A method, device, apparatus and medium for notifying authentication and authorization results and processing thereof

Abstract

The present invention discloses an authentication and authorization result notification and a processing method, device, apparatus and medium thereof, including: obtaining the authentication and authorization result of a network slice; notifying the access and mobility management function of the authentication and authorization result. The access and mobility management function receives the authentication and authorization result notification of the network slice; the access and mobility management function updates the locally stored authentication and authorization result. The present invention solves the problem that the authentication and authorization status / result specific to the network slice cannot be synchronized between different access and mobility management functions.

Description

[0001] This invention application is a divisional application of the invention application with application date of April 7, 2020, application number 2020102640648, and invention name “A method, equipment, device and medium for processing authentication and authorization result notification”. Technical Field

[0002] The present invention relates to the field of wireless communication technology, and in particular to an authentication and authorization result notification and a processing method, device, apparatus and medium thereof. Background Art

[0003] The prior art only supports the scenario in which UE (User Equipment) registers to the same PLMN (Public Land Mobile Network) through 3GPP access and non-3GPP access (that is, there is only one AMF (Access and Mobility Management Function) to provide services for the UE), and does not support the scenario in which the UE registers to different PLMNs through different accesses, that is, the scenario in which the UE has two AMFs is not supported. Therefore, the deficiency of the prior art is that the prior art does not support applications involving scenarios in which the UE has two AMFs. Summary of the invention

[0004] The present invention provides an authentication and authorization result notification and a processing method, device, apparatus and medium thereof, so as to solve the problem that when there are multiple AMFs serving a UE, the network slice-specific authentication and authorization status / results cannot be synchronized between different AMFs.

[0005] An embodiment of the present invention provides an authentication and authorization result notification method, comprising:

[0006] Obtain authentication and authorization results for network slices;

[0007] Notify AMF of the authentication and authorization results.

[0008] Implementation, including:

[0009] UDM obtains the authentication and authorization results of the network slice from the AMF or AAA server;

[0010] UDM notifies other AMFs of the authentication and authorization results.

[0011] In implementation, when UDM determines, based on the context of the UE, that there is more than one AMF providing services to the UE, it notifies other AMFs of the authentication and authorization results.

[0012] In implementation, the UDM notifies other AMFs of the authentication and authorization results when it determines that one or a combination of the following situations occurs:

[0013] The Allowed NSSAI allocated by other AMFs to the UE includes the S-NSSAI; or,

[0014] The authentication and authorization result information of the S-NSSAI associated with other AMFs includes information about the S-NSSAI; or,

[0015] Other AMFs subscribe to the authentication and authorization result information of S-NSSAI; or,

[0016] The authentication and authorization results of the network slice change.

[0017] During implementation, the authentication and authorization results of the network slice obtained by UDM from AMF are the authentication and authorization status / results notified to UDM by AMF after executing the authentication and authorization process of the network slice.

[0018] Implementation, including:

[0019] UE obtains the authentication and authorization results of the network slice from AMF;

[0020] The UE notifies other AMFs of the authentication and authorization results.

[0021] During implementation, the UE obtains the authentication and authorization result of the network slice after completing the authentication and authorization process of the S-NSSAI network slice through the AMF.

[0022] During implementation, when the UE determines that there is more than one AMF providing services for the UE, it notifies other AMFs of the authentication and authorization results.

[0023] During implementation, when the UE determines that the Allowed NSSAI allocated by other AMFs includes S-NSSAI; and / or when it is determined that the authentication and authorization results have changed, the UE notifies other AMFs of the authentication and authorization results.

[0024] In implementation, the UE notifies other AMFs of the authentication and authorization results by carrying the authentication and authorization results in a registration request sent to other AMFs; or,

[0025] The UE notifies other AMFs of the authentication and authorization results by carrying information in the registration request sent to other AMFs according to preset rules.

[0026] Implementation, including:

[0027] AUSF or AAA server obtains the authentication and authorization results of the network slice;

[0028] The AUSF or AAA server notifies the AMF of the authentication and authorization results.

[0029] During implementation, the other AMFs notified by the AUSF or AAA server are the AMFs to be notified set by the AMF or UDM when it subscribes to the authentication and authorization results of S-NSSAI from the AUSF or AAA server.

[0030] During implementation, when the authentication and authorization results for a certain S-NSSAI change, the AUSF or AAA server notifies the AMF of the changed authentication and authorization results.

[0031] An embodiment of the present invention provides an authentication and authorization result notification processing method, including:

[0032] AMF receives the authentication and authorization result notification of the network slice;

[0033] The AMF updates the locally stored authentication and authorization results.

[0034] During implementation, update the locally stored authentication and authorization results, including:

[0035] Update the UE's Allowed NSSAI and rejected S-NSSAI.

[0036] In implementation, after updating the locally stored authentication and authorization results, it further includes:

[0037] Release the PDU session associated with S-NSSAI1 established by the UE.

[0038] During implementation, it further includes:

[0039] After performing the network slice-specific authentication and authorization process, AMF notifies UDM of the authentication and authorization results.

[0040] During implementation, it further includes:

[0041] After receiving the authentication and authorization results notified by the UE, the AMF requests the AAA server through the AUSF to verify the validity of the authentication and authorization results provided by the UE.

[0042] During implementation, when AMF or UDM subscribes to the authentication and authorization results of S-NSSAI from the AUSF or AAA server, it is the AUSF or AAA server that notifies the AMF to receive the authentication and authorization results of the network slice.

[0043] An embodiment of the present invention provides a communication device, including:

[0044] The processor reads the program in the memory and performs the following processes:

[0045] Obtain authentication and authorization results for network slices;

[0046] Notify the AMF of the authentication and authorization results;

[0047] A transceiver is used to receive and send data under the control of the processor.

[0048] In implementation, the communication equipment is located in the UDM, where:

[0049] Obtain the authentication and authorization results of the network slice from the AMF or AAA server;

[0050] Notify other AMFs of the authentication and authorization results.

[0051] During implementation, when it is determined based on the context of the UE that there is more than one AMF providing services for the UE, the authentication and authorization results are notified to other AMFs.

[0052] In implementation, when one or a combination of the following situations is determined to occur, the authentication and authorization results are notified to other AMFs:

[0053] The Allowed NSSAI allocated by other AMFs to the UE includes the S-NSSAI; or,

[0054] The authentication and authorization result information of the S-NSSAI associated with other AMFs includes information about the S-NSSAI; or,

[0055] Other AMFs subscribe to the authentication and authorization result information of S-NSSAI; or,

[0056] The authentication and authorization results of the network slice change.

[0057] In implementation, the authentication and authorization result of the network slice obtained from AMF is the authentication and authorization status / result notified to UDM by AMF after performing the authentication and authorization process of the network slice.

[0058] In implementation, the communication device is located in the UE, wherein:

[0059] Obtain authentication and authorization results for network slices from AMF;

[0060] Notify other AMFs of the authentication and authorization results.

[0061] During implementation, the authentication and authorization results of the network slice are obtained after the authentication and authorization process of the network slice of S-NSSAI is completed through AMF.

[0062] During implementation, when it is determined that there is more than one AMF providing services for the UE, the authentication and authorization results are notified to other AMFs.

[0063] During implementation, when it is determined that the Allowed NSSAI allocated by other AMFs includes S-NSSAI; and / or, when it is determined that the authentication and authorization results have changed, the authentication and authorization results are notified to other AMFs.

[0064] In implementation, the authentication and authorization results are carried in the registration request sent to the other AMF to notify the other AMF of the authentication and authorization results; or,

[0065] By carrying information according to preset rules in the registration request sent to other AMFs, other AMFs are notified of the authentication and authorization results.

[0066] In implementation, the communication device is located at the AUSF or AAA server, wherein:

[0067] Obtain authentication and authorization results for network slices;

[0068] Notify AMF of the authentication and authorization results.

[0069] During implementation, other AMFs notified are the AMFs that need to be notified set by the AMF or UDM when subscribing to the authentication and authorization results of S-NSSAI from the AUSF or AAA server.

[0070] During implementation, when the authentication and authorization results for a certain S-NSSAI change, the AMF is notified of the changed authentication and authorization results.

[0071] An embodiment of the present invention provides an AMF, including:

[0072] The processor reads the program in the memory and performs the following processes:

[0073] Receive notifications of authentication and authorization results of network slices;

[0074] When the authentication and authorization result is inconsistent with the locally stored authentication and authorization result, updating the locally stored authentication and authorization result;

[0075] A transceiver is used to receive and send data under the control of the processor.

[0076] During implementation, update the locally stored authentication and authorization results, including:

[0077] Update the UE's Allowed NSSAI and rejected S-NSSAI.

[0078] In implementation, after updating the locally stored authentication and authorization results, it further includes:

[0079] Release the PDU session associated with S-NSSAI1 established by the UE.

[0080] During implementation, it further includes:

[0081] After performing the network slice specific authentication and authorization process, the UDM is notified of the authentication and authorization results.

[0082] During implementation, it further includes:

[0083] After receiving the authentication and authorization results notified by the UE, the AUSF requests the AAA server to verify the validity of the authentication and authorization results provided by the UE.

[0084] During implementation, when AMF or UDM subscribes to the authentication and authorization results of S-NSSAI from the AUSF or AAA server, it is the AUSF or AAA server that notifies the AMF to receive the authentication and authorization results of the network slice.

[0085] An embodiment of the present invention provides an authentication and authorization result notification device, comprising:

[0086] An acquisition module is used to obtain the authentication and authorization results of the network slice;

[0087] The notification module is used to notify the AMF of the authentication and authorization results.

[0088] An embodiment of the present invention provides an authentication and authorization result notification processing device, including:

[0089] A receiving module, used to receive authentication and authorization result notifications of network slices;

[0090] The update module is used to update the authentication and authorization results stored locally.

[0091] An embodiment of the present invention provides a computer-readable storage medium, characterized in that the computer-readable storage medium stores a computer program for executing the above-mentioned authentication and authorization result notification method and / or authentication and authorization result notification processing method.

[0092] The beneficial effects of the present invention are as follows:

[0093] In the technical solution provided by the embodiment of the present invention, after obtaining the authentication and authorization results of the network slice, the authentication and authorization results will be notified to the AMF. Further, other AMFs can be notified by the UDM or UE, AUSF or AAA server. Since each AMF can obtain the authentication and authorization results on other AMFs, the problem of being unable to synchronize the network slice-specific authentication and authorization status / results between different AMFs is solved. BRIEF DESCRIPTION OF THE DRAWINGS

[0094] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0095] Figure 1 Schematic diagram of the authentication and authorization process of a network slice in an embodiment of the present invention;

[0096] Figure 2 Schematic diagram of the re-authentication and re-authorization process of a network slice in an embodiment of the present invention;

[0097] Figure 3 This is a schematic diagram of the authorization revocation process of a network slice in an embodiment of the present invention;

[0098] Figure 4 A schematic diagram of an implementation flow of a method for notifying a result of authentication and authorization in an embodiment of the present invention;

[0099] Figure 5 A schematic diagram of an implementation flow of a method for processing authentication and authorization result notification in an embodiment of the present invention;

[0100] Figure 6 This is a schematic diagram of the implementation process of authentication and authorization result notification in Embodiment 1 of the present invention;

[0101] Figure 7 This is a schematic diagram of an indication that the AMF receives from the UDM that the UE has registered with other AMFs in Embodiment 1 of the present invention;

[0102] Figure 8 This is a schematic diagram of an event in which the network slice-specific authentication and authorization status / result changes in which the UDM subscribes to the AMF for S-NSSAI in the first embodiment of the present invention;

[0103] Fig. 9 This is a schematic diagram of the implementation process of authentication and authorization result notification in Embodiment 2 of the present invention;

[0104] Fig.10 It is a schematic diagram of the synchronous implementation process of UDM between different AMFs when the status / result of the authentication and authorization result in the second embodiment of the present invention changes;

[0105] Fig.11 This is a schematic diagram of the implementation process of authentication and authorization result notification in Embodiment 3 of the present invention;

[0106] Fig.12 This is a schematic diagram of the implementation process of authentication and authorization result notification in Embodiment 4 of the present invention;

[0107] Fig.13 This is a schematic diagram of the implementation process of the UDM subscription authentication and authorization status / result in the fifth embodiment of the present invention;

[0108] Fig.14 A schematic diagram of the implementation process of AMF subscription authentication and authorization status / result in Embodiment 5 of the present invention;

[0109] Fig.15 A schematic diagram of the structure of a communication device in an embodiment of the present invention;

[0110] Fig.16 Schematic diagram of the AMF structure in an embodiment of the present invention. DETAILED DESCRIPTION

[0111] The inventors noticed during the invention process that:

[0112] When the AAA (Authentication, Authorization and Accounting) server is required to authenticate and authorize S-NSSAI (Single Network Slice Selection Assistance Information), the network slice-specific authentication and authorization process is triggered. The AAA server may belong to the HPLMN (Home Public Land Mobile Network) operator or a third party. If the AAA server belongs to a third party, an AAA proxy needs to be deployed in the HPLMN.

[0113] During the registration process, if AMF decides that the S-NSSAI in the Allowed NSSAI (permitted network slice selection auxiliary information) needs to be authenticated and authorized, or when the AAA server triggers re-authentication, AMF triggers the network slice specific authentication and authorization process. In this process, AMF acts as an EAP (Extensible Authentication Protocol) authenticator and communicates with the AAA server through AUSF (Authentication Server Function).

[0114] The following describes network slicing specific authentication and authorization.

[0115] Figure 1 This is a schematic diagram of the authentication and authorization process of network slicing, as shown in the figure, which mainly includes:

[0116] Step 101, trigger to perform Slice-Specific Authentication And Authorisation (trigger for performing slice-specific authentication and authorization).

[0117] Based on the contract information or due to the triggering of AAA-S (AAA server), AMF triggers the network slice-specific authentication and authorization process for S-NSSAI that needs to perform network slice-specific authentication and authorization processes.

[0118] Step 102: The NAS MM Transport (Non-Access Stratum Mobility Management Transport) message carries the EAP IDRequest and the S-NSSAI.

[0119] The AMF sends a NAS (Non Access Stratum) mobility management transmission message to the UE, which includes an EAP identity request and S-NSSAI.

[0120] Step 103: NAS MM Transport (EAP ID response, S-NSSAI).

[0121] The UE returns a NAS mobility management transport message to the AMF, which includes the EAP identity reply and S-NSSAI.

[0122] Step 104, Nausf_NSSAA_Authenticate Req (Nausf_NSSAA_Authentication Request; NSSAA: Network Slice-Specific Authentication and Authorization) carries EAP ID Response (EAP ID response), GPSI (Generic Public Subscription Identifier), and S-NSSAI.

[0123] AMF sends a Nausf_NSSAA_Authenticate request to AUSF, carrying the EAP identity reply, AAA server address, GPSI, and S-NSSAI.

[0124] Step 105: AAA Protocol message (EAP ID Response, GPSI, S-NSSAI).

[0125] If AAA-P (AAA-Proxy) is deployed, AUSF sends the EAP Identity Reply message, GPSI and S-NSSAI to the AAA Proxy, otherwise it sends the message directly to AUSF. AUSF encapsulates the EAP Identity Reply message, GPSI and S-NSSAI using the AAA protocol message supported by the AAA Proxy or AAA Server, and then sends the AAA protocol message to the AAA Proxy or AAA Server.

[0126] Step 106: AAA Protocol message (EAP ID Response, GPSI, S-NSSAI).

[0127] The AAA proxy sends the EAP Identity Reply message, GPSI, and S-NSSAI to the AAA server based on the AAA server address. The AAA server stores the GPSI and creates an association between the GPSI and the EAP Identity in the EAP Identity Reply message so that the AAA server can use the association to revoke authentication or trigger reauthentication.

[0128] Step 107: AAA Protocol message (EAP msg, GPSI, S-NSSAI).

[0129] Step 108: AAA Protocol message (EAP msg, GPSI, S-NSSAI).

[0130] Step 109, Nausf_NSSAA_Authenticate Resp (Nausf interface NSSAA authentication response) (EAPmsg, GPSI, S-NSSAI).

[0131] Step 110: NAS MM Transport (EAP msg, S-NSSAI).

[0132] Step 111: NAS MM Transport (EAP msg, S-NSSAI).

[0133] Step 112: Nausf_NSSAA_Authenticate Request (EAP msg, GPSI, S-NSSAI).

[0134] Step 113: AAA Protocol message (EAP msg, AAA-S Addr., GPSI, S-NSSAI).

[0135] Step 114: AAA Protocol message (EAP msg, GPSI, S-NSSAI).

[0136] In steps 107 to 114, EAP messages are exchanged between the AAA server and the UE.

[0137] Step 115: AAA Protocol message (EAP success / failure, GPSI, S-NSSAI).

[0138] EAP authentication is complete. The AAA server stores the authorized S-NSSAI, and AAA-S can trigger re-authentication and authorization based on local policy decisions. The AAA server sends EAP success / failure messages, GPSI, and S-NSSAI to the AAA proxy (or directly to the AUSF if not deployed).

[0139] Step 116: AAA Protocol messager (EAP Success / failure, GPSI, S-NSSAI).

[0140] If AAA proxy is used, the AAA proxy sends AAA protocol messages (EAP success / failure, S-NSSAI, GPSI) to AUSF.

[0141] Step 117: Nausf_NSSAA_Authenticate Resp(EAP Success / failuremsg, GPSI, S-NSSAI).

[0142] AUSF sends Nausf_NSSAA_Authenticate reply (EAP success / failure, S-NSSAI, GPSI) to AMF.

[0143] Step 118: NAS MM Transport (EAP success / failure).

[0144] The AMF sends a NAS mobility management transfer message (EAP success / failure) to the UE.

[0145] Step 119: UE configuration update procedure.

[0146] If the Allowed NSSAI or rejected S-NSSAI needs to be updated, the AMF initiates the UE configuration update procedure.

[0147] The network slice specific re-authentication and re-authorization process triggered by the AAA server is explained below.

[0148] Figure 2 This is a schematic diagram of the re-authentication and re-authorization process of network slicing, as shown in the figure, which mainly includes:

[0149] Step 201: AAA Protocol Re-Auth Request (GPSI, S-NSSAI).

[0150] The AAA server (AAA-S) sends an AAA protocol re-authentication request, carrying GPSI, S-NSSAI, requesting re-authentication and authorization of the network slice identified by S-NSSAI for the UE identified by GPSI. If an AAA proxy (AAA-P) is deployed, the message is sent to the AAA proxy, otherwise it is sent directly to the AUSF.

[0151] Step 202: AAA Protocol Re-Auth Request (GPSI, S-NSSAI).

[0152] If an AAA proxy is deployed, the AAA proxy forwards the message to AUSF.

[0153] Step 203a: Nudm_UECM_Get Req (Nudm_UECM_Get Request; UECM: UE Context Management) (GPSI, AMF Registration).

[0154] Step 203b, Nudm_UECM_Get Resp (AMF ID).

[0155] In steps 203a-203b, AUSF obtains the AMF ID from UDM (Unified Data Management) using Nudm_UECM_Get.

[0156] Step 204, NAusf_NSSAA_Notify (NAusf interface NSSAA notification) (Re-Auth event, GPSI, S-NSSAI).

[0157] AUSF notifies AMF of the re-authentication event and requests AMF to re-authenticate / authorize S-NSSAI for UE. AUSF sends Nausf_NSSAA_Notify(GPSI, S-NSSAI) to AMF.

[0158] Step 205, Network Slice-Specific Secondary Authentication And Authorisation (network slice specific secondary authentication and authorization).

[0159] The AMF triggers the network slice specific authentication and authorization process.

[0160] The slice-specific authorization revocation process triggered by the AAA server is described below.

[0161] Figure 3 This is a schematic diagram of the authorization revocation process of network slicing, as shown in the figure, which mainly includes:

[0162] Step 301: AAA Protocol Revoke Auth Request (GPSI, S-NSSAI).

[0163] The AAA server (AAA-S) sends an AAA protocol deauthentication request message (GPSI, S-NSSAI) to request the deauthorization of the S-NSSAI of the UE identified by the GPSI. If an AAA proxy (AAA-P) is deployed, the message is sent to the AAA proxy.

[0164] Step 302: AAA Protocol Revoke Auth Request (GPSI, S-NSSAI).

[0165] If an AAA proxy is deployed, the AAA proxy forwards the message to AUSF.

[0166] Step 303a: Nudm_UECM_Get Req (GPSI, AMF Registration).

[0167] Step 303b, Nudm_UECM_Get Resp (AMF ID).

[0168] In steps 303a-303b, the AUSF obtains the AMF ID from the UDM using Nudm_UECM_Get.

[0169] Step 304, NAusf_NSSAA_Notify (Revoke Auth event, GPSI, S-NSSAI).

[0170] AUSF sends Nausf_NSSAA_Notify(GPSI, S-NSSAI) to AMF, requesting AMF to revoke the authorization of S-NSSAI for the UE.

[0171] Step 305: UE Configuration Update (UE configuration update).

[0172] The AMF revokes the above S-NSSAI from the UE's Allowed NSSAI, and then sends the updated Allowed NSSAI to the UE.

[0173] It can be seen that the existing technology only supports the scenario where the UE registers to the same PLMN through 3GPP access and non-3GPP access (that is, there is only one AMF providing services to the UE), and does not support the scenario where the UE registers to different PLMNs through different accesses, that is, it does not support the scenario where the UE has two AMFs. Therefore, when there are more than two AMFs, each AMF cannot obtain the status / results of authentication and authorization of S-NSSAI stored on other AMFs.

[0174] In summary, the current network slice-specific authentication and authorization mechanism does not support the scenario where the UE is connected to different PLMNs through 3GPP access and non-3GPP access. In this scenario, different AMFs in different PLMNs provide services for the UE, and different AMFs allocate Allowed NSSAI to the UE respectively. Different Allowed NSSAIs may include the same S-NSSAI. When authentication and authorization are performed for the S-NSSAI, it can only be performed through one AMF. Therefore, another AMF cannot obtain the latest authentication and authorization status / results of the S-NSSAI. Based on this, an authentication and authorization result notification scheme is provided in an embodiment of the present invention to solve the synchronization of authentication and authorization status / results between multiple AMFs.

[0175] The specific implementation of the present invention will be described below in conjunction with the accompanying drawings.

[0176] In the description process, the implementation of the UDM, UE, AUSF, AAA server and AMF will be described respectively, and then an example of their coordinated implementation will be given to better understand the implementation of the solution given in the embodiment of the present invention. This description does not mean that they must be implemented in coordination or must be implemented separately. In fact, when they are implemented separately, they also solve the problems on their own side, and when they are used in combination, better technical effects will be obtained.

[0177] Figure 4 A flowchart for implementing the authentication and authorization result notification method, as shown in the figure, may include:

[0178] Step 401: Obtain authentication and authorization results of the network slice;

[0179] Step 402: Notify the AMF of the authentication and authorization results.

[0180] Figure 5 The flowchart for implementing the authentication and authorization result notification processing method is shown in the figure, including:

[0181] Step 501: AMF receives the authentication and authorization result notification of the network slice;

[0182] Step 502: Update the locally stored authentication and authorization results.

[0183] Specifically, the AMF may update the locally stored authentication and authorization result when the authentication and authorization result is inconsistent with the locally stored authentication and authorization result.

[0184] The implementation on the UDM, UE, AUSF or AAA server side is described below respectively.

[0185] 1. Implementation on UDM.

[0186] In this mode, UDM synchronizes the authentication and authorization results of S-NSSAI among multiple AMFs.

[0187] In practice, the plan may include:

[0188] UDM obtains the authentication and authorization results of the network slice from the AMF or AAA server;

[0189] UDM notifies other AMFs of the authentication and authorization results.

[0190] UDM obtains the authentication and authorization results of the network slice from the AMF or AAA server, and notifies other AMFs of the authentication and authorization results.

[0191] Specifically, when the UDM determines, based on the context of the UE, that there is more than one AMF providing services for the UE, the UDM may notify other AMFs of the authentication and authorization results.

[0192] In a specific implementation, the UDM notifies other AMFs of the authentication and authorization results when it determines that one or a combination of the following situations occurs:

[0193] The Allowed NSSAI allocated by other AMFs to the UE includes the S-NSSAI; or,

[0194] The authentication and authorization result information of the S-NSSAI associated with other AMFs includes information about the S-NSSAI; or,

[0195] Other AMFs subscribe to the authentication and authorization result information of S-NSSAI; or,

[0196] The authentication and authorization results of the network slice change.

[0197] Specifically, UDM can make the following judgments before sending authentication and authorization results to other AMFs:

[0198] Whether more than one AMF is included in the context of the UE. If more than one, it means that multiple AMFs provide services to the UE, so the authentication and authorization results need to be synchronized.

[0199] Specifically, in addition to this, UDM may further determine whether it is necessary to provide the authentication and authorization results of S-NSSAI1 (in the example, the S-NSSAI is numbered 1 for distinction, the same below) to other AMFs. The basis for the judgment may be that the Allowed NSSAI allocated by other AMFs to the UE includes S-NSSAI1, or the authentication and authorization result information of S-NSSAI related to other AMFs includes S-NSSAI1 information, or other AMFs have subscribed to the authentication and authorization result information of S-NSSAI1.

[0200] If the above judgment results are all yes, UDM sends the authentication and authorization results of S-NSSAI1 to other AMFs, such as AMF2.

[0201] For the AMF side, during implementation, the locally stored authentication and authorization results are updated, including:

[0202] Update the UE's Allowed NSSAI and rejected S-NSSAI.

[0203] In a specific implementation, after updating the locally stored authentication and authorization results, it further includes:

[0204] Release the PDU session associated with S-NSSAI1 established by the UE.

[0205] Specifically, after AMF2 receives the authentication and authorization results of S-NSSAI1, if the result has not changed, AMF2 does not perform any operation. If the result changes from success to failure, AMF2 updates the UE's Allowed NSSAI and rejected S-NSSAI, and releases the PDU session related to S-NSSAI1 that the UE has established.

[0206] For the AMF side, the implementation further includes:

[0207] After performing the network slice-specific authentication and authorization process, AMF notifies UDM of the authentication and authorization results.

[0208] In the specific implementation, the authentication and authorization results of the network slice obtained by UDM from AMF are the authentication and authorization status / results notified to UDM by AMF after executing the authentication and authorization process of the network slice.

[0209] Specifically, AMF can notify UDM of the authentication and authorization status / results after performing the network slice-specific authentication and authorization process. UDM can also request authentication and authorization status / results from the AAA server.

[0210] 2. Implementation on UE.

[0211] In this mode, the UE synchronizes the authentication and authorization results of S-NSSAI between multiple AMFs.

[0212] Implementation may include:

[0213] UE obtains the authentication and authorization results of the network slice from AMF;

[0214] The UE notifies other AMFs of the authentication and authorization results.

[0215] In the specific implementation, the UE obtains the authentication and authorization results of the network slice after completing the authentication and authorization process of the S-NSSAI network slice through the AMF.

[0216] Specifically, after the UE completes the network slice-specific authentication and authorization process of S-NSSAI1 through AMF1 (for easy distinction, the AMF that generates the authentication and authorization results is numbered 1, the same below), the UE notifies other AMFs of the authentication and authorization results of S-NSSAI1.

[0217] For the AMF side, the implementation further includes:

[0218] After receiving the authentication and authorization results notified by the UE, the AMF requests the AAA server through the AUSF to verify the validity of the authentication and authorization results provided by the UE.

[0219] Specifically, AMF requests the AAA server through AUSF to verify the validity of the information provided by the UE.

[0220] During implementation, when the UE determines that there is more than one AMF providing services for the UE, it notifies other AMFs of the authentication and authorization results.

[0221] During implementation, when the UE determines that the Allowed NSSAI allocated by other AMFs includes S-NSSAI; and / or when it is determined that the authentication and authorization results have changed, the UE notifies other AMFs of the authentication and authorization results.

[0222] Specifically, the UE may make the following judgments before sending authentication and authorization results to other AMFs:

[0223] Whether the UE is connected to multiple AMFs. If there are more than one, it means that multiple AMFs are providing services to the UE, so the authentication and authorization results need to be synchronized.

[0224] In addition, the UE may further determine whether it is necessary to provide the authentication and authorization results of S-NSSAI1 to other AMFs. The basis for the determination may be that the Allowed NSSAI allocated by other AMFs includes S-NSSAI1 or that the authentication and authorization results have changed.

[0225] In implementation, the UE notifies other AMFs of the authentication and authorization results by carrying the authentication and authorization results in a registration request sent to other AMFs; or,

[0226] The UE notifies other AMFs of the authentication and authorization results by carrying information in the registration request sent to other AMFs according to preset rules.

[0227] Specifically, the UE can explicitly or implicitly notify other AMFs of the authentication and authorization results of S-NSSAI1. If it is an explicit notification, the UE sends a registration request to other AMFs, and the message includes the latest authentication and authorization results of S-NSSAI1; if it is an implicit notification, the UE sends a registration request to other AMFs, and the Requested NSSAI included in the request message does not include S-NSSAI1 (if the authentication and authorization results are failed) or includes S-NSSAI (if the authentication and authorization results are successful).

[0228] 3. Implementation on AUSF or AAA server.

[0229] In this mode, the AUSF or AAA server synchronizes the authentication and authorization results of S-NSSAI between AMFs.

[0230] AUSF or AAA server obtains the authentication and authorization results of the network slice;

[0231] The AUSF or AAA server notifies the AMF of the authentication and authorization results.

[0232] During implementation, the other AMFs notified by the AUSF or AAA server are the AMFs to be notified set by the AMF or UDM when it subscribes to the authentication and authorization results of S-NSSAI from the AUSF or AAA server.

[0233] During implementation, when the authentication and authorization results for a certain S-NSSAI change, the AUSF or AAA server notifies the AMF of the changed authentication and authorization results.

[0234] For the AMF side, in implementation, when AMF or UDM subscribes to the authentication and authorization results of S-NSSAI from the AUSF or AAA server, it is the AUSF or AAA server that notifies the AMF to receive the authentication and authorization results of the network slice.

[0235] Specifically, AMF or UDM can subscribe to the authentication and authorization results of S-NSSAI from AUSF or AAA server. When UDM subscribes, UDM sets the result notification endpoint to AMF information. When the authentication and authorization results for a certain S-NSSAI change, the AAA server directly notifies AUSF, and AUSF notifies AMF of the result.

[0236] The following is an example to illustrate.

[0237] Embodiment 1

[0238] In this embodiment, UDM is implemented through a subscription and notification mechanism to synchronize network slice-specific authentication and authorization result status between different AMFs.

[0239] Figure 6 This is a schematic diagram of the implementation process of authentication and authorization result notification in Example 1, as shown in the figure, which may include:

[0240] Step 601, Nudm_EventExposure_Subscribe carries UE ID, S-NSSAI, network slice specific authentication and authorization status / results.

[0241] Specifically, AMF sends a Nudm_EventExposure_Subscribe message to UDM, and the parameters include UE ID, S-NSSAI, and network slice-specific authentication and authorization status / result. Through this message, AMF subscribes to UDM for the network slice-specific authentication and authorization status / result of the UE's S-NSSAI. AMF may provide multiple S-NSSAIs.

[0242] Step 602, Nudm_EventExposure_Notify carries the network slice-specific authentication and authorization status / results.

[0243] Specifically, when UDM discovers that the authentication and authorization status / result of S-NSSAI has changed, UDM sends a Nudm_EventExposure_Notify message to AMF, and the parameters include the network slice-specific authentication and authorization status / result of S-NSSAI.

[0244] In implementation, before the AMF sends step 601 in the above figure to the UDM, it may receive an indication from the UDM that the UE has registered with other AMFs. The AMF may receive the above indication during the registration process, or receive relevant indications from the UDM through the subscription / notification mechanism, or directly receive notification information from the UDM. At least possible implementation schemes can be as follows:

[0245] Figure 7 This is a schematic diagram of an indication that the AMF receives from the UDM that the UE has registered with other AMFs in Embodiment 1. As shown in the figure, it may include:

[0246] Method 1:

[0247] Step 701: Nudm_UECM_Registration Request.

[0248] Step 702: Nudm_UECM_Registration Response carries a multi-AMF registration indication.

[0249] Specifically, during the UE registration process, AMF sends a Nudm_UECM_Registration Request message (carrying UE ID, AMF ID) to UDM to register the AMF ID in UDM.

[0250] In this method, if UDM finds that other AMF IDs are included in the context of the UE, when UDM returns the Nudm_UECM_Registration Response message to AMF, UDM carries a multi-AMF registration indication in the reply message. Based on the indication information, AMF knows that there are other AMFs serving the UE, so AMF subscribes to UDM for the network slice-specific authentication and authorization status / result of S-NSSAI.

[0251] Method 2:

[0252] Step 703: Nudm_EventExposure_Subscribe, carrying UE ID and AMF registration status.

[0253] Step 704: Nudm_EventExposure_Notify, carrying the AMF registration status.

[0254] Specifically, AMF sends a Nudm_EventExposure_Subscribe message (carrying UE ID and AMF registration status) to UDM.

[0255] When UDM finds that the AMF registration status of the UE (i.e. multi-AMF registration or single AMF registration) has changed, UDM sends Nudm_EventExposure_Subscribe(AMF registration status) to AMF. If AMF finds that the AMF registration status of the UE is multi-AMF registration, AMF subscribes to UDM for the network slice specific authentication and authorization status / result of S-NSSAI.

[0256] Method 3:

[0257] Step 705: Nudm_UECM_Get Request.

[0258] Step 706, 2. Nudm_UECM_Get Response.

[0259] Specifically, AMF sends a Nudm_UECM_Get request message to UDM, which includes the UE ID and AMF, and UDM returns a Nudm_UECM_Get reply message to AMF, which includes the identifier of the AMF to which the UE is registered this time. If UDM returns multiple AMF identifiers, indicating that the UE is registered with multiple AMFs at this time, AMF subscribes to UDM for the network slice-specific authentication and authorization status / result of S-NSSAI.

[0260] Method 4:

[0261] Step 707: First notification message.

[0262] Specifically, when UDM finds that the AMF registration status of the UE has changed, UDM sends a first notification message to the AMF registered with the UE (the first, second, etc. used in the embodiment are only to distinguish from other notification messages, and do not mean to use the "first notification message" message for implementation, the same below), and the message parameter is the AMF registration status, that is, multi-AMF registration or single AMF registration. If it is multi-AMF registration, AMF subscribes to UDM for the network slice-specific authentication and authorization status / result of S-NSSAI.

[0263] It should be noted that there is no dependency relationship between the above four methods, and each of them can be implemented independently.

[0264] When the UE is registered with multiple AMFs (i.e., the AMF registration status is multi-AMF registration, and the UE context saved by UDM includes information of multiple AMFs), UDM subscribes to AMFs for events related to changes in the network slice-specific authentication and authorization status / results of S-NSSAI.

[0265] Figure 8 This is a schematic diagram of an event in which the network slice-specific authentication and authorization status / result of the S-NSSAI that the UDM subscribes to the AMF respectively in Embodiment 1 changes. As shown in the figure, it may include:

[0266] The description of the above figure is as follows:

[0267] Step 801, Namf_EventExposure_Subscribe, carries UE ID, network slice specific authentication and authorization status / results.

[0268] Specifically, UDM sends a Namf_EventExposure_Subscribe message to AMF, and the parameters include UE ID, network slice-specific authentication and authorization status / result. AMF subscribes to the UE's network slice-specific authentication and authorization status / result from UDM through this message.

[0269] Step 802, Namf_EventExposure_Notify, carries the network slice-specific authentication and authorization status / results.

[0270] Specifically, when AMF finds that the network slice-specific authentication and authorization status / result of the UE has changed, AMF sends a Namf_EventExposure_Notify message to UDM, and the parameters include S-NSSAI and the network slice-specific authentication and authorization status / result.

[0271] Embodiment 2

[0272] In this embodiment, UDM stores the network slice-specific authentication and authorization status / results of S-NSSAI and synchronizes the information to different AMFs.

[0273] Fig. 9 This is a schematic diagram of the implementation process of authentication and authorization result notification in Example 2. As shown in the figure, the specific process of UDM obtaining the authentication and authorization status / result specific to the network slice may include:

[0274] Step 901: AMF sends a third request message to UDM, carrying UE ID.

[0275] Specifically, AMF sends a third request message to UDM, which includes the UE identifier and requests the network slice-specific authentication and authorization status / result of the UE. The message may also include one or more S-NSSAIs, indicating that the authentication and authorization status / results of these S-NSSAIs are requested. If S-NSSAI is not provided, it indicates that the status / result of the S-NSSAI that needs to be authenticated and authorized among all the contracted S-NSSAIs of the requested UE.

[0276] Step 902: UDM returns a third reply message to AMF, carrying the network slice-specific authentication and authorization status / results.

[0277] Specifically, UDM returns a third reply message to AMF, and the message parameters are the network slice-specific authentication and authorization status / results.

[0278] Step 903: Network slice specific authentication and authorization process.

[0279] Specifically, if UDM does not return any information, AMF initiates authentication and authorization procedures for all S-NSSAIs in Allowed NSSAI that need to be authenticated and authorized. If UDM returns the authentication and authorization status / result of some S-NSSAI as failed, AMF removes these S-NSSAIs from Allowed NSSAI and puts them into rejected S-NSSAI.

[0280] Step 904: AMF sends a second request message to UDM, carrying UE ID, network slice-specific authentication and authorization status / results.

[0281] Specifically, AMF sends a second request message to UDM, with the parameters of UE ID, network slice-specific authentication and authorization status / result. The second request message can be a Nudm_UECM_Update message or a newly defined message.

[0282] Step 905: UDM returns a second reply message to AMF.

[0283] Assuming that the UE first registers with the network through AMF1, and that S-NSSAI1, S-NSSAI2, and S-NSSAI3 included in the Allowed NSSAI determined by AMF1 for the UE need to perform authentication and authorization procedures, AMF1 initiates the above process and requests UDM to provide the authentication and authorization status / results of these three S-NSSAIs. Because the status and results related to these three S-NSSAIs are not stored in UDM, the reply message returned by UDM does not include the authentication and authorization status / results. AMF1 initiates network slice-specific authentication and authorization procedures for these three S-NSSAIs respectively, assuming that the authentication and authorization status / results of S-NSSAI1 and S-NSSAI2 are successful, and the authentication and authorization status / result of S-NSSAI3 is failed. AMF1 sends the authentication and authorization status / results of the above three S-NSSAIs to UDM through steps 904 and 905 of the above process.

[0284] When the UE registers to the network again through AMF2, after AMF2 determines the Allowed NSSAI for the UE, it finds that S-NSSAI2, S-NSSAI3 and S-NSSAI4 in the Allowed NSSAI need to perform network slice-specific authentication and authorization processes. AMF2 requests the authentication and authorization status / results of S-NSSAI2, S-NSSAI3 and S-NSSAI4 from UDM, and UDM returns the information it stores to it. Since S-NSSAI2 has been successfully authenticated, AMF2 skips the authentication and authorization process; since S-NSSAI3 authentication fails, AMF2 removes it from the Allowed NSSAI and includes it in the rejected S-NSSAI; since UDM does not return the authentication and authorization status / results of S-NSSAI4, AMF2 triggers the network slice-specific authentication and authorization process for it. AMF2 sends the authentication and authorization status / results of S-NSSAI to UDM.

[0285] Fig.10 This is a schematic diagram of the process of UDM synchronizing between different AMFs when the authentication and authorization result status / result changes in Example 2. As shown in the figure, when the authentication and authorization status / result specific to the network slice changes, the process of UDM synchronizing the status between different AMFs may include:

[0286] Step 1001, AMF2 sends a second request message to UDM, the message including UE ID, network slice specific authentication and authorization status / result.

[0287] Specifically, when AMF2 discovers that the authentication and authorization status / result for a network slice changes, for example, the AAA server revokes the authentication and authorization for S-NSSAI4, or the re-authentication and re-authorization process for S-NSSAI2 triggered by the AAA server fails, AMF2 sends a second request message to the UDM. The message includes the UE ID and the network slice-specific authentication and authorization status / result.

[0288] Step 1002: The UDM returns a second response message to AMF2.

[0289] The UDM updates the local information.

[0290] Step 1003: The UDM sends a fourth notification message to AMF1. The parameters include the UE ID and the network slice-specific authentication and authorization status / result.

[0291] Specifically, when the UDM discovers that the authentication and authorization status / result of S-NSSAI2 stored in AMF1 needs to be updated, the UDM sends a fourth notification message to AMF1. The parameters include the UE ID and the network slice-specific authentication and authorization status / result.

[0292] Step 1004: AMF2 returns a fourth response message to the UDM.

[0293] To support the above mechanism, the following information can be stored in the UE context in the UDM:

[0294] 1. <AMF1, Allowed NSSAI1>, <AMF2, Allowed NSSAI2>, the authentication and authorization status / result of the S-NSSAI; or,

[0295] 2. <S-NSSAI, the authentication and authorization status / result, information of the AMF reporting the authentication and authorization status / result of this S-NSSAI>; or,

[0296] 3. AMF1, S-NSSAI, the authentication and authorization status / result.

[0297] According to the different information stored in the UDM, the internal processing logic of the UDM is different. If the Allowed NSSAI is stored in the UDM, when the AMF reports the network slice-specific authentication and authorization status / result, it also provides the Allowed NSSAI. When the AMF reports the authentication and authorization status of the S-NSSAI, the UDM checks which Allowed NSSAI the S-NSSAI is also in and sends the authentication and authorization status of the S-NSSAI to the AMF corresponding to that Allowed NSSAI.

[0298] Embodiment III

[0299] In this embodiment, UDM obtains the authentication and authorization status / results of the network slice from the AAA server.

[0300] Fig.11 This is a schematic diagram of the implementation process of authentication and authorization result notification in Example 3, as shown in the figure, which may include:

[0301] Step 1101, UDM sends authentication and authorization status / result subscription to AUSF, the message includes S-NSSAI;

[0302] Step 1102, the AUSF forwards the message authentication and authorization status / result subscription, including the S-NSSAI, to the AAA server;

[0303] AUSF forwards the message to the AAA server;

[0304] Step 1103: The AAA server sends an authentication and authorization status / result notification to the AUSF, where the message parameters are the authentication and authorization status / result of the S-NSSAI.

[0305] When the AAA server finds that the authentication and authorization status / result of S-NSSAI has changed, the AAA server sends an authentication and authorization status / result notification to AUSF, and the message parameters are the authentication and authorization status / result of S-NSSAI.

[0306] Step 1104: AUSF forwards the authentication and authorization status / result notification to UDM, and the message parameters are the authentication and authorization status / result of S-NSSAI.

[0307] After obtaining the above information, UDM sends an event notification to the AMF that has subscribed to the authentication and authorization status / results of S-NSSAI.

[0308] Embodiment 4

[0309] In this embodiment, the UE synchronizes network slice-specific authentication and authorization status / results between AMFs.

[0310] Fig.12 This is a schematic diagram of the implementation process of authentication and authorization result notification in Example 4, as shown in the figure, which may include:

[0311] Step 1201. The UE sends a registration request to the AMF, and the message includes S-NSSAI, network slice-specific authentication and authorization status / result (optional parameters).

[0312] Step 1202: AMF sends the information provided by the UE to AUSF to check the correctness of the information provided by the UE.

[0313] Step 1203: AUSF forwards the AMF registration request message, including S-NSSAI, network slice-specific authentication and authorization status / results, to the AAA server.

[0314] Step 1204. The AAA server returns the network slice-specific authentication and authorization status / results of S-NSSAI to AUSF.

[0315] Step 1205. AUSF forwards the message network slice specific authentication and authorization status / results to AMF.

[0316] Step 1206: The AMF box UE returns a registration acceptance message.

[0317] For S-NSSAI included in Allowed NSSAI but without checking the authentication and authorization status / result, the AMF needs to trigger the network slice specific authentication and authorization process.

[0318] Embodiment 5

[0319] In this embodiment, the AAA server synchronizes the authentication and authorization status / results between AMFs.

[0320] Fig.13 This is a schematic diagram of the implementation process of the UDM subscription authentication and authorization status / result in Example 5. As shown in the figure, the UDM subscription authentication and authorization status / result may include:

[0321] Step 1301, UDM sends authentication and authorization status / result subscription (UE ID, S-NSSAI, notification node, AAA server address) to AUSF.

[0322] The notification node is the information of AMF, and the AAA server address can be pre-configured in UDM or provided by AMF. When UDM finds that there are multiple service AMFs for UE (the context of UE includes multiple AMFs), and the Allowed NSSAIs allocated by different service AMFs all include the same S-NSSAI that needs to perform authentication and authorization, UDM can trigger this process.

[0323] Step 1302: AUSF sends the authentication and authorization status / result subscription message to the AAA server according to the AAA server address in the message.

[0324] Step 1303: The AAA server discovers that the authentication and authorization status / result of the S-NSSAI has changed. The AAA server notifies the AMF of the authentication and authorization status / result of the S-NSSAI according to the information of the notification node in the subscription message.

[0325] Fig.14This is a schematic diagram of the implementation process of AMF subscription authentication and authorization status / result in Example 5. As shown in the figure, AMF subscription authentication and authorization status / result may include:

[0326] Step 1401, AMF sends authentication and authorization status / result subscription (UE ID, S-NSSAI, notification node, AAA server address) to AUSF.

[0327] The notification node is the information of AMF. When AMF finds that UE is registered with multiple AMFs, and the Allowed NSSAIs assigned by different service AMFs all include the same S-NSSAI that needs to perform authentication and authorization, AMF can trigger this process. UDM or UE can provide AMF with information about Allowed NSSAI assigned by other AMFs.

[0328] Step 1402: AUSF sends the authentication and authorization status / result subscription message to the AAA server according to the AAA server address in the message.

[0329] Step 1403: The AAA server discovers that the authentication and authorization status / result of the S-NSSAI has changed. The AAA server notifies the AMF of the authentication and authorization status / result of the S-NSSAI according to the information of the notification node in the subscription message.

[0330] Based on the same inventive concept, a communication device, an AMF, an authentication and authorization result notification device, an authentication and authorization result notification processing device, and a computer-readable storage medium are also provided in the embodiment of the present invention. Since the principles of solving the problems by these devices are similar to those of the authentication and authorization result notification method and the authentication and authorization result notification processing method, the implementation of these devices can refer to the implementation of the method, and the repeated parts will not be repeated.

[0331] When implementing the technical solution provided by the embodiment of the present invention, it can be implemented as follows.

[0332] Fig.15 The structure diagram of the communication equipment is shown in the figure, including:

[0333] The processor 1500 is used to read the program in the memory 1520 and execute the following process:

[0334] Obtain authentication and authorization results for network slices;

[0335] Notify the AMF of the authentication and authorization results;

[0336] The transceiver 1510 is configured to receive and send data under the control of the processor 1500 .

[0337] In implementation, the communication equipment is located in the UDM, where:

[0338] Obtain the authentication and authorization results of the network slice from the AMF or AAA server;

[0339] Notify other AMFs of the authentication and authorization results.

[0340] During implementation, when it is determined based on the context of the UE that there is more than one AMF providing services for the UE, the authentication and authorization results are notified to other AMFs.

[0341] In implementation, when one or a combination of the following situations is determined to occur, the authentication and authorization results are notified to other AMFs:

[0342] The Allowed NSSAI allocated by other AMFs to the UE includes the S-NSSAI; or,

[0343] The authentication and authorization result information of the S-NSSAI associated with other AMFs includes information about the S-NSSAI; or,

[0344] Other AMFs subscribe to the authentication and authorization result information of S-NSSAI; or,

[0345] The authentication and authorization results of the network slice change.

[0346] In implementation, the authentication and authorization result of the network slice obtained from AMF is the authentication and authorization status / result notified to UDM by AMF after performing the authentication and authorization process of the network slice.

[0347] In implementation, the communication device is located in the UE, wherein:

[0348] Obtain authentication and authorization results for network slices from AMF;

[0349] Notify other AMFs of the authentication and authorization results.

[0350] During implementation, the authentication and authorization results of the network slice are obtained after the authentication and authorization process of the network slice of S-NSSAI is completed through AMF.

[0351] During implementation, when it is determined that there is more than one AMF providing services for the UE, the authentication and authorization results are notified to other AMFs.

[0352] During implementation, when it is determined that the Allowed NSSAI allocated by other AMFs includes S-NSSAI; and / or, when it is determined that the authentication and authorization results have changed, the authentication and authorization results are notified to other AMFs.

[0353] In implementation, the authentication and authorization results are carried in the registration request sent to the other AMF to notify the other AMF of the authentication and authorization results; or,

[0354] By carrying information according to preset rules in the registration request sent to other AMFs, other AMFs are notified of the authentication and authorization results.

[0355] In implementation, the communication device is located at the AUSF or AAA server, wherein:

[0356] Obtain authentication and authorization results for network slices;

[0357] Notify AMF of the authentication and authorization results.

[0358] During implementation, other AMFs notified are the AMFs that need to be notified set by the AMF or UDM when subscribing to the authentication and authorization results of S-NSSAI from the AUSF or AAA server.

[0359] During implementation, when the authentication and authorization results for a certain S-NSSAI change, the AMF is notified of the changed authentication and authorization results.

[0360] Among them, Fig.15 In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically linking together various circuits of one or more processors represented by processor 1500 and memory represented by memory 1520. The bus architecture may also link together various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. The transceiver 1510 may be a plurality of components, namely, a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium. The processor 1500 is responsible for managing the bus architecture and general processing, and the memory 1520 may store data used by the processor 1500 when performing operations.

[0361] An embodiment of the present invention provides an authentication and authorization result notification device, comprising:

[0362] An acquisition module is used to obtain the authentication and authorization results of the network slice;

[0363] The notification module is used to notify the AMF of the authentication and authorization results.

[0364] For specific implementation, please refer to the implementation of authentication and authorization result notification method.

[0365] For the convenience of description, the various parts of the above-mentioned device are divided into various modules or units according to their functions and described separately. Of course, when implementing the present invention, the functions of each module or unit can be implemented in the same or multiple software or hardware.

[0366] Fig.16 The following is a schematic diagram of the AMF structure. As shown in the figure, AMF includes:

[0367] The processor 1600 is used to read the program in the memory 1620 and execute the following process:

[0368] Receive notifications of authentication and authorization results of network slices;

[0369] Update the authentication and authorization results stored locally;

[0370] The transceiver 1610 is configured to receive and send data under the control of the processor 1600 .

[0371] Specifically, when the authentication and authorization result is inconsistent with the locally stored authentication and authorization result, the locally stored authentication and authorization result may be updated.

[0372] During implementation, update the locally stored authentication and authorization results, including:

[0373] Update the UE's Allowed NSSAI and rejected S-NSSAI.

[0374] In implementation, after updating the locally stored authentication and authorization results, it further includes:

[0375] Release the PDU session associated with S-NSSAI1 established by the UE.

[0376] During implementation, it further includes:

[0377] After performing the network slice specific authentication and authorization process, the UDM is notified of the authentication and authorization results.

[0378] During implementation, it further includes:

[0379] After receiving the authentication and authorization results notified by the UE, the AUSF requests the AAA server to verify the validity of the authentication and authorization results provided by the UE.

[0380] During implementation, when AMF or UDM subscribes to the authentication and authorization results of S-NSSAI from the AUSF or AAA server, it is the AUSF or AAA server that notifies the AMF to receive the authentication and authorization results of the network slice.

[0381] Among them, Fig.16In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically one or more processors represented by processor 1600 and various circuits of memory represented by memory 1620 are linked together. The bus architecture may also link together various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. The transceiver 1610 may be a plurality of components, i.e., including a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium. The processor 1600 is responsible for managing the bus architecture and general processing, and the memory 1620 may store data used by the processor 1600 when performing operations.

[0382] An embodiment of the present invention provides an authentication and authorization result notification processing device, including:

[0383] A receiving module, used to receive authentication and authorization result notifications of network slices;

[0384] The update module is used to update the authentication and authorization results stored locally.

[0385] For specific implementation, please refer to the implementation of authentication and authorization result notification processing method.

[0386] For the convenience of description, the various parts of the above-mentioned device are divided into various modules or units according to their functions and described separately. Of course, when implementing the present invention, the functions of each module or unit can be implemented in the same or multiple software or hardware.

[0387] An embodiment of the present invention provides a computer-readable storage medium, characterized in that the computer-readable storage medium stores a computer program for executing the above-mentioned authentication and authorization result notification method and / or authentication and authorization result notification processing method.

[0388] For specific implementation, please refer to the implementation of the authentication and authorization result notification method and / or the authentication and authorization result notification processing method.

[0389] In summary, in the technical solution provided in the embodiment of the present invention, the UDM or AAA server or UE synchronizes the authentication and authorization status / results of network slices between different AMFs. Specifically:

[0390] UDM obtains the authentication and authorization status / result of the network slice from AMF or AAA server and sends this information to other AMFs connected to the UE. Further UDM subscribes to the authentication and authorization status / result of the network slice from AMF or AAA server. AMF subscribes to the authentication and authorization status / result of the network slice from UDM.

[0391] The UDM or AMF subscribes to the AAA server for the authentication and authorization status / results of the network slice. The AAA server further notifies the UDM or AMF of the authentication and authorization status / results of the network slice. The UDM notifies the AMF of the authentication and authorization status / results of the network slice.

[0392] The UE sends the authentication and authorization status / result of the network slice to the AMF. After receiving the information provided by the UE, the AMF can verify the validity of the information provided by the UE to the AAA server through the AUSF.

[0393] The solution provided in the embodiment of the present invention solves the problem that network slice-specific authentication and authorization status / results cannot be synchronized between different AMFs.

[0394] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) containing computer-usable program code.

[0395] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0396] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0397] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0398] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A method for notifying authentication and authorization results, applied to an authentication service function, characterized in that: include: Obtain the authentication and authorization result of the network slice from the first access and mobility management function AMF or the authentication, authorization and accounting AAA server; When the authentication and authorization results for the S-NSSAI change, the second AMF is notified of the changed authentication and authorization results; Among them, the authentication and authorization results of the network slice are the authentication and authorization results obtained by the first AMF after executing the authentication and authorization process of the network slice; the first AMF and the second AMF are the AMFs registered respectively when the UE is connected to different PLMNs through different access types at the same time.

2. The method according to claim 1, characterized in that The second AMF notified by the authentication service function is the AMF to be notified set by the second AMF or UDM when subscribing to the authentication service function or AAA server for the authentication and authorization results of S-NSSAI.

3. A communication device, characterized in that: include: The processor reads the program in the memory and performs the following processes: Obtain the authentication and authorization result of the network slice from the first access and mobility management function AMF or the authentication, authorization and accounting AAA server; When the authentication and authorization results for the S-NSSAI change, the second AMF is notified of the changed authentication and authorization results; Among them, the authentication and authorization results of the network slice are the authentication and authorization results obtained by the first AMF after executing the authentication and authorization process of the network slice; the first AMF and the second AMF are the AMFs registered respectively when the UE is connected to different PLMNs through different access types at the same time.

4. The device according to claim 3, characterized in that The second AMF notified by the authentication service function is the AMF to be notified set by the second AMF or UDM when subscribing to the authentication service function or AAA server for the authentication and authorization results of S-NSSAI.

5. An authentication and authorization result notification device, applied to the authentication service function, characterized in that: include: An obtaining module, used to obtain the authentication and authorization results of the network slice from the first access and mobility management function AMF or the authentication, authorization and accounting AAA server; a notification module, configured to notify the second AMF of the changed authentication and authorization results when the authentication and authorization results for the S-NSSAI change; Among them, the authentication and authorization results of the network slice are the authentication and authorization results obtained by the first AMF after executing the authentication and authorization process of the network slice; the first AMF and the second AMF are the AMFs registered respectively when the UE is connected to different PLMNs through different access types at the same time.

6. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program for executing the method according to any one of claims 1 to 2.

Images