented on one or more computer-usable non-transient storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0099] The present disclosure is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present disclosure. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that specifies a functional entity in a box or multiple boxes.

[0100] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A functional entity specified in one or more boxes.

[0101] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps of the functional entities specified in one or more boxes.

[0102] The above description is only a preferred embodiment of the present disclosure and is not intended to limit the present disclosure. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present disclosure should be included in the protection scope of the present disclosure.

Claims

1. A method for accessing a non-standalone network NSA user roaming to an independent network SA, comprising: The network interworking function entity receives a user authentication request sent by an access and mobility management function entity AMF in the SA, wherein the user authentication request is sent by the AMF in response to an access request initiated by an NSA user roaming to an SA coverage area; The network interworking function entity obtains a 4G authentication vector from a home subscriber server HSS of the NSA network to which the NSA user belongs; The network interworking function entity converts the 4G authentication vector into a 5G authentication vector, and generates a user authentication response according to the 5G authentication vector and returns it to the AMF, so that the AMF and the NSA user complete mutual authentication according to the authentication response; The network interworking function entity receives the authentication proof request sent by the AMF, wherein the authentication proof request includes: RES* generated by the NSA user during the mutual authentication process between the AMF and the NSA user; The network interworking function entity authenticates the NSA user according to the RES* and returns the authentication result to the AMF; The network interworking function entity receives the registration request sent by the AMF when the NSA user authentication is successful; The network interworking function entity obtains the subscription data of the NSA user from the HSS of the NSA network to which the NSA user belongs, where the subscription data includes an identifier of whether the NSA user supports 5G roaming access; The network interworking function entity caches the subscription data of the NSA user and the IMSI of the NSA user in correspondence; The network interworking function entity sends a registration success response message to the AMF; The network interworking function entity receives a subscription data acquisition message sent by the AMF, where the subscription data acquisition message includes: the IMSI of the NSA user; The network intercommunication function entity searches for the subscription data of the NSA user according to the IMSI of the NSA user, converts the subscription data of the NSA user into a format supported by the AMF, and sends the converted subscription data to the AMF, so that the AMF determines whether the NSA user supports 5G roaming access according to the converted subscription data, and accesses the NSA user if the NSA user supports 5G roaming access.

2. The access method according to claim 1, wherein: The user authentication request is sent by the AMF to the network intercommunication function entity after the AMF queries the authentication service function AUSF to the network storage function entity NRF for the network intercommunication function entity; Among them, the NRF identifies, based on the number segment information of the NSA user, that the NSA network to which the NSA user belongs only provides NSA roaming services, and determines that the AUSF is the network intercommunication function entity.

3. The access method according to claim 1, wherein: The network interworking function entity obtains a 4G authentication vector from a home subscriber server HSS of an NSA network to which the NSA user belongs, including: The network interworking function entity sends an authentication information request message to the HSS of the NSA network to which the NSA user belongs, wherein the authentication information request message includes the IMSI of the NSA user; The network interworking function entity receives the authentication information response message returned by the HSS, wherein the authentication information response message includes a 4G authentication vector corresponding to the NSA user; The 4G authentication vector includes: RAND, AUTN, RES, CK and IK.

4. The access method according to claim 3, wherein: The network interworking function entity converts the 4G authentication vector into a 5G authentication vector, and includes according to the 5G authentication vector: The network interworking function entity uses the RAND and AUTN in the 4G authentication vector as the RAND and AUTN in the 5G authentication vector, derives the HXRES* in the 5G authentication vector according to RES, and derives the K in the 5G authentication vector according to CK and IK SEAF .

5. The access method according to claim 4, wherein: The AMF and the NSA user completing mutual authentication according to the authentication response includes: The AMF generates an authentication request according to the user authentication response and sends it to the NSA user, wherein the user authentication response includes RAND, AUTN and HXRES*, and the authentication request includes RAND and AUTN; The NSA user authenticates the AMF according to the authentication request and calculates RES*; The AMF receives an authentication response sent by the NSA user, wherein the authentication response includes the RES*; The AMF determines HRES* based on the RES* and compares the HRES* with the HXRES*. If they are consistent, the authentication is successful.

6. The access method according to claim 1, wherein: The network interworking function entity authenticates the NSA user according to the RES*, including: The network intercommunication function entity queries whether the 5G authentication vector corresponding to the NSA user is within the validity period. If not, the authentication fails. If it is within the validity period, the RES* is compared with the XRES*. If they are consistent, the authentication is successful, otherwise the authentication fails, wherein the XRES* is derived based on the RES in the 4G authentication vector.

7. The access method according to claim 1, wherein: The network interworking function entity obtains the subscription data of the NSA user from the HSS of the NSA network to which the NSA user belongs, including: The network interworking function entity sends an update location request ULR message to the HSS of the NSA network to which the NSA user belongs, wherein the ULR message includes: the IMSI of the NSA user; The network interworking function entity receives an update location answer ULA message returned by the HSS, where the ULA message includes the subscription data of the NSA user obtained by searching the IMSI of the NSA user.

8. A network intercommunication functional entity, comprising: A first receiving module is used to receive a user authentication request sent by an access and mobility management function entity AMF in an independent network SA, wherein the user authentication request is sent by the AMF in response to an access request initiated by a non-independent network NSA user roaming to an SA coverage area; An acquisition module, configured to acquire a 4G authentication vector from a home subscriber server HSS of an NSA network to which the NSA user belongs; A conversion module, configured to convert the 4G authentication vector into a 5G authentication vector, and generate a user authentication response according to the 5G authentication vector and return it to the AMF, so that the AMF and the NSA user complete mutual authentication according to the authentication response; A second receiving module is used to receive an authentication proof request sent by the AMF, wherein the authentication proof request includes: a RES* generated by the NSA user during the mutual authentication process between the AMF and the NSA user; an authentication module, configured to authenticate the NSA user according to the RES* and return an authentication result to the AMF; The third receiving module is used to receive the registration request sent by AMF when the NSA user authentication is successful. Among them, the acquisition module is also used to obtain the contract data of the NSA user from the HSS of the NSA network to which the NSA user belongs, the contract data including an identifier of whether the NSA user supports 5G roaming access, and the conversion module is also used to cache the contract data of the NSA user and the IMSI of the NSA user; send a registration success response message to the AMF; receive a contract data acquisition message sent by the AMF, the contract data acquisition message including: the IMSI of the NSA user; search for the contract data of the NSA user according to the IMSI of the NSA user, convert the contract data of the NSA user into a format supported by the AMF, and send the converted contract data to the AMF, so that the AMF determines whether the NSA user supports 5G roaming access according to the converted contract data, and accesses the NSA user if the NSA user supports 5G roaming access.

9. A network intercommunication functional entity, comprising: processor; as well as A memory coupled to the processor, for storing instructions, wherein when the instructions are executed by the processor, the processor executes the access method for an NSA user roaming to an SA as described in any one of claims 1-7.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, wherein: When the program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

11. An access system for an NSA user roaming to an SA, comprising: The network intercommunication functional entity according to any one of claims 9 to 10; as well as AMF, used to send a user authentication request to the network interoperability function entity, receive a user authentication response sent by the network interoperability function entity, and complete mutual authentication with the NSA user according to the authentication response; send an authentication proof request to the network interoperability function entity, and receive an authentication result returned by the network interoperability function entity; HSS, which is the HSS of the NSA network to which the NSA user belongs, is used to send a 4G authentication vector to the network intercommunication function entity.

12. The access system according to claim 11, further comprising: NSA user, network storage function entity NRF; The NSA user is used to initiate an access request to the AMF when roaming to the SA coverage area; The AMF is also used to receive the access request sent by the NSA user, query the authentication service function AUSF of the NRF for the network interoperability function entity, and then send a user authentication request to the network interoperability function entity. The NRF is used to identify, based on the number segment information of the NSA user, that the NSA network to which the NSA user belongs only provides NSA roaming services, and determine that the AUSF is the network intercommunication function entity.

13. The access system according to claim 11, wherein: The HSS is used to receive an authentication information request message sent by the network interworking function entity, wherein the authentication information request message includes the IMSI of the NSA user, generate a 4G authentication vector corresponding to the NSA user according to the IMSI of the NSA user, and send an authentication information response message to the network interworking function entity, wherein the authentication information response message includes the 4G authentication vector corresponding to the NSA user; The 4G authentication vector includes: RAND, AUTN, RES, CK and IK.

14. The access system according to claim 11, wherein: The AMF is used to generate an authentication request according to the user authentication response and send it to the NSA user, wherein the user authentication response includes RAND, AUTN and HXRES*, and the authentication request includes RAND and AUTN; receive the authentication response sent by the NSA user, wherein the authentication response includes the RES*; determine the HRES* according to the RES*, and compare the HRES* with the HXRES*, if they are consistent, the authentication is successful; The NSA user is used to authenticate the AMF according to the authentication request and calculate RES*.

15. The access system according to claim 11, wherein: The AMF is further configured to, if the NSA user authentication is successful, send a registration request to the network interworking function entity; receive the converted subscription data sent by the network interworking function entity, determine whether the NSA user supports 5G roaming access according to the converted subscription data, and access the NSA user if the NSA user supports 5G roaming access; The HSS is also used to send the subscription data of the NSA user to the network intercommunication function entity, and the subscription data includes an identifier of whether the NSA user supports 5G roaming access.

16. The access system according to claim 15, wherein: The HSS is used to receive an update location request ULR message sent by the network interoperability function entity, the ULR message including: the IMSI of the NSA user; search for the subscription data of the NSA user according to the IMSI of the NSA user, and send an update location answer ULA message to the network interoperability function entity, the ULA message including the subscription data of the NSA user obtained according to the IMSI of the NSA user.

17. The access system according to claim 15, wherein: The AMF is also used to receive a registration success response message sent by the network interoperability function entity; send a subscription data acquisition message to the network interoperability function entity, the subscription data acquisition message includes: the IMSI of the NSA user, and receive the converted subscription data sent by the network interoperability function entity.

Images