Data network re-authentication method, device, equipment and readable storage medium

Abstract

The embodiment of the present application provides a data network re-authentication method, device, equipment and readable storage medium, the method comprising: receiving a first message, the first message indicating that the authentication server requires data network re-authentication for the terminal; determining the access management network element of the terminal according to the user's session management context; and sending a second message for the data network re-authentication to the terminal through the access management network element. In the embodiment of the present application, the access network change of the UE can be adapted to support the UE to complete re-authentication when residing in different core networks (EPC or 5GC).

Description

Technical Field

[0001] The embodiments of the present application relate to the field of communication technology, and specifically to a data network re-authentication method, device, equipment and readable storage medium. Background Art

[0002] Fifth generation mobile communication technology (5th generation, 5G) operators provide vertical industry customers with exclusive, differentiated and quality-assured private network services through slicing and non-public network (NPN) features defined by 5G networks.

[0003] Vertical industry customers deploy registration servers and application servers on the data network (DN) to provide application services to users who register applications, and deploy authentication servers to authenticate users on the data network. Figure 1 As shown, the DN-AAA server is located in the external data network and performs secondary authentication on 5G users using data services.

[0004] Differences in data network authentication between 5G and the fourth generation (4G) mobile communication technology: Considering the differences between 5G and 4G in security requirements, session management, and algorithm flexibility, 5G networks have made some modifications to the data network authentication features: (1) Algorithm changes: Password Authentication Protocol (PAP) / Challenge Handshake Authentication Protocol (CHAP) = > Extensible Authentication Protocol (EAP) authentication; (2) Authentication process changes: One-time submission of username / password verification = > Multiple interactions, DN-AAA server initiates request; (3) Verify information security: Encrypt IE = > Ensure security at the application layer; (4) Authentication when the attachment process establishes the default bearer = > Authentication is performed only when the Protocol Data Unit (PDU) session is established; (5) Support re-authentication: Authentication after the PDU session is established.

[0005] The basic process of re-authentication is as follows: (1) If the DN-AAA server decides to initiate re-authentication for the user, it will send a re-authentication request to the Session Management Function (SMF); or the SMF decides to initiate re-authentication based on conditions. (2) The SMF notifies the terminal to re-authenticate the terminal; (3) The DN-AAA server sends the authentication result to the terminal through the SMF. (4) The SMF receives the authentication result and performs subsequent processing (such as releasing the relevant PDU session if the authentication fails).

[0006] Affected by network coverage, a user may initially move from 5G to 4G after attaching to 5G. The standard does not define the processing when a user moves to 4G and the 5G session management network element receives a re-authentication request from DN-AAA or decides to re-authenticate the user. Summary of the invention

[0007] An object of the embodiments of the present application is to provide a data network re-authentication method, apparatus, device and readable storage medium to solve the problem of how to perform re-authentication.

[0008] In a first aspect, a data network re-authentication method is provided, which is performed by a first network element and includes:

[0009] receiving a first message, wherein the first message indicates that the authentication server requires data network re-authentication for the terminal;

[0010] Determining an access management network element of the terminal according to a session management context of the user;

[0011] A second message for re-authentication of the data network is sent to the terminal through the access management network element.

[0012] Optionally, determining the access management network element of the terminal according to the session management context of the user includes:

[0013] Determining the mobile network system where the terminal is located according to the access network type and / or the wireless access technology type in the session management context;

[0014] The identifier / address of the access management network element providing mobility management for the terminal is determined through the identifier / address of the service node of the mobile network system where the terminal is located.

[0015] Optionally, the method further comprises:

[0016] Determining an authentication method for re-authentication according to the subscription data of the terminal, the interface protocol between the mobile network system where the terminal is located and the authentication server, and the first message;

[0017] The second message is determined according to the mobile network system where the terminal is located and the authentication method.

[0018] Optionally, the second message instructs the terminal to report authentication information corresponding to the data network, and the authentication information includes: a terminal identifier for data network authentication and / or verification information for data network authentication.

[0019] Optionally, the method further comprises:

[0020] Receiving a re-authentication result of the data network of the terminal sent by an authentication server, wherein the re-authentication result includes: authentication success or authentication failure;

[0021] The re-authentication result is sent to the terminal.

[0022] Optionally, the method further comprises:

[0023] If the re-authentication result is authentication failure, a third message is sent to the terminal, the third message instructing the terminal to release the session or release the packet data network PDN connection, the third message carrying a cause value and a timer, the cause value indicating data network authentication failure.

[0024] Optionally, the method further comprises:

[0025] When a protocol data unit PDU session or a PDN connection is established, checking a mapping relationship between a data network name DNN and an access point name APN of the terminal;

[0026] When the DNN is authorized, data network authentication is not initiated for the PDN connection related to the mapped APN, and the PDN connection is allowed to be established;

[0027] When the APN is authorized, data network authentication is not initiated for the PDU session related to the mapped DNN, and the PDU session is allowed to be established.

[0028] In a second aspect, a data network re-authentication method is provided, which is executed by a terminal and includes:

[0029] Receiving a second message for data network re-authentication of the terminal sent by the first network element through the access management network element, the second message instructing the terminal to report authentication information corresponding to the data network, the authentication information including: a terminal identifier for data network authentication and / or verification information for data network authentication;

[0030] reporting the authentication information to an authentication server according to the second message;

[0031] Receive a re-authentication result sent by the authentication server, where the re-authentication result includes: authentication success or authentication failure.

[0032] Optionally, the verification information is used to perform data network authentication on the DNN of the terminal, or to perform data network authentication on an APN that has a mapping relationship with the DNN.

[0033] Optionally, the method further comprises:

[0034] If the re-authentication result is authentication failure, a third message is received, wherein the third message instructs the terminal to release the session or release the PDN connection, and the third message carries a cause value and a timer, wherein the cause value indicates that the data network authentication fails.

[0035] Optionally, the method further comprises:

[0036] Release all PDU sessions associated with the DNN corresponding to the session or release all PDN connections associated with the APN corresponding to the PDN connection.

[0037] Optionally, if the terminal receives the third message from a fifth-generation mobile communication technology 5G network, then according to the cause value and the timer, before the timer times out, a PDU session establishment request is not initiated for the DNN corresponding to the session; through a mapping relationship between DNN and APN, after the terminal moves into a fourth-generation mobile communication technology 4G network, before the timer times out, a PDN connection establishment request is not initiated for the APN corresponding to the PDN connection;

[0038] If the terminal receives the third message from the 4G network, then according to the cause value and the timer, before the timer times out, the PDN connection establishment request is not initiated for the APN corresponding to the PDN connection; through the mapping relationship between DNN and APN, after the terminal moves into the 5G network, before the timer times out, the PDU session establishment request should not be initiated for the DNN corresponding to the session.

[0039] In a third aspect, a data network re-authentication method is provided, which is executed by an authentication server and includes:

[0040] When a data network re-authentication request needs to be initiated for the terminal, a fusion SMF is selected to provide session management services for the DNN of the terminal;

[0041] Sending a data network re-authentication request for the terminal to the fused SMF;

[0042] Receiving, from the converged SMF, authentication information corresponding to the data network reported by the terminal;

[0043] Re-authenticating the data network of the terminal according to the authentication information to obtain a re-authentication result, wherein the re-authentication result includes: authentication success or authentication failure;

[0044] Send the re-authentication result for the terminal to the fused SMF.

[0045] Optionally, the method further comprises:

[0046] Query the UDM address of the terminal through the network storage function NRF;

[0047] According to the home UDM address, the SMF that provides session management service for the DNN of the terminal is queried from the home UDM.

[0048] Optionally, the method further comprises:

[0049] Pre-store authentication information corresponding to the terminal and the data network, the authentication information is used to perform data network authentication on the DNN of the terminal, or to perform data network authentication on the APN mapped by the DNN; the authentication information includes: a terminal identifier for data network authentication and / or verification information for data network authentication.

[0050] In a fourth aspect, a data network re-authentication device is provided, which is applied to a first network element, including:

[0051] A first receiving module, configured to receive a first message, wherein the first message indicates that the authentication server requires data network re-authentication for the terminal;

[0052] A first determining module, configured to determine an access management network element of the terminal according to a session management context of the user;

[0053] The first sending module is used to send a second message for re-authentication of the data network to the terminal through an access management network element.

[0054] In a fifth aspect, a data network re-authentication device is provided, which is applied to a terminal, including:

[0055] A third receiving module is used to receive a second message for data network re-authentication of the terminal issued by the first network element through the access management network element, wherein the second message instructs the terminal to report authentication information corresponding to the data network, and the authentication information includes: a terminal identifier for data network authentication and / or verification information for data network authentication;

[0056] A fourth sending module, configured to report the authentication information to an authentication server according to the second message;

[0057] The fourth receiving module is used to receive the re-authentication result sent by the authentication server, and the re-authentication result includes: authentication success or authentication failure.

[0058] In a sixth aspect, a data network re-authentication device is provided, which is applied to an authentication server, comprising:

[0059] A selection module, used for selecting a fusion SMF that provides session management services for the DNN of the terminal when a data network re-authentication request needs to be initiated to the terminal;

[0060] A fifth sending module, configured to send a data network re-authentication request for the terminal to the fusion SMF;

[0061] A sixth receiving module, configured to receive authentication information corresponding to the data network reported by the terminal from the fusion SMF;

[0062] A re-authentication module, configured to re-authenticate the data network of the terminal according to the authentication information to obtain a re-authentication result, wherein the re-authentication result includes: authentication success or authentication failure;

[0063] The sixth sending module is used to send the re-authentication result for the terminal to the fusion SMF.

[0064] In a seventh aspect, a terminal is provided, comprising: a processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the steps of the method described in the second aspect.

[0065] In an eighth aspect, a network side device is provided, comprising: a processor, a memory, and a program stored in the memory and executable on the processor, wherein when the program is executed by the processor, the steps of the method described in the first aspect or the third aspect are implemented.

[0066] In a ninth aspect, a readable storage medium is provided, on which a program is stored. When the program is executed by a processor, the steps of the method described in the first aspect, the second aspect, or the third aspect are implemented.

[0067] In an embodiment of the present application, the access network changes of the UE can be adapted to support the UE residing in different core networks (EPC or 5GC) to complete re-authentication. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0069] Figure 1 This is a schematic diagram of the interconnection between the 5G network and the data network;

[0070] Figure 2This is one of the flow charts of the data network re-authentication method in the embodiment of the present application;

[0071] Figure 3 This is the second flowchart of the data network re-authentication method in the embodiment of the present application;

[0072] Figure 4 This is the third flowchart of the data network re-authentication method in the embodiment of the present application;

[0073] Figure 5 This is the fourth flowchart of the data network re-authentication method in the embodiment of the present application;

[0074] Figure 6 This is the fifth flow chart of the data network re-authentication method in the embodiment of the present application;

[0075] Figure 7 This is the sixth flowchart of the data network re-authentication method in the embodiment of the present application;

[0076] Figure 8 This is one of the structural diagrams of the data network re-authentication device in the embodiment of the present application;

[0077] Fig. 9 This is the second structural diagram of the data network re-authentication device in the embodiment of the present application;

[0078] Fig.10 This is the third structural diagram of the data network re-authentication device in the embodiment of the present application;

[0079] Fig.11 This is a structural diagram of a terminal in an embodiment of the present application;

[0080] Fig.12 This is a structural diagram of the authentication server in an embodiment of the present application. DETAILED DESCRIPTION

[0081] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0082] The term "comprise" and any variation thereof in the specification and claims of the present application are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units need not be limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices. In addition, the use of "and / or" in the specification and claims to indicate at least one of the connected objects, such as A and / or B, means that A alone, B alone, and A and B exist in three cases.

[0083] In the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0084] It is worth noting that the technology described in the embodiments of the present application is not limited to the Long Term Evolution (LTE) / LTE-Advanced (LTE-A) system, but can also be used in other wireless communication systems, such as Code Division Multiple Access (CDMA), Time Division Multiple Access (TDMA), Frequency Division Multiple Access (FDMA), Orthogonal Frequency Division Multiple Access (OFDMA), Single-carrier Frequency Division Multiple Access (SC-FDMA) and other systems. The terms "system" and "network" in the embodiments of the present application are often used interchangeably, and the described technology can be used for the above-mentioned systems and radio technologies as well as other systems and radio technologies. However, the following description describes a new radio (NR) system for example purposes, and NR terms are used in most of the following descriptions, although these technologies can also be applied to applications other than NR system applications, such as the 6th Generation (6G) communication system.

[0085] See also Figure 2, the embodiment of the present application provides a data network re-authentication method, the main body of the method can be a first network element (or called a converged network element), the first network element simultaneously supports the fourth-generation mobile communication technology (Fourth-generation, 4G) and the fifth-generation mobile communication technology (Fifth-Generation, 5G) business processes and processing logic, supports the interoperability between 4G networks and 5G networks, such as the converged session management function (Session Management Function, SMF) in the 5G network, and has the capabilities of the public data network gateway control plane (PGW-C) in the 4G network core network. When a 5G user attaches to the 5G and establishes a session, the session management entity is not replaced when the user moves to the 4G network to maintain business continuity. When a 4G user attaches to the 4G network and establishes a session, the session management entity is not replaced when the user moves to the 5G network to maintain business continuity. The method includes: step 201, step 202 and step 203.

[0086] Step 201: receiving a first message, wherein the first message indicates that an authentication server requires data network re-authentication for a terminal;

[0087] In an embodiment of the present application, a unified interface can be used between the first network element and the authentication server, which is compatible with 4G / 5G authentication messages and does not distinguish between user access methods. The first network element can record the data network authentication status of the UE based on the data network name (Data Network Name, DNN) / access point name (Access Point Name, APN).

[0088] Step 202: Determine the access management network element of the terminal according to the user's session management context;

[0089] Optionally, the mobile network system where the terminal is located is determined according to the access network type and / or wireless access technology type in the session management context (for example, whether the mobile network system where the terminal is located is 5G or 4G); and the identifier / address of the access management network element that provides mobility management for the terminal is determined through the service node identifier / address of the network where the terminal is located.

[0090] For example, access networks include: Next Generation Radio Access Network (NG RAN), Evolved Universal Terrestrial Radio Access Network (E-UTRAN), and radio access technology types (RAT type) include: New Radio (NR), Evolved-UMTS Terrestrial Radio Access (EUTRA).

[0091] It is understandable that both identifiers / addresses may exist, one identifier / address is activated (active), and the other identifier / address is inactive (inactive). Select the active identifier / address. You can also select through the access network. In the 5G network, select the identifier / address of the 5G core network access and mobility management function (Access and Mobility Management Function, AMF); in the 4G network, select the identifier / address of the 4G core network mobility management entity (Mobility Management Entity, MME).

[0092] Table 1: Enumeration Access Type

[0093] Enumeration value Description "3GPP_ACCESS" 3GPP access "NON_3GPP_ACCESS" Non-3GPP access

[0094] Table 2: Enumeration Rat Type

[0095]

[0096] Step 203: Send a second message for re-authentication of the data network to the terminal through the access management network element.

[0097] In an embodiment of the present application, the method also includes: determining an authentication method for re-authentication based on the contract data of the terminal, the interface protocol between the mobile network system where the terminal is located and the authentication server, and the first message; determining the second message based on the mobile network system where the terminal is located and the authentication method.

[0098] Optionally, the second message instructs the terminal to report authentication information corresponding to the data network, and the authentication information includes: a terminal identifier for data network authentication and / or verification information for data network authentication.

[0099] Optionally, the data network is indicated by a DNN or APN, or may be indicated by a session established by a user on the data network or a corresponding identifier of a Packet Data Network (PDN) connection.

[0100] For example, the Protocol Data Unit (PDU) session ID can be associated with the DNN requested when establishing a session in a 5G network. The PDN connection ID can be associated with the APN requested when establishing a PDN connection in a 4G network.

[0101] In an embodiment of the present application, the method further includes: receiving a re-authentication result of the data network of the terminal sent by an authentication server, the re-authentication result including: authentication success or authentication failure; and sending the re-authentication result to the terminal.

[0102] In an embodiment of the present application, the method further includes:

[0103] If the re-authentication result is authentication failure, a third message is sent to the terminal, the third message instructing the terminal to release the session or release the PDN connection, the third message carrying a cause value and a timer, the cause value indicating that the data network authentication failed.

[0104] In an embodiment of the present application, after re-authentication fails, the first network element (for example, the fused SMF) notifies the UE to release the DNN-related PDU session or release the PDN connection, so as to avoid the situation where multiple first network elements (fused SMFs) that manage different PDU sessions / PDN connections of the DNN for the UE need to simultaneously initiate session release or release PDN connections for the UE when the release is initiated from the network side.

[0105] In an embodiment of the present application, the method further includes:

[0106] When a PDU session or a PDN connection is established, checking the mapping relationship between the DNN and the APN of the terminal;

[0107] When the DNN is authorized, data network authentication is not initiated for the PDN connection related to the mapped APN, and the PDN connection is allowed to be established;

[0108] When the APN is authorized, data network authentication is not initiated for the PDU session related to the mapped DNN, and the PDU session is allowed to be established.

[0109] In an embodiment of the present application, the first network element (fused SMF) can associate the DNN / APN authentication result, and the establishment of the PDU session / PDN connection authorized by the DN does not require authentication.

[0110] In an embodiment of the present application, the access network changes of the UE can be adapted to support the UE residing in different core networks (EPC or 5GC) to complete re-authentication.

[0111] See also Figure 3 The embodiment of the present application provides a data network re-authentication method, the execution subject of the method may be a terminal, and the specific steps include: step 301-step 303.

[0112] Step 301: receiving a second message for data network re-authentication for the terminal sent by the first network element through the access management network element, wherein the second message instructs the terminal to report authentication information corresponding to the data network, wherein the authentication information includes: a terminal identifier for data network authentication and / or verification information for data network authentication;

[0113] Step 302: reporting the authentication information to an authentication server according to the second message;

[0114] Step 303: Receive a re-authentication result sent by the authentication server, where the re-authentication result includes: authentication success or authentication failure.

[0115] In an embodiment of the present application, the verification information is used to perform data network authentication on the DNN of the terminal, or to perform data network authentication on the APN that has a mapping relationship with the DNN.

[0116] In an embodiment of the present application, the method further includes:

[0117] If the re-authentication result is authentication failure, a third message is received, wherein the third message instructs the terminal to release the session or release the PDN connection, and the third message carries a cause value and a timer, wherein the cause value indicates that the data network authentication fails.

[0118] In an embodiment of the present application, the method further includes:

[0119] Release all PDU sessions associated with the DNN corresponding to the session or release all PDN connections associated with the APN corresponding to the PDN connection.

[0120] In an embodiment of the present application, if the terminal receives the third message from 5G, then according to the cause value and the timer, before the timer times out, the DNN corresponding to the session does not initiate a PDU session establishment request; through the mapping relationship between DNN and APN, after the terminal moves into 4G, before the timer times out, the APN corresponding to the PDN connection does not initiate a PDN connection establishment request;

[0121] If the terminal receives the third message from 4G, then according to the cause value and the timer, before the timer times out, the PDN connection establishment request is not initiated for the PDN corresponding to the PDN connection; through the mapping relationship between DNN and APN, after the terminal moves into 5G, before the timer times out, the PDU session establishment request is not initiated for the DNN corresponding to the session.

[0122] In an embodiment of the present application, the access network changes of the UE can be adapted to support the UE residing in different core networks (EPC or 5GC) to complete re-authentication.

[0123] See also Figure 4 The embodiment of the present application provides a data network re-authentication method. The execution subject of the method can be an authentication server. The specific steps include: step 401, step 402, step 403, step 404 and step 405.

[0124] Step 401: When a data network re-authentication request needs to be initiated to a terminal, a fusion SMF that provides session management services for the DNN of the terminal is selected;

[0125] Step 402: Sending a data network re-authentication request for the terminal to the fusion SMF;

[0126] Step 403: receiving authentication information corresponding to the data network reported by the terminal from the converged SMF;

[0127] Step 404: re-authenticate the data network of the terminal according to the authentication information to obtain a re-authentication result, wherein the re-authentication result includes: authentication success or authentication failure;

[0128] Step 405: Send the re-authentication result for the terminal to the converged SMF.

[0129] In an embodiment of the present application, the method also includes: querying the home unified data management (UDM) address of the terminal through a network storage function (NRF); and querying the SMF that provides session management services for the DNN of the terminal from the home UDM according to the home UDM address.

[0130] In an embodiment of the present application, the method also includes: pre-storing authentication information corresponding to the terminal and the data network, the authentication information being used to perform data network authentication on the DNN of the terminal, or to perform data network authentication on the APN mapped by the DNN; the authentication information includes: a terminal identifier for data network authentication and / or verification information for data network authentication.

[0131] In an embodiment of the present application, the access network changes of the UE can be adapted to support the UE residing in different core networks (EPC or 5GC) to complete re-authentication.

[0132] The following describes an embodiment of the present application in combination with scenario 1, scenario 2, and scenario 3.

[0133] Scenario 1: DN-AAA (authentication server) initiates re-authentication, and the integrated SMF instructs the user to re-authenticate on 5G, and the re-authentication is successful.

[0134] See also Figure 5, UE uniformly configures a set of authentication information for DNN / APN with mapping relationship (allowing switching), and DN-AAA can save a set of authentication information for the same UE. Simplify UE and DN-AAA implementation, and save authentication information based on users rather than access networks.

[0135] In the embodiment of the present application, the UE and the DN-AAA configure a set of authentication information.

[0136] Specifically, the UE uniformly configures a set of verification information for DNN / APN with mapping relationship (switching allowed), regardless of whether the user accesses from 4G or 5G. The user can configure a set of verification information for the DNN signed by 5G, and the user uses this set of verification information for data authentication in the DNN corresponding to the data application; the user also uses this set of verification information for data authentication in the 4G APN mapped by these DNNs corresponding to the data application.

[0137] Step 1: The UE attaches to 4G, initiates the PDN connection establishment process, and completes the data network authentication of APN1 on the 4G network.

[0138] After 4G attachment, the UE reports the network authentication capability. The converged SMF obtains the user's contract and determines that APN1 requires authentication. The converged SMF obtains the verification information of APN1 from the UE and initiates an authentication request to the authentication server. DN-AAA performs authentication based on the stored verification information of the UE, and allows the user to establish a PDN connection for APN1 if successful. The converged SMF records the UE's APN1 authentication result / authorization status (success). If the authentication fails, it is recorded as unauthorized. DN-AAA records the address of the converged SMF that initiated the authentication request. The user ID is recorded, which may also include session information. The authentication result / authorization status (success) of the UE is recorded.

[0139] Step 2: UE moves into 5G;

[0140] The PDN connection established in 4G is switched to 5G, and the fusion SMF knows that the UE has moved to 5G. The UE subsequently initiates a new PDU session establishment request for DNN1 to the SMF in the 5G network. The fusion SMF checks that the UE's DNN1 has a mapping relationship with APN1, and APN1 is authorized. It does not initiate data network authentication, allows PDUsession to be established, and executes the subsequent session establishment process.

[0141] Step 3: DN-AAA decides to initiate re-authentication for the UE;

[0142] DN-AAA decides to perform re-authentication and selects an SMF that provides session management services for the UE's DNN.

[0143] Method 1: Based on the fusion SMF address saved during data authentication. (When a user establishes a PDUsession for a DNN for the first time, data network authentication is required. During this process, the authentication server records the UE's authentication identifier, authentication result (whether it has been authenticated and authorized), and the fusion SMF address that initiated the authentication request.

[0144] Method 2: Go to NRF to query the user's home UDM address, and then go to the home UDM to query the SMF that provides session management services for the user's DNN. If several SMFs are found, you can select one SMF from them.

[0145] Step 4: DN-AAA sends a re-authentication request to the converged SMF, carrying the UE identity;

[0146] Step 5: The fused SMF determines the UE's access management network element, i.e., the AMF in the 5G network, based on the UE's session management context;

[0147] Step 6: The fusion SMF selects the re-authentication authentication method according to the contract data of the terminal, the interface protocol with the authentication server, and the received re-authentication request;

[0148] The integrated SMF checks whether the user is in the 5G network and decides to use the authentication method of the 5G network.

[0149] Step 7: The fused SMF sends a re-authentication authentication message to the UE through the AMF, instructing the UE to report the authentication information of the data network authentication;

[0150] The converged SMF receives the re-authentication request. Checks that the user is in 5G and decides to use EAP authentication. Addresses the AMF based on the user ID and sends an EAP authentication message to the UE through the AMF.

[0151] Step 8: Execute the re-authentication message interaction process;

[0152] After receiving the EAP authentication message, the UE interacts with the DN-AAA to complete the re-authentication. The DN-AAA sends the re-authentication result.

[0153] Step 9: DN-AAA sends the re-authentication result (success) to the converged SMF;

[0154] Step 10: The fused SMF records that the UE has successfully re-authenticated itself for DNN1. The UE is authorized to establish a session for DNN1 or a PDN connection for APN1 mapped to DNN1;

[0155] Step 11: The fused SMF sends the re-authentication result to the UE via the AMF.

[0156] Scenario 2: DN-AAA initiates re-authentication, and the integrated SMF instructs the user to re-authenticate on 4G. The re-authentication is successful.

[0157] See also Figure 6 , the UE uniformly configures a set of authentication information for the DNN / APN with a mapping relationship (allowing switching), and DN-AAA can save a set of authentication information for the same UE.

[0158] Step 1: The UE attaches to 5G, initiates the PDN connection establishment process, and completes the data network authentication of DNN1 on the 5G network.

[0159] After 5G attachment, the UE reports the network authentication capability. The fused SMF obtains the user contract and determines that DNN2 needs authentication. The fused SMF obtains the verification information of DNN2 from the UE and initiates an authentication request to DN-AAA. DN-AAA performs authentication based on the stored verification information of the UE, and allows the user to establish a DNN2 session if successful. The fused SMF records the UE's DNN2 authentication result / authorization status (success). If the authentication fails, it is recorded as unauthorized. The authentication server records the address of the fused SMF that initiated the authentication request. The user identity is recorded, which may also include session information. The authentication result / authorization status (success) of the UE is recorded.

[0160] Step 2: UE moves to 4G;

[0161] The UE moves to the 4G network, and the PDU session established in 5G is switched to 4G. The converged SMF knows that the UE has moved to 4G. The UE then initiates a new PDN connection establishment request for APN2 to the PGW-C jointly set up by the converged SMF in the 4G network. The converged SMF checks whether there is a mapping relationship between the UE's DNN2 and APN2, and APN2 is authorized. It does not initiate data network authentication, allows the PDN connection to be established, and executes the subsequent connection establishment process.

[0162] Step 3: DN-AAA decides to initiate re-authentication for the UE;

[0163] DN-AAA decides to re-authenticate and selects an SMF based on the SMF address saved from the last authentication.

[0164] Method 1: Based on the fusion SMF address saved during data authentication. (When a user establishes a PDUsession for a DNN for the first time, data network authentication is required. During this process, DN-AAA records the UE's authentication identifier, authentication result (whether it has been authenticated and authorized), and the fusion SMF address that initiated the authentication request.

[0165] Method 2: Go to NRF to query the user's home UDM address, and then go to the home UDM to query the SMF that provides session management services for the user's DNN. If several SMFs are found, you can select one SMF from them.

[0166] Step 4: DN-AAA sends a re-authentication request to the converged SMF, carrying the UE identity;

[0167] Step 5: The converged SMF determines the access management network element of the UE, that is, the MME in the 4G network, based on the session management context of the UE;

[0168] Step 6: The fusion SMF selects the re-authentication authentication method according to the contract data of the terminal, the interface protocol with the authentication server, and the received re-authentication request;

[0169] The Fusion SMF checks that the user is on the 4G network and decides to use the 4G network’s authentication method.

[0170] Step 7: The fused SMF sends a re-authentication authentication message to the UE through the MME, instructing the UE to report the authentication information of the data network authentication;

[0171] Step 8: Execute the re-authentication message interaction process;

[0172] Step 9: DN-AAA sends the re-authentication result (success) to the converged SMF;

[0173] Step 10: The fused SMF records that the UE has successfully re-authenticated for APN1. The UE is authorized to establish a PDN connection for APN1 or a session for DNN1 mapped to APN1;

[0174] Step 11: The fused SMF sends the re-authentication result to the UE via the MMF.

[0175] Scenario 3: DN-AAA initiates re-authentication, and the integrated SMF instructs the user to re-authenticate on 5G, but the re-authentication fails.

[0176] See also Figure 7 , the UE uniformly configures a set of authentication information for the DNN / APN with a mapping relationship (allowing switching), and DN-AAA can save a set of authentication information for the same UE.

[0177] Step 1: The UE attaches to 4G, initiates the PDN connection establishment process, and completes the data network authentication of APN1 on the 4G network.

[0178] Step 2: UE moves into 5G;

[0179] Step 3: DN-AAA decides to initiate re-authentication for the UE;

[0180] Step 4: DN-AAA sends a re-authentication request to the converged SMF, carrying the UE identity;

[0181] Step 5: The fused SMF determines the UE's access management network element, i.e., the AMF in the 5G network, based on the UE's session management context;

[0182] Step 6: The fusion SMF selects the re-authentication authentication method according to the contract data of the terminal, the interface protocol with the authentication server, and the received re-authentication request;

[0183] Step 7: The fused SMF sends a re-authentication authentication message to the UE through the AMF, instructing the UE to report the authentication information of the data network authentication;

[0184] Step 8: Execute the re-authentication message interaction process;

[0185] Step 9: DN-AAA sends the re-authentication result (failure) to the converged SMF;

[0186] Step 10: The fused SMF records the UE's re-authentication failure for DNN1. Cancel the authorization for the UE to establish a session for DNN1 or to establish a PDN connection for APN1 mapped to DNN1, and release the session corresponding to DNN1 and the PDN connection corresponding to APN1. Inhibit subsequent UEs from establishing a session for DNN1 or to establish a PDN connection for APN1 mapped to DNN1;

[0187] Step 11: The fused SMF sends a session release command to the UE through the AMF, carrying the re-authentication failure, reason value, and timer.

[0188] Step 12: The UE locally releases the PDU session corresponding to DNN1 and the PDN connection corresponding to APN1 according to the cause value; and, based on the cause value and the timer, the UE does not initiate a session establishment request for DNN1 before the timer expires; and does not initiate PDN connection establishment for APN1 mapped to DNN1.

[0189] See also Figure 8 The embodiment of the present application provides a data network re-authentication device, which is applied to a first network element. The device 800 includes:

[0190] A first receiving module 801 is used to receive a first message, where the first message indicates that the authentication server requires data network re-authentication for the terminal;

[0191] A first determining module 802, configured to determine an access management network element of the terminal according to a session management context of the user;

[0192] The first sending module 803 is used to send a second message for re-authentication of the data network to the terminal through an access management network element.

[0193] In an embodiment of the present application, the first determination module 802 is further used to: determine the mobile network system where the terminal is located according to the access network type and / or wireless access technology type in the session management context (for example, determine whether the mobile network system where the terminal is located is 5G or 4G); determine the identifier / address of the access management network element that provides mobility management for the terminal through the service node identifier / address of the mobile network system where the terminal is located.

[0194] In an embodiment of the present application, the device 800 also includes: a second determination module, used to determine the authentication method for re-authentication based on the contract data of the terminal, the interface protocol between the mobile network system where the terminal is located and the authentication server, and the first message; determine the second message based on the mobile network system where the terminal is located and the authentication method.

[0195] In the embodiment of the present application, the second message instructs the terminal to report authentication information corresponding to the data network, and the authentication information includes: a terminal identifier for data network authentication and / or verification information for data network authentication.

[0196] In the embodiment of the present application, the apparatus 800 further includes:

[0197] A second receiving module, configured to receive a re-authentication result of the data network of the terminal sent by the authentication server, wherein the re-authentication result includes: authentication success or authentication failure;

[0198] The second sending module is used to send the re-authentication result to the terminal.

[0199] In the embodiment of the present application, the apparatus 800 further includes:

[0200] The third sending module is used to send a third message to the terminal if the re-authentication result is authentication failure, the third message instructing the terminal to release the session or release the PDN connection, the third message carries a cause value and a timer, and the cause value indicates that the data network authentication failed.

[0201] In an embodiment of the present application, the device 800 also includes: a processing module, which is used to check the mapping relationship between the DNN of the terminal and the access point name APN when the PDU session or PDN connection is established; when the DNN is authorized, data network authentication is not initiated for the PDN connection related to the mapped APN, and the PDN connection is allowed to be established; when the APN is authorized, data network authentication is not initiated for the PDU session related to the mapped DNN, and the PDU session is allowed to be established.

[0202] The device provided in the embodiment of the present application can achieve Figure 2The various processes implemented by the method embodiment shown achieve the same technical effect and will not be described again here to avoid repetition.

[0203] See also Fig. 9 The embodiment of the present application provides a data network re-authentication device, which is applied to a terminal. The device 900 includes:

[0204] The third receiving module 901 is used to receive a second message for data network re-authentication of the terminal issued by the first network element through the access management network element, wherein the second message instructs the terminal to report authentication information corresponding to the data network, and the authentication information includes: a terminal identifier for data network authentication and / or verification information for data network authentication;

[0205] The fourth sending module 902 is used to report the authentication information to the authentication server according to the second message;

[0206] The fourth receiving module 903 is used to receive the re-authentication result sent by the authentication server, where the re-authentication result includes: authentication success or authentication failure.

[0207] In an embodiment of the present application, the verification information is used to perform data network authentication on the DNN of the terminal, or to perform data network authentication on the APN that has a mapping relationship with the DNN.

[0208] In the embodiment of the present application, the device 900 further includes:

[0209] The fifth receiving module is used to receive a third message if the re-authentication result is authentication failure, wherein the third message instructs the terminal to release the session or release the PDN connection, and the third message carries a cause value and a timer, wherein the cause value indicates that the data network authentication fails.

[0210] In the embodiment of the present application, the device 900 further includes:

[0211] A release module is used to release all PDU sessions associated with the DNN corresponding to the session or to release all PDN connections associated with the APN corresponding to the PDN connection.

[0212] In the embodiment of the present application, the device 900 further includes:

[0213] A processing module, configured to, if the terminal receives the third message from the 5G network, not initiate a PDU session establishment request for the DNN corresponding to the session before the timer times out, according to the cause value and the timer; and not initiate a PDN connection establishment request for the APN corresponding to the PDN connection after the terminal moves into the 4G network before the timer times out, according to the mapping relationship between the DNN and the APN;

[0214] If the terminal receives the third message from the 4G network, then according to the cause value and the timer, before the timer times out, the PDN connection establishment request is not initiated for the APN corresponding to the PDN connection; through the mapping relationship between DNN and APN, after the terminal moves into the 5G network, before the timer times out, the PDU session establishment request should not be initiated for the DNN corresponding to the session.

[0215] The device provided in the embodiment of the present application can achieve Figure 3 The various processes implemented by the method embodiment shown achieve the same technical effect and will not be described again here to avoid repetition.

[0216] See also Fig.10 The embodiment of the present application provides a data network re-authentication device, which is applied to an authentication server. The device 1000 includes:

[0217] A selection module 1001 is used to select a fusion SMF that provides session management services for the DNN of the terminal when a data network re-authentication request needs to be initiated to the terminal;

[0218] A fifth sending module 1002 is used to send a data network re-authentication request for the terminal to the fusion SMF;

[0219] The sixth receiving module 1003 is used to receive the authentication information corresponding to the data network reported by the terminal from the fusion SMF;

[0220] The re-authentication module 1004 is used to re-authenticate the data network of the terminal according to the authentication information to obtain a re-authentication result, wherein the re-authentication result includes: authentication success or authentication failure;

[0221] The sixth sending module 1005 is used to send the re-authentication result for the terminal to the integrated SMF.

[0222] In the embodiment of the present application, the apparatus 1000 further includes:

[0223] The query module is used to query the home UDM address of the terminal through the NRF; according to the home UDM address, query the SMF that provides session management services for the DNN of the terminal from the home UDM.

[0224] In the embodiment of the present application, the apparatus 1000 further includes:

[0225] A storage module is used to pre-store authentication information corresponding to the terminal and the data network, wherein the authentication information is used to perform data network authentication on the DNN of the terminal or on the APN mapped by the DNN; the authentication information includes: a terminal identifier for data network authentication and / or verification information for data network authentication.

[0226] The device provided in the embodiment of the present application can achieve Figure 4 The various processes implemented by the method embodiment shown achieve the same technical effect and will not be described again here to avoid repetition.

[0227] Fig.11 A schematic diagram of the hardware structure of a terminal for implementing an embodiment of the present application.

[0228] The terminal 1100 includes but is not limited to: a radio frequency unit 1101, a network module 1102, an audio output unit 1103, an input unit 1104, a sensor 1105, a display unit 1106, a user input unit 1107, an interface unit 1108, a memory 1109, and a processor 1110 and other components.

[0229] Those skilled in the art will appreciate that the terminal 1100 may also include a power source (such as a battery) for supplying power to various components, and the power source may be logically connected to the processor 1110 through a power management system, thereby implementing functions such as managing charging, discharging, and power consumption management through the power management system. Fig.11 The terminal structure shown in the figure does not constitute a limitation on the terminal. The terminal may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently, which will not be described in detail here.

[0230] It should be understood that in the embodiment of the present application, the input unit 1104 may include a graphics processor (Graphics Processing Unit, GPU) 11041 and a microphone 11042, and the graphics processor 11041 processes the image data of the static picture or video obtained by the image capture device (such as a camera) in the video capture mode or the image capture mode. The display unit 1106 may include a display panel 11061, and the display panel 11061 may be configured in the form of a liquid crystal display, an organic light emitting diode, etc. The user input unit 1107 includes a touch panel 11071 and other input devices 11072. The touch panel 11071 is also called a touch screen. The touch panel 11071 may include two parts: a touch detection device and a touch controller. Other input devices 11072 may include, but are not limited to, a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, and a joystick, which will not be repeated here.

[0231] In the embodiment of the present application, the radio frequency unit 1101 receives downlink data from the network side device and sends it to the processor 1110 for processing; in addition, the uplink data is sent to the network side device. Generally, the radio frequency unit 1101 includes but is not limited to an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier, a duplexer, etc.

[0232] The memory 1109 can be used to store software programs or instructions and various data. The memory 1109 can mainly include a program or instruction storage area and a data storage area, wherein the program or instruction storage area can store an operating system, an application program or instruction required for at least one function (such as a sound playback function, an image playback function, etc.), etc. In addition, the memory 1109 can include a high-speed random access memory, and can also include a non-volatile memory, wherein the non-volatile memory can be a read-only memory (Read-Only Memory, ROM), a programmable read-only memory (Programmable ROM, PROM), an erasable programmable read-only memory (Erasable PROM, EPROM), an electrically erasable programmable read-only memory (Electrically EPROM, EEPROM) or a flash memory. For example, at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device.

[0233] The processor 1110 may include one or more processing units; optionally, the processor 1110 may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a user interface, and application programs or instructions, etc., and the modem processor mainly processes wireless communications, such as a baseband processor. It is understandable that the modem processor may not be integrated into the processor 1110.

[0234] The terminal provided in the embodiment of the present application can achieve Figure 3 The various processes implemented by the method embodiment shown achieve the same technical effect and will not be described again here to avoid repetition.

[0235] The present application embodiment also provides a network side device. Fig.12 As shown, the network side device 1200 includes: an antenna 1201, a radio frequency device 1202, and a baseband device 1203. The antenna 1201 is connected to the radio frequency device 1202. In the uplink direction, the radio frequency device 1202 receives information through the antenna 1201 and sends the received information to the baseband device 1203 for processing. In the downlink direction, the baseband device 1203 processes the information to be sent and sends it to the radio frequency device 1202. The radio frequency device 1202 processes the received information and sends it out through the antenna 1201.

[0236] The frequency band processing device may be located in the baseband device 1203 . The method performed by the network-side device in the above embodiment may be implemented in the baseband device 1203 . The baseband device 1203 includes a processor 1204 and a memory 1205 .

[0237] The baseband device 1203 may include, for example, at least one baseband board on which a plurality of chips are arranged. Fig.12 As shown, one of the chips is, for example, a processor 1204, which is connected to a memory 1205 to call a program in the memory 1205 to execute the network device operations shown in the above method embodiment.

[0238] The baseband device 1203 may further include a network interface 1206 for exchanging information with the radio frequency device 1202 . The interface may be, for example, a common public radio interface (CPRI for short).

[0239] Specifically, the network side device of the embodiment of the present invention further includes: instructions or programs stored in the memory 1205 and executable on the processor 1204, and the processor 1204 calls the instructions or programs in the memory 1205 to execute Figure 3 or Figure 4 The methods executed by the modules shown achieve the same technical effects, and therefore will not be described here in detail to avoid repetition.

[0240] The network side device provided in the embodiment of the present application can achieve Figure 3 or Figure 4 The various processes implemented by the method embodiment shown achieve the same technical effect and will not be described again here to avoid repetition.

[0241] The embodiment of the present application also provides a readable storage medium on which a program or instruction is stored. When the program or instruction is executed by a processor, the above Figure 2 or Figure 3 or Figure 4 The various processes of the method embodiment shown can achieve the same technical effect, and will not be described again here to avoid repetition.

[0242] The processor is the processor in the terminal described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0243] The steps of the method or algorithm described in conjunction with the contents disclosed in this application can be implemented in hardware or by executing software instructions in a processor. The software instructions can be composed of corresponding software modules, and the software modules can be stored in RAM, flash memory, ROM, EPROM, EEPROM, registers, hard disks, mobile hard disks, read-only optical disks, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be carried in an ASIC. In addition, the ASIC can be carried in a core network interface device. Of course, the processor and the storage medium can also exist in the core network interface device as discrete components.

[0244] Those skilled in the art should be aware that in one or more of the above examples, the functions described in this application can be implemented using hardware, software, firmware, or any combination thereof. When implemented using software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium. Computer-readable media include computer storage media and communication media, wherein communication media include any media that facilitates the transmission of a computer program from one place to another. The storage medium can be any available medium that a general or special-purpose computer can access.

[0245] The specific implementation methods described above further illustrate the purpose, technical solutions and beneficial effects of the present application in detail. It should be understood that the above description is only the specific implementation methods of the present application and is not intended to limit the scope of protection of the present application. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solutions of the present application should be included in the scope of protection of the present application.

[0246] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the embodiments of the present application may adopt the form of complete hardware embodiments, complete software embodiments, or embodiments in combination with software and hardware. Moreover, the embodiments of the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0247] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0248] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0249] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0250] Obviously, those skilled in the art can make various changes and modifications to the embodiments of the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the embodiments of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A data network re-authentication method, executed by a first network element, characterized in that: include: receiving a first message from an authentication server, wherein the first message indicates that the authentication server requires data network re-authentication for the terminal; Determine the access management network element of the terminal according to the session management context of the user, the access management network element including AMF or MME; Sending a second message for re-authentication of the data network to the terminal through an access management network element; The method further comprises: Determining an authentication method for re-authentication according to the subscription data of the terminal, the interface protocol between the mobile network system where the terminal is located and the authentication server, and the first message; Determining the second message according to the mobile network system where the terminal is located and the authentication method; Among them, the first network element is a converged session management function SMF in the 5G network, and the converged SMF also has the capability of the public data network gateway control plane in the 4G network core network.

2. The method according to claim 1, characterized in that: The determining the access management network element of the terminal according to the session management context of the user includes: Determining the mobile network system where the terminal is located according to the access network type and / or the wireless access technology type in the session management context; The identifier / address of the access management network element providing mobility management for the terminal is determined through the identifier / address of the service node of the mobile network system where the terminal is located.

3. The method according to claim 1, characterized in that The second message instructs the terminal to report authentication information corresponding to the data network, and the authentication information includes: a terminal identifier for data network authentication and / or verification information for data network authentication.

4. The method according to claim 1, characterized in that The method further comprises: Receiving a re-authentication result of the data network of the terminal sent by an authentication server, wherein the re-authentication result includes: authentication success or authentication failure; The re-authentication result is sent to the terminal.

5. The method according to claim 4, characterized in that The method further comprises: If the re-authentication result is authentication failure, a third message is sent to the terminal, the third message instructing the terminal to release the session or release the packet data network PDN connection, the third message carrying a cause value and a timer, the cause value indicating data network authentication failure.

6. The method according to claim 1, characterized in that The method further comprises: When a protocol data unit PDU session or a PDN connection is established, checking a mapping relationship between a data network name DNN and an access point name APN of the terminal; When the DNN is authorized, data network authentication is not initiated for the PDN connection related to the mapped APN, and the PDN connection is allowed to be established; When the APN is authorized, data network authentication is not initiated for the PDU session related to the mapped DNN, and the PDU session is allowed to be established.

7. A data network re-authentication method, executed by a terminal, characterized in that: include: receiving a second message for data network re-authentication of the terminal sent by the first network element through the access management network element, wherein the second message instructs the terminal to report authentication information corresponding to the data network, the authentication information including: a terminal identifier for data network authentication and / or verification information for data network authentication, and the access management network element includes an AMF or an MME; reporting the authentication information to an authentication server according to the second message; Receiving a re-authentication result sent by the authentication server, wherein the re-authentication result includes: authentication success or authentication failure; The second message is determined by the first network element according to the mobile network system where the terminal is located and the authentication method, the authentication method is determined by the first network element according to the subscription data of the terminal, the interface protocol between the mobile network system where the terminal is located and the authentication server, and the first message, and the first message indicates that the authentication server requires data network re-authentication for the terminal; The first network element is a converged session management function SMF in a 5G network, and the converged SMF also has the capability of a public data network gateway control plane in a 4G network core network.

8. The method according to claim 7, characterized in that The verification information is used to perform data network authentication on the DNN of the terminal, or to perform data network authentication on the APN that has a mapping relationship with the DNN.

9. The method according to claim 7, characterized in that: The method further comprises: If the re-authentication result is authentication failure, a third message is received, wherein the third message instructs the terminal to release the session or release the PDN connection, and the third message carries a cause value and a timer, wherein the cause value indicates that the data network authentication fails.

10. The method according to claim 9, characterized in that The method further comprises: Release all PDU sessions associated with the DNN corresponding to the session or release all PDN connections associated with the APN corresponding to the PDN connection.

11. The method according to claim 9, characterized in that If the terminal receives the third message from the fifth generation mobile communication technology 5G network, then according to the cause value and the timer, before the timer times out, the DNN corresponding to the session does not initiate a PDU session establishment request; through the mapping relationship between the DNN and the APN, after the terminal moves into the fourth generation mobile communication technology 4G network, before the timer times out, the PDN connection establishment request is not initiated for the APN corresponding to the PDN connection; If the terminal receives the third message from the 4G network, then according to the cause value and the timer, before the timer times out, the PDN connection establishment request is not initiated for the APN corresponding to the PDN connection; through the mapping relationship between DNN and APN, after the terminal moves into the 5G network, before the timer times out, the PDU session establishment request should not be initiated for the DNN corresponding to the session.

12. A data network re-authentication method, executed by an authentication server, characterized in that: include: When a data network re-authentication request needs to be initiated for the terminal, a fusion SMF in the 5G network that provides session management services for the DNN of the terminal is selected, and the fusion SMF is used to determine the access management network element of the terminal according to the user's session management context. The access management network element includes AMF or MME, and the fusion SMF also has the ability of the public data network gateway control plane in the 4G network core network; Sending a data network re-authentication request for the terminal to the fused SMF; Receiving, from the converged SMF, authentication information corresponding to the data network reported by the terminal; Re-authenticating the data network of the terminal according to the authentication information to obtain a re-authentication result, wherein the re-authentication result includes: authentication success or authentication failure; Send the re-authentication result for the terminal to the fused SMF.

13. The method according to claim 12, characterized in that The method further comprises: Query the UDM address of the terminal through the network storage function NRF; According to the home UDM address, the SMF that provides session management service for the DNN of the terminal is queried from the home UDM.

14. The method according to claim 12, characterized in that The method further comprises: Pre-store authentication information corresponding to the terminal and the data network, the authentication information is used to perform data network authentication on the DNN of the terminal, or to perform data network authentication on the APN mapped by the DNN; the authentication information includes: a terminal identifier for data network authentication and / or verification information for data network authentication.

15. A data network re-authentication device, applied to a first network element, characterized in that: include: A first receiving module, configured to receive a first message from an authentication server, wherein the first message indicates that the authentication server requires data network re-authentication for the terminal; A first determination module is used to determine the access management network element of the terminal according to the session management context of the user, and the access management network element includes AMF or MME; A first sending module, configured to send a second message for re-authentication of the data network to the terminal through an access management network element; The device also includes: A second determination module is used to determine the authentication method of re-authentication according to the subscription data of the terminal, the interface protocol between the mobile network system where the terminal is located and the authentication server, and the first message; determine the second message according to the mobile network system where the terminal is located and the authentication method; Among them, the first network element is a converged session management function SMF in the 5G network, and the converged SMF also has the capability of the public data network gateway control plane in the 4G network core network.

16. A data network re-authentication device, applied to a terminal, characterized in that: include: A third receiving module is used to receive a second message for data network re-authentication of the terminal issued by the first network element through the access management network element, wherein the second message instructs the terminal to report authentication information corresponding to the data network, the authentication information including: a terminal identifier for data network authentication and / or verification information for data network authentication, and the access management network element includes an AMF or an MME; A fourth sending module, configured to report the authentication information to an authentication server according to the second message; A fourth receiving module, configured to receive a re-authentication result sent by the authentication server, wherein the re-authentication result includes: authentication success or authentication failure; The second message is determined by the first network element according to the mobile network system where the terminal is located and the authentication method, the authentication method is determined by the first network element according to the subscription data of the terminal, the interface protocol between the mobile network system where the terminal is located and the authentication server, and the first message, and the first message indicates that the authentication server requires data network re-authentication for the terminal; The first network element is a converged session management function SMF in a 5G network, and the converged SMF also has the capability of a public data network gateway control plane in a 4G network core network.

17. A data network re-authentication device, applied to an authentication server, characterized in that: include: A selection module is used to select a fusion SMF in a 5G network that provides session management services for the DNN of the terminal when a data network re-authentication request needs to be initiated for the terminal. The fusion SMF is used to determine the access management network element of the terminal according to the user's session management context. The access management network element includes an AMF or an MME. The fusion SMF also has the ability of a public data network gateway control plane in a 4G network core network; A fifth sending module, configured to send a data network re-authentication request for the terminal to the fusion SMF; A sixth receiving module, configured to receive authentication information corresponding to the data network reported by the terminal from the fusion SMF; A re-authentication module, configured to re-authenticate the data network of the terminal according to the authentication information to obtain a re-authentication result, wherein the re-authentication result includes: authentication success or authentication failure; The sixth sending module is used to send the re-authentication result for the terminal to the fusion SMF.

18. A terminal, characterized in that: include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein when the program is executed by the processor, the steps of the method according to any one of claims 7 to 11 are implemented.

19. A network side device, characterized in that: include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the steps of the method according to any one of claims 1 to 6, or the steps of the method according to any one of claims 12 to 14.

20. A readable storage medium, characterized in that: The readable storage medium stores a program, and when the program is executed by a processor, the steps of the method according to any one of claims 1 to 14 are implemented.

Images