Communication method and communication device

Abstract

A communication method and a communication device, the method comprising: a first network element receiving a registration request message from a second network element for requesting registration of the second network element as a service network element of a terminal device to the first network element, the registration request message comprising a first uniform resource identifier; and under the condition that the first uniform resource identifier is the same as the uniform resource identifier stored in the first network element, the first network element sends a message used for indicating registration failure to the second network element. Based on the method, the malicious network element can be prevented from registering to the first network element by using the uniform resource identifier of the network element actually providing service for the terminal equipment, and the network security can be improved.

Description

Technical Field

[0001] The present application relates to the field of secure communications, and more particularly, to a communication method and a communication device. Background Art

[0002] Currently, during the terminal device registration process, the terminal device implements bidirectional authentication between the terminal device and the network through the primary authentication process. After the primary authentication is completed, the access and mobility management function (AMF) network element serving the terminal device will register with the unified data management (UDM) network element, so that the UDM network element can subsequently provide relevant information about the terminal device to the terminal device through the AMF.

[0003] A malicious AMF network element may exist in the network and falsely claim to provide services to terminal devices, requesting them to register with the UDM network element. Once the malicious AMF network element successfully registers with the UDM network element, the malicious AMF network element can obtain sensitive data of the terminal device from the UDM network element, causing network security to degrade. Summary of the Invention

[0004] The embodiments of the present application provide a communication method that can improve network security.

[0005] In a first aspect, a communication method is provided. The method can be executed by a first network element, or can also be executed by a component of the first network element (such as a chip or circuit), without limitation.

[0006] The method includes: a first network element receiving a registration request message from a second network element, the registration request message being used to request that the second network element be registered with the first network element as a service network element of a terminal device, the registration request message including identification information of a second public land network where the second network element is located; and when the public land network where the terminal device is located (referred to as the first public land network) is different from the second public land network, the first network element sending a message to the second network element indicating a registration failure.

[0007] Optionally, the method further includes: the first network element receiving identification information of the first public land network from the authentication service function network element.

[0008] For example, when the identification information of the first public land network differs from the identification information of the second public land network, the first network element sends a message to the second network element indicating a registration failure. The identification information of the first public land network differs from the identification information of the second public land network, which means that the public land network indicated by the identification information of the first public land network is different from the public land network indicated by the identification information of the second public land network. Even if the format and / or representation of the identification information of the first public land network and the identification information of the second public land network are different, as long as the public land networks indicated by the identification information of the first public land network and the identification information of the second public land network are the same, the identification information of the first public land network is considered to be the same as the identification information of the second public land network.

[0009] It should also be understood that when the identification information of the first public land network is different from the identification information of the second public land network, the first network element may send a message to the second network element to indicate a registration failure, or the first network element may not send a response message (for example, a message to indicate a registration failure) regarding the registration request message to the second network element, or the first network element may not send a message to the second network element to indicate a registration result.

[0010] It should also be understood that the first network element is, for example, a UDM network element, and the second network element is, for example, an AMF network element.

[0011] According to the method provided in this application, the first network element can determine whether to accept the registration of the second network element as the network element providing services to the terminal device based on whether the public land network of the second network element included in the registration request message is the same as the public land network of the terminal device. Considering that the public land network of the malicious network element is different from the public land network of the terminal device, the network element that actually provides services to the terminal device is the same as the public land network of the terminal device, this method can prevent the malicious network element from registering with the first network element, thereby improving network security.

[0012] In combination with the first aspect, in some possible implementations, the registration request message also includes identification information of the terminal device, and the method further includes: the first network element determining, based on the identification information of the terminal device, that the public land network where the terminal device is located is the first public land network.

[0013] In one possible implementation, the method further includes: the first network element receiving identification information of the first public land network from the authentication service function network element, and the first network element storing the identification information of the first public land network, such as storing a correspondence between the identification information of the first public land network and the identification information of the terminal device. The first network element determining, based on the identification information of the terminal device, that the public land network where the terminal device is located is the first public land network, includes: the first network element obtaining, based on the identification information of the terminal device, the identification information of the first public land network corresponding to the terminal device from locally stored identification information of public land networks, and determining, based on the correspondence, that the identification information of the public land network corresponding to the identification information of the terminal device is the identification information of the first public land network.

[0014] In combination with the first aspect, in some possible implementations, the HTTP header in the registration request message includes identification information of the second public land network, and / or the token in the registration request message includes identification information of the second public land network.

[0015] Based on the above technical solution, the information in the HTTP header of the registration request message and the information in the token of the registration request message cannot be tampered with. The identification information of the second public land network is located in the HTTP header of the registration request message and / or in the token of the registration request message. This can prevent malicious network elements from forging the identification information of their own public land network, facilitate the first network element to identify malicious network elements, reject the malicious network element's registration request, and improve network security.

[0016] For the first aspect, please refer to the following Figure 3 Detailed description in the method shown.

[0017] In a second aspect, a communication method is provided. The method can be executed by a first network element, or can also be executed by a component of the first network element (such as a chip or circuit), without limitation.

[0018] The method includes: a first network element receives a registration request message from a second network element, the registration request message is used to request that the second network element be registered to the first network element as a service network element of a terminal device, and the registration request message includes a first uniform resource identifier; when the first uniform resource identifier is the same as a uniform resource identifier stored in the first network element, the first network element sends a message to the second network element for indicating that the second network element has failed to register with the first network element.

[0019] The first uniform resource identifier is used to send a message for requesting re-authentication of the terminal device, or it can also be understood that the address information in the first uniform resource identifier is used to send a message for requesting re-authentication of the terminal device.

[0020] It should be understood that the uniform resource identifier stored by the first network element may be the uniform resource identifier stored by the first network element within the first time period, or the uniform resource identifier stored by the first network element may be the uniform resource identifier of the first quantity, such as the first quantity of uniform resource identifiers most recently stored by the first network element, or the uniform resource identifier stored by the first network element may be all uniform resource identifiers stored by the first network element.

[0021] It should also be understood that the first time period and the first quantity may be pre-configured by the system, or pre-defined by the protocol, or determined by the first network element itself, etc., and this application does not limit them.

[0022] According to the method provided in the present application, when a first network element receives a registration request message from a second network element requesting to serve as a service network element for a terminal device, the first network element determines whether to accept the registration request of the second network element based on whether the first uniform resource identifier in the registration request message is the same as the uniform resource identifier stored by the first network element. Generally, the uniform resource identifier in each registration request message sent by the network element that actually provides services to the terminal device is different, that is, the uniform resource identifier in the registration request message of the network element that actually provides services to the terminal device is different from the uniform resource identifier stored by the first network element. When the first uniform resource identifier in the registration request message of the second network element is the same as the uniform resource identifier stored by the first network element, the first network element sends a message to the second network element indicating a registration failure, thereby preventing malicious network elements from registering with the first network element and improving network security.

[0023] In combination with the second aspect, in some possible implementation methods, the method includes: when a first condition is met, the first network element sends a first request message to the third network element based on the first uniform resource identifier, wherein the first condition includes that the first uniform resource identifier is different from the uniform resource identifier stored by the first network element, the first request message is used to request re-authentication of the terminal device, and the first request message includes the first uniform resource identifier; the first network element receives a first response message from the third network element, and the first response message is used to indicate that the re-authentication failed; the first network element sends a message to the second network element based on the first response message to indicate that the registration failed.

[0024] It should be understood that the first network element sending the first request information to the third network element can be: after the first network element receives the registration request message, or when triggered by the registration request message, the first network element sends the first request message to the third network element. It can also be understood that in response to the first uniform resource identifier being different from the uniform resource identifier stored by the first network element, the first network element sends the first request information to the third network element based on the first uniform resource identifier.

[0025] It should also be understood that the address information included in the first uniform resource identifier corresponds to the third network element, that is, the address information is the address information of the third network element, indicates the address of the third network element, and is used to send a message to the third network element. The second network element and the third network element are network elements of the same type; the third network element and the second network element can be the same network element or different network elements.

[0026] It should also be understood that the first network element sends the first request message to the third network element according to the address information. For example, the first network element sends the first request message to the third network element according to the address information in the first uniform resource identifier.

[0027] Based on the above technical solution, if the first uniform resource identifier is different from the uniform resource identifier stored by the first network element, the first network element requests the third network element to trigger re-authentication of the terminal device based on the first uniform resource identifier, and if the re-authentication fails, sends a message indicating registration failure to the second network element. The re-authentication result helps increase the possibility of the first network element identifying malicious network elements, thereby further improving network security.

[0028] In combination with the second aspect, in some possible implementation methods, the method includes: when a first condition is met, the first network element sends a first request message to the third network element based on the first uniform resource identifier, wherein the first condition includes that the first uniform resource identifier is different from the uniform resource identifier stored by the first network element, the first request message is used to request re-authentication of the terminal device, and the first request message includes the first uniform resource identifier; the first network element receives a second response message from the third network element, and the second response message is used to indicate that the re-authentication is successful; the first network element stores the first uniform resource identifier and sends a message to the second network element to indicate that the registration is successful.

[0029] In combination with the second aspect, in some possible implementation methods, the first uniform resource identifier includes address information of the third network element, and the first network element sends a first request message to the third network element based on the first uniform resource identifier, including: the first network element sends a first request message to the third network element based on the address information.

[0030] In conjunction with the second aspect, in some possible implementations, the address information includes a full domain name or an Internet Protocol address.

[0031] In conjunction with the second aspect, in some possible implementations, the registration request message further includes identification information of the public land network where the second network element is located, and the first condition further includes: the public land network where the second network element is located is different from the public land network where the terminal device is located.

[0032] For the second aspect, please refer to the following Figure 4 Detailed description in the method shown.

[0033] On the third aspect, a communication method is provided. The method can be executed by a third network element, or can also be executed by a component of the third network element (such as a chip or circuit), without limitation.

[0034] The method includes: a third network element sends a registration request message to a first network element, where the registration request message is used to request that the third network element be registered to the first network element as a service network element of a terminal device, and the registration request message includes a first uniform resource identifier; the third network element receives a message from the first network element for requesting re-authentication, where the message for requesting re-authentication includes the first uniform resource identifier; when the first uniform resource identifier is different from the second uniform resource identifier, the third network element sends a message to the first network element for indicating that the re-authentication has failed.

[0035] According to the method provided in the present application, the third network element determines whether to send a message indicating successful re-authentication or a message indicating failed re-authentication to the first network element based on whether the first uniform resource identifier included in the message for requesting re-authentication from the first network element is the same as or different from the second uniform resource identifier in the registration request message sent by the third network element to the first network element. Wherein, if the first uniform resource identifier is different from the second uniform resource identifier, the third network element sends a message indicating failed re-authentication to the first network element, thereby preventing malicious network elements from using the uniform resource identifier of the third network element to register with the first network element, thereby improving network security.

[0036] For the third aspect, please refer to the following Figure 4 Detailed description in the method shown.

[0037] In a fourth aspect, a communication method is provided. The method can be executed by a first network element, or can also be executed by a component of the first network element (such as a chip or circuit), without limitation.

[0038] The method includes: a first network element receives a registration request message from a second network element, the registration request message is used to request that the second network element be registered to the first network element as a service network element of a terminal device, and the registration request message includes a uniform resource identifier; when the second address information of the second network element is different from the first address information included in the uniform resource identifier, the first network element sends a message to the second network element to indicate a registration failure.

[0039] In combination with the fourth aspect, in some possible implementations, the registration request message includes identification information of the second network element, and the method further includes: the first network element obtains the second address information according to the identification information of the second network element.

[0040] Optionally, the first address information includes a first full address domain name or a first Internet Protocol address.

[0041] Optionally, the second address information includes a second full address domain name or a second Internet Protocol address.

[0042] It should be understood that when the first address information includes the first full address domain name, the first network element obtains the second address information based on the identification information of the second network element, where the second address information includes the second full address domain name. When the first address information includes the first Internet Protocol address, the first network element obtains the second address information based on the identification information of the second network element, where the second address information includes the second Internet Protocol address.

[0043] In combination with the fourth aspect, in some possible implementations, the method further includes: the first network element obtains a certificate of the second network element, where the certificate includes the second address information.

[0044] It should be understood that after the first network element receives the registration request message from the second network element, the first network element may determine the second address information according to the certificate of the second network element.

[0045] In combination with the fourth aspect, in some possible implementation methods, the method also includes: the first network element obtains the certificate of the second network element, the certificate includes a second full-address domain name, the first address information is a first Internet Protocol address, and the second address information is a second Internet Protocol address. The method also includes: the first network element obtains the second Internet Protocol address based on the second full-address domain name.

[0046] It should be understood that when the first address information is a first Internet Protocol address and the certificate of the second network element includes a second full address domain name, the first network element obtains the second Internet Protocol address corresponding to the second network element from other network elements based on the second full address domain name in the certificate of the second network element, and then determines whether to send a message to the second network element to indicate a registration failure based on the first Internet Protocol address and the second Internet Protocol address.

[0047] The fourth aspect can also be referred to later Figure 5 Detailed description in the method shown.

[0048] In a fifth aspect, a communication method is provided. The method can be executed by the first network element, or can also be executed by a component of the first network element (such as a chip or circuit), without limitation.

[0049] The method includes: a first network element receives a registration request message from a second network element, where the registration request message is used to request that the second network element be registered to the first network element as a service network element of a terminal device; the first network element sends a message to the second network element indicating a registration failure based on whether the second network element supports re-authentication and whether the registration request message includes a uniform resource identifier, where the uniform resource identifier is used to send a message requesting re-authentication of the terminal device.

[0050] It should be understood that the uniform resource identifier is used to send a message for requesting re-authentication of the terminal device. It can also be understood that the address information in the uniform resource identifier is used to send a message for requesting re-authentication of the terminal device.

[0051] It should be understood that when the second network element first interacts with the second network element through the first network element, the second network element indicates to the first network element whether the second network element has the capability to support re-authentication. Generally, when a network element with the capability to support re-authentication sends a registration request message to the first network element, the registration request message includes a uniform resource identifier.

[0052] In one possible implementation, when the second network element supports re-authentication and the registration request message includes a uniform resource identifier, the first network element may send a message to the second network element after receiving the registration request message to indicate successful registration; when the second network element supports re-authentication and the registration request message does not include a uniform resource identifier, the first network element may send a message to the second network element after receiving the registration request message to indicate a registration failure, or may not send a message to indicate failure; when the second network element does not support re-authentication and the registration request message includes a uniform resource identifier, the first network element may send a message to the second network element after receiving the registration request message to indicate a registration failure; when the second network element does not support re-authentication and the registration request message does not include a uniform resource identifier, the first network element may send a message to the second network element after receiving the registration request message to indicate a successful registration.

[0053] According to the method provided in the present application, the first network element determines whether to accept the registration request of the second network element based on whether the second network element supports re-authentication and whether the registration request message of the second network element carries a uniform resource identifier. This can prevent malicious network elements from registering with the first network element and improve network security.

[0054] In combination with the fifth aspect, in some possible implementation methods, the first network element sends a message to the second network element to indicate a registration failure based on whether the second network element supports re-authentication and whether the registration request message includes a uniform resource identifier, including: when the second network element supports re-authentication and the registration request message meets the second condition, the first network element sends a message to the second network element to indicate a registration failure, and the second condition includes: the registration request message does not include a uniform resource identifier.

[0055] In combination with the fifth aspect, in some possible implementation methods, the uniform resource identifier includes first address information, and the method also includes: when the second network element supports re-authentication and the registration request message includes the uniform resource identifier, the first network element sends a message for requesting re-authentication according to the first address information; the first network element receives a message indicating that the re-authentication failed; the first network element sends a message indicating that the registration failed to the second network element based on the message indicating that the re-authentication failed.

[0056] Based on the above technical solution, if the second network element supports re-authentication and the registration request message includes a uniform resource identifier, the first network element can send a message requesting re-authentication based on the uniform resource identifier. When the second network element is a network element that truly provides services to the terminal device, the second network element, upon receiving the message requesting re-authentication, normally triggers the re-authentication process for the terminal device. When the second network element is a malicious network element that does not provide services to the terminal device, the second network element, upon receiving the message requesting re-authentication, is unable to perform the re-authentication process for the terminal device. When the second network element is a malicious network element, the uniform resource identifier in the registration request message of the second network element is the uniform resource identifier of a third network element obtained by the second network element, and the third network element is a network element that truly provides services to the terminal device. In this case, the first network element sends a message requesting re-authentication to the third network element based on the uniform resource identifier in the registration request message. The third network element determines that the uniform resource identifier in the message requesting re-authentication is different from the uniform resource identifier in the registration message sent by the third network element to the first network element, and the third network element sends a message to the first network element indicating that the re-authentication failed. Correspondingly, when the second network element is a malicious network element, the first network element receives a message indicating that re-authentication has failed. The first network element rejects the registration request of the second network element based on the message indicating that re-authentication has failed, thereby preventing the malicious network element from registering with the first network element and improving network security.

[0057] In combination with the fifth aspect, in some possible implementation methods, before the first network element receives the registration request message from the second network element, the method also includes: the first network element receives a second request message from the second network element, the second request message includes identification information of the terminal device, and the second request message is used to obtain registration information of the first access and mobility management network element serving the terminal device; the first network element sends a third response message to the second network element, and the third response message is used to indicate the rejection of the registration information of the first access and mobility management network element, or the third response message includes the registration information of the first access and mobility management network element, and the registration information of the first access and mobility management network element does not include a uniform resource identifier used to send a re-authentication request to the first access and mobility management network element.

[0058] The above technical solution can prevent malicious network elements from obtaining the registration information of the first access and mobility management network element that actually serves the terminal device from the first network element through the second request message, or obtaining the uniform resource identifier of the first access and mobility management network element for re-authentication. It can prevent malicious network elements from falsely claiming to provide services to the terminal device and registering with the first network element, thereby improving network security.

[0059] In combination with the fifth aspect, in some possible implementation methods, the first network element sends a third response message to the second network element, including: when the second network element is an access and mobility management network element, the first network element sends a third response message to the second network element.

[0060] In combination with the fifth aspect, in some possible implementation methods, the second request message includes a first token, the first token indicates that it is prohibited to provide registration information of the access and mobility management network element, or the first token indicates that it is prohibited to provide a uniform resource identifier for sending a re-authentication request to the access and mobility management network element; the first network element sends a third response message to the second network element, including: the first network element sends the third response message based on the first token.

[0061] In one possible implementation, when the first token indicates that it is prohibited to provide registration information of the access and mobility management network element, the first network element sends a third response message to the second network element, and the third response message is used to indicate the refusal to provide registration information of the first access and mobility management network element; or, when the first token indicates that it is prohibited to provide a uniform resource identifier for sending a re-authentication request to the access and mobility management network element, the first network element sends a third response message to the second network element, and the third response message includes the registration information of the first access and mobility management network element, and the registration information of the first access and mobility management network element does not include the uniform resource identifier for sending a re-authentication request to the first access and mobility management network element.

[0062] Based on the above technical solution, the information in the first token cannot be tampered with. The first token instructs the first network element to prohibit providing registration information of the access and mobility management network element, or prohibit providing a uniform resource identifier for sending a re-authentication request to the access and mobility management network element. This can prevent malicious network elements from modifying the information in the first token, ensure the accuracy of transmitted information, and improve network security.

[0063] In combination with the fifth aspect, in some possible implementation methods, the method also includes: when the second network element supports re-authentication and the registration request message includes a uniform resource identifier, the first network element sends a message to the second network element to indicate a registration failure when the second address information corresponding to the second network element is different from the first address information included in the uniform resource identifier.

[0064] Based on the above technical solution, when the second network element supports re-authentication and the registration request message includes a uniform resource identifier, the first network element determines whether to accept the registration request based on the first address information included in the uniform resource identifier and the second address information corresponding to the second network element. This prevents malicious network elements from falsely claiming that the terminal device is registering with the first network element by carrying the uniform resource identifier of the network element that actually provides services to the terminal device in the registration request message, thereby improving network security.

[0065] In combination with the fifth aspect, in some possible implementation methods, the first network element obtains the second address information corresponding to the second network element based on the identification information of the second network element, including: the first network element obtains the second address information based on the identification information of the second network element.

[0066] In combination with the fifth aspect, in some possible implementations, the method further includes the first network element obtaining a certificate of the second network element, where the certificate includes the second address information.

[0067] In combination with the fifth aspect, in some possible implementation methods, the method also includes the first network element obtaining a certificate of the second network element, the certificate including a second full-address domain name, the first address information including a first Internet Protocol address, and the first network element determining the second address information based on the certificate corresponding to the identification information of the second network element, including: the first network element obtaining the second Internet Protocol address based on the second full-address domain name.

[0068] In conjunction with the fifth aspect, in some possible implementations, the first address information includes a first full domain name or a first Internet Protocol address, or the second address information includes a second full domain name or a second Internet Protocol address.

[0069] In combination with the fifth aspect, in some possible implementation methods, the first network element sends a message to the second network element to indicate a registration failure based on whether the second network element supports re-authentication and whether the registration request message includes a uniform resource identifier, including: when the second network element supports re-authentication, the registration request message includes a uniform resource identifier, and the uniform resource identifier included in the registration request message is the same as the uniform resource identifier stored in the first network element, the first network element sends a message to the second network element to indicate a registration failure, and the uniform resource identifier includes address information for sending re-authentication.

[0070] In combination with the fifth aspect, in some possible implementation methods, the first network element sends a message indicating registration failure to the second network element based on whether the second network element supports re-authentication and whether the registration request message includes a uniform resource identifier, including: when the second network element supports re-authentication, the registration request message includes a uniform resource identifier, and the uniform resource identifier included in the registration request message is different from the uniform resource identifier stored in the first network element, the first network element sends a message requesting re-authentication to the third network element based on the uniform resource identifier in the registration request message, and the message requesting re-authentication includes the uniform resource identifier in the registration request message; the first network element receives a message indicating re-authentication failure from the third network element; the first network element sends a message indicating registration failure to the second network element based on the message indicating re-authentication failure.

[0071] In combination with the fifth aspect, in some possible implementations, the registration request message includes identification information of the first public land network where the second network element is located. When a third condition is met, the first network element sends a message for requesting re-authentication to the third network element based on the uniform resource identifier. The third condition includes: the identification information of the first public land network is different from the identification information of the second public land network, and / or the identification information of the first public land network is different from the identification information of the public land network in the registration request message of the fourth network element. The second public land network is the public land network where the terminal device is located, and the fourth network element is the network element that successfully registered with the first network element as a network element serving the terminal device before the first network element received the registration request message.

[0072] It should be understood that the fourth network element and the second network element are network elements of the same type.

[0073] Based on the above technical solution, the first network element uses the third condition as the condition for triggering re-authentication. When the third condition is met, the first network element triggers the second network element / third network element to re-authenticate the terminal device; when the third condition is not met, the first network element does not need to trigger the second network element / third network element to re-authenticate the terminal device, thereby saving resource overhead.

[0074] The fifth aspect can also be referred to later Figure 6 、 Figure 7 and Figure 8 Detailed description in the method shown.

[0075] In a sixth aspect, a communication method is provided, the method comprising: a second network element sending a registration request message to a first network element; the first network element receiving the registration request message from the second network element, the registration request message being used to request that the second network element be registered to the first network element as a service network element of a terminal device, the registration request message including identification information of a second public land network where the second network element is located; in a case where the public land network where the terminal device is located (referred to as the first public land network) is different from the second public land network, the first network element sending a message to the second network element indicating a registration failure; the second network element receiving the message from the first network element indicating a registration failure.

[0076] Optionally, the method further includes: the first network element receiving identification information of the first public land network from the authentication service function network element.

[0077] In combination with the sixth aspect, in some possible implementations, the registration request message also includes identification information of the terminal device, and the method further includes: the first network element determines that the public land network where the terminal device is located is the first public land network based on the identification information of the terminal device.

[0078] In one possible implementation, the method further includes: the first network element receiving identification information of the first public land network from the authentication service function network element, and the first network element storing the identification information of the first public land network, such as storing a correspondence between the identification information of the first public land network and the identification information of the terminal device. The first network element determining, based on the identification information of the terminal device, that the public land network where the terminal device is located is the first public land network, includes: the first network element obtaining, based on the identification information of the terminal device, the identification information of the first public land network corresponding to the terminal device from locally stored identification information of public land networks, and determining, based on the correspondence, that the identification information of the public land network corresponding to the identification information of the terminal device is the identification information of the first public land network.

[0079] In combination with the sixth aspect, in some possible implementations, the Hypertext Transfer Protocol header in the registration request message includes identification information of the second public land network, and / or the token in the registration request message includes identification information of the second public land network.

[0080] The sixth aspect can also be referred to later Figure 3 Detailed description in the method shown.

[0081] In the seventh aspect, a communication method is provided, which includes: the second network element sends a registration request message to the first network element, the registration request message is used to request that the second network element be registered to the first network element as a service network element of the terminal device, and the registration request message includes a first uniform resource identifier; the first network element receives the registration request message from the second network element; when the first uniform resource identifier is the same as the uniform resource identifier stored in the first network element, the first network element sends a message to the second network element indicating that the second network element has failed to register with the first network element; the second network element receives a message from the first network element indicating that the second network element has failed to register with the first network element.

[0082] In combination with the seventh aspect, in some possible implementation methods, the method includes: when a first condition is met, the first network element sends a first request message to the third network element based on the first uniform resource identifier, wherein the first condition includes that the first uniform resource identifier is different from the uniform resource identifier stored in the first network element, the first request message is used to request re-authentication of the terminal device, and the first request message includes the first uniform resource identifier; the third network element receives the first request message from the first network element; when the first uniform resource identifier is different from the second uniform resource identifier, the third network element sends a first response message to the first network element, the first response message is used to indicate that the re-authentication failed, and the second uniform resource identifier is the uniform resource identifier in the registration request message sent by the third network element to the first network element; the first network element receives the first response message from the third network element; the first network element sends a message to the second network element based on the first response message to indicate that the registration failed.

[0083] In combination with the seventh aspect, in some possible implementation methods, the method includes: when the first condition is met, the first network element sends a first request message to the third network element based on the first uniform resource identifier, the first request message is used to request re-authentication of the terminal device, wherein the first condition includes that the first uniform resource identifier is different from the uniform resource identifier stored in the first network element, and the first request message includes the first uniform resource identifier; the third network element receives the first request message from the first network element; when the first uniform resource identifier is the same as the second uniform resource identifier, the third network element sends a second response message to the first network element, the second response message is used to indicate that the re-authentication is successful, and the second uniform resource identifier is the uniform resource identifier in the registration request message sent by the third network element to the first network element; the first network element receives the second response message from the third network element; the first network element stores the first uniform resource identifier and sends a message to the second network element to indicate that the registration is successful.

[0084] In combination with the seventh aspect, in some possible implementation methods, the first uniform resource identifier includes address information of the third network element, and the first network element sends a first request message to the third network element based on the first uniform resource identifier, including: the first network element sends a first request message to the third network element based on the address information.

[0085] In conjunction with the seventh aspect, in some possible implementations, the address information includes a full domain name or an Internet Protocol address.

[0086] In combination with the seventh aspect, in some possible implementations, the registration request message also includes identification information of the public land network where the second network element is located, and the first condition also includes: the public land network where the second network element is located is different from the public land network where the terminal device is located.

[0087] The seventh aspect can also be referred to later Figure 4 Detailed description in the method shown.

[0088] In an eighth aspect, a communication method is provided, including: a second network element sends a registration request message to a first network element, the registration request message being used to request that the second network element be registered to the first network element as a service network element of a terminal device, the registration request message including a uniform resource identifier; the first network element receives the registration request message from the second network element; when the second address information of the second network element is different from the first address information included in the uniform resource identifier, the first network element sends a message to the second network element indicating a registration failure; the second network element receives a message from the first network element indicating a registration failure.

[0089] In combination with the eighth aspect, in some possible implementations, the registration request message also includes identification information of the second network element, and the method also includes: the first network element obtains the second address information based on the identification information of the second network element.

[0090] In combination with the eighth aspect, in some possible implementations, the method further includes: the first network element obtains a certificate of the second network element, where the certificate includes second address information.

[0091] In combination with the eighth aspect, in some possible implementation methods, the method also includes: the first network element obtains the certificate of the second network element, the certificate includes the second full-address domain name, the first address information includes the first Internet Protocol address, and the second address information is the second Internet Protocol address. The method also includes: the first network element obtains the second Internet Protocol address based on the second full-address domain name.

[0092] The eighth aspect can also be referred to later Figure 5 Detailed description in the method shown.

[0093] According to a ninth aspect, a communication device is provided, comprising: a transceiver module and a processing module. The transceiver module is configured to receive a registration request message from a second network element, the registration request message being configured to request that the second network element be registered with the communication device as a serving network element of a terminal device, the registration request message including identification information of a second public land network in which the second network element resides; and the processing module is configured to send, via the transceiver module, a message indicating a registration failure to the second network element when the public land network in which the terminal device resides (referred to as the first public land network) is different from the second public land network.

[0094] The transceiver module can perform the reception and transmission processing in the aforementioned first aspect, and the processing module can perform other processing except reception and transmission in the aforementioned first aspect.

[0095] In a tenth aspect, a communication device is provided, comprising: a transceiver module and a processing module. The transceiver module is configured to receive a registration request message from a second network element, the registration request message being used to request that the second network element be registered with the communication device as a service network element of a terminal device, the registration request message including a first uniform resource identifier; and the processing module is configured to, when the first uniform resource identifier is identical to a uniform resource identifier stored in the communication device, send, via the transceiver module, a message to the second network element indicating that registration of the second network element with the communication device has failed, the first uniform resource identifier being used to send a message requesting reauthentication of the terminal device.

[0096] The transceiver module can perform the receiving and sending processing in the aforementioned second aspect, and the processing module can perform other processing except receiving and sending in the aforementioned second aspect.

[0097] In an eleventh aspect, a communication device is provided, comprising: a transceiver module and a processing module. The transceiver module is configured to send a registration request message to a first network element, the registration request message being used to request a serving network element serving as a terminal device to register with the first network element, the registration request message including a first uniform resource identifier; the transceiver module is further configured to receive a message from the first network element requesting reauthentication, the message including a second uniform resource identifier; and the processing module is configured to send a message to the first network element via the transceiver module indicating a reauthentication failure if the first uniform resource identifier and the second uniform resource identifier are different.

[0098] The transceiver module can perform the reception and transmission processing in the aforementioned third aspect, and the processing module can perform other processing except reception and transmission in the aforementioned third aspect.

[0099] In a twelfth aspect, a communication device is provided, comprising: a transceiver module and a processing module. The transceiver module is configured to receive a registration request message from a second network element, the registration request message being used to request the second network element to register with the communication device as a service network element of a terminal device, the registration request message including a uniform resource identifier (URI); and the processing module is configured to send a message indicating a registration failure to the second network element via the transceiver module if second address information of the second network element is different from first address information included in the URI.

[0100] The transceiver module can perform the receiving and sending processing in the aforementioned fourth aspect, and the processing module can perform other processing except receiving and sending in the aforementioned fourth aspect.

[0101] In a thirteenth aspect, a communication device is provided, comprising: a transceiver module and a processing module. The transceiver module is configured to receive a registration request message from a second network element, the registration request message being used to request that the second network element be registered with the communication device as a serving network element of a terminal device; and the processing module is configured to send a message indicating a registration failure to the second network element via the transceiver module based on whether the second network element supports reauthentication and whether the registration request message includes a uniform resource identifier, the uniform resource identifier being used to send a message requesting reauthentication of the terminal device.

[0102] The transceiver module can perform the receiving and sending processing in the fifth aspect. The processing module can perform other processing except receiving and sending in the fifth aspect.

[0103] In a fourteenth aspect, a communication system is provided, which includes the above-mentioned first network element and second network element.

[0104] Optionally, the communication system also includes the above-mentioned third network element.

[0105] In the fifteenth aspect, a communication device is provided, which includes: a transceiver module and a processing module, the transceiver module is used to execute the steps of sending and receiving information in the methods provided by the above aspects, and the processing module is used to execute the steps of processing in the methods provided by the above aspects.

[0106] In the sixteenth aspect, a communication device is provided, which includes: a memory for storing programs; a processor for executing the programs stored in the memory, and when the programs stored in the memory are executed, the processor is used to execute the methods provided in the above aspects.

[0107] In the seventeenth aspect, the present application provides a processor for executing the methods provided in the above aspects. In the process of executing these methods, the process of sending the above information and obtaining / receiving the above information in the above methods can be understood as the process of the processor outputting the above information, and the process of the processor receiving the input above information. When outputting the above information, the processor outputs the above information to the transceiver so that the transceiver can transmit it. After being output by the processor, the above information may also need to undergo other processing before reaching the transceiver. Similarly, when the processor receives the input above information, the transceiver obtains / receives the above information and inputs it into the processor. Furthermore, after the transceiver receives the above information, the above information may need to undergo other processing before being input into the processor.

[0108] Based on the above principles, for example, the receiving request message mentioned in the above method can be understood as the processor receiving input information.

[0109] For the operations such as transmission, sending and acquisition / reception involved in the processor, unless otherwise specified, or if they do not conflict with their actual functions or internal logic in the relevant descriptions, they can be more generally understood as processor output, reception, input and other operations, rather than the transmission, sending and receiving operations directly performed by the RF circuit and antenna.

[0110] During implementation, the processor may be a processor specifically configured to execute these methods, or may be a processor that executes computer instructions in a memory to execute these methods, such as a general-purpose processor. The memory may be a non-transitory memory, such as a read-only memory (ROM), which may be integrated with the processor on the same chip or disposed on separate chips. The embodiments of the present application do not limit the type of memory or the configuration of the memory and the processor.

[0111] In an eighteenth aspect, a computer-readable storage medium is provided, which stores a program code for execution by a device, and the program code includes a method for executing the methods provided in the above aspects.

[0112] In the nineteenth aspect, a computer program product comprising instructions is provided, which, when run on a computer, enables the computer to execute the methods provided in the above aspects.

[0113] In the twentieth aspect, a chip is provided, which includes a processor and a communication interface. The processor reads instructions stored in a memory through the communication interface to execute the methods provided in the above aspects.

[0114] Optionally, as an implementation method, the chip may further include a memory storing instructions, and the processor is used to execute the instructions stored in the memory. When the instructions are executed, the processor is used to execute the methods provided in the above aspects. BRIEF DESCRIPTION OF THE DRAWINGS

[0115] Figure 1 It is a schematic diagram of the network architecture 100 provided in this application.

[0116] Figure 2 The present invention is a schematic flowchart of an authentication and key negotiation method.

[0117] Figure 3 This is a schematic flowchart of a communication method provided in an embodiment of the present application.

[0118] Figure 4 This is a schematic flowchart of another communication method provided in an embodiment of the present application.

[0119] Figure 5 This is a schematic flowchart of another communication method provided in an embodiment of the present application.

[0120] Figure 6 This is a schematic flowchart of another communication method provided in an embodiment of the present application.

[0121] Figure 7 This is a schematic flowchart of another communication method provided in an embodiment of the present application.

[0122] Figure 8 This is a schematic flowchart of another communication method provided in an embodiment of the present application.

[0123] Figure 9 It is a schematic block diagram of a communication device 10 provided in an embodiment of the present application.

[0124] Figure 10 FIG. 2 is a schematic diagram of another communication device 20 provided in an embodiment of the present application.

[0125] Figure 11 FIG. 3 is a schematic diagram of a chip system 30 provided in an embodiment of the present application. DETAILED DESCRIPTION

[0126] The technical solution in this application will be described below with reference to the accompanying drawings.

[0127] The technical solution provided in this application can be applied to various communication systems, such as: new radio (NR) system, long term evolution (LTE) system, LTE frequency division duplex (FDD) system, LTE time division duplex (TDD) system, etc.

[0128] A public land mobile network (PLMN) is a network established and operated by the government or an operator approved by it for the purpose of providing land mobile communication services to the public. It is mainly a public network in which mobile network operators (MNOs) provide mobile broadband access services to users. PLMN can also be referred to as an operator network. The PLMN described in the embodiments of the present application may specifically be a network that complies with the standards of the 3rd Generation Partnership Project (3GPP), referred to as a 3GPP network. 3GPP networks generally include but are not limited to fifth-generation mobile communication networks, referred to as 5G networks, fourth-generation mobile communication networks, referred to as 4G networks, and other future communication systems, such as sixth-generation mobile communication networks, referred to as 6G networks.

[0129] For the convenience of description, the embodiments of the present application will be described using the PLMN as a 5G network as an example.

[0130] Figure 1 This is a schematic diagram of the network architecture provided by this application, taking the 5G network architecture based on the service-based architecture (SBA) in the non-roaming scenario defined in the 3GPP standardization process as an example. As shown in the figure, the network architecture can include three parts, namely the terminal equipment part, the data network (DN) and the operator network (i.e., PLMN) part. The functions of the network elements of each part are briefly described below. The operator network part may include but is not limited to the (radio) access network ((R)AN) 120 and the core network (CN) part.

[0131] The terminal device portion may include a terminal device 110, which may also be referred to as user equipment (UE). The terminal device 110 in this application is a device with wireless transceiver capabilities that can communicate with one or more core network (CN) network elements via access network equipment (or access equipment) in the (R)AN. The terminal device 110 may also be referred to as an access terminal, terminal, subscriber unit, subscriber station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, user agent, or user device. The terminal device 110 may be deployed on land, including indoors or outdoors, handheld or vehicle-mounted; may also be deployed on water (e.g., on a ship); or may be deployed in the air (e.g., on an airplane, balloon, or satellite). The terminal device 110 may be a cellular phone, a cordless phone, a Session Initiation Protocol (SIP) phone, a smart phone, a mobile phone, a wireless local loop (WLL) station, a personal digital assistant (PDA), or the like. Alternatively, the terminal device 110 may be a handheld device with wireless communication capabilities, a computing device, or other device connected to a wireless modem, an in-vehicle device, a wearable device, an unmanned aerial vehicle device, or a terminal in the Internet of Things, the Internet of Vehicles, a terminal of any form in a 5G network and future networks, a relay user device, or a terminal in a future evolved 6G network, etc. The relay user device may be, for example, a 5G residential gateway (RG). For example, the terminal device 110 may be a virtual reality (VR) terminal, an augmented reality (AR) terminal, a wireless terminal in industrial control, a wireless terminal in self-driving, a wireless terminal in remote medical care, a wireless terminal in a smart grid, a wireless terminal in transportation safety, a wireless terminal in a smart city, a wireless terminal in a smart home, etc. The terminal device here refers to a 3GPP terminal. The embodiments of the present application do not limit the type or category of the terminal device. For ease of explanation, the present application will be described below using UE as an example to refer to a terminal device.

[0132] (R)AN 120 can be considered a subnetwork of the operator network, serving as the implementation system between service nodes in the operator network and terminal device 110. To access the operator network, terminal device 110 first passes through (R)AN 120, which then connects to service nodes in the operator network. The access network device (RAN device) in the embodiment of the present application is a device that provides wireless communication functions for the terminal device 110, and may also be referred to as a network device. The RAN device includes but is not limited to: the next generation node base station (gNB) in the 5G system, the evolved node B (eNB) in the long term evolution (LTE), the radio network controller (RNC), the node B (NB), the base station controller (BSC), the base transceiver station (BTS), the home base station (for example, home evolved node B, or home node B, HNB), the base band unit (BBU), the transmission and receiving point (TRP), the transmitting point (TP), the small base station device (pico), the mobile switching center, or the network device in the future network. In systems using different wireless access technologies, the names of devices with access network device functions may be different. For ease of description, in all embodiments of the present application, the apparatus providing wireless communication functions for the terminal device 110 is collectively referred to as an access network device or RAN or AN for short. It should be understood that the specific type of access network device is not limited herein.

[0133] The CN part may include but is not limited to the following network functions (NF): user plane function (UPF) network element 130, network exposure function (NEF) network element 131, network function repository function (NRF) network element 132, policy control function (PCF) network element 133, unified data management (UDM) network element 134, unified data repository (UDR) network element 135, network data analytics function (NWDAF) network element 136, authentication server function (AUSF) network element 137, access and mobility management function (AMF) network element 138, and session management function (SMF) network element 139.

[0134] Among them, the network function in this application can also be called a network element.

[0135] Data network DN 140, also known as a packet data network (PDN), is typically located outside of a carrier's network, such as a third-party network. Of course, in some implementations, the DN may also be deployed by the carrier, meaning that the DN is part of a PLMN. This application does not restrict whether the DN is part of a PLMN. A PLMN can access multiple data network DNs 140, and various services can be deployed on the data network DN 140, providing data and / or voice services to the terminal device 110. For example, data network DN 140 may be the private network of a smart factory, where sensors installed in the workshop may be terminal devices 110. A control server for the sensors is deployed within data network DN 140, and the control server can provide services to the sensors. The sensors can communicate with the control server, obtain instructions from the control server, and transmit collected sensor data to the control server according to the instructions. For another example, data network DN 140 may be a company's internal office network, where the company's employees' mobile phones or computers may be terminal devices 110, allowing the employees' mobile phones or computers to access information and data resources on the company's internal office network. Terminal device 110 can establish a connection with the operator network through an interface provided by the operator network (e.g., N1) and use data and / or voice services provided by the operator network. Terminal device 110 can also access data network DN 140 through the operator network and use operator services deployed on data network DN 140 and / or services provided by third parties.

[0136] The following is a brief description of some of the NF functions included in CN.

[0137] 1. The NRF network element 132 is a control plane function provided by the operator and is used to maintain real-time information about network functions and services in the network. For example, it supports network service discovery, maintains the NF profile of an NF instance and the services it supports, supports discovery of service communication proxies (SCPs), maintains the SCP profile of an SCP instance, sends notifications about newly registered, deregistered, and updated NFs and SCPs, and maintains the health status of NFs and SCPs.

[0138] 2. The UDM network element 134 is a control plane function provided by the operator and is responsible for storing information such as the subscriber permanent identifier (SUPI), the general public subscription identifier (GPSI), and credentials of subscribers in the operator network. The SUPI is first encrypted during transmission, and the encrypted SUPI is called the subscription concealed identifier (SUCI). This information stored by the UDM network element 134 can be used to authenticate and authorize the terminal device 110 to access the operator network. The subscribers of the above-mentioned operator network can specifically be users who use services provided by the operator network, such as users who use China Telecom's subscriber identity module (SIM) card or users who use China Mobile's SIM card. The credentials of the above-mentioned subscribers can be a small file storing long-term keys stored in the SIM card or information related to SIM card encryption, which is used for authentication and / or authorization. It should be noted that the subscriber permanent identifier, credentials, security context, authentication data (cookie), and token are equivalent to information related to verification / authentication and authorization. For the sake of convenience in description in this embodiment of the application, no distinction or limitation is made.

[0139] 3. The AUSF network element 137 is a control plane function provided by the operator and is typically used for level 1 authentication, i.e., authentication between the terminal device 110 (subscriber) and the operator's network. After receiving the authentication request, the AUSF network element 137 can authenticate and / or authorize the terminal device 110 using the authentication information and / or authorization information stored in the UDM network element 134, or generate authentication and / or authorization information for the terminal device 110 through the UDM network element 134. The AUSF network element 137 can also provide feedback of the authentication and / or authorization information to the terminal device 110.

[0140] 4. The AMF network element 138 is a control plane network function provided by the operator network. It is responsible for access control and mobility management for the terminal device 110 to the operator network. For example, it includes functions such as mobility state management, allocating temporary user identities, and authenticating and authorizing users. The AMF network element 138 is used to establish a non-access stratum (NAS) connection with the terminal device 110 and has the same 5G NAS security context as the terminal device 110.

[0141] in, Figure 1The CN also includes: UPF network element 130, PCF network element 133, UDR network element 135, SMF network element 139, etc. For the specific functions of the above network elements, please refer to the detailed introduction in the 5G communication system.

[0142] The functions of the above network elements or devices can be completed by an independent network element or by several network elements. In actual deployment, the network elements in the core network can be deployed on the same or different physical devices. For example, as a possible deployment, AMF and SMF can be deployed on the same physical device. For another example, the network elements of the 5G core network can be deployed on the same physical device as the network elements of the 4G core network. This embodiment of the present application is not limited to this.

[0143] It should be understood that the above naming is defined only to facilitate the distinction between different functions and should not constitute any limitation to this application. This application does not exclude the possibility of adopting other naming in 5G networks and other future networks. For example, in a 6G network, some or all of the above network elements may continue to use the terminology used in 5G, or may adopt other names.

[0144] It should also be understood that the above-mentioned network architecture applied to the embodiment of the present application is only a network architecture described from the perspective of a service-oriented architecture. The network architecture applicable to the embodiment of the present application is not limited to this. Any network architecture that can realize the functions of the above-mentioned network elements is applicable to the embodiment of the present application.

[0145] It should also be understood that Figure 1 The AMF network element, SMF network element, UPF network element, NEF network element, AUSF network element, NRF network element, PCF network element, and UDM network element shown in the figure can be understood as network elements used to implement different functions in the core network, for example, they can be combined into network slices as needed. These core network network elements can be independent devices or integrated into the same device to implement different functions. This application does not limit the specific form of the above network elements.

[0146] Figure 2 This is a diagram of the registration process for a terminal device. Figure 2 As shown, it may specifically include the following steps, and for parts not fully described, reference may be made to existing protocols.

[0147] It should be noted that this method is illustrated by taking the terminal device as UE, the access and mobility management function network element as AMF network element, the unified data management network element as UDM network element, and the authentication service function network element as AUSF network element as an example.

[0148] 201. The UE sends a registration request message #1 to the RAN. Correspondingly, the RAN receives the registration request message #1 from the UE.

[0149] It should be understood that the registration request message #1 is used by the UE to request network access. After the RAN receives the registration request message #1 from the UE, it selects an AMF network element that provides services to the UE based on the registration request message #1.

[0150] Assume that RAN selects Figure 2 The New AMF in the UE provides services for the UE, and the method further includes:

[0151] 202. The RAN sends a registration request message #1 to the New AMF. Correspondingly, the New AMF receives the registration request message #1 sent by the RAN.

[0152] It should be understood that after the RAN receives the registration request message #1 from the UE, it selects the NewAMF to provide services for the UE according to the registration request message #1. The RAN forwards the registration request message #1 from the UE to the NewAMF.

[0153] It should also be understood that a detailed description of how the RAN selects the AMF to provide services for the UE can be found in the description in the existing standards.

[0154] Assume that, before step 202, the Old AMF is providing services for the UE, and the RAN selects the New AMF to provide services for the UE according to the Registration Request message #1 received in step 201. The method may further include:

[0155] 203. The New AMF sends a UE Context Request message to the Old AMF. Correspondingly, the Old AMF receives the UE Context Request message from the New AMF.

[0156] 204. The Old AMF sends a UE Context Response message to the New AMF. Correspondingly, the New AMF receives the UE Context Response message from the Old AMF.

[0157] It should be understood that the Old AMF sends a UE context response message to the New AMF according to the UE context request message of the New AMF, and the UE context response information includes the UE context message.

[0158] It should also be understood that the New AMF may not need to request UE context information from the Old AMF, that is, the above steps 203 and 204 are optional steps.

[0159] It should also be understood that the UE registration process may also include a main authentication process between the UE and the network. The main authentication process is mainly used for two-way authentication between the UE and the network to ensure the security of subsequent communications. Figure 2 As shown, steps 205 to 208 are the main authentication process between the UE and the network.

[0160] 205. The UE performs primary authentication with the network.

[0161] It should be understood that the main authentication between the UE and the network can be extensible authentication protocol (EAP) authentication or 5G authentication and key agreement (5G-AKA) authentication. The specific main authentication process is similar to the existing standard, and please refer to the description in the existing standard.

[0162] 206. AUSF sends a request message #1 to UDM. Correspondingly, UDM receives the request message #1 from UDM.

[0163] It should be understood that after the UE authenticates with the network master in step 205, the AUSF sends a request message #1 to the UDM. The request message #1 may include one or more of the following parameters: the UE's SUPI, a timestamp indicating successful authentication between the UE and the network, the master authentication type (e.g., EAP authentication, 5G-AKA authentication), and the identification information of the PLMN where the UE is located (e.g., PLMN ID).

[0164] 207. UDM stores the content in request message #1 locally.

[0165] It should be understood that after the UDM receives the request message #1 from the AUSF, it stores the parameters included in the request message #1 locally in the UDM.

[0166] It should also be understood that the UDM stores the parameters in the request message #1 locally in the UDM to facilitate control of subsequent communication processes.

[0167] 208. UDM sends a response message #1 to AUSF. Accordingly, AUSF receives the response message #1 from UDM.

[0168] It should be understood that the UDM sends a response message #1 to the AUSF based on the received request message #1. The response message #1 is used to respond to the AUSF request message #1.

[0169] It should also be understood that the above steps 206 to 208 are performed after the UE and the network are authenticated in step 205. The AUSF sends the relevant information of the primary authentication to the UDM, and the UDM stores the relevant information of the UE primary authentication locally to facilitate subsequent control of the communication process.

[0170] 209. The New AMF sends a registration request message #2 to the UDM. Correspondingly, the UDM receives the registration request message #2 from the New AMF.

[0171] It should be understood that the New AMF sends Registration Request Message #2 to the UDM. Registration Request Message #2 is used to notify the UDM that the New AMF provides services for the UE and that the New AMF can process the context information of the UE session. Registration Request Message #2 is used to request the New AMF to register with the UDM as a network element providing services for the UE.

[0172] In one possible implementation, the registration request message #2 includes Amf3GppAccessRegistration type parameters, such as reauthNotifyCallbackUri, SUPI, etc. For example, the registration request message #2 may be a Nudm_UECM_Registration request.

[0173] 210. The UDM sends a registration response message #2 to the New AMF. Correspondingly, the New AMF receives the registration response message #2 from the UDM.

[0174] It should be understood that the UDM can determine whether to accept the registration of the New AMF based on the parameters in the request message #1 stored in step 207, and send the registration result to the New AMF through the registration response message #2.

[0175] As an example, it is assumed that the UDM accepts the registration request of the New AMF, that is, the UDM accepts the registration of the New AMF to the UDM, that is, the registration response message #2 sent by the UDM to the New AMF includes information indicating that the registration is successful.

[0176] As another example, assume that the UDM does not accept the registration request of the New AMF, that is, the UDM does not accept the New AMF to register with the UDM, that is, the registration response message #2 sent by the UDM to the New AMF includes information indicating the registration failure, or the UDM does not send the registration response message #2 to the New AMF.

[0177] It should be understood that the above steps 209 and 210 describe that the New AMF sends a registration request to the UDM, requesting the NewAMF to register with the UDM as a network element providing services for the UE, to facilitate subsequent UE context management. The UDM can perform a deregistration operation on the Old AMF, for example, when the New AMF successfully registers with the UDM. After deregistration, the Old AMF no longer provides network services to the UE.

[0178] Based on the above Figure 2The method shown in the figure takes into account the complexity of the network environment. There may be malicious AMFs in the network that falsely claim to provide services to the terminal device and send a registration request message to the UDM. For example, in the above Figure 2 After steps 209 and 210 in the above example, the malicious AMF executes Figure 2 In step 211. In step 211, the malicious AMF sends a registration request message #3 to the UDM. Accordingly, the UDM receives the registration request message #3 from the malicious AMF. The registration request message #3 is used to request that the malicious AMF be registered with the UDM as a network element providing services for the terminal device. Next, the UDM sends a registration response message #3 to the malicious AMF. Accordingly, the malicious AMF receives the registration response message #3 from the UDM, as shown in step 212. When the registration response message #3 includes information indicating a successful registration, that is, the malicious AMF successfully registers with the UDM, the UDM may deregister the New AMF. The New AMF no longer provides network services to the UE. Since the malicious AMF cannot provide normal network services to the UE, the UE will not be able to access the network normally. In addition, the malicious AMF can obtain the sensitive data of the UE through data transmission between it and the UDM, causing problems such as leakage of user sensitive data.

[0179] Currently, the existing technology has proposed the following two solutions to the problem that the malicious AMF registers with the UDM, causing the UE to be unable to access the network normally and leaking the UE's sensitive data:

[0180] Method 1: UDM verifies the AMF that requests to register with UDM through the time difference information to determine whether to accept the successful registration of the AMF with UDM.

[0181] The time difference information indicates the time difference between the time when the UE successfully authenticates the network master and the time when the UDM receives the registration request message sent by the AMF.

[0182] For example, combining the above Figure 2 , UDM determines whether to approve NewAMF to register with UDM based on the time difference between the timestamp of the successful authentication between UE and network master in request message #1 stored in step 207 and the time when UDM receives registration request message #2 in step 209.

[0183] For example, when the time difference is less than or equal to the preconfigured time threshold, the UDM accepts the registration of the AMF, that is, the UDM sends a message to the AMF to indicate a successful registration; when the time difference is greater than the preconfigured time threshold, the UDM rejects the registration request of the AMF, that is, the UDM sends a message to the AMF to indicate a registration failure, or the UDM does not send a message to the AMF to indicate the registration result.

[0184] Based on method 1, this method mainly considers that the malicious AMF is unaware of the time when the UE primary authentication is successful. That is, the malicious AMF can request to register with the UDM at any time. The UDM compares the time difference information with the pre-configured time threshold to determine whether to accept the AMF's registration, thereby preventing the malicious AMF from successfully registering with the UDM.

[0185] However, in certain scenarios, a malicious AMF may be able to monitor network signaling. Specifically, after the malicious AMF determines that the UE primary authentication is complete based on the obtained network signaling, it can immediately send a registration request message to the UDM. This ensures that the time difference corresponding to the malicious AMF is less than or equal to the pre-configured time threshold, resulting in the malicious AMF successfully registering with the UDM. Therefore, the above method 1 cannot effectively prevent the malicious AMF from successfully registering with the UDM.

[0186] Method 2: UDM verifies the AMF that sends the registration request message to UDM through the re-authentication process to determine whether to accept the successful registration of the AMF with UDM.

[0187] Among them, the re-authentication refers to the UE of the AMF service re-authenticating with the network. The specific introduction of the main authentication can be found in the above Figure 2 Step 205 is shown and described in detail in the existing protocol.

[0188] As an example, combining the above Figure 2 In step 209, the AMF sends a registration request message #2 to the UDM. The registration request message #2 includes reauthNotifyCallbackUri, which is used for implicit registration for re-authentication. The UDM determines the AMF that needs to be re-authenticated based on the reauthNotifyCallbackUri, and triggers the AMF to re-authenticate. After receiving the re-authentication message from the UDM, the normal AMF performs the normal re-authentication process. Since the malicious AMF does not serve the real UE, that is, after the malicious AMF receives the re-authentication message from the UDM, the malicious AMF cannot perform the normal re-authentication process, that is, the malicious AMF re-authentication fails. The UDM rejects the registration request of the AMF that fails the re-authentication.

[0189] Based on Method 2, this method considers that the malicious AMF does not provide services to the real UE, that is, the malicious AMF cannot perform re-authentication. The UDM triggers the re-authentication process of the AMF that sent the registration request message to verify whether the AMF is a malicious AMF and further determine whether to accept the AMF's registration request.

[0190] However, in certain scenarios, the reauthNotifyCallbackUri included in the registration request message sent by the malicious AMF to the UDM may be a parameter corresponding to the real AMF. This means that the UDM determines that the AMF is the real AMF based on the reauthNotifyCallbackUri, and the UDM triggers reauthentication with the real AMF based on the reauthNotifyCallbackUri. The reauthentication process for the malicious AMF is completed by the real AMF, and the UDM is unaware of the anomaly, causing the malicious AMF to bypass the reauthentication check and successfully register with the UDM. Therefore, the second method described above cannot effectively prevent the malicious AMF from successfully registering with the UDM.

[0191] In view of the problems existing in the above-mentioned methods 1 and 2, this application provides a communication method that can prevent malicious AMFs from registering with UDMs and ensure network security.

[0192] Next, the communication method provided by the embodiment of the present application will be described in detail with reference to the accompanying drawings. Figure 1 In the communication system shown.

[0193] Figure 3 This is a flow chart of a communication method provided by an embodiment of the present application. This method can be applied to Figure 1 The network architecture shown, for example, the first network element can be the above Figure 1 The UDM network element shown, or a network element with UDM function, the second network element can be the above Figure 1 The AMF network element shown, or the network element with the above-mentioned AMF function, is not limited in this application.

[0194] like Figure 3 As shown, the method may include the following steps. For parts that are not fully described, please refer to the existing protocol.

[0195] 301. The second network element sends a registration request message to the first network element. Correspondingly, the first network element receives the registration request message from the second network element.

[0196] The registration request message is used to request that the second network element be registered with the first network element as a serving network element of the terminal device. The registration request message includes identification information of a second PLMN where the second network element is located.

[0197] In a possible implementation manner, a hypertext transfer protocol header (HTTP Header) of the registration request message includes identification information of the second PLMN, and / or a token of the registration request message includes identification information of the second PLMN.

[0198] For example, the 3gpp-Sbi-Originating-Network-Id in the HTTP Header in the registration request message is identification information of the second PLMN.

[0199] It should be understood that the token of the registration request message and the content carried in the HTTP Header cannot be tampered with during the communication transmission process, which can prevent malicious network elements from forging the identification information of their own PLMN, making it easier for the first network element to identify malicious network elements, reject the registration requests of malicious network elements, and improve network security.

[0200] In the case where the first PLMN and the second PLMN where the terminal device is located are different, such as Figure 3 The illustrated method further includes:

[0201] 302-1. The first network element sends a message indicating a registration failure to the second network element.

[0202] In the case where the first PLMN and the second PLMN where the terminal device is located are the same, such as Figure 3 The illustrated method further includes:

[0203] 302-2. The first network element sends a message indicating successful registration to the second network element.

[0204] The first network element sending a message to the second network element for indicating a registration failure can be understood as: the first network element sending a message to the second network element for indicating that the second network element has failed to register with the first network element.

[0205] Optionally, if the first PLMN and the second PLMN where the terminal device is located are different, the first network element may not send a message indicating the registration result to the second network element; or may not send a response message to the registration request message in step 301 to the second network element. That is, step 302-1 is an optional step.

[0206] The first network element sending a message to the second network element for indicating successful registration can be understood as: the first network element sending a message to the second network element for indicating that the second network element has successfully registered with the first network element.

[0207] Optionally, before step 301, Figure 3 The method shown also includes: the first network element obtains identification information of the first PLMN.

[0208] For example, the AUSF network element sends the identification information of the first PLMN to the first network element, and accordingly, the first network element receives the identification information of the first PLMN from the AUSF network element. The first network element can store the identification information of the first PLMN locally, such as the first network element storing the correspondence between the identification information of the first PLMN and the identification information of the terminal device.

[0209] Taking the first network element as the UDM network element as an example, in the process related to the terminal device and the network master authentication, the AUSF network element sends the relevant information of the terminal device and the network master authentication to the UDM network element, and the UDM network element stores the relevant information of the master authentication locally. Among them, the relevant information of the master authentication includes the identification information of the first PLMN. For details, please refer to the above Figure 2 An introduction to step 206 is shown.

[0210] The identification information of the PLMN in the embodiment of the present application may be a PLMN identity (identity or identifier, ID).

[0211] In one possible implementation, the registration request message includes identification information of the terminal device. After receiving the registration request message, the first network element can locally obtain identification information of the PLMN corresponding to the terminal device, i.e., identification information of the first PLMN, based on the identification information of the terminal device. For example, based on the correspondence between the identification information of the first PLMN and the identification information of the terminal device, the first network element determines that the identification information of the PLMN corresponding to the identification information of the terminal device is the identification information of the first PLMN. The first network element determines whether to accept the registration request from the second network element based on whether the PLMN indicated by the identification information of the first PLMN is the same as the PLMN indicated by the identification information of the second PLMN.

[0212] Considering that the PLMN where the malicious network element is located is different from the PLMN where the terminal device is located, based on the above Figure 3 In the method shown, the first network element obtains the identification information of the second PLMN where the second network element is located from the registration request message, and then identifies malicious network elements based on the fact that the second PLMN is different from the PLMN where the terminal device is located, and refuses malicious network elements to register with the first network element, which helps to improve network security.

[0213] Figure 4 This is a flow chart of another communication method provided by the embodiment of the present application. This method can be applied to Figure 1 The network architecture shown, for example, the first network element can be the above Figure 1 The UDM shown, or a network element with UDM function, the second network element can be the above Figure 1The AMF shown, or the network element having the above-mentioned AMF function, is not limited in this application. Next, examples 1 to 4 will be used to introduce the above-mentioned AMF. For parts that are not fully described, please refer to the existing protocol.

[0214] Example 1

[0215] Step 1-1: The second network element sends a registration request message to the first network element. Correspondingly, the first network element receives the registration request message from the second network element.

[0216] The registration request message is used to request that the second network element be registered to the first network element as a service network element of the terminal device, and the registration request message includes a first uniform resource identifier.

[0217] The first uniform resource identifier is used to send a message requesting re-authentication of the terminal device, or the address information in the first uniform resource identifier is used to send a message requesting re-authentication of the terminal device. The address information may include a full qualified domain name (FQDN) or an Internet Protocol (IP) address. The full domain name may also be called a fully qualified domain name.

[0218] The uniform resource identifier in the embodiments of the present application may also be referred to as a uniform resource identifier. The uniform resource identifier may be a reauthNotifyCallbackUri parameter, which includes the address information of the network element. The first network element may send a reauthentication request to the network element based on the address information in the uniform resource identifier, requesting the network element to trigger reauthentication of the terminal device. The uniform resource identifier may also be represented as reauthNotifyCallbackUri, reauthCallbackUri, CallbackUri, or Callback URI, etc., which is not limited in this application.

[0219] The format of the URI is "scheme":"" / / "host[":"port][prefix]" / " <callbackuripart>", where "scheme" represents "http" or "https", "host" represents the FQDN or IP address, and "callbackUriPart" is a random number. The "callbackUriPart" changes with each registration, that is, the registration request messages sent by the same network element at different times include different uniform resource identifiers.

[0220] In step 1-2, the first network element sends a message indicating a registration failure to the second network element. Correspondingly, the second network element receives the message indicating a registration failure from the first network element.

[0221] Exemplarily, when the first uniform resource identifier is identical to a uniform resource identifier stored in the first network element, the first network element sends a message indicating a registration failure to the second network element.

[0222] Among them, the uniform resource identifier stored in the first network element can be the uniform resource identifier of the network element that successfully registered with the first network element before step 1-1. For example, the first network element receives a registration request message from a certain network element (for example, network element #1, network element #1 and the second network element are not the same network element), and the registration request message requests that network element #1 be registered with the first network element as a network element providing services for the terminal device, and the registration request message includes the uniform resource identifier of network element #1 (recorded as uniform resource identifier #1). When the first network element accepts the registration of network element #1 with the first network element, the uniform resource identifier #1 is stored locally. For example, in combination with the above Figure 2 As shown, the NEW AMF network element sends a registration request message #2 to the UDM network element in step 209. The UDM network element accepts the NEW AMF network element as a network element providing services to the terminal device and registers it with the UDM network element. The UDM network element stores the uniform resource identifier in the registration request message #2 locally in the first network element.

[0223] Among them, the uniform resource identifier compared with the first uniform resource identifier can be a uniform resource identifier stored by the first network element within a certain time period (for example, the first time period), or a certain number (for example, the first number) of uniform resource identifiers stored by the first network element, such as the first number of uniform resource identifiers most recently stored by the first network element, or all uniform resource identifiers stored by the first network element.

[0224] It should be understood that the first time period and the first number may be predefined or preconfigured by the system, and this application does not limit this. Which stored uniform resource identifiers the first network element compares with the first uniform resource identifier may be determined by the first network element itself, or may be predefined or preconfigured by a protocol or system, and this application does not limit this.

[0225] Generally, the Uniform Resource Identifier (URI) in each registration request message sent by the network element that actually provides services to the terminal device (hereinafter referred to as the URI for convenience) is different. That is, the URI in the registration request message of the URI is different from the URI stored by the first network element. A malicious network element may obtain the URI of the URI and carry it in a registration request message, requesting to register with the first network element. Based on the fact that the URI in the registration request message is the same as the stored URI, the first network element can identify the second network element as a malicious network element and send a message to the second network element indicating a registration failure, thereby preventing the malicious network element from registering with the first network element and helping to improve network security.

[0226] In another exemplary embodiment, when the address information in the first uniform resource identifier is incorrect, or the network element indicated by the address information in the first uniform resource identifier does not exist, the first network element sends a message indicating a registration failure to the second network element.

[0227] Optionally, when the address information in the first uniform resource identifier is incorrect, or the network element indicated by the address information in the first uniform resource identifier does not exist, the first network element can directly send a message indicating a registration failure to the second network element without determining whether the first uniform resource identifier is the same as the uniform resource identifier stored in the first network element itself.

[0228] Optionally, when the first uniform resource identifier is different from the uniform resource identifier stored in the first network element, the first network element further determines whether the format of the first uniform resource identifier is correct and / or whether the address information is accurate. When the format of the first uniform resource identifier is incorrect or the address information is incorrect, the first network element sends a message to the second network element to indicate a registration failure.

[0229] Optionally, when the first uniform resource identifier is different from the uniform resource identifier stored in the first network element, the first network element further determines the network element indicated by the address information in the first uniform resource identifier. When the network element indicated by the address information does not exist, the first network element sends a message to the second network element to indicate a registration failure.

[0230] The uniform resource identifier to be compared with the first uniform resource identifier may be described above and will not be described in detail here.

[0231] Based on the method of this example, the first network element checks the format, address information, and network element indicated by the address information of the uniform resource identifier, which can prevent malicious network elements from using fabricated uniform resource identifiers that do not meet the requirements to request registration from the first network element, thereby helping to improve network security.

[0232] It should be understood that in the embodiments of the present application, if a first network element refuses to allow a second network element to register with the first network element as a network element providing services for a terminal device, the first network element may not send a message to the second network element in response to the registration request message; or the first network element may not send a message to the second network element indicating the registration result; or the first network element may send a message to the second network element in response to the registration request message, where the message indicates a registration failure. The embodiments of the present application use the example of the first network element sending a message to the second network element indicating a registration failure as an example for illustrative description. Of course, the first network element sending a message to the second network element indicating a registration failure is an optional step.

[0233] Example 2

[0234] In step 2-1, the second network element sends a registration request message to the first network element. Correspondingly, the first network element receives the registration request message from the second network element.

[0235] The registration request message is used to request that the second network element be registered to the first network element as a service network element of the terminal device, and the registration request message includes a first uniform resource identifier.

[0236] Step 2-1 is similar to step 1-1 above. For details, please refer to the detailed description in step 1-1 above.

[0237] When a first condition is met, the first network element sends a first request message based on a first uniform resource identifier (URI). The first request message is used to request re-authentication of the terminal device, and the first request message includes the first URI. The first condition includes: the first URI is different from a URI stored by the first network element. For example, after receiving a registration request message, i.e., triggered by the registration request message, the first network element determines whether the first condition is met, and, if the first condition is met, sends the first request message based on the first URI.

[0238] In one possible implementation, the first network element sends a first request message to the second network element according to the first uniform resource identifier. For example, the first uniform resource identifier includes address information of the second network element, that is, the address information indicates the address of the second network element, which is used to send a message to the second network element. The first network element sends the first request message to the second network element according to the address information. In this implementation, Figure 4 The illustrated method further includes:

[0239] In step 2-2, the first network element sends a first request message to the second network element. Correspondingly, the second network element receives the first request message from the first network element.

[0240] When the second network element is the network element that actually provides services to the terminal device, such as Figure 4 The method shown may further include the following steps:

[0241] In step 2-3, the second network element sends a second response message to the first network element according to the first request message. Accordingly, the first network element receives the second response message from the second network element, and the second response message is used to indicate that the re-authentication is successful.

[0242] For example, the second network element receives a first uniform resource identifier included in the first request message, which is the same as the first uniform resource identifier in the registration request message sent by the second network element to the first network element in step 2-1. The second network element triggers re-authentication of the terminal device and sends a second response message to the first network element to indicate the success of the re-authentication if the re-authentication is successful.

[0243] In step 2-4, the first network element sends a message indicating that the registration is successful to the second network element. Correspondingly, the second network element receives the message indicating that the registration is successful from the first network element.

[0244] Exemplarily, after the first network element receives the second response message from the second network element, the first network element accepts the registration request of the second network element based on the second response message, that is, when the second response message indicates that the re-authentication is successful, the first network element sends a message to the second network element to indicate that the registration is successful.

[0245] It should be understood that when the first network element accepts the registration request of the second network element, the first network element may store the first uniform resource identifier locally.

[0246] Example 3

[0247] In step 3-1, the second network element sends a registration request message to the first network element. Correspondingly, the first network element receives the registration request message from the second network element.

[0248] In step 3-2, the first network element sends a first request message to the second network element. Correspondingly, the second network element receives the first request message from the first network element.

[0249] Step 3-1 and step 3-2 are similar to the above steps 2-1 and step 2-2. For details on the specific implementation, please refer to the above introduction.

[0250] When the second network element is a malicious network element, such as Figure 4 The illustrated method further includes:

[0251] In step 3-3, the second network element sends a first response message to the first network element according to the first request message. Correspondingly, the first network element receives the first response message from the second network element. The first response message is used to indicate that the re-authentication has failed.

[0252] For example, a malicious second network element uses its own address information to construct a first uniform resource identifier. Although the constructed first uniform resource identifier is different from the uniform resource identifier stored in the first network element, when the first network element sends a first request message based on the first uniform resource identifier, since the address information in the first uniform resource identifier indicates the address of the second network element, the first request message will be sent to the second network element. However, the second network element is a malicious network element and cannot trigger the re-authentication operation of the terminal device. Therefore, the second network element has to send a first response message to the first network element to indicate the failure of re-authentication.

[0253] In step 3-4, the first network element sends a message indicating a registration failure to the second network element. Correspondingly, the second network element receives the message indicating a registration failure from the first network element.

[0254] Exemplarily, after the first network element receives the first response message from the second network element, the first network element rejects the registration request of the second network element according to the first response message, that is, the first network element sends a message to the second network element indicating registration failure.

[0255] Example 4

[0256] In step 4-1, the second network element sends a registration request message #1 to the first network element. Correspondingly, the first network element receives the registration request message #1 from the second network element. The registration request message #1 includes a first uniform resource identifier.

[0257] It should be understood that step 4-1 is similar to the above step 1-1, and for details, please refer to the introduction of the above step 1-1.

[0258] The first network element sends a first request message based on a first uniform resource identifier when a first condition is satisfied, the first request message being used to request re-authentication of the terminal device, the first request message including the first uniform resource identifier. The first condition includes: the first uniform resource identifier being different from a uniform resource identifier stored by the first network element.

[0259] In another possible implementation, the first network element sends a first request message to a third network element based on a first uniform resource identifier. For example, the first uniform resource identifier includes address information of the third network element, i.e., the address information indicates the address of the third network element, which is used to send a message to the second network element. The first network element sends the first request message to the third network element based on the address information.

[0260] For example, the second network element is a malicious network element, the third network element is a network element that actually provides services to the terminal device, and the second network element and the third network element are of the same type, such as both the second network element and the third network element are access and mobility management network elements. The second network element uses the address information of the third network element to construct a first uniform resource identifier; or, the second network element obtains the uniform resource identifier of the third network element, modifies the information in the uniform resource identifier other than the address information to obtain the first uniform resource identifier, such as modifying the random number in the uniform resource identifier so that the first uniform resource identifier is different from the uniform resource identifier in the registration request message sent by the third network element to the first network element, that is, different from the uniform resource identifier stored by the first network element. Then, the second network element sends a registration request message including the first uniform resource identifier to the first network element. When the first network element sends a first request message based on the first uniform resource identifier, since the address information in the first uniform resource identifier indicates the address of the third network element, the first request message will be sent to the third network element. In this implementation method, if Figure 4 The illustrated method further includes:

[0261] In step 4-2, the first network element sends a first request message to the third network element. Correspondingly, the third network element receives the first request message from the first network element.

[0262] In step 4-3, the third network element sends a first response message to the first network element according to the first request message. Correspondingly, the first network element receives the first response message from the third network element. The first response message is used to indicate that the re-authentication has failed.

[0263] For example, when the first uniform resource identifier is different from the uniform resource identifier in the registration request message sent by the third network element to the first network element, the third network element sends a first response message to the first network element. Figure 4 Before step 4-1, the method further includes:

[0264] In step 4-0, the third network element sends a registration request message #2 to the first network element. In response, the first network element receives the registration request message #2 from the third network element. The registration request message #2 includes the second uniform resource identifier. The registration request message #2 is used to request that the third network element be registered with the first network element as a network element providing services for the terminal device.

[0265] The third network element sends a first response message to the first network element if the first uniform resource identifier is different from the second uniform resource identifier.

[0266] As mentioned above, the uniform resource identifier in the registration request message is for the first network element to send a message for requesting re-authentication of the terminal device (for the convenience of expression, it is referred to as the re-authentication request message below, but it should be understood that the embodiment of the present application does not limit the name of the message), that is, the third network element as the real network element carries the second uniform resource identifier in the registration request message #2, so that the first network element can send a re-authentication request message to the third network element based on the second uniform resource identifier. Correspondingly, when the first network element needs to request the third network element to trigger re-authentication of the terminal device, the first network element will send a re-authentication request message to the third network element based on the second uniform resource identifier in the registration request message #2 sent by the third network element, and include the second uniform resource identifier in the message. In this case, the uniform resource identifier in the re-authentication request message received by the third network element is the same as the uniform resource identifier in the registration request message #2, both of which are the second uniform resource identifier.

[0267] However, in Example 4, the malicious second network element uses the third network element's address information to construct a first uniform resource identifier (URI), or modifies the information in the second URI to obtain the first URI, so that the first URI includes the third network element's address information and the first URI is different from the second URI. The second network element then sends a registration request message #1 to the first network element, including the first URI. When the first network element needs to request the second network element to trigger re-authentication of the terminal device, the first network element sends a re-authentication request message based on the first URI in the registration request message #1 sent by the second network element, and includes the first URI in the re-authentication request message. However, because the address information in the first URI is the third network element's address information, the re-authentication request message is sent to the third network element. The URI in the re-authentication request message received by the third network element is the first URI, which is different from the second URI in the registration request message #2. In this case, the third network element sends a first response message to the first network element, indicating that the re-authentication failed, allowing the first network element to identify the malicious second network element.

[0268] The first response message indicating that the re-authentication failed can be replaced by the first response message indicating an error, or indicating that re-authentication cannot be performed. Optionally, the first response message includes information indicating the cause of the error, which may be inconsistent uniform resource identifiers.

[0269] In step 4-4, the first network element sends a message indicating a registration failure to the second network element. Correspondingly, the second network element receives the message indicating a registration failure from the first network element.

[0270] Exemplarily, the first network element rejects the registration request of the second network element according to the first response message, that is, the first network element sends a message indicating a registration failure to the second network element.

[0271] Based on Examples 2 to 4 above, when the first uniform resource identifier in the registration request message is different from the uniform resource identifier stored in the first network element, the first network element sends a message requesting re-authentication of the terminal device based on the first uniform resource identifier, and sends a registration success or failure message to the second network element based on the result of the re-authentication. In this way, no matter whether the malicious network element uses its own address information or the address information of the real network element to construct the first uniform resource identifier, or obtains the uniform resource identifier of the real network element and then changes it, even if the first uniform resource identifier is different from the uniform resource identifier stored in the first network element, the first network element can still identify the malicious network element based on the result of the re-authentication, prevent the malicious network element from registering to the first network element, and help to further improve network security.

[0272] Optionally, in Examples 2 to 4 above, the registration request message further includes identification information of the public land network where the second network element is located, and the first condition further includes: the public land network where the second network element is located is different from the public land network where the terminal device is located, or the public land network where the second network element is located is different from the public land network where the fourth network element is located (denoted as a third PLMN). The fourth network element is a network element that successfully registers with the first network element as a network element serving the terminal device, and the fourth network element is of the same type as the second network element and the third network element.

[0273] The specific implementation of the first network element determining whether the public land network where the second network element is located is the same as the public land network where the terminal device is located can refer to the above Figure 3 The relevant descriptions in the method shown are not repeated here.

[0274] The fourth network element is a network element that has successfully registered with the first network element as a network element serving the terminal device. That is, when the first network element receives the registration request message, the network element serving the terminal device in the local record of the first network element is the fourth network element. Exemplarily, after receiving the registration request message, the first network element determines, from the network elements registered with the first network element, a fourth network element of the same type as the second network element serving the terminal device, and compares the PLMN (i.e., the third PLMN) where the fourth network element is located with the PLMN where the second network element is located to determine whether it is the same. The first network element may store identification information of the third PLMN. For example, when accepting the registration of the fourth network element with the first network element, the first network element saves the identification information of the third PLMN in the registration information of the fourth network element.

[0275] Considering that when the second network element and the terminal device or the fourth network element are in the same public land network, the probability that the second network element is a trusted network element is higher, the first network element requests to trigger re-authentication when the second network element and the terminal device are in different public land network elements. This can avoid the waste of network resources caused by frequent triggering of re-authentication, and reduce network load while ensuring network security.

[0276] Figure 5 This is a flow chart of another communication method provided by the embodiment of the present application. This method can be applied to Figure 1 The network architecture shown, for example, the first network element can be the above Figure 1 The UDM shown, or a network element with UDM function, the second network element can be the above Figure 1 The AMF shown, or the network element having the above-mentioned AMF function, is not limited in this application.

[0277] like Figure 5 As shown, the method may include the following steps. For parts that are not fully described, please refer to the existing protocol.

[0278] 501. The second network element sends a registration request message to the first network element. Correspondingly, the first network element receives the registration request message from the second network element.

[0279] The registration request message is used to request that the second network element be registered as a service network element of the terminal device to the first network element, and the registration request message includes a first uniform resource identifier. Figure 4 The first uniform resource identifier in is similar and will not be repeated here.

[0280] Optionally, the registration request message also includes identification information of the second network element.

[0281] In the case where the first address information included in the first uniform resource identifier is different from the second address information of the second network element, such as Figure 5 As shown, the method further includes:

[0282] 502-1, the first network element sends a message indicating a registration failure to the second network element. Correspondingly, the second network element receives the message indicating a registration failure from the first network element.

[0283] It should be noted that step 502-1 is optional, and the first network element may not send a message for responding to the registration request message to the second network element, that is, may not send a message for indicating the registration result to the second network element.

[0284] In the case where the first address information included in the first uniform resource identifier is the same as the second address information of the second network element, such as Figure 5 As shown, the method further includes:

[0285] 502-2, the first network element sends a message indicating a successful registration to the second network element. Correspondingly, the second network element receives the message indicating a successful registration from the first network element.

[0286] In one possible implementation, the first network element obtains the second address information corresponding to the second network element based on the identification information of the second network element in the registration request message, and sends a message to the second network element to indicate whether the registration is successful or failed based on whether the second address information is the same as the first address information.

[0287] As an example, the first address information includes a first FQDN. The first network element can obtain the FQDN of the second network element (referred to as the second FQDN) from another network element (e.g., an NRF network element) based on the identification information of the second network element. That is, the second address information is the second FQDN. If the first FQDN and the second FQDN are different, the first network element sends a message to the second network element indicating a registration failure. If the first FQDN and the second FQDN are the same, the first network element sends a message to the second network element indicating a registration success.

[0288] As another example, the first address information includes a first IP address, and the first network element may obtain the IP address of the second network element (referred to as the second IP address) from another network element based on the identification information of the second network element. That is, the second address information is the second IP address. For example, the first network element obtains the IP address of the second network element from a domain name system (DNS) server based on the identification information of the second network element. If the first IP address and the second IP address are different, the first network element sends a message to the second network element indicating a registration failure. If the first IP address and the second IP address are the same, the first network element sends a message to the second network element indicating a registration success.

[0289] In another possible implementation, the first network element obtains the certificate of the second network element, which includes the second address information. The first network element sends a message to the second network element to indicate whether the registration is successful or failed based on whether the second address information included in the certificate is the same as the first address information.

[0290] It should be understood that the certificate of the second network element may be a certificate obtained by the first network element from the second network element when the first network element and the second network element establish a transport layer security protocol (TLS), that is, the first network element receives a certificate from the second network element.

[0291] As an example, the first address information includes a first FQDN, and the second address information included in the certificate of the second network element is the FQDN of the second network element (referred to as the second FQDN). If the first FQDN and the second FQDN are different, the first network element sends a message to the second network element indicating a registration failure. If the first FQDN and the second FQDN are the same, the first network element sends a message to the second network element indicating a registration success.

[0292] In another possible implementation, a first network element obtains a certificate from a second network element, where the certificate includes the FQDN of the second network element (referred to as the second FQDN), and the first address information includes the first IP address. The first network element may obtain the IP address of the second network element (referred to as the second IP address) from another network element (e.g., a DNS server) based on the second FQDN. That is, the second address information is the second IP address. If the first IP address and the second IP address are different, the first network element sends a message to the second network element indicating a registration failure. If the first IP address and the second IP address are the same, the first network element sends a message to the second network element indicating a registration success.

[0293] Considering that when the second network element is a malicious network element, the first uniform resource identifier in the registration request message may be the uniform resource identifier of the real network element stolen by the second network element, or the uniform resource identifier constructed by the second network element using the address information of the real network element. In this case, the first address information in the first uniform resource identifier is the address information of the real network element rather than the second network element. Figure 5 According to the method shown, the first network element sends a message to the second network element to indicate a registration failure when the first address information and the second address information of the second network element are different. In this way, no matter whether the malicious network element uses the uniform resource identifier of the real network element or constructs the uniform resource identifier using the address information of the real network element, the malicious network element can be prevented from registering with the first network element, which helps to improve network security.

[0294] Figure 6 This is a flow chart of another communication method provided by the embodiment of the present application. This method can be applied to Figure 1 The network architecture shown, for example, the first network element can be the above Figure 1 The UDM shown, or a network element with UDM function, the second network element can be the above Figure 1 The AMF shown, or the network element having the above-mentioned AMF function, is not limited in this application.

[0295] like Figure 6 As shown, the method may include the following steps. For parts that are not fully described, please refer to the existing protocol.

[0296] 601. A second network element sends a registration request message to a first network element. Correspondingly, the first network element receives the registration request message from the second network element. The registration request message is used to request that the second network element be registered with the first network element as a serving network element of a terminal device.

[0297] 602. The first network element sends a message indicating registration success or failure to the second network element according to whether the second network element supports re-authentication and whether the registration request message includes a uniform resource identifier.

[0298] Among them, whether the second network element supports re-authentication can be understood as whether the second network element has the ability to re-authenticate. Exemplarily, when the first network element and the second network element interact for the first time (for example, when the second network element leaves the factory, the second network element and the first network element interact with each other), the second network element indicates to the first network element whether the second network element supports re-authentication, and the information of the first interaction is accurate and true. For the specific implementation of the uniform resource identifier, please refer to the above Figure 4 As described in the method shown.

[0299] In a possible implementation, the second network element does not support re-authentication, and the registration request message includes a uniform resource identifier. In this case, the first network element sends a message indicating a registration failure to the second network element.

[0300] Generally, if the network element that actually provides services to the terminal device (hereinafter referred to as a normal network element or a real network element for ease of description) does not support re-authentication, the registration request message does not include a uniform resource identifier. If a second network element does not support re-authentication but the registration request message includes a uniform resource identifier, the first network element will determine that the second network element is a malicious network element and refuse to register the second network element with the first network element as a service network element for the terminal device, thereby improving network security.

[0301] In another possible implementation, the second network element supports re-authentication and the registration request message satisfies a second condition. In this case, the first network element sends a message to the second network element indicating a registration failure. The second condition includes: the registration request message does not include a uniform resource identifier.

[0302] Generally, when the real network element supports re-authentication, the registration request message includes a uniform resource identifier. If the second network element supports re-authentication but the registration request message does not include a uniform resource identifier, the first network element determines that the second network element is a malicious network element and sends a message to the second network element indicating a registration failure, refusing to register the second network element with the first network element as a serving network element for the terminal device, thereby improving network security.

[0303] In another possible implementation, the second network element does not support re-authentication, and the registration request message does not include a uniform resource identifier. In this case, the first network element sends a message indicating successful registration to the second network element.

[0304] In another possible implementation, the second network element supports re-authentication, and the registration request message includes a uniform resource identifier. In this case, the first network element sends a message indicating successful registration to the second network element.

[0305] It should be noted that the first network element sends a message to the second network element indicating a registration failure, and accordingly, the second network element receives the message from the first network element indicating a registration failure. The first network element sends a message to the second network element indicating a registration success, and accordingly, the second network element receives the message from the first network element indicating a registration success.

[0306] Optionally, when the first network element sends a message indicating successful registration to the second network element, the first network element may further perform the following steps: the first network element stores the uniform resource identifier in the registration request message in step 601 .

[0307] That is, when the first network element determines to accept the second network element as a network element providing services for the terminal device to register with the first network element, the first network element stores the uniform resource identifier in the registration request message of the second network element locally. It should be noted that the embodiment of the present application does not restrict the order in which the first network element stores the uniform resource identifier and sends a message indicating a successful registration. That is, after the first network element determines to accept the second network element as a network element providing services for the terminal device to register with the first network element, the first network element may first store the uniform resource identifier and then send a message indicating a successful registration to the second network element, or may first send a message indicating a successful registration to the second network element and then store the uniform resource identifier, or may simultaneously store the uniform resource identifier and send a message indicating a successful registration.

[0308] Considering that once a malicious network element that supports re-authentication obtains the uniform resource identifier of the network element that actually serves the terminal device and uses the uniform resource identifier to register with the first network element, the first network element cannot identify the malicious network element based on whether the second network element supports re-authentication and whether the registration request message includes the uniform resource identifier. Figure 7 and Figure 8 The communication method shown can solve the above problems and further improve network security.

[0309] like Figure 7 As shown, the method may include the following steps. For parts that are not fully described, please refer to the existing protocol.

[0310] 701. The second network element sends a second request message to the first network element. Correspondingly, the first network element receives the second request message from the second network element.

[0311] The second request message includes identification information of the terminal device, and the second request message is used to request registration information of a first access and mobility management network element serving the terminal device.

[0312] As an example, the second request message is a terminal device context management acquisition service request message, and the type of information requested by the second request message is the registration information of the first access and mobility management network element serving the terminal device. For example, the second request message is a Nudm_UECM_Getrequest message, and the Nudm_UECM_Getrequest message includes / registrations / amf-3gpp-access.

[0313] 702. The first network element sends a third response message to the second network element. Correspondingly, the second network element receives the third response message from the first network element.

[0314] The third response information is used to indicate a refusal to provide the registration information of the first access and mobility management network element, or the third response message includes the registration information of the first access and mobility management network element but does not include a uniform resource identifier corresponding to the first access and mobility management network element, that is, the third response message includes part or all of the information in the registration information of the first access and mobility management network element except the uniform resource identifier. The uniform resource identifier is used to send a reauthentication request to the first access and mobility management network element.

[0315] In a possible implementation manner, the first network element sends a third response message to the second network element based on the network element type of the second network element being an access and mobility management network element.

[0316] Considering that normal access and mobility management network elements do not need to request the registration information of the first access and mobility management network element serving the terminal device from the first network element, only network elements of other network element types (such as network open function network elements) may request the registration information. Therefore, the first network element determines whether to provide the registration information or whether to provide the unified resource identifier corresponding to the first access and mobility management network element based on the type of network element sending the second request message. This can prevent malicious access and mobility management network elements from obtaining the unified resource identifier of the normal access and mobility management network element. In this way, malicious access and mobility management network elements cannot use the unified resource identifier to register with the first network element, which helps to improve network security.

[0317] Optionally, the first network element may further send a third response message to the second network element based on a local policy. The local policy may be system-predefined or preconfigured for the first network element, or may be indicated to the first network element by a gateway. For example, the local policy may include information prohibiting the second network element from using the first service and / or prohibiting the second network element from obtaining information related to a uniform resource identifier.

[0318] In another possible implementation, the second request message includes a first token, the first token indicates prohibition of providing registration information of the access and mobility management network element, and the first network element sends a third response message to the second network element based on the first token. The third response information is used to indicate refusal to provide registration information of the first access and mobility management network element; or the first token indicates prohibition of providing a uniform resource identifier of the first access and mobility management network element, and the first network element sends a third response message to the second network element based on the first token. The third response information includes part or all of the information in the registration information of the first access and mobility management network element except the uniform resource identifier. In this way, based on the first token, a malicious access and mobility management network element can be prevented from obtaining the real uniform resource identifier of the access and mobility management network element, and the malicious access and mobility management network element cannot use the uniform resource identifier to register with the first network element, which helps to improve network security.

[0319] In this implementation, before step 701, the method may further include: Figure 8 The following steps are shown as 801 and 802-1.

[0320] 801. The second network element sends a request message #2 to the NRF network element. Correspondingly, the NRF network element receives the request message #2 from the second network element.

[0321] The request message #2 is used to request a token for accessing a first service, where the first service is to obtain registration information of a first access and mobility management network element serving a terminal device from a first network element. For example, the request message #2 is an access token acquisition request message (e.g., an Nnrf_AccessToken_Get Request message).

[0322] Optionally, request message #2 includes identification information of the second network element.

[0323] 802-1, the NRF network element sends a response message #2 to the second network element according to the request message #2. Correspondingly, the second network element receives the response message #2 from the NRF network element, and the response message #2 includes the first token.

[0324] For example, the NRF network element determines, based on the request message #2, that the second network element is not allowed to access the first service, and then sends a response message #2 including the first token to the second network element.

[0325] Exemplarily, the NRF network element determines that the second network element is not allowed to access the first service based on the type of the second network element being an access and mobility management network element. For example, the NRF network element can determine that the type of the second network element is an access and mobility management network element based on the identification information of the second network element in the request message #2.

[0326] Considering that normal access and mobility management network elements do not need to request the token for access to the first service from the NRF network element, only network elements of other types of network elements (such as network open function network elements) may request the token for access to the first service. Therefore, when the network element requesting the token is an access and mobility management network element, the NRF refuses to issue the token, which can prevent malicious access and mobility management network elements from using the token to obtain the unified resource identifier of the normal access and mobility management network element and register with the first network element, which helps to improve network security.

[0327] In another possible implementation, when the second request message satisfies condition #1, the first network element sends a third response message to the second network element, wherein condition #1 includes: the second request message does not include a token for accessing the first service, or the token for accessing the first service in the second request message is not authorized.

[0328] In this implementation, before step 701, the method may further include: Figure 8 The above step 801 and the following step 802-2 are shown.

[0329] 802-2, the NRF network element sends a response message #3 to the second network element according to the request message #2. Accordingly, the second network element receives the response message #3 from the NRF network element. The response message #3 indicates that the NRF network element refuses to issue a token for accessing the first service.

[0330] For example, the NRF network element determines that the second network element is not allowed to access the first service based on the request message #2, and then sends a response message #3 to the second network element. The implementation method of the NRF network element determining that the second network element is not allowed to access the first service can refer to step 802-1.

[0331] It should be noted that, when it is determined that the second network element is not allowed to access the first service, the NRF network element may not send a response message to the request message #2 to the second network element, that is, step 802-2 is optional.

[0332] Through steps 801 and 802-2, the second network element does not obtain the token authorized by the NRF network element for accessing the first service. Figure 7 In the second request message shown, the second request message does not include a token for accessing the first service, or the second request message includes an unauthorized token forged by the second network element. If the second request message satisfies condition #1, the first network element may send a third response message to the second network element, thereby avoiding providing the registration information of the first access and mobility management network element or the uniform resource identifier corresponding to the first access and mobility management network element to a malicious network element. In this way, the malicious access and mobility management network element cannot use the uniform resource identifier to register with the first network element, thereby improving network security.

[0333] exist Figure 6 In the method shown, when the second network element supports re-authentication and the registration request message includes a uniform resource identifier, the first network element can also determine whether to accept the registration request of the second network element in the following manner, that is, determine whether to send a registration failure message or a registration success message to the second network element in the following manner.

[0334] Method 1: The first network element sends a message indicating the success or failure of the registration to the second network element based on whether the uniform resource identifier in the registration request message is the same as the uniform resource identifier stored in the first network element. For specific implementation, please refer to Figure 4 The description of Example 1 is omitted here.

[0335] The first network element may also send a message for requesting re-authentication based on the first address information in the uniform resource identifier. When the response message to the message for requesting re-authentication indicates that the re-authentication failed, the first network element sends a message to the second network element indicating that the registration failed; when the response message to the message for requesting re-authentication indicates that the re-authentication succeeded, the first network element sends a message to the second network element indicating that the registration succeeded. For specific implementation, please refer to Figure 4 The descriptions of Examples 2 to 4 are not repeated here.

[0336] Method 2: The uniform resource identifier in the registration request message includes the first address information. The first network element sends a message indicating the success or failure of the registration to the second network element based on whether the first address information is the same as the second address information of the second network element. For specific implementation, please refer to Figure 5 The method shown will not be described here in detail.

[0337] Mode 3: The registration request message includes the identification information of the second PLMN where the second network element is located. The first network element sends a message indicating the success or failure of the registration to the second network element according to whether the second PLMN is the same as the PLMN where the terminal device is located. For specific implementation, please refer to Figure 3 The method shown will not be described here in detail.

[0338] Above, combined Figures 3 to 8 The communication method provided by the embodiment of the present application is described in detail. The above communication method is mainly introduced from the perspective of interaction between the terminal device and the network device. It is understandable that in order to implement the above functions, the terminal device includes a hardware structure and / or software module corresponding to each function.

[0339] Those skilled in the art should be aware that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is performed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0340] The following combination Figures 9 and 10 The communication device provided in this application is described in detail. It should be understood that the description of the device embodiment corresponds to the description of the method embodiment. Therefore, for the sake of brevity, some contents are not repeated here.

[0341] In the embodiment of the present application, the functional modules of the transmitting device or the receiving device can be divided according to the above method example. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated modules can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiment of the present application is schematic and is only a logical functional division. There may be other division methods in actual implementation. The following is an example of dividing each functional module according to each function.

[0342] Figure 9 This is a schematic block diagram of a communication device 10 provided in an embodiment of the present application. The device 10 includes a transceiver module 11 and a processing module 12. The transceiver module 11 can implement corresponding communication functions, while the processing module 12 is used to process data. In other words, the transceiver module 11 is used to perform operations related to receiving and sending, while the processing module 12 is used to perform operations other than receiving and sending. The transceiver module 11 can also be referred to as a communication interface or a communication unit.

[0343] Optionally, the device 10 may further include a storage module 13, which may be used to store instructions and / or data. The processing module 12 may read the instructions and / or data in the storage module so that the device implements the actions of the devices in the aforementioned method embodiments.

[0344] In one design, the apparatus 10 may correspond to the first network element (eg, a UDM network element) in the above method embodiment, or a component of the first network element (eg, a chip).

[0345] The device 10 can implement the steps or processes corresponding to those executed by the first network element in the above method embodiment, wherein the transceiver module 11 can be used to perform operations related to transceiver transmission of the first network element in the above method embodiment, and the processing module 12 can be used to perform operations related to processing of the first network element in the above method embodiment.

[0346] It should be understood that the specific process of each unit executing the above corresponding steps has been described in detail in the above method embodiment, and for the sake of brevity, it will not be repeated here.

[0347] In another design, the device 10 may correspond to the second network element (such as an AMF network element) in the above method embodiment, or a component of the second network element (such as a chip).

[0348] It should be understood that the specific process of each unit executing the above corresponding steps has been described in detail in the above method embodiment, and for the sake of brevity, it will not be repeated here.

[0349] In yet another design, the apparatus 10 may correspond to the third network element in the above method embodiment, or be a component (such as a chip) of the third network element.

[0350] It should be understood that the specific process of each unit executing the above corresponding steps has been described in detail in the above method embodiment, and for the sake of brevity, it will not be repeated here.

[0351] It should also be understood that the device 10 here is embodied in the form of a functional module. The term "module" here may refer to an application specific integrated circuit (ASIC), an electronic circuit, a processor (such as a shared processor, a dedicated processor or a group processor, etc.) and a memory for executing one or more software or firmware programs, a combined logic circuit and / or other suitable components that support the described functions. In an optional example, those skilled in the art will understand that the device 10 may be specifically the first network element in the above-mentioned embodiment, and may be used to execute the various processes and / or steps corresponding to the first network element in the above-mentioned method embodiments; or, the device 10 may be specifically the second network element in the above-mentioned embodiment, and may be used to execute the various processes and / or steps corresponding to the second network element in the above-mentioned method embodiments; or, the device 10 may be specifically the third network element in the above-mentioned embodiment, and may be used to execute the various processes and / or steps corresponding to the third network element in the above-mentioned method embodiments. To avoid repetition, it will not be described here.

[0352] The apparatus 10 of each of the above-mentioned solutions has the function of implementing the corresponding steps performed by the devices (e.g., the first network element, the second network element, the third network element, etc.) in the above-mentioned methods. This function can be implemented by hardware, or by hardware executing corresponding software implementations. The hardware or software includes one or more modules corresponding to the above-mentioned functions; for example, the transceiver module can be replaced by a transceiver (e.g., the transmitting unit in the transceiver module can be replaced by a transmitter, and the receiving unit in the transceiver module can be replaced by a receiver), and other units, such as the processing module, can be replaced by a processor, respectively performing the transceiver operations and related processing operations in each method embodiment.

[0353] In addition, the transceiver module 11 may also be a transceiver circuit (for example, may include a receiving circuit and a sending circuit), and the processing module may be a processing circuit.

[0354] Figure 10 FIG2 is a schematic diagram of another communication device 20 provided in an embodiment of the present application. The device 20 includes a processor 21, which is configured to execute computer programs or instructions stored in a memory 22, or read data / signaling stored in the memory 22, to perform the methods described in the above method embodiments. Optionally, there are one or more processors 21.

[0355] Alternatively, as Figure 9 As shown, the device 20 further includes a memory 22, which is used to store computer programs or instructions and / or data. The memory 22 can be integrated with the processor 21, or can be separately provided. Optionally, there are one or more memories 22.

[0356] Alternatively, as Figure 9 As shown, the device 20 further includes a transceiver 23, which is used to receive and / or send signals. For example, the processor 21 is used to control the transceiver 23 to receive and / or send signals.

[0357] As a solution, the device 20 is used to implement the operations performed by the first network element in each of the above method embodiments.

[0358] As another solution, the device 20 is used to implement the operations performed by the second network element in the above various method embodiments.

[0359] As another solution, the device 20 is used to implement the operations performed by the third network element in the above various method embodiments.

[0360] It should be understood that the processor mentioned in the embodiments of the present application may be a central processing unit (CPU), or may be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc.

[0361] It should also be understood that the memory mentioned in the embodiments of the present application may be a volatile memory and / or a non-volatile memory. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM). For example, RAM can be used as an external cache. By way of example and not limitation, RAM includes the following forms: static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0362] It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, the memory (storage module) can be integrated into the processor.

[0363] It should also be noted that the memory described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0364] Figure 11 FIG2 is a schematic diagram of a chip system 30 provided in an embodiment of the present application. The chip system 30 (or also referred to as a processing system) includes a logic circuit 31 and an input / output interface 32 .

[0365] The logic circuit 31 may be a processing circuit in the chip system 30. The logic circuit 31 may be coupled to a storage network element and invoke instructions in the storage network element, so that the chip system 30 can implement the methods and functions of the various embodiments of the present application. The input / output interface 32 may be an input / output circuit in the chip system 30, outputting information processed by the chip system 30 or inputting data or signaling information to be processed into the chip system 30 for processing.

[0366] As a solution, the chip system 30 is used to implement the operations performed by the first network element, the second network element, and the third network element in the above method embodiments.

[0367] For example, the logic circuit 31 is used to implement the processing-related operations performed by the first network element, the second network element, and the third network element in the above method embodiment; the input / output interface 32 is used to implement the sending and / or receiving-related operations performed by the first network element, the second network element, and the third network element in the above method embodiment.

[0368] An embodiment of the present application further provides a computer-readable storage medium storing computer instructions for implementing the methods executed by the first network element, the second network element, and the third network element in the above-mentioned method embodiments.

[0369] For example, when the computer program is executed by a computer, the computer can implement the methods performed by the first network element, the second network element, and the third network element in each embodiment of the above method.

[0370] An embodiment of the present application further provides a computer program product comprising instructions, which, when executed by a computer, implement the methods performed by the first network element, the second network element, and the third network element in the above-mentioned method embodiments.

[0371] An embodiment of the present application also provides a communication system, including the aforementioned first network element and second network element, which are used to execute the relevant operations performed by the first network element and the second network element in the above method embodiment.

[0372] Optionally, the communication system may further include a third network element, which is configured to execute the relevant operations performed by the third network element in the above method embodiment.

[0373] The explanation of the relevant contents and beneficial effects of any of the above-mentioned devices can be referred to the corresponding method embodiments provided above, which will not be repeated here.

[0374] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0375] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. For example, the computer can be a personal computer, a server, or a network device, etc. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrations. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid state disk (SSD)). For example, the aforementioned available medium includes, but is not limited to, various media that can store program code, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0376] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.< / callbackuripart>

Claims

1. A communication method, characterized in that: include: The first network element receives a registration request message from the second network element, where the registration request message is used to request that the second network element be registered as a serving network element of a terminal device to the first network element, and the registration request message includes a first uniform resource identifier; In a case where the first uniform resource identifier is identical to the uniform resource identifier stored in the first network element, the first network element sends a message to the second network element indicating that the registration of the second network element with the first network element has failed.

2. The method according to claim 1, characterized in that The method further comprises: When a first condition is met, the first network element sends a first request message to a third network element according to the first uniform resource identifier, where the first request message is used to request re-authentication of the terminal device, the first request message includes the first uniform resource identifier, and the first condition includes: the first uniform resource identifier is different from a uniform resource identifier stored by the first network element; The first network element receives a first response message from the third network element, where the first response message is used to indicate that the re-authentication has failed; The first network element sends a message indicating the registration failure to the second network element based on the first response message.

3. The method according to claim 1, characterized in that The method further comprises: When a first condition is met, the first network element sends a first request message to a third network element according to the first uniform resource identifier, where the first request message is used to request re-authentication of the terminal device, the first request message includes the first uniform resource identifier, and the first condition includes: the first uniform resource identifier is different from a uniform resource identifier stored by the first network element; The first network element receives a second response message from the third network element, where the second response message is used to indicate that the re-authentication is successful; The first network element stores the first uniform resource identifier and sends a message indicating that the registration is successful to the second network element.

4. The method according to claim 2 or 3, characterized in that The first uniform resource identifier includes address information of the third network element, and the first network element sends a first request message to the third network element according to the first uniform resource identifier, including: The first network element sends the first request message to the third network element according to the address information.

5. The method according to claim 4, characterized in that The address information includes a full domain name or an Internet Protocol address.

6. The method according to any one of claims 2 to 5, characterized in that The registration request message further includes identification information of the public land network where the second network element is located, and the first condition further includes: the public land network where the second network element is located is different from the public land network where the terminal device is located.

7. A communication method, characterized in that: include: The third network element sends a registration request message to the first network element, where the registration request message is used to request that the third network element be registered as a serving network element of the terminal device to the first network element, and the registration request message includes a second uniform resource identifier; The third network element receives a first request message from the first network element, where the first request message is used to request re-authentication of the terminal device, and the first request message includes a first uniform resource identifier; In a case where the first uniform resource identifier is different from the second uniform resource identifier, the third network element sends a first response message to the first network element, where the first response message is used to indicate that the re-authentication has failed.

8. A communication method, characterized in that: include: The first network element receives a registration request message from the second network element, where the registration request message is used to request that the second network element be registered with the first network element as a serving network element of a terminal device, and the registration request message includes a uniform resource identifier; In a case where the second address information of the second network element is different from the first address information included in the uniform resource identifier, the first network element sends a message indicating the registration failure to the second network element.

9. The method according to claim 8, characterized in that The registration request message further includes identification information of the second network element, and the method further includes: The first network element obtains the second address information according to the identification information of the second network element.

10. The method according to claim 8, characterized in that The method further comprises: The first network element obtains a certificate of the second network element, where the certificate includes the second address information.

11. The method according to claim 8, characterized in that The method further comprises: The first network element obtains a certificate of the second network element, the certificate includes a second full address domain name, the first address information is a first Internet Protocol address, and the second address information is a second Internet Protocol address, and the method further includes: The network element obtains the second Internet Protocol address according to the second full address domain name.

12. A communication device, characterized in that: The apparatus comprises a module for executing the method according to any one of claims 1 to 6, or the apparatus comprises a module for executing the method according to claim 7, or the apparatus comprises a module for executing the method according to any one of claims 8 to 11.

13. A communication device, characterized in that: include Memory for storing computer programs; A processor for executing the computer program so that the communication device performs the method of any one of claims 1 to 6; or so that the communication device performs the method of claim 7; or so that the communication device performs the method of any one of claims 8 to 11.

14. A communication system, characterized in that: The system comprises a first network element and a second network element, wherein: The first network element is configured to perform the method according to any one of claims 1 to 6; The second network element is used to send a registration request message to the first network element, and is also used to receive a message from the first network element indicating that the second network element has failed to register with the first network element.

15. The method according to claim 14, characterized in that The system further includes a third network element, and the third network element is configured to execute the method according to claim 7.

16. A communication system, characterized in that: The system comprises a first network element and a second network element, wherein: The first network element is configured to perform the method according to any one of claims 8 to 11; The second network element is used to send a registration request message to the first network element, and is also used to receive a message from the first network element indicating that the second network element has failed to register with the first network element.

17. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, which, when executed on a computer, cause the computer to execute the method according to any one of claims 1 to 6; or, cause the computer to execute the method according to claim 7; or, cause the computer to execute the method according to any one of claims 8 to 11.

18. A computer program product, characterized in that The computer program product comprises a computer program or instructions for executing the method according to any one of claims 1 to 6; or, the computer program product comprises a computer program or instructions for executing the method according to claim 7; or, the computer program product comprises a computer program or instructions for executing the method according to any one of claims 8 to 11.

Images