Slice authentication method, device and system

Abstract

The embodiment of the application provides a slice authentication method, device and system, relates to the technical field of communication, and can improve the technical problem that the 5G communication system cannot authenticate and authorize terminal equipment when not supporting EAP authentication, or cannot authenticate and authorize terminal equipment due to compatibility in the case of PAP authentication / CHAP authentication. The method comprises the following steps: a mobility management network element receives identification information of a network slice from a terminal device; and obtains an authentication mode and a first authentication parameter corresponding to the network slice; the authentication mode comprises PAP authentication or CHAP authentication; the first authentication parameter comprises PAP authentication parameters or CHAP authentication parameters; after obtaining the authentication mode, the mobility management network element sends a first identifier of the terminal device, the identification information of the network slice and the first authentication parameter to a network slice authentication and authorization network element; receives the first identifier and an authentication result from the network slice authentication and authorization network element, and sends the authentication result to the terminal device.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a slice authentication method, apparatus and system. Background Technology

[0002] In existing communication systems, when a terminal device accesses the core network, the core network device can initiate communication with the authentication, authorization, and accounting (AAA) server so that the AAA server can authenticate and authorize the terminal device.

[0003] For 4th-generation (4G) communication systems, the AAA server can use a point-to-point protocol (PPP) to authenticate and authorize terminal devices. PPP protocols can include password authentication protocols (PAP) and challenge handshake authentication protocols (CHAP), among others.

[0004] Currently, the 3rd Generation Partnership Project (3GPP), in defining 5th-generation (5G) communication systems, defines that AAA servers can authenticate and authorize terminal devices based on the Extensible Authentication Protocol (EAP). However, when the AAA server does not support EAP, EAP cannot be used end-to-end in the 5G communication system, thus preventing the AAA server from authenticating and authorizing terminal devices.

[0005] In addition, if the AAA server does not support EAP, the 5G communication system needs to use PAP / CHAP to authenticate and authorize terminal devices. However, the terminal devices may support the EAP authentication method. Therefore, there may be a compatibility problem when the authentication method of the terminal device is different from that of the 5G communication system, which will prevent the AAA server from authenticating and authorizing the terminal device. Summary of the Invention

[0006] In view of this, embodiments of this application provide a slice authentication method, apparatus, and system, which can improve the technical problem that 5G communication systems cannot authenticate and authorize terminal devices when EAP authentication is not supported, or cannot authenticate and authorize terminal devices due to compatibility issues when PAP / CHAP authentication is used.

[0007] In a first aspect, embodiments of this application provide a slice authentication method, the method comprising: a mobility management network element receiving identification information of a network slice from a terminal device; and obtaining an authentication method and a first authentication parameter corresponding to the network slice; wherein the authentication method includes PAP authentication or CHAP authentication; the first authentication parameter includes PAP authentication parameter or CHAP authentication parameter; after obtaining the authentication method, the mobility management network element sends the first identifier of the terminal device, the identification information of the network slice, and the first authentication parameter to a network slice authentication authorization network element, and receives the first identifier and authentication result from the network slice authentication authorization network element, and sends the authentication result to the terminal device.

[0008] Based on the first aspect, when the network slice authentication method is PAP or CHAP authentication, the mobility management network element can send the terminal device's first identifier, the network slice's identifier information, and the first authentication parameters to the network slice authentication and authorization network element. This allows the network slice authentication and authorization network element to initiate communication with the authentication and authorization server, using PAP or CHAP authentication to complete the authentication and authorization of the terminal device. This enables the 5G communication system to authenticate and authorize the terminal device according to the existing 5G authentication process when the authentication and authorization server supports EAP authentication, and to use PAP or CHAP authentication when the authentication and authorization server does not support EAP authentication. This method also avoids compatibility issues caused by differences between the authentication method of the terminal device and the authentication method of the 5G communication system. For example, if the terminal device and its corresponding authentication and authorization server use PAP or CHAP authentication, but the core network of the 5G communication system still uses EAP authentication, the PAP / CHAP authentication process will fail, resulting in authentication failure. In the scheme of this application, when the terminal device and the corresponding authentication and authorization server adopt the authentication method of PAP or CHAP, the core network can also adopt the authentication method of PAP or CHAP, thereby enabling the 5G communication system to use PAP authentication or CHAP authentication to authenticate the terminal device, ensuring the compatibility of authentication methods.

[0009] In one possible design, the mobility management network element receives a first message from the terminal device carrying the first authentication parameters.

[0010] In one possible design, the first message is a registration request, a security mode completion message, or an uplink non-access stratum transmission message.

[0011] Based on the two possible designs mentioned above, the mobility management network element can obtain the first authentication parameters according to the first message shown above, providing a feasible solution for the mobility management network element to obtain the first authentication parameters.

[0012] In one possible design, the mobility management network element sends a first request, including identification information of the network slice, to the terminal device; and receives first authentication parameters from the terminal device.

[0013] Based on this possible design, the mobility management network element can also obtain the first authentication parameters by sending a first request to the terminal device, providing another feasible solution for the mobility management network element to obtain the first authentication parameters.

[0014] In one possible design, the mobility management network element receives the authentication method corresponding to the network slice from the terminal device.

[0015] In one possible design, the mobility management network element sends a second request, including a second identifier of the terminal device, to the unified data management network element; and receives subscription information from the unified data management network element, including the authentication method corresponding to the network slice.

[0016] In one possible design, the mobility management network element determines the authentication method corresponding to the network slice based on a pre-configured first correspondence and the identification information of the network slice; wherein, the first correspondence includes the identification information of the network slice and the authentication method corresponding to the identification information of the network slice.

[0017] Based on the three possible designs described above, the mobility management network element can receive the authentication method corresponding to the network slice sent by the terminal device; it can also obtain the authentication method corresponding to the network slice based on the terminal device's subscription information; or it can obtain the authentication method corresponding to the network slice based on the first correspondence, without restriction. This provides multiple feasible solutions for the mobility management network element to obtain the authentication method corresponding to the network slice.

[0018] In one possible design, the mobility management network element determines the network slice authentication and authorization network element based on one or more of the following information: the identification information of the network slice, the authentication method corresponding to the network slice, or the data network name corresponding to the network slice.

[0019] Based on this possible design, mobility management network elements can select appropriate network slice authentication and authorization network elements according to one or more of the above information, thereby improving the success rate of authenticating and authorizing terminal devices.

[0020] In one possible design, when the mobility management network element supports the authentication method of network slicing, the mobility management network element obtains the first authentication parameters corresponding to the network slice.

[0021] Based on this possible design, the mobility management network element can obtain the first authentication parameters corresponding to the network slice when the network slice authentication method is supported, thereby realizing the authentication and authorization of the terminal device. This avoids the mobility management network element continuing to perform the authentication and authorization of the terminal device when the network slice authentication method is not supported, thus improving the efficiency of authenticating and authorizing the terminal device.

[0022] In one possible design, when the mobility management network element does not support network slicing authentication, the mobility management network element sends a registration rejection message to the terminal device; wherein, the registration rejection message is used to instruct the mobility management network element to reject the registration request of the terminal device.

[0023] In one possible design, when the mobility management network element does not support the authentication method corresponding to the network slice, the mobility management network element sends a third request to the network slice selection network element; wherein, the third request includes the identification information of the network slice and the authentication method corresponding to the network slice; the mobility management network element receives the information of the target mobility management network element returned by the network slice selection network element; the mobility management network element sends the identification information of the network slice and the authentication method corresponding to the network slice to the target mobility management network element.

[0024] Based on the two possible designs mentioned above, when the mobility management network element does not support the authentication method corresponding to the network slice, the mobility management network element can send a registration rejection message to the terminal device, and can also send a third request to the network slice selection network element to request the target mobility management network element that supports the authentication method corresponding to the network slice, so that the target mobility management network element can continue to perform authentication and authorization for the terminal device.

[0025] Secondly, embodiments of this application provide a mobility management network element, which can implement the network element executed by the mobility management network element in the first aspect or possible designs described above. This network element can be implemented by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the aforementioned network element, such as a receiving module, a processing module, and a sending module. The receiving module is used to receive identification information of a network slice from a terminal device; the processing module is used to obtain the authentication method and first authentication parameters corresponding to the network slice; the authentication method includes PAP authentication or CHAP authentication; the first authentication parameters include PAP authentication parameters or CHAP authentication parameters; the processing module is further used to, after obtaining the authentication method, send the first identifier of the terminal device, the identification information of the network slice, and the first authentication parameters to the network slice authentication authorization network element through the sending module; the receiving module is further used to receive the first identifier and authentication result from the network slice authentication authorization network element; the sending module is further used to send the authentication result to the terminal device.

[0026] In one possible design, the receiving module is specifically used to receive a first message carrying a first authentication parameter from the terminal device.

[0027] In one possible design, the first message is a registration request, a security mode completion message, or an uplink non-access stratum transmission message.

[0028] In one possible design, the sending module is further configured to send a first request for the identification information of the network slice to the terminal device; the receiving module is further configured to receive the first authentication parameters from the terminal device.

[0029] In one possible design, the receiving module is specifically used to receive the authentication method corresponding to the network slice from the terminal device.

[0030] In one possible design, the sending module is further configured to send a second request, including the second identifier of the terminal device, to the unified data management network element; the receiving module is further configured to receive subscription information, including the authentication method corresponding to the network slice, from the unified data management network element.

[0031] In one possible design, the processing module is further configured to determine the authentication method corresponding to the network slice based on a pre-configured first correspondence and the identification information of the network slice; wherein the first correspondence includes the identification information of the network slice and the authentication method corresponding to the identification information of the network slice.

[0032] In one possible design, the processing module is further configured to determine the network slice authentication and authorization network element based on one or more of the following information: the identification information of the network slice, the authentication method corresponding to the network slice, or the data network name corresponding to the network slice.

[0033] In one possible design, the processing module is also used to obtain the first authentication parameter corresponding to the network slice when the processing module supports the authentication method of network slice.

[0034] In one possible design, the processing module is further configured to send a registration rejection message to the terminal device via the sending module when the processing module does not support the network slicing authentication method; wherein the registration rejection message is used to instruct the processing module to reject the registration request of the terminal device.

[0035] In one possible design, the processing module is further configured to send a third request to the network slice selection network element through the sending module when the processing module does not support the authentication method corresponding to the network slice; wherein the third request includes the identification information of the network slice and the authentication method corresponding to the network slice; the receiving module is further configured to receive the information of the target mobility management network element returned by the network slice selection network element; and the sending module is further configured to send the identification information of the network slice and the authentication method corresponding to the network slice to the target mobility management network element.

[0036] It should be noted that the specific implementation of this mobility management network element can also refer to the behavioral network element of the mobility management network element in the slice authentication method provided by the first aspect or any possible design of the first aspect. The technical effects brought by this mobility management network element can also refer to the technical effects brought by any possible design of the first aspect mentioned above, and will not be elaborated here.

[0037] Thirdly, embodiments of this application provide a mobility management network element, which can be a mobility management network element or a chip or system-on-a-chip within a mobility management network element. This mobility management network element can implement the network elements executed by the mobility management network element in the above aspects or possible designs, and the network element can be implemented in hardware. In one possible design, the mobility management network element may include a transceiver and a processor. The transceiver and processor can be used to support the mobility management network element in implementing the network elements involved in the first aspect or any possible design of the first aspect. For example: the transceiver can be used to receive identification information of a network slice from a terminal device; the processor can be used to obtain the authentication method and first authentication parameters corresponding to the network slice; the authentication method includes PAP authentication or CHAP authentication; the first authentication parameters include PAP authentication parameters or CHAP authentication parameters; the processor can also be used, after obtaining the authentication method, to send the first identifier of the terminal device, the identification information of the network slice, and the first authentication parameters to the network slice authentication and authorization network element through the transceiver; the transceiver can also be used to receive the first identifier and authentication result from the network slice authentication and authorization network element; and send the authentication result to the terminal device. In another possible design, the mobility management network element may further include a memory for storing necessary computer execution instructions and data. When the mobility management network element is running, the transceiver and processor execute the computer execution instructions stored in the memory to cause the mobility management network element to perform the slice authentication method as described in the first aspect or any possible design of the first aspect.

[0038] In the third aspect, the specific implementation of the mobility management network element can refer to the behavioral network element of the mobility management network element in the slice authentication provided by the first aspect or any possible design of the first aspect.

[0039] Fourthly, embodiments of this application provide a slice authentication method, which may include: a terminal device generating a first authentication parameter corresponding to a network slice; and sending the identification information of the network slice and the first authentication parameter to a mobility management network element; the terminal device also receiving an authentication result from the mobility management network element; wherein the first authentication parameter includes PAP authentication parameters or CHAP authentication parameters.

[0040] Based on the fourth aspect, the terminal device can send the network slice identification information and the first authentication parameters to the mobility management network element. This allows the mobility management network element to send the terminal device's first identifier, the network slice identification information, and the first authentication parameters to the network slice authentication and authorization network element when the network slice authentication method is PAP or CHAP. This enables the network slice authentication and authorization network element to initiate communication with the authentication and authorization server, using PAP or CHAP authentication to complete the authentication and authorization of the terminal device. This allows the 5G communication system to authenticate and authorize the terminal device according to the existing 5G authentication process when the authentication and authorization server supports EAP authentication. When the authentication and authorization server does not support EAP authentication, PAP or CHAP authentication can be used. This method also avoids compatibility issues caused by differences between the authentication method of the terminal device and the authentication method of the 5G communication system. For example, if the terminal device and the corresponding authentication and authorization server use PAP or CHAP authentication, but the core network of the 5G communication system still uses EAP authentication, the PAP / CHAP authentication process will fail, resulting in authentication failure. In the scheme of this application, when the terminal device and the corresponding authentication and authorization server adopt the authentication method of PAP or CHAP, the core network can also adopt the authentication method of PAP or CHAP, thereby enabling the 5G communication system to use PAP authentication or CHAP authentication to authenticate the terminal device, ensuring the compatibility of authentication methods.

[0041] In one possible design, when the first authentication parameter is a PAP authentication parameter, the first authentication parameter includes the username and first password of the terminal device.

[0042] In one possible design, when the first authentication parameter is a CHAP authentication parameter, the first authentication parameter includes the terminal device's username, a second password, and a random code; the terminal device generates a random code and pre-sets a shared key with the authentication and authorization server, and uses the random code, the shared key, and the terminal device's username to generate the second password.

[0043] Based on the two possible designs mentioned above, when the authentication method corresponding to the network slice is PAP authentication, the first authentication parameter can be the aforementioned PAP authentication parameter; when the authentication method corresponding to the network slice is CHAP authentication, the first authentication parameter can be the aforementioned CHAP authentication parameter; thus providing a feasible solution for generating the first authentication parameter for the terminal device.

[0044] In one possible design, the terminal device sends a first message carrying the first authentication parameters to the mobility management network element.

[0045] In one possible design, the first message is a registration request, a security mode completion message, or an uplink non-access stratum transmission message.

[0046] Based on the two possible designs mentioned above, the terminal device can send the first authentication parameters to the mobility management network element through the first message, providing a feasible solution for the mobility management network element to obtain the first authentication parameters.

[0047] In one possible design, the terminal device receives a first request from the mobility management network element, including identification information of network slices; and sends first authentication parameters to the mobility management network element according to the first request.

[0048] Based on this possible design, the terminal device can also send the first authentication parameters to the mobility management network element according to the first request, providing another feasible solution for the mobility management network element to obtain the first authentication parameters.

[0049] In one possible design, the terminal device sends the authentication method corresponding to the network slice to the mobility management network element; wherein the authentication method includes PAP authentication or CHAP authentication.

[0050] Fifthly, embodiments of this application provide a terminal device that can implement the functions performed by the terminal device in the fourth aspect or possible designs described above. These functions can be implemented by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the aforementioned functions, such as a processing module, a receiving module, and a sending module. The processing module is used to generate first authentication parameters corresponding to a network slice; wherein the first authentication parameters include PAP authentication parameters or CHAP authentication parameters. The sending module is used to send the identification information of the network slice and the first authentication parameters to the mobility management network element. The receiving module is used to receive the authentication result from the mobility management network element.

[0051] In one possible design, when the first authentication parameter is a PAP authentication parameter, the first authentication parameter includes the username and first password of the terminal device.

[0052] In one possible design, when the first authentication parameter is a CHAP authentication parameter, the first authentication parameter includes the username of the terminal device, the second password, and the random code; the processing module is specifically used to generate the random code, and pre-set a shared key with the authentication and authorization server, and use the random code, the shared key, and the username of the terminal device to generate the second password.

[0053] In one possible design, the sending module is specifically used to send a first message carrying the first authentication parameters to the mobility management network element.

[0054] In one possible design, the first message is a registration request, a security mode completion message, or an uplink non-access stratum transmission message.

[0055] In one possible design, the receiving module is further configured to receive a first request from the mobility management network element, including identification information of network slices; the processing module is further configured to send first authentication parameters to the mobility management network element through the sending module according to the first request.

[0056] In one possible design, the sending module is also used to send the authentication method corresponding to the network slice to the mobility management network element; wherein the authentication method includes PAP authentication or CHAP authentication.

[0057] It should be noted that the specific implementation of this terminal device can also refer to the behavior function of the terminal device in the slice authentication method provided by the fourth aspect or any possible design of the fourth aspect. The technical effects brought about by this terminal device can also refer to the technical effects brought about by any possible design of the fourth aspect mentioned above, and will not be elaborated here.

[0058] Sixthly, embodiments of this application provide a terminal device, which can be a terminal device or a chip or system-on-a-chip within a terminal device. This terminal device can implement the functions performed by the terminal device in the above aspects or possible designs, and these functions can be implemented in hardware. In one possible design, the terminal device may include a processor and a transceiver. The processor and transceiver can be used to support the terminal device in implementing the functions involved in the fourth aspect or any possible design of the fourth aspect. For example, the processor can be used to generate first authentication parameters corresponding to a network slice; wherein the first authentication parameters include PAP authentication parameters or CHAP authentication parameters; the transceiver can be used to send the identification information of the network slice and the first authentication parameters to the mobility management network element; the transceiver can also be used to receive authentication results from the mobility management network element. In yet another possible design, the terminal device may further include a memory for storing necessary computer execution instructions and data of the terminal device. When the terminal device is running, the transceiver and processor execute the computer execution instructions stored in the memory to cause the terminal device to perform the slice authentication method as described in the fourth aspect or any possible design of the fourth aspect.

[0059] In the sixth aspect, the specific implementation of the terminal device can refer to the behavior function of the terminal device in the slice authentication provided by the fourth aspect or any possible design of the fourth aspect.

[0060] In a seventh aspect, embodiments of this application provide a slice authentication method, which may include: a network slice authentication and authorization network element receiving a first identifier of a terminal device, identification information of a network slice corresponding to the terminal device, and a first authentication parameter corresponding to the network slice from a mobility management network element; wherein, the first authentication parameter includes password authentication protocol (PAP) authentication parameters or challenge handshake authentication protocol (CHAP) authentication parameters; after receiving the first authentication parameter, the network slice authentication and authorization network element sends a second authentication parameter to the authentication and authorization server corresponding to the identification information of the network slice; and receives the authentication result from the authentication and authorization server, and sends the authentication result and the first identifier to the mobility management network element.

[0061] Based on the seventh aspect, the network slice authentication and authorization network element can initiate communication with the authentication and authorization server based on the first identifier of the terminal device, the network slice identifier information, and the first authentication parameters sent by the mobility management network element when the network slice authentication method is PAP or CHAP authentication. It then uses PAP or CHAP authentication to complete the authentication and authorization of the terminal device. This allows the 5G communication system to authenticate and authorize the terminal device according to the existing 5G authentication process when the authentication and authorization server supports EAP authentication, and to use PAP or CHAP authentication when the authentication and authorization server does not support EAP authentication. This method also avoids compatibility issues caused by differences between the authentication method corresponding to the terminal device and the authentication method corresponding to the 5G communication system. For example, if the terminal device and the corresponding authentication and authorization server use PAP or CHAP authentication, but the core network of the 5G communication system still uses EAP authentication, the PAP / CHAP authentication process will fail, resulting in authentication failure. In the scheme of this application, when the terminal device and the corresponding authentication and authorization server adopt the authentication method of PAP or CHAP, the core network can also adopt the authentication method of PAP or CHAP, thereby enabling the 5G communication system to use PAP authentication or CHAP authentication to authenticate the terminal device, ensuring the compatibility of authentication methods.

[0062] In one possible design, when the first authentication parameter includes the CHAP authentication parameter, the second authentication parameter is the first authentication parameter.

[0063] In one possible design, the first authentication parameter includes the username of the terminal device; the network slice authentication and authorization network element stores the username of the terminal device and the first identifier of the terminal device; the network slice authentication and authorization network element receives a request from the authentication and authorization server carrying the username of the terminal device; the network slice authentication and authorization network element obtains the first identifier of the terminal device based on the username of the terminal device; the network slice authentication and authorization network element sends a request to the mobility management network element carrying the first identifier of the terminal device and the identification information of the network slice; this request is used to request the mobility management network element to revoke the authorization of the terminal device in the network slice.

[0064] Based on this possible design, the network slice authentication and authorization network element can also send a request to the mobility management network element based on the received request for the username of the carrying terminal device, along with a request for the identification information of the network slice, in order to revoke the authorization of the terminal device in the network slice.

[0065] Eighthly, embodiments of this application provide a network slice authentication and authorization network element. This network slice authentication and authorization network element can implement the functions performed by the network slice authentication and authorization network element in the seventh aspect or possible designs of the seventh aspect. The functions can be implemented by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions, such as a receiving module, a processing module, and a sending module. The receiving module is used to receive a first identifier of a terminal device, the identifier information of the network slice corresponding to the terminal device, and a first authentication parameter corresponding to the network slice from a mobility management network element; wherein, the first authentication parameter includes PAP authentication parameters or CHAP authentication parameters; the processing module is used to send a second authentication parameter to the authentication and authorization server corresponding to the identifier information of the network slice through the sending module after the receiving module receives the first authentication parameter; the receiving module is also used to receive the authentication result from the authentication and authorization server; the sending module is also used to send the authentication result and the first identifier to the mobility management network element.

[0066] In one possible design, when the first authentication parameter includes the CHAP authentication parameter, the second authentication parameter is the first authentication parameter.

[0067] In one possible design, the first authentication parameter includes the username of the terminal device; the processing module is further configured to store the username of the terminal device and the first identifier of the terminal device; the receiving module is further configured to receive a request from the authentication and authorization server carrying the username of the terminal device; the processing module is further configured to obtain the first identifier of the terminal device based on the username of the terminal device; and the sending module is further configured to send a request carrying the first identifier of the terminal device and the identification information of the network slice to the mobility management network element; the request is used to request the mobility management network element to revoke the authorization of the terminal device in the network slice.

[0068] It should be noted that the specific implementation of this network slice authentication and authorization network element can also refer to the behavioral network element of the network slice authentication and authorization network element in the slice authentication method provided in aspect seven or any possible design of aspect seven. The technical effects brought about by this network slice authentication and authorization network element can also refer to the technical effects brought about by any possible design of aspect seven above, and will not be elaborated here.

[0069] Ninthly, embodiments of this application provide a network slice authentication and authorization network element, which can be a network slice authentication and authorization network element or a chip or system-on-a-chip within a network slice authentication and authorization network element. This network slice authentication and authorization network element can implement the functions performed by the network slice authentication and authorization network element in the above aspects or possible designs, and these functions can be implemented in hardware. In one possible design, the network slice authentication and authorization network element may include a transceiver and a processor. The transceiver and processor can be used to support the network slice authentication and authorization network element in implementing the functions involved in the seventh aspect or any possible design of the seventh aspect. For example, the transceiver can be used to receive a first identifier of a terminal device from a mobility management network element, identifier information of a network slice corresponding to the terminal device, and a first authentication parameter corresponding to the network slice; wherein the first authentication parameter includes PAP authentication parameters or CHAP authentication parameters; the processor can be used to send a second authentication parameter to the authentication and authorization server corresponding to the identifier information of the network slice after the transceiver receives the first authentication parameter; the transceiver can also be used to receive the authentication result from the authentication and authorization server; and send the authentication result and the first identifier to the mobility management network element. In another possible design, the network slice authentication and authorization element may further include a memory for storing necessary computer execution instructions and data. When the network slice authentication and authorization element is running, the transceiver and processor execute the computer execution instructions stored in the memory to cause the network slice authentication and authorization element to perform the slice authentication method as described in aspect seven above or any possible design of aspect seven.

[0070] In particular, the specific implementation of the network slice authentication and authorization network element in the ninth aspect can refer to the behavioral functions of the network slice authentication and authorization network element in the slice authentication provided by the seventh aspect or any possible design of the seventh aspect.

[0071] A tenth aspect provides a communication device comprising one or more processors and one or more communication interfaces, wherein the one or more processors are configured to execute computer programs or instructions, and the one or more communication interfaces are coupled to the one or more processors, wherein when the one or more processors execute the computer instructions or instructions, the communication device performs a slice authentication method as described in the first aspect or any possible design of the first aspect; or performs a slice authentication method as described in the fourth aspect or any possible design of the fourth aspect; or performs a slice authentication method as described in the seventh aspect or any possible design of the seventh aspect; and the one or more communication interfaces are configured to communicate with other modules outside the communication device.

[0072] In one possible design, the communication device further includes one or more memories coupled to one or more processors, the memories used to store the aforementioned computer programs or instructions. In one possible implementation, the memories are located outside the communication device. In another possible implementation, the memories are located inside the communication device. In embodiments of this application, the processor and memory may also be integrated into a single device, i.e., the processor and memory can be integrated together.

[0073] Eleventhly, a communication device is provided, the communication device including an interface circuit and a logic circuit; the interface circuit is coupled to the logic circuit; the logic circuit is used to perform the slice authentication method as described in the first aspect or any possible design of the first aspect; or to perform the slice authentication method as described in the fourth aspect or any possible design of the fourth aspect; or to perform the slice authentication method as described in the seventh aspect or any possible design of the seventh aspect; the interface circuit is used to communicate with other modules outside the communication device.

[0074] In a twelfth aspect, a computer-readable storage medium is provided that stores computer instructions or programs that, when executed on a computer, cause the computer to perform the slice authentication method as described in the first aspect or any possible design of the first aspect, or to perform the slice authentication method as described in the fourth aspect or any possible design of the fourth aspect, or to perform the slice authentication method as described in the seventh aspect or any possible design of the seventh aspect.

[0075] In a thirteenth aspect, a computer program product comprising computer instructions is provided, which, when run on a computer, causes the computer to perform the slice authentication method as described in the first aspect or any possible design of the first aspect, or to perform the slice authentication method as described in the fourth aspect or any possible design of the fourth aspect, or to perform the slice authentication method as described in the seventh aspect or any possible design of the seventh aspect.

[0076] In a fourteenth aspect, embodiments of this application provide a computer program that, when run on a computer, causes the computer to perform the slice authentication method as described in the first aspect or any possible design of the first aspect, or to perform the slice authentication method as described in the fourth aspect or any possible design of the fourth aspect, or to perform the slice authentication method as described in the seventh aspect or any possible design of the seventh aspect.

[0077] The technical effects of any of the design methods in aspects 10 to 14 can be found in the technical effects of any possible design in aspect 1 above, or in the technical effects of any possible design in aspect 4 above, or in the technical effects of any possible design in aspect 7 above, and will not be elaborated further.

[0078] In a fifteenth aspect, a communication system is provided, comprising a mobility management network element as described in any one of the second to third aspects and a network slicing authentication and authorization network element as described in any one of the eighth to ninth aspects. Attached Figure Description

[0079] Figure 1a A schematic diagram of a communication system provided in an embodiment of this application; Figure 1b This is a schematic diagram of a 5G communication system provided in an embodiment of this application; Figure 2 A structural diagram of a communication device provided in an embodiment of this application; Figure 3 A flowchart of a slice authentication method provided in this application embodiment; Figure 4 A flowchart illustrating a method for revoking authorization, as provided in this application embodiment; Figure 5 A schematic diagram illustrating the composition of a mobility management network element provided in an embodiment of this application; Figure 6 This is a schematic diagram of the composition of a terminal device provided in an embodiment of this application; Figure 7 This is a schematic diagram illustrating the composition of a network slice authentication and authorization network element provided in an embodiment of this application. Detailed Implementation

[0080] Before describing the embodiments of this application, the technical terms involved in the embodiments of this application will be described.

[0081] Network slice: refers to a logical network that can provide specific network capabilities and characteristics.

[0082] In a communication system, based on the protocols and configuration requirements between the operator and third-party service providers, when a terminal device requests access to a network slice, the core network device can initiate communication with the authentication, authorization, and accounting (AAA) server to authenticate and authorize the terminal device.

[0083] For 4th-generation (4G) communication systems, the AAA server can use point-to-point protocols (PPP) such as Password Authentication Protocol (PAP) and Challenge Handshake Authentication Protocol (CHAP) to authenticate and authorize terminal devices. When defining 5th-generation (5G) communication systems, the 3rd Generation Partnership Project (3GPP) only defined the Extensible Authentication Protocol (EAP) for network slice authentication.

[0084] In the early stages of 5G communication system deployment, due to factors in the industry environment, AAA servers may not be able to support EAP authentication, resulting in EAP authentication not being usable between terminal devices and AAA servers, and AAA servers being unable to authenticate and authorize terminal devices.

[0085] In addition, if the AAA server does not support EAP, the 5G communication system needs to use PAP / CHAP to authenticate and authorize terminal devices. However, the terminal devices may support the EAP authentication method. Therefore, there may be situations where the authentication method corresponding to the terminal device and the authentication method corresponding to the 5G communication system coexist, which will cause compatibility issues and prevent the AAA server from authenticating and authorizing the terminal devices.

[0086] To address this issue, embodiments of this application provide a slice authentication method, apparatus, and system. A mobility management network element (MLE) can receive network slice identification information from a terminal device and obtain the authentication method and first authentication parameters corresponding to the network slice. The authentication method includes PAP authentication or CHAP authentication. The MLE can send the terminal device's first identifier, the network slice identification information, and the first authentication parameters to a network slice authentication authorization network element based on the network slice's authentication method. It also receives the first identifier and authentication result from the network slice authentication authorization network element and sends the authentication result to the terminal device.

[0087] In this embodiment, when the network slice authentication method is PAP or CHAP authentication, the mobility management network element can send the terminal device's first identifier, the network slice's identifier information, and the first authentication parameters to the network slice authentication and authorization network element. This allows the network slice authentication and authorization network element to initiate communication with the authentication and authorization server, using PAP or CHAP authentication to complete the authentication and authorization of the terminal device. This enables the 5G communication system to authenticate and authorize the terminal device according to the existing 5G authentication process when the authentication and authorization server supports EAP authentication, and to use PAP or CHAP authentication when the authentication and authorization server does not support EAP authentication. This method also avoids compatibility issues caused by differences between the authentication method of the terminal device and the authentication method of the 5G communication system. For example, if the terminal device and its corresponding authentication and authorization server use PAP or CHAP authentication, but the core network of the 5G communication system still uses EAP authentication, the PAP / CHAP authentication process will fail, resulting in authentication failure. In the scheme of this application, when the terminal device and the corresponding authentication and authorization server adopt the authentication method of PAP or CHAP, the core network can also adopt the authentication method of PAP or CHAP, thereby enabling the 5G communication system to use PAP authentication or CHAP authentication to authenticate the terminal device, ensuring the compatibility of authentication methods.

[0088] The embodiments of this application will now be described in detail with reference to the accompanying drawings.

[0089] The communication method provided in this application can be used in any communication system, such as a third-generation partnership project (3GPP) communication system, for example, a long-term evolution (LTE) system, or a fifth-generation (5G) mobile communication system, a new radio (NR) system, an NR V2X system, and other next-generation communication systems, or a non-3GPP communication system, without limitation.

[0090] The communication method provided in this application can be applied to various communication scenarios, such as one or more of the following: enhanced mobile broadband (eMBB), ultra-reliable low latency communication (URLLC), machine-type communication (MTC), massive machine-type communication (mMTC), device-to-device (D2D), vehicle-to-everything (V2X), vehicle-to-vehicle (V2V), and Internet of Things (IoT), etc. The following examples illustrate this. Figure 1a Taking an example, the communication method provided in the embodiments of this application will be described.

[0091] Figure 1a A schematic diagram of a communication system provided in an embodiment of this application is shown below. Figure 1a As shown, the communication system may include terminal equipment, core network equipment, and a data network (DN); wherein, the core network equipment may include mobility management network elements, network slice authentication and authorization network elements, network slice selection network elements, unified data management network elements, and policy control network elements; the data network may include authentication and authorization servers.

[0092] in, Figure 1a Terminal devices can provide authentication methods for network slicing. For example, terminal devices can communicate with core network devices through specific interfaces, such as the next-generation (N)1 interface (N1 for short) to communicate with mobility management network elements in the core network device.

[0093] Figure 1a The terminal equipment in this context can also be called user equipment (UE), mobile station (MS), or mobile terminal (MT), etc. Specifically, Figure 1a The terminal device can be a mobile phone, tablet computer, or computer with wireless transceiver capabilities. It can also be a virtual reality (VR) terminal, an augmented reality (AR) terminal, a wireless terminal in industrial control, a wireless terminal in autonomous driving, a wireless terminal in telemedicine, a wireless terminal in a smart grid, a wireless terminal in a smart city, a wireless terminal in a smart home, an in-vehicle terminal, a vehicle with vehicle-to-vehicle (V2V) communication capabilities, an intelligent connected vehicle, a drone with drone-to-drone (U2U) communication capabilities, etc., without restriction.

[0094] Figure 1a The mobility management network element can perform corresponding authentication processes according to the authentication method of network slicing. It can also be responsible for terminal device access authentication, mobility management, signaling interaction between various network elements, such as managing user registration status, user connection status, user registration and network access, tracking area updates, cell handover user authentication and key security.

[0095] Figure 1a The network slice authentication and authorization network element in the data network can complete the network slice authentication of terminal devices by interacting with the authentication and authorization server in the data network.

[0096] Figure 1a In the network slice selection, you can choose the network slice that provides services to the terminal device, or you can choose the mobility management network element corresponding to the network slice.

[0097] Figure 1a The unified data management network element can store the subscription information of terminal devices.

[0098] Figure 1a The policy control network element can be used to provide policies to mobility management network elements, session management network elements, terminal equipment, etc., such as quality of service policies, UE route selection policies (URSP), etc.

[0099] Figure 1aThe data network (DN) in a DN can be a carrier network that provides data transmission services to users, such as a carrier network that provides IP multimedia service (IMS). An authentication and authorization server can be deployed in the DN to provide authentication and authorization services to users.

[0100] It should be noted that the terminal device, core network device, and authentication and authorization server in the embodiments of this application can all be one or more chips, or they can be system on chip (SOC), etc. Figure 1a The accompanying drawings are merely illustrative and the number of devices included is not limited. Furthermore, except... Figure 1a In addition to the device shown, the communication system may also include other devices. For example, besides Figure 1a In addition to the network elements shown, Figure 1a The communication system shown may also include access network elements, session management network elements, user plane network elements, etc., without limitation. Figure 1a The names of the various devices and links are unrestricted, except... Figure 1a In addition to the names shown, each device and each link can be named in other ways without restriction.

[0101] by Figure 1a The communication system shown is an example of a 5G communication system. Figure 1b As shown, the network elements or entities corresponding to the above-mentioned mobility management network elements can be the access and mobility management function (AMF) in the 5G communication system; the network elements or entities corresponding to the network slice authentication and authorization network elements can be the network slice specific authentication and authorization function (NSSAAF) in the 5G communication system; the network elements or entities corresponding to the network slice selection network elements can be the network slice selection function (NSSF) in the 5G communication system; the network elements or entities corresponding to the unified data management network elements can be the unified data management (UDM) in the 5G communication system; and the policy control network elements can be the policy control function (PCF) in the 5G communication system, etc.

[0102] Among them, such as Figure 1bAs shown, the terminal device communicates with the AMF via the N1 interface. Core network devices can communicate with each other through service-oriented interfaces, such as: the AMF can communicate with other core network devices through the Namf interface, the NSSAAF can communicate with other core network devices through the Nnssaaf interface, the NSSF can communicate with other core network devices through the Nnssf interface, the UDM can communicate with other core network devices through the Nudm interface, and the PCF can communicate with other core network devices through the Npcf interface.

[0103] In practical implementation, Figure 1a As shown, terminal devices, core network devices, and authentication and authorization servers can all adopt [this approach]. Figure 2 The shown composition structure, or including Figure 2 The components shown. Figure 2 This is a schematic diagram illustrating the composition of a communication device 200 provided in an embodiment of this application. The communication device 200 can be a terminal, a chip within a terminal, or a system-on-a-chip (SoC); it can also be an access network element, a chip within an access network element, or a SoC; or it can be core network equipment, a chip within core network equipment, or a SoC. For example... Figure 2 As shown, the communication device 200 includes a processor 201, a transceiver 202, and a communication line 203.

[0104] Furthermore, the communication device 200 may also include a memory 204. The processor 201, memory 204, and transceiver 202 can be connected via a communication line 203.

[0105] The processor 201 can be a central processing unit (CPU), a network processor (NP), a digital signal processor (DSP), a microprocessor, a microcontroller, a programmable logic device (PLD), or any combination thereof. The processor 201 can also be other devices with processing capabilities, such as circuits, devices, or software modules, without limitation.

[0106] Transceiver 202 is used to communicate with other devices or other communication networks. These other communication networks can be Ethernet, radio access network (RAN), wireless local area networks (WLAN), etc. Transceiver 202 can be a module, circuit, transceiver, or any device capable of enabling communication.

[0107] Communication line 203 is used to transmit information between the components included in communication device 200.

[0108] Memory 204 is used to store instructions. These instructions can be computer programs.

[0109] The memory 204 can be a read-only memory (ROM) or other type of static storage device that can store static information and / or instructions; it can also be a random access memory (RAM) or other type of dynamic storage device that can store information and / or instructions; it can also be an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, etc., without limitation.

[0110] It should be noted that the memory 204 can exist independently of the processor 201 or can be integrated with the processor 201. The memory 204 can be used to store instructions, program code, or some data, etc. The memory 204 can be located inside or outside the communication device 200, without limitation. The processor 201 is used to execute the instructions stored in the memory 204 to implement the slice authentication method provided in the following embodiments of this application.

[0111] In one example, processor 201 may include one or more CPUs, for example Figure 2 CPU0 and CPU1 in the CPU.

[0112] As an optional implementation, the communication device 200 includes multiple processors, for example, besides Figure 2 In addition to processor 201, it may also include processor 207.

[0113] As an optional implementation, the communication device 200 also includes an output device 205 and an input device 206. For example, the input device 206 is a device such as a keyboard, mouse, microphone, or joystick, and the output device 205 is a device such as a display screen or speaker.

[0114] It should be noted that the communication device 200 can be a desktop computer, laptop computer, network server, mobile phone, tablet computer, wireless terminal, embedded device, chip system, or other device. Figure 2Equipment with a similar structure. Furthermore... Figure 2 The structural composition shown does not constitute a limitation on the communication device, except... Figure 2 In addition to the components shown, the communication device may include more or fewer components than illustrated, or combine certain components, or have different component arrangements.

[0115] In this embodiment of the application, the chip system may be composed of chips or may include chips and other discrete devices.

[0116] Furthermore, the actions, terms, etc., involved in the various embodiments of this application can be referenced interchangeably without limitation. The message names or parameter names in the messages exchanged between the various devices in the embodiments of this application are merely examples, and other names may be used in specific implementations without limitation.

[0117] The following is combined Figure 1a and Figure 1b The communication system shown herein describes the slice authentication method provided in the embodiments of this application. The terminal device can be any terminal device in the communication system, the mobility management network element can be any mobility management network element in the communication system, and the network slice authentication and authorization network element can be any network slice authentication and authorization network element in the communication system. The terminal device, mobility management network element, network slice authentication and authorization network element, and authentication and authorization server described in the following embodiments can possess… Figure 2 The component shown.

[0118] Figure 3 A flowchart of a slice authentication method provided in this application embodiment is shown below. Figure 3 As shown, the method may include: Step 301: The terminal device sends the identification information of the network slice to the mobility management network element.

[0119] Among them, network slicing can be the network slice that the terminal device needs to access.

[0120] Specifically, when a terminal device needs to communicate through network slicing, it can send the identification information of the network slice to the mobility management network element in the core network. Under the action of the core network equipment, including the mobility management network element, and the authentication and authorization server, the terminal device can complete the network slice authentication and authorization, thereby enabling the terminal device to communicate through network slicing.

[0121] Optionally, when the terminal device corresponds to multiple network slices, the terminal device sends the identification information of the multiple network slices corresponding to the terminal device to the mobility management network element in a list manner.

[0122] Optionally, the terminal device may send the identification information of the network slice corresponding to the terminal device in the registration request to the mobility management network element.

[0123] For example, the identification information of a network slice can be single network slice selection assistance information (S-NSSAI).

[0124] S-NSSAI can include slice / service type (SST) information, which describes the expected network slicing behavior, such as the slice / service type used to describe the network slice, and is not limited.

[0125] For example, the slice / service type (SST) of a network slice can include: enhanced mobile broadband (eMBB), ultra-reliable low latency communications (URLLC), massive Internet of Things (MIoT), vehicle to everything (V2X), etc., without limitation.

[0126] Optionally, S-NSSAI also includes slice differentiator (SD) information, which is supplementary information to SST information. When SST information points to multiple network slices, SD information can help to correspond to a unique network slice.

[0127] Step 302: The mobility management network element obtains the authentication method corresponding to the network slice.

[0128] The authentication methods may include PAP authentication or CHAP authentication.

[0129] In one possible design, the mobility management network element receives the authentication method corresponding to the network slice sent by the terminal device.

[0130] The terminal device can determine the authentication method corresponding to the network slice and send the authentication method corresponding to the network slice to the mobility management network element.

[0131] Specifically, terminal devices can send the network slice identification information and the corresponding authentication method to the mobility management network element in the registration request; alternatively, they can send the network slice identification information and the corresponding authentication method to the mobility management network element separately, without restriction.

[0132] For example, the terminal device can determine the authentication method corresponding to the network slice based on the configuration information pre-issued by the management plane network element.

[0133] The configuration information may include the authentication method corresponding to the network slice; the management plane network element may be the operation administration and maintenance (OAM) system.

[0134] In another example, the terminal device can determine the authentication method corresponding to the network slice based on the URSP rules configured by the policy control network element.

[0135] The URSP rules can include the authentication method corresponding to the network slice.

[0136] It should be noted that the specific description of URSP rules can be found in the description of URSP rules in existing communication protocols, and will not be repeated here.

[0137] In another example, the terminal device can determine the authentication method corresponding to the network slice based on the UE parameter update (UPU) process initiated by the unified data management network element.

[0138] The specific description of the UPU process can be found in the existing communication protocol descriptions of the UPU process, and will not be repeated here.

[0139] In another possible design, the mobility management network element determines the authentication method corresponding to the network slice based on the subscription information of the terminal device.

[0140] For example, the mobility management network element can send a second request to the unified data management network element and receive the subscription information of the terminal device sent by the unified data management network element.

[0141] The second request may include the second identifier of the terminal device; the subscription information of the terminal device may include the authentication method corresponding to the network slice.

[0142] Optionally, the second identifier of the terminal device is a subscription permanent identifier (SUPI).

[0143] In another possible design, the mobility management network element determines the authentication method of the network slice based on the pre-configured first correspondence and the identification information of the network slice.

[0144] The first correspondence may include the identification information of the network slice and the authentication method corresponding to the identification information of the network slice.

[0145] Specifically, the mobility management network element can determine the authentication method corresponding to the network slice based on the identification information of the network slice sent by the terminal device and according to the first correspondence.

[0146] For example, the first correspondence can be the correspondence between the identification information of the network slice and the authentication method, or it can be the correspondence between the authentication method and the identification information of the network slice.

[0147] For example, the first correspondence can be the correspondence between the identification information and authentication method of the network slice, as shown in Table 1 below.

[0148] Table 1

[0149] For example, the first correspondence can also be the correspondence between the authentication method and the identification information of the network slice, as shown in Table 2 below.

[0150] Table 2

[0151] Optionally, after obtaining the authentication method corresponding to the network slice, the mobility management network element determines whether it supports the authentication method corresponding to the network slice based on the pre-configured authentication method; if it does, it continues to authenticate and authorize the terminal device.

[0152] For example, if the authentication method pre-configured for the mobility management network element is PAP authentication, when the authentication method of the network slice is PAP authentication, it is determined that the mobility management network element supports the authentication method of the network slice; otherwise, it is determined that the mobility management network element does not support the authentication method of the network slice.

[0153] Furthermore, when the terminal device sends the network slice identification information in the registration request to the mobility management network element, the mobility management network element can obtain the authentication method of the network slice and determine whether the authentication method of the network slice is supported. If supported, the mobility management network element can send a registration accept message to the terminal device to instruct the mobility management network element to accept the registration request of the terminal device.

[0154] Step 303: The terminal device generates the first authentication parameters corresponding to the network slice.

[0155] In one possible design, when the authentication method includes PAP authentication, the first authentication parameters include the username and first password of the terminal device.

[0156] The username of the terminal device can be used to indicate the terminal device, and the first password corresponds to the username.

[0157] In another possible design, when the authentication method includes CHAP authentication, the first authentication parameters include the terminal device's username, second password, and random code.

[0158] The terminal device's username can be used to indicate the terminal device; the second password corresponds to the terminal device's username; and the random code can be randomly generated by the terminal device.

[0159] Optionally, the random code is a 16-byte random code randomly generated by the terminal device.

[0160] For example, the terminal device can use a shared key with the authentication and authorization server, as well as a random code generated by the terminal device, to generate a second password.

[0161] Specifically, the terminal device can encrypt the shared key and random code based on the message-digest algorithm 5 (MD5) to obtain the second password.

[0162] Optionally, the second password is 16 bytes in size.

[0163] It should be noted that the first password and the second password mentioned above can be the same or different, and there is no restriction.

[0164] Furthermore, there is no restriction on the order in which the terminal device executes steps 301 and 303. The terminal device may execute step 301 first and then step 303; or it may execute step 303 first and then step 301; or it may execute steps 301 and 303 simultaneously without restriction.

[0165] There is no restriction on the order in which steps 302 and 303 are executed. Step 302 can be executed first, followed by step 303; or step 303 can be executed first, followed by step 302; or steps 302 and 303 can be executed simultaneously.

[0166] Step 304: The mobility management network element obtains the first authentication parameters corresponding to the network slice.

[0167] In one possible design, the mobility management network element receives a first message from the terminal device carrying the first authentication parameters.

[0168] The first message can be a registration request, a security mode complete message, or an up-link non-access stratum transport (UL NAS transport) message.

[0169] For example, the terminal device may send the first authentication parameter in the registration request to the mobility management network element when saving the non-access stratum (NAS) security context; or, it may be described that the terminal device sends the first authentication parameter in the registration request to the mobility management network element when the registration request is securely protected.

[0170] In another example, when the terminal device does not save the NAS security context, or in other words, when the registration request is not securely protected, the terminal device can send the first authentication parameters in the security mode completion message to the mobility management network element.

[0171] In another example, the terminal device may also send the first authentication parameter in the uplink non-access stratum transport message to the mobility management element when communicating with the mobility management element.

[0172] In another possible design, the mobility management network element sends a first request to the terminal device and receives the first authentication parameters from the terminal device.

[0173] The first request may include identification information for the network slice.

[0174] For example, the mobility management network element can send the first request to the terminal device in a downlink non-access stratum transport (DL NAS transport) message.

[0175] The first request may further include indication information for instructing the acquisition of the first authentication parameters corresponding to the network slice, so that the terminal device sends the first authentication parameters corresponding to the network slice to the mobility management network element according to the indication information.

[0176] In another example, the mobility management network element can also send the first request to the terminal device in the registration acceptance message.

[0177] Specifically, the terminal device can send the network slice identification information and the first authentication parameters corresponding to the network slice in the uplink non-access stratum message to the mobility management network element based on the received first request.

[0178] Step 305: After obtaining the authentication method, the mobility management network element sends the terminal device's first identifier, the network slice's identifier information, and the first authentication parameters to the network slice authentication and authorization network element.

[0179] The first identifier can be a generic public subscription identifier (GPSI).

[0180] For example, a mobility management network element can determine a network slice authentication and authorization network element based on one or more of the following information: the identification information of the network slice, the authentication method corresponding to the network slice, or the data network name corresponding to the network slice.

[0181] Among them, the mobility management network element can determine the network slice authentication authorization network element based on the correspondence between the authentication method pre-configured by the management plane network element and the network slice authentication authorization network element that supports the authentication method.

[0182] For example, taking the correspondence between the authentication method of the network slice pre-configured by the management plane network element and the network slice authentication authorization network element that supports the authentication method as shown in Table 3 below, when the authentication method corresponding to the network slice obtained by the mobility management network element includes PAP authentication, the mobility management network element can send the first identifier of the terminal device, the identifier information of the network slice and the first authentication parameters to the network slice authentication authorization network element 1.

[0183] Table 3

[0184] Among them, the mobility management network element can also determine the network slice authentication and authorization network element corresponding to the received network slice identification information based on the correspondence between the network slice identification information pre-configured by the management plane network element and the network slice authentication and authorization network element.

[0185] For example, taking the correspondence between the network slice identification information pre-configured by the management plane network element and the network slice authentication and authorization network element as shown in Table 4 below, when the network slice identification information received by the mobility management network element is S-NSSAI1, the mobility management network element can send the first identifier of the terminal device, S-NSSAI1 and the first authentication parameters to the network slice authentication and authorization network element 1.

[0186] Table 4

[0187] Furthermore, the mobility management network element can also determine the network slice authentication and authorization network element based on the correspondence between the data network name (DNN) pre-configured by the management plane network element and the network slice authentication and authorization network element.

[0188] For example, the mobility management network element can determine the DNN corresponding to the network slice based on the identification information of the network slice, determine the network slice authentication and authorization network element based on the correspondence between the DNN and the network slice authentication and authorization network element, and send the first identifier of the terminal device, the identification information of the network slice, and the first authentication parameters to the network slice authentication and authorization network element.

[0189] Step 306: After receiving the first authentication parameter, the network slice authentication and authorization network element sends the second authentication parameter to the authentication and authorization server corresponding to the identification information of the network slice.

[0190] For example, when the first authentication parameter includes PAP authentication parameters, referring to step 303 above, the first authentication parameter may include the username and first password of the terminal device; the network slice authentication and authorization network element may generate a random code and pre-set a shared key with the authentication and authorization server; use the shared key, random code and first password to generate a third password; and send the username, random code and third password of the terminal device as the second authentication parameter to the authentication and authorization server.

[0191] The random code can be a 16-byte random code randomly generated by the network slice authentication and authorization network element; the shared key can be sent in advance by the authentication and authorization server to the network slice authentication and authorization network element, or it can be negotiated in advance between the authentication and authorization server and the network slice authentication and authorization network element, without restriction.

[0192] Specifically, network slice authentication and authorization network elements can use the following formula to process the shared key, random code, and first password based on the MD5 algorithm to obtain the third password: The third password = the first password XOR MD5 (random code + shared key); Where XOR stands for Exclusive OR and MD5 stands for MD5 algorithm.

[0193] In another example, when the first authentication parameter includes the CHAP authentication parameter, the second authentication parameter can be the first authentication parameter.

[0194] Referring to step 303 above, the second authentication parameters may include the terminal device's username, second password, and random code.

[0195] Optionally, the network slice authentication and authorization network element stores the username of the terminal device and the first identifier of the terminal device corresponding to the username in the first authentication parameters.

[0196] Step 307: The authentication and authorization server authenticates and authorizes the terminal device according to the second authentication parameters and obtains the authentication result.

[0197] The authentication and authorization server can be an AAA server.

[0198] For example, when the second authentication parameters include the terminal device's username, random code, and third password, the authentication and authorization server can retrieve the user password from the database based on the terminal device's username, and generate a fourth password using the user password, the shared key with the network slice authentication and authorization network element, and the random code in the second authentication parameters; and compare the third password with the fourth password. If they are the same, the authentication result is determined to be successful; otherwise, the authentication result is determined to be unsuccessful.

[0199] The authentication and authorization server can use the following formula to process the user password, shared key, and random code based on the MD5 algorithm to obtain the fourth password: The fourth password = user password XOR MD5 (random code + shared key); Where XOR stands for Exclusive OR and MD5 stands for MD5 algorithm.

[0200] In another example, when the second authentication parameter includes the terminal device's username, second password, and random code, the authentication and authorization server can look up the shared key with the terminal device in the database based on the terminal device's username, use the shared key and the random code in the second authentication parameter to generate a fifth password; and determine whether the fifth password generated by the authentication and authorization server is the same as the second password in the second authentication parameter. If they are the same, the authentication result is determined to be successful; otherwise, the authentication result is determined to be unsuccessful.

[0201] The authentication and authorization server can encrypt the shared key and random code based on the MD5 algorithm to obtain the fifth cipher.

[0202] Step 308: The authentication and authorization server sends the authentication result to the network slice authentication and authorization network element.

[0203] Optionally, the authentication and authorization server may also send the username of the terminal device corresponding to the authentication result to the network slice authentication and authorization network element.

[0204] Step 309: The network slice authentication and authorization network element sends the authentication result and the first identifier of the terminal device to the mobility management network element.

[0205] Among them, the network slice authentication and authorization network element can determine the first identifier of the terminal device corresponding to the received authentication result based on the pre-saved username of the terminal device and the first identifier of the terminal device corresponding to the username, and send the authentication result and the first identifier of the terminal device corresponding to the authentication result to the mobility management network element.

[0206] Step 310: The mobility management network element sends the authentication result to the terminal device.

[0207] The mobility management network element can send the authentication result to the terminal device based on the received authentication result and the first identifier of the terminal device corresponding to the authentication result, so that the terminal device can communicate through network slicing based on the authentication result.

[0208] Based on the above Figure 3 The method shown allows the mobility management network element to send the terminal device's first identifier, the network slice's identifier information, and the first authentication parameters to the network slice authentication and authorization network element when the network slice authentication method is PAP or CHAP. This enables the network slice authentication and authorization network element to initiate communication with the authentication and authorization server, using PAP or CHAP authentication to complete the authentication and authorization of the terminal device. This allows the 5G communication system to authenticate and authorize the terminal device according to the existing 5G authentication process when the authentication and authorization server supports EAP authentication, and to use PAP or CHAP authentication when the authentication and authorization server does not support EAP authentication. This method also avoids compatibility issues caused by differences between the authentication method of the terminal device and the authentication method of the 5G communication system. For example, if the terminal device and its corresponding authentication and authorization server use PAP or CHAP authentication, but the core network of the 5G communication system still uses EAP authentication, the PAP / CHAP authentication process will fail, resulting in authentication failure. In the scheme of this application, when the terminal device and the corresponding authentication and authorization server adopt the authentication method of PAP or CHAP, the core network can also adopt the authentication method of PAP or CHAP, thereby enabling the 5G communication system to use PAP authentication or CHAP authentication to authenticate the terminal device, ensuring the compatibility of authentication methods.

[0209] Furthermore, in step 302 above, when the terminal device sends the network slice identification information in the registration request to the mobility management network element, the mobility management network element can obtain the authentication method of the network slice and determine whether the authentication method of the network slice is supported. If it is determined that the authentication method corresponding to the network slice is not supported, the mobility management network element can send a registration reject message to the terminal device to instruct the mobility management network element to reject the registration request of the terminal device.

[0210] Optionally, when the mobility management network element does not support the authentication method corresponding to the network slice, the mobility management network element sends a third request to the network slice selection network element and receives the information of the target mobility management network element returned by the network slice selection network element.

[0211] The third request may include the identification information of the network slice and the authentication method corresponding to the network slice.

[0212] Specifically, the network slice selection network element can select a mobility management network element that supports the authentication method of the network slice as the target mobility management network element based on the identification information of the network slice and the authentication method corresponding to the network slice, and send the information of the target mobility management network element to the mobility management network element.

[0213] Furthermore, the mobility management network element can send the network slice identification information and the corresponding authentication method to the target mobility management network element, so that the target mobility management network element can, based on the network slice identification information and the corresponding authentication method, refer to the above... Figure 3 The actions performed by the mobility management network element in steps 304 and thereafter complete the authentication and authorization of the terminal device, thereby improving the success rate of authentication and authorization of the terminal device.

[0214] Based on the above methods for authenticating and authorizing terminal devices, as follows: Figure 4 As shown, the authentication and authorization server can also initiate an authorization revocation process for the terminal device after successful authentication and authorization, in order to revoke the authentication and authorization of the terminal device.

[0215] Figure 4 A flowchart of an authorization revocation method provided in this application embodiment is shown below. Figure 4 As shown, the method may include: Step 401: The authentication and authorization server sends a fourth request to the network slice authentication and authorization network element.

[0216] The fourth request may carry the username of the terminal device; or, the fourth request may carry the first identifier of the terminal device.

[0217] Optionally, the fourth request may also include identification information for the network slice.

[0218] Specifically, the authentication and authorization server can send a fourth request to revoke the authorization of the terminal device in that network slice.

[0219] Step 402: The network slice authentication and authorization network element sends the fifth request to the mobility management network element.

[0220] The fifth request may carry the first identifier of the terminal device and the identifier information of the network slice. The fifth request may be used to request the mobility management network element to revoke the authorization of the terminal device in the network slice.

[0221] For example, when the fourth request carries the username of the terminal device, the network slice authentication and authorization network element can obtain the first identifier of the terminal device corresponding to the username of the terminal device in the fourth request from the pre-saved username of the terminal device and the first identifier of the terminal device corresponding to the username.

[0222] For example, when the fourth request carries the first identifier of the terminal device, the network slice authentication and authorization network element determines the first identifier of the terminal device based on the fourth request.

[0223] Optionally, the network slice authentication and authorization network element sends the first identifier of the terminal device to the unified data management network element, receives the subscription information of the terminal device sent by the unified data management network element, determines the identifier of the mobility management network element corresponding to the terminal device based on the subscription information, and sends a fifth request to the mobility management network element.

[0224] Step 403: The mobility management network element updates the identification information of the network slice corresponding to the terminal device according to the fifth request.

[0225] Step 404: The mobility management network element sends the updated network slice identification information to the terminal device.

[0226] Among them, the mobility management network element can notify the terminal device through the UE configuration update (UCU) procedure to remove the network slice indicated by the fifth request from the authorized network slice.

[0227] For example, the mobility management network element can use the method shown in steps 403 and 404 to update the identification information of the network slice corresponding to the terminal device according to the fifth request, and send it to the terminal device.

[0228] For example, if the identification information of the authorized network slice corresponding to the terminal device includes S-NSSAI1, S-NSSAI2, S-NSSAI3, and S-NSSAI4, and assuming that the fifth request received by the mobility management network element includes S-NSSAI2, then the mobility management network element can update the identification information of the authorized network slice corresponding to the terminal device to S-NSSAI1, S-NSSAI3, and S-NSSAI4, and send S-NSSAI1, S-NSSAI3, and S-NSSAI4 to the terminal device.

[0229] Alternatively, steps 403 and 404 above can be replaced by steps 405 and 406 below.

[0230] Step 405: The mobility management network element sends the fifth request to the terminal device.

[0231] Step 406: The terminal device updates the identification information of the network slice according to the fifth request.

[0232] Corresponding to steps 403 and 404 above, the mobility management network element can also directly send the fifth request to the terminal device, and the terminal device can update the identification information of the network slice according to the fifth request.

[0233] For example, if the identifier information of the authorized network slice corresponding to the terminal device includes S-NSSAI1, S-NSSAI2, S-NSSAI3, and S-NSSAI4, and assuming that the fifth request received by the terminal device includes S-NSSAI2, then the terminal device can update the identifier information of its own authorized network slice to S-NSSAI1, S-NSSAI3, and S-NSSAI4.

[0234] Alternatively, steps 403 and 404, or steps 405 and 406, can be replaced by step 407.

[0235] Step 407: Based on the fifth request, the mobility management network element initiates a deregistration process to the terminal device and takes the terminal device offline.

[0236] Based on steps 403 to 407 above, the mobility management network element can update the identification information of the network slice corresponding to the terminal device according to the fifth request; it can also directly send the fifth request to the terminal device, so that the terminal device can update the identification information of its own network slice; or it can directly initiate a deregistration process to the terminal device according to the fifth request, and directly take the terminal device offline without restriction.

[0237] The foregoing mainly describes the solutions provided in the embodiments of this application from the perspective of interaction between devices. It is understood that each device, in order to achieve the above functions, includes hardware structures and / or software modules that execute the corresponding network elements. Those skilled in the art should readily recognize that, in conjunction with the algorithm steps of the examples described in the embodiments disclosed herein, this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0238] This application embodiment can divide each network element into functional modules according to the above method example. For example, each network element can be divided into its own functional modules, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. It should be noted that the module division in this application embodiment is illustrative and only represents one logical functional division. In actual implementation, there may be other division methods.

[0239] When each functional module is divided according to its corresponding network element, Figure 5 A mobility management network element (MLE) 50 is illustrated. MLE 50 may include a receiving module 501, a processing module 502, and a transmitting module 503. Exemplarily, MLE 50 may be a mobility management network element, or a chip or other combination device or component having the aforementioned mobility management network element applied within it. When MLE 50 is a mobility management network element, the receiving module 501 or the transmitting module 503 may be a transceiver, which may include an antenna and radio frequency circuitry, etc.; the processing module 502 may be a processor (or processing circuitry), such as a baseband processor, which may include one or more CPUs. When MLE 50 is a component having the aforementioned mobility management network element, the receiving module 501 or the transmitting module 503 may be a radio frequency unit; the processing module 502 may be a processor (or processing circuitry), such as a baseband processor. When the mobility management network element 50 is a chip system, the receiving module 501 can be the input interface of the chip (e.g., a baseband chip); the transmitting module 503 can be the output interface of the chip (e.g., a baseband chip); and the processing module 502 can be the processor (or processing circuitry) of the chip system, and may include one or more central processing units. It should be understood that the receiving module 501 or transmitting module 503 in the embodiments of this application can be implemented by a transceiver or transceiver-related circuit components; and the processing module 502 can be implemented by a processor or processor-related circuit components (or, referred to as processing circuitry).

[0240] For example, the receiving module 501 can be used to perform... Figures 3-4 In the illustrated embodiment, all receiving operations performed by the mobility management network element, and / or other processes used to support the technology described herein; processing module 502 can be used to perform Figures 3-4 In the illustrated embodiment, all operations performed by the mobility management network element except for receiving and transmitting operations, and / or other processes used to support the technology described herein; the transmitting module 503 can be used to perform Figures 3-4 The embodiments shown include all transmission operations performed by the mobility management network element, and / or other processes used to support the techniques described herein.

[0241] As another feasible approach Figure 5 The receiving module 501 or transmitting module 503 can be replaced by a transceiver, which can integrate the functions of the receiving module 501 or transmitting module 503; the processing module 502 can be replaced by a processor, which can integrate the functions of the processing module 502. Furthermore, Figure 5 The mobility management network element 50 shown may also include a memory. When the receiving module 501 or the transmitting module 503 is replaced by a transceiver, and the processing module 502 is replaced by a processor, the mobility management network element 50 involved in this application embodiment can be... Figure 2 The communication device shown.

[0242] When each functional module is divided according to its corresponding network element, Figure 6 A terminal device 60 is illustrated. The terminal device 60 may include a processing module 601, a transmitting module 602, and a receiving module 603. Exemplarily, the terminal device 60 may be a terminal device, or a chip or other combination device or component having the aforementioned terminal device functions. When the terminal device 60 is a terminal device, the processing module 601 may be a processor (or processing circuitry), such as a baseband processor, which may include one or more CPUs; the transmitting module 602 or the receiving module 603 may be a transceiver, which may include an antenna and radio frequency circuitry, etc. When the terminal device 60 is a component having the aforementioned terminal device functions, the processing module 601 may be a processor (or processing circuitry), such as a baseband processor; the transmitting module 602 or the receiving module 603 may be a radio frequency unit. When the terminal device 60 is a chip system, the processing module 601 may be a processor (or processing circuitry) of the chip system, and may include one or more central processing units; the transmitting module 602 may be an output interface of a chip (e.g., a baseband chip); and the receiving module 603 may be an input interface of a chip (e.g., a baseband chip). It should be understood that the processing module 601 in the embodiments of this application can be implemented by a processor or processor-related circuit components (or, referred to as processing circuitry); the sending module 602 or the receiving module 603 can be implemented by a transceiver or transceiver-related circuit components.

[0243] For example, processing module 601 can be used to execute Figures 3-4 In the illustrated embodiments, all operations performed by the terminal device except for receiving and sending operations, and / or other processes used to support the technology described herein; the sending module 602 can be used to perform... Figures 3-4 In the illustrated embodiment, all transmission operations performed by the terminal device, and / or other processes used to support the techniques described herein; the receiving module 603 can be used to perform Figures 3-4The embodiments shown include all receiving operations performed by the terminal device, and / or other processes used to support the techniques described herein.

[0244] As another feasible approach Figure 6 The receiving module 603 or transmitting module 602 can be replaced by a transceiver, which can integrate the functions of the receiving module 603 or transmitting module 602; the processing module 601 can be replaced by a processor, which can integrate the functions of the processing module 601. Furthermore, Figure 6 The terminal device 60 shown may also include a memory. When the receiving module 603 or the transmitting module 602 is replaced by a transceiver, and the processing module 601 is replaced by a processor, the terminal device 60 involved in the embodiments of this application can be... Figure 2 The communication device shown.

[0245] When each functional module is divided according to its corresponding network element, Figure 7 A network slice authentication and authorization network element 70 is illustrated. This network slice authentication and authorization network element 70 may include a receiving module 701, a processing module 702, and a transmitting module 703. Exemplarily, the network slice authentication and authorization network element 70 may be a network slice authentication and authorization network element itself, or a chip or other combination device or component having the aforementioned network slice authentication and authorization network element. When the network slice authentication and authorization network element 70 is a network slice authentication and authorization network element, the receiving module 701 or the transmitting module 703 may be a transceiver, which may include an antenna and radio frequency circuitry, etc.; the processing module 702 may be a processor (or processing circuitry), such as a baseband processor, which may include one or more CPUs. When the network slice authentication and authorization network element 70 is a component having the aforementioned network slice authentication and authorization network element, the receiving module 701 or the transmitting module 703 may be a radio frequency unit; the processing module 702 may be a processor (or processing circuitry), such as a baseband processor. When the network slice authentication and authorization element 70 is a chip system, the receiving module 701 can be the input interface of the chip (e.g., a baseband chip); the transmitting module 703 can be the output interface of the chip (e.g., a baseband chip); and the processing module 702 can be the processor (or processing circuitry) of the chip system, which may include one or more central processing units. It should be understood that the receiving module 701 or transmitting module 703 in the embodiments of this application can be implemented by a transceiver or transceiver-related circuit components; and the processing module 702 can be implemented by a processor or processor-related circuit components (or, referred to as processing circuitry).

[0246] For example, the receiving module 701 can be used to perform... Figures 3-4In the illustrated embodiment, all receiving operations performed by the network slice authentication and authorization network element, and / or other processes used to support the technology described herein; processing module 702 can be used to perform Figures 3-4 In the illustrated embodiment, all operations performed by the network slice authentication and authorization network element other than receiving and sending operations, and / or other processes used to support the technology described herein; the sending module 703 can be used to perform... Figures 3-4 The embodiments shown include all transmission operations performed by the network slice authentication and authorization network element, and / or other processes used to support the techniques described herein.

[0247] As another feasible approach Figure 7 The receiving module 701 or transmitting module 703 can be replaced by a transceiver, which can integrate the functions of the receiving module 701 or transmitting module 703; the processing module 702 can be replaced by a processor, which can integrate the functions of the processing module 702. Furthermore, Figure 7 The network slice authentication and authorization element 70 shown may also include a memory. When the receiving module 701 or the sending module 703 is replaced by a transceiver, and the processing module 702 is replaced by a processor, the network slice authentication and authorization element 70 involved in this application embodiment can be... Figure 2 The communication device shown.

[0248] This application also provides a computer-readable storage medium. All or part of the processes in the above method embodiments can be implemented by a computer program instructing related hardware. This program can be stored in the computer-readable storage medium, and when executed, it can include the processes of the above method embodiments. The computer-readable storage medium can be an internal storage unit of the terminal (including a data sending end and / or a data receiving end) of any of the foregoing embodiments, such as the terminal's hard disk or memory. The computer-readable storage medium can also be an external storage device of the terminal, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the terminal. Further, the computer-readable storage medium can include both the terminal's internal storage unit and external storage devices. The computer-readable storage medium is used to store the computer program and other programs and data required by the terminal. The computer-readable storage medium can also be used to temporarily store data that has been output or will be output.

[0249] It should be noted that the terms "first" and "second," etc., in the specification, claims, and drawings of this application are used to distinguish different objects, not to describe a specific order. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or apparatuses.

[0250] It should be understood that in this application, "at least one (item)" means one or more, "more than one" means two or more, "at least two (items)" means two or three or more, and "and / or" is used to describe the relationship between related objects, indicating that there can be three relationships. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the related objects before and after are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0251] Through the above description of the embodiments, those skilled in the art can clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0252] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed. Furthermore, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0253] The units described as separate components may or may not be physically separate. A component shown as a unit can be one or more physical units; that is, it can be located in one place or distributed in multiple different locations. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0254] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0255] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, essentially, or the parts that contribute to the prior art, or all or part of the technical solutions, can be embodied in the form of a software product. This software product is stored in a storage medium and includes several instructions to cause a device (which may be a microcontroller, chip, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0256] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A slice authentication method, characterized in that, include: Mobility management network elements receive network slice identification information from terminal devices; The mobility management network element obtains the authentication method corresponding to the network slice; wherein, the authentication method includes Password Authentication Protocol (PAP) authentication or Challenge Handshake Authentication Protocol (CHAP) authentication. The mobility management network element obtains the first authentication parameters corresponding to the network slice; wherein, the first authentication parameters include PAP authentication parameters or CHAP authentication parameters; After obtaining the authentication method, the mobility management network element sends the first identifier of the terminal device, the identifier information of the network slice, and the first authentication parameters to the network slice authentication and authorization network element. The mobility management network element receives the first identifier and authentication result from the network slice authentication and authorization network element, and sends the authentication result to the terminal device.

2. The method according to claim 1, characterized in that, The mobility management network element obtains the first authentication parameters corresponding to the network slice, including: The mobility management network element sends a first request to the terminal device; wherein the first request includes the identification information of the network slice; The mobility management network element receives the first authentication parameters from the terminal device.

3. The method according to claim 1 or 2, characterized in that, The mobility management network element obtains the authentication method corresponding to the network slice, including: The mobility management network element receives the authentication method corresponding to the network slice from the terminal device.

4. The method according to claim 1 or 2, characterized in that, The mobility management network element obtains the authentication method corresponding to the network slice, including: The mobility management network element sends a second request to the unified data management network element; wherein, the second request includes a second identifier of the terminal device; The mobility management network element receives subscription information from the unified data management network element; wherein, the subscription information includes the authentication method corresponding to the network slice.

5. The method according to claim 1 or 2, characterized in that, The mobility management network element obtains the authentication method corresponding to the network slice, including: The mobility management network element determines the authentication method corresponding to the network slice based on a pre-configured first correspondence and the identification information of the network slice; wherein, the first correspondence includes the identification information of the network slice and the authentication method corresponding to the identification information of the network slice.

6. The method according to claim 1 or 2, characterized in that, The method further includes: The mobility management network element determines the network slice authentication and authorization network element based on one or more of the following information: the identification information of the network slice, the authentication method corresponding to the network slice, or the data network name corresponding to the network slice.

7. The method according to claim 1 or 2, characterized in that, The mobility management network element obtains the first authentication parameters corresponding to the network slice, including: When the mobility management network element supports the authentication method of the network slice, the mobility management network element obtains the first authentication parameter corresponding to the network slice; When the mobility management network element does not support the authentication method of the network slice, the mobility management network element sends a registration rejection message to the terminal device; wherein, the registration rejection message is used to instruct the mobility management network element to reject the registration request of the terminal device.

8. The method according to claim 1 or 2, characterized in that, The mobility management network element obtains the first authentication parameters corresponding to the network slice, including: When the mobility management network element supports the authentication method of the network slice, the mobility management network element obtains the first authentication parameter corresponding to the network slice; When the mobility management network element does not support the authentication method corresponding to the network slice, the mobility management network element sends a third request to the network slice selection network element; wherein, the third request includes the identification information of the network slice and the authentication method corresponding to the network slice; The mobility management network element receives information about the target mobility management network element returned by the network slice selection network element; The mobility management network element sends the identification information of the network slice and the authentication method corresponding to the network slice to the target mobility management network element.

9. A slice authentication method, characterized in that, include: The terminal device sends the identification information of the network slice to the mobility management network element; The terminal device generates a first authentication parameter corresponding to the network slice; wherein, the first authentication parameter includes PAP authentication parameter or CHAP authentication parameter. The terminal device receives a first request from the mobility management network element; wherein the first request includes the identification information of the network slice; The terminal device sends the first authentication parameters to the mobility management network element according to the first request; The terminal device receives the authentication result from the mobility management network element.

10. The method according to claim 9, characterized in that, The method further includes: The terminal device sends the authentication method corresponding to the network slice to the mobility management network element; wherein, the authentication method includes PAP authentication or CHAP authentication.

11. A slice authentication method, characterized in that, include: The network slice authentication and authorization network element receives a first identifier of the terminal device, the identifier information of the network slice corresponding to the terminal device, and the first authentication parameters corresponding to the network slice from the mobility management network element; wherein, the first authentication parameters include password authentication protocol PAP authentication parameters or challenge handshake authentication protocol CHAP authentication parameters. After receiving the first authentication parameter, the network slice authentication and authorization network element sends the second authentication parameter to the authentication and authorization server corresponding to the identification information of the network slice. The network slice authentication and authorization network element receives the authentication result from the authentication and authorization server and sends the authentication result and the first identifier to the mobility management network element.

12. The method according to claim 11, characterized in that, When the first authentication parameter includes the CHAP authentication parameter, the second authentication parameter is the first authentication parameter.

13. The method according to claim 11 or 12, characterized in that, The first authentication parameter includes the username of the terminal device; the network slice authentication and authorization network element stores the username of the terminal device and the first identifier of the terminal device; The method further includes: The network slice authentication and authorization network element receives a request from the authentication and authorization server carrying the username of the terminal device; The network slice authentication and authorization network element obtains the first identifier of the terminal device based on the username of the terminal device. The network slice authentication and authorization network element sends a request to the mobility management network element carrying the first identifier of the terminal device and the identifier information of the network slice. The request is used to request the mobility management network element to revoke the authorization of the terminal device in the network slice.

14. A mobility management network element, characterized in that, include: The receiving module is used to receive network slice identification information from the terminal device; The processing module is used to obtain the authentication method corresponding to the network slice; wherein, the authentication method includes Password Authentication Protocol (PAP) authentication or Challenge Handshake Authentication Protocol (CHAP) authentication. The processing module is further configured to obtain the first authentication parameter corresponding to the network slice; wherein the first authentication parameter includes PAP authentication parameter or CHAP authentication parameter; The processing module is further configured to, after obtaining the authentication method, send the first identifier of the terminal device, the identifier information of the network slice, and the first authentication parameters to the network slice authentication and authorization network element through the sending module; The receiving module is further configured to receive the first identifier and authentication result from the network slice authentication and authorization network element; The sending module is also used to send the authentication result to the terminal device.

15. The mobility management network element according to claim 14, characterized in that, The sending module is further configured to send a first request to the terminal device; wherein the first request includes the identification information of the network slice; The receiving module is further configured to receive the first authentication parameters from the terminal device.

16. The mobility management network element according to claim 14 or 15, characterized in that, The receiving module is specifically used to receive the authentication method corresponding to the network slice from the terminal device.

17. The mobility management network element according to claim 14 or 15, characterized in that, The sending module is further configured to send a second request to the unified data management network element; wherein the second request includes a second identifier of the terminal device; The receiving module is further configured to receive subscription information from the unified data management network element; wherein the subscription information includes the authentication method corresponding to the network slice.

18. The mobility management network element according to claim 14 or 15, characterized in that, The processing module is further configured to determine the authentication method corresponding to the network slice based on the pre-configured first correspondence and the identification information of the network slice; wherein, the first correspondence includes the identification information of the network slice and the authentication method corresponding to the identification information of the network slice.

19. The mobility management network element according to claim 14 or 15, characterized in that, The processing module is further configured to determine the network slice authentication and authorization network element based on one or more of the following information: the identification information of the network slice, the authentication method corresponding to the network slice, or the data network name corresponding to the network slice.

20. The mobility management network element according to claim 14 or 15, characterized in that, The processing module is further configured to obtain the first authentication parameter corresponding to the network slice when the processing module supports the authentication method of the network slice; The processing module is further configured to send a registration rejection message to the terminal device through the sending module when the processing module does not support the authentication method of the network slice; wherein the registration rejection message is used to instruct the processing module to reject the registration request of the terminal device.

21. The mobility management network element according to claim 14 or 15, characterized in that, The processing module is further configured to obtain the first authentication parameter corresponding to the network slice when the processing module supports the authentication method of the network slice; The processing module is further configured to send a third request to the network element selected by the network slice through the sending module when the processing module does not support the authentication method corresponding to the network slice; wherein the third request includes the identification information of the network slice and the authentication method corresponding to the network slice; The receiving module is also used to receive information about the target mobility management network element returned by the network slice selection network element; The sending module is further configured to send the identification information of the network slice and the authentication method corresponding to the network slice to the target mobility management network element.

22. A terminal device, characterized in that, include: The sending module is used to send network slice identification information to the mobility management network element; The processing module is used to generate the first authentication parameters corresponding to the network slice; wherein, the first authentication parameters include the password authentication protocol PAP authentication parameters or the challenge handshake authentication protocol CHAP authentication parameters; A receiving module is configured to receive a first request from the mobility management network element; wherein the first request includes the identification information of the network slice; The processing module is further configured to send the first authentication parameters to the mobility management network element through the sending module according to the first request. The receiving module is used to receive the authentication result from the mobility management network element.

23. The terminal device according to claim 22, characterized in that, The sending module is further configured to send the authentication method corresponding to the network slice to the mobility management network element; wherein the authentication method includes PAP authentication or CHAP authentication.

24. A network slicing authentication and authorization network element, characterized in that, include: The receiving module is configured to receive a first identifier of the terminal device, the identifier information of the network slice corresponding to the terminal device, and the first authentication parameters corresponding to the network slice from the mobility management network element; wherein, the first authentication parameters include password authentication protocol PAP authentication parameters or challenge handshake authentication protocol CHAP authentication parameters. The processing module is used to send the second authentication parameter to the authentication and authorization server corresponding to the identification information of the network slice through the sending module after the receiving module receives the first authentication parameter; The receiving module is also used to receive authentication results from the authentication and authorization server; The sending module is further configured to send the authentication result and the first identifier to the mobility management network element.

25. The network slice authentication and authorization network element according to claim 24, characterized in that, When the first authentication parameter includes the CHAP authentication parameter, the second authentication parameter is the first authentication parameter.

26. The network slice authentication and authorization network element according to claim 24 or 25, characterized in that, The first authentication parameter includes the username of the terminal device; the processing module is also used to store the username of the terminal device and the first identifier of the terminal device; The receiving module is also configured to receive a request from the authentication and authorization server carrying the username of the terminal device; The processing module is further configured to obtain the first identifier of the terminal device based on the username of the terminal device; The sending module is further configured to send a request to the mobility management network element carrying the first identifier of the terminal device and the identifier information of the network slice; The request is used to request the mobility management element to revoke the authorization of the terminal device in the network slice.

27. A computer-readable storage medium, characterized in that, A computer-readable storage medium stores computer instructions or programs that, when executed on a computer, cause the computer to perform the slice authentication method as described in any one of claims 1-13.

28. A communication system, characterized in that, The communication system includes a mobility management network element as described in any one of claims 14-21 and a network slicing authentication and authorization network element as described in any one of claims 24-26.

Images