Communication method and device

Abstract

The embodiment of the invention relates to the technical field of communication, and provides a communication method and device, which are used for realizing remote access of terminal equipment to a park through an operator network without supporting non-3GPP (3rd Generation Partnership Project) access by the terminal equipment and the park, and the implementation mode is simple. In the method, a first control plane network element in a first network receives a first request from a first terminal device, and the first request is used for the first terminal device to request to access a second network; according to the first request, sending a second request to a second control plane network element in a second network, the second request being used by the first control plane network element to request to access the first terminal device to the second network; receiving a second response from the second control plane network element, wherein the second response is used for indicating that the first terminal device is allowed to access the second network through the first network; and sending a first response to the first terminal device, wherein the first response is used for indicating that the first terminal device successfully accesses the second network.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a communication method and device. Background Art

[0002] Currently, when a terminal device in a campus moves outside the campus and wants to communicate with the campus, the terminal device needs to first access the operator network and establish a packet data unit (PDU) session, and then use the PDU session to establish a tunnel with the non-3rd generation partnership project interworking function (N3IWF) device in order to register with the campus. In this solution, both the terminal device and the campus network need to support non-3GPP access, and the implementation method is relatively complicated. Summary of the invention

[0003] The embodiments of the present application provide a communication method and apparatus for enabling a terminal device to remotely access a campus through an operator network, without requiring the terminal device and the campus to support non-3GPP access, and the implementation is simple.

[0004] In a first aspect, the present application provides a communication method, which can be executed by a first control plane network element in a first network, or by a component in the first control plane network element. The first control plane network element can be, for example, an access and mobility management function network element, or a network element that is a combination of an access and mobility management function network element and a session management function network element, without limitation. In the method, the first control plane network element receives a first request from a first terminal device, the first request being used for the first terminal device to request access to a second network; according to the first request, a second request is sent to a second control plane network element in the second network, the second request being used for the first control plane network element to request access to the first terminal device to the second network; a second response is received from the second control plane network element, the second response being used to indicate that the first terminal device is allowed to access the second network through the first network; a first response is sent to the first terminal device, the first response being used to indicate that the first terminal device has successfully accessed the second network.

[0005] By adopting the above method, the first control plane network element in the first network can send a second request to the second control plane network element in the second network in response to the first request of the first terminal device, so that the first terminal device can access the second network through the first network, and the implementation method is simple. For example, the first network is an operator network, the second network is a park, and the terminal device is located outside the coverage of the park. By adopting the above method, the terminal device can remotely access the park through the operator network without the need for the terminal device and the park to support non-3GPP access technology. The implementation method is simple and can reduce the complexity of the terminal device remotely accessing the park through the operator network element.

[0006] In one possible implementation, the first request includes an identifier of the second network. Before sending the second request to the second control plane network element in the second network according to the first request, the first control plane network element may also obtain first information according to the identifier of the second network, the first information being used to indicate that at least one terminal device is allowed to communicate with the second network through the first network, and the first terminal device belongs to at least one terminal device; and, based on the first information, determining to send the second request to the second control plane network element.

[0007] Through the above implementation, the first control plane network element can determine whether to send the second request to the second control plane network element in the second network by obtaining the first information, which can reduce the problem of malicious terminal devices accessing the first network through the first network.

[0008] In one possible implementation, the first request includes an identifier of the second network. Before sending the second request to the second control plane network element in the second network according to the first request, the first control plane network element may also obtain range information of the second network according to the identifier of the second network, where the range information is used to indicate a range in which at least one terminal device is allowed to access the second network, and the first terminal device belongs to at least one terminal device; based on the range information and the location information of the first terminal device, determine to send the second request to the second control plane network element.

[0009] Through the above implementation, the first control plane network element can determine whether to send the second request to the second control plane network element in the second network by obtaining the range information of the second network. For example, the first terminal device is outside the range indicated by the range information, which means that the first request is an invalid request, and the first control plane network element can refuse the first terminal device to access the second network through the first network, that is, not send the second request to the second control plane network element. For another example, the first terminal device is within the range indicated by the range information, which means that the first request is a valid request, and the first control plane network element can send the second request to the second control plane network element.

[0010] In one possible implementation, the first control plane network element may also, before receiving a second response from the second control plane network element, restrict messages transmitted between the first terminal device and the second network through the first network based on restriction information, wherein the restriction information includes one or more of the following: the type of messages allowed to be transmitted between the first terminal device and the second network through the first network, the number of messages allowed to be transmitted between the first terminal device and the second network through the first network, or the duration allowed for the first terminal device and the second network to communicate through the first network; after receiving the second response, canceling the restriction on messages transmitted between the first terminal device and the second network through the first network.

[0011] Through the above-mentioned implementation method, before the first control plane network element receives the authorization indication from the second network element to the first terminal device (i.e., an indication to allow the first terminal device to access the second network through the first network), it indicates to allow the first terminal device to pass, and can restrict the messages transmitted between the first network and the second network by the first terminal device through the restriction information, thereby reducing problems such as waste of network resources caused by malicious terminal devices accessing the second network through the first network.

[0012] In a possible implementation, before sending the second request to the second control plane network element in the second network according to the first request, the first control plane network element may also establish a secure connection with the second control plane network element, and the secure connection is used for message transmission between the first control plane network element and the second control plane network element. For example, a security gateway in the first network establishes the secure connection with a security gateway in the second network. Afterwards, the first control plane network element and the second control plane network element may be transmitted through the secure connection.

[0013] In a possible implementation, the first control plane network element can also obtain a first quantity, where the first quantity is the total number of terminal devices that access the second network through the first network; based on the first quantity and the second information, determine that the first terminal device is allowed to access the second network through the first network, and the second information includes the maximum number of terminal devices allowed to access the second network through the first network.

[0014] Through the above implementation, the first control plane network element can determine whether to allow the first terminal device to access the second network through the first network through the first number and the second information. For example, if the first number is greater than the maximum number, the first control plane network element can determine to deny the first terminal device from accessing the second network through the first network. For another example, if the first number is less than or equal to the maximum number, the first control plane network element can determine to allow the first terminal device to access the second network through the first network.

[0015] In a possible implementation, the first control plane network element may further add 1 to the first number. For example, the first number is maintained by the first control plane network element, and if the first control plane network element determines that the first terminal device is allowed to access the second network through the first network, the first control plane network element may add 1 to the first number to update the total number of terminal devices accessing the second network through the first network.

[0016] In a possible implementation, the first control plane network element may also receive a first key from a second control plane network element, the first key being used for secure transmission between the first terminal device and the first network; determine a second key based on the first key, the second key being used for secure transmission between the first terminal device and a first access network element of the first network, the first terminal device accessing through the first access network element; and send the second key to the first access network element. This implementation may achieve secure transmission between the first terminal device and the first access network element.

[0017] In a possible implementation, the first control plane network element may also determine a third key based on the first key, the third key being used to perform security protection on non-access layer NAS messages transmitted between the first control plane network element and the first terminal device; and send third information to the first terminal device, the third information being used to instruct the first terminal device to start performing security protection on NAS messages transmitted between the first control plane network element and the first terminal device. This implementation may implement security protection on NAS messages transmitted between the first control plane network element and the first terminal device.

[0018] In a possible implementation, the first control plane network element may further obtain fourth information, the fourth information including one or more of the following: the number of terminal devices accessing the second network through the first network, the number of messages transmitted between the first terminal device through the first network and the second network, or the traffic consumed by the messages transmitted between the first terminal device through the first network and the second network; and send the fourth information to the billing system. This implementation may enable the billing system to charge for the service of the first terminal device accessing the second network through the first network.

[0019] In a possible implementation, after the first terminal device accesses the second network through the first network, the first control plane network element may also receive a third request from the first terminal device, where the third request is used to request establishment of a first session from the first terminal device to the second network; based on the third request, send a fourth request to a fourth control plane network element in the second network, where the fourth request is used to request establishment of the first session, and the fourth request includes endpoint information of the first user plane network element in the first network; receive a fourth response from the fourth control plane network element, where the fourth response includes endpoint information of the second user plane network element in the second network; and send a third response to the first terminal device, where the third response is used to indicate that the first session is successfully established.

[0020] Through the above implementation, after the first terminal device accesses the second network through the first network, a first session can be established between the first terminal device and the second network through the first network.

[0021] In one possible implementation, before sending the third response to the first terminal device, the first control plane network element may also obtain the contract information of the second network, the contract information including one or more of the following: maximum bandwidth, scheduling priority, preemption priority, or quality of service QoS level; receive the first QoS parameter corresponding to the first session from the fourth control plane network element; and determine, based on the contract information, whether to allow the establishment of the first session based on the first QoS parameter.

[0022] Through the above implementation, the first control plane network element can verify the first QoS parameter from the fourth control plane network element based on the subscription information of the second network to determine whether to allow the first session to be established according to the first QoS parameter.

[0023] In a possible implementation manner, the first control plane network element may further select a second user plane network element according to the third request; and obtain endpoint information of the second user plane network element.

[0024] In a second aspect, the present application provides a communication method, which can be executed by a second control plane network element in a second network, or by a component in the second control plane network element. The first control plane network element can be, for example, an access and mobility management function network element, or a combined network element of an access and mobility management function network element and a session management function network element, without limitation. In the method, the second control plane network element receives a second request from the first control plane network element in the first network, the second request is used for the first control plane network element to request that the first terminal device be connected to the second network; according to the second request, a second response is sent to the first control plane network element, the second response is used to indicate that the first terminal device is allowed to access the second network through the first network.

[0025] By adopting the above method, the second control plane network element in the second network responds to the second request of the first control plane network element in the first network, and sends a second response to the first control plane network element to indicate that the first terminal device is allowed to access the second network through the first network, so that the first terminal device can access the second network through the first network, and the implementation method is simple. For example, the first network is an operator network, the second network is a park, and the terminal device is located outside the coverage of the park. By adopting the above method, the terminal device can remotely access the park through the operator network without the need for the terminal device and the park to support non-3GPP access technology. The implementation method is simple and can reduce the complexity of the terminal device remotely accessing the park through the operator network element.

[0026] In one possible implementation, before sending a second response to the first control plane network element based on the second request, the second control plane network element may also obtain a second quantity, where the second quantity is the total number of terminal devices that access the second network through the first network; based on the second quantity and the second information, determine that the first terminal device is allowed to access the second network through the first network, and the second information includes the maximum number of terminal devices allowed to access the second network through the first network.

[0027] In a possible implementation, the second control plane network element may further add 1 to the second number. For example, the second number is maintained by the second control plane network element, and if the second control plane network element determines that the first terminal device is allowed to access the second network through the first network, the second control plane network element may add 1 to the first number to update the total number of terminal devices accessing the second network through the first network.

[0028] In a possible implementation, before sending the second response to the first control plane network element according to the second request, the second control plane network element may also authenticate and authorize the first terminal device. For example, the second control plane network element may interact with the first terminal device through the first control plane network element to authenticate and authorize the first terminal device.

[0029] In a possible implementation manner, the second control plane network element may also establish a secure connection with the first control plane network element, and the secure connection is used for message transmission between the first control plane network element and the second control plane network element.

[0030] In a possible implementation, the second control plane network element may further allocate a first key to the first control plane network element, where the first key is used for secure transmission between the first terminal device and the first network; and send the first key to the first control plane network element.

[0031] In one possible implementation, after the first terminal device accesses the second network through the first network, the second control plane network element may also receive a fourth request from the first control plane network element, where the fourth request is used to request establishment of a first session from the first terminal device to the second network, and the fourth request includes endpoint information of the first user plane network element in the first network; based on the fourth request, a fourth response is sent to the first control plane network element, and the fourth response includes endpoint information of the second user plane network element in the second network.

[0032] In one possible implementation, the second control plane network element can also obtain the contract information of the first terminal device, the contract information including one or more of the following: maximum bandwidth, scheduling priority, preemption priority, or quality of service QoS level; determine the first QoS parameter corresponding to the first session based on the contract information; and send the first QoS parameter to the first control plane network element.

[0033] In a possible implementation manner, the second control plane network element may further select a second user plane network element according to the fourth request; and obtain endpoint information of the second user plane network element.

[0034] For the beneficial effects of any possible implementation of the second aspect, please refer to the beneficial effects of any possible implementation of the first aspect, and no further details will be given.

[0035] In a third aspect, the present application provides a communication method, which can be executed by a first terminal device, or by a component in the first terminal device. In the method, the first terminal device sends a first request to a first control plane network element in the first network, the first request includes an identifier of the second network, and the first request is used by the first terminal device to request access to the second network; and receives a first response from the first control plane network element, the first response is used to indicate that the first terminal device has successfully accessed the second network.

[0036] By adopting the above method, the first terminal device carries the identifier of the second network in the first request sent to the first control plane network element in the first network, so that the first control plane network element determines that the first terminal device requests to access the second network instead of requesting to access the first network based on the identifier of the second network, thereby enabling the first terminal device to access the second network through the first network, and the implementation method is simple. For example, the first network is an operator network, the second network is a park, and the terminal device is located outside the coverage of the park. By adopting the above method, the terminal device can remotely access the park through the operator network without the need for the terminal device and the park to support non-3GPP access technology. The implementation method is simple and can reduce the complexity of the terminal device remotely accessing the park through the operator network element.

[0037] In a possible implementation, the first terminal device may also generate a fourth key, which is a key generated after the first terminal device successfully authenticates the second network; determine a fifth key and / or a sixth key based on the fourth key, wherein the fifth key is used for secure transmission between the first terminal device and a first access network element of the first network, and the first terminal device accesses through the first access network element, and the sixth key is used for security protection of non-access layer NAS messages transmitted between the first control plane network element and the first terminal device.

[0038] In a possible implementation, the first terminal device may also receive third information from the first control plane network element, where the third information is used to instruct the first terminal device to initiate security protection of NAS messages transmitted between the first control plane network element and the first terminal device; in response to the third information, start using the sixth key to perform security protection on NAS messages between the first control plane network element and the first terminal device.

[0039] In one possible implementation, the first terminal device may also send a third request to the first control plane network element after receiving the first response from the first control plane network element, where the third request is used to request establishment of a first session from the first terminal device to the second network; and receive a fourth response from the first control plane network element, where the third response is used to indicate that the first session is successfully established.

[0040] For the beneficial effects of any possible implementation of the third aspect, please refer to the beneficial effects of any possible implementation of the first aspect, and no further details will be given.

[0041] In a fourth aspect, the present application provides a communication method, which can be executed by a third control plane network element in the first network, or by a component in the third control plane network element. The third control plane network element can be, for example, a session management function network element, or a combined network element of an access and mobility management function network element and a session management function network element, without limitation. In the method, the third control plane network element receives a fifth request from a fourth control plane network element in the second network, the fifth request is used to request the establishment of a second session from a second terminal device to the first network, the second terminal device is a terminal device that has been registered with the second network, the fifth request includes a first identifier, the first identifier is used to indicate a third quality of service QoS parameter assigned by the second network to the second session; the second QoS parameter is determined according to the first identifier, the second QoS parameter is the QoS parameter used when establishing the second session; and a fifth response is sent to the fourth control plane network element, the fifth response includes the second QoS parameter.

[0042] By adopting the above method, the third control plane network element in the first network responds to the fifth request of the fourth control plane network element in the second network, determines the second QoS parameter for establishing the second session from the second terminal device to the first network, and sends the second QoS parameter to the fourth control plane network element, so as to achieve the establishment of the second session from the second terminal device to the first network, thereby achieving the second terminal device in the second network accessing the service of the first network through the second network, and the implementation method is simple. For example, the first network is an operator network, and the second network is a park. By adopting the above method, the terminal device in the park can access the operator network through the park, without the need for the terminal device and the operator network to support non-3GPP access technology. The implementation method is simple and can reduce the complexity of the terminal device accessing the operator network through the park.

[0043] In a possible implementation, the fifth request also includes an identifier of the second network, and the third control plane network element determines the second QoS parameter corresponding to the second session according to the first identifier: the third control plane network element obtains the third QoS parameter according to the identifier of the second network and the first identifier; and determines the second QoS parameter according to the third QoS parameter. Through this implementation, the third control plane network element can determine the second QoS parameter according to the identifier of the second network and the first identifier.

[0044] In a possible implementation, the third control plane network element determines the second QoS parameter corresponding to the second session according to the first identifier by: the third control plane network element sends fifth information to the first policy control network element in the first network, the fifth information includes the identifier of the second network and the first identifier, and the fifth information is used by the first policy control network element to determine policy control and billing information for the second session; receives policy control and billing information from the first policy control network element; and determines the second QoS parameter according to the policy control and billing information. Through this implementation, the third control plane network element can determine the second QoS parameter according to the policy control and billing information.

[0045] In a possible implementation, the QoS parameter includes one or more of the following: maximum bandwidth, scheduling priority, preemption priority, or QoS level.

[0046] In a possible implementation manner, the first identifier is an identifier of a QoS profile subscribed by the second network in the first network, and the QoS profile includes a third QoS parameter.

[0047] In a fifth aspect, the present application provides a communication method, which can be executed by a fourth control plane network element in the second network, or by a component in the fourth control plane network element. The fourth control plane network element can be, for example, a session management function network element, or a network element that is a combination of an access and mobility management function network element and a session management function network element, without limitation. In the method, the fourth control plane network element receives a sixth request from a second terminal device, the sixth request is used to request the establishment of a second session from the second terminal device to the first network, and the second terminal device is a terminal device that has been registered with the second network; according to the sixth request, a fifth request is sent to a third control plane network element in the first network, the fifth request is used for the fourth control plane network element to request the establishment of a second session, the fifth request includes a first identifier, and the first identifier is used to indicate a third quality of service QoS parameter assigned by the second network to the second session; a fifth response is received from the third control plane network element, the fifth response includes a second QoS parameter, and the second QoS parameter is a QoS parameter used when establishing the second session; a sixth response is sent to the second terminal device, and the sixth response is used to indicate that the second session is successfully established.

[0048] By adopting the above method, the fourth control plane network element in the second network sends a fifth request to the fourth control plane network element in the first network in response to the sixth request of the second terminal device, so that the fourth control plane network element determines the second QoS parameter for establishing the second session from the second terminal device to the first network, and sends the second QoS parameter to the fourth control plane network element, which can realize the establishment of the second session from the second terminal device to the first network, thereby realizing the second terminal device in the second network accessing the service of the first network through the second network, and the implementation method is simple. For example, the first network is an operator network, and the second network is a park. By adopting the above method, the terminal devices in the park can access the operator network through the park, without the need for the terminal device and the operator network to support non-3GPP access technology. The implementation method is simple and can reduce the complexity of the terminal device accessing the operator network through the park.

[0049] In a possible implementation, before sending the fifth request to the third control plane network element in the first network according to the sixth request, the fourth control plane network element may also obtain sixth information, where the sixth information is used to indicate that the second terminal device is allowed to communicate with the first network through the second network; and determine to send the fifth request to the third control plane network element according to the sixth information. Through this implementation, the fourth control plane network element may determine whether to send the fifth request to the third control plane network element in the first network according to the sixth information.

[0050] In a possible implementation, the sixth request includes a second identifier, and the second identifier is used to indicate a fourth QoS parameter requested by the second terminal device; before sending the fifth request to the third control plane network element in the first network, the fourth control plane network element may also determine the first identifier based on the second identifier. With this implementation, the fourth control plane network element may consider the second identifier from the second terminal device when determining the first identifier.

[0051] In a possible implementation, before sending the fifth request to the third control plane network element in the first network, the fourth control plane network element may also obtain the subscription information of the second terminal device, where the subscription information includes at least one identifier, and each identifier in the at least one identifier is used to indicate the QoS parameter subscribed by the second terminal device; and determine the first identifier from the at least one identifier. Through this implementation, the fourth control plane network element may determine the first identifier according to the subscription information of the second terminal device in the second network.

[0052] In a possible implementation, the QoS parameter includes one or more of the following: maximum bandwidth, scheduling priority, preemption priority, or QoS level.

[0053] In a sixth aspect, the present application provides a communication method, which can be executed by a third control plane network element in a first network, or by a component in the third control plane network element. The third control plane network element can be, for example, a session management function network element, or a network element that is a combination of an access and mobility management function network element and a session management function network element, without limitation. In the method, the third control plane network element receives a third request from a first terminal device, the third request is used to request the establishment of a first session from the first terminal device to the second network, the first terminal device is a terminal device that has been registered with the second network through the first network; according to the third request, a fourth request is sent to a fourth control plane network element in the second network, the fourth request is used for the third control plane network element to request the establishment of the first session, the fourth request includes the endpoint information of the first user plane network element in the first network; a fourth response is received from the third control plane network element, the fourth response includes the endpoint information of the second user plane network element in the second network; a third response is sent to the first terminal device, the third response is used to indicate that the first session is successfully established.

[0054] In one possible implementation, before sending a third response to the first terminal device, the third control plane network element may also obtain contract information of the second network, the contract information including one or more of the following: maximum bandwidth, scheduling priority, preemption priority, or QoS level; receive a first QoS parameter corresponding to the first session from the fourth control plane network element; and determine, based on the contract information, whether to allow establishment of the first session based on the first QoS parameter.

[0055] In one possible implementation, before receiving the third request from the first terminal device, the third control plane network element may also receive a first request from the first terminal device, where the first request is used for the first terminal device to request access to the second network; based on the first request, send a second request to the second control plane network element in the second network, where the second request is used for the first control plane network element to request access to the first terminal device to the second network; receive a second response from the second control plane network element, where the second response is used to indicate that the first terminal device is allowed to access the second network through the first network; and send a first response to the first terminal device, where the first response is used to indicate that the first terminal device has successfully accessed the second network.

[0056] In one possible implementation, the first request includes an identifier of the second network. Before sending the second request to the second control plane network element in the second network according to the first request, the third control plane network element may also obtain first information according to the identifier of the second network, where the first information is used to indicate that at least one terminal device is allowed to communicate with the second network through the first network, and the first terminal device belongs to at least one terminal device; based on the first information, determine to send the second request to the second control plane network element.

[0057] In one possible implementation, the first request includes an identifier of the second network. Before sending the second request to the second control plane network element in the second network according to the first request, the third control plane network element may also obtain range information of the second network according to the identifier of the second network, where the range information is used to indicate a range in which at least one terminal device is allowed to access the second network, and the first terminal device belongs to at least one terminal device; based on the range information and the location information of the first terminal device, determine to send the second request to the second control plane network element.

[0058] In one possible implementation, the third control plane network element may also, before receiving the second response from the second control plane network element, restrict messages transmitted between the first terminal device and the second network through the first network based on restriction information, wherein the restriction information includes one or more of the following: the type of messages allowed to be transmitted between the first terminal device and the second network through the first network, the number of messages allowed to be transmitted between the first terminal device and the second network through the first network, or the duration allowed for the first terminal device and the second network to communicate through the first network; after receiving the second response, cancel the restriction on messages transmitted between the first terminal device and the second network through the first network.

[0059] In one possible implementation, before sending the second request to the second control plane network element in the second network according to the first request, the third control plane network element may also establish a secure connection with the second control plane network element, and the secure connection is used for message transmission between the first control plane network element and the second control plane network element.

[0060] In a possible implementation, the third control plane network element can also obtain a first quantity, where the first quantity is the total number of terminal devices that access the second network through the first network; based on the first quantity and the second information, determine that the first terminal device is allowed to access the second network through the first network, and the second information includes the maximum number of terminal devices allowed to access the second network through the first network.

[0061] In a possible implementation manner, the third control plane network element may further add 1 to the first number.

[0062] In a possible implementation, the third control plane network element can also receive a first key from the second control plane network element, where the first key is used for secure transmission between the first terminal device and the first network; determine a second key based on the first key, where the second key is used for secure transmission between the first terminal device and an access network element of the first network, and the first terminal device accesses the access network element through the access network element; and send the second key to the access network element.

[0063] In a possible implementation, the third control plane network element can also determine a third key based on the first key, and the third key is used to securely protect NAS messages between the first control plane network element and the first terminal device; and send third information to the first terminal device, and the third information is used to instruct the first terminal device to start security protection of NAS messages between the first control plane network element and the first terminal device.

[0064] In a possible implementation, the third control plane network element can also obtain fourth information, and the fourth information includes one or more of the following: the number of terminal devices accessing the second network through the first network, the number of messages transmitted by the first terminal device between the first network and the second network, or the traffic consumed by the messages transmitted by the first terminal device between the first network and the second network; and send the fourth information to the billing system.

[0065] For the beneficial effects of the sixth aspect and any possible implementation thereof, please refer to the beneficial effects of the first aspect and any possible implementation thereof, and no further details will be given.

[0066] In a seventh aspect, the present application provides a communication method, which can be executed by a fourth control plane network element in the second network, or by a component in the fourth control plane network element. The fourth control plane network element can be, for example, a session management function network element, or a combined network element of an access and mobility management function network element and a session management function network element, without limitation. In the method, the fourth control plane network element receives a fourth request from a third control plane network element in the first network, the fourth request is used to request the establishment of a first session from a first terminal device to a second network, the first terminal device is a terminal device that has been registered with the second network through the first network, and the fourth request includes the endpoint information of the first user plane network element in the first network; according to the fourth request, a fourth response is sent to the first control plane network element, and the fourth response includes the endpoint information of the second user plane network element in the second network.

[0067] In one possible implementation, the fourth control plane network element can also obtain the contract information of the first terminal device, the contract information including one or more of the following: maximum bandwidth, scheduling priority, preemption priority, or QoS level; determine the first QoS parameter corresponding to the first session based on the contract information; and send the first QoS parameter to the first control plane network element.

[0068] In one possible implementation, before receiving a fourth request from a first control plane network element in the first network, the fourth control plane network element may also receive a second request from the first control plane network element, the second request being used by the first control plane network element to request that the first terminal device access the second network; based on the second request, a second response is sent to the first control plane network element, the second response being used to indicate that the first terminal device is allowed to access the second network through the first network.

[0069] In one possible implementation, before sending a second response to the first control plane network element based on the second request, the fourth control plane network element may also obtain a second quantity, where the second quantity is the total number of terminal devices that access the second network through the first network; based on the second quantity and the second information, determine that the first terminal device is allowed to access the second network through the first network, and the second information includes the maximum number of terminal devices allowed to access the second network through the first network.

[0070] In a possible implementation manner, the fourth control plane network element may further add 1 to the second number.

[0071] In a possible implementation, before sending the second response to the first control plane network element according to the second request, the fourth control plane network element may also authenticate and authorize the first terminal device.

[0072] In a possible implementation manner, the fourth control plane network element may also establish a secure connection with the first control plane network element, and the secure connection is used for message transmission between the first control plane network element and the second control plane network element.

[0073] In a possible implementation, the fourth control plane network element may further allocate a first key to the first control plane network element, where the first key is used for secure transmission between the first terminal device and the first network; and send the first key to the first control plane network element.

[0074] For the beneficial effects of the seventh aspect and any possible implementation thereof, please refer to the beneficial effects of the second aspect and any possible implementation thereof, and no further details will be given.

[0075] In an eighth aspect, an embodiment of the present application provides a communication device. The communication device is used to execute the method in any one of the first to seventh aspects above and any possible implementation thereof. The communication device is, for example, a first control plane network element (or a second control plane network element, or a first terminal device, or a third control plane network element, or a fourth control plane network element), or a functional module in the first control plane network element (or a second control plane network element, or a first terminal device, or a third control plane network element, or a fourth control plane network element), such as a baseband device or a chip system. In one possible implementation, the communication device includes a baseband device and a radio frequency device.

[0076] In another possible implementation, the communication device includes a processing unit (sometimes also referred to as a processing module) and a transceiver unit (sometimes also referred to as a transceiver module). The transceiver unit can implement a sending function and a receiving function. When the transceiver unit implements the sending function, it can be called a sending unit (sometimes also referred to as a sending module), and when the transceiver unit implements the receiving function, it can be called a receiving unit (sometimes also referred to as a receiving module). The sending unit and the receiving unit can be the same functional unit, which is called a transceiver unit, and the functional unit can implement the sending function and the receiving function; or, the sending unit and the receiving unit can be different functional units, and the transceiver unit is a general term for these functional units.

[0077] In the ninth aspect, an embodiment of the present application further provides a communication device. The communication device may include one or more processors. Optionally, the communication device may also include a memory. The memory is used to store one or more computer programs or instructions. The one or more processors are used to execute the one or more computer programs or instructions stored in the memory, so that the communication device performs the method described in the first aspect and any possible implementation thereof, or performs the method described in the second aspect and any possible implementation thereof, or performs the method described in the third aspect and any possible implementation thereof, or performs the method described in the fourth aspect and any possible implementation thereof, or performs the method described in the fifth aspect and any possible implementation thereof, or performs the method described in the sixth aspect and any possible implementation thereof, or performs the method described in the seventh aspect and any possible implementation thereof.

[0078] In a tenth aspect, an embodiment of the present application further provides a communication system. The communication system includes one or more of the following: a first control plane network element, a second control plane network element, or a first terminal device. The first control plane network element is used to execute the method described in the first aspect and any possible implementation thereof, the second control plane network element is used to execute the method described in the second aspect and any possible implementation thereof, and the first terminal device is used to execute the method described in the first aspect and any possible implementation thereof.

[0079] In the eleventh aspect, an embodiment of the present application further provides a communication system. The communication system includes one or more of the following: a third control plane network element, or a fourth control plane network element. The third control plane network element is used to execute the method described in the fourth aspect and any possible implementation thereof, and the fourth control plane network element is used to execute the method described in the fifth aspect and any possible implementation thereof; or, the third control plane network element is used to execute the method described in the sixth aspect and any possible implementation thereof, and the fourth control plane network element is used to execute the method described in the seventh aspect and any possible implementation thereof.

[0080] In the twelfth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store a computer program or instruction, which, when executed, enables the method described in the first aspect and any possible implementation thereof to be implemented, or enables the method described in the second aspect and any possible implementation thereof to be implemented, or enables the method described in the third aspect and any possible implementation thereof to be implemented, or enables the method described in the fourth aspect and any possible implementation thereof to be implemented, or enables the method described in the fifth aspect and any possible implementation thereof to be implemented, or enables the method described in the sixth aspect and any possible implementation thereof to be implemented, or enables the method described in the seventh aspect and any possible implementation thereof to be implemented.

[0081] In the thirteenth aspect, the embodiments of the present application also provide a computer program product comprising instructions, which, when executed on a computer, enables the method described in the first aspect and any possible implementation thereof to be implemented, or enables the method described in the second aspect and any possible implementation thereof to be implemented, or enables the method described in the third aspect and any possible implementation thereof to be implemented, or enables the method described in the fourth aspect and any possible implementation thereof to be implemented, or enables the method described in the fifth aspect and any possible implementation thereof to be implemented, or enables the method described in the sixth aspect and any possible implementation thereof to be implemented, or enables the method described in the seventh aspect and any possible implementation thereof to be implemented.

[0082] In the fourteenth aspect, an embodiment of the present application also provides a chip, which is coupled to a memory and is used to read and execute program instructions in the memory, so that the device where the chip is located implements the method described in the first aspect and any possible implementation thereof, or implements the method described in the second aspect and any possible implementation thereof, or implements the method described in the third aspect and any possible implementation thereof, or implements the method described in the fourth aspect and any possible implementation thereof, or implements the method described in the fifth aspect and any possible implementation thereof, or implements the method described in the sixth aspect and any possible implementation thereof, or implements the method described in the seventh aspect and any possible implementation thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0083] Figure 1 A schematic diagram of a network architecture of a communication system;

[0084] Figure 2 A network architecture diagram for interconnection between a park and a carrier network;

[0085] Figure 3 A schematic diagram of the architecture of a communication system provided in an embodiment of the present application;

[0086] Figure 4 A schematic diagram of a flow chart of a first communication method provided in an embodiment of the present application;

[0087] Figure 5 A schematic diagram of another flow chart of the first communication method provided in an embodiment of the present application;

[0088] Figure 6 A schematic diagram of a flow chart of a second communication method provided in an embodiment of the present application;

[0089] Figure 7 A further flow chart of the second communication method provided in the embodiment of the present application;

[0090] Figure 8 A schematic diagram of a flow chart of a third communication method provided in an embodiment of the present application;

[0091] Fig. 9 A further flow chart of the third communication method provided in the embodiment of the present application;

[0092] Fig.10 A schematic diagram of the structure of a communication device provided in an embodiment of the present application;

[0093] Fig.11 A schematic diagram of the structure of another communication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0094] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the embodiments of the present application will be further described in detail below with reference to the accompanying drawings.

[0095] The network architecture and business scenarios described in this application are intended to more clearly illustrate the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. A person of ordinary skill in the art can appreciate that with the evolution of the network architecture and the emergence of new business scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0096] In the embodiments of the present application, "multiple" may refer to two or more than two. In view of this, in the embodiments of the present application, "multiple" may also be understood as "at least two". "At least one" may be understood as one or more, for example, one, two or more. For example, "including at least one" means including one, two or more. For example, including at least one of A, B and C, then A, B, C, A and B, A and C, B and C, or A, B and C may be included. "And / or" describes the association relationship of associated objects. Specifically, there may be three relationships. For example, A and / or B may represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / ", unless otherwise specified, generally indicates that the previously associated objects are in an "or" relationship.

[0097] In addition, the terms "system" and "network" in the embodiments of the present application may be used interchangeably, and "according to" and "based on" may be used interchangeably.

[0098] The ordinal numbers such as "first" and "second" mentioned in the embodiments of the present application are generally used to distinguish different objects, and are not used to limit the order, timing, priority or importance of multiple objects. For example, the first network and the second network in the embodiments of the present application are used to distinguish two networks, and do not limit the priority or importance of the two networks.

[0099] The embodiments of the present application will be presented around a system including multiple devices, components, modules, etc. It should be understood that the system may include other devices, components, modules, etc. not mentioned, or may only include some of the devices, components, or modules, etc. mentioned in the embodiments.

[0100] The following first introduces a communication system to which the embodiments of the present application are applicable.

[0101] The technical solutions of the embodiments of the present application can be applied to various communication systems, for example, universal mobile telecommunications system (UMTS), wireless local area network (WLAN), short-range wireless communication system (such as sidelink, wireless fidelity (Wi-Fi), Bluetooth and other systems), wired network, vehicle to everything (V2X) communication system, device-to-device (D2D) communication system, Internet of Vehicles communication system, third generation (3G) communication system, fourth generation (4G) mobile communication system (such as long term evolution (LTE) system), LTE frequency division duplex (FDD) system, LTE time division duplex (TDD) system, worldwide interoperability for microwave access (WiMAX) communication system, fifth generation (5G) mobile communication system (such as new radio (NR) system), future communication system (such as sixth generation (6G) system). generation, 6G) mobile communication system), or other similar communication systems, etc., without limitation. Figure 1 The communication system shown is described as an example. When the technical solutions of the embodiments of the present application are applied to other communication systems, the devices, components, modules, etc. in the embodiments can be replaced with corresponding devices, components, modules in other communication systems without limitation.

[0102] Figure 1 A network architecture for a 5G communication system based on a service-oriented architecture is provided, and the network architecture may include user equipment (UE) and an operator network part. The network architecture may also include a data network (DN) and / or an application function (AF) network element. The operator network may also be referred to as a general network, a public network, a public data network, or a public land mobile network (PLMN), etc., without limitation.

[0103] UE, also known as terminal device, or terminal, is a device with wireless transceiver function, which can be deployed on land, including indoors or outdoors, handheld or vehicle-mounted; it can also be deployed on the water (such as ships); it can also be deployed in the air (such as airplanes, balloons and satellites). Specifically, UE can be a mobile phone, a tablet computer, a computer with wireless transceiver function, a virtual reality (VR) terminal, an augmented reality (AR) terminal, a wireless terminal in industrial control, a wireless terminal in self-driving, a wireless terminal in remote medical, a wireless terminal in smart grid, a wireless terminal in transportation safety, a wireless terminal in smart city, a wireless terminal in smart home, a terminal device in the Internet of Things (IOT) (such as a terminal device in a smart factory, a terminal device in the smart manufacturing industry, etc.), a terminal device supporting sparklink short-range communication technology, etc.

[0104] The operator network may include, but is not limited to, one or more of the following network elements: network storage function network element, access management function network element, policy control function network element, unified data management network element, session management function network element, user plane function network element, and access network (AN). In the above operator network, the part other than the access network part may be referred to as the core network (CN) part. In a possible implementation method, the operator network may also include an AF.

[0105] The above-mentioned terminal device can establish a connection with the operator network through the interface provided by the operator network (such as N1, etc.), and use the data and / or voice services provided by the operator network. The terminal device can also access the DN through the operator network, use the operator services deployed on the DN, and / or services provided by a third party. Among them, the above-mentioned third party may be a service provider other than the operator network and the terminal device, and can provide data and / or voice services to the terminal device. Among them, the specific form of expression of the above-mentioned third party can be determined according to the actual application scenario, and is not limited here.

[0106] The core network elements can be divided into control plane elements and user plane elements. The control plane elements are, for example, access management function elements, unified data management elements, session management function elements, policy control function elements, or network storage function elements. The user plane elements are, for example, user plane function elements. The following introduces some of the network elements in the core network.

[0107] The access management function network element is responsible for the access control and mobility management of terminal devices accessing the operator's network, such as mobile state management, allocation of user temporary identity, authentication and authorization, etc. In the 5G communication system, the access management function network element can be the access and mobility management function (AMF) network element. In future communication systems, the access management function network element can also have other names, without limitation.

[0108] The unified data management network element is responsible for generating authentication credentials, user identification processing (such as storing and managing user permanent identities, etc.), contract data management, etc. In the 5G communication system, the unified data management network element can be a unified data management (UDM) network element. In future communication systems, the unified data management network element can also have other names without limitation.

[0109] The session management function network element is mainly responsible for session management in the mobile network, such as session establishment, modification, or release. The session management function network element can also allocate Internet Protocol (IP) addresses to users, select user plane function network elements that provide message forwarding functions, etc. In the 5G communication system, the session management function network element can be a session management function (SMF) network element. In future communication systems, the session management function network element can also have other names, which are not limited.

[0110] The policy control function network element mainly provides policy rules and is responsible for obtaining user subscription information related to policy decisions. In the 4G communication system, the policy control function network element can be a policy and charging rules function (PCRF) network element. In the 5G communication system, the policy control function network element can be a policy control function (PCF) network element. In future communication systems, the policy control function network element can also have other names without limitation. The PCFs connected to AMF and SMF correspond to AM PCF (PCF for access and mobility control) and SM PCF (PCF for session management), respectively, and may not be the same PCF entity in actual deployment scenarios.

[0111] The network storage function network element is responsible for providing the network element discovery function and providing network element information corresponding to the network element type based on the requests of other network elements. Optionally, the network storage function network element can also provide network element management services, such as network element registration, update, deregistration, and network element status subscription and push. In the 5G communication system, the network storage function network element can be a network storage function network element (network repository function, NRF) network element. In future communication systems, the network storage function network element can also have other names without limitation.

[0112] The user plane function network element is responsible for receiving and forwarding user data. For example, user data can be received from the DN and transmitted to the terminal device through the access network device; the user plane function network element can also receive user data from the terminal device through the access network device and forward it to the DN. In the 5G communication system, the user plane function network element can be a user plane function (UPF) network element. In future communication systems, the user plane function network element can also have other names without limitation.

[0113] AN includes AN equipment. The AN equipment is used to access the terminal device to the wireless network. As a node in the access network, the AN equipment can also be called an access network element, a base station, a radio access network (RAN) node (or device, or network element), an access point (AP), a small tower, etc. For example, the next generation node B (gNB) in the 5G communication system, the evolved node B (eNB) in the LTE system, the radio network controller (RNC), the node B (NB), the base station controller (BSC), the base transceiver station (BTS), the home node B (HNB), the baseband unit (BBU), the wireless fidelity (WiFi) access point, the transmission reception point (TRP), the transmission point (TP), or the mobile switching center, etc.

[0114] It should be noted that in communication systems using different wireless access technologies, the devices with base station functions may be different. For example, in a 5G communication system, the device may be called gNB or 5G NodeB; in an LTE system, the device may be called an evolved NodeB (eNB or eNodeB); in a 3G communication system, it may be called a NodeB, etc.

[0115] DN, a network outside the mobile communication system, can provide services to users. For example, DN can be a packet data network (PDN), such as the Internet, Internet protocol multi-media service (IMS) network, some application-specific data networks, Ethernet, Internet protocol (IP) local network, etc. DN can deploy a variety of services to provide data and / or voice services to terminal devices. There can be multiple application servers (AS) in a DN, and each AS can provide at least one service.

[0116] AF mainly transmits the requirements of the application side to the network side, such as quality of service (QoS) requirements or user status event subscriptions, etc. AF can be a third-party functional entity or an application service deployed by an operator, such as IMS voice call service.

[0117] As above, Figure 1 This section mainly introduces network elements that may be involved in various embodiments of the present application. Figure 1 The communication system shown may also involve other network elements. For example, the core network may also include one or more of the following: a unified data repository (UDR) network element, a network slice selection function (NSSF) network element, an authentication server function (AUSF) network element, or a network exposure function (NEF) network element, etc. Figure 1 Not shown in FIG.

[0118] Figure 1 Among them, Nnrf, Namf, Npcf, Nsmf, Nudm, Naf, N1, N2, N3, N4, and N6 are interface serial numbers. The meanings of these interface serial numbers can be found in the meanings defined in the third generation partnership project (3GPP) standard protocol, and are not limited here.

[0119] Understandably, Figure 1 The network element or function shown can be a network element in a hardware device, a software function running on dedicated hardware, or a virtualized function instantiated on a platform (e.g., a cloud platform). In a possible implementation, the network element or function can be implemented by one device, or by multiple devices, or by a functional module in one device, which is not specifically limited.

[0120] In addition, the embodiments of the present application do not limit the names of the network elements in the communication system. For example, in communication systems of different standards, each network element may have other names; for another example, when multiple network elements are integrated into the same physical device, the physical device may also have other names. For the convenience of description, the device name mentioned in the embodiments of the present application may omit "network element". For example, AMF network element and AMF have the same meaning. For another example, SMF network element and SMF have the same meaning. For another example, UPF network element and UPF have the same meaning.

[0121] In future networks, the functions of the core network and the access network may be split and reorganized. For example, the mobility management function of AMF is split and merged into the access network, and the functions of AMF and SMF are merged. Figure 1 The architecture of is used as an example to illustrate.

[0122] Next, the technical features involved in the embodiments of the present application are introduced.

[0123] A private network usually refers to an internal network, which may be a network of an enterprise, a network of a park, or a network of a supermarket, etc. The specific implementation form of the private network is not limited in the embodiments of the present application. The private network may also be referred to as a non-public network, a park network, a private network, or a private network, etc., without limitation. The following description takes the private network as a park network (referred to as a park) as an example.

[0124] Figure 2 A network architecture diagram for interconnection between a campus and a carrier network is provided. Figure 2 In the example above, the operator network is taken as PLMN. In the following text, unless otherwise specified, the operator network is taken as PLMN for description. Figure 2 As shown, the campus network may include but is not limited to: AMF, SMF, RAN, or UPF, etc. Among them, please refer to the above content for the description of AMF, SMF, RAN and UPF, which will not be repeated here. Please refer to the above content for the description of PLMN, which will not be repeated here. Figure 2 Where N1, N2, N3, N4, N11 and Nwu are interface serial numbers. The meanings of these interface serial numbers can be found in the meanings defined in the 3GPP standard protocol and are not limited here. Figure 2 The access path is indicated by a thick black line.

[0125] Terminal equipment in the park (such as Figure 2 UE2) shown in (a) can access the PLMN. Currently, after accessing the campus network, terminal devices in the park can access the PLMN through non-3GPP access technology and then access the PLMN. In this solution, the terminal devices in the park need to support non-3GPP access technology, and the PLMN also needs to be deployed to support non-3GPP access technology, such as N3IWF, which is responsible for accessing the terminal devices accessed through non-3GPP to the PLMN. Accordingly, the AMF and other network elements of the PLMN also need to be upgraded accordingly to support UE access to the PLMN from the campus through non-3GPP access technology, etc. The implementation method is complex and the cost is high.

[0126] When the terminal equipment in the park (such as Figure 2When UE1 shown in (b) moves outside the campus and wants to communicate with the campus, the terminal device needs to first access the PLMN and establish a PDU session, and then use the PDU session to establish a tunnel with the N3IWF network element to register with the campus. In this solution, the terminal device needs to support non-3GPP access technology, and the campus also needs to support non-3GPP access technology. For example, network elements such as N3IWF are deployed to connect terminal devices that access the PLMN through non-3GPP access. The AMF and other network elements deployed in the campus also need to be upgraded accordingly to support non-3GPP access technology. The implementation method is complex and the cost is high.

[0127] In view of this, an embodiment of the present application provides a communication method and device for enabling a terminal device to remotely access a campus through a PLMN, or to access a terminal device to a PLMN through a campus, without the need for the terminal device and the campus to support non-3GPP access technology. The implementation is simple and can reduce costs.

[0128] It should be pointed out that the method provided in the embodiment of the present application is not only applicable to the communication scenario of the interconnection between the PLMN and the campus, but also applicable to the communication scenario of the interconnection between any other two networks (such as the first network and the second network) without limitation. Among them, the first network can be a PLMN or a campus, and the embodiment of the present application does not limit the specific implementation form of the first network. The second network can be a PLMN or a campus, and the embodiment of the present application does not limit the specific implementation form of the second network. The first network and the second network can be any combination of the above-mentioned different types of networks. Optionally, there is a contractual relationship or a contractual relationship between the first network and the second network. For example, the first network signs a contract with the second network to allow the terminal device of the first network to access the first network or access the service of the first network through the second network. For another example, the second network signs a contract with the first network to allow the terminal device of the second network to access the first network or access the service of the second network.

[0129] For ease of understanding, the following description will be based on the first network being PLMN and the second network being a campus as an example without special instructions. When the technical solution of the embodiment of the present application is applied to the intercommunication scenario between other two networks, the PLMN and campus in the embodiment can be replaced with the other two networks accordingly without limitation.

[0130] Before introducing the method provided in the embodiment of the present application, the communication architecture to which the method provided in the embodiment of the present application is applicable is first introduced. Figure 3 , is a schematic diagram of the architecture of a communication system provided in an embodiment of the present application. Figure 3 As shown, the communication system includes PLMN 310 and campus 320 .

[0131] PLMN310 may include RAN1, control plane network element ( Figure 3 AMF1, SMF1, PCF1 and security gateway 1 are used as examples) and user plane network elements ( Figure 3 (UPF1 is taken as an example). Optionally, PLMN310 can provide IMS services, Internet services, etc., without limitation. It should be understood that PLMN310 can also involve other network elements, such as a subscription management function network element, UDR, or UDM, etc., without limitation. In addition, please refer to the aforementioned description of each network element in PLMN310. Figure 1 The relevant description will not be repeated here.

[0132] Campus 320 includes RAN2, control plane network elements ( Figure 3 AMF2, SMF2, UDM2 and security gateway 2 are used as examples) and user plane network elements ( Figure 3 In the example of UPF2, the park 320 may also involve other network elements, such as enterprise servers, PCFs, or UDRs, etc., without limitation. In addition, the description of each network element in the park 320 may also refer to the aforementioned description of Figure 1 The relevant description will not be repeated here.

[0133] The control plane signaling of PLMN310 and campus 320 can be interconnected through a security gateway. The security network element can support network topology hiding, such as not exposing the address information of the control plane network element. The security network element can also be responsible for the security of data transmission between the operation network 310 and the campus 320, such as establishing a secure connection, encrypting and integrity protecting the data transmitted between PLMN310 and campus 320, etc.

[0134] There is a user plane interface between the user plane network element in PLMN310 and the user plane network element in campus 320, which can be used for data transmission.

[0135] It should be noted that, in specific deployment, two or more control plane network elements can be co-located or deployed separately without restriction. For example, AMF and SMF can be co-located, but their respective functional modules still exist. Figure 3 In the example above, AMF and SMF are deployed separately. For another example, UDM and PCF can be co-located or deployed separately.

[0136] In addition, the deployment of UDM2 in campus 320 is used as an example in the embodiment of the present application, but it should be pointed out that the UDM function in campus 320 may be different from the UDM function in PLMN. For example, the subscription information of the terminal device stored in UDM2 in campus 320 may not include the user permanent identifier (SUPI) of the terminal device.

[0137] Some terms involved in the embodiments of the present application are explained below.

[0138] The first terminal device may be a contracted terminal of the park, that is, a terminal device that has signed a contract with the park; or it may be a terminal device that has been authorized to access the park. For example, the first terminal device is a terminal device that has been authorized to access the park by scanning a code for registration. For another example, the first terminal device is a visitor to the park. For example, the first terminal device is a terminal device for a visitor to a museum. The museum allows any visitor to access the museum's campus network without restriction. In an embodiment of the present application, the first terminal device expects to access the park through a PLMN. For example, the first terminal device is outside the coverage of the park and within the coverage of the PLMN, and expects to access the park through the PLMN. The first terminal device may be a contracted terminal of the PLMN, or it may not be a contracted terminal of the PLMN, without restriction. Exemplarily, the first terminal device may be Figure 3 UE1 in the communication system shown.

[0139] The second terminal device is a terminal device that has been registered with the park. In the embodiment of the present application, the second terminal device expects to access the PLMN through the park. For example, the second terminal device is located in the park and has been registered with the park, and expects to access the PLMN through the park. Exemplarily, the second terminal device can be Figure 3 UE2 in the communication system shown.

[0140] The first control plane network element is a control plane network element in the PLMN. The first control plane network element has the function of AMF; or has the function of AMF and the function of SMF, that is, the first control plane network element is a combined network element of AMF and SMF, or has the NAS message forwarding function and mobility management function of AMF. In the following text, unless otherwise specified, the first control plane network element is AMF as an example for description. Exemplarily, the first control plane network element can be Figure 3 AMF1 in the communication system shown.

[0141] The second control plane network element is a control plane network element in the park. The second control plane network element has the function of AMF; or has the function of AMF and the function of SMF, that is, the second control plane network element is a combined network element of AMF and SMF; or the second control plane network element has the access management function of AMF, that is, supports the control and authorization of the access of terminal devices. In the following text, unless otherwise specified, the second control plane network element is AMF as an example for description. Exemplarily, the first control plane network element can be Figure 3 AMF2 in the communication system shown.

[0142] The third control plane network element is a control plane network element in the PLMN. The third control plane network element has the function of SMF; or has the function of AMF and the function of SMF, that is, the third control plane network element is a combined network element of AMF and SMF. In the following text, unless otherwise specified, the third control plane network element is described as SMF. Exemplarily, the third control plane network element can be Figure 3 SMF1 in the communication system shown.

[0143] The fourth control plane network element is a control plane network element in the park. The fourth control plane network element has the function of SMF; or has the function of AMF and the function of SMF, that is, the fourth control plane network element is a combined network element of AMF and SMF. In the following text, unless otherwise specified, the fourth control plane network element is SMF as an example for description. For example, the first control plane network element can be Figure 3 SMF2 in the communication system shown.

[0144] The first user plane network element is a user plane network element in the PLMN, for example Figure 3 UPF1 in the communication system shown.

[0145] The second user plane network element is a user plane network element in the park, for example Figure 3 UPF2 in the communication system shown.

[0146] In the embodiments of the present application, the terms "access", "registration" and "visit" can be used interchangeably. The contract information of the second network (or campus) in the first network (or PLMN) can be referred to as the contract information of the second network (or campus). The contract information of the first terminal device in the second network (or campus) can be referred to as the contract information of the first terminal device. The contract information of the second terminal device in the second network (or campus) can be referred to as the contract information of the second terminal device.

[0147] The present application embodiment involves two communication scenarios, which are denoted as communication scenario 1 and communication scenario 2. Communication scenario 1 refers to a communication scenario in which a first terminal device remotely accesses the park through a PLMN. For example, the first terminal device is Figure 3 In the communication system shown, UE1 expects to remotely access campus 320 through PLMN 310. Communication scenario 2 refers to a communication scenario in which a second terminal device accesses PLMN through the campus. For example, the second terminal device is Figure 3 The UE2 in the communication system shown in the figure desires to access the PLMN310 through the campus 320 , such as accessing the IMS service provided by the PLMN310 .

[0148] The method provided in the embodiment of the present application is first introduced below in conjunction with communication scenario 1.

[0149] Figure 4A flow chart of a first communication method provided in an embodiment of the present application. In this embodiment, a first terminal device accesses a campus through a PLMN. Figure 4 The method 400 shown can be applied to Figure 3 The communication system shown is not limited. Figure 4 As shown, the method 400 may include the following contents.

[0150] S401: A first terminal device sends a first request to a first control plane network element in a first network.

[0151] Correspondingly, the first control plane network element receives a first request from the first terminal device.

[0152] The S401 may also be expressed as: the first terminal device sends a first request to a first control plane network element in the PLMN; correspondingly, the first control plane network element receives the first request from the first terminal device.

[0153] The first request can be used by the first terminal device to request access to the second network, that is, to request access to the campus. For example, the first terminal device is a contracted terminal device of the campus. When the first terminal device moves out of the coverage of the campus and wants to access the campus, the first terminal device can send the first request to the first control plane network element in the first network (that is, PLMN) where it is located, such as through the first access network network element (such as Figure 3 RAN1) sends a first request to the first control plane network element. The first request itself can be used for the first terminal device to request access to the park. For example, the first request is a registration request message. Alternatively, the first request may also include information (or information element) for the first terminal device to request access to the park. The embodiment of the present application does not limit the specific implementation method of the first request. Optionally, the first request may include an identifier of the second network, that is, an identifier of the park.

[0154] It should be pointed out that the terms such as the first network, the second network, the PLMN, the campus, the first terminal device, and the first control plane network element involved in the embodiments of the present application can be referred to the previous terminology explanation part and will not be repeated here.

[0155] S402: The first control plane network element sends a second request to a second control plane network element in the second network according to the first request.

[0156] Correspondingly, the second control plane network element receives the second request from the first control plane network element.

[0157] S402 may also be expressed as: the first control plane network element sends a second request to the second control plane network element in the park according to the first request; correspondingly, the second control plane network element receives the second request from the first control plane network element.

[0158] The second request can be used by the first control plane network element to request the first terminal device to access the second network, that is, to request the first terminal device to access the park. For example, after receiving the first request, the first control plane network element parses the first request, determines that the first terminal device needs to be connected to the park, generates a second request, and sends the second request to the second control plane network element in the park. Among them, the second request itself can be used to request the first terminal device to access the park. For example, the second request is a registration request message. Alternatively, the second request may also include information (information element) for requesting the first terminal device to access the park. The information (or information element) for requesting the first terminal device to access the park may be generated by the second control plane network element, or may be from the first terminal device, such as parsing the first request to obtain the information (or information element), without limitation. It should be understood that the embodiment of the present application does not limit the specific implementation method of the second request.

[0159] In a possible implementation, the first control plane network element may determine whether to allow or deny the first terminal device to access the park. In one example, the first control plane network element may determine whether to allow or deny the first terminal device to access the park based on the contract status of the park in the PLMN (such as contract or no contract) or based on the cooperation status between the park and the PLMN (such as cooperation or no cooperation). For example, the first request includes an identifier of the park, and the first control plane network element fails to obtain the contract information of the park or the cooperation information between the park and the PLMN based on the identifier of the park, which means that the park has not signed a contract with the PLMN, then the first control plane network element denies the first terminal device access to the park, in other words, there is no need to send a second request to the second control plane network element. Alternatively, the first control plane network element obtains the contract information of the park based on the identifier of the park, which means that the park has signed a contract with the PLMN, then the first control plane network element allows the first terminal device to access the park, in other words, determines to send a second request to the second control plane network element. Among them, the contract information of the park refers to the contract information of the park in the PLMN. For the convenience of description, the contract information of the park and the cooperation information between the park and PLMN will be collectively referred to as the contract information of the park, that is, the cooperation information between the park and PLMN and the contract information of the park can be used interchangeably. It should be pointed out that the contract information can be saved in the contract server (such as UDM) or saved as configuration information without pre-restriction.

[0160] In another example, the first request includes an identifier of the park, and the first control plane network element can obtain the first information according to the identifier of the park, and determine whether to allow or deny the first terminal device to access the park according to the first information. The first information can be used to indicate whether to allow or deny at least one terminal device to communicate with the park through the PLMN, and the first terminal device belongs to the at least one terminal device. For example, if the first information is used to indicate that at least one terminal device is denied to communicate with the park through the PLMN, the first control plane network element denies the first terminal device access to the park, in other words, there is no need to send the second request to the second control plane network element. Alternatively, if the first information is used to indicate that at least one terminal device is allowed to communicate with the park through the PLMN, the first control plane network element allows the first terminal device to access the park, in other words, determines to send the second request to the second control plane network element. The first information can be pre-defined, pre-agreed, or included in the contract information of the park, without limitation. It should be understood that the first information can be included in the contract information of the park, or can also be the contract information of the park, without limitation. For example, if the first control plane network element obtains the first information, the first control plane network element allows the first terminal device to access the campus; if the first information is not obtained, the first control plane network element may deny the first terminal device from accessing the campus.

[0161] In another example, the first request includes an identifier of the park, and the first control plane network element can obtain the scope information of the park according to the identifier of the park, and determine whether to allow or deny the first terminal device to access the park according to the scope information of the park and the location information of the first terminal device. The scope information of the park can be used to indicate the scope of allowing at least one terminal device to access the park, and the first terminal device belongs to the at least one terminal device. For example, the first terminal device is outside the scope indicated by the scope information of the park, and the first control plane network element denies the first terminal device access to the park, in other words, there is no need to send the second request to the second control plane network element. Alternatively, the first terminal device is within the scope indicated by the scope information of the park, and the first control plane network element allows the first terminal device to access the park, in other words, it determines to send the second request to the second control plane network element. Optionally, the scope information of the park can be included in the contract information of the park, without limitation. The scope information of the park can be one or more of a tracking area (TA), a TA list, a cell, and a cell list, without limitation.

[0162] In another example, the first request includes an identifier of the park, and the first control plane network element determines the information of the second control plane network element in the second network (such as the address information of the second control plane network element, etc., without limitation) according to the identifier of the park, that is, determines the information of the second control plane network element in the park. For example, the first control plane network element can obtain the information of the second control plane network element by querying the NRF according to the identifier of the park. Through this example, the first control plane network element can determine the information of the second control plane network element in the park, so that the first control plane network element sends a second request to the second control plane network element.

[0163] It should be noted that the embodiment of the present application is described by taking the example of the first control plane network element allowing the first terminal device to access the campus.

[0164] In a possible implementation, the first control plane network element may establish a secure connection with the second control plane network element. Further, the first control plane network element may communicate with the second control plane network element through the secure connection, such as sending a second request. The secure connection is used for message transmission between the first control plane network element and the second control plane network element, such as transmission of control signaling. The secure connection may be a connection between a security gateway in a PLMN and a security gateway in a campus. The security gateway in the PLMN may be Figure 3 The security gateway 1 in the communication system shown in the figure. The security gateway in the park can be Figure 3 The security gateway 2 in the communication system shown. Exemplarily, the first control plane network element can send the identification of the park to the security gateway in the PLMN; accordingly, the security gateway in the PLMN receives the identification of the park, obtains the information of the security gateway in the park according to the identification of the park, and establishes a secure connection with the security gateway in the park according to the information. Optionally, the secure connection can be a connection based on the hypertext transfer protocol secure (HTTPS), such as the security gateway in the PLMN and the security gateway in the park perform mutual identity authentication to determine the identity of each other. It should be pointed out that the embodiment of the present application does not limit the specific process of establishing the secure connection between the first control plane network element and the second control plane network element.

[0165] S403: The second control plane network element sends a second response to the first control plane network element.

[0166] Correspondingly, the first control plane network element receives a second response from the second control plane network element.

[0167] The second response indicates that the first terminal device is allowed (or supported) or denied (or prohibited) to access the second network through the first network, that is, the first terminal device is allowed or denied to access the campus through the PLMN. The second response may also be referred to as an authorization indication, etc., without limitation. For example, after receiving the second request, the second control plane network element parses the second request, and may determine whether to allow or deny the first terminal device to access the campus through the PLMN, generate a second response, and send the second response to the first control plane network element. Among them, the second response itself may indicate whether to allow or deny the first terminal device to access the campus through the PLMN. For example, the second response is a negative acknowledgement (NACK) message to indicate that the first terminal device is denied access to the campus through the PLMN; or, the second response is an acknowledgement (ACK) message to indicate that the first terminal device is allowed to access the campus through the PLMN, without limitation. Alternatively, the second response may also include information (information element) for indicating whether to allow or deny the first terminal device to access the campus through the PLMN. The embodiment of the present application does not limit the specific implementation method of the second response.

[0168] After receiving the second request, the second control plane network element may determine whether to allow or deny the first terminal device to access the park through the PLMN. In one example, the second control plane network element may determine whether to allow or deny the first terminal device to access the park through the PLMN according to the seventh information. The seventh information may be used to indicate whether to allow or deny the first terminal device to access the park through the PLMN. For example, if the seventh information is used to indicate whether to deny the first terminal device to access the park through the PLMN, the second control plane network element determines according to the seventh information to deny the first terminal device to access the park through the PLMN, and accordingly, the second response indicates that the first terminal device is denied to access the park through the PLMN. Alternatively, if the seventh information is used to indicate whether to allow the first terminal device to access the park through the PLMN, the second control plane network element determines according to the seventh information to allow the first terminal device to access the park through the PLMN, and accordingly, the second response indicates that the first terminal device is allowed to access the park through the PLMN. The seventh information may be predefined or included in the contract information of the first terminal device, without limitation. For example, the second control plane network element obtains the contract information of the first terminal device according to the second request, and the contract information of the first terminal device includes the seventh information. The contract information of the first terminal device refers to the contract information of the first terminal device in the park.

[0169] In another example, the second control plane network element may determine whether to allow or deny the first terminal device to access the park through the PLMN based on the second number and the second information. The second number is the total number of terminal devices that access the park through the PLMN, such as the total number of terminal devices that currently access the park through the PLMN. The second information includes the maximum number of terminal devices that are allowed to access the park through the PLMN. Exemplarily, the second control plane network element may obtain the second number, and determine whether to allow or deny the first terminal device to access the park through the PLMN based on the second number and the second information. For example, if the second number is greater than the maximum number of terminal devices that are allowed to access the park through the PLMN, the second control plane network element may determine to deny the first terminal device to access the park through the PLMN, and accordingly, the second response indicates that the first terminal device is denied access to the park through the PLMN. Alternatively, if the second number is less than or equal to the maximum number of terminal devices that are allowed to access the park through the PLMN, the second control plane network element may determine to allow the first terminal device to access the park through the PLMN, and accordingly, the second response indicates that the first terminal device is allowed to access the park through the PLMN.

[0170] Among them, the second information can be pre-defined, or included in the contract information of the park, without limitation. The second quantity can be maintained (or stored) by the second control plane network element, or it can also be maintained by other network elements in the park. The other network element can, for example, be a data management network element in the park, such as UDM, or UDR, etc. It should be understood that if the second quantity is maintained by other network elements in the park, then the second control plane network element can obtain the second quantity by interacting with the other network elements, without limitation.

[0171] Further, if the second control plane network element determines that the first terminal device is allowed to access the campus through the PLMN, and the second number is maintained by the second control plane network element, then the second control plane network element may add 1 to the second number. Alternatively, if the second control plane network element determines that the first terminal device is allowed to access the campus through the PLMN, and the second number is maintained by other network elements in the campus, then the second control plane network element may send a notification message to the other network element so that the other network element adds 1 to the second number.

[0172] The second number mentioned above is the total number of terminal devices that access the park through the PLMN, and the second information includes the maximum number of terminal devices that are allowed to access the park through the PLMN. In another possible implementation, the park may sign a contract with multiple PLMNs, that is, allow the first terminal device to access the park through multiple PLMNs, and the park has signed a contract with each of the multiple PLMNs for the total number of terminal devices that are allowed to access through the PLMN. In this case, the second number is the total number of terminal devices that access the park through the multiple PLMNs, and the second information includes a third number, which is the sum of the total number of terminal devices that are allowed to access through each of the multiple PLMNs. Further, if the second number is greater than the third number, the terminal device is not allowed (or denied) to access the park through any of the multiple PLMNs; otherwise, the terminal device is allowed to access the park through any of the multiple PLMNs. Among them, the total number of terminal devices that are allowed to access the park through the PLMN that the park has signed a contract with each of the multiple PLMNs can be the same or different. For example, the multiple PLMNs include PLMN1 and PLMN2, the total number of terminal devices that are allowed to access the park through PLMN1 and that have signed a contract with the park is recorded as number 1, and the total number of terminal devices that are allowed to access the park through PLMN2 and that have signed a contract with the park is recorded as number 2, and number 1 is the same as or different from number 2. If the second number is greater than the sum of number 1 and number 2, the terminal device is denied access to the park through PLMN1 or PLMN2; otherwise, the terminal device is allowed to access the park through PLMN1 or PLMN2.

[0173] It should be noted that the embodiment of the present application is described by taking the example that the second response indicates that the first terminal device is allowed to access the campus through the PLMN.

[0174] In one possible implementation, if the second control plane network element determines that the first terminal device is allowed to access the campus through the PLMN, the second control plane network element may also authenticate and authorize the first terminal device. For example, the second control plane network element authenticates and authorizes the first terminal device before sending the second response to the first control plane network element. It is worth noting that the authentication information between the second control plane network element and the first terminal device is transmitted through the first control plane network element. The embodiment of the present application does not limit the specific implementation process of the second control plane network element authenticating and authorizing the first terminal device.

[0175] Exemplarily, the second control plane network element can obtain the identity information of the first terminal device, and authenticate and authorize the first terminal device according to the identity information of the first terminal device. For example, the second control plane network element can interact with the authentication network element (such as AUSF, etc.) in the park to complete the authentication and authorization of the first terminal device. For example, the second network can allocate and install an embedded subscriber identity module (eSIM) for the first terminal device, and the eSIM includes information such as the identity identification and security parameters of the first terminal device in the park; further, the second control plane network element authenticates and authorizes the first terminal device according to the information. It should be understood that the second control plane network element can also use other mechanisms to authenticate and authorize the first terminal device, such as a certificate mechanism, that is, when the first terminal device signs a contract with the park, the park writes the certificate to the first terminal device, and the first terminal device can be authenticated and authorized by the certificate later. When authenticating the first terminal device, the second control plane network element and the first terminal device interact with the authentication message through the first control plane network element in the first network. For example, the second control plane network element sends an authentication request message to the first terminal device through the first control plane network element in the first network; the first terminal device responds to the authentication request message and sends an authentication response message to the second control plane network element through the first control plane network element. The embodiment of the present application does not limit the specific implementation process of the authentication and authorization of the first terminal device.

[0176] Among them, the identity information of the first terminal device can be understood as the identity information of the first terminal device in the park, for example, it can be the identification of the first terminal device, without limitation. The identity information of the first terminal device can be included in the first request, and sent by the first control plane network element to the second control plane network element in the second request; or, it can also be actively obtained by the second control plane network element, that is, the second control plane network element sends an ID request message to the first terminal device through the first control plane network element, and in response to the ID request message, the first terminal device sends the identity information to the second control plane network element through the first control plane network element, without limitation. The embodiment of the present application does not limit the acquisition of the identity information of the first terminal device by the second control plane network element. It should be pointed out that the first terminal device can encrypt the identity information when sending the identity information, so that the network elements in the first network, such as the first control plane network element, cannot obtain the identity information of the first terminal device, which can effectively prevent the behavior of park users from being tracked by the first network.

[0177] In one possible implementation, if the second control plane network element determines that the first terminal device is allowed to access the campus through the PLMN, the second control plane network element may also allocate a campus temporary identifier for the first terminal device and send it to the first terminal device through the first control plane network element. For example, the second control plane network element may carry the campus temporary identifier in the second response and send it to the first control plane network element, which is then forwarded to the first terminal device through the first access network network element by the first control plane network element. Accordingly, the first control plane network element may save the campus temporary identifier. The campus temporary identifier may uniquely identify the first terminal device within the campus, thereby hiding the true identity information of the first terminal device in the campus. Optionally, the second control plane network element is a joint network element of AMF and SMF, and the campus temporary identifier may be a context identifier of the first terminal device, such as a mobility management context identifier. It should be noted that the campus temporary identifier may be a string or an integer, etc., without limitation. Optionally, the second control plane network element can also send the campus temporary identifier of the first terminal device to the data management network element (such as UDM, or UDR, etc.) in the campus, so that other network elements in the campus can obtain the identity information of the first terminal device in the campus and the signing information of the first terminal device from the data management network element based on the campus temporary identifier of the first terminal device.

[0178] In a possible implementation, the second control plane network element may also send the encrypted SUPI of the first terminal device to the first control plane network element; accordingly, the first control plane network element receives the encrypted SUPI and saves the encrypted SUPI. Optionally, the encrypted SUPI may be included in the second response without limitation.

[0179] Optionally, if the second control plane network element determines to allow the first terminal device to access the campus through the PLMN, the second control plane network element may also send a notification message to the data management network element in the campus to notify the first terminal device that it is in a registered state, enabling the data management network element to provide services for the first terminal device.

[0180] Before the second control plane network element determines to allow the first terminal device to access the campus through the PLMN, the first terminal device and the second control plane network element may need to interact with each other through authentication messages and information such as user identity information. At this time, the first control plane network element should allow the first terminal device and the second control plane network element to transmit messages through the first control plane network element. However, since the first control plane network element has not yet received the authorization indication (i.e., the second response) allowing the first terminal device to access the campus through the PLMN, the first terminal device sending messages to the campus through the PLMN is prone to malicious use, causing the PLMN and / or the campus to be accessed by malicious terminal devices, resulting in a waste of network resources. To this end, in a possible implementation method, before receiving the second response from the second control plane network element, the first control plane network element can restrict the messages transmitted between the first terminal device and the campus through the PLMN based on the restriction information, so as to reduce the problem of terminal devices sending malicious messages before the first control plane network element receives the authorization indication from the campus, thereby reducing network resource consumption. The restriction information may include one or more of the following: the type of messages allowed to be transmitted between the terminal device (such as the first terminal device) and the park through the PLMN, the number of messages allowed to be transmitted between the terminal device (such as the first terminal device) and the park through the PLMN, or the duration for which the terminal device (such as the first terminal device) is allowed to communicate with the park through the PLMN. The restriction information may be predefined or included in the contract information of the park without restriction. For example, the first control plane network element may obtain the restriction information, such as obtaining the contract information of the park through the identification of the park, and obtaining the restriction information based on the contract information of the park without restriction.

[0181] Optionally, after the first control plane network element receives the second response, the first control plane network element may cancel restrictions on messages transmitted between the first terminal device and the campus through the PLMN.

[0182] It should be noted that the term "transmission" involved in the embodiments of the present application may include sending and / or receiving.

[0183] S404: The first control plane network element sends a first response to the first terminal device.

[0184] Correspondingly, the first terminal device receives a first response from the first control plane network element.

[0185] The first response can be used to indicate whether the first terminal device successfully or failed to access the second network, that is, successfully or failed to access the campus. In other words, the first response is used to indicate whether the first terminal device successfully or failed to access the second network through the first network, that is, successfully or failed to access the campus through the PLMN. The embodiment of the present application is described by taking the example that the first response is used to indicate that the first terminal device successfully accesses the campus. The first response can be, for example, a registration response message, without limitation. Exemplarily, after receiving the second response, the first control plane network element can generate a first response and send the first response to the first terminal device. For example, the first control plane network element sends the first response to the first access network network element, which is then forwarded to the first terminal device by the first access network network element. Among them, the first response itself can be used to indicate whether the first terminal device successfully or failed to access the second network. For example, the first response is a NACK message, which can indicate that the first terminal device failed to access the campus; or, the first response is an ACK message, which can indicate that the first terminal device successfully accessed the campus, without limitation. Alternatively, the first response can also include information (information element) used to indicate whether the first terminal device successfully or failed to access the campus. The information indicating the success or failure of the first terminal device to access the campus may be generated by the first control plane network element; or may come from the second control plane network element, for example, the second response includes the information. The embodiment of the present application does not limit the specific implementation of the first response.

[0186] In a possible implementation, the second response is used to indicate that the first terminal device is allowed to access the park through the PLMN. After receiving the second response, the first control plane network element determines that the second control plane network element allows the first terminal device to access the park through the PLMN. Further, the first control plane network element can also determine whether to allow or deny the first terminal device to access the park through the PLMN based on the first quantity and the second information, so as to achieve multiple verifications, which can reduce the problem of terminal devices maliciously accessing the park through the PLMN. The embodiment of the present application is described by taking the first control plane network element determining that the first terminal device is allowed to access the park through the PLMN as an example. Among them, please refer to the above content for the description of the second information, which will not be repeated. The first quantity is the total number of terminal devices that access the park through the PLMN. The first quantity can be maintained (or stored) by the first control plane network element, or maintained by other network elements in the PLMN, without limitation. The other network element can, for example, be a data management network element in the PLMN, such as UDM, or UDR, etc. It should be understood that if the first quantity is maintained by other network elements in the PLMN, then the first control plane network element can obtain the first quantity by interacting with the other network elements, without limitation. In addition, the specific implementation process of the first control plane network element determining whether to allow or reject the first terminal device to access the park through the PLMN based on the first quantity and the second information can refer to the aforementioned related content and will not be repeated here.

[0187] It should be pointed out that the park may sign contracts with multiple PLMNs, that is, allow the first terminal device to access the park through multiple PLMNs. In this case, the first number is the total number of terminal devices accessing the park through multiple PLMNs. For details, please refer to the aforementioned related content and no further details will be given.

[0188] It should be noted that the first control plane network element can determine whether to allow or deny the first terminal device to access the campus through the PLMN based on the first quantity and the second information when receiving the second response message; or, the first control plane network element can also determine whether to allow or deny the first terminal device to access the campus through the PLMN based on the first quantity and the second information after receiving the first request sent by the first terminal device (i.e. after S401), without limitation. It should be understood that if the first control plane network element determines to deny the first terminal device to access the campus through the PLMN based on the first quantity and the second information after receiving the first request sent by the first terminal device, then the first control plane network element does not send the second request, but sends a rejection indication to the first terminal device.

[0189] Further, if the first control plane network element determines that the first terminal device is allowed to access the campus through the PLMN, and the first number is maintained by the second control plane network element, then the first control plane network element may add 1 to the first number. Alternatively, if the first control plane network element determines that the first terminal device is allowed to access the campus through the PLMN, and the first number is maintained by other network elements in the PLMN, then the first control plane network element may send a notification message to the other network element so that the other network element adds 1 to the first number.

[0190] In a possible implementation, the first control plane network element may obtain the fourth information and send the fourth information to the billing system so that the billing system charges the service of the first terminal device accessing the park through the PLMN. The fourth information may include one or more of the following: the number of terminal devices accessing the park through the PLMN, the number of messages transmitted between the terminal devices (such as the first terminal device) accessing the park through the PLMN and the park, or the traffic consumed by the messages transmitted between the terminal devices (such as the first terminal device) accessing the park through the PLMN and the park.

[0191] It should be noted that, in this embodiment, the first terminal device may be a contracted terminal of the PLMN, or may not be a contracted terminal of the PLMN. If the first terminal device is a contracted terminal device of the PLMN, the first terminal device may also access the PLMN, such as using a SIM card of the PLMN to access the PLMN to access the services of the PLMN. Of course, the first terminal device may not access the PLMN, and there is no restriction.

[0192] In order to ensure the reliable transmission of messages when the first terminal device accesses, in a possible implementation, the park can allocate a key to the first terminal device to ensure the security of messages when the first terminal device communicates with the park through the PLMN. Exemplarily, the second control plane network element can determine the first key and send the first key to the first control plane network element. For example, after the second control plane network element successfully authenticates the first terminal device, it can allocate the first key to the first terminal device. Correspondingly, the first control plane network element receives the first key from the second control plane network element. Optionally, the first key can be included in the second response, or the first key can also be sent to the first control plane network element together with the second response, without limitation. The second control plane network element can allocate the first key to the first terminal device, or obtain the first key from other network elements in the park, such as obtaining the first key from the AUSF in the park. The embodiment of the present application does not limit the specific implementation process of the second control plane network element determining the first key.

[0193] Correspondingly, on the first terminal device side, the first terminal device can generate a fourth key, and the fourth key and the first key form a key pair, that is, the fourth key is the same as the first key, the fourth key is generated by the first terminal device, and the first key is generated by the park side. For example, the first terminal device can generate the fourth key after the first terminal device successfully authenticates the park. The embodiment of the present application does not limit the specific implementation process of the first terminal device generating the fourth key.

[0194] Optionally, after receiving the first key, the first control plane network element can determine (or derive, or calculate, etc.) a second key based on the first key, and send the second key to the first access network element in the PLMN to ensure the security of communication between the first terminal device and the first access network element. Correspondingly, the first access network element receives the second key from the first control plane network element. For example, the first control plane network element can carry the second key in a create UE context request message and send it to the first access network element. Optionally, the create UE context request message may also include a first response, without limitation. The embodiment of the present application does not limit the specific implementation process of the first control plane network element determining the second key based on the first key.

[0195] Correspondingly, on the first terminal device side, the first terminal device can determine (or derive, or calculate, etc.) a fifth key based on the fourth key, and the fifth key is used for secure transmission between the first terminal device and the first access network element. In other words, the fifth key and the second key are a key pair. The embodiment of the present application does not limit the specific implementation process of the first terminal device determining the fifth key based on the fourth key.

[0196] Optionally, the first control plane network element may also determine (or derive, or calculate, etc.) a third key based on the first key. The third key is used for secure transmission between the first terminal device and the first control plane network element. For example, the third key can be used to securely protect NAS messages transmitted between the first terminal device and the first control plane network element. The embodiment of the present application does not limit the specific implementation process of the first control plane network element determining the third key based on the first key.

[0197] Correspondingly, on the first terminal device side, the first terminal device can determine (or derive, or calculate, etc.) the sixth key based on the fourth key. The sixth key is used for secure transmission between the first terminal device and the first control plane network element. For example, the sixth key can be used to securely protect NAS messages transmitted between the first terminal device and the first control plane network element. In other words, the sixth key and the third key are a key pair. The embodiment of the present application does not limit the specific implementation process of the first terminal device determining the sixth key based on the fourth key.

[0198] Further, the first control plane network element sends the third information to the first terminal device, and accordingly, the first terminal device receives the third information. The third information can be used to instruct the first terminal device to start security protection for messages transmitted between the first control plane network element and the first terminal device. The message can be, for example, a non-access stratum (NAS) message, without limitation. For example, the first control plane network element can send a NAS security command request to the first terminal device, and the NAS security command request includes the third information or is the third information, so as to instruct the first terminal device to start security protection for NAS messages transmitted between the first control plane network element and the first terminal device. After receiving the third information, the first terminal device can respond to the third information and start using (or according to) the sixth key to perform security protection on the NAS messages between the first control plane network element and the first terminal device. Optionally, the first terminal device can also send a response message of the third information to the first control plane network element, such as a NAS security command completion message, to indicate that the first terminal device has started security protection for messages transmitted between the first control plane network element and the first terminal device. It should be understood that the first terminal device can generate the sixth key based on the fourth key after receiving the third information, or can generate the sixth key based on the fourth key after the first terminal device successfully authenticates the campus and before receiving the third information, without limitation.

[0199] The following method 400 is applied to Figure 3 As an example, the communication system shown in Figure 4 The process shown in FIG. 1 is described in detail. Among them, the first network is Figure 3 The second network is PLMN310 in the communication system shown. Figure 3The communication system shown in the park 320. The first terminal device is Figure 3 UE1 in the communication system shown. The first control plane network element is Figure 3 AMF1 in the communication system shown. The second control plane network element is Figure 3 AMF2 in the communication system shown. The first access network element is Figure 3 RAN1 in the communication system shown.

[0200] Please refer to Figure 5 , is another flow chart of the first communication method provided in the embodiment of the present application. It should be understood that, Figure 5 This is an exemplary interaction diagram of method 400, and the embodiments of the present application are not limited thereto.

[0201] S501: UE1 sends a first request to AMF1; accordingly, AMF1 receives the first request.

[0202] The first request may be used for UE1 to request access to the park 320. Optionally, the first request carries an identifier of the park 320. For a description of the first request, please refer to the content of S401, which will not be described in detail.

[0203] S502: AMF1 determines to allow UE1 to access campus 320.

[0204] After receiving the first request, AMF1 may determine whether to allow or deny UE1 to access campus 320. For the specific implementation process, please refer to the relevant content of S402, which will not be described in detail. In this embodiment, AMF1 determines to allow UE1 to access campus 320 as an example for description.

[0205] S503: AMF1 establishes a secure connection with AMF2.

[0206] The security connection is used for message transmission between the first control plane network element and the second control plane network element, such as transmission of control signaling. The security connection may specifically be a connection between the security gateway 1 in the PLMN 310 and the security gateway 2 in the campus 320 . Figure 5 Security Gateway 1 and Security Gateway 2 are not shown.

[0207] S504: AMF1 restricts messages transmitted between UE1 and campus 320 through PLMN310 according to the restriction information.

[0208] S504 is an optional step. Figure 5The restriction information may include one or more of the following: the type of message allowed to be transmitted between UE1 and campus 320 through PLMN310, the number of messages allowed to be transmitted between UE1 and campus 320 through PLMN310, or the duration of communication allowed between UE1 and campus 320 through PLMN310. For the specific implementation process of S504, please refer to the relevant content of S403 and will not be repeated here.

[0209] S505: AMF1 sends a second request to AMF2; accordingly, AMF2 receives the second request.

[0210] The second request may be used by AMF1 to request UE1 to access the park 320. For the specific implementation process of S505, please refer to the relevant content of S402, which will not be described in detail.

[0211] S506: AMF2 authenticates and authorizes UE1.

[0212] For the specific implementation process of S506, please refer to the relevant content of S403, which will not be repeated here.

[0213] S507: UE1 generates a fourth key.

[0214] For example, after UE1 successfully authenticates AMF2, UE1 can generate the fourth key, or generate the fourth key when receiving the third information, without restriction.

[0215] S508: AMF2 determines that UE1 is allowed to access campus 320 through PLMN310.

[0216] AMF2 can determine whether to allow or deny UE1 to access the campus 320 through PLMN310. For the specific implementation process, please refer to the relevant content of S403, which will not be repeated here. In this embodiment, AMF2 determines to allow UE1 to access the campus 320 through PLMN310 as an example. Optionally, AMF2 can add 1 to the second number, and the second number is the total number of UEs that access the campus 320 through PLMN310.

[0217] S509: AMF2 allocates a first key to UE1.

[0218] The first key and the fourth key form a key pair.

[0219] Optionally, AMF2 may allocate a campus temporary identifier to UE1. Figure 5 It is not shown in the figure. Please refer to the relevant contents of S403 for details. No further details will be given.

[0220] S510: AMF2 sends a second response and a first key to AMF1; accordingly, AMF1 receives the second response and the first key from AMF2.

[0221] The second response may be used to indicate that UE1 is allowed to access campus 320 through PLMN 310. For the specific implementation process of S510, please refer to the relevant content of S403, which will not be repeated here. It should be understood that the sending of the second response and the sending of the first key may be performed in one step, or may be performed separately in two steps, without limitation.

[0222] S511: AMF1 determines that UE1 is allowed to access campus 320 through PLMN310.

[0223] S511 is an optional step. Figure 5 Indicated by a dotted line. For example, AMF1 can determine whether to allow or deny UE1 to access campus 320 through PLMN310 based on the first quantity and the second information. For the specific implementation process, please refer to the relevant content of S403, which will not be repeated here. In this embodiment, AMF1 determines to allow UE1 to access campus 320 through PLMN310 as an example. Optionally, AMF1 can add 1 to the first quantity, and the first quantity is the total number of UEs accessing campus 320 through PLMN310.

[0224] S512: AMF1 cancels the restriction on messages transmitted between UE1 and campus 320 through PLMN310.

[0225] S512 is an optional step. Figure 5 For example, after AMF1 determines that UE1 is allowed to access campus 320 through PLMN310, the restriction on messages transmitted between UE1 and campus 320 through PLMN310 may be cancelled.

[0226] S513: AMF1 determines the second key and the third key according to the first key.

[0227] The second key can be used for secure transmission between UE1 and RAN1. The third key can be used for security protection of NAS messages transmitted between AMF1 and UE1. For the specific implementation process of S513, please refer to the relevant content of S404 and will not be repeated here. It should be understood that the determination of the second key and the determination of the third key can be performed in one step, or can also be performed separately in two steps without limitation.

[0228] S514: AMF1 sends the first response, the second key and the third information to RAN1. Correspondingly, RAN1 receives the first response, the second key and the third information.

[0229] The first response may be used to indicate that UE1 has successfully accessed campus 320. The third information may be used to indicate that UE1 initiates security protection of NAS messages transmitted between AMF1 and UE1. It should be understood that the sending of the first response, the sending of the second key, and the sending of the third information may be performed in one step, or may also be performed in two or three steps without limitation.

[0230] S515: RAN1 sends the first response and the third information to UE1. Correspondingly, UE1 receives the first response and the third information.

[0231] It should be understood that the sending of the first response and the sending of the third information may be performed in one step, or may be performed separately in two steps, without limitation.

[0232] S516: UE1 determines the fifth key according to the fourth key.

[0233] The fifth key is used for secure transmission between UE1 and RAN1. The fifth key and the second key form a key pair.

[0234] S517: UE1 determines a sixth key according to the fourth key in response to the third information.

[0235] The sixth key can be used to securely protect the NAS message transmitted between AMF1 and UE1. The sixth key and the third key form a key pair. Further, UE1 begins to securely protect the NAS message transmitted between AMF1 and UE1 according to the sixth key ( Figure 5 not shown).

[0236] For the specific implementation process of the above S513 to S517, please refer to the content of S404 and will not be repeated here.

[0237] Understandably, Figure 5 The execution order of each step is an example and is not limited to this. For example, AMF1 can cancel the restriction on the message transmitted between UE1 and campus 320 through PLMN310 before determining the second key and the third key according to the first key; or, after canceling the restriction on the message transmitted between UE1 and campus 320 through PLMN310, it can determine the second key and the third key according to the first key. For another example, UE1 can generate the fourth key before receiving the first response, or it can generate the fourth key after the first response.

[0238] Through the above method 400, the first terminal device can access the second network through the first network, and the implementation is simple. When the first network is a PLMN and the second network is a park, the terminal device is located outside the coverage of the park. The method 400 can enable the terminal device to remotely access the park through the PLMN, without the need for the terminal device and the park to support non-3GPP access technology. The implementation is simple and can reduce the complexity of the terminal device remotely accessing the park through the PLMN.

[0239] Figure 6 A flow chart of a second communication method provided in an embodiment of the present application. In this embodiment, a first terminal device requests to establish a session to a campus through a PLMN, and the first terminal device is a terminal device that has been registered to the campus through a PLMN. Figure 6 The method 600 shown can be applied to Figure 3 The communication system shown is not limited. Figure 6 As shown, the method 600 may include the following contents.

[0240] S601: The first terminal device sends a third request to a third control plane network element in the first network.

[0241] Correspondingly, the third control plane network element receives a third request from the first terminal device.

[0242] The S601 may also be expressed as: the first terminal device sends a third request to a third control plane network element in the PLMN; correspondingly, the third control plane network element receives the third request from the first terminal device.

[0243] The third request can be used to request the establishment of a first session from the first terminal device to the second network, that is, to request the establishment of a first session from the first terminal device to the campus. For example, after the first terminal device registers to the campus, the third request can be sent to the third control plane network element in the first network (that is, the PLMN). Among them, the third request itself can be used by the first terminal device to request the establishment of a first session to the campus. For example, the third request is a session establishment request message. Alternatively, the third request may also include information (or information element) for the first terminal device to request the establishment of a first session to the campus. The embodiment of the present application does not limit the specific implementation method of the third request.

[0244] Optionally, the third request may include but is not limited to one or more of the following: data network name (DNN), or slice identifier, etc.

[0245] Exemplarily, if the third control plane network element is SMF (which can be recorded as SMF1), the first terminal device sending the third request to the third control plane network element can be: the first terminal device sends the third request to AMF (which can be recorded as AMF1) in PLMN; AMF1 receives the third request from the first terminal device and sends the third request to SMF1. Correspondingly, SMF1 receives the third request.

[0246] In one example, AMF1 may send the identifier of the park to SMF1, such as carrying the identifier of the park in the third request. The identifier of the park may come from the first terminal device, or may come from AMF1, without limitation. For example, AMF1 saves the identifier of the park where the first terminal device is registered when the first terminal device registers to the park through the PLMN. Accordingly, SMF1 receives the identifier of the park.

[0247] In one example, AMF1 can send the subscription information of the campus to SMF1. Correspondingly, SMF1 receives the subscription information of the campus sent from AMF1. Alternatively, SMF1 can also obtain the subscription information of the campus based on the identification of the campus, without the need for AMF1 to send the subscription information of the campus to SMF1. Among them, the subscription information of the campus includes the QoS parameters of the campus's subscription in the PLMN. The QoS parameters may include but are not limited to: maximum bandwidth, scheduling priority, preemption priority, or QoS level, etc.

[0248] Optionally, AMF1 may also send the campus temporary identification of the first terminal device to SMF1, and carry the campus temporary identification of the first terminal device in the third request to SMF1. Please refer to the above content for the campus temporary identification, which will not be described in detail.

[0249] Optionally, AMF1 may send the encrypted SUPI of the first terminal device to SMF1, such as carrying the encrypted SUPI in the third request and sending it to SMF1. Please refer to the aforementioned content for the encrypted SUPI and will not repeat it here. It should be understood that the encrypted SUPI of the first terminal device and the campus temporary identification of the first terminal device may be sent separately or together, such as both carried in the third request and sent to SMF1, without limitation.

[0250] S602: The third control plane network element sends a fourth request to a fourth control plane network element in the second network according to the third request.

[0251] Correspondingly, the fourth control plane network element receives the fourth request from the third control plane network element.

[0252] S602 may also be expressed as: the third control plane network element sends a fourth request to a fourth control plane network element in the park according to the third request; correspondingly, the fourth control plane network element receives the fourth request from the third control plane network element.

[0253] The fourth request can be used for the third control plane network element to request the establishment of the first session. For example, after receiving the third request, the third control plane network element parses the third request, generates a fourth request, and sends the fourth request to the fourth control plane network element. For example, the third control plane network element can send the fourth request to the fourth control plane network element via a secure connection. For the description of the secure connection, please refer to the aforementioned content and will not be repeated here. Among them, the fourth request itself can be used to request the establishment of the first session. For example, the fourth request is a session establishment request message. Alternatively, the fourth request may also include information (or information element) for establishing the first session. Optionally, the information (or information element) for establishing the first session comes from the first terminal device and is not limited. The embodiment of the present application does not limit the specific implementation method of the fourth request.

[0254] The fourth request includes the endpoint information 1 of the first user plane network element in the first network, that is, the endpoint information 1 of the first user plane network element in the PLMN. The endpoint information 1 of the first user plane network element is used to establish a tunnel between the PLMN and the campus. Exemplarily, in response to the third request, the third control plane network element can select the first user plane network element in the PLMN to provide services for the first terminal device, and establish a connection with the first user plane network element for the first session. For example, the third control plane network element can select the first user plane network element according to one or more of the park identifier, DNN or slice to select the user plane network element that can support the session from the first terminal device to the campus, and the specific implementation process is not limited. In the process of the first user plane network element establishing a connection for the first session, the first user plane network element can allocate the endpoint information of the interface between the campus and the first session (recorded as the endpoint information 1 of the first user plane network element), and send the endpoint information to the third control plane network element; accordingly, the third control plane network element obtains the endpoint information of the first user plane network element. Optionally, the first user plane network element may also allocate endpoint information of the interface between the first access network network element and the first session (recorded as endpoint information 2 of the first user plane network element), and send the endpoint information to the first access network network element. The endpoint information may include an IP address and a general packet radio service tunneling protocol-user plane (GTP-U) identifier, without limitation.

[0255] Optionally, the fourth request may also include the campus temporary identifier and / or encrypted SUPI of the first terminal device.

[0256] In one example, the fourth control plane network element obtains the contract information of the first terminal device in the campus according to the campus temporary identifier or encrypted SUPI of the first terminal device. For example, the fourth control plane network element can obtain the contract information of the first terminal device from the UDM in the campus. Furthermore, the fourth control plane network element determines whether to allow the first terminal device to establish the first session according to the contract information of the first terminal device. For example, the fourth control plane network element can determine whether the DNN requested by the first terminal device to access is included in the contract information of the first terminal device according to the contract information of the first terminal device. If not, the first terminal device is not allowed to establish the first session.

[0257] S603: The fourth control plane network element sends a fourth response to the third control plane network element according to the fourth request.

[0258] Correspondingly, the third control plane network element receives a fourth response from the fourth control plane network element.

[0259] The fourth response includes the endpoint information of the second user plane network element in the second network, that is, the endpoint information of the second user plane network element in the park. The endpoint information of the second user plane is used to establish a tunnel between the PLMN and the park. The fourth response can be a session establishment response message, without limitation.

[0260] Exemplarily, in response to the fourth request, the fourth control plane network element may select a second user plane network element in the park to provide services for the first terminal device, and establish a connection with the second user plane network element for the first session. For example, the fourth control plane network element may select a user plane network element from the park that can support sessions accessed from the PLMN. For example, the fourth control plane network element may select a user plane network element located in a demilitarized zone (DMZ) in the park so as to isolate terminal devices accessed from the PLMN to prevent security issues from occurring in the park. In the process of the second user plane network element establishing a connection for the first session, the second user plane network element may allocate endpoint information of the interface between the PLMN and the first session (recorded as the endpoint information of the second user plane network element), and send the endpoint information to the fourth control plane network element; accordingly, the fourth control plane network element obtains the endpoint information of the second user plane network element. The embodiment of the present application does not limit the specific implementation process of the fourth control plane network element selecting the second user plane network element and the second user plane network element allocating the endpoint information.

[0261] In a possible implementation, the fourth control plane network element may allocate (or determine, or configure) a first QoS parameter for the first session, and send the first QoS parameter to the third control plane network element. The first QoS parameter is used to establish the first session. The first QoS parameter may include, but is not limited to, one or more of the following: maximum bandwidth, scheduling priority, preemption priority, or QoS level, etc. Exemplarily, the fourth control plane network element may determine the first QoS parameter corresponding to the first session based on the subscription information and / or policy control and charging (PCC) information of the first terminal device.

[0262] In one example, the fourth control plane network element can obtain the contract information of the first terminal device in the park, and determine the first QoS parameter based on the contract information. For example, the fourth control plane network element can determine the first QoS parameter based on the QoS parameter signed by the first terminal device in the park. For example, the fourth control plane network element can obtain the contract information of the first terminal device based on the encrypted SUPI of the first terminal device. For another example, the fourth control plane network element can obtain the contract information of the first terminal device based on the park temporary identifier of the first terminal device. For example, the fourth control plane network element determines the real park identifier of the first terminal device based on the park temporary identifier of the first terminal device, and obtains the contract information of the first terminal device based on the real park identifier; or, if the park temporary identifier of the first terminal device is registered in the data management network element of the park, the fourth control plane network element can obtain the contract information of the first terminal device based on the park temporary identifier.

[0263] In another example, the fourth control plane network element may obtain PCC information and determine the first QoS parameter based on the PCC information. For example, the fourth control plane network element may obtain the PCC information from the data management network element in the park based on the park temporary identifier or encrypted SUPI of the first terminal device, or may also obtain the PCC information from the PCF in the park, without limitation. The PCC information may include but is not limited to one or more of the following: priority, maximum bandwidth, guaranteed bandwidth, maximum data volume, etc.

[0264] Optionally, the fourth control plane network element may carry the first QoS parameter in a fourth response and send it to the third control plane network element, that is, the fourth response includes the first QoS parameter, without limitation.

[0265] S604: The third control plane network element sends a third response to the first terminal device.

[0266] Correspondingly, the first terminal device receives a third response from the third control plane network element.

[0267] The third response can be used to indicate the success or failure of the first session establishment. The embodiment of the present application is described by taking the third response as an example to indicate the success of the first session establishment. The third response can be, for example, a session establishment response message, without limitation. Exemplarily, after receiving the fourth response, the third control plane network element can generate a third response and send the third response to the first terminal device. For example, the third control plane network element sends the third response to the first access network network element, which is then forwarded to the first terminal device by the first access network network element. Among them, the third response itself can be used to indicate the success or failure of the first session establishment. For example, the third response is a NACK message, which can indicate that the first session establishment failed; or, the third response is an ACK message, which can indicate that the first session establishment was successful, without limitation. Alternatively, the third response can also include information (information element) for indicating the success or failure of the first session establishment. The information for indicating the success or failure of the first session establishment can be generated by the third control plane network element; or, it can also come from the fourth control plane network element, for example, the fourth response includes the information. The embodiment of the present application does not limit the specific implementation of the third response.

[0268] In a possible implementation, the third control plane network element receives the first QoS parameter from the fourth control plane network element, and determines whether to allow or refuse to establish the first session according to the first QoS parameter based on the contract information of the park. The embodiment of the present application is described by taking the third control plane network element determining that the first session is allowed to be established according to the first QoS parameter as an example. Through this implementation, the third control plane network element can further check the QoS parameters configured by the fourth control plane network element to avoid the problem that the QoS parameters configured by the fourth control plane network element do not match the QoS parameters contracted by the park.

[0269] Exemplarily, the third control plane network element may obtain the contract information of the campus, receive the first QoS parameter from the fourth control plane network element, and determine whether to allow or refuse to establish the first session according to the first QoS parameter based on the contract information of the campus. For example, if the maximum bandwidth in the first QoS parameter exceeds the maximum bandwidth of the campus contract, the third control plane network element refuses to establish the first session according to the first QoS parameter; or, if the maximum bandwidth in the first QoS parameter does not exceed the maximum bandwidth of the campus contract, the third control plane network element allows the first session to be established according to the first QoS parameter. For another example, if the priority in the first QoS parameter is outside the priority range of the campus contract, the third control plane network element refuses to establish the first session according to the first QoS parameter; or, if the priority in the first QoS parameter is within the priority range of the campus contract, the third control plane network element allows the first session to be established according to the first QoS parameter.

[0270] The third control plane network element may send a seventh request to the first access network network element, the seventh request being used to request the establishment of a first session, and the seventh request may include the endpoint information of the interface between the first user plane network element and the first access network network element (recorded as the endpoint information 2 of the first user plane network element). Optionally, the seventh request includes the first QoS parameter. Accordingly, the first access network network element receives the seventh request. The seventh request is, for example, a session establishment request message, without limitation. Further, in response to the seventh request, the first access network network element allocates the endpoint information of the interface between the first user plane network element (such as the endpoint information of the first access network network element), and sends a seventh response to the third control plane network element, the seventh response including the endpoint information of the first access network network element. Accordingly, the third control plane network element receives the seventh response from the first access network network element, and sends the endpoint information of the first access network network element to the first user plane network element. The first user plane network element receives the endpoint information of the first access network network element. The seventh response may be, for example, a session establishment response message, without limitation.

[0271] Optionally, the first access network element may further configure air interface resources in response to the seventh request, such as configuring the air interface resources according to the first QoS parameter.

[0272] Optionally, the seventh request may include a third response, that is, the third control plane network element carries the third response in the seventh request and sends it to the first access network network element; or, the third control plane network element may also send the third response and the seventh request to the first access network element respectively, without restriction.

[0273] After receiving the third response, the first terminal device can transmit data with the park through the first session.

[0274] The following method 600 is applied to Figure 3 As an example, the communication system shown in Figure 6 The process shown in FIG. 1 is described in detail. Among them, the first network is Figure 3 The second network is PLMN310 in the communication system shown. Figure 3 The communication system shown in the park 320. The first terminal device is Figure 3 UE1 in the communication system shown. The third control plane network element is Figure 3 The fourth control plane network element is SMF1 in the communication system shown. Figure 3 The first access network element is SMF2 in the communication system shown. Figure 3 RAN1 in the communication system shown.

[0275] Please refer to Figure 7 , is another flow chart of the second communication method provided in the embodiment of the present application. It should be understood that, Figure 7 This is an exemplary interaction diagram of method 600, and the embodiments of the present application are not limited thereto.

[0276] S701: UE1 sends a third request to AMF1. Correspondingly, AMF1 receives the third request from UE1. The third request may be used to request to establish a first session from UE1 to campus 320.

[0277] S702: AMF1 sends a third request to SMF1. Correspondingly, SMF1 receives the third request from AMF1.

[0278] The specific implementation process of the above S701 and S702 can refer to the content of S601 and will not be repeated here.

[0279] S703: SMF1 selects UPF1.

[0280] S704: SMF1 and UPF1 establish a connection for the first session. In the process of SMF1 and UPF1 establishing a connection for the first session, the SMF1 can obtain endpoint information 1 of UPF1 and endpoint information 2 of UPF1. The endpoint information 1 of UPF1 is used to establish a tunnel between UPF1 and campus 320. The endpoint information 2 of UPF1 is used to establish a tunnel between UPF1 and RAN1.

[0281] S705: SMF1 sends a fourth request to SMF2. Correspondingly, SMF2 receives the fourth request from SMF1. The fourth request is used by SMF1 to request to establish the first session. The fourth request includes the endpoint information of UPF1.

[0282] The specific implementation process of the above S703 and S705 can refer to the content of S602 and will not be repeated here.

[0283] S706: SMF2 selects UPF2.

[0284] S707: SMF2 and UPF2 establish a connection for the first session. During the process of SMF2 and UPF2 establishing a connection for the first session, the SMF2 may obtain the endpoint information of UPF2.

[0285] S708: SMF2 allocates a first QoS parameter to the first session. The first QoS parameter can be used to establish the first session.

[0286] S709: SMF2 sends the fourth response and the first QoS parameter to SMF1. Correspondingly, SMF1 receives the fourth response and the first QoS parameter from SMF2. The fourth response includes the endpoint information of UPF2. At this point, the tunnel between UPF1 and UPF2 is established.

[0287] The specific implementation process of the above S706 and S709 can refer to the content of S603 and will not be repeated here.

[0288] S710: SMF1 determines that the first session is allowed to be established according to the first QoS parameter. S710 is an optional step. Figure 7 For example, SMF1 may determine, based on the subscription information of the park and / or PCC, that the first session is allowed to be established based on the first QoS parameter. For the specific implementation process, reference may be made to the relevant content of S604 and will not be described in detail.

[0289] S711: SMF1 sends a seventh request to RAN1. Accordingly, RAN1 receives the seventh request from SMF1. The seventh request includes endpoint information 2 of UPF1 and a third response. The third response is used to indicate that the first session is successfully established. Optionally, the seventh request also includes the first QoS parameter, Figure 7 Not shown.

[0290] S712: RAN1 sends a seventh response to SMF1. Accordingly, SMF1 receives the seventh response from RAN1. The seventh response includes endpoint information of RAN1. For example, RAN1 allocates endpoint information of the interface with UPF1 in response to the seventh request, and sends the endpoint information to SMF1 in the seventh response.

[0291] Optionally, RAN1 may configure air interface resources for the first session, such as configuring air interface resources according to the first QoS parameter. Figure 7 Not shown.

[0292] S713: SMF1 sends the endpoint information of RAN1 to UPF1. Correspondingly, UPF1 receives the endpoint information of RAN1 from SMF1. At this point, the tunnel between RAN1 and UPF1 is established.

[0293] S714: RAN1 sends a third response to UE1. Correspondingly, UE1 receives the third response from RAN1.

[0294] For the specific implementation process of the above S711 to S714, please refer to the content of S604 and will not be repeated here.

[0295] Understandably, Figure 7 The execution order of each step is an example and is not limited thereto. For example, SMF2 may first select UPF2 and then allocate the first QoS parameter for the first session; or the first QoS parameter may first be allocated for the first session and then AMF1 may select UPF2.

[0296] It should be noted that method 400 and method 600 can be used separately or in combination without limitation. For example, after S404, that is, after the first terminal device accesses the second network element through the first network, method 600 can also be executed.

[0297] It is worth noting that if the third control plane network element is a combined network element of AMF and SMF, that is, the third control plane network element has the functions of AMF and SMF, then the first control plane network element in method 400 can be replaced by the third control plane network element. Similarly, if the first control plane network element is a combined network element of AMF and SMF, that is, the first control plane network element has the functions of AMF and SMF, then the third control plane network element in method 600 can be replaced by the first control plane network element. If method 300 and method. If the fourth control plane network element is a combined network element of AMF and SMF, that is, the fourth control plane network element has the functions of AMF and SMF, then the second control plane network element in method 400 can be replaced by the fourth control plane network element. If the second control plane network element is a combined network element of AMF and SMF, that is, the second control plane network element has the functions of AMF and SMF, then the fourth control plane network element in method 600 can be replaced by the second control plane network element.

[0298] Through the above method 600, the first session can be established between the first terminal device and the second network through the first network, and the implementation is simple. When the first network is a PLMN and the second network is a park, the method 600 can enable the terminal device to remotely access the park's services through the PLMN, without the need for the terminal device and the park to support non-3GPP access technology. The implementation is simple and can reduce the complexity of the terminal device remotely accessing the park through the PLMN.

[0299] The method provided in the embodiment of the present application is introduced in conjunction with communication scenario 1 above. Next, the method provided in the embodiment of the present application is introduced in conjunction with communication scenario 2.

[0300] Figure 8 A flow chart of a third communication method provided in an embodiment of the present application. In this embodiment, a second terminal device establishes a session to a PLMN through a campus request, and the second terminal device is a terminal device that has been registered with the campus. Figure 8 The method 800 shown can be applied to Figure 3 The communication system shown is not limited. Figure 8 As shown, the method 800 may include the following contents.

[0301] S801: The second terminal device sends a sixth request to the fourth control plane network element.

[0302] Correspondingly, the fourth control plane network element receives a sixth request from the second terminal device.

[0303] The sixth request can be used to request the establishment of a second session from the second terminal device to the first network, that is, to request the establishment of a second session from the second terminal device to the PLMN. The second terminal device is a terminal device that has been registered with the second network, that is, a terminal device registered with the park. Among them, the sixth request itself can be used by the second terminal device to request the establishment of a second session to the PLMN. For example, the sixth request is a session establishment request message. Alternatively, the sixth request may also include information (or information element) for the second terminal device to request the establishment of a second session to the PLMN. The embodiment of the present application does not limit the specific implementation method of the sixth request.

[0304] Optionally, the sixth request may also include, but is not limited to, one or more of the following: DNN, slice identifier, or PLMN service indication information, etc. It should be understood that the DNN included in the sixth request is the DNN requested by the second terminal device. The slice indicated by the slice identifier included in the sixth request is the slice requested by the second terminal device. Among them, the PLMN service indication information can be used to indicate that the second session is used for PLMN service. Exemplarily, if the fourth control plane network element is SMF (which can be recorded as SMF2), then the second terminal device sending the sixth request to the fourth control plane network element can be: the second terminal device sends the sixth request to the AMF (which can be recorded as AMF2) in the park; AMF2 receives the sixth request from the second terminal device, and sends the sixth request to SMF2. Accordingly, SMF2 receives the sixth request.

[0305] Optionally, the sixth request may also include a second identifier, which can be used to indicate the fourth QoS parameter requested by the second terminal device. In other words, the fourth QoS parameter can be understood as the second terminal device's expectation to establish a second session based on the fourth QoS parameter. The fourth QoS parameter may include, but is not limited to, one or more of the following: maximum bandwidth, scheduling priority, preemption priority, or QoS level, etc. Exemplarily, the second identifier can be an identifier of a QoS profile signed by the second terminal device (i.e., a QoS profile signed by the second terminal device in the campus). The QoS profile signed by the second terminal device includes the fourth QoS parameter.

[0306] S802: The fourth control plane network element sends a fifth request to the third control plane network element in the first network.

[0307] Correspondingly, the third control plane network element receives the fifth request from the fourth control plane network element.

[0308] The S802 may also be expressed as: the fourth control plane network element sends a fifth request to the third control plane network element in the PLMN; correspondingly, the third control plane network element receives the fifth request from the fourth control plane network element.

[0309] The fifth request can be used for the fourth control plane network element to request the establishment of a second session. For example, after receiving the sixth request, the fourth control plane network element parses the sixth request, generates the fifth request, and sends the sixth request to the third control plane network element. For example, the fourth control plane network element can send the sixth request to the third control plane network element through a secure connection. For the description of the secure connection, please refer to the aforementioned content and will not be repeated. Among them, the sixth request itself can be used to request the establishment of a second session. For example, the sixth request is a session establishment request message. Alternatively, the sixth request may also include information (or information element) for establishing a second session. Optionally, the information (or information element) for establishing a second session comes from the second terminal device, without limitation. The embodiment of the present application does not limit the specific implementation method of the sixth request. Optionally, the fifth request may include an identifier of the second network, that is, an identifier of the park. Optionally, the fifth request may also include a DNN and / or a slice identifier, etc. For example, the third control plane network element determines to carry a DNN and / or a slice identifier in the fifth request based on one or more of the subscription information of the second terminal device, the DNN requested by the second terminal device, or the slice identifier requested by the second terminal device.

[0310] Optionally, the fifth request may include endpoint information 1 of the second user plane network element in the second network, that is, endpoint information 1 of the second user plane network element in the park. The endpoint information 1 of the second user plane network element is used to establish a tunnel between the PLMN and the park. Exemplarily, in response to the sixth request, the fourth control plane network element may select the second user plane network element in the park to provide services for the second terminal device, and establish a connection with the second user plane network element for the second session. The specific implementation process of the fourth control plane network element selecting the second user plane network element can refer to the relevant content of S603 and will not be repeated here. In this embodiment, the second user plane network element can also allocate endpoint information of the interface between the second access network network element for the second session (recorded as endpoint information 2 of the second user plane network element), and send the endpoint information 2 to the second access network network element. The second terminal device accesses through the second access network network element.

[0311] Optionally, the fifth request may include a first identifier. The first identifier may be used to indicate a third QoS parameter of the second session (or determine, or configure). The third QoS parameter may include, but is not limited to, one or more of the following: maximum bandwidth, scheduling priority, preemption priority, or QoS level, etc. Exemplarily, the first identifier may be an identifier of a QoS profile subscribed by the campus (i.e., a QoS profile subscribed by the campus in the PLMN). The QoS profile subscribed by the campus includes the third QoS parameter.

[0312] In one example, the fourth control plane network element may determine the first identifier based on the subscription information and / or PCC information of the second terminal device. For example, the fourth control plane network element may obtain the subscription information of the second terminal device, the subscription information of the second terminal device includes at least one identifier, and determine the first identifier based on the at least one identifier. Each identifier in the at least one identifier may be used to indicate a set of QoS parameters. For example, one of the at least one identifier has a mapping relationship with the first identifier, and the fourth control plane network element determines the first identifier based on the mapping relationship, or one of the at least one identifier is the first identifier. Optionally, the fourth control plane network element may also consider the second identifier when determining the first identifier. For example, when the at least one identifier includes the second identifier, the fourth control plane network element determines the first identifier based on the second identifier. For another example, when the sixth request includes the second identifier, the fourth control plane network element determines the first identifier based on the second identifier. The specific implementation process of the fourth control plane obtaining the subscription information of the second terminal device can refer to the relevant content of S603 and will not be repeated.

[0313] In a possible implementation, the fourth control plane network element may determine whether to allow or deny the second terminal device to access the PLMN through the campus. In one example, the fourth control plane network element may obtain sixth information, which may be used to indicate whether to allow or deny the second terminal device to communicate with the PLMN through the campus, and determine whether to allow or deny the second terminal device to access the PLMN through the campus based on the sixth information. In other words, the fourth control plane network element may obtain the sixth information, and determine whether to send the fifth request to the third control plane network element based on the sixth information. For example, if the sixth information is used to indicate that the second terminal device is denied access to the PLMN through the campus, the fourth control plane network element denies the second terminal device access to the PLMN through the campus, in other words, there is no need to send the fifth request to the third control plane network element. Alternatively, if the sixth information is used to indicate that the second terminal device is accessing the PLMN through the campus, the fourth control plane network element allows the second terminal device to access the PLMN through the campus, in other words, it is determined to send the fifth request to the third control plane network element. Among them, the sixth information may be predefined, preconfigured, pre-agreed, or included in the contract information of the second terminal device, without limitation. For example, the fourth control plane network element obtains the subscription information of the second terminal device, and obtains the sixth information based on the subscription information of the second terminal device.

[0314] S803: The third control plane network element sends a fifth response to the fourth control plane network element.

[0315] Correspondingly, the fourth control plane network element receives a fifth response from the third control plane network element.

[0316] The fifth response includes the second QoS parameter and / or the third identifier. The third identifier is used to indicate the second QoS parameter. The second QoS parameter is the QoS parameter used when establishing the second session. In other words, the fourth control plane network element establishes the second session according to the second QoS parameter. It should be understood that when the fifth response includes the third identifier but does not include the second QoS parameter, the fourth control plane network element can determine the second QoS parameter according to the third identifier. Optionally, the third identifier can be the identifier of the QoS profile subscribed by the campus (i.e., the QoS profile subscribed by the campus in the PLMN). The second QoS parameter is included in the QoS profile subscribed by the campus.

[0317] In a possible implementation, after receiving the fifth request, the third control plane network element may determine the third identifier (or the second QoS parameter) according to the first identifier and / or the identifier of the park. Optionally, the third control plane network element determines the second QoS parameter according to the third identifier. The third identifier may be the same as or different from the first identifier. When the third identifier is different from the first identifier, the second QoS parameter level indicated by the third identifier may be lower than the third QoS parameter indicated by the first identifier. For example, the third identifier is included in the contract information of the park, and the third control plane network element may determine the third identifier in the contract information of the park. For example, the fifth request includes the identifier of the park, and the third control plane network element may obtain the contract information of the park according to the identifier of the park. The contract information of the park may include at least one identifier, and each of the at least one identifier may be used to indicate the QoS parameters of the park contracted in the PLMN.

[0318] Optionally, the fifth response may also include endpoint information of the first user plane network element in the first network. The specific implementation process may refer to the relevant content of S602 and will not be repeated here.

[0319] In a possible implementation, the third control plane network element may send fifth information to the first policy control network element in the first network, that is, send fifth information to the first policy control plane network element in the PLMN. The fifth information includes an identifier of the second network and a first identifier (or a third identifier). The fifth information is used by the first policy control network element to determine PCC information for the second session. Accordingly, the first policy control network element receives the fifth information, determines PCC information for the second session based on the fifth information, and sends the PCC information to the third control plane network element. The third control plane network element determines the second QoS parameter based on the PCC information.

[0320] S804: The fourth control plane network element sends a sixth response to the second terminal device.

[0321] Correspondingly, the second terminal device receives a sixth response from the fourth control plane network element.

[0322] The sixth response can be used to indicate the success or failure of the second session establishment. The embodiment of the present application is described by taking the sixth response indicating the success of the second session establishment as an example. The sixth response can be, for example, a session establishment response message, without limitation. Exemplarily, after receiving the fifth response, the fourth control plane network element can generate a sixth response and send the sixth response to the second terminal device. For example, the fourth control plane network element sends the sixth response to the second access network network element, which is then forwarded to the second terminal device by the second access network network element. Among them, the sixth response itself can be used to indicate the success or failure of the second session establishment, or the sixth response can also include information (information element) for indicating the success or failure of the second session establishment. For details, please refer to the content of the third response and will not be repeated. The information for indicating the success or failure of the second session establishment can be generated by the fourth control plane network element; or it can also come from the third control plane network element, for example, the fifth response includes the information. The embodiment of the present application does not limit the specific implementation method of the sixth response.

[0323] The fourth control plane network element may send an eighth request to the second access network network element, the eighth request being used to request the establishment of a second session, and the eighth request may include the endpoint information of the interface between the second user plane network element and the second access network network element (recorded as the endpoint information 2 of the second user plane network element). Optionally, the eighth request includes a second QoS parameter. Accordingly, the second access network network element receives the eighth request. The eighth request is, for example, a session establishment request message, which is not limited. In response to the eighth request, the second access network network element allocates the endpoint information of the interface between the second user plane network element (such as the endpoint information of the second access network network element), and sends an eighth response to the fourth control plane network element, the eighth response including the endpoint information of the second access network network element. Accordingly, the fourth control plane network element receives the eighth response from the second access network network element, and sends the endpoint information of the second access network network element to the second user plane network element. The second user plane network element receives the endpoint information of the second access network network element. The eighth response may be, for example, a session establishment response message, which is not limited.

[0324] Optionally, the second access network element may further configure air interface resources in response to the eighth request, such as configuring the air interface resources according to the second QoS parameters.

[0325] Optionally, the eighth request may include a sixth response, that is, the fourth control plane network element carries the sixth response in the eighth request and sends it to the second access network network element; or, the fourth control plane network element may also send the sixth response and the eighth request to the second access network element respectively, without restriction.

[0326] After receiving the sixth response, the second terminal device can transmit data with the PLMN through the second session.

[0327] The following method 800 is applied to Figure 3As an example, the communication system shown in Figure 8 The process shown in FIG. 1 is described in detail. Among them, the first network is Figure 3 The second network is PLMN310 in the communication system shown. Figure 3 The second terminal device is a campus 320 in the communication system shown. Figure 3 UE2 in the communication system shown. The third control plane network element is Figure 3 The fourth control plane network element is SMF1 in the communication system shown. Figure 3 The second access network element is SMF2 in the communication system shown. Figure 3 RAN2 in the communication system shown.

[0328] Please refer to Fig. 9 , is another flow chart of the second communication method provided in the embodiment of the present application. It should be understood that, Fig. 9 This is an exemplary interaction diagram of method 800, and the embodiments of the present application are not limited thereto.

[0329] S900: UE2 registers with the park 320. The embodiment of the present application does not limit the specific implementation process of UE2 registering with the park 320.

[0330] S901: UE2 sends a sixth request to AMF2. Accordingly, AMF2 receives the sixth request from UE2. The sixth request may be used to establish a second session from UE2 to PLMN310. Optionally, the sixth request may include a fourth QoS parameter.

[0331] S902: AMF2 sends a sixth request to SMF2. Correspondingly, SMF2 receives the sixth request from AMF2.

[0332] The specific implementation process of the above S901 and S902 can refer to the content of S801 and will not be repeated here.

[0333] S903: SMF2 selects UPF2.

[0334] S904: SMF2 and UPF2 establish a connection for the second session. In the process of SMF2 and UPF2 establishing a connection for the second session, the SMF2 may obtain endpoint information 1 of UPF2 and endpoint information 2 of UPF2. The endpoint information 1 of UPF2 is used to establish a tunnel between UPF2 and PLMN310. The endpoint information 2 of UPF2 is used to establish a tunnel between UPF2 and RAN2.

[0335] S905: SMF2 obtains a first identifier. The first identifier is used to indicate a third QoS parameter allocated by SMF2 to the second session.

[0336] S906: SMF2 sends a fifth request to SMF1. Correspondingly, SMF1 receives the fifth request from SMF2. The fifth request is used by SMF2 to request to establish a second session. The fifth request includes endpoint information 1 and the first identifier of UPF2.

[0337] The specific implementation process of the above S903 and S906 can refer to the content of S802 and will not be repeated here.

[0338] S907: SMF1 selects UPF1.

[0339] S908: SMF1 and UPF1 establish a connection for the second session. During the process of SMF1 and UPF1 establishing a connection for the second session, SMF1 may obtain endpoint information of UPF1.

[0340] S909: SMF1 determines a second QoS parameter according to the first identifier. The second QoS parameter may be used to establish a second session.

[0341] S910: SMF1 sends a fifth response to SMF2. Correspondingly, SMF2 receives the fifth response from SMF1. The fifth response includes the second QoS parameter and the endpoint information of UPF1. At this point, the tunnel between UPF1 and UPF2 is established.

[0342] The specific implementation process of the above S907 and S910 can refer to the content of S803 and will not be repeated here.

[0343] S911: SMF2 establishes a second session according to the second QoS parameters.

[0344] S912: SMF2 sends an eighth request to RAN2. Accordingly, RAN2 receives the eighth request from SMF2. The eighth request includes endpoint information 2 of UPF2 and a sixth response. The sixth response is used to indicate that the second session is successfully established. Optionally, the eighth request also includes a second QoS parameter, Fig. 9 Not shown.

[0345] S913: RAN2 sends an eighth response to SMF2. Accordingly, SMF2 receives the eighth response from RAN2. The eighth response includes endpoint information of RAN2. For example, RAN2 allocates endpoint information of the interface with UPF2 in response to the eighth request, and sends the endpoint information to SMF2 in the eighth response.

[0346] Optionally, RAN2 may configure air interface resources for the second session, such as configuring air interface resources according to the second QoS parameter. Fig. 9 Not shown.

[0347] S914: SMF2 sends the endpoint information of RAN2 to UPF2. Correspondingly, UPF2 receives the endpoint information of RAN2 from SMF2. At this point, the tunnel between RAN2 and UPF2 is established.

[0348] S915: RAN2 sends a sixth response to UE2. Correspondingly, UE2 receives the sixth response from RAN2.

[0349] For the specific implementation process of the above S911 to S915, please refer to the content of S804 and will not be repeated here.

[0350] Through the above method 800, the second session can be established between the second terminal device and the first network through the second network, and the implementation is simple. When the first network is a PLMN and the second network is a park, the method 800 can be used to enable the terminal device in the park to access the services of the PLMN through the park, without the need for the terminal device and the PLMN to support non-3GPP access technology. The implementation is simple and can reduce the complexity of the terminal device accessing the PLMN through the park.

[0351] In the present application, the method provided by the embodiment of the present application is introduced from the perspective of interaction between a plurality of communication devices such as a first control plane network element, a second control plane network element, a third control plane network element, a fourth control plane network element, and a first terminal device. In order to implement the method provided by each embodiment of the present application, each of the above-mentioned communication devices may include a hardware structure and / or a software module, and implement the above-mentioned functions in the form of a hardware structure, a software module, or a hardware structure plus a software module.

[0352] The following describes the communication device used to implement the above method in the embodiment of the present application in conjunction with the accompanying drawings. Therefore, the above contents can be used in subsequent embodiments, and repeated contents will not be repeated.

[0353] Fig.10 A schematic diagram of the structure of a communication device 1000 is shown. The communication device 1000 can implement the functions or steps implemented by the first control plane network element, the second control plane network element, the third control plane network element, the fourth control plane network element, or the first terminal device in the above-mentioned various method embodiments.

[0354] In a possible implementation, the communication device 1000 may include a processing module 1001 and a transceiver module 1002. The processing module 1001 may be used to execute the steps of the first control plane network element, the second control plane network element, the third control plane network element, the fourth control plane network element, or the first terminal device in any of the above method embodiments; the transceiver module 1002 may be used to receive or send relevant data, information or messages.

[0355] In another possible implementation, the communication device 1000 may include a transceiver module 1002, which can be used to execute the steps or methods of the first control plane network element, the second control plane network element, the third control plane network element, the fourth control plane network element, or the first terminal device in any of the above method embodiments.

[0356] In some possible implementations, the communication device 1000 can implement the behaviors and functions of the first control plane network element in the above method embodiments. For example, the communication device 1000 can be a first control plane network element, or a component (such as a chip or circuit) applied to the first control plane network element. The processing module 1001 is used to perform all operations except the transceiver operation performed by the first control plane network element in the above embodiments. The transceiver module 1002 can be used to perform all receiving or sending operations performed by the first control plane network element in the above embodiments.

[0357] Exemplarily, the transceiver module 1002 is used to receive a first request from a first terminal device, the first request being used by the first terminal device to request access to a second network; based on the first request, sending a second request to a second control plane network element in the second network, the second request being used by the first control plane network element to request access of the first terminal device to the second network; receiving a second response from the second control plane network element, the second response being used to indicate that the first terminal device is allowed to access the second network through the first network; and sending a first response to the first terminal device, the first response being used to indicate that the first terminal device has successfully accessed the second network.

[0358] In one possible implementation, the first request includes an identifier of the second network. Before sending the second request to the second control plane network element in the second network according to the first request, the processing module 1001 is also used to obtain first information according to the identifier of the second network, the first information being used to indicate that at least one terminal device is allowed to communicate with the second network through the first network, and the first terminal device belongs to at least one terminal device; and, based on the first information, determine to send the second request to the second control plane network element.

[0359] In one possible implementation, the first request includes an identifier of the second network. Before sending the second request to the second control plane network element in the second network according to the first request, the processing module 1001 is also used to obtain range information of the second network according to the identifier of the second network, where the range information is used to indicate a range in which at least one terminal device is allowed to access the second network, and the first terminal device belongs to at least one terminal device; based on the range information and the location information of the first terminal device, determine to send the second request to the second control plane network element.

[0360] In one possible implementation, the processing module 1001 is also used to limit messages transmitted between the first terminal device and the second network through the first network based on restriction information before receiving a second response from the second control plane network element, wherein the restriction information includes one or more of the following: the type of messages allowed to be transmitted between the first terminal device and the second network through the first network, the number of messages allowed to be transmitted between the first terminal device and the second network through the first network, or the duration allowed for the first terminal device and the second network to communicate through the first network; after receiving the second response, canceling the restriction on messages transmitted between the first terminal device and the second network through the first network.

[0361] In one possible implementation, before sending the second request to the second control plane network element in the second network according to the first request, the processing module 1001 is also used to establish a secure connection with the second control plane network element, and the secure connection is used for message transmission between the first control plane network element and the second control plane network element.

[0362] In a possible implementation, the processing module 1001 is also used to obtain a first number, where the first number is the total number of terminal devices that access the second network through the first network; based on the first number and the second information, determine whether the first terminal device is allowed to access the second network through the first network, and the second information includes the maximum number of terminal devices allowed to access the second network through the first network.

[0363] In a possible implementation, the processing module 1001 is further configured to add 1 to the first number.

[0364] In a possible implementation, the transceiver module 1002 is also used to receive a first key from a second control plane network element, and the first key is used for secure transmission between a first terminal device and a first network; the processing module 1001 is also used to determine a second key based on the first key, and the second key is used for secure transmission between the first terminal device and a first access network element of the first network, and the first terminal device accesses through the first access network element; the transceiver module 1002 is also used to send the second key to the first access network element.

[0365] In a possible implementation, the processing module 1001 is also used to determine a third key based on the first key, and the third key is used to perform security protection on the non-access layer NAS message transmitted between the first control plane network element and the first terminal device; the transceiver module 1002 is also used to send third information to the first terminal device, and the third information is used to instruct the first terminal device to start security protection on the NAS message transmitted between the first control plane network element and the first terminal device.

[0366] In one possible implementation, the processing module 1001 is also used to obtain fourth information, and the fourth information includes one or more of the following: the number of terminal devices that access the second network through the first network, the number of messages transmitted by the first terminal device between the first network and the second network, or the traffic consumed by the messages transmitted by the first terminal device between the first network and the second network; the transceiver module 1002 is also used to send the fourth information to the billing system.

[0367] In one possible implementation, after the first terminal device accesses the second network through the first network, the transceiver module 1002 is also used to receive a third request from the first terminal device, the third request is used to request to establish a first session from the first terminal device to the second network; according to the third request, send a fourth request to a fourth control plane network element in the second network, the fourth request is used to request to establish the first session, and the fourth request includes endpoint information of the first user plane network element in the first network; receive a fourth response from the fourth control plane network element, the fourth response includes endpoint information of the second user plane network element in the second network; send a third response to the first terminal device, and the third response is used to indicate that the first session is successfully established.

[0368] In one possible implementation, before sending the third response to the first terminal device, the processing module 1001 is also used to obtain the contract information of the second network, the contract information including one or more of the following: maximum bandwidth, scheduling priority, preemption priority, or quality of service QoS level; receiving the first QoS parameter corresponding to the first session from the fourth control plane network element; and determining, based on the contract information, that it is allowed to establish the first session based on the first QoS parameter.

[0369] In a possible implementation manner, the processing module 1001 is further configured to select a second user plane network element according to the third request; and obtain endpoint information of the second user plane network element.

[0370] In some possible implementations, the communication device 1000 can implement the behaviors and functions of the second control plane network element in the above method embodiments. For example, the communication device 1000 can be a second control plane network element, or a component (such as a chip or circuit) applied to the second control plane network element. The processing module 1001 is used to perform all operations except the transceiver operation performed by the second control plane network element in the above embodiments. The transceiver module 1002 can be used to perform all receiving or sending operations performed by the second control plane network element in the above embodiments.

[0371] Exemplarily, the transceiver module 1002 is used to receive a second request from a first control plane network element in a first network, where the second request is used by the first control plane network element to request that the first terminal device access the second network; based on the second request, a second response is sent to the first control plane network element, where the second response is used to indicate that the first terminal device is allowed to access the second network through the first network.

[0372] In one possible implementation, before sending a second response to the first control plane network element based on the second request, the processing module 1001 is also used to obtain a second number, where the second number is the total number of terminal devices that access the second network through the first network; based on the second number and the second information, determine whether the first terminal device is allowed to access the second network through the first network, and the second information includes the maximum number of terminal devices allowed to access the second network through the first network.

[0373] In a possible implementation, the processing module 1001 is further configured to add 1 to the second number.

[0374] In a possible implementation, before sending the second response to the first control plane network element according to the second request, the processing module 1001 is further used to authenticate and authorize the first terminal device.

[0375] In a possible implementation manner, the processing module 1001 is further configured to establish a secure connection with the first control plane network element, where the secure connection is used for message transmission between the first control plane network element and the second control plane network element.

[0376] In a possible implementation, the processing module 1001 is also used to allocate a first key to the first control plane network element, and the first key is used for secure transmission between the first terminal device and the first network; the transceiver module 1002 is also used to send the first key to the first control plane network element.

[0377] In one possible implementation, after the first terminal device accesses the second network through the first network, the transceiver module 1002 is also used to receive a fourth request from the first control plane network element, the fourth request is used to request to establish a first session from the first terminal device to the second network, and the fourth request includes endpoint information of the first user plane network element in the first network; according to the fourth request, a fourth response is sent to the first control plane network element, and the fourth response includes endpoint information of the second user plane network element in the second network.

[0378] In one possible implementation, the processing module 1001 is also used to obtain the contract information of the first terminal device, the contract information including one or more of the following: maximum bandwidth, scheduling priority, preemption priority, or quality of service QoS level; determine the first QoS parameter corresponding to the first session according to the contract information; the transceiver module 1002 is also used to send the first QoS parameter to the first control plane network element.

[0379] In a possible implementation manner, the processing module 1001 is further configured to select a second user plane network element according to the fourth request; and obtain endpoint information of the second user plane network element.

[0380] In some possible implementations, the communication device 1000 can implement the behaviors and functions of the first terminal device in the above method embodiments. For example, the communication device 1000 can be a first terminal device, or a component (such as a chip or circuit) used in the first terminal device. The processing module 1001 is used to perform all operations except the transceiver operation performed by the first terminal device in the above embodiments. The transceiver module 1002 can be used to perform all the receiving or sending operations performed by the first terminal device in the above embodiments.

[0381] Exemplarily, the transceiver module 1002 is used to send a first request to a first control plane network element in a first network, the first request including an identifier of a second network, and the first request is used by a first terminal device to request access to the second network; and receive a first response from the first control plane network element, the first response being used to indicate that the first terminal device has successfully accessed the second network.

[0382] In a possible implementation, the processing module 1001 is also used to generate a fourth key, which is a key generated after the first terminal device successfully authenticates the second network; determine the fifth key and / or determine the sixth key based on the fourth key, wherein the fifth key is used for secure transmission between the first terminal device and the first access network element of the first network, and the first terminal device accesses through the first access network element, and the sixth key is used to securely protect the non-access layer NAS message transmitted between the first control plane network element and the first terminal device.

[0383] In a possible implementation, the transceiver module 1002 is also used to receive third information from the first control plane network element, and the third information is used to instruct the first terminal device to start security protection for NAS messages transmitted between the first control plane network element and the first terminal device; the processing module 1001 is also used to respond to the third information and start using the sixth key to security protect NAS messages between the first control plane network element and the first terminal device.

[0384] In one possible implementation, the transceiver module 1002 is also used to send a third request to the first control plane network element after receiving a first response from the first control plane network element, the third request being used to request establishment of a first session from the first terminal device to the second network; and receive a fourth response from the first control plane network element, the third response being used to indicate that the first session is successfully established.

[0385] In some possible implementations, the communication device 1000 can implement the behaviors and functions of the third control plane network element in the above method embodiments. For example, the communication device 1000 can be a third control plane network element, or a component (such as a chip or circuit) applied to the third control plane network element. The processing module 1001 is used to perform all operations except the transceiver operation performed by the third control plane network element in the above embodiments. The transceiver module 1002 can be used to perform all receiving or sending operations performed by the third control plane network element in the above embodiments.

[0386] Exemplarily, the transceiver module 1002 is used to receive a fifth request from a fourth control plane network element in the second network, the fifth request is used to request to establish a second session from the second terminal device to the first network, the second terminal device is a terminal device that has been registered with the second network, and the fifth request includes a first identifier, and the first identifier is used to indicate a third quality of service QoS parameter allocated by the second network to the second session. The processing module 1001 is used to determine a second QoS parameter based on the first identifier, and the second QoS parameter is a QoS parameter used when establishing the second session. The transceiver module 1002 is also used to send a fifth response to the fourth control plane network element, and the fifth response includes the second QoS parameter.

[0387] In a possible implementation, the fifth request also includes an identifier of the second network. When determining the second QoS parameter corresponding to the second session based on the first identifier, the processing module 1001 is specifically used to: obtain a third QoS parameter based on the identifier of the second network and the first identifier; and determine the second QoS parameter based on the third QoS parameter.

[0388] In one possible implementation, when determining the second QoS parameter corresponding to the second session based on the first identifier, the sending module 1002 is specifically used to: send fifth information to the first policy control network element in the first network, the fifth information including the identifier of the second network and the first identifier, and the fifth information is used by the first policy control network element to determine policy control and billing information for the second session; receive policy control and billing information from the first policy control network element; the processing module 1001 is specifically used to: determine the second QoS parameter based on the policy control and billing information.

[0389] In a possible implementation, the QoS parameter includes one or more of the following: maximum bandwidth, scheduling priority, preemption priority, or QoS level.

[0390] In a possible implementation manner, the first identifier is an identifier of a QoS profile subscribed by the second network in the first network, and the QoS profile includes a third QoS parameter.

[0391] In some possible implementations, the communication device 1000 can implement the behavior and function of the fourth control plane network element in the above method embodiments. For example, the communication device 1000 can be a fourth control plane network element, or a component (such as a chip or circuit) applied to the fourth control plane network element. The processing module 1001 is used to perform all operations except the transceiver operation performed by the fourth control plane network element in the above embodiments. The transceiver module 1002 can be used to perform all receiving or sending operations performed by the fourth control plane network element in the above embodiments.

[0392] Exemplarily, the transceiver module 1002 is used to receive a sixth request from the second terminal device, the sixth request is used to request establishment of a second session from the second terminal device to the first network, and the second terminal device is a terminal device that has been registered with the second network; according to the sixth request, a fifth request is sent to the third control plane network element in the first network, the fifth request is used to request the fourth control plane network element to establish a second session, the fifth request includes a first identifier, and the first identifier is used to indicate the third quality of service QoS parameter allocated by the second network to the second session; a fifth response is received from the third control plane network element, the fifth response includes a second QoS parameter, and the second QoS parameter is a QoS parameter used when establishing the second session; a sixth response is sent to the second terminal device, and the sixth response is used to indicate that the second session is successfully established.

[0393] In one possible implementation, before sending a fifth request to the third control plane network element in the first network according to the sixth request, the processing module 1001 is also used to obtain sixth information, and the sixth information is used to indicate that the second terminal device is allowed to communicate with the first network through the second network; based on the sixth information, it is determined to send the fifth request to the third control plane network element.

[0394] In one possible implementation, the sixth request includes a second identifier, which is used to indicate the fourth QoS parameter requested by the second terminal device; before sending the fifth request to the third control plane network element in the first network, the processing module 1001 is specifically used to determine the first identifier based on the second identifier.

[0395] In one possible implementation, before sending the fifth request to the third control plane network element in the first network, the processing module 1001 is specifically used to obtain the contract information of the second terminal device, the contract information includes at least one identifier, and each identifier of the at least one identifier is used to indicate the QoS parameters of the contract of the second terminal device; determine the first identifier from the at least one identifier.

[0396] In a possible implementation, the QoS parameter includes one or more of the following: maximum bandwidth, scheduling priority, preemption priority, or QoS level.

[0397] It should be noted that the above-mentioned units may be independently configured or partially or completely integrated. For example, the transceiver module 1002 may include a sending module and a receiving module.

[0398] For a more detailed description of the processing module 1001 and the transceiver module 1002, please refer to Figures 4 to 8 The relevant description in any of the method embodiments shown in is directly obtained and will not be repeated here.

[0399] like Fig.11 As shown, an embodiment of the present application provides a structural diagram of a communication device 1100. The communication device 1100 may include a processor 1120, which is used to implement or support the communication device 1100 to implement the functions of the first control plane network element, the second control plane network element, the third control plane network element, the fourth control plane network element, or the first terminal device in any method embodiment of the present application. For details, please refer to the detailed description in the aforementioned method embodiment, which will not be repeated here. For example, the processor 1120 is used to read and execute program instructions through a communication interface so that the communication device 1100 implements the corresponding method. The processor 1120 may include one or more processors without limitation.

[0400] Specifically, the communication device 1100 can be a first terminal device or a functional module located in the first terminal device, which can implement the function of the first terminal device in any method embodiment of the present application; or, the communication device 1100 can be a first control plane network element or a functional module located in the first control plane network element, which can implement the function of the first control plane network element in any method embodiment of the present application; or, the communication device 1100 can be a second control plane network element or a functional module located in the second control plane network element, which can implement the function of the second control plane network element in any method embodiment of the present application; or, the communication device 1100 can be a third control plane network element or a functional module located in the third control plane network element, which can implement the function of the third control plane network element in any method embodiment of the present application; or, the communication device 1100 can be a fourth control plane network element or a functional module located in the fourth control plane network element, which can implement the function of the fourth control plane network element in any method embodiment of the present application.

[0401] It should be pointed out that the above-mentioned functional modules can be implemented by hardware or by a combination of hardware and software without limitation.

[0402] For example, the communication device 1100 may be a chip system, wherein the chip system may be composed of a chip, or may include a chip and other discrete devices, without limitation.

[0403] Optionally, the communication device 1100 may further include a memory 1130 for storing program instructions and / or data. The memory 1130 is coupled to the processor 1120. Coupling may be understood as an indirect coupling or communication connection between devices, units or modules, which may be electrical, mechanical or other forms, for information exchange between devices, units or modules. The processor 1120 may operate in coordination with the memory 1130. The memory 1130 may include one or more memories, without limitation.

[0404] Furthermore, the processor 1120 is configured to execute program instructions stored in the memory 1130 so that the communication device 1100 implements a corresponding method.

[0405] Among them, one or more memories in the memory 1130 may be included in the processor, and the memory 1130 may also exist independently, such as an off-chip memory, through a communication bus ( Fig.11 The memory 1130 and the processor 1120 may also be integrated together.

[0406] Optionally, the communication device 1100 further includes a communication interface 1110 ( Fig.11 The communication interface 1110 is used to communicate with other devices through a transmission medium, so that the device in the communication device 1100 can communicate with other devices. Exemplarily, when the communication device is a first control plane network element, the other device can be a second control plane network element, etc. The processor 1120 can use the communication interface 1110 to send and receive data.

[0407] The communication interface 1110 may be a transceiver. In hardware implementation, the transceiver may be used to implement the functions of the transceiver module 1402 , and the transceiver is integrated in the communication device 1100 to form the communication interface 1110 .

[0408] It should be noted that the specific connection medium between the communication interface 1110 , the processor 1120 , and the memory 1130 is not limited in the embodiments of the present application. Fig.11 In the figure, the memory 1130, the processor 1120 and the communication interface 1110 are connected via the communication bus 1140. The connection between other components is only for schematic illustration and is not limited thereto. The communication bus 1140 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.11 Only one thick line is used in the figure, but it does not mean that there is only one communication bus or one type of communication bus.

[0409] In the embodiment of the present application, the processor 1120 may be a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component. The general-purpose processor may be a microprocessor or any conventional processor, etc. The method disclosed in the embodiment of the present application may be executed by hardware in the processor, or by a combination of hardware and software in the processor.

[0410] In the embodiment of the present application, the memory 1130 may be a non-volatile memory, such as a hard disk drive (HDD) or a solid-state drive (SSD), etc., or a volatile memory (volatile memory), such as a random-access memory (RAM). The memory may also be any other medium for carrying or storing program codes in the form of instructions or data structures and accessible by a computer; or, a circuit or any other device capable of implementing a storage function, for storing program instructions and / or data.

[0411] An embodiment of the present application also provides a communication system, which may include one or more of the following: a first terminal device, a first control plane network element, a second control plane network element, a third control plane network element, or a fourth control plane network element.

[0412] Among them, the first control plane network element, the second control plane network element, the third control plane network element, the fourth control plane network element, or the first terminal device can all refer to the description in the aforementioned method embodiments, and will not be repeated here.

[0413] A computer-readable storage medium is also provided in an embodiment of the present application, including program instructions, which, when executed on a computer, enables the computer to execute the method or steps of any communication device in the above-mentioned embodiments (for example, the first control plane network element, the second control plane network element, the third control plane network element, the fourth control plane network element, or the first terminal device).

[0414] A computer program product is also provided in an embodiment of the present application, including program instructions, which, when executed on a computer, enable the computer to execute the method or steps of any communication device in the above-mentioned embodiments (for example, the first control plane network element, the second control plane network element, the third control plane network element, the fourth control plane network element, or the first terminal device).

[0415] The embodiment of the present application provides a chip system, which includes a processor, and is used to implement the functions of the first control plane network element, the second control plane network element, the third control plane network element, the fourth control plane network element, or the first terminal device in the aforementioned method (for example, execute the corresponding method or step). The chip system can be composed of chips, or can include chips and other discrete devices.

[0416] Optionally, the chip system also includes a memory, which is used to store program instructions so that the above-mentioned processor can read and execute them to implement the corresponding method.

[0417] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0418] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0419] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0420] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0421] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0422] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0423] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can essentially or in other words, the part that contributes or the part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0424] The above is only a specific implementation of the present application, but the protection scope of the embodiments of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the embodiments of the present application, which should be included in the protection scope of the embodiments of the present application. Therefore, the protection scope of the embodiments of the present application should be based on the protection scope of the claims.

Claims

1. A communication method, applied to a first control plane network element in a first network, characterized in that: include: receiving a first request from a first terminal device, where the first request is used by the first terminal device to request access to the second network; Sending a second request to a second control plane network element in the second network according to the first request, where the second request is used by the first control plane network element to request that the first terminal device be connected to the second network; receiving a second response from the second control plane network element, where the second response is used to indicate that the first terminal device is allowed to access the second network through the first network; A first response is sent to the first terminal device, where the first response is used to indicate that the first terminal device has successfully accessed the second network.

2. The method according to claim 1, characterized in that The first request includes an identifier of the second network, and before sending the second request to a second control plane network element in the second network according to the first request, the method further includes: acquiring, according to an identifier of the second network, first information, where the first information is used to indicate that at least one terminal device is allowed to communicate with the second network through the first network, and the first terminal device belongs to the at least one terminal device; Determine, based on the first information, to send the second request to the second control plane network element.

3. The method according to claim 1 or 2, characterized in that: The first request includes an identifier of the second network, and before sending the second request to a second control plane network element in the second network according to the first request, the method further includes: Acquire, according to the identifier of the second network, range information of the second network, where the range information is used to indicate a range in which at least one terminal device is allowed to access the second network, and the first terminal device belongs to the at least one terminal device; According to the range information and the location information of the first terminal device, determine to send the second request to the second control plane network element.

4. The method according to any one of claims 1 to 3, characterized in that The method further comprises: Before receiving the second response from the second control plane network element, restricting messages transmitted between the first terminal device and the second network through the first network according to restriction information, wherein the restriction information includes one or more of the following: types of messages allowed to be transmitted between the first terminal device and the second network through the first network, the number of messages allowed to be transmitted between the first terminal device and the second network through the first network, or the duration of time allowed for the first terminal device and the second network to communicate through the first network; After receiving the second response, the restriction on messages transmitted between the first terminal device and the second network through the first network is cancelled.

5. The method according to any one of claims 1 to 4, characterized in that Before sending a second request to a second control plane network element in the second network according to the first request, the method further includes: A secure connection is established with the second control plane network element, where the secure connection is used for message transmission between the first control plane network element and the second control plane network element.

6. The method according to any one of claims 1 to 5, characterized in that The method further comprises: Acquire a first quantity, where the first quantity is the total number of terminal devices accessing the second network through the first network; According to the first number and second information, it is determined that the first terminal device is allowed to access the second network through the first network, and the second information includes a maximum number of terminal devices allowed to access the second network through the first network.

7. The method according to claim 6, characterized in that The method further comprises: The first number is increased by 1.

8. The method according to any one of claims 1 to 7, characterized in that: The method further comprises: receiving a first key from the second control plane network element, where the first key is used for secure transmission between the first terminal device and the first network; Determine a second key according to the first key, where the second key is used for secure transmission between the first terminal device and a first access network element of the first network, and the first terminal device accesses through the first access network element; Send the second key to the first access network element.

9. The method according to claim 8, characterized in that The method further comprises: Determine a third key according to the first key, where the third key is used to perform security protection on a non-access layer NAS message transmitted between the first control plane network element and the first terminal device; Send third information to the first terminal device, where the third information is used to instruct the first terminal device to start security protection for NAS messages transmitted between the first control plane network element and the first terminal device.

10. The method according to any one of claims 1 to 9, characterized in that: The method further comprises: Acquire fourth information, where the fourth information includes one or more of the following: the number of terminal devices accessing the second network through the first network, the number of messages transmitted between the first terminal device and the second network through the first network, or the traffic consumed by the first terminal device for transmitting messages between the first network and the second network through the first network; The fourth information is sent to the billing system.

11. The method according to any one of claims 1 to 10, characterized in that After the first terminal device accesses the second network through the first network, the method further includes: receiving a third request from the first terminal device, wherein the third request is used to request to establish a first session from the first terminal device to the second network; Sending a fourth request to a fourth control plane network element in the second network according to the third request, where the fourth request is used to request to establish the first session, and the fourth request includes endpoint information of the first user plane network element in the first network; receiving a fourth response from the fourth control plane network element, the fourth response including endpoint information of a second user plane network element in the second network; A third response is sent to the first terminal device, where the third response is used to indicate that the first session is successfully established.

12. The method according to claim 11, characterized in that Before sending the third response to the first terminal device, the method further includes: Acquire the subscription information of the second network, where the subscription information includes one or more of the following: maximum bandwidth, scheduling priority, preemption priority, or quality of service QoS level; Receiving a first QoS parameter corresponding to the first session from the fourth control plane network element; Determine, based on the subscription information, that establishment of the first session based on the first QoS parameter is allowed.

13. The method according to claim 11 or 12, characterized in that: The method further comprises: Selecting the second user plane network element according to the third request; Obtain endpoint information of the second user plane network element.

14. A communication method, applied to a second control plane network element in a second network, characterized in that: include: receiving a second request from a first control plane network element in the first network, where the second request is used by the first control plane network element to request that the first terminal device be connected to the second network; According to the second request, a second response is sent to the first control plane network element, where the second response is used to indicate that the first terminal device is allowed to access the second network through the first network.

15. The method according to claim 14, characterized in that Before sending a second response to the first control plane network element according to the second request, the method further includes: Acquire a second number, where the second number is the total number of terminal devices accessing the second network through the first network; According to the second number and second information, it is determined that the first terminal device is allowed to access the second network through the first network, and the second information includes a maximum number of terminal devices allowed to access the second network through the first network.

16. The method according to claim 15, characterized in that The method further comprises: The second number is incremented by 1.

17. The method according to any one of claims 14 to 16, characterized in that Before sending a second response to the first control plane network element according to the second request, the method further includes: The first terminal device is authenticated and authorized.

18. The method according to any one of claims 14 to 17, characterized in that The method further comprises: A secure connection is established with the first control plane network element, where the secure connection is used for message transmission between the first control plane network element and the second control plane network element.

19. The method according to any one of claims 14 to 18, characterized in that The method further comprises: Allocating a first key to the first control plane network element, where the first key is used for secure transmission between the first terminal device and the first network; Send the first key to the first control plane network element.

20. The method according to any one of claims 14 to 19, characterized in that After the first terminal device accesses the second network through the first network, the method further includes: receiving a fourth request from the first control plane network element, the fourth request being used to request establishment of a first session from the first terminal device to the second network, the fourth request including endpoint information of a first user plane network element in the first network; According to the fourth request, a fourth response is sent to the first control plane network element, where the fourth response includes endpoint information of a second user plane network element in the second network.

21. The method according to claim 20, characterized in that The method further comprises: Acquire the contract information of the first terminal device, where the contract information includes one or more of the following: maximum bandwidth, scheduling priority, preemption priority, or quality of service QoS level; Determine a first QoS parameter corresponding to the first session according to the subscription information; Send the first QoS parameter to the first control plane network element.

22. The method according to claim 20 or 21, characterized in that The method further comprises: Selecting the second user plane network element according to the fourth request; Obtain endpoint information of the second user plane network element.

23. A communication method, applied to a first terminal device, characterized in that: include: Sending a first request to a first control plane network element in the first network, where the first request includes an identifier of the second network, and the first request is used by the first terminal device to request access to the second network; Receive a first response from the first control plane network element, where the first response is used to indicate that the first terminal device has successfully accessed the second network.

24. The method according to claim 23, characterized in that The method further comprises: Generate a fourth key, where the fourth key is a key generated after the first terminal device successfully authenticates the second network; The fifth key and / or the sixth key are determined based on the fourth key, wherein the fifth key is used for secure transmission between the first terminal device and the first access network element of the first network, the first terminal device accesses through the first access network element, and the sixth key is used for security protection of non-access layer NAS messages transmitted between the first control plane network element and the first terminal device.

25. The method according to claim 24, characterized in that The method further comprises: receiving third information from the first control plane network element, where the third information is used to instruct the first terminal device to start security protection for a NAS message transmitted between the first control plane network element and the first terminal device; In response to the third information, start using the sixth key to securely protect NAS messages between the first control plane network element and the first terminal device.

26. The method according to any one of claims 23 to 25, characterized in that After receiving the first response from the first control plane network element, the method further includes: Sending a third request to the first control plane network element, where the third request is used to request establishment of a first session from the first terminal device to the second network; A fourth response is received from the first control plane network element, where the third response is used to indicate that the first session is successfully established.

27. A communication method, applied to a third control plane network element in a first network, characterized in that: include: receiving a fifth request from a fourth control plane network element in the second network, the fifth request being used to request establishment of a second session from a second terminal device to the first network, the second terminal device being a terminal device that has been registered with the second network, the fifth request including a first identifier, the first identifier being used to indicate a third quality of service QoS parameter allocated by the second network to the second session; Determine a second QoS parameter according to the first identifier, where the second QoS parameter is a QoS parameter used when establishing the second session; Send a fifth response to the fourth control plane network element, where the fifth response includes the second QoS parameter.

28. The method according to claim 27, characterized in that The fifth request further includes an identifier of the second network, and determining a second QoS parameter corresponding to the second session according to the first identifier includes: Acquire the third QoS parameter according to the identifier of the second network and the first identifier; The second QoS parameter is determined according to the third QoS parameter.

29. The method according to claim 27 or 28, characterized in that The determining, according to the first identifier, a second QoS parameter corresponding to the second session includes: Sending fifth information to a first policy control network element in the first network, where the fifth information includes an identifier of the second network and the first identifier, and the fifth information is used by the first policy control network element to determine policy control and charging information for the second session; receiving the policy control and charging information from the first policy control network element; The second QoS parameter is determined according to the policy control and charging information.

30. The method according to any one of claims 27 to 29, characterized in that The QoS parameters include one or more of the following: maximum bandwidth, scheduling priority, preemption priority, or QoS level.

31. The method according to any one of claims 27 to 30, characterized in that The first identifier is an identifier of a QoS profile to which the second network subscribes in the first network, and the QoS profile includes the third QoS parameter.

32. A communication method, applied to a fourth control plane network element in a second network, characterized in that: include: receiving a sixth request from a second terminal device, the sixth request being used to request establishment of a second session from the second terminal device to the first network, the second terminal device being a terminal device that has been registered with the second network; Sending a fifth request to a third control plane network element in the first network according to the sixth request, where the fifth request is used by the fourth control plane network element to request establishment of the second session, where the fifth request includes a first identifier, where the first identifier is used to indicate a third quality of service QoS parameter allocated by the second network to the second session; receiving a fifth response from the third control plane network element, wherein the fifth response includes a second QoS parameter, where the second QoS parameter is a QoS parameter used when establishing the second session; A sixth response is sent to the second terminal device, where the sixth response is used to indicate that the second session is successfully established.

33. The method according to claim 32, characterized in that Before sending a fifth request to a third control plane network element in the first network according to the sixth request, the method further includes: Acquire sixth information, where the sixth information is used to indicate that the second terminal device is allowed to communicate with the first network through the second network; According to the sixth information, determine to send the fifth request to the third control plane network element.

34. The method according to claim 32 or 33, characterized in that The sixth request includes a second identifier, where the second identifier is used to indicate a fourth QoS parameter requested by the second terminal device; Before sending the fifth request to the third control plane network element in the first network, the method further includes: The first identifier is determined according to the second identifier.

35. The method according to any one of claims 32 to 34, characterized in that Before sending the fifth request to the third control plane network element in the first network, the method further includes: Acquire subscription information of the second terminal device, where the subscription information includes at least one identifier, and each identifier of the at least one identifier is used to indicate a QoS parameter subscribed by the second terminal device; The first identification is determined from the at least one identification.

36. The method according to any one of claims 32 to 35, characterized in that The QoS parameters include one or more of the following: maximum bandwidth, scheduling priority, preemption priority, or QoS level.

37. A communication device, characterized in that: Comprising a module for executing the method as described in any one of claims 1 to 13, or a module for executing the method as described in any one of claims 14 to 22, or a module for executing the method as described in any one of claims 23 to 26, or a module for executing the method as described in any one of claims 27 to 31, or a module for executing the method as described in any one of claims 32 to 36.

38. A communication device, characterized in that: including a processor and a memory; The memory is used to store one or more computer programs or instructions, and the processor is used to execute the one or more computer programs or instructions stored in the memory, so that the communication device performs the method as described in any one of claims 1 to 13, or the method as described in any one of claims 14 to 22, or the method as described in any one of claims 23 to 26, or the method as described in any one of claims 27 to 31, or the method as described in any one of claims 32 to 36.

39. A communication system, characterized in that: It includes a first control plane network element, a second control plane network element and a first terminal device, or includes a third control plane network element and a fourth control plane network element, wherein the first control plane network element is used to execute the method as described in any one of claims 1 to 13, the second control plane network element is used to execute the method as described in any one of claims 14 to 22, the first terminal device is used to execute the method as described in any one of claims 23 to 26, the third control plane network element is used to execute the method as described in any one of claims 27 to 31, and the fourth control plane network element is used to execute the method as described in any one of claims 32 to 36.

40. A computer-readable storage medium, characterized in that A computer program or instructions is stored, the computer program or instructions being used to implement the method as claimed in any one of claims 1 to 13, or the method as claimed in any one of claims 14 to 22, or the method as claimed in any one of claims 23 to 26, or the method as claimed in any one of claims 27 to 31, or the method as claimed in any one of claims 32 to 36.

41. A computer program product, characterized in that The computer program product comprises a computer program which, when executed on a computer, causes the computer to perform the method according to any one of claims 1 to 13, or the method according to any one of claims 14 to 22, or the method according to any one of claims 23 to 26, or the method according to any one of claims 27 to 31, or the method according to any one of claims 32 to 36.

Images