Communication method and communication device

Abstract

The invention provides a communication method and a communication device, which are applied to a scene that terminal equipment (such as IoT (Internet of Things) equipment) is accessed to 5GC through user equipment (such as UE) or the user equipment is accessed to 5GC. After user equipment is registered to 5GC, in the process that the user equipment triggers session establishment or session updating, the method comprises the following steps: receiving an NAS request message from the user equipment, acquiring user identity information according to the NAS request message, and establishing or updating the session according to the user identity information. Wherein the user identity information is used for indicating a user of the user equipment. According to the technical scheme, the user identity information is authenticated, so that the terminal equipment or the user equipment is supported to access the 5GC, that is, the connection service and the service control provided by the 5GC are obtained, and the possible potential network security risk is avoided or reduced.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of communications, and more specifically, to a communication method and a communication device. Background Art

[0002] In the communication system, for example, the fifth-generation (5G) mobile communication network not only supports user equipment (UE) to access the 5G core network (5G core, 5GC) through the wireless technology defined by the third generation partnership project (3GPP), but also supports UE to access the 5GC through non-3GPP access technology. Among them, the UE is a terminal device that supports the subscriber identity module (SIM) card and the non-access stratum (NAS) signaling module. For example, after the UE establishes a communication connection with the cellular wireless network, the UE sends NAS signaling to the control plane network element of the 5GC, and the control plane network element performs security authentication on the UE based on the authentication vector in the NAS signaling. For the UE that has been successfully authenticated, the registration process from the UE to the 5GC is completed based on the NAS signaling. The 5GC can generate context information for the UE, perform mobility management on the UE, and provide network connection services and business control.

[0003] With the development of mobile networks, 5GC has evolved from being oriented to consumers (2C) to being oriented to businesses (2B), and can be used in scenarios such as parks, factories, and museums. However, the Internet of Things (IoT) devices in 2B scenarios cannot access 5GC because they do not support cellular access technology, do not have SIM cards, and do not have NAS signaling modules. As a result, mobile operators are unable to provide connection services and business management for IoT devices based on 5GC. Summary of the invention

[0004] The present application provides a communication method and a communication device, in which a core network element establishes or updates a session according to user identity information, so that a terminal device or user equipment can obtain connection services and business management provided by the network based on the session.

[0005] In a first aspect, a communication method is provided, which can be executed by a core network element, or can also be executed by a chip or circuit of the core network element, which is not limited in the present application. For ease of description, the following description is given by taking the execution by the core network element as an example.

[0006] The method comprises: receiving a NAS request message from a user device, the NAS message being used to request to establish a session or update a session; acquiring user identity information according to the NAS request message, the user identity information being used to indicate a user of the user device; and establishing or updating a session according to the user identity information.

[0007] It should be understood that the method is applied to the process in which the user equipment triggers the establishment of a session or the update of a session after the user equipment registers with the core network. That is, the session is triggered to be established or updated based on the user identity information, and the core network element can determine whether the establishment or update of the session is successful by verifying the user identity information.

[0008] Exemplarily, the user of the user device includes: the user of the user device is the user of the user device, and the user identity information is the user identity information of the user of the user device; or, the terminal device is in communication connection with the user device, the user of the user device is the user of the terminal device, and the user identity information is the user identity information of the user of the terminal device. The terminal device is a terminal device that supports non-3GPP access technology and does not support NAS signaling. In other words, the terminal device may not have cellular access capability, does not support NAS signaling, and does not support SIM cards.

[0009] It should be noted that the communication connection between the terminal device and the user device can be understood as: the user turns on the wifi hotspot function of the user device, assuming that the access point identifier of the above wifi hotspot is A, this access point identifier A can be the identification information set at the user granularity, such as the access point identifier set by the user at will, or it can also be the identification information set at the 2B service granularity, such as using the company name as the access point identifier. The terminal device (such as a laptop, iPad and other devices) scans the available wifi hotspots, and selects the wifi hotspot with the access point identifier A, and initiates the connection process to the above wifi hotspot, that is, the terminal device and the user device complete the establishment of the layer 2 (layer 2, L2) connection. The specific implementation method of the connection process can refer to the existing protocol.

[0010] Exemplarily, the terminal device may be an IoT device (such as a laptop computer), and the user device may be a UE (such as a mobile phone). For ease of description and distinction, the embodiments of the present application use terminal devices and user devices to represent IoT devices and UEs, respectively. The difference between the two is that the user device supports cellular access technology, SIM card and NAS signaling module, while the IoT device does not support cellular access technology, supports non-3GPP access technology, does not support SIM card, and does not have a NAS signaling module. Among them, non-3GPP access technology includes wireless local area network (WLAN) access technology, Bluetooth access technology, wired access technology, fixed network access technology, or short-distance access technology.

[0011] Optionally, the NAS request message may be an uplink non access stratum transport (UL NAS transport) message or a protocol data unit (PDU) session establishment / update request message. For example, the NAS request message sent by the UE and received by the access and mobility management function (AMF) may be a UL NAS transport message, and the UL NAS transport message may include a session establishment / update request message (for example, PDU session establishment / modification request). The AMF continues to send the session establishment / update request message to the session management function (SMF), and the SMF is responsible for managing the establishment, modification and release of the PDU session.

[0012] Optionally, when the UL NAS transport message contains user identity information, AMF obtains the user identity information from the above UL NAS transport message, and then AMF continues to send the user identity information to SMF through the interface between SMF. Alternatively, the PDU session establishment / update request message contains user identity information, AMF continues to forward the PDU session establishment / update request message to SMF through the interface between SMF, and SMF obtains the user identity information from the PDU session establishment / update request message.

[0013] Exemplarily, the NAS request message includes a data network name (DNN) and slice information.

[0014] Furthermore, the NAS request message may also include identification information of the user device and / or user identity information (User ID). It should be understood that the user identity information is used to indicate the user using the terminal device, and the user identity information is different from the identification information of the terminal device. Among them, the identification information of the terminal device may be an identity document (ID) of the device, or it may be the address information of the device, such as an Internet protocol (IP) address or a media access control (MAC) address, or it may be other forms of expression used to identify the terminal device. The user identity information may be the identity information of the user to whom the terminal device belongs, or it may be the identification information of the user (or the identity information of the user using the IoT device), such as the employee's work number, or the user name, or the user ID number, or it may be other forms of expression used to identify the user using the terminal device. In other words, the user identity information is used to identify the user, indicating "person", while the identification information of the terminal device is used to identify the device.

[0015] Optionally, user identity information (User ID) can be restricted to terminal devices (IoT devices, or devices without 5GC access capabilities), or it can be unrestricted to terminal devices. For example, when a user logs in to an application (APP) on a user device (mobile phone), the user ID is used, and 5GC can also determine whether to allow the user to use this APP based on the user ID. Therefore, user identity information can be used on devices that do not support 5GC (non 5GC capabledevice) (such as IoT devices) or on devices that support 5GC (5GC capabledevice) (such as UE), and this application does not impose any restrictions on this.

[0016] That is to say, the technical solution of the present application can be applicable to a scenario in which a terminal device (IoT device) requests to access 5GC by connecting to a user device, and 5GC determines whether to establish or update a session corresponding to the user identity information by authenticating the user identity information of the terminal device, that is, whether the terminal device is allowed to access 5GC. Alternatively, it can also be applicable to a scenario in which a user device requests to access 5GC by carrying user identity information, and 5GC determines whether to establish or update a session corresponding to the user identity information by authenticating the user identity information of the user device, that is, whether the user device is allowed to access 5GC.

[0017] In the embodiment of the present application, for the scenario where the terminal device (IoT device) accesses the core network (such as 5GC) through the user device (such as UE), the user identity information (User ID) of the terminal device is authenticated to determine whether the terminal device is allowed to access the core network, that is, whether the core network supports providing network access services and business management and control to the terminal device. In addition, by authenticating the user identity information, compared with authenticating the terminal device, the security is higher, and verifying the user identity information can prevent illegal users from accessing the core network, or prevent illegal users from maliciously attacking the core network, or enable the core network to clearly know which services are used by which users, which is convenient for business management and control, and avoids or reduces potential security risks.

[0018] Optionally, the core network element sends a NAS response message to the user equipment, and the NAS response message is used to indicate that the session establishment or update is successful. Exemplarily, the session establishment / update process may include: the user equipment sends an Uplink NAS transport message to the AMF, carrying a PDU session establishment / modification request message, and the AMF forwards the PDU session establishment / modification request to the SMF. Among them, the Uplink NAS transport message carries the DNN and slice information. The AMF selects the SMF and sends the DNN and slice information to the SMF. The SMF is responsible for managing the establishment, modification, maintenance and release of the PDU session of the terminal device. The specific implementation method can refer to the existing protocol. Furthermore, the terminal device or user equipment can interact with the data network through the session.

[0019] In combination with the first aspect, in certain implementations of the first aspect, obtaining user identity information according to a NAS request message includes: receiving user identity information from a data network-authentication, authorization, and accounting (DN-AAA) server according to the NAS request message; or, receiving user identity information from a user device according to the NAS request message.

[0020] In combination with the first aspect, in certain implementations of the first aspect, the NAS request message includes a data network name, and the method further includes: sending a first authentication message (e.g., EAP-Request / Identity) to a user device based on the data network name, the first authentication message being used to request authentication of a terminal device or a user device; and receiving a first authentication response message (e.g., EAP-Response / Identity) from the user device, the first authentication response message including user identity information.

[0021] Among them, receiving user identity information from the DN-AAA server according to the NAS request message includes: determining the address of the DN-AAA server according to the data network name; sending a second authentication message to the DN-AAA server according to the address of the DN-AAA server, the second authentication message includes a first authentication response message, and the second authentication message is used to request authentication of the user identity information; when the user identity information authentication is successful, receiving a first message from the DN-AAA server, the first message includes the user identity information and the second message, and the second message is used to indicate that the user identity information authentication is successful.

[0022] Exemplarily, the implementation method in which the above-mentioned core network network element determines the address of the DN-AAA server according to the data network name can be that the core network network element obtains the DN-AAA server address from the DNN-related contract data, wherein the DNN-related contract data can be obtained from the unified data management function (UDM) or the policy control function (PCF), or the core network element obtains the DN-AAA server address from the UE, which is not limited in this application.

[0023] It should be noted that this application does not restrict the message names such as the first authentication message, the second authentication message, the first authentication response message, etc.

[0024] Exemplarily, before the SMF sends the second authentication message to the DN-AAA server, the SMF obtains the user identity information from the NAS request message, or the SMF obtains the user identity information from the message sent by the AMF, and then the SMF generates a first authentication response message including the above user identity information, and sends it to the DN-AAA via the second authentication message including the first authentication response message. Alternatively, the SMF sends the first authentication message to the user equipment, and the user equipment replies to the first authentication response message, and carries the user identity information in the above first authentication response message. The SMF continues to forward the first authentication response message carrying the user identity information to the DN-AAA via the second authentication message.

[0025] Optionally, the above-mentioned NAS request message may not include the data network name. In this case, after receiving the NAS request message, the AMF or SMF can determine the contract data of the user device and / or the contract data of the user identity information based on the identification information of the user device and / or the user identity information carried in the NAS request message, and then obtain the default data network name in the NAS request message from the contract data of the user device or the contract data of the user identity information. Then, the AMF or SMF can trigger the authentication process for the user device or terminal device based on the data network name.

[0026] Among them, the contract data of the user equipment or the contract data of the user identity information can be configured by the core network management system to the policy control function network element or the unified data management function network element, or sent by the application function network element to the policy control function network element or the unified data management function network element through the network open function network element. Then the core network network element can query the policy control function network element or the unified data management function network element by carrying the identification information and / or user identity information of the user equipment to obtain the contract data of the user equipment or the contract data of the user identity information.

[0027] Based on the above solution, the core network element can trigger the authentication process for the terminal device based on the NAS request message, and request the DN-AAA server to authenticate the user identity information after receiving the authentication response. In other words, the core network element will obtain the user identity information from the DN-AAA server only when the authentication of the user identity information is passed, and then the terminal device can access the core network, which is more secure and can avoid or reduce potential network security risks.

[0028] In combination with the first aspect, in certain implementations of the first aspect, the first message further includes one or more of the following: an IP address of the session, a user level, a quality of service (QoS) parameter, or a second indication information, the QoS parameter indicates a QoS control parameter for a service data flow of the session, the second indication information is used to indicate statistics on a service flow or data flow of the session, and the user level is used to indicate a service level for the user. The method further includes: the core network element determines the policy information corresponding to the user identity information according to the user level and / or the QoS parameter. The policy information may be a QoS policy, including at least one of the maximum bandwidth of the service, the guaranteed bandwidth of the service, the delay, the packet loss rate, and the flow rate, for example, reporting the number of packet losses to the core network every T1 time period, and the core network detecting the duration, flow rate, bandwidth, and other information statistics used by the terminal device to access the target website every T2 time period.

[0029] Optionally, the core network network element can determine the session used by the terminal device or user equipment to access the core network based on the IP address of the session carried in the first message. Subsequently, the terminal device or user equipment can access the core network based on the IP address and obtain services provided by the core network.

[0030] Optionally, the core network network element may determine to perform statistics on the service flow or data flow after the terminal device or user device accesses the core network based on the second indication information carried in the first message. For example, after the terminal device or user device accesses the core network, the core network element may perform statistics on one or more web pages or applications logged in by the terminal device or user device, as well as information such as the duration or traffic of using the web pages or applications. This also facilitates the core network side to perform real-time and accurate resource scheduling and allocation for the terminal device or user device, thereby ensuring network transmission bandwidth, reducing network transmission delay, and improving the utilization rate of network resources.

[0031] Based on the above solution, core network elements can independently determine policy information and accurately schedule and allocate resources for terminal devices in real time, thereby ensuring network transmission bandwidth, reducing network transmission delay, and improving the utilization of network resources.

[0032] In combination with the first aspect, in certain implementations of the first aspect, a request message is sent to a policy control function network element or a unified data management function network element, where the request message is used to request policy information corresponding to user identity information, and the request message includes the user identity information; policy information is received from the policy control function network element or the unified data management function network element, where the policy information is determined based on the user level and / or QoS parameters corresponding to the user identity information.

[0033] Based on the above solution, the core network elements can obtain policy information from the policy control function elements or the unified data management function elements, which can be used for subsequent resource scheduling and allocation for terminal devices, etc., to ensure network transmission bandwidth, reduce network transmission delay, and improve the utilization rate of network resources.

[0034] In combination with the first aspect, in some implementations of the first aspect, an IP address of the session is obtained; and the user identity information and the IP address are sent to the DN-AAA server.

[0035] Based on the above solution, the DN-AAA server can allocate an IP address for the user identity information and send it to the core network element; or the core network element or user plane function (UPF) can allocate an IP address for the user identity information. It should be understood that an IP address usually represents a unique address used to identify a device on the Internet or a local network.

[0036] In combination with the first aspect, in some implementations of the first aspect, the user identity information is carried in the NAS request message.

[0037] Exemplarily, the user device, as an authenticator, sends an EAP-Request / Identity message to the terminal device to request authentication of the terminal device; correspondingly, the terminal device parses the EAP-Request / Identity message and replies with an EAP-Response / Identity message to the user device. The EAP-Response / Identity message carries the user identity information User ID. Further, the user device triggers the initiation of a session establishment / update process for the terminal device based on the user identity information.

[0038] In combination with the first aspect, in certain implementations of the first aspect, establishing or updating a session based on user identity information includes: obtaining contract data of a user device or contract data of the user identity information based on the user identity information; establishing or updating a session based on the contract data of the user device or the contract data of the user identity information.

[0039] Optionally, the contract data of the user equipment or the contract data of the user identity information can be configured by the core network management system to the policy control function network element or the unified data management function network element, or sent by the application function network element to the policy control function network element or the unified data management function network element through the network open function network element. Then the core network network element can obtain the contract data of the user equipment or the contract data of the user identity information by querying the policy control function network element or the unified data management function network element.

[0040] In combination with the first aspect, in certain implementations of the first aspect, the subscription data of the user device includes a user identity information list and / or third indication information, the user identity information list contains at least one user identity information, the at least one user identity information is used to indicate at least one user identity information allowed to be accessed by the user device, and the third indication information is used to indicate that any user identity information is allowed to access the core network from the user device.

[0041] Among them, establishing or updating a session according to the subscription data of the user device includes: establishing or updating a session when the user identity information is included in the user identity information list, or when the subscription data of the user device includes the third indication information; or sending a NAS response message to the user device when the user identity information is not included in the user identity information list and the subscription data of the user device does not include the third indication information, the NAS response message is used to indicate that the session establishment failed or the update failed. Optionally, the NAS response message may carry a failure reason value to indicate that the user identity information is not included in the user identity information list and the subscription data of the user device does not include the third indication information, that is, the core network element refuses to establish or update the session corresponding to the user identity information, and then the user device or terminal device cannot access 5GC, and cannot obtain the connection service and business control provided by 5GC.

[0042] Based on the above scheme, the core network network element determines whether to establish or update a session by judging whether the user identity information is included in the user identity information list, or by judging whether the subscription data of the user device contains the third indication information, so that subsequent terminal devices or user devices can access the core network while ensuring network security.

[0043] In combination with the first aspect, in certain implementations of the first aspect, the subscription data of the user identity information includes a user device identifier list and / or first indication information, the user device identifier list includes at least one user device identifier, the at least one user device identifier is used to indicate at least one user device that the user identity information is allowed to access, and the first indication information is used to indicate that the user identity information is allowed to access the core network from any user device.

[0044] Among them, establishing or updating a session according to the contract data of the user identity information includes: establishing or updating a session when the identifier of the user device is included in the user device identifier list, or when the contract data of the user identity information includes the first indication information; or sending a NAS response message to the user device when the identifier of the user device is not included in the user device identifier list and the contract data of the user identity information does not include the first indication information, the NAS response message is used to indicate that the session establishment failed or the update failed. Optionally, the NAS response message may carry a failure reason value, and the failure reason value is used to indicate that the identifier of the user device is not included in the user device identifier list and the contract data of the user identity information does not include the first indication information, that is, the core network element refuses to establish or update the session corresponding to the user identity information, and then the user device or terminal device cannot access 5GC, and cannot obtain the connection service and business control provided by 5GC.

[0045] Based on the above scheme, the core network network element determines whether to establish or update a session by judging whether the user device identifier is included in the user device identifier list, or by judging whether the contract data of the user identity information contains the first indication information, so that subsequent user devices or terminal devices can access the core network while ensuring network security.

[0046] In a second aspect, a communication method is provided, which may be executed by a user equipment, or may be executed by a chip or circuit of the user equipment, which is not limited in the present application. For ease of description, the following description is given by taking the user equipment as an example.

[0047] The method comprises: acquiring user identity information, the user identity information is used to indicate the user of the user equipment; sending a NAS request message to a core network element based on the user identity information, the NAS request message is used to request to establish a session or update a session.

[0048] Optionally, the NAS request message includes user identity information.

[0049] It should be understood that the method is applied to the process in which the user equipment triggers the establishment of a session or the update of a session after the user equipment registers with the core network. That is, the session is triggered to be established or updated based on the user identity information, and the core network element can determine whether the establishment or update of the session is successful by verifying the user identity information.

[0050] According to the solution provided by the present application, for the scenario where the terminal device (IoT device) accesses the core network (such as 5GC) through the user device (such as UE), the user identity information (User ID) of the terminal device is authenticated to determine whether the terminal device is allowed to access the core network, that is, whether the core network supports providing network access services and business management and control to the terminal device. In addition, by authenticating the user identity information, compared with authenticating the terminal device, the security is higher, and verifying the user identity information can prevent illegal users from accessing the core network, or prevent illegal users from maliciously attacking the core network, or enable the core network to clearly know which user uses which services, which is convenient for business management and control, and avoids or reduces potential security risks.

[0051] In combination with the second aspect, in certain implementations of the second aspect, the user device obtains user identity information, including: obtaining user identity information of a user of the user device, where the user of the user device is the user of the user device, and the user identity information is the user identity information of the user of the user device; or, when the user device establishes a communication connection with a terminal device, obtaining the user identity information from the terminal device, where the user of the user device is the user of the terminal device, and the user identity information is the user identity information of the user of the terminal device, and the terminal device is a terminal device that supports non-3GPP access technology and does not support NAS signaling.

[0052] In combination with the second aspect, in certain implementations of the second aspect, obtaining user identity information includes: sending a request message to a terminal device, the request message is used to request obtaining user identity information; receiving a response message from the terminal device, the response message includes user identity information, and the user identity information is used to indicate a user using the terminal device.

[0053] In combination with the second aspect, in certain implementations of the second aspect, before the user equipment triggers the establishment or update of a session, the method also includes: receiving a routing selection policy from a core network element, the routing selection policy including an access point identifier and / or user identity information, the access point identifier being used to indicate an access point name provided by the user equipment.

[0054] In combination with the second aspect, in some implementations of the second aspect, sending a NAS request message to a core network network element based on user identity information includes: when the access point used by the terminal device to communicate with the user equipment is the same as the access point indicated by the access point identifier included in the routing selection policy, sending a NAS request message to the core network network element; and / or, when the user identity information obtained by the user equipment is the same as the user identity information included in the routing selection policy, sending a NAS request message to the core network network element.

[0055] In combination with the second aspect, in certain implementations of the second aspect, the routing selection strategy also includes indication information, and sending an NSA request message to a core network element based on user identity information, including: when the indication information is used to instruct the terminal device to establish a communication connection with the user device from an access point corresponding to the access point identifier, or the indication information is used to indicate when obtaining user identity information, a NAS request message is sent to the core network element.

[0056] Optionally, when different terminal devices access from access points in the routing selection strategy, the user equipment initiates different session establishment / update request processes. Alternatively, when the user equipment obtains different user identity information, the user equipment initiates different session establishment / update request processes.

[0057] The beneficial effects of the above-mentioned second aspect and some implementation methods of the second aspect can be referred to the relevant description of the first aspect, which will not be repeated here.

[0058] In a third aspect, a communication device is provided, comprising: a transceiver unit, used to receive a NAS request message from a user device, the NAS request message being used to request establishment of a session or update of a session; a processing unit, used to obtain user identity information according to the NAS request message, the user identity information being used to indicate a user of the user device; the processing unit is also used to establish or update a session according to the user identity information.

[0059] The transceiver unit can perform the reception and transmission processing in the aforementioned first aspect, and the processing unit can perform other processing except reception and transmission in the aforementioned first aspect.

[0060] In a fourth aspect, a communication device is provided, which includes: a transceiver unit for obtaining user identity information, where the user identity information is used to indicate a user of a user device; the transceiver unit is also used to send a NAS request message to a core network element based on the user identity information, where the NAS request message is used to request to establish a session or update a session.

[0061] The transceiver unit can perform the reception and transmission processing in the aforementioned second aspect, and the processing unit can perform other processing except reception and transmission in the aforementioned second aspect.

[0062] In a fifth aspect, a communication device is provided, comprising a processor, the processor being coupled to a memory, the memory being used to store a computer program, and the processor being used to call and run the computer program from the memory, so that the device executes the method in the above-mentioned first aspect or second aspect and any possible implementation thereof.

[0063] Optionally, the number of the processors is one or more, and the number of the memories is one or more.

[0064] Optionally, the memory may be integrated with the processor, or the memory may be provided separately from the processor.

[0065] Optionally, the communication device also includes a transceiver.

[0066] In a sixth aspect, a communication system is provided, comprising: a core network element, the core network element being used to execute the method in the above-mentioned first aspect and any possible implementation manner thereof.

[0067] Optionally, the communication system further includes a user device, and the user device is used to execute the method in the above-mentioned second aspect and any possible implementation manner thereof.

[0068] Optionally, the communication system further includes a unified data management function network element, a policy control function network element, an access and mobility management function network element, a session management function network element, a data network-authentication and billing server, or a terminal device.

[0069] In the seventh aspect, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores a computer program or code, and when the computer program or code is run on a computer, the computer executes the method in the above-mentioned first aspect or second aspect and any possible implementation manner thereof.

[0070] In an eighth aspect, a chip is provided, comprising at least one processor, wherein the at least one processor is coupled to a memory, the memory being used to store a computer program, and the processor being used to call and run the computer program from the memory, so that a device equipped with the chip system executes the method in the above-mentioned first aspect or second aspect and any possible implementation thereof.

[0071] The chip may include an input circuit or interface for sending information or data, and an output circuit or interface for receiving information or data.

[0072] In a ninth aspect, a computer program product is provided, the computer program product comprising: a computer program code, when the computer program code is run on the computer, the method in the above-mentioned first aspect or second aspect and any possible implementation manner thereof is executed. BRIEF DESCRIPTION OF THE DRAWINGS

[0073] Figures 1 to 3 It is a schematic diagram of the structure of the network architecture applicable to this application.

[0074] Figure 4 It is a flow chart of the communication method 400 provided in an embodiment of the present application.

[0075] Figure 5 It is a flow chart of the communication method 500 provided in an embodiment of the present application.

[0076] Figure 6 It is a flow chart of the communication method 600 provided in an embodiment of the present application.

[0077] Figure 7 It is a flow chart of the communication method 700 provided in an embodiment of the present application.

[0078] Figure 8 It is a schematic diagram of the structure of the communication device 1000 provided in an embodiment of the present application.

[0079] Fig. 9 It is a structural diagram of the communication device 2000 provided in an embodiment of the present application.

[0080] Fig.10 It is a schematic diagram of the structure of the chip system 3000 provided in an embodiment of the present application. DETAILED DESCRIPTION

[0081] The technical solution in this application will be described below in conjunction with the accompanying drawings.

[0082] The technical solution provided in this application can be applied to various communication systems, such as: new radio (NR) system, long term evolution (LTE) system, LTE frequency division duplex (FDD) system, LTE time division duplex (TDD) system, etc. The technical solution provided in this application can also be applied to device to device (D2D) communication, vehicle to everything (V2X) communication, machine to machine (M2M) communication, machine type communication (MTC), and Internet of things (IoT) communication system or other communication systems.

[0083] In the communication system, the part operated by the operator can be called a public land mobile network (PLMN), or an operator network, etc. PLMN is a network established and operated by the government or an operator approved by it for the purpose of providing land mobile communication services to the public. It is mainly a public network in which mobile network operators (MNO) provide mobile broadband access services to users. The PLMN described in the embodiments of the present application may specifically be a network that meets the requirements of the 3GPP standard, referred to as a 3GPP network. 3GPP networks generally include but are not limited to 5G networks, fourth-generation mobile communication (4th-generation, 4G) networks, and other future communication systems, such as sixth-generation mobile communication (6th-generation, 6G) networks, etc.

[0084] For ease of description, the embodiments of the present application will be described using PLMN or 5G network as an example.

[0085] Figure 11 is a schematic diagram of a network architecture 100 applicable to the present application, taking the 5G network architecture based on service-based architecture (SBA) in a non-roaming scenario defined in the 3GPP standardization process as an example. Figure 1 As shown, the network architecture may include a terminal device part, a data network (DN) part and an operator network PLMN part. The operator network PLMN part may include but is not limited to a (radio) access network ((R)AN) 120 and a core network (CN) part.

[0086] The functions of each network element are briefly described below.

[0087] The terminal equipment part may include UE 110, which is a device that provides voice and / or data connectivity to users. UE 110 in the present application is a device with wireless transceiver functions, which can communicate with one or more core network (CN) devices via access network equipment (or also referred to as access equipment) in (radio) access network (R) AN120. UE 110 may also be referred to as access terminal, terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, user agent or user device, etc. UE 110 may be deployed on land, including indoors or outdoors, handheld or vehicle-mounted; it may also be deployed on the water (such as ships, etc.); it may also be deployed in the air (such as airplanes, balloons and satellites, etc.). UE 110 may be a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a smart phone, a mobile phone, a wireless local loop (WLL) station, a personal digital assistant (PDA), etc. Alternatively, UE 110 may also be a handheld device with wireless communication function, a computing device or other device connected to a wireless modem, a vehicle-mounted device, a wearable device, a drone device or an Internet of Things, a terminal in the Internet of Vehicles, a 5G network and any form of terminal in the future network, a relay user device or a terminal in the future evolved 6G network, etc. Among them, the relay user device may be, for example, a 5G residential gateway (RG). The embodiment of the present application does not limit the type or type of UE, etc. For ease of description and distinction, the embodiment of the present application uses terminal devices and user devices to represent two types of terminals, wherein the terminal device may be a desktop computer, a printer, a portable notebook, etc. commonly used in corporate offices, which may be collectively referred to as an IoT device (or terminal device), and the user device may be the UE 110 described above. The difference between the two is that the user device supports cellular access technology, has a SIM card and a NAS signaling module, while the IoT device does not support cellular access technology, does not support a SIM card, does not have a NAS signaling module, and supports non-3GPP access technology. Among them, non-3GPP access technologies include WLAN access technology, Bluetooth access technology, wired access technology, fixed network access technology, or short-distance access technology.

[0088] (R)AN 120 may include one or more access network elements or access network devices, and the interface between the access network device and the terminal device may be a Uu interface (or air interface, that is, the messages exchanged between the access network device and the terminal device may be called air interface messages). Of course, in future communications, the interface name may remain unchanged or may be replaced by other names, and this application is not limited to this. (R)AN 120 is a device that provides wireless communication functions for UE 110, and can connect the terminal device to a node or device of a wireless network, and may also be called a network device. (R)AN 120 can be regarded as a subnetwork of the operator network, and is an implementation system between a service node in the operator network and UE 110. For example, UE 110 can connect to a service node of the operator network through (R)AN 120 to obtain services provided by the service node. (R)AN 120 includes, but is not limited to, next generation node base station (gNB) in 5G system, evolved node B (eNB) in LTE, radio network controller (RNC), node B (NB), base station controller (BSC), base transceiver station (BTS), home base station (e.g., home evolved node B, or home node B, HNB), base band unit (BBU), transmission point (TRP), transmitting point (TP), small base station equipment, mobile switching center, or network equipment in future networks, etc. The access network equipment may also be a module or unit that performs the functions of a base station, such as a centralized unit (CU) and a distributed unit (DU); for example, the CU may be used to support communications under protocols such as radio resource control (RRC), packet data convergence protocol (PDCP), and service data adaptation protocol (SDAP); the DU may be used to support communications under radio link control (RLC) layer protocols, MAC layer protocols, and physical layer protocols. The embodiments of the present application do not limit the specific technology and specific device form used by the access network equipment.In systems using different wireless access technologies, the names of devices having access network device functions may be different. For ease of description, in all embodiments of the present application, the above-mentioned devices providing wireless communication functions for UE 110 are collectively referred to as access network devices or RAN for short.

[0089] The CN part may include but is not limited to the following network functions (NF): user plane function UPF130, network exposure function (NEF) 131, network function repository function (NRF) 132, policy control function PCF133, unified data management function UDM134, unified data repository function (UDR) 135, application function (AF) 136, authentication server function (AUSF) 137, access and mobility management function AMF138, session management function SMF139.

[0090] The data network DN 140, also known as a packet data network (PDN), is usually a network outside the operator's network, such as a third-party network or an Internet service. For ease of description, the embodiment of the present application uses the network in DN 140 for providing authentication, certification, and billing services, and the wired network includes fixed home network access, etc. The network side architecture is similar to the non-trusted non-3GPP access architecture. The non-trusted non-3GPP access gateway (e.g. Figure 2 The N3IWF shown in the figure is replaced by a trusted non-3GPP gateway function (TNGF) or a wired access gateway function (W-AGF). The access network equipment between the UE and the above access gateway includes: a wireless access point (WLAN access point, WLAN AP), a fixed access network device (fixed access network, FAN), a switch, or a router, etc.

[0091] That is to say, N3G access technologies include trusted WLAN access, untrusted WLAN access, or wired access. Whether it is trusted Non-3GPP access or untrusted Non-3GPP access, 5GC can Figure 2The interface protocol shown is point-to-point, or Figure 1 The 3GPP access core network architecture shown consistently adopts service-oriented interfaces.

[0092] In summary, 5GC not only supports UE access to 5GC through 3GPP-defined wireless technologies (such as LTE, 5G RAN, etc.), but also supports UE access to 5GC through non-3GPP access technologies (such as N3IWF or next generation packet datagateway (ngPDG)).

[0093] Figure 3 It is a schematic diagram of another network architecture 300 using the present application. The application scenario of the present application can be an enterprise campus 2B scenario, where the enterprise campus is covered by a network deployed by a mobile operator. The types of terminal devices in the enterprise campus are very different from those in the 2C scenario. For example, the terminal devices commonly used in corporate offices are desktop computers, printers, portable notebooks, etc., which can be collectively referred to as IoT devices. In addition, the enterprise campus also includes a DN-AAA server and 5GC, where the control plane network elements of the 5GC include AUSF, UDM, PCF, AMF and SMF, etc. For specific network element introductions, please refer to Figure 1 Related description. Exemplarily, the IoT device can access the 5GC through the WLAN hotspot provided by the mobile phone (such as user 1), for example, user 1 or user 2 logs in to the IoT device, and the IoT device accesses the AMF in the 5GC through the WLAN hotspot provided by the mobile phone used by user 1. For another example, user 3 logs in to the IoT device, and the IoT device establishes a communication connection with the gNB through the WLAN hotspot provided by the mobile phone used by user 1, and accesses the UPF, SMF or DN-AAA in the 5GC; or, the IoT device can access the 5GC through the WLAN or wired access technology provided by the 5G customer premises equipment (CPE), for example, user 4 logs in to the IoT device, and the IoT device accesses the UPF, SMF or DN-AAA in the 5GC through the WLAN hotspot provided by the 5G CPE. Among them, the 5G CPE can be deployed indoors (such as an employee office), and the IoT device can be connected through a WLAN interface or a wired interface, and the two can also establish a communication connection through wireless access technology. It should be understood that CPE is a mobile signal access device that receives mobile signals and forwards them as wireless wifi numbers. It is usually located at the customer's premises and can be a telephone or other service.

[0094] Considering that the UE in the consumer 2C scenario is currently supported to access 5GC, the UE is a terminal device that supports SIM card and NAS signaling module, such as a smart phone. With the development of mobile networks, enterprise 2B scenarios can also be gradually deployed by mobile operators. Unlike UE, IoT devices in enterprises generally support WLAN access technology or Bluetooth access technology. Since IoT devices do not support cellular access, do not have SIM cards, and do not have NAS signaling modules, IoT devices cannot access 5GC based on existing solutions, that is, mobile operators cannot provide connection services to IoT devices based on 5GC. In addition, 5GC's authentication of UE is based on the UE authentication vector, which is carried in the SIM card of the UE. As a terminal device without a SIM card, the IoT device cannot authenticate the IoT device itself when the IoT device accesses the network. Instead, it needs to authenticate the user using the IoT device. In other words, the attributes of the IoT device are not a factor in determining whether it can access 5GC. For example, when an enterprise employee uses a laptop to access the enterprise campus network, no matter which laptop the employee uses, as long as he is a legitimate user of the enterprise, the authentication should be successful. Therefore, in the scenario where IoT devices access 5GC, the network side needs to authenticate the users who use the IoT devices, rather than the IoT devices themselves, to prevent illegal users from accessing the network or maliciously attacking the network, thereby ensuring the security of network use.

[0095] In view of this, an embodiment of the present application provides a communication method and device, which authenticates the user identity information of a terminal device (or user device) to determine whether to establish or update a session associated with the user identity information, thereby avoiding or reducing potential security risks.

[0096] The communication method provided by the embodiment of the present application will be described in detail below with reference to the accompanying drawings. The embodiment provided by the present application can be applied to any communication scenario in which a transmitting device and a receiving device communicate, for example, it can be applied to the above Figures 1 to 3 In order to realize the communication between the core network element and the communication device in the RAN service-oriented architecture, the present application proposes the following Figures 4 to 7 The method shown should be understood as follows. Figures 4 to 7 The method embodiments shown can be combined with each other. Figures 4 to 7 The steps in the method embodiments shown can refer to each other. For example, in the embodiments of the present application, Figures 5 to 7 The method embodiment shown can be regarded as implementing Figure 4 A possible implementation of the functions of the method embodiment shown, wherein Figure 5 This section mainly describes the authentication and authorization process of sending user identity information from the DN-AAA server to the core network element. Figure 6Mainly based on the extension of NAS messages, the user equipment of the terminal device sends user identity information to the core network element for authentication. In addition, Figure 7 This section mainly describes how user equipment uses user identity information to access the core network.

[0097] Figure 4 4 is a flow chart of a communication method 400 provided in an embodiment of the present application. Figure 4 As shown, the method flow can be executed by a terminal device, a user device, a core network element, and a data network-authentication and billing server, or by a module and / or device (e.g., a chip or an integrated circuit, etc.) with corresponding functions installed in the terminal device, the user device, the core network element, and the data network-authentication and billing server, and the present application does not limit it. For the convenience of description, the following description is based on the terminal device, the user device, the core network element, and the data network-authentication and billing server as the execution subject. The method includes the following multiple steps, and the part not described in detail can refer to the existing protocol.

[0098] S410: The user equipment obtains user identity information, where the user identity information is used to indicate a user of the user equipment.

[0099] It should be understood that the user of the user device includes: the user of the user device is the user of the user device, and the user identity information is the user identity information of the user of the user device; or the terminal device is connected to the user device in communication, the user of the user device is the user of the terminal device, and the user identity information is the user identity information of the user of the terminal device. The terminal device is a terminal device that supports non-3GPP access technology and does not support NAS signaling. In other words, the terminal device may not have cellular access capability, does not support NAS, and does not support SIM cards.

[0100] Exemplarily, the terminal device may be an IoT device (such as a personal computer (PC)), and the user equipment may be a UE (such as a mobile phone). The difference between the two is that the user equipment supports cellular access, SIM card and NAS signaling module, while the terminal device does not support cellular access, SIM card and NAS signaling module. In other words, the terminal device is a terminal device that does not support SIM card and NAS signaling module when accessing the core network through 3GPP technology. It should be understood that the terminal device supports non3GPP access technology, and non 3GPP access technology includes WLAN access technology, Bluetooth access technology, wired access technology, fixed network access technology, or short-distance access technology.

[0101] In one example, a user device sends a request message to a terminal device, such as an EAP request message (such as an EAP-identity request message), where the request message is used to obtain user identity information; correspondingly, the user device receives a reply message from the terminal device, where the reply message includes the user identity information, and the user identity information is used to indicate a user using the terminal device.

[0102] In another example, the user device locally obtains user identity information, where the user identity information is used to indicate a user using the user device.

[0103] S420, the user equipment sends a NAS request message to the core network element based on the user identity information, and correspondingly, the core network element receives the NAS request message from the user equipment. The NAS message is used to request to establish a session or update a session.

[0104] It should be understood that the session is triggered to be established or updated based on the user identity information. Whether the establishment or update of the session is successful is determined by verifying the user identity information. In the embodiment of the present application, if the session is established or updated unsuccessfully, the terminal device cannot access the 5GC.

[0105] Exemplarily, the NAS request message includes the data network name DNN and slice information.

[0106] It should be understood that the NAS request message also includes identification information of the user device and / or user identity information (User ID). It should be understood that the user identity information is used to indicate the user using the terminal device, and the user identity information is different from the identification information of the terminal device. Among them, the identification information of the terminal device can be a device ID, or it can also be the address information of the device, such as an IP address or a MAC address, or it can also be other forms of expression for identifying the terminal device. The user identity information can be the identity information of the user to whom the terminal device belongs, or it can also be the identification information of the user (or the identity information of the user using the IoT device), such as an employee's work number, or a user name, or a user ID number, etc., or it can also be other forms of expression for identifying the user using the terminal device. In other words, the user identity information is used to identify the user, indicating a "person", while the identification information of the terminal device is used to identify the device.

[0107] Optionally, the NAS request message may be a UL NAS transport message or a PDU session establishment / modification request message. For example, the NAS request message received by the AMF from the user equipment may be a UL NAS transport message, which includes a session establishment / modification request message (PDU session establishment / modification request). The AMF then sends the session establishment / modification request message to the SMF, which is responsible for managing the establishment, modification and release of the PDU session.

[0108] Optionally, when the UL NAS transport message contains user identity information, AMF obtains the user identity information from the above UL NAS transport message, and then AMF continues to send the user identity information to SMF through the interface between SMF. Alternatively, the PDU session establishment / update request message contains user identity information, AMF continues to forward the PDU session establishment / update request message to SMF through the interface between SMF, and SMF obtains the user identity information from the PDU session establishment / update request message.

[0109] Exemplarily, the PDU session establishment / update process includes: the user equipment sends an Uplink NAS transport message to the AMF, carrying a PDU session establishment / modification request message, and the AMF forwards the PDU session establishment / modification request to the SMF. Among them, the Uplink NAS transport message carries DNN and slice information. The AMF selects SMF and sends DNN and slice information to the SMF. The SMF is responsible for managing the establishment, modification, maintenance and release of the PDU session of the terminal device. The specific implementation method can refer to the existing protocol. Furthermore, the terminal device or user equipment can communicate with the core network element based on the PDU session to obtain the connection service provided by the core network.

[0110] Optionally, user identity information (User ID) can be restricted to terminal devices (IoT devices, or devices without 5GC access capabilities), or it can be unrestricted to terminal devices. For example, when a user logs in to an APP on a user device (mobile phone), the user ID is used, and 5GC can also determine whether to allow the user to use this APP based on the user ID. Therefore, user identity information can be used on devices that do not support 5GC (non 5GC capable device) (such as IoT devices) or on devices that support 5GC (5GC capable device) (such as UE), and this application does not impose any restrictions on this.

[0111] That is to say, the technical solution of the present application can be applicable to a scenario in which a terminal device (IoT device) requests access to 5GC through a user device, and 5GC determines whether to establish or update a session corresponding to the user identity information by authenticating the user identity information of the terminal device, that is, whether the terminal device is allowed to access 5GC. Alternatively, it can also be applicable to a scenario in which a user device requests access to 5GC by carrying user identity information, and 5GC determines whether to establish or update a session corresponding to the user identity information by authenticating the user identity information of the user device, that is, whether the user device is allowed to access 5GC.

[0112] Before executing step S410, the method 400 may further include S401 and S402.

[0113] S401, user equipment registers to the core network.

[0114] Exemplarily, the user equipment sends an N1 message to the AMF to request registration to the 5GC. For example, the N1 message is a registration request message, carrying the Subscription Concealed Identifier (SUCI) or the 5G Globally Unique Temporary Identifier (5G-GUTI) of the user equipment. Correspondingly, the AMF initiates identity authentication to the user equipment, for example, using the 5G Authentication and Key Agreement (5G-AKA) authentication method or the Extensible Authentication Protocol-Authentication and Key Agreement (EAP-AKA') authentication method. Only when the authentication of the user equipment is passed, can the user equipment complete the registration process. For the specific implementation method, please refer to the existing protocol.

[0115] It should be noted that after the user equipment is registered with 5GC, the user equipment can obtain the user equipment's route selection policy (URSP) from the core network element. For example, the PCF sends the URSP policy to the AMF, and then the AMF sends the URSP policy to the user equipment through a NAS message. Furthermore, the user equipment can use the URSP to determine the path through which its data traffic is sent. For example, the user equipment can select an existing session connected to a data network (DN) to send its data traffic through the URSP rules, or it can send its data traffic by establishing a new session in a specific network slice.

[0116] Exemplarily, the URSP policy includes an access point identifier and / or user identity information. The access point identifier is used to indicate the access point provided by the user equipment. For example, the access point identifier can be at least one of a service set identifier (SSID), a homogeneous extended service set identifier (HESSID), and a basic service set identifier (BSSID). Optionally, the present application does not limit the number and specific form of the access point identifier and / or user identity information carried in the URSP policy.

[0117] Optionally, the URSP policy also includes indication information #1, which is used to indicate that when the terminal device accesses the access point represented by the above-mentioned access point identifier, the user device establishes / updates an independent PDU session for the terminal device. Alternatively, indication information #1 is used to indicate that the user device establishes / updates a PDU session for the terminal device corresponding to the user identity information (for example, indicating a user using the terminal device, or a user logging into the terminal device using the user identity information). It should be noted that when the URSP policy does not include indication information #1, the access point identifier or user identity information can be used as indication information #1. At this time, the access point identifier or user identity information includes the function of indication information #1 in addition to its own meaning.

[0118] Optionally, when different terminal devices access from the access point in the URSP policy, the user device initiates different session establishment / update request processes. Alternatively, when the user device obtains different user identity information, the user device initiates different session establishment / update request processes. For example, when initiating different session establishment / update request processes, the user device carries different terminal device identifiers in different session establishment / update request messages, and / or carries different DNN or slice information in session establishment requests for different terminal devices, and / or carries different session identifiers in session establishment / update requests for different terminal devices, so as to ensure a one-to-one correspondence between different terminal devices and different sessions.

[0119] S402, optionally, the terminal device is connected to the user device for communication.

[0120] Exemplarily, the user turns on the wifi hotspot function of the user device. Assuming that the access point identifier of the above wifi hotspot is A, this access point identifier A can be the identifier information set at the user granularity, such as the access point identifier set by the user at will, or it can also be the identifier information set at the 2B service granularity, such as using the company name as the access point identifier. The terminal device (such as a PC, a laptop, an ipad, etc.) scans the available wifi hotspots, and selects the wifi hotspot with the access point identifier A, and initiates the connection process to the above wifi hotspot. The specific implementation method can refer to the existing protocol, that is, the terminal device and the user device complete the establishment of the L2 connection.

[0121] Next, a specific implementation manner of the user equipment sending a NAS request message to a core network element in the above step S420 is described.

[0122] Exemplarily, after the user equipment establishes an L2 connection with the terminal device, the user equipment sends a NAS request message to a core network element according to a URSP policy.

[0123] In one implementation, when the access point used by the terminal device to communicate with the user device matches the access point indicated by the access point identifier included in the URSP policy, the user device sends a NAS request message to the core network element. For example, the terminal device uses a wifi hotspot with an access point identifier A to connect to the user device, and the access point identifier A is included in the URSP policy, then the user device triggers the establishment / update of a PDU session for the terminal device.

[0124] In another implementation, the user device acts as an authenticator to send an EAP-Request / Identity message to the terminal device to request authentication of the terminal device; correspondingly, the EAP-Response / Identity message is received from the terminal device. When the user identity information carried in the EAP-Response / Identity message matches the user identity information included in the URSP policy, the user device sends a NAS request message to the core network element. For example, if the EAP-Response / Identity message carries user identity information #1, and the user identity information #1 is included in the URSP policy, the user device triggers the establishment / update of a PDU session for the terminal device. In other words, when the user device passes the authentication of the terminal device, the user device sends a NAS request message to the core network element.

[0125] In yet another implementation, the user equipment triggers establishment / update of a PDU session for the terminal device according to indication information #1 carried in the URSP policy.

[0126] Optionally, the user device may save the L2 connection between the user device and the terminal device, and the correspondence between the PDU session initiated by the user device for the terminal device, and / or the user device may save the correspondence between the terminal device and the PDU session. For example, the user device allocates a PDU session ID for this PDU session, and the user device may store the correspondence between the L2 connection and the PDU session ID. The L2 connection between the user device and the terminal device may be a MAC address identifier of the terminal device or an L2 identifier of the terminal device, that is, the user device may store the correspondence between the MAC address of the terminal device and the PDU session ID, or the correspondence between the L2 identifier of the terminal device and the PDU session ID.

[0127] S430, the core network element obtains the user identity information according to the NAS request message.

[0128] Method 1:

[0129] Exemplarily, the core network element receives user identity information from the user equipment according to the NAS request message. For example, the user identity information is carried in the NAS request message in step S420.

[0130] For example, after executing step S402, the user equipment sends an EAP-Request / Identity message to the terminal equipment as an authenticator to request authentication of the terminal equipment; correspondingly, the terminal equipment parses the EAP-Request / Identity message and replies with an EAP-Response / Identity message to the user equipment. The EAP-Response / Identity message carries the user identity information User ID. Furthermore, the user equipment triggers the initiation of a session establishment / update process for the terminal equipment based on the user identity information User ID and the URSP policy. For example, the UE sends a ULNAS transport message to the AMF, and the UL NAS transport message carries a PDU session establishment request message, wherein the UL NAS transport and / or PDU session establishment request message carry the User ID. Correspondingly, after obtaining the UL NAS transport message, the AMF continues to forward the PDU session establishment request message to the SMF, that is, the core network element obtains the User ID of the terminal device.

[0131] Method 2:

[0132] Exemplarily, the core network element receives user identity information from the DN-AAA server according to the NAS request message.

[0133] Optionally, the NAS request message may be a UL NAS transport message or a PDU session establishment / update request message. For example, the AMF receives a UL NAS transport message sent by the user equipment, and the UL NAS transport message may carry a PDU session establishment / modification request message. The AMF sends the PDU session establishment / modification request message to the SMF, and the SMF is responsible for managing the establishment, modification and release of the PDU session.

[0134] First, in response to the NAS request message received from the user equipment, the core network element triggers the authentication process for the terminal device according to the DNN carried in the NAS request message. That is, the core network element sends a NAS message to the user equipment, and the NAS message carries an EAP-Request / Identity message for requesting authentication of the terminal device.

[0135] For example, SMF first sends the EAP-Request / Identity message to AMF, and then AMF encapsulates the EAP-Request / Identity message in a NAS message and sends it to the user device. Correspondingly, the user device receives and parses the NAS message to obtain the EAP-request / identify message, and then the user device can determine that the PDU session is established / updated for the terminal device based on the correspondence between the locally stored L2 connection and the PDU session, or the correspondence between the terminal device and the PDU session (for example, the correspondence between the MAC address of the terminal device and the PDU session ID), and the PDU session information (for example, PDU sessionID) carried in the NAS message, and then forwards the parsed EAP-request / identify message to the terminal device according to the MAC address of the terminal device. For example, the user device can send the EAP-Request / Identity through the L2 connection established between it and the terminal device, or the user device can also send the EAP-Request / Identify based on the WLAN air interface between the user device and the terminal device. Correspondingly, after parsing the EAP-Request / Identity message, the terminal device replies to the user device with an EAP-Response / Identity message, which carries the user identity information User ID. Correspondingly, the user device encapsulates the received EAP-Response / Identity message in a NAS message, and sends the NAS message to the core network element, and the EAP-Response / Identity message carries the User ID. For example, the user device sends a NAS message to the AMF, carrying the EAP-Request / Identity message, and the AMF then forwards the EAP-Request / Identity message to the SMF. It should be understood that the EAP-Response / Identity message can be understood as being sent by the terminal device to the core network element through the user device, that is, the EAP-Response / Identity message is transparently transmitted to the core network element through the user device, and the user device does not parse the EAP-Response / Identity message, and is therefore unaware of the user identity information carried in the EAP-Response / Identity message.

[0136] Further, after receiving the EAP-Response / Identity message, the core network element determines the address of the DN-AAA server based on the DNN carried in the NAS request message in step S420, and then sends an authentication message to the DN-AAA server, carrying the user identity information, for requesting the DN-AAA server to perform an authentication process with the terminal device based on the identity information. After parsing the authentication message, the DN-AAA server obtains the corresponding context information based on the user identity information, and then performs the authentication process with the terminal device to determine whether to establish or update the session.

[0137] For example, SMF sends an authentication and authorization message to the DN-AAA server through the interface between SMF and DN-AAA, carrying the above-received EAP-Response / Identity message. Alternatively, SMF sends the authentication and authorization message to UPF, and UPF forwards the authentication and authorization message to the DN-AAA server, which is not limited in this application. In addition, the authentication and authorization message may also include identification information of the user device, such as the GPSI identifier of the user device, or the SUPI identifier of the user device. Optionally, the address of the DN-AAA server may be obtained from the contract data of the DNN by the core network element, or it may be obtained from the user device, which is not limited in this application. Correspondingly, the DN-AAA server parses the authentication and authorization message to obtain the identification information of the user device and the User ID contained in the EAP-Response / Identity. DN-AAA searches for the corresponding context information based on the User ID, and performs the authentication and authorization process based on the User ID and its user password to determine whether to establish or update the session. For example, DN-AAA interacts with the terminal device to obtain the user password corresponding to the User ID, and inquires whether the User ID and its user password match the context information of the User ID. If they match, it can be determined to establish or update the session, and send the user identity information to the core network element; otherwise, the session establishment / update request is rejected, and the access service is refused to the terminal device or user device. The specific implementation method of the authentication process can refer to the existing protocol.

[0138] Exemplarily, the context information of the User ID (or the User ID signing data) includes one or more of the following:

[0139] 1) User ID

[0140] Exemplarily, the user identity information is used to indicate the user who uses the terminal device, or in other words, the user identity information is the identity information of the user to whom the terminal device belongs, or it can also be the identification information of the user, such as the employee's work number, or user name, or user ID number, etc. It should be understood that the user identity information is used to identify the user, indicating "person", rather than to identify the device.

[0141] 2) User password (password)

[0142] For example, user passwords are usually used together with user identity information to ensure the confidentiality of information. The security authentication function of the password is used to achieve the authenticity of information, the integrity of data and the non-repudiation of behavior, avoiding or reducing potential network security risks.

[0143] 3) User equipment identification list (e.g., allowed UE ID list)

[0144] Exemplarily, the user equipment identification list includes at least one user equipment identification, which is used to indicate the identification of the user equipment that is allowed to access by the user identity information.

[0145] 4) First indication information (e.g., any UE ID indication)

[0146] Exemplarily, the first indication information indicates that the user identity information can be accessed through any user equipment.

[0147] 5) User Level

[0148] Exemplarily, the user level is used to indicate the service level of the user, such as gold user, silver user, bronze user, etc.

[0149] 6)QoS parameters.

[0150] Exemplarily, the QoS parameter is used to represent the QoS parameter information of the data flow of this session, such as at least one of the parameters including the maximum bandwidth of the service, the guaranteed bandwidth of the service, the delay, and the packet loss rate.

[0151] Optionally, the above-mentioned NAS request message may not include the data network name. In this case, after receiving the NAS request message, the AMF or SMF can determine the subscription data of the user device and / or the subscription data of the user identity information based on the identification information of the user device and / or the user identity information carried in the NAS request message, and then obtain the default data network name in the NAS request message from the subscription data of the user device or the subscription data of the user identity information. Then, the AMF or SMF can trigger the authentication process for the user device or terminal device based on the data network name. The specific implementation method can refer to the relevant description above and will not be repeated here.

[0152] Exemplarily, the contract data of the user equipment or the contract data of the user identity information can be configured by the core network management system to the policy control function network element or the unified data management function network element, or sent by the application function network element to the policy control function network element or the unified data management function network element through the network open function network element. Then, the core network network element can query the policy control function network element or the unified data management function network element by carrying the identification information and / or user identity information of the user equipment to obtain the contract data of the user equipment or the contract data of the user identity information.

[0153] S440: The core network element establishes or updates a session according to the user identity information.

[0154] The following describes how the core network element and the DN-AAA server perform authentication on the user identity information of the terminal device to determine whether to establish or update a session.

[0155] Method 1:

[0156] Exemplarily, the core network element determines whether to establish or update a session based on the user identity information (User ID) in the NAS request message in S420 and the acquired subscription data of the user device or the subscription data of the user identity information. It should be understood that in the case of determining to establish or update a session, the user device or the terminal device can access the core network.

[0157] Optionally, the subscription data of the user equipment or the subscription data of the user identity information can be configured into the UDM or PCF by the core network management system, or sent by the AF to the UDM or PCF through the NEF. For example, the AMF sends a subscription request message to the UDM / PCF, carrying the identifier of the user equipment (e.g., UE ID) and / or User ID to obtain the subscription data of the user equipment or the subscription data of the user identity information.

[0158] Exemplarily, the subscription data of the user equipment (or the context information of the user equipment) includes one or more of the following: user identity information, user password, allowed User ID list (i.e., user identity information list), anyUser ID indication (i.e., third indication information), user level, and QoS parameters. Among them, the allowed User ID list contains at least one User ID, which is used to indicate the User ID information that this user equipment is allowed to access. The Any User ID indication is used to indicate that this user equipment allows any User ID to access. The interpretation of other parameters can be referred to the relevant description of the User ID subscription data above, which will not be explained here.

[0159] In one implementation, when the user identity information is included in the allowed User ID list, or the subscription data of the user device includes the any User ID indication, the core network element establishes or updates the session; or, when the user identity information is not included in the user identity information list, and the subscription data of the user device does not include the any User ID indication, the core network element may send a NAS response message to the user device, and the NAS response message is used to indicate that the session establishment failed or the update failed. Optionally, the NAS response message may carry a failure reason value, and the failure reason value is used to indicate that the user identity information is not included in the user identity information list and the subscription data of the user device does not include the any User ID indication, that is, the core network element refuses to establish or update the session corresponding to the User ID, that is, the terminal device or user equipment is not allowed to access the core network. For example, the allowed User ID list contains User ID#1 and User ID#2, indicating that User ID#1 and User ID#2 are allowed to access 5GC through the user device. If the User ID in the NAS request message is equal to User ID#1 or User ID#2, the SMF establishes or updates the session; if the User ID in the NAS request message is equal to UserID#3, the SMF determines that the terminal device is not allowed to access 5GC. Optionally, the SMF can send a rejection message to the user device, carrying a rejection reason value, to refuse to provide access services to the terminal device. For another example, if the subscription data of the user device contains the any User ID indication, indicating that any User ID is allowed to access 5GC through the user device, then as long as the NAS request message carries the User ID, the SMF can establish or update a session for the terminal device to access 5GC through the user device.

[0160] In another implementation, when the identifier of the user equipment is included in the allowed UE ID list, or the User ID subscription data includes the any UE ID indication, a session is established or updated; or, when the identifier of the user equipment is not included in the user equipment identifier list, and the User ID subscription data does not include the any User ID indication, the core network element may send a NAS response message to the user equipment, and the NAS response message is used to indicate that the session establishment failed or the update failed. Optionally, the NAS response message may carry a failure reason value, and the failure reason value is used to indicate that the identifier of the user equipment is not included in the user equipment identifier list and the User ID subscription data does not include the any User ID indication, that is, the core network element refuses to establish or update the session corresponding to the User ID, that is, the terminal device or user equipment is not allowed to access the core network. For example, the allowed UE ID list includes the identifier of user device 1 and the identifier of user device 2, indicating that the User ID is allowed to access 5GC through user device 1 or user device 2. If the identifier of the user device in the NAS request message is the same as the identifier of user device 1 or the identifier of user device 2, the SMF determines that the terminal device is allowed to access 5GC; if the identifier of the user device in the NAS request message is equal to the identifier of user device 3, the SMF determines that the terminal device is not allowed to access 5GC. Optionally, the SMF can send a rejection message to the user device, carrying a rejection reason value, to refuse to provide access services to the terminal device. For another example, if the User ID subscription data includes the any UE ID indication, indicating that the User ID is allowed to access 5GC through any user device, then as long as the NAS request message carries the identifier of the user device, the SMF can determine that the user device is allowed to access 5GC.

[0161] Method 2:

[0162] Exemplarily, the DN-AAA server searches for the contract data of the User ID based on the User ID, and determines whether to establish or update the session based on the contract data of the User ID, that is, determines whether to allow the user equipment or terminal equipment to access the core network network element. The specific implementation method can refer to the authentication process of the above-mentioned core network element.

[0163] It should be noted that the user authentication method can usually be based on the user name and user password. For example, the user name is the employee's work number and the user password is the login password set by the individual. For example, when an employee uses a PC to access the enterprise campus network, no matter which PC the employee uses, as long as he is a legitimate user of the enterprise, the authentication should be successful.

[0164] Further, for the terminal device that has passed the authentication of the user identity information, in response to the authentication and authorization message (i.e., the first message) received from the core network element, the DN-AAA server replies to the core network element with an authentication and authorization response message, which carries the user identity information and an EAP-Success message (i.e., the second message), to indicate that the authentication of the user identity information is successful. For example, the DN-AAA server sends the authentication and authorization message through the interface between the SMF and the DN-AAA server, or sends the authentication and authorization message to the SMF through the UPF.

[0165] Optionally, the authentication and authorization message may also include one or more of the following parameters: IP address; user level; QoS parameter; indication information #2 (i.e., second indication information). The indication information #2 is used to indicate statistics on the data flow or service flow of the session, such as at least one of traffic statistics, duration statistics, and statistics on target website visits. The interpretation of other parameters can be found in the relevant description above.

[0166] Optionally, the core network network element can determine the session used by the terminal device or user equipment to access the core network based on the IP address of the session carried in the first message. Subsequently, the terminal device or user equipment can access the core network based on the IP address and obtain services provided by the core network.

[0167] Optionally, the core network network element may determine to perform statistics on the service flow or data flow after the terminal device or user device accesses the core network based on the second indication information carried in the first message. For example, after the terminal device or user device accesses the core network, the core network element may perform statistics on one or more web pages or applications logged in by the terminal device or user device, as well as information such as the duration or traffic of using the web pages or applications. This also facilitates the core network side to perform real-time and accurate resource scheduling and allocation for the terminal device or user device, thereby ensuring network transmission bandwidth, reducing network transmission delay, and improving the utilization rate of network resources.

[0168] It should be noted that the above technical solution is described in the scenario that the terminal device requests to access 5GC through the user device, and 5GC determines whether to establish or update the session corresponding to the user identity information by authenticating the user identity information of the terminal device, that is, whether to allow the terminal device to access 5GC. Optionally, the present application is also applicable to the scenario that the user device requests to access 5GC by carrying the user identity information, and 5GC determines whether to establish or update the session corresponding to the user identity information by authenticating the user identity information of the user device, that is, whether to allow the user device to access 5GC. The specific implementation method can be referred to as method 700 below, which will not be described here. It should be understood that compared with the existing scheme of verifying the identity of the user device (such as UE ID) to determine whether the user device is allowed to access 5GC, authenticating the user identity information can be an additional verification based on the verification of the identity of the user device, which is more secure, and verifying the user identity information can prevent illegal users from using 5GC, or prevent illegal users from maliciously attacking the network, or can enable 5GC to clearly know which user uses which services, which is convenient for business management and control.

[0169] Optionally, when the user identity information authentication is passed, the method 400 further includes: the core network element obtains the IP address corresponding to the user identity information.

[0170] In one implementation, the IP address is carried in the authentication and authorization message sent by the DN-AAA to the core network element. That is, the DN-AAA server allocates an IP address for the user identity information and sends it to the core network element.

[0171] In another implementation, if the core network element does not receive the IP address assigned from the DN-AAA server, the core network element may assign an IP address for the user identity information, or the UPF may assign an IP address. The specific implementation method may refer to the existing protocol. Optionally, the SMF sends a notification message to the DN-AAA server, where the notification message carries the user identity information and the IP address. After the DN-AAA server resolves and obtains the IP address, it stores the IP address in the context information corresponding to the User ID. In other words, the core network element or the UPF assigns an IP address to the user identity information.

[0172] It should be understood that an IP address generally represents a unique address used to identify a device on the Internet or a local network, ie, a terminal device.

[0173] Optionally, when the user identity information authentication is passed, 5GC can perform differentiated management and control based on user attributes (i.e., user identity information (User ID) of the terminal device), or perform differentiated service QoS control based on different user levels. That is, the method 400 also includes: the core network element obtains policy information.

[0174] In one implementation, a core network element determines policy information corresponding to user identity information according to a user level and / or QoS parameter.

[0175] In another implementation, the core network element sends a request message to the PCF / UDM to request policy information corresponding to the user identity information, and the request message includes the user identity information; correspondingly, the PCF / UDM sends the policy information to the core network element. Optionally, the policy information is determined according to the user level and / or QoS parameters corresponding to the user identity information.

[0176] Among them, the policy information can be a QoS policy, including at least one of the maximum bandwidth of the service, the guaranteed bandwidth of the service, delay, packet loss rate, and traffic. For example, the number of packet losses is reported to the core network every T1 time period, and the core network detects the duration, traffic, bandwidth, and other information statistics used by the terminal device to access the target website every T2 time period, so as to facilitate real-time and accurate resource scheduling and allocation for the terminal device, ensure network transmission bandwidth, reduce network transmission delay, and improve network resource utilization. In addition, the specific implementation method of the core network element or PCF / UDM determining the policy information according to the user level and / or QoS parameters can refer to the existing protocol, and this application does not limit this.

[0177] Further optionally, when the user identity information authentication is passed, that is, after the core network element receives the EAP-Success message from the DN-AAA server, the core network element continues to execute the subsequent PDU session establishment / update process. For example, SMF sends a PDU session establishment / modification accept message to AMF, carrying an EAP-Success message. AMF can encapsulate the PDU session establishment / modification accept message in a DL NAS transport message and send it to the user device, and then the user device parses the DL NAS transport message and the PDU session establishment / modification accept message to obtain the EAP-Success message. Finally, based on the correspondence between the locally stored MAC address and the PDU session ID, and the PDU session ID carried in the DL NAS transport message or the PDU session establishment / modification accept message, the user device can determine that the PDU session is established / updated for the terminal device, and therefore forwards the EAP-Success message to the terminal device, and then the terminal device can request the core network to provide access services based on the EAP-Success message.

[0178] In the technical solution of the present application, for the scenario where a terminal device accesses 5GC through a user device, or a user device accesses 5GC, 5GC authenticates the user identity information of the terminal device or user device to determine whether to allow the terminal device or user device to access 5GC, that is, whether to provide network access services and business management to the terminal device or user device. In addition, authenticating the user identity information can avoid or reduce potential security risks.

[0179] Figure 5 is a flow chart of a communication method 500 provided in an embodiment of the present application. Figure 5 As shown, taking the terminal device as PC, the user equipment as UE, the core network element as AMF / SMF, the data network authentication and billing server as DN-AAA server, and the core network as 5GC as an example, the implementation method mainly involves the DN-AAA server to authenticate the User ID, and send the user identity information User ID to AMF / SMF if the authentication passes. The method includes the following steps, and the parts not described in detail can refer to the existing protocol. It should be understood that the above Figure 4The relevant description in the embodiment shown is also applicable to this implementation. Figure 4 and Figure 5 There may be the same or similar technical means between them. Figure 4 The contents already described in the illustrated embodiment will not be repeated here.

[0180] S501, UE registers to 5GC.

[0181] S502: The UE obtains the URSP policy of the UE.

[0182] Exemplarily, the UE may request the AMF to obtain the UE's URSP policy, and then the AMF may query the PCF to obtain the UE's URSP policy; alternatively, the PCF may pre-configure the URSP policy to the AMF, and then the AMF may send the URSP policy to the UE via a NAS message.

[0183] Among them, the URSP policy includes access point identification and / or user identity information, and the specific interpretation can be referred to the relevant description above. It should be understood that after the UE registers with the 5GC, the UE can obtain the UE's URSP from the AMF. Further, the UE can determine which path its data traffic is sent to the core network side based on the URSP policy. For example, the UE can select an existing session connected to a data network through the URSP policy to send its data traffic, or it can also send its data traffic by establishing a new session in a specific network slice.

[0184] S503: The PC establishes an L2 connection with the UE.

[0185] Among them, the URSP policy includes an access point identifier (such as specific-SSID) or a User ID. Optionally, the URSP policy also includes one or more of indication information #1, DNN, or slice information. The specific interpretation of the parameters can be found in the relevant description of 400 above.

[0186] The specific implementation of the above steps S501 to S503 may refer to the relevant description of the above steps S401 and S402.

[0187] S504, the UE sends a PDU session establishment / update request to the AMF / SMF, and correspondingly, the AMF / SMF receives the PDU session establishment / update request from the UE.

[0188] Among them, the PDU session establishment / update request carries DNN and slice information.

[0189] Exemplarily, the UE triggers a PDU session establishment / update process for the PC based on the URSP policy obtained in step S502. For example, when the UE determines that a new device (i.e., a PC) is connected to a wifi hotspot, and the access point identifier A of the wifi hotspot matches the access point identifier A included in the URSP policy in step S502, the UE initiates a PDU session establishment / update process for the PC. For specific implementation methods, refer to the relevant description of step S410 of the above method 400.

[0190] Optionally, the UE stores the correspondence between the L2 connection and the PDU session, or the UE stores the correspondence between the PC and the PDU session. For example, the UE allocates a PDU session ID for this PDU session, and the UE can store the correspondence between the L2 connection and the PDU session ID. Among them, the L2 connection between the UE and the PC can be the MAC address identifier of the PC or the L2 identifier of the PC, that is, the UE can store the correspondence between the MAC address of the PC and the PDU session ID, or the correspondence between the L2 identifier of the PC and the PDU session ID.

[0191] Further, AMF / SMF triggers a secondary authentication process based on the DNN carried in the PDU session establishment / update request received in step S504, that is, executes the following step S505.

[0192] S505, AMF / SMF sends an EAP-request / identify message to the UE, and correspondingly, the UE receives the EAP-request / identify message from the AMF / SMF.

[0193] For example, SMF first sends an EAP-request / identify message to AMF, and then AMF encapsulates the EAP-request / identify message in a NAS message and sends it to the UE to request authentication of the PC.

[0194] S506: The UE parses the NAS message.

[0195] Exemplarily, the UE can obtain the EAP-request / identify message by parsing the NAS message, and then the UE can determine that the PDU session is established for the PC based on the correspondence between the MAC address of the PC and the PDU session ID stored locally and the PDU session ID carried in the NAS message, and then perform the following step S507.

[0196] S507, the UE sends an EAP-request / identify message to the PC, and correspondingly, the PC receives the EAP-request / identify message from the UE.

[0197] Exemplarily, the UE sends an EAP-Request / Identity message to the PC through a WLAN air interface or an L2 connection between the UE and the PC.

[0198] S508: The PC parses the EAP-Request / Identity message.

[0199] S509, the PC sends an EAP-Response / Identity message to the UE, and correspondingly, the UE receives the EAP-Response / Identity message from the PC.

[0200] The specific implementation method of the PC parsing the EAP-Request / Identity message can refer to the parsing method in the existing protocol, which is not explained here. Exemplarily, in response to the EAP-Request / Identity message, the PC sends an EAP-Response / Identity message to the UE, and the EAP-Response / Identity message includes the user identity information of the PC, that is, the UserID, and the User ID is used to indicate the user identity information of the PC or the identification information of the user, such as the employee ID or the user name; or the User ID is used to indicate the user who uses the PC, or the User ID is used to indicate the identity information of the user of the PC.

[0201] S510, the UE sends the EAP-Response / Identity message to the AMF / SMF, and correspondingly, the AMF / SMF receives the EAP-Response / Identity message from the UE.

[0202] Exemplarily, the UE sends an EAP-Response / Identity message to the AMF, and the AMF then encapsulates the EAP-Response / Identity message in a NAS message and sends the NAS message to the SMF. It should be understood that the UE does not parse the EAP-Response / Identity here, and it can be understood that the PC transparently transmits the EAP-Response / Identity message to the AMF / SMF through the UE.

[0203] S511, AMF / SMF determines the DN-AAA server address based on DNN.

[0204] Exemplarily, the DN-AAA server address can be obtained from the subscription data of the DNN, or obtained from the UE, which is not limited in this application.

[0205] S512, AMF / SMF sends an authentication and authorization message to the DN-AAA server, and correspondingly, the DN-AAA server receives an authentication and authorization message from AMF / SMF.

[0206] The authentication and authorization message includes the EAP-Response / Identity message and UE identification information received in the above step S510. The EAP-Response / Identity message includes the User ID. The UE identification information may be the GPSI identification of the UE or the SUPI identification of the UE.

[0207] Exemplarily, SMF sends the authentication and authorization message to the DN-AAA server through the interface between SMF and the DN-AAA server, or, SMF first sends the authentication and authorization message to UPF, and then UPF forwards the authentication and authorization message to the DN-AAA server. This application is not limited to this.

[0208] S513, the DN-AAA server parses the authentication and authorization message.

[0209] Exemplarily, the DN-AAA server may obtain the UE identification information (eg, the GPSI identification of the UE, or the SUPI identification of the UE) and the User ID in the EAP-Response / Identity message by parsing the authentication and authorization message.

[0210] Further, the DN-AAA server searches for user context information of the User ID based on the User ID. The user context information of the User ID (or the subscription data of the User ID) includes one or more of the following parameters: User ID, user password, allowed UE ID list, any UE ID indication, user level or QoS parameter. The specific interpretation of the parameters can refer to the relevant description of the above method 400.

[0211] S514, an EAP authentication process is performed between the DN-AAA server and the PC.

[0212] Exemplarily, the DN-AAA server completes the authentication of the PC based on the User ID and its corresponding user password. The specific implementation method can refer to the existing protocol and will not be described here.

[0213] Optionally, for a PC that has successfully been authenticated, the DN-AAA server may allocate an IP address to the User ID.

[0214] S515, the DN-AAA server sends an authentication and authorization response message to AMF / SMF, and correspondingly, AMF / SMF receives an authentication and authorization response message from the DN-AAA server.

[0215] Exemplarily, the DN-AAA server sends the authentication and authorization response message to the SMF through the interface between the SMF and the DN-AAA, or the DN-AAA first sends the authentication and authorization response message to the UPF, and then the UPF forwards the authentication and authorization response message to the SMF. This application is not limited to this.

[0216] The authentication and authorization response message includes the User ID and the EAP-Success message. Optionally, the authentication and authorization response message may also include one or more of the following parameters: an IP address corresponding to the User ID, indication information #2, a user level, or a QoS parameter. The specific interpretation of the parameters can refer to the relevant description of the above method 400.

[0217] S516, AMF / SMF parses the authentication and authorization response message.

[0218] Exemplarily, the SMF can obtain the information carried in the above step S515, such as the User ID and the EAP-Success message, by parsing the authentication and authorization response message. Optionally, at least one of the following parameters is also included: IP address, indication information, user level, or QoS parameter, etc. The specific interpretation can refer to the relevant description above.

[0219] Optionally, if AMF / SMF does not receive the IP address assigned by the DN-AAA server to the User ID in step S515, AMF / SMF may assign an IP address to the User ID, or UPF may assign an IP address to the User ID, which is not limited in this application. Further, AMF / SMF sends the IP address to the DN-AAA server and stores it in the context information of the User ID. For specific implementation methods, refer to step S521.

[0220] S517, optionally, AMF / SMF sends an SM policy request to PCF / UDM, and correspondingly, PCF / UDM receives the SM policy request from AMF / SMF to obtain policy information corresponding to the User ID.

[0221] The SM policy request includes a User ID and optionally includes at least one of the following parameters: an IP address corresponding to the User ID, indication information #2, a QoS parameter, or a user level.

[0222] S518, optionally, PCF / UDM obtains context information corresponding to the User ID.

[0223] In other words, PCF / UDM searches for context information corresponding to the User ID based on the User ID.

[0224] The context information corresponding to the User ID includes the User ID, and optionally, also includes at least one of the following parameters: the IP address corresponding to the User ID, indication information #2, QoS parameters, or user level; or, the PCF / UDM adds or updates at least one of the following parameters in the context information: the IP address corresponding to the User ID, indication information #2, QoS parameters, or user level.

[0225] S519, optionally, the PCF / UDM determines the QoS policy for the service corresponding to the User ID.

[0226] Exemplarily, if PCF / UDM receives the user level or QoS parameter corresponding to the User ID in the above step S517, UDM / PCF can determine the QoS policy for the service of the User ID based on the user level or QoS parameter. The specific implementation method can refer to the existing protocol.

[0227] S520, optionally, UDM / PCF sends a QoS policy to AMF / SMF, and correspondingly, AMF / SMF receives a QoS policy from UDM / PCF.

[0228] Exemplarily, the QoS policy may include one or more of the maximum bandwidth of the service, the guaranteed bandwidth of the service, delay, packet loss rate, and flow rate.

[0229] S521, optionally, AMF / SMF sends a Notification message to the DN-AAA server, and correspondingly, the DN-AAA server receives a Notification message from AMF / SMF, wherein the Notification message carries the User ID and its corresponding IP address.

[0230] Furthermore, the DN-AAA server may store the IP address in the context information corresponding to the User ID.

[0231] It should be understood that for the User ID that has successfully been authenticated, AMF / SMF will continue to execute the PDU session establishment / update process, that is, execute step S522.

[0232] S522, AMF / SMF sends an EAP-Success message to the UE, and correspondingly, the UE receives an EAP-Success message from the AMF / SMF.

[0233] Exemplarily, SMF first sends a PDU session establishment accept message to AMF, and correspondingly, AMF receives a PDU session establishment accept message from SMF. The PDU session establishment accept message includes an EAP-Success message. Then, AMF encapsulates the PDU session establishment accept message in a DL NAS transport message and sends it to UE.

[0234] S523: The UE parses the NAS message.

[0235] Exemplarily, the UE can obtain the PDU session establishment accept message by parsing the DL NAS transport message, and then obtain the EAP-Success message. Then, the UE can determine that the PDU session is established for the PC based on the correspondence between the MAC address and the PDU session ID stored in the above step S504, and the PDU session ID carried in the DL NAS transport, and then execute step S524.

[0236] S524, the UE sends an EAP-Success message to the PC, and correspondingly, the PC receives the EAP-Success message from the UE.

[0237] At this point, the PC can access the 5GC based on the EAP-Success message and obtain the network access service provided by the 5GC.

[0238] Based on the above technical solution, for the scenario where the PC accesses the 5GC through the UE, the 5GC identifies the User ID of the PC, and the DN-AAA server authenticates the User ID to ensure that the PC is allowed to access the 5GC only when the User ID authentication is passed, and then the mobile operator can provide connection services to the PC based on the 5GC. Furthermore, the 5GC can achieve differentiated control and management of the PC's services based on the User ID. Moreover, by authenticating the User ID, potential network security risks can be avoided or reduced.

[0239] Figure 6 It is a flow chart of the communication method 600 provided in an embodiment of the present application. Taking the terminal device as PC, the user equipment as UE, the core network element as AMF / SMF, the data network authentication and billing server as DN-AAA server, and the core network as 5GC as an example, the implementation method mainly involves UE sending User ID to AMF / SMF during the process of triggering the PDU session establishment / update of the terminal device, so that AMF / SMF can perform authentication based on User ID, UE contract data or User ID contract data, and then determine whether to allow PC to access 5GC. The method includes the following multiple steps. For the parts not described in detail, please refer to the existing protocol. It should be understood that the above Figure 4 or Figure 5 The relevant description in the embodiment shown is also applicable to this implementation. Figures 4 to 6 There may be the same or similar technical means between them. Figures 4 to 5 The contents already described in the illustrated embodiment will not be repeated here.

[0240] S600, UDM / PCF adds the subscription data of the UE or the subscription data of the User ID.

[0241] Among them, the parameters and their interpretations included in the UE's subscription data or the User ID's subscription data can refer to the relevant description of the above method 400.

[0242] Optionally, the above User ID related information or User ID subscription data can be configured into the UDM / PCF by the core network management system, or sent to the UDM / PCF by the AF or DN-AAA server through the NEF.

[0243] S601, UE registers to 5GC.

[0244] S602: The UE obtains the URSP policy of the UE.

[0245] S603: Establish an L2 connection between the PC and the UE.

[0246] The specific implementation of the above steps S601 to S603 may refer to the relevant description of the above steps S501 to S503.

[0247] At this time, the UE acts as an authenticator and sends an EAP-Request / Identity message to the PC to authenticate the PC.

[0248] S604, the UE sends an EAP-Request / Identify message to the PC, and correspondingly, the PC receives the EAP-Request / Identify message from the UE.

[0249] Exemplarily, the UE sends an EAP-Request / Identity message to the PC through the WLAN air interface between the UE and the PC.

[0250] S605, the PC sends an EAP-Response / Identity message to the UE, and correspondingly, the UE receives the EAP-Response / Identity message from the PC.

[0251] Exemplarily, the PC parses the EAP-Request / Identify message, calculates the response RES, and then replies an EAP-Response / Identify message to the UE, wherein the EAP-Response / Identity message includes the User ID.

[0252] S606: The UE parses the EAP-Response / Identity message.

[0253] Exemplarily, the UE can obtain the User ID by parsing the EAP-Response / Identity message, and then initiate a PDU session establishment / update process for the PC based on the URSP policy obtained in the above step S602, that is, execute the following step S607.

[0254] S607, UE sends a PDU session establishment / update request to AMF / SMF, and correspondingly, AMF / SMF receives the PDU session establishment / update request from the UE.

[0255] Among them, the parameters carried in the PDU session establishment / update request and their interpretations, as well as the specific implementation method of triggering the PDU session establishment / update process can be achieved by referring to the relevant description of step S504 of the above method 500.

[0256] S608, AMF / SMF obtains the subscription data of the UE or the subscription data of the User ID, and determines whether to allow the PC to access the 5GC based on the subscription data of the UE or the subscription data of the User ID. Specifically, there are two methods:

[0257] Exemplarily, if the UL NAS transport message in step S607 includes User ID, AMF / SMF obtains the subscription data of UE from UDM, or obtains the subscription data of User ID based on User ID, and then AMF / SMF determines whether to allow the PC to access 5GC based on the subscription data of UE or the subscription data of User ID. Among them, the parameters and their interpretations included in the subscription data of UE or the subscription data of UserID can refer to the relevant description of the above step S600, and the specific implementation method can refer to the relevant description of step S430 of the above method 400, which will not be described here for brevity.

[0258] Exemplarily, if the PDU session establishment request message in step S607 contains the User ID, after obtaining the User ID, the AMF can continue to forward the User ID to the SMF through the interface between the AMF and SMF, and then the SMF determines whether to allow the PC to access the 5GC based on the UE's contract data or the User ID's contract data. For specific implementation methods, please refer to the relevant description of step S430 of the above method 400. For the sake of brevity, it will not be described here. Optionally, if the AMF receives the User ID, the AMF can also make the above judgment based on the UE's contract data or the User ID's contract data. The specific implementation method is similar to the processing on the SMF side and will not be repeated here.

[0259] Further, AMF / SMF triggers the authentication process based on the DNN carried in the PDU session request received in step S607, that is, executes the following step S609.

[0260] S609, AMF / SMF sends an EAP-Response / Identity message to the DN-AAA server, and correspondingly, the DN-AAA server receives the EAP-Response / Identity message from AMF / SMF, wherein the EAP-Response / Identity message includes the User ID.

[0261] S610, an EAP authentication process is performed between the DN-AAA server and the PC.

[0262] S611, the DN-AAA server sends an EAP-Success message to the AMF / SMF, and correspondingly, the AMF / SMF receives the EAP-Success message from the DN-AAA server.

[0263] The specific implementation of the above steps S609 to S611 may refer to the relevant description of steps S512 to S515 of the above method 500.

[0264] S612, optionally, AMF / SMF determines the QoS policy corresponding to the User ID.

[0265] Exemplarily, the SMF determines the QoS policy based on the user level or QoS parameter corresponding to the User ID. The specific implementation method can refer to the existing protocol, and the specific interpretation of the QoS policy can refer to the relevant description of step S520 of the above method 500.

[0266] S613, optionally, AMF / SMF sends a Notification message to the DN-AAA server, and correspondingly, the DN-AAA server receives a Notification message from AMF / SMF, wherein the Notification message carries the User ID and its corresponding IP address.

[0267] Furthermore, DN-AAA may store the IP address in the context information corresponding to the User ID.

[0268] It should be understood that for the User ID that has successfully been authenticated, AMF / SMF will continue to execute the PDU session establishment / update process.

[0269] S614, AMF / SMF sends an EAP-Success message to the UE, and correspondingly, the UE receives an EAP-Success message from the AMF / SMF.

[0270] S615: The UE parses the NAS message.

[0271] S616, the UE sends an EAP-Success message to the PC, and correspondingly, the PC receives the EAP-Success message from the UE.

[0272] At this point, the PC can access the 5GC based on the EAP-Success message and obtain the network access service provided by the 5GC.

[0273] The specific implementation of steps S614 to S616 can refer to the relevant description of steps S522 to S524 of the method 500, which will not be repeated here.

[0274] Based on the above technical solution, for the scenario where the PC accesses 5GC through the UE, the 5GC identifies the User ID of the PC, and the AMF / SMF authenticates the User ID to ensure that the PC is allowed to access the 5GC only when the User ID authentication is passed, and then the mobile operator can provide connection services to the PC based on the 5GC. Furthermore, the 5GC can achieve differentiated control and management of the PC's services based on the User ID. Moreover, by authenticating the User ID, potential network security risks can be avoided or reduced.

[0275] It should be noted that the above Figure 5 and Figure 6 The following description is based on the scenario where a PC accesses 5GC through a UE. Optionally, the present application is also applicable to the scenario where a UE requests to access 5GC by carrying a User ID (a user using the UE). Figure 7 The following describes how 5GC determines whether to allow UE to access 5GC by authenticating the User ID of the UE. It should be understood that compared with the existing solution of verifying the identification information of the UE (such as the UE ID) to determine whether to allow UE to access 5GC, authenticating the User ID can be an additional verification on the basis of verifying the UE ID, which is more secure, and verifying the User ID can prevent illegal users from using 5GC, or prevent illegal users from maliciously attacking the network, or can enable 5GC to clearly know which user uses which services, which is convenient for service management and control.

[0276] Figure 7 700 is a flow chart of a communication method 700 provided in an embodiment of the present application. Figure 7As shown, taking the user equipment as UE, the core network element as AMF / SMF, the data network authentication and billing server as DN-AAA server, and the core network as 5GC as an example, the implementation method includes the DN-AAA server or AMF / SMF authenticating the User ID of the UE, and allowing the UE to access the 5GC if the authentication passes. The method includes the following multiple steps, and the parts not described in detail can refer to the existing protocol. It should be understood that the above Figures 4 to 6 The relevant description in the embodiment shown is also applicable to this implementation. Figures 4 to 7 There may be the same or similar technical means between them. Figures 4 to 6 The contents already described in the illustrated embodiment will not be repeated here.

[0277] S701, UE registers to 5GC.

[0278] S702: The UE obtains the URSP policy of the UE.

[0279] Optionally, the URSP policy may not carry the access point identifier, and other carried parameters and their interpretations may refer to the relevant description of the above method 500.

[0280] S703, the UE sends a PDU session establishment / update request to the AMF / SMF according to the URSP policy, and correspondingly, the AMF / SMF receives the PDU session establishment / update request from the UE.

[0281] Among them, the PDU session establishment / update request carries DNN and slice information. The PDU session establishment / update request is used to request to establish / update a PDU session for the UE. The specific PDU session establishment / update process can refer to the relevant description of step S504 of the above method 500. The difference is that the PDU session in step S703 is established / updated for the UE.

[0282] The following is a specific description of determining whether to allow UE to access 5GC based on User ID in combination with two implementation methods. It should be understood that in method 1, the DN-AAA server authenticates the User ID, and the undetailed part can refer to the relevant description of the above method 400 or 500; in method 2, the AMF / SMF authenticates the User ID, and the undetailed part can refer to the relevant description of the above method 400 or 600.

[0283] Method 1:

[0284] Furthermore, AMF / SMF triggers a secondary authentication process based on the DNN carried in the received PDU session establishment / update request.

[0285] S704, AMF / SMF sends an EAP-request / identify message to the UE, and correspondingly, the UE receives the EAP-request / identify message from the AMF / SMF. For example, the AMF encapsulates the EAP-request / identify message through a NAS message and sends it to the UE.

[0286] S705: The UE parses the NAS message.

[0287] S706, the UE sends an EAP-Response / Identity message to the AMF / SMF, and correspondingly, the AMF / SMF receives the EAP-Response / Identity message from the UE. For example, the UE encapsulates the EAP-Response / Identity message through a NAS message and sends it to the AMF.

[0288] S707, AMF / SMF determines the DN-AAA server address based on DNN.

[0289] S708, AMF / SMF sends an authentication and authorization message to the DN-AAA server, and correspondingly, the DN-AAA server receives an authentication and authorization message from AMF / SMF.

[0290] The authentication and authorization message includes the EAP-Response / Identity message.

[0291] S709, the DN-AAA server parses the authentication and authorization message.

[0292] S710, an EAP authentication process is performed between the DN-AAA server and the UE.

[0293] S711, the DN-AAA server sends an authentication and authorization response message to AMF / SMF, and correspondingly, AMF / SMF receives an authentication and authorization response message from the DN-AAA server.

[0294] The authentication and authorization response message contains the User ID and EAP-Success message.

[0295] S712, AMF / SMF parses the authentication and authorization response message.

[0296] Method 2:

[0297] At this time, the PDU session establishment / update request in step S703 also includes a User ID, which is used to indicate the user using the UE.

[0298] S713, UDM / PCF adds the subscription data of the UE or the subscription data of the User ID.

[0299] S714, AMF / SMF obtains the UE's contract data or the User ID's contract data, and determines whether to allow the UE to access the 5GC based on the UE's contract data or the User ID's contract data. For the specific implementation method, please refer to the relevant description of step S608 of the above method 600.

[0300] Further, AMF / SMF triggers a secondary authentication process based on the DNN carried in the PDU session request, that is, executes the following step S715.

[0301] S715, AMF / SMF sends an EAP-Response / Identity message to the DN-AAA server, and correspondingly, the DN-AAA server receives the EAP-Response / Identity message from AMF / SMF, wherein the EAP-Response / Identity message includes the User ID.

[0302] S716, the DN-AAA server and the UE perform an EAP authentication process.

[0303] S717, the DN-AAA server sends an EAP-Success message to AMF / SMF, and correspondingly, AMF / SMF receives the EAP-Success message from the DN-AAA server.

[0304] S718, optionally, AMF / SMF determines the QoS policy corresponding to the User ID.

[0305] S719, optionally, AMF / SMF sends a Notification message to the DN-AAA server, and correspondingly, the DN-AAA server receives a Notification message from AMF / SMF, wherein the Notification message carries the User ID and its corresponding IP address.

[0306] Furthermore, DN-AAA may store the IP address in the context information corresponding to the User ID.

[0307] It should be understood that for the User ID that has successfully been authenticated, AMF / SMF will continue to execute the PDU session establishment / update process.

[0308] S720, AMF / SMF sends an EAP-Success message to the UE, and correspondingly, the UE receives an EAP-Success message from the AMF / SMF.

[0309] At this point, the UE can access the 5GC based on the EAP-Success message and obtain the network access service provided by the 5GC.

[0310] Based on the above technical solution, for the scenario where UE accesses 5GC, 5GC identifies the User ID of UE and authenticates the User ID to ensure that UE is allowed to access 5GC only when the User ID authentication is passed, and then the mobile operator can provide connection services to UE based on 5GC. Furthermore, 5GC can achieve differentiated control and management of UE services based on User ID. Moreover, by authenticating the User ID, potential network security risks can be avoided or reduced.

[0311] Combination of the above Figures 1 to 7 , describes in detail the communication method side embodiment of the present application, and will be combined with Figures 8 to 10 , describes in detail the communication device side embodiment of the present application. It should be understood that the description of the device embodiment corresponds to the description of the method embodiment, so the parts not described in detail can refer to the previous method embodiment.

[0312] Figure 8 1 is a schematic diagram of the structure of the communication device 1000 provided in the embodiment of the present application. Figure 8 As shown, the device 1000 may include a transceiver unit 1010 and a processing unit 1020. The transceiver unit 1010 may communicate with the outside, and the processing unit 1020 is used for data processing. The transceiver unit 1010 may also be called a communication interface or a transceiver unit.

[0313] In one possible design, the device 1000 can implement steps or processes corresponding to those executed by the core network network elements in the above method embodiments, wherein the processing unit 1020 is used to execute operations related to the processing of the core network network elements in the above method embodiments, and the transceiver unit 1010 is used to execute operations related to the transmission and reception of the core network elements in the above method embodiments.

[0314] In another possible design, the device 1000 may implement steps or processes corresponding to those performed by the user equipment in the above method embodiments, wherein the transceiver unit 1010 is used to perform transceiver-related operations of the user equipment in the above method embodiments, and the processing unit 1020 is used to perform processing-related operations of the user equipment in the above method embodiments.

[0315] It should be understood that the device 1000 here is embodied in the form of a functional unit. The term "unit" here may refer to an application specific integrated circuit (ASIC), an electronic circuit, a processor (such as a shared processor, a proprietary processor or a group processor, etc.) and a memory for executing one or more software or firmware programs, a merged logic circuit and / or other suitable components that support the described functions. In an optional example, those skilled in the art can understand that the device 1000 can be specifically the transmitting end in the above-mentioned embodiment, and can be used to execute the various processes and / or steps corresponding to the transmitting end in the above-mentioned method embodiment, or the device 2000 can be specifically the receiving end in the above-mentioned embodiment, and can be used to execute the various processes and / or steps corresponding to the receiving end in the above-mentioned method embodiment. To avoid repetition, it will not be repeated here.

[0316] The apparatus 1000 of each of the above-mentioned schemes has the function of implementing the corresponding steps executed by the transmitting end in the above-mentioned method, or the apparatus 1000 of each of the above-mentioned schemes has the function of implementing the corresponding steps executed by the receiving end in the above-mentioned method. The functions can be implemented by hardware, or can be implemented by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above-mentioned functions; for example, the transceiver unit can be replaced by a transceiver (for example, the sending unit in the transceiver unit can be replaced by a transmitter, and the receiving unit in the transceiver unit can be replaced by a receiver), and other units, such as the processing unit, can be replaced by a processor, respectively performing the transceiver operations and related processing operations in each method embodiment.

[0317] In addition, the above-mentioned transceiver unit can also be a transceiver circuit (for example, it can include a receiving circuit and a sending circuit), and the processing unit can be a processing circuit. In an embodiment of the present application, the device 1000 can be a receiving device or a sending device in the aforementioned embodiment, or a chip or a chip system in a receiving device or a sending device, for example: a system on chip (SoC). Among them, the transceiver unit can be an input and output circuit, a communication interface. The processing unit is a processor or a microprocessor or an integrated circuit integrated on the chip. This is not limited here.

[0318] Fig. 9 2 is a schematic diagram of the structure of the communication device 2000 provided in the embodiment of the present application. Fig. 9 As shown, the device 2000 includes a processor 2010 and a transceiver 2020. The processor 2010 and the transceiver 2020 communicate with each other through an internal connection path, and the processor 2010 is used to execute instructions to control the transceiver 2020 to send signals and / or receive signals.

[0319] Optionally, the device 2000 may further include a memory 2030, and the memory 2030 communicates with the processor 2010 and the transceiver 2020 through an internal connection path. The memory 2030 is used to store instructions, and the processor 2010 may execute the instructions stored in the memory 2030.

[0320] In a possible implementation, the device 2000 is used to implement various processes and steps corresponding to the core network elements in the above method embodiments.

[0321] In another possible implementation manner, the apparatus 2000 is used to implement various processes and steps corresponding to the user equipment in the above method embodiment.

[0322] It should be understood that the device 2000 can be specifically the transmitting end or receiving end in the above embodiment, or a chip or a chip system. Correspondingly, the transceiver 2020 can be a transceiver circuit of the chip, which is not limited here. Specifically, the device 2000 can be used to execute each step and / or process corresponding to the transmitting end or receiving end in the above method embodiment.

[0323] Optionally, the memory 2030 may include a read-only memory and a random access memory, and provide instructions and data to the processor. A portion of the memory may also include a non-volatile random access memory. For example, the memory may also store information about the device type. The processor 2010 may be used to execute instructions stored in the memory, and when the processor 2010 executes instructions stored in the memory, the processor 2010 is used to execute the various steps and / or processes of the above-mentioned method embodiment corresponding to the transmitting end or the receiving end.

[0324] In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in a processor or an instruction in the form of software. The steps of the method disclosed in conjunction with the embodiment of the present application can be directly embodied as a hardware processor for execution, or a combination of hardware and software modules in a processor for execution. The software module can be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in a memory, and the processor reads the information in the memory and completes the steps of the above method in conjunction with its hardware. To avoid repetition, it is not described in detail here.

[0325] It should be noted that the processor in the embodiment of the present application can be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method embodiment can be completed by an integrated logic circuit of hardware in the processor or an instruction in the form of software. The above processor can be a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component. The processor in the embodiment of the present application can implement or execute the methods, steps and logic block diagrams disclosed in the embodiment of the present application. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiment of the present application can be directly embodied as a hardware decoding processor to perform, or the hardware and software modules in the decoding processor can be combined to perform. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in a memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0326] It is understood that the memory in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static random access memory, dynamic random access memory, synchronous dynamic random access memory, double data rate synchronous dynamic random access memory, enhanced synchronous dynamic random access memory, synchronously connected dynamic random access memory, and direct memory bus random access memory. It should be noted that the memory of the system and method described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0327] Fig.10 3 is a schematic diagram of the structure of a chip system 3000 provided in an embodiment of the present application. Fig.10 As shown, the chip system 3000 (or may also be called a processing system) includes a logic circuit 3010 and an input / output interface (input / output interface) 3020 .

[0328] Among them, the logic circuit 3010 can be a processing circuit in the chip system 3000. The logic circuit 3010 can be coupled to the storage unit and call the instructions in the storage unit so that the chip system 3000 can implement the methods and functions of each embodiment of the present application. The input / output interface 3020 can be an input / output circuit in the chip system 3000, outputting information processed by the chip system 3000, or inputting data or signaling information to be processed into the chip system 3000 for processing.

[0329] As a solution, the chip system 3000 is used to implement the operations performed by the core network elements in the above method embodiments.

[0330] As a solution, the chip system 3000 is used to implement the operations performed by the user equipment in the above method embodiments.

[0331] An embodiment of the present application also provides a computer-readable storage medium on which computer instructions for implementing the methods executed by the core network element and the user equipment in the above-mentioned method embodiments are stored.

[0332] An embodiment of the present application also provides a computer program product, comprising computer program code or instructions. When the computer program code or instructions are executed on a computer, the computer implements the methods executed by the core network element and the user equipment in the above-mentioned method embodiments.

[0333] An embodiment of the present application also provides a communication system, including the aforementioned core network element and user equipment, and optionally, may also include a unified data management function network element, a policy control function network element, an access and mobility management function network element, a session management function network element, a data network-authentication and billing server, or a terminal device.

[0334] The explanation of the relevant contents and beneficial effects of any of the above-mentioned devices can be referred to the corresponding method embodiments provided above, which will not be repeated here.

[0335] In order to facilitate understanding of the above embodiments provided in this application, the following points are explained:

[0336] 1) In this application, unless otherwise specified or there is a logical conflict, the terms and / or descriptions between different embodiments are consistent and can be referenced to each other, and the technical features in different embodiments can be combined to form new embodiments according to their internal logical relationships.

[0337] 2) In this application, "at least one" means one or more, and "more than one" means two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. In the text description of this application, the character " / " generally indicates that the associated objects before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b and c can mean: a, or b, or c, or a and b, or a and c, or b and c, or a, b and c. Where a, b and c can be single or multiple, respectively.

[0338] 3) In the present application, "first", "second" and various numerical numbers (e.g., #1, #2, etc.) indicate distinctions made for ease of description and are not used to limit the scope of the embodiments of the present application. For example, to distinguish between different messages, etc., rather than to describe a specific order or sequence. It should be understood that the objects described in this way can be interchanged where appropriate so as to be able to describe solutions other than the embodiments of the present application.

[0339] 4) In this application, descriptions such as "when...", "in the case of..." and "if" all mean that the device will take corresponding actions under certain objective circumstances. They do not limit the time, nor do they require the device to make judgments when implementing them, nor do they mean that there are other limitations.

[0340] 5) In this application, "used for indication" may include being used for direct indication and being used for indirect indication. When describing that a certain indication information is used for indicating A, it may include that the indication information directly indicates A or indirectly indicates A, but it does not mean that the indication information must carry A.

[0341] The indication method involved in the embodiments of the present application should be understood to include various methods that can enable the party to be indicated to know the information to be indicated. The information to be indicated can be sent as a whole or divided into multiple sub-information and sent separately, and the sending period and / or sending time of these sub-information can be the same or different. The present application does not limit the specific sending method.

[0342] The "indication information" in the embodiments of the present application may be an explicit indication, i.e., directly indicated by signaling, or obtained by combining other rules or other parameters or by deduction according to the parameters indicated by the signaling. It may also be an implicit indication, i.e., obtained by combining other rules or other parameters or by deduction according to a rule or relationship. The present application does not make any specific limitation on this.

[0343] 6) In this application, "protocol" may refer to a standard protocol in the field of communications, such as 5G protocol, NR protocol, and related protocols used in future communication systems, which are not limited in this application. "Predefined" may include pre-definition. For example, protocol definition. "Preconfiguration" may be implemented by pre-saving corresponding codes, tables, or other methods that can be used to indicate relevant information in the device, and this application does not limit its specific implementation method.

[0344] 7) In this application, "communication" may also be described as "data transmission", "information transmission", "data processing", etc. "Transmission" includes "sending" and "receiving".

[0345] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0346] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0347] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0348] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0349] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0350] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage media include: various media that can store program codes, such as USB flash drives, mobile hard disks, read-only memories, random access memories, magnetic disks or optical disks.

[0351] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A communication method, characterized in that: Applied to after the user equipment registers with the core network, during the process of the user equipment triggering the establishment or update of a session, the method includes: receiving a non-access stratum NAS request message from the user equipment, where the NAS request message is used to request to establish a session or update a session; Acquire user identity information according to the NAS request message, where the user identity information is used to indicate a user of the user equipment; The session is established or updated according to the user identity information.

2. The method according to claim 1, characterized in that The user of the user equipment includes: The user of the user device is the user of the user device, and the user identity information is the user identity information of the user of the user device; or The terminal device is communicatively connected with the user device, the user of the user device is the user of the terminal device, the user identity information is the user identity information of the user of the terminal device, and the terminal device is a terminal device that supports non-3rd Generation Partnership Project 3GPP access technology and does not support NAS signaling.

3. The method according to claim 1 or 2, characterized in that: The acquiring the user identity information according to the NAS request message includes: Receive the user identity information from the data network-authentication and accounting DN-AAA server according to the NAS request message; or, The user identity information is received from the user equipment according to the NAS request message.

4. The method according to claim 3, characterized in that The NAS request message includes a data network name, and the method further includes: Sending a first authentication message to the user equipment according to the data network name, wherein the first authentication message is used to request authentication of the terminal device or the user equipment; Receiving a first authentication response message from the user equipment, wherein the first authentication response message includes the user identity information; The receiving the user identity information from the DN-AAA server according to the NAS request message includes: Determining the address of the DN-AAA server according to the data network name; Sending a second authentication message to the DN-AAA server according to the address of the DN-AAA server, where the second authentication message includes the first authentication response message, and the second authentication message is used to request authentication of the user identity information; In response to the second authentication message, when the user identity information authentication is successful, a first message is received from the DN-AAA server, the first message including the user identity information and a second message, the second message being used to indicate that the user identity information authentication is successful.

5. The method according to claim 4, characterized in that The first message further includes one or more of the following: an Internet Protocol IP address, a user level, a quality of service QoS parameter or second indication information of the session, the QoS parameter represents a QoS control parameter for a data flow of the session, the second indication information is used to indicate statistics for the data flow of the session, and the user level is used to indicate a service level of the user; Wherein, the method further comprises: According to the user level and / or the QoS parameter, policy information corresponding to the user identity information is determined.

6. The method according to claim 4, characterized in that The method further comprises: Sending a request message to a policy control function network element or a unified data management function network element, where the request message is used to obtain policy information corresponding to the user identity information, and the request message includes the user identity information; The policy information is received from the policy control function network element or the unified data management function network element, where the policy information is determined according to the user level and / or QoS parameter corresponding to the user identity information.

7. The method according to claim 4 or 6, characterized in that: The method further comprises: Obtaining an Internet Protocol (IP) address for the session; Send the user identity information and the IP address to the DN-AAA server.

8. The method according to claim 1 or 2, characterized in that: The user identity information is carried in the NAS request message.

9. The method according to any one of claims 1 to 8, characterized in that The establishing or updating the session according to the user identity information includes: Acquire the subscription data of the user device or the subscription data of the user identity information according to the user identity information; The session is established or updated according to the subscription data of the user equipment or the subscription data of the user identity information.

10. The method according to claim 9, characterized in that The subscription data of the user equipment includes a user identity information list and / or third indication information, the user identity information list includes at least one user identity information, the at least one user identity information is used to indicate at least one user identity information allowed to be accessed by the user equipment, and the third indication information is used to indicate that any user identity information is allowed to access the core network from the user equipment; The establishing or updating of the session according to the subscription data of the user equipment includes: In a case where the user identity information is included in the user identity information list, or the subscription data of the user equipment includes the third indication information, the session is established or updated.

11. The method according to claim 9, characterized in that The subscription data of the user identity information includes a user equipment identifier list and / or first indication information, the user equipment identifier list includes at least one user equipment identifier, the at least one user equipment identifier is used to indicate at least one user equipment that the user identity information allows to access, and the first indication information is used to indicate that the user identity information allows access to the core network from any user equipment; Wherein, establishing or updating the session according to the contract data of the user identity information includes: The session is established or updated when the identifier of the user equipment is included in the user equipment identifier list or the subscription data of the user identity information includes the first indication information.

12. The method according to any one of claims 1 to 11, characterized in that The method further comprises: In the case where the user identity information authentication is successful, a NAS response message is sent to the user equipment, where the NAS response message is used to indicate that the session establishment or update is successful.

13. A communication method, characterized in that: Applied to after the user equipment registers with the core network, during the process of the user equipment triggering the establishment or update of a session, the method includes: Acquire user identity information, where the user identity information is used to indicate a user of the user device; A non-access layer NAS request message is sent to a core network element according to the user identity information, where the NAS request message is used to request to establish a session or request to update a session.

14. The method according to claim 13, characterized in that The method further comprises: In the case where the user identity information authentication is successful, a NAS response message is received from the core network element, where the NAS response message is used to indicate that the session is successfully established or updated.

15. The method according to claim 13 or 14, characterized in that The obtaining of user identity information includes: Acquire user identity information of a user of the user device, wherein the user of the user device is the user of the user device, and the user identity information is the user identity information of the user of the user device; or, When the user equipment establishes a communication connection with the terminal equipment, the user identity information is obtained from the terminal equipment, the user of the user equipment is the user of the terminal equipment, the user identity information is the user identity information of the user of the terminal equipment, and the terminal equipment is a terminal equipment that supports non-3rd Generation Partnership Project 3GPP access technology and does not support NAS signaling.

16. The method according to any one of claims 13 to 15, characterized in that The NAS request message includes the user identity information.

17. The method according to any one of claims 13 to 16, characterized in that Before the user equipment triggers establishment or update of the session, the method further includes: A routing selection policy is received from the core network element, where the routing selection policy includes an access point identifier and / or the user identity information, and the access point identifier is used to indicate an access point name provided by the user equipment.

18. The method according to claim 17, characterized in that The sending a NAS request message to a core network element based on the user identity information includes: When the access point used by the terminal device to establish a communication connection with the user equipment is the same as the access point indicated by the access point identifier included in the routing selection policy, sending the NAS request message to the core network element; and / or, When the user identity information acquired by the user equipment is the same as the user identity information included in the routing selection policy, the NAS request message is sent to the core network element.

19. The method according to claim 17 or 18, characterized in that The routing selection strategy further includes indication information, and the sending the NAS request message to the core network element based on the user identity information includes: When the indication information is used to instruct the terminal device to establish a communication connection with the user equipment from the access point corresponding to the access point identifier, or the indication information is used to indicate that the NAS request message is sent to the core network element when the user identity information is obtained.

20. A communication method, characterized in that: Applied to after the user equipment registers with the core network, during the process of the user equipment triggering the establishment or update of a session, the method includes: The user equipment acquires user identity information, where the user identity information is used to indicate a user of the user equipment; The user equipment sends a non-access layer NAS request message to a core network element according to the user identity information, and the core network element receives the NAS request message from the user equipment, where the NAS request message is used to request to establish a session or update a session; The core network element obtains user identity information according to the NAS request message; The core network element establishes or updates the session according to the user identity information.

21. The method according to claim 20, characterized in that The user of the user equipment includes: The user of the user device is the user of the user device, and the user identity information is the user identity information of the user of the user device; or The terminal device is communicatively connected with the user device, the user of the user device is the user of the terminal device, the user identity information is the user identity information of the user of the terminal device, and the terminal device is a terminal device that supports non-3rd Generation Partnership Project 3GPP access technology and does not support NAS signaling.

22. The method according to claim 20 or 21, characterized in that The core network element obtains the user identity information of the terminal device according to the NAS request message, including: The core network element receives the user identity information from the data network-authentication and accounting DN-AAA server according to the NAS request message; or, The core network element receives the user identity information from the user equipment according to the NAS request message.

23. The method according to claim 22, characterized in that The NAS request message includes a data network name, and the method further includes: The core network element sends a first authentication message to the user equipment according to the data network name, and the user equipment receives the first authentication message from the core network element, where the first authentication message is used to request authentication of the terminal device or the user equipment; The user equipment sends a first authentication response message to the core network element, and the core network element receives the first authentication response message from the user equipment, where the first authentication response message includes the user identity information; The core network element receiving the user identity information from the DN-AAA server according to the NAS request message includes: The core network element determines the address of the DN-AAA server according to the data network name; The core network element triggers an authentication process for the user equipment or terminal equipment according to the data network name; The core network element sends a second authentication message to the DN-AAA server according to the address of the DN-AAA server, and the DN-AAA server receives the second authentication message from the core network element, where the second authentication message includes the first authentication response message, and the second authentication message is used to request an authentication process for the user identity information; In response to the second authentication message, if the user identity information authentication is successful, the DN-AAA server sends a first message to the core network network element, and the core network network element receives the first message from the DN-AAA server, the first message including the user identity information and a second message, and the second message is used to indicate that the user identity information authentication is successful.

24. The method according to claim 20 or 21, characterized in that The user identity information is carried in the NAS request message.

25. The method according to any one of claims 20 to 24, characterized in that Before the user equipment sends a NAS request message to a core network element based on the user identity information, the method further includes: The user equipment sends a request message to the terminal equipment, and the terminal equipment receives the request message from the user equipment, where the request message is used to obtain the user identity information; The terminal device sends a response message to the user device, and the user device receives the response message from the terminal device, wherein the response message includes the user identity information, and the user identity information is the user identity information of the user of the terminal device.

26. The method according to any one of claims 20 to 25, characterized in that The core network element establishing or updating the session according to the user identity information includes: The core network element acquires the subscription data of the user equipment or the subscription data of the user identity information according to the user identity information; The core network element establishes or updates the session according to the subscription data of the user equipment or the subscription data of the user identity information.

27. The method according to claim 26, characterized in that The subscription data of the user equipment includes a user identity information list and / or third indication information, the user identity information list includes at least one user identity information, the at least one user identity information is used to indicate at least one user identity information allowed to be accessed by the user equipment, and the third indication information is used to indicate that any user identity information is allowed to access the core network from the user equipment; The core network element establishing or updating the session according to the subscription data of the user equipment includes: In a case where the user identity information is included in the user identity information list, or the subscription data of the user equipment includes the third indication information, the core network element establishes or updates the session.

28. The method according to claim 26, characterized in that The subscription data of the user identity information includes a user equipment identifier list and / or first indication information, the user equipment identifier list includes at least one user equipment identifier, the at least one user equipment identifier is used to indicate at least one user equipment that the user identity information allows to access, and the first indication information is used to indicate that the user identity information allows access to the core network from any user equipment; The core network element establishes or updates the session according to the subscription data of the user identity information, including: When the identifier of the user equipment is included in the user equipment identifier list, or when the subscription data of the user identity information includes the first indication information, the core network element establishes or updates the session.

29. A communication device, characterized in that: include: One or more functional modules, wherein the one or more functional modules are used to execute the method according to any one of claims 1 to 12, or the one or more functional modules are used to execute the method according to any one of claims 13 to 19.

30. A communication device, characterized in that: include: a processor coupled to the memory; The processor is configured to execute the computer program stored in the memory so that the apparatus performs the method according to any one of claims 1 to 12, or the apparatus performs the method according to any one of claims 13 to 19.

31. A computer-readable storage medium, characterized in that: include: The computer-readable storage medium stores a computer program, which, when executed on a computer, enables the computer to execute the method according to any one of claims 1 to 12, or enables the computer to execute the method according to any one of claims 13 to 19.

Images