Authentication and authorization method and device for AI function in core network

Abstract

The embodiment of the invention discloses an authentication and authorization method and device for an AI function in a core network, which can be applied to the technical field of communication, and the method comprises the following steps: an AMF network element sends an authentication and authorization request to an AAA-S network element, the authentication and authorization request comprising a first identifier of a specified terminal device and first AI function auxiliary information; receiving an authentication and authorization response returned by the AAA-S network element, the authentication and authorization response comprising: an authentication and authorization result used for representing whether the specified terminal device is allowed to use an AI function corresponding to the first AI function auxiliary information; therefore, authentication and authorization of the AI function in the core network are realized, and the terminal equipment can conveniently use the service of the AI function in the core network.

Description

A method and device for authentication and authorization of AI functions in a core network Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a method and device for authenticating and authorizing AI functions in a core network. Background Art

[0002] Artificial Intelligence (AI) is a new technical discipline that studies and develops theories, methods, technologies, and application systems for simulating, extending, and expanding human intelligence. Currently, the typical application scenarios of sixth-generation mobile networks (6G) and AI overlap by over 80%, demonstrating the deep integration of the two.

[0003] Currently, AI functions are simply overlaid on 6G network processes and are considered add-on applications. Therefore, it is possible to consider adding AI functions as independent network elements to the 6G core network architecture, tightly coupling them with other network elements to provide reliable and systematic AI functional services. However, there is currently a lack of authentication and authorization processes for AI functions.

[0004] Summary of the Invention

[0005] An embodiment of the present application provides an authentication and authorization method and apparatus for an AI function in a core network, which can be applied to the field of communications technology to implement sending an authentication and authorization request to an AAA-S network element, wherein the authentication and authorization request includes: a first identifier of a specified terminal device and first AI function auxiliary information; and receiving an authentication and authorization response returned by the AAA-S network element, thereby implementing authentication and authorization of the AI ​​function in the core network and facilitating terminal devices to use the services of the AI ​​function in the core network.

[0006] In the first aspect, an embodiment of the present application provides an authentication and authorization method for an AI function in a core network, which is executed by an AMF network element. The method includes: sending an authentication and authorization request to an AAA-S network element, wherein the authentication and authorization request includes: a first identifier of a specified terminal device and first AI function auxiliary information; receiving an authentication and authorization response returned by the AAA-S network element, wherein the authentication and authorization response includes: an authentication and authorization result, which is used to indicate whether the specified terminal device is allowed to use the AI ​​function corresponding to the first AI function auxiliary information.

[0007] In one implementation, the authentication and authorization request further includes: an EAP identity response of the designated terminal device, which is used for identity authentication of the designated terminal device.

[0008] In one implementation, before sending an authentication and authorization request to the AAA-S network element, the method further includes: sending a first message to at least one candidate terminal device, wherein the first message includes: an EAP identity request and the first AI function auxiliary information; the at least one candidate terminal device includes the designated terminal device; and receiving a second message returned by the designated terminal device, wherein the second message includes: an EAP identity response of the designated terminal device, the first identifier, and the first AI function auxiliary information.

[0009] In one implementation, the first message and the second message are NAS MM transmission messages.

[0010] In one implementation, sending an authentication and authorization request to the AAA-S network element includes: sending an AIAA authentication request to the AIAAF network element, wherein the AIAA authentication request includes: the first identifier and the first AI function auxiliary information; wherein the first AI function auxiliary information includes: the address of the AAA-S network element, used to instruct the AIAAF network element to send the authentication and authorization request to the AAA-S network element according to the address.

[0011] In one implementation, receiving the authentication and authorization response returned by the AAA-S network element includes: receiving a third message returned by the AAA-S network element, wherein the third message includes: the authentication and authorization result, a second identifier, and second AI function auxiliary information; when the second identifier is consistent with the first identifier, and the second AI function auxiliary information is consistent with the first AI function auxiliary information, determining that the third message is the authentication and authorization response.

[0012] In this technical solution, an authentication and authorization request is sent to an AAA-S network element, where the authentication and authorization request includes: a first identifier of a specified terminal device and first AI function auxiliary information; an authentication and authorization response is returned by the AAA-S network element, where the authentication and authorization response includes: an authentication and authorization result, which is used to indicate whether the specified terminal device is allowed to use the AI ​​function corresponding to the first AI function auxiliary information; thereby achieving authentication and authorization of the AI ​​function in the core network, facilitating terminal devices to use the services of the AI ​​function in the core network.

[0013] In the second aspect, an embodiment of the present application provides another authentication and authorization method for an AI function in a core network, which is executed by an AAA-S network element. The method includes: receiving an authentication and authorization request sent by an AMF network element, wherein the authentication and authorization request includes: a first identifier of a specified terminal device and first AI function auxiliary information; sending an authentication and authorization response to the AMF network element, wherein the authentication and authorization response includes: an authentication and authorization result, which is used to indicate whether the specified terminal device is allowed to use the AI ​​function corresponding to the first AI function auxiliary information.

[0014] In one implementation, the authentication and authorization request further includes: an EAP identity response of the designated terminal device, which is used for identity authentication of the designated terminal device.

[0015] In one implementation, the receiving of the authentication and authorization request sent by the AMF network element includes: receiving the authentication and authorization request sent by the AIAAF network element, wherein the authentication and authorization request is sent by the AIAAF network element based on the AIAA authentication request received from the AMF network element; the AIAA authentication request includes: the first identifier and the first AI function auxiliary information, the first AI function auxiliary information includes: the address of the AAA-S network element, used to instruct the AIAAF network element to send the authentication and authorization request to the AAA-S network element according to the address.

[0016] In one implementation, sending an authentication and authorization response to the AMF network element includes sending a third message to the AMF network element, wherein the third message includes: the authentication and authorization result, the first identifier, and the first AI function auxiliary information.

[0017] In one implementation, the method further includes: sending a fourth message to the designated terminal device, wherein the fourth message includes: an EAP authentication request, the first identifier, and the first AI function auxiliary information; receiving a fifth message returned by the designated terminal device, wherein the fifth message includes: an EAP authentication response, the first identifier, and the first AI function auxiliary information; and determining, based on the EAP authentication response, whether the designated terminal device is allowed to use the AI ​​function corresponding to the first AI function auxiliary information.

[0018] In one implementation, the method further includes: storing an association between the first identifier, the first AI function auxiliary information, and the authentication and authorization result.

[0019] In this technical solution, an authentication and authorization request sent by an AMF network element is received, wherein the authentication and authorization request includes: a first identifier of a specified terminal device and first AI function auxiliary information; an authentication and authorization response is sent to the AMF network element, wherein the authentication and authorization response includes: an authentication and authorization result, which is used to indicate whether the specified terminal device is allowed to use the AI ​​function corresponding to the first AI function auxiliary information; thereby realizing authentication and authorization of the AI ​​function in the core network, making it convenient for the terminal device to use the services of the AI ​​function in the core network.

[0020] In a third aspect, an embodiment of the present application provides another authentication and authorization method for an AI function in a core network, which is executed by a terminal device, and the method includes: receiving a first message sent by an AMF network element, wherein the first message includes: an EAP identity request and first AI function auxiliary information; returning a second message to the AMF network element, wherein the second message includes: a first identifier of the terminal device, an EAP identity response and the first AI function auxiliary information; the EAP identity response is used for identity authentication of the terminal device; receiving a sixth message sent by the AMF network element, wherein the sixth message includes: an authentication and authorization result, which is used to indicate whether the specified terminal device is allowed to use the AI ​​function corresponding to the first AI function auxiliary information.

[0021] In one implementation, the first message and the second message are NAS MM transmission messages.

[0022] In one implementation, the method further includes: receiving a fourth message sent by an AAA-S network element, wherein the fourth message includes: an EAP authentication request, the first identifier, and the first AI function auxiliary information; returning a fifth message to the AAA-S network element, wherein the fifth message includes: an EAP authentication response, the first identifier, and the first AI function auxiliary information; the EAP authentication response is used to determine whether the terminal device is allowed to use the AI ​​function corresponding to the first AI function auxiliary information.

[0023] In this technical solution, a first message sent by an AMF network element is received, wherein the first message includes: an EAP identity request and first AI function auxiliary information; a second message is returned to the AMF network element, wherein the second message includes: a first identifier of the terminal device, an EAP identity response and the first AI function auxiliary information; the EAP identity response is used for identity authentication of the terminal device; a sixth message sent by the AMF network element is received, wherein the sixth message includes: an authentication and authorization result, which is used to indicate whether the specified terminal device is allowed to use the AI ​​function corresponding to the first AI function auxiliary information; thereby realizing authentication and authorization of the AI ​​function in the core network, and facilitating the terminal device to use the services of the AI ​​function in the core network.

[0024] In a fourth aspect, an embodiment of the present application provides an authentication and authorization device for an AI function in a core network, which is applied to an AMF network element. The device has the function of implementing some or all of the functions described in the method described in the first aspect above. For example, the function of the authentication and authorization device for the AI ​​function in the core network may have the functions of some or all of the embodiments in this application, or may have the function of implementing any one of the embodiments in this application separately. The functions can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more units or modules corresponding to the above functions.

[0025] In one implementation, the structure of the authentication and authorization device for the AI ​​function in the core network may include a transceiver module and a processing module, wherein the processing module is configured to support the authentication and authorization device for the AI ​​function in the core network to perform the corresponding functions in the above method. The transceiver module is used to support communication between the authentication and authorization device for the AI ​​function in the core network and other devices. The authentication and authorization device for the AI ​​function in the core network may also include a storage module, which is coupled to the transceiver module and the processing module and stores the computer programs and data necessary for the authentication and authorization device for the AI ​​function in the core network.

[0026] As an example, the processing module may be a processor, the transceiver module may be a transceiver or a communication interface, and the storage module may be a memory.

[0027] In a fifth aspect, an embodiment of the present application provides an authentication and authorization device for an AI function in a core network, which is applied to an AAA-S network element. The device has the function of implementing some or all of the functions described in the method described in the first aspect above. For example, the function of the authentication and authorization device for an AI function in a core network may have the functions of some or all of the embodiments in this application, or may have the function of implementing any one of the embodiments in this application separately. The functions may be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more units or modules corresponding to the above functions.

[0028] In one implementation, the structure of the authentication and authorization device for the AI ​​function in the core network may include a transceiver module and a processing module, wherein the processing module is configured to support the authentication and authorization device for the AI ​​function in the core network to perform the corresponding functions in the above method. The transceiver module is used to support communication between the authentication and authorization device for the AI ​​function in the core network and other devices. The authentication and authorization device for the AI ​​function in the core network may also include a storage module, which is coupled to the transceiver module and the processing module and stores the computer programs and data necessary for the authentication and authorization device for the AI ​​function in the core network.

[0029] As an example, the processing module may be a processor, the transceiver module may be a transceiver or a communication interface, and the storage module may be a memory.

[0030] In a sixth aspect, an embodiment of the present application provides an authentication and authorization device for an AI function in a core network, which is applied to a terminal device. The device has the function of implementing some or all of the functions described in the method described in the first aspect above. For example, the function of the authentication and authorization device for an AI function in a core network may have the functions of some or all of the embodiments in this application, or may have the function of implementing any one of the embodiments in this application separately. The functions may be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more units or modules corresponding to the above functions.

[0031] In one implementation, the structure of the authentication and authorization device for the AI ​​function in the core network may include a transceiver module and a processing module, wherein the processing module is configured to support the authentication and authorization device for the AI ​​function in the core network to perform the corresponding functions in the above method. The transceiver module is used to support communication between the authentication and authorization device for the AI ​​function in the core network and other devices. The authentication and authorization device for the AI ​​function in the core network may also include a storage module, which is coupled to the transceiver module and the processing module and stores the computer programs and data necessary for the authentication and authorization device for the AI ​​function in the core network.

[0032] As an example, the processing module may be a processor, the transceiver module may be a transceiver or a communication interface, and the storage module may be a memory.

[0033] In a seventh aspect, an embodiment of the present application provides a communication device, which includes a processor. When the processor calls a computer program in a memory, it executes the method described in the first aspect above, or executes the method described in the second aspect above.

[0034] In an eighth aspect, an embodiment of the present application provides a communication device, which includes a processor. When the processor calls a computer program in a memory, it executes the method described in the third aspect above.

[0035] In the ninth aspect, an embodiment of the present application provides a communication device, which includes a processor and a memory, in which a computer program is stored; the processor executes the computer program stored in the memory so that the communication device executes the method described in the first aspect above, or executes the method described in the second aspect above.

[0036] In the tenth aspect, an embodiment of the present application provides a communication device, which includes a processor and a memory, in which a computer program is stored; the processor executes the computer program stored in the memory so that the communication device executes the method described in the third aspect above.

[0037] In the eleventh aspect, an embodiment of the present application provides a communication device, which includes a processor and an interface circuit, wherein the interface circuit is used to receive code instructions and transmit them to the processor, and the processor is used to run the code instructions to enable the device to execute the method described in the first aspect above, or to execute the method described in the second aspect above.

[0038] In the twelfth aspect, an embodiment of the present application provides a communication device, which includes a processor and an interface circuit, wherein the interface circuit is used to receive code instructions and transmit them to the processor, and the processor is used to run the code instructions to enable the device to execute the method described in the third aspect above.

[0039] In aspect 13, an embodiment of the present application provides a communication system, which includes the communication device described in aspect 7 and the communication device described in aspect 8, or the system includes the communication device described in aspect 9 and the communication device described in aspect 10, or the system includes the communication device described in aspect 11 and the communication device described in aspect 12.

[0040] In the fourteenth aspect, an embodiment of the present invention provides a computer-readable storage medium for storing instructions used by the above-mentioned network device. When the instructions are executed, the network device executes the method described in the first aspect above, or executes the method described in the second aspect above.

[0041] In a fifteenth aspect, an embodiment of the present invention provides a readable storage medium for storing instructions for the above-mentioned terminal device, and when the instructions are executed, the terminal device executes the method described in the third aspect.

[0042] In the sixteenth aspect, the present application also provides a computer program product comprising a computer program, which, when executed on a computer, enables the computer to execute the method described in the first aspect above, or to execute the method described in the second aspect above.

[0043] In the seventeenth aspect, the present application also provides a computer program product comprising a computer program, which, when executed on a computer, enables the computer to execute the method described in the third aspect above.

[0044] In an eighteenth aspect, the present application provides a chip system, which includes at least one processor and an interface, and is used to support a network device to implement the functions involved in the first aspect, or to implement the functions involved in the second aspect, for example, determining or processing at least one of the data and information involved in the above method. In one possible design, the chip system also includes a memory, which is used to store computer programs and data necessary for the terminal device. The chip system can be composed of a chip, or it can include a chip and other discrete devices.

[0045] In a nineteenth aspect, the present application provides a chip system comprising at least one processor and an interface for supporting a terminal device in implementing the functions described in the third aspect, such as determining or processing at least one of the data and information described in the above method. In one possible design, the chip system further comprises a memory for storing computer programs and data necessary for the network device. The chip system may consist of a chip or may include a chip and other discrete components.

[0046] In the twentieth aspect, the present application provides a computer program which, when executed on a computer, enables the computer to execute the method described in the first aspect above, or to execute the method described in the second aspect above.

[0047] In the twenty-first aspect, the present application provides a computer program which, when executed on a computer, enables the computer to execute the method described in the third aspect above. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the background technology, the drawings required for use in the embodiments of the present application or the background technology will be described below.

[0049] FIG1 is a schematic diagram of the architecture of a communication system provided in an embodiment of the present application;

[0050] FIG2 is a flow chart of a method for authentication and authorization of an AI function in a core network provided by an embodiment of the present application;

[0051] FIG3 is a flow chart of another method for authentication and authorization of AI functions in a core network provided by an embodiment of the present application;

[0052] FIG4 is a flow chart of another method for authentication and authorization of AI functions in a core network provided in an embodiment of the present application;

[0053] FIG5 is a flow chart of another method for authentication and authorization of AI functions in a core network provided by an embodiment of the present application;

[0054] FIG6 is a flow chart of another method for authentication and authorization of an AI function in a core network provided in an embodiment of the present application;

[0055] FIG7 is a flow chart of another method for authentication and authorization of AI functions in a core network provided in an embodiment of the present application;

[0056] FIG8 is an interactive flow chart of another method for authentication and authorization of AI functions in a core network provided in an embodiment of the present application;

[0057] FIG9 is a schematic structural diagram of an authentication and authorization device for an AI function in a core network provided by an embodiment of the present application;

[0058] FIG10 is a schematic structural diagram of another authentication and authorization device for AI functions in a core network provided in an embodiment of the present application;

[0059] FIG11 is a schematic structural diagram of another authentication and authorization device for AI functions in a core network provided in an embodiment of the present application;

[0060] FIG12 is a schematic structural diagram of a communication device provided by an embodiment of the present disclosure;

[0061] FIG13 is a schematic structural diagram of a chip provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0062] To facilitate understanding, the terms involved in this application are first introduced.

[0063] 1. Artificial Intelligence (AI)

[0064] AI is a new technical science that studies and develops theories, methods, technologies and application systems for simulating, extending and expanding human intelligence.

[0065] 2. 6th generation mobile networks (6G)

[0066] The 6G network is a fully connected world, integrating terrestrial wireless and satellite communications. By integrating satellite communications into 6G mobile communications, seamless global coverage is achieved, enabling network signals to reach even the most remote villages. Furthermore, supported by the interconnected global positioning system, telecommunications satellite systems, Earth imaging satellite systems, and the 6G terrestrial network, this comprehensive ground-to-air network can also help humans predict weather and rapidly respond to natural disasters.

[0067] 3. Access and Mobility Management Function (AMF) network element

[0068] The AMF network element performs registration, connection, reachability, and mobility management. It provides a session management message transmission channel between terminal devices and SMF network elements, and provides authentication and authorization functions for terminal device access. It is the access point between terminal devices and the wireless core network control plane.

[0069] 4. Authentication and Authorization Server (AAA-S) network element

[0070] AAA-S network element, used for authentication and authorization of AI functions, etc.

[0071] The various network elements / functions involved in the embodiments of the present disclosure may be an independent hardware device or a function implemented by computer code within a hardware device, and the embodiments of the present disclosure do not limit this.

[0072] In order to better understand the authentication and authorization method for AI functions in a core network disclosed in an embodiment of the present application, the communication system to which the embodiment of the present application is applicable is first described below.

[0073] Please refer to Figure 1, which is a schematic diagram of the architecture of a communication system provided in an embodiment of the present application. The communication system may include, but is not limited to, a network device and a terminal device. The number and form of devices shown in Figure 1 are for example purposes only and do not constitute a limitation on the embodiments of the present application. In actual applications, two or more network devices and two or more terminal devices may be included. The communication system shown in Figure 1 includes, for example, a network device 101 and a terminal device 102.

[0074] It should be noted that the technical solutions of the embodiments of the present application can be applied to various communication systems. For example, long term evolution (LTE) systems, fifth generation (5G) mobile communication systems, 5G new radio (NR) systems, sixth generation (6G) mobile communication systems, or other future new mobile communication systems.

[0075] The network device 101 in the embodiment of the present application is an entity on the network side for transmitting or receiving signals. For example, the network device 101 can be an evolved NodeB (eNB), a transmission reception point (TRP), a next generation NodeB (gNB) in an NR system, a base station in other future mobile communication systems, or an access node in a wireless fidelity (WiFi) system. The embodiments of the present application do not limit the specific technology and specific device form adopted by the network device. The network device provided in the embodiment of the present application can be composed of a centralized unit (CU) and a distributed unit (DU), wherein the CU can also be called a control unit. The CU-DU structure can be used to split the protocol layer of the network device, such as the base station, and the functions of some protocol layers are placed in the CU for centralized control, and the functions of the remaining part or all of the protocol layers are distributed in the DU, and the DU is centrally controlled by the CU.

[0076] The terminal device 102 in the embodiment of the present application is an entity on the user side for receiving or transmitting signals, such as a mobile phone. The terminal device can also be called a terminal device (terminal), user equipment (UE), mobile station (MS), mobile terminal device (MT), etc. The terminal device can be a car with communication function, a smart car, a mobile phone, a wearable device, a tablet computer (Pad), a computer with wireless transceiver function, a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a wireless terminal device in industrial control (industrial control), a wireless terminal device in self-driving, a wireless terminal device in remote medical surgery, a wireless terminal device in smart grid (smart grid), a wireless terminal device in transportation safety (transportation safety), a wireless terminal device in smart city (smart city), a wireless terminal device in smart home (smart home), etc. The embodiment of the present application does not limit the specific technology and specific device form adopted by the terminal device.

[0077] Artificial Intelligence (AI) is a new technical discipline that studies and develops theories, methods, technologies, and application systems for simulating, extending, and expanding human intelligence. Currently, the typical application scenarios of sixth-generation mobile networks (6G) and AI overlap by over 80%, demonstrating the deep integration of the two.

[0078] Currently, AI functions are simply added to 6G network processes and are considered plug-in applications. Therefore, it is possible to consider adding AI functions as independent network elements to the 6G core network architecture, tightly coupling them with other network elements to provide reliable and systematic AI function services. Therefore, AI functions need to be authenticated and authorized.

[0079] It can be understood that the communication system described in the embodiment of the present application is for the purpose of more clearly illustrating the technical solution of the embodiment of the present application, and does not constitute a limitation on the technical solution provided by the embodiment of the present application. Ordinary technicians in this field can know that with the evolution of the system architecture and the emergence of new business scenarios, the technical solution provided by the embodiment of the present application is also applicable to similar technical problems.

[0080] The following is a detailed introduction to the authentication and authorization method and device for the AI ​​function in the core network provided by this application in conjunction with the accompanying drawings.

[0081] Please refer to Figure 2, which is a flowchart of a method for authentication and authorization of AI functions in a core network provided by an embodiment of the present application. The method can be executed by the network device in Figure 1, specifically by an AMF network element.

[0082] As shown in FIG2 , the method may include but is not limited to the following steps:

[0083] Step S201: Send an authentication and authorization request to the AAA-S network element, where the authentication and authorization request includes: a first identifier of a specified terminal device and first AI function auxiliary information.

[0084] In an embodiment of the present application, the AMF network element may communicate with at least one AI function network element to determine the AI ​​function network element that requires authentication and authorization processing. Different AI function network elements implement different AI functions.

[0085] Among them, for the AI ​​function implemented by the specific AI function network element, some terminal devices may need to use the AI ​​function, while some terminal devices may not need to use the AI ​​function. Therefore, the AMF network element needs to initiate an authentication and authorization process for the specific AI function and the specific terminal device. The specific terminal device is a terminal device that needs to use the specific AI function. The designated terminal device is a terminal device that needs to use the AI ​​function corresponding to the first AI function auxiliary information.

[0086] As an example, the first identifier of the designated terminal device may be, for example, a Generic Public Subscription Identifier (GPSI) of the designated terminal device, which is used to uniquely identify the designated terminal device.

[0087] As an example, in order to facilitate the subsequent interaction between the AAA-S network element and the designated terminal device to determine whether the designated terminal device is allowed to use the AI ​​function corresponding to the first AI function auxiliary information, the authentication and authorization request also includes: an Extensible Authentication Protocol (EAP) identity response of the designated terminal device, which is used to authenticate the identity of the designated terminal device. In other words, after receiving the authentication and authorization request, the AAA-S network element can carry the EAP identity response in the interaction with the designated terminal device; when the designated terminal device receives a message carrying the EAP identity response, it will receive and process the message; when it receives a message that does not carry the EAP identity response, it will ignore or not receive the message.

[0088] As an example, the process of the AMF network element sending an authentication and authorization request to the AAA-S network element may be, for example, sending an AIAA authentication request (AIAA_Authenticate Request) to the AIAAF network element, wherein the AIAA authentication request includes: a first identifier and first AI function auxiliary information; wherein the first AI function auxiliary information includes: an address of the AAA-S network element, used to instruct the AIAAF network element to send an authentication and authorization request to the AAA-S network element according to the address. As an example, the AIAA authentication request may also include an EAP identity response of a specified terminal device.

[0089] When the Artificial Intelligence Authentication and Authorization Function (AIAAF) network element receives an AIAA authentication request, it obtains the address of the Authentication and Authorization Server (AAA-S) network element included in the first AI function auxiliary information in the AIAA authentication request, and sends an authentication and authorization request to the AAA-S network element based on the address. There can be multiple AAA-S network elements, and different AI functions may correspond to different AAA-S network elements, that is, different AI functions may require the use of different AAA-S network elements for authentication and authorization processing.

[0090] The AIAAF network element may send an AAA Protocol message to the AAA-S network element, wherein the AAA Protocol message carries an authentication and authorization request.

[0091] As an example, the AIAAF network element may transparently transmit the AAA Protocol message to the AAA-S network element through the Authentication and Authorization Proxy (AAA-P) network element.

[0092] Step S202: Receive an authentication and authorization response returned by the AAA-S network element, where the authentication and authorization response includes: an authentication and authorization result, which is used to indicate whether the specified terminal device is allowed to use the AI ​​function corresponding to the first AI function auxiliary information.

[0093] As an example, the authentication and authorization response may also include: a first identifier and first AI function auxiliary information. The AMF network element may receive a third message returned by the AAA-S network element, wherein the third message includes: an authentication and authorization result, a second identifier and second AI function auxiliary information; when the second identifier is consistent with the first identifier, and the second AI function auxiliary information is consistent with the first AI function auxiliary information, the third message is determined to be an authentication and authorization response. In addition, when the second identifier is inconsistent with the first identifier, or the second AI function auxiliary information is inconsistent with the first AI function auxiliary information, it is determined that the third message is not an authentication and authorization response for the above-mentioned authentication and authorization request; it may be an authentication and authorization response for an authentication and authorization request for other terminal devices, or it may be an authentication and authorization response for the designated terminal device and for the AI ​​function corresponding to the second AI function auxiliary information.

[0094] As an example, the process of the AMF network element receiving the third message returned by the AAA-S network element may be, for example, that the AMF network element receives the third message returned by the AIAAF network element; wherein, the third message is sent by the AAA-S network element to the AIAAF network element.

[0095] In the embodiments of the present application, the AMF network element can communicate directly with the AAA-S network element to send authentication and authorization requests and receive authentication and authorization responses; it can also communicate with the AAA-S network element through other network devices. It should be noted that in all steps of all embodiments of the present application, the intermediate device may be omitted in the description, and only the sending device and the receiving device are limited; however, those skilled in the art will understand that this description does not necessarily mean that the sending device must send directly to the receiving device.

[0096] In one possible implementation, the AMF network element may interact through the AIAAF network element, the AAA-P network element, and the AAA-S network element. In another possible implementation, the AMF network element may interact directly with the AAA-S network element.

[0097] In the authentication and authorization method for the AI ​​function in the core network of an embodiment of the present application, the AMF network element sends an authentication and authorization request to the AAA-S network element, wherein the authentication and authorization request includes: a first identifier of a specified terminal device and first AI function auxiliary information; and receives an authentication and authorization response returned by the AAA-S network element, wherein the authentication and authorization response includes: an authentication and authorization result, which is used to indicate whether the specified terminal device is allowed to use the AI ​​function corresponding to the first AI function auxiliary information; thereby realizing authentication and authorization of the AI ​​function in the core network, and facilitating the terminal device to use the service of the AI ​​function in the core network.

[0098] It should be noted that the above-mentioned possible implementation methods can be executed separately or in combination, and the embodiments of the present application are not limited to this.

[0099] Please refer to Figure 3, which is a flow chart of another authentication and authorization method for AI functions in the core network provided in an embodiment of the present application. This method can be executed by the network device in Figure 1, specifically by the AMF network element.

[0100] Among them, the authentication and authorization method of the AI ​​function in the core network can be executed alone, or it can be executed in combination with any embodiment in this application or a possible implementation method in the embodiment, or it can be executed in combination with any technical solution in the related technology.

[0101] As shown in FIG3 , the method may include but is not limited to the following steps:

[0102] Step S301: Send a first message to at least one candidate terminal device, wherein the first message includes: an EAP identity request and first AI function auxiliary information; the at least one candidate terminal device includes a designated terminal device.

[0103] In an embodiment of the present application, at least one candidate terminal device may be a terminal device that communicates with the AMF network element through a radio access network (RAN).

[0104] The first message may be, for example, a Non Access Stratum (NAS) MM transmission message.

[0105] Step S302: Receive a second message returned by the designated terminal device, wherein the second message includes: an EAP identity response of the designated terminal device, a first identifier, and first AI function auxiliary information.

[0106] In an embodiment of the present application, when the designated terminal device determines that it needs to use the AI ​​function corresponding to the first AI function auxiliary information, it may return a second message to the AMF network element, which carries the EAP identity response of the designated terminal device, the first identifier, and the first AI function auxiliary information, indicating that the designated terminal device needs to use the AI ​​function corresponding to the first AI function auxiliary information. In addition, when the designated terminal device determines that it does not need to use the AI ​​function corresponding to the first AI function auxiliary information, the designated terminal device may not return the second message.

[0107] The second message may be, for example, a Non Access Stratum (NAS) MM transmission message.

[0108] Step S303: Send an authentication and authorization request to the AAA-S network element, where the authentication and authorization request includes: a first identifier of the specified terminal device and first AI function auxiliary information.

[0109] Step S304: Receive an authentication and authorization response returned by the AAA-S network element, where the authentication and authorization response includes: an authentication and authorization result, which is used to indicate whether the specified terminal device is allowed to use the AI ​​function corresponding to the first AI function auxiliary information.

[0110] In the embodiment of the present application, step S303 and step S304 can be implemented respectively using any of the methods in the embodiments of the present application. The embodiment of the present application does not limit this and will not be repeated.

[0111] In an authentication and authorization method for an AI function in a core network according to an embodiment of the present application, an AMF network element sends a first message to at least one candidate terminal device, wherein the first message includes: an EAP identity request and first AI function auxiliary information; at least one candidate terminal device includes a designated terminal device; a second message returned by the designated terminal device is received, wherein the second message includes: an EAP identity response, a first identifier, and first AI function auxiliary information of the designated terminal device; an authentication and authorization request is sent to an AAA-S network element, wherein the authentication and authorization request includes: the first identifier of the designated terminal device and the first AI function auxiliary information; an authentication and authorization response is received from the AAA-S network element, wherein the authentication and authorization response includes: an authentication and authorization result, which is used to indicate whether the designated terminal device is allowed to use the AI ​​function corresponding to the first AI function auxiliary information; thereby, authentication and authorization of the AI ​​function in the core network is implemented, and it is convenient for the terminal device to use the service of the AI ​​function in the core network.

[0112] Please refer to Figure 4, which is a flow chart of another authentication and authorization method for AI functions in a core network provided in an embodiment of the present application. This method can be executed by the network device in Figure 1, specifically by an AAA-S network element.

[0113] Among them, the authentication and authorization method of the AI ​​function in the core network can be executed alone, or it can be executed in combination with any embodiment in this application or a possible implementation method in the embodiment, or it can be executed in combination with any technical solution in the related technology.

[0114] As shown in FIG4 , the method may include but is not limited to the following steps:

[0115] Step S401: Receive an authentication and authorization request sent by an AMF network element, where the authentication and authorization request includes: a first identifier of a specified terminal device and first AI function auxiliary information.

[0116] In an embodiment of the present application, the designated terminal device may be a terminal device that needs to use the AI ​​function corresponding to the first AI function auxiliary information among at least one candidate terminal device communicating with the AMF network element.

[0117] As an example, the first identifier of the designated terminal device may be, for example, a Generic Public Subscription Identifier (GPSI) of the designated terminal device, which is used to uniquely identify the designated terminal device.

[0118] As an example, to facilitate subsequent interaction between the AAA-S network element and the designated terminal device to determine whether the designated terminal device is allowed to use the AI ​​function corresponding to the first AI function auxiliary information, the authentication and authorization request also includes: an EAP identity response of the designated terminal device, which is used to authenticate the identity of the designated terminal device. In other words, after receiving the authentication and authorization request, the AAA-S network element can carry the EAP identity response in its interaction with the designated terminal device; when the designated terminal device receives a message carrying the EAP identity response, it will receive and process the message; when it receives a message that does not carry the EAP identity response, it will ignore or not receive the message.

[0119] As an example, the process of the AAA-S network element receiving the authentication and authorization request sent by the AMF network element may be, for example, receiving the authentication and authorization request sent by the AIAAF network element, wherein the authentication and authorization request is sent by the AIAAF network element based on the AIAA authentication request received from the AMF network element; the AIAA authentication request includes: a first identifier and first AI function auxiliary information, and the first AI function auxiliary information includes: the address of the AAA-S network element, which is used to instruct the AIAAF network element to send the authentication and authorization request to the AAA-S network element according to the address. As an example, the AIAA authentication request may also include an EAP identity response of a specified terminal device.

[0120] When the Artificial Intelligence Authentication and Authorization Function (AIAAF) network element receives an AIAA authentication request, it obtains the address of the Authentication and Authorization Server (AAA-S) network element included in the first AI function auxiliary information in the AIAA authentication request, and sends an authentication and authorization request to the AAA-S network element based on the address. There can be multiple AAA-S network elements, and different AI functions may correspond to different AAA-S network elements, that is, different AI functions may require the use of different AAA-S network elements for authentication and authorization processing.

[0121] The AAA-S network element may receive an AAA Protocol message sent by the AIAAF network element, wherein the AAA Protocol message carries an authentication and authorization request.

[0122] As an example, the AAA-S network element may receive the AAA Protocol message transparently transmitted by the AIAAF network element through the Authentication and Authorization Proxy (AAA-P) network element.

[0123] Step S402: Send an authentication and authorization response to the AMF network element, where the authentication and authorization response includes: an authentication and authorization result, which is used to indicate whether the specified terminal device is allowed to use the AI ​​function corresponding to the first AI function auxiliary information.

[0124] As an example, the AAA-S network element may send a third message to the AMF network element, wherein the third message includes: an authentication and authorization result, a first identifier, and first AI function auxiliary information; so that the AMF network element determines whether the third message is an authentication and authorization response to the above-mentioned authentication and authorization request based on the first identifier and the first AI function auxiliary information.

[0125] As an example, the process of the AAA-S network element sending the third message to the AMF network element may be, for example, that the AAA-S network element sends the third message to the AIAAF network element; and the AIAAF network element sends the third message to the AMF network element.

[0126] The AAA-S network element may send an AAA Protocol message to the AIAAF network element, wherein the AAA Protocol message carries the third message.

[0127] As an example, the AAA-S network element may send the AAA Protocol message to the AIAAF network element through transparent transmission of the Authentication and Authorization Proxy (AAA-P) network element.

[0128] As an example, when the authentication and authorization result indicates that the specified terminal device is allowed to use the AI ​​function corresponding to the first AI function auxiliary information, the AAA-S network element can store the association between the first identifier, the first AI function auxiliary information and the authentication and authorization result; thereby facilitating the AAA-S network element to subsequently trigger re-authentication and re-authorization based on local policies.

[0129] In the embodiments of the present application, the AAA-S network element can communicate directly with the AMF network element to receive authentication and authorization requests and send authentication and authorization responses; it can also communicate with the AMF network element through other network devices. It should be noted that in all steps of all embodiments of the present application, the description may omit intermediate devices and only limit them to sending devices and receiving devices; however, those skilled in the art will understand that this description does not necessarily mean that the sending device must send directly to the receiving device.

[0130] In one possible implementation, the AAA-S network element may interact with the AAA-P network element, the AIAAF network element, and the AMF network element. In another possible implementation, the AAA-S network element may interact directly with the AMF network element.

[0131] In the authentication and authorization method for the AI ​​function in the core network of an embodiment of the present application, the AAA-S network element receives an authentication and authorization request sent by the AMF network element, wherein the authentication and authorization request includes: a first identifier of a specified terminal device and first AI function auxiliary information; and sends an authentication and authorization response to the AMF network element, wherein the authentication and authorization response includes: an authentication and authorization result, which is used to indicate whether the specified terminal device is allowed to use the AI ​​function corresponding to the first AI function auxiliary information; thereby realizing authentication and authorization of the AI ​​function in the core network, and facilitating the terminal device to use the service of the AI ​​function in the core network.

[0132] It should be noted that the above-mentioned possible implementation methods can be executed separately or in combination, and the embodiments of the present application are not limited to this.

[0133] Please refer to Figure 5, which is a flow chart of another authentication and authorization method for AI functions in a core network provided in an embodiment of the present application. This method can be executed by the network device in Figure 1, specifically by an AAA-S network element.

[0134] Among them, the authentication and authorization method of the AI ​​function in the core network can be executed alone, or it can be executed in combination with any embodiment in this application or a possible implementation method in the embodiment, or it can be executed in combination with any technical solution in the related technology.

[0135] As shown in FIG5 , the method may include but is not limited to the following steps:

[0136] Step S501: Receive an authentication and authorization request sent by an AMF network element, where the authentication and authorization request includes: a first identifier of a specified terminal device and first AI function auxiliary information.

[0137] Step S502: Send a fourth message to the designated terminal device, where the fourth message includes: an EAP identity authentication request, a first identifier, and first AI function auxiliary information.

[0138] In an embodiment of the present application, as an example, the AAA-S network element may directly send the fourth message to the designated terminal device. As another example, the AAA-S network element may interact with the designated terminal device through the AAA-P network element, the AIAAF network element, the AMF network element, and the designated terminal device to send the fourth message.

[0139] As an example, the process of the AAA-S network element sending the fourth message to the designated terminal device may be, for example, that the AAA-S network element sends the fourth message to the AIAAF network element through the transparent transmission of the AAA-P network element; the AIAAF network element sends the fourth message to the AMF network element; and the AMF network element sends the fourth message to the designated terminal device through the radio access network (Radio Access Network, RAN).

[0140] Step S503: Receive a fifth message returned by the designated terminal device, wherein the fifth message includes: an EAP identity authentication response, a first identifier, and first AI function auxiliary information.

[0141] In the embodiment of the present application, the EAP authentication response may be, for example, an EAP message. The EAP message may include parameters related to the auxiliary information for specifying the first AI function used by the terminal device, such as channel-related parameters, resource-related parameters, and parameters related to the hardware performance of the specified terminal device. These parameters may be selected based on actual needs and are not specifically limited herein.

[0142] As an example, the process of the AAA-S network element receiving the fifth message returned by the designated terminal device may be, for example, that the AAA-S network element receives the fifth message returned by the AIAAF network element through the transparent transmission of the AAA-P network element; wherein, the fifth message is sent by the designated terminal device to the AMF network element through the radio access network (Radio Access Network, RAN), and then sent by the AMF network element to the AIAAF network element.

[0143] Step S504: Determine, based on the EAP identity authentication response, whether the specified terminal device is allowed to use the AI ​​function corresponding to the first AI function auxiliary information.

[0144] Step S505: Send an authentication and authorization response to the AMF network element, where the authentication and authorization response includes: an authentication and authorization result, which is used to indicate whether the specified terminal device is allowed to use the AI ​​function corresponding to the first AI function auxiliary information.

[0145] In the embodiment of the present application, the authentication and authorization result may be, for example, an EAP result. When the EAP result indicates success, it indicates that the authentication and authorization are successful, i.e., the specified terminal device is allowed to use the AI ​​function corresponding to the first AI function auxiliary information. When the EAP result indicates failure, it indicates that the authentication and authorization are failed, i.e., the specified terminal device is not allowed to use the AI ​​function corresponding to the first AI function auxiliary information.

[0146] In the embodiment of the present application, step S501 and step S505 can be implemented respectively using any of the methods in the embodiments of the present application. The embodiment of the present application does not limit this and will not be repeated.

[0147] In an authentication and authorization method for an AI function in a core network of an embodiment of the present application, an AAA-S network element receives an authentication and authorization request sent by an AMF network element, wherein the authentication and authorization request includes: a first identifier of a designated terminal device and first AI function auxiliary information; sends a fourth message to the designated terminal device, wherein the fourth message includes: an EAP identity authentication request, a first identifier, and first AI function auxiliary information; receives a fifth message returned by the designated terminal device, wherein the fifth message includes: an EAP identity authentication response, a first identifier, and first AI function auxiliary information; determines whether the designated terminal device is allowed to use the AI ​​function corresponding to the first AI function auxiliary information based on the EAP identity authentication response; sends an authentication and authorization response to the AMF network element, wherein the authentication and authorization response includes: an authentication and authorization result, which is used to indicate whether the designated terminal device is allowed to use the AI ​​function corresponding to the first AI function auxiliary information; thereby realizing authentication and authorization of the AI ​​function in the core network and facilitating the terminal device to use the service of the AI ​​function in the core network.

[0148] Please refer to Figure 6, which is a flowchart of a method for authentication and authorization of AI functions in a core network provided by an embodiment of the present application. This method can be executed by the terminal device in Figure 1.

[0149] As shown in FIG6 , the method may include but is not limited to the following steps:

[0150] Step S601: Receive the first message sent by the AMF network element, wherein the first message includes: an EAP identity request and the first AI function auxiliary information. In all embodiments of the present disclosure, the terminal device can connect to the various network elements or devices of the core network in the embodiments of the present disclosure through the access network device. In some possible implementations, the terminal device may also connect to the various network elements or devices of the core network in any feasible manner, and the embodiments of the present disclosure do not make specific limitations on this. Of course, no matter what connection method is used, as long as data communication between the terminal device and the network element or device of the core network can be achieved, it can be called sending / receiving.

[0151] In an embodiment of the present application, the terminal device may be one of at least one candidate terminal device communicating with the AMF network element. That is, the at least one candidate terminal device communicating with the AMF network element may receive the first message sent by the AMF network element. The AMF network element may communicate with at least one AI function network element to determine the AI ​​function network element that requires authentication and authorization processing.

[0152] As an example, the terminal device can receive the first message sent by the AMF network element through the Radio Access Network (RAN).

[0153] The first message may be, for example, a Non Access Stratum (NAS) MM transmission message.

[0154] Step S602: Return a second message to the AMF network element, where the second message includes: the first identifier of the terminal device, the EAP identity response, and the first AI function auxiliary information; the EAP identity response is used for identity authentication of the terminal device.

[0155] In this embodiment of the present application, for the AI ​​function corresponding to the first AI function auxiliary information, if the terminal device needs to use the AI ​​function, a second message is returned to the AMF network element; if the terminal device does not need to use the AI ​​function, the second message does not need to be returned to the AMF network element. Among the at least one candidate terminal device, there may be at least one terminal device that needs to use the AI ​​function.

[0156] The EAP identity response is used for terminal device authentication, facilitating interaction between the AAA-S network element and the designated terminal device to determine whether the designated terminal device is allowed to use the AI ​​function corresponding to the first AI function auxiliary information. In other words, the AAA-S network element can carry the EAP identity response in subsequent interactions with the terminal device. Upon receiving a message carrying the EAP identity response, the designated terminal device will receive and process the message. Upon receiving a message without the EAP identity response, the designated terminal device will ignore or not receive the message.

[0157] The second message may be, for example, a Non Access Stratum (NAS) MM transmission message.

[0158] Step S603: Receive the sixth message sent by the AMF network element, where the sixth message includes: an authentication and authorization result, which is used to indicate whether the specified terminal device is allowed to use the AI ​​function corresponding to the first AI function auxiliary information.

[0159] As an example, the terminal device can receive the sixth message sent by the AMF network element through the radio access network (Radio Access Network, RAN).

[0160] In the authentication and authorization method for the AI ​​function in the core network of an embodiment of the present application, a terminal device receives a first message sent by an AMF network element, wherein the first message includes: an EAP identity request and the first AI function auxiliary information; returns a second message to the AMF network element, wherein the second message includes: a first identifier of the terminal device, an EAP identity response and the first AI function auxiliary information; the EAP identity response is used for identity authentication of the terminal device; receives a sixth message sent by the AMF network element, wherein the sixth message includes: an authentication and authorization result, which is used to indicate whether the specified terminal device is allowed to use the AI ​​function corresponding to the first AI function auxiliary information; thereby realizing authentication and authorization of the AI ​​function in the core network, and facilitating the terminal device to use the service of the AI ​​function in the core network.

[0161] It should be noted that the above-mentioned possible implementation methods can be executed separately or in combination, and the embodiments of the present application are not limited to this.

[0162] Please refer to Figure 7, which is a flow chart of another authentication and authorization method for AI functions in a core network provided in an embodiment of the present application. This method can be executed by the terminal device in Figure 1.

[0163] Among them, the authentication and authorization method of the AI ​​function in the core network can be executed alone, or it can be executed in combination with any embodiment in this application or a possible implementation method in the embodiment, or it can be executed in combination with any technical solution in the related technology.

[0164] As shown in FIG7 , the method may include but is not limited to the following steps:

[0165] Step S701: Receive a fourth message sent by an AAA-S network element, where the fourth message includes: an EAP identity authentication request, a first identifier, and first AI function auxiliary information.

[0166] In an embodiment of the present application, when a terminal device needs to use the AI ​​function corresponding to the first AI function auxiliary information and the terminal device returns a second message to the first message of the AMF network element, the terminal device may receive a fourth message sent by the AAA-S network element. The first message includes: an EAP identity request and the first AI function auxiliary information; the second message includes: a first identifier of the terminal device, an EAP identity response, and the first AI function auxiliary information; the EAP identity response is used for identity authentication of the terminal device.

[0167] In an embodiment of the present application, as an example, the terminal device may directly receive the fourth message sent by the AAA-S network element. As another example, the terminal device may interact with the AAA-S network element through the AMF network element, the AIAAF network element, and the AAA-P network element to receive the fourth message.

[0168] As an example, the process of the terminal device receiving the fourth message sent by the AAA-S network element may be, for example, that the terminal device receives the fourth message sent by the AMF network element through the radio access network (Radio Access Network, RAN); wherein the fourth message is sent by the AAA-S network element to the AIAAF network element through the transparent transmission of the AAA-P network element; and sent by the AIAAF network element to the AMF network element.

[0169] Step S702: Return a fifth message to the AAA-S network element, where the fifth message includes: an EAP identity authentication response, a first identifier, and first AI function auxiliary information; the EAP identity authentication response is used to determine whether the terminal device is allowed to use the AI ​​function corresponding to the first AI function auxiliary information.

[0170] In the embodiment of the present application, the EAP authentication response may be, for example, an EAP message. The EAP message may include parameters related to the auxiliary information for specifying the first AI function used by the terminal device, such as channel-related parameters, resource-related parameters, and parameters related to the hardware performance of the specified terminal device. These parameters may be selected based on actual needs and are not specifically limited herein.

[0171] As an example, the process of the terminal device returning the fifth message to the AAA-S network element may be, for example, that the terminal device sends the fifth message to the AMF network element through the radio access network (Radio Access Network, RAN); the AMF network element sends the fifth message to the AIAAF network element; and the AIAAF network element sends the fifth message to the AAA-S network element through the transparent transmission of the AAA-P network element.

[0172] Among them, after receiving the fifth message, the AAA-S network element can determine whether to allow the terminal device to use the AI ​​function corresponding to the first AI function auxiliary information based on the EAP identity authentication response in the fifth message.

[0173] In an authentication and authorization method for an AI function in a core network in an embodiment of the present application, a terminal device receives a fourth message sent by an AAA-S network element, wherein the fourth message includes: an EAP identity authentication request, a first identifier, and first AI function auxiliary information; and returns a fifth message to the AAA-S network element, wherein the fifth message includes: an EAP identity authentication response, a first identifier, and first AI function auxiliary information; the EAP identity authentication response is used to determine whether the terminal device is allowed to use the AI ​​function corresponding to the first AI function auxiliary information; thereby achieving authentication and authorization of the AI ​​function in the core network, facilitating the terminal device to use the service of the AI ​​function in the core network.

[0174] Please refer to Figure 8, which is an interactive flow chart of another authentication and authorization method for AI functions in the core network provided by an embodiment of the present application. As shown in Figure 8, the method may include but is not limited to the following steps:

[0175] Step S801: The AMF network element triggers the authentication and authorization process for the AI ​​function that requires authentication and authorization processing.

[0176] Step S802a: The AMF network element sends a first NAS MM transport message (NAS MM Transport) to the terminal device, which includes: an EAP identity request and first AI function assistance information.

[0177] Step S802b: The terminal device (UE) sends a second NAS MM transmission message to the AMF network element, which includes: the EAP identity response of the terminal device, the first identifier, and the first AI function auxiliary information.

[0178] Step S803: The AMF network element sends an AIAA authentication request (AIAA_Authenticate Request) to the AIAAF network element, where the AIAA authentication request includes: a first identifier and first AI function auxiliary information.

[0179] Step S804: The AIAAF network element sends a first AAA Protocol message to the AAA-P network element, which includes: an EAP identity response of the terminal device, a first identifier, and first AI function assistance information.

[0180] Step S805: The AAA-P network element sends a first AAA Protocol message to the AAA-S network element, which includes: an EAP identity response of the terminal device, a first identifier, and first AI function auxiliary information.

[0181] Step S806: The AAA-S network element interacts with the terminal device to obtain a second AAA Protocol message, which includes: an EAP authentication response (EAP message), a first identifier, and first AI function auxiliary information.

[0182] Step S807: The AAA-S network element sends a third AAA Protocol message to the AAA-P network element, which includes: an authentication and authorization result (EAP result), a first identifier, and first AI function auxiliary information.

[0183] Step S808: The AAA-P network element sends a third AAA Protocol message to the AIAAF network element, which includes: the authentication and authorization result, the first identifier, and the first AI function auxiliary information.

[0184] Step S809: The AIAAF network element sends an AIAA authentication response (AIAA_Authenticate Resp) to the AMF network element, which includes: authentication and authorization result, the first identifier, and the first AI function auxiliary information.

[0185] Step S810: The AMF network element sends a third NAS MM transmission message to the terminal device, which includes: authentication and authorization result.

[0186] In the embodiments provided above, the methods provided in the embodiments of the present application are described from the perspectives of a network device and a first terminal device, respectively. To implement the various functions of the methods provided in the embodiments of the present application, the network device and the first terminal device may include hardware structures and software modules, and the aforementioned functions may be implemented in the form of hardware structures, software modules, or a combination of hardware structures and software modules. Any of the aforementioned functions may be implemented in the form of hardware structures, software modules, or a combination of hardware structures and software modules.

[0187] Please refer to Figure 9, which is a structural diagram of an authentication and authorization device 900 for an AI function in a core network provided by an embodiment of the present application. The device is applied to an AMF network element, and the device includes: a transceiver unit 901, used to send an authentication and authorization request to an AAA-S network element, wherein the authentication and authorization request includes: a first identifier of a specified terminal device and first AI function auxiliary information; the transceiver unit 901 is also used to receive an authentication and authorization response returned by the AAA-S network element, wherein the authentication and authorization response includes: an authentication and authorization result, which is used to indicate whether the specified terminal device is allowed to use the AI ​​function corresponding to the first AI function auxiliary information.

[0188] In one embodiment, the authentication and authorization request further includes: an EAP identity response of the designated terminal device, which is used for identity authentication of the designated terminal device.

[0189] In one embodiment, the transceiver unit 901 is further used to send a first message to at least one candidate terminal device, wherein the first message includes: an EAP identity request and the first AI function auxiliary information; the at least one candidate terminal device includes the designated terminal device; and receive a second message returned by the designated terminal device, wherein the second message includes: an EAP identity response of the designated terminal device, the first identifier, and the first AI function auxiliary information.

[0190] In one implementation, the first message and the second message are NAS MM transmission messages.

[0191] In one embodiment, the transceiver unit 901 is specifically used to send an AIAA authentication request to the AIAAF network element, wherein the AIAA authentication request includes: the first identifier and the first AI function auxiliary information; wherein the first AI function auxiliary information includes: the address of the AAA-S network element, used to instruct the AIAAF network element to send the authentication authorization request to the AAA-S network element according to the address.

[0192] In one embodiment, the transceiver unit 901 is specifically used to receive a third message returned by the AAA-S network element, wherein the third message includes: the authentication and authorization result, the second identifier, and the second AI function auxiliary information; when the second identifier is consistent with the first identifier, and the second AI function auxiliary information is consistent with the first AI function auxiliary information, the third message is determined to be the authentication and authorization response.

[0193] Please refer to Figure 10, which is a structural diagram of an authentication and authorization device 1000 for another AI function in a core network provided by an embodiment of the present application. The device is applied to an AAA-S network element, and the device includes: a transceiver unit 1001, used to receive an authentication and authorization request sent by an AMF network element, wherein the authentication and authorization request includes: a first identifier of a specified terminal device and first AI function auxiliary information; the transceiver unit 1001 is also used to send an authentication and authorization response to the AMF network element, wherein the authentication and authorization response includes: an authentication and authorization result, which is used to indicate whether the specified terminal device is allowed to use the AI ​​function corresponding to the first AI function auxiliary information.

[0194] In one embodiment, the authentication and authorization request further includes: an EAP identity response of the designated terminal device, which is used for identity authentication of the designated terminal device.

[0195] In one embodiment, the transceiver unit 1001 is specifically used to receive the authentication and authorization request sent by the AIAAF network element, wherein the authentication and authorization request is sent by the AIAAF network element based on the AIAA authentication request received from the AMF network element; the AIAA authentication request includes: the first identifier and the first AI function auxiliary information, and the first AI function auxiliary information includes: the address of the AAA-S network element, used to instruct the AIAAF network element to send the authentication and authorization request to the AAA-S network element according to the address.

[0196] In one embodiment, the transceiver unit 1001 is specifically used to send a third message to the AMF network element, wherein the third message includes: the authentication and authorization result, the first identifier, and the first AI function auxiliary information.

[0197] In one embodiment, the device also includes: a processing unit 1002; the transceiver unit 1001 is further used to send a fourth message to the designated terminal device, wherein the fourth message includes: an EAP authentication request, the first identifier, and the first AI function auxiliary information; the transceiver unit 1001 is also used to receive a fifth message returned by the designated terminal device, wherein the fifth message includes: an EAP authentication response, the first identifier, and the first AI function auxiliary information; the processing unit 1002 is used to determine whether the designated terminal device is allowed to use the AI ​​function corresponding to the first AI function auxiliary information based on the EAP authentication response.

[0198] In one embodiment, the processing unit 1002 is further configured to store an association between the first identifier, the first AI function auxiliary information, and the authentication and authorization result.

[0199] Please refer to Figure 11, which is a structural diagram of another authentication and authorization device 1100 for an AI function in a core network provided by an embodiment of the present application. The device is applied to a terminal device, and the device includes: a transceiver unit 1101, used to receive a first message sent by an AMF network element, wherein the first message includes: an EAP identity request and the first AI function auxiliary information; the transceiver unit 1101 is also used to return a second message to the AMF network element, wherein the second message includes: a first identifier of the terminal device, an EAP identity response and the first AI function auxiliary information; the EAP identity response is used for the identity authentication of the terminal device; the transceiver unit 1101 is also used to receive a sixth message sent by the AMF network element, wherein the sixth message includes: an authentication and authorization result, which is used to indicate whether the specified terminal device is allowed to use the AI ​​function corresponding to the first AI function auxiliary information.

[0200] In one implementation, the first message and the second message are NAS MM transmission messages.

[0201] In one embodiment, the transceiver unit 1101 is further used to receive a fourth message sent by the AAA-S network element, wherein the fourth message includes: an EAP authentication request, the first identifier, and the first AI function auxiliary information; and return a fifth message to the AAA-S network element, wherein the fifth message includes: an EAP authentication response, the first identifier, and the first AI function auxiliary information; the EAP authentication response is used to determine whether the terminal device is allowed to use the AI ​​function corresponding to the first AI function auxiliary information.

[0202] It should be noted that the explanation of the method executed on the AMF network element side in any of the embodiments of Figures 2 to 3 above is also applicable to the authentication and authorization device 900 of the AI ​​function in the core network of this embodiment, or the explanation of the method executed on the AAA-S network element side in any of the embodiments of Figures 4 to 5 above is also applicable to the authentication and authorization device 1000 of the AI ​​function in the core network of this embodiment, or the explanation of the method executed on the terminal device side in any of the embodiments of Figures 6 to 7 above is also applicable to the authentication and authorization device 1100 of the AI ​​function in the core network of this embodiment. The implementation principles are similar and will not be repeated here.

[0203] Please refer to Figure 12, which is a schematic diagram of the structure of a communication device 1200 provided in an embodiment of the present application. Communication device 1200 can be a network device or a terminal device, or a chip, chip system, or processor that supports the network device to implement the above method. It can also be a chip, chip system, or processor that supports the terminal device to implement the above method. This device can be used to implement the method described in the above method embodiment. For details, please refer to the description of the above method embodiment.

[0204] The communication device 1200 may include one or more processors 1201. The processor 1201 may be a general-purpose processor or a dedicated processor. For example, it may be a baseband processor or a central processing unit. The baseband processor may be used to process communication protocols and communication data, and the central processing unit may be used to control the communication device (e.g., a base station, a baseband chip, a terminal device, a terminal device chip, a DU or CU, etc.), execute computer programs, and process computer program data.

[0205] Optionally, the communication device 1200 may further include one or more memories 1202, on which a computer program 1204 may be stored. The processor 1201 executes the computer program 1204 to cause the communication device 1200 to perform the method described in the above method embodiment. Optionally, the memory 1202 may also store data. The communication device 1200 and the memory 1202 may be provided separately or integrated together.

[0206] Optionally, the communication device 1200 may further include a transceiver 1205 and an antenna 1206. The transceiver 1205 may be referred to as a transceiver unit, a transceiver, or a transceiver circuit, and is configured to implement transceiver functions. The transceiver 1205 may include a receiver and a transmitter. The receiver may be referred to as a receiver or a receiving circuit, and is configured to implement a receiving function; the transmitter may be referred to as a transmitter or a transmitting circuit, and is configured to implement a transmitting function.

[0207] Optionally, the communication device 1200 may further include one or more interface circuits 1207. The interface circuit 1207 is configured to receive code instructions and transmit the code instructions to the processor 1201. The processor 1201 executes the code instructions to enable the communication device 1200 to perform the method described in the above method embodiment.

[0208] The communication device 1200 is an AMF network element: the transceiver 1205 is used to execute steps 201 to 202 in Figure 2; steps 301 to 304 in Figure 3.

[0209] The communication device 1200 is an AAA-S network element: the transceiver 1205 is configured to execute steps 401 to 402 in Figure 4 , steps 501 to 503 and step 505 in Figure 5 , and the processor 1201 is configured to execute step 504 in Figure 5 .

[0210] The communication device 1200 is a terminal device: the transceiver 1205 is used to execute steps 601 to 603 in FIG. 6 ; and steps 701 to 702 in FIG. 7 .

[0211] In one implementation, processor 1201 may include a transceiver for implementing receiving and transmitting functions. For example, the transceiver may be a transceiver circuit, an interface, or an interface circuit. The transceiver circuit, interface, or interface circuit for implementing the receiving and transmitting functions may be separate or integrated. The transceiver circuit, interface, or interface circuit may be used for reading and writing code / data, or may be used for transmitting or delivering signals.

[0212] In one implementation, processor 1201 may store a computer program 1203. Computer program 1203, when executed on processor 1201, enables communication device 1200 to perform the method described in the above method embodiment. Computer program 1203 may be embedded in processor 1201, in which case processor 1201 may be implemented by hardware.

[0213] In one implementation, the communication device 1200 may include a circuit that can implement the functions of sending, receiving, or communicating in the aforementioned method embodiments. The processor and transceiver described in this application can be implemented on an integrated circuit (IC), an analog IC, a radio frequency integrated circuit RFIC, a mixed signal IC, an application specific integrated circuit (ASIC), a printed circuit board (PCB), an electronic device, etc. The processor and transceiver can also be manufactured using various IC process technologies, such as complementary metal oxide semiconductor (CMOS), N-type metal oxide semiconductor (nMetal-oxide-semiconductor, NMOS), P-type metal oxide semiconductor (positive channel metal oxide semiconductor, PMOS), bipolar junction transistor (bipolar junction transistor, BJT), bipolar CMOS (BiCMOS), silicon germanium (SiGe), gallium arsenide (GaAs), etc.

[0214] The communication device described in the above embodiments may be a network device or a terminal device, but the scope of the communication device described in this application is not limited thereto, and the structure of the communication device may not be limited to FIG12. The communication device may be an independent device or may be part of a larger device. For example, the communication device may be:

[0215] (1) An independent integrated circuit (IC), or chip, or chip system or subsystem;

[0216] (2) a collection of one or more ICs, optionally including a storage component for storing data and computer programs;

[0217] (3) ASIC, such as modem;

[0218] (4) Modules that can be embedded in other devices;

[0219] (5) Receivers, terminal devices, intelligent terminal devices, cellular phones, wireless devices, handheld devices, mobile units, vehicle-mounted devices, network devices, cloud devices, artificial intelligence devices, etc.;

[0220] (6)Others, etc.

[0221] If the communication device can be a chip or a chip system, please refer to the schematic diagram of the chip structure shown in Figure 13. The chip shown in Figure 13 includes a processor 1301 and an interface 1302. The number of processors 1301 can be one or more, and the number of interfaces 1302 can be multiple.

[0222] Optionally, the chip further includes a memory 1303, which is used to store necessary computer programs and data.

[0223] Those skilled in the art will also appreciate that the various illustrative logical blocks and steps listed in the embodiments of the present application can be implemented by electronic hardware, computer software, or a combination of both. Whether such functions are implemented by hardware or software depends on the specific application and the design requirements of the entire system. Those skilled in the art may use various methods to implement the described functions for each specific application, but such implementation should not be construed as exceeding the scope of protection of the embodiments of the present application.

[0224] The present application also provides a readable storage medium having instructions stored thereon, which implement the functions of any of the above method embodiments when executed by a computer.

[0225] The present application also provides a computer program product, which implements the functions of any of the above method embodiments when executed by a computer.

[0226] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer programs. When the computer program is loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer program can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer program can be transmitted from one website, computer, server or data center to another website, computer, server or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a high-density digital video disc (DVD)), or a semiconductor medium (eg, a solid state disk (SSD)).

[0227] Those skilled in the art will understand that the various numerical numbers such as first and second involved in this application are only for the convenience of description and are not used to limit the scope of the embodiments of this application, and also indicate the order of precedence.

[0228] In this application, at least one can also be described as one or more, and multiple can be two, three, four or more, which is not limited in this application. In the embodiments of this application, for a technical feature, the technical features in the technical feature are distinguished by "first", "second", "third", "A", "B", "C" and "D", and there is no order of precedence or size between the technical features described by "first", "second", "third", "A", "B", "C" and "D".

[0229] The correspondences shown in the tables in this application can be configured or predefined. The values ​​of the information in each table are examples only and can be configured to other values, which are not limited by this application. When configuring the correspondence between information and parameters, it is not necessarily required to configure all the correspondences shown in each table. For example, in the tables in this application, the correspondences shown in certain rows may not be configured. For another example, appropriate deformation adjustments can be made based on the above tables, such as splitting, merging, etc. The names of the parameters shown in the titles of the above tables can also use other names that can be understood by the communication device, and the values ​​or representations of the parameters can also use other values ​​or representations that can be understood by the communication device. When implementing the above tables, other data structures can also be used, such as arrays, queues, containers, stacks, linear lists, pointers, linked lists, trees, graphs, structures, classes, heaps, hash tables or hash tables, etc.

[0230] The predefined in this application may be understood as defined, predefined, stored, pre-stored, pre-negotiated, pre-configured, solidified, or pre-burned.

[0231] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0232] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0233] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A method for authentication and authorization of AI functions in a core network, characterized in that: Applied to an AMF network element, the method includes: Sending an authentication and authorization request to the AAA-S network element, wherein the authentication and authorization request includes: a first identifier of the specified terminal device and first AI function auxiliary information; Receive an authentication and authorization response returned by the AAA-S network element, wherein the authentication and authorization response includes: an authentication and authorization result, which is used to indicate whether the designated terminal device is allowed to use the AI ​​function corresponding to the first AI function auxiliary information.

2. The method according to claim 1, characterized in that The authentication and authorization request also includes: an EAP identity response of the designated terminal device, which is used for identity authentication of the designated terminal device.

3. The method according to claim 1 or 2, characterized in that Before sending the authentication and authorization request to the AAA-S network element, the method further includes: Sending a first message to at least one candidate terminal device, wherein the first message includes: an EAP identity request and the first AI function assistance information; the at least one candidate terminal device includes the designated terminal device; Receive a second message returned by the designated terminal device, wherein the second message includes: an EAP identity response of the designated terminal device, the first identifier, and the first AI function auxiliary information.

4. The method according to claim 3, characterized in that The first message and the second message are NAS MM transmission messages.

5. The method according to claim 1, wherein The sending of the authentication and authorization request to the AAA-S network element includes: Sending an AIAA authentication request to an AIAAF network element, where the AIAA authentication request includes: the first identifier and the first AI function auxiliary information; The first AI function auxiliary information includes: the address of the AAA-S network element, which is used to instruct the AIAAF network element to send the authentication and authorization request to the AAA-S network element according to the address.

6. The method according to claim 1, characterized in that The receiving the authentication and authorization response returned by the AAA-S network element includes: Receive a third message returned by the AAA-S network element, wherein the third message includes: the authentication and authorization result, the second identifier, and the second AI function auxiliary information; When the second identifier is consistent with the first identifier, and the second AI function auxiliary information is consistent with the first AI function auxiliary information, the third message is determined to be the authentication and authorization response.

7. A method for authentication and authorization of AI functions in a core network, characterized in that: Applied to an AAA-S network element, the method includes: Receive an authentication and authorization request sent by the AMF network element, where the authentication and authorization request includes: a first identifier of a specified terminal device and first AI function auxiliary information; Send an authentication and authorization response to the AMF network element, where the authentication and authorization response includes: an authentication and authorization result, which is used to indicate whether the designated terminal device is allowed to use the AI ​​function corresponding to the first AI function auxiliary information.

8. The method according to claim 7, characterized in that The authentication and authorization request also includes: an EAP identity response of the designated terminal device, which is used for identity authentication of the designated terminal device.

9. The method according to claim 7 or 8, characterized in that The receiving the authentication and authorization request sent by the AMF network element includes: Receiving the authentication and authorization request sent by the AIAAF network element, wherein the authentication and authorization request is sent by the AIAAF network element according to the AIAA authentication request received from the AMF network element; The AIAA authentication request includes: the first identifier and the first AI function auxiliary information, and the first AI function auxiliary information includes: the address of the AAA-S network element, used to instruct the AIAAF network element to send the authentication authorization request to the AAA-S network element according to the address.

10. The method according to claim 7, characterized in that The sending of an authentication and authorization response to the AMF network element comprises: Send a third message to the AMF network element, where the third message includes: the authentication and authorization result, the first identifier, and the first AI function auxiliary information.

11. The method according to claim 7, characterized in that The method further comprises: Sending a fourth message to the designated terminal device, wherein the fourth message includes: an EAP identity authentication request, the first identifier, and the first AI function auxiliary information; Receive a fifth message returned by the designated terminal device, wherein the fifth message includes: an EAP identity authentication response, the first identifier, and the first AI function auxiliary information; Determine, according to the EAP identity authentication response, whether to allow the designated terminal device to use the AI ​​function corresponding to the first AI function auxiliary information.

12. The method according to claim 7, characterized in that The method further comprises: Store an association between the first identifier, the first AI function auxiliary information, and the authentication and authorization result.

13. A method for authentication and authorization of AI functions in a core network, characterized in that: Applied to a terminal device, the method includes: Receive a first message sent by an AMF network element, wherein the first message includes: an EAP identity request and first AI function assistance information; Return a second message to the AMF network element, where the second message includes: the first identifier of the terminal device, the EAP identity response, and the first AI function auxiliary information; the EAP identity response is used for identity authentication of the terminal device; Receive a sixth message sent by the AMF network element, wherein the sixth message includes: an authentication and authorization result, used to indicate whether the designated terminal device is allowed to use the AI ​​function corresponding to the first AI function auxiliary information.

14. The method according to claim 13, characterized in that The first message and the second message are NAS MM transmission messages.

15. The method according to claim 13, characterized in that The method further comprises: receiving a fourth message sent by the AAA-S network element, wherein the fourth message includes: an EAP identity authentication request, the first identifier, and the first AI function auxiliary information; Return a fifth message to the AAA-S network element, wherein the fifth message includes: an EAP authentication response, the first identifier, and the first AI function auxiliary information; the EAP authentication response is used to determine whether the terminal device is allowed to use the AI ​​function corresponding to the first AI function auxiliary information.

16. An authentication and authorization device for AI functions in a core network, characterized in that: Applied to an AMF network element, the device includes: A transceiver unit, configured to send an authentication and authorization request to an AAA-S network element, wherein the authentication and authorization request includes: a first identifier of a specified terminal device and first AI function auxiliary information; The transceiver unit is further configured to receive an authentication and authorization response returned by the AAA-S network element, wherein the authentication and authorization response includes: an authentication and authorization result, which is used to indicate whether the designated terminal device is allowed to use the AI ​​function corresponding to the first AI function auxiliary information.

17. An authentication and authorization device for AI functions in a core network, characterized in that: Applied to an AAA-S network element, the device includes: A transceiver unit, configured to receive an authentication and authorization request sent by an AMF network element, wherein the authentication and authorization request includes: a first identifier of a specified terminal device and first AI function auxiliary information; The transceiver unit is further used to send an authentication and authorization response to the AMF network element, wherein the authentication and authorization response includes: an authentication and authorization result, which is used to indicate whether the designated terminal device is allowed to use the AI ​​function corresponding to the first AI function auxiliary information.

18. An authentication and authorization device for AI functions in a core network, characterized in that: Applied to a terminal device, the device includes: A transceiver unit, configured to receive a first message sent by an AMF network element, wherein the first message includes: an EAP identity request and first AI function assistance information; The transceiver unit is further configured to return a second message to the AMF network element, wherein the second message includes: the first identifier of the terminal device, the EAP identity response, and the first AI function auxiliary information; the EAP identity response is used for identity authentication of the terminal device; The transceiver unit is further used to receive a sixth message sent by the AMF network element, wherein the sixth message includes: an authentication and authorization result, which is used to indicate whether the designated terminal device is allowed to use the AI ​​function corresponding to the first AI function auxiliary information.

19. A communication device, characterized in that: The device includes a processor and a memory, wherein a computer program is stored in the memory, and the processor executes the computer program stored in the memory so that the device performs the method according to any one of claims 1 to 6, or performs the method according to any one of claims 7 to 12.

20. A communication device, characterized in that: The device includes a processor and a memory, wherein a computer program is stored in the memory, and the processor executes the computer program stored in the memory to enable the device to perform the method according to any one of claims 13 to 15.

21. A communication device, characterized in that: include: processor and interface circuits; The interface circuit is used to receive code instructions and transmit them to the processor; The processor is configured to run the code instructions to execute the method according to any one of claims 1 to 6, or to execute the method according to any one of claims 7 to 12.

22. A communication device, characterized in that: include: processor and interface circuits; The interface circuit is used to receive code instructions and transmit them to the processor; The processor is configured to run the code instructions to perform the method according to any one of claims 13 to 15.

23. A computer-readable storage medium storing instructions, which, when executed, enables the method according to any one of claims 1 to 6 to be implemented, or the method according to any one of claims 7 to 12 to be implemented.

24. A computer-readable storage medium storing instructions, which, when executed, enable the method according to any one of claims 13 to 15 to be implemented.

Images