Communication method, device and system

Abstract

The embodiment of the invention provides a communication method, device and system, relates to the technical field of communication, and can smoothly realize network slice authentication in a scene of network slice replacement. The method comprises: a mobility management network element receiving a notification message, the notification message being used for indicating that a first network slice needs to be replaced by a second network slice, the first network slice being a network slice currently accessed by a UE; and before the UE accesses the second network slice, the mobility management network element sends to-be-authenticated network slice information to the UE, the to-be-authenticated network slice information comprising an identifier of the second network slice, and the to-be-authenticated network slice information being used for triggering execution of an authentication process on the second network slice.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of communication technology, and in particular, to a communication method, device and system. Background Art

[0002] In 3GPP R16 (communication standard protocol), the concept of network slice-specific authentication and authorization (NSSAA) is introduced. Before accessing a network slice in a communication network, the user equipment (UE) needs to determine whether the NSSAA process needs to be performed on the network slice.

[0003] If the UE supports the capability of the NSSAA process, and there is at least one network slice that needs to perform NSSAA in the network slices included in the registration request sent by the UE to the access and mobility management function (AMF) network element, the AMF triggers the NSSAA process.

[0004] When the resources of some network slices in the communication network are insufficient or cannot be used any more, network slice replacement (i.e., network slice replacement) can be performed to replace the old network slice with a new one, and service continuity can be achieved by using the resources of the new network slice. However, during the network slice replacement process, if the new network slice needs to execute the NSSAA process, then how to execute the NSSAA process on the new network slice needs to be solved. Summary of the invention

[0005] The embodiments of the present application provide a communication method, device and system that can smoothly implement network slice authentication in the scenario of network slice replacement.

[0006] In order to achieve the above purpose, the embodiment of the present application adopts the following technical solution:

[0007] In a first aspect, an embodiment of the present application provides a communication method, including: a mobility management network element receives a notification message, the notification message is used to indicate that a first network slice needs to be replaced with a second network slice, and the first network slice is the network slice currently accessed by the UE; before the UE accesses the second network slice, the mobility management network element sends network slice information to be authenticated to the UE, the network slice information to be authenticated includes an identifier of the second network slice, and the network slice information to be authenticated is used to trigger an authentication process for the second network slice.

[0008] The communication method provided in the embodiment of the present application can smoothly implement network slice authentication in the scenario of network slice replacement, thereby avoiding the security risks brought about by the UE's arbitrary access to the second network slice due to failure to authenticate the second network slice.

[0009] In a possible implementation, the mobility management network element sends the network slice information to be authenticated to the UE, including: the mobility management network element sends a first configuration update control message to the UE, and the first configuration update control message includes the network slice information to be authenticated. In this solution, the mobility management network element can send a configuration update control message to the UE through the UCU process to instruct the UE to perform an authentication process on the second network slice, so that when the first network slice is congested or unavailable, the second network slice needs to be used to replace the first network slice, and the UE has not yet initiated a PDU session establishment request. The scenario smoothly realizes network slice authentication, thereby avoiding the security risk caused by the UE's arbitrary access to the second network slice due to non-authentication of the second network slice.

[0010] In a possible implementation, the mobility management network element sends the network slice information to be authenticated to the UE, including: the mobility management network element sends a registration acceptance message to the UE, and the registration acceptance message includes the network slice information to be authenticated. In this solution, the mobility management network element can send a configuration update control message to the UE through the UCU process to trigger the UE to initiate a re-registration process, and then the AMF initiates the authentication process for the second network slice, which can achieve the situation where the first network slice is congested or unavailable and the second network slice needs to be used to replace the first network slice, and the UE has not yet initiated a PDU session establishment request. The network slice authentication is smoothly implemented, thereby avoiding the security risk caused by the UE's arbitrary access to the second network slice due to non-authentication of the second network slice.

[0011] In a possible implementation, before the mobility management network element sends a registration acceptance message to the UE, the communication method provided in the embodiment of the present application further includes: the mobility management network element sends a second configuration update control message to the UE, and the second configuration update control message is used to trigger the UE to initiate a registration process; and the mobility management network element receives a registration request message from the UE. Triggering the UE to initiate a registration process through the second configuration update control message can further enable the AMF to initiate an authentication process for the second network slice.

[0012] In one possible implementation, the communication method provided in an embodiment of the present application includes: the mobility management network element initiates an authentication process for the second network slice; and determines that the authentication of the second network slice is successful; and sends a third configuration update control message to the UE, the third configuration update control message includes network slice information allowed for access, and the network slice information allowed for access includes an identifier of the second network slice.

[0013] In a possible implementation, the third configuration update control message also includes: a mapping relationship between the first network slice and the second network slice. According to the mapping relationship between the first network slice and the second network slice, the AMF and the UE interact to enable the UE to access the second network slice, thereby realizing network slice replacement.

[0014] In one possible implementation, before the mobility management network element receives the notification message, the communication method provided in the embodiment of the present application also includes: the mobility management network element receives a first session establishment request from the UE, the first session establishment request includes an identifier of the first network slice, and the first session establishment request is used to trigger establishment of a PDU session associated with the first network slice.

[0015] Furthermore, after the second network slice is successfully authenticated, the communication method provided in the embodiment of the present application also includes: if the PDU session associated with the first network slice is not established, the mobility management network element sends a second session establishment request to the session management network element, and the second session establishment request includes an identifier of the second network slice, and the second session establishment request is used to trigger the establishment of a PDU session associated with the second network slice.

[0016] In an embodiment of the present application, after the mobility management network element successfully authenticates the second network slice, the mobility management network element can convert the PDU session previously initiated by the UE to establish an association with the first network slice into a PDU session associated with the second network slice. This can avoid the security risks caused by the UE's arbitrary access to the second network slice due to failure to authenticate the second network slice, and can also smoothly establish a PDU session for the UE.

[0017] In a possible implementation, the communication method provided by the embodiment of the present application also includes: when the UE has established a protocol data unit PDU session associated with the first network slice, the mobility management network element triggers a session modification process for migrating the PDU session from the first network slice to the second network slice. After the first network slice is replaced by the second network slice, the PDU session originally associated with the first network slice is migrated to the second network slice, which can ensure that the continuity of the service is not affected.

[0018] In one possible implementation, before the above-mentioned mobility management network element sends the network slice information to be authenticated to the UE, the communication method provided in the embodiment of the present application also includes: the mobility management network element determines whether it is necessary to perform an authentication process on the second network slice based on the UE's subscription data.

[0019] In a second aspect, an embodiment of the present application provides a communication method, including: a mobility management network element receives a session establishment request from a UE, the session request includes an identifier of a first network slice, and the session establishment request is used to trigger establishment of a PDU session associated with the first network slice; thereafter, the mobility management network element receives a notification message, the notification message is used to indicate that the first network slice needs to be replaced with a second network slice; when the mobility management network element determines that an authentication process needs to be performed on the second network slice, the mobility management network element sends an indication information to the UE, and the indication information is used to indicate a refusal to establish a PDU session associated with the first network slice.

[0020] In the communication method provided in the embodiment of the present application, when the mobility management network element determines that the second network slice needs to be replaced by the first network slice, it needs to consider whether to authenticate the second network slice. When the second network slice needs to be authenticated, the AMF refuses to establish a PDU session associated with the first network slice. This can avoid the security risks caused by the UE's arbitrary access to the second network slice due to failure to authenticate the second network slice.

[0021] In one possible implementation, before the mobility management network element sends indication information to the UE, the communication method provided in the embodiment of the present application also includes: the mobility management network element determines that the UE has not executed the authentication process of the second network slice; or, the mobility management network element does not store the authentication result of the UE executing the authentication process of the second network slice.

[0022] In one possible implementation, before the mobility management network element sends indication information to the UE, the communication method provided in the embodiment of the present application also includes: the mobility management network element determines whether it is necessary to perform an authentication process on the second network slice based on the subscription data of the UE.

[0023] In a third aspect, an embodiment of the present application provides a communication device, comprising: a receiving module and a sending module. The receiving module is used to receive a notification message, the notification message is used to indicate that a first network slice needs to be replaced with a second network slice, and the first network slice is the network slice currently accessed by the UE; the sending module is used to send network slice information to be authenticated to the UE before the UE accesses the second network slice, the network slice information to be authenticated includes an identifier of the second network slice, and the network slice information to be authenticated is used to trigger an authentication process for the second network slice.

[0024] In one possible implementation, the sending module is specifically used to send a first configuration update control message to the UE, and the first configuration update control message includes network slice information to be authenticated.

[0025] In one possible implementation, the sending module is specifically used to send a registration acceptance message to the UE, where the registration acceptance message includes network slice information to be authenticated.

[0026] In a possible implementation, the sending module is further used to send a second configuration update control message to the UE, where the second configuration update control message is used to trigger the UE to initiate a registration process; and the receiving module is further used to receive a registration request message from the UE.

[0027] In a possible implementation, the communication device provided in the embodiment of the present application further includes a processing module and a determination module. The processing module is used to initiate an authentication process for the second network slice; the determination module is used to determine that the authentication of the second network slice is successful. The sending module is also used to send a third configuration update control message to the UE, and the third configuration update control message includes network slice information allowed to be accessed, and the network slice information allowed to be accessed includes an identifier of the second network slice.

[0028] In one possible implementation, the third configuration update control message also includes a mapping relationship between the first network slice and the second network slice.

[0029] In one possible implementation, the receiving module is also used to receive a first session establishment request from the UE, the first session establishment request includes an identifier of the first network slice, and the first session establishment request is used to trigger the establishment of a PDU session associated with the first network slice; the sending module is also used to send a second session establishment request to the session management network element if the PDU session associated with the first network slice is not established, the second session establishment request includes an identifier of the second network slice, and the second session establishment request is used to trigger the establishment of a PDU session associated with the second network slice.

[0030] In one possible implementation, the processing module is also used to trigger a session modification process for migrating the PDU session from the first network slice to the second network slice when the UE has established a PDU session associated with the first network slice.

[0031] In one possible implementation, the determination module is also used to determine whether it is necessary to perform an authentication process on the second network slice based on the UE's subscription data.

[0032] In a fourth aspect, an embodiment of the present application provides a communication device, comprising: a receiving module and a sending module. The receiving module is used to receive a session establishment request from a UE, the session request includes an identifier of a first network slice, and the session establishment request is used to trigger the establishment of a PDU session associated with the first network slice; the receiving module is also used to receive a notification message, the notification message is used to indicate that the first network slice needs to be replaced with a second network slice; the sending module is used to send an indication message to the UE when the mobility management network element determines that an authentication process needs to be performed on the second network slice, the indication message is used to indicate the refusal to establish a PDU session associated with the first network slice.

[0033] In a possible implementation, the communication device provided in the embodiment of the present application further includes a determination module. The determination module is used to determine that the UE has not performed the authentication process of the second network slice; or, the determination module is used to determine that the authentication result of the UE performing the authentication process of the second network slice is not stored.

[0034] In one possible implementation, the determination module is also used to determine whether it is necessary to perform an authentication process on the second network slice based on the UE's subscription data.

[0035] In a fifth aspect, an embodiment of the present application provides a communication device, comprising a memory and at least one processor connected to the memory, the memory being used to store computer program code, the computer program code comprising computer instructions, and when the computer instructions are executed by at least one processor, the communication device executes the communication method described in any one of the first aspect, the second aspect and any possible implementation methods thereof.

[0036] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer instructions are stored. When the computer instructions are run on a computer, the communication method described in any one of the first aspect, the second aspect and their possible implementation methods is executed.

[0037] In a seventh aspect, an embodiment of the present application provides a computer program product, which includes computer instructions. When the computer instructions are run on a computer, the communication method described in the first aspect, the second aspect, and any one of their possible implementations is executed.

[0038] In the eighth aspect, an embodiment of the present application provides a chip system, comprising: a processor, used to call and run a computer program from a memory, so that a terminal device equipped with the chip system executes the communication method described in any one of the first aspect, the second aspect and their possible implementation methods.

[0039] In a ninth aspect, an embodiment of the present application provides a communication system, comprising a mobility management network element and a UE, wherein the mobility management network element is used to execute the communication method described in any one of the first aspect, the second aspect and possible implementation methods thereof.

[0040] It should be understood that the beneficial effects achieved by the technical solutions of the third to ninth aspects of the present application and the corresponding possible implementation methods can be referred to the technical effects of the first aspect, the second aspect and their corresponding possible implementation methods mentioned above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 One of the schematic diagrams of a 5G communication network architecture provided in an embodiment of the present application;

[0042] Figure 2 A second schematic diagram of a 5G communication network architecture provided in an embodiment of the present application;

[0043] Figure 3 A schematic diagram of an authentication process for a network slice provided in an embodiment of the present application;

[0044] Figure 4 One of the schematic diagrams of a communication method provided in an embodiment of the present application;

[0045] Figure 5 A second schematic diagram of a communication method provided in an embodiment of the present application;

[0046] Figure 6 A third schematic diagram of a communication method provided in an embodiment of the present application;

[0047] Figure 7 A fourth schematic diagram of a communication method provided in an embodiment of the present application;

[0048] Figure 8 A fifth schematic diagram of a communication method provided in an embodiment of the present application;

[0049] Fig. 9 A sixth schematic diagram of a communication method provided in an embodiment of the present application;

[0050] Fig.10 One of the structural schematic diagrams of a communication device provided in an embodiment of the present application;

[0051] Fig.11 The present invention provides a second structural diagram of a communication device according to an embodiment of the present application. DETAILED DESCRIPTION

[0052] The term "and / or" in this article is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone.

[0053] The terms "first" and "second" in the description and claims of the embodiments of the present application are used to distinguish different objects rather than to describe a specific order of objects. For example, a first network slice and a second network slice are used to distinguish different network slices rather than to describe a specific order of network slices.

[0054] In the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0055] In the description of the embodiments of the present application, unless otherwise specified, "multiple" means two or more than two, for example, multiple network slices refer to two or more network slices.

[0056] The communication method provided in the embodiments of the present application can be applied to the fourth generation mobile communication technology (the 4th Generation mobile communication technology, 4G) network architecture, such as the long term evolution (long term evolution, LTE) system, and can also be applied to the fifth generation mobile communication technology (the 5th Generation mobile communication technology, 5G) network architecture, such as the NR system, or can also be applied to the future sixth generation mobile communication technology network architecture or other similar communication systems, and the embodiments of the present application are not limited.

[0057] Below, taking the 5G network architecture as an example, the communication network architecture of this application is introduced.

[0058] Figure 1 This is a schematic diagram of the 5G communication network architecture based on service-oriented architecture. Figure 1 The 5G communication network architecture shown includes three parts, namely UE, data network (DN) and operator network.

[0059] Among them, the operator network may include one or more of the following network elements: access network (AN) or radio access network (RAN), user plane function (UPF), network slice-specific authentication and authorization function (NSSAAF), authentication server function (AUSF), access management function (AMF), session management function (SMF), unified data repository function (UDR), network slice selection function (NSSF), network exposure function (NEF), network storage function (NF repository function, NRF), policy control function (PCF), unified data management (UDM), and application function (AF).

[0060] In the above-mentioned operator network, the part other than the (wireless) access network part can be referred to as the core network part. In addition, for the convenience of description, in the embodiment of the present application, the AMF network element can be referred to as AMF, the UDM network element can be referred to as UDM, and other network elements are similar and are not listed one by one.

[0061] Below Figure 1 A brief introduction to the main functions of each network element is given.

[0062] (R)AN: (R)AN can be either AN or RAN. Specifically, (R)AN can be various forms of base stations, such as macro base stations, micro base stations, distributed unit-control units (DU-CU), etc. In addition, the above base stations can also be wireless controllers in cloud radio access network (CRAN) scenarios, or relay stations, access points, vehicle-mounted devices, wearable devices, or network devices in future evolved public land mobile networks (PLMN) networks. (R)AN is mainly responsible for wireless resource management, service quality management, data compression and encryption, etc. on the air interface side.

[0063] UPF: supports all or part of the following functions: interconnection between PDU sessions and data networks; packet routing and forwarding, for example, support for uplink classifier to forward traffic to the data network, support for branching points to support multi-homed PDU sessions); packet inspection.

[0064] NSSAAF: Responsible for supporting authentication and authorization of network slices.

[0065] AUSF: Responsible for user authentication and authorization, including receiving AMF's request for UE identity authentication, requesting keys from UDM, and forwarding the keys issued by UDM to AMF for authentication processing.

[0066] AMF: responsible for user mobility management, including mobile state management, allocating temporary user identities, and authenticating and authorizing users;

[0067] SMF: responsible for UPF network element selection, UPF network element reselection, Internet Protocol (IP) address allocation, responsible for bearer establishment, modification and release, and QoS control.

[0068] UDR: Stores and retrieves contract data, policy data, and public architecture data, etc., for UDM, PCF, and NEF to obtain relevant data. UDR can have different data access authentication mechanisms for different types of data (such as contract data, policy data) to ensure the security of data access. UDR can return a failure response with an appropriate reason value for illegal service operations or data access requests.

[0069] NSSF: used to select a group of network slices for the UE and determine single network slice selection assistance information (NSSAI), for example, determine single network slice selection assistance information (S-NSSAI).

[0070] NEF: Mainly supports network capability exposure functions, opening network capabilities and services to the outside world; the 3rd generation partnership project (3GPP) network function (NF) publishes functions and events to other network functions through NEF. The capabilities and events exposed by network functions can be safely opened to third-party applications.

[0071] NRF: Network function profile for service discovery, maintaining available network function instances and the services supported by these network functions.

[0072] PCF: Mainly used to manage policy rules, user subscription information, etc.

[0073] UDM: Responsible for managing contract data and notifying corresponding network elements when contract data is modified.

[0074] AF: Provides some application layer services to UE. When providing services to UE, AF has requirements for quality of service (QoS) and charging policies, and needs to notify the network. At the same time, AF also needs application-related information fed back by the core network.

[0075] Figure 1 In the operator network, except for (R)AN and UPF, any two network elements can communicate through service-based interfaces. It can be understood that each network element has a corresponding service-based interface. For example, the service-based interface of NSSAAF is Nnssaaf, the service-based interface of AUSF is Nausf, the service-based interface of AMF is Namf, the service-based interface of SMF is Nsmf, the service-based interface of UDR is Nudr, the service-based interface of NSSF is Nnssf, the service-based interface of NEF is Nnef, the service-based interface of NRF is Nnrf, the service-based interface of PCF is Npcf, the service-based interface of UDM is Nudm, and the service-based interface of AF is Naf. For example, the interfaces used for communication between NEF and AUSF are Nnef and Nausf, and the interfaces between other network elements are similar and are not listed one by one.

[0076] in addition, Figure 1 The AMF and UE can communicate through the N1 interface, the AMF and (R)AN can communicate through the N2 interface, the RAN and UPF can communicate through the N3 interface, the SMF and UPF can communicate through the N4 interface, the UE and RAN can communicate through the air interface, and the UPF and DN can communicate through the N6 interface.

[0077] Above Figure 1 The UE in the description may be a netbook, a tablet computer, a smart watch, etc. Alternatively, the UE may also be other desktop devices, laptop devices, handheld devices, wearable devices, smart home devices, and vehicle-mounted devices with radio communication functions, such as ultra-mobile personal computers (UMPCs), smart cameras, netbooks, personal digital assistants (PDAs), portable multimedia players (PMPs), AR (augmented reality) / VR (virtual reality) devices, aircraft, robots, etc. The specific type and structure of the UE are not limited in the embodiments of the present application.

[0078] Figure 1 The data network DN in the data network can be an operator service network, Internet access or a third-party service network, etc. The DN can exchange information with the UE through a PDU session. Among them, the PDU session can be divided into multiple types, such as Internet Protocol version 4 (IPv4), IPv6, etc.

[0079] Figure 2 This is a schematic diagram of a 5G communication network architecture based on point-to-point. Figure 2 The communication network architecture shown is similar to Figure 1 The network architecture shown includes similar network elements. Figure 2 For an introduction to the functions of each network element in Figure 1 The functional introduction of the corresponding network elements will not be repeated here. Figure 1 and Figure 2 The main differences are: Figure 2 The interfaces between the network elements in the network are point-to-point interfaces. Figure 1 The interfaces between the various network elements in the network are service-oriented interfaces.

[0080] Optionally, Figure 1 and Figure 2The communication network architecture may include more network elements, or fewer network elements, and the names of the network elements may also be other names, which are not limited in the embodiments of the present application. It should be noted that the mobility management network element in the embodiments of the present application may be the AMF in the 5G communication network architecture. In the following embodiments, the mobility management network element is described as the AMF.

[0081] The following explains some technical terms and background knowledge involved in a communication method, device and system provided in an embodiment of the present application.

[0082] 1. Network Slicing

[0083] In 5G networks, by creating virtual independent logical networks on the same network infrastructure, isolated network environments are provided for different application scenarios, so that different application scenarios can customize network functions and features according to their own needs, and can effectively guarantee the quality of service (QoS) requirements of different services. Network slicing is an end-to-end logical network. Each network slice includes a set of network functions (or network elements), resources for running these network functions, and specific configurations of these network functions. Each network slice includes its own service functions (for example, AMF, user plane function (UPF), session management function SMF, and policy control function PCF, etc.). In 5G networks, different types of network slices can be selected for UEs based on their business needs.

[0084] Exemplarily, according to different application scenarios, network slices may include different types of network slices applied to mobile bandwidth (MBB) scenarios, Internet of Things scenarios, etc. For example, MBB network slices, critical machine type communication (critical MTC) network slices, and massive machine type communication (massive MTC) network slices.

[0085] 2. Network Slice Authentication and Authorization (NSSAA)

[0086] When the UE initially attaches to the network, the network slice selection process is triggered, that is, according to the UE's business needs, the appropriate type of network slice is selected for the UE, and then the UE can access the network slice to perform related services. The network slice authentication and authorization (NSSAA) process is introduced in 3GPP R16 (communication standard protocol). Specifically, before the UE accesses the requested network slice, it is necessary to determine whether the network slice requested by the UE needs to be authenticated. If the network slice needs to be authenticated, the UE first interacts with the core network to complete the authentication of the requested network slice. After the authentication is successful, the UE can access the network slice; if the network slice does not need to be authenticated, the UE does not perform the authentication process, and the UE can directly access the network slice.

[0087] It should be understood that the network slice requested by the UE may include one or more, some network slices (for example, network slices with higher security requirements) need to execute the NSSAA process; some network slices (for example, network slices with no security requirements) do not need to execute the NSSAA process. The UE's subscription data stores the identifier of the contracted network slice, and the subscription data also includes indication information on whether the network slice needs to execute the NSSAA process.

[0088] At present, in the standard protocol, before the UE accesses the network slice, it first determines whether the requested network slice needs to execute the NSSAA process. For the network slice that needs to execute the NSSAA process, the mobility management network element calls the network slice specific authentication process based on the extensible authentication protocol (EAP) to execute the NSSAA process. After the authentication is completed, the UE can access the network slice that has been successfully authenticated. For the network slice that does not need to execute the NSSAA process, the UE can directly access the network slice.

[0089] In the embodiment of the present application, each network slice corresponds to a unique network slice selection auxiliary information (NSSAI), and the embodiment of the present application is described by taking NSSAI as single network slice selection auxiliary information (S-NSSAI) as an example. It can be understood that S-NSSAI is unique, so S-NSSAI can identify the network slice, that is, S-NSSAI can be used as an identifier of the network slice, and a network slice can also be referred to as an S-NSSAI in the following embodiments.

[0090] Correspondingly, the NSSAA process of the network slice identified by S-NSSAI can be simply referred to as the authentication process of the network slice, or simply referred to as the authentication process of S-NSSAI. Similarly, the result of the NSSAA process of the network slice identified by S-NSSAI can be simply referred to as the authentication result of the network slice identified by S-NSSAI, or simply referred to as the authentication result of S-NSSAI.

[0091] 3. Network slice replacement

[0092] When the resources of a network slice (S-NSSAI) are insufficient (for example, congestion occurs) or it can no longer be used, the network slice can be replaced by replacing the network slice currently accessed by the UE with another network slice (which can be called a replaced network slice). By using the resources of the replaced network slice, service continuity is achieved. Therefore, the concept of network slice replacement is introduced. Specifically, some network elements in the network (for example, PCF, NSSF or network elements in the network management system, such as operation administration and maintenance (OAM) network elements in the management network) can determine that some S-NSSAI in the network is unavailable or congested, and then notify the corresponding AMF network element, and the AMF network element triggers the network slice replacement process.

[0093] For the sake of convenience of description, the replaced network slice (i.e., the network slice that is congested or unavailable) can be referred to as old S-NSSAI, and the replaced network slice can be referred to as Alternative S-NSSAI.

[0094] Optionally, the PCF, NSSF or OAM network element can determine that the network slice is congested or unavailable based on some performance indicators, including but not limited to one or more of the following: network slice resources, packet loss rate, latency, rate, network slice life cycle, etc. For example, when the network slice resources are insufficient, the packet loss rate exceeds the threshold, the latency is high, and the rate is too low, it can be determined that the network slice is congested, and when the life cycle of the network slice expires, it can be determined that the network slice is unavailable.

[0095] The following references Figure 3 , the existing network slice authentication process is introduced. Figure 3 As shown, the authentication process of the network slice includes S301-S306.

[0096] S301. UE sends a Registration Request message to AMF. Correspondingly, AMF receives the Registration Request message.

[0097] The registration request message carries the identifier of the network slice requested by the UE (for example, carries Requested NSSAI), and the network slice requested by the UE includes one or more, that is, Requested NSSAI includes one or more S-NSSAI.

[0098] Optionally, the registration request message may also carry indication information for indicating whether the UE supports the capability of the NSSAA process, that is, indication information for indicating whether the UE supports the NSSAA feature.

[0099] S302, AMF obtains the subscription data of the UE from the UDM. Specifically, the AMF sends a request to the UDM to obtain the subscription data of the UE, and the UDM returns the subscription data of the UE to the AMF.

[0100] In the embodiment of the present application, the subscription data of the UE includes the S-NSSAI (of the network slice) to which the UE has subscribed. If one or more S-NSSAIs in the S-NSSAI to which the UE has subscribed need to execute the NSSAA process, the subscription information also includes indication information (such as NSSAA indication) indicating whether the S-NSSAI needs to execute the NSSAA process.

[0101] For example, "0" may be used to indicate that the NSSAA process does not need to be executed, and "1" may be used to indicate that the NSSAA process needs to be executed. Assuming that the S-NSSAI subscribed by the UE includes S-NSSAI#1 and S-NSSAI#2, and the indication information corresponding to S-NSSAI#1 is 1, then S-NSSAI#1 needs to execute the NSSAA process, and the indication information corresponding to S-NSSAI#2 is 0, then S-NSSAI#2 does not need to execute the NSSAA process.

[0102] It can be understood that after receiving the registration request message, AMF first executes the primary authentication process of the UE's permanent identity. The primary authentication process of the UE's permanent identity can also be called the UE's security procedures PLMN access. After the primary authentication process succeeds, AMF obtains the UE's subscription data from UDM.

[0103] S303. AMF determines the S-NSSAI set that does not need to execute the NSSAA process (i.e., the S-NSSAI set that is allowed to access without authentication, hereinafter referred to as Allowed NSSAI) and the S-NSSAI set that needs to execute the NSSAA process (i.e., the S-NSSAI set to be authenticated, hereinafter referred to as Pending NSSAI) based on the UE's subscription data, the UE's current location information, and the identifier of the network slice requested by the UE.

[0104] The location information of the UE is used to determine whether the UE is within the coverage of the network slice. If the UE is within the coverage of the network slice, the UE is allowed to access the network slice; if the UE is outside the coverage of the network slice, the UE is not allowed to access the network slice. For example, in one or more network slices requested by the UE, the UE may be within the coverage of one part of the network slices and outside the coverage of another part of the network slices.

[0105] The subscription data of the UE is used to determine which S-NSSAIs in the S-NSSAIs requested by the UE (ie, Requested NSSAIs) need to execute the NSSAA process and which S-NSSAIs do not need to execute the NSSAA process.

[0106] It should be noted that, in the embodiment of the present application, the Allowed NSSAI includes the S-NSSAI that covers the location of the UE determined according to the location information of the UE, and that does not need to execute the NSSAA process determined according to the contract data, that is, the AMF adds the S-NSSAI that covers the location of the UE in the Requested NSSAI and that the indication information in the contract data indicates that NSSAA does not need to be executed to the Allowed NSSAI. The Pending NSSAI includes the S-NSSAI that covers the location of the UE determined according to the location information of the UE, and that needs to execute the NSSAA process determined according to the contract data, that is, the AMF adds the S-NSSAI that covers the location of the UE in the Requested NSSAI and that the indication information in the contract data indicates that NSSAA needs to be executed to the PendingNSSAI.

[0107] For example, assuming that the UE is located within the coverage of the network slice requested by the UE, the Requested NSSAI carried by the above RegistrationRequest message includes S-NSSAI#1, S-NSSAI#2, and S-NSSAI#3. According to the indication information corresponding to each S-NSSAI in the UE's subscription number, it is determined that S-NSSAI#1 needs to execute the NSSAA process, S-NSSAI#2 does not need to execute the NSSAA process, and S-NSSAI#3 needs to execute the NSSAA process. Then, S-NSSAI#1 and S-NSSAI#3 are added to the Pending NSSAI, and S-NSSAI#2 is added to the Allowed NSSAI.

[0108] Subsequently, for the S-NSSAI in the Pending NSSAI, the AMF triggers the NSSAA process for the S-NSSAI, that is, the NSSAA process needs to be executed. After the S-NSSAI is successfully authenticated, the UE is allowed to access these S-NSSAIs. For the S-NSSAI in the Allowed NSSAI, the AMF does not trigger the NSSAA process for the S-NSSAI, that is, there is no need to execute the NSSAA process, that is, the UE is allowed to directly access these S-NSSAIs.

[0109] S304. AMF sends a Registration Accept message to the UE, which carries the Allowed NSSAI and the Pending NSSAI. Correspondingly, the UE receives the Registration Accept message.

[0110] In an embodiment of the present application, after the UE receives the Pending NSSAI and the Allowed NSSAI, the UE can know which network slices need to execute the NSSAA process and which network slices do not need to execute the NSSAA process.

[0111] S305. AMF initiates the NSSAA process for S-NSSAI in Pending NSSAI.

[0112] For example, if the pending NSSAI includes S-NSSAI#1 and S-NSSAI#3, the AMF triggers the NSSAA procedure for S-NSSAI#1 and also triggers the NSSAA procedure for S-NSSAI#3.

[0113] The NSSAA process is implemented by the interaction between UE and AMF. For the specific implementation process of the NSSAA process, please refer to the description of existing technical materials, which will not be described in detail in the embodiments of this application.

[0114] S306. AMF sends a configuration update control (UE configuration update command) message to the UE, where the configuration update control message includes a new Allowed NSSAI and / or Rejected NSSAI.

[0115] In the embodiment of the present application, for each S-NSSAI in the Pending NSSAI, if the authentication result of the NSSAA process for the S-NSSAI is successful, the AMF adds the S-NSSAI to the Allowed NSSAI, that is, the Allowed NSSAI will be updated according to the authentication result. If the authentication result of the NSSAA process for the S-NSSAI fails, the AMF adds the S-NSSAI to the rejected S-NSSAI set (hereinafter referred to as Rejected NSSAI).

[0116] For example, the Requested NSSAI carried by the UE includes S-NSSAI#1 and S-NSSAI#2, where S-NSSAI#1 does not need to execute the NSSAA process, but S-NSSAI#2 needs to execute the NSSAA process. In this case, in the registration acceptance message, the AllowedNSSAI includes S-NSSAI#1, and the Pending NSSAI includes S-NSSAI#2. Afterwards, the AMF triggers the NSSAA process for S-NSSAI#2. If the authentication result of the process is successful, the AMF adds S-NSSAI#2 to the Allowed NSSAI, that is, the Allowed NSSAI is updated, and the updated Allowed NSSAI includes S-NSSAI#1 and S-NSSAI#2. If the authentication result of the process is a failure, the AMF adds S-NSSAI#2 to the Rejected NSSAI, that is, the RejectedNSSAI includes S-NSSAI#2.

[0117] In an embodiment of the present application, the AMF sends a configuration update control message to the UE through a UE configuration update process (UE configuration update process, referred to as UCU process) to send a new Allowed NSSAI (i.e., new Allowed NSSAI) and / or Rejected NSSAI to the UE.

[0118] Based on the above, the present application embodiment provides a communication method, which can be applied to the above Figure 1 and Figure 2 The communication network architecture shown, the application scenario of the communication method is: when some network slices in the communication network are congested or unavailable, during the network slice replacement (i.e., network slice replacement), whether it is necessary to execute the NSSAA process on the new network slice and how to execute the NSSAA process on the new network slice.

[0119] like Figure 4As shown, the communication method provided in the embodiment of the present application includes:

[0120] S401. The mobility management network element receives a notification message, which is used to indicate that the first network slice needs to be replaced with the second network slice.

[0121] The above-mentioned first network slice is the network slice that the UE is currently accessing. The above-mentioned notification message also carries the identifier of the first network slice and the identifier of the second network slice. For example, the identifier of the first network slice is recorded as the first S-NSSAI, and the identifier of the second network slice is recorded as the second S-NSSAI.

[0122] In an embodiment of the present application, the mobility management network element receives the above notification message from other network elements (such as PCF, NSSF or OAM). It should be understood that the PCF, NSSF or OAM network element in the network can monitor the status of the network slice. When it is detected that one or some network slices in the network are congested or unavailable, the PCF, NSSF or OAM determines that the network slice needs to be replaced (hereinafter referred to as the first network slice), and the PCF, NSSF or OAM can select a non-congested or available network slice from the network slices in the network (hereinafter referred to as the second network slice), and send the above notification message to the mobility management network element supporting the first network slice to notify the mobility management network element that the congested or unavailable first network slice needs to be replaced with the second network slice.

[0123] For example, PCF, NSSF or OAM detects that the first network slice (i.e., old S-NSSAI) is unavailable, and determines to use the second network slice (Alternative S-NSSAI) to replace the first network slice. Therefore, PCF, NSSF or OAM sends a notification message carrying the identifier of the first network slice and the identifier of the second network slice to AMF to notify the mobility management network element that the first network slice needs to be replaced with the second network slice. After receiving the notification message, the mobility management network element can learn that the first network slice is congested or unavailable, and that the first network slice needs to be replaced with the second network slice.

[0124] Optionally, the second network slice that can replace the first network slice may be one or more, which is not limited in the embodiments of the present application.

[0125] S402. Before the UE accesses the second network slice, the mobility management network element sends the network slice information to be authenticated to the UE.

[0126] The network slice information to be authenticated includes the identifier of the second network slice. The network slice information to be authenticated is used to trigger the authentication process for the second network slice. It should be understood that the execution of the authentication process for the network slice in the embodiments of the present application refers to the execution of the NSSAA process for the network slice.

[0127] In an embodiment of the present application, as an implementation method, the network slice information to be authenticated can be represented by PendingNSSAI, and Pending NSSAI includes the identifier of the second network slice.

[0128] After the mobility management network element receives the notification message of step S401, the mobility management network element determines that the first network slice is the network slice currently accessed by the UE, and determines that the UE needs to access the second network slice according to the notification message. Before the UE accesses the second network slice, the mobility management network element determines that the second network slice is the network slice that needs to execute the NSSAA process among the network slices subscribed by the UE based on the subscription data obtained from the unified data management function (UDM), so that the mobility management network element initiates the authentication process for the second network slice.

[0129] Optionally, the method for the mobility management network element to determine that the first network slice is the network slice currently accessed by the UE may be: the mobility management network element determines, based on the context of the UE, that the Allowed NSSAI of the UE includes an identifier of the first network slice, which indicates that the first network slice is the network slice currently accessed by the UE.

[0130] For a description of the authentication process for the second network slice, please refer to Figure 3 The corresponding contents will not be elaborated here.

[0131] The communication method provided in the embodiment of the present application is a technical solution for network slice authentication in a network slice replacement scenario. When the first network slice in the network is congested or unavailable, the relevant network element (such as PCF, NSSF or OAM) can send a notification message to the mobility management network element to indicate that the first network slice needs to be switched to the second network slice. Then, before the UE accesses the second network slice, the mobility management network element determines that the second network slice is the network slice to be authenticated, and sends the network slice information to be authenticated (including the identifier of the second network slice) to the UE to trigger the authentication process for the second network slice. This method can smoothly implement network slice authentication in the scenario of network slice replacement, thereby avoiding the security risk caused by the UE's arbitrary access to the second network slice due to non-authentication of the second network slice.

[0132] It should be noted that the communication method provided in the embodiment of the present application is a method for performing network slice authentication in a network slice replacement scenario, and the method can be applied in the following two scenarios:

[0133] The first scenario: the first network slice currently accessed by the UE is congested or unavailable, and the UE does not have a PDU session associated with the first network slice.

[0134] It can be understood that the UE does not have a PDU session associated with the first network slice, including the following situations:

[0135] Case 1: When the first network slice currently accessed by the UE is congested or unavailable, the UE has not yet initiated a PDU session establishment request.

[0136] Case 2: When the first network slice currently accessed by the UE is congested or unavailable, the UE initiates a PDU session establishment request, but the PDU session establishment process has not been completed.

[0137] In the scenarios of the above two situations, the communication method provided in the embodiments of the present application is executed. Before establishing the PDU session, after completing the authentication process of the new network slice (the new network slice is referred to as the second network slice in the following embodiments), the UE accesses the second network slice and establishes a PDU session associated with the second network slice.

[0138] The second scenario: the first network slice to which the UE is currently accessed is congested or unavailable, and the UE has a PDU session based on the first network slice.

[0139] In the second scenario, the communication method provided in the embodiment of the present application is executed to complete the authentication process for the second network slice, and after the authentication is successful, the PDU session is modified to migrate the PDU session from the first network slice to the second network slice.

[0140] Below, taking the 5G communication network architecture as an example, the communication methods in the above different scenarios are described in detail from the perspective of interaction between various network elements.

[0141] Example 1

[0142] When the first network slice currently accessed by the UE is congested or unavailable, the second network slice needs to be used to replace the first network slice. In the scenario where the UE has not yet initiated a PDU session establishment request, one implementation method is: the mobility management network element (such as AMF) sends a configuration update control message to the UE through the UCU process to instruct the UE to perform an authentication process (i.e., NSSAA process) on the second network slice. Specifically, Figure 5 As shown, the communication method provided in the embodiment of the present application may include:

[0143] S501. UE sends a registration request message to AMF. Correspondingly, AMF receives the registration request message.

[0144] The registration request message carries the identifier of the network slice requested by the UE (Requested NSSAI). In the following embodiments, the identifier of the network slice is S-NSSAI as an example for description.

[0145] S502. AMF obtains the UE's subscription data from UDM.

[0146] The UE's subscription data includes the S-NSSAI (of the network slice) to which the UE has subscribed, and indication information indicating whether the S-NSSAI needs to perform the NSSAA process.

[0147] S503. AMF determines the S-NSSAI set that does not need to execute the NSSAA process (i.e., Allowed NSSAI) and the S-NSSAI set that needs to execute the NSSAA process (i.e., Pending NSSAI) based on the UE's subscription data, the UE's current location information, and the S-NSSAI of the network slice requested by the UE.

[0148] S504: AMF sends a registration acceptance message to the UE. Correspondingly, the UE receives a registration acceptance message from the AMF.

[0149] The registration acceptance message includes Allowed NSSAI and / or Pending NSSAI. Among them, the S-NSSAI in the Allowed NSSAI does not need to perform the authentication process, and the S-NSSAI in the Pending NSSAI needs to perform the authentication process.

[0150] It can be understood that for the Requested NSSAI in the registration request message in the above S501, if all S-NSSAI in the RequestedNSSAI do not need to execute the authentication process, the above registration acceptance message includes AllowedNSSAI; if all S-NSSAI in the Requested NSSAI need to execute the authentication process, the above registration acceptance message includes Pending NSSAI; if some of the S-NSSAI in the Requested NSSAI do not need to execute the authentication process, and some S-NSSAI need to execute the authentication process, the above registration acceptance message includes Allowed NSSAI and Pending NSSAI.

[0151] For each S-NSSAI in the Pending NSSAI, the AMF initiates an authentication process for each S-NSSAI, obtains a new Allowed NSSAI and / or Rejected NSSAI based on the authentication result, and then sends the new Allowed NSSAI and / or Rejected NSSAI to the UE through a configuration update control message. After that, the UE accesses the network slice (including the first network slice) in the new Allowed NSSAI. For details, please refer to the relevant description in steps S305-S306 of the above embodiment, which will not be repeated here.

[0152] S505. PCF / NSSF / OAM sends a notification message to AMF, where the notification message is used to indicate that the first network slice needs to be replaced with the second network slice. Correspondingly, AMF receives the notification message.

[0153] The above notification message carries the identifier of the first network slice and the identifier of the second network slice, wherein the first network slice can also be called old S-NSSAI, and the second network slice can also be called Alternative S-NSSAI. The identifier of the first network slice is the first S-NSSAI, and the identifier of the second network slice is the second S-NSSAI.

[0154] S506. AMF determines that an authentication process needs to be performed on the second network slice.

[0155] In an embodiment of the present application, the AMF determines that the first network slice needs to be replaced with the second network slice according to the notification message, and the AMF determines which UE or UEs are currently accessing the first network slice according to the network slices allowed to be accessed in the context of the UE (i.e., Allowed NSSAI). Taking one of the UEs accessing the first network slice as an example, the AMF determines whether the second network slice needs to perform an authentication process according to the subscription data of the UE.

[0156] If it is determined that the authentication process does not need to be performed on the second network slice, the AMF can trigger the process for the UE to access the second network slice. If it is determined that the authentication process needs to be performed on the second network slice, the AMF adds the identifier of the second network slice to the Pending NSSAI and executes the following S507.

[0157] S507. AMF sends a first configuration update control message to the UE. The first configuration update control message carries a pending NSSAI, and the pending NSSAI includes a second S-NSSAI.

[0158] S508. AMF initiates the authentication process for the second network slice.

[0159] In the embodiment of the present application, if the result of executing the authentication process for the second network slice is successful authentication, the AMF adds the second S-NSSAI to the Allowed NSSAI to obtain a new Allowed NSSAI, and then the AMF executes the following S509, and the AMF performs network slice replacement. It should be noted that the new Allowed NSSAI described in step S508 is an update result of the Allowed NSSAI in the above step S504. If the result of executing the authentication process for the second network slice is a failed authentication, the AMF adds the second S-NSSAI to the Rejected NSSAI, and the AMF does not perform network slice replacement.

[0160] S509. AMF sends a third configuration update control message to the UE, which carries the new Allowed NSSAI and the mapping relationship between the first network slice and the second network slice (mapping of the oldS-NSSAI to the Alternative S-NSSAI).

[0161] After S509, the UE can learn that the first network slice needs to be replaced with the second network slice based on the mapping relationship between the first network slice and the second network slice, and then the AMF and the UE interact to enable the UE to access the second network slice to achieve network slice replacement. And subsequently, the UE initiates a PDU session establishment request to the AMF, and the PDU session establishment request carries the second S-NSSAI, and the second S-NSSAI is used to indicate the establishment of a PDU session associated with the second network slice, and then the AMF, SMF and the UE interact to establish a PDU session associated with the second network slice.

[0162] For more detailed descriptions of S501 - S509 , please refer to the relevant descriptions in the above embodiments, which will not be repeated here.

[0163] Through the above S501-S509, the mobility management network element can send a configuration update control message to the UE through the UCU process to instruct the UE to perform an authentication process on the second network slice, and successfully implement authentication of the second network slice in a scenario where the UE has not yet initiated a PDU session establishment request, thereby avoiding the security risks caused by the UE's arbitrary access to the second network slice due to failure to authenticate the second network slice.

[0164] Example 2

[0165] When the first network slice currently accessed by the UE is congested or unavailable, the second network slice needs to be used to replace the first network slice. In the scenario where the UE has not yet initiated a PDU session establishment request, another implementation method is: the mobility management network element (such as AMF) sends a configuration update control message to the UE through the UCU process to trigger the UE to initiate a re-registration process, and then the AMF initiates the authentication process for the second network slice. Specifically, Figure 6 As shown, the communication method provided in the embodiment of the present application may include:

[0166] S601. UE sends a first registration request message to AMF. Correspondingly, AMF receives the first registration request message.

[0167] The first registration request message carries the S-NSSAI (Requested NSSAI) of the network slice requested by the UE.

[0168] S602. AMF obtains UE's subscription data from UDM.

[0169] The UE's subscription data includes the S-NSSAI (of the network slice) to which the UE has subscribed, and indication information indicating whether the S-NSSAI needs to perform the NSSAA process.

[0170] S603. AMF determines the S-NSSAI set that does not need to execute the NSSAA process (i.e., Allowed NSSAI) and the S-NSSAI set that needs to execute the NSSAA process (i.e., Pending NSSAI) based on the UE's subscription data, the UE's current location information, and the S-NSSAI of the network slice requested by the UE.

[0171] S604. AMF sends a first registration acceptance message to UE. Correspondingly, UE receives the first registration acceptance message from AMF.

[0172] The first registration acceptance message includes Allowed NSSAI and / or Pending NSSAI, wherein the S-NSSAI in the Allowed NSSAI does not need to execute the authentication process, and the S-NSSAI in the Pending NSSAI needs to execute the authentication process.

[0173] Similar to the above-mentioned embodiment 1, for each S-NSSAI in the pending NSSAI, the AMF initiates an authentication process for each S-NSSAI, and obtains a new Allowed NSSAI and / or Rejected NSSAI based on the authentication result, and then sends the new Allowed NSSAI and / or Rejected NSSAI to the UE through a configuration update control message. Subsequently, the UE accesses the network slice (including the first network slice) in the new Allowed NSSAI.

[0174] S605. PCF / NSSF / OAM sends a notification message to AMF, where the notification message is used to indicate that the first network slice needs to be replaced with the second network slice. Correspondingly, AMF receives the notification message.

[0175] The above notification message carries the identifier of the first network slice (old S-NSSAI) and the identifier of the second network slice (Alternative S-NSSAI). The identifier of the first network slice is the first S-NSSAI, and the identifier of the second network slice is the second S-NSSAI.

[0176] S606. AMF determines that an authentication process needs to be performed on the second network slice.

[0177] If it is determined that the authentication process does not need to be performed on the second network slice, the AMF can trigger the process for the UE to access the second network slice. If it is determined that the authentication process needs to be performed on the second network slice, the AMF adds the identifier of the second network slice to the Pending NSSAI and executes the following S607.

[0178] S607. The AMF sends a second configuration update control message to the UE, where the second configuration update control message is used to trigger the UE to initiate a re-registration process. Correspondingly, the UE receives the second configuration update control message from the AMF.

[0179] S608. The UE sends a second registration request message to the AMF. Correspondingly, the AMF receives the second registration request message from the UE.

[0180] It should be noted that the Requested NSSAI carried in the second registration request message may be the same as or different from the Requested NSSAI carried in the first registration request message.

[0181] S609. The AMF sends a second registration acceptance message to the UE. Correspondingly, the UE receives the second registration acceptance message from the AMF.

[0182] Specifically, AMF determines the S-NSSAI set that does not require the authentication process (i.e., Allowed NSSAI) and the S-NSSAI set that needs to perform the authentication process (i.e., Pending NSSAI) based on the UE's subscription data, the UE's current location information, and the identifier of the network slice requested by the UE.

[0183] The second registration acceptance message includes a pending NSSAI, the S-NSSAI in the pending NSSAI needs to execute an authentication process, and the pending NSSAI includes a second S-NSSAI. Optionally, the second registration acceptance message may also include an allowed NSSAI, and the S-NSSAI in the allowed NSSAI does not need to execute an authentication process.

[0184] S610. AMF initiates the authentication process for the second network slice, that is, AMF initiates the NSSAA process for the second S-NSSAI in the Pending NSSAI.

[0185] In the embodiment of the present application, if the result of executing the authentication process for the second network slice is successful authentication, the AMF adds the second S-NSSAI to the Allowed NSSAI to obtain a new Allowed NSSAI, and then the AMF executes the following S611, and the AMF performs network slice replacement. It should be noted that the new Allowed NSSAI described in step S610 is the update result of the Allowed NSSAI in the above step S609. If the result of executing the authentication process for the second network slice is a failed authentication, the AMF adds the second S-NSSAI to the Rejected NSSAI, and the AMF does not perform network slice replacement.

[0186] S611. AMF sends a third configuration update control message to the UE, where the third configuration update control message carries a new Allowed NSSAI and a mapping relationship between the first network slice and the second network slice.

[0187] With the above Figure 5 The corresponding embodiment is similar. After S611, the AMF and the UE interact to enable the UE to access the second network slice, and subsequently, the UE initiates a PDU session establishment request to the AMF. The PDU session establishment request carries a second S-NSSAI, and the second S-NSSAI is used to indicate the establishment of a PDU session associated with the second network slice, and then the AMF, SMF and the UE interact to establish a PDU session associated with the second network slice.

[0188] Through the above S601-S611, the mobility management network element can send a configuration update control message to the UE through the UCU process to trigger the UE to initiate a re-registration process, and then the AMF initiates the authentication process for the second network slice, which can achieve smooth authentication of the second network slice in the scenario where the UE has not yet initiated a PDU session establishment request, thereby avoiding the security risks caused by the UE's arbitrary access to the second network slice due to failure to authenticate the second network slice.

[0189] Example 3

[0190] When the first network slice currently accessed by the UE is congested or unavailable, the UE has initiated a session establishment request to establish a PDU session associated with the first network slice, but the establishment process of the PDU session has not been completed. In this scenario, one implementation method is: AMF does not perform network slice replacement, and AMF refuses to establish a PDU session associated with the first network slice. Specifically, Figure 7 As shown, the communication method provided in the embodiment of the present application may include:

[0191] S701. UE sends a registration request message to AMF. Correspondingly, AMF receives the registration request message.

[0192] The registration request message carries the S-NSSAI (Requested NSSAI) of the network slice requested by the UE.

[0193] S702. AMF obtains UE's subscription data from UDM.

[0194] The UE's subscription data includes the S-NSSAI (of the network slice) to which the UE has subscribed, and indication information indicating whether the S-NSSAI needs to perform the NSSAA process.

[0195] S703. AMF determines the S-NSSAI set that does not need to execute the NSSAA process (i.e., Allowed NSSAI) and the S-NSSAI set that needs to execute the NSSAA process (i.e., Pending NSSAI) based on the UE's subscription data, the UE's current location information, and the S-NSSAI of the network slice requested by the UE.

[0196] S704. AMF sends a registration acceptance message to UE. Correspondingly, UE receives a registration acceptance message from AMF.

[0197] The registration acceptance message includes Allowed NSSAI and / or Pending NSSAI, wherein the S-NSSAI in the Allowed NSSAI does not need to execute the authentication process, and the S-NSSAI in the Pending NSSAI needs to execute the authentication process.

[0198] Similar to the above-mentioned embodiment 1, for each S-NSSAI in the pending NSSAI, the AMF initiates an authentication process for each S-NSSAI, and obtains a new Allowed NSSAI and / or Rejected NSSAI based on the authentication result, and then sends the new Allowed NSSAI and / or Rejected NSSAI to the UE through a configuration update control message, and the UE accesses the network slice (including the first network slice) in the new Allowed NSSAI.

[0199] S705. The UE sends a session establishment request to the AMF. Correspondingly, the AMF receives the session establishment request from the UE.

[0200] The session establishment request is used to trigger the establishment of a PDU session associated with the first network slice. It should be understood that the session establishment request carries the first S-NSSAI to initiate the establishment process of the PDU session associated with the first network slice.

[0201] S706. PCF / NSSF / OAM sends a notification message to AMF, where the notification message is used to indicate that the first network slice needs to be replaced with the second network slice. Correspondingly, AMF receives the notification message.

[0202] It should be noted that after AMF receives the session establishment request sent by UE, PCF / NSSF / OAM detects that the first network slice in the network is congested or unavailable, and sends a notification message to AMF. The notification message carries the identifier of the first network slice (old S-NSSAI) and the identifier of the second network slice (Alternative S-NSSAI), the identifier of the first network slice is the first S-NSSAI, and the identifier of the second network slice is the second S-NSSAI.

[0203] S707. AMF determines that an authentication process needs to be performed on the second network slice.

[0204] If it is determined that the authentication process does not need to be performed on the second network slice, the AMF can trigger the process for the UE to access the second network slice. If it is determined that the authentication process needs to be performed on the second network slice, the AMF executes the following S708.

[0205] S708. AMF determines that the UE has not performed the authentication process of the second network slice, or the AMF determines that the authentication result of the UE performing the authentication process of the second network slice is not stored.

[0206] S709. AMF sends indication information to the UE, where the indication information is used to indicate the refusal to establish a PDU session associated with the first network slice.

[0207] Through the above S701-S709, when the mobility management network element determines that the second network slice needs to be replaced by the first network slice, it needs to consider whether to authenticate the second network slice. When the second network slice needs to be authenticated, the AMF refuses to establish a PDU session associated with the first network slice. This can avoid the security risks caused by the UE's arbitrary access to the second network slice due to failure to authenticate the second network slice.

[0208] Example 4

[0209] When the first network slice currently accessed by the UE is congested or unavailable, the second network slice needs to be used to replace the first network slice. The UE has initiated a session establishment request to establish a PDU session associated with the first network slice, but the establishment process of the PDU session has not been completed. In this scenario, another implementation method is: AMF suspends the session establishment process and sends a configuration update control message to the UE through the UCU process to instruct the UE to perform an authentication process (i.e., NSSAA process) on the second network slice. Specifically, Figure 8 As shown, the communication method provided in the embodiment of the present application may include:

[0210] S801. UE sends a registration request message to AMF. Correspondingly, AMF receives the registration request message.

[0211] The registration request message carries the S-NSSAI (Requested NSSAI) of the network slice requested by the UE.

[0212] S802. AMF obtains UE's subscription data from UDM.

[0213] The UE's subscription data includes the S-NSSAI (of the network slice) to which the UE has subscribed, and indication information indicating whether the S-NSSAI needs to perform the NSSAA process.

[0214] S803. AMF determines the S-NSSAI set that does not need to execute the NSSAA process (i.e., Allowed NSSAI) and the S-NSSAI set that needs to execute the NSSAA process (i.e., Pending NSSAI) based on the UE's subscription data, the UE's current location information, and the S-NSSAI of the network slice requested by the UE.

[0215] S804. AMF sends a registration acceptance message to UE. Correspondingly, UE receives a registration acceptance message from AMF.

[0216] The registration acceptance message includes Allowed NSSAI and / or Pending NSSAI, wherein the S-NSSAI in the Allowed NSSAI does not need to execute the authentication process, and the S-NSSAI in the Pending NSSAI needs to execute the authentication process.

[0217] Similarly, for each S-NSSAI in the Pending NSSAI, the AMF initiates an authentication process for each S-NSSAI, and obtains a new Allowed NSSAI and / or Rejected NSSAI based on the authentication result, and then sends the new Allowed NSSAI and / or Rejected NSSAI to the UE through a configuration update control message, and the UE accesses the network slice (including the first network slice) in the new AllowedNSSAI.

[0218] S805. The UE sends a first session establishment request to the AMF. Correspondingly, the AMF receives the first session establishment request from the UE.

[0219] The first session establishment request is used to trigger the establishment of a PDU session associated with the first network slice. It can be understood that the first session establishment request carries the identifier of the first network slice, that is, the first S-NSSAI, to indicate the establishment of a PDU session associated with the first network slice.

[0220] S806. PCF / NSSF / OAM sends a notification message to AMF, where the notification message is used to indicate that the first network slice needs to be replaced with the second network slice. Correspondingly, AMF receives the notification message.

[0221] It should be noted that after AMF receives the session establishment request sent by the UE, PCF / NSSF / OAM detects that the first network slice in the network is congested or unavailable, and sends the above notification message to AMF.

[0222] S807. AMF determines that an authentication process needs to be performed on the second network slice.

[0223] If it is determined that the authentication process does not need to be performed on the second network slice, the AMF can trigger the process for the UE to access the second network slice. If it is determined that the authentication process needs to be performed on the second network slice, the AMF executes the following S808.

[0224] S808. AMF determines that the UE has not performed the authentication process of the second network slice, or the AMF has not stored the authentication result of the UE performing the authentication process of the second network slice.

[0225] In an embodiment of the present application, the AMF determines that an authentication process needs to be performed on the second network slice. The AMF needs to first determine whether the UE has executed the authentication process of the second network slice, or determine whether the AMF has stored the authentication result of the UE executing the authentication process of the second network slice.

[0226] In one implementation, if the UE does not execute the authentication process of the second network slice or the AMF does not store the authentication result of the UE executing the authentication process of the second network slice, the AMF suspends the PDU session establishment process and adds the second S-NSSAI to the Pending NSSAI. Then the AMF executes the following S809-S811 to complete the authentication process of the second network slice first, and after the UE accesses the second network slice, executes the session modification process of S812-S814 to migrate the PDU session from the first network slice to the second network slice.

[0227] In another implementation, if the AMF stores the authentication result of the UE executing the authentication process of the second network slice, and the authentication result is successful, there are two cases in this implementation.

[0228] The first case is that the AMF stores the successful authentication result of the second network slice, and the UE's local Allowed NSSAI contains the identifier of the second network slice, that is, the UE is currently connected to the second network slice. At this time, the AMF directly executes the following S812-S814 session modification process to migrate the PDU session from the first network slice to the second network slice.

[0229] The second situation is that AMF stores the successful authentication result of the second network slice, but the UE's local Allowed NSSAI does not contain the identifier of the second network slice, which means that the UE is not currently accessing the second network slice. At this time, AMF executes the following S811, sends a new Allowed NSSAI containing the second network slice to the UE through a configuration update control message, and then executes the session modification process of S812-S814 after the UE accesses the second network slice to migrate the PDU session from the first network slice to the second network slice.

[0230] For the second case, AMF stores the authentication result of successful authentication of the second network slice, but a possible reason why the UE's local Allowed NSSAI does not include the identifier of the second network slice is: before the first network slice accessed by the UE is congested or unavailable, the UE performs an authentication process on the second network slice, so AMF locally stores the authentication result of successful authentication of the second network slice, and the UE's Allowed NSSAI includes the identifier of the second network slice, and the UE also accesses the second network slice. Afterwards, the UE accesses the first network slice and no longer accesses the second network slice, then the identifier of the second network slice in the UE's Allowed NSSAI is removed from the Allowed NSSAI, so the UE's local AllowedNSSAI no longer includes the identifier of the second network slice.

[0231] S809. AMF sends a first configuration update control message to the UE. The first configuration update control message carries a pending NSSAI, and the pending NSSAI includes a second S-NSSAI.

[0232] S810. AMF initiates the authentication process for the second network slice.

[0233] It should be understood that when the authentication of the second network slice is successful, AMF adds the second S-NSSAI to the Allowed NSSAI to obtain a new Allowed NSSAI, and then AMF executes the following S811. When the authentication of the second network slice fails, AMF will refuse to establish the PDU session. Similar to the above S709, AMF sends an indication message to the UE to indicate the refusal to establish the PDU session associated with the first network slice.

[0234] S811. AMF sends a third configuration update control message to the UE. The third configuration update control message carries a new Allowed NSSAI and a mapping relationship between the first network slice and the second network slice. The new Allowed NSSAI includes an identifier of the second network slice.

[0235] S812. AMF sends a second session establishment request to SMF. The second session establishment request is used to trigger the establishment of a PDU session associated with the second network slice. The session establishment request carries the identifier of the second network slice, i.e., the second S-NSSAI.

[0236] In an embodiment of the present application, AMF selects SMF based on the second network slice, and sends a session establishment request to SMF to trigger SMF to establish a PDU session associated with the second network slice.

[0237] S813. SMF returns a session establishment response to AMF.

[0238] S814. AMF sends a session establishment accept message to the UE.

[0239] In the embodiment of the present application, when the UE requests to establish a PDU session associated with the first network slice, when the AMF determines that the first network slice needs to be switched to the second network slice, the AMF initiates an authentication process for the second network slice, and after the authentication is successful, a PDU session associated with the second network slice is established through S812-S814. For the detailed process of the PDU session establishment process, reference can be made to the description of the existing technical materials, and the embodiment of the present application will not be described in detail.

[0240] Through the above S801-S814, when the mobility management network element determines that the second network slice needs to be replaced by the first network slice, it needs to consider whether to authenticate the second network slice. When the second network slice needs to be authenticated, the AMF initiates the authentication process for the second network slice, and after the authentication is successful, the UE's previously initiated PDU session associated with the first network slice is converted to a PDU session associated with the second network slice. This can avoid the security risks caused by the UE's arbitrary access to the second network slice due to failure to authenticate the second network slice, and can also smoothly establish a PDU session for the UE.

[0241] Example 5

[0242] When the first network slice currently accessed by the UE is congested or unavailable, it is necessary to use the second network slice to replace the second network slice, and in the scenario where the UE has a PDU session associated with the first network slice, the mobility management network element (such as AMF) sends a configuration update control message to the UE through the UCU process to instruct the UE to perform an authentication process (i.e., NSSAA process) on the second network slice. Specifically, Fig. 9 As shown, the communication method provided in the embodiment of the present application may include:

[0243] S901. The UE establishes a PDU session associated with the first network slice, that is, the UE has established a PDU session associated with the first network slice.

[0244] S902, PCF / NSSF / OAM sends a notification message to the UE, where the notification message is used to indicate that the first network slice needs to be replaced with the second network slice. Correspondingly, AMF receives the notification message.

[0245] The above notification message carries the second S-NSSAI.

[0246] S903. AMF determines that an authentication process needs to be performed on the second network slice.

[0247] In an embodiment of the present application, the AMF determines whether it is necessary to perform an authentication process on the second network slice. If it is determined that the authentication process does not need to be performed on the second network slice, after the UE accesses the second network slice, the AMF executes S907-S909 to complete the session modification process; if it is determined that the authentication process needs to be performed on the second network slice, the AMF first executes the following S904-S906 to complete the authentication process for the second network slice, and after the UE accesses the second network slice, the AMF executes S907-S909 to complete the session modification process.

[0248] S904. AMF sends a first configuration update control message to the UE. The first configuration update control message carries a pending NSSAI, and the pending NSSAI includes a second S-NSSAI.

[0249] S905. AMF initiates the authentication process for the second network slice.

[0250] In the embodiment of the present application, if the result of executing the authentication process for the second network slice is successful authentication, the AMF adds the second S-NSSAI to the Allowed NSSAI to obtain a new Allowed NSSAI, and then the AMF executes the following S906. If the result of executing the authentication process for the second network slice is a failed authentication, the AMF adds the S-NSSAI of the second network slice to the Rejected NSSAI, and the AMF does not perform network slice replacement.

[0251] S906. AMF sends a third configuration update control message to the UE, and the third configuration update control message carries the new Allowed NSSAI and the mapping relationship between the first network slice and the second network slice.

[0252] In an embodiment of the present application, after the AMF receives the third configuration update control message, the AMF initiates a session modification process (S907-S909) to migrate the PDU session of the current UE from the first network slice to the second network slice and establish a PDU session associated with the second network slice.

[0253] S907, AMF sends a session modification request to SMF. The session modification request carries the second S-NSSAI, and the session modification request is used to trigger the modification of the UE's current PDU session associated with the first network slice to a PDU session associated with the second network slice.

[0254] S908. SMF returns a session modification response to AMF.

[0255] S909. AMF sends a session modification command to the UE.

[0256] In the embodiment of the present application, when the UE has established a PDU session associated with the first network slice, when the first network slice needs to be switched to the second network slice, the AMF initiates an authentication process for the second network slice, and after the authentication is successful, the PDU session is modified through S907-S909 to migrate the PDU session from the first network slice to the second network slice. The detailed process of the PDU session modification process can be referred to the description of the existing technical materials, and the embodiment of the present application will not be described in detail.

[0257] In the above-mentioned communication method of S901-S909, the first network slice can be replaced by the second network slice, and the PDU session originally associated with the first network slice can be migrated to the second network slice, thereby ensuring that the continuity of the service is not affected.

[0258] In the above-mentioned Embodiments 1 to 5, some steps are the same or similar, so the descriptions of the steps of each embodiment can refer to each other.

[0259] It is understandable that the communication device (i.e., the mobility management network element) for executing the communication method mentioned above includes hardware structures and / or software modules corresponding to executing each function in order to implement the above functions. Those skilled in the art should easily realize that, in combination with the method steps of each example described in the embodiments disclosed herein, the embodiments of the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the embodiments of the present application.

[0260] The embodiment of the present application can divide the functional modules of the above-mentioned communication device according to the above-mentioned method example. For example, each functional module can be divided corresponding to each function, or two or more functions can be integrated into one processing module. The above-mentioned integrated module can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiment of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0261] In the case of dividing each functional module into corresponding functional modules, Fig.10 FIG. 1 is a schematic diagram showing a possible structure of a communication device provided in an embodiment of the present application. It should be understood that the communication device can implement the functions of the mobility management network element in the above embodiment. Fig.10 As described above, the communication device includes a receiving module 1001 and a sending module 1002 .

[0262] The receiving module 1001 is used to execute S401, S501, S502, S505, S601, S602, S605, S608, S701, S702, S705, S706, S801, S802, S805, S806, and S902 in the above method embodiments. The sending module 1002 is used to execute S402, S504, S507, S509, S603, S604, S607, S609, S611, S704, S709, S804, S809, S811, S812, S814, S904, S906, S907, and S909 in the above method embodiments.

[0263] Optionally, the communication device provided in the embodiment of the present application further includes a processing module 1003 and a determining module 1004.

[0264] The processing module 1003 is used to execute S508, S610, S810, and S905 in the above method embodiment. The determining module 1004 is used to execute S503, S506, S606, S703, S707, S708, S803, S807, S808, and S903 in the above method embodiment.

[0265] In the case of an integrated unit, Fig.11 Another possible structural diagram of the communication device involved in the above embodiment is shown. The communication device may include: a processing module 1101 and a communication module 1102. The processing module 1101 may be used to control and manage the actions of the communication device. For example, the processing module 1101 may be used to support the communication device to execute S503, S506, S508, S606, S610, S703, S707, S708, S803, S807, S808, S810, S903, S905 in the above method embodiment, and / or other processes for the technology described herein. The communication module 1102 may be used to support the communication between the communication device and other network entities, for example, to execute S401, S402, S501, S502, S504, S505, S507, S509, S601, S602, S603, S604, S605, S607, S608, S609, S611, S701, S702, S704, S705, S706, S709, S801, S802, S804, S805, S806, S809, S811, S812, S814, S902, S904, S906, S907, S909 in the above method embodiments. Fig.11 As shown, the communication device may further include a storage module 1103 for storing program codes and data of the communication device.

[0266] The processing module 1101 may be a processor, the communication module 1102 may be a transceiver, a transceiver circuit or a communication interface, etc., and the storage module 1103 may be a memory.

[0267] Each module of the above-mentioned communication device can also be used to perform other actions in the above-mentioned method embodiment. All relevant contents of each step involved in the above-mentioned method embodiment can be referred to the functional description of the corresponding functional module and will not be repeated here.

[0268] For more details on how the modules included in the above communication device implement the above functions, please refer to the descriptions in the previous method embodiments, which will not be repeated here. Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments.

[0269] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using a software program, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer instruction is loaded and executed on a computer, the process or function in accordance with the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network or other programmable device. The computer instruction can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instruction can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) mode or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a communication device, a data center, etc. that includes one or more available media integrated. The available medium may be a magnetic medium (eg, a floppy disk, a magnetic disk, a magnetic tape), an optical medium (eg, a digital video disc (DVD)), or a semiconductor medium (eg, a solid state drive (SSD)).

[0270] Through the description of the above implementation methods, technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device and unit described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0271] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0272] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0273] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0274] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art, or all or part of the technical solution. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) or a processor to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: flash memory, mobile hard disk, read-only memory, random access memory, disk or optical disk, and other media that can store program codes.

[0275] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A communication method, characterized in that: include: The mobility management network element receives a notification message; the notification message is used to indicate that the first network slice needs to be replaced with the second network slice, and the first network slice is the network slice currently accessed by the user equipment UE; Before the UE accesses the second network slice, the mobility management network element sends network slice information to be authenticated to the UE; wherein the network slice information to be authenticated includes an identifier of the second network slice, and the network slice information to be authenticated is used to trigger an authentication process for the second network slice.

2. The method according to claim 1, characterized in that The mobility management network element sends network slice information to be authenticated to the UE, including: The mobility management network element sends a first configuration update control message to the UE, and the first configuration update control message includes the network slice information to be authenticated.

3. The method according to claim 1, characterized in that The mobility management network element sends network slice information to be authenticated to the UE, including: The mobility management network element sends a registration acceptance message to the UE; the registration acceptance message includes the network slice information to be authenticated.

4. The method according to claim 3, characterized in that Before the mobility management network element sends a registration acceptance message to the UE, the method further includes: The mobility management network element sends a second configuration update control message to the UE, where the second configuration update control message is used to trigger the UE to initiate a registration process; The mobility management network element receives a registration request message from the UE.

5. The method according to any one of claims 1 to 4, characterized in that: The method comprises: The mobility management network element initiates an authentication process for the second network slice; The mobility management network element determines that the authentication of the second network slice is successful; The mobility management network element sends a third configuration update control message to the UE, wherein the third configuration update control message includes network slice information allowed for access, and the network slice information allowed for access includes an identifier of the second network slice.

6. The method according to claim 5, characterized in that The third configuration update control message also includes: a mapping relationship between the first network slice and the second network slice.

7. The method according to any one of claims 1 to 6, characterized in that: Before the mobility management network element receives the notification message, the method further includes: The mobility management network element receives a first session establishment request from the UE; the first session establishment request includes an identifier of the first network slice, and the first session establishment request is used to trigger establishment of a protocol data unit PDU session associated with the first network slice; After the second network slice is successfully authenticated, the method further includes: The mobility management network element sends a second session establishment request to the session management network element; the second session establishment request includes an identifier of the second network slice, and the second session establishment request is used to trigger establishment of a PDU session associated with the second network slice.

8. The method according to any one of claims 1 to 6, characterized in that: The method further comprises: In a case where the UE has established a protocol data unit (PDU) session associated with the first network slice, the mobility management network element triggers a session modification process for migrating the PDU session from the first network slice to the second network slice.

9. The method according to any one of claims 1 to 8, characterized in that: Before the mobility management network element sends the network slice information to be authenticated to the UE, the method further includes: The mobility management network element determines whether it is necessary to perform an authentication process on the second network slice based on the subscription data of the UE.

10. A communication method, characterized in that: include: The mobility management network element receives a session establishment request from a user equipment UE; the session request includes an identifier of a first network slice, and the session establishment request is used to trigger establishment of a PDU session associated with the first network slice; The mobility management network element receives a notification message; the notification message is used to indicate that the first network slice needs to be replaced with a second network slice; When the mobility management network element determines that an authentication process needs to be performed on the second network slice, the mobility management network element sends indication information to the UE; The indication information is used to indicate a refusal to establish a PDU session associated with the first network slice.

11. The method according to claim 10, characterized in that Before the mobility management network element sends the indication information to the UE, the method further includes: The mobility management network element determines that the UE does not perform the authentication process of the second network slice; or, The mobility management network element does not store the authentication result of the UE executing the authentication process of the second network slice.

12. The method according to claim 10 or 11, characterized in that: Before the mobility management network element sends the indication information to the UE, the method further includes: The mobility management network element determines whether it is necessary to perform an authentication process on the second network slice based on the subscription data of the UE.

13. A communication device, characterized in that: include: Receiving module and sending module; The receiving module is used to receive the notification message; The notification message is used to indicate that the first network slice needs to be replaced with the second network slice, where the first network slice is the network slice currently accessed by the user equipment UE; The sending module is used to send network slice information to be authenticated to the UE before the UE accesses the second network slice; wherein the network slice information to be authenticated includes an identifier of the second network slice, and the network slice information to be authenticated is used to trigger an authentication process for the second network slice.

14. The communication device according to claim 13, characterized in that: The sending module is specifically used to send a first configuration update control message to the UE, wherein the first configuration update control message includes the network slice information to be authenticated.

15. The communication device according to claim 13, characterized in that: The sending module is specifically used to send a registration acceptance message to the UE; the registration acceptance message includes the network slice information to be authenticated.

16. The communication device according to claim 15, characterized in that: The sending module is further used to send a second configuration update control message to the UE, where the second configuration update control message is used to trigger the UE to initiate a registration process; The receiving module is further configured to receive a registration request message from the UE.

17. The communication device according to any one of claims 13 to 16, characterized in that: The communication device also includes a processing module and a determination module; The processing module is used to initiate an authentication process for the second network slice; The determining module is used to determine that the authentication of the second network slice is successful; The sending module is also used to send a third configuration update control message to the UE, wherein the third configuration update control message includes network slice information allowed for access, and the network slice information allowed for access includes an identifier of the second network slice.

18. The communication device according to claim 17, characterized in that: The third configuration update control message also includes: a mapping relationship between the first network slice and the second network slice.

19. The communication device according to any one of claims 13 to 18, characterized in that: The receiving module is further used to receive a first session establishment request from the UE; the first session establishment request includes an identifier of the first network slice, and the first session establishment request is used to trigger establishment of a protocol data unit PDU session associated with the first network slice; The sending module is also used to send a second session establishment request to the session management network element if the PDU session associated with the first network slice is not established; the second session establishment request includes an identifier of the second network slice, and the second session establishment request is used to trigger the establishment of a PDU session associated with the second network slice.

20. The communication device according to any one of claims 13 to 18, characterized in that: The processing module is also used to trigger a session modification process for migrating the PDU session from the first network slice to the second network slice when the UE has established a protocol data unit PDU session associated with the first network slice.

21. The communication device according to any one of claims 13 to 20, characterized in that: The determination module is also used to determine whether it is necessary to perform an authentication process on the second network slice based on the subscription data of the UE.

22. A communication device, characterized in that: include: Receiving module and sending module; The receiving module is used to receive a session establishment request from a user equipment UE; the session request includes an identifier of a first network slice, and the session establishment request is used to trigger establishment of a PDU session associated with the first network slice; The receiving module is further used to receive a notification message; the notification message is used to indicate that the first network slice needs to be replaced with a second network slice; The sending module is used to send indication information to the UE when the mobility management network element determines that an authentication process needs to be performed on the second network slice; The indication information is used to indicate a refusal to establish a PDU session associated with the first network slice.

23. The communication device according to claim 22, characterized in that: The communication device also includes a determination module; The determining module is used to determine that the UE does not perform the authentication process of the second network slice; or: The determination module is used to determine that the authentication result of the UE executing the authentication process of the second network slice is not stored.

24. The communication device according to claim 22 or 23, characterized in that: The determination module is also used to determine whether it is necessary to perform an authentication process on the second network slice based on the subscription data of the UE.

25. A communication device, characterized in that: The invention comprises a memory and at least one processor connected to the memory, wherein the memory is used to store computer program code, and the computer program code comprises computer instructions. When the computer instructions are executed by the at least one processor, the communication device executes the method according to any one of claims 1 to 9, or executes the method according to any one of claims 10 to 12.

26. A computer-readable storage medium, characterized in that: Computer instructions are stored, and when the computer instructions are executed on a computer, the method according to any one of claims 1 to 9 or the method according to any one of claims 10 to 12 is executed.

27. A communication system, characterized in that: The method comprises a mobility management network element and a user equipment UE, wherein the mobility management network element is used to execute the method according to any one of claims 1 to 9 or any one of claims 10 to 12.

Images