Communication method and communication device

Abstract

The invention provides a communication method and a communication device, which are applied to a scene in which terminal equipment is registered to a home network through a first mobility management function network element and a second mobility management function network element respectively. Sending an authentication notice to the first mobility management function network element, wherein the authentication notice is used for requesting to carry out main authentication on the terminal equipment; the home network element sends an authentication notification to a second mobility management function network element under the condition that the first mobility management function network element cannot perform main authentication on the terminal equipment, the authentication notification is used for requesting to perform main authentication on the terminal equipment, and the home network element sends the authentication notification to the second mobility management function network element under the condition that the second mobility management function network element can perform main authentication on the terminal equipment. And the home network element sends the notification message used for indicating to delete the first suspension mark to the first mobility management function network element, thereby avoiding re-triggering the main authentication of the terminal equipment when the subsequent terminal equipment accesses the first mobility management function network element again, and reducing the signaling overhead.

Description

Technical Field

[0001] The present application relates to the field of communications, and more specifically, to a communication method and a communication device. Background Art

[0002] In communication systems, such as the fifth generation (5G), in order to ensure network security, it is necessary to perform a primary authentication process on the terminal devices accessing the network, that is, to authenticate and authorize the terminal devices. The terminal devices can access the network only after passing the authentication, and further request to establish a protocol data unit (PDU) session to access various services on the data network (DN).

[0003] Exemplarily, the terminal device may use the third generation partnership project (3GPP) technology and the non-3GPP technology to access the network through the first mobility management function network element and the second mobility management function network element respectively. When the home network element determines according to the operator's authentication policy that primary authentication of the terminal device is required, the home network element may request the mobility management function network element to perform primary authentication of the terminal device. If the two mobility function network elements cannot initiate primary authentication of the terminal device, a suspension flag may be set locally to trigger the primary authentication when the primary authentication of the terminal device can be initiated. However, the two primary authentication processes may result in unnecessary signaling overhead. Summary of the invention

[0004] The present application provides a communication method and a communication device, which can avoid redundant main authentication processes for terminal equipment and reduce signaling overhead.

[0005] In a first aspect, a communication method is provided, which may be executed by a home network element, or may be executed by a chip or circuit of the home network element, which is not limited in the present application. For ease of description, the following description is given by taking the execution by the home network element as an example.

[0006] The method comprises: when a terminal device is registered to a network through a first mobility management function network element and a second mobility management function network element respectively, a home network element stores an identifier of the first mobility management function network element and an identifier of the second mobility management function network element; when it is determined that a primary authentication is required for the terminal device, the home network element sends a first authentication notification message to the first mobility management function network element, the first authentication notification message is used to request triggering the primary authentication of the terminal device; the home network element receives a first authentication response message from the first mobility management function network element, the first authentication response message is used to indicate that the primary authentication of the terminal device cannot be initiated; and the response In response to the first authentication response message, the hometown network element sends a second authentication notification message to the second mobility management function network element, and the second authentication notification message is used to request triggering a primary authentication for the terminal device; the hometown network element receives the second authentication response message from the second mobility management function network element; when it is determined according to the second authentication response message that the second mobility management function network element can initiate the primary authentication for the terminal, the hometown network element sends a first notification message to the first mobility management function network element, and the first notification message is used for the first mobility management function network element to cancel a first suspension flag, wherein the first suspension flag is used to indicate that the primary authentication for the terminal device needs to be triggered.

[0007] Among them, canceling the first suspension mark can be understood as the first suspension mark being invalid. If the first suspension mark is indicated by a bit, such as 1 represents that the first suspension mark is valid, and 0 represents that the first suspension mark is invalid, then the first mobility management function network element changes the first suspension mark from 1 to 0; or, if the first suspension mark exists to indicate validity, and no longer exists to indicate invalidity, then the first mobility management function network element deletes the first suspension mark, etc.

[0008] It should be understood that the first suspension flag is used to indicate that when the terminal device re-registers with the network through the first mobility management function network element, or the terminal device is reachable, the first mobility management function network element determines to authenticate the terminal device based on the locally set first suspension flag.

[0009] Exemplarily, when the terminal device reattaches to the same mobility management function network element or the terminal device becomes reachable, the mobility management function network element checks the authentication suspension flag and performs re-authentication if necessary. After the terminal device re-authentication is completed, the mobility management function network element resets the authentication suspension flag. If the terminal device is attached to a new mobility management function network element (for example, in a mobile scenario), the new mobility management function network element may retrieve the context of the terminal device from the previous mobility management function network element, determine that the authentication of the terminal device is suspended, and perform re-authentication.

[0010] It should be understood that the embodiment of the present application does not limit how the home network element preferentially selects the first mobility management function network element to initiate an authentication request when the home network element stores both the first mobility management function network element and the second mobility management function network element.

[0011] In an embodiment of the present application, the inability to initiate the primary authentication of the terminal device can be understood as the terminal device is unreachable, or the first mobility management function network element has not found the terminal device. Among them, "cannot be initiated" can also be replaced by names such as "cannot be initiated", "cannot be triggered", and "cannot be triggered". Exemplarily, after receiving the first authentication notification message, the first mobility management function network element determines whether to trigger the primary authentication of the terminal device based on the local authentication policy and the status of the terminal device. For example, if the first mobility management function network element finds that the terminal device is unreachable, or the first mobility management function network element has not found the terminal device, the first mobility management function network element sends a first authentication response message to the hometown network element.

[0012] According to the solution provided in the present application, the hometown network element determines, based on the received second authentication response message, that the second mobility management function network element can initiate the main authentication of the terminal device, and then can send a first notification message to the first mobility management function network element serving the terminal device, for notifying the first mobility management function network element to delete or reset the suspension flag, or to notify the first mobility management function network element to cancel or terminate the hometown network's execution of the main authentication process, thereby avoiding the subsequent first mobility management function network element triggering a re-authentication process for the terminal device and reducing signaling overhead.

[0013] In combination with the first aspect, in some implementations of the first aspect, the first authentication response message includes a first cause value, and the first cause value is used to indicate that the first mobility management function network element cannot perform primary authentication on the terminal device.

[0014] Based on the above scheme, the first authentication response message carries a first cause value, and the first cause value is used to indicate that the first mobility management function network element cannot start the primary authentication of the terminal device. For example, the first cause value may indicate that the primary authentication of the terminal device fails to start, or the first cause value may indicate that the terminal device is unreachable, and the home network element may determine that the first mobility management function network element has not performed the primary authentication of the terminal device according to the first cause value.

[0015] In combination with the first aspect, in certain implementations of the first aspect, in response to a first authentication response message, a first authentication suspension flag is set, and the first authentication suspension flag is used to indicate that a first suspension flag is set on the first mobility management function network element; wherein, the hometown network element sends a first notification message to the first mobility management function network element, including: the hometown network element sends the first notification message to the first mobility management function network element according to the first authentication suspension flag.

[0016] Optionally, a first authentication suspension flag is set according to the first reason value.

[0017] Among them, the first notification message itself has an indicative function, or carries a reason value with an indicative function, that is, it is used to instruct the first mobility management function network element to delete the first suspension flag, and the first suspension flag is used to indicate the need to trigger the main authentication of the terminal device; or, the first notification message is used to instruct the first mobility management function network element to cancel or terminate the execution of the main authentication process of the home network.

[0018] Exemplarily, the first notification message may be an authentication notification message carrying a reason value, or a first notification message carrying a reason value, or a first notification message not carrying a reason value, and the reason value may be used to indicate that the second mobility management function network element has performed primary authentication on the terminal device, or to indicate that the primary authentication of the terminal device is in progress, or to indicate that the primary authentication of the terminal device is successful, or to instruct the first mobility management function network element to delete the first suspension flag, or to indicate that the first mobility management function network element will no longer trigger the primary authentication process for the terminal device due to the locally set first suspension flag, that is, to instruct the first mobility management function network element to cancel or terminate the execution of the primary authentication process by the home network.

[0019] Optionally, the home network element sets the first authentication suspension flag only when receiving a specific failure cause value. For example, when the failure cause value received by the home network element indicates that the terminal device is reachable, the home network element sets the first authentication suspension flag.

[0020] Based on the above scheme, the hometown network element can know that the terminal device is unreachable according to the first reason value, or know that the first mobility management function network element has failed to start the main authentication of the terminal device, and then can set the first authentication suspension flag, and can associate the first authentication suspension flag with the first mobility management function network element.

[0021] Exemplarily, after receiving the second authentication response message that does not carry a cause value, the home network element may determine that the second mobility management function network element is capable of executing the main authentication process for the terminal device. Further, the home network element determines whether to send the first notification message to the first mobility management function network element. For example, the home network element determines whether the first mobility management function network element exists, and if so, further determines whether to send the first notification message to the first mobility management function network element that is determined to exist.

[0022] Exemplarily, when it is determined that the first notification message needs to be sent, the first notification message can be sent to notify the cancellation or termination of the home network triggered main authentication process, or to notify that the suspension flag set at the first mobility management function network element can be cancelled.

[0023] In combination with the first aspect, in some implementations of the first aspect, after sending the first notification message to the first mobility management function network element, the home network element deletes the first authentication suspension flag.

[0024] Exemplarily, the first authentication suspension flag may be deleted after the primary authentication of the terminal device succeeds, or during the process of performing the primary authentication on the terminal device.

[0025] Based on the above scheme, by deleting the first authentication suspension flag, if the first mobility management function network element subsequently requests primary authentication for the terminal device, the hometown network element can reject the authentication request of the first mobility management function network element based on the fact that the first authentication suspension flag is not stored locally, thereby avoiding redundant authentication processes and reducing signaling overhead.

[0026] In combination with the first aspect, in certain implementations of the first aspect, in response to the first authentication response message, a second authentication notification message is sent to the second mobility management function network element, including: in response to the first authentication response message, according to the identifier of the second mobility management function network element, a second authentication notification message is sent to the second mobility management function network element.

[0027] In combination with the first aspect, in certain implementation methods of the first aspect, when any of the following items is met, it is determined that the second mobility management function network element can initiate primary authentication of the terminal; the second authentication response message carries a response message to the second authentication notification message; or, the second authentication response message does not carry a second cause value, and the second cause value is used to indicate that the second mobility management function network element cannot perform primary authentication on the terminal device.

[0028] It should be understood that the present application does not limit the timing of sending the first notification message.

[0029] In combination with the first aspect, in certain implementations of the first aspect, when it is determined based on the second authentication response message that the second mobility management function network element cannot initiate primary authentication for the terminal, the second authentication response message includes a third cause value, and the third cause value is used to indicate that the second mobility management function network element cannot perform primary authentication for the terminal device. For example, the third cause value includes that the second mobility management function network element cannot find the terminal device, or the terminal device is unreachable.

[0030] Exemplarily, when it is determined according to the second authentication response message that the primary authentication of the terminal cannot be initiated, and subsequently one of the first mobility management function network element and the second mobility management function network element initiates the primary authentication of the terminal, any of the following operations is performed on the other of the first mobility management function network element and the second mobility management function network element: notifying the fourth mobility management function network element to cancel the suspension flag; or rejecting the primary authentication request initiated by the fourth mobility management function network element.

[0031] That is, if the two mobility management function network elements cannot access the terminal device, two pending flags are stored in the two mobility management function network elements. When the terminal device becomes reachable and one of the mobility management function network elements initiates the primary authentication process, the home network element can take appropriate action on the other mobility management function network element by rejecting the primary authentication due to the previous request, or notifying the other mobility management function network element to delete the pending flag, or the home network element can respond to the two primary authentication processes in sequence.

[0032] Based on the above scheme, the home network element can determine that the second mobility management function network element has not performed primary authentication on the terminal device according to the cause value. The cause value is used to indicate that the second mobility management function network element cannot start the primary authentication of the terminal device. For example, the failure cause value can indicate that the primary authentication of the terminal device fails to start, or the failure cause value can indicate that the terminal device is unreachable.

[0033] In combination with the first aspect, in certain implementations of the first aspect, when the terminal device registers to the network again through the second mobility management function network element, the hometown network element receives a first request message from the second authentication server function network element, the first request message is used to request a first primary authentication for the terminal device, the first request message includes a second service network name, and the second service network name is used to indicate the service network where the second mobility management function network element is located; the hometown network element determines that the first primary authentication comes from the second mobility management function network element based on the second service network name; the hometown network element sends a second notification message to the first authentication server function network element or the first mobility management function network element, and the second notification message is used to instruct the first mobility management function network element to cancel the first suspension flag.

[0034] Among them, the second notification message itself has an indicative function, or carries a reason value with an indicative function, that is, it is used to instruct the first mobility management function network element to delete or invalidate the first suspension flag, and the first suspension flag is used to indicate the need to trigger the main authentication of the terminal device; or, the second notification message is used to instruct the first mobility management function network element to cancel or terminate the execution of the main authentication process of the home network.

[0035] Exemplarily, the second notification message may be an authentication notification message carrying a reason value, or a second notification message carrying a reason value, or a second notification message without a reason value, and the reason value may be used to indicate that the second mobility management function network element has performed primary authentication on the terminal device, or to indicate that primary authentication of the terminal device is in progress, or to indicate that primary authentication of the terminal device is successful, or to indicate that the first mobility management function network element deletes the first suspension flag, or to indicate that the first mobility management function network element will no longer trigger the primary authentication process for the terminal device due to the first suspension flag set locally, that is, to instruct the first mobility management function network element to cancel or terminate the execution of the primary authentication process by the home network. Correspondingly, the first mobility management function network element may determine not to trigger the primary authentication of the terminal device based on the second notification message or the reason value carried in the second notification message, thereby avoiding redundant primary authentication processes and reducing signaling overhead.

[0036] Based on the above scheme, the hometown network element determines which mobility management function network element the authentication comes from. After knowing that the current main authentication comes from the mobility management function network element of the service terminal device, after receiving the authentication request initiated by the first mobility management function network element of the service terminal device, it rejects the authentication request of the first mobility management function network element, thereby avoiding redundant authentication processes and reducing signaling overhead.

[0037] In combination with the first aspect, in certain implementations of the first aspect, the hometown network element sends a second notification message to the first authentication server function network element or the first mobility management function network element, including: the hometown network element sends the first notification message to the first mobility management function network element based on the stored identifier of the first mobility management function network element; or, the hometown network element sends the first notification message to the first mobility management function network element based on a set first authentication suspension flag, and the first authentication suspension flag is used to indicate that a first suspension flag is set on the first mobility management function network element.

[0038] Based on the above solution, the home network element determines which mobility management function network element the authentication comes from, and after knowing that the current primary authentication comes from the mobility management function network element of the service terminal device, directly sends a cancel suspension flag to the first mobility management function network element of other service terminal devices that have not triggered the authentication request, thereby avoiding triggering redundant authentication processes and reducing signaling overhead. Compared with rejecting the authentication request after receiving it from the first mobility management function network element, unnecessary overhead can be reduced.

[0039] In combination with the first aspect, in certain implementations of the first aspect, before the hometown network element sends the second notification message to the first authentication server function network element or the first mobility management function network element, the method also includes: the hometown network element determines to perform a first primary authentication on the terminal device; the hometown network element sends an authentication vector to the second authentication server function network element, and the authentication vector is used to perform the first primary authentication on the terminal device; the hometown network element receives the authentication result from the second authentication server function network element; wherein the hometown network element sends the second notification message to the first authentication server function network element or the first mobility management function network element, including: when the authentication result indicates that the first primary authentication is successful, the hometown network element sends the second notification message to the first authentication server function network element or the first mobility management function network element.

[0040] Based on the above scheme, when it is determined that the second mobility management function network element has successfully authenticated the terminal device, the hometown network element sends a second notification message to the first authentication server function network element or the first mobility management function network element to avoid the subsequent first mobility management function network element re-triggering the primary authentication of the terminal device when the terminal device is reachable, avoiding redundant authentication processes and reducing signaling overhead.

[0041] In combination with the first aspect, in certain implementations of the first aspect, when the authentication result indicates that the first primary authentication is successful, the hometown network element deletes the second authentication suspension flag, and the second authentication suspension flag is used to indicate that a second suspension flag is set on the second mobility management function network element, and the second suspension flag is used to indicate that it is necessary to trigger the primary authentication of the terminal device.

[0042] Based on the above solution, if the first mobility management function network element subsequently requests primary authentication for the terminal device, the hometown network element can reject the authentication request of the first mobility management function network element based on the fact that the second authentication suspension flag is not stored locally, thereby avoiding redundant authentication processes and reducing signaling overhead.

[0043] In combination with the first aspect, in certain implementations of the first aspect, before the hometown network element receives the first request message from the second authentication server function network element, the method also includes: the hometown network element sets a second authentication suspension flag according to a third reason value, and the second authentication suspension flag is used to indicate that a second suspension flag is set on the second mobility management function network element; wherein, the hometown network element determines to perform a first primary authentication on the terminal device, including: the hometown network element determines to perform a first primary authentication on the terminal device based on the stored first authentication suspension flag and the second authentication suspension flag, and the first authentication suspension flag is used to indicate that a first suspension flag is set on the first mobility management function network element.

[0044] Based on the above scheme, when the hometown network element determines that the first mobility management function network element and the second mobility management function network element serving the terminal device are unable to perform primary authentication on the terminal device, a first authentication suspension flag and a second authentication suspension flag are set to enable the hometown network element to determine that the primary authentication of the current terminal device has not been performed or has not occurred. Then, after the first authentication request message thereafter, it can be determined that the primary authentication of the terminal device will be executed.

[0045] In combination with the first aspect, in certain implementations of the first aspect, the hometown network element determines that the first primary authentication comes from the second mobility management function network element based on the second service network name, including: the hometown network element determines that the first primary authentication comes from the second mobility management function network element based on the second service network name and the stored correspondence between the second service network name and the second mobility management function network element; or, the hometown network element determines that the first primary authentication comes from the second mobility management function network element based on the information used to indicate the service network of the second mobility management function network element contained in the second service network name, and the stored correspondence between the information used to indicate the service network of the second mobility management function network element and the second mobility management function network element; or, the hometown network element determines that the first primary authentication comes from the second mobility management function network element by matching the information used to indicate the service network of the second mobility management function network element contained in the second service network name and the stored information used to indicate the service network of the second mobility management function network element contained in the second mobility management function network element identifier.

[0046] In combination with the first aspect, in some implementations of the first aspect, the information used to indicate the service network of the first mobility management function network element includes an identifier of a public land mobile network corresponding to the first mobility management function network element.

[0047] In combination with the first aspect, in certain implementations of the first aspect, the first request message also includes a fourth cause value, and the fourth cause value is used to indicate that the first primary authentication is determined based on the second suspension flag.

[0048] Based on the above solution, when the terminal device registers with the network again through the second mobility management function network element, the second mobility management function network element can trigger the primary authentication of the terminal device according to the second suspension flag set locally.

[0049] In combination with the first aspect, in certain implementations of the first aspect, before the hometown network element sends a second notification message to the first authentication server function network element, the method also includes: when the terminal device registers to the network again through the first mobility management function network element, the hometown network element receives a second request message from the first authentication server function network element, the second request message is used to request a second authentication of the terminal device, the second request message includes a first service network name, and the first service network name is used to indicate the service network where the first mobility management function network element is located.

[0050] Based on the above scheme, when the hometown network element knows that the current primary authentication comes from the second mobility management function network element that serves the terminal device, after receiving the authentication request initiated by the first mobility management function network element that serves the terminal device, it can reject the authentication request of the first mobility management function network element based on the current primary authentication of the terminal device, thereby avoiding redundant primary authentication processes and reducing signaling overhead.

[0051] In combination with the first aspect, in certain implementations of the first aspect, the second request message also includes a fifth cause value, and the fifth cause value is used to indicate that the second primary authentication is determined by the first suspension flag.

[0052] In combination with the first aspect, in certain implementations of the first aspect, the second notification message includes a sixth reason value, and the sixth reason value is used to indicate that when the terminal device registers to the network again through the first mobility management function network element, no primary authentication is performed on the terminal device, or in other words, to instruct the first mobility management function network element to cancel the first suspension flag.

[0053] In combination with the first aspect, in certain implementations of the first aspect, when it is determined that the primary authentication of the terminal device cannot be initiated according to the second authentication response message, and subsequently the third mobility management function network element initiates the primary authentication of the terminal, any of the following operations is performed on the fourth mobility management function network element: notifying the fourth mobility management function network element to cancel the suspension flag; or rejecting the primary authentication request initiated by the fourth mobility management function network element; wherein the third mobility management function network element is one of the first mobility management function network element and the second mobility management function network element, and the fourth mobility management function network element is the other of the first mobility management function network element and the second mobility management function network element except the third mobility management function network element.

[0054] In combination with the first aspect, in certain implementations of the first aspect, a first request message triggered by a third mobility management function network element is received, the first request message is used to request primary authentication of a terminal device, the first request message includes a second service network name, and the second service network name is used to indicate the service network where the third mobility management function network element is located; based on the second service network name, it is determined that an operation needs to be performed on a fourth mobility management function network element.

[0055] In combination with the first aspect, in certain implementations of the first aspect, based on the name of the second service network, it is determined that an operation needs to be performed on a fourth mobility management function network element, including: based on the second service network name, and the stored identifier of the first mobility management function network element and the identifier of the second mobility management function network element, it is determined that an operation needs to be performed on the fourth mobility management function network element; or, based on the second service network name, and a set first authentication suspension flag and a set second authentication suspension flag, it is determined that an operation needs to be performed on the fourth mobility management function network element, wherein the first authentication suspension flag is used to indicate that a first suspension flag is set on the first mobility management function network element, the second authentication suspension flag is used to indicate that a second suspension flag is set on the second mobility management function network element, and the second suspension flag is used to indicate that it is necessary to trigger a primary authentication of the terminal device.

[0056] In combination with the first aspect, in certain implementations of the first aspect, before determining that an operation needs to be performed on a fourth mobility management function network element, the method also includes: determining to perform primary authentication on a terminal device; sending an authentication vector to a third mobility management function network element, the authentication vector being used to perform primary authentication on the terminal device; receiving an authentication result for the terminal device; wherein determining that an operation needs to be performed on the fourth mobility management function network element includes: determining that an operation needs to be performed on the fourth mobility management function network element when the authentication result indicates that the authentication of the terminal device is successful.

[0057] In combination with the first aspect, in certain implementations of the first aspect, before receiving a first request message triggered by a third mobility management function network element, the method also includes: when it is determined that the first mobility function network element and the second mobility function network element cannot initiate the primary authentication of the terminal device, setting a first authentication suspension flag and a second authentication suspension flag; wherein, determining to perform the primary authentication on the terminal device includes: determining to perform the primary authentication on the terminal device based on the stored first authentication suspension flag and the second authentication suspension flag.

[0058] In combination with the first aspect, in certain implementations of the first aspect, before determining, based on the second service network name, that an operation needs to be performed on the fourth mobility management function network element, the method also includes: determining, based on the second service network name, and a stored correspondence between the second service network name and the third mobility management function network element, that the first request message is triggered by the third mobility management function network element; or, determining, based on the identifier of the public land mobile network included in the second service network name, and a stored correspondence between the identifier of the public land mobile network and the third mobility management function network element, that the first request message is triggered by the third mobility management function network element.

[0059] In combination with the first aspect, in certain implementations of the first aspect, before determining that an operation needs to be performed on a fourth mobility management function network element based on the second service network name, the method also includes: receiving a second request message triggered by the fourth mobility management function network element, the second request message being used to request primary authentication of the terminal device, the second request message including a third service network name, the third service network name being used to indicate the service network where the fourth mobility management function network element is located.

[0060] In summary, when both the first mobility management function network element and the second mobility management function network element cannot start the primary authentication of the terminal device, the first mobility management function network element and the second mobility management function network element locally set the first suspension flag and the second suspension flag, and optionally, the hometown network element sets the first authentication suspension flag and the second authentication suspension flag. Further, when the terminal device is reachable, or registers to the network through the third mobility management function network element, the third mobility management function network element triggers the primary authentication process for the terminal device according to the local suspension flag. Correspondingly, after receiving the authentication request sent by the third mobility management function network element, the hometown network element notifies the fourth mobility management function network element to cancel the suspension flag; or rejects the subsequent primary authentication request initiated by the fourth mobility function network element. If the third mobility management function network element is the first mobility management function network element, the fourth mobility management function network element is the second mobility management function network element; conversely, if the third mobility management function network element is the second mobility management function network element, the fourth mobility management function network element is the first mobility management function network element. For ease of description, in the embodiment of the present application, the second mobility management function network element requests to trigger the main authentication process for the terminal device, and the hometown network element notifies the first mobility management function to cancel the suspension mark; or, rejects the subsequent main authentication request initiated by the first mobility function network element as an example for explanation. For specific implementation methods, please refer to the relevant description in the specific embodiments below. If the first mobility management function network element requests to trigger the main authentication process for the terminal device, the hometown network element notifies the second mobility management function to cancel the suspension mark; or, rejects the main authentication request initiated by the second mobility function network element, and the specific implementation method is similar.

[0061] That is, when primary authentication of the key device is required, but both mobility management function network elements cannot reach the terminal device, two pending flags are stored in the two mobility management function network elements. When the terminal device becomes reachable and one of the mobility management function network elements initiates the primary authentication process, the home network element can take appropriate action on the other mobility management function network element by rejecting the primary authentication due to the previous request, or notifying the other mobility management function network element to delete the pending flag, or the home network element can respond to the two primary authentication processes in sequence.

[0062] In a second aspect, a communication method is provided, which can be executed by a first mobility management function network element, or can also be executed by a chip or circuit of the first mobility management function network element, which is not limited in this application. For ease of description, the following description is taken as an example of execution by the first mobility management function network element.

[0063] The method includes: when a terminal device registers to a network through a first mobility management function network element and a second mobility management function network element respectively, the first mobility management function network element receives a first authentication notification message from a home network element, the first authentication notification message is used to request triggering a primary authentication of the terminal device; when it is determined that the terminal device cannot be primarily authenticated, the first mobility management function network element sets a first suspension flag, and sends a first authentication response message to the home network element, the first suspension flag is used to indicate that when the terminal device accesses the first mobility management function network element again, it is necessary to trigger a primary authentication of the terminal device; when the second mobility management function network element is able to primarily authenticate the terminal device, the first mobility management function network element receives a notification message from the home network element, the notification message is used to indicate that when the terminal device registers to the network through the first mobility management function network element again, the primary authentication of the terminal device is not performed; the first mobility management function network element deletes the first suspension flag according to the notification message, or the notification message is used to notify the cancellation or termination of the home network's execution of the primary authentication process.

[0064] According to the solution provided in the present application, the first mobility management function network element can determine to delete or reset the suspension flag, or cancel or terminate the execution of the main authentication process by the home network by receiving the first notification message, thereby avoiding subsequent triggering of the re-authentication process for the terminal device and reducing signaling overhead.

[0065] In combination with the second aspect, in some implementations of the second aspect, the first authentication response message includes a first cause value, and the first cause value is used to indicate that the first mobility management function network element cannot perform primary authentication on the terminal device.

[0066] In combination with the second aspect, in certain implementations of the second aspect, the first request message also includes a second cause value, and the second cause value is used to indicate that the primary authentication is determined based on the first suspension flag.

[0067] In combination with the second aspect, in some implementations of the second aspect, the first mobility management function network element receives a notification message from a hometown network element, including: when the primary authentication of the terminal device is successful, the first mobility management function network element receives a notification message from the hometown network element.

[0068] The beneficial effects of the above-mentioned second aspect and some implementation methods of the second aspect can be referred to the relevant description of the first aspect, which will not be repeated here.

[0069] According to a third aspect, a communication device is provided, such as a home network element, which includes: a processing unit, which is used for the home network element to store an identifier of the first mobility management function network element and an identifier of the second mobility management function network element when a terminal device registers to the network through the first mobility management function network element and the second mobility management function network element respectively; a transceiver unit, which is used for the home network element to send a first authentication notification message to the first mobility management function network element when it is determined that primary authentication of the terminal device is required, the first authentication notification message is used to request triggering primary authentication of the terminal device; the transceiver unit is also used for the home network element to receive a first authentication response message from the first mobility management function network element, the first authentication response message is used to indicate The terminal device cannot be authenticated by the primary authentication; the transceiver unit is also used for the hometown network element to send a second authentication notification message to the second mobility management function network element in response to the first authentication response message, and the second authentication notification message is used to request triggering the primary authentication of the terminal device; the transceiver unit is also used for the hometown network element to receive the second authentication response message from the second mobility management function network element; the transceiver unit is also used for the hometown network element to send a first notification message to the first mobility management function network element when it is determined according to the second authentication response message that the second mobility management function network element can initiate the primary authentication of the terminal, and the first notification message is used to indicate that the terminal device will not be authenticated by the primary authentication when it registers to the network again through the first mobility management function network element. For example, the first notification message is used to instruct the first mobility management function network element to delete the first suspension flag, and the first suspension flag is used to indicate that the primary authentication of the terminal device needs to be triggered; or the first notification message is used to notify the first mobility management function network element to cancel or terminate the hometown network's execution of the primary authentication process.

[0070] The transceiver unit can perform the reception and transmission processing in the aforementioned first aspect, and the processing unit can perform other processing except reception and transmission in the aforementioned first aspect.

[0071] In a fourth aspect, a communication device is provided, such as a first mobility management function network element, the first mobility management function network element comprising: a transceiver unit, for when a terminal device is registered to a network through the first mobility management function network element and the second mobility management function network element respectively, the first mobility management function network element receives a first authentication notification message from a home network element, the first authentication notification message being used to request triggering a primary authentication of the terminal device; a processing unit, for when it is determined that the primary authentication of the terminal device cannot be performed, the first mobility management function network element sets a first suspension flag, and sends a request to the home network element. The first authentication response message, the first suspension flag is used to indicate that when the terminal device accesses the first mobility management function network element again, it is necessary to trigger the main authentication of the terminal device; the transceiver unit is also used for the first mobility management function network element to receive a notification message from the hometown network element when the second mobility management function network element is able to perform the main authentication on the terminal device, and the notification message is used to instruct the first mobility management function network element to delete the first suspension flag; the processing unit is also used for the first mobility management function network element to delete the first suspension flag according to the notification message, or to cancel or terminate the execution of the main authentication process of the hometown network according to the notification message.

[0072] The transceiver unit can perform the reception and transmission processing in the aforementioned second aspect, and the processing unit can perform other processing except reception and transmission in the aforementioned second aspect.

[0073] In a fifth aspect, a communication device is provided, comprising a processor, the processor being coupled to a memory, the memory being used to store a computer program, and the processor being used to call and run the computer program from the memory, so that the device executes the method in the above-mentioned first aspect or second aspect and any possible implementation thereof.

[0074] Optionally, the number of the processors is one or more, and the number of the memories is one or more.

[0075] Optionally, the memory may be integrated with the processor, or the memory may be provided separately from the processor.

[0076] Optionally, the communication device also includes a transceiver.

[0077] In a sixth aspect, a communication system is provided, comprising a home network element and a first mobility management function network element, the home network element being used to execute the method in the above-mentioned first aspect and any possible implementation manner thereof, and the first mobility management function network element being used to execute the method in the above-mentioned second aspect and any possible implementation manner thereof.

[0078] Optionally, the communication system also includes a first authentication server function network element, a second authentication server function network element or a terminal device.

[0079] In the seventh aspect, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores a computer program or code, and when the computer program or code is run on a computer, the computer executes the method in the above-mentioned first aspect or second aspect and any possible implementation manner thereof.

[0080] In the eighth aspect, a chip is provided, comprising at least one processor, wherein the at least one processor is coupled to a memory, the memory is used to store a computer program, and the processor is used to call and run the computer program from the memory, so that a device equipped with the chip system executes the method in the above-mentioned first aspect or second aspect and any possible implementation thereof.

[0081] The chip may include an input circuit or interface for sending information or data, and an output circuit or interface for receiving information or data.

[0082] In a ninth aspect, a computer program product is provided, comprising: a computer program code, which, when executed on a computer, enables the computer to execute the method in the first aspect or the second aspect and any possible implementation thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0083] Figure 1 is a schematic diagram of a network architecture 100 .

[0084] Figure 2 A schematic diagram of a UE registering with a network.

[0085] Figure 3 The diagram is a diagram of a UDM-initiated home network triggering primary authentication process.

[0086] Figure 4 It is a flow chart of the communication method 400 provided in an embodiment of the present application.

[0087] Figure 5 It is a flow chart of the communication method 500 provided in an embodiment of the present application.

[0088] Figure 6 It is a flow chart of the communication method 600 provided in an embodiment of the present application.

[0089] Figure 7 It is a flow chart of the communication method 700 provided in an embodiment of the present application.

[0090] Figure 8 It is a schematic diagram of the structure of the communication device 1000 provided in an embodiment of the present application.

[0091] Fig. 9It is a schematic diagram of the structure of the communication device 2000 provided in an embodiment of the present application.

[0092] Fig.10 It is a schematic diagram of the structure of the chip system 3000 provided in an embodiment of the present application. DETAILED DESCRIPTION

[0093] The technical solution in this application will be described below in conjunction with the accompanying drawings.

[0094] The technical solution provided in this application can be applied to various communication systems, such as: new radio (NR) system, long term evolution (LTE) system, LTE frequency division duplex (FDD) system, LTE time division duplex (TDD) system, etc. The technical solution provided in this application can also be applied to device to device (D2D) communication, vehicle to everything (V2X) communication, machine to machine (M2M) communication, machine type communication (MTC), and Internet of things (IoT) communication system or other communication systems.

[0095] In the communication system, the part operated by the operator can be called a public land mobile network (PLMN), or an operator network, etc. PLMN is a network established and operated by the government or an operator approved by it for the purpose of providing land mobile communication services to the public. It is mainly a public network in which mobile network operators (MNO) provide mobile broadband access services to users. The PLMN described in the embodiment of the present application may specifically be a network that meets the requirements of the third generation partnership project (3GPP) standards, referred to as a 3GPP network. 3GPP networks generally include but are not limited to fifth-generation mobile communication (5th-generation, 5G) networks, fourth-generation mobile communication (4th-generation, 4G) networks, and other future communication systems, such as sixth-generation mobile communication (6th-generation, 6G) networks, etc.

[0096] For ease of description, the embodiments of the present application will be described using PLMN or 5G network as an example.

[0097] Figure 1 A schematic diagram of a network architecture 100 is shown, taking the 5G network architecture based on service-based architecture (SBA) in a non-roaming scenario defined in the 3GPP standardization process as an example. Figure 1 As shown, the network architecture may include a terminal device part, a data network (DN) part and an operator network PLMN part. The operator network PLMN part may include but is not limited to a (radio) access network ((R)AN) 120 and a core network (CN) part.

[0098] The functions of each network element are briefly described below.

[0099] The terminal device part may include a terminal device 110, which is a device that provides voice and / or data connectivity to the user. The terminal device 110 may also be referred to as a user equipment UE. The terminal device 110 in the present application is a device with wireless transceiver functions, which can communicate with one or more core network (CN) devices via an access network device (or may also be referred to as an access device) in a (radio) access network (R)AN 120. The terminal device 110 may also be referred to as an access terminal, a terminal, a user unit, a user station, a mobile station, a mobile station, a remote station, a remote terminal, a mobile device, a user terminal, a user agent or a user device, etc. The terminal device 110 may be deployed on land, including indoors or outdoors, handheld or vehicle-mounted; it may also be deployed on the water (e.g., a ship, etc.); it may also be deployed in the air (e.g., on an airplane, a balloon, and a satellite, etc.). The terminal device 110 may be a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a smart phone, a mobile phone, a wireless local loop (WLL) station, a personal digital assistant (PDA), etc. Alternatively, the terminal device 110 may also be a handheld device with wireless communication function, a computing device or other device connected to a wireless modem, a vehicle-mounted device, a wearable device, a drone device or a terminal in the Internet of Things, the Internet of Vehicles, a terminal in any form in a 5G network and a future network, a relay user device or a terminal in a future evolved 6G network, etc. Among them, the relay user device may be, for example, a 5G residential gateway (RG). For example, the terminal device 110 may be a virtual reality (VR) terminal, an augmented reality (AR) terminal, a wireless terminal in industrial control, a wireless terminal in unmanned driving, a wireless terminal in telemedicine, a wireless terminal in a smart grid, a wireless terminal in transportation safety, a wireless terminal in a smart city, a wireless terminal in a smart home, etc. The terminal device here refers to a 3GPP terminal. The embodiments of the present application do not limit the type or category of the terminal device. For ease of explanation, the present application will hereinafter use UE to represent the terminal device as an example for explanation.

[0100] (R)AN 120 may include one or more access network elements or access network devices, and the interface between the access network device and the terminal device may be a Uu interface (or referred to as an air interface, i.e., the messages exchanged between the access network device and the terminal device may be referred to as air interface messages). Of course, in future communications, the interface name may remain unchanged or may be replaced by other names, and this application does not limit this. (R)AN 120 is a device that provides wireless communication functions for the terminal device 110, and can connect the terminal device to a node or device of a wireless network, and may also be referred to as a network device. (R)AN 120 may be regarded as a subnetwork of the operator network, and is an implementation system between a service node in the operator network and the terminal device 110. For example, the terminal device 110 may be connected to a service node of the operator network through (R)AN 120, thereby obtaining services provided by the service node. For the convenience of description, in all embodiments of this application, the above-mentioned device that provides wireless communication functions for the terminal device 110 is collectively referred to as an access network device or RAN for short. It should be understood that this document does not limit the specific type of access network device.

[0101] The CN part may include but is not limited to the following network functions (NF): user plane function (UPF) 130, network exposure function (NEF) 131, network function repository function (NRF) 132, policy control function (PCF) 133, unified data management function (UDM) 134, unified data repository function (UDR) 135, application function (AF) 136, authentication server function (AUSF) 137, access and mobility management function (AMF) 138, session management function (SMF) 139.

[0102] The data network DN 140, also referred to as a packet data network (PDN), is usually a network located outside the operator's network, such as a third-party network.

[0103] The following is a brief description of the NF functions included in CN.

[0104] 1. UPF 130 is a gateway provided by the operator and is the gateway for the operator network to communicate with DN 140. UPF 130 network functions include data packet routing and transmission, data packet detection, service usage reporting, quality of service (QoS) processing, legal monitoring, uplink data packet detection, downlink data packet storage and other user-related functions.

[0105] 2. NEF 131 is a control plane function provided by the operator, which mainly enables third parties to use the services provided by the network, supports the network to open its capabilities, event and data analysis, provide PLMN security configuration information from external applications, and convert interactive information inside and outside the PLMN.

[0106] 3. NRF 132 is a control plane function provided by the operator and can be used to maintain real-time information of network functions and services in the network.

[0107] 4. PCF 133 is a control plane function provided by the operator. It mainly supports providing a unified policy framework to control network behavior, provides policy rules to the control layer network function, and is responsible for obtaining user contract information related to policy decisions.

[0108] 5. UDM 134 is a control plane function provided by the operator, responsible for storing information such as the subscriber permanent identifier (SUPI) of the subscriber in the operator's network, the generic public subscription identifier (GPSI) of the subscriber, and credentials.

[0109] 6. UDR 135 is a control plane function provided by the operator, which provides the UDM with the function of saving and obtaining subscription data, the PCF with the function of saving and obtaining policy data, and the user's NF group ID information.

[0110] 7. AF 136 is a control plane function provided by the operator. It mainly provides corresponding services by interacting with other NFs in the PLMN, such as providing roaming UE with access network selection information, guiding the routing of data flows, and accessing NEF131.

[0111] 8. AUSF 137 is a control plane function provided by the operator and is usually used for level 1 authentication, i.e. authentication between the terminal device 110 (subscriber) and the operator network.

[0112] 9. AMF 138 is a control plane network function provided by the operator network, responsible for access control and mobility management of the terminal device 110 accessing the operator network, such as mobility status management, allocation of user temporary identity, authentication and authorization of users, etc.

[0113] 10. SMF 139 is a control plane network function provided by the operator network, responsible for managing the protocol data unit (PDU) session of the terminal device 110 (including the establishment, modification and release of the session), and is used for the selection and reselection of the user plane function network element, the allocation of the Internet protocol (IP) address of the terminal device, and the quality of service (QoS) control. Among them, the PDU session is a channel for transmitting PDU, and the terminal device transmits PDU to each other with the DN 140 through the PDU session. The PDU session is established, maintained and deleted by the SMF network function 139. The SMF network function 139 includes session management (such as session establishment, modification and release, including tunnel maintenance between the user plane function UPF 130 and (R)AN 120), selection and control of the UPF network function 130, service and session continuity (SSC) mode selection, roaming and other session-related functions.

[0114] It is understandable that the above network elements or functions can be physical entities in hardware devices, software instances running on dedicated hardware, or virtualized functions instantiated on a shared platform (e.g., a cloud platform). In short, an NF can be implemented by hardware or software.

[0115] Figure 1 Where Nnef, Nnrf, Npcf, Nudm, Nudr, Naf, Nausf, Namf, Nsmf, N1, N2, N3, N4, and N6 are interface serial numbers. For example, the meaning of the above interface serial numbers can be found in the meaning defined in the 3GPP standard protocol, and this application does not limit the meaning of the above interface serial numbers. It should be noted that, Figure 1 The interface name between the various network functions in the system architecture is only an example. In a specific implementation, the interface name of the system architecture may also be other names, which are not limited in this application. In addition, the name of the message (or signaling) transmitted between the above-mentioned network elements is only an example and does not constitute any limitation on the function of the message itself.

[0116] It should be noted that in Figure 1In the architecture shown, the interface between the (R)AN and the CN may also be referred to as the NG interface (not shown in the figure), and the (R)AN and the CN are connected via the NG interface. The NG interface may include an NG-C interface and an NG-U interface, wherein the NG-C interface is a control plane interface, and the two connected parties are the (R)AN and the AMF, and is used to transmit control plane data; the NG-U interface is a user plane interface, and the two connected parties are the (R)AN and the UPF, and is used to transmit user plane data.

[0117] It should be understood that the above network architecture 100 is only a network architecture described from the perspective of service-oriented architecture. In this service-based architecture, PLMN can combine some or all network functions in an orderly manner according to specific scenario requirements to achieve customization of network capabilities and services, thereby deploying dedicated networks for different services, that is, realizing 5G network slicing. Network slicing technology can enable operators to respond to customer needs more flexibly and quickly, and support flexible allocation of network resources.

[0118] For the convenience of explanation, in the embodiments of the present application, the network functions (such as NEF 131 ... SMF139) are collectively referred to as NFs, that is, the NFs described later in the embodiments of the present application can be replaced by any network functions. In addition, in the embodiments of the present application, the session management function SMF 139 is referred to as SMF, and the terminal device 110 is referred to as UE, that is, the SMFs described later in the embodiments of the present application can be replaced by session management functions, and UEs can be replaced by terminal devices. Figure 1 Only some network functions are schematically described. The NF described below is not limited to Figure 1 The network functions shown in .

[0119] It should be understood that Figure 1 The AMF, SMF, UPF, NEF, AUSF, NRF, PCF, and UDM shown in the figure can be understood as network elements used to implement different functions in the core network, for example, they can be combined into network slices as needed. These core network elements can be independent devices or integrated into the same device to implement different functions. This application does not limit the specific form of the above network elements.

[0120] It should also be understood that the above naming is only defined for the convenience of distinguishing different functions and should not constitute any limitation to this application. This application does not exclude the possibility of using other naming in 5G networks and other future networks. For example, in a 6G network, some or all of the above network elements may use the terminology in 5G, or may use other names.

[0121] Currently, in order to ensure network security, it is necessary to perform a primary authentication process on terminal devices that access the network, that is, to authenticate and authorize the terminal devices. The terminal devices can access the network only after passing the authentication.

[0122] Figure 2 This is a flow chart of the process of UE registering to the network. Figure 2 As shown, the method 200 includes the following multiple steps. For the parts not described in detail, please refer to the relevant description of the existing protocol.

[0123] S210, UE registers to the network.

[0124] Exemplarily, the UE sends an N1message to the Security anchor function (SEAF) to request registration with the network. Optionally, the N1 message may be a registration request message, which carries the UE's Subscription Concealed Identifier (SUCI) or 5G Globally Unique Temporary Identifier (5G-GUTI). Among them, SEAF and AMF are jointly established, which can be understood as SEAF is a part of AMF, that is, the UE can request registration with the network by sending a registration request message to AMF.

[0125] Correspondingly, after receiving the N1 message from the UE, the SEAF can initiate identity authentication to the UE in any process of establishing a signaling connection with the UE according to local policies.

[0126] Exemplarily, when SEAF wants to start authentication of UE, SEAF sends Nausf_UEAuthentication_Authenticate Request message to AUSF to call Nausf_UEAuthentication service. The message carries the serving network name (SN Name), and SUCI or SUPI. The SNName is used to bind the anchor key to the serving network through the serving network identifier to ensure that the anchor key is used for secure communication between the UE and the 5G core network. It should be understood that if SEAF receives SUCI from the UE, the message carries SUCI; if SEAF receives 5G-GUTI from the UE, SEAF determines SUPI based on 5G-GUTI and carries SUPI in the message.

[0127] It should be understood that SUPI includes a SUPI type and a value, wherein there are 4 types of SUPI types: IMSI, NSI (network specific identifier), a Global Line Identifier (GLI) or a Global Cable Identifier (GCI), and there are 2 formats of SUPI values: IMSI and NAI. In order not to expose the user's SUPI over the air interface, the part of SUPI except the SUPI type is usually calculated to obtain a result, which is part of the SUCI.

[0128] Correspondingly, after AUSF receives the Nausf_UEAuthentication_AuthenticateRequest message from SEAF, AUSF can check whether the SEAF in the service network that makes the authentication request has the right to use the SN Name in Nausf_UEAuthentication_AuthenticateRequest by comparing the SN Name carried in the message with the expected SN Name. AUSF can temporarily store the received service network name. If the service network is not authorized to use the SNName, AUSF sends a Nausf_UEAuthentication_Authenticate Response message to SEAF, which is used to indicate that "the service network is not authorized", that is, SEAF can reject the UE's registration process. If the service network has the right to use the SNName, AUSF sends a Nudm_UEAuthentication_Get Request message to UDM to request primary authentication of the UE. The message carries SUCI or SUPI, as well as the SN Name.

[0129] Correspondingly, after receiving the Nudm_UEAuthentication_Get Request message from AUSF, if the message carries SUCI, UDM first needs to parse the message to obtain SUPI, and then select an authentication method based on the SUPI, such as the 5G-AKA authentication method or the EAP-AKA' authentication method.

[0130] It should be understood that the current 5G network supports two authentication methods, namely the 5G Authentication and Key Agreement (5G-AKA) authentication method and the Extensible Authentication Protocol-Authentication and Key Agreement (EAP-AKA') authentication method. The present application does not limit how UDM selects the authentication method based on SUPI. For example, the implementation method of UDM selecting the authentication method based on the SUPI includes: the operator can configure the authentication method to the contract data, and the UDM can specify the authentication method after obtaining the UE's SUPI; or, UDM selects according to the SUPI type in the SUPI. For example, if the SUPI type is IMSI, select 5G-AKA. If the SUPI type is NAI, select EAP-AKA'.

[0131] S220, UDM executes the main authentication process.

[0132] Exemplarily, UDM sends an authentication vector to AUSF, such as an authentication vector of 5G-AKA or an authentication vector of EAP-AKA', in response to the authentication request message of AUSF, and then performs the main authentication with the UE. For the specific authentication implementation method, please refer to the relevant description in Chapter 6 of the existing protocol TS 33.501.

[0133] S230, main authentication result confirmation process.

[0134] Exemplarily, an authentication result can be obtained based on the above-mentioned primary authentication of the UE, and then the AUSF and UDM perform the primary authentication result confirmation process.

[0135] In one example, if the above-mentioned UDM selects the EAP-AKA' authentication method to authenticate the UE, after AUSF receives the EAP-Response / AKA'-Challenge message from the UE or SEAF and AUSF completes the authentication of the UE, AUSF sends a Nudm_UEAuthentication_ResultConfirmation Request message to the UDM.

[0136] In another example, if UDM selects the 5G-AKA authentication method to authenticate the UE, after AUSF receives the Nausf_UEAuthentication_Authenticate Request message from SEAF and AUSF successfully authenticates the UE, AUSF sends a Nudm_UEAuthentication_ResultConfirmation Request message to UDM.

[0137] The Nudm_UEAuthentication_ResultConfirmation Request message carries the UE's authentication status, including the UE's SUPI, authentication timestamp, authentication result (e.g., authentication success or failure), authentication method (or authentication type (e.g., EAP-AKA' authentication method or 5G-AKA authentication method)), and service network name SNName. Optionally, for the purpose of preventing fraud, AUSF can carry only information about successful authentication in the message according to the operator's policy.

[0138] Correspondingly, UDM stores the UE's authentication status, including SUPI, authentication timestamp, authentication result, and serving network name SN Name.

[0139] It should be noted that the UE can register with different AMFs, such as AMF1 and AMF2, through 3GPP access technology and non-3GPP access technology, that is, AMF1 and AMF2 can provide services for the same UE. Based on the above registration and authentication process, UDM stores the two authentication results, identity authentication timestamp, and SN Name#1 and SN Name#2 information respectively. This application does not limit the number of AMFs.

[0140] Further, UDM sends a Nudm_UEAuthentication_ResultConfirmationResponse message to AUSF.

[0141] It should be understood that UDM may detect and accept certain types of spoofing attacks based on operator policies. For example, UDM stores the ID and time of the visited network. Optionally, the operator can classify the visited networks: for example, in the first category, AMF needs to send the Nudm_UECM_Registration Request message immediately; in the second category, it only needs to check whether the Nudm_UECM_Registration Request message is received within a close time after the authentication process is completed; in the third category, no check is required. If UDM receives a new Nudm_UECM_Registration Request message, UDM checks whether the new visited network is the same as the previously stored one. If they are the same, the registration request is accepted; if they are different, a rejection request message is sent with a reason value to notify AMF that it needs to send a Nausf_UEAuthentication_AuthenticateRequest message to AUSF to trigger the main authentication process.

[0142] S240: Optionally, execute a NAS SMC process.

[0143] It should be understood that the NAS SMC procedure is intended to protect the UE registration request from a man-in-the-middle attack, preventing an attacker from modifying the information element IE containing the UE security capabilities provided by the UE in the registration request.

[0144] Exemplarily, AMF activates NAS integrity protection and sends a NAS security mode command message to the UE. Correspondingly, after receiving the NAS security mode command message from AMF, the UE needs to verify the NAS security mode command message, including checking whether the UE security functions sent by AMF match the security functions stored in the UE to ensure that attackers do not modify these functions, and verify the integrity protection using the indicated NAS integrity algorithm and the NAS integrity key based on the KAMF indicated by ngKSI. In addition, after sending the NAS security mode command message, AMF activates NAS uplink decryption. If the integrity verification of the NAS security mode command message is successful, the UE should start NAS integrity protection and encryption / decryption using the security context indicated by ngKSI. Further, the UE sends a NAS security mode completion message to AMF for encryption and integrity protection, and AMF activates NAS downlink encryption.

[0145] S250, the remaining registration process.

[0146] In the remaining registration process, the process of AMF registering with UDM may be executed. The purpose of this process is to register the AMF that is serving the UE with UDM. After receiving the AMF registration information, UDM will store AMF related information, such as AMF ID. It should be noted that the UE can register with different AMFs, such as AMF1 and AMF2, through 3GPP access technology and non-3GPP access technology, that is, AMF1 and AMF2 can provide services for the same UE. Multiple AMF related information can be stored in UDM, such as AMF1ID and AMF2 ID.

[0147] Exemplarily, the SEAF sends a registration response message to the UE to indicate that the UE has been successfully registered, and the UE can then request to establish a session to access various services on the data network.

[0148] Figure 3 This is a schematic diagram of a home network (such as a UDM in the home network) initiating a triggering primary authentication process. Figure 3 As shown, the method 300 includes the following multiple steps. For the parts not described in detail, please refer to the relevant description of the existing protocol.

[0149] S310, optionally, the UDM pre-configures an operator authentication policy to determine the initiating network to trigger a main authentication process for the UE.

[0150] S320, when the UDM determines to initiate the home network to trigger the main authentication process, it determines the AMF1 that provides services for the UE.

[0151] Exemplarily, UDM decides to trigger and execute the home network authentication process for the UE based on an event (e.g., SoR / UPU or AAnF request) or an authentication policy. For example, AAnF sends a Nudm_UECM_AuthTrigger request to UDM, allowing UDM to perform primary authentication. Correspondingly, UDM determines to initiate a home network trigger primary authentication process for the UE based on the received event and the pre-configured operator authentication policy, and then UDM determines the serving AMF / SEAF for the UE.

[0152] Based on the above method 200, it can be known that the UE can register with AMF1 and AMF2 through 3GPP access technology or non-3GPP access technology, indicating that the current UE is served by the AMF1 and AMF2. In other words, the current UE is on AMF1 and AMF2, or the UE can be found through AMF1 and AMF2. Correspondingly, after the main authentication, the UDM stores the information of AMF1 and AMF2, such as AMF1ID and AMF2 ID. That is, the UDM knows that the AMF1 and AMF2 are providing services for the UE, and subsequently when the UDM determines to trigger the re-authentication of the UE, it can find the AMF1 and AMF2 serving the UE. For example, the UDM selects AMF1 to re-authenticate the UE according to the operator's authentication policy.

[0153] S330, UDM sends an authentication notification message to AMF1, and correspondingly, AMF1 receives the authentication notification message from UDM.

[0154] The authentication notification message is used to request AMF1 to trigger authentication of the UE, and the authentication notification message includes the SUPI of the UE.

[0155] Correspondingly, after receiving the authentication response message from UDM, AMF1 determines whether to trigger the primary authentication of the UE according to the local authentication policy and UE status. If it can be initiated, AMF1 determines to perform the primary authentication of the UE.

[0156] S340, AMF1 executes the main authentication process.

[0157] Among them, the specific implementation method of AMF1 performing primary authentication can refer to the relevant description of the above method 200.

[0158] It should be noted that in this application, "authentication" and "certification" can be replaced, for example, "primary authentication" can be replaced by "primary authentication", and "authentication suspension flag" can be replaced by "authentication suspension flag". For the convenience of description, the following uniformly uses "authentication, primary authentication, suspension flag, authentication suspension flag", etc.

[0159] Furthermore, AMF1 may send an authentication response message to UDM.

[0160] S350, AMF1 sends an authentication response message to UDM, and correspondingly, UDM receives the authentication response message from AMF1.

[0161] Among them, in response to the authentication notification message, AMF1 replies to the UDM with an authentication response message. It is used to notify the UDM whether the request is successful or failed. If the authentication response message does not carry a failure reason value, it means that the AMF can perform the primary authentication of the UE. That is, the process of step S340. If AMF1 cannot perform the primary authentication process according to step S340, for example, when the UE is unreachable or AMF1 cannot find the UE, the authentication response message carries a failure reason value, which is used to indicate that AMF1 cannot start the primary authentication of the UE.

[0162] S360, AMF1 sets the suspend flag.

[0163] Exemplarily, if AMF1 confirms that it is impossible to perform primary authentication of the UE, such as the UE is unreachable, AMF1 sets the suspend flag #1 in the UE context. It should be understood that the meaning of the suspend flag #1 means that when the UE re-registers or accesses the AMF1, or the UE is reachable, AMF1 first needs to perform primary authentication on the UE according to the suspend flag set locally.

[0164] It should be understood that if the above-mentioned AMF1 sends an authentication response message to UDM to indicate that AMF1 cannot start the main authentication for the UE, then UDM can check whether there are other AMFs providing services to the UE, for example, determine AMF2 through the locally stored AMF2 ID. At this time, UDM will send an authentication notification message to AMF2 to request AMF2 to perform the main authentication for the UE. The specific implementation method can refer to the above-mentioned relevant description. If AMF2 is also unable to start the main authentication for the UE, AMF2 sends an authentication response message to UDM, carrying a failure reason value, indicating that AMF2 cannot start the main authentication process for the UE. In addition, AMF2 can set the suspension flag #2 in the UE context. At this time, since both AMF1 and AMF2 cannot start the main authentication for the UE, AMF1 and AMF2 are locally set with suspension flags.

[0165] Optionally, when the UE re-accesses or registers to AMF1 or when the UE is reachable, AMF1 checks that the suspension flag #1 is set locally, and then sends a re-authentication request to UDM through AUSF. If the UE re-authentication is completed, or the AMF determines to execute the main authentication process, AMF1 cancels (deletes or resets) the suspension flag #1. When the UE accesses a new AMF3 (for example, in a mobile scenario), AMF3 can retrieve the UE context from the original AMF1 or AMF2, determine the UE's suspension flag, and execute the re-authentication process.

[0166] It should be noted that the execution order of step S340, step S350 and the steps is not limited.

[0167] Considering that AMF1 and AMF2 are both locally set with suspension flags, when the UE accesses AMF1 and AMF2 again, AMF1 and AMF2 will trigger the main authentication process for the UE based on their respective suspension flags. Since the two suspension flags are set by the same UDM request, and essentially the UDM only needs to authenticate the UE once, the two main authentications of the UE are unnecessary, resulting in unnecessary signaling overhead.

[0168] In view of this, the present application provides a communication method and a communication device, in which the hometown network element determines, based on the received second authentication response message, that the second mobility management function network element can initiate the main authentication of the terminal device, and then can send a first notification message to the first mobility management function network element serving the terminal device, for notifying the first mobility management function network element to delete or reset the suspension flag, or to notify the first mobility management function network element to cancel or terminate the hometown network's execution of the main authentication process, thereby avoiding subsequent triggering of the re-authentication process for the terminal device and reducing signaling overhead.

[0169] The communication method provided by the embodiment of the present application will be described in detail below with reference to the accompanying drawings. The embodiment provided by the present application can be applied to any communication scenario in which a transmitting device and a receiving device communicate, for example, it can be applied to the above Figure 1 The present application proposes the following Figures 4 to 7 The method shown should be understood as follows. Figures 4 to 7 The method embodiments shown can be combined with each other. Figures 4 to 7 The steps in the method embodiments shown can refer to each other. For example, in the embodiments of the present application, Figures 5 to 7 The method embodiment shown can be regarded as implementing Figure 4 Possible implementations of the functions of the method embodiment shown, Figure 6 This article mainly explains that after UDM knows that the current UE can perform primary authentication at AMF1, it rejects the authentication request of AMF2 after receiving the authentication request initiated by AMF2 from the serving UE. Figure 7 The main purpose is to explain that after UDM knows that the UE can perform the main authentication at AMF1, it sends a cancel suspension flag to other AMF2s that have not triggered the authentication request based on the locally stored information of multiple AMFs serving the UE, so as to avoid triggering redundant authentication processes.

[0170] Figure 4 4 is a flow chart of a communication method 400 provided in an embodiment of the present application. Figure 4As shown, the method flow can be executed by the home network element, the first mobility management function network element, and the second mobility management function network element, or by a module and / or device (for example, a chip or an integrated circuit, etc.) with corresponding functions installed in the home network element, the first mobility management function network element, and the second mobility management function network element, and this application is not limited. For the convenience of description, the following description is based on the home network element, the first mobility management function network element, and the second mobility management function network element as the execution subject. The method includes the following multiple steps, and the parts not described in detail can refer to the relevant description of the existing protocol.

[0171] S410: When the terminal device registers with the network through the first mobility management function network element and the second mobility management function network element respectively, the home network element stores the identifier of the first mobility management function network element and the identifier of the second mobility management function network element.

[0172] In one implementation, the terminal device accesses the first mobility management function network element and the second mobility management function network element through the 3GPP access technology and the non-3GPP access technology respectively to register with the network. For the specific implementation, reference may be made to the relevant description of the above method 200. In the process of registering with the network through the first mobility management function network element and the second mobility management function network element respectively and performing the authentication process, the first mobility management function network element and the second mobility management function network element may use the same or different authentication server function network elements.

[0173] S420, when it is determined that the terminal device needs to be authenticated, the home network element sends a first authentication notification message to the first mobility management function network element, where the first authentication notification message is used to request triggering of the primary authentication of the terminal device.

[0174] Among them, the specific implementation of the hometown network element determining that the terminal device needs to be authenticated can refer to the relevant description of step S320 of the above method 300.

[0175] Exemplarily, the first authentication notification message includes an identifier of the terminal device, such as SUPI. It should be understood that the embodiment of the present application does not limit how the home network element preferentially selects the first mobility management function network element to initiate an authentication request when the home network element stores both the first mobility management function network element and the second mobility management function network element.

[0176] S430: The first mobility management function network element determines that the primary authentication of the terminal device cannot be initiated.

[0177] Among them, the inability to start the main authentication of the terminal device can be understood as the terminal device is unreachable, or the first mobility management function network element has not found the terminal device.

[0178] Exemplarily, after receiving the first authentication notification message, the first mobility management function network element determines whether to trigger the primary authentication of the terminal device according to the local authentication policy and the status of the terminal device. For example, if the first mobility management function network element finds that the terminal device is unreachable, or the first mobility management function network element does not find the terminal device, the first mobility management function network element sends a first authentication response message to the home network element.

[0179] S440, the home network element receives a first authentication response message from the first mobility management function network element, where the first authentication response message is used to indicate that the first mobility management function network element cannot initiate primary authentication for the terminal device.

[0180] Exemplarily, the first authentication response message includes a first cause value, and the first cause value is used to indicate that the first mobility management function network element cannot start the primary authentication of the terminal device. For example, the failure cause value may indicate that the primary authentication of the terminal device fails to start, or the failure cause value may indicate that the terminal device is unreachable. This embodiment does not limit the definition and value-taking method of the failure cause value.

[0181] Optionally, the hometown network element may set a first authentication suspension flag according to the first reason value, and the first authentication suspension flag is used to indicate that a first suspension flag is set on the first mobility management function network element. For example, the hometown network element may know that the terminal device is unreachable according to the first reason value, or know that the first mobility management function network element has failed to start the main authentication of the terminal device, and then set the first authentication suspension flag, and the first authentication suspension flag may be associated with the first mobility management function network element, for example, by associating the first authentication suspension flag with one or more of the AMF1 ID, the service network where the first mobility management function network element is located, and the PLMN ID corresponding to the first mobility management function network element. For the specific implementation method, please refer to the relevant description of method 500.

[0182] Optionally, the home network element sets the first authentication suspension flag only when receiving a specific failure cause value. For example, when the failure cause value received by the home network element indicates that the terminal device is reachable, the home network element sets the first authentication suspension flag.

[0183] It should be understood that the hometown network element sets the first authentication suspension flag according to the first reason value, which can be executed explicitly or implicitly. For example, the first authentication suspension flag can be indicated by a bit, such as 1 represents that the authentication suspension flag is valid, and 0 represents that the authentication suspension flag is invalid. In the case where it is determined that the first mobility management function network element cannot start the main authentication of the terminal device, the hometown network element can change the first authentication suspension flag from 0 to 1. For another example, the first authentication suspension flag represents validity when it appears, and represents invalidity when it does not appear. In the case where it is determined that the first mobility management function network element cannot start the main authentication of the terminal device, the hometown network element stores the association relationship between the first authentication suspension flag, the first mobility management function network element, and the terminal device.

[0184] S450: The first mobility management function network element sets a first suspension flag.

[0185] Exemplarily, if the first mobility management function network element confirms that the primary authentication for the terminal device cannot be started, a first pending flag is set in the context of the terminal device.

[0186] It should be understood that the first suspension flag is used to indicate that when the terminal device re-registers with the network through the first mobility management function network element, or the terminal device is reachable, the first mobility management function network element determines to authenticate the terminal device based on the locally set first suspension flag.

[0187] It should be noted that the present application does not limit the order in which the above steps S440 and S450 are executed.

[0188] S460, in response to the first authentication response message, the home network element sends a second authentication notification message to the second mobility management function network element, where the second authentication notification message is used to request triggering of a primary authentication of the terminal device.

[0189] Exemplarily, the hometown network element first determines whether there are multiple mobility management function network elements serving the terminal device. Based on the above scheme, it can be known that there are two mobility management function network elements. Then, when it is determined that the second mobility management function network element also provides services for the terminal device, the hometown network element continues to execute the hometown network trigger main authentication process and executes step S460.

[0190] S470, the home network element receives a second authentication response message from the second mobility management function network element.

[0191] Among them, the second authentication response message is used to indicate whether the second mobility management function network element executes the main authentication process for the UE. In other words, the second authentication response message can be used by the hometown network element to determine whether the second mobility management function network element can or cannot perform the main authentication for the terminal. For example, if it is determined that the main authentication can be performed on the terminal, the following steps S480 and S490 are performed; if it is determined that the main authentication cannot be performed on the terminal, the hometown network element can locally set the second authentication suspension flag, which means that the two mobility management function network elements serving the terminal device are unable to perform the main authentication for the terminal device, and the two mobility management function network elements have set the suspension flag locally, which specifically corresponds to branch two of the following method 500. The specific implementation method can refer to the relevant descriptions of methods 500 to 700, which will not be explained here.

[0192] Exemplarily, in step S460, the second mobility management function network element decides whether to execute the main authentication process for the terminal device according to the local authentication policy and the status of the terminal device. The specific implementation method can refer to the relevant description of the above method 300. If the second mobility management function network element cannot start the main authentication of the terminal device, the second authentication response message carries a rejection reason value to indicate that the main authentication of the UE has failed, or indicates that the terminal device is unreachable. If the second authentication response message can start the main authentication of the terminal device, the second authentication response message does not carry a rejection reason value, which is used to inform the home network element that the second authentication notification message has been received.

[0193] It can be understood that determining that the second mobility management function network element is able to perform primary authentication on the terminal includes any of the following situations: the second authentication response message carries a response message to the second authentication notification message; or the second authentication response message does not carry a second cause value, and the second cause value is used to indicate that the second mobility management function network element cannot start the primary authentication of the terminal device; or, after the second mobility management function network element successfully performs primary authentication on the terminal device, or, during the process of the second mobility management function network element performing primary authentication on the terminal device. That is to say, the present application does not specifically limit the timing of sending the first notification message.

[0194] S480: When it is determined according to the second authentication response message that the second mobility management function network element can initiate primary authentication for the terminal, the home network element sends a first notification message to the first mobility management function network element.

[0195] Among them, the first notification message itself has an indicative function, or carries a reason value with an indicative function, that is, it is used to instruct the first mobility management function network element to cancel the first suspension flag, and the first suspension flag is used to indicate the need to trigger the main authentication of the terminal device; or, the first notification message is used to instruct the first mobility management function network element to cancel or terminate the home network to execute the main authentication process.

[0196] Among them, canceling the first suspension mark can be understood as the first suspension mark being invalid. If the first suspension mark is indicated by a bit, such as 1 represents that the first suspension mark is valid, and 0 represents that the first suspension mark is invalid, then the first mobility management function network element changes the first suspension mark from 1 to 0; or, if the first suspension mark exists to indicate validity, and no longer exists to indicate invalidity, then the first mobility management function network element deletes the first suspension mark, etc.

[0197] In an embodiment of the present application, there are multiple ways to implement the first notification message. For example, the first notification message may be an authentication notification message carrying a reason value, or a first notification message carrying a reason value, or a first notification message not carrying a reason value. The reason value may be used to indicate that the second mobility management function network element has performed primary authentication on the terminal device, or to indicate that the primary authentication of the terminal device is in progress, or to indicate that the primary authentication of the terminal device is successful, or to instruct the first mobility management function network element to delete the first suspension flag, or to indicate that the first mobility management function network element will no longer trigger the primary authentication process for the terminal device due to the locally set first suspension flag, that is, to instruct the first mobility management function network element to cancel or terminate the execution of the primary authentication process by the home network.

[0198] Exemplarily, after receiving the second authentication response message that does not carry a failure cause value, the hometown network element may determine that the second mobility management function network element is able to perform the main authentication process for the terminal device. Furthermore, the hometown network element determines whether to send a first notification message to the first mobility management function network element. For example, the hometown network element determines whether a first mobility management function network element exists, and if so, further determines whether to send a first notification message to the first mobility management function network element that is determined to exist. In other words, the hometown network element may first determine whether a first mobility management function network element exists, and then determine whether it is necessary to send a first notification message, or it may first determine whether it is necessary to send a first notification message, and then determine whether a first mobility management function network element exists, and this application does not limit this.

[0199] For example, when it is determined that the first notification message needs to be sent, the first notification message can be sent to notify the cancellation or termination of the home network triggered main authentication process, or to notify that the suspension flag set at the first mobility management function network element can be cancelled.

[0200] For example, if it is not necessary to send the first notification message, the judgment action may not be performed. The hometown network element may determine whether to send the first notification message to the first mobility management function network element according to the local pre-configuration policy; or the hometown network element may determine whether to send the first notification message to the first mobility management function network element according to whether the first authentication suspension flag corresponding to the first mobility management function network element is set locally; or the hometown network element determines to send the first notification message to the first mobility management function network element according to the identifier of the first mobility management function network element stored locally.

[0201] S450, the first mobility management function network element deletes the first suspension flag, or cancels or terminates the home network execution of the main authentication process.

[0202] Exemplarily, the first mobility management function network element cancels (e.g., deletes or resets) the first suspension flag, or determines to cancel or terminate the request to the home network to execute the main authentication process, based on the first notification message itself or the cause value carried in the first notification message.

[0203] Among them, canceling the first suspension mark can be understood as the first suspension mark being invalid. If the first suspension mark is indicated by a bit, such as 1 represents that the first suspension mark is valid, and 0 represents that the first suspension mark is invalid, then the first mobility management function network element changes the first suspension mark from 1 to 0; or, if the first suspension mark exists to indicate validity, and no longer exists to indicate invalidity, then the first mobility management function network element deletes the first suspension mark, etc.

[0204] The solution provided in the present application is that the hometown network element determines that the second mobility management function network element can initiate the main authentication of the terminal device based on the received second authentication response message, and then can send a notification message to other first mobility management function network elements serving the terminal device, for notifying the first mobility management function network element to delete or reset the suspension flag, or cancel or terminate the hometown network's execution of the main authentication process, so as to avoid subsequent triggering of the re-authentication process for the terminal device and reduce signaling overhead.

[0205] Figure 5 is a flow chart of a communication method 500 provided in an embodiment of the present application. Figure 5As shown, the method flow can be executed by a home network element (e.g., UDM), AMF1, AMF2, an authentication server function network element (e.g., AUSF), a terminal device (e.g., UE), or by a module and / or device (e.g., a chip or integrated circuit, etc.) with corresponding functions installed in UDM, AMF1, AMF2, AUSF, or UE, which is not limited in this application. For ease of description, the following description is based on UDM, AMF1, AMF2, AUSF, and UE as the execution subjects. The method includes the following multiple steps. For the parts not described in detail, please refer to the relevant description of the existing protocol.

[0206] S501, UE registers to the network through AMF1.

[0207] S502, UE registers to the network through AMF2.

[0208] Exemplarily, the UE accesses AMF1 and AMF2 through 3GPP access technology and non-3GPP access technology respectively to register with the network. For specific implementation methods, reference may be made to the relevant description of the above method 200. In the process of registering with the network through AMF1 and AMF2 respectively and performing the authentication process, AMF1 and AMF2 may use the same AUSF or different AUSFs.

[0209] It should be understood that the UE registers with the network through AMF1 or AMF2, which means that the UE has a registration process with AMF1 or AMF2. After the UE is successfully registered, AMF1 or AMF2 has the context information of the UE.

[0210] S503, UDM stores information of AMF1 and AMF2.

[0211] Exemplarily, when the UE is registered with AMF1 and AMF2, the UDM stores the AMF1 ID and the AMF2 ID. There are many ways to implement the AMF ID, such as the PLMN ID where the AMF is located, or the serving PLMN ID. For another example, the AMF ID is a globally unique AMF identifier (GUAMI).

[0212] S504, UDM determines to initiate a home network to trigger a primary authentication process.

[0213] For the specific implementation, please refer to the relevant description of step S320 of the above method 300.

[0214] S505, UDM sends a first authentication notification message to AMF1, and correspondingly, AMF1 receives the first authentication notification message from UDM. The first authentication notification message is used to request triggering execution of a third primary authentication process for the UE. The first authentication notification message includes the SUPI of the UE.

[0215] Exemplarily, based on the operator authentication policy, UDM initiates the home network to trigger the main authentication process, and selects AMF1 to trigger the main authentication process, then UDM sends a first authentication notification message to AMF1. The embodiment of the present application does not limit how UDM preferentially selects AMF1 when AMF1 and AMF2 are stored at the same time.

[0216] S506, AMF1 sends a first authentication response message to UDM, and correspondingly, UDM receives the first authentication response message from AMF1.

[0217] Among them, the first authentication response message carries a failure reason value, which is used to indicate that AMF1 cannot start the primary authentication of the UE.

[0218] Exemplarily, after receiving the first authentication notification message, AMF1 determines whether to trigger the primary authentication of the UE according to the local authentication policy and the UE status. For example, if AMF1 finds that the UE is unreachable, or AMF1 does not find the UE, AMF1 sends a first authentication response message to the UDM, and carries a failure cause value in the first authentication response message. The failure cause value is used to indicate that AMF1 cannot start the primary authentication of the UE. For example, the failure cause value may indicate that the primary authentication of the UE has failed to start, or the failure cause value may indicate that the UE is unreachable. This embodiment does not limit the definition and value-taking method of the failure cause value.

[0219] S507, AMF1 sets a first pending flag (eg, pending flag).

[0220] Exemplarily, if AMF1 confirms that the main authentication process for the UE cannot be started, a first suspension flag is set in the UE context. It should be understood that the first suspension flag is used to indicate that when the UE re-registers or accesses the network through the AMF1, or the UE is reachable, AMF1 determines to authenticate the UE according to the first suspension flag set locally.

[0221] It should be noted that the present application does not limit the order in which the above steps S506 and S507 are executed.

[0222] S508, optionally, UDM sets a first authentication suspension flag.

[0223] This step can be performed explicitly or implicitly.

[0224] Exemplarily, UDM can determine that the main authentication startup of the UE has failed based on the failure cause value in the first authentication response message of AMF1. For example, the failure cause value can indicate that the UE is unreachable, or AMF1 has not found the UE and cannot start the main authentication process for the UE. Correspondingly, after obtaining the failure cause value, UDM sets a first authentication suspension flag based on the failure cause value, and can associate the first authentication suspension flag with AMF1. Among them, the first authentication suspension flag is used to indicate that UDM has requested AMF1 to trigger the main authentication process, and AMF1 is set with a first suspension flag because it cannot start the main authentication process for the UE, or the first authentication suspension flag is used to indicate that AMF1 cannot start the main authentication process for the UE, or the first authentication suspension flag is used to indicate that the first suspension flag is set on the first mobility management function network element, or the first authentication suspension flag is used to indicate that the UE is unreachable, or AMF1 has not found the UE, etc., and this application does not limit this.

[0225] It should be understood that the setting of the first authentication suspension flag facilitates the subsequent UDM to determine that the AMF1 associated with it is set with the first suspension flag, and the AMF1 has not yet executed the main authentication process for the UE. Optionally, further, the UDM will only set the first authentication suspension flag when it receives a specific failure cause value. For example, when the failure cause value received by the UDM indicates that the UE is unreachable, the UDM sets the first authentication suspension flag. There are many ways to associate the first authentication suspension flag with the AMF1, such as the UDM associates and stores the first authentication suspension flag with the AMF1 ID; for another example, the UDM associates and stores the first authentication suspension flag with the first service network name SN Name#1 corresponding to the AMF1 ID; for another example, the UDM stores the first authentication suspension flag with the PLMN ID#1 corresponding to the AMF1 ID; for another example, the UDM associates and stores the first authentication suspension flag with the AMF1 ID, SN Name#1, and at least two parameters of the PLMN ID#1 corresponding to the AMF1.

[0226] Exemplarily, if the first authentication suspension flag is explicitly stored, the first authentication suspension flag can be indicated using a bit, for example, 1 represents that the authentication suspension flag is valid, and 0 represents that the authentication suspension flag is invalid. Then, when it is determined that AMF1 triggers the main authentication of the UE, UDM can change the first authentication suspension flag from 1 to 0.

[0227] Exemplarily, if the first authentication suspension flag is implicitly stored, the first authentication suspension flag represents validity when it appears, and represents invalidity when it does not appear. In the case of determining that AMF1 triggers the main authentication of the UE, the UDM can delete the first authentication suspension flag.

[0228] It should be understood that the above-mentioned manner of associating the first authentication suspension flag with AMF1 and the expression form of the authentication suspension flag are merely examples, and this application does not make any specific limitations on this.

[0229] Exemplarily, if the first authentication suspension flag is explicitly stored, the UDM can subsequently check whether there is another AMF providing services for the UE, and if it is determined that there is another AMF, since the UDM knows that there are two AMFs providing services for the UE, the UDM can request other AMFs serving the UE, such as AMF2, to execute the main authentication process if it is determined that the main authentication startup of AMF1 fails. At this time, the UDM needs to implicitly record or know that the home network triggered main authentication process has been executed through AMF1, and the failure cause value has been received from AMF1.

[0230] S509, UDM sends a second authentication notification message to AMF2, and correspondingly, AMF2 receives the second authentication notification message from UDM. The second authentication notification message is used to request triggering the execution of the fourth main authentication process for the UE, and the second authentication notification message includes the SUPI of the UE.

[0231] Exemplarily, as described in step S508, when UDM determines that AMF2 also provides services for the UE, UDM continues to execute the home network triggering main authentication process and determines to initiate a request to AMF2.

[0232] S510, AMF2 sends a second authentication response message to UDM, and correspondingly, UDM receives the second authentication response message from AMF2.

[0233] Among them, the second authentication response message is used to indicate whether AMF2 executes the main authentication process for the UE. Exemplarily, AMF2 decides whether to execute the main authentication process for the UE based on the local authentication policy and the UE status. The specific implementation method can refer to the relevant description of the above method 300. Among them, if AMF2 cannot perform the main authentication for the UE, the rejection reason value is carried in the second authentication response message to indicate that the main authentication of the UE has failed. If AMF2 can perform the main authentication for the UE, the second authentication response message does not carry the rejection reason value, which is used to inform the UDM that the second authentication notification message has been received.

[0234] Based on the above solution, the current AMF1 cannot execute the main authentication process for the UE, and AMF1 is locally set with a first suspension flag. Optionally, UDM is locally set with a first authentication suspension flag.

[0235] In combination with branch 1 and branch 2, the following specifically describes whether AMF2 can execute the main authentication process for the UE, how UDM determines which AMF the main authentication process comes from, and which AMF to notify to cancel the suspension flag. In other words, how UDM determines the AMF that is currently providing services to the UE.

[0236] Branch 1: AMF2 can initiate the main authentication process for the UE.

[0237] S511, UDM sends a first notification message to AMF1, and correspondingly, AMF1 receives the first notification message from UDM.

[0238] Before executing step S511, UDM receives the S510 message, and the second authentication response message in step S510 is used to notify that the second authentication notification message has been received. Accordingly, after receiving the second authentication response message, UDM determines that AMF2 can perform the main authentication process for the UE.

[0239] Further, optionally, the UDM determines whether to send a notification message to another AMF. For example, the UDM determines whether another AMF exists, and if so, further determines whether to send a notification message to the AMF that is determined to exist. That is, the UDM may first determine whether another AMF exists, and then determine whether a notification message needs to be sent, or may first determine whether a notification message needs to be sent, and then determine whether another AMF exists. In the case where a notification message needs to be sent, the notification message may be sent to notify the cancellation or termination of the execution of the home network triggering the main authentication process, or to notify that the suspension flag set at the AMF can be cancelled. In the case where a notification message is not required to be sent, the judgment action may not be performed. The UDM may determine whether to send a notification message to the AMF that is determined to exist based on a local pre-configuration policy. The pre-configuration policy may be a local policy pre-configured by the operator, or it may be a product code to implement the function. This embodiment does not specifically limit the pre-configuration policy. Alternatively, the UDM may determine whether to send a notification message to another AMF based on whether the authentication suspension flag of another AMF is set locally; or, the UDM determines to send a notification message to another AMF based on another AMF ID that serves the UE stored locally.

[0240] In this embodiment, UDM determines whether it needs to send a notification message to AMF1. For example, if UDM determines that AMF1 can still serve the UE, then UDM further determines whether the first authentication suspension flag is explicitly stored locally, or implicitly knows that the home network triggered main authentication process has been executed through AMF1, and the failure cause value has been received from AMF1. If there is a first authentication suspension flag, or it is known that the failure cause value has been received from AMF1, UDM sends a first notification message to AMF1, and the first notification message is used to indicate the cancellation or termination of the execution of the home network triggered main authentication process, or to notify that the suspension flag set at the AMF can be canceled.

[0241] Optionally, the first notification message itself has an indicative function, or carries a cause value having an indicative function. That is to say, there are multiple ways to implement the first notification message, for example, the first notification message may be an authentication notification message carrying a cause value, or a first notification message carrying a cause value, or a first notification message not carrying a cause value, and the cause value may be used to indicate that AMF2 has performed primary authentication on the UE, or to indicate that primary authentication of the UE is in progress, or to indicate that primary authentication of the UE is successful, or to indicate that AMF1 deletes the first suspension flag, or to indicate that AMF1 does not request primary authentication of the UE due to the first suspension flag set locally.

[0242] S512a, AMF1 cancels the first suspension flag.

[0243] Exemplarily, after receiving the first notification message, AMF1 cancels the first suspension flag according to the first notification message, for example, cancels the first suspension flag according to the first notification message itself or a reason value carried in the first notification message.

[0244] Among them, canceling the first suspension flag can be understood as the first suspension flag being invalid. If the first suspension flag uses a bit indication, such as 1 represents that the first suspension flag is valid, and 0 represents that the first suspension flag is invalid, then AMF1 changes the first suspension flag from 1 to 0; or, if the first suspension flag exists to indicate validity, and no longer exists to indicate invalidity, then AMF1 deletes the first suspension flag.

[0245] S512b, optionally, UDM cancels the first authentication suspension flag.

[0246] Among them, canceling the first authentication suspension flag can be understood as the first authentication suspension flag being invalid. If the first authentication suspension flag uses a bit indication, such as 1 represents that the first authentication suspension flag is valid, and 0 represents that the first authentication suspension flag is invalid, then UDM changes the first authentication suspension flag corresponding to AMF1 from 1 to 0; or, if the first authentication suspension flag exists to indicate validity, and no longer exists to indicate invalidity, then UDM deletes the first authentication suspension flag corresponding to AMF1.

[0247] Exemplarily, if in step S508, after receiving the message from AMF1 that the UE authentication failed, the UDM locally sets the first authentication suspension flag, then after the UDM determines that AMF2 can perform the main authentication process for the UE, the previously set first authentication suspension flag can be deleted. For example, after receiving the second authentication response message, the second authentication response message does not carry the failure reason value; or, after determining that the UE authentication is successful; or, in the execution of the authentication process for the UE. This embodiment does not limit the specific timing of canceling the first authentication suspension flag.

[0248] It should be noted that step S512b can be performed before step S511, during step S511, or after step S511 and before step S512.

[0249] That is to say, based on the above scheme, after UDM determines that AMF2 serving the UE triggers the main authentication of the UE, it can send a notification message to AMF1 according to the stored information of AMF1 and AMF2 serving the UE, so as to avoid AMF1 triggering re-authentication of the UE due to the first suspension flag set locally when the UE accesses AMF1 again later, thereby reducing unnecessary UE authentication processes and reducing signaling overhead.

[0250] Branch 2: AMF2 cannot start the main authentication process for the UE.

[0251] S513, AMF2 sets a second pending flag (eg, pending flag).

[0252] For specific implementation, please refer to the description related to step S507.

[0253] Accordingly, the second authentication response message in step S510 carries the rejection reason value. At this time, the specific implementation of step S510 can refer to the relevant description of step S506. S514, optionally, the UDM sets the second authentication suspension flag.

[0254] For specific implementation, please refer to the description related to step S508.

[0255] Based on the above scheme, neither AMF1 nor AMF2 serving the UE triggers authentication of the UE, and AMF1 is locally set with a first suspension flag, AMF2 is locally set with a second suspension flag, and optionally, UDM is locally set with a first authentication suspension flag and a second authentication suspension flag.

[0256] It should be understood that since AMF2 is locally set with a second suspension flag, when the UE accesses AMF2 again, AMF2 triggers authentication of the UE based on the second suspension flag.

[0257] S515, the UE sends a first registration request message to AMF2, and correspondingly, AMF2 receives the first registration request message from the UE.

[0258] Among them, the first registration request message carries the UE's 5G-GUTI.

[0259] S516, AMF2 determines to trigger the main authentication process based on the second suspension flag.

[0260] Exemplarily, when AMF2 locally checks and finds that there is a second suspension flag on AMF2, AMF2 needs to trigger the main authentication process, that is, execute the following step S517.

[0261] It should be noted that the above steps S515 and S516 are for the UE to access the network again through AMF2, and then AMF2 triggers the main authentication process according to the second suspension flag. Optionally, the UE can also send a registration request to other AMFs in the operator network where AMF2 is located, such as AMF4, that is, request to access the network through AMF4. It should be understood that when the UE initiates a registration request to AMF4, AMF4 will obtain the second suspension flag from AMF2, and trigger the main authentication process for the UE based on the second suspension flag, so the second suspension flag will be used by AMF4. In other words, this embodiment does not limit the UE to access the network again through AMF2 after failing to access the network through AMF2, and can also access the network through other AMF4 in the operator network where AMF2 is located. For the convenience of description, the embodiment of the present application takes the UE accessing the network through the same AMF, namely AMF2, as an example. It should be understood that if the UE fails to access the network through AMF2 and requests to access the network through AMF4, AMF4 can obtain relevant parameters in the UE context on AMF2, such as the second suspension flag, and trigger the primary authentication of the UE. The specific implementation method is similar to the method in which AMF2 triggers the primary authentication, which will not be repeated here.

[0262] S517, AMF2 sends a first authentication request message to AUSF, and correspondingly, AUSF receives the first authentication request message from AMF2.

[0263] Exemplarily, AMF2 selects an AUSF and sends a Nausf_UEAuthentication_Authenticate Request message to the AUSF. For specific implementation methods, please refer to the relevant description of step S210 of the above method 200.

[0264] The first authentication request message is used to request a first primary authentication for the UE, and the first authentication request message includes the SUPI of the UE and the second service network name SN Name#2. SN Name#2 can refer to the relevant description of step S210 of the above method 200. It should be noted that if the UE accesses AMF4, the first authentication request message can still use SN Name#2; or the first authentication request message uses SN Name#4, but SN Name#4 can be associated with SN Name#2, for example, SN Name#4 and SN Name#2 have the same PLMN ID.

[0265] Exemplarily, the first authentication request message may be a Nausf_UEAuthentication_GetRequest message.

[0266] Optionally, the first authentication request message may also carry a reason value to notify the UDM that the main authentication process is initiated in response to the second suspension flag set locally by AMF2. It should be understood that the reason value is optional and does not need to be carried in the first authentication request message in order to reduce changes to existing standards. If the first authentication request message carries the reason value, the UDM can be informed that the reason for triggering the main authentication process is the presence of the second suspension flag, which means that the main authentication process is an authentication process initiated by AMF2 in response to the UDM's previous authentication notification request.

[0267] Optionally, before sending the first authentication request message, AMF2 may further determine whether there are other factors that cause the main authentication process to be triggered. If yes, it means that the initiation of the main authentication process is not only due to the second suspension flag, and the first authentication request message may not carry the reason value; if no, the first authentication request message may carry the reason value.

[0268] S518, AUSF sends a second authentication request message to UDM, and correspondingly, UDM receives the second authentication request message from AUSF. The second authentication request message is used to request an authentication vector from UDM, and the authentication vector is used to perform primary authentication of the UE. The second authentication request message includes the SUPI and SN Name#2 of the UE.

[0269] Exemplarily, the second authentication request message may be a Nudm_UEAuthentication_GetRequest message.

[0270] Optionally, if a reason value is carried in step S517, a reason value may also be carried in step S518.

[0271] S519, UDM determines that the first primary authentication comes from AMF2 based on SN Name#2.

[0272] Optionally, after determining that the first primary authentication comes from AMF2, it can be further determined whether it is necessary to perform primary authentication on the UE, that is, whether the UDM needs to select an authentication method and send an authentication vector to the AUSF for primary authentication of the UE. If the UDM determines that neither AMF1 nor AMF2 authenticates the UE, the following steps S520 to S522 are executed. There are many ways for the UDM to determine that neither AMF1 nor AMF2 authenticates the UE, such as determining by an explicit authentication suspension flag or by an implicit internal judgment logic. In the case of using the authentication suspension flag, optionally, if the UDM is set with a second authentication suspension flag in the above step S514, after the UDM receives the second authentication request message, the UDM sets the second authentication suspension flag corresponding to AMF2 to invalid. For example, after the UDM determines that the authentication request comes from AMF2 and determines that AMF2 performs the primary authentication, the UDM cancels the second authentication suspension flag. Among them, canceling the second authentication suspension flag can be understood as the second authentication suspension flag being invalid. If the second authentication suspension flag uses a bit indication, for example, 1 represents that the second authentication suspension flag is valid, and 0 represents that the second authentication suspension flag is invalid, then UDM changes the second authentication suspension flag corresponding to AMF2 from 1 to 0; or, if the second authentication suspension flag exists to indicate validity, and no longer exists to indicate invalidity, then UDM deletes the second authentication suspension flag corresponding to AMF2.

[0273] Exemplarily, when the cause value is carried in S519, the UDM needs to determine which AMF the authentication request comes from. For example, the UDM can determine that the authentication request comes from AMF2 based on the SN Name#2 carried in the second authentication request message. For example, if the UDM locally stores the correspondence between SN Name and AMF, the UDM can determine the corresponding AMF2 based on the SN Name#2 carried in the second authentication request message and the correspondence between SN Name#2 and AMF2 stored locally, and further determine that the authentication request comes from AMF2. For another example, if the UDM locally stores the correspondence between PLMN ID and AMF, the UDM determines the AMF2 corresponding to PLMN ID#2 based on the PLMN ID#2 in SNName#2 and the correspondence between PLMN ID#2 and AMF2 stored locally, and further determines that the authentication request comes from AMF2. For another example, if the UDM only stores the AMF ID locally and does not store the SN Name or PLMN ID information corresponding to the AMF, the UDM can determine based on the information in the AMF ID and the information in SN Name#2. For example, if both the AMF ID and SN Name#2 contain PLMN ID#2, the UDM can determine that the authentication request comes from AMF2 based on the same PLMN ID#2.

[0274] Optionally, if the UE accesses AMF4, assuming that the authentication request message sent by AMF4 carries SN Name#2, the UDM can determine that the authentication request comes from AMF2 based on the SN Name#2 carried in the authentication request message. Assuming that the authentication request message sent by AMF4 carries SN Name#4, the UDM can further determine that the authentication request comes from AMF2 based on the SN Name#4 carried in the authentication request message. This is because in the above steps S516 and S517, SN Name#4 is associated with SNName#2, or SN Name#4 and SN Name#2 have the same PLMN ID. After receiving SN Name#4, the UDM can determine the SN Name#2 based on SN Name#4, and further determine that the authentication request comes from AMF2, or the UDM can determine the corresponding SN Name#2 based on the PLMN ID in SNName#4, and further determine that the authentication request comes from AMF2, or the UDM can match the PLMN ID in SN Name#4 with the PLMN in the locally stored AMF2 ID, and determine that the authentication request comes from AMF2, etc.

[0275] It should be understood that if the UE registers with AMF1 and AMF2 at the same time, then AMF1 and AMF2 will initiate authentication of the UE at the same time. At this time, after determining which AMF the authentication occurs in, UDM can suspend processing of another AMF, or UDM can reject the authentication request of another AMF (for example, AMF1 requests UDM to execute the main authentication process through AUSF, then UDM can reject the authentication request of AMF2 after receiving the authentication result sent by AUSF, or UDM directly rejects the authentication request of AMF2 after receiving the authentication request from AUSF), or continue to execute the authentication request of another AMF (for example, UDM executes the authentication request of AMF2 after receiving the authentication result sent by AUSF). This application does not limit this.

[0276] S520, UDM determines that neither AMF1 nor AMF2 has authenticated the UE.

[0277] Optionally, after determining that the authentication request comes from AMF2, UDM further determines whether to execute the main authentication process for UE, which can also be understood as UDM determining whether it is necessary to execute steps such as selecting an authentication method and generating an authentication vector. For example, UDM can check whether the first authentication suspension flag and the second authentication suspension flag corresponding to AMF1 and AMF2 are stored locally. If both the first authentication suspension flag and the second authentication suspension flag exist, it is determined that the main authentication process can be executed. If the second authentication suspension flag corresponding to AMF2 exists, but the first authentication suspension flag corresponding to AMF1 does not exist, it means that AMF1 has performed the main authentication with the UE, and then it can be determined that the main authentication process is not executed. If the second authentication suspension flag corresponding to AMF2 does not exist, but the first authentication suspension flag corresponding to AMF1 exists, it means that AMF2 has performed the main authentication with the UE, and then it can be determined that the main authentication process is not executed. If it is determined that the main authentication process is executed for the UE, the following steps S521 and S522 are continued to be executed, and S523 can also be executed optionally.

[0278] Optionally, if the UDM determines in step S520 that the primary authentication of the UE has been performed, or the primary authentication of the UE is in progress, there is no need to execute the following steps S512 and S522, and the first and second methods can be continued to be executed.

[0279] S521, execute the main authentication process.

[0280] S522, execute the main authentication confirmation process.

[0281] For the specific implementation of the above steps S521 and S522, please refer to the relevant description of the above method 200.

[0282] S523, UDM cancels the second authentication suspension flag.

[0283] Optionally, if the authentication result received by UDM from AUSF in step S522 indicates that the primary authentication of the UE by AMF2 is successful, UDM may cancel the second authentication suspension flag previously set.

[0284] It should be noted that if after the above step S518, after UDM receives the second authentication request message, the second authentication suspension flag corresponding to AMF2 is canceled, deleted or set invalid, then step S523 may not be executed; if AMF2 does not cancel the second authentication suspension flag after the above step S518, then UDM may cancel the second authentication suspension flag in step S523.

[0285] Based on the above scheme, UDM can determine in step S519 that the first primary authentication comes from AMF2, or UDM can determine in step S522 that the first primary authentication is successful, and directly send a notification message to AMF1 to notify the cancellation or termination of the execution of the home network triggered primary authentication process, or to notify that the suspension flag set at the AMF can be cancelled. Accordingly, AMF1 can cancel the first suspension flag set locally, and there is no need to initiate the primary authentication process for the UE subsequently, that is, execute step S531; or, UDM can also determine in step S522 that the first primary authentication is successful, or, UDM can also determine in step S522 that the first primary authentication is successful, and wait for AMF1 to initiate the authentication process before rejecting AMF1's authentication request, so as to avoid repeatedly executing the primary authentication process for the UE and reduce signaling overhead.

[0286] The following is a combination of Method 1 and Method 2, which specifically describes how UDM notifies AMF1 to cancel the suspension flag when it determines that the first primary authentication comes from AMF2. Method 1 is that the UE accesses AMF1 again, and AMF1 triggers an authentication request due to the first suspension flag set locally. UDM rejects AMF1's authentication request when it knows that AMF2 performs primary authentication on the UE. Method 2 is that when UDM determines that the first primary authentication comes from AMF2, it directly notifies AMF1 that the primary authentication of the UE is in progress or has been successfully authenticated, that is, AMF1 does not need to trigger authentication of the UE subsequently.

[0287] Method 1:

[0288] S524, the UE sends a second registration request message to AMF1, and correspondingly, AMF1 receives the second registration request message from the UE.

[0289] Among them, the second registration request message carries the UE's 5G-GUTI.

[0290] S525, AMF1 determines to trigger the main authentication process based on the first suspension flag, that is, executes the following step S526.

[0291] Exemplarily, when AMF1 locally checks and finds that there is a first suspension mark on AMF1, AMF1 triggers the main authentication process, that is, executes the following step S526.

[0292] It should be noted that the above steps S524 and S525 are for the UE to access the network again through AMF1, and then AMF1 triggers the main authentication process according to the first suspension flag. Optionally, the UE can also send a registration request to other AMFs in the operator network where AMF1 is located, such as AMF3, that is, request to access the network through AMF3. It should be understood that when the UE initiates registration with AMF3, AMF3 will obtain the first suspension flag from AMF1, and trigger the main authentication process for the UE based on the first suspension flag, so the first suspension flag will be used by AMF3. In other words, this embodiment does not limit the UE to access the network again through AMF1 after failing to access the network through AMF1, and can also access the network through other AMF3 in the operator network where AMF1 is located. For the convenience of description, the embodiment of the present application takes the UE accessing the network through the same AMF, namely AMF1, as an example. It should be understood that if the UE fails to access the network through AMF1 and requests to access the network through AMF3, AMF3 can obtain relevant parameters in the UE context on AMF1, such as the first suspension flag, and trigger the primary authentication of the UE. The specific implementation method is similar to the method in which AMF1 triggers the primary authentication, which will not be repeated here.

[0293] S526, AMF1 sends a third authentication request message to AUSF, and AUSF receives the third authentication request message from AMF1. The third authentication request message is used to request a second primary authentication for the UE. The third authentication request message includes the SUPI and SN Name#1 of the UE. SN Name#1 indicates the name of the service network where AMF1 is located. For SN Name#1, please refer to the description of step S210. In a possible implementation, SN Name#1 contains the PLMN ID#1 corresponding to AMF1.

[0294] Exemplarily, the third authentication request message may be a Nausf_UEAuthentication_GetRequest message.

[0295] Optionally, the third authentication request message may also carry a reason value to notify UDM that the main authentication process is initiated in response to the first suspension flag set locally by AMF1. If the third authentication request message carries the reason value, UDM can know that the reason for triggering the main authentication process is the existence of the first suspension flag, which means that the main authentication process is an authentication process initiated by AMF1 in response to UDM's previous authentication notification request.

[0296] It should be noted that this embodiment is introduced from the perspective that AMF1 and AMF2 send an authentication request message to the same AUSF, but in actual scenarios, AMF1 and AMF2 can select different AUSFs. For ease of understanding and description, AMF1 and AMF2 happen to select the same AUSF as an example. In other words, the embodiment of the present application does not limit AMF1 and AMF2 to use the same or different AUSFs.

[0297] S527, AUSF sends a fourth authentication request message to UDM, and correspondingly, UDM receives the fourth authentication request message from AUSF. The fourth authentication request message is used to request an authentication vector from UDM, and the authentication vector is used to perform primary authentication of the UE. The fourth authentication request message carries the SUPI and SN Name#1 of the UE. If the reason value #2 is carried in the above step S517, the authentication request message #4 also includes the reason value #2.

[0298] Exemplarily, the authentication request message #4 may be a Nudm_UEAuthentication_GetRequest message.

[0299] Optionally, if a reason value is carried in step S526, a reason value may also be carried in step S527.

[0300] S528, UDM determines that AMF2 has authenticated the UE.

[0301] Optionally, UDM can find out based on local query that there is no second authentication suspension flag, and determine that AMF2 has authenticated the UE; or, UDM can determine that AMF2 has authenticated the UE based on the authentication result received in step S522; or, UDM can determine in step S519 that the first authentication comes from AMF2, and then obtain the authentication of the UE by AMF2.

[0302] S529, UDM sends a third authentication response message to AUSF, and correspondingly, AUSF receives the third authentication response message from UDM.

[0303] The third authentication response message is used to indicate the rejection of the authentication request. Optionally, the third authentication response message includes a rejection reason value, which is used to indicate that AMF2 has authenticated the UE or that the primary authentication of the UE is successful.

[0304] S530, AUSF sends a fourth authentication response message to AMF1, and correspondingly, AMF1 receives the fourth authentication response message from UDM.

[0305] Among them, the fourth authentication response message is used to indicate the rejection of AMF1's authentication request. Optionally, the fourth authentication response message includes a rejection reason value, which is used to indicate that AMF2 has authenticated the UE, or that the UE's primary authentication is successful.

[0306] S530a, AMF1 cancels the first suspension flag.

[0307] Exemplarily, AMF1 cancels the first suspension flag set in step S507 according to the received rejection reason value. For the specific implementation method of the cancellation, please refer to the relevant description of the above step S512a.

[0308] Method 2:

[0309] S531, UDM sends a second notification message to AMF1, and correspondingly, AMF1 receives the notification message from UDM.

[0310] The second notification message is used to notify the cancellation or termination of the execution of the home network triggered main authentication process, or to notify that the suspension flag set at the AMF can be cancelled. That is, accordingly, AMF1 can cancel the first suspension flag previously set in step S507.

[0311] S532, AMF1 cancels the first suspension flag.

[0312] Exemplarily, AMF1 cancels the first suspension flag set in step S507 according to the second notification message. For the specific implementation method of the cancellation, please refer to the relevant description of the above step S512a.

[0313] In the solution provided by the present application, UDM determines that AMF2 can execute the main authentication process for UE based on the authentication response message of AMF2, and then can send a notification message of canceling the suspension mark to other AMF1 serving the UE, so as to avoid the subsequent AMF1 triggering a re-authentication request for the UE. In addition, by determining which AMF the authentication comes from, UDM can directly send a notification message of canceling the suspension mark to other AMF1 serving UEs that have not triggered the authentication request after knowing that the current main authentication comes from AMF2 serving the UE, so as to avoid the subsequent AMF1 triggering a re-authentication request for the UE; or, after receiving the authentication request initiated by AMF1 serving the UE, UDM will reject the authentication request of AMF1, so as to avoid redundant authentication processes and reduce signaling overhead.

[0314] Next, combine Figure 6 and Figure 7 Method 1 and method 2 in the above method 500 are described in detail. Take the example that the UE accesses AMF1 and AMF2 respectively through 3GPP access technology and non-3GPP access technology to illustrate, indicating that the current UE is served by the AMF1 and AMF2, or the UE can be found through AMF1 and AMF2. Based on the above method 200, it can be known that at this time, the UDM has stored the information of AMF1 and AMF2 that provide services to the UE, such as AMF1 ID and AMF2 ID. The UDM can determine the AMF1 and AMF2 that serve the UE based on the AMF ID. Further, based on the above Figure 3 Step S330 of the method 300 shown, that is, the UDM may determine to trigger the main authentication process based on an event or an operator authentication policy.

[0315] Figure 6 600 is a flow chart of a communication method 600 provided in an embodiment of the present application. Figure 6 As shown, with UDM, AMF1, AMF2, AUSF, and UE as the execution entities, the implementation method is mainly that after UDM knows that the current primary authentication comes from AMF1 serving UE, after receiving the authentication request initiated by AMF2 serving UE, it rejects the authentication request of AMF2. The method includes the following steps. For the parts not described in detail, please refer to the existing protocol. It should be understood that the above Figure 6 The relevant description in the embodiment shown is also applicable to this implementation. Figures 4 to 6 There may be the same or similar technical means between them. Figure 4 and Figure 5 The contents already described in the illustrated embodiment will not be repeated.

[0316] S601, UDM sends an authentication notification message #1 to AMF1, and correspondingly, AMF1 receives the authentication notification message #1 from UDM.

[0317] The authentication notification message #1 includes the SUPI of the UE.

[0318] Exemplarily, UDM determines to trigger the main authentication process based on the operator's authentication policy, and chooses to trigger the main authentication process through AMF1, then UDM sends an authentication notification message #1 to AMF1.

[0319] S602, AMF1 sends an authentication response message #1 to UDM, and UDM receives the authentication response message #1 from AMF1.

[0320] Exemplarily, if AMF1 finds that the UE is unreachable, or AMF1 fails to find the UE, AMF1 sends an authentication response message #1 to the UDM, and carries a failure cause value in the authentication response message #1.

[0321] S603a, AMF1 sets the suspend flag #1.

[0322] Exemplarily, since AMF1 cannot start the primary authentication of the UE, AMF1 can set a suspend flag #1 in the UE context. The specific interpretation of the suspend flag #1 can refer to the relevant description of the above method 400.

[0323] This embodiment does not limit the execution order of steps S602 and S603a, that is, AMF2 may execute step S602 first and then step S603a, or execute step S603a first and then step S602.

[0324] The specific implementation of the above steps S601, S602 and S603a may refer to the relevant description of steps S340, S360 and S370 of the above method 300.

[0325] S603b, optionally, UDM sets the authentication suspension flag #1.

[0326] Exemplarily, the UDM can determine that the primary authentication of the UE has failed to start based on the failure reason value in the authentication response message #1 of AMF1, and then set the authentication suspension flag #1, and associate the authentication suspension flag #1 with AMF1. The authentication suspension flag #1 is used to indicate that the UDM has requested AMF1 to trigger the primary authentication process, and AMF1 is set with the suspension flag #1 because it cannot start the primary authentication process for the UE. The setting of the authentication suspension flag #1 facilitates the subsequent UDM to determine that the AMF1 associated with it is set with the suspension flag #1, and the AMF1 has not yet executed the primary authentication process for the UE.

[0327] Among them, the manner of associating the authentication suspension flag #1 with AMF1 can refer to the relevant description of the above-mentioned method 400, and there are many ways, such as UDM associates and stores the authentication suspension flag #1 with the AMF1 ID; for another example, UDM associates and stores the authentication suspension flag #1 with the SN Name #1 corresponding to the AMF1 ID; for another example, UDM stores the authentication suspension flag #1 with the PLMN ID #1 corresponding to the AMF1 ID; for another example, UDM associates and stores the authentication suspension flag #1 with at least two parameters of the AMF1 ID, SN Name #1 and the PLMN ID #1 corresponding to the AMF1.

[0328] Among them, the expression of the authentication suspension mark #1 can refer to the relevant description of the above method 400, and this application does not make any specific limitation on this.

[0329] Since UDM knows that there are two AMFs serving the UE, when UDM determines that the primary authentication startup of AMF1 fails, it can request other AMFs serving the UE, such as AMF2, to execute the primary authentication process.

[0330] S604, UDM sends an authentication notification message #2 to AMF2, and correspondingly, AMF2 receives the authentication notification message #2 from UDM.

[0331] The authentication notification message #2 includes the SUPI of the UE.

[0332] S605, AMF2 sends an authentication response message #2 to UDM, and UDM receives the authentication response message #2 from AMF2.

[0333] S606a, AMF2 sets the suspend flag #2.

[0334] S606b, optionally, UDM sets authentication suspension flag #2.

[0335] It should be noted that the present application does not limit the order in which the above steps S605 and S606a are executed.

[0336] The specific implementation of the above steps S604 to S606b can refer to the relevant description of the above methods S601 to S603b, and for the sake of brevity, it will not be repeated here.

[0337] It should be understood that since AMF2 is locally set with a suspend flag #2, when the UE accesses AMF2 again, AMF2 performs the main authentication process for the UE based on the local suspend flag #2. For example, AMF1 selects an AUSF and sends a Nausf_UEAuthentication_Authenticate Request message to the AUSF, see the description of step S210 for details.

[0338] S607, UE sends registration request message #1 to AMF2, and correspondingly, AMF2 receives registration request message #1 from the UE.

[0339] Among them, the registration request message #1 carries the UE's 5G-GUTI.

[0340] S608, AMF2 checks whether there is a suspension flag #2 to determine whether to trigger the main authentication process.

[0341] Exemplarily, when AMF2 locally checks and finds that there is a suspension flag #2 on AMF2, AMF2 first needs to trigger the main authentication process, that is, execute the following step S609.

[0342] S609, AMF2 sends an authentication request message #1 to AUSF, and correspondingly, AUSF receives an authentication request message #1 from AMF2.

[0343] The authentication request message #1 is used to request the primary authentication of the UE. The authentication request message #1 carries the SUPI and SN Name #2 of the UE. SN Name #2 indicates the service network name where the AMF2 is located, wherein the SN Name #2 contains the PLMN ID #2 corresponding to the AMF2. For the SN Name #2, please refer to the description of step S210.

[0344] Exemplarily, SN Name#2 contains the PLMN ID corresponding to AMF2.

[0345] Exemplarily, the authentication request message #1 may be a Nausf_UEAuthentication_GetRequest message.

[0346] Optionally, the authentication request message #1 may also carry a reason value #1, which is used to notify the UDM that the main authentication process is initiated in response to the suspension flag #2 set locally by AMF2. It should be understood that the reason value #1 is optional, and in order to reduce changes to existing standards, it may not be necessary to carry it in the authentication request message #1. If the authentication request message #1 carries the reason value #1, the UDM can be made aware that the reason for triggering the main authentication process is the existence of the suspension flag #2, which means that the main authentication process is an authentication process initiated by AMF2 in response to the UDM's previous authentication notification request.

[0347] Optionally, before sending the authentication request message #1, AMF2 may further determine whether there are other factors that cause the main authentication process to be triggered. If so, it means that the initiation of the main authentication process is not only due to the suspension flag #2, and the authentication request message #1 may not carry the reason value #1; if not, the authentication request message #1 may carry the reason value #1.

[0348] S610, AUSF sends an authentication request message #2 to UDM, and correspondingly, UDM receives the authentication request message #2 from AUSF.

[0349] The authentication request message #2 is used to request an authentication vector from the UDM, and the authentication vector is used to perform primary authentication of the UE. The authentication request message #2 carries the SUPI and SN Name #2 of the UE. If the cause value #1 is carried in the above step S609, the authentication request message #2 also includes the cause value #1.

[0350] Exemplarily, the authentication request message #2 may be a Nudm_UEAuthentication_GetRequest message.

[0351] S611, UDM determines that the authentication request comes from AMF2 based on SN Name#2.

[0352] Exemplarily, when the reason value #1 is carried in S610, the UDM needs to determine which AMF the authentication request comes from. For the specific implementation method, please refer to the relevant description of the above method 500.

[0353] Optionally, after determining which AMF the authentication request comes from, such as AMF2, the UDM further determines whether to perform a primary authentication process on the UE, which can also be understood as the UDM determining whether it is necessary to perform steps such as selecting an authentication method and generating an authentication vector. For specific implementations, refer to the relevant description of the above method 500. If it is determined that the primary authentication process is to be performed on the UE, continue to perform the following step S612. If it is determined not to perform the primary authentication process on the UE, the following step S620 may be performed.

[0354] Optionally, if the UDM is set with an authentication suspension flag, then after the UDM receives the authentication request message, the UDM sets the authentication suspension flag corresponding to the AMF to invalid. For example, after the UDM determines that the authentication request comes from AMF2 and determines to perform the main authentication on AMF2, the UDM cancels the authentication suspension flag #2. Among them, canceling the authentication suspension flag #2 can be understood as the invalidation of the authentication suspension flag #2. If the authentication suspension flag #2 uses a bit indication, such as 1 represents that the authentication suspension flag #2 is valid, and 0 represents that the authentication suspension flag #2 is invalid, then the UDM changes the authentication suspension flag #2 of AMF2 from 1 to 0; or, if the authentication suspension flag #2 exists to indicate validity, and no longer exists to indicate invalidity, then the UDM deletes the authentication suspension flag #2 of AMF2.

[0355] It should be understood that if the UE registers with AMF1 and AMF2 at the same time, then AMF1 and AMF2 will initiate authentication of the UE at the same time. At this time, after determining which AMF the authentication occurs in, UDM can suspend processing of another AMF, or UDM can reject the authentication request of another AMF (for example, AMF1 requests UDM to execute the main authentication process through AUSF, then UDM can reject the authentication request of AMF2 after receiving the authentication result sent by AUSF, or UDM directly rejects the authentication request of AMF2 after receiving the authentication request from AUSF), or continue to execute the authentication request of another AMF (for example, UDM executes the authentication request of AMF2 after receiving the authentication result sent by AUSF). This application does not limit this.

[0356] S612, executing the main authentication process.

[0357] S613, execute the main authentication confirmation process.

[0358] The specific implementation of the above steps S612 and S613 may refer to the relevant description of the above method 200.

[0359] S614, optionally, UDM cancels authentication suspension flag #2.

[0360] Exemplarily, if the UDM cancels the authentication suspension flag #2 in step S611, this step does not need to be performed; if the UDM does not cancel the authentication suspension flag #2 in step S611, this step can be performed.

[0361] Optionally, the above step S611 may not be performed, that is, in step S614, the UDM may also determine which AMF triggered the authentication process. For example, the UDM may determine that the authentication process is triggered by AMF2 based on the service network name in the authentication response in step S613. For the specific confirmation method, please refer to the relevant description of step S611.

[0362] It should be understood that since AMF2 is locally set with the suspension flag #2, when the UE accesses AMF2 again, AMF2 will trigger the main authentication process for the UE through the AUSF request to the UDM based on the local suspension flag #2. Optionally, AMF1 and AMF2 send an authentication request message to the same AUSF, but in actual scenarios, AMF1 and AMF2 can select different AUSFs. For ease of understanding and description, it is taken as an example that AMF1 and AMF2 happen to select the same AUSF. In other words, the embodiment of the present application does not limit AMF1 and AMF2 to use the same or different AUSF.

[0363] S615, the UE sends a registration request message #2 to AMF1, and correspondingly, AMF1 receives the registration request message #2 from the UE.

[0364] Among them, the registration request message #2 carries the UE's 5G-GUTI.

[0365] S616, AMF1 checks whether there is a suspension flag #1 to determine whether to trigger the main authentication process.

[0366] Exemplarily, when AMF1 locally checks and finds that there is a suspension flag #1 on AMF1, AMF1 first needs to trigger the main authentication process, that is, execute the following step S617.

[0367] S617, AMF1 sends an authentication request message #3 to AUSF, and correspondingly, AUSF receives an authentication request message #3 from AMF1.

[0368] The authentication request message #3 is used to request the primary authentication of the UE. The authentication request message #3 carries the SUPI and SN Name #1 of the UE. SN Name #1 indicates the service network name where the AMF1 is located, wherein the SN Name #1 contains the PLMN ID #1 corresponding to the AMF1. The SN Name #1 can refer to the relevant description of step S210.

[0369] Exemplarily, the authentication request message #3 may be a Nausf_UEAuthentication_GetRequest message.

[0370] Optionally, the authentication request message #3 may also carry reason value #2, which is used to notify UDM that the main authentication process is initiated in response to the suspension flag #1 set locally by AMF1. If the authentication request message #3 carries the reason value #2, UDM can know that the reason for triggering the main authentication process is the existence of suspension flag #1, which means that the main authentication process is the authentication process initiated by AMF1 in response to the previous authentication notification request of UDM. For specific interpretation, please refer to the relevant description of the above step S609.

[0371] S618, AUSF sends an authentication request message #4 to UDM, and correspondingly, UDM receives the authentication request message #4 from AUSF.

[0372] The authentication request message #4 is used to request an authentication vector from the UDM, and the authentication vector is used to perform primary authentication of the UE. The authentication request message #4 carries the UE's SUPI and SN Name #1. If the cause value #2 is carried in the above step S617, the authentication request message #4 also includes the cause value #2.

[0373] Exemplarily, the authentication request message #4 may be a Nudm_UEAuthentication_GetRequest message.

[0374] S619, UDM determines that the primary authentication through AMF2 is successful.

[0375] Optionally, when the reason value can be carried, and when the reason value #2 is carried in step S618, the UDM determines that the authentication process is triggered by the suspension flag #1, and then the UDM checks whether authentication has already occurred, such as determining whether authentication has already occurred according to the relevant description of step S611 or step S614. When the UDM determines that authentication has already occurred, in order to avoid repeated authentication, the subsequent authentication process can be rejected, and the rejection reason value #3 is sent in the subsequent authentication request process. When the UDM determines that authentication has not occurred, for example, according to the relevant description of the above step S611, the authentication process can continue, such as executing the above step S612.

[0376] Optionally, if the authentication reason value can be carried, and if the reason value #2 is not carried in step S618, the UDM continues to execute the subsequent authentication process. Optionally, the UDM can further cancel the relevant mark for AMF1, such as the authentication suspension mark #1 set in step S603b.

[0377] Optionally, when the reason value cannot be carried, UDM can have at least 2 processing logics. For example, UDM can continue the authentication process according to the relevant description of the existing protocol. For another example, UDM determines whether the authentication process has been requested, but the request fails (for example, AMF1 records the suspension mark #1), and then determines whether the authentication has occurred (for example, there is no suspension mark #2 on another AMF2). If it has occurred, the authentication process can be rejected first, and the rejection reason value #3 is replied; at the same time, UDM cancels the authentication suspension mark, which means that UDM has not requested AMF to authenticate the UE, so any other authentication requests from AMF need to be processed.

[0378] S620, UDM sends an authentication response message #3 to AUSF, and correspondingly, AUSF receives an authentication response message #3 from UDM.

[0379] The authentication response message #3 carries the rejection reason value #3, which indicates that the authentication request of AMF1 is rejected. In other words, AMF2 has requested the primary authentication and has successfully authenticated, so the authentication request of AMF1 can be terminated.

[0380] S621, AUSF sends an authentication response message #4 to AMF1, and correspondingly, AMF1 receives an authentication response message #4 from AUSF.

[0381] Among them, the authentication response message #4 carries the failure reason value #3.

[0382] S622, AMF1 cancels the suspension flag #1.

[0383] Exemplarily, if the authentication reason value can be carried, after AMF1 receives the failure reason value #3, AMF1 cancels the suspension flag #1 according to the rejection reason value #3 and continues to provide services to the UE.

[0384] In the solution provided by the present application, UDM determines which AMF the authentication comes from, and after knowing that the current primary authentication comes from AMF2 serving the UE, after receiving the authentication request initiated by AMF1 serving the UE, it rejects the authentication request of AMF1, thereby avoiding redundant authentication processes and reducing signaling overhead.

[0385] Figure 7It is a flowchart of the communication method 700 provided in an embodiment of the present application. With UDM, AMF1, AMF2, AUSF, and UE as the execution subjects, the implementation method is mainly that after UDM knows that the current main authentication comes from AMF1 serving UE, based on the information of multiple AMFs serving UE stored locally, it sends a cancel suspension flag to other AMF2s that have not triggered the authentication request to avoid triggering redundant authentication processes. The method includes the following steps. For the parts not described in detail, please refer to the existing protocol. It should be understood that the above Figures 4 to 6 The relevant description in the embodiment shown is also applicable to this implementation. Figures 4 to 7 There may be the same or similar technical means between them. Figure 7 With the above Figures 4 to 6 The contents already described in the illustrated embodiment will not be repeated.

[0386] S701, UDM sends an authentication notification message #1 to AMF1, and correspondingly, AMF1 receives the authentication notification message #1 from UDM.

[0387] S702, AMF1 sends an authentication response message #1 to UDM, and UDM receives the authentication response message #1 from AMF1.

[0388] S703a, AMF1 sets the suspend flag #1.

[0389] S703b, optionally, UDM sets the authentication suspension flag #1.

[0390] S704, UDM sends an authentication notification message #2 to AMF2, and correspondingly, AMF2 receives the authentication notification message #2 from UDM.

[0391] S705, AMF2 sends an authentication response message #2 to UDM, and UDM receives the authentication response message #2 from AMF2.

[0392] S706a, AMF2 sets the suspend flag #2.

[0393] S706b, optionally, UDM sets authentication suspension flag #2.

[0394] S707, UE sends registration request message #1 to AMF2, and correspondingly, AMF2 receives registration request message #1 from the UE.

[0395] S708, AMF2 checks whether there is a suspension flag #1 to determine whether to trigger the main authentication process.

[0396] S709, AMF2 sends an authentication request message #1 to AUSF, and correspondingly, AUSF receives an authentication request message #1 from AMF2.

[0397] S710, AUSF sends an authentication request message #2 to UDM, and correspondingly, UDM receives the authentication request message #2 from AUSF.

[0398] S711, UDM determines that the authentication request comes from AMF2 based on SN Name#2.

[0399] S712, execute the main authentication process.

[0400] S713, execute the main authentication confirmation process.

[0401] S714, optionally, UDM cancels authentication suspension flag #2.

[0402] Among them, the specific implementation method of the above steps S701 to S714 can refer to the relevant description of steps S601 to S614 of the above method 600, and for the sake of brevity, it will not be repeated here.

[0403] Based on the above implementation, UDM knows that AMF2 triggers the primary authentication of the UE successfully. In order to avoid subsequent redundant authentication processes, UDM can directly send a notification to cancel the suspension flag #1 to other AMF1 serving the UE, that is, execute step S715.

[0404] S715, UDM sends a notification message to AMF1, and correspondingly, AMF1 receives the notification message from UDM.

[0405] Among them, the notification message is used to notify AMF1 to cancel the suspension flag #1, so that if the UE accesses the AMF1 again later, AMF1 may not trigger the primary authentication of the UE, and the notification message includes the SUPI of the UE.

[0406] Exemplarily, when UDM determines that the authentication comes from AMF2, UDM sends a notification message to another AMF1 serving the UE to notify AMF1 to cancel the suspension flag #1.

[0407] S716, AMF1 cancels the suspension flag #1.

[0408] Exemplarily, AMF1 cancels the suspension flag #1 according to the received notification message.

[0409] S717, AMF1 sends a response message to UDM, and correspondingly, AMF1 receives a response message from UDM.

[0410] It should be noted that, in one example, step S715 may occur after step S711, that is, when the UDM knows that the primary authentication of the UE has occurred, it can send a cancellation (e.g., deletion or reset) process to another AMF1 serving the UE. In another example, after step S714, the UDM may determine that the AMF2 authentication is successful, and then send a cancellation (e.g., deletion or reset) process to another AMF 1 serving the UE, which is not limited in this application.

[0411] In the solution provided by the present application, UDM determines which AMF the authentication comes from. After knowing that the current primary authentication comes from AMF2 serving the UE, it directly sends a cancel suspension flag to the AMF1 of other serving UEs that have not triggered the authentication request, so as to avoid triggering redundant authentication processes and reduce signaling overhead.

[0412] Combination of the above Figures 1 to 6 , describes in detail the communication method side embodiment of the present application, and will be combined with Figures 7 to 9 , describes in detail the communication device side embodiment of the present application. It should be understood that the description of the device embodiment corresponds to the description of the method embodiment, so the parts not described in detail can refer to the previous method embodiment.

[0413] Figure 8 1 is a schematic diagram of the structure of the communication device 1000 provided in the embodiment of the present application. Figure 8 As shown, the device 1000 may include a transceiver unit 1010 and a processing unit 1020. The transceiver unit 1010 may communicate with the outside, and the processing unit 1020 is used for data processing. The transceiver unit 1010 may also be called a communication interface or a transceiver unit.

[0414] In one possible design, the device 1000 can implement steps or processes corresponding to those executed by the home network element in the above method embodiment, wherein the processing unit 1020 is used to execute operations related to processing of the home network element in the above method embodiment, and the transceiver unit 1010 is used to execute operations related to sending and receiving of the home network element in the above method embodiment.

[0415] Exemplarily, the processing unit 1020 is used for, when the terminal device is registered to the network through the first mobility management function network element and the second mobility management function network element respectively, the hometown network element stores the identifier of the first mobility management function network element and the identifier of the second mobility management function network element; the transceiver unit 1010 is used for, when it is determined that the terminal device needs to be primarily authenticated, the hometown network element sends a first authentication notification message to the first mobility management function network element, the first authentication notification message is used to request to trigger the primary authentication of the terminal device; the transceiver unit 1010 is also used for the hometown network element to receive a first authentication response message from the first mobility management function network element, the first authentication response message is used to indicate that the first mobility management function network element cannot initiate the primary authentication of the terminal device. The home network element sends a second authentication notification message to the second mobility management function network element in response to the first authentication response message, and the second authentication notification message is used to request triggering of the main authentication of the terminal device; the transceiver unit 1010 is also used for the home network element to receive the second authentication response message from the second mobility management function network element; the transceiver unit 1010 is also used for the home network element to send a first notification message to the first mobility management function network element when it is determined that the second mobility management function network element can initiate the main authentication of the terminal according to the second authentication response message, and the first notification message is used to indicate that when the terminal device registers to the network again through the first mobility management function network element, no main authentication is performed on the terminal device.

[0416] In another possible design, the device 1000 may implement steps or processes corresponding to those executed by the first mobility management function network element in the above method embodiment, wherein the transceiver unit 1010 is used to execute operations related to the transmission and reception of the first mobility management function network element in the above method embodiment, and the processing unit 1020 is used to execute operations related to the processing of the first mobility management function network element in the above method embodiment.

[0417] It should be understood that the device 1000 here is embodied in the form of a functional unit. The term "unit" here may refer to an application specific integrated circuit (ASIC), an electronic circuit, a processor (such as a shared processor, a proprietary processor or a group processor, etc.) and a memory for executing one or more software or firmware programs, a merged logic circuit and / or other suitable components that support the described functions. In an optional example, those skilled in the art can understand that the device 1000 can be specifically the transmitting end in the above-mentioned embodiment, and can be used to execute the various processes and / or steps corresponding to the transmitting end in the above-mentioned method embodiment, or the device 2000 can be specifically the receiving end in the above-mentioned embodiment, and can be used to execute the various processes and / or steps corresponding to the receiving end in the above-mentioned method embodiment. To avoid repetition, it will not be repeated here.

[0418] The apparatus 1000 of each of the above-mentioned schemes has the function of implementing the corresponding steps executed by the transmitting end in the above-mentioned method, or the apparatus 1000 of each of the above-mentioned schemes has the function of implementing the corresponding steps executed by the receiving end in the above-mentioned method. The functions can be implemented by hardware, or can be implemented by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above-mentioned functions; for example, the transceiver unit can be replaced by a transceiver (for example, the sending unit in the transceiver unit can be replaced by a transmitter, and the receiving unit in the transceiver unit can be replaced by a receiver), and other units, such as the processing unit, can be replaced by a processor, respectively performing the transceiver operations and related processing operations in each method embodiment.

[0419] In addition, the transceiver unit may also be a transceiver circuit (for example, it may include a receiving circuit and a sending circuit), and the processing unit may be a processing circuit. Figure 8 The device in the embodiment may be a receiving end or a transmitting end in the foregoing embodiment, or may be a chip or a chip system, such as a system on chip (SoC). The transceiver unit may be an input / output circuit or a communication interface. The processing unit may be a processor or a microprocessor or an integrated circuit integrated on the chip. This is not limited here.

[0420] Fig. 9 2 is a schematic diagram of the structure of the communication device 2000 provided in the embodiment of the present application. Fig. 9 As shown, the device 2000 includes a processor 2010 and a transceiver 2020. The processor 2010 and the transceiver 2020 communicate with each other through an internal connection path, and the processor 2010 is used to execute instructions to control the transceiver 2020 to send signals and / or receive signals.

[0421] Optionally, the device 2000 may further include a memory 2030, and the memory 2030 communicates with the processor 2010 and the transceiver 2020 through an internal connection path. The memory 2030 is used to store instructions, and the processor 2010 may execute the instructions stored in the memory 2030.

[0422] In a possible implementation manner, the device 2000 is used to implement various processes and steps corresponding to the home network element in the above method embodiment.

[0423] In another possible implementation manner, the device 2000 is used to implement various processes and steps corresponding to the first mobility management function network element in the above method embodiment.

[0424] It should be understood that the device 2000 can be specifically the transmitting end or receiving end in the above embodiment, or a chip or a chip system. Correspondingly, the transceiver 2020 can be a transceiver circuit of the chip, which is not limited here. Specifically, the device 2000 can be used to execute each step and / or process corresponding to the transmitting end or receiving end in the above method embodiment.

[0425] Optionally, the memory 2030 may include a read-only memory and a random access memory, and provide instructions and data to the processor. A portion of the memory may also include a non-volatile random access memory. For example, the memory may also store information about the device type. The processor 2010 may be used to execute instructions stored in the memory, and when the processor 2010 executes instructions stored in the memory, the processor 2010 is used to execute the various steps and / or processes of the above-mentioned method embodiment corresponding to the transmitting end or the receiving end.

[0426] In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in a processor or an instruction in the form of software. The steps of the method disclosed in conjunction with the embodiment of the present application can be directly embodied as a hardware processor for execution, or a combination of hardware and software modules in a processor for execution. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in a memory, and the processor reads the information in the memory and completes the steps of the above method in conjunction with its hardware. To avoid repetition, it is not described in detail here.

[0427] It should be noted that the processor in the embodiment of the present application can be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method embodiment can be completed by an integrated logic circuit of hardware in the processor or an instruction in the form of software. The above processor can be a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component. The processor in the embodiment of the present application can implement or execute the methods, steps and logic block diagrams disclosed in the embodiment of the present application. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiment of the present application can be directly embodied as a hardware decoding processor to perform, or the hardware and software modules in the decoding processor can be combined to perform. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0428] It is understood that the memory in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static random access memory, dynamic random access memory, synchronous dynamic random access memory, double data rate synchronous dynamic random access memory, enhanced synchronous dynamic random access memory, synchronously connected dynamic random access memory, and direct memory bus random access memory. It should be noted that the memory of the system and method described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0429] Fig.10 3 is a schematic diagram of the structure of a chip system 3000 provided in an embodiment of the present application. Fig.10 As shown, the chip system 3000 (or may also be called a processing system) includes a logic circuit 3010 and an input / output interface (input / output interface) 3020 .

[0430] Among them, the logic circuit 3010 can be a processing circuit in the chip system 3000. The logic circuit 3010 can be coupled to the storage unit and call the instructions in the storage unit so that the chip system 3000 can implement the methods and functions of each embodiment of the present application. The input / output interface 3020 can be an input / output circuit in the chip system 3000, outputting information processed by the chip system 3000, or inputting data or signaling information to be processed into the chip system 3000 for processing.

[0431] As a solution, the chip system 3000 is used to implement the operations performed by the home network element in each of the above method embodiments.

[0432] As a solution, the chip system 3000 is used to implement the operations performed by the first mobility management function network element in the above method embodiments.

[0433] An embodiment of the present application also provides a computer-readable storage medium on which computer instructions for implementing the methods executed by the home network element and the first mobility management function network element in the above-mentioned method embodiments are stored.

[0434] An embodiment of the present application also provides a computer program product, comprising computer program code or instructions. When the computer program code or instructions are executed on a computer, the computer implements the methods executed by the home network element and the first mobility management function network element in the above-mentioned method embodiments.

[0435] An embodiment of the present application also provides a communication system, including the aforementioned home network element and a first mobility management function network element.

[0436] The explanation of the relevant contents and beneficial effects of any of the above-mentioned devices can be referred to the corresponding method embodiments provided above, which will not be repeated here.

[0437] In order to facilitate understanding of the above embodiments provided in this application, the following points are explained:

[0438] 1) In this application, unless otherwise specified or there is a logical conflict, the terms and / or descriptions between different embodiments are consistent and can be referenced to each other, and the technical features in different embodiments can be combined to form new embodiments according to their internal logical relationships.

[0439] 2) In this application, "at least one" means one or more, and "more than one" means two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. In the text description of this application, the character " / " generally indicates that the associated objects before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b and c can mean: a, or b, or c, or a and b, or a and c, or b and c, or a, b and c. Where a, b and c can be single or multiple, respectively.

[0440] 3) In the present application, "first", "second" and various numerical numbers (e.g., #1, #2, etc.) indicate distinctions made for ease of description and are not used to limit the scope of the embodiments of the present application. For example, to distinguish between different messages, etc., rather than to describe a specific order or sequence. It should be understood that the objects described in this way can be interchanged where appropriate so as to be able to describe solutions other than the embodiments of the present application.

[0441] 4) In this application, descriptions such as "when...", "in the case of..." and "if" all mean that the device will take corresponding actions under certain objective circumstances. They do not limit the time, nor do they require the device to make judgments when implementing them, nor do they mean that there are other limitations.

[0442] 5) In this application, "used for indication" may include being used for direct indication and being used for indirect indication. When describing that a certain indication information is used for indicating A, it may include that the indication information directly indicates A or indirectly indicates A, but it does not mean that the indication information must carry A.

[0443] The indication method involved in the embodiments of the present application should be understood to include various methods that can enable the party to be indicated to know the information to be indicated. The information to be indicated can be sent as a whole or divided into multiple sub-information and sent separately, and the sending period and / or sending time of these sub-information can be the same or different. The present application does not limit the specific sending method.

[0444] The "indication information" in the embodiments of the present application may be an explicit indication, i.e., directly indicated by signaling, or obtained by combining other rules or other parameters or by deduction according to the parameters indicated by the signaling. It may also be an implicit indication, i.e., obtained by combining other rules or other parameters or by deduction according to a rule or relationship. The present application does not make any specific limitation on this.

[0445] 6) In this application, "protocol" may refer to a standard protocol in the field of communications, such as 5G protocol, NR protocol, and related protocols used in future communication systems, which are not limited in this application. "Predefined" may include pre-definition. For example, protocol definition. "Preconfiguration" may be implemented by pre-saving corresponding codes, tables, or other methods that can be used to indicate relevant information in the device, and this application does not limit its specific implementation method.

[0446] 7) In this application, "communication" may also be described as "data transmission", "information transmission", "data processing", etc. "Transmission" includes "sending" and "receiving".

[0447] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0448] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0449] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the explicit or discussed mutual coupling or direct coupling or communication connection can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0450] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0451] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0452] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes various media that can store program codes, such as USB flash drives, mobile hard disks, read-only memories, random access memories, magnetic disks or optical disks.

[0453] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A communication method, characterized in that: include: When the terminal device registers with the network through the first mobility management function network element and the second mobility management function network element respectively, storing the identifier of the first mobility management function network element and the identifier of the second mobility management function network element; In the case where it is determined that the terminal device needs to be primary authenticated, sending a first authentication notification message to the first mobility management function network element, where the first authentication notification message is used to request triggering primary authentication of the terminal device; Receiving a first authentication response message from the first mobility management function network element, where the first authentication response message is used to indicate that the first mobility management function network element cannot initiate primary authentication for the terminal device; In response to the first authentication response message, sending a second authentication notification message to the second mobility management function network element, where the second authentication notification message is used to request triggering a primary authentication of the terminal device; Receiving a second authentication response message from the second mobility management function network element; When it is determined based on the second authentication response message that the second mobility management function network element can initiate the primary authentication of the terminal, a first notification message is sent to the first mobility management function network element, and the first notification message is used to instruct the first mobility management function network element to cancel the first suspension flag, and the first suspension flag is used to indicate the need to trigger the primary authentication of the terminal device.

2. The method according to claim 1, characterized in that The first authentication response message includes a first cause value, and the first cause value is used to indicate that the first mobility management function network element cannot initiate primary authentication for the terminal device.

3. The method according to claim 1 or 2, characterized in that: The method further comprises: In response to the first authentication response message, setting a first authentication suspension flag, where the first authentication suspension flag is used to indicate that the first suspension flag is set on the first mobility management function network element; The sending of a first notification message to the first mobility management function network element includes: According to the first authentication suspension flag, the first notification message is sent to the first mobility management function network element.

4. The method according to claim 3, characterized in that After sending the first notification message to the first mobility management function network element, the method further includes: Delete the first authentication suspension flag.

5. The method according to claim 1 or 2, characterized in that: The sending a second authentication notification message to the second mobility management function network element in response to the first authentication response message includes: In response to the first authentication response message, a second authentication notification message is sent to the second mobility management function network element according to the identifier of the second mobility management function network element.

6. The method according to any one of claims 1 to 5, characterized in that The method further comprises: Under the condition that any one of the following conditions is met, determining that the second mobility management function network element can initiate primary authentication for the terminal; The second authentication response message carries a response message to the second authentication notification message; or, The second authentication response message does not carry a second cause value, and the second cause value is used to indicate that the second mobility management function network element cannot initiate the primary authentication of the terminal device.

7. The method according to any one of claims 1 to 6, characterized in that When it is determined that the primary authentication for the terminal device cannot be started according to the second authentication response message, and the third mobility management function network element subsequently starts the primary authentication for the terminal, performing any of the following operations on the fourth mobility management function network element: Notify the fourth mobility function network element to cancel the suspension flag; or, rejecting the primary authentication request initiated by the fourth mobility function network element; The third mobility management function network element is one of the first mobility management function network element and the second mobility management function network element, and the fourth mobility management function network element is the other one of the first mobility management function network element and the second mobility management function network element except the third mobility management function network element.

8. The method according to claim 7, characterized in that The method further comprises: Receiving a first request message triggered by the third mobility management function network element, where the first request message is used to request primary authentication of the terminal device, and the first request message includes a second service network name, where the second service network name is used to indicate a service network where the third mobility management function network element is located; According to the second service network name, it is determined that the operation needs to be performed on the fourth mobility management function network element.

9. The method according to claim 8, characterized in that The determining, according to the second service network name, that the operation needs to be performed on the fourth mobility management function network element includes: determining, according to the second service network name, and the stored identifier of the first mobility management function network element and the identifier of the second mobility management function network element, that the operation needs to be performed on the fourth mobility management function network element; or, According to the name of the second service network, and the set first authentication suspension flag and second authentication suspension flag, it is determined that the operation needs to be performed on the fourth mobility management function network element, wherein the first authentication suspension flag is used to indicate that the first suspension flag is set on the first mobility management function network element, and the second authentication suspension flag is used to indicate that the second suspension flag is set on the second mobility management function network element, and the second suspension flag is used to indicate that it is necessary to trigger the main authentication of the terminal device.

10. The method according to claim 8 or 9, characterized in that: Before determining that the operation needs to be performed on the fourth mobility management function network element, the method further includes: Determining to perform primary authentication on the terminal device; Sending an authentication vector to the third mobility management function network element, where the authentication vector is used to perform primary authentication on the terminal device; Receiving an authentication result for the terminal device; The determining that the fourth mobility management function network element is required includes: When the authentication result indicates that the authentication of the terminal device is successful, it is determined that the operation needs to be performed on the fourth mobility management function network element.

11. The method according to claim 10, characterized in that Before receiving the first request message triggered by the third mobility management function network element, the method further includes: In the case of determining that the first mobility function network element and the second mobility function network element are unable to initiate primary authentication of the terminal device, setting the first authentication suspension flag and the second authentication suspension flag; The determining to perform primary authentication on the terminal device includes: According to the first authentication suspension flag and the second authentication suspension flag stored, it is determined to perform a primary authentication on the terminal device.

12. The method according to any one of claims 8 to 11, characterized in that Before determining, according to the second service network name, that the operation needs to be performed on the fourth mobility management function network element, the method further includes: determining, according to the second service network name and the stored correspondence between the second service network name and the third mobility management function network element, that the first request message is triggered by the third mobility management function network element; or, According to the identifier of the public land mobile network included in the second service network name and the stored correspondence between the identifier of the public land mobile network and the third mobility management function network element, it is determined that the first request message is triggered by the third mobility management function network element.

13. The method according to any one of claims 8 to 12, characterized in that Before determining, according to the second service network name, that the operation needs to be performed on the fourth mobility management function network element, the method further includes: Receive a second request message triggered by the fourth mobility management function network element, the second request message is used to request primary authentication of the terminal device, the second request message includes a third service network name, and the third service network name is used to indicate the service network where the fourth mobility management function network element is located.

14. A communication method, characterized in that: The method comprises: In the case where the terminal device registers with the network through the first mobility management function network element and the second mobility management function network element respectively, the home network element stores the identifier of the first mobility management function network element and the identifier of the second mobility management function network element; In the case where it is determined that the terminal device needs to be authenticated, the home network element sends a first authentication notification message to the first mobility management function network element, and the first mobility management function network element receives the first authentication notification message from the home network element, where the first authentication notification message is used to request triggering of the primary authentication of the terminal device; In the case of determining that the primary authentication for the terminal device cannot be started, the first mobility management function network element sends a first authentication response message to the home network element, and the home network element receives the first authentication response message from the first mobility management function network element, where the first authentication response message is used to indicate that the first mobility management function network element cannot start the primary authentication for the terminal device; In response to the first authentication response message, the home network element sends a second authentication notification message to the second mobility management function network element, and the second mobility management function network element receives the second authentication notification message from the home network element, where the second authentication notification message is used to request triggering a primary authentication of the terminal device; The home network element sends a second authentication response message to the second mobility management function network element, and the home network element receives the second authentication response message from the second mobility management function network element; In a case where it is determined according to the second authentication response message that the second mobility management function network element can initiate primary authentication for the terminal, the home network element sends a first notification message to the first mobility management function network element, and the first mobility management function network element receives the first notification message from the home network element, where the first notification message is used to instruct the first mobility management function network element to delete a first suspension flag, where the first suspension flag is used to indicate that primary authentication for the terminal device needs to be triggered; The first mobility management function network element deletes the first suspension flag according to the first notification message.

15. The method according to claim 14, characterized in that The first authentication response message includes a first cause value, and the first cause value is used to indicate that the first mobility management function network element cannot initiate primary authentication for the terminal device.

16. The method according to claim 14 or 15, characterized in that The method further comprises: In response to the first authentication response message, the home network element sets a first authentication suspension flag, where the first authentication suspension flag is used to indicate that the first suspension flag is set on the first mobility management function network element; The home network element sending a first notification message to the first mobility management function network element includes: The home network element sends the first notification message to the first mobility management function network element according to the first authentication suspension flag.

17. The method according to claim 16, characterized in that The method further comprises: When it is determined that the primary authentication of the terminal device by the second mobility management function network element is successful, the home network element deletes the first authentication suspension flag.

18. The method according to any one of claims 14 to 17, characterized in that When it is determined according to the second authentication response message that the primary authentication for the terminal cannot be started, and subsequently one of the first mobility management function network element and the second mobility management function network element starts the primary authentication for the terminal, the home network element performs any of the following operations on the other of the first mobility management function network element and the second mobility management function network element: The home network element notifies the other one of the first mobility management function network element and the second mobility management function network element to cancel the suspension flag; or, The home network element rejects a primary authentication request initiated by the other of the first mobility management function network element and the second mobility management function network element.

19. The method according to claim 18, characterized in that The method further comprises: The third mobility management function network element sends a first request message to the home network element, and the home network element receives the first request message triggered by the third mobility management function network element, where the first request message is used to request a primary authentication for the terminal device, and the first request message includes a second service network name, where the second service network name is used to indicate a service network where the third mobility management function network element is located; The home network element determines, according to the second service network name, that the operation needs to be performed on the fourth mobility management function network element.

20. The method according to claim 19, characterized in that The home network element determines, according to the second service network name, that the operation needs to be performed on the fourth mobility management function network element, including: The home network element determines, according to the second service network name, and the stored identifier of the first mobility management function network element and the identifier of the second mobility management function network element, that the operation needs to be performed on the fourth mobility management function network element; or, The hometown network element determines that the operation needs to be performed on the fourth mobility management function network element based on the second service network name, and the set first authentication suspension flag and second authentication suspension flag, wherein the first authentication suspension flag is used to indicate that the first suspension flag is set on the first mobility management function network element, the second authentication suspension flag is used to indicate that the second suspension flag is set on the second mobility management function network element, and the second suspension flag is used to indicate that it is necessary to trigger the main authentication of the terminal device.

21. The method according to claim 19 or 20, characterized in that Before determining that the operation needs to be performed on the fourth mobility management function network element, the method further includes: The home network element determines to perform primary authentication on the terminal device; The home network element sends an authentication vector to the third mobility management function network element, and the third mobility management function network element receives the authentication vector from the home network element, where the authentication vector is used to perform primary authentication on the terminal device; The third mobility management function network element sends an authentication result for the terminal device to the home network element, and the home network element receives the authentication result for the terminal device from the third mobility management function network element; The determining that the fourth mobility management function network element is required includes: In a case where the authentication result indicates that the primary authentication of the terminal device is successful, the home network element determines that the operation needs to be performed on the fourth mobility management function network element.

22. The method according to claim 20, characterized in that Before the home network element receives the first request message triggered by the third mobility management function network element, the method further includes: In the case of determining that the first mobility function network element and the second mobility function network element are unable to initiate primary authentication for the terminal device, the home network element sets the first authentication suspension flag and the second authentication suspension flag; The home network element determines to perform primary authentication on the terminal device, including: The home network element determines to perform primary authentication on the terminal device according to the first authentication suspension flag and the second authentication suspension flag stored therein.

23. The method according to any one of claims 19 to 22, characterized in that Before the home network element determines, according to the second service network name, that the operation needs to be performed on the fourth mobility management function network element, the method further includes: The home network element determines that the triggering of the first request message comes from the third mobility management function network element according to the second service network name and the stored correspondence between the second service network name and the third mobility management function network element; or, The home network element determines that the triggering of the first request message comes from the third mobility management function network element according to the identifier of the public land mobile network included in the second service network name and the correspondence between the saved identifier of the public land mobile network and the third mobility management function network element.

24. The method according to any one of claims 19 to 23, characterized in that Before the home network element determines, according to the second service network name, that the operation needs to be performed on the fourth mobility management function network element, the method further includes: The home network element receives a second request message from the fourth mobility management function network element, where the second request message is used to request primary authentication of the terminal device, and the second request message includes a third service network name, where the third service network name is used to indicate the service network where the fourth mobility management function network element is located.

25. A communication device, characterized in that: include: One or more functional modules, wherein the one or more functional modules are used to execute the method according to any one of claims 1 to 13.

26. A communication device, characterized in that: include: a processor coupled to the memory; The processor is configured to execute the computer program stored in the memory, so that the apparatus performs the method according to any one of claims 1 to 13.

27. A computer-readable storage medium, characterized in that: include: The computer-readable storage medium stores a computer program, and when the computer program is executed on a computer, the computer is caused to execute the method according to any one of claims 1 to 13.

Images