Primary authentication method of user equipment (UE), electronic equipment and storage medium

Abstract

Provided are a primary authentication method of a user equipment (UE), an electronic device and a storage medium, relating to the technical field of communications, the primary authentication method of the UE comprising: a first network element receiving a re-primary authentication request message sent by a second network element, the re-primary authentication request message carrying a UE identifier, the first network element determining a UE according to the UE identifier, and sending the UE to the second network element; the method comprises the following steps that: a first network element receives UE (User Equipment) and acquires the state of the UE, then the first network element determines corresponding response indication information according to the state of the UE and sends a re-main authentication response message to a second network element, the re-main authentication response message carries the response indication information, and the second network element performs corresponding operation according to the response indication information. The operation of the second network element can be adapted to the current state of the UE, thereby achieving the purpose of improving the success rate of the main authentication process of the UE, and improving the network service quality and the user experience.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of communication technology, and in particular to a primary authentication method for a user equipment UE, an electronic device, and a storage medium. Background Art

[0002] At present, during the network registration process, the user equipment (UE) submits a registration request to the home network through the visited network element. After receiving the registration request from the UE, the home network element decides whether to execute the main authentication process triggered by the home network according to the event or its own authentication policy. In triggering the main authentication process, the home network sends a re-authentication request to the visited network element. However, after the visited network element receives the re-authentication request, the UE may be in a special scenario, which may cause the home network element or the visited network element to fail to authenticate based on the original policy operation, thereby affecting the network service quality and reducing the user experience. How to trigger the main authentication process when the UE is in a special scenario is a technical problem that needs to be solved at present. Summary of the invention

[0003] The embodiments of the present application provide a primary authentication method for a user equipment UE, an electronic device, and a storage medium, aiming to improve the primary authentication process of the UE, thereby improving the network service quality and user experience.

[0004] In a first aspect, an embodiment of the present application provides a primary authentication method for a user equipment UE, which is applied to a first network element, and the method includes:

[0005] receiving a re-authentication request message sent by the second network element, where the re-authentication request message carries a UE identifier;

[0006] Determine the UE according to the UE identifier, and obtain the state of the UE;

[0007] Determine response indication information according to the state of the UE;

[0008] Send a re-authentication response message to the second network element, where the re-authentication response message carries the response indication information, so that the second network element performs a corresponding operation according to the response indication information.

[0009] In a second aspect, an embodiment of the present application provides a primary authentication method for a user equipment UE, which is applied to a second network element, and the method includes:

[0010] Sending a re-authentication request message to the first network element, where the re-authentication request message carries a UE identifier, so that the first network element determines the UE according to the UE identifier and determines response indication information according to a state of the UE;

[0011] receiving a re-authentication response message sent by the first network element, wherein the re-authentication response message carries the confirmation response indication information;

[0012] Perform corresponding operations according to the response indication information.

[0013] In a third aspect, an embodiment of the present application provides an electronic device, including:

[0014] one or more processors;

[0015] A memory having one or more programs stored thereon, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the primary authentication method of the user equipment UE as described in the first aspect above, or the primary authentication method of the user equipment UE as described in the second aspect above.

[0016] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the primary authentication method of the user equipment UE as described in the first aspect above, or the primary authentication method of the user equipment UE as described in the second aspect above.

[0017] The embodiment of the present application provides a primary authentication method, electronic device and storage medium for a user equipment UE. The first network element receives a re-authentication request message sent by a second network element, and the re-authentication request message carries a UE identifier. The first network element determines the UE according to the UE identifier and obtains the status of the UE. Then the first network element determines corresponding response indication information according to the status of the UE, and sends a re-authentication response message to the second network element. The re-authentication response message carries the response indication information. The second network element performs corresponding operations according to the response indication information. The operation of the second network element can be adapted to the current status of the UE, thereby achieving the purpose of improving the success rate of the primary authentication process of the UE, thereby improving the network service quality and user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The accompanying drawings are used to provide a further understanding of the technical solution of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the technical solution of the present invention and do not constitute a limitation on the technical solution of the present invention.

[0019] Figure 1 It is a network system architecture diagram provided by an embodiment of the present application;

[0020] Figure 2 is a network system architecture diagram provided by another embodiment of the present application;

[0021] Figure 3 It is a flowchart of a primary authentication method of a user equipment UE provided in an embodiment of the present application;

[0022] Figure 4 It is a flowchart of a primary authentication method of a user equipment UE provided by another embodiment of the present application;

[0023] Figure 5 It is a flow chart of a primary authentication method of a user equipment UE in the prior art;

[0024] Figure 6 It is a flowchart of a primary authentication method of a user equipment UE provided by another embodiment of the present application;

[0025] Figure 7 It is a flowchart of a primary authentication method of a user equipment UE provided by another embodiment of the present application;

[0026] Figure 8 It is a flowchart of a primary authentication method of a user equipment UE provided by another embodiment of the present application;

[0027] Fig. 9 It is a flowchart of a primary authentication method of a user equipment UE provided by another embodiment of the present application;

[0028] Fig.10 It is a flowchart of a primary authentication method of a user equipment UE provided by another embodiment of the present application;

[0029] Fig.11 It is a flowchart of a primary authentication method of a user equipment UE provided by another embodiment of the present application;

[0030] Fig.12 It is a flowchart of a primary authentication method of a user equipment UE provided by another embodiment of the present application;

[0031] Fig.13 It is a flowchart of a primary authentication method of a user equipment UE provided by another embodiment of the present application;

[0032] Fig.14 It is a flowchart of a primary authentication method of a user equipment UE provided by another embodiment of the present application;

[0033] Fig.15 It is a schematic diagram of the device structure of the electronic device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0034] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0035] It should be understood that in the description of the embodiments of the present application, if there is a description of "first", "second", etc., it is only used for the purpose of distinguishing technical features, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features or implicitly indicating the order of the indicated technical features. "At least one" means one or more, and "multiple" means two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist, for example, A and / or B, which can indicate the existence of A alone, the existence of A and B at the same time, and the existence of B alone. Wherein A and B can be singular or plural. The character " / " generally indicates that the associated objects before and after are in an "or" relationship. "At least one of the following" and similar expressions refer to any group of these items, including any group of single or plural items. For example, at least one of a, b and c can indicate: a, b, c, a and b, a and c, b and c, or a and b and c, where a, b, c can be single or multiple.

[0036] In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0037] The primary authentication method for the user terminal UE provided in the embodiment of the present application can be applied to various communication systems, such as: 5G communication system, or various future communication systems, etc.

[0038] The network architecture and business scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. A person of ordinary skill in the art can appreciate that with the evolution of the network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0039] Before introducing the technical solution of the embodiment of the present application, the network architecture of the embodiment of the present application is first exemplified. Figure 1 , Figure 1 is a schematic diagram of a network system architecture provided by an embodiment of the present application, such as Figure 1As shown in Figure 1, the network architecture consists of User Equipment (UE), Radio Access Network (RAN) and operator network. The operator network includes Core Network (CN) and Data Network (DN). UE accesses the operator network through RAN. CN, as a bearer network, provides an interface to DN, providing communication connection, authentication, management, policy control and data service bearing for UE. Among them, CN includes: Access and Mobility Management Function (AMF), Security Anchor Function (SEAF), Session Management Function (SMF), User Plane Function (UPF), Authentication Server Function (AUSF), Unified Data Management Function (UDM), Network Exposure Function (NEF), Application Function (AF), Network Slice Selection Function (NSSF), Policy Control Function (PCF), Network Function Repository Function (NRF), etc. Figure 1 In the figure, N1, N2, N3, N4 and N6 are interfaces between corresponding network elements; Namf, Nsmf, Nausf, Nudm, Nnef, Npcf, Naf, Nnssf and Nnrf are the services presented by AMF, SMF, AUSF, UDM, NEF, PCF, AF, NSSF and NRF respectively.

[0040] See also Figure 2 , Figure 2 for Figure 1The network elements and their connection relationships mainly involved in the embodiments of the present application in the network architecture shown include UE, AMF, UDM and NF, etc., wherein the UE includes a handheld device, a vehicle-mounted device, a wearable device or a computing device with a wireless communication function. Exemplarily, the UE can be a mobile phone, a tablet computer or a computer with a wireless transceiver function. The terminal device can also be a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a wireless terminal in industrial control, a wireless terminal in unmanned driving, a wireless terminal in telemedicine, a wireless terminal in a smart grid, a wireless terminal in a smart city, a wireless terminal in a smart home, and the like. The UE communicates with the AMF through the N1 interface, or communicates with the AMF through the RAN and N2 interfaces. AMF is responsible for the access management and mobility management of the terminal, such as registration management, connection management, mobility management, reachability management, etc. In practical applications, it includes the mobility management function in the Mobility Management Entity (MME) in the network framework of the Long Term Evolution (LTE) system, and adds the access management function. In addition, SEAF provides the main authentication service. In the current standard definition, SEAF and AMF are combined. Namf is the service-oriented interface provided by AMF. UDM is a control plane network element provided by the operator, responsible for generating authentication parameters, storing the Subscriber Permanent Identifier (SUPI), registration information, credentials, contract data, etc. of the operator's network. Nudm is the service-oriented interface provided by UDM. In addition, the Authentication credential Repository and Processing Function (ARPF) is located in UDM and is used to generate authentication parameters. A network function (NF) is a software module or entity in the network, used to perform specific network tasks or functions. Access and Mobility Management Function (AAnF) is a network function NF in the core network, responsible for managing the mobility of user equipment UE, including UE switching, redirection and registration. Naanf is the service-oriented interface provided by AAnf. AUSF is a control plane network element provided by the operator, which can be used for the operator network to authenticate network subscribers. Nausf is the service-oriented interface provided by AUSF.AMF / SEAF and AUSF can be located in the same network, for example, AMF / SEAF and AUSF are both located in the Home Public Land Mobile Network (HPLMN), referred to as the Home network for short. AMF / SEAF and AUSF can also be located in different networks, for example, SEAF / AMF is located in the Visited Public Land mobile Network (VPLMN), referred to as the Visited network for short, and AUSF is located in the Home network. If the UE is outside the coverage of the Home network, it cannot directly access the Home network to obtain services. At this time, if the UE is within the coverage of the Visited network, the UE needs to access the Visited network in order to obtain network services provided by the Visited network and the Home network.

[0041] At present, during the network registration process, the user equipment UE submits a registration request to the home network through the visited network element. After receiving the registration request from the UE, the home network element decides whether to execute the main authentication process triggered by the home network based on the event or its own authentication policy. In triggering the main authentication process, the home network sends a re-master authentication request to the visited network element. However, after the visited network element receives the re-master authentication request, the UE may be in a special scenario, which may cause the home network element or the visited network element to fail to authenticate based on the original policy operation, thereby affecting the network service quality and reducing the user experience. How to trigger the main authentication process when the UE is in a special scenario is a technical problem that needs to be solved at present.

[0042] like Figure 5 A primary authentication method is shown, comprising:

[0043] Step S501, UDM pre-configures the operator authentication policy to determine when to trigger the main authentication process;

[0044] Step S502: UE registers with the network. AMF / SEAF registers the UE with UDM through Nudm_UECM_registration and provides a callback URI for UDM.

[0045] Step S503: The NF (such as AAnF) determines whether to send a Nudm_UECM_AuthTrigger request to the UDM according to the operator's local authentication policy, so as to use the UDM service for primary authentication. The Nudm_UECM_AuthTrigger request includes the SUPI of the UE.

[0046] Step S504: UDM determines whether to perform the primary authentication process triggered by the home network according to an event (e.g., NF request) or its own authentication policy. If different AMF / SEAFs are registered in UDM for different access modes, UDM shall select an AMF / SEAF to perform the primary authentication. The criteria for selecting AMF / SEAF depends on the authentication policy of UDM itself.

[0047] Step S505: If the UDM determines whether to perform the home network-triggered primary authentication process according to the NF request, the UDM replies a Nudm_UECM_AuthTrigger response to the NF;

[0048] Step S506: UDM sends a Nudm_UECM_Re-AuthenticationNotification message to AMF / SEAF through the callback URI provided by AMF / SEAF, where the message carries the SUPI of the UE.

[0049] Step S507, after receiving the Nudm_UECM_Re-AuthenticationNotification message from UDM, AMF / SEAF determines whether to perform the primary authentication process based on its own local authentication policy and UE status. If AMF / SEAF determines that the primary authentication cannot be performed, AMF / SEAF sends an authentication response message with the failure reason to UDM. If AMF / SEAF determines that the primary authentication can be performed, AMF / SEAF confirms the re-primary authentication request sent by UDM. If AMF / SEAF confirms the re-primary authentication request sent by UDM, but AMF / SEAF cannot initiate the primary authentication of the UE (for example, the UE is in an unreachable state), AMF / SEAF sets the authentication suspension flag;

[0050] During this period, when the UE reconnects to the same AMF / SEAF or becomes reachable again, the AMF / SEAF checks the authentication suspension flag and performs re-authentication if necessary. Once the UE re-authentication is completed, the AMF / SEAF resets the authentication suspension flag; when receiving an authentication response message with a failure reason sent from the AMF / SEAF, the UDM can detect whether the AMF / SEAF under another access mode is available. The UDM can select another available AMF / SEAF and retry to trigger the primary authentication;

[0051] Step S508: AMF / SEAF starts the main authentication process.

[0052] After AMF / SEAF receives the Nudm_UECM_Re-AuthenticationNotification message sent by UDM, there are still problems in which AMF / SEAF and UDM cannot perform operations correctly in multiple scenarios such as the UE is performing primary authentication, the UE is performing mobility registration, or the UE is performing handover, which seriously affects the service quality and reduces the user experience.

[0053] The present application embodiment first proposes a primary authentication method for a user equipment UE, which is applied to a first network element. Figure 3 , Figure 3 A primary authentication method for a user equipment UE provided in an embodiment of the present application is shown, such as Figure 3 As shown, the main authentication method of the user equipment UE includes but is not limited to steps S301 to S304.

[0054] Step S301: receiving a master authentication request message sent by a second network element, where the master authentication request message carries a UE identifier.

[0055] It can be understood that the first network element is a visited network network element, and the second network element is a home network element. In the main authentication process, the second network element sends a re-authentication request carrying a UE identifier to the first network element to request the first network element to execute the main authentication process of the UE, wherein the UE identifier can be the Subscriber Permanent Identifier (SUPI) of the user equipment in the operator's network or other UE identifiers that can uniquely identify the UE, and the embodiments of the present application are not limited here.

[0056] Step S302: Acquire the status of the corresponding UE according to the UE identifier.

[0057] It can be understood that after receiving the re-authentication request message carrying the UE identifier, the first network element obtains the status of the corresponding user equipment UE according to the UE identifier carried in the re-authentication request message. Exemplarily, the status of the user equipment UE may be whether the user equipment is performing primary authentication (authentication), whether it is performing a mobility registration process (mobility registration) or whether it is performing a handover process (handover), etc., which may cause the first network element and the second network element to be unable to correctly perform the primary authentication operation. The embodiments of the present application are not limited here.

[0058] It should be noted that the user equipment UE sends various service requests carrying its own status information to the first network element to request the first network element to provide corresponding services. The first network element can obtain the UE status from the various service requests reported by the UE and record it using the UE identifier that can uniquely identify the user equipment. Alternatively, the first network element actively requests the user equipment UE to reply with its own status information and records it using the UE identifier that can uniquely identify the user equipment, so that the first network element can obtain the corresponding UE status from the corresponding UE status record information according to the UE identifier.

[0059] Step S303: determine response indication information according to the state of the UE.

[0060] It should be understood that after obtaining the status of the corresponding UE according to the UE identifier, the first network element determines the response indication information according to the status of the UE, wherein the response indication information is determined by the UE status and can be indication information for characterizing the confirmation of the re-authentication request message sent by the second network element, an error code for indicating that the UE is in a special status, or a reason value for indicating that the UE is in a special status, and other indication information. Different response indication information is used to represent different UE statuses to instruct the second network element to perform subsequent corresponding operations under different UE statuses.

[0061] Step S304: Send a re-authentication response message to the second network element, where the re-authentication response message carries response indication information, so that the second network element performs corresponding operations according to the response indication information.

[0062] It can be understood that after determining the response indication information according to the status of the UE, the first network element sends a re-master authentication response information carrying the response indication information to the second network element. After the second network element receives the re-master authentication response information sent by the first network element, the second network element can perform subsequent operations for the special UE status according to the response indication information carried in the re-master authentication response information, so that the subsequent operations of the network element can be adapted to the current status of the UE, avoiding the situation where the network element cannot correctly perform the corresponding main authentication operation when the UE is in a special status, resulting in authentication failure, thereby achieving the purpose of improving the success rate of the UE's main authentication process.

[0063] In some embodiments, the first network element is an access and mobility management function AMF network element or a security anchor function SEAF network element, and the second network element is a unified data management UDM network element.

[0064] It should be understood that the first network element is an AMF or SEAF network element, and the second network element is a UDM network element. Figure 4In the UE primary authentication process shown, when the user equipment UE performs network registration, the AMF / SEAF network element registers the UE with the UDM network element through the Nudm registration request Nudm_UECM_registration. The UDM network element determines whether to perform the primary authentication process triggered by the home network according to the event or its own authentication policy. Then the UDM network element sends a re-authentication request message to the AMF / SEAF, that is, the Nudm_UECM_Re-AuthenticationNotification message, which carries the SUPI of the UE. After receiving the re-authentication request message sent by the UDM network element, the AMF / SEAF network element determines whether to perform the primary authentication process of the UE. Specifically, the AMF / SEAF network element obtains the status of the corresponding UE according to the SUPI of the UE, and then the AMF / SEAF network element determines the response indication information according to the status of the UE, and sends a re-authentication response message carrying the response indication information to the UDM network element, that is, the Nudm_UECM_Re-AuthenticationNotification response message, and the UDM network element performs corresponding operations according to the response indication information carried in the response message.

[0065] In some embodiments, determining the response indication information according to the state of the UE includes:

[0066] When the UE is in the state of performing the main authentication process, it is determined that the response indication information is confirmation request indication information.

[0067] Correspondingly, sending a re-authentication response message to the second network element, where the re-authentication response message carries response indication information, so that the second network element performs a corresponding operation according to the response indication information, including:

[0068] A re-authentication response message is sent to the second network element, where the re-authentication response message carries confirmation request indication information, so that the second network element performs the primary authentication process of the UE according to the confirmation request indication information.

[0069] It can be understood that if the UE is performing the main authentication process when the first network element receives the re-authentication request message sent by the second network element, the first network element determines that the response indication information is the confirmation request indication information and sends a re-authentication response message carrying the confirmation request indication information to the second network element, that is, the first network element directly confirms the second network element's re-authentication request in the re-authentication response message sent to the second network element.

[0070] For example, the first network element is an AMF / SEAF network element and the second network element is a UDM network element. Figure 6 , Figure 6 A schematic diagram of a process flow of a primary authentication method for a user equipment UE provided in an embodiment of the present application is shown, Figure 6As shown, if AMF / SEAF is already performing the primary authentication process on the UE when it receives the re-authentication request message sent by UDM, AMF / SEAF replies to UDM with a Nudm_UECM_Re-AuthenticationNotification response message and confirms the re-authentication request sent by UDM in the response message.

[0071] In an embodiment of the present application, if a first network element serving as a visited network network element receives a re-primary authentication request sent by a second network element serving as a home network element to instruct the first network element to perform primary authentication on the UE, and the UE is performing a primary authentication process, the first network element confirms the primary authentication request to the second network element, so that subsequent operations of the network element can be adapted to the state in which the UE is performing the primary authentication process, thereby avoiding the situation in which the visited network network element and the home network element encounter the situation in which the UE is performing the primary authentication process and cannot correctly perform the corresponding primary authentication operation when executing the primary authentication process, thereby achieving the purpose of improving the success rate of the UE's primary authentication process.

[0072] In some embodiments, determining the response indication information according to the state of the UE includes:

[0073] When the UE is in the state of performing a mobility registration procedure, it is determined that the response indication information is the first error indication information.

[0074] Correspondingly, sending a re-authentication response message to the second network element, where the re-authentication response message carries response indication information, so that the second network element performs a corresponding operation according to the response indication information, including:

[0075] A re-authentication response message is sent to the second network element, where the re-authentication response message carries the first error indication information, so that the second network element starts a timer according to the first error indication information, and re-sends the re-authentication request message according to the UE's latest first network element registration information after the timer expires.

[0076] It can be understood that if the first network element receives the re-authentication request message sent by the second network element while the UE is performing a mobility registration process, the first network element determines that the response message is the first error indication information and sends a re-authentication response message carrying the first error indication information to the second network element. When the second network element receives the re-authentication response message carrying the first error indication information, the second network element starts a timer and re-sends the re-authentication request message according to the latest first network element registration information of the UE after the timer expires, that is, the second network element re-sends the re-authentication request message of the UE after a preset time interval. Wherein, the receiving network element of the subsequent re-authentication request message is determined according to whether the first network element sends a change after the mobility registration process of the UE. If the latest first network element registration information of the UE shows that the first network element of the UE has not changed after the mobility registration process, the second network element re-sends the re-authentication request message of the UE to the original first network element after the preset time interval. If the latest first network element registration information of the UE shows that the first network element of the UE has changed after the mobility registration process, the second network element re-sends the re-authentication request message of the UE to the changed first network element after the preset time interval.

[0077] It should be noted that the UE mobility registration process refers to when the user equipment UE moves from one service area to another service area, the UE initiates a registration request to the AMF of the new service area.

[0078] It should also be noted that the first error indication information is used to indicate the reason for the failure of the main authentication. It can be an error code used to characterize "the UE is performing a mobility registration process", such as TEMPORARY_REJECT_REGISTRATION_ONGOING, or it can be a reason value used to characterize "the UE is performing a mobility registration process", such as 1. That is to say, the first error indication information can be used to inform the second network element that "the UE is performing a mobility registration process". The embodiment of the present application does not limit the specific form of the first error indication information.

[0079] For example, the first network element is an AMF / SEAF network element and the second network element is a UDM network element. Figure 7 , Figure 7 A schematic diagram of a process flow of a primary authentication method for a user equipment UE provided in an embodiment of the present application is shown, Figure 7As shown, if AMF / SEAF receives the re-authentication request message sent by UDM while the UE is performing a mobility registration process, AMF / SEAF replies to UDM with a Nudm_UECM_Re-AuthenticationNotification response message, which includes an error code TEMPORARY_REJECT_REGISTRATION_ONGOING indicating the cause of failure, or includes other cause value 1 indicating that "UE is performing a mobility registration process". When UDM receives the response message and the response message includes an error code TEMPORARY_REJECT_REGISTRATION_ONGOING indicating the cause of failure, or includes other cause value 1 indicating that "UE is performing a mobility registration process", UDM starts a timer (for example, 1 second) and resends the re-authentication request message according to the UE's latest AMF / SEAF registration information after the timer expires.

[0080] In an embodiment of the present application, if a first network element serving as a visited network network element receives a re-master authentication request sent by a second network element serving as a home network element to instruct the first network element to perform master authentication on the UE, and the UE is performing a mobility registration process, the first network element sends a re-master authentication response message carrying first error indication information to the second network element. After receiving the re-master authentication response message carrying the first error indication information, the second network element resends the re-master authentication request message according to the UE's latest first network element registration information, so that subsequent operations of the network element can be adapted to the state in which the UE is performing a mobility registration process, thereby avoiding the situation in which the visited network network element and the home network element encounter the situation in which the UE is performing a mobility registration process and cannot correctly perform the corresponding master authentication operation when performing the master authentication process, thereby achieving the purpose of improving the success rate of the UE's master authentication process.

[0081] In some embodiments, determining the response indication information according to the state of the UE includes:

[0082] When the UE is in the state of performing a mobility registration procedure and the first network element does not change in the mobility registration procedure, it is determined that the response indication information is confirmation request indication information.

[0083] Correspondingly, sending a re-authentication response message to the second network element, where the re-authentication response message carries response indication information, so that the second network element performs a corresponding operation according to the response indication information, including:

[0084] A re-authentication response message is sent to the second network element, where the re-authentication response message carries confirmation request indication information, so that the second network element performs the primary authentication process of the UE according to the confirmation request indication information.

[0085] It can be understood that if the UE is performing a mobility registration process when the first network element receives the re-authentication request message sent by the second network element, and the first network element does not change during the mobility registration process, the first network element determines that the response indication information is a confirmation request indication information and sends a re-authentication response message carrying the confirmation request indication information to the second network element, that is, the first network element directly confirms the re-authentication request of the second network element in the re-authentication response message replied to the second network element.

[0086] For example, the first network element is an AMF / SEAF network element and the second network element is a UDM network element. Figure 8 , Figure 8 A schematic diagram of a process flow of a primary authentication method for a user equipment UE provided in an embodiment of the present application is shown, Figure 8 As shown, if the UE is performing a mobility registration process when the AMF / SEAF receives the re-authentication request message sent by the UDM, and the AMF / SEAF does not change after the UE performs the mobility registration process, the AMF / SEAF replies to the UDM with a Nudm_UECM_Re-AuthenticationNotification response message and confirms the re-authentication request sent by the UDM in the response message.

[0087] In an embodiment of the present application, if a first network element serving as a visited network network element receives a re-primary authentication request sent by a second network element serving as a home network element to instruct the first network element to perform primary authentication on the UE, and the UE is performing a mobility registration process, and the first network element does not change during the mobility registration process, the first network element confirms the primary authentication request to the second network element, so that subsequent operations of the network element can be adapted to the state in which the UE is performing a mobility registration process, thereby avoiding the situation in which the visited network network element and the home network element encounter the situation in which the UE is performing a mobility registration process and cannot correctly perform the corresponding primary authentication operation when executing the primary authentication process, thereby achieving the purpose of improving the success rate of the UE's primary authentication process.

[0088] In some embodiments, determining the response indication information according to the state of the UE includes:

[0089] When the UE is in the process of performing a mobility registration process and a first network element change event occurs in the mobility registration process, the response indication information is determined to be the second error indication information, the third error indication information or the fourth error indication information, wherein the first network element change event indicates that the UE switches access from the source first network element to the target first network element, and the first network element is the source first network element.

[0090] Correspondingly, sending a re-authentication response message to the second network element, where the re-authentication response message carries response indication information, so that the second network element performs a corresponding operation according to the response indication information, including:

[0091] Sending a re-authentication response message to the second network element, where the re-authentication response message carries second error indication information, so that the second network element starts a timer according to the second error indication information, and re-sends the re-authentication request message according to the latest first network element registration information of the UE after the timer expires;

[0092] or,

[0093] Sending a re-authentication response message to the second network element, where the re-authentication response message carries third error indication information, so that the second network element terminates the primary authentication process for the UE according to the third error indication information;

[0094] or,

[0095] A re-authentication response message is sent to the second network element, where the re-authentication response message carries fourth error indication information, so that the second network element determines the target first network element according to the fourth error indication information, and sends the re-authentication response message to the target first network element after the mobility registration process is completed.

[0096] It can be understood that if the UE is performing a mobility registration process when the first network element receives a re-authentication request message sent by the second network element, and a first network element change event occurs in the mobility registration process and the current first network element is the source first network element in the first network element change event, the first network element determines that the response indication information is the second error indication information, the third error indication information or the fourth error indication information and sends a re-authentication response message carrying the corresponding error indication information to the second network element, and the second network element performs subsequent operations according to the type of error indication information carried in the re-authentication response message.

[0097] It should be noted that the second error indication information, the third error indication information and the fourth error indication information are all used to indicate the reason for the failure of the primary authentication. Among them, the second error indication information may be an error code used to characterize "UE is performing a mobility registration process", such as TEMPORARY_REJECT_REGISTRATION_ONGOING; the second error indication information may be an error code used to characterize "authentication not allowed", such as REAUTHENTICATION_NOT_ALLOWED; the third error knowledge information may be a reason value used to characterize "UE is performing a mobility registration process and the first network element is about to change", such as 2. In other words, different error indication information can be used to inform the second network element of different reasons for the failure of the primary authentication. The embodiment of the present application does not limit the specific forms of the second error indication information, the third error indication information and the fourth error indication information.

[0098] Specifically, when the second network element receives a re-authentication response message carrying second error indication information sent by the first network element, the second network element starts a timer according to the second error indication information, and resends the re-authentication request message according to the UE's latest registration information of the first network element after the timer expires. That is, the second network element learns that the UE is performing a mobility registration process through the second error indication information carried in the re-authentication response message, and the second network element chooses to resend the UE's re-authentication request message after a preset time interval to continue the UE's main authentication process.

[0099] Specifically, when the second network element receives a re-authentication response message sent by the first network element and carrying the third error indication information, the second network element terminates the main authentication process for the UE according to the third error indication information. That is, the second network element learns that authentication is not allowed through the third error indication information carried in the re-authentication response message, and the second network element chooses to terminate the main authentication process for the UE. If a new registration request from the first network element is subsequently received, the second network element can decide whether to initiate a new main authentication process according to its own authentication policy.

[0100] Specifically, when the second network element receives a re-authentication response message sent by the first network element and carrying the fourth error indication information, the second network element determines the target first network element based on the fourth error indication information, and sends a re-authentication response message to the target first network element after the mobility registration process is completed. That is, the second network element learns through the fourth error indication information carried in the re-authentication response message that the UE is performing a mobility registration process and the UE switches access from the source first network element to the target first network element. The second network element chooses to send a re-authentication response message to the target first network element after the mobility registration process is completed to continue the UE's main authentication process.

[0101] For example, the first network element is an AMF / SEAF network element and the second network element is a UDM network element. Fig. 9 , Fig. 9 A schematic diagram of a process flow of a primary authentication method for a user equipment UE provided in an embodiment of the present application is shown, Fig. 9 As shown, when the source AMF / SEAF receives the re-authentication request message sent by UDM, the UE is performing a mobility registration process, the AMF / SEAF is about to change and the source AMF / SEAF receives the re-authentication request message sent by UDM, then the source AMF / SEAF can perform one of the following steps:

[0102] A. The source AMF / SEAF replies to the UDM with a Nudm_UECM_Re-AuthenticationNotification response message, which contains the error code TEMPORARY_REJECT_REGISTRATION_ONGOING indicating the cause of the failure.

[0103] B. The source AMF / SEAF replies to the UDM with a Nudm_UECM_Re-AuthenticationNotification response message, which contains the error code REAUTHENTICATION_NOT_ALLOWED indicating the cause of the failure.

[0104] C. The source AMF / SEAF replies to the UDM with a Nudm_UECM_Re-AuthenticationNotification response message, which contains a cause value 2 indicating that "the UE is undergoing a mobility registration procedure and the AMF / SEAF is about to change".

[0105] Correspondingly, after receiving the Nudm_UECM_Re-AuthenticationNotification response message, UDM performs the subsequent process according to the error indication information carried in the response message:

[0106] A. If the response message includes the second error indication information, i.e., the error code TEMPORARY_REJECT_REGISTRATION_ONGOING, the UDM starts a timer (e.g., 1 second), and resends the re-authentication request message in step S907 according to the latest AMF / SEAF registration information of the UE after the timer expires;

[0107] B. If the response message contains the third error indication information, that is, the error code REAUTHENTICATION_NOT_ALLOWED, UDM does not need to perform other operations, that is, UDM terminates the main authentication process for the UE. If UDM subsequently receives a new AMF registration request, UDM can determine whether to initiate a new main authentication process based on its own authentication policy;

[0108] C. If the response message contains the fourth error indication information, that is, the other reason value 2 representing "UE is performing a mobility registration process and the AMF / SEAF is about to change", the UDM determines the changed target AMF / SEAF and sends a re-authentication request message to the target AMF / SEAF after the current mobility registration process ends.

[0109] In an embodiment of the present application, if a first network element serving as a visited network network element receives a re-master authentication request sent by a second network element serving as a home network element to instruct the first network element to perform master authentication on the UE, and the UE is performing a mobility registration process, a first network element change event occurs in the mobility registration process and the current first network element is the source first network element in the first network element change event, then the first network element sends a re-master authentication response message carrying second error indication information, second error indication information or third error indication information to the second network element, and the second network element performs corresponding operations according to the type of error indication information carried in the re-master authentication response message, so that subsequent operations of the network element can be adapted to the state in which the UE is performing a mobility registration process, thereby avoiding the situation in which the visited network network element and the home network element encounter the situation in which the UE is performing a mobility registration process and the first network element changes and cannot correctly perform the corresponding master authentication operation when executing the master authentication process, thereby achieving the purpose of improving the success rate of the master authentication process of the UE.

[0110] In some embodiments, determining the response indication information according to the state of the UE includes:

[0111] When the UE is in the process of performing a mobility registration process and a first network element change event occurs during the mobility registration process, the response indication information is determined to be confirmation request indication information, wherein the first network element change event indicates that the UE switches access from a source first network element to a target first network element, and the first network element is the target first network element.

[0112] Correspondingly, sending a re-authentication response message to the second network element, where the re-authentication response message carries response indication information, so that the second network element performs a corresponding operation according to the response indication information, including:

[0113] A re-authentication response message is sent to the second network element, where the re-authentication response message carries confirmation request indication information, so that the second network element performs the primary authentication process of the UE according to the confirmation request indication information.

[0114] It can be understood that if the UE is performing a mobility registration process when the first network element receives a re-authentication request message sent by the second network element, and a first network element change event occurs in the mobility registration process and the current first network element is the target first network element in the first network element change event, the first network element determines that the response indication information is a confirmation request indication information and sends a re-authentication response message carrying the confirmation request indication information to the second network element, that is, the first network element directly confirms the second network element's re-authentication request in the re-authentication response message replied to the second network element.

[0115] For example, the first network element is an AMF / SEAF network element and the second network element is a UDM network element. Fig.10 , Fig.10A schematic diagram of a process flow of a primary authentication method for a user equipment UE provided in an embodiment of the present application is shown, Fig.10 As shown, if the target AMF / SEAF is performing a mobility registration process when it receives the re-authentication request message sent by UDM, the target AMF / SEAF replies to the UDM with a Nudm_UECM_Re-AuthenticationNotification response message and confirms the re-authentication request sent by UDM in the response message.

[0116] In an embodiment of the present application, if a first network element serving as a visited network network element receives a re-master authentication request sent by a second network element serving as a home network element to instruct the first network element to perform master authentication on the UE, and the UE is performing a mobility registration process, a first network element change event occurs during the mobility registration process, and the current first network element is the target first network element in the first network element change event, then the first network element confirms the master authentication request to the second network element, so that subsequent operations of the network element can be adapted to the state in which the UE is performing a mobility registration process, thereby avoiding the situation in which the visited network network element and the home network element encounter the situation in which the UE is performing a mobility registration process and cannot correctly perform the corresponding master authentication operation when performing the master authentication process, thereby achieving the purpose of improving the success rate of the master authentication process of the UE.

[0117] In some embodiments, determining the response indication information according to the state of the UE includes:

[0118] When the UE is in the state of performing a handover procedure, it is determined that the response indication information is fifth error indication information.

[0119] Correspondingly, sending a re-authentication response message to the second network element, where the re-authentication response message carries response indication information, so that the second network element performs a corresponding operation according to the response indication information, including:

[0120] A re-authentication response message is sent to the second network element, where the re-authentication response message carries the fifth error indication information, so that the second network element starts a timer according to the fifth error indication information, and re-sends the re-authentication request message according to the UE's latest first network element registration information after the timer expires.

[0121] It can be understood that if the first network element receives the re-authentication request message sent by the second network element while the UE is performing a handover process, the first network element determines that the response message is the first error indication information and sends a re-authentication response message carrying the fifth error indication information to the second network element. When the second network element receives the re-authentication response message carrying the fifth error indication information, the second network element starts the timer and re-sends the re-authentication request message according to the latest first network element registration information of the UE after the timer expires, that is, the second network element re-sends the re-authentication request message of the UE after a preset time interval. Wherein, the receiving network element of the subsequent re-authentication request message is determined according to whether the first network element sends a change after the handover process of the UE. If the latest first network element registration information of the UE shows that the first network element of the UE has not changed after the handover process, the second network element re-sends the re-authentication request message of the UE to the original first network element after the preset time interval. If the latest first network element registration information of the UE shows that the first network element of the UE has changed after the handover process, the second network element re-sends the re-authentication request message of the UE to the changed first network element after the preset time interval.

[0122] It should be noted that the UE handover process refers to a process in which the user equipment UE switches from one serving cell to another serving cell.

[0123] It should also be noted that the fifth error indication information is used to indicate the reason for the failure of the primary authentication. It can be an error code used to characterize "the UE is performing a handover process", such as TEMPORARY_REJECT_HANDOVER_ONGOING, or it can be a reason value used to characterize "the UE is performing a handover process", such as 3. That is to say, the fifth error indication information can be used to inform the second network element that "the UE is performing a handover process". The embodiment of the present application does not limit the specific form of the fifth error indication information.

[0124] For example, the first network element is an AMF / SEAF network element and the second network element is a UDM network element. Fig.11 , Fig.11 A schematic diagram of a process flow of a primary authentication method for a user equipment UE provided in an embodiment of the present application is shown, Fig.11As shown, if the UE is performing a handover process when AMF / SEAF receives the re-authentication request message sent by UDM, and regardless of whether AMF / SEAF will change after the UE executes the handover process, AMF / SEAF replies to UDM with a Nudm_UECM_Re-AuthenticationNotification response message, which includes an error code TEMPORARY_REJECT_HANDOVER_ONGOING indicating the cause of failure, or includes other cause values ​​3 indicating that "UE is performing a handover process". When UDM receives the response message and the response message includes an error code TEMPORARY_REJECT_HANDOVER_ONGOING indicating the cause of failure, or includes other cause values ​​3 indicating that "UE is performing a handover process", UDM starts a timer (for example, 1 second) and resends the re-authentication request message according to the UE's latest AMF / SEAF registration information after the timer expires.

[0125] In an embodiment of the present application, if a first network element serving as a visited network network element receives a re-master authentication request sent by a second network element serving as a home network element to instruct the first network element to perform master authentication on the UE, and the UE is performing a switching process, the first network element sends a re-master authentication response message carrying fifth error indication information to the second network element. After receiving the re-master authentication response message carrying the fifth error indication information, the second network element resends the re-master authentication request message according to the UE's latest first network element registration information, so that subsequent operations of the network element can be adapted to the state in which the UE is performing a switching process, thereby avoiding the situation in which the visited network network element and the home network element encounter the situation in which the UE is performing a switching process and cannot correctly perform the corresponding master authentication operation when executing the master authentication process, thereby achieving the purpose of improving the success rate of the UE's master authentication process.

[0126] In some embodiments, determining the response indication information according to the state of the UE includes:

[0127] When the UE is in the state of performing a handover procedure and the first network element does not change during the handover procedure, it is determined that the response indication information is confirmation request indication information.

[0128] Correspondingly, sending a re-authentication response message to the second network element, where the re-authentication response message carries response indication information, so that the second network element performs a corresponding operation according to the response indication information, including:

[0129] A re-authentication response message is sent to the second network element, where the re-authentication response message carries confirmation request indication information, so that the second network element performs the primary authentication process of the UE according to the confirmation request indication information.

[0130] It can be understood that if the UE is performing a switching process when the first network element receives the re-authentication request message sent by the second network element, and the first network element does not change during the switching process, the first network element determines that the response indication information is a confirmation request indication information and sends a re-authentication response message carrying the confirmation request indication information to the second network element, that is, the first network element directly confirms the second network element's re-authentication request in the re-authentication response message sent to the second network element.

[0131] For example, the first network element is an AMF / SEAF network element and the second network element is a UDM network element. Fig.12 , Fig.12 A schematic diagram of a primary authentication method provided in an embodiment of the present application is shown. Fig.12 As shown, if the UE is performing a handover process when the AMF / SEAF receives the re-authentication request message sent by the UDM, and the AMF / SEAF does not change after the UE performs the handover process, the AMF / SEAF replies to the UDM with a Nudm_UECM_Re-AuthenticationNotification response message and confirms the re-authentication request sent by the UDM in the response message.

[0132] In an embodiment of the present application, if a first network element serving as a visited network network element receives a re-master authentication request sent by a second network element serving as a home network element to instruct the first network element to perform master authentication on the UE, and the UE is performing a switching process and the first network element does not change during the switching process, the first network element confirms the master authentication request to the second network element, so that subsequent operations of the network element can be adapted to the state in which the UE is performing a switching process, thereby avoiding the situation in which the visited network network element and the home network element encounter the situation in which the UE is performing a switching process and cannot correctly perform the corresponding master authentication operation when executing the master authentication process, thereby achieving the purpose of improving the success rate of the master authentication process of the UE.

[0133] In some embodiments, determining the response indication information according to the state of the UE includes:

[0134] When the UE is in the state of performing a switching process and a first network element change event occurs during the switching process, the response indication information is determined to be the sixth error indication information, the seventh error indication information or the eighth error indication information, wherein the first network element change event indicates that the UE switches access from the source first network element to the target first network element, and the first network element is the source first network element.

[0135] Correspondingly, sending a re-authentication response message to the second network element, where the re-authentication response message carries response indication information, so that the second network element performs a corresponding operation according to the response indication information, including:

[0136] Sending a re-authentication response message to the second network element, where the re-authentication response message carries sixth error indication information, so that the second network element starts a timer according to the sixth error indication information, and re-sends the re-authentication request message according to the latest first network element registration information of the UE after the timer expires;

[0137] or,

[0138] Sending a re-master authentication response message to the second network element, where the re-master authentication response message carries the seventh error indication information, so that the second network element terminates the master authentication process for the UE according to the seventh error indication information;

[0139] or,

[0140] A re-authentication response message is sent to the second network element, the re-authentication response message carries the eighth error indication information, so that the second network element determines the target first network element according to the eighth error indication information, and sends a re-authentication response message to the target first network element after the switching process is completed.

[0141] It can be understood that if the UE is performing a switching process when the first network element receives a re-authentication request message sent by the second network element, and a first network element change event occurs in the switching process and the current first network element is the source first network element in the first network element change event, the first network element determines that the response indication information is the sixth error indication information, the seventh error indication information or the eighth error indication information and sends a re-authentication response message carrying the corresponding error indication information to the second network element, and the second network element performs subsequent operations according to the type of error indication information carried in the re-authentication response message.

[0142] It should be noted that the sixth error indication information, the seventh error indication information and the eighth error indication information are all used to indicate the reason for the failure of the primary authentication. Among them, the sixth error indication information may be an error code used to characterize "UE is in the process of handover", such as TEMPORARY_REJECT_HANDOVER_ONGOING; the seventh error indication information may be an error code used to characterize "authentication not allowed", such as REAUTHENTICATION_NOT_ALLOWED; the eighth error knowledge information may be a reason value used to characterize "UE is in the process of handover and the first network element is about to change", such as 4. In other words, different error indication information can be used to inform the second network element of different reasons for the failure of the primary authentication. The embodiment of the present application does not limit the specific forms of the sixth error indication information, the seventh error indication information and the eighth error indication information.

[0143] Specifically, when the second network element receives a re-authentication response message carrying the sixth error indication information sent by the first network element, the second network element starts a timer according to the sixth error indication information, and resends the re-authentication request message according to the UE's latest registration information of the first network element after the timer expires. That is, the second network element learns that the UE is performing a switching process through the fifth error indication information carried in the re-authentication response message, and chooses to resend the UE's re-authentication request message after a preset time interval to continue the UE's main authentication process.

[0144] Specifically, when the second network element receives the re-master authentication response message sent by the first network element and carrying the seventh error indication information, the second network element terminates the main authentication process for the UE according to the seventh error indication information, that is, the second network element learns that authentication is not allowed through the seventh error indication information carried in the re-master authentication response message, and the second network element chooses to terminate the main authentication process for the UE. If a new registration request from the first network element is subsequently received, the second network element can decide whether to initiate a new main authentication process according to its own authentication policy.

[0145] Specifically, when the second network element receives a re-authentication response message carrying the eighth error indication information sent by the first network element, the second network element determines the target first network element based on the eighth error indication information, and sends a re-authentication response message to the target first network element after the mobility registration process is completed. That is, the second network element learns through the eighth error indication information carried in the re-authentication response message that the UE is performing a switching process and the UE switches access from the source first network element to the target first network element. The second network element chooses to send a re-authentication response message to the target first network element after the switching process is completed to continue the UE's main authentication process.

[0146] For example, take the first network element as AMF / SEAF network element and the second network element as UDM network element as an example, see Fig.13 , Fig.13 A schematic diagram of a process flow of a primary authentication method for a user equipment UE provided in an embodiment of the present application is shown, Fig.13 As shown, if the source AMF / SEAF is performing a mobility registration process when the UE receives the re-authentication request message sent by the UDM, the AMF / SEAF is about to change and the source AMF / SEAF receives the re-authentication request message sent by the UDM, the source AMF / SEAF can perform one of the following steps:

[0147] A. The source AMF / SEAF replies to the UDM with a Nudm_UECM_Re-AuthenticationNotification response message, which contains the error code TEMPORARY_REJECT_HANDOVER_ONGOING indicating the cause of the failure.

[0148] B. The source AMF / SEAF replies to the UDM with a Nudm_UECM_Re-AuthenticationNotification response message, which contains the error code REAUTHENTICATION_NOT_ALLOWED indicating the cause of the failure.

[0149] C. The source AMF / SEAF replies to the UDM with a Nudm_UECM_Re-AuthenticationNotification response message, which contains a cause value 4 indicating that "UE is undergoing a handover procedure and AMF / SEAF is about to change";

[0150] Correspondingly, after receiving the Nudm_UECM_Re-AuthenticationNotification response message, UDM performs the subsequent process according to the error indication information carried in the response message:

[0151] A. If the response message includes the sixth error indication information, i.e., the error code TEMPORARY_REJECT_HANDOVER_ONGOING, the UDM starts a timer (e.g., 1 second), and resends the re-authentication request message in step S1307 according to the latest AMF / SEAF registration information of the UE after the timer expires;

[0152] B. If the response message contains the seventh error indication information, that is, the error code REAUTHENTICATION_NOT_ALLOWED, UDM does not need to perform other operations, that is, UDM terminates the main authentication process for the UE. If UDM subsequently receives a new AMF registration request, UDM can determine whether to initiate a new main authentication process based on its own authentication policy;

[0153] C. If the response message contains the eighth error indication information, that is, other reason value 4 representing "UE is performing a switching process and the AMF / SEAF is about to change", the UDM determines the changed target AMF / SEAF and sends a re-authentication request message as in step S1307 to the target AMF / SEAF after the current switching process ends.

[0154] In an embodiment of the present application, if a first network element serving as a visited network network element receives a re-master authentication request sent by a second network element serving as a home network element to instruct the first network element to perform master authentication on the UE, and the UE is performing a switching process, a first network element change event occurs during the switching process, and the current first network element is the source first network element in the first network element change event, then the first network element sends a re-master authentication response message carrying a sixth error indication information, a seventh error indication information, or an eighth error indication information to the second network element, and the second network element performs corresponding operations according to the type of error indication information carried in the re-master authentication response message, so that subsequent operations of the network element can be adapted to the state in which the UE is performing a switching process, thereby avoiding the situation in which the visited network network element and the home network element encounter a situation in which the UE is performing a switching process and the first network element changes when performing the master authentication process, and cannot correctly perform the corresponding master authentication operation, thereby achieving the purpose of improving the success rate of the master authentication process of the UE.

[0155] In some embodiments, determining the response indication information according to the state of the UE includes:

[0156] When the UE is in the switching process and a first network element change event occurs during the switching process, the response indication information is determined to be confirmation request indication information, wherein the first network element change event indicates that the UE switches access from the source first network element to the target first network element, and the first network element is the target first network element.

[0157] Correspondingly, sending a re-authentication response message to the second network element, where the re-authentication response message carries response indication information, so that the second network element performs a corresponding operation according to the response indication information, including:

[0158] A re-authentication response message is sent to the second network element, where the re-authentication response message carries confirmation request indication information, so that the second network element performs the primary authentication process of the UE according to the confirmation request indication information.

[0159] It can be understood that if the UE is performing a switching process when the first network element receives a re-authentication request message sent by the second network element, and a first network element change event occurs in the switching process and the current first network element is the target first network element in the first network element change event, the first network element determines that the response indication information is a confirmation request indication information and sends a re-authentication response message carrying the confirmation request indication information to the second network element, that is, the first network element directly confirms the second network element's re-authentication request in the re-authentication response message sent to the second network element.

[0160] For example, the first network element is an AMF / SEAF network element and the second network element is a UDM network element. Fig.14 , Fig.14 A schematic diagram of a process flow of a primary authentication method for a user equipment UE provided in an embodiment of the present application is shown, Fig.14 As shown, if the target AMF / SEAF is performing a handover process when it receives the re-authentication request message sent by UDM, the target AMF / SEAF replies to the UDM with a Nudm_UECM_Re-AuthenticationNotification response message and confirms the re-authentication request sent by UDM in the response message.

[0161] In an embodiment of the present application, if a first network element serving as a visited network network element receives a re-master authentication request sent by a second network element serving as a home network element to instruct the first network element to perform master authentication on the UE, and the UE is performing a switching process, a first network element change event occurs during the switching process, and the current first network element is the target first network element in the first network element change event, then the first network element confirms the master authentication request to the second network element, so that subsequent operations of the network element can be adapted to the state in which the UE is performing the switching process, thereby avoiding the situation in which the visited network network element and the home network element encounter the situation in which the UE is performing the switching process and cannot correctly perform the corresponding master authentication operation when executing the master authentication process, thereby achieving the purpose of improving the success rate of the master authentication process of the UE.

[0162] The present application also provides a primary authentication method for a user equipment UE, which is applied to a second network element. Figure 4 , Figure 4 A primary authentication method for a user equipment UE provided in an embodiment of the present application is shown, such as Figure 4 As shown, the main authentication method of the user equipment UE includes but is not limited to steps S401 to S403.

[0163] Step S401: Send a re-authentication request message to a first network element, where the re-authentication request message carries a UE identifier, so that the first network element obtains a corresponding UE status according to the UE identifier and determines response indication information according to the UE status.

[0164] Step S402: receiving a re-authentication response message sent by the first network element, where the re-authentication response message carries response indication information.

[0165] Step S403: perform corresponding operations according to the response indication information.

[0166] In an embodiment of the present application, the second network element sends a re-authentication request message carrying a UE identifier to the first network element, the first network element obtains the status of the corresponding UE according to the UE identifier and determines the response indication information according to the status of the UE, the second network element receives the re-authentication response message carrying the response indication information sent by the first network element, the second network element performs corresponding operations according to the response indication information, and the operation of the second network element can be adapted to the current status of the UE, thereby achieving the purpose of improving the success rate of the UE's primary authentication process, thereby improving the network service quality and user experience.

[0167] It should be noted that the specific description and technical effects of the primary authentication method applied to the second network element provided in the embodiment of the present application can be found in the description of the primary authentication method applied to the first network element provided in the above embodiment, and will not be repeated here.

[0168] In some embodiments, performing corresponding operations according to the response indication information includes:

[0169] When the response indication information is confirmation request indication information, the main authentication process of the UE is executed.

[0170] In some embodiments, performing corresponding operations according to the response indication information includes:

[0171] When the response indication information is any one of the first error indication information, the second error indication information, the fifth error indication information or the sixth error indication information, start the timer, and resend the re-authentication request message according to the latest first network element registration information of the UE after the timer times out; wherein,

[0172] The first error indication information indicates that the UE is in a state of performing a mobility registration procedure;

[0173] The second error indication information indicates that the UE is in a state of performing a mobility registration procedure, and a first network element change event occurs in the mobility registration procedure;

[0174] The fifth error indication information indicates that the UE is in a state of performing a handover procedure;

[0175] The sixth error indication information indicates that the UE is in a state of performing a handover procedure and that a first network element change event occurs during the handover procedure.

[0176] In some embodiments, performing corresponding operations according to the response indication information includes:

[0177] When the response indication information is the third error indication information or the seventh error indication information, the main authentication process for the UE is terminated; wherein,

[0178] The third error indication information indicates that the UE is in a state of performing a mobility registration procedure, and a first network element change event occurs during the mobility registration procedure;

[0179] The seventh error indication information indicates that the UE is in a state of performing a handover procedure, and that a first network element change event occurs during the handover procedure.

[0180] In some embodiments, performing corresponding operations according to the response indication information includes:

[0181] In the case where the response indication information is the fourth error indication information or the eighth error indication information, determining the target first network element, and sending a re-authentication response message to the target first network element after the UE ends the mobility registration process or the switching process; wherein,

[0182] The fourth error indication information indicates that the UE is in a state of performing a mobility registration procedure, and a first network element change event occurs in the mobility registration procedure;

[0183] The eighth error indication information indicates that the UE is in a state of performing a handover procedure, and that a first network element change event occurs during the handover procedure.

[0184] In some embodiments, the first network element is an access and mobility management function AMF network element or a security anchor function SEAF network element, and the second network element is a unified data management UDM network element.

[0185] In an embodiment of the present application, when the first network element receives the re-authentication request message sent by the second network element, in a special scenario where the UE is performing primary authentication, the UE is performing a mobility registration process, or the UE is performing a handover process, the first network element determines the response indication information according to the status of the UE and sends the re-authentication response information carrying the response indication information to the second network element, and the second network element performs corresponding operations according to the response indication information carried in the re-authentication response information. This can avoid the situation where, after the visited network network element receives the re-authentication request, the home network element or the visited network element cannot correctly perform the operation based on the local authentication policy, resulting in authentication failure due to the UE being in a special scenario, thereby improving service quality and user experience.

[0186] It should be noted that the embodiment of the present application describes a series of operations performed by the second network element based on various response indication information carried in the re-master authentication response information. Its specific description and technical effects can be found in the description of a master authentication method applied to the first network element provided in the embodiment of the present application, and will not be repeated here.

[0187] A primary authentication method for a user equipment UE provided by the present application is described below through a specific embodiment.

[0188] Embodiment 1

[0189] Embodiment 1 is a scenario in which the AMF is already performing primary authentication on the UE when receiving the primary authentication message of the UDM, such as Figure 6 As shown, the main authentication method includes:

[0190] Step S610: UDM pre-configures the operator authentication policy to determine when to trigger the main authentication process;

[0191] Step S620: UE registers with the network. AMF / SEAF registers the UE with UDM through Nudm_UECM_registration and provides a callback URI for UDM.

[0192] Step S630: The NF (such as AAnF) determines whether to send a Nudm_UECM_AuthTrigger request to the UDM according to the operator's local authentication policy, so as to use the UDM service for primary authentication. The Nudm_UECM_AuthTrigger request includes the SUPI of the UE.

[0193] Step S640: UDM determines whether to perform the primary authentication process triggered by the home network according to an event (e.g., NF request) or its own authentication policy. If different AMF / SEAFs are registered in the UDM for different access modes, the UDM shall select an AMF / SEAF to perform the primary authentication. The criteria for selecting the AMF / SEAF depends on the UDM's own authentication policy.

[0194] Step S650: If the UDM determines whether to perform the main authentication process triggered by the home network according to the NF request, the UDM replies a Nudm_UECM_AuthTrigger response to the NF;

[0195] Step S660: UE starts the main authentication process. Step S660 may occur in any time period between the end of step S620 and the start of step S670;

[0196] Step S670: UDM sends a Nudm_UECM_Re-AuthenticationNotification message to AMF / SEAF, where the message includes the SUPI of the UE.

[0197] Step S680: If AMF / SEAF is already performing the primary authentication process on the UE when it receives the re-authentication request message sent by UDM, that is, the UE status is in the primary authentication process, AMF / SEAF replies to UDM with a Nudm_UECM_Re-AuthenticationNotification response message and confirms the re-authentication request sent by UDM in the response message.

[0198] Embodiment 2

[0199] Embodiment 2 is a scenario in which the UE is performing a mobility registration process when the AMF receives the primary authentication message of the UDM, such as Figure 7 As shown, the main authentication methods include:

[0200] Step S701, UDM pre-configures the operator authentication policy to determine when to trigger the main authentication process;

[0201] Step S702: UE registers with the network. AMF / SEAF registers the UE with UDM through Nudm_UECM_registration and provides a callback URI for UDM.

[0202] Step S703, the NF (such as AAnF) determines whether to send a Nudm_UECM_AuthTrigger request to the UDM according to the operator's local authentication policy, so as to use the UDM service for primary authentication. The Nudm_UECM_AuthTrigger request includes the SUPI of the UE.

[0203] Step S704: UDM determines whether to execute the primary authentication process triggered by the home network according to an event (e.g., NF request) or its own authentication policy. If different AMF / SEAFs are registered in UDM for different access modes, UDM shall select an AMF / SEAF to perform the primary authentication. The criteria for selecting AMF / SEAF depends on the authentication policy of UDM itself.

[0204] Step S705: If the UDM determines whether to perform the main authentication process triggered by the home network according to the NF request, the UDM replies a Nudm_UECM_AuthTrigger response to the NF;

[0205] Step S706: The UE starts a mobility registration process. Step S706 may occur in any time period between the end of step S702 and the start of step S707.

[0206] Step S707: UDM sends a Nudm_UECM_Re-AuthenticationNotification message to AMF / SEAF, where the message includes the SUPI of the UE.

[0207] Step S708: If the UE is performing a mobility registration procedure when the AMF / SEAF receives the re-authentication request message sent by the UDM, and regardless of whether the AMF / SEAF will change after the UE performs the mobility registration procedure, the AMF / SEAF replies to the UDM with a Nudm_UECM_Re-AuthenticationNotification response message, which includes an error code TEMPORARY_REJECT_REGISTRATION_ONGOING indicating the cause of the failure, or includes other cause values ​​1 indicating that "the UE is performing a mobility registration procedure";

[0208] Step S709: When the UDM receives the response message and the response message includes the error code TEMPORARY_REJECT_REGISTRATION_ONGOING indicating the cause of the failure, or includes other cause value 1 indicating that "UE is performing a mobility registration process", the UDM starts a timer (for example, 1 second), and resends the re-authentication request message in step S707 according to the latest AMF / SEAF registration information of the UE after the timer expires;

[0209] Step S710: AMF / SEAF starts the main authentication process.

[0210] Embodiment 3

[0211] Embodiment 3 is a scenario in which the UE is performing a mobility registration process when the AMF receives the primary authentication message of the UDM, and the AMF does not change in this scenario, such as Figure 8 As shown, the main authentication methods include:

[0212] Step S801, UDM pre-configures the operator authentication policy to determine when to trigger the main authentication process;

[0213] Step S802: UE registers with the network. AMF / SEAF registers the UE with UDM through Nudm_UECM_registration and provides a callback URI for UDM.

[0214] Step S803: The NF (such as AAnF) determines whether to send a Nudm_UECM_AuthTrigger request to the UDM according to the operator's local authentication policy, so as to use the UDM service for primary authentication. The Nudm_UECM_AuthTrigger request includes the SUPI of the UE.

[0215] Step S804: UDM determines whether to execute the primary authentication process triggered by the home network according to an event (e.g., NF request) or its own authentication policy. If different AMF / SEAFs are registered in UDM for different access modes, UDM shall select an AMF / SEAF to perform the primary authentication. The criteria for selecting AMF / SEAF depends on the authentication policy of UDM itself.

[0216] Step S805: If the UDM determines whether to perform the main authentication process triggered by the home network according to the NF request, the UDM replies a Nudm_UECM_AuthTrigger response to the NF;

[0217] Step S806: The UE starts a mobility registration process. Step S806 may occur in any time period between the end of step S802 and the start of step S807.

[0218] Step S807: UDM sends a Nudm_UECM_Re-AuthenticationNotification message to AMF / SEAF, which includes the SUPI of the UE.

[0219] Step S808: If the UE is performing a mobility registration process when the AMF / SEAF receives the re-authentication request message sent by the UDM, and the AMF / SEAF does not change after the UE performs the mobility registration process, the AMF / SEAF replies to the UDM with a Nudm_UECM_Re-AuthenticationNotification response message, and confirms the re-authentication request sent by the UDM in the response message;

[0220] Step S809: AMF / SEAF starts the main authentication process.

[0221] Embodiment 4

[0222] Embodiment 4 is a scenario in which the UE is performing a mobility registration process when the AMF receives the primary authentication message of the UDM, and in this scenario the AMF changes, such as Fig. 9 As shown, the main authentication methods include:

[0223] Step S901, UDM pre-configures the operator authentication policy to determine when to trigger the main authentication process;

[0224] Step S902: UE registers with the network. AMF / SEAF registers the UE with UDM through Nudm_UECM_registration and provides a callback URI for UDM.

[0225] Step S903: The NF (such as AAnF) determines whether to send a Nudm_UECM_AuthTrigger request to the UDM according to the operator's local authentication policy, so as to use the UDM service for primary authentication. The Nudm_UECM_AuthTrigger request includes the SUPI of the UE.

[0226] Step S904: UDM determines whether to execute the primary authentication process triggered by the home network according to an event (e.g., NF request) or its own authentication policy. If different AMF / SEAFs are registered in UDM for different access modes, UDM shall select an AMF / SEAF to perform the primary authentication. The criteria for selecting AMF / SEAF depends on the authentication policy of UDM itself.

[0227] Step S905: If the UDM determines whether to perform the home network-triggered primary authentication process according to the NF request, the UDM replies a Nudm_UECM_AuthTrigger response to the NF;

[0228] Step S906: The UE starts a mobility registration process. Step S906 may occur in any time period between the end of step S902 and the start of step S907.

[0229] Step S907: UDM sends a Nudm_UECM_Re-AuthenticationNotification message to the source AMF / SEAF, where the message includes the SUPI of the UE.

[0230] Step S908: If the UE is performing a mobility registration procedure when the source AMF / SEAF receives the re-authentication request message sent by the UDM, the AMF / SEAF is about to change and the source AMF / SEAF receives the re-authentication request message sent by the UDM, the source AMF / SEAF may perform one of the following steps:

[0231] A. The source AMF / SEAF replies to the UDM with a Nudm_UECM_Re-AuthenticationNotification response message, which contains the error code TEMPORARY_REJECT_REGISTRATION_ONGOING indicating the cause of the failure.

[0232] B. The source AMF / SEAF replies to the UDM with a Nudm_UECM_Re-AuthenticationNotification response message, which contains the error code REAUTHENTICATION_NOT_ALLOWED indicating the cause of the failure.

[0233] C. The source AMF / SEAF replies to the UDM with a Nudm_UECM_Re-AuthenticationNotification response message, which contains a cause value 2 indicating that "the UE is undergoing a mobility registration procedure and the AMF / SEAF is about to change".

[0234] Step S909: After receiving the Nudm_UECM_Re-AuthenticationNotification response message, the UDM performs subsequent processes according to the error indication information carried in the response message:

[0235] A. If the response message includes the second error indication information, i.e., the error code TEMPORARY_REJECT_REGISTRATION_ONGOING, the UDM starts a timer (e.g., 1 second), and resends the re-authentication request message in step S907 according to the latest AMF / SEAF registration information of the UE after the timer expires;

[0236] B. If the response message contains the third error indication information, that is, the error code REAUTHENTICATION_NOT_ALLOWED, UDM does not need to perform other operations, that is, UDM terminates the main authentication process for the UE. If UDM subsequently receives a new AMF registration request, UDM can determine whether to initiate a new main authentication process based on its own authentication policy;

[0237] C. If the response message includes the fourth error indication information, i.e., other reason value 2 representing "UE is performing a mobility registration process and the AMF / SEAF is about to change", the UDM determines the changed target AMF / SEAF and sends a re-authentication request message as in step S907 to the target AMF / SEAF after the current mobility registration process ends;

[0238] Step S910, UDM sends a re-authentication request message as in step S907 to the target AMF / SEAF;

[0239] Step S911, if the target AMF / SEAF can perform the primary authentication process for the UE, the target AMF / SEAF replies a Nudm_UECM_Re-AuthenticationNotification response message to the UDM, and confirms the re-authentication request sent by the UDM in the response message;

[0240] Step S912: The target AMF / SEAF starts the main authentication process.

[0241] Embodiment 5

[0242] Embodiment 5 is a scenario in which the UE is performing a mobility registration process when the AMF receives the primary authentication message of the UDM, and in this scenario the AMF changes, such as Fig.10 As shown, the main authentication methods include:

[0243] Step S1001, UDM pre-configures the operator authentication policy to determine when to trigger the main authentication process;

[0244] Step S1002: UE registers with the network. AMF / SEAF registers the UE with UDM through Nudm_UECM_registration and provides a callback URI for UDM.

[0245] Step S1003: The NF (such as AAnF) determines whether to send a Nudm_UECM_AuthTrigger request to the UDM according to the operator's local authentication policy, so as to use the UDM service for primary authentication. The Nudm_UECM_AuthTrigger request includes the SUPI of the UE.

[0246] Step S1004, UDM determines whether to execute the primary authentication process triggered by the home network according to an event (for example, NF request) or its own authentication policy. If different AMF / SEAFs are registered in UDM for different access modes, UDM shall select an AMF / SEAF to perform the primary authentication. The criteria for selecting AMF / SEAF depends on the authentication policy of UDM itself.

[0247] Step S1005: If the UDM determines whether to perform the main authentication process triggered by the home network according to the NF request, the UDM replies a Nudm_UECM_AuthTrigger response to the NF;

[0248] Step S1006: The UE starts a mobility registration process. Step S1006 may occur in any time period from the end of step S1002 to the start of step S1007.

[0249] Step S1007: UDM sends a Nudm_UECM_Re-AuthenticationNotification message to the target AMF / SEAF, where the message includes the SUPI of the UE.

[0250] Step S1008: If the UE is performing a mobility registration process when the target AMF / SEAF receives the re-authentication request message sent by the UDM, the target AMF / SEAF replies a Nudm_UECM_Re-AuthenticationNotification response message to the UDM and confirms the re-authentication request sent by the UDM in the response message;

[0251] Step S1009: The target AMF / SEAF starts the main authentication process.

[0252] Embodiment 6

[0253] Embodiment 6 is a scenario in which the UE is performing a handover process when the AMF receives the primary authentication message of the UDM, such as Fig.11 As shown, the main authentication methods include:

[0254] Step S1101, UDM pre-configures the operator authentication policy to determine when to trigger the main authentication process;

[0255] Step S1102: UE registers with the network. AMF / SEAF registers the UE with UDM through Nudm_UECM_registration and provides a callback URI for UDM.

[0256] Step S1103: The NF (such as AAnF) determines whether to send a Nudm_UECM_AuthTrigger request to the UDM according to the operator's local authentication policy, so as to use the UDM service for primary authentication. The Nudm_UECM_AuthTrigger request includes the SUPI of the UE.

[0257] Step S1104: UDM determines whether to execute the primary authentication process triggered by the home network according to an event (e.g., NF request) or its own authentication policy. If different AMF / SEAFs are registered in UDM for different access modes, UDM shall select an AMF / SEAF to perform the primary authentication. The criteria for selecting AMF / SEAF depends on the authentication policy of UDM itself.

[0258] Step S1105: If the UDM determines whether to perform the main authentication process triggered by the home network according to the NF request, the UDM replies a Nudm_UECM_AuthTrigger response to the NF;

[0259] Step S1106: The UE starts the handover process. Step S1106 may occur in any time period from the end of step S1102 to the start of step S1107.

[0260] Step S1107: UDM sends a Nudm_UECM_Re-AuthenticationNotification message to AMF / SEAF, where the message includes the SUPI of the UE.

[0261] Step S1108: If the UE is performing a handover procedure when the AMF / SEAF receives the re-authentication request message sent by the UDM, and regardless of whether the AMF / SEAF will change after the UE performs the handover procedure, the AMF / SEAF replies to the UDM with a Nudm_UECM_Re-AuthenticationNotification response message, which includes an error code TEMPORARY_REJECT_HANDOVER_ONGOING indicating the cause of the failure, or includes other cause values ​​3 indicating that "the UE is performing a handover procedure";

[0262] Step S1109: When the UDM receives the response message and the response message includes the error code TEMPORARY_REJECT_HANDOVER_ONGOING indicating the cause of the failure, or includes other cause value 3 indicating that "UE is in the process of handover", the UDM starts a timer (for example, 1 second), and resends the re-authentication request message in step S1107 according to the latest AMF / SEAF registration information of the UE after the timer expires;

[0263] Step S1110: AMF / SEAF starts the main authentication process.

[0264] Embodiment 7

[0265] Embodiment 7 is a scenario in which the UE is performing a handover process when the AMF receives the primary authentication message of the UDM, and in this scenario, the AMF does not occur, such as Fig.12 As shown, the main authentication methods include:

[0266] Step S1201, UDM pre-configures the operator authentication policy to determine when to trigger the main authentication process;

[0267] Step S1202: UE registers with the network. AMF / SEAF registers the UE with UDM through Nudm_UECM_registration and provides a callback URI for UDM.

[0268] Step S1203: The NF (such as AAnF) determines whether to send a Nudm_UECM_AuthTrigger request to the UDM according to the operator's local authentication policy, so as to use the UDM service for primary authentication. The Nudm_UECM_AuthTrigger request includes the SUPI of the UE.

[0269] Step S1204, UDM determines whether to execute the primary authentication process triggered by the home network according to the event (for example, NF request) or its own authentication policy. If different AMF / SEAFs are registered in UDM for different access modes, UDM shall select an AMF / SEAF to perform the primary authentication. The criteria for selecting AMF / SEAF depends on the authentication policy of UDM itself.

[0270] Step S1205: If the UDM determines whether to perform the main authentication process triggered by the home network according to the NF request, the UDM replies a Nudm_UECM_AuthTrigger response to the NF;

[0271] Step S1206: The UE starts the handover process. Step S1206 may occur in any time period from the end of step S1202 to the start of step S1207.

[0272] Step S1207: UDM sends a Nudm_UECM_Re-AuthenticationNotification message to AMF / SEAF, where the message includes the SUPI of the UE.

[0273] Step S1208: If the UE is performing a handover procedure when the AMF / SEAF receives the re-authentication request message sent by the UDM, and the AMF / SEAF does not change after the UE executes the handover procedure, the AMF / SEAF replies a Nudm_UECM_Re-AuthenticationNotification response message to the UDM, and confirms the re-authentication request sent by the UDM in the response message;

[0274] Step S1209: AMF / SEAF starts the main authentication process.

[0275] Embodiment 8

[0276] Embodiment 8 is a scenario in which the UE is performing a handover process when the AMF receives the primary authentication message of the UDM, and in this scenario, the AMF occurs, such as Fig.13 As shown, the main authentication methods include:

[0277] Step S1301, UDM pre-configures the operator authentication policy to determine when to trigger the main authentication process;

[0278] Step S1302: UE registers with the network. AMF / SEAF registers the UE with UDM through Nudm_UECM_registration and provides a callback URI for UDM.

[0279] Step S1303: The NF (such as AAnF) determines whether to send a Nudm_UECM_AuthTrigger request to the UDM according to the operator's local authentication policy, so as to use the UDM service for primary authentication. The Nudm_UECM_AuthTrigger request includes the SUPI of the UE.

[0280] Step S1304: UDM determines whether to execute the primary authentication process triggered by the home network according to an event (e.g., NF request) or its own authentication policy. If different AMF / SEAFs are registered in UDM for different access modes, UDM shall select one AMF / SEAF to perform the primary authentication. The criteria for selecting AMF / SEAF depends on the authentication policy of UDM itself.

[0281] Step S1305: If the UDM determines whether to perform the home network-triggered primary authentication process according to the NF request, the UDM replies a Nudm_UECM_AuthTrigger response to the NF;

[0282] Step S1306: The UE starts the handover process. Step S1306 may occur in any time period from the end of step S1302 to the start of step S1307.

[0283] Step S1307: UDM sends a Nudm_UECM_Re-AuthenticationNotification message to the source AMF / SEAF, where the message includes the SUPI of the UE.

[0284] Step S1308: If the UE is performing a mobility registration procedure when the source AMF / SEAF receives the re-authentication request message sent by the UDM, the AMF / SEAF is about to change and the source AMF / SEAF receives the re-authentication request message sent by the UDM, the source AMF / SEAF may perform one of the following steps:

[0285] A. The source AMF / SEAF replies to the UDM with a Nudm_UECM_Re-AuthenticationNotification response message, which contains the error code TEMPORARY_REJECT_HANDOVER_ONGOING indicating the cause of the failure.

[0286] B. The source AMF / SEAF replies to the UDM with a Nudm_UECM_Re-AuthenticationNotification response message, which contains the error code REAUTHENTICATION_NOT_ALLOWED indicating the cause of the failure.

[0287] C. The source AMF / SEAF replies to the UDM with a Nudm_UECM_Re-AuthenticationNotification response message, which contains a cause value 4 indicating that "the UE is undergoing a handover procedure and the AMF / SEAF is about to change".

[0288] Step S1309: After receiving the Nudm_UECM_Re-AuthenticationNotification response message, the UDM performs subsequent processes according to the error indication information carried in the response message:

[0289] A. If the response message includes the sixth error indication information, i.e., the error code TEMPORARY_REJECT_HANDOVER_ONGOING, the UDM starts a timer (e.g., 1 second), and resends the re-authentication request message in step S1307 according to the latest AMF / SEAF registration information of the UE after the timer expires;

[0290] B. If the response message contains the seventh error indication information, that is, the error code REAUTHENTICATION_NOT_ALLOWED, UDM does not need to perform other operations, that is, UDM terminates the main authentication process for the UE. If UDM subsequently receives a new AMF registration request, UDM can determine whether to initiate a new main authentication process based on its own authentication policy;

[0291] C. If the response message includes the eighth error indication information, i.e., other reason value 4 representing "UE is performing a handover process and AMF / SEAF is about to change", UDM determines the changed target AMF / SEAF and sends a re-authentication request message as in step S1307 to the target AMF / SEAF after the current handover process ends;

[0292] Step S1310, UDM sends a re-authentication request message as in step S1307 to the target AMF / SEAF;

[0293] Step S1311, if the target AMF / SEAF can perform the primary authentication process for the UE, the target AMF / SEAF replies a Nudm_UECM_Re-AuthenticationNotification response message to the UDM, and confirms the re-authentication request sent by the UDM in the response message;

[0294] Step S1312: The target AMF / SEAF starts the main authentication process.

[0295] Embodiment 9

[0296] Embodiment 9 is a scenario in which the UE is performing a handover process when the AMF receives the primary authentication message of the UDM, and in this scenario, the AMF occurs, such as Fig.14 As shown, the main authentication methods include:

[0297] Step S1401, UDM pre-configures the operator authentication policy to determine when to trigger the main authentication process;

[0298] Step S1402: UE registers with the network. AMF / SEAF registers the UE with UDM through Nudm_UECM_registration and provides a callback URI for UDM.

[0299] Step S1403: The NF (such as AAnF) determines whether to send a Nudm_UECM_AuthTrigger request to the UDM according to the operator's local authentication policy, so as to use the UDM service for primary authentication. The Nudm_UECM_AuthTrigger request includes the SUPI of the UE.

[0300] Step S1404: UDM determines whether to execute the primary authentication process triggered by the home network according to an event (e.g., NF request) or its own authentication policy. If different AMF / SEAFs are registered in UDM for different access modes, UDM shall select an AMF / SEAF to perform the primary authentication. The criteria for selecting AMF / SEAF depends on the authentication policy of UDM itself.

[0301] Step S1405: If the UDM determines whether to perform the main authentication process triggered by the home network according to the NF request, the UDM replies a Nudm_UECM_AuthTrigger response to the NF;

[0302] Step S1406: The UE starts the handover process. Step S1406 may occur in any time period from the end of step S1402 to the start of step S1407.

[0303] Step S1407: UDM sends a Nudm_UECM_Re-AuthenticationNotification message to the target AMF / SEAF, where the message includes the SUPI of the UE.

[0304] Step S1408: If the target AMF / SEAF is in the process of handover when receiving the re-authentication request message sent by UDM, the target AMF / SEAF replies to UDM with a Nudm_UECM_Re-AuthenticationNotification response message, and confirms the re-authentication request sent by UDM in the response message;

[0305] Step S1409: The target AMF / SEAF starts the main authentication process.

[0306] The present application also provides an electronic device, such as Fig.15 As shown, the electronic device 1400 includes:

[0307] one or more processors 1410;

[0308] The memory 1420 stores one or more programs, and when the one or more programs are executed by the one or more processors 1410, the one or more processors 1410 implement a primary authentication method of the user equipment UE.

[0309] The memory 1420, as a non-transient network system, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory 1420 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory 1420 may optionally include a memory 1420 remotely arranged relative to the processor 1410, and these remote memories 1420 may be connected to the processor 1410 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0310] The memory 1420 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1420 can store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program codes are stored in the memory 1420, and the processor 1410 calls and executes the methods of the embodiments of this application.

[0311] The processor 1410 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application.

[0312] In some embodiments, the electronic device further comprises:

[0313] Input / output interface, used to realize information input and output;

[0314] Communication interface, used to realize communication interaction between this device and other devices, which can be realized through wired mode (such as USB, network cable, etc.) or wireless mode (such as mobile network, WIFI, Bluetooth, etc.);

[0315] A bus that transmits information between the various components of the device (e.g., the processor 1410, the memory 1420, the input / output interface, and the communication interface);

[0316] The processor 1410 , the memory 1420 , the input / output interface and the communication interface can be connected to each other in communication within the device via a bus.

[0317] An embodiment of the present application further provides a computer-readable storage medium storing computer-executable instructions for executing:

[0318] A primary authentication method for a user equipment UE as applied to a first network element; or

[0319] For example, a primary authentication method for a user equipment UE applied to a second network element.

[0320] An embodiment of the present application further provides a computer program product, including a computer program or a computer instruction, wherein the computer program or the computer instruction is stored in a computer-readable storage medium, and a processor of a computer device reads the computer program or the computer instruction from the computer-readable storage medium, and the processor executes the computer program or the computer instruction, so that the computer device executes and implements:

[0321] A primary authentication method for a user equipment UE as applied to a first network element; or

[0322] For example, a primary authentication method for a user equipment UE applied to a second network element.

[0323] The system architecture and application scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of the system architecture and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are equally applicable to similar technical problems.

[0324] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in the present application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0325] It will be appreciated by those skilled in the art that all or some of the steps and systems in the disclosed method above may be implemented as software, firmware, hardware and appropriate combinations thereof. Some physical components or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor or a microprocessor, or may be implemented as hardware, or may be implemented as an integrated circuit, such as an application specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or a non-transitory medium) and a communication medium (or a temporary medium). As known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, disk storage or other magnetic storage devices, or any other medium that may be used to store desired information and may be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0326] The above describes some embodiments of the present application with reference to the accompanying drawings, but does not limit the scope of the present invention. Any modification, equivalent substitution and improvement made by those skilled in the art without departing from the scope and essence of the present invention shall be within the scope of the present application.

Claims

1. A primary authentication method for a user equipment UE, applied to a first network element, the method comprising: receiving a re-authentication request message sent by the second network element, where the re-authentication request message carries a UE identifier; Acquire the status of the corresponding UE according to the UE identifier; Determine response indication information according to the state of the UE; Send a re-authentication response message to the second network element, where the re-authentication response message carries the response indication information, so that the second network element performs a corresponding operation according to the response indication information.

2. The method according to claim 1, characterized in that The determining the response indication information according to the state of the UE includes: When the UE is in the state of performing a main authentication process, determining that the response indication information is confirmation request indication information; The sending a re-authentication response message to the second network element, wherein the re-authentication response message carries the response indication information, so that the second network element performs a corresponding operation according to the response indication information, includes: Send a re-primary authentication response message to the second network element, where the re-primary authentication response message carries the confirmation request indication information, so that the second network element performs the primary authentication process of the UE according to the confirmation request indication information.

3. The method according to claim 1, characterized in that The determining the response indication information according to the state of the UE includes: In a case where the state of the UE is that a mobility registration procedure is being performed, determining that the response indication information is first error indication information; The sending a re-authentication response message to the second network element, wherein the re-authentication response message carries the response indication information, so that the second network element performs a corresponding operation according to the response indication information, includes: Send a re-authentication response message to the second network element, where the re-authentication response message carries the first error indication information, so that the second network element starts a timer according to the first error indication information, and resends the re-authentication request message according to the UE's latest first network element registration information after the timer expires.

4. The method according to claim 1, characterized in that: The determining the response indication information according to the state of the UE includes: When the UE is in a state of performing a mobility registration procedure and the first network element does not change during the mobility registration procedure, determining that the response indication information is confirmation request indication information; The sending a re-authentication response message to the second network element, wherein the re-authentication response message carries the response indication information, so that the second network element performs a corresponding operation according to the response indication information, includes: Send a re-primary authentication response message to the second network element, where the re-primary authentication response message carries the confirmation request indication information, so that the second network element performs the primary authentication process of the UE according to the confirmation request indication information.

5. The method according to claim 1, characterized in that The determining the response indication information according to the state of the UE includes: In a case where the status of the UE is that a mobility registration process is in progress and a first network element change event occurs in the mobility registration process, determining that the response indication information is second error indication information, third error indication information or fourth error indication information, wherein the first network element change event indicates that the UE switches access from a source first network element to a target first network element, and the first network element is the source first network element; The sending a re-authentication response message to the second network element, wherein the re-authentication response message carries the response indication information, so that the second network element performs a corresponding operation according to the response indication information, includes: Sending a re-authentication response message to the second network element, where the re-authentication response message carries the second error indication information, so that the second network element starts a timer according to the second error indication information, and re-sends the re-authentication request message according to the latest first network element registration information of the UE after the timer expires; or, Sending a re-primary authentication response message to the second network element, where the re-primary authentication response message carries the third error indication information, so that the second network element terminates the primary authentication process for the UE according to the third error indication information; or, Send a re-authentication response message to the second network element, where the re-authentication response message carries the fourth error indication information, so that the second network element determines the target first network element according to the fourth error indication information, and sends the re-authentication response message to the target first network element after the mobility registration process is completed.

6. The method according to claim 1, characterized in that The determining the response indication information according to the state of the UE includes: In a case where the UE is in a state of performing a mobility registration process and a first network element change event occurs in the mobility registration process, determining that the response indication information is confirmation request indication information, wherein the first network element change event indicates that the UE switches access from a source first network element to a target first network element, and the first network element is the target first network element; The sending a re-authentication response message to the second network element, wherein the re-authentication response message carries the response indication information, so that the second network element performs a corresponding operation according to the response indication information, includes: Send a re-primary authentication response message to the second network element, where the re-primary authentication response message carries the confirmation request indication information, so that the second network element performs the primary authentication process of the UE according to the confirmation request indication information.

7. The method according to claim 1, characterized in that The determining the response indication information according to the state of the UE includes: When the state of the UE is that a handover procedure is in progress, determining that the response indication information is fifth error indication information; The sending a re-authentication response message to the second network element, wherein the re-authentication response message carries the response indication information, so that the second network element performs a corresponding operation according to the response indication information, includes: Send a re-authentication response message to the second network element, where the re-authentication response message carries the fifth error indication information, so that the second network element starts a timer according to the fifth error indication information, and resends the re-authentication request message according to the UE's latest first network element registration information after the timer expires.

8. The method according to claim 1, characterized in that The determining the response indication information according to the state of the UE includes: When the UE is in a state of performing a handover procedure and the first network element does not change during the handover procedure, determining that the response indication information is confirmation request indication information; The sending a re-authentication response message to the second network element, wherein the re-authentication response message carries the response indication information, so that the second network element performs a corresponding operation according to the response indication information, includes: Send a re-primary authentication response message to the second network element, where the re-primary authentication response message carries the confirmation request indication information, so that the second network element performs the primary authentication process of the UE according to the confirmation request indication information.

9. The method according to claim 1, characterized in that: The determining the response indication information according to the state of the UE includes: When the state of the UE is that a handover process is in progress and a first network element change event occurs in the handover process, determining that the response indication information is sixth error indication information, seventh error indication information or eighth error indication information, wherein the first network element change event indicates that the UE switches access from a source first network element to a target first network element, and the first network element is the source first network element; The sending a re-authentication response message to the second network element, wherein the re-authentication response message carries the response indication information, so that the second network element performs a corresponding operation according to the response indication information, includes: Sending a re-authentication response message to the second network element, where the re-authentication response message carries the sixth error indication information, so that the second network element starts a timer according to the sixth error indication information, and re-sends the re-authentication request message according to the latest first network element registration information of the UE after the timer expires; or, Sending a re-master authentication response message to the second network element, where the re-master authentication response message carries the seventh error indication information, so that the second network element terminates the master authentication process for the UE according to the seventh error indication information; or, A re-authentication response message is sent to the second network element, where the re-authentication response message carries the eighth error indication information, so that the second network element determines the target first network element according to the eighth error indication information, and sends the re-authentication response message to the target first network element after the switching process is completed.

10. The method according to claim 1, characterized in that The determining the response indication information according to the state of the UE includes: In a case where the UE is in a state of performing a handover procedure and a first network element change event occurs in the handover procedure, determining that the response indication information is confirmation request indication information, wherein the first network element change event indicates that the UE switches access from a source first network element to a target first network element, and the first network element is the target first network element; The sending a re-authentication response message to the second network element, wherein the re-authentication response message carries the response indication information, so that the second network element performs a corresponding operation according to the response indication information, includes: Send a re-primary authentication response message to the second network element, where the re-primary authentication response message carries the confirmation request indication information, so that the second network element performs the primary authentication process of the UE according to the confirmation request indication information.

11. The method according to any one of claims 1 to 10, characterized in that: The first network element is an access and mobility management function AMF network element or a security anchor function SEAF network element, and the second network element is a unified data management UDM network element.

12. A primary authentication method for a user equipment UE, applied to a second network element, the method comprising: Sending a re-authentication request message to the first network element, where the re-authentication request message carries a UE identifier, so that the first network element obtains the status of the corresponding UE according to the UE identifier, and determines response indication information according to the status of the UE; receiving a re-authentication response message sent by the first network element, wherein the re-authentication response message carries the confirmation response indication information; Perform corresponding operations according to the response indication information.

13. The method according to claim 12, characterized in that The performing corresponding operations according to the response indication information includes: In a case where the response indication information is confirmation request indication information, a main authentication process of the UE is executed.

14. The method according to claim 12, characterized in that The performing corresponding operations according to the response indication information includes: When the response indication information is any one of the first error indication information, the second error indication information, the fifth error indication information or the sixth error indication information, a timer is started, and after the timer times out, the re-authentication request message is resent according to the latest first network element registration information of the UE; wherein, The first error indication information indicates that the state of the UE is that a mobility registration process is in progress; The second error indication information indicates that the status of the UE is that a mobility registration procedure is in progress, and a first network element change event occurs in the mobility registration procedure; The fifth error indication information indicates that the state of the UE is that a handover procedure is in progress; The sixth error indication information indicates that the UE is in a state of performing a handover procedure and that a first network element change event occurs during the handover procedure.

15. The method according to claim 12, characterized in that The performing corresponding operations according to the response indication information includes: When the response indication information is the third error indication information or the seventh error indication information, the main authentication process for the UE is terminated; wherein, The third error indication information indicates that the status of the UE is that a mobility registration procedure is in progress, and a first network element change event occurs in the mobility registration procedure; The seventh error indication information indicates that the UE is in a state of performing a handover procedure and that a first network element change event occurs during the handover procedure.

16. The method according to claim 12, characterized in that The performing corresponding operations according to the response indication information includes: In the case where the response indication information is the fourth error indication information or the eighth error indication information, determining the target first network element, and sending the re-authentication response message to the target first network element after the UE ends the mobility registration process or the switching process; wherein, The fourth error indication information indicates that the status of the UE is that a mobility registration procedure is in progress, and a first network element change event occurs in the mobility registration procedure; The eighth error indication information indicates that the UE is in a state of performing a handover procedure and that a first network element change event occurs during the handover procedure.

17. The method according to any one of claims 12 to 16, characterized in that: The first network element is an access and mobility management function AMF network element or a security anchor function SEAF network element, and the second network element is a unified data management UDM network element.

18. An electronic device, comprising: one or more processors; A memory having one or more programs stored thereon, when the one or more programs are executed by the one or more processors, the one or more processors implement: The primary authentication method for a user equipment UE as claimed in any one of claims 1 to 11; or, A primary authentication method for a user equipment UE as described in any one of claims 12 to 17.

19. A computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the computer program implements: The primary authentication method for a user equipment UE as claimed in any one of claims 1 to 11; or, A primary authentication method for a user equipment UE as described in any one of claims 12 to 17.

Images