An authorization method and apparatus

Abstract

The application provides an authorization method and device. The method comprises the following steps: an access management network element acquires operation permission indication information and authorization conditions, the operation permission indication information is used for indicating that a terminal device is allowed to provide a connection service, and the authorization conditions comprise an authorized location range of the connection service and / or an authorized time range of the connection service; and the access management network element sends an authorization result to an access network element accessed by the terminal device according to the authorized location range and / or the authorized time range, the authorization result is used for indicating that the terminal device is not allowed to provide the connection service or the terminal device is allowed to provide the connection service, and even if the operation permission indication information is used for indicating that the terminal device is allowed to provide the connection service, the access management network element can determine that the terminal device is not allowed to provide the connection service based on the authorization conditions, so that the terminal device is prevented from providing the connection service outside the authorized location range and / or the authorized time range.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a licensed method and apparatus. Background Technology

[0002] During the registration process, the Unified Data Management (UDM) provides the UE's subscription data to the Access and Mobility Management Function (AMF). This subscription data includes Operation Permission Instruction (API), which instructs either an authorized or unauthorized UE to provide connectivity services. The AMF sends either an authorization instruction or an unauthorized instruction to the RAN based solely on the API, allowing the RAN to control the UE's connectivity services.

[0003] The network controls and manages the UE's connection service only based on the operation permission instruction information. For example, when the operation permission instruction information is used to instruct the authorized UE to provide connection service, the UE can provide connection service at any location and at any time, resulting in poor flexibility for the network to control and manage the UE's provision of connection service. Summary of the Invention

[0004] This application provides an authorization method and apparatus for flexibly and dynamically controlling and managing the provision of connectivity services to a UE.

[0005] In a first aspect, an authorization method is provided, comprising the following steps: an access management network element obtains operation permission indication information and authorization conditions, wherein the operation permission indication information is used to indicate that the terminal device is allowed to provide connection services, and the authorization conditions include the authorized location range and / or the authorized time range of the connection services; the access management network element sends an authorization result to the access network element to which the terminal device is accessed, according to the authorization conditions, wherein the authorization result is used to indicate that the terminal device is not allowed to provide connection services, or that the terminal device is allowed to provide connection services.

[0006] Accordingly, the access network element receives the authorization result and then controls the connection service of the terminal device based on the authorization result. The terminal device can perform corresponding operations according to the control of the access network element, such as releasing resources used to provide connection services or providing connection services.

[0007] In related technologies, the access management network element only allows terminal devices to provide connectivity services at any location and time based on operation permission instructions. This may result in poor flexibility in the network's control and management of UE connectivity services, and may also cause terminal devices to interfere with existing communications outside the authorized location or time range. In the above solution, in addition to operation permission instructions, the access management network element can also obtain authorization conditions. Thus, even if the operation permission instructions indicate that the terminal device is allowed to provide connectivity services, the access management network element can determine whether to disallow the terminal device to provide connectivity services based on the authorization conditions. This allows for flexible and dynamic control and management of UE connectivity services, preventing terminal devices from providing services outside the authorized location and / or time range.

[0008] For example, the access management network element can send an authorization result to the access network element based on the authorized location range and / or authorized time range. More specifically, the access management network element can send an authorization result to the access network element based on the location of the terminal device and the authorized location range of the connection service, and / or the current time and the authorized time range of the connection service.

[0009] In one possible implementation, the access management network element can also send authorization results to the terminal device.

[0010] Correspondingly, the terminal device can receive the authorization result and then perform the corresponding operation based on the authorization result. For example, if the authorization result indicates that the terminal device is not allowed to provide connection services, the terminal device can release the resources used to provide connection services; if the authorization result indicates that the terminal device is allowed to provide connection services, the terminal device can provide connection services.

[0011] Optionally, the terminal device may perform corresponding operations based on the control and / or authorization results of the access network element.

[0012] In one possible implementation, when the access management network element sends the authorization result to the access network element to which the terminal device is connected, based on the authorization conditions, the access management network element can determine the authorization result based on the authorization conditions (such as the authorized location range and / or authorized time range) and send the authorization result to the access network element.

[0013] For example, the access management network element can determine the authorization result based on the location of the terminal device and the authorized location range of the connection service. In another example, the access management network element can determine the authorization result based on the current time and the authorized location range of the connection service.

[0014] In one possible implementation, the authorization conditions include the authorization time range for the connection service.

[0015] When the access management network element determines the authorization result based on the authorized time range, if the current time is outside the authorized time range, the access management network element can determine that the authorization result is used to disallow the terminal device from providing connection services; if the current time is within the authorized time range, the access management network element can determine that the authorization result is used to allow the terminal device to provide connection services. This implementation avoids interference with existing communication caused by the terminal device providing services outside the authorized time range.

[0016] In one possible implementation, the authorization conditions include the authorized location range for the connection service.

[0017] When the access management network element determines the authorization result based on the authorized location range, if the terminal device is outside the authorized location range, the access management network element can determine the authorization result to indicate that the terminal device is not allowed to provide connection services; if the terminal device is within the authorized location range, the access management network element can determine the authorization result to indicate that the terminal device is allowed to provide connection services. This implementation avoids interference with existing communication caused by the terminal device providing services outside the authorized location range.

[0018] For example, the terminal device can obtain its location from the location management network element, and determine whether the terminal device is outside or inside the authorized location range based on its location and the authorized location range.

[0019] In one possible implementation, the authorization conditions include the authorized location range for the connection service.

[0020] When the access management network element determines the authorization result based on the authorized location range, if the terminal device is outside the authorized location range, the access management network element receives a notification message from the location management network element. This notification message informs the terminal device that it is either outside or within the authorized location range. If the notification message indicates the terminal device is outside the authorized location range, the access management network element determines the authorization result to indicate that the terminal device is not allowed to provide connection services. If the notification message indicates the terminal device is within the authorized location range, the access management network element determines the authorization result to indicate that the terminal device is allowed to provide connection services. This implementation avoids interference with existing communication caused by the terminal device providing services outside the authorized location range.

[0021] For example, a terminal device can send a request message to a location management network element to request whether the terminal device is outside or within an authorized location range. This request message may include information about the authorized location range.

[0022] In one possible implementation, the authorization conditions include the authorized location range for the connection service.

[0023] When the access management network element determines the authorization result based on the authorized location range, if the terminal device is outside the authorized location range, or if the tracking area where the terminal device is located is outside the tracking area range corresponding to the authorized location range, the access management network element determines the authorization result to indicate that the terminal device is not allowed to provide connection services. Conversely, if the tracking area where the terminal device is located is within the tracking area range corresponding to the authorized location range, the access management network element determines the authorization result to indicate that the terminal device is allowed to provide connection services. This implementation avoids interference with existing communication caused by the terminal device providing services outside the authorized location range.

[0024] For example, the access management network element can obtain the tracking area range corresponding to the authorized location range from the network open network element.

[0025] In one possible implementation, the connectivity service includes an integrated access and backhaul (IAB) service, with the terminal device being an IAB terminal device; or the connectivity service includes a vehicle-mounted relay (VMR) service, with the terminal device being a VMR device; or the connectivity service includes a relay service, with the terminal device being a relay terminal device. VMR can also be a mobile base station relay.

[0026] In one possible implementation, the authorized location range includes one or more of the following: authorized routes for the connection service, authorized regions for the connection service, regions where the connection service is permitted, or regions where the connection service is prohibited.

[0027] For example, in an IAB scenario, the authorized location range includes the authorized routes and authorized areas for the connection service. As another example, in an L2 Relay scenario, the authorized location range includes areas where the connection service is permitted and areas where the connection service is prohibited.

[0028] Secondly, an authorization method is provided, comprising the following steps: a data management network element obtains operation permission indication information and authorization conditions, wherein the operation permission indication information is used to indicate that the terminal device is allowed to provide connection services, and the authorization conditions include the authorized location range and / or the authorized time range of the connection services; the data management network element sends an authorization result to the access management network element according to the authorization conditions, wherein the authorization result is used to indicate that the terminal device is not allowed to provide connection services, or that the terminal device is allowed to provide connection services.

[0029] In one possible implementation, when the data management network element sends the authorization result to the access management network element according to the authorization conditions, the data management network element can determine the authorization result (such as the authorized location range and / or authorized time range) according to the authorization conditions and send the authorization result to the access management network element.

[0030] For example, a data management network element can determine the authorization result based on the location of the terminal device and the authorized location range of the connection service. In another example, a data management network element can determine the authorization result based on the current time and the authorized location range of the connection service.

[0031] In one possible implementation, the authorization conditions include the authorization time range for the connection service.

[0032] When the data management network element determines the authorization result based on the authorized time range, if the current time is outside the authorized time range, the data management network element can determine that the authorization result is used to disallow the terminal device from providing connection services; if the current time is within the authorized time range, the data management network element can determine that the authorization result is used to allow the terminal device to provide connection services. This implementation avoids interference with existing communication caused by the terminal device providing services outside the authorized time range.

[0033] In one possible implementation, the authorization conditions include the authorized location range for the connection service.

[0034] When the data management network element determines the authorization result based on the authorized location range, if the terminal device is outside the authorized location range, the data management network element can determine the authorization result to indicate that the terminal device is not allowed to provide connection services; if the terminal device is within the authorized location range, the data management network element can determine the authorization result to indicate that the terminal device is allowed to provide connection services. This implementation avoids interference with existing communication caused by the terminal device providing services outside the authorized location range.

[0035] For example, the terminal device can obtain its location from the gateway's mobile location center, and determine whether the terminal device is outside or inside the authorized location range based on its location and the authorized location range.

[0036] In one possible implementation, the authorization conditions include the authorized location range for the connection service.

[0037] When the data management network element determines the authorization result based on the authorized location range, if the terminal device is outside the authorized location range, the data management network element receives a notification message from the gateway's mobile location center. This notification message informs the terminal device whether it is outside or within the authorized location range. If the notification message indicates the terminal device is outside the authorized location range, the data management network element determines the authorization result to indicate that the terminal device is not allowed to provide connection services. If the notification message indicates the terminal device is within the authorized location range, the data management network element determines the authorization result to indicate that the terminal device is allowed to provide connection services. This implementation avoids interference with existing communication caused by the terminal device providing services outside the authorized location range.

[0038] For example, a terminal device can send a request message to the gateway mobile location center to request whether the terminal device is outside or within an authorized location range. This request message may include information about the authorized location range.

[0039] In one possible implementation, the connectivity service includes an integrated access backhaul (IAB) service, and the terminal device is an IAB terminal device; or the connectivity service includes a vehicle-mounted relay (VMR) service, and the terminal device is a VMR device or a mobile base station relay device; or the connectivity service includes a relay service, and the terminal device is a relay terminal device.

[0040] In one possible implementation, the authorized location range includes one or more of the following: authorized routes for the connection service, authorized regions for the connection service, regions where the connection service is permitted, or regions where the connection service is prohibited.

[0041] For example, in an IAB scenario, the authorized location range includes the authorized routes and authorized areas for the connection service. As another example, in an L2 Relay scenario, the authorized location range includes areas where the connection service is permitted and areas where the connection service is prohibited.

[0042] Thirdly, an authorization method is provided, comprising the following steps: a terminal device receives a first authorization result sent by an access management network element, the first authorization result indicating that the terminal device is not allowed to provide connection services; the terminal device releases resources used to provide connection services according to the first authorization result.

[0043] In the above scheme, the access management network element can send an authorization result to the terminal device, indicating that the terminal device is not allowed to provide connection services, thereby avoiding interference to existing communication caused by the terminal device providing services outside the authorized location range and / or authorized time range.

[0044] In one possible implementation, when releasing resources used to provide connectivity services, the terminal device releases the F1 interface, which is used for information transmission between the terminal device and the access network element.

[0045] In one possible implementation, the terminal device can also receive a second authorization result sent by the access management network element. This second authorization result indicates that the terminal device is permitted to provide connection services, and the terminal device can provide connection services based on the second authorization result. In this implementation, the access management network element can instruct the terminal device to provide connection services, thereby ensuring service continuity and reliability.

[0046] Fourthly, an authorization method is provided, comprising the following steps: a terminal device receives a connection control message sent by an access network element to which the terminal device is connected, the connection control message being used to control the terminal device not to provide connection services; the terminal device releases resources used to provide connection services according to the connection control message.

[0047] In the above scheme, the terminal device can release the resources used to provide connection services under the control of the access network element, thereby avoiding interference to existing communication caused by the terminal device providing services outside the authorized location range and / or authorized time range.

[0048] In one possible implementation, when releasing resources used to provide connectivity services, the terminal device releases the F1 interface, which is used for information transmission between the terminal device and the access network element.

[0049] In one possible implementation, the connection control message can also be used to control the terminal device to provide connection services. The terminal device can also provide connection services based on the connection control message. In this implementation, the terminal device can provide connection services under the control of the access network element, thereby ensuring service continuity and reliability.

[0050] Fifthly, a communication device is provided, which can be an access management network element, a data management network element, or a terminal device, or a chip disposed in an access management network element, a data management network element, or a terminal device. This communication device can implement the method provided in any of the above aspects.

[0051] The communication device includes modules, units, or means that implement the methods described above. These modules, units, or means can be implemented in hardware, software, or by hardware executing corresponding software. The hardware or software includes one or more modules or units corresponding to the functions described above.

[0052] A sixth aspect provides a communication device including a transceiver unit. Optionally, the communication device further includes a processing unit. The communication device can implement the method provided in any one aspect or any one of the aspects.

[0053] A seventh aspect provides a communication device including a processor. The processor can be used to execute the methods provided by any of the above aspects or any implementation thereof. Optionally, the device further includes a memory, the processor being coupled to the memory, the memory storing computer programs or instructions, the processor being able to execute the programs or instructions in the memory such that the device can execute the methods provided by any of the above aspects or any implementation thereof.

[0054] Eighthly, a communication device is provided, comprising an interface circuit and a logic circuit coupled to the interface circuit. The interface circuit may be a code / data read / write interface circuit, used to receive computer execution instructions (which are stored in memory, may be read directly from memory, or may be transmitted through other devices) and transmit them to the logic circuit, so that the logic circuit executes the computer execution instructions to perform the methods provided in any of the above aspects or any one of the above aspects.

[0055] In some possible designs, the communication device can be a chip or a chip system.

[0056] A ninth aspect provides a communication device including a processor and a memory coupled together. The processor is configured to read instructions stored in the memory, receive signals via a receiver, and transmit signals via a transmitter to execute any of the above aspects or any one of the above aspects implementing the provided method.

[0057] Optionally, there can be one or more processors, and there can also be one or more memories. Optionally, the memory can be integrated with the processor, or the memory can be set separately from the processor.

[0058] In the specific implementation process, the memory can be a non-transitory memory, such as read-only memory (ROM), which can be integrated with the processor on the same chip or set on different chips. This application does not limit the type of memory or the way the memory and processor are set.

[0059] The communication device can be a chip. The processor can be implemented in hardware or software. When implemented in hardware, the processor can be a logic circuit, integrated circuit, etc. When implemented in software, the processor can be a general-purpose processor that reads software code stored in memory. The memory can be integrated into the processor or located outside the processor and exist independently.

[0060] A tenth aspect provides a processor, comprising: an input circuit, an output circuit, and a processing circuit. The processing circuit is configured to receive signals through the input circuit and transmit signals through the output circuit, causing the processor to execute any of the above aspects or any one of the above aspects to implement the provided method.

[0061] In specific implementation, the processor can be a chip, the input circuit can be input pins, the output circuit can be output pins, and the processing circuit can be transistors, gate circuits, flip-flops, and various logic circuits. The input signal received by the input circuit can be received and input by, for example, but not limited to, a receiver, and the signal output by the output circuit can be, for example, but not limited to, output to and transmitted by a transmitter. Furthermore, the input circuit and the output circuit can be the same circuit, which is used as both the input circuit and the output circuit at different times. This application does not limit the specific implementation of the processor and various circuits.

[0062] Eleventhly, a communication device is provided, comprising: logic circuitry and an input / output interface for communicating with a module outside the communication device; the logic circuitry for executing a computer program or instructions to perform the method provided by any of the designs in any of the preceding aspects. The communication device may be a first access network element, a second access network element, or an access management network element as described in any of the preceding aspects, or a device comprising the aforementioned access management network element, data management network element, or terminal device, or a device included in the aforementioned access management element, data management element, or terminal device, such as a chip.

[0063] Alternatively, the input / output interface can be a code / data read / write interface circuit or a communication interface, which is used to receive computer programs or instructions (the computer programs or instructions are stored in memory, may be read directly from memory, or may be transmitted through other devices) and transmit them to the input / output interface so that the input / output interface can run the computer programs or instructions to perform any of the methods described above.

[0064] Optionally, the communication device can be a chip.

[0065] In a twelfth aspect, a computer program product is provided, comprising: a computer program (also referred to as code or instructions) that, when run, causes a computer to perform the method provided by any of the above aspects or any implementation of any of the above aspects.

[0066] In a thirteenth aspect, a computer-readable medium is provided that stores a computer program (also referred to as code or instructions) that, when run on a computer, causes the computer to perform the methods provided by any of the above aspects or any implementation of any of the above aspects.

[0067] In a fourteenth aspect, a chip system is provided, comprising a processor and an interface for supporting a communication device in implementing the functions provided by any one of the aforementioned aspects. In one possible design, the chip system further includes a memory for storing necessary information and data of the aforementioned communication device. The chip system may be composed of chips or may include chips and other discrete devices.

[0068] In a fifteenth aspect, a chip device is provided, the chip device including an input interface and / or an output interface. The input interface can implement the receiving function provided by any one of the above aspects, and the output interface can implement the transmitting function provided by any one of the above aspects.

[0069] In a sixteenth aspect, a functional entity is provided for implementing the method provided by any one of the above aspects or any one of the above aspects.

[0070] In a seventeenth aspect, a communication system is provided, including an access management network element and an access network element for performing the method described in the first aspect.

[0071] Optionally, the communication system may also include a terminal device for performing the methods in the third and / or fourth aspects described above.

[0072] Eighteenth aspect: A communication system is provided, including a data management network element and an access management network element for performing the functions described in the second aspect above.

[0073] Optionally, the communication system may also include terminal equipment and access network elements for performing the methods in the third and / or fourth aspects described above.

[0074] The technical effects resulting from the implementation of any of the fifth to eighteenth aspects mentioned above can be found in the technical effects resulting from the first to fourth aspects mentioned above, and will not be repeated here. Attached Figure Description

[0075] Figure 1A This is a schematic diagram of the architecture of a 5G communication system.

[0076] Figure 1B This is a schematic diagram of an IAB architecture;

[0077] Figure 2 This is a schematic diagram of a mobile IAB architecture;

[0078] Figure 3 This is a schematic diagram of the network access process for an IAB-node.

[0079] Figure 4 This is a schematic diagram of an L2 Relay architecture;

[0080] Figure 5 A schematic diagram illustrating the connection establishment process for a remote UE;

[0081] Figure 6 A schematic diagram of the initiation process for UE positioning;

[0082] Figure 7 A schematic diagram of the termination process for UE positioning;

[0083] Figure 8A A schematic diagram of an authorization process provided for an embodiment of this application;

[0084] Figure 8B This is another schematic diagram of the licensing process provided in the embodiments of this application;

[0085] Figure 9 A schematic diagram of an authorization process for an IAB scenario provided in an embodiment of this application;

[0086] Figure 10 A schematic diagram of the authorization process for an L2 Relay scenario provided in this application embodiment;

[0087] Figure 11 A schematic diagram of an authorization process provided for an embodiment of this application;

[0088] Figure 12 A schematic diagram of an authorization process for an IAB scenario provided in an embodiment of this application;

[0089] Figure 13 This is a schematic diagram of the structure of a communication device provided in an embodiment of this application;

[0090] Figure 14 This is a schematic diagram of the structure of a communication device provided in an embodiment of this application;

[0091] Figure 15 This is a schematic diagram of the structure of a communication device provided in an embodiment of this application. Detailed Implementation

[0092] The embodiments of this application will now be described in detail with reference to the accompanying drawings.

[0093] The technical solutions of this application embodiment can be applied to mobile communication systems. For example, the mobile communication system can be a fourth-generation (4G) communication system (e.g., a long-term evolution (LTE) system), a fifth-generation (5G) mobile communication system (e.g., a new radio (NR) system), and future mobile communication systems such as 6G.

[0094] The 3GPP standards group has developed the next-generation mobile communication network architecture, known as the 5G network architecture. Figure 1A This is a schematic diagram of a 5G network architecture, including: terminal equipment, network equipment, and data network (DN).

[0095] The terminal equipment section generally includes user equipment (UE). In a wireless network, a UE is a device with wireless transceiver capabilities, which can communicate with one or more core network (CN) elements via access network elements in the radio access network (RAN).

[0096] For example, user equipment can also be referred to as an access terminal, terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, user agent, or user device. User equipment can be deployed on land, including indoors or outdoors, handheld or vehicle-mounted; it can also be deployed on water (such as on ships); and it can also be deployed in the air (such as on airplanes, balloons, and satellites). User equipment can be a cellular phone, cordless phone, session initiation protocol (SIP) phone, smartphone, mobile phone, wireless local loop (WLL) station, personal digital assistant (PDA), etc. Alternatively, the user equipment can also be a handheld device with wireless communication capabilities, a computing device or other device connected to a wireless modem, an in-vehicle device, a wearable device, a drone device, or a terminal in the Internet of Things (also known as an IoT device), a terminal in the Internet of Vehicles (IoV), a terminal in any form in 5G networks and future networks, a relay user equipment, a mobile terminal (MT), or a terminal in a future evolved public land mobile network (PLMN), etc. For example, a relay user equipment can be a 5G residential gateway (RG). For instance, the user equipment can be a virtual reality (VR) terminal, an augmented reality (AR) terminal, a wireless terminal in industrial control, a wireless terminal in self-driving, a wireless terminal in remote medical care, a wireless terminal in a smart grid, a wireless terminal in transportation safety, a wireless terminal in a smart city, a wireless terminal in a smart home, etc. This application does not limit the type or category of the terminal equipment.

[0097] The network equipment includes network exposure function (NEF), network repository function (NRF), policy control function (PCF), UDM, authentication server function (AUSF), AMF, session management function (SMF), user plane function (UPF), access network (AN), and network slice selection function (NSSF). The portion of the network equipment excluding the access network can be referred to as the core network.

[0098] The core network consists of user plane functions and control plane functions. User plane functions are primarily responsible for packet forwarding, quality of service (QoS) control, and billing information statistics. Control plane functions are primarily responsible for service process interaction, issuing packet forwarding policies and QoS control policies to user plane functions, etc.

[0099] A data network (DN), also known as a packet data network (PDN), is typically deployed outside the operator's network, such as through a third-party network. For example, an operator's network can access multiple DNs, and various services can be deployed on these DNs to provide data and / or voice services to the UE. The aforementioned third party can be a service provider outside of the operator's network and the UE, offering other data and / or voice services to the UE. The specific form of this third party can be determined based on the actual application scenario and is not limited here.

[0100] Application functions (AFs) may or may not belong to the carrier network. However, they are usually affiliated with a third party and not with the carrier network, but they have a protocol relationship with the carrier network. AFs are functional network elements used to provide various service functions. They can support functions that influence data routing through applications, access network open functions (NEFs), and interact with policy frameworks for policy control.

[0101] For example, the network functions in a carrier network are briefly described below.

[0102] RAN (Access Network Component) is a subnetwork of the operator's network, serving as the implementation system between service nodes (or network functions) and the UE (User Equipment) within the operator's network. For a UE to access the operator's network, it first passes through the RAN, and then connects to service nodes within the operator's network via the RAN. In other words, the RAN exists between the UE and the core network, providing communication connectivity between the two. In this application's embodiments, RAN can refer to the access network itself or an access network element; no distinction is made here. An access network element is a device that provides wireless communication functions for the UE; it can also be called an access network device or AN device, etc. This access network element includes, but is not limited to: next-generation base stations or next-generation node Bs (gNBs) in 5G systems, evolved node Bs (eNBs) in LTE systems, radio network controllers (RNCs), node Bs (NBs), base station controllers (BSCs), base transceiver stations (BTSs), home node Bs (HNBs), building base band units (BBUs), transmit-receive points (TRPs), transmission points (TPs), small cell equipment (pico), mobile switching centers, or network equipment in future networks. It is understood that this application does not limit the specific type of access network equipment. In systems employing different wireless access technologies, the names of devices with access network equipment functions may differ.

[0103] Optionally, in some deployments of access devices, the access devices may include centralized units (CU) and distributed units (DU), etc.

[0104] The Network Element (NEF) is a control plane function provided by the operator, offering a framework, authentication, and interfaces related to network capability openness, facilitating information exchange between network functions and other network functions in a 5G system. The NEF provides a secure, bidirectional interface to third parties, opening up network capabilities. When other network functions (such as Active Element) need to communicate with third-party networks, the NEF can act as a relay for communication with third-party network entities. The NEF can also translate the identification information of subscribed users and the identification information of third-party network functions. For example, when the NEF sends a subscribed user's subscriber permanent identifier (SUPI) from the PLMN to a third party, it can translate the SUPI into its corresponding externally publicly used subscription identifier (GPSI). Conversely, the NEF forwards external information to the PLMN network, preventing other network functions within the PLMN from directly contacting the outside world.

[0105] NRF is a control plane function provided by the operator, which can be used to maintain real-time information on all network function services in the network.

[0106] PCF is a control plane function provided by operators for generating and managing user, session, and QoS flow processing policies. It supports a unified policy framework to govern network behavior and provides policy rules and subscription information related to policy decisions to other control functions.

[0107] UDM is a control plane function provided by the operator, responsible for storing information such as the security context and subscription data of subscribed users in the PLMN. Specifically, subscribed users of the aforementioned operator network can be users who utilize services provided by the operator network, such as users of China Telecom's terminal equipment SIM cards or China Mobile's terminal equipment SIM cards. For example, the aforementioned security context can be data (cookies) or tokens stored on the local terminal device (e.g., a mobile phone). The subscription data of the aforementioned subscribed users can be the associated services of the terminal equipment SIM card, such as the data plan of the mobile phone SIM card.

[0108] AUSF is a control plane function provided by the operator, typically used for Level 1 authentication, i.e., network authentication between the UE (subscribed user) and the operator's network.

[0109] AMF is a control plane network function provided by the operator's network. It is responsible for access control and mobility management of UE access to the operator's network, including functions such as registration management, connection management, reachability management, mobility management, allocation of temporary user identities, authentication and authorization of users, etc.

[0110] The SMF (Service Control Function) is a control plane network function provided by the operator's network, responsible for managing the UE's Protocol Data Unit (PDU) sessions. A PDU session is a channel used to transmit PDUs; terminal devices need to exchange data with the DN (Network Controller) through PDU sessions. The SMF can be responsible for establishing, maintaining, and deleting PDU sessions. The SMF includes session management (such as session establishment, modification, and release, including tunnel maintenance between the UPF and AN), UPF selection and control, service and session continuity (SSC) mode selection, roaming, and other session-related functions.

[0111] UPF is a gateway provided by the operator, serving as the gateway for communication between the operator's network and the DN. UPF includes user plane-related functions such as packet routing and transmission, packet inspection, service usage reporting, QoS processing, lawful interception, uplink packet inspection, and downlink packet storage.

[0112] NSSF is a control plane network function provided by the operator's network, which is responsible for determining network slice instances, selecting AMFs, etc.

[0113] In some scenarios, the core network may also include a location management function (LMF) to obtain the UE's location information using specific positioning technologies. These positioning technologies include, but are not limited to, observed time difference of arrival (OTDOA), uplink time difference of arrival (UTDOA), timing advance (TA), or angle of arrival (AoA).

[0114] In some scenarios, the core network may also include a gateway mobilelocation center (GMLC), which is mainly responsible for providing location services to external location service (LCS) clients or AFs.

[0115] Figure 1ANnef, Nausf, Nnrf, Npcf, Nudm, Naf, Namf, Nsmf, Nnssf, N1, N2, N3, N4, and N6 are interface sequence numbers. For example, the meaning of the above interface sequence numbers can be found in the definitions in the 3GPP standard protocols; this application does not limit the meaning of the above interface sequence numbers. It should be noted that... Figure 1A The names of the various network functions and the interface names between them are merely examples. In actual implementation, the interface names of this system architecture may be other names, and this application does not limit them.

[0116] The embodiments of this application can be applied to IAB scenarios and Layer-2 (L2) relay scenarios.

[0117] Scenario 1: IAB scenario.

[0118] The 5G NR research proposed the IAB base station, also known as an IAB node (IAB-node). An IAB-node integrates a radio access link and a radio backhaul link. The radio access link is the communication link between the UE and the IAB-node, while the radio backhaul link is the communication link between IAB-nodes, primarily for data backhaul. Since the IAB-node does not require a wired transmission network for data backhaul, it reduces the deployment requirements for wired transmission networks and can be deployed in outdoor and indoor scenarios where wired transmission networks are difficult to deploy. The IAB-node includes MT (Mobile Transmission) and gNB-DU (Ground-Based Node) functions. After the IAB-node is activated, its MT function will select the access network through cell selection; therefore, it is necessary to ensure that the IAB-node can access the IAB network to realize its functions. Figure 1BThis diagram illustrates an IAB architecture where the next-generation (NG) RAN communicates with the 5G core network (5G core, 5GC) via the NG interface. The NR RAN includes gNBs, IAB-nodes, and IAB-donor gNBs. The IAB-donor gNB (abbreviated as IAB-donor) includes gNB-CU and gNB-DU functions. The gNB-CU primarily handles non-real-time higher-layer radio protocol stack functions, such as radio resource control (RRC) or packet data convergence protocol (PDCP). The gNB-DU primarily handles physical layer functions and layer 2 functions with high real-time requirements, such as physical layer (PHY), media access control (MAC), and radio link control (RLC) functions. The gNB-DU in the IAB-node can be used as the Uu interface termination point for backhaul links between the IAB-node and the IAB-donor, or between the IAB-node and other IAB-nodes.

[0119] Figure 2 This is a schematic diagram of a mobile IAB architecture. The relay installed on the vehicle (which moves with the vehicle) supports wireless relay functions as either a vehicle-mounted relay (VMR) or a mobile base station relay. It supports access and backhaul via NR, meaning it supports service access and provides wireless access to the UE via wireless backhaul. (This is consistent with the above...) Figure 1B Compared to the IAB mechanism shown, VMR has mobility, while Figure 1B In this context, the IAB-node is a fixed relay station on the ground; therefore, VMR can also be understood as a mobile IAB-node. The ground-based donor RAN is responsible for providing the core network interface to the UE and the radio backhaul function to the VMR. Generally, the donor RAN is installed on the ground and has no mobility.

[0120] See the diagram for the network access of IAB-node MT (abbreviated as IAB-MT). Figure 3 As shown, it includes the following steps:

[0121] S301: IAB-MT sends an RRC connection establishment message to IAB-donor.

[0122] The RRC connection establishment message includes an IAB indication.

[0123] In this S301, the IAB-node initiates the RRC connection establishment process to access the 5G system.

[0124] Specifically, the IAB-MT sends an RRC connection establishment message to the Donor-CU of the IAB-donor.

[0125] S302: The IAB-donor sends an N2 message to the AMF.

[0126] The N2 message includes IAB-indication.

[0127] S303: IAB-MT completes the registration process.

[0128] Specifically, the UDM provides the AMF with an IAB operation allowed indication, which is part of the access and mobility subscription data. The AMF sends an IAB node authorized indication to the RAN, which can indicate authorized or unauthorized status. The RAN stores this IAB node authorized indication. After the registration process is completed, the IAB node remains connected.

[0129] S304: IAB-MT establishes a protocol data unit (PDU) session, obtains an Internet Protocol (IP) address, and interacts with Operation Administration and Maintenance (OAM).

[0130] In this S304, the IAB-MT PDU session provides an IP-based transport connection between the IAB-node and OAM via the 5G network.

[0131] S305: IAB-MT obtains configuration information from OAM.

[0132] This configuration information includes the cell global identifier (CGI), physical cell identifier (PCI), and tracking area code (TAC).

[0133] S306: The IAB-DU (i.e., the DU of the IAB-node) sends an F1 Setup Request message to the RAN.

[0134] The F1 setup request message is used to request the establishment of an F1 interface, including CGI, PCI, and TAC.

[0135] S307: The Donor-CU of IAB-donor completes the parameter configuration update process with AMF.

[0136] For example, Donor-CU and AMF complete the tracking area (TA) list update.

[0137] S308: The Donor-CU of the IAB-donor sends an F1 establishment response message to the IAB-DU to complete the establishment of the F1 interface.

[0138] Donor-CU determines whether to accept F1 interface establishment based on the IAB-node authorized indication received from AMF. If the IAB-node authorized indication indicates authorization, Donor-CU accepts F1 interface establishment; if the IAB-node authorized indication indicates non-authorization, Donor-CU does not accept F1 interface establishment.

[0139] Scenario 2: L2 relay scenario.

[0140] When the UE is outside the network coverage or the communication signal between the UE and the RAN is poor, the UE, as a remote UE, can be assisted by a relay UE to access the network and enable communication between the remote UE and the network. Figure 4This is a schematic diagram of an L2 Relay architecture. In 5G systems, indirect communication supports L2 Relay communication, which refers to a communication mode where the Remote UE accesses the network through a Relay UE. The Relay UE forwards uplink and downlink data from the Remote UE according to the access stratum layer (ASlayer) configuration, enabling the Remote UE to access the RAN and communicate with the 5GC. L2 Relay can also be called a Layer 2 UE-to-Network Relay or L2 U2N Relay.

[0141] For the connection establishment process of Remote UE in L2 Relay scenario, please refer to [link / reference]. Figure 5 As shown, it includes the following steps:

[0142] S501: Remote UE and Relay UE initially register with the network.

[0143] Remote UEs may not be registered if they are not directly connected to the network, and they need to be registered in subsequent S509 processes.

[0144] During the initial registration process of the Relay UE, the AMF obtains 5G ProSe subscription data from the UDM. The 5G ProSe subscription data includes the UE being authorized as an L2 Relay. The AMF sends the indication information that the UE is authorized as an L2 Relay to the RAN.

[0145] S502: The Remote UE obtains authorization information from the PCF corresponding to the Remote UE, and the Relay UE obtains authorization information from the PCF corresponding to the Relay UE.

[0146] The PCF corresponding to the UE can be understood as the PCF responsible for providing the UE policy during UE registration.

[0147] The authorization information obtained by the Remote UE includes that the UE is authorized to communicate indirectly, i.e., as a Remote UE.

[0148] The authorization information obtained by the Relay UE includes that the UE is authorized to communicate indirectly, i.e., as a Relay UE.

[0149] If the remote UE is not registered with the network, pre-configured authorization information can be used.

[0150] S503: Relay UE completes the discovery and selection process.

[0151] S504: The Remote UE sends an indirect communication request message to the Relay UE to instruct the Relay UE to establish indirect communication.

[0152] S505: Relay UE initiates a Service Request message.

[0153] S505 is an optional step. If the Relay UE is not in connected state (RRC connected), the Relay UE can initiate a Service Request message to put the Relay UE into connected state.

[0154] S506: The Relay UE returns an indirect communication response message to the Remote UE.

[0155] After S504 to S506, the Remote UE establishes a PC5 connection with the Relay UE, and the Relay UE is in the connected state.

[0156] S507: The Remote UE sends an RRC Setup Request message to the RAN through the Relay UE.

[0157] S508: The RAN sends an RRC Setup message to the Remote UE via the Relay UE.

[0158] According to the AS layer configuration, the Relay UE can forward the uplink and downlink signaling of the Remote UE, enabling the Remote UE to access the RAN and establish an RRC connection between the Remote UE and the RAN. If the Relay UE is not authorized as an L2 Relay UE, the RAN can refuse access by the Remote UE through the Relay UE.

[0159] S509: The Remote UE sends a non-access stratum (NAS) request message to the AMF via the RAN.

[0160] If the remote UE is not registered in S501, this NAS message is an initial registration message. If the remote UE is already registered in S501, this NAS message is a service request message. In the service request message, the remote UE can choose to activate a PDU session.

[0161] The AMF corresponding to a UE can be understood as the AMF responsible for UE mobility management when the UE is registered. That is, the AMF corresponding to a Remote UE is the AMF responsible for Remote UE mobility management when the Remote UE is registered, and the AMF corresponding to a Relay UE is the AMF responsible for Relay UE mobility management when the Relay UE is registered.

[0162] S510: Remote UE initiates PDU session establishment process.

[0163] S511: The Remote UE transmits uplink and downlink data with the corresponding UPF of the Remote UE through the Relay UE and RAN.

[0164] The Relay UE forwards uplink and downlink data from the Remote UE according to the AS layer configuration. The protocol stack between the Relay UE and the RAN supports an adaptation layer, which is used to distinguish the Remote UE's data between the Relay UE and the RAN.

[0165] During the relay UE registration process, the AMF obtains 5G ProSe subscription data from the UDM. This data includes information indicating that the UE is authorized to act as an L2 relay. The AMF then sends an indication to the RAN that the UE is authorized to act as an L2 relay. Once the AMF learns that the UE is authorized to act as an L2 relay, it will not actively trigger the connection release procedure; the connection release is controlled by the RAN. This is because only the RAN knows whether the UE is currently providing L2 relay service, and the relay UE's connection should not be released while providing L2 relay service.

[0166] In this scenario, the L2 Relay UE has two functional roles: one is to transmit the Relay UE's own service data, and the other is to provide relay services for the Remote UE to transmit the Remote UE's service data.

[0167] Based on subscription data, such as access and mobility subscription data or 5G ProSesubscription data, service area restrictions are defined, which define the areas where the UE is allowed or not allowed to initiate communication with the network. In the allowed area, the UE can communicate normally with the network. In the non-allowed area, the UE cannot initiate Service Request procedures or general session management-related signaling interactions with the network. When the UE is in the non-allowed area, the UE needs to respond to paging initiated by the core network, NAS notification procedures, and paging initiated by the RAN node.

[0168] Service area restrictions can include one or more complete TAs, or all TAs of a public land mobile network (PLMN). Service area restrictions are contained in the UE's subscription data stored in the UDM and can be represented by TA identifiers and / or other geographic information (such as latitude and longitude, postal codes, etc.). If geographic location information is used, the AMF will first map the geographic location information to TAs before sending service area restriction information to the PCF, RAN, and UE. During registration, if the AMF does not have the context of the UE's service area restrictions in its database, the AMF can obtain this information from the UDM and may further adjust it through the PCF. The network can update service area restrictions through the general UE configuration update procedure.

[0169] When the service area restriction allocated by the AMF to the UE is of limited size (e.g., containing only one or more complete TAs), the Allowed Area included in the service area restriction provided by the AMF to the UE can be pre-configured or dynamically allocated by the AMF (e.g., dynamic TA control as the UE's location changes). The AMF provides service area restrictions in the form of TAs, which can be part of a complete list stored in the UE's subscription data or provided to the UE by the PCF during the registration process. When the UE is in a Non-Allowed Area, the AMF does not allow the UE to interact with the network through Service Request procedures or general session management-related signaling; that is, the UE cannot perform service-related procedures, but other mobility-related signaling procedures are permitted.

[0170] When providing service area restrictions, the network will not provide both Allowed Area and Non-Allowed Area to the UE simultaneously. If the network provides a Non-Allowed Area to the UE, a TA in a PLMN that is not listed will be considered as belonging to the Allowed Area.

[0171] By initiating and terminating the location process, the location estimation result of the UE can be determined, thereby determining whether the UE is within the Allowed Area or the Non-Allowed Area.

[0172] For the UE location initiation process, please refer to Figure 6 As shown, it includes the following steps:

[0173] S601: The idle UE initiates a service request process to complete the signaling connection with the AMF.

[0174] S602: The UE sends a mobile-originated location request (MO-LR) message.

[0175] The MO-LR message can be carried in the uplink NAS transport (UL NAS TRANSPORT) message.

[0176] The UE can request different types of location services: A) location estimation for the UE, B) location estimation sent to the LCS client or AF, and C) location assistance information. For types A) and B), the UL NAS TRANSPORT message can also include LCS quality of service (QoS) information, such as location accuracy, response time, and LCS QoS class. The LCS QoS class can include Best Effort Class and Assured Class. For type B), the UL NAS TRANSPORT message can also include the LCS client or AF identifier and the GMLC address assigned by the AMF.

[0177] S603: AMF selects a suitable LMF.

[0178] S604: The AMF sends a Location Determine Request (Nlmf_Location_DetermineLocationRequest) message to the LMF.

[0179] The message includes the serving cell identity of the UE, and indications or location assistance data requesting the UE's location information.

[0180] S605: LMF initiates the UE location process.

[0181] Specifically, the LMF obtains positioning data by interacting with the RAN and UE, and calculates the UE's position estimation results.

[0182] In this S605, the positioning technologies used by LMF include, but are not limited to: OTDOA, UTDOA, TA, or AoA technologies.

[0183] S606: When the location estimation result satisfies the requested LCS QoS information, the LMF returns the UE's location estimation result to the AMF.

[0184] S607: AMF sends a location update request (Ngmlc_Location_LocationUpdate Request) message to GMLC.

[0185] The message includes the location estimation results, the UE identifier, and the LCS QoS information requested by the UE.

[0186] S608: GMLC sends a location update request message to the LCS client or AF.

[0187] The location update request message includes the UE's location estimation results.

[0188] S609: The LCS client or AF returns a location update response (Ngmlc_Location_LocationUpdateResponse) message.

[0189] If the UE is roaming, the GMLC includes two entities: the visited GMLC (VGMLC) and the home GMLC (HGMLC). If the UE is not roaming, the VGMLC and HGMLC are the same entity.

[0190] S608 and S609 are optional steps. For example, if the UE does not request location service type B, S608 and S609 can be skipped.

[0191] S610: GMLC sends a location update response message to AMF.

[0192] S611: The AMF sends an MO-LR response message to the UE.

[0193] MO-LR response messages can be carried within downlink NAS transfer (DL NAS TRANSPORT) messages. DL NASTRANSPORT messages may also include the position estimation results and whether the position estimation results meet the requested positioning accuracy.

[0194] For the UE location termination process, please refer to Figure 7 As shown, it includes the following steps:

[0195] S701: The LCS client sends an LCS Service Request message to the GMLC to request the location of the UE.

[0196] The LCS Service Request message includes the UE's identifier and the required QoS. The UE's identifier can be a generic public subscription identifier (GPSI) or a subscription permanent identifier (SUPI).

[0197] S702: GLMC obtains the AMF address of the currently serving UE from UDM.

[0198] S703: The GLMC sends a Location Information Request (Namf_Location_ProvidePositioningInfo Request) message to the AMF to request the location of the UE.

[0199] GLMC obtains the LCS privacy profile from UDM, determines the location of the UE authorized by the LCS client based on the LCS privacy profile, and then requests the UE's location from AMF.

[0200] S704: If the UE is in an idle state, the AMF initiates a service request process to complete the signaling connection between the UE and the AMF.

[0201] S704 is an optional step.

[0202] S705: AMF should be selected as LMF.

[0203] S706: The AMF sends an Nlmf_Location_DetermineLocation Request message to the LMF to request the UE's current location.

[0204] The Nlmf_Location_DetermineLocation Request message can also include the UE's cell identifier.

[0205] S707: LMF initiates the UE's location process.

[0206] LMF obtains positioning data by interacting with UE through RAN and calculates the UE's position estimation result.

[0207] In this S707, the positioning technologies used by LMF include, but are not limited to: OTDOA, UTDOA, TA, or AoA technologies.

[0208] S708: The LMF sends an Nlmf_Location_DetermineLocation Response message to the AMF, which includes the UE's current location and the achieved accuracy.

[0209] S709: The AMF sends a Namf_Location_ProvidePositioningInfo Response message to the GMLC, which includes the UE's current location and the achieved accuracy.

[0210] S710: The GMLC sends an LCS Service Response message to the LCS client, including the UE's current location and the achieved accuracy.

[0211] In summary, in both Scenario 1 and Scenario 2, the network controls and manages the UE's connection service solely based on operation permission indication information (such as the IAB-node authorized indication in Scenario 1 or the 5G ProSe subscription data in Scenario 2). For example, when the operation permission indication information is used to authorize the UE to provide service, the UE may provide connection service at any location and at any time, resulting in poor flexibility for the network to control and manage the UE's provision of connection service.

[0212] Based on this, this application provides an authorization method applicable to the above-described scenarios one and two. Figure 8A This application provides a schematic diagram of an authorization method, which includes the following steps:

[0213] S801: Access management network element obtains operation permission instruction information and authorization conditions.

[0214] Operation permission indication information is used to indicate whether terminal devices are allowed to provide connection services.

[0215] Authorization conditions are used to determine whether a terminal device is allowed to provide connectivity services. For example, authorization conditions may include the authorized location range and / or the authorized time range for connectivity services.

[0216] S802: The access management network element sends the authorization result to the access network element to which the terminal device is connected, based on the authorization conditions. The access network element then receives the authorization result.

[0217] The authorization result is used to indicate whether the terminal device is not allowed to provide connection services or is allowed to provide connection services.

[0218] Based on the above scheme, the access management network element can determine whether the location and / or current time of the terminal device meet the authorization conditions based on the obtained authorization conditions, and send the corresponding authorization result to the access network element to which the terminal device is connected. Even if the operation permission indication information allows the terminal device to provide connection services, the access management network element will not allow the terminal device to provide connection services if the authorization conditions are not met. This allows for flexible and dynamic control and management of the terminal device's provision of connection services. The above scheme can also avoid providing services outside the authorized location range and / or authorized time range, thus avoiding interference with existing communications to a certain extent.

[0219] As one implementation, the access management network element can obtain operation permission indication information and authorization conditions from the data management network element (such as UDM) or the policy control network element (such as PCF). For example, when a terminal device initiates a registration process and accesses the network through the access management network element, the access management network element can obtain subscription data from the data management network element. This subscription data includes operation permission indication information and authorization conditions. The terminal device's registration process can be found above. Figure 3 S301 to S303. Subscription data can be Access and Mobility Subscription data (as in the IAB scenario), or 5G ProSe subscription data (as in the L2 Relay scenario). For example, when the PCF network element sends an access management policy to the access management network element, the access management policy includes operation permission indication information and authorization conditions.

[0220] In some cases, the operation permission instruction is used to indicate that the terminal device is not allowed to provide connection services. Subscription data may not include authorization conditions. Based on this operation permission instruction, the access management network element determines that the terminal device is not allowed to provide services.

[0221] In some cases, the access management network element may not receive operation permission instructions and will not allow the terminal device to provide services by default.

[0222] Connectivity services include, but are not limited to, IAB services, VMR, or relay services. IAB terminal devices can provide IAB services; that is, the terminal device can be an IAB-UE / IAB-MT, specifically, an IAB-MT. VMR devices or mobile base station relay devices can provide VMR services; that is, the terminal device can be a VMR device or a mobile base station relay. The VMR device acts as a relay between the terminal device and the network (such as a 5G network), for example, providing an access link to the UE and wirelessly connecting to the network via an IAB-donor. When a mobile base station relay is installed on a moving vehicle, it can serve UEs located inside (or entering) or outside (or leaving) the vehicle. Relay terminal devices can provide relay services; that is, the terminal device can be a relay terminal device.

[0223] In S802, the access management network element can determine the authorization result based on the authorization conditions, and then send the authorization conditions to the access network element.

[0224] In one possible scenario (hereinafter referred to as Scenario 1), the authorization conditions include the authorized time range for the connection service. The access management network element can determine whether the current time is outside or within the authorized time range to determine the authorization result.

[0225] When the current time is outside the authorized time range, the access management network element determines the authorization result to indicate that the terminal device is not allowed to provide services. When the current time is within the authorized time range, the access management network element determines the authorization result to indicate that the terminal device is allowed to provide services.

[0226] In another possible scenario (hereinafter referred to as Scenario 2), the authorization conditions include the authorized location range for the connection service. The access management network element can determine whether the terminal device is outside or within the authorized location range, thereby determining the authorization result.

[0227] When the terminal device is outside the authorized location range, the access management network element determines the authorization result to indicate that the terminal device is not allowed to provide connection services. When the terminal device is within the authorized location range, the access management network element determines the authorization result to indicate that the terminal device is allowed to provide connection services.

[0228] If the terminal device is mobile, such as a VMR terminal device, moving the terminal device out of the authorized location range will result in the terminal device being outside the authorized location range, and moving the terminal device into the authorized location range will result in the terminal device being within the authorized location range.

[0229] The authorized location range includes one or more of the following: authorized routes for the connectivity service, authorized areas for the connectivity service, areas where connectivity services are permitted, or areas where connectivity services are prohibited. The authorized area for the connectivity service can contain one or more complete TAs. If the authorized area for the connectivity service is geographic location information, the AMF maps the geographic location information to TAs. The authorized area for the connectivity service can also include one or more cells, such as each cell's identifier, which can be a cell global identifier (CGI).

[0230] In another possible scenario (hereinafter referred to as scenario 3), the authorization conditions include the authorized location range and the authorized time range of the connection service. The access management network element can determine whether the current time is outside (or within) the authorized time range, and whether the terminal device is outside (or within) the authorized location range, thereby determining the authorization result.

[0231] When the current time is outside the authorized time range and / or the terminal device is outside the authorized location range, the access management network element determines the authorization result to indicate that the terminal device is not allowed to provide connection services. When the current time is within the authorized time range and the terminal device is within the authorized location range, the access management network element determines the authorization result to indicate that the terminal device is allowed to provide connection services.

[0232] The following mainly explains some implementation methods for case 2.

[0233] As one implementation method, the access management network element can determine whether the terminal device is outside or inside the authorized location range based on the location of the terminal device and the authorized location range.

[0234] In this implementation, the location of the terminal device can be the real-time location estimated by the location management network element (such as LMF), and the access management network element can obtain the location of the terminal device from the location management network element, for example, see the above. Figure 6 S604 to S606, or see above. Figure 7 S706 to S708. Optionally, the location of the terminal device can be a location within an authorized time range. For example, the access management network element sends a location determination request message to the location management network element to request the location of the terminal device. The location determination request message can carry an authorized time range, and the location management network element can obtain the location of the terminal device within the authorized time range.

[0235] For example, in the IAB scenario, the authorized location range includes the authorized path and the authorized area for the connection service. In the L2 Relay scenario, the authorized location range includes the allowed area and the non-Allowed area.

[0236] As another implementation method, the location management network element determines whether the terminal device is outside or inside the authorized location range, and then notifies the access management network element of the determination result.

[0237] Specifically, the access management network element can send a request message to the location management network element (see above for example). Figure 6 S604 in or see above Figure 7 (S706 in the original text) The request message includes information about the authorized location range. This request message is used to request whether the terminal device is outside or within the authorized location range. The location management network element sends notification information to the access management network element (see, for example, the above). Figure 6 S606 in or see above Figure 7 (S708 in the text) This notification information is used to notify the terminal device that it is outside the authorized location range or that the terminal device is within the authorized location range.

[0238] Optionally, the request message may include an authorization time range.

[0239] In another implementation, the access management network element uses the tracking area where the terminal device is located to determine whether the terminal device is outside or within the authorized location range.

[0240] Specifically, the access management network element can receive the tracking area range corresponding to the authorized location range (e.g., the authorized location range is a tracking area range, or the network open network element converts the authorized location range into a tracking area range), and the access management network element knows the tracking area where the terminal device is located. If the tracking area where the terminal device is located is outside the tracking area range corresponding to the authorized location range (i.e., the tracking area range corresponding to the authorized location range does not include the tracking area where the terminal device is located), it means that the terminal device is outside the authorized location range. If the tracking area where the terminal device is located is within the tracking area range corresponding to the authorized location range (i.e., the tracking area range corresponding to the authorized location range includes the tracking area where the terminal device is located), it means that the terminal device is within the authorized location range. In this implementation, the access management network element can request the network open network element to map the authorized location range to a tracking area range.

[0241] For example, when allocating a registration area to a terminal device, the access management network element can consider the tracking area range corresponding to the authorized location range. If the terminal device is within the authorized location range, the registration area should consist of a set of TAs belonging to the tracking area range corresponding to the authorized location range. Otherwise, the registration area should consist of a set of TAs not belonging to the tracking area range corresponding to the authorized location range. Furthermore, the access management network element can determine whether the terminal device is within or outside the authorized location range through the mobility registration update mechanism.

[0242] In another implementation, the access management network element determines whether the terminal device is outside or within the authorized location range based on the cell where the terminal device is located.

[0243] Specifically, the access management network element can receive a list of cells corresponding to the authorized location range (e.g., the authorized location range is a list of cells, or the network open network element converts the authorized location range into a list of cells), and the access management network element knows the cell where the terminal device is located. If the cell where the terminal device is located is outside the list of cells corresponding to the authorized location range (i.e., the list of cells corresponding to the authorized location range does not include the cell where the terminal device is located), it means that the terminal device is outside the authorized location range. If the cell where the terminal device is located is within the list of cells corresponding to the authorized location range (i.e., the list of cells corresponding to the authorized location range includes the cell where the terminal device is located), it means that the terminal device is within the authorized location range.

[0244] In the above S802, the access network element can control the connection service of the terminal device based on the received authorization result.

[0245] Optionally, the access management network element can also send authorization results to the terminal device.

[0246] For terminal devices:

[0247] The terminal device can perform corresponding operations solely based on the authorization result sent by the access management network element. For example, the terminal device receives a first authorization result from the access management network element, which indicates that the terminal device is not allowed to provide connection services. Based on the first authorization result, the terminal device releases the resources used to provide connection services. Alternatively, the terminal device receives a second authorization result from the access management network element, which indicates that the terminal device is allowed to provide connection services. Based on the second authorization result, the terminal device provides connection services.

[0248] Alternatively, the terminal device may perform corresponding operations solely based on the control of the access network element. For example, the terminal device receives a connection control message sent by the access network element. This connection control message controls the terminal device to not provide connection services, and the terminal device releases resources used to provide connection services based on the connection control message. Alternatively, the connection control message may also be used to provide connection services, and the terminal device provides connection services based on the connection control message.

[0249] Alternatively, the terminal device can perform corresponding operations based on the control results from the access network element and the authorization results from the access management network element. Generally, the control results from the access network element and the authorization results from the access management network element are consistent, meaning that the terminal device will perform the same operation. Of course, to avoid inconsistencies between the control results from the access network element and the authorization results from the access management network element, the priority of their control results can be set, for example, the control results from the access network element have a higher priority than the authorization results from the access management network element.

[0250] For example, when a terminal device releases resources used to provide connectivity services, it may release the F1 interface, which is used for information transmission between the terminal device and the access network element. Here, "information" includes data and / or signaling.

[0251] Optionally, when the authorization result indicates that the terminal device is not allowed to provide connection services, the access management network element sends a deregistration request message to the terminal device. For example, the deregistration request message may include indication information that the terminal device is not allowed to provide connection services. After receiving the deregistration request message, the terminal device releases the resources used to provide connection services.

[0252] As another implementation, the access management network element can obtain the unauthorized location range (or prohibited area) for connection services. When a terminal is within the unauthorized location range (or prohibited area), the terminal device is not allowed to provide connection services, thus flexibly and dynamically controlling and managing the connection services provided by the terminal device. See also Figure 8B This is a schematic diagram of another licensing method provided in an embodiment of this application, including the following steps:

[0253] S811: Access management network elements obtain operation permission indication information and unauthorized location range for connection services.

[0254] Operation permission indication information is used to indicate whether terminal devices are allowed to provide connection services.

[0255] The unauthorized location range for connecting to the service is the Forbidden Area. For example, the Forbidden Area is included in the Access and Mobility Subscription data.

[0256] Access management network elements can obtain operation permission instructions and unauthorized location ranges for connection services from data management network elements or policy control network elements.

[0257] S812: The access management network element determines that the terminal device is in an unauthorized location range (or prohibited area) and sends an authorization result to the access network element to which the terminal device is connected, indicating that the terminal device is not allowed to provide connection services; or it sends an N2 UE Context Release Request message to the access network element to which the terminal device is connected, for example, the N2 UE Context Release Request message may include indication information that the terminal device is not allowed to provide connection services. Accordingly, the access network element receives the authorization result or the N2 UE Context Release Request message.

[0258] In this example, the access management network element can also send an authorization result to the terminal device. Alternatively, if the authorization result indicates that the terminal device is not allowed to provide connection services, the access management network element sends a deregistration request message to the terminal device. For example, the deregistration request message may include indication information that the terminal device is not allowed to provide connection services. After receiving the deregistration request message, the terminal device releases the resources used to provide connection services.

[0259] In S812, the access management network element determines that the terminal device is in a prohibited area. This process is similar to that in S802, where the access management network element determines that the terminal device is outside or within the authorized location range. The repetitions will not be repeated here. The difference lies in the fact that when the terminal device is within the prohibited area, the access management network element determines that the terminal device is not allowed to provide connection services; when the terminal device is outside the prohibited area, the access management network element determines that the terminal device is allowed to provide connection services.

[0260] The following examples illustrate this. Figure 8A The authorization process shown is explained below.

[0261] refer to Figure 9 This is a schematic diagram of the authorization process in an IAB scenario, including the following steps:

[0262] S901: IAB-UE initiates the registration process.

[0263] S902: UDM sends Access and Mobility Subscription data to AMF, which includes IAB-operation allowed indication and authorized path / area.

[0264] IAB-operation allowed indication is an example of the above operation permission indication information, and authorized path / area is an example of the above authorized location range.

[0265] Optionally, Access and Mobility Subscription data also includes a validity period, which is an example of the authorization time range mentioned above.

[0266] S903: AMF obtains the location of IAB-UE from LMF.

[0267] For example, see the above. Figure 6 S604 to S606, or see above. Figure 7 S706 to S708 in the series.

[0268] S904: AMF determines whether IAB-UE is within the authorized path / area to determine the authorization result.

[0269] When the IAB-UE is outside the authorized path / area, the authorization result is determined to be an unauthorized indication. This unauthorized indication indicates that the IAB-UE is not authorized, meaning it is not allowed to provide connection services. This example primarily illustrates the situation where the IAB-UE is outside the authorized path / area.

[0270] When the IAB-UE is within the authorized path / area, the authorization result is determined as authorization indication information. This authorization indication information is used to instruct the IAB-UE to provide connection services, that is, to allow the IAB-UE to provide connection services.

[0271] S903 and S904 represent possible implementation method 1.

[0272] S905: Whether the AMF subscribes to the IAB-UE from the LMF within the authorized path / area.

[0273] LMF determines that the IAB-UE is outside the authorized path / area. Alternatively, LMF determines that the IAB-UE is inside the authorized path / area.

[0274] S906: The LMF sends an event notify message to the AMF, which includes indication information to notify the IAB-UE that it is outside the authorized path / area.

[0275] If the LMF determines that the IAB-UE is within the authorized path / area, the event notify message includes indication information to notify the IAB-UE that it is within the authorized path / area.

[0276] S905 and S906 represent a possible implementation method 2.

[0277] S907: AMF determines whether the TA / cell where the IAB-UE is located is within the TA / cell set corresponding to the authorized area.

[0278] When the TA where the IAB-UE is located is outside the TA range corresponding to the authorized area, the AMF determines that the IAB-UE is outside the authorized area.

[0279] When the cell containing IAB-UE is outside the cell list corresponding to the authorized area, AMF determines that IAB-UE is outside the authorized area.

[0280] When the TA where the IAB-UE is located is within the TA range corresponding to the authorized area, the AMF determines that the IAB-UE is within the authorized area.

[0281] When the cell containing IAB-UE is within the cell list corresponding to the authorized area, AMF determines that IAB-UE is within the authorized area.

[0282] S908: When the IAB-UE is outside the authorized area, the AMF determines the authorization result as a non-authorization indication message.

[0283] S907 and S908 represent possible implementation 3. The authorization granularity of S907 and S908 is the authorized area.

[0284] S909: The AMF sends an N2 message to the RAN. When the IAB-UE is outside the authorized path / area, the N2 message includes unauthorized indication information.

[0285] When the IAB-UE is within the authorized path / area, the N2 message includes authorization indication information.

[0286] Optionally, when the IAB-UE is outside the authorized path / area, the AMF can initiate the IAB-UE registration process or release the NAS connection.

[0287] Understandably, when an IAB-operation allowed indication authorizes an IAB-UE, the AMF determines that if the IAB-UE is outside the authorized path / area, it will send an unauthorized indication message to the RAN. If the RAN does not receive authorization or unauthorization information from the IAB-UE, it assumes that the IAB-UE is not authorized.

[0288] S910: The RAN controls the services of the IAB-UE based on the N2 message.

[0289] When the N2 message includes unauthorized indication information, the RAN may disallow the IAB-UE from providing IAB services as an IAB-node, release the resources used by the IAB-UE to provide IAB services, release the IAB-UE as the F1 interface of the DU, or disallow the IAB-UE from requesting to establish an F1 interface as a DU.

[0290] In this example, the AMF does not authorize the IAB-UE to provide IAB services outside a specific route / area. It can dynamically update the authorization indication of the IAB-UE. The RAN controls the IAB-UE's IAB service according to the updated unauthorized indication, which can prevent the IAB-UE from interfering with existing communications by providing IAB services in unauthorized areas (or unauthorized times).

[0291] refer to Figure 10 This is a schematic diagram of the authorization process in an L2 Relay scenario, including the following steps:

[0292] S1001: UE initiates registration process.

[0293] S1002: UDM sends 5G ProSe subscription data to AMF. The 5G ProSe subscription data includes L2 UE to network (UEto network, U2N) relay authorized and Allowed area (or Non-Allowed area).

[0294] The L2 U2N Relay authorized instruction indicates that the UE is permitted to provide L2 U2N Relay services.

[0295] S1003: The AMF determines whether to authorize the UE as an L2 U2N Relay based on whether the UE is in the Allowed area. The AMF determines whether to not authorize the UE as an L2 U2N Relay based on whether the UE is in the Non-Allowed area.

[0296] The implementation of S1003 can be found in the implementation of case 2 above, and the repetitive parts will not be repeated.

[0297] S1004: The AMF sends an N2 message to the RAN. When it is determined that the UE is not authorized to act as an L2 U2N Relay, the N2 message includes unauthorized indication information.

[0298] When determining that an authorized UE is to act as an L2 U2N Relay, the N2 message includes authorization indication information.

[0299] When it is determined that the UE is not authorized to act as an L2 U2N Relay, the AMF can also initiate a NAS connection release procedure or actively initiate an N2 connection release procedure to trigger the UE to enter an idle state.

[0300] S1005: The RAN controls the L2 U2N Relay service of the UE based on the N2 message.

[0301] When the N2 message includes unauthorized indication information, the RAN can disable the UE's L2 U2N Relay service. The RAN can also release the RRC connection between the RAN and the UE.

[0302] When the N2 message includes authorization indication information, the RAN can allow the UE's L2 U2N Relay service.

[0303] In this example, the AMF determines whether the UE is allowed to act as an L2 U2N Relay based on whether the UE is in an Allowed or Non-Allowed area. It can update the UE's authorization indication, and the RAN controls the UE's L2 U2N Relay service according to the updated non-authorized indication. This can prevent the UE from interfering with existing communications by providing L2 U2N Relay service in a Non-Allowed area.

[0304] This application also provides an authorization method applicable to the above-described scenarios one and two. Figure 11This application provides a schematic diagram of an authorization method, which includes the following steps:

[0305] S1101: Data management network elements obtain operation permission instructions and authorization conditions.

[0306] Operation permission indication information is used to indicate whether terminal devices are allowed to provide connection services.

[0307] Authorization conditions are used to determine whether a terminal device is allowed to provide connectivity services. For example, authorization conditions may include the authorized location range and / or the authorized time range for connectivity services.

[0308] S1102: The data management network element sends the authorization result to the access management network element according to the authorization conditions. Correspondingly, the access management network element receives the authorization result.

[0309] The authorization result is used to indicate whether the terminal device is not allowed to provide connection services or is allowed to provide connection services.

[0310] Based on the above scheme, the data management network element can determine whether the location and / or current time of the terminal device meet the authorization conditions based on the obtained authorization conditions, and send the corresponding authorization result to the access management network element. Even if the operation permission indication information allows the terminal device to provide connection services, the data management network element will not allow the terminal device to provide connection services if the authorization conditions are not met. This allows for flexible and dynamic control and management of the terminal device's provision of connection services. The above scheme can also avoid providing services outside the authorized location range and / or authorized time range, thus avoiding interference with existing communications to a certain extent.

[0311] As one implementation method, the data management network element stores subscription data, which includes operation permission instructions and authorization conditions. The authorization process of the data management network element is similar to that of the access management network element, and will not be elaborated upon here.

[0312] In another implementation, the data management network element obtains contracted data from the universal data repository (UDR), which includes operation permission instructions and authorization conditions. The UDR provides a unified data repository service.

[0313] In S1102, the data management network element can determine the authorization result based on the authorization conditions, and then send the authorization result to the access management network element.

[0314] Optionally, if the authorization result indicates that the terminal device is not allowed to provide connection services, the data management network element may choose not to send the authorization result to the access management network element. The access management network element, having not received the authorization result, is aware that the terminal device is not allowed to provide connection services.

[0315] Optionally, when the access management network element determines that the terminal device is not allowed to provide connection services, it sends a deregistration request message to the terminal device. For example, the deregistration request message may include indication information that the terminal device is not allowed to provide connection services. After receiving the deregistration request message, the terminal device releases the resources used to provide connection services.

[0316] In one possible scenario (hereinafter referred to as Scenario 1), the authorization conditions include the authorized time range for the connection service. The data management network element can determine whether the current time is outside or within the authorized time range to determine the authorization result.

[0317] When the current time is outside the authorized time range, the data management network element determines the authorization result to indicate that the terminal device is not allowed to provide services. When the current time is within the authorized time range, the data management network element determines the authorization result to indicate that the terminal device is allowed to provide services.

[0318] In another possible scenario (hereinafter referred to as Scenario 2), the authorization conditions include the authorized location range for the connection service. The data management network element can determine whether the terminal device is outside or within the authorized location range to determine the authorization result.

[0319] When the terminal device is outside the authorized location range, the data management network element determines the authorization result to indicate that the terminal device is not allowed to provide connection services. When the terminal device is within the authorized location range, the data management network element determines the authorization result to indicate that the terminal device is allowed to provide connection services.

[0320] If the terminal device is mobile, such as a VMR terminal device, moving the terminal device out of the authorized location range will result in the terminal device being outside the authorized location range, and moving the terminal device into the authorized location range will result in the terminal device being within the authorized location range.

[0321] In another possible scenario (hereinafter referred to as scenario 3), the authorization conditions include the authorized location range and the authorized time range of the connection service. The data management network element can determine whether the current time is outside (or within) the authorized time range, and whether the terminal device is outside (or within) the authorized location range, thereby determining the authorization result.

[0322] When the current time is outside the authorized time range and / or the terminal device is outside the authorized location range, the data management network element determines the authorization result to indicate that the terminal device is not allowed to provide connection services. When the current time is within the authorized time range and the terminal device is within the authorized location range, the data management network element determines the authorization result to indicate that the terminal device is allowed to provide connection services.

[0323] The following mainly explains some implementation methods for case 2.

[0324] As one implementation method, the data management network element can determine whether the terminal device is outside or inside the authorized location range based on the terminal device's location and authorized location range.

[0325] In this implementation, the location of the terminal device can be the real-time location estimated by a network mobility location center (such as GMLC), and the data management network element can obtain the location of the terminal device from the network mobility location center. Optionally, the location of the terminal device can be a location within an authorized time range. For example, the data management network element sends a location determination request message to the network mobility location center to request the location of the terminal device. This location determination request message can carry an authorized time range, and the network mobility location center can obtain the location of the terminal device within that authorized time range.

[0326] For example, in the IAB scenario, the authorized location range includes the authorized path and the authorized area for the connection service. In the L2 Relay scenario, the authorized location range includes the allowed area and the non-Allowed area.

[0327] As another implementation method, the data management network element determines whether the terminal device is outside or inside the authorized location range, and then notifies the access management network element of the determination result.

[0328] Specifically, the data management network element can send a request message to the network mobility location center. This request message includes information about the authorized location range and is used to request whether the terminal device is outside or within the authorized location range. The network mobility location center then sends a notification message to the data management network element, which is used to notify the terminal device whether it is outside or within the authorized location range.

[0329] Optionally, the request message may include an authorization time range.

[0330] As another implementation, in S1101 above, the data management network element can obtain the unauthorized location range (or prohibited area) for connection services. When the terminal is within the unauthorized location range (or prohibited area), the data management network element does not allow the terminal device to provide connection services, thereby flexibly and dynamically controlling and managing the connection services provided by the terminal device.

[0331] The process by which the data management network element determines that the terminal device is in a prohibited area is similar to the process in S1102 above, where the data management network element determines that the terminal device is outside or within the authorized location range. The repetitions will not be repeated here. The difference lies in the fact that when the terminal device is within the prohibited area, the data management network element determines that the terminal device is not allowed to provide connection services; when the terminal device is outside the prohibited area, the data management network element determines that the terminal device is allowed to provide connection services.

[0332] The following examples illustrate this. Figure 11 The authorization process shown is explained below.

[0333] refer to Figure 12 This is a schematic diagram of the authorization process in an IAB scenario, including the following steps:

[0334] S1201: IAB-UE initiates registration process.

[0335] S1202: UDM stores Access and Mobility Subscription data, which includes IAB-operation allowed indication and authorized path / area.

[0336] IAB-operation allowed indication is an example of the above operation permission indication information, and authorized path / area is an example of the above authorized location range.

[0337] Optionally, Access and Mobility Subscription data also includes a validity period, which is an example of the authorization time range mentioned above.

[0338] S1203: UDM obtains the location of IAB-UE from GMLC.

[0339] S1204: DUM determines whether IAB-UE is within the authorized path / area and confirms the authorization result.

[0340] When the IAB-UE is outside the authorized path / area, the authorization result is determined to be an unauthorized indication. This unauthorized indication indicates that the IAB-UE is not authorized, meaning it is not allowed to provide connection services. This example primarily illustrates the situation where the IAB-UE is outside the authorized path / area.

[0341] When the IAB-UE is within the authorized path / area, the authorization result is determined as authorization indication information. This authorization indication information is used to instruct the IAB-UE to provide connection services, that is, to allow the IAB-UE to provide connection services.

[0342] S1203 and S1204 represent possible implementation 1.

[0343] S1205: Whether the UDM's subscription to IAB-UE from GMLC is within the authorized path / area.

[0344] GMLC determines that the IAB-UE is outside the authorized path / area. Alternatively, GMLC determines that the IAB-UE is within the authorized path / area.

[0345] S1206: The GMLC sends an event notify message to the UDM, which includes indication information to notify the IAB-UE that it is outside the authorized path / area.

[0346] If the GMLC determines that the IAB-UE is within the authorized path / area, the event notify message includes indication information to notify the IAB-UE that it is within the authorized path / area.

[0347] S1205 and S1206 represent a possible implementation method 2.

[0348] S1207: UDM sends Access and Mobility Subscription data to AMF, which includes IAB-operation allowed indication and unauthorized indication information.

[0349] S1208: The AMF sends an N2 message to the RAN. When the IAB-UE is outside the authorized path / area, the N2 message includes unauthorized indication information.

[0350] When the IAB-UE is within the authorized path / area, the N2 message includes authorization indication information.

[0351] S1209: The RAN controls the services of the IAB-UE based on the N2 message.

[0352] In this example, the UDM does not authorize the IAB-UE to provide IAB services outside a specific route / area. It can dynamically update the authorization indication of the IAB-UE. The RAN controls the IAB-UE's IAB service according to the updated unauthorized indication, which can prevent the IAB-UE from interfering with existing communications by providing IAB services in unauthorized areas (or unauthorized times).

[0353] Based on the same technical concept as the above-mentioned authorized method, embodiments of this application also provide a communication device, such as... Figure 13 As shown, the communication device 1300 includes a receiving unit 1301 and a transmitting unit 1302. The functions implemented by the optional receiving unit 1301 and transmitting unit 1302 can be accomplished by a communication interface, and the receiving unit and transmitting unit can be integrated into a transceiver unit. The communication device 1300 can be an access management network element, a data management network element, or a terminal device, or it can be located within an access management network element, a data management network element, or a terminal device. The communication device 1300 can be used to implement the methods described in the above method embodiments; for example, the communication device 1300 can perform the above... Figures 8A to 12 The various steps performed by the access management network element, data management network element, or terminal equipment in the method.

[0354] In one possible embodiment, the communication device 1300 is applied to the access management network element.

[0355] For example, receiving unit 1301 is used to obtain operation permission indication information and authorization conditions. The operation permission indication information is used to indicate that the terminal device is allowed to provide connection services. The authorization conditions include the authorized location range and / or the authorized time range of the connection services. Sending unit 1302 is used to send an authorization result to the access network element accessed by the terminal device according to the authorization conditions. The authorization result is used to indicate that the terminal device is not allowed to provide connection services, or that the terminal device is allowed to provide connection services.

[0356] In one implementation, the sending unit 1302 is specifically used to send the authorization result to the access network element according to the authorized location range and / or authorized time range.

[0357] In one implementation, the sending unit 1302 is also used to send the authorization result to the terminal device.

[0358] In one implementation, a processing unit 1303 is also included, which is used to determine the authorization result based on the authorization conditions.

[0359] In one implementation, the processing unit is specifically used to determine the authorization result based on the authorized location range and / or authorized time range.

[0360] In one implementation, the processing unit 1303 is specifically configured to determine the authorization result to indicate that the terminal device is not allowed to provide connection services when the current time is outside the authorized time range; and to determine the authorization result to indicate that the terminal device is allowed to provide connection services when the current time is within the authorized time range.

[0361] In one implementation, the processing unit 1303 is specifically configured to determine the authorization result to indicate that the terminal device is not allowed to provide connection services when the terminal device is outside the authorized location range; and to determine the authorization result to indicate that the terminal device is allowed to provide connection services when the terminal device is within the authorized location range.

[0362] In one implementation, the receiving unit 1301 is further configured to receive notification information sent by the positioning management network element, the notification information being used to notify the terminal device that it is outside or within the authorized location range;

[0363] The processing unit 1303 is specifically configured to determine the authorization result to indicate that the terminal device is not allowed to provide connection services when the notification information is used to notify the terminal device that it is outside the authorized location range; and to determine the authorization result to indicate that the terminal device is allowed to provide connection services when the notification information is used to notify the terminal device that it is within the authorized location range.

[0364] In one implementation, the processing unit 1303 is specifically configured to determine the authorization result to indicate that the terminal device is not allowed to provide connection services when the tracking area where the terminal device is located is outside the tracking area corresponding to the authorized location range; and to determine the authorization result to indicate that the terminal device is allowed to provide connection services when the tracking area where the terminal device is located is within the tracking area corresponding to the authorized location range.

[0365] In one implementation, the connectivity service includes an integrated access and backhaul IAB service, and the terminal device is an IAB terminal device; or

[0366] Connectivity services include vehicular repeater (VMR) services, with the terminal device being a VMR device; or

[0367] The connectivity service includes relay services, and the terminal device is a relay terminal device.

[0368] In one implementation, the authorized location range includes one or more of the following: authorized routes for the connection service, authorized regions for the connection service, regions where the connection service is permitted, or regions where the connection service is prohibited.

[0369] In another possible embodiment, the communication device 1300 is applied to a terminal device.

[0370] For example, receiving unit 1301 is used to receive a first authorization result sent by access management network element, the first authorization result being used to indicate that terminal devices are not allowed to provide connection services;

[0371] The processing unit 1303 is configured to release resources used to provide connection services based on the first authorization result.

[0372] In one implementation, the processing unit 1303 is specifically used to release the F1 interface, which is used for information transmission between the terminal device and the access network element to which the terminal device is connected.

[0373] In one implementation, the receiving unit 1301 is further configured to receive a second authorization result sent by the access management network element, the second authorization result being used to indicate that the terminal device is allowed to provide connection services;

[0374] The processing unit 1303 is also configured to provide connection services based on the second authorization result.

[0375] It should be noted that the module division in the embodiments of this application is illustrative and only represents one logical functional division. In actual implementation, there may be other division methods. Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, exist as separate physical units, or have two or more units integrated into one unit. The integrated units can be implemented in hardware or as software functional units. For example, a transceiver unit may include a receiving unit and / or a transmitting unit.

[0376] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the integrated unit can be stored in a storage medium as a computer software product, including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute all or part of the steps of the methods of the various embodiments of this application.

[0377] like Figure 14As shown in the diagram, this application also provides a structural schematic of a communication device 1400. The communication device 1400 can be used to implement the methods described in the above method embodiments, as can be seen in the descriptions in the above method embodiments. For example, the communication device 1400 can perform the above... Figures 8A to 12 The various steps performed by the access management network element, data management network element, or terminal equipment in the method.

[0378] Device 1400 includes one or more processors 1401. Processor 1401 can be a general-purpose processor or a dedicated processor, such as a baseband processor or a central processing unit (CPU). The baseband processor can be used to process communication protocols and communication data, while the CPU can be used to control the communication device (e.g., a base station, terminal, or chip), execute software programs, and process data from the software programs. The communication device may include a transceiver unit for inputting (receiving) and outputting (transmitting) signals. For example, the transceiver unit can be a transceiver, an RF chip, etc.

[0379] The apparatus 1400 includes one or more processors 1401, which can implement the methods in the embodiments shown above. Optionally, in addition to implementing the methods in the embodiments shown above, the processors 1401 can also implement other functions.

[0380] In one design, processor 1401 can execute instructions that cause device 1400 to perform the methods described in the above method embodiments. The instructions may be stored wholly or partially within processor 1401. For example, instruction 1403 may be stored wholly or partially in processor 1401, or instruction 1403 may be stored in processor 1401, and instruction 1404 may be stored in memory 1402 coupled to the processor. Processor 1401 can simultaneously execute instructions 1403 and 1404 to cause device 1400 to perform the methods described in the above method embodiments. Instructions 1403 and 1404 are also referred to as computer programs.

[0381] In another possible design, the communication device 1400 may also include circuitry that can perform the functions described in the foregoing method embodiments.

[0382] In another possible design, device 1400 may include one or more memories 1402 storing instructions 1404, which can be executed on processor 1401 to cause device 1400 to perform the methods described in the above method embodiments. Optionally, memory 1402 may also store data. Processor 1401 may also optionally store instructions and / or data. For example, one or more memories 1402 may store the correspondences described in the above embodiments, or related parameters or tables involved in the above embodiments. The processor and memory may be configured separately or integrated together.

[0383] In another possible design, device 1400 may also include transceiver 1405 and antenna 1406. Processor 1401, which may be called a processing unit, controls the device (terminal or base station). Transceiver 1405, which may be called a transceiver, transceiver circuit, or transceiver unit, is used to realize the device's transmission and reception functions through antenna 1406.

[0384] The processor can be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), one or more integrated circuits for controlling the execution of the program in this application, a general-purpose processor, a digital signal processor (DSP), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly embodied in the execution of a hardware decoding processor, or can be executed by a combination of hardware and software modules in the decoding processor. The software modules can be stored in a storage medium located in memory.

[0385] The memory can be volatile or non-volatile, or a combination of both. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory can be random access memory (RAM), used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDR SDRAM), Enhanced SDRAM (ESDRAM), Synchronous Link DRAM (SLDRAM), and Direct Rambus RAM (DR RAM). It should be noted that the memory in the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory. The memory may be standalone and connected to the processor via communication lines. The memory may also be integrated with the processor.

[0386] This application also provides a computer-readable medium having a computer program stored thereon, which, when executed by a computer, implements the communication method of any of the above method embodiments.

[0387] This application also provides a computer program product, including a computer program that, when executed by a computer, implements the communication method of any of the above method embodiments.

[0388] This application also provides a communication system, including an access management network element and an access network element. The access management network element and the access network element can implement the communication method of any of the above-described method embodiments.

[0389] Optionally, the communication system may further include one or more of a terminal device and a data management network element, wherein the terminal device and the data management network element may implement the communication method of any of the above method embodiments.

[0390] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of this application is generated. The computer can be the communication device described above. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. The computer-readable storage medium can be the storage medium or the memory described above.

[0391] In one possible design, when the aforementioned communication device is a chip, such as a chip in a network device, or a chip in a terminal device, the processing unit or processor 1401 can be one or more logic circuits, and the transmitting unit or receiving unit or transceiver 1405 can be an input / output interface, or a communication interface, or an interface circuit, or an interface, etc. Alternatively, the transceiver 1405 can also be a transmitting unit and a receiving unit, where the transmitting unit can be an output interface and the receiving unit can be an input interface, integrated into one unit, such as an input / output interface. Figure 15 As shown, Figure 15 The communication device 1500 shown includes a logic circuit 1501 and an interface circuit 1502. That is, the aforementioned determining unit or processor 1401 can be implemented using the logic circuit 1501, and the transmitting unit, receiving unit, or transceiver 1405 can be implemented using the interface circuit 1502. The logic circuit 1501 can be a chip, processing circuit, integrated circuit, or system-on-a-chip (SoC) chip, etc., and the interface circuit 1502 can be a communication interface, input / output interface, etc. In this embodiment, the logic circuit and the interface circuit can also be coupled to each other. The specific connection method of the logic circuit and the interface circuit is not limited in this embodiment.

[0392] In some embodiments of this application, the logic circuit 1501 and interface circuit 1502 can be used to perform the functions or operations described above for network functions or control plane functions. The interface circuit 1502 can be used to receive signals from other communication devices besides communication device 1500 and transmit them to the logic circuit 1501, or to send signals from the logic circuit 1501 to other communication devices besides communication device 1500. The logic circuit 1501 can be used to implement any of the above method embodiments by executing code instructions.

[0393] For example, the interface circuit 1502 is used to receive operation permission indication information and authorization conditions. The functions or operations performed by the communication device can be referred to the foregoing method embodiments, and will not be repeated here.

[0394] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this application.

[0395] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0396] In the embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the couplings or direct couplings or communication connections shown or discussed may be indirect couplings or communication connections through some interfaces, apparatuses, or units, or they may be electrical, mechanical, or other forms of connection.

[0397] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of the embodiments of this application, depending on actual needs.

[0398] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0399] From the above description of the embodiments, those skilled in the art will clearly understand that this application can be implemented in hardware, firmware, or a combination thereof. When implemented in software, the above functions can be stored in a computer-readable medium or transmitted as one or more instructions or code on a computer-readable medium. Computer-readable media include computer storage media and communication media, wherein communication media include any medium that facilitates the transmission of a computer program from one place to another. Storage media can be any available medium that a computer can access.

[0400] In summary, the above are merely embodiments of the technical solutions of this application and are not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, improvements, etc., made within the principles of this application should be included within the scope of protection of this application.

Claims

1. An authorization method, characterized in that, The method includes: The access management network element obtains operation permission indication information and authorization conditions. The operation permission indication information is used to instruct the terminal device to provide connection services. The authorization conditions include the authorized location range and / or the authorized time range of the connection services. The access management network element sends an authorization result to the access network element to which the terminal device is connected, based on the authorized location range and / or the authorized time range. The authorization result is used to indicate whether the terminal device is not allowed to provide the connection service or is allowed to provide the connection service. The connection service includes mobile base station relay service, and the terminal device is a mobile base station relay device. The method further includes: The access management network element sends the authorization result to the terminal device.

2. The method as described in claim 1, characterized in that, The access management network element sends the authorization result to the access network element to which the terminal device is connected, based on the authorized location range and / or the authorized time range, including: The access management network element determines the authorization result based on the authorized location range and / or the authorized time range, and sends the authorization result to the access network element.

3. The method as described in claim 2, characterized in that, The access management network element determines the authorization result based on the authorization time range, including: When the current time is outside the authorized time range, the access management network element determines that the authorization result is used to indicate that the terminal device is not allowed to provide the connection service; When the current time is within the authorized time range, the access management network element determines the authorization result to indicate that the terminal device is allowed to provide the connection service.

4. The method as described in claim 2, characterized in that, The access management network element determines the authorization result based on the authorized location range, including: When the terminal device is outside the authorized location range, the access management network element determines the authorization result to indicate that the terminal device is not allowed to provide the connection service; When the terminal device is within the authorized location range, the access management network element determines the authorization result to indicate that the terminal device is allowed to provide the connection service.

5. The method as described in claim 2, characterized in that, The access management network element determines the authorization result based on the authorized location range, including: The access management network element receives a notification message sent by the location management network element. The notification message is used to notify the terminal device that it is outside the authorized location range or within the authorized location range. When the notification information is used to notify the terminal device that it is outside the authorized location range, the access management network element determines the authorization result to indicate that the terminal device is not allowed to provide the connection service; When the notification information is used to inform the terminal device that it is within the authorized location range, the access management network element determines the authorization result to indicate that the terminal device is allowed to provide the connection service.

6. The method as described in claim 2, characterized in that, The access management network element determines the authorization result based on the authorized location range, including: When the tracking area where the terminal device is located is outside the tracking area range corresponding to the authorized location range, the access management network element determines the authorization result to indicate that the terminal device is not allowed to provide the connection service; When the tracking area where the terminal device is located is within the tracking area range corresponding to the authorized location range, the access management network element determines the authorization result to indicate that the terminal device is allowed to provide the connection service.

7. The method according to any one of claims 1-6, characterized in that, The authorized location range includes one or more of the following: the authorized route of the connection service, the authorized area of ​​the connection service, the area where the connection service is allowed to be provided, or the area where the connection service is prohibited from being provided.

8. An authorization method, characterized in that, The method includes: The terminal device receives a first authorization result sent by the access management network element, the first authorization result being used to indicate that the terminal device is not allowed to provide connection services; The terminal device releases the resources used to provide the connection service based on the first authorization result; The connection service includes mobile base station relay service, and the terminal device is a mobile base station relay device.

9. The method as described in claim 8, characterized in that, The release of resources used to provide the connection service includes: The terminal device releases the F1 interface, which is used for information transmission between the terminal device and the access network element to which the terminal device is connected.

10. The method as described in claim 8, characterized in that, The method further includes: The terminal device receives a second authorization result sent by the access management network element, the second authorization result being used to indicate that the terminal device is allowed to provide the connection service; The terminal device provides the connection service based on the second authorization result.

11. A communication device, characterized in that, The device includes: A receiving unit is configured to acquire operation permission indication information and authorization conditions. The operation permission indication information is used to instruct the terminal device to provide connection services. The authorization conditions include the authorized location range and / or the authorized time range of the connection services. The sending unit is configured to send an authorization result to the access network element to which the terminal device is connected, based on the authorized location range and / or the authorized time range. The authorization result is used to indicate whether the terminal device is not allowed to provide the connection service or is allowed to provide the connection service. The connection service includes mobile base station relay service, and the terminal device is a mobile base station relay device. The sending unit is also used to send the authorization result to the terminal device.

12. The apparatus as claimed in claim 11, characterized in that, The device further includes: A processing unit is used to determine the authorization result based on the authorization conditions.

13. The apparatus as claimed in claim 12, characterized in that, The processing unit is specifically configured to determine, when the current time is outside the authorized time range, that the authorization result is used to indicate that the terminal device is not allowed to provide the connection service; and when the current time is within the authorized time range, determine that the authorization result is used to indicate that the terminal device is allowed to provide the connection service.

14. The apparatus as claimed in claim 12, characterized in that, The processing unit is specifically configured to determine, when the terminal device is outside the authorized location range, that the authorization result is used to indicate that the terminal device is not allowed to provide the connection service; When the terminal device is within the authorized location range, the authorization result is determined to indicate that the terminal device is allowed to provide the connection service.

15. The apparatus as claimed in claim 12, characterized in that, The receiving unit is further configured to receive notification information sent by the positioning management network element, the notification information being used to notify the terminal device that it is outside or within the authorized location range; The processing unit is specifically configured to, when the notification information is used to notify the terminal device that it is outside the authorized location range, determine that the authorization result is used to indicate that the terminal device is not allowed to provide the connection service; When the notification information is used to inform the terminal device that it is within the authorized location range, the authorization result is determined to indicate that the terminal device is allowed to provide the connection service.

16. The apparatus as claimed in claim 12, characterized in that, The processing unit is specifically configured to determine, when the tracking area where the terminal device is located is outside the tracking area range corresponding to the authorized location range, that the authorization result is used to indicate that the terminal device is not allowed to provide the connection service; When the tracking area where the terminal device is located is within the tracking area range corresponding to the authorized location range, the authorization result is determined to indicate that the terminal device is allowed to provide the connection service.

17. The apparatus according to any one of claims 11-16, characterized in that, The authorized location range includes one or more of the following: the authorized route of the connection service, the authorized area of ​​the connection service, the area where the connection service is allowed to be provided, or the area where the connection service is prohibited from being provided.

18. A communication device, characterized in that, The device includes: The receiving unit is configured to receive a first authorization result sent by the access management network element, wherein the first authorization result is used to indicate that the terminal device is not allowed to provide connection services; The processing unit is configured to release the resources used to provide the connection service based on the first authorization result; The connection service includes mobile base station relay service, and the terminal device is a mobile base station relay device.

19. The apparatus as claimed in claim 18, characterized in that, The processing unit is specifically used to release the F1 interface, which is used for information transmission between the terminal device and the access network element to which the terminal device is connected.

20. The apparatus as claimed in claim 18, characterized in that, The receiving unit is further configured to receive a second authorization result sent by the access management network element, wherein the second authorization result is used to indicate that the terminal device is allowed to provide the connection service; The processing unit is further configured to provide the connection service based on the second authorization result.

21. A communication device, characterized in that, Includes a processor, which is coupled to a memory; The processor is configured to execute a computer program or instructions stored in the memory to cause the apparatus to perform the method as described in any one of claims 1-10.

22. A communication device, characterized in that, It includes a logic circuit and an interface circuit. The interface circuit is used to receive signals from other communication devices besides the communication device and transmit them to the logic circuit, or to send signals from the logic circuit to other communication devices besides the communication device. The logic circuit executes code instructions to implement the method as described in any one of claims 1-10.

23. A computer-readable storage medium, characterized in that, It includes a computer program or instructions that, when run on a computer, cause the method as described in any one of claims 1-10 to be performed.

24. A computer program product, characterized in that, It includes a computer program or instructions that, when run on a computer, cause the method as described in any one of claims 1-10 to be performed.

25. A communication system, characterized in that, It includes an access management network element and an access network element for performing the method as described in any one of claims 1-7.

Images