Network element selection method and device, equipment, storage medium and product

Abstract

Disclosed are a network element selection method, apparatus and device, a storage medium and a product, applied to a session management function network element, the method comprising: receiving first authorization information sent by a server device in a data network, the first authorization information being used for indicating authorized access identification information; determining whether the access identifier corresponding to the first user plane function network element is included in the authorized access identifier information; and if the access identifier corresponding to the first user plane function network element is included in the authorized access identifier information, determining the first user plane function network element as a target user plane function network element, the target user plane function network element being used for communication between the terminal device and the data network. The method can ensure that the target user plane function network element determined by the session management function network element can meet the security requirement of the data network.

Description

Technical Field

[0001] The present application relates to, but is not limited to, the field of communication technology, and in particular to a network element selection method, device, equipment, storage medium and product. Background Art

[0002] In the current mainstream user plane function (UPF) selection method, the UPF selection is usually based on the conditions of the 5G system itself. For example, the UPF selection is usually based on the user equipment (UE) location, UPF capabilities, etc.

[0003] However, in actual applications, the UPF selected based on the above method may not necessarily enable the UE to obtain the best access experience. For example, as corporate customers pay more and more attention to the security of their data networks (DN), many data networks require the unified implementation of multiple security policies such as user authentication, access control, and attack prevention. This security policy may cause the UE to receive different security treatments when accessing the network through different UPFs. In this way, if the UPF is selected only based on the conditions of the 5G system itself, the selected UPF may not meet the security requirements of the data network, which may cause the UE to be unable to access the data network normally through the UPF, or to obtain a better access experience. Summary of the invention

[0004] The present application at least provides a network element selection method, device, equipment, storage medium and product.

[0005] The technical solution of this application is implemented as follows:

[0006] In a first aspect, the present application provides a network element selection method, which is applied to a session management function network element, the method comprising: receiving first authorization information sent by a server device in a data network, the first authorization information being used to indicate authorized access identification information; determining whether an access identification corresponding to a first user plane function network element is included in the authorized access identification information; if the access identification corresponding to the first user plane function network element is included in the authorized access identification information, determining the first user plane function network element as a target user plane function network element, and the target user plane function network element is used for communication between a terminal device and a data network.

[0007] In a second aspect, an embodiment of the present application provides a network element selection device, which includes: a receiving unit, the receiving unit is used to receive first authorization information sent by a server device in a data network, the first authorization information is used to indicate authorized access identification information; a determination unit, the determination unit is used to: determine whether the access identification corresponding to the first user plane function network element is included in the authorized access identification information; if the access identification corresponding to the first user plane function network element is included in the authorized access identification information, then determine the first user plane function network element as a target user plane function network element, and the target user plane function network element is used for communication between a terminal device and a data network.

[0008] In a third aspect, an embodiment of the present application provides a network element selection device, which includes a memory and a processor; wherein the memory is used to store computer-executable instructions; the processor is connected to the memory and is used to implement the method described in the first aspect by executing the computer-executable instructions.

[0009] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by at least one processor, it implements the method described in the first aspect.

[0010] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program or instructions, which, when executed by a processor, implements the method described in the first aspect.

[0011] In an embodiment of the present application, a session management function network element may receive first authorization information sent by a server device in a data network, and the first authorization information is used to indicate authorized access identification information. Further, the session management function network element may determine whether the access identification corresponding to the first user plane function network element is included in the authorized access identification information. If the access identification corresponding to the first user plane function network element is included in the authorized access identification information, the first user plane function network element may be determined as a target user plane function network element, and the target user plane function network element may be used for communication between the terminal device and the data network.

[0012] According to the method of the embodiment of the present application, since the server device in the data network can authorize the access identifier according to the security requirements of the data network, or in other words, the server device in the data network can provide authorized access identifier information based on the security requirements of the data network, the session management function network element selects the user plane function network element according to the authorized access identifier information provided by the server device, thereby ensuring that the selected user plane function network element (i.e., the target user plane function network element) can meet the security requirements of the data network.

[0013] It should be understood that the above general description and the following detailed description are merely exemplary and explanatory, and are not intended to limit the technical solutions of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The drawings herein are incorporated into the specification and constitute a part of the specification. These drawings illustrate embodiments consistent with the present application and are used together with the specification to illustrate the technical solution of the present application.

[0015] Figure 1 Schematic diagram of the scenario of deploying UPF for multiple access points of DN;

[0016] Figure 2 A flowchart of a network element selection method provided in an embodiment of the present application;

[0017] Figure 3 A possible implementation flow diagram of the network element selection method provided in the embodiment of the present application;

[0018] Figure 4 A schematic diagram of the structure of a network element selection device provided in an embodiment of the present application;

[0019] Figure 5 A schematic diagram of a hardware entity of a network element selection device in an embodiment of the present application. DETAILED DESCRIPTION

[0020] In order to enable a more detailed understanding of the features and technical contents of the embodiments of the present application, the implementation of the embodiments of the present application is described in detail below in conjunction with the accompanying drawings. The attached drawings are for reference only and are not used to limit the embodiments of the present application.

[0021] Unless otherwise defined, all technical and scientific terms used in the embodiments of the present application have the same meaning as those commonly understood by those skilled in the art of the present application. The terms used in the embodiments of the present application are only for the purpose of describing the embodiments of the present application and are not intended to limit the present application.

[0022] In the following description, reference is made to "some embodiments", which describe a subset of all possible embodiments, but it is understood that "some embodiments" may be the same subset or different subsets of all possible embodiments, and may be combined with each other without conflict. It should also be noted that the terms "first\second\third" involved in the embodiments of the present application are only used to distinguish similar objects and do not represent a specific ordering of the objects. It is understandable that "first\second\third" may be interchanged in a specific order or sequence where permitted, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein.

[0023] It should be understood that the term "and / or" in the embodiments of the present application is only a description of the association relationship of the associated objects, indicating that there may be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0024] At present, various 5G core network manufacturers have implemented a variety of UPF selection methods, and UPF can be selected based on a variety of conditions. For example, UPF selection can usually be based on the following conditions: Data Network Name (DNN), Protocol Data Unit (PDU) session type (such as IPv4, IPv6, IPv4v6, Ethernet, etc.), Service and Session Continuity (SSC) mode, Single Network Slice Selection Assistance information (S-NSSAI), UPF location, UPF N3\N6 routing relationship, UE location (such as the cell, Tracking Area Code (TAC)), traffic and performance analysis based on Network Data Analytics Function (NWDAF), operator's local strategy, UPF static configuration capacity, etc.

[0025] The following is a method for selecting UPF based on UE location. Figure 1 As shown in the figure, DN deploys information technology (IT) resources at both location 1 and location 2, and the 5G core network deploys UPF1 near location 1 and UPF2 near location 2.

[0026] If DN is regarded as a large whole, then SMF can select UPF according to the UE location. For example, when the Radio Access Network (RAN) accessed by the UE is closer to UPF1, SMF can select UPF1; when the RAN accessed by the UE is closer to UPF2, SMF can select UPF2. In this way, SMF can minimize the transmission distance of UE service flow within the 5G system (5G System, 5GS). Furthermore, if there are multiple UPFs with equivalent conditions when selecting UPF according to the UE location, then SMF can further select a UPF that is best from the 5GS perspective to serve the UE based on many conditions such as UPF load, UPF maximum performance, operator strategy, etc.

[0027] However, in actual applications, the shortest transmission distance in 5GS does not necessarily enable the UE to obtain the best access experience.

[0028] For example, as enterprise customers pay more and more attention to the security of their networks (such as DN in 5GS), many networks will require the unified implementation of multiple security policies such as user authentication, access control, and attack prevention. In this process, each enterprise customer will deploy its own DN-AAA (Authentication, Authorization and Accounting) server. These AAA servers will initiate identity authentication for each UE accessing this DN through SMF, and can authorize the UE to the address uniformly managed by the AAA Server. As a result, many security devices in the DN can uniformly identify 5G users (just like they identify hosts or servers that are already in the DN) and complete unified security processing.

[0029] In a DN that implements security policies, to ensure the end-to-end service access of UEs, it is no longer possible to simply "consider the DN as a whole". The AAA server is likely to authorize the UE (or the role / user group to which the UE belongs) with limited access rights. For example, Figure 1 In the scenario shown, the UE is only allowed to access resources on server 2. In addition, security policies may result in different security treatments for UEs when accessing through UPF1 and UPF2, and even some very strict security controls may be implemented in the DN during special periods, for example, only traffic passing through UPF2 is allowed to enter the DN or access specific resources. Based on the above background, if the SMF still selects UPF1 to serve the UE according to the conventional UPF selection method, the following situations may occur: the UE's traffic actually takes a long detour inside the DN, resulting in a poor UE experience, or the UE cannot access the target service at all.

[0030] On the other hand, the security management methods in DN are complex and can change dynamically, and each DN has its own management method. If you want to merge it with the operator's management policy so that SMF can select UPF based on static configuration, the configuration is extremely difficult.

[0031] It can be seen from this that the existing UPF selection method may cause the selected UPF to fail to meet the security requirements of the DN, which in turn causes the UE to be unable to access the DN normally through the UPF, or to be unable to obtain a good access experience.

[0032] In view of this, an embodiment of the present application provides a network element selection method, apparatus, device, storage medium and product. In the method, a session management function network element may receive first authorization information sent by a server device in a data network, and the first authorization information is used to indicate authorized access identification information. Further, the session management function network element may determine whether the access identification corresponding to the first user plane function network element is included in the authorized access identification information. If the access identification corresponding to the first user plane function network element is included in the authorized access identification information, the first user plane function network element may be determined as a target user plane function network element, and the target user plane function network element may be used for communication between a terminal device and a data network.

[0033] According to the method of the embodiment of the present application, since the server device in the data network can authorize the access identifier according to the security requirements of the data network, or in other words, the server device in the data network can provide authorized access identifier information based on the security requirements of the data network, the session management function network element selects the user plane function network element according to the authorized access identifier information provided by the server device, thereby ensuring that the selected user plane function network element (i.e., the target user plane function network element) can meet the security requirements of the data network.

[0034] The embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0035] This embodiment of the application provides a network element selection method. Figure 2 As shown, the method may include:

[0036] S201, a session management function network element receives first authorization information sent by a server device in a data network, where the first authorization information is used to indicate authorized access identification information.

[0037] In this embodiment, the server device in the data network may send the first authorization information to the session management function network element, and accordingly, the session management function network element may receive the first authorization information. The first authorization information is used to indicate the authorized access identification information.

[0038] In some embodiments, the first authorization information is used to indicate authorized access identification information, which can be understood as the first authorization information including the authorized access identification information.

[0039] In some embodiments, the authorized access identification information may include an authorized access identification list, and the access identification list may include at least one authorized access identification. As an example, the access identification may be a data network access identification (Data Network Access Identifier, DNAI).

[0040] In some embodiments, the authorized access identification information may be determined by a server device in the data network. That is, the server device in the data network may determine which access identifications can be authorized, and then the server device may carry the authorized access identifications in the authorized access identification information and send them to the session management function network element, so that the session management function network element can select the target user plane function network element.

[0041] It is understandable that, since the server device in the data network knows the security requirements of the data network, the security requirements of the data network can be taken into consideration when determining which access identifiers can be authorized. In other words, the server device in the data network can authorize the access identifier based on the security requirements of the data network, or the server device in the data network can provide authorized access identifier information based on the security requirements of the data network. In this way, determining / selecting the target user plane function network element based on the authorized access identifier information can ensure that the selected target user plane function network element can meet the security requirements of the data network.

[0042] In some implementations, the server device in the data network may be an Authentication, Authorization and Accounting (AAA) server.

[0043] S202: The session management function network element determines whether the access identifier corresponding to the first user plane function network element is included in the authorized access identifier information.

[0044] In this step, the session management function network element may determine whether the access identifier corresponding to the first user plane function network element is included in the authorized access identifier information. For example, the authorized access identifier information includes an authorized access identifier list, then the session management function network element may determine whether the access identifier corresponding to the first user plane function network element is included in the access identifier list.

[0045] The first user plane function network element may be, for example, a candidate user plane function network element.

[0046] In some embodiments, the access identifier corresponding to the user plane function network element (such as the first user plane function network element) may be preconfigured.

[0047] S203, if the access identifier corresponding to the first user plane function network element is included in the authorized access identifier information, the session management function network element determines the first user plane function network element as the target user plane function network element, and the target user plane function network element is used for communication between the terminal device and the data network.

[0048] That is, if the session management function network element has determined that the access identifier corresponding to the first user plane function network element is included in the authorized access identifier information, then the session management function network element may determine the first user plane function network element as the target user plane function network element. The target user plane function network element may be used for communication between the terminal device and the data network.

[0049] For example, assuming that the authorized access identification information includes an authorized access identification list, then if the access identification corresponding to the first user plane function network element is included in the access identification list, the first user plane function network element can be determined as the target user plane function network element.

[0050] It can be understood that, since the server device in the data network can provide authorized access identification information based on the security requirements of the data network, if the access identification corresponding to the first user plane functional network element is included in the authorized access identification information, it means that the terminal device can meet the security requirements of the data network when communicating with the data network through the first user plane functional network element. Therefore, the first user plane functional network element can be determined as the target user plane functional network element to ensure that the terminal device can meet the security requirements of the data network when communicating with the data network through the target user plane functional network element, thereby improving the success rate and access experience of the terminal device in accessing data network resources.

[0051] In some embodiments, the method may further include: the session management function network element determines whether the first user plane function network element is included in the candidate user plane function network element set. In this case, if the access identifier corresponding to the first user plane function network element is included in the authorized access identifier information, the session management function network element determines the first user plane function network element as the target user plane function network element, which may include: if the access identifier corresponding to the first user plane function network element is included in the authorized access identifier information, and the first user plane function network element is included in the candidate user plane function network element set, then the first user plane function network element is determined as the target user plane function network element.

[0052] That is to say, whether the first user plane function network element can be determined as the target user plane function network element requires not only determining whether the access identifier corresponding to the first user plane function network element is included in the authorized access identifier information, but also determining whether the first user plane function network element is included in the candidate user plane function network element set. Further, if the access identifier corresponding to the first user plane function network element is included in the authorized access identifier information, and the first user plane function network element is included in the candidate user plane function network element set, the first user plane function network element can be determined as the target user plane function network element.

[0053] That is to say, the first user plane function network element, as the target user plane function network element, needs to meet the following conditions 1 and 2 at the same time.

[0054] Condition 1: The access identifier corresponding to the first user plane function network element is included in the authorized access identifier information;

[0055] Condition 2: The first user plane function network element is included in the candidate user plane function network element set.

[0056] Among them, the candidate user plane function network element set may include at least one candidate user plane function network element, and the at least one candidate user plane function network element may be determined by the session management function network element according to certain conditions / factors (such as the conditions of the 5G system itself).

[0057] According to the method of this embodiment, in the process of determining / selecting the target user plane function network element, the session management function network element may consider other conditions / factors in addition to the authorized access identification information, thereby further improving the rationality of the selection of the target user plane function network element and further improving the communication performance of the terminal device.

[0058] In some embodiments, in order to ensure that the target user plane function network element satisfies both the above conditions 1 and 2, there are two optional implementation methods:

[0059] Implementation method 1: The session management function network element may first select a candidate user plane function network element from the candidate user plane function network element set as the first user plane function network element, and then determine whether the access identifier corresponding to the first user plane function network element is included in the authorized access identifier information. If the access identifier corresponding to the first user plane function network element is included in the authorized access identifier information, the first user plane function network element may be determined as the target user plane function network element.

[0060] Implementation method 2: The session management function network element may first select an authorized access identifier (referred to as a target access identifier) ​​from the authorized access identifier information, and use the user plane function network element corresponding to the target access identifier as the first user plane function network element. Then, it may be determined whether the first user plane function network element is included in the candidate user plane function network element set. If the first user plane function network element is included in the candidate user plane function network element set, the first user plane function network element may be determined as the target user plane function network element.

[0061] In some embodiments, the method may further include: the session management function network element determines a set of candidate user plane function network elements based on at least one of the following: the location of the user plane function network element; the capability of the user plane function network element; and the traffic analysis result for the user plane function network element.

[0062] In one implementation, the session management function network element may determine a set of candidate user plane function network elements according to the location of the user plane function network element. For example, the session management function network element may select at least one user plane function network element that is closer to the RAN accessed by the terminal device as a candidate user plane function network element in the set of candidate user plane function network elements. In this way, it is helpful to ensure that the target user plane function network element is closer to the RAN accessed by the terminal device, so that the transmission distance of the service flow of the terminal device in the communication system (such as the 5G system) is shorter, thereby reducing the transmission delay.

[0063] In one implementation, the session management function network element may determine a set of candidate user plane function network elements according to the capabilities of the user plane function network element. Exemplarily, the capabilities of the user plane function network element may include but are not limited to at least one of the following: a PDU session type supported by the user plane function network element (such as IPv4, IPv6, IPv4v6, Ethernet, etc.), and an SSC mode supported by the user plane function network element.

[0064] By determining the candidate user plane function network element set according to the capabilities of the user plane function network element, it is helpful to ensure that the capabilities of the target user plane function network element can meet the communication requirements of the terminal device.

[0065] In one implementation, the session management function network element may determine a set of candidate user plane function network elements according to a traffic analysis result for the user plane function network element.

[0066] Exemplarily, the NWDAF network element may analyze the traffic situation of the user plane function network element to obtain a traffic analysis result for the user plane function network element. Thus, the session management function network element may select at least one user plane function network element according to the traffic analysis result as a candidate user plane function network element in the candidate user plane function network element set. For example, the session management function network element may select a user plane function network element with relatively sufficient resources or relatively small load according to the traffic analysis result as a candidate user plane function network element in the candidate user plane function network element set.

[0067] By determining a candidate user plane function network element set according to the traffic analysis result, it is helpful to ensure that the target user plane function network element can provide a good service quality.

[0068] In some embodiments, the method may further include: a session management function network element establishes a PDU session for the terminal device through a target user plane function network element, and the PDU session is used for data transmission between the terminal device and the data network.

[0069] Exemplarily, after the session management function network element determines the target user plane function network element, a PDU session can be established for the terminal device through the target user plane function network element. For example, the session management function network element can find the N4 identifier (ID) of the target user plane function network element, and then complete the PDU session establishment process with the target user plane function network element based on the N4 ID. Then, the terminal device can transmit data with the data network through the established PDU session.

[0070] According to the method of this embodiment, the session management function network element can establish a PDU session for the terminal device through the target user plane function network element. Since the target user plane function network element is determined according to the authorized access identification information, the PDU session is established for the terminal device through the target user plane function network element, so that the terminal device can transmit data with the data network while meeting the security requirements of the data network, thereby obtaining a better access experience.

[0071] In some embodiments, the method may further include: the session management function network element again receives the first authorization information sent by the server device (ie, the server device in the data network), wherein the first authorization information received again is used to indicate new authorized access identification information and second authorization information.

[0072] In some embodiments, the first authorization information received again is used to indicate new authorized access identification information and second authorization information. It can be understood that the first authorization information received again includes new authorized access identification information and second authorization information.

[0073] Furthermore, if the access identifier corresponding to the target user plane functional network element is included in the new authorized access identifier information, the second authorization information is applied; if the access identifier corresponding to the target user plane functional network element is not included in the new authorized access identifier information, the PDU session is released.

[0074] That is, after the session management function network element determines the target user plane function network element, if it receives the first authorization information sent by the server device again, it can determine whether the access identifier corresponding to the target user plane function network element is included in the new authorized access identifier information.

[0075] In one possible case, the access identifier corresponding to the target user plane function network element is included in the newly authorized access identifier information. In this case, it can be explained that the previously determined target user plane function network element can still meet the security requirements of the data network, so the target user plane function network element can continue to be used, and the second authorization information indicated in the first authorization information received again can be applied normally.

[0076] The second authorization information may be, for example, other information in the first authorization information received again except for the new authorized access identification information.

[0077] In one possible case, the access identifier corresponding to the target user plane functional network element is not included in the new authorized access identifier information. In this case, it can be explained that the previously determined target user plane functional network element no longer meets the security requirements of the data network, or that the server device in the data network recommends replacing a target user plane functional network element to serve the terminal device. Therefore, the session management functional network element needs to release the previously established PDU session and re-determine the target user plane functional network element.

[0078] According to the method of this embodiment, if the previously determined target user plane functional network element no longer meets the security requirements of the data network, the session management functional network element can promptly release the PDU session established through the target user plane functional network element. This is conducive to ensuring that the terminal device always communicates with the data network while meeting the security requirements of the data network, thereby ensuring the access experience of the terminal device to the data network.

[0079] In some embodiments, the server device in the data network is an AAA server. In this case, the method may further include: recording the authorized access identification information and / or the access identification corresponding to the target user plane functional network element in the AAA session of the AAA server.

[0080] That is, after receiving the first authorization information sent by the AAA server, the session management function network element may record the authorized access identifier information indicated by the first authorization information in the AAA session, and / or may record the access identifier corresponding to the target user plane function network element in the AAA session. In this way, it is convenient to maintain the authorization status of the access identifier and / or the determination status of the target user plane function network element.

[0081] To facilitate understanding of the embodiments of the present application, a possible implementation process of the network element selection method provided in the embodiments of the present application is introduced below.

[0082] Figure 3 A possible implementation flow diagram of the network element selection method provided in an embodiment of the present application.

[0083] Among them, SMF (corresponding to the aforementioned session management function network element) can select UPF in the PDU session establishment process. Figure 3 As shown, the implementation process may include:

[0084] S301, UE sends a PDU Session Establishment Request message to AMF.

[0085] S302, AMF selects SMF.

[0086] S303, AMF sends a Nsmf_PDUSession_CreateSMContext Request message to SMF.

[0087] S304, SMF initiates session registration to UDM and obtains contract information.

[0088] S305, SMF sends a Nsmf_PDUSession_CreateSMContext Response message to AMF.

[0089] S306, PDU session authentication / authorization.

[0090] In this step, the DN-AAA server in the DN (corresponding to the aforementioned server device) may send an authorization response message (corresponding to the aforementioned first authorization information) to the SMF, so that the SMF may check whether the authorization response message provides an authorized DNAI list (corresponding to the aforementioned authorized access identification information). If the DN-AAA server provides an authorized DNAI list and the length is not 0, the SMF may record the authorized DNAI list into the AAA session (AAA Session); if the DN-AAA server provides an authorized DNAI list and the length is 0, the SMF may reject the UE's PDU session establishment request and release the AAA session; if the DN-AAA server does not provide an authorized DNAI list, the SMF skips this step.

[0091] S307, SMF selects a PCF.

[0092] S308, SM Policy Association Establishment / SM Policy Association Modification.

[0093] S309, SMF selects UPF.

[0094] When SMF selects UPF, it can first select at least one candidate UPF according to conventional dynamic methods (such as based on UE location, UPF capabilities, NWDAF traffic analysis, etc.), and then SMF can match the DNAI of the at least one candidate UPF with the authorized DNAI list.

[0095] In one possible approach, the SMF may use the first matching DNAI in the authorized DNAI list as the final selected DNAI (hereinafter referred to as the target DNAI), and record the target DNAI in the AAA session.

[0096] Furthermore, the SMF can search for the N4ID of the UPF corresponding to the target DNAI (corresponding to the aforementioned target user plane functional network element), and then based on the N4 ID, the UPF corresponding to the target DNAI continues to complete the PDU session establishment process.

[0097] In one possible approach, if the SMF cannot match a DNAI according to the authorized DNAI list, that is, the DNAI of at least one candidate UPF is not included in the authorized DNAI list, the SMF may reject the UE's PDU session establishment request.

[0098] S310, SMF initiates SM Policy Association Modification.

[0099] S311, SMF sends an N4 Session Establishment / Modification Request to UPF.

[0100] S312, UPF sends an N4 Session Establishment / Modification Response (N4 Session Establishment / Modification Response) to SMF.

[0101] S313, SMF sends a Namf_Communication_N1N2MessageTransfer message to AMF.

[0102] In some embodiments, during the PDU session, if the DN-AAA server performs secondary authorization (i.e., the DN-AAA server sends an authorization response message to the SMF again), the SMF can interpret whether the authorization response message contains a new authorized DNAI list.

[0103] In one possible scenario, if the authorization response message does not contain a new authorized DNAI list, the SMF may apply the authorization information in the authorization response message normally.

[0104] Another possible situation is that if the authorization response message contains a new authorized DNAI list, the SMF can match the target DNAI recorded in the AAA session with the new authorized DNAI list. If the target DNAI recorded in the AAA session can match the DNAI in the new authorized DNAI list, or in other words, the target DNAI recorded in the AAA session is included in the new authorized DNAI list, the SMF can normally apply the authorization information in the authorization response message; if the target DNAI recorded in the AAA session cannot match the DNAI in the new authorized DNAI list, or in other words, the target DNAI recorded in the AAA session is not included in the new authorized DNAI list, the SMF can release the PDU session. In this case, the UE can create a new PDU session again, and then return to S306.

[0105] In some embodiments, for a PDU session that has been authenticated and authorized by a DN-AAA server, the SMF needs to establish and maintain a corresponding AAA session.

[0106] As an example, one or more of the following information a) to i) needs to be maintained in the AAA session:

[0107] a)SMF ID: the ID of this SMF device.

[0108] b) DNN: The name of the DN network in the core network. SMF can obtain it from the PDU session request message or use the local default configuration.

[0109] c) AAA server ID: DN - the ID of the AAA server, which can be its Internet Protocol (IP) address or fully qualified domain name (FQDN).

[0110] d) UE Subscription Permanent Identifier (SUPI): This is the identity of the UE in the core network. The SMF can obtain this information from the PDU Session Request message.

[0111] e) Associated PDU session ID: The ID of the PDU session. The SMF can obtain this information from the PDU session request message.

[0112] f) S-NSSAI: Network slice information. It can be obtained from the PDU session request message or use the local default configuration.

[0113] g) Authorized DNAI list: SMF can read this information from the authorization response message returned by the AAA server and record it in the AAA session.

[0114] h) Selected DNAI (target DNAI): the DNAI actually selected by SMF.

[0115] i) Other information other than a) to h) above.

[0116] It should be understood that the DNAI authorization process between the SMF and the DN-AAA server provided in the embodiment of the present application can be implemented by a variety of protocols. For example, in the Radius protocol, the interaction message can be composed of multiple TLV (Type-Length-Value) triplets of different lengths, and when adding new attributes, the attribute extension of Vendor Specific of Type=26 can be used.

[0117] Table 1 shows an example of the authorized DNAI list provided by the DN-AAA server to the SMF.

[0118] Table 1

[0119]

[0120] It should be noted that the content in Table 1 is only exemplary, and different manufacturers may define the content in Table 1 differently. For example, since different manufacturers have different extensions to the protocol, the numbering rules may also be different, so the attribute numbering may be determined according to the numbering rules of the specific manufacturer.

[0121] According to the method of the embodiment of the present application, the SMF can obtain and save the authorized DNAI list in the interaction with the DN-AAA server. Further, the SMF can combine the authorized DNAI list with other UPF selection conditions (such as UE location, UPF capabilities, NWDAF traffic analysis, etc.) to select the final UPF.

[0122] The above technical means solve the following problems in the prior art:

[0123] 1) In the scheme of dynamically selecting UPF, the current mainstream scheme is to select UPF based on UE location, UPF capability, NWDAF traffic analysis and other methods, but these schemes are based on the conditions of 5GS itself and ignore the characteristics of each DN itself.

[0124] 2) The static UPF selection scheme is difficult to configure and cannot adapt to dynamic changes, making it difficult to meet DN security requirements.

[0125] Through the above technical means, the following technical effects can be achieved:

[0126] 1) When the initial PDU session is established, the SMF can obtain the DNAI authorized by the DN-AAA server and use the authorized DNAI as one of the conditions for UPF selection, so that the UPF selected by the SMF can meet the security requirements of the specific DN. Furthermore, during the survival of the PDU session, the SMF can dynamically obtain the DNAI authorized by the DN-AAA server. If the initially selected UPF no longer meets the security requirements of the DN, the SMF can release the PDU session in time.

[0127] 2) When the selected UPF meets the security requirements of the DN, the success rate of UE accessing DN resources will be higher and the latency will be lower.

[0128] 3) When the selected UPF meets the security requirements of the DN, the security policy of the DN itself is easier to implement.

[0129] The preferred embodiments of the present application are described in detail above in conjunction with the accompanying drawings. However, the present application is not limited to the specific details in the above embodiments. Within the technical concept of the present application, the technical solution of the present application can be subjected to a variety of simple modifications, and these simple modifications all belong to the protection scope of the present application. For example, the various specific technical features described in the above specific embodiments can be combined in any suitable manner without contradiction. In order to avoid unnecessary repetition, the present application will not further explain various possible combinations. For another example, the various different embodiments of the present application can also be arbitrarily combined, as long as they do not violate the idea of ​​the present application, they should also be regarded as the contents disclosed in the present application. For another example, under the premise of no conflict, the various embodiments and / or the technical features in the various embodiments described in the present application can be arbitrarily combined with the prior art, and the technical solution obtained after the combination should also fall within the protection scope of the present application.

[0130] Based on the above embodiments, the embodiments of the present application provide a corresponding network element selection device. The device includes the modules included, and the submodules included in each module, which can be implemented by a processor in a computer device with information processing capabilities; of course, it can also be implemented by a specific logic circuit; in the implementation process, the processor can be a central processing unit (CPU), a microprocessor (MPU), a digital signal processor (DSP) or a field programmable gate array (FPGA), etc.

[0131] The present application embodiment provides a network element selection device. Figure 4 As shown, the network element selection device 400 may include:

[0132] A receiving unit 401, the receiving unit 401 is used to receive first authorization information sent by a server device in a data network, where the first authorization information is used to indicate authorized access identification information;

[0133] Determination unit 402, determination unit 402 is used to: determine whether the access identifier corresponding to the first user plane function network element is included in the authorized access identifier information; if the access identifier corresponding to the first user plane function network element is included in the authorized access identifier information, then the first user plane function network element is determined as the target user plane function network element, and the target user plane function network element is used for communication between the terminal device and the data network.

[0134] In some embodiments, the determination unit 402 is also used to: determine whether the first user plane function network element is included in the candidate user plane function network element set; if the access identifier corresponding to the first user plane function network element is included in the authorized access identifier information, and the first user plane function network element is included in the candidate user plane function network element set, then the first user plane function network element is determined as the target user plane function network element.

[0135] In some embodiments, the determination unit 402 is further used to: determine the candidate user plane function network element set according to at least one of the following: the location of the user plane function network element; the capability of the user plane function network element; and the traffic analysis result for the user plane function network element.

[0136] In some embodiments, the network element selection device 400 also includes an establishment unit, which is used to establish a protocol data unit PDU session for the terminal device through the target user plane functional network element, and the PDU session is used for data transmission between the terminal device and the data network.

[0137] In some embodiments, the receiving unit 401 is also used to: receive the first authorization information sent by the server device again, wherein the first authorization information received again is used to indicate new authorized access identification information and second authorization information; the network element selection device 400 also includes a processing unit, and the processing unit is used to: if the access identifier corresponding to the target user plane functional network element is included in the new authorized access identification information, then apply the second authorization information; if the access identifier corresponding to the target user plane functional network element is not included in the new authorized access identification information, then release the PDU session.

[0138] In some embodiments, the server device is an authentication, authorization and accounting AAA server, and the network element selection device 400 also includes a recording unit, which is used to record the authorized access identification information and / or the access identification corresponding to the target user plane function network element in the AAA session of the AAA server.

[0139] The description of the above device embodiment is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. In some embodiments, the functions or modules / units included in the device provided in the embodiment of the present application can be used to execute the method described in the above method embodiment. For technical details not disclosed in the device embodiment of the present application, please refer to the description of the method embodiment of the present application for understanding.

[0140] It should be noted that in the embodiment of the present application, if the above method is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the relevant technology can be embodied in the form of a software product, which is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a U disk, a mobile hard disk, a read-only memory (ROM), a disk or an optical disk. In this way, the embodiment of the present application is not limited to any specific hardware, software or firmware, or any combination of hardware, software, and firmware.

[0141] An embodiment of the present application also provides a network element selection device, including a memory and a processor, wherein the memory stores a computer program that can be executed on the processor, and when the processor executes the program, some or all of the steps in the above method are implemented.

[0142] The embodiment of the present application further provides a chip, which includes: a processor, which is used to call and run a computer program from a memory, so that a device equipped with the chip executes some or all of the steps in the above method.

[0143] The embodiment of the present application also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, some or all of the steps in the above method are implemented. The computer-readable storage medium can be transient or non-transient.

[0144] An embodiment of the present application also provides a computer program, including a computer-readable code. When the computer-readable code runs in a device, a processor in the device executes part or all of the steps in the above method.

[0145] The present application also provides a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and when the computer program is read and executed by a computer, some or all of the steps in the above method are implemented. The computer program product can be implemented specifically by hardware, software, or a combination thereof. In some embodiments, the computer program product is specifically embodied as a computer storage medium, and in other embodiments, the computer program product is specifically embodied as a software product, such as a software development kit (SDK), etc.

[0146] It should be noted here that the description of the various embodiments above tends to emphasize the differences between the various embodiments, and the same or similar aspects can be referenced to each other. The description of the above device, chip, storage medium, computer program and computer program product embodiments is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. For technical details not disclosed in the embodiments of the device, chip, storage medium, computer program and computer program product of this application, please refer to the description of the method embodiment of this application for understanding.

[0147] The present application embodiment provides a network element selection device. Figure 5 As shown, the network element selection device 500 (hereinafter referred to as device 500) includes a processor 510, and the processor 510 can call and run a computer program from a memory to implement the method in the embodiment of the present application.

[0148] In some embodiments, Figure 5 As shown, the device 500 may further include a memory 520. The processor 510 may call and run a computer program from the memory 520 to implement the method in the embodiment of the present application. The memory 520 may be a separate device independent of the processor 510, or may be integrated in the processor 510.

[0149] In some embodiments, Figure 5 As shown, the device 500 may also include a transceiver 530, and the processor 510 may control the transceiver 530 to communicate with other devices, specifically, to send information or data to other devices, or to receive information or data sent by other devices. The transceiver 530 may include a transmitter and a receiver. The transceiver 530 may further include an antenna, and the number of antennas may be one or more.

[0150] It should be understood that "one embodiment", "an embodiment" or "some embodiments" mentioned throughout the specification means that specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present application. Therefore, "in one embodiment", "in an embodiment" or "in some embodiments" appearing throughout the specification may not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. It should be understood that in various embodiments of the present application, the size of the serial number of each step / process mentioned above does not mean the order of execution, and the execution order of each step / process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present application. The serial numbers of the embodiments of the present application mentioned above are for description only and do not represent the advantages and disadvantages of the embodiments.

[0151] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0152] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units or modules is only a logical function division. There may be other division methods in actual implementation, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored, or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0153] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units; they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0154] In addition, all functional units in the embodiments of the present application may be integrated into one processing unit, or each unit may be a separate unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0155] A person skilled in the art can understand that all or part of the steps of implementing the above method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiment; and the aforementioned storage medium includes: mobile storage devices, read-only memories (ROM), magnetic disks or optical disks, etc., various media that can store program codes.

[0156] Alternatively, if the above-mentioned integrated unit of the present application is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can essentially or in other words, the part that contributes to the relevant technology can be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROMs, magnetic disks, or optical disks.

[0157] The above is only an implementation method of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application.

Claims

1. A network element selection method, applied to a session management function network element, the method comprising: Receiving first authorization information sent by a server device in a data network, where the first authorization information is used to indicate authorized access identification information; Determining whether the access identifier corresponding to the first user plane function network element is included in the authorized access identifier information; If the access identifier corresponding to the first user plane function network element is included in the authorized access identifier information, the first user plane function network element is determined as the target user plane function network element, and the target user plane function network element is used for communication between the terminal device and the data network.

2. The method according to claim 1, further comprising: Determining whether the first user plane function network element is included in a set of candidate user plane function network elements; If the access identifier corresponding to the first user plane function network element is included in the authorized access identifier information, determining the first user plane function network element as the target user plane function network element includes: If the access identifier corresponding to the first user plane function network element is included in the authorized access identifier information, and the first user plane function network element is included in the candidate user plane function network element set, the first user plane function network element is determined as the target user plane function network element.

3. The method according to claim 2, further comprising: The candidate user plane function network element set is determined according to at least one of the following: The location of the user plane functional network element; Capabilities of user plane functional network elements; Traffic analysis results for user plane functional network elements.

4. The method according to any one of claims 1 to 3, further comprising: A protocol data unit (PDU) session is established for the terminal device through the target user plane functional network element, and the PDU session is used for data transmission between the terminal device and the data network.

5. The method according to claim 4, further comprising: receiving again the first authorization information sent by the server device, wherein the first authorization information received again is used to indicate new authorized access identification information and second authorization information; If the access identifier corresponding to the target user plane functional network element is included in the new authorized access identifier information, applying the second authorization information; If the access identifier corresponding to the target user plane functional network element is not included in the new authorized access identifier information, the PDU session is released.

6. The method according to any one of claims 1 to 3, wherein the server device is an authentication, authorization and accounting AAA server, and the method further comprises: The authorized access identification information and / or the access identification corresponding to the target user plane function network element is recorded in the AAA session of the AAA server.

7. A network element selection device, the device comprising: A receiving unit, the receiving unit is used to receive first authorization information sent by a server device in a data network, the first authorization information is used to indicate authorized access identification information; A determination unit, the determination unit being configured to: determine whether an access identifier corresponding to the first user plane function network element is included in the authorized access identifier information; If the access identifier corresponding to the first user plane function network element is included in the authorized access identifier information, the first user plane function network element is determined as the target user plane function network element, and the target user plane function network element is used for communication between the terminal device and the data network.

8. A network element selection device, the device comprising: A memory for storing computer executable instructions; A processor, connected to the memory, configured to implement the method according to any one of claims 1 to 6 by executing the computer executable instructions.

9. A computer-readable storage medium storing a computer program, wherein the computer program implements the method according to any one of claims 1 to 6 when executed by at least one processor.

10. A computer program product, comprising a computer program or instructions, wherein when the computer program or instructions are executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images