Communication system, method and device

Abstract

The invention provides a communication system, a communication method and a communication device, which are used for solving the problem that terminal equipment in the prior art does not know how to initiate a correct process so as to establish communication connection with an application function AF to obtain a business service. The principle of the method is as follows: the AF sends a service mode supported by the AF to the UE through a core network. Therefore, before the UE initiates a service to the AF, the UE can sense the service mode supported by the AF, and the UE initiates a correct connection establishment process to the AF according to the service mode supported by the AF.

Description

[0001] This application is a divisional application. The application number of the original application is 202010260887.3, and the original application date is April 3, 2020. The entire contents of the original application are incorporated into this application by reference. Technical Field

[0002] The present application relates to the field of communication technology, and in particular to a communication system, method and device. Background Art

[0003] Currently, terminal devices can support authentication and key management for applications (AKMA) services. In AKMA services, terminal devices can use the Ua* reference point to send an Application Session Establishment Request message to an application function (AF). The Application Session Establishment Request message carries parameters used to support AF in obtaining keys, such as Kakma ID, thereby triggering AF to obtain the corresponding AF security key.

[0004] The existing AKMA service does not define how the terminal device determines whether to initiate the Ua* process. For an AF that supports AKMA, when receiving the Application Session Establishment Request sent by the UE, it is capable of parsing the Application Session Establishment Request and executing the subsequent process. If the AF does not support the AKMA service, the AF cannot parse the message to continue the subsequent process, and the AF cannot establish a communication connection with the terminal device. As a result, the communication link between the terminal device and the AF fails to be established. Summary of the invention

[0005] The present application provides a communication system, method and apparatus, so that a terminal device can determine whether to initiate a Ua* process to establish a communication connection with an AF.

[0006] A first aspect of the present application provides a communication system, the system comprising an application function network element and a data management network element;

[0007] The application function network element is used to send first information to the data management network element, where the first information includes capability information of the application function network element, wherein the capability information of the application function network element is used to indicate a service mode supported by the application function network element;

[0008] The data management network element is used to receive the capability information of the application function network element from the application function network element, and send the capability information of the application function network element to the terminal device.

[0009] In the embodiment of the present application, the application function network element sends the service mode supported by itself to the terminal device through the core network. Therefore, before the terminal device initiates a service to the application function network element, the terminal device can perceive the service mode supported by the application function network element, and the terminal device initiates the correct connection establishment process to the application function network element according to the service mode supported by the application function network element.

[0010] In a possible implementation, the system further includes a policy control function network element; the data management network element is specifically used to send the capability information of the application function network element to the policy control function network element;

[0011] The policy control function network element is used to receive the capability information of the application function network element sent by the data management network element; and send the capability information of the application function network element to the terminal device through the access and mobility management function.

[0012] In a possible implementation, the policy control function network element is used to generate or update the UE routing policy URSP corresponding to the terminal device, and the URSP includes the capability information of the application function network element. By carrying the capability information of the application function network element in the URSP of the terminal device (i.e., adding a new cell in the USRP), the capability information of the application function network element is sent to the terminal device. When the terminal device needs to establish a communication connection with the AF, the UE obtains the service mode supported by the AF in the URSP, and determines the service mode between itself and the AF according to the service mode supported by the AF.

[0013] In a possible implementation, the data management network element is specifically used to request the authentication service function network element to perform security protection on the capability information of the application function network element, receive a response message sent by the authentication service function network element, the response message includes the capability information of the application function network element after security protection; and send the capability information of the application function network element after security protection to the terminal device through the access and mobility management function. The data management network element can perform security protection on the capability information of the application function network element and then send it to the terminal device, thereby preventing the capability information of the application function network element from being maliciously tampered with during the process of being transmitted to the terminal device.

[0014] In a possible implementation, the data management network element is also used to obtain capability information of the terminal device, and the capability information of the terminal device is used to indicate the service mode supported by the terminal device; when the service mode supported by the terminal device matches the service mode supported by the application function network element, it is determined that the capability information of the application function network element needs to be sent to the terminal device.

[0015] In a possible implementation, the first information also includes a target object identifier, which is used to indicate the terminal device; the data management network element is also used to determine, based on the target object identifier, that the capability information of the application function network element needs to be sent to the terminal device.

[0016] When the data management network element receives the capability information of the application function network element from the AF, the data management network element needs to determine which terminal devices to send the received capability information of the application function network element based on the acquired capability information of the terminal devices, thereby avoiding sending useless information to irrelevant terminal devices that do not support the corresponding service mode.

[0017] In a possible implementation, the capability information of the application function network element also includes a service mode selection policy, and the service mode selection policy is used to indicate the priority of multiple service modes supported by the application function network element. The terminal device can use the service mode with the highest priority as the service mode between itself and the AF among the service modes supported by both itself and the AF.

[0018] In a second aspect, the present application provides a communication method, the method comprising: a network device receives first information from an application function network element, the first information includes capability information of the application function network element, the capability information of the application function network element is used to indicate a service mode supported by the application function network element; the network device sends the capability information of the application function network element to a terminal device. The network device may be a data management network element or a policy control function network element in the implementation mode recorded in the present application.

[0019] In the embodiment of the present application, the network device receives the service mode supported by the application function network element and sends it to the terminal device. Therefore, before the terminal device initiates a service to the application function network element, the terminal device can perceive the service mode supported by the application function network element, and the terminal device initiates the correct connection establishment process to the application function network element according to the service mode supported by the application function network element.

[0020] In a possible implementation, the first information also includes a target object identifier, and the target object identifier is used to indicate the terminal device; the method also includes: the network device determines, based on the target object identifier, that the capability information of the application function network element needs to be sent to the terminal device.

[0021] In a possible implementation, the method also includes: the network device obtains capability information of the terminal device, and the capability information of the terminal device is used to indicate a service mode supported by the terminal device; when the service mode supported by the terminal device matches the service mode supported by the application function network element, the network device determines that the capability information of the application function network element needs to be sent to the terminal device.

[0022] When the network device receives the capability information of the application function network element from the AF, the data management network element needs to determine which terminal devices to send the received capability information of the application function network element based on the acquired capability information of the terminal devices, thereby avoiding sending useless information to irrelevant terminal devices that do not support the corresponding service mode.

[0023] In a possible implementation, the network device is a data management network element. The sending of the capability information of the application function network element to the terminal device is specifically: the data management network element sends the capability information of the application function network element to the terminal device through the policy control function network element, or

[0024] The data management network element requests the authentication service function network element to perform security protection on the capability information of the application function network element;

[0025] The data management network element receives a response message sent by the authentication service function network element, wherein the response message includes capability information of the application function network element after security protection;

[0026] The data management network element sends the capability information of the application function network element after security protection to the terminal device through the access and mobility management function network element.

[0027] In a possible implementation, the network device is a policy control function network element. The sending of the capability information of the application function network element to the terminal device is specifically as follows: the policy control function network element generates a UE routing policy URSP, and the URSP includes the capability information of the application function network element; the policy control function network element sends the URSP to the terminal device. The policy control function network element sends the capability information of the application function network element to the terminal device by carrying the capability information of the application function network element in the URSP of the terminal device (i.e., adding a new cell in the USRP). When the terminal device needs to establish a communication connection with the AF, the UE obtains the service mode supported by the AF in the URSP, and determines the service mode between itself and the AF according to the service mode supported by the AF.

[0028] In a possible implementation, the capability information of the application function network element also includes a service mode selection policy, and the service mode selection policy is used to indicate the priority of multiple service modes supported by the application function network element. The terminal device can use the service mode with the highest priority as the service mode between itself and the AF among the service modes supported by both itself and the AF.

[0029] In a possible implementation, the method further includes the network device determining the priority of multiple service modes supported by the application function network element. When the capability information of the application function network element does not include a service mode selection policy, the network device specifies a selection policy for the multiple service modes supported by the application function network element. Optionally, a selection policy is specified for the multiple service modes supported by the application function network element according to the modes supported by the terminal device. For example, a service fee mode supported by both the terminal device and the application function network element is set to a high priority.

[0030] In a third aspect, an embodiment of the present application further provides a communication method, the method comprising a terminal device receiving capability information of an application function network element sent by an access and mobility management function network element, the capability information being used to indicate a service mode supported by the application function network element; the terminal device determining a service mode between itself and the application function network element according to the service party supported by the application function network element. Because the terminal device can perceive the service mode supported by the AF before initiating a service to the AF, the terminal device can initiate a correct connection establishment process to the AF according to the service mode supported by the AF.

[0031] In one possible implementation, the capability information also includes a service mode selection strategy, and the service mode selection strategy is used to indicate the priority of multiple service modes supported by the application function network element; the terminal device determines the service mode between itself and the application function network element according to the service modes supported by the application function network element, specifically: the terminal device uses the service mode with the highest priority as the service mode between itself and the application function network element among the service modes supported by both itself and the application function network element.

[0032] In a possible implementation, the terminal device receives the capability information of the application function network element sent by the access and mobility management function network element, specifically: the terminal device receives the UE routing selection policy URSP sent by the access and mobility management function network element, and the URSP includes the capability information of the application function network element. When the terminal device needs to establish a communication connection with the AF, the UE obtains the service mode supported by the AF in the URSP, and determines the service mode between itself and the AF according to the service mode supported by the AF.

[0033] The embodiment of the present application provides a terminal device, which has the function of implementing the behavior of the terminal in any of the above method embodiments. The function can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to each sub-function in the above function. The terminal device can be a user device.

[0034] The present application also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a computer, the method flow related to the terminal device in any of the above method embodiments is implemented. Specifically, the computer can be the above terminal device.

[0035] The embodiment of the present application further provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a computer, the method flow related to the network device in any of the above method embodiments is implemented. Specifically, the computer can be the above network device.

[0036] The present application also provides a computer program or a computer program product including the computer program, which, when executed on a computer, enables the computer to implement the method flow related to the terminal device in any of the above method embodiments. Specifically, the computer may be the above terminal device.

[0037] The present application also provides a computer program or a computer program product including the computer program, which, when executed on a computer, enables the computer to implement the method flow related to the network device in any of the above method embodiments. Specifically, the computer may be the above network device.

[0038] The embodiment of the present application also provides a device, which is applied to a terminal device, and the device is coupled to a memory, and is used to read and execute instructions stored in the memory, so that the terminal device can execute the method flow related to the terminal device in any of the above method embodiments. The memory can be integrated in the processor or independent of the processor. The device can be a chip on the user terminal (such as a system on a chip SoC (System on a Chip)).

[0039] The embodiment of the present application also provides a device, which is applied to a network device, and the device is coupled to a memory, and is used to read and execute instructions stored in the memory, so that the network device can execute the method flow related to the network device in any of the above method embodiments. The memory can be integrated in the processor or independent of the processor. The device can be a chip on the network device (such as a system on a chip SoC (System on a Chip)). BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 A schematic diagram of a network architecture of a 5G communication system;

[0041] Figure 2 A schematic diagram of the network architecture of an AKMA service;

[0042] Figure 3 A schematic diagram of a process for generating a key for an AKMA service;

[0043] Figure 4 A schematic diagram of a process for generating a communication key between an AF and a UE;

[0044] Figure 5 Schematic diagram of UE establishing a communication connection with AF through HTTP process;

[0045] Figure 6 A flow chart of a communication method provided by the present application;

[0046] Figure 7 A flowchart of another communication method provided by the present application;

[0047] Figure 8 A flowchart of another communication method provided by the present application;

[0048] Fig. 9 A schematic diagram of the structure of a communication device provided by the present application;

[0049] Fig.10 A schematic diagram of the structure of another communication device provided in this application. DETAILED DESCRIPTION

[0050] In order to better understand the technical solution provided by this application, the technical terms involved in this application are first introduced.

[0051] (1) Fifth Generation th -generation, 5G) system

[0052] The 5G system may include terminal equipment, access network and core network. For example, see Figure 1 Schematic diagram of the network architecture of the 5G system shown.

[0053] Among them, the terminal device is a device with wireless transceiver function, which can be deployed on land, including indoors or outdoors, handheld, wearable or vehicle-mounted; it can also be deployed on the water surface (such as ships, etc.); it can also be deployed in the air (such as airplanes, balloons and satellites, etc.). The terminal device can be a mobile phone, a tablet computer, a computer with wireless transceiver function, a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a wireless terminal in industrial control, a vehicle-mounted terminal device, a wireless terminal in self-driving, a wireless terminal in remote medical, a wireless terminal in smart grid, a wireless terminal in transportation safety, a wireless terminal in smart city, a wireless terminal in smart home, a wearable terminal device, etc. Terminal equipment may also be sometimes referred to as terminal, user equipment (UE), access terminal equipment, vehicle-mounted terminal, industrial control terminal, UE unit, UE station, mobile station, mobile station, remote station, remote terminal equipment, mobile equipment, UE agent or UE device, etc. Terminal equipment may also be fixed or mobile. Figure 1 In this application, the terminal device is introduced by taking UE as an example.

[0054] Among them, the access network is used to implement access-related functions and can provide network access functions for authorized users in a specific area. The access network forwards control signals and user data between terminal devices and the core network. The access network may include access network equipment, which may be equipment that provides access to terminal devices, and may include radio access network (RAN) equipment and AN equipment. RAN equipment is mainly wireless network equipment in 3GPP networks, and AN equipment may be access network equipment not defined by 3GPP. In systems using different wireless access technologies, the names of devices with base station functions may be different. For example, in 5G systems, they are called RAN or next-generation Node basestation (gNB); in long term evolution (LTE) systems, they are called evolved NodeB (eNB or eNodeB).

[0055] Among them, the core network is responsible for maintaining the subscription data of the mobile network and providing UE with functions such as session management, mobility management, policy management and security authentication. The core network may include the following network elements: user plane function (UPF), authentication server function (AUSF), access and mobility management function (AMF), session management function (SMF), network exposure function (NEF), network function repository function (NRF), policy control function (PCF) and unified data management (UDM). Optionally, it may also include application function (AF) and unified data repository (UDR). In the embodiment of the present application, UDM and UDR are collectively referred to as data management network elements.

[0056] AMF is mainly responsible for mobility management in mobile networks, such as user location update, user registration network, user switching, etc. SMF is mainly responsible for session management in mobile networks, such as session establishment, modification, and release. UPF is responsible for forwarding and receiving user data in terminal devices. It can receive user data from the data network and transmit it to the terminal device through the access network device; it can also receive user data from the terminal device through the access network device and forward it to the data network. PCF mainly supports providing a unified policy framework to control network behavior, provides policy rules to the control layer network functions, and is responsible for obtaining user subscription information related to policy decisions. AUSF is used to perform security authentication of UE. NEF is mainly used to support the opening of capabilities and events. NRF is used to provide storage and selection functions of network function entity information for other network elements. UDM is used to store user data, such as subscription data, authentication / authorization data, etc. AF interacts with the 3GPP core network to provide application layer services, such as providing application layer data routing, providing access network capability exposure functions, interacting with the policy framework to provide policy control, and interacting with the IP multimedia subsystem (IMS) of the 5G network.

[0057] The data network (DN) is used to provide business services to users. It can be a private network, such as a local area network; it can also be an external network that is not controlled by the operator, such as the Internet; it can also be a proprietary network jointly deployed by operators, such as the IMS network. The terminal device can access the DN through the established protocol data unit (PDU) session.

[0058] (2)AKMA Service

[0059] When a UE supporting AKMA service transmits data with an AF supporting AKMA service, the security protection based on the AKMA process can be used to improve the security of data transmission. For example, when an AF corresponds to a certain video application server, and a UE supporting AKMA service transmits data with the AF, the use of the AKMA service can improve the security of data transmission compared to the unprotected transmission method between the traditional UE and AF. For example, see Figure 2 The network architecture diagram of AKAM service is shown. Figure 2 The network architecture shown includes UE, (R)AN, AUSF, AMF, AF, NEF, AKMA anchor function (AAnF) and UDM.

[0060] Figure 2 There are three ways for UE to communicate with AF: one is that UE communicates with AF through (R)AN and AMF, one is that UE communicates with AF through AMF, and one is that UE communicates with AF directly through Ua* interface. Among them, Ua* interface is the communication interface between UE and AF.

[0061] Figure 2 In the AKMA service, AUSF can generate the key of the AKMA service and provide the key of the AKMA service of the UE to AAnF. Among them, the key of the AKMA service can be Kakma, which can also be called the root key of the AKMA service. The UE side will also generate the same key of the AKMA service by itself, that is, generate the same Kakma.

[0062] For example, the process of generating a key for the AKMA service can be found in Figure 3As shown. During the process of UE registering with the 5G core network, the UE sends a registration request to AMF through RAN. The registration request carries the identity information of the UE. The AMF selects AUSF based on the identity information of the UE (such as the hidden identity information (subscriber concealed identifier, SUCI)), and sends a message to the AUSF to trigger the main authentication process; the AUSF authenticates the UE and sends authentication parameters to the AMF; the AMF sends authentication parameters to the UE through RAN, the UE authenticates the AUSF based on the authentication parameters, and sends a response to the AMF through RAN. The AMF compares the responses, and the authentication is successful if they match. Figure 3 The primary authentication in the registration process refers to the process in which AUSF authenticates the UE and the UE authenticates the AUSF. The primary authentication can also be described as a two-way authentication. For details, please refer to the relevant description in section 6.1 of 3GPPTS33.501-g10. Figure 3 In the present invention, after the primary authentication, the AUSF may use the intermediate key generated in the primary authentication process, such as Kausf, to generate Kakma, and generate key identification information for Kakma. The key identification information may be used to identify Kakma, and may be, for example, a Kakma identifier (ID). After the primary authentication and before initiating the AKMA service, the UE may use the intermediate key generated in the primary authentication process, such as Kausf, to generate Kakma and generate key identification information for Kakma. It is understandable that the UE and the AUSF generate the same Kausf, Kakma and key identification information locally, respectively.

[0063] Figure 2 In the embodiment, AAnF can interact with AUSF, obtain the key of AKMA service from AUSF, and generate the communication key between the AF and UE and the validity period of the communication key according to the key of AKMA service and the identifier of AF. AAnF can send the communication key and the validity period of the communication key to the AF so that the AF can use the communication key to transmit data with the UE, thereby improving the security of data transmission between the AF and UE. The communication key between the AF and UE can be, for example, Kaf.

[0064] For example, the process of generating a communication key between the AF and the UE can be found in Figure 4 shown. Figure 4In the process, before the UE sends an application session establishment request to the AF, it performs the process of master authentication and generating Kakma. After generating Kakma and Kakma ID, AAnF may save the Kakma corresponding to the Kakma ID. The UE sends an application session establishment request (e.g., application session establishment request) carrying the Kakma ID to the AF. When the AF receives the application session establishment request, it sends a key request (e.g., key request) to the AAnF. The key request is used to request the Kaf between the AF and the UE. The key request carries the Kakma ID and the AF ID. If the AAnF saves the Kakma corresponding to the Kakma ID, then the AAnF directly generates Kaf and the validity period of Kaf based on the Kakma and the AF ID. If the AAnF does not save the Kakma corresponding to the KakmaID, then the AAnF sends a KAMA key request (e.g., AKMA key request) carrying the Kakma ID to the AUSF; the AUSF searches for the corresponding Kakma based on the Kakma ID, and sends a KAMA key response carrying the Kakma to the AAnF; the AAnF generates Kaf and the validity period of Kaf based on the Kakma and the AF ID. AAnF sends a key response (e.g., key response) to AF, carrying Kaf and Kaf's validity period; after receiving the key response, AF sends an application session establishment response (e.g., application session establishment response) to UE. After receiving the application session establishment response, UE can generate Kaf based on the local Kakma and AF ID.

[0065] The Kaf between different AFs and the same UE may be different. For example, the Kaf between AF1 and UE1 is Kaf1, and the Kaf between AF2 and UE1 is Kaf2. Figure 2 In the 5G core network, AF can interact with 3GPP core network elements. For example, AF can obtain quality of service (QoS) parameters from PCF, or AF provides QoS parameters to PCF, which can affect the data transmission of the application. For another example, AF can interact with NEF. In the AKMA service scenario, AF obtains the communication key between the AF and the UE and the validity period of the communication key from AAnF. AF can be located inside or outside the 5G core network. If AF is located inside the 5G core network, AF can interact directly with PCF; if AF is located outside the 5G core network, AF can interact with PCF through NEF.

[0066] For AFs that do not support AKMA services, the UE can establish a communication connection with the AF using existing procedures, such as Figure 5 As shown, the UE can establish a communication connection with the AF through the HTTP process. The client can be the UE and the server can be the AF. Specifically, the UE and the AF can establish a connection through a three-way handshake; then the UE sends a request message to the AF; the AF returns a response message (data) to the UE; the UE or the AF can disconnect the communication connection through four handshakes.

[0067] When the UE needs to establish communication with the AF, the UE initiates a connection establishment process to the AF. Different processes are required to establish a communication connection for different AFs. In the embodiment of the present application, the AF notifies the UE of the service modes supported by itself through the network. Before the UE initiates a service to the AF, the UE can perceive the service modes supported by the AF, and thus initiate the correct process according to the service modes supported by the AF before initiating the service.

[0068] See also Figure 6 , is a flow chart of a communication method provided by the present application, the flow chart may include but is not limited to the following steps:

[0069] Step 601, UDM / UDR obtains UE capability information;

[0070] The UE capability information includes service modes supported by the UE, such as the UE supporting AKMA services or supporting Generic Bootstrapping Architecture (GBA) services, or other similar services. This application does not limit the specific services supported by the UE.

[0071] UDM / UDR can obtain UE capability information in a variety of ways, such as:

[0072] Method 1: During the process of UE registering with the network, UDM / UDR may receive capability information of the UE reported by the UE.

[0073] For example, the UE sends a registration request to the AMF, and the registration request includes the capability information of the UE. After receiving the registration request sent by the UE, the AMF initiates the UE contract information acquisition process to the UDM / UDR. In the contract information acquisition process, the AMF sends the capability information of the UE to the UDM / UDR.

[0074] Method 2: The operator management system stores the authentication capability information of the UE in the UDM / UDR.

[0075] It should be noted that step 1 is optional.

[0076] Step 602: The AF reports the service description information and corresponding capability information of the AF to the UDM / UDR.

[0077] The service description information is information used to identify a service, and the service description information may include an identifier of the AF or an identifier of an application service provided by the AF or a service filter, etc.

[0078] The capability information of the AF includes the service modes supported by the AF, for example, the AF supports AKMA services or GBA services, or other similar services. The present application does not limit the specific services supported by the AF.

[0079] Optionally, when the AF supports multiple service modes, the capability information of the AF may further include a service mode selection policy. The service mode selection policy is used to determine the priority of the multiple service modes supported by the AF. For example, the service mode selection policy may include the priority of each service mode among the multiple service modes supported by the AF.

[0080] Exemplarily, the capability information of the AF reported by the AF to the UDM / UDR may be:

[0081] (AF ID, (AKMA, GBA) (1,2))

[0082] The above AF capability information indicates that the AF corresponding to the AF ID supports AKMA and GBA service modes, and the priority corresponding to the AKMA service is 1, and the priority corresponding to the GBA service is 2. The priority value indicates the priority of the service mode recommended by the AF for priority use. For example, if the priority of the AKMA service is higher than that of the GBA service, it means that the AF recommends the AKMA service mode for priority use.

[0083] Optionally, the AF also reports the identifier of the target object to the UDM / UDR. The identifier of the target object may be an identifier of a terminal device, a first group identifier, or a list of multiple terminal device identifiers. The first group identifier is used to indicate one or more terminal devices. The identifier of the target object is used to indicate a terminal device associated with the AF. For example, if the identifier of the target object includes an identifier of UE A, then in a subsequent step 603, the UDM / UDR needs to send part or all of the service modes supported by the AF to UE A through AMF.

[0084] In a possible implementation, the AF reports the AF capability information to the UDM / UDR through the NEF. Specifically, the AF may send a Nnef_Service_config request to the NEF, and the Nnef_Service_config request includes the service description information and the AF capability information. The NEF may perform an authorization check on the AF, and if the authorization check passes (optional), the NEF sends the service description information and the AF capability information to the UDM / UDR. Optionally, when the Nnef_Service_config request also includes the external identifier of the target object, the NEF may optionally map the external identifier of the target object to the internal identifier of the target object, and send the internal identifier of the target object to the UDM / UDR.

[0085] Step 603: UDM / UDR sends the service description information of the AF and the capability information of the AF to the UE through the AMF.

[0086] In a possible implementation, the UDM / UDR may first send the service description information of the AF and the capability information of the AF to the AUSF for security protection, and then send the service description information of the AF and the capability information of the AF after security protection to the UE through the AMF. For example, the service description information of the AF and the capability information of the AF are sent to the UE through the user parameter update (UE parameters update, UPU) process. For details, please refer to Figure 7 The embodiments are not described in detail here.

[0087] In another possible implementation, UDM / UDR may first send the service description information of the AF and the capability information of the AF to PCF, and then PCF sends the service description information of the AF and the capability information of the AF to UE through AMF. Alternatively, PCF may further generate a UE route selection policy (URSP) corresponding to the UE based on the service description information of the AF and the capability information of the AF, and then send the generated URSP to the UE through AMF. For example, the service description information of the AF and the capability information of the AF are sent to the UE through the user configuration update (UEConfiguration Update, UCU) process. For details, please refer to Figure 8 The embodiments are not described in detail here.

[0088] Optionally, when the AF supports multiple service modes, the UDM / UDR or PCF further determines the selection policies corresponding to the multiple service modes supported by the AF. For example, when the capability information of the AF does not include the service mode selection policy, the UDM / UDR or PCF may specify the selection policies corresponding to the multiple service modes supported by the AF, and send the selection policies corresponding to the multiple service modes supported by the AF to the UE.

[0089] Step 604: The UE obtains the service description information of the AF and the capability information of the AF, and determines the service mode between itself and the AF according to the service mode supported by the AF.

[0090] The determining of the service mode between the AF and the AF according to the service mode supported by the AF is specifically:

[0091] The UE determines the service mode between itself and the AF according to the service modes supported by itself and the service modes supported by the AF.

[0092] When the capability information of the AF also includes a service mode selection policy, the UE may determine the authentication mode between itself and the AF from the service modes supported by both itself and the AF according to the service mode selection policy. For example, the UE may use the service mode with the highest priority as the service mode between itself and the AF among the service modes supported by both itself and the AF.

[0093] When the capability information of the AF does not include a service mode selection policy, the UE can determine a service mode from the service modes supported by both itself and the AF as the service mode to be established between itself and the AF according to the local configuration or the user's choice. For example, the UE can use the service mode with the highest priority as the service mode between itself and the AF among the service modes supported by both itself and the AF. Alternatively, the UE can present the service modes supported by both itself and the AF to the user on the UE interface, and use the service mode selected by the user as the service mode between itself and the AF.

[0094] Furthermore, the UE may initiate a corresponding process according to the determined service mode, for example, initiating an application session establishment request to the AF through the Ua* reference point.

[0095] In the embodiment of the present application, the AF sends the service mode supported by itself to the UE through the core network, so that before the UE initiates a service to the AF, the UE can perceive the service mode supported by the AF, and the UE initiates the correct connection establishment process to the AF according to the service mode supported by the AF.

[0096] Combination Figure 7 A flow chart of another communication method provided by the present application is introduced, and the flow chart may include but is not limited to the following steps:

[0097] 701. PCF obtains the service mode supported by UE;

[0098] For example, the UE supports AKMA service or GBA service, or other service modes. This application does not limit the specific service modes supported by the UE.

[0099] PCF can obtain the service modes supported by UE through various implementation methods, such as:

[0100] Method 1: The PCF receives the service modes supported by the UE reported by the UE during the process of the UE registering with the network.

[0101] For example, the UE sends a registration request to the AMF, and the registration request includes the service modes supported by the UE. After receiving the registration request sent by the UE, the AMF sends a UE policy association establishment request to the PCF, and the UE policy association establishment request carries the service modes supported by the UE. In a possible implementation, the UE includes the service modes supported by the UE in a UE policy container and sends it to the PCF.

[0102] Method 2: PCF obtains the service mode supported by the UE from UDM / UDR.

[0103] For example, the service modes supported by the UE can be stored in the UDM / UDR as the subscription data of the UE. During the process of the UE registering with the network, the AMF obtains the service modes supported by the UE from the UDM / UDR and sends it to the PCF.

[0104] Optionally, after the PCF obtains the service mode supported by the UE, the PCF sends a first subscription request to the UDM / UDR, and the first subscription request is used to instruct the UDM / UDR to feed back to the PCF application information corresponding to the service mode supported by the UE. Specifically, when the UDM / UDR learns that the service mode supported by a certain AF matches the service mode supported by the UE, the UDM / UDR sends a first notification message to the PCF, and the first notification message may include the service description information of the AF and the service mode supported by the AF. In a possible implementation, the first subscription request may include the service mode supported by the UE, and optionally, the first subscription request may also include the identifier of the UE or a second group identifier, wherein the second group identifier is used to indicate one or more terminal devices, and the terminal devices indicated by the second group identifier include the UE.

[0105] Optionally, after the PCF obtains the service mode supported by the UE, the PCF sends a second subscription request to the UDM / UDR, where the second subscription request is used to instruct the UDM / UDR to feed back application information corresponding to the UE to the PCF.

[0106] It should be noted that step 1 is optional.

[0107] Step 702: The AF reports the service description information and corresponding capability information of the AF to the UDM / UDR.

[0108] Refer to the above Figure 6 Step 602 of the embodiment will not be described in detail here.

[0109] Optionally, the AF also reports the identifier of the target object to the UDM / UDR. The identifier of the target object may be an identifier of a terminal device, a first group identifier, or a list of multiple terminal device identifiers. The first group identifier is used to indicate one or more terminal devices. The identifier of the target object is used to indicate a terminal device associated with the AF. For example, if the identifier of the target object includes an identifier of UE A, then in the subsequent step 703, the UDM / UDR needs to send part or all of the service modes supported by the AF to UE A through AMF.

[0110] Step 703: UDM / UDR sends the service description information and corresponding capability information of the AF to the PCF.

[0111] Optionally, when the PCF sends a first subscription request to the UDM / UDR, instructing the UDM / UDR to feed back application information corresponding to the specified service mode to the PCF, the UDM / UDR determines whether the service mode supported by the AF matches the service mode specified by the PCF. If they match, the UDM / UDR sends a first notification message to the PCF, and the first notification message includes the service description information and corresponding capability information of the AF.

[0112] Optionally, when the PCF sends a second subscription request to the UDM / UDR, instructing the UDM / UDR to feed back the application information corresponding to the UE to the PCF, when the target object identifier indicates the UE, the UDM / UDR sends a second notification message to the PCF, and the second notification message includes the service description information and corresponding capability information of the AF.

[0113] Optionally, when the UDM / UDR receives the target object identifier from the AF, the UDM / UDR sends the target object identifier to the PCF.

[0114] Step 704: The PCF receives the service description information and corresponding capability information of the AF from the UDM / UDR; the PCF generates or updates the URSP of the UE according to the service description information and corresponding capability information of the AF.

[0115] Specifically, the URSP includes the service description information and corresponding capability information of the AF.

[0116] Optionally, the PCF determines whether to update or generate the URSP of the UE according to the service mode supported by the UE obtained in step 701. For example, UE B reports to the PCF in the registration process that it supports AKMA service, and the capability information of the AF received by the PCF from the UDM / UDR indicates that the AF also supports AKMA service. At this time, the PCF can generate or update the URSP of UE B. That is, the PCF can determine which UEs' URSPs need to be updated or generated according to the service modes supported by the UE stored in itself and the capability information of the AF received from the UDM / UDR. Then, the subsequent step 705 is executed to send the generated or updated URSP to the determined UE.

[0117] Optionally, the PCF may determine to update or generate the URSP of the UE indicated by the identity of the target object according to the identity of the target object, and then perform subsequent step 705 to send the generated or updated URSP to the UE indicated by the identity of the target object.

[0118] Optionally, when the capability information of the AF does not include a service mode selection policy, the PCF may specify that the AF supports selection policies corresponding to multiple service modes, and send the specified selection policies to the UE, for example, carry them in the URSP.

[0119] Step 705: The PCF sends the URSP to the UE.

[0120] In a possible implementation, the PCF sends a Namf_Communication_N1N2Transfer message to the AMF, and the Namf_Communication_N1N2Transfer message includes the URSP generated or updated in step 704. After receiving the Namf_Communication_N1N2Transfer message sent by the PCF, the AMF sends a UE policy transmission message to the UE, and the UE policy transmission message includes the URSP.

[0121] Step 706: The UE determines the service mode between itself and the AF based on the URSP.

[0122] When the UE needs to establish a communication connection with the AF, the UE obtains the service mode supported by the AF in the URSP, and determines the service mode between itself and the AF according to the service mode supported by the AF.

[0123] Optionally, when the UE registration process (step 701) occurs after the AF sends the AF's service description information and corresponding capability information to the UDM / UDR (step 702), the PCF may send the AF's service description information and corresponding capability information to the AMF in the registration process, so that the AMF can send the AF's service description information and corresponding capability information to the UE in the registration acceptance message.

[0124] In a possible implementation, in step 704, the PCF does not carry the capability information of the AF in the URSP, but directly sends the service description information and corresponding capability information of the AF to the UE through the AMF.

[0125] In the embodiment of the present application, the AF sends the capability information of the AF to the UDM / UDR through the NEF, and the PCF receives the capability information of the AF sent by the UDM / UDR and provides it to the UE when the UE accesses the network, so that the UE can obtain the capability information of the AF. Before the UE initiates a service to the AF, the UE can perceive the capability information of the AF, and the UE initiates a correct authentication process to the AF based on the capability information of the AF.

[0126] Combination Figure 8 A flow chart of another communication method provided by the present application is introduced, and the flow chart may include but is not limited to the following steps:

[0127] Step 801: UDM / UDR obtains UE capability information;

[0128] Step 802: The AF reports the service description information and corresponding capability information of the AF to the UDM / UDR.

[0129] Steps 801-802 are the same as steps 601 and 602 above and will not be described again here.

[0130] Step 803: UDM / UDR requests AUSF to perform security protection, such as integrity protection, on the information sent to the UE.

[0131] The UDM / UDR may send a UPU protection request message to the AUSF, wherein the UPU protection request message is used to request the AUSF to perform security protection, such as integrity protection, on the information that the UDM / UDR needs to send to the UE. The UPU protection request includes the UE identifier, the service description information of the AF, and the corresponding capability information.

[0132] Step 804: AUSF performs security protection on the information sent by UDM / UDR, and sends the protected information to UDM / UDR.

[0133] Optionally, AUSF obtains the intermediate key Kausf generated during the UE master authentication process based on the UE identifier, performs integrity protection on the service description information and corresponding capability information of the AF, obtains a first authentication message code, and sends the first authentication message code to UDM / UDR.

[0134] Step 805: UDM / UDR sends the service description information and corresponding capability information of the securely protected AF to the UE through the AMF.

[0135] In a possible implementation, the UDM / UDR sends a Nudm_SDM_notification message to the AMF, wherein the Nudm_SDM_notification message includes the service description information and corresponding capability information of the AF after security protection. Specifically, the service description information and corresponding capability information of the AF after security protection may include the first authentication message code and the service description information and corresponding capability information of the AF. After receiving the service description information and corresponding capability information of the AF after security protection, the AMF sends a DLNAS transport message to the UE, wherein the DL NAS transport message includes the first authentication message code, the service description information and corresponding capability information of the AF.

[0136] Step 806: The UE receives the security-protected AF's service description information and corresponding capability information sent by the AMF, and determines the service mode between itself and the AF according to the security-protected AF's service description information and corresponding capability information.

[0137] In a possible implementation, the UE may first verify the received information, for example, verify whether the received service description information and corresponding capability information of the AF have been tampered with. Specifically, the UE may use the intermediate key Kausf in the main authentication process, the service description information of the AF and the corresponding authentication capability information to calculate the second authentication message code. When the first authentication message code and the second authentication message code are the same, it is determined that the received service description information and corresponding capability information of the AF have not been tampered with. Furthermore, when it is determined that the received service description information and corresponding capability information of the AF have not been tampered with, the UE saves the received service description information and corresponding capability information of the AF.

[0138] The UE determines the service mode between itself and the AF according to the service mode supported by the AF. For details, please refer to the description of the above embodiment, which will not be repeated here.

[0139] Based on the same inventive concept as the method embodiment, the present application embodiment also provides a device 900 for executing the above Figures 6 to 8The methods executed by the terminal device and various network devices (such as AF, NEF, UDR / UDM, PCF or AMF) in the method embodiment shown, the relevant features can be found in the above method embodiment, and will not be repeated here. As an example, Fig. 9 As shown, the device 900 includes a transceiver module 901 and a processing module 902 .

[0140] For the specific functions of the transceiver module 901 and the processing module 902, please refer to the description in the above method embodiment, which will not be described here.

[0141] No further explanation is given here. The division of units in the embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, each functional unit in each embodiment of the present application may be integrated into a processor, or may exist physically separately, or two or more units may be integrated into a module. The above-mentioned integrated units may be implemented in the form of hardware or in the form of software functional modules.

[0142] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions to enable a terminal device (which can be a personal computer, mobile phone, or network device, etc.) or a processor (processor) to execute all or part of the steps of the method of each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

[0143] In the embodiments of the present application, both the terminal device and the network device can be presented in the form of dividing each functional module in an integrated manner. The "module" here can refer to a specific ASIC, circuit, processor and memory that executes one or more software or firmware programs, integrated logic circuit, and / or other devices that can provide the above functions.

[0144] In a simple embodiment, Fig.10 The communication device 1000 shown includes at least one processor 1001 , a memory 1002 , and optionally, may also include a communication interface 1003 .

[0145] The memory 1002 may be a volatile memory, such as a random access memory; the memory may also be a non-volatile memory, such as a read-only memory, a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD), or the memory 1002 may be any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 1002 may be a combination of the above memories.

[0146] The specific connection medium between the processor 1001 and the memory 1002 is not limited in the embodiment of the present application. In the figure, the memory 1002 and the processor 1001 are connected via a bus 1004, which is represented by a thick line in the figure. The connection between other components is only for schematic illustration and is not limited. The bus 1004 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.10 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0147] The processor 1001 may have a data transceiver function and may communicate with other devices. Fig.10 An independent data transceiver module, such as a communication interface 1003, may also be provided in the device for transmitting and receiving data; when the processor 1001 communicates with other devices, data may be transmitted through the communication interface 1003.

[0148] In one example, when the terminal device uses Fig.10 When the form shown is Fig.10 The processor in the device can call the computer execution instructions stored in the memory 1002 to enable the terminal device to execute the method executed by the terminal device in any of the above method embodiments.

[0149] Specifically, Fig. 9 The functions / implementation processes of the processing module and the transceiver module can be achieved through Fig.10 The processor 1001 in the embodiment calls the computer execution instruction stored in the memory 12002 to implement. Or, Fig. 9 The function / implementation process of the processing module can be achieved through Fig.10 The processor 1001 in the embodiment calls the computer execution instruction stored in the memory 1002 to implement, Fig. 9 The function / implementation process of the transceiver module can be achieved through Fig.10 It is implemented by the communication interface 1003 in.

[0150] In another example, when all network devices use Fig.10When the form shown is Fig.10 The processor in the system may call the computer execution instructions stored in the memory 1002, so that the authentication server function executes the method executed by the network device in any of the above method embodiments.

[0151] The embodiment of the present application further provides a communication system, which may include an application function network element AF and a data management network element. Optionally, it may also include a policy control function network element.

[0152] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0153] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0154] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0155] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0156] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A communication method, characterized in that: The method comprises: The capability information of the application function network element is sent to the core network element, where the capability information of the application function network element is used to indicate the service mode supported by the application function network element, and the service mode supported by the application function network element is used to determine the service mode between the terminal device and the application function network element.

2. The method according to claim 1, characterized in that The service modes supported by the application function network element include identity authentication and key management services of application programs, or general bootstrap architecture services.

3. The method according to claim 1 or 2, characterized in that: The sending the capability information of the application function network element to the core network element includes: The capability information and target object identifier of the application function network element are sent to the core network network element, where the target object identifier is used to indicate the terminal device.

4. The method according to any one of claims 1 to 3, characterized in that: The sending the capability information of the application function network element to the core network element includes: Send the capability information of the application function network element and the description information of the application function network element to the core network network element.

5. The method according to any one of claims 1 to 4, characterized in that: The capability information of the application function network element also includes a service mode selection policy, and the service mode selection policy is used to indicate the priority of multiple service modes supported by the application function network element.

6. A communication method, characterized in that: The method comprises: Acquire capability information of an application function network element, where the capability information of the application function network element is used to indicate a service mode supported by the application function network element; Determine the service mode between the terminal device and the application function network element according to the service mode supported by the application function network element.

7. The method according to claim 6, characterized in that The service modes supported by the application function network element include identity authentication and key management services of application programs, or general bootstrap architecture services.

8. The method according to claim 6 or 7, characterized in that: The obtaining of capability information of the application function network element includes: Acquire capability information of the application function network element and description information of the application function network element.

9. The method according to any one of claims 6 to 8, characterized in that: The capability information of the application function network element also includes a service mode selection strategy, where the service mode selection strategy is used to indicate the priority of multiple service modes supported by the application function network element, and determining the service mode between the terminal device and the application function network element according to the service mode supported by the application function network element includes: The service mode between the terminal device and the application function network element is determined according to the service mode supported by the application function network element and the service mode selection strategy.

10. The method according to claim 9, characterized in that Determining the service mode between the terminal device and the application function network element according to the service mode supported by the application function network element and the service mode selection policy, including: Among the service modes supported by both the terminal device and the application function network element, a service mode with the highest priority is selected as the service mode between the terminal device and the application function network element.

11. The method according to any one of claims 6 to 10, characterized in that: The obtaining of capability information of the application function network element includes: Receive capability information of the application function network element from a core network network element.

12. The method according to claim 11, characterized in that The core network element includes an access and mobility management function network element, and the receiving capability information of the application function network element from the core network element includes: A user equipment routing selection policy is received from the access and mobility management function network element, where the user equipment routing selection policy includes capability information of the application function network element.

13. A communication method, characterized in that: The method comprises: Receiving capability information from an application function network element, wherein the capability information of the application function network element is used to indicate a service mode supported by the application function network element, and the service mode supported by the application function network element is used to determine a service mode between a terminal device and the application function network element; Send the capability information of the application function network element to the terminal device.

14. The method according to claim 13, characterized in that The service modes supported by the application function network element include identity authentication and key management services of application programs, or general bootstrap architecture services.

15. The method according to claim 13 or 14, characterized in that The receiving capability information from the application function network element includes: Receive capability information and at least one of the following information from the application function network element: a target object identifier, or description information of the application function network element, wherein the target object identifier is used to indicate the terminal device.

16. The method according to any one of claims 13 to 15, characterized in that: The capability information of the application function network element also includes a service mode selection policy, and the service mode selection policy is used to indicate the priority of multiple service modes supported by the application function network element.

17. The method according to any one of claims 13 to 16, characterized in that: The sending the capability information of the application function network element to the terminal device includes: The capability information of the application function network element is sent to the terminal device through the access and mobility management function network element.

18. The method according to any one of claims 13 to 17, characterized in that: The sending the capability information of the application function network element to the terminal device includes: generating a user equipment routing selection policy, wherein the user equipment routing selection policy includes capability information of the application function network element; The user equipment routing selection policy is sent to the terminal equipment.

19. A communication method, characterized in that: The method comprises: The application function network element sends capability information of the application function network element to the core network element, wherein the capability information of the application function network element is used to indicate a service mode supported by the application function network element, and the service mode supported by the application function network element is used to determine a service mode between a terminal device and the application function network element; The core network element receives the capability information of the application function network element from the application function network element, and sends the capability information of the application function network element to the terminal device.

20. A communication system, characterized in that: The system includes application function network elements and core network elements, wherein: The application function network element is used to: send capability information of the application function network element to the core network element, wherein the capability information of the application function network element is used to indicate a service mode supported by the application function network element, and the service mode supported by the application function network element is used to determine a service mode between a terminal device and the application function network element; The core network network element is used to: receive capability information of the application function network element from the application function network element, and send the capability information of the application function network element to the terminal device.

21. A communication device, characterized in that: The device includes a processing module and a transceiver module, which is used for the device to implement the method according to any one of claims 1 to 5, or to implement the method according to any one of claims 6 to 12, or to implement the method according to any one of claims 13 to 18.

22. A communication device, characterized in that: include: A processor, wherein the processor is coupled to a memory, wherein the memory is used to store programs or instructions, and when the programs or instructions are executed by the processor, the device executes the method according to any one of claims 1 to 5, or executes the method according to any one of claims 6 to 12, or executes the method according to any one of claims 13 to 18.

23. A computer-readable storage medium having a computer program or instruction stored thereon, characterized in that: When the computer program or instruction is executed, the computer executes the method according to any one of claims 1 to 5, or the method according to any one of claims 6 to 12, or the method according to any one of claims 13 to 18.

24. A chip, characterized in that: The method comprises a processor, wherein the processor is coupled to a memory, wherein the memory is used to store programs or instructions. When the programs or instructions are executed by the processor, the method according to any one of claims 1 to 5 is executed, or the method according to any one of claims 6 to 12 is executed, or the method according to any one of claims 13 to 18 is executed.

25. A computer program product having a computer program or instructions stored thereon, characterized in that: When the computer program or instruction is executed by a computer, the computer executes the method according to any one of claims 1 to 5, or the method according to any one of claims 6 to 12, or the method according to any one of claims 13 to 18.

Images