A communication method and device

Abstract

A communication method and device, wherein the method comprises: a terminal sends first network information of a second network to a first network, the first network information includes first indication information of the second network, the first indication information is used to indicate that the terminal requests to access the second network; the terminal performs contract issuance authentication of the second network through the first network; when the contract issuance authentication of the second network is passed, the terminal receives the configuration information of the first network through the first network, and obtains the credentials of the second network from the online contract server of the second network through the first network. The above technical solution can solve the problem that the terminal cannot access the private network due to lack of relevant information.

Description

Technical Field

[0001] The present application relates to the field of wireless communication technology, and in particular to a communication method and device. Background Art

[0002] Public Network Integrated Non-Public Network (PNI-NPN) refers to a non-public network (NPN, referred to as private network) formed by the operator of the public network (PLMN, referred to as public network) dividing part of its own network resources (such as RAN, core network resources) to third-party manufacturers (such as enterprises, factories). Non-public networks can obtain independent and isolated resources, such as using the closed access group (CAG) cell mechanism to divide access network resources, and using slicing, dedicated data network name (DNN) and other mechanisms to divide core network resources.

[0003] In the PNI-NPN scenario, there are three entities, the terminal (for example, Volkswagen employees, with a mobile Subscriber Identity Module (SIM) card, and Volkswagen's private network application on the terminal), the public network (for example, the operator China Mobile) and the private network (for example, the car company Volkswagen). Volkswagen hopes that Volkswagen employees can obtain independent and isolated resources of the private network when using private network applications. For example: public network users cannot access the CAG cell, only Volkswagen employees can access the CAG cell, so the CAG cell has a better signal; public network users cannot access Volkswagen's data network, only Volkswagen employees can access the data network, so it has a higher security level.

[0004] In current technology, the terminal needs to access the private network based on the information related to accessing the private network that has been obtained on the terminal. However, it is possible that the terminal does not obtain the information related to accessing the private network before accessing the private network. For example, when a new employee of Volkswagen joins the company, he only has a USIM card of the operator China Mobile. At this time, his terminal does not have any information related to Volkswagen's private network, such as authentication credentials, so he cannot access Volkswagen's private network. However, there is no corresponding solution in the existing technology. Summary of the invention

[0005] The embodiments of the present application provide a communication method and device for solving the problem that a terminal cannot access a private network due to lack of relevant information.

[0006] In a first aspect, the present application provides a communication method, comprising:

[0007] The terminal sends first network information of the second network to the first network, where the first network information includes first indication information of the second network, and the first indication information is used to indicate that the terminal requests to access the second network;

[0008] The terminal performs a subscription authentication of the second network through the first network;

[0009] When the subscription issuance and authentication of the second network is passed, the terminal receives the configuration information of the first network through the first network, and obtains the credentials of the second network from the online subscription server of the second network through the first network.

[0010] In a possible implementation manner, the first network information may further include a subscription request indication, which is used to instruct a control plane network element of the first network to initiate a subscription authentication.

[0011] In a possible implementation manner, it is characterized in that the method further includes:

[0012] The terminal obtains the second network information of the second network from a broadcast message of the access network, and obtains the first network information based on the second network information; or the terminal obtains the network identifier of the second network from a broadcast message of the access network, obtains the second network information of the second network from a path information mapping network element based on the network identifier of the second network, and obtains the first network information based on the second network information; or the terminal obtains the second network information of the second network from an application server of the second network, and obtains the first network information based on the second network information.

[0013] In a possible implementation manner, the method further includes: the terminal accessing the second network according to the configuration information of the first network and the credentials of the second network.

[0014] In a possible implementation, the method further includes: the terminal receives a temporary indication returned by the first network, and starts a timer according to the temporary indication; when the timer times out, the terminal executes access to the second network based on the obtained configuration information of the first network and the credentials of the second network.

[0015] In a possible implementation manner, the configuration information of the first network includes access and mobility management related parameters and session management policies, and the access and mobility management related parameters and the session management policies are obtained by the first network according to the first subscription information of the second network.

[0016] In a possible implementation manner, the terminal obtaining the credential of the second network from the online signing server of the second network through the first network includes: the terminal obtaining an address of the online signing server, and obtaining the credential of the second network from the online signing server through a first session and the address of the online signing server, wherein the first session is a session established between the terminal and the first network.

[0017] In a possible implementation manner, the terminal obtaining the address of the online contract server includes: the terminal obtaining the address of the online contract server from the second network information; or the terminal receiving the address of the online contract server returned by the first network.

[0018] The first network is a public network, and the second network is a non-public network.

[0019] In a second aspect, the present application provides a communication method, comprising:

[0020] A control plane network element of a first network receives first network information of a terminal, where the first network information includes first indication information of a second network, and the first indication information is used to indicate that the terminal requests to access the second network; the control plane network element determines, based on the first network information of the terminal, that a contract signing authentication of the second network needs to be performed on the terminal, and triggers the contract signing authentication of the second network; when the contract signing authentication of the second network is passed, the control plane network element sends a third message to a storage function network element of the first network, to trigger the storage function network element to update user contract data of the terminal, and the message includes an identifier of the terminal and the second indication information of the second network.

[0021] In a possible implementation manner, the control plane network element sends a second message to the terminal, where the second message includes one or more of a temporary indication and an address of an online subscription server.

[0022] In a possible implementation manner, the second indication information is obtained by the control plane network element according to the first indication information.

[0023] In a possible implementation manner, the second indication information is the same as the first indication information.

[0024] In a possible implementation manner, the control plane network element obtains the address of the online contract authentication device according to the first indication information of the second network, and sends a first message to the online contract authentication device to trigger contract issuance authentication of the second network.

[0025] In a possible implementation manner, the control plane network element obtains the address of the online signing server corresponding to the second network according to the first indication information of the second network.

[0026] In a possible implementation manner, the control plane network element determining, according to the first network information of the terminal, that it is necessary to perform subscription issuance authentication for the second network on the terminal includes:

[0027] The control plane network element searches for the second subscription information of the second network according to the first network information, and determines that the terminal needs to be authenticated for subscription issuance of the second network according to the second subscription information of the second network; or

[0028] The control plane network element determines, according to the subscription request indication included in the first network information, that it is necessary to perform subscription issuance authentication for the second network on the terminal.

[0029] The first network is a public network, and the second network is a non-public network.

[0030] In a third aspect, the present application provides a communication method, comprising:

[0031] The storage function network element of the first network receives a third message from the control plane network element of the first network, which is used to trigger updating of user subscription data of the first network of the terminal, wherein the third message carries an identifier of the terminal and second indication information of the second network;

[0032] The storage function network element obtains the first subscription data corresponding to the second network according to the second indication information of the second network,

[0033] The storage function network element updates the user subscription data of the terminal according to the first subscription data of the second network.

[0034] In a possible implementation manner, the storage function network element updates configuration information on the terminal.

[0035] In a possible implementation, the configuration information includes a session management policy, and the storage function network element updates the configuration information on the terminal including: the storage function network element sends a subscription data change notification to the policy control network element, triggering the policy control network element to update the session management policy on the terminal.

[0036] In one possible implementation, the configuration information includes access and mobility management related parameters, and the storage function network element updates the configuration information on the terminal, including: the storage function network element obtains the access and mobility management related parameters according to the first subscription information of the second network, and sends the access and mobility management related parameters to the terminal.

[0037] In a possible implementation manner, the first subscription data of the second network includes a data network name DNN.

[0038] In a possible implementation, the first subscription data of the second network may also include one or more of network slice selection auxiliary information NSSAI, non-open access group identifier CAG ID, slice identifier privacy indication, secondary authentication execution indication, slice authentication execution indication and user plane protection policy.

[0039] The first network is a public network, and the second network is a non-public network.

[0040] In a fourth aspect, the present application provides a communication method, comprising:

[0041] The terminal sends first network information of the second network to the first network, where the first network information includes first indication information of the second network, and the first indication information is used to indicate that the terminal requests to access the second network;

[0042] The terminal performs a subscription authentication of the second network through the first network;

[0043] When the subscription and authentication of the second network fails, the terminal selects the first network information of the third network and sends the first network information of the third network to the first network.

[0044] In a fifth aspect, an embodiment of the present application provides a communication device, which has the function of implementing the terminal in the first aspect or any possible implementation of the first aspect, or has the function of implementing the control plane network element in the second aspect or any possible implementation of the second aspect, or has the function of implementing the storage function network element in the third aspect or any possible implementation of the third aspect, or has the function of implementing the terminal in the fourth aspect or any possible implementation of the fourth aspect.

[0045] The device may be a terminal or a chip included in the terminal. The functions of the above communication equipment may be implemented by hardware or by hardware executing corresponding software, and the hardware or software may include one or more modules corresponding to the above functions.

[0046] The device may be a network device or a chip included in the network device. The functions of the above communication equipment may be implemented by hardware or by hardware executing corresponding software, wherein the hardware or software includes one or more modules corresponding to the above functions.

[0047] In one possible design, the structure of the device includes a processing module and a transceiver module, wherein the processing module is configured to support the device to execute the method in the first aspect or any possible implementation of the first aspect, or to execute the method in the second aspect or any possible implementation of the second aspect, or to execute the method in the third aspect or any possible implementation of the third aspect, or to execute the method in the fourth aspect or any possible implementation of the fourth aspect. The transceiver module is used to support communication between the device and other communication devices.

[0048] In another possible design, the structure of the device includes a processor and may also include a memory. The processor is coupled to the memory and can be used to execute computer program instructions stored in the memory so that the device executes the method in the first aspect or any possible implementation of the first aspect, or executes the method in the second aspect or any possible implementation of the second aspect, or executes the method in the third aspect or any possible implementation of the third aspect, or executes the method in the fourth aspect or any possible implementation of the fourth aspect. Optionally, the device also includes a communication interface, and the processor is coupled to the communication interface. When the device is a network device, the communication interface can be a transceiver or an input / output interface; when the device is a chip included in the network device, the communication interface can be an input / output interface of the chip. Optionally, the transceiver can be a transceiver circuit, and the input / output interface can be an input / output circuit.

[0049] In a sixth aspect, an embodiment of the present application provides a chip system, comprising: a processor, the processor being coupled to a memory, the memory being used to store programs or instructions, and when the program or instructions are executed by the processor, the chip system implements the method in the above-mentioned first aspect or any possible implementation of the first aspect, or executes the method in the above-mentioned second aspect or any possible implementation of the second aspect, or executes the method in the above-mentioned third aspect or any possible implementation of the third aspect, or executes the above-mentioned fourth aspect or any possible implementation of the fourth aspect.

[0050] Optionally, the chip system also includes an interface circuit, which is used to interact with code instructions to the processor.

[0051] Optionally, there may be one or more processors in the chip system, and the processor may be implemented by hardware or software. When implemented by hardware, the processor may be a logic circuit, an integrated circuit, etc. When implemented by software, the processor may be a general-purpose processor implemented by reading software code stored in a memory.

[0052] Optionally, the memory in the chip system may be one or more. The memory may be integrated with the processor or may be separately provided with the processor, which is not limited in the present application. Exemplarily, the memory may be a non-transient processor, such as a read-only memory ROM, which may be integrated with the processor on the same chip or may be provided on different chips. The present application does not specifically limit the type of memory and the arrangement of the memory and the processor.

[0053] In the seventh aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program or instruction stored thereon. When the computer program or instruction is executed, the computer executes the method in the first aspect or any possible implementation of the first aspect, or executes the method in the second aspect or any possible implementation of the second aspect, or executes the method in the third aspect or any possible implementation of the third aspect, or executes the method in the fourth aspect or any possible implementation of the fourth aspect.

[0054] In an eighth aspect, an embodiment of the present application provides a computer program product. When a computer reads and executes the computer program product, the computer executes the method in the first aspect or any possible implementation of the first aspect, or executes the method in the second aspect or any possible implementation of the second aspect, or executes the method in the third aspect or any possible implementation of the third aspect, or executes the method in the fourth aspect or any possible implementation of the fourth aspect.

[0055] In a ninth aspect, an embodiment of the present application provides a communication system, which includes the above-mentioned control plane network element and storage network element. Optionally, the communication system may also include other network devices and / or terminals. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 A schematic diagram of a network architecture of a communication system applicable to an embodiment of the present application;

[0057] Figure 2 A schematic diagram of a 5G network architecture applicable to an embodiment of the present application;

[0058] Figure 3 A communication diagram of a method for a terminal to access a private network in the prior art;

[0059] Figure 4 A flow chart of a communication method provided in an embodiment of the present application;

[0060] Figure 5 A specific example of a communication method provided in an embodiment of the present application;

[0061] Figure 6 Another specific example of a communication method provided in an embodiment of the present application;

[0062] Figure 7 A schematic diagram of a method for a terminal to obtain second network information of a private network provided in an embodiment of the present application;

[0063] Figure 8 A schematic diagram of a communication device provided for this application;

[0064] Fig. 9 A schematic diagram of a communication device provided for this application;

[0065] Fig.10 A schematic diagram of a chip provided for this application;

[0066] Fig.11 A terminal schematic diagram provided for this application. DETAILED DESCRIPTION

[0067] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the embodiments of the present application will be further described in detail below with reference to the accompanying drawings.

[0068] The communication method provided in the embodiment of the present application can be applied to a variety of system architectures. The network architecture and business scenarios described in the embodiment of the present application are intended to more clearly illustrate the technical solutions of the embodiment of the present application, and do not constitute a limitation on the technical solutions provided in the embodiment of the present application. It is known to those skilled in the art that with the evolution of the network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiment of the present application are also applicable to similar technical problems.

[0069] like Figure 1 As shown, it is a schematic diagram of a possible network architecture applicable to an embodiment of the present application. The PNI-NPN network architecture includes a terminal, a public network, an online contract service provider (Service Provider, SP), and a private network.

[0070] Among them, the terminal is a device with wireless transceiver function, which can be deployed on land, including indoors or outdoors, handheld, wearable or vehicle-mounted; it can also be deployed on the water surface (such as ships, etc.); it can also be deployed in the air (for example, on airplanes, balloons and satellites, etc.). The terminal can communicate with the core network via the radio access network (RAN) and exchange voice and / or data with the RAN. The terminal can be a mobile phone, a tablet computer (Pad), a computer with wireless transceiver function, a mobile Internet device (MID), a wearable device, a virtual reality (VR) terminal, an augmented reality (AR) terminal, a wireless terminal in industrial control, a wireless terminal in self driving, a wireless terminal in remote medical, a wireless terminal in smart grid, a wireless terminal in transportation safety, a wireless terminal in smart city, a wireless terminal in smart home, etc. The embodiments of the present application do not limit the application scenarios. The terminal may sometimes also be referred to as a terminal device, user equipment (UE), a mobile station, and a remote station. The embodiments of the present application do not limit the specific technology, device form, and name adopted by the terminal. In the present application, the terminal may be a terminal with an interface or a terminal without an interface. A terminal with an interface means that the user can control the terminal using an APP or other methods; a terminal without an interface means that the user has limited control over the terminal and can only perform simple control and status observation through buttons or indicator lights.

[0071] The PLMN network is an operationally deployed network, specifically including access network equipment, access management network elements, session management network elements, user plane network elements, policy control network elements, authentication service function network elements, unified data management network elements, unified data storage network elements, network capability exposure network elements, etc. The PLMN network may also include other network elements, which are not limited in the embodiments of the present application.

[0072] (1) Access network equipment is a device in the network used to connect a terminal to a wireless network. The access network equipment may be a node in a wireless access network, also known as a base station, or a radio access network (RAN) node (or device). The network device may include an evolved base station (NodeB or eNB or e-NodeB, evolutionary Node B) in a long term evolution (LTE) system or an evolved LTE system (LTE-Advanced, LTE-A), such as a traditional macro base station eNB and a micro base station eNB in ​​a heterogeneous network scenario, or may also include a next generation node B (next generation node B, gNB) in a fifth generation mobile communication technology (5th generation, 5G) new radio (new radio, NR) system, or may also include a radio network controller (radio network controller, RNC), a node B (Node B, NB), a base station controller (base station controller, BSC), a base transceiver station (base transceiver station, BTS), a transmission reception point (transmission reception point, TRP), a home base station (for example, home evolved NodeB, or home Node B, HNB), a base band unit (base band unit, BBU), a base band pool BBU pool, or a WiFi access point (access point, AP), etc., or may also include a cloud access network (cloud radio access The embodiments of the present application do not limit the centralized unit (CU) and distributed unit (DU) in the CloudRAN network system. In the separate deployment scenario where the access network equipment includes CU and DU, CU supports protocols such as radio resource control (RRC), packet data convergence protocol (PDCP), and service data adaptation protocol (SDAP); DU mainly supports radio link control layer (RLC), media access control layer (MAC) and physical layer protocols.

[0073] (2) Access management network element, mainly used for the attachment, mobility management, and tracking area update process of terminals in mobile networks. The access management network element terminates non-access stratum (NAS) messages, completes registration management, connection management, and reachability management, allocates tracking area lists (TA lists) and mobility management, and transparently routes session management (SM) messages to the session management network element. In the fifth generation (5G) communication system, the access management network element may be an access and mobility management function (AMF). In future communication systems (such as 6G communication systems), the mobility management network element may still be an AMF network element, or may have other names, which are not limited in this application.

[0074] (3) Session management network element, mainly used for session management in mobile networks, such as session establishment, modification, and release. Specific functions include allocating Internet Protocol (IP) addresses to terminals, selecting user plane network elements that provide message forwarding functions, etc. In 5G communication systems, the session management network element can be a session management function (SMF). In future communication systems (such as 6G communication systems), the session management network element can still be an SMF network element, or it can have other names, which are not limited in this application.

[0075] (4) User plane network element, mainly used to process user messages, such as forwarding, billing, legal monitoring, etc. The user plane network element can also be called a protocol data unit (PDU) session anchor (PSA). In a 5G communication system, the user plane network element can be a user plane function (UPF). In future communication systems (such as 6G communication systems), the user plane network element can still be a UPF network element, or it can have other names, which is not limited in this application.

[0076] (5) Policy control network element, including user subscription data management function, policy control function, charging policy control function, quality of service (QoS) control, etc. In the 5G communication system, the policy control network element may be a policy control function (PCF). In future communication systems (such as 6G communication systems), the policy control network element may still be a PCF network element, or may have other names, which are not limited in this application.

[0077] (6) Authentication service function network element, mainly used for terminal security authentication. In the 5G communication system, the authentication service function network element may be an authentication server function (AUSF). In future communication systems (such as 6G communication systems), the authentication service function network element may still be an AUSF network element, or may have other names, which are not limited in this application.

[0078] (7) Data management network element, mainly used to manage user contract data of the terminal. In the 5G communication system, the unified data management network element may be unified data management (UDM). In future communication systems (such as 6G communication systems), the unified data management network element may still be the UDM network element, or may have other names, which are not limited in this application.

[0079] (8) Data storage network element, mainly used to store structured data information, including user contract data, policy information, and network data or service data defined in a standard format. In a 5G communication system, the unified data storage network element may be a unified data repository (UDR). In future communication systems (such as a 6G communication system), the unified data storage network element may still be a UDR network element, or may have other names, which are not limited in this application.

[0080] (9) Network capability exposure network element, which can expose some functions of the network to applications in a controlled manner. In a 5G communication system, a network capability exposure network element can be a network exposure function (NEF). In future communication systems (such as a 6G communication system), a network capability exposure network element can still be a NEF network element, or it can have other names, which are not limited in this application.

[0081] Among them, in the PNI-NPN architecture, the private network is enabled through the public network, for example, obtaining public network resources through proprietary DNN, or proprietary slices or CAG, etc. For example, when using a proprietary DNN, the private network can obtain proprietary user plane resources (for example, obtaining UPF resources that are only accessible to private network devices), when using a proprietary slice, the private network can obtain proprietary control plane resources (for example, obtaining AMF and SMF resources that are only accessible to private network devices), and when using CAG, the private network can obtain proprietary access network resources (for example, obtaining cells that are only accessible to private network devices, such as CAG cells).

[0082] The private network may include a private network server (NPN Server) and a private network authentication device (Non-Public Network Authentication, Authorization, and Accounting, NPN AAA). The private network server is used to provide private network services to private network terminals, and the private network authentication device is used to determine whether the terminal is allowed to access the private network. The private network server and the private network authentication device can be devices deployed in one, or they can be two independent devices, which is not limited in this application.

[0083] In the PNI-NPN architecture, how a terminal uses the public network to access a private network requires the terminal to have the configuration information of the public network and the credential information for accessing the private network. At the same time, how the public network determines whether the terminal uses the public network to access the private network requires the terminal's contract information. In addition, how the private network determines whether the terminal is allowed to access the private network requires the private network to have the credential information of the terminal. In order to complete these configurations, an online contract service provider needs to be introduced.

[0084] Among them, the online contract service provider (SP) may include an online contract server (Online Sign-up server, OSU server) and an online contract authentication device (OSU AAA server). The online contract server is used to generate contract data for the private network to the terminal during the online contract process, and the online contract authentication device is used to authenticate the terminal during the online contract process. The online contract server and the online contract authentication device can be a device deployed in one, or two independent devices, which is not limited in this application.

[0085] If the SP is independent of the other three roles, then there is an agreement between the NPN and the SP, and the NPN requires the SP to perform account opening services for it; the SP also has an agreement with the PLMN, and the SP requires the PLMN to perform account opening services for it. At this time, the OSU and the NPN are in different DNNs, and the OSU AAA can be deployed on the user plane through the N6 interface or on the control plane through the Naf interface. The OSU AAA can also be directly co-located with the OSU. If the SP also belongs to the NPN, then there is an agreement between the NPN and the PLMN, and the NPN requires the PLMN to perform account opening services for it. At this time, the OSU and the NPN are in the same DNN, and the OSU AAA can be deployed on the user plane through the N6 interface or on the control plane through the Naf interface. The OSU AAA can also be directly co-located with the OSU or NPN AAA.

[0086] It is understandable that the above network element or function can be a network element in a hardware device, a software function running on dedicated hardware, or a virtualized function instantiated on a platform (e.g., a cloud platform). The above functions can be divided into one or more services, and further, services that exist independently of the network functions may also appear. In this application, an instance of the above function, or an instance of a service included in the above function, or an instance of a service that exists independently of the network function can be referred to as a service instance.

[0087] like Figure 2 As shown, Figure 2 As shown, taking the 5G communication system as an example, it is a schematic diagram of a specific possible network architecture applicable to the embodiment of the present application, including terminal, RAN, AMF, SMF, UPF, PCF, UDM, NEF, UDR, OSU AAA, NPN AAA, OSUserver, NPN Server, etc. Among them, network elements such as AMF, SMF, UDM, UDR, PCF, etc. can interact using service interfaces. For example: the service interface provided by AMF to the outside is Namf; the service interface provided by SMF to the outside is Nsmf; the service interface provided by UDM to the outside is Nudm; the service interface provided by UDR is Nudr; the service interface provided by PCF is Npcf. Figure 2The N1 interface is the reference point between UE and AMF; the N2 interface is the reference point between RAN and AMF, used for sending non-access stratum (NAS) messages and next generation application protocol (NGAP) messages; the N3 interface is the reference point between RAN and UPF, used for transmitting user plane data; the N4 interface is the reference point between SMF and UPF, used for transmitting information such as tunnel identification information of N3 connection, data cache indication information, and downlink data notification messages; the N6 interface is the reference point between UPF and DN, used for transmitting user plane data.

[0088] For the convenience of explanation, this application will be described later by taking the access management network element as the AMF network element, the session management network element as the SMF network element, the authentication service function network element as the AUSF network element, the unified data storage network element as the UDR network element, the unified data management network element as the UDM network element, and the policy control network element as the PCF network element as an example. Furthermore, the AMF network element is referred to as AMF, the SMF network element is referred to as SMF, the AUSF network element is referred to as AUSF, the UDR network element is referred to as UDR, the UDM network element is referred to as UDM, and the PCF network element is referred to as PCF. That is, the AMF described later in this application can be replaced with an access management network element, the SMF can be replaced with a session management network element, the AUSF can be replaced with an authentication service function network element, the UDR can be replaced with a unified data storage network element, the UDM can be replaced with a unified data management network element, and the PCF can be replaced with a policy control network element.

[0089] It should be noted that the terms "system" and "network" in the embodiments of the present application can be used interchangeably. "Multiple" refers to two or more. In view of this, "multiple" can also be understood as "at least two" in the embodiments of the present application. "At least one" can be understood as one or more, for example, one, two or more. For example, including at least one means including one, two or more, and there is no restriction on which ones are included. For example, including at least one of A, B and C, then A, B, C, A and B, A and C, B and C, or A and B and C can be included. Similarly, the understanding of descriptions such as "at least one" is similar. "And / or" describes the association relationship of associated objects, indicating that three relationships can exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / ", unless otherwise specified, generally indicates that the associated objects before and after are in an "or" relationship.

[0090] Unless otherwise specified, the embodiments of the present application mention ordinal numbers such as "first" and "second" for distinguishing between multiple objects, and are not used to limit the order, timing, priority or importance of multiple objects, and the descriptions of "first" and "second" do not limit the objects to be different.

[0091] Figure 3 This is the process of UE accessing the private network from the public network in the PNI-NPN scenario in the existing 5G technology, where it is assumed that the UE has obtained the configuration information and private network credentials. It specifically includes the following steps:

[0092] S301. RAN broadcasts CAG ID.

[0093] S302. The UE selects a network according to the configured mobility restriction policy. The mobility restriction policy can be used to indicate the cells that the UE can access. When selecting a network, the UE selects the CAG ID indicated by the mobility restriction. The mobility restriction policy is dynamically configured by the PLMN for the UE.

[0094] S303. The UE determines whether it is necessary to carry network slice selection support information (NSSAI) in the RRC message based on the slice identifier privacy indication (Inclusion of NSSAI in RRCConnection Establishment Allowed) obtained in the last registration to protect the UE's privacy information.

[0095] S304.UE sends an RRC message to RAN. The message determines whether to carry NSSAI according to the Inclusion of NSSAI in RRCConnection Establishment Allowed indication. The RRC message may be an RRC establishment complete message. The UE also sends a registration request message to AMF. The registration request message may include the subscribed NSSAI set. The registration request message may be loaded on the RRC message. The subscribed NSSAI set may be pre-configured on the terminal or dynamically configured by the PLMN for the UE.

[0096] S305. If the RRC message carries NSSAI, the RAN selects an appropriate AMF based on the NSSAI.

[0097] S306.RAN forwards the registration request message to AMF.

[0098] S307. The UE and the PLMN network perform the first authentication based on the UE ID (SUPI) and the PLMN authentication credential (K). The authentication path is UE-AMF-AUSF-UDM.

[0099] S308.AMF queries UDM for UE’s user subscription data.

[0100] S309. UDM returns the user subscription data related to the UE's mobility management, including the allowed NSSAI, the CAG allowed to access, the Inclusion of NSSAI in RRC Connection Establishment Allowed, and the secondary authentication indication.

[0101] S310.AMF determines whether the NSSAI requested by the UE is allowed based on the NSSAI in the NAS message and the NSSAI obtained from the user subscription data.AMF determines whether the UE is allowed to access the CAG cell based on the CAG ID and the currently connected base station.

[0102] S311.AMF sends a Registration Accept message to the UE, which includes the Inclusion of NSSAI in RRCConnection Establishment Allowed indication. The UE can update the parameter it has saved.

[0103] S312. Optionally, after AMF completes registration, slice authentication is triggered according to Slice Authentication Indication and / or NSSAI and local policy. At this time, UE and AAA2 complete slice authentication based on NPN credentials. The authentication path is UE-AMF-AAA P-AAA2.

[0104] S313.UE uses the terminal route selection policy (URSP) configured by the PLMN (the mapping relationship between the application and the DNN and / or NSSAI), that is, when the UE activates an application, the application triggers the UE to query the URSP to obtain the DNN and NSSAI (optional). The UE uses the DNN and NSSAI (optional) to initiate the PDU session establishment process, that is, to send a UL NASTRANSPORT message, which carries the DNN, NSSAI (optional) and the PDU session establishment request message.

[0105] S314.AMF selects SMF based on DNN and / or NSSAI, and sends DNN and / or NSSAI, PDU session establishment request message to SMF.

[0106] S315.SMF obtains the user subscription data of UE from UDM.

[0107] S316.UDM returns user subscription data related to UE session management, including allowed NSSAI, allowed DNN, user plane security policy (User Plane Security Policy), and Secondary Authentication Indication.

[0108] S317.SMF determines whether the requested NSSAI is allowed based on the received NSSAI and the NSSAI obtained from the user's contract data. SMF determines whether the requested DNN is allowed based on the received DNN and the DNN obtained from the user's contract data. SMF triggers secondary authentication based on Secondary Authentication Indication and / or DNN and / or NSSAI and local policy.

[0109] S318.UE and AAA2 complete secondary authentication based on NPN credentials. The authentication path is UE-SMF-UPF-NPN AAA2.

[0110] S319.SMF sends a PDU session establishment receive message to the UE. SMF sends an N2 container including the User PlaneSecurity Policy to the RAN.

[0111] S320.RAN determines whether to activate encryption and integrity protection of the user plane of the UE according to the User Plane Security Policy.

[0112] exist Figure 3 In the PNI-NPN scenario described in the specification, the process of UE accessing the private network from the public network can be seen. The information required for UE side to access the private network includes: mobility restriction (used to select CAG ID), slice identifier privacy indication (used to indicate whether NSSAI is carried in RRC), URSP (used to indicate the mapping relationship between NPN application and NPN DN / NSSAI), and private network credentials used for secondary authentication / slice authentication.

[0113] exist Figure 3 In the PNI-NPN scenario described in the figure, the process of UE accessing the private network from the public network shows that the public network needs to pre-configure user subscription data, as shown in Table 1 below.

[0114] Table 1

[0115]

[0116]

[0117] exist Figure 3 In the PNI-NPN scenario described in the text, it can be seen that the process of UE accessing the private network from the public network requires the private network to pre-configure the UE's private network credentials.

[0118] The existing technology assumes that the terminal, public network and private network already have this information, and defines how the terminal uses this information to access the network. However, before the terminal opens an account in the private network, the terminal, public network and private network do not have any of this information. How the terminal, public network and private network obtain and synchronize this information is a problem that needs to be solved.

[0119] In order to solve the above problem, the embodiment of the present application provides a communication method. In the embodiment of the present application, the terminal can obtain the above information required by online signing.

[0120] First, the relevant terms involved in the embodiments are introduced as follows:

[0121] (1) Indication information of a private network: used to identify a private network. The indication information of a private network may be one or more of DNN, CAG ID, NSSAI and NPN ID. The indication information of a private network may be the first indication information of a private network or the second indication information of a private network. The first indication information and the second indication information are both used to identify the same private network. They may be the same indication information, but they may also be different indication information (in different information formats). For example: when identifying the first private network, the first indication information is the DNN of the first private network, and the second indication information is the NPN ID of the first private network (that is, either the DNN or the NPN ID can identify the first private network). When the DNN cannot uniquely identify a private network, the NPN ID may be used to identify a private network, or the DNN and the NPN ID may be used together to identify a private network. Among them:

[0122] DNN: used to identify the data network that the terminal can access. When a DNN is assigned to a private network, it can be used to identify a private network.

[0123] CAG ID: used to identify the cell that the terminal can access. When a CAG ID is assigned to a private network, it can be used to identify a private network.

[0124] NSSAI: used to identify the slices accessible to the terminal. When an NSSAI is assigned to a private network, it can be used to identify a private network.

[0125] NPN ID: used to identify a private network, which can be a string used to identify the private network.

[0126] (2) The first contract information of the private network: at the granularity of the private network, information related to a private network can be configured on the storage function network element of the public network. It can be understood that the first contract information corresponding to multiple private networks can be configured on the public network. The first contract information of the private network is pre-configured on the storage function network element of the public network, and the storage function network element of the public network can update the contract data of the terminal on the public network according to the first contract information of the private network. The first contract information includes indication information of the private network. Optionally, it may also include any one or more of the following: DNN, NPN ID, Network Slice Selection Assistance Information (NSSAI), CAG ID, slice identification privacy indication, secondary authentication execution indication, slice authentication execution indication, and user plane protection policy, etc. Among them:

[0127] Slice identifier privacy indication: that is, Inclusion of NSSAI in RRC Connection EstablishmentAllowed, is used to indicate whether the slice identifier NSSAI requires confidentiality protection.

[0128] Slice Authentication Indication: Slice Authentication Indication is used to indicate whether to perform slice authentication to determine whether to allow the terminal's slice access. When a private network uses a dedicated slice to obtain public network resources, the terminal can perform slice authentication when accessing the private network.

[0129] Secondary Authentication Indication: Secondary Authentication Indication is used to indicate whether to perform secondary authentication to determine whether to allow the terminal's PDU session to be established. When a private network uses a dedicated DNN to obtain public network resources, the terminal can perform secondary authentication when accessing the private network.

[0130] User plane protection policy: User Plane Security Policy, which is used to indicate the security protection policy of the terminal, which can be an encryption protection indication at the PDU session granularity (required, preferred, not needed), and / or an integrity protection indication at the PDU session granularity (required, preferred, not needed).

[0131] The specific configuration method can be that the private network is pre-configured to the storage function network element of the public network through the capability exposure interface, or the public network operator configures it to the storage function network element of the public network according to the agreement signed with the private network.

[0132] Specific update methods may include adding, overwriting and other methods. When the update parameter of the first subscription of the private network is a new value, the storage function network element adds the new value to the current value. When the update parameter of the first subscription of the private network is an existing value, the storage function network element overwrites the new value with the current value. For example, when the storage function network element pre-updates the DNNlist of the terminal, the storage function network element adds the DNN of the first subscription of the private network to the current DNN list. When the storage function network element pre-updates the slice identifier privacy indication of the terminal, the storage function network element overwrites the slice identifier privacy indication of the first subscription of the private network with the current slice identifier privacy indication of the terminal.

[0133] (3) Second contract information of a private network: information related to a private network that can be configured on a control plane network element on a public network at a private network granularity. It is understandable that the public network can be configured with second contract information corresponding to multiple private networks. The second contract information of a private network can be configured on a control plane network element on a public network.

[0134] The second contract information includes: private network indication information, online contract authentication device address. Optionally, it also includes online contract device address, online contract device and / or private network DNN, NPN ID, NSSAI, CAG ID, and local policy.

[0135] Online signing and authentication device address: used to address the online signing and authentication device, which can be the IP address, Ethernet address, etc. of the online signing and authentication device.

[0136] Online signing device address: used to address the online signing device, which can be the IP address, Ethernet address, etc. of the online signing device.

[0137] Local policy: used to indicate whether the private network indicated by the indication information of the private network needs to perform online contract authentication, so as to assist the control plane network element in deciding whether to perform online contract authentication based on the indication information of the private network. For example, when the control plane network element obtains the indication information of the private network, when the local policy indicates that the private network indicated by the indication information of the private network needs to perform online contract authentication, the control plane network element decides to perform online contract authentication.

[0138] (4) User subscription data of the terminal on the public network: that is, subscription date. The user subscription data of the terminal on the public network can be updated according to the first subscription information of the private network.

[0139] (5) Terminal configuration information: Access and mobility management parameters used by the terminal to select a private network and the terminal's session management policy for establishing a private network session. Access and mobility management parameters include mobility restriction and allowed NSSAI. The terminal's session management policy includes URSP. Among them,

[0140] Mobility restriction: used to control the service access of the terminal. In particular, if the mobility restriction contains a CAG ID, it can indicate that the terminal is allowed to access the CAG cell corresponding to the CAG ID.

[0141] Allowed NSSAI: used to indicate the NSSAI that the terminal is allowed to access.

[0142] URSP: Used to instruct the terminal to decide how to route an external data flow.

[0143] (6) The private network credentials of the terminal: used by the private network to determine whether the terminal is allowed to access the private network, including the private network authentication credentials of the terminal, and optionally, the private network identity of the terminal.

[0144] Private network identity: used to identify the terminal in the private network, which can be GPSI.

[0145] Private network authentication credentials: used for private network authentication terminals (for example, AAA2 authentication terminals), which can be certificates, symmetric keys, etc.

[0146] (7) Online signing: issuing network authentication credentials to a terminal without network authentication credentials so that the terminal can use the authentication credentials to access the network.

[0147] First, you can perform the following preset steps to configure private network related information in the public network.

[0148] (i) The first contract information of the private network is configured on the storage function network element of the public network, so that when the terminal successfully opens an account in the private network, the public network can update the contract data of the terminal in the public network according to the first contract information of the private network.

[0149] The storage function network element may be a data management network element and / or a data storage network element, wherein the data management network element and the data storage network element may be combined into one network element, or may be two independent network elements.

[0150] (ii) Optionally, the second contract information of the private network is configured on the control plane network element of the public network so that the control plane network element can obtain the corresponding online contract authentication device address or online contract server address according to the second contract information.

[0151] The control plane network element may be a session management network element or an access management network element.

[0152] Specifically, the communication method includes the following steps:

[0153] S401. A terminal sends first network information of a private network to a control plane network element of a public network, where the first network information includes first indication information of the private network.

[0154] The first indication information of the private network is used to indicate the private network that the terminal requests to access, or is used to indicate the private network that the terminal requests to perform online signing, or indicates the private network that the terminal requests to perform online signing.

[0155] Among them, the first indication information of the private network may include DNN, NSSAI, CAG ID, and NPN ID.

[0156] Optionally, the first network information may further include a contract signing request indication, where the contract signing request indication is used to indicate that the control plane network element needs to initiate contract signing authentication.

[0157] The terminal sending the first network information of the private network to the public network includes: the terminal sending the first network information of the private network to the control plane network element of the public network, which can be specifically implemented in any of the following ways:

[0158] Method 1: When the control plane network element is an access management network element, the terminal sends a first NAS message of a private network to the access management network element, and the message carries the first network information of the private network. The first NAS message may be a newly added message. For details, please refer to the subsequent Figure 6 Corresponding embodiment 2

[0159] Method 2: When the control plane network element is a session management network element, the terminal sends a session request message to the session management network element to request to establish a first session, and the session request message carries the first network information of the private network. Figure 5 Corresponding embodiment 1

[0160] Optionally, before step S401, the method further includes: the terminal obtains the second network information of the private network, and obtains the first network information of the private network according to the second network information. The first network information may include all or part of the content in the second network information. The second network information includes: one or more of CAG ID, DNN, NSSAI, AAA address, OSU address, NPNID, etc.

[0161] The terminal obtains the second network information of the private network, which specifically includes: the terminal can obtain the second network information of one or more private networks. The process can be specifically carried out in any of the following ways:

[0162] Mode A: The terminal obtains the second network information of one or more private networks from the broadcast message of the access network:

[0163] The access network broadcasts the second network information of the plurality of private networks. Optionally, the access network also broadcasts an online contract support indication corresponding to the second network information, where the online contract support indication is used to indicate that the private network corresponding to the second network information supports online contract.

[0164] The terminal obtains the second network information of one or more private networks from the broadcast message of the access network, specifically including:

[0165] The terminal obtains multiple pieces of second network information from the broadcast. Optionally, if the access network also broadcasts an online signing support indication corresponding to the second network information, the terminal only obtains all second network information including the online signing support indication from the broadcast.

[0166] The terminal can also display the private network corresponding to the second network information on the terminal interface according to the multiple second network information broadcasted in the broadcast. Optionally, the terminal only selects the private network corresponding to all the second network information containing the online signing indication from the broadcast. The user selects from all the displayed private networks, and after the user selects a private network, the terminal obtains the second network information of the private network.

[0167] Method B: The terminal obtains one or more private network access network identifiers from the broadcast message of the access network, and obtains the second network information of the private network from the path information mapping network element according to the private network access network identifier; for details, please refer to Figure 7 The corresponding embodiment three.

[0168] Method C: The terminal obtains the second network information from the application server in the private network:

[0169] A specific implementation method is: the terminal sends an application request to the private network application server through the user to request the second network information of the private network. The private network application server sends an application reply message to the terminal, and the reply message includes the second network information of the private network.

[0170] The terminal obtains the first network information of the private network according to the second network information, specifically including:

[0171] If the terminal obtains the second network information of multiple private networks, the terminal selects a private network corresponding to the second network information from the second network information of the multiple private networks and obtains the first network information of the private network. Optionally, the terminal can select one by one or select a private network with a stronger signal according to the signal strength.

[0172] The terminal obtains the first network information of the private network based on part or all of the second network information of the private network. For example, if the second network information of the private network includes CAG ID, DNN, NSSAI, online contract authentication device address, and online contract server address, the terminal can select DNN as the first network information of the private network.

[0173] S402. Optionally, the control plane network element determines, based on the first network information, that a contract signing authentication needs to be performed on the terminal, where the contract signing authentication is used to authorize the authenticated terminal to perform online contract signing.

[0174] Specifically, you can use any of the following methods to determine whether the terminal needs to be signed and authenticated:

[0175] Method 1: search for the second contract information of the private network according to the first indication information of the private network in the first network information (for example, search for the policy in the second contract information of the private network), and determine the need for contract issuance and authentication of the terminal according to the second contract information of the private network.

[0176] Method 2: According to the contract signing request indication in the first network information (used to indicate the need for contract signing authentication), it is determined that the terminal needs to be authenticated under the contract signing.

[0177] S403: The control plane network element triggers the signing and issuing authentication process between the terminal and the online signing and authentication device.

[0178] Optionally, the control plane network element sends a first message to the online contract authentication device to trigger a contract issuance authentication process between the terminal and the online contract authentication device.

[0179] Optionally, the control plane network element sends a first message to the terminal to trigger a contract signing and authentication process between the terminal and the online contract authentication device.

[0180] Optionally, before step S403, the method also includes: the control plane network element queries the second contract information of the private network according to the first indication information of the private network to obtain the online contract authentication device address, wherein the second contract data includes the correspondence between the online contract authentication device address and the first indication information of the private network.

[0181] If the control plane network element queries the second contract information according to the indication information of the private network to obtain the addresses of two online contract authentication devices (for example, AAA1 is used for contract issuance authentication, and AAA2 is used for secondary authentication after the terminal obtains the credentials of the private network), the control plane network element can further determine the need to send a first message to the corresponding AAA1 to trigger the contract issuance authentication according to the contract request indication.

[0182] S404, the terminal signs and authenticates the contract with the online contract authentication device through the public network.

[0183] Specifically, the control plane network element serves as an intermediate node to transfer authentication signaling between the terminal and the online contract authentication device, thereby realizing two-way authentication between the terminal and the online contract authentication device.

[0184] For example, when the control plane network element is an access management network element, the private network contract authentication between the terminal and the online contract authentication device can be a slice authentication.

[0185] For example, when the control plane network element is a session management network element, the subscription authentication for the private network between the terminal and the online subscription authentication device may be a secondary authentication.

[0186] S405: The control plane network element issues the authentication result according to the contract, and the control plane network element returns a second message to the terminal.

[0187] Since the signing and issuing authentication is triggered by the control plane network element, the subsequent signing and issuing authentication process between the terminal and the online signing and authentication device needs to pass through the control plane network element, so the control plane network element can obtain the result of whether the signing and issuing authentication is passed.

[0188] The specific process in which the control plane network element returns the second message to the terminal according to the result of the authentication may be any of the following:

[0189] In case A, the contract is issued and the authentication is passed, the control plane network element returns an acceptance message to the terminal, and executes step 406. There is no order between step 406 and the step of returning the acceptance message to the terminal, and they can be executed at the same time, or the acceptance message is returned to the terminal first, and then step 406 is executed, or step 406 is executed first, and then the acceptance message is returned to the terminal.

[0190] Optionally, the acceptance message carries one or more of a temporary indication and an online signing server address, wherein the temporary indication is used to instruct the terminal to retry accessing the private network after a certain period of time, including a temporary registration indication or a temporary session indication.

[0191] The control plane network element may return an acceptance message to the terminal in the following two ways:

[0192] Mode 1: When the control plane network element is an access management network element, the access management network element returns a first NAS response message for replying to the first NAS message. Optionally, the first NAS response message includes one or more of a temporary registration indication and an online subscription server address.

[0193] Mode 2: When the control plane network element is a session management network element, the session management network element establishes a first session for the terminal and returns a session establishment response message to the terminal to indicate that the first session has been established. Optionally, the session establishment response message includes one or more of a temporary session indication and an online signing server address.

[0194] In case B, when the contract signing and authentication fails, the control plane network element returns a rejection message to the terminal.

[0195] Optionally, the rejection message carries a first reason value, which is used to indicate that the contract signing authentication fails. After receiving the rejection message, the terminal may try to select the first network information of another private network and re-execute step S401. For details, please refer to Example 5.

[0196] The above two situations are just two possible situations, and this application does not exclude the existence of other situations.

[0197] Optionally, before step S401, the terminal obtains second network information of multiple private networks. After receiving the rejection message, the terminal selects second network information of another private network from the second network information of the multiple private networks, and obtains first network information of another private network based on the second network information of the other private network.

[0198] For terminals without an interface, the terminal cannot manually select a network, so it attempts to access the network by blindly selecting a network and performs online contract authentication. If the authentication fails, it means that the UE has selected the wrong private network, so the UE will try to select the next private network until the authentication succeeds, thereby executing online contract. In this way, terminals without an interface can also successfully complete online contract signing.

[0199] S406: When the contract signing and authentication are passed, the control plane network element sends a third message to the storage function network element to trigger the storage function network element to update the user contract information of the terminal, and the third message carries the identifier of the terminal and the second indication information of the private network. The second indication information is obtained by the control plane network element according to the first indication information.

[0200] Among them, the control plane network element can obtain the second indication information according to the first indication information. The first indication information and the second indication information can be the same, for example, both are DNN. Or the second indication information is obtained by the control plane network element according to the first indication information. For example, the first indication information received by the control plane network element is DNN, and the control plane network element obtains the corresponding second indication information according to the first indication information as NPN ID, and sends the NPN ID to the storage function network element.

[0201] The terminal identifier is used to identify the terminal in the public network. For example, SUPI.

[0202] Optionally, the third message also includes GPSI, which is used to identify the terminal in the private network. The GPSI may be generated by the terminal and the online contract authentication device during the contract signing and authentication process.

[0203] When the storage function network element is a data management network element and / or a data storage network element, the control plane network element sends a message to the storage function network element to trigger the storage function network element to update the user subscription information of the terminal. Any of the following methods can be used:

[0204] Method 1: The control plane network element sends a message to the data management network element, triggering the data management network element to update the context information of the terminal on the data management network element.

[0205] Method 2: The control plane network element sends a message to the data storage network element, triggering the data storage network element to update the context information of the terminal on the data management network element.

[0206] Method 3: The control plane network element sends a message to the data management network element, triggering the data management network element to update the context information of the terminal on the data management network element, and then the data management network element sends a message to the data storage network element, triggering the data storage network element to update the contract information of the terminal on the data storage network element.

[0207] Method 4: The control plane network element sends a message to the data management network element to trigger the data management network element to update the context information of the terminal on the data management network element, and the control plane network element sends a message to the data storage network element to trigger the data storage network element to update the context information of the terminal on the data management network element.

[0208] S407. The storage function network element obtains the first subscription data corresponding to the private network according to the second indication information of the private network, and the storage function network element updates the user subscription data of the terminal according to the obtained first subscription data of the private network;

[0209] The storage function network element obtains the user contract data of the terminal according to the terminal identifier, and obtains the first contract information of the private network according to the second indication information (refer to the preset step 1). The storage function network element uses the first contract information to update the user contract data of the terminal.

[0210] For example, the storage function network element overwrites the slice identifier privacy indication in the user subscription data of the terminal with the slice identifier privacy indication indicated by the first subscription information.

[0211] The storage function network element adds a secondary authentication execution instruction, a slice authentication execution instruction, and a user plane protection policy indicated by the first subscription information to the user subscription data of the terminal.

[0212] The storage function network element adds the CAG ID indicated by the first subscription information to the CAG ID list in the user subscription data of the terminal.

[0213] The storage function network element adds the DNN indicated by the first subscription information to the DNN list in the user subscription data of the terminal.

[0214] The storage function network element adds the NSSAI indicated by the first subscription information to the NSSAI list in the user subscription data of the terminal.

[0215] Optionally, the storage function network element also updates the user subscription data of the terminal according to the GPSI.

[0216] Optionally, when the indication information of the private network is only used to identify the first contract information of the private network, the storage function network element does not need to update the indication information of the private network in the user contract data of the terminal.

[0217] At this point, the public network has completed the update of the user contract data of the terminal.

[0218] S408, the storage function network element triggers a process to update the configuration information on the terminal, and at the same time, the terminal receives the configuration information of the public network through the public network;

[0219] The configuration information includes one or more of access and mobility management related parameters and session management strategies.

[0220] The storage function network element updates the session management policy on the terminal including the following steps: The storage function network element can trigger the PLMN PCF to execute the terminal Configuration Update procedure for transparent terminal Policy delivery process to update the URSP on the terminal side. Among them, the URSP contains the mapping relationship between the NPN application and the DNN and / or NSSAI corresponding to the NPN, so that the terminal obtains the DNN and / or NSSAI corresponding to the NPN when using the NPN application to establish a PDU session to access the NPNDNN. At this point, the terminal side has completed the update of the configuration information related to the session management policy in the PLMN.

[0221] The storage function network element updates the access and mobility management related parameters on the terminal, including the following steps: The storage function network element can trigger the PLMN data management network element to execute the terminal Configuration Update procedure for access andmobility management related parameters process to update the mobility restriction and / or allowed NSSAI on the terminal side. The mobility restriction includes the CAG ID corresponding to the NPN, so that the terminal can select the cell corresponding to the CAG ID to access when accessing the NPN. Optionally, the allowed NSSAI of the terminal is also updated so that the terminal can provide the RAN / access management network element with information on selecting the network when registering. At this point, the terminal side has completed the update of the configuration information related to the mobility management policy in the PLMN.

[0222] S409: The terminal obtains the private network's credentials from the private network's online signing server via the public network.

[0223] Among them: the private network credentials include one or more of the NPN identity and the NPN authentication credentials.

[0224] The process of the terminal obtaining the private network credentials from the online signing server through the public network includes:

[0225] The terminal obtains the address of the online contract server, and obtains the private network credential from the online contract server through the first session and the address of the online contract server, wherein the first session is a session established between the terminal and the public network.

[0226] When the control plane network element is a session management network element, the first session has been established in step S405, and the private network credentials can be transmitted in the established first session in step S409. Specifically, when the authentication of the private network is passed, the terminal receives a response message returned by the session management network element, indicating that the first session has been established, and then the terminal accesses the online contract server corresponding to the address of the online contract server through the first session, and obtains the private network credentials related to the NPN.

[0227] When the control plane network element is an access management network element, after step S405 and before step S409, the method further includes: a process of establishing a first session between the terminal and the public network. Specifically, when the authentication of the private network is passed, the terminal sends a session request message to the session management network element, and establishes a first session through the session management network element, and then the terminal accesses the online contract server corresponding to the address of the online contract server through the first session, and obtains the private network credentials related to the NPN.

[0228] Specifically, the terminal may obtain the address of the online signing server in any of the following ways:

[0229] Method 1: The terminal obtains the address of the online signing server from the second network information; or

[0230] Method 2: The terminal receives the address of the online signing server returned by the public network in step S405.

[0231] S410, the terminal selects private network access according to the configuration information of the public network and the private network credentials.

[0232] Optionally, the terminal can use Figure 3 The method shown selects the private network to re-access based on the configuration information of the public network and the credentials of the private network.

[0233] Optionally, after completing step S408, the public network sends a deregistration request message to the terminal, so that the terminal enters a deregistration state. Afterwards, the terminal selects private network access according to the configuration information of the public network and the credentials of the private network.

[0234] Optionally, after completing step S408, the public network sends a session release request message to the terminal, so that the terminal releases the first session. Afterwards, the terminal selects private network access according to the configuration information of the public network and the private network credentials.

[0235] Specifically, the public network may start a timer after signing and issuing the authentication or completing S408. When the timer times out, the public network sends a registration request message or a session release request message to the terminal.

[0236] Optionally, when the terminal receives a temporary indication (temporary session indication or temporary registration indication) in step 405, a timer is started (the timer can be preset on the terminal or sent to the terminal by the network side). When the timer expires, private network access is selected based on the received public network configuration information and private network credentials.

[0237] If the temporary indication is a temporary registration indication, the terminal will first enter the deregistration state after the timer expires, and then select the private network access according to the received public network configuration information and the private network credentials. At this time, the terminal will reselect the access network (for example, reselect CAG according to the access and mobility management related parameters).

[0238] If the temporary indication is a temporary session indication, the terminal only releases the first session after the timer expires, and then selects the private network access according to the received public network configuration information and the private network credentials. At this time, the terminal does not need to reselect the access network, and directly re-establishes a new session to access the private network.

[0239] pass Figure 4 In the method shown, the terminal sends the first network information of the private network to the public network, and performs authentication of the private network through the public network; when the authentication of the private network is passed, the terminal receives the configuration information of the public network through the public network, and obtains the certificate of the private network from the online contract server of the private network through the public network. Since the terminal obtains the configuration information of the public network and the certificate of the private network, the public network updates the user contract data of the terminal, and the terminal can subsequently access the private network through the public network according to this information.

[0240] Combine the following Figure 5-7Corresponding specific embodiments, the communication method in the above-mentioned embodiment 4 is explained in detail by example. For the convenience of explanation, this application will be described later by taking the access management network element as the AMF network element, the session management network element as the SMF network element, the data storage network element as the UDR network element, the data management network element as the UDM network element, the online contract authentication device as the AAA network element, the online contract server as the OSU server network element, and the policy control network element as the PCF network element as an example. Further, the AMF network element is referred to as AMF, the SMF network element is referred to as SMF, the UDR network element is referred to as UDR, the UDM network element is referred to as UDM, and so on. That is, the AMF described later in this application can be replaced with an access management network element, the SMF can be replaced with a session management network element, the UDR can be replaced with a data storage network element, the UDM can be replaced with a data management network element, the PCF can be replaced with a policy control network element, and so on.

[0241] Embodiment 1

[0242] refer to Figure 5 , a specific example of a communication method provided in an embodiment of the present application. In this embodiment, the control plane network element is SMF, and the SMF triggers the contract signing and authentication process (such as secondary authentication). SMF obtains the authentication success result and notifies UDM / UDR to update the PLMN contract of the UE saved by itself. It includes the following steps:

[0243] S500: The first subscription information of the NPN is pre-configured in the PLMN UDM / UDR, and is used to configure the subscription information of the PLMN for the terminal that successfully opens an account in the NPN.

[0244] Optionally, the NPN may be configured to the PLMN UDM / UDR through a capability exposure interface, or the operator may configure the NPN according to a policy. The first subscription information of NPN may include: external group ID (information used for NPN to identify the group to which the terminal belongs), slice identifier privacy indication (used to indicate whether the slice identifier NSSAI requires confidentiality protection), subscription issuance authentication execution indication (used to indicate whether the terminal needs to perform subscription issuance authentication, the subscription issuance authentication in embodiments one and three may be secondary authentication, and the subscription issuance authentication in embodiment two may be slice authentication), user plane protection policy (used to indicate the security protection policy of the terminal, which may be an encryption protection indication at the PDU session granularity (required, preferred, not needed), and / or an integrity protection indication at the PDU session granularity (required, preferred, not needed), NPN ID (used to identify an NPN that can perform on-boarding, which may be a CAG ID or a string used to identify the NPN), CAG ID (if the NPN ID is not a CAG ID, it is used to identify the cell that the UE can access when accessing the NPN), DNN (used to identify the data network for the UE to access the NPN), and NSSAI (used to identify the slice for the UE to access the NPN). Note that who configures the above parameters can refer to the table of the second prior art.

[0245] Optionally, the second subscription information of NPN is pre-configured in the SMF of PLMN for SMF to address AAA. The second subscription information of NPN may include: NPN ID, AAA address (used for SMF to address AAA, which may be AAA's IP address, MAC address, etc.), OSU address, etc.

[0246] S501, UE obtains OB Info.

[0247] OB Info is used by the UE to establish a communication path for accessing the DN where the OSU is located, and may include a DNN. Optionally, OBinfo may also include one or more of an NSSAI, an AAA1 address, or an OSU address.

[0248] Optionally, the UE also obtains an NPN ID, which is used to identify an NPN that can perform on-boarding, and can be a CAG ID or a character string used to identify the NPN.

[0249] For the method of UE obtaining OB Info / ID, please refer to the subsequent embodiments.

[0250] S502: The UE sends a NAS request message to the PLMN AMF, where the NAS request message includes OB Info.

[0251] Prior to this, the UE has already accessed the public network and obtained the configuration information of the public network.

[0252] S503: PLMN AMF sends OB Info to PLMN SMF.

[0253] Optionally, the NAS request message also includes an NPN ID.

[0254] Optionally, the NAS request message also includes a contract signing request indication, which is used to instruct the SMF to initiate contract signing and authentication.

[0255] Specifically: UE sends a UL NAS TRANSPORT message to PLMN AMF, and the NAS TRANSPORT message also includes OBInfo and PDU Session Establishment Request message. Optionally, the NAS TRANSPORT message may also include one or more of NPN ID and subscription request indication. The NPN ID or subscription request indication may be independent of the PDUSession Establishment Request message, or may be placed in the PDU Session Establishment Request message.

[0256] One implementation is: the UE sends a UL NAS TRANSPORT message to the PLMN AMF, the message may carry OBInfo, and optionally, also includes an NPN ID. The UL NAS TRANSPORT message also includes an SM container, the SM container includes a PDU Session Establishment Request message, and optionally, the PDU Session Establishment Request message includes a subscription request indication.

[0257] Another implementation manner is: the UE sends a UL NAS TRANSPORT message to the PLMN AMF, the message may carry OB Info, the UL NAS TRANSPORT message further includes an SM container, the SM container includes a PDU Session Establishment Request message, the PDU Session Establishment Request message includes a subscription request indication, and optionally, the PDU Session Establishment Request message also includes an NPN ID.

[0258] For example, the UE sends a UL NAS TRANSPORT message to the PLMN AMF. The message may carry DNN and NSSAI. The UL NAS TRANSPORT message also includes an SM container. The SM container includes a PDU Session Establishment Request message. The message includes a subscription request indication and an NPN ID.

[0259] S504, PLMN SMF triggers the subscription and authentication according to OB Info and / or NPN ID.

[0260] Specifically, the PLMN SMF obtains the AAA address corresponding to the OB Info and / or NPN ID according to the OB Info and / or NPN ID, and triggers the AAA subscription authentication identified by the AAA address. For example, the PLMN SMF searches for the second subscription data configured previously according to the OB Info and / or NPN ID, and obtains the AAA address corresponding to the OB Info and / or NPN ID.

[0261] Among them, if two AAA addresses are obtained (for example, AAA1 is used for contract issuance authentication, and AAA2 is used for secondary authentication after obtaining contract), the PLMN SMF can further select to trigger the contract issuance authentication (contract request indication) of the AAA identified by AAA1 according to the contract request indication. In the prior art, the PLMN SMF only obtains AAA2, so it directly performs secondary authentication after obtaining contract. However, since AAA1 is introduced in the online contract process, the PLMN SMF selects to trigger the contract issuance authentication of the AAA identified by AAA1 according to the contract request indication.

[0262] Optionally, this step may also include: the PLMN SMF determines whether it is necessary to perform a contract issuance authentication according to the OB Info and / or the NPN ID. Specifically, any of the following methods may be used:

[0263] One implementation method is: PLMN SMF searches for the second contract information according to OB Info and / or NPN ID, and finds that the second contract information requires execution of contract issuance authentication, then determines that contract issuance authentication is required.

[0264] Another implementation method is: PLMN SMF confirms that a contract is required and issues the authentication according to the contract request instruction

[0265] S505, PLMN SMF initiates contract signing and issues authentication.

[0266] Specifically, PLMN SMF acts as an intermediate node to transfer authentication signaling between UE and AAA1, and realizes two-way authentication between UE and AAA1. Authentication signaling can be carried on EAP protocol, such as EAP-TLS, EAP-AKA', etc. Optionally, UE carries EAP protocol through NAS signaling, and NPNAAA carries EAP protocol through user plane data. The communication path can be UE-AMF-SMF-UPF-AAA1. Contract-issued authentication can be secondary authentication.

[0267] S506, SMF obtains the result of the contract signing and certification, and processes it according to the result.

[0268] Specifically, since the signing and issuing of authentication is triggered by SMF, SMF can obtain the result of whether the signing and issuing of authentication is successful from AAA1.

[0269] If the authentication is successful, step S507 is executed, that is, the PLMN SMF triggers the update of the user subscription data of the UE. The PLMN SMF sends the UE ID (such as SUPI) and OB Info and / or NPN ID to the PLMN UDM / UDR. Optionally, the PLMN SMF also sends the GPSI to the PLMN UDM / UDR. The GPSI is used to identify the UE in the NPN. The GPSI can be generated by the UE and AAA1 during the subscription and authentication process.

[0270] If the authentication fails, the PLMN SMF rejects the UE's PDU session establishment request, and the UE will not be able to establish a PDU session to access the NPN. Optionally, the UE performs the automatic selection process with reference to the third embodiment.

[0271] S507, PLMN UDM / UDR updates the user subscription data of the UE corresponding to the UE ID according to the UE ID and OB Info and / or NPN ID.

[0272] One implementation method is that the PLMN UDM / UDR obtains the user subscription data of the UE according to the SUPI, and the PLMN UDM / UDR obtains the first subscription information of the NPN preconfigured in the preset condition 1 according to the OB Info and / or the NPN ID. The PLMN UDM / UDR uses the first subscription information to update the user subscription data of the UE. For example, the PLMN UDM / UDR modifies the user subscription data of the UE to the external group ID indicated by the first subscription information, the slice identifier privacy indication, the subscription authentication execution indication, the user plane protection policy, the CAG ID, the DNN, the NSSAI, etc. At this point, the PLMN network side completes the update of the saved user subscription data of the UE. In this way, the SMF can directly request the UDM / UDR to update the user subscription data

[0273] Another implementation method is that the PLMN SMF calls the user subscription data update service provided by the PLMN UDM, and provides the terminal identifier for which the user subscription data needs to be updated, as well as OB Info and / or NPN ID. The UDM obtains the updated UE user subscription data based on the terminal identifier, OBInfo and / or NPN ID, and calls the data management update service of the UDR to update the user subscription data of the terminal stored on the UDR. In this method, the SMF may need to update the data on the UDR through the UDM.

[0274] The PLMN SMF sends a PDU session establishment receive message to the PLMN AMF.

[0275] S508: PLMN SMF sends a PDU session establishment reception message to PLMN AMF.

[0276] Optionally, the PDU session establishment reception message may include the address of the NPN OSU (e.g., OSU IP address) so that the UE can address and access the NPN OSU to perform the online contract process to obtain the NPN credentials. Optionally, the PDU session establishment reception message may also include a temporary registration indication, which is used to instruct the UE to deregister and reselect the network after a period of time (which may be a fixed time or allocated by the network).

[0277] S509, the PLMN AMF sends a PDU session establishment reception message to the UE to establish a PDU session for the UE to access the NPN.

[0278] Optionally, the PDU session establishment reception message includes the address of the NPN OSU and a temporary session indication.

[0279] S510, optionally, the PLMN UDR may trigger the PLMN PCF to perform the UE Configuration Update procedure for transparent UE Policy delivery to update the URSP on the UE side, where the URSP includes a mapping relationship between the NPN application and the DNN and / or NSSAI corresponding to the NPN, so that the UE obtains the DNN and / or NSSAI corresponding to the NPN when using the NPN application to establish a PDU session for accessing the NPN DNN. At this point, the UE side has completed the update of the subscription information related to the session management policy in the PLMN.

[0280] S511, optionally, the PLMN UDR may trigger the PLMN UDM to execute the UE Configuration Update procedure for access and mobility management related parameters to update the mobility restriction and / or allowed NSSAI on the UE side, where the mobility restriction includes the CAGID corresponding to the NPN, so that the UE can select the cell corresponding to the CAG ID to access when accessing the NPN.

[0281] Optionally, the UE's allowed NSSAI is also updated so that the UE can provide RAN / AMF with information on selecting a network when registering. So far, the UE side has completed the update of subscription information related to the mobility management policy in the PLMN.

[0282] S512: The UE accesses the NPN OSU through the established PDU session.

[0283] Optionally, the UE finds the NPN OSU according to the OSU address obtained in step S509.

[0284] Optionally, the UE obtains the OSU address according to the method of Embodiment 6 to find the NPN OSU. The NPN OSU issues NPN credentials to the UE, such as the NPN identity and the NPN authentication credentials. The NPN identity is used for the NPN to identify the UE, and the NPN authentication credentials are used for the NPN to authenticate the UE (for example, AAA2 authenticates the UE), which can be a certificate, a symmetric key, etc. At this point, the UE side has completed the update of the NPN contract information.

[0285] S510-S512 complete the update of the configuration information of the PLMN and the credentials of the NPN on the UE side, so that the UE can complete the update of the PLMN and NPN information in the PNI-NPN scenario.

[0286] S513, optionally, the UE reselects network access according to the temporary session indication.

[0287] One implementation method is that after receiving the temporary session indication sent in step S509, the UE starts a timer. When the timer times out, the UE enters the deregistered state, and then according to the present application Figure 3 The described method reconnects access to the network.

[0288] Embodiment 1 clarifies how to update the subscription information of the NPN when the authentication is triggered by the SMF, and provides the logic for the UE to re-access the network based on the subscription information.

[0289] Embodiment 2

[0290] refer to Figure 6 , another specific example of a communication method provided by an embodiment of the present application. In this embodiment, the control plane network element is AMF, and the AMF triggers the contract issuance authentication process (such as slice authentication). The AMF obtains the authentication success result and notifies the UDM / UDR to update the PLMN contract of the UE saved by itself. The specific method includes the following steps:

[0291] S600, for detailed description, please refer to step S500.

[0292] S601, for detailed description, please refer to step S501.

[0293] S602: The UE sends a first NAS request message to the PLMN AMF, where the first NAS request message includes OB Info.

[0294] Optionally, the first NAS request message also includes an NPN ID. Optionally, the first NAS request message also includes a contract request indication, which is used to instruct the AMF to initiate a contract issuance authentication, or the first NAS request message is used to instruct the AMF to initiate a contract issuance authentication. In this embodiment, the contract issuance authentication can be a slice authentication.

[0295] S603, PLMN AMF triggers the subscription and authentication according to OB Info and / or NPN ID.

[0296] Specifically, PLMNAMF obtains the AAA address corresponding to OB Info and / or NPN ID according to OB Info and / or NPN ID, and triggers the AAA subscription authentication identified by the AAA address. For example, PLMNAMF searches for the second subscription data configured previously according to OB Info and / or NPN ID, and obtains the AAA address corresponding to OB Info and / or NPN ID.

[0297] If two AAA addresses are obtained (for example, AAA1 is used for contract issuance authentication, and AAA2 is used for secondary authentication after contract signing), the PLMN AMF can further select to trigger the contract issuance authentication (contract request indication) of the AAA identified by AAA1 according to the contract signing request indication. In the prior art, the PLMN AMF only obtains AAA2, so it directly performs secondary authentication after contract signing. However, since AAA1 is introduced into the online contract signing process, the PLMN AMF selects to trigger the contract issuance authentication of the AAA identified by AAA1 according to the contract signing request indication.

[0298] Optionally, this step may also include: the PLMN AMF determines whether it is necessary to perform a contract issuance authentication according to the OB Info and / or the NPN ID. Specifically, any of the following methods may be adopted:

[0299] One implementation method is: PLMN AMF searches for the second contract information according to OB Info and / or NPN ID, and finds that the second contract information requires execution of contract issuance authentication, then determines that contract issuance authentication is required.

[0300] Another implementation method is: the PLMN SMF confirms that a contract is required and issues authentication according to the contract request indication.

[0301] S604, PLMN AMF initiates contract signing and issues authentication.

[0302] Specifically, PLMN AMF acts as an intermediate node to transfer authentication signaling between UE and AAA1 to achieve two-way authentication between UE and AAA1. Authentication signaling can be carried on EAP protocol, such as EAP-TLS, EAP-AKA', etc. Optionally, UE carries EAP protocol through NAS signaling, and NPNAAA carries EAP protocol through user plane data. The communication path can be UE-AMF-AAAproxy (can be AUSF)-AAA. The contract-issued authentication can be slice authentication.

[0303] S605, AMF obtains the result of the contract signing and authentication, and processes it according to the result. If the authentication is successful, PLMNAMF triggers the contract updating process of UE.

[0304] Specifically, since the contract signing and authentication is triggered by AMF, AMF can obtain the result of whether the contract signing and authentication is successful from AAA1. If the authentication is successful, the PLMN AMF triggers the update of the UE's user contract data, that is, the PLMN AMF sends the SUPI and OB Info and / or NPN ID to the PLMN UDR. Optionally, the PLMN AMF also sends the GPSI to the PLMN UDR. The GPSI can be generated by the UE and the NPN AAA during the contract signing and authentication process, and continues to execute step S606. If the authentication fails, the PLMN AMF rejects the UE's NAS request, and the UE will not be able to access the NPN. Optionally, the UE performs the automatic selection process with reference to Example 5.

[0305] S606, for detailed description, please refer to step S507.

[0306] S607: The PLMN AMF sends a first NAS response message to the UE to reply to the first NAS request message.

[0307] Optionally, the first NAS reply message may include the address of the NPN OSU so that the UE can address and access the NPNOSU for online signing. Optionally, the PDU session establishment reception message may also include a temporary registration indication, which is used to instruct the UE to deregister and reselect the network after a period of time (which may be a fixed time or allocated by the network). The PDU session establishment reception message includes the address of the NPN OSU and the temporary registration indication.

[0308] S608-S609, for detailed description, please refer to steps S510-S511.

[0309] S610, the UE initiates a PDU session establishment request to establish a user plane for accessing the NPN.

[0310] S611. The UE accesses the NPN OSU through the established PDU session.

[0311] Optionally, the UE finds the NPN OSU according to the OSU IP obtained in step S607 and accesses the NPN OSU. Optionally, the UE obtains the OSU address according to the method of embodiment 6 to find the NPN OSU. The NPN OSU issues NPN credentials to the UE, such as the NPN identity and the NPN authentication credentials. The NPN identity is used for the NPN to identify the UE, and the NPN authentication credentials are used for the NPN to authenticate the UE (for example, AAA2 authenticates the UE), which can be a certificate, a symmetric key, etc. At this point, the UE side has completed the update of the NPN contract information.

[0312] Steps S608-S610 complete the update of the configuration information of the PLMN and the credentials of the NPN on the UE side, so that the UE can complete the update of the PLMN and NPN information in the PNI-NPN scenario.

[0313] S611, optionally, the UE reselects network access according to the temporary registration indication.

[0314] One implementation method is that after receiving the temporary registration indication sent in step S609, the UE starts a timer. When the timer times out, the UE enters a deregistered state and then reconnects to the network according to the prior art.

[0315] refer to Figure 7 The embodiment of the present application provides a method for a terminal to obtain second network information of a private network. The method introduces a new core network function path information mapping network element. The path information mapping network element can be an independent functional entity or a function that is combined with a core network element, such as AMF, SMF, PCF, etc. The specific method includes the following steps:

[0316] S700.MF pre-configured mapping information, the mapping information may be a mapping relationship between the access network identifier of the private network and the second network information of the private network. The access network identifier of the private network is used to identify the private network with the public access network, and may include CAG ID and NPN ID.

[0317] S701. The access network broadcasts the access network identifier of the private network.

[0318] Optionally, the access network also broadcasts an online contract support indication corresponding to the access network identifier of the private network, where the online contract support indication is used to indicate that the cell corresponding to the access network identifier supports online contract.

[0319] S702. The terminal obtains the access network identifier of the private network.

[0320] Specifically, the terminal obtains one or more private network access network identifiers from the broadcast message of the access network, which specifically includes:

[0321] The terminal obtains access network identifiers of multiple private networks from the broadcast. Optionally, if the access network also broadcasts online signing support indications corresponding to the access network identifiers of the private networks, the terminal only obtains access network identifiers of all private networks including the online signing indication from the broadcast.

[0322] The terminal can also display the private network corresponding to the access network identifier on the terminal interface according to the multiple access network identifiers broadcast in the broadcast. Optionally, the terminal only selects the private network corresponding to all the access network identifiers containing the online signing indication from the broadcast. The user selects from all the displayed private networks. After the user selects a private network, the terminal obtains the access network identifier of the private network.

[0323] S703 The terminal initiates a second NAS request message to the AMF, and the second NAS request message carries one or more access network identifiers of private networks.

[0324] Optionally, the second NAS request message is used to request to obtain second network information of the private network indicated by the access network identifier.

[0325] Optionally, the second NAS request message further includes a network information request indication, where the network information request indication is used to request to obtain second network information of the private network indicated by the access network identifier.

[0326] S704.AMF sends one or more private network access network identifiers to the path information mapping network element. Note that if the path information mapping network element is integrated in the AMF, steps S704 and S706 are skipped.

[0327] S705. The path information mapping network element maps the corresponding second network information of the private network according to the access network identifier of the private network.

[0328] Specifically, the path information mapping network element maps the second network information of the private network corresponding to the access network identifier according to the access network identifier of the private network and a pre-configured mapping relationship.

[0329] Optionally, if the path information mapping network element obtains multiple access network identifiers, the path information mapping network element can form one or more mapping relationships of {access network identifier of private network, second network information of private network} according to the mapping relationship, for example, it can be a mapping relationship of {NPN ID, DNN, NSSAI, AAAIP, OSU IP}(s).

[0330] S706. The path information mapping network element sends the second network information of the private network to the AMF.

[0331] Optionally, the path information mapping network element sends one or more {private network access network identifier, private network second network information} to the AMF.

[0332] S707.AMF sends a second NAS response message to the UE, where the second NAS response message includes the second network information of the private network.

[0333] Optionally, the second NAS response message includes one or more {access network identifier of the private network, second network information of the private network}.

[0334] S708. The UE obtains the second network information of the private network.

[0335] Optionally, if the UE obtains multiple {access network identifiers of private networks, second network information of private networks}, the UE obtains the second network information of multiple private networks.

[0336] Through the above Figure 7 In the method described above, the terminal can obtain the second network information of the private network by querying the public network through the access network identifier.

[0337] The above mainly introduces the solution provided by the present application from the perspective of the interaction between various network elements. It can be understood that in order to realize the above functions, the above-mentioned network elements include hardware structures and / or software modules corresponding to the execution of various functions. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiments disclosed in this document, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in hardware or in a computer software-driven hardware manner depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of this application.

[0338] The embodiments of the present application can divide the functional modules of the terminal, control plane network element, storage function network element or other network equipment according to the above method examples. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0339] In the case of integrated units, please refer to Figure 8 , is a structural diagram of a communication device provided in an embodiment of the present application, and the communication device 800 includes: a transceiver module 810 and a processing module 820. The communication device can be used to implement the control plane network element or storage function network element involved in any of the above method embodiments, or to implement the functions of the network elements involved in any of the above method embodiments. For example, the communication device can be an AMF network element or an SMF network element in the core network, or it can also be a UDR network element, a UDM network element, or it can also be a PCF network element, an AAA network element, an OSU server network element, an MF network element, etc. The network element or network function can be a network element in a hardware device, a software function running on dedicated hardware, or a virtualized function instantiated on a platform (for example, a cloud platform).

[0340] (I) In one example, when the communication device is used as a terminal, or is a chip used in a terminal, and performs the steps performed by the terminal in the above method embodiment. The transceiver module 810 can be used to support the communication device 800 to communicate, for example, to perform Figure 4 , Figure 7 The sending and / or receiving actions performed by the terminal in Figure 5 , Figure 6 The processing module 820 can be used to support the communication device 800 to perform the processing actions in the above method embodiment, such as performing Figure 4 , Figure 7 The processing action performed by the terminal in Figure 5 , Figure 6 Optionally, the first communication device 800 may further include a storage module 830 ( Figure 8 ), for storing program code and data of the first communication device. In a possible implementation, the details are as follows:

[0341] A transceiver module, configured to send first network information of a second network to the first network, wherein the first network information includes first indication information of the second network, and the first indication information is used to indicate that the terminal requests to access the second network;

[0342] A processing module, used to use the transceiver module to perform the signing and issuing authentication of the second network through the first network;

[0343] When the signing and issuing authentication of the second network is passed, the processing module is used to use the transceiver module to receive the configuration information of the first network through the first network, and obtain the credentials of the second network from the online signing server of the second network through the first network.

[0344] Optionally, the first network information may further include a subscription request indication, which is used to instruct the control plane network element of the first network to initiate subscription issuance authentication.

[0345] Optionally, the processing module is further configured to obtain second network information of the second network from a broadcast message of the access network using the transceiver module, and obtain the first network information according to the second network information; or

[0346] The processing module is further used to obtain the network identifier of the second network from the broadcast message of the access network using the transceiver module, obtain the second network information of the second network from the path information mapping network element according to the network identifier of the second network, and obtain the first network information according to the second network information; or

[0347] The processing module is further used to obtain the second network information of the second network from the application server of the second network by using the transceiver module, and obtain the first network information according to the second network information.

[0348] Optionally, the processing module is further used to use the transceiver module to access the second network according to the configuration information of the first network and the credentials of the second network.

[0349] Optionally, the processing module is further configured to receive, by using the transceiver module, a temporary indication returned by the first network, and start the timer according to the temporary indication;

[0350] When the timer times out, the processing module executes access to the second network using the transceiver module according to the obtained configuration information of the first network and the credential of the second network.

[0351] Optionally, the configuration information of the first network includes access and mobility management related parameters and session management policies, and the access and mobility management related parameters and session management policies are obtained by the first network based on the first subscription information of the second network.

[0352] Optionally, the processing module is configured to obtain an address of an online signing server, and obtain a credential of the second network from the online signing server through the first session and the address of the online signing server, wherein the first session is a session established between the terminal and the first network.

[0353] Optionally, the processing module is specifically configured to obtain an address of an online signing server from the second network information; or

[0354] The processing module is specifically configured to use the transceiver module to receive the address of the online signing server returned by the first network.

[0355] (II) In one example, when the communication device is used as a control plane network element, or is a chip used in a control plane network element, and performs the steps performed by the control plane network element in the above method embodiment. The transceiver module 810 can be used to support the communication device 800 to communicate, for example, to perform Figure 4 The sending and / or receiving actions performed by the control plane network element in the Figure 5 The sending and / or receiving actions performed by the SMF in Figure 6 and Figure 7 The processing module 820 can be used to support the communication device 800 to perform the processing actions in the above method embodiment, such as performing Figure 4 The processing action performed by the control plane network element in the Figure 5 The processing action performed by SMF in Figure 6 and Figure 7 Optionally, the first communication device 800 may further include a storage module 830 ( Figure 8 ), for storing program code and data of the first communication device. In a possible implementation, the details are as follows:

[0356] A transceiver module, configured to receive first network information of a terminal, wherein the first network information includes first indication information of a second network, and the first indication information is used to indicate that the terminal requests to access the second network;

[0357] A processing module, configured to determine, according to the first network information of the terminal, that a subscription and issuance authentication of the second network needs to be performed on the terminal, and trigger the subscription and issuance authentication of the second network;

[0358] When the contract signing and authentication of the second network are passed, the transceiver module is used to send a third message to the storage function network element of the first network, to trigger the storage function network element to update the user contract data of the terminal. The message includes the terminal identifier and the second indication information of the second network.

[0359] Optionally, the transceiver module is used to send a second message to the terminal, where the second message includes one or more of a temporary indication and an address of an online signing server.

[0360] Optionally, the second indication information is obtained by the control plane network element based on the first indication information.

[0361] Optionally, the second indication information is the same as the first indication information.

[0362] Optionally, the processing module is further used to obtain the address of the online contract authentication device according to the first indication information of the second network, and the transceiver module is further used to send a first message to the online contract authentication device to trigger the contract issuance authentication of the second network.

[0363] Optionally, the processing module is further configured to obtain an address of an online signing server corresponding to the second network according to the first indication information of the second network.

[0364] Optionally, the processing module is specifically used to: search for the second signing information of the second network based on the first network information, and determine whether the terminal needs to be authenticated for the signing of the second network based on the second signing information of the second network; or determine whether the terminal needs to be authenticated for the signing of the second network based on the signing request indication included in the first network information.

[0365] (III) In one example, when the communication device is used as a storage function network element, or is a chip used in a storage function network element, and performs the steps performed by the storage function network element in the above method embodiment. The transceiver module 810 can be used to support the communication device 800 to communicate, for example, to perform Figure 4 The sending and / or receiving actions performed by the storage function network element in the Figure 5 The sending and / or receiving actions performed by the UDM or UDR in Figure 6 The processing module 820 can be used to support the communication device 800 to perform the processing actions in the above method embodiment, such as performing Figure 4 The processing action performed by the storage functional network element in the Figure 5 The processing action performed by the UDM or UDR, or Figure 6 Optionally, the first communication device 800 may further include a storage module 830 ( Figure 8 ), for storing the program code and data of the first communication device. In a possible implementation, the details are as follows:

[0366] A transceiver module, configured to receive a third message from a control plane network element of the first network, configured to trigger updating of user subscription data of the first network of the terminal, wherein the third message carries an identifier of the terminal and second indication information of the second network;

[0367] a processing module, configured to obtain first subscription data corresponding to the second network according to second indication information of the second network,

[0368] The processing module is used to update the user subscription data of the terminal according to the first subscription data of the second network.

[0369] Optionally, the processing module is used to update the configuration information on the terminal using the transceiver module.

[0370] Optionally, the processing module is specifically configured to utilize the transceiver module to send a subscription data change notification to the policy control network element, thereby triggering the policy control network element to update the session management policy on the terminal.

[0371] Optionally, the configuration information includes access and mobility management related parameters, and the processing module is specifically used to obtain the access and mobility management related parameters according to the first subscription information of the second network, and use the transceiver module to send the access and mobility management related parameters to the terminal.

[0372] Optionally, the first subscription data of the second network includes a data network name DNN.

[0373] Optionally, the first subscription data of the second network may also include one or more of network slice selection auxiliary information NSSAI, non-open access group identifier CAG ID, slice identifier privacy indication, secondary authentication execution indication, slice authentication execution indication and user plane protection policy.

[0374] When the processing module 820 is a processor, the transceiver module 810 is a communication interface, and the storage module 830 is a memory, the communication device 800 involved in the embodiment of the present application can be Fig. 9 The communication device 900 is shown.

[0375] like Fig. 9 As shown, Fig. 9 FIG. 1 shows a schematic diagram of the hardware structure of a communication device in an embodiment of the present application. The structure of the control plane network element and the storage function network element can refer to FIG. Fig. 9 The communication device includes a processor 91, a communication line 94 and at least one communication interface ( Fig. 9 The example including the communication interface 93 is merely illustrative).

[0376] Optionally, the communication device may further include a memory 92 .

[0377] The processor 91 may be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the program of the present application.

[0378] Communications link 94 may include a pathway for transmitting information between the above-described components.

[0379] The communication interface 93 uses any transceiver-like device for communicating with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area networks (WLAN), etc.

[0380] The memory 92 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, an optical disc storage (including a compressed optical disc, a laser disc, an optical disc, a digital versatile disc, a Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory may be independent and connected to the processor via a communication line 94. The memory may also be integrated with the processor.

[0381] The memory 92 is used to store computer-executable instructions for executing the solution of the present application, and the execution is controlled by the processor 91. The processor 91 is used to execute the computer-executable instructions stored in the memory 92, thereby realizing a communication method provided in the following embodiment of the present application.

[0382] Optionally, the computer-executable instructions in the embodiments of the present application may also be referred to as application code, which is not specifically limited in the embodiments of the present application.

[0383] In a specific implementation, as an embodiment, the processor 91 may include one or more CPUs, such as Fig. 9 CPU0 and CPU1 in.

[0384] In a specific implementation, as an embodiment, the communication device may include multiple processors, such as Fig. 9 91 and processor 99 in the embodiment. Each of these processors can be a single-CPU processor or a multi-CPU processor. The processor here can refer to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions).

[0385] In the embodiments of the present application, the specific structure of the execution subject of a communication method is not particularly limited in the embodiments of the present application. As long as communication can be performed according to a communication method of the embodiments of the present application by running a program that records the code of a communication method of the embodiments of the present application, the present application does not limit this.

[0386] It should be pointed out that the various embodiments of the present application can refer to each other, for example, the same or similar steps, method embodiments and device embodiments can refer to each other without limitation.

[0387] Fig.10 1 is a schematic diagram of the structure of a chip 1000 provided in an embodiment of the present application. The chip 1000 includes one or more (including two) processors 1001 and a communication interface 1003 .

[0388] Optionally, the chip 1000 further includes a memory 1004, which may include a read-only memory and a random access memory, and provides operation instructions and data to the processor 1001. A portion of the memory 1004 may also include a non-volatile random access memory (NVRAM).

[0389] In some implementations, the memory 1004 stores the following elements, execution modules or data structures, or a subset thereof, or an extended set thereof.

[0390] In the embodiment of the present application, the corresponding operation is performed by calling the operation instruction stored in the memory 1004 (the operation instruction may be stored in the operating system).

[0391] In one possible implementation, the structures of the chips used by the control plane network element, the storage function network element, and the terminal are similar, and different devices can use different chips to implement their respective functions.

[0392] The processor 1001 controls the processing operation of any one of the control plane network element, the storage function network element, and the terminal. The processor 1001 can also be called a central processing unit (CPU).

[0393] The memory 1004 may include a read-only memory and a random access memory, and provides instructions and data to the processor 1001. A portion of the memory 1004 may also include an NVRAM. For example, in an application, the memory 1004, the communication interface 1003, and the memory 1004 are coupled together through the bus system 1002, wherein the bus system 1002 may include a power bus, a control bus, and a status signal bus in addition to a data bus. However, for the sake of clarity, various buses are labeled as the bus system 1002 in FIG. 18.

[0394] The method disclosed in the above embodiment of the present application can be applied to the processor 1001, or implemented by the processor 1001. The processor 1001 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 1001. The above processor 1001 can be a general-purpose processor, a digital signal processor (digital signal processing, DSP), an ASIC, a field-programmable gate array (field-programmable gate array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiment of the present application can be directly embodied as a hardware decoding processor to execute, or the hardware and software modules in the decoding processor can be executed. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 1004, and the processor 1001 reads the information in the memory 1004 and completes the steps of the above method in combination with its hardware.

[0395] In one possible implementation, the communication interface 1030 is used to execute Figure 2 and Figure 3 The steps of receiving and sending corresponding network elements in the embodiment shown. The processor 1001 is configured to execute Figure 2 and Figure 3 The processing steps of the corresponding network elements in the illustrated embodiment.

[0396] The above communication unit may be a communication interface of the device, used to receive signals from other devices. For example, when the device is implemented in the form of a chip, the communication unit is a communication interface of the chip used to receive or send signals from other chips or devices, such as a pin of the chip.

[0397] Fig.11 The simplified schematic diagram of a possible design structure of a terminal involved in the embodiment of the present application is shown. The terminal 1100 includes a transmitter 1101, a receiver 1102 and a processor 1103. The processor 1103 may also be a controller. Fig.11 1103 . Optionally, the terminal 1100 may further include a modem processor 1105 , wherein the modem processor 1105 may include an encoder 1106 , a modulator 11011 , a decoder 1108 , and a demodulator 1109 .

[0398] In one example, the transmitter 1101 adjusts (e.g., analog conversion, filtering, amplification, up-conversion, etc.) the output sample and generates an uplink signal, which is transmitted to the DNS and P-CSCF described in the above embodiment via the antenna. On the downlink, the antenna receives the downlink signal. The receiver 1102 adjusts (e.g., filters, amplifies, down-converts, and digitizes) the signal received from the antenna and provides input samples. In the modem processor 1105, the encoder 1106 receives the service data and signaling message to be sent on the uplink, and processes the service data and signaling message (e.g., formatting, encoding, and interleaving). The modulator 11011 further processes (e.g., symbol mapping and modulation) the encoded service data and signaling message and provides output samples. The demodulator 1109 processes (e.g., demodulates) the input sample and provides symbol estimation. The decoder 1108 processes (e.g., deinterleaves and decodes) the symbol estimation and provides decoded data and signaling messages sent to the terminal 1100. The encoder 1106, the modulator 11011, the demodulator 1109 and the decoder 1108 can be implemented by the synthesized modem processor 1105. These units perform processing according to the radio access technology (for example, the access technology of LTE and other evolved systems) adopted by the radio access network. It should be noted that when the terminal 1100 does not include the modem processor 1105, the above functions of the modem processor 1105 can also be completed by the processor 1103.

[0399] The processor 1103 controls and manages the actions of the terminal 1100, and is used to execute the processing performed by the terminal 1100 in the above-mentioned embodiment of the present application. For example, the terminal 1103 is also used to execute Figure 4 ,, Figure 5 , Figure 6 , Figure 7 and Figure 4 The method shown involves the processing process of the terminal or UE and / or other processes of the technical solution described in this application.

[0400] Furthermore, the terminal 1100 may also include a memory 1104 , and the memory 1104 is used to store program codes and data of the terminal 1100 .

[0401] An embodiment of the present application further provides a computer-readable storage medium, in which computer-readable instructions are stored. When a computer reads and executes the computer-readable instructions, the computer executes a method in any of the above method embodiments.

[0402] The embodiment of the present application also provides a computer program product. When a computer reads and executes the computer program product, the computer executes the method in any of the above method embodiments.

[0403] The embodiment of the present application further provides a communication system, which includes a control plane network element and a storage function network element. Optionally, the communication system may also include other network devices and / or terminals.

[0404] It should be understood that the processor mentioned in the embodiments of the present application may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0405] It should also be understood that the memory mentioned in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0406] It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, the memory (storage module) is integrated in the processor.

[0407] It should be noted that the memory described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0408] It should be understood that in various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0409] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0410] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0411] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0412] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0413] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0414] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0415] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A communication method, characterized in that: The method comprises: The terminal device sends online contract information to the session management function network element through the access and mobility management function network element, where the online contract information is used to establish a communication path for accessing the data network where the online contract server is located, and the online contract information includes the name of the data network; The terminal device receives, through the access and mobility management function network element, a protocol data unit session establishment reception message sent by the session management function network element, where the protocol data unit session establishment reception message includes the address of the online signing server; The terminal device obtains the non-public network credential from the online signing server according to the address of the online signing server.

2. The method according to claim 1, characterized in that Before the terminal device receives the protocol data unit session establishment reception message from the session management function through the access and mobility management function network element, the method further includes: The terminal device signs a contract with the authentication server and issues authentication through the session management function network element.

3. The method according to claim 1, characterized in that The non-public network credential includes a non-public network identity and a non-public network authentication credential. The non-public network identity is used by the non-public network to identify the terminal device, and the non-public network authentication credential is used by the non-public network to authenticate the terminal device.

4. The method according to claim 1, characterized in that The session management function network element and the access and mobility management function network element are located in a first network, and the online signing server is located in a second network.

5. The method according to claim 4, characterized in that The first network is a public network, and the second network is a non-public network.

6. The method according to claim 4 or 5, characterized in that Before the terminal device sends the online signing information to the session management function network element through the access and mobility management function network element, the method further includes: The terminal device accesses the first network.

7. The method according to claim 2, characterized in that The terminal device performs the signing and issuing authentication, including: A secondary authentication is performed with an authentication, authorization and accounting (AAA) server through the session management function network element.

8. A communication method, characterized in that: The method comprises: The session management function network element receives online contract information from the terminal device through the access and mobility management function network element, wherein the online contract information is used to establish a communication path for accessing a data network where an online contract server is located, and the online contract information includes a name of the data network; The session management function network element triggers the signing and issuing authentication according to the online signing information; After the contract signing and authentication are passed, the session management function network element sends a PDU session establishment reception message to the terminal device through the access and mobility management function network element, and the protocol data unit session establishment reception message includes the address of the online contract server.

9. The communication method according to claim 8, characterized in that: After the contract is signed and the authentication is passed, the method includes: The session management function network element sends a first message to the storage function network element, where the first message is used to trigger the storage function network element to update the user subscription data of the terminal device, and the first message includes an identifier of the terminal device and the online subscription information.

10. The communication method according to claim 8 or 9, characterized in that: The session management function network element and the access and mobility management function network element are located in a first network, and the online signing server is located in a second network.

11. The communication method according to claim 10, characterized in that: The first network is a public network, and the second network is a non-public network.

12. The communication method according to claim 8, characterized in that: The signing and issuing of authentication is a secondary authentication.

13. A communication device, characterized in that: The apparatus comprises at least one processor coupled to at least one memory: The at least one processor is configured to execute a computer program or instruction stored in the at least one memory, so that the apparatus executes the method according to any one of claims 1 to 7, or the apparatus executes the method according to any one of claims 8 to 12.

14. A readable storage medium, characterized in that: Used to store instructions, when the instructions are executed, the method according to any one of claims 1 to 7 is implemented, or the method according to any one of claims 8 to 12 is implemented.

Images