Network registration method and device

Abstract

The invention relates to the technical field of communication, in particular to a network registration method and device. The method comprises the steps that a first authentication request message sent by a terminal is received, and the first authentication request message indicates identity authentication of a network and the terminal based on a target authentication strategy; sending the first authentication request message to a second network function; a first request message sent by the second network function is received, and the first request message is used for indicating to trigger bidirectional identity verification of the network and the terminal; converting the first request message into a second request message compatible with the terminal; sending the second request message to the terminal; a first response message sent by the terminal is received, and the first response message is used for indicating that the network and the terminal identity are legal; converting the first response message into a second response message compatible with a second network function; and sending the second response message to the second network function. Therefore, the problem of incompatibility of authentication protocols between the terminal and the core network is solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication, and in particular to a network registration method and device. BACKGROUND

[0002] The current 5th generation (5G) core network architecture has explicitly supported heterogeneous access, which is divided into 3GPP access through base stations and non-3GPP access through wireless local area networks (WLAN) and other networks in terms of access types, and further divided into trusted domains and untrusted domains that require different security policies based on the degree of trust in network infrastructure. In order to realize the "one network for multiple uses" trend of network convergence and efficient resource utilization, the industry has proposed a scheme to integrate different access technologies through the 5G core network, and for untrusted domain access, the standard technical path is to require terminals to access through N3IWF network elements supporting IKEv2 / IPSec and 5G NAS protocols, in order to realize secure interconnection and service continuity with the 5G network.

[0003] Under this mode, the terminal modules widely deployed in the market are not planned to support this combination of protocol stacks, which leads to serious terminal compatibility barriers in actual deployment, making it difficult for the standard scheme to land in the existing terminal ecosystem and unable to effectively support non-trusted network access to achieve widespread 5G core network integration access. SUMMARY

[0004] The present application provides a network registration method and device to solve the technical problem that the terminal does not meet the 5G NAS signaling and does not support IKEv2 and IPSec, so as to realize non-trusted non-3GPP access to the 5G core network through the standard N3IWF.

[0005] In a first aspect, an embodiment of the present application provides a network registration method, which is executed by a first network function, and the method comprises: receiving a first authentication request message sent by a terminal, wherein the first authentication request message indicates identity authentication of a network and the terminal based on a target authentication strategy; sending the first authentication request message to a second network function; receiving a first request message sent by the second network function, wherein the first request message is used to indicate triggering of bidirectional identity authentication of the network and the terminal; converting the first request message into a second request message compatible with the terminal; sending the second request message to the terminal; receiving a first response message sent by the terminal, wherein the first response message is used to indicate that the network and terminal identities are legal; converting the first response message into a second response message compatible with a second network function; sending the second response message to the second network function.

[0006] In one embodiment, the method further comprises: receiving an authentication success message sent by the second network function, wherein the authentication success message is used to indicate that the bidirectional identity authentication between the terminal and the network is successful; sending the authentication success message to the terminal.

[0007] In one embodiment, the method further comprises: receiving an initial context establishment request sent by the second network function, wherein the initial context establishment request is used to indicate that the first network function establishes an access layer security context with the terminal and carries an access layer resource configuration parameter; receiving a second authentication request message sent by the terminal, wherein the second authentication request message comprises an authentication parameter AUTH; verifying the AUTH, and sending an initial context establishment response to the second network function if the AUTH verification is passed, wherein the initial context establishment response is used to indicate that the access layer security context has been established.

[0008] In a second aspect, an embodiment of the present application provides a network registration method, executed by a second network function, and the method comprises: receiving a first authentication request message sent by the first network function, wherein the first authentication request message indicates that the identity authentication of the network and the terminal is performed based on a target authentication strategy; sending the first authentication request message to a third network function; receiving a second response message sent by the first network function; sending the second response message to the third network function.

[0009] In one embodiment, the method further comprises: receiving an authentication success message sent by the third network function, wherein the authentication success message is used to indicate that a response RES parameter in the second response message meets a preset parameter threshold; sending the authentication success message to the first network function.

[0010] In one embodiment, the method further comprises: Receive an initial context establishment request sent by the third network function, wherein the initial context establishment request is used to indicate the establishment of an access layer context; Send an initial context establishment request to the first network function; Receive an initial context establishment response sent by the first network function, wherein the initial context establishment response is used to indicate that an access layer security context has been established.

[0011] Thirdly, embodiments of this application provide a network registration method, executed by a terminal, the method comprising: Send a first authentication request message to a first network function, wherein the first authentication request message is used to trigger two-way identity authentication between the terminal and the network; Receive a second request message sent by the first network function, wherein the second request message is a message used by the terminal to request verification of whether the network is legitimate; Based on the second request message, a first response message is generated, wherein the first response message is used to indicate that the network and terminal identities are legitimate; Send the first response message to the first network function.

[0012] In one embodiment, the method further includes: Receive an authentication success message sent by the first network function, wherein the authentication success message is used to indicate that the two-way identity authentication between the terminal and the network is successful; Send a second authentication request message to the first network function, wherein the second authentication request message includes the AUTH parameter.

[0013] Fourthly, embodiments of this application provide a PDU session establishment method, executed by a first network function, the method comprising: Receive a PDU session establishment request sent by the terminal; Send the PDU session establishment request to the second network function; Receive a PDU session request sent by the second network function, wherein the PDU session request includes: Quality of Service (QoS) information; Based on the QoS information, determine the first number of sub-security associations (SAs) that need to be established with the terminal; Establish the first number of SAs between the first network function and the terminal.

[0014] In one embodiment, the method further includes: Generate a PDU session response, wherein the PDU session response is used to indicate that the network-side session resources have been configured. Send a PDU session response to the second network function, wherein the PDU session response includes: access network side channel information provided by the first network function.

[0015] In one embodiment, the method further includes: The Quality of Service (QoS) stream is mapped to the established sub-SA for transmission.

[0016] Fifthly, embodiments of this application provide a PDU session establishment method, executed by a second network function, the method comprising: Receive a PDU session establishment request sent by the first network function; Send a PDU session establishment request to the fourth network function; Receive a PDU session request sent by the fourth network function, wherein the PDU session request includes: Quality of Service (QoS) information; Send the PDU session request to the first network function.

[0017] In one embodiment, the method further includes: Receive a PDU session response sent by a first network function, wherein the PDU session response includes: access network side channel information provided by the first network function.

[0018] Sixthly, embodiments of this application provide a PDU session establishment method, executed by a terminal, the method comprising: Send a PDU session establishment request to the first network function.

[0019] Seventhly, embodiments of this application provide a network registration device, including: The first receiving module is configured to receive a first authentication request message sent by the terminal, wherein the first authentication request message indicates that the network and the terminal are authenticated based on a target authentication policy; The first sending module is used to send the first authentication request message to the second network function; The second receiving module is used to receive a first request message sent by the second network function, wherein the first request message is used to indicate the triggering of two-way authentication between the network and the terminal; The first conversion module is used to convert the first request message into a terminal-compatible second request message; The second sending module is used to send the second request message to the terminal; The third receiving module is used to receive a first response message sent by the terminal, wherein the first response message is used to indicate that the network and the terminal are legitimate. The second conversion module is used to convert the first response message into a second response message that is compatible with the second network function; The third sending module is used to send the second response message to the second network function.

[0020] In one embodiment, the network registration device further includes: The thirteenth receiving module is used to receive an authentication success message sent by the second network function, wherein the authentication success message is used to indicate that the two-way identity authentication between the terminal and the network is successful; The eleventh sending module is used to send the authentication success message to the terminal.

[0021] In one embodiment, the network registration device further includes: The fourteenth receiving module is used to receive an initial context establishment request sent by the second network function, wherein the initial context establishment request is used to instruct the first network function to establish an access layer security context with the terminal and carries access layer resource configuration parameters; The fifteenth receiving module is used to receive a second authentication request message sent by the terminal, wherein the second authentication request message includes: authentication parameter AUTH; The verification module is used to verify the AUTH. If the AUTH verification passes, it sends an initial context establishment response to the second network function, wherein the initial context establishment response is used to indicate that the access layer security context has been established.

[0022] Eighthly, embodiments of this application provide a network registration device, comprising: The fourth receiving module is used to receive the first authentication request message sent by the first network function, wherein the first authentication request message indicates that the network and the terminal are authenticated based on the target authentication policy; The fourth sending module is used to send the first authentication request message to the third network function; The fifth receiving module is used to receive the second response message sent by the first network function; The fifth sending module is used to send the second response message to the third network function.

[0023] In one embodiment, the network registration device further includes: The sixteenth receiving module is used to receive the authentication success message sent by the third network function, wherein the authentication success message is used to indicate that the response RES parameter in the second response message meets the preset parameter threshold. The twelfth sending module is used to send the authentication success message to the first network function.

[0024] In one embodiment, the network registration device further includes: The seventeenth receiving module is configured to receive an initial context establishment request sent by the third network function, wherein the initial context establishment request is used to indicate the establishment of an access layer context; The thirteenth sending module is used to send an initial context establishment request to the first network function; The eighteenth receiving module is used to receive the initial context establishment response sent by the first network function, wherein the initial context establishment response is used to indicate that the access layer security context has been established.

[0025] Ninthly, embodiments of this application provide a network registration device, comprising: The sixth sending module is used to send a first authentication request message to the first network function, wherein the first authentication request message is used to trigger two-way identity authentication between the terminal and the network; The sixth receiving module is used to receive the second request message sent by the first network function, wherein the second request message is a message used by the terminal to request verification of whether the network is legitimate; The first generation module is configured to generate a first response message based on the second request message, wherein the first response message is used to indicate that the network and terminal identities are legitimate; The seventh sending module is used to send the first response message to the first network function.

[0026] In one embodiment, the network registration device further includes: The nineteenth receiving module is used to receive the authentication success message sent by the first network function, wherein the authentication success message is used to indicate that the two-way identity authentication between the terminal and the network is successful. The fourteenth sending module is used to send a second authentication request message to the first network function, wherein the second authentication request message includes the AUTH parameter.

[0027] Tenthly, embodiments of this application provide a PDU session establishment apparatus, comprising: The seventh receiving module is used to receive PDU session establishment requests sent by the terminal; The eighth sending module is used to send the PDU session establishment request to the second network function; The eighth receiving module is used to receive a PDU session request sent by the second network function, wherein the PDU session request includes: Quality of Service (QoS) information; The determining module is used to determine, based on the QoS information, a first number of sub-security associations (SAs) that need to be established with the terminal; A module is established to establish the first number of SAs between the first network function and the terminal.

[0028] In one embodiment, the PDU session establishment apparatus further includes: The twentieth receiving module is used to generate a PDU session response, wherein the PDU session response is used to indicate that the network-side session resources have been configured. The sixteenth sending module is used to send a PDU session response to the second network function, wherein the PDU session response includes: access network side channel information provided by the first network function.

[0029] In one embodiment, the PDU session establishment apparatus further includes: The mapping module is used to map the Quality of Service (QoS) stream to the established sub-SA for transmission.

[0030] Eleventhly, embodiments of this application provide a PDU session establishment apparatus, including: The ninth receiving module is used to receive the PDU session establishment request sent by the first network function; The ninth sending module is used to send a PDU session establishment request to the fourth network function; The tenth receiving module is used to receive the PDU session request sent by the fourth network function, wherein the PDU session request includes: Quality of Service (QoS) information; The tenth sending module is used to send the PDU session request to the first network function.

[0031] In one embodiment, the PDU session establishment apparatus further includes: The twenty-first receiving module is used to receive a PDU session response sent by the first network function, wherein the PDU session response includes: access network side channel information provided by the first network function; In a twelfth aspect, embodiments of this application provide a PDU session establishment apparatus, including: The eleventh receiving module is used to send a PDU session establishment request to the first network function.

[0032] In a thirteenth aspect, embodiments of this application provide a terminal, including a memory, a transceiver, and a processor: The memory is used to store computer programs; the transceiver is used to send and receive data under the control of the processor; the processor is used to read the computer program in the memory and execute the steps of the network registration method, or implement the steps of the PDU session establishment method.

[0033] In a fourteenth aspect, embodiments of this application provide a first network function, including a memory, a transceiver, and a processor: The memory is used to store computer programs; the transceiver is used to send and receive data under the control of the processor; the processor is used to read the computer program in the memory and execute the steps of the network registration method, or execute the steps of the PDU session establishment method.

[0034] In a fifteenth aspect, embodiments of this application provide a second network function, including a memory, a transceiver, and a processor: The memory is used to store computer programs; the transceiver is used to send and receive data under the control of the processor; the processor is used to read the computer program in the memory and execute the steps of the network registration method, or execute the steps of the PDU session establishment method.

[0035] In a sixteenth aspect, embodiments of this application provide an electronic device, including a processor and a memory storing a computer program, wherein the processor executes the program to implement the steps of a network registration method or a PDU session establishment method.

[0036] In a seventeenth aspect, embodiments of this application provide a non-transitory computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of a network registration method or the steps of a PDU session establishment method.

[0037] In an eighteenth aspect, embodiments of this application provide a computer program product, including a computer program, wherein when the computer program is executed by a processor, it implements the steps of a network registration method or a PDU session establishment method.

[0038] The network registration method and apparatus provided in this application embodiment act as a core protocol conversion hub in the authentication process through the first network function (N3IWF). It converts the authentication request messages issued by the second network function of the 5G core network, which are not natively recognized by the terminal, into a terminal-compatible format in real time, and converts the terminal's response messages into a 5G core network-compatible format in reverse. Thus, without changing the existing terminal (especially 4G modules that only support traditional protocol stacks) hardware and protocol stack, it cleverly solves the interoperability problem between the terminal and the 5G enhanced security authentication mechanism. Attached Figure Description

[0039] Figure 1 This is a schematic diagram illustrating the functional extension of the N3IWF provided in the embodiments of this application.

[0040] Figure 2 This is one of the flowcharts of the network registration method provided in the embodiments of this application.

[0041] Figure 3 This is the second flowchart of the network registration method provided in the embodiments of this application.

[0042] Figure 4 This is the third flowchart of the network registration method provided in the embodiments of this application.

[0043] Figure 5 This is one of the flowcharts of the PDU session establishment method provided in the embodiments of this application.

[0044] Figure 6 This is the second flowchart of the PDU session establishment method provided in the embodiments of this application.

[0045] Figure 7 This is the third flowchart of the PDU session establishment method provided in the embodiments of this application.

[0046] Figure 8 This is one of the structural schematic diagrams of the network registration device provided in the embodiments of this application.

[0047] Figure 9 This is the second schematic diagram of the network registration device provided in the embodiments of this application.

[0048] Figure 10 This is the third schematic diagram of the network registration device provided in the embodiments of this application.

[0049] Figure 11 This is one of the structural schematic diagrams of the PDU session establishment device provided in the embodiments of this application.

[0050] Figure 12 This is the second schematic diagram of the structure of the PDU session establishment device provided in the embodiments of this application.

[0051] Figure 13 This is the third schematic diagram of the structure of the PDU session establishment device provided in the embodiments of this application.

[0052] Figure 14 This is a schematic diagram of the structure of a terminal according to an embodiment of this application.

[0053] Figure 15 This is a schematic diagram of the structure of a first network function according to an embodiment of this application.

[0054] Figure 16 This is a schematic diagram of the structure of the second network function according to an embodiment of this application.

[0055] Figure 17 A schematic diagram of the physical structure of an electronic device is provided. Detailed Implementation

[0056] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0057] In this application, "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent three cases: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this document indicates that the preceding and following related objects have an "or" relationship.

[0058] "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or multiple items. For example, at least one of a, b, or c can mean: a, b, c, a and b, a and c, b and c, or a, b, and c, where each of a, b, and c can be an element on its own or a set containing one or more elements.

[0059] In this application, "at least one" refers to one or more. "More than one" refers to two or more. The use of terms like "first," "second," etc., in the embodiments of this application is for illustrative purposes and to distinguish the described objects only. There is no particular order between them, nor does it indicate a specific limitation on the number of entities in the embodiments of this application, and they do not constitute any limitation on the embodiments of this application. For example, "first identifier" and "second identifier" are only used to distinguish identifiers corresponding to different vehicles, and do not indicate that the two identifiers are the same or different.

[0060] In this application, terms such as "exemplary," "in some embodiments," and "in other embodiments" are used to indicate that something is an example, illustration, or description. Any embodiment or design described as "exemplary" in this application should not be construed as being more preferred or advantageous than other embodiments or designs. Rather, the term "exemplary" is used to present the concept in a specific manner.

[0061] In this application, the terms "of," "corresponding (relevant)," "corresponding," and "related" may sometimes be used interchangeably. It should be noted that, unless a distinction is emphasized, their intended meanings are consistent. Similarly, in the embodiments of this application, "communication" and "transmission" may sometimes be used interchangeably. It should be noted that, unless a distinction is emphasized, their intended meanings are consistent. For example, transmission can include sending and / or receiving, and can be a noun or a verb.

[0062] In this application, "equal to" can be used with "less than" or "greater than", but not simultaneously with both. When "equal to" is used with "less than", it applies to the technical solution adopted by "less than". When "equal to" is used with "greater than", it applies to the technical solution adopted by "greater than".

[0063] To facilitate understanding of the technical solution of this application, the following content is now described: The first network function refers to the non-3GPP interoperability function (N3IWF). Given that current 5G terminal modules do not support direct access to the 5G core network via N3IWF, this invention proposes to utilize existing 4G modules and add a processing module to the N3IWF network element to achieve untrusted non-3GPP access to the 5G core network.

[0064] Among them, see Figure 1 , Figure 1This is a functional extension diagram of the N3IWF provided in this application embodiment. The N3IWF adds an authentication service module, as well as a Non-Access Stratum (NAS) and session control module. The authentication service module is mainly responsible for the protocol conversion between Extensible Authentication Protocol - Authentication and Key Agreement (EAP-AKA) and the enhanced version of Extensible Authentication Protocol - Authentication and Key Agreement (EAP-AKA) during the authentication process. It converts the 4G authentication protocol into an authentication method that can be supported by the 5G core network, thereby completing the subsequent authentication actions. Specifically, upon receiving the EAP-AKA authentication request sent by the UE to the network, the authentication service module maps the International Mobile Subscriber Identity (IMSI) to a temporary ID and generates the EAP-AKA. The request in the specified format is forwarded to the core network. The core network returns an EAP-AKA authentication response. The authentication service module converts the response to EAP-AKA format and sends it back to the UE to complete the authentication. The NAS and session control module have two main functions: 1. After receiving the service request from the terminal, it simulates and constructs a 5G NAS message, initiates the 5G registration process, and forwards it to the Access and Mobility Management Function (AMF) through the Next Generation Application Protocol (NGAP) module; 2. It constructs the 5G Protocol Data Unit (PDU) packet data unit session establishment process, completes the 5G PDU session establishment with the 5G core network, and then realizes the GPRS Tunneling Protocol for the User Plane (GTPU) tunnel establishment with the UPF.

[0065] The second network function can be, for example, AMF, and there are no restrictions on this.

[0066] The third network function can be, for example, an authentication server function (AUSF), and there are no restrictions on this.

[0067] The technical solution of this application can be applied to fourth-generation (4G) systems, also known as long-term evolution (LTE) systems; or to fifth-generation (5G) systems, also known as new radio (NR) systems; or to sixth-generation (6G) systems, or seventh-generation (7G) systems, or other future communication systems. The embodiments of this application are not limited in this respect.

[0068] The technical solution of this application is also applicable to different network architectures, including but not limited to relay network architecture, dual-link architecture, vehicle-to-everything (V2X) architecture, device-to-device (D2D) architecture, etc.

[0069] The device in this application embodiment includes network functionality and a terminal.

[0070] The terminal in this application embodiment can also be called a terminal device, which can refer to various forms of user equipment (UE), access terminal, user unit, user station, mobile station, mobile station (MS), remote station, remote terminal, mobile device, user terminal, wireless communication device, user agent, or user device. The terminal can also be a cellular phone, cordless phone, Session Initiation Protocol (SIP) phone, Wireless Local Loop (WLL) station, Personal Digital Assistant (PDA), handheld device with wireless communication capabilities, computing device or other processing device connected to a wireless modem, vehicle-mounted device, wearable device, a terminal in a future 5G network, or a terminal in a future evolved Public Land Mobile Network (PLMN), etc. The terminal can also refer to chips and their products, such as chips, chip modules, etc. This application embodiment does not limit this.

[0071] Figure 2 This is one of the flowcharts of the network registration method provided in the embodiments of this application. For example... Figure 2 As shown, the network registration method provided in this application embodiment may include the following steps: Step 210: The terminal sends a first authentication request message, and correspondingly, the first network function receives the first authentication request message; Step 220: The first network function sends a first authentication request message, and correspondingly, the second network function receives the first authentication request message.

[0072] Step 230: The second network function sends a first request message, and correspondingly, the first network function receives the first request message.

[0073] Step 240: The first network function converts the first request message into a terminal-compatible second request message.

[0074] Step 250: The first network function sends a second request message, and the terminal receives the second request message accordingly.

[0075] Step 260: The terminal generates a first response message based on the second request message; Step 270: The terminal sends a first response message, and correspondingly, the first network function receives the first response message.

[0076] Step 280: Convert the first response message into a second response message that is compatible with the second network function.

[0077] Step 290: The first network function sends a second response message, and correspondingly, the second network function receives the second response message.

[0078] The first authentication request message indicates that network and terminal authentication should be performed based on the target authentication policy. This first request message may be, for example, an IKE authentication (IKE_AUTH) request message. This message carries user identification information and access point name (APN). It indicates that network and terminal authentication should be performed using the Internet Key Exchange Protocol version 2 (EAP over IKEv2 authentication) policy (target authentication policy) by not including the AUTH parameter.

[0079] The first request message could be, for example, an EAP AKA' Challenge, which is an authentication challenge obtained by the AMF from the AUSF.

[0080] In this embodiment of the application, since the terminal cannot be compatible with and recognize the EAP AKA' Challenge, the first network function can convert the EAP AKA' Challenge into a second request message, EAP AKAChallenge, which is compatible with the terminal.

[0081] The first response message can be, for example, an EAP AKA Challenge response. Since the second network function on the core network side is not compatible with the first response message, the first network function can convert the first response message into a second response message (EAP AKA Challenge response) that is compatible with the second network function.

[0082] The network registration method in this application embodiment cleverly solves the incompatibility problem between traditional terminals (which only support EAP AKA) and advanced 5G core networks (which use enhanced EAP AKA) by performing intelligent bidirectional conversion between EAP AKA' and EAP AKA protocols at untrusted non-3GPP access points (N3IWF). This enables terminals to securely and seamlessly access 5G networks through untrusted access such as Wi-Fi without the need for terminal upgrades or modifications, allowing operators to smoothly promote network upgrades using the existing terminal ecosystem.

[0083] Figure 3 This is the second flowchart of the network registration method provided in the embodiments of this application. For example... Figure 3 As shown, the network registration method provided in this application embodiment may include the following steps: Step 310: The third network function sends an authentication success message, and correspondingly, the second network function receives the authentication success message. Step 320: The second network function sends an authentication success message, and correspondingly, the first network function receives the authentication success message.

[0084] Step 330: The first network function sends an authentication success message, and the terminal receives the authentication success message accordingly.

[0085] Step 340: The third network function sends an initial context establishment request, and correspondingly, the second network function receives the initial context establishment request.

[0086] Step 350: The second network function sends an initial context establishment request, and correspondingly, the first network function receives the initial context establishment request.

[0087] Step 360: The terminal sends a second authentication request message, and correspondingly, the first network function receives the second authentication request message.

[0088] Step 370: The first network function verifies AUTH.

[0089] Step 380: If the AUTH verification passes, the first network function sends an initial context establishment response, and the second network function receives the initial context establishment response accordingly.

[0090] The authentication success message indicates that the two-way authentication between the terminal and the network has been successful.

[0091] The initial context establishment request is used to instruct the first network function to establish an access layer security context with the terminal, and carries access layer resource configuration parameters.

[0092] The initial context establishment response is used to indicate that the access layer security context has been established.

[0093] The second authentication request message includes the authentication parameter AUTH, which can be specifically, for example, an IKE_AUTH request (including the AUTH parameter).

[0094] The network registration method in this application embodiment solves the problem of incompatibility between the authentication protocol between the terminal and the 5G core network by performing bidirectional protocol conversion (EAP AKA'↔EAP AKA) during the authentication phase through the first network function (N3IWF). After successful authentication, it acts as a security proxy to coordinate the establishment and verification of the indirect access layer security context between the terminal and the network (by verifying the AUTH parameter). This allows traditional terminals to obtain the same security authentication experience and service continuity guarantee as 3GPP access through untrusted access such as Wi-Fi without modification.

[0095] Figure 4 This is the third flowchart of the network registration method provided in the embodiments of this application, such as... Figure 4 As shown, the network registration method provided in this application embodiment may include the following steps: Step 1a: The UE connects to the untrusted non-3GPP access network through any appropriate authentication procedure and is assigned an IP address; Step 1b: The UE selects the N3IWF network element and obtains its IP address information; Step 2: The UE and N3IWF exchange the first pair of messages to negotiate the encryption algorithm, etc. Step 3: The UE sends an IKE_AUTH authentication parameter request message to the N3IWF, carrying the user identification information IMSI and APN access point name information; by not including the AUTH parameter, it indicates that the EAP over IKEv2 authentication process is used; Step 4: N3IWF constructs N1 and N2 messages and sends a registration request message to AMF; Step 5: The AMF and N3IWF complete the exchange of user identification and other information; Steps 6a-6c: AMF and AUSF conduct AAA certification and return the results to the N3IWF EAP AKA' Challenge; Step 6d: N3IWF converts the EAP AKA' Challenge into an EAP AKA Challenge and sends it to the UE; Step 6e: The UE sends an EAP AKA Challenge response message to the N3IWF; Step 6f: N3IWF converts the EAP AKA Challenge response into an EAP AKA' Challenge and sends it to AMF; Steps 6g-6h: AMF interacts with AUSF to receive the EAP AKA' Challenge response message and obtains the result of successful EAP authentication; Steps 7a-7b: The AMF and N3IWF complete the authentication success message exchange and exchange security information; Step 8a: The AMF sends an Initial Context Setup Request message to the N3IWF; Step 9a: The UE sends an IKE_AUTH message request, carrying the AUTH parameter; Step 9b: N3IWF sends an Initial Context Setup response to AMF.

[0096] Figure 5 This is one of the flowcharts for the PDU session establishment method provided in the embodiments of this application. For example... Figure 5 As shown, the PDU session establishment method provided in this application embodiment may include the following steps: Step 510: The terminal sends a PDU session establishment request, and correspondingly, the first network function receives the PDU session establishment request. Step 520: The first network function sends a PDU session establishment request, and correspondingly, the second network function receives the PDU session establishment request.

[0097] Step 530: The second network function sends a PDU session establishment request, and correspondingly, the fourth network function receives the PDU session establishment request. Step 550: The fourth network function sends a PDU session request, and correspondingly, the second network function receives the PDU session request. Step 550: The second network function sends a PDU session request, and correspondingly, the first network function receives the PDU session request.

[0098] Step 560: The first network function determines the first number of sub-security associations (SAs) that need to be established with the terminal based on the QoS information.

[0099] Step 570: The first network function establishes a first number of SAs between the first network function and the terminal.

[0100] The fourth network function can be any other network function, such as SMF, etc., without restriction.

[0101] In other words, in this embodiment of the application, the UE that has completed registration and NAS security establishment sends a PDU session establishment request to the N3IWF.

[0102] In this embodiment of the application, N3IWF converts the request into N1 interface message / N2 interface message (N1 / N2 message), and forwards it to SMF responsible for session management through AMF.

[0103] In this embodiment, after receiving QoS information from other network functions, the N3IWF analyzes it. Based on the number and characteristics of the Quality of Service (QoS) flows (e.g., whether Guaranteed Bit Rate (GBR) is required, different priorities, etc.), it decides how many IPsec sub-security associations (SAs) need to be established with the UE.

[0104] In this embodiment, the N3IWF conducts one or more rounds of IKEv2 exchange with the UE based on the "first number" determined in the decision. Each exchange negotiates a new pair of child SAs, and the first number of child SAs are established sequentially.

[0105] The PDU session establishment method in this application enhances the functionality of N3IWF, enabling it to make intelligent decisions based on the refined QoS policies (such as different priorities and guaranteed bit rate requirements) issued by the 5G core network and dynamically establish multiple IPsec child security associations (Child SAs) with the terminal. This allows for the construction of multiple logically independent and differentiated data transmission channels within a unified IPSec tunnel for untrusted non-3GPP access, successfully extending the end-to-end QoS assurance capabilities of the 5G network to access links such as Wi-Fi. This achieves an effective unification of security encryption and service-level QoS assurance, providing a reliable and high-quality seamless converged access experience for vertical industry applications.

[0106] Figure 6 This is the second flowchart of the PDU session establishment method provided in the embodiments of this application. Figure 6 As shown, the PDU session establishment method provided in this application embodiment may include the following steps: Step 610: The first network function generates a PDU session response; Step 620: The first network function sends a PDU session response, and correspondingly, the second network function receives the PDU session response.

[0107] Step 630: Map the Quality of Service (QoS) stream to the established sub-SA for transmission.

[0108] In this embodiment, during the data transmission phase, the N3IWF performs a crucial mapping function. It maps each QoS flow issued by other network functions to a previously established corresponding sub-SA for transmission, based on its priority and characteristics. This allows high-priority service data to be transmitted in independent, protected IPsec sub-tunnels, achieving better quality of service guarantees.

[0109] The PDU session establishment method in this application enhances N3IWF to perform a key step of mapping the fine-grained Quality of Service (QoS) flow issued by the core network to the corresponding sub-SA for transmission, based on the dynamic establishment of multiple IPsec sub-SAs. This enables the construction of a data channel with both strong security and service-level differentiation guarantee capabilities for existing terminal modules that only support 4G protocols on untrusted Wi-Fi and other access links. Ultimately, without the need for terminal upgrades, it achieves unified and high-quality management of heterogeneous converged access by the 5G core network, effectively solving the dual technical challenges of terminal compatibility barriers and fragmented end-to-end QoS guarantee capabilities faced by existing technologies.

[0110] Figure 7 This is the third flowchart of the PDU session establishment method provided in the embodiments of this application, as follows: Figure 7 As shown, the PDU session establishment method provided in this application embodiment may include the following steps: Step 0: An IPSEC SA has been successfully established for NAS messages; Step 1: After the registration process is completed, N3IWF constructs a PDU Session Establishment Request and sends it to AMF; Steps 2a-2b: The AMF completes the PDU establishment process with other network elements and sends an N2 PDU SessionRequest back to the N3IWF; Step 3: 3IWF decides the number of IPsec sub-SAs to be established between the UE; Step 4: The N3IWF and UE interact to establish the first IPsec sub-SA; Steps 4c-4d: As in step 3, if the decision is made to establish multiple IPsec sub-SAs, other sub-SAs will continue to be established with the UE; Step 5: The N3IWF sends a notification to the UE that the service tunnel establishment request has been completed; Step 6: The N3IWF sends an N2 PDU Session Response message to the AMF; Step 7: The AMF completes the subsequent process of PDU establishment with other network elements; Steps 8a-8b: Establish QoS flow between N3IWF and UE on IPSEC subSA.

[0111] The network registration device provided in the embodiments of this application will be described below. The network registration device described below can be referred to in correspondence with the network registration method described above and can achieve the same technical effect, so it will not be repeated here.

[0112] Figure 8 This is one of the structural schematic diagrams of the network registration device provided in the embodiments of this application, such as... Figure 8 As shown, the device may include: The first receiving module 801 is used to receive a first authentication request message sent by the terminal, wherein the first authentication request message indicates that the network and the terminal are authenticated based on the target authentication policy; The first sending module 802 is used to send the first authentication request message to the second network function; The second receiving module 803 is used to receive a first request message sent by the second network function, wherein the first request message is used to indicate the triggering of two-way authentication between the network and the terminal; The first conversion module 804 is used to convert the first request message into a terminal-compatible second request message; The second sending module 805 is used to send the second request message to the terminal; The third receiving module 806 is used to receive a first response message sent by the terminal, wherein the first response message is used to indicate that the network and the terminal are legitimate. The second conversion module 807 is used to convert the first response message into a second response message that is compatible with the second network function. The third sending module 808 is used to send a second response message to the second network function.

[0113] In one embodiment, the network registration device 80 further includes: The thirteenth receiving module (not shown in the figure) is used to receive the authentication success message sent by the second network function, wherein the authentication success message is used to indicate that the two-way identity authentication between the terminal and the network is successful. The eleventh sending module (not shown in the figure) is used to send an authentication success message to the terminal.

[0114] In one embodiment, the network registration device further includes: The fourteenth receiving module (not shown in the figure) is used to receive the initial context establishment request sent by the second network function. The initial context establishment request is used to instruct the first network function to establish an access layer security context with the terminal and carries access layer resource configuration parameters. The fifteenth receiving module (not shown in the figure) is used to receive the second authentication request message sent by the terminal, wherein the second authentication request message includes: authentication parameter AUTH; The verification module (not shown in the figure) is used to verify AUTH. If the AUTH verification passes, it sends an initial context establishment response to the second network function. The initial context establishment response is used to indicate that the access layer security context has been established.

[0115] Figure 9 This is a second schematic diagram of the network registration device provided in the embodiments of this application, as shown below. Figure 9 As shown, the device may include: The fourth receiving module 901 is used to receive a first authentication request message sent by the first network function, wherein the first authentication request message indicates that the network and the terminal are authenticated based on the target authentication policy; The fourth sending module 902 is used to send a first authentication request message to the third network function; The fifth receiving module 903 is used to receive the second response message sent by the first network function; The fifth sending module 904 is used to send a second response message to the third network function.

[0116] In one embodiment, the network registration device further includes: The sixteenth receiving module (not shown in the figure) is used to receive the authentication success message sent by the third network function. The authentication success message is used to indicate that the response RES parameter in the second response message meets the preset parameter threshold. The twelfth sending module (not shown in the figure) is used to send an authentication success message to the first network function.

[0117] In one embodiment, the network registration device further includes: The seventeenth receiving module (not shown in the figure) is used to receive the initial context establishment request sent by the third network function, wherein the initial context establishment request is used to indicate the establishment of an access layer context; The thirteenth sending module (not shown in the figure) is used to send an initial context establishment request to the first network function; The eighteenth receiving module (not shown in the figure) is used to receive the initial context establishment response sent by the first network function, wherein the initial context establishment response is used to indicate that the access layer security context has been established.

[0118] Figure 10 This is the third schematic diagram of the network registration device provided in the embodiments of this application, as shown below. Figure 10 As shown, the device may include: The sixth sending module 1001 is used to send a first authentication request message to the first network function, wherein the first authentication request message is used to trigger two-way identity authentication between the terminal and the network; The sixth receiving module 1002 is used to receive the second request message sent by the first network function, wherein the second request message is a message used by the terminal to request verification of whether the network is legitimate; The first generation module 1003 is used to generate a first response message based on the second request message, wherein the first response message is used to indicate that the network and terminal identities are legitimate; The seventh sending module 1004 is used to send the first response message to the first network function.

[0119] In one embodiment, the network registration device further includes: The nineteenth receiving module (not shown in the figure) is used to receive the authentication success message sent by the first network function, wherein the authentication success message is used to indicate that the two-way identity authentication between the terminal and the network is successful. The fourteenth sending module (not shown in the figure) is used to send a second authentication request message to the first network function, wherein the second authentication request message includes the AUTH parameter.

[0120] Figure 11 This is one of the structural schematic diagrams of the PDU session establishment device provided in the embodiments of this application, such as... Figure 11 As shown, the device may include: The seventh receiving module 1101 is used to receive the PDU session establishment request sent by the terminal; The eighth sending module 1102 is used to send a PDU session establishment request to the second network function; The eighth receiving module 1103 is used to receive a PDU session request sent by the second network function, wherein the PDU session request includes: Quality of Service (QoS) information; The determination module 1104 is used to determine the first number of sub-security associations (SAs) that need to be established with the terminal based on the QoS information. Establish module 1105 for establishing a first number of SAs between a first network function and a terminal.

[0121] In one embodiment, the PDU session establishment apparatus further includes: The twentieth receiving module (not shown in the figure) is used to generate a PDU session response, wherein the PDU session response is used to indicate that the network-side session resources have been configured. The sixteenth sending module (not shown in the figure) is used to send a PDU session response to the second network function, wherein the PDU session response includes: access network side channel information provided by the first network function.

[0122] In one embodiment, the PDU session establishment apparatus further includes: The mapping module (not shown in the figure) is used to map the Quality of Service (QoS) stream to the established sub-SA for transmission.

[0123] Figure 12 This is a second schematic diagram of the structure of the PDU session establishment device provided in the embodiments of this application, as shown below. Figure 12 As shown, the device may include: The ninth receiving module 1201 is used to receive the PDU session establishment request sent by the first network function; The ninth sending module 1202 is used to send a PDU session establishment request to the fourth network function; The tenth receiving module 1203 is used to receive a PDU session request sent by the fourth network function, wherein the PDU session request includes: Quality of Service (QoS) information; The tenth sending module 1204 is used to send a PDU session request to the first network function.

[0124] In one embodiment, the PDU session establishment apparatus further includes: The twenty-first receiving module (not shown in the figure) is used to receive the PDU session response sent by the first network function, wherein the PDU session response includes: access network side channel information provided by the first network function.

[0125] Figure 13 This is the third schematic diagram of the structure of the PDU session establishment device provided in the embodiments of this application, as shown below. Figure 13 As shown, the device may include: The eleventh receiving module 1301 is used to send a PDU session establishment request to the first network function.

[0126] Figure 14 This is a schematic diagram of the terminal structure according to an embodiment of this application, with reference to... Figure 14 This application embodiment also provides a terminal, which may include: a memory 1410, a transceiver 1420 and a processor 1430; Memory 1410 is used to store computer programs; transceiver 1420 is used to send and receive data under the control of processor 1430; processor 1430 is used to read the computer program in memory 1410 and perform the following operations: Send a first authentication request message to the first network function, wherein the first authentication request message is used to trigger two-way authentication between the terminal and the network; Receive a second request message sent by the first network function, wherein the second request message is a message used by the terminal to request verification of whether the network is legitimate; Based on the second request message, a first response message is generated, wherein the first response message is used to indicate that the network and terminal identities are legitimate; Send the first response message to the first network function; Alternatively, perform the following operation: send a PDU session establishment request to the first network function.

[0127] Among them, Figure 14 In this context, the bus architecture can include any number of interconnected buses and bridges, specifically linking various circuits together, such as one or more processors represented by processor 1430 and memory represented by memory 1410. The bus architecture can also link together various other circuits, such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. The bus interface provides an interface. Transceiver 1420 can be multiple elements, including transmitters and receivers, providing a unit for communicating with various other devices over a transmission medium. For different user equipment, user interface 1440 can also be an interface capable of connecting external or internal devices as needed.

[0128] Processor 1430 is responsible for managing the bus architecture and general processing, while memory 1410 can store data used by processor 1430 when performing operations.

[0129] The processor 1430 executes any of the methods provided in the embodiments of this application according to the obtained executable instructions by calling a computer program stored in the memory 1410. The processor and the memory may also be physically separated.

[0130] Figure 15 This is a schematic diagram of the structure of the first network function according to an embodiment of this application, with reference to... Figure 15 This application embodiment also provides a first network function, which may include: a memory 1510, a transceiver 1520, and a processor 1530; Memory 1510 is used to store computer programs; transceiver 1520 is used to send and receive data under the control of processor 1530; processor 1530 is used to read the computer program in memory 1510 and perform the following operations: The receiving terminal sends a first authentication request message, wherein the first authentication request message indicates that the network and the terminal are authenticated based on the target authentication policy; Send the first authentication request message to the second network function; Receive a first request message sent by the second network function, wherein the first request message is used to indicate the triggering of two-way authentication between the network and the terminal; Convert the first request message into a terminal-compatible second request message; Send the second request message to the terminal; The receiving terminal sends a first response message, wherein the first response message is used to indicate that the network and the terminal are legitimate; Convert the first response message into a second response message that is compatible with the second network function; Send a second response message to the second network function; Alternatively, perform the following operation: receive a PDU session establishment request sent by the terminal; Send a PDU session establishment request to the second network function; Receive a PDU session request sent by the second network function, wherein the PDU session request includes: Quality of Service (QoS) information; Based on the QoS information, determine the first number of sub-security associations (SAs) that need to be established with the terminal; Establish the first number of SAs between the first network function and the terminal.

[0131] Among them, Figure 15 In this context, the bus architecture may include any number of interconnected buses and bridges, specifically linking various circuits together, represented by one or more processors (processor 1530) and memory (memory 1510). The bus architecture may also link together various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. The bus interface provides an interface. The transceiver 1520 may be multiple elements, including transmitters and receivers, providing a unit for communicating with various other devices over a transmission medium. The processor 1530 is responsible for managing the bus architecture and general processing, and the memory 1510 may store data used by the processor 1530 during operation.

[0132] Figure 16 This is a schematic diagram of the structure of the second network function according to an embodiment of this application, with reference to... Figure 16 This application embodiment also provides a second network function, which may include: a memory 1610, a transceiver 1620 and a processor 1630; The memory 1610 is used to store computer programs; the transceiver 1620 is used to send and receive data under the control of the processor 1630; the processor 1630 is used to read the computer program in the memory 1610 and perform the following operations: Receive a first authentication request message sent by a first network function, wherein the first authentication request message indicates that network and terminal identity authentication is performed based on a target authentication policy; Send a first authentication request message to the third network function; Receive the second response message sent by the first network function; Send a second response message to the third network function; Alternatively, perform the following operation: Receive a PDU session establishment request sent by the first network function; Send a PDU session establishment request to the fourth network function; Receive a PDU session request sent by the fourth network function, wherein the PDU session request includes: Quality of Service (QoS) information; Send a PDU session request to the first network function.

[0133] Among them, Figure 16 In this context, the bus architecture can include any number of interconnected buses and bridges, specifically linking various circuits together, represented by one or more processors (processor 1630) and memory (memory 1610). The bus architecture can also link various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. The bus interface provides an interface. The transceiver 1620 can be multiple elements, including transmitters and receivers, providing a unit for communicating with various other devices over a transmission medium. The processor 1630 is responsible for managing the bus architecture and general processing, and the memory 1610 can store data used by the processor 1630 during operation.

[0134] It should be noted that the terminal and network functions provided in this application embodiment can implement all the method steps implemented in the above method embodiment and can achieve the same technical effect. Therefore, the parts and beneficial effects that are the same as those in the method embodiment will not be described in detail here.

[0135] Figure 17 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 17 As shown, the electronic device may include a processor 1710, a communication interface 1720, a memory 1730, and a communication bus 1740, wherein the processor 1710, the communication interface 1720, and the memory 1730 communicate with each other via the communication bus 1740. The processor 1710 may call a computer program in the memory 1730 to execute the steps of the network registration method, or execute the steps of the network registration method.

[0136] Furthermore, the logical instructions in the aforementioned memory 1730 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0137] On the other hand, this application also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can perform the steps of the network registration method provided in the above embodiments, or perform the steps of the PDU session establishment method.

[0138] On the other hand, embodiments of this application also provide a processor-readable storage medium storing a computer program that enables a processor to execute the steps of the network registration method provided in the above embodiments, or to execute the steps of the PDU session establishment method.

[0139] Processor-readable storage media can be any available medium or data storage device that the processor can access, including but not limited to magnetic storage (such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MOs), etc.), optical storage (such as CDs, DVDs, BDs, HVDs, etc.), and semiconductor storage (such as ROMs, EPROMs, EEPROMs, non-volatile memory (NAND flash), solid-state drives (SSDs)).

[0140] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0141] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of various embodiments or some parts of embodiments.

[0142] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A network registration method, characterized in that, Performed by a first network function, the method includes: The receiving terminal sends a first authentication request message, wherein the first authentication request message indicates that the network and the terminal are authenticated based on a target authentication policy; Send the first authentication request message to the second network function; Receive a first request message sent by the second network function, wherein the first request message is used to indicate triggering two-way authentication between the network and the terminal; Convert the first request message into a terminal-compatible second request message; Send the second request message to the terminal; The receiving terminal sends a first response message, wherein the first response message is used to indicate that the network and the terminal are legitimate; Convert the first response message into a second response message that is compatible with the second network function; Send the second response message to the second network function.

2. The method according to claim 1, characterized in that, The method further includes: Receive an authentication success message sent by the second network function, wherein the authentication success message is used to indicate that the two-way identity authentication between the terminal and the network is successful; Send the authentication success message to the terminal.

3. The method according to claim 1, characterized in that, The method further includes: The system receives an initial context establishment request sent by the second network function, wherein the initial context establishment request is used to instruct the first network function to establish an access layer security context with the terminal and carries access layer resource configuration parameters. The receiving terminal sends a second authentication request message, wherein the second authentication request message includes: authentication parameter AUTH; The AUTH is verified, and if the AUTH verification passes, an initial context establishment response is sent to the second network function, wherein the initial context establishment response is used to indicate that the access layer security context has been established.

4. A network registration method, characterized in that, Performed by a second network function, the method includes: Receive a first authentication request message sent by the first network function, wherein the first authentication request message indicates that the network and the terminal are authenticated based on the target authentication policy; Send the first authentication request message to the third network function; Receive the second response message sent by the first network function; Send the second response message to the third network function.

5. The method according to claim 4, characterized in that, The method further includes: Receive the authentication success message sent by the third network function, wherein the authentication success message is used to indicate that the response RES parameter in the second response message meets the preset parameter threshold; Send the authentication success message to the first network function.

6. The method according to claim 4, characterized in that, The method further includes: Receive an initial context establishment request sent by the third network function, wherein the initial context establishment request is used to indicate the establishment of an access layer context; Send an initial context establishment request to the first network function; Receive an initial context establishment response sent by the first network function, wherein the initial context establishment response is used to indicate that an access layer security context has been established.

7. A network registration method, characterized in that, The method, executed by a terminal, includes: Send a first authentication request message to a first network function, wherein the first authentication request message is used to trigger two-way identity authentication between the terminal and the network; Receive a second request message sent by the first network function, wherein the second request message is a message used by the terminal to request verification of whether the network is legitimate; Based on the second request message, a first response message is generated, wherein the first response message is used to indicate that the network and terminal identities are legitimate; Send the first response message to the first network function.

8. The method according to claim 7, characterized in that, The method further includes: Receive an authentication success message sent by the first network function, wherein the authentication success message is used to indicate that the two-way identity authentication between the terminal and the network is successful; Send a second authentication request message to the first network function, wherein the second authentication request message includes the AUTH parameter.

9. A method for establishing a PDU session, characterized in that, Performed by a first network function, the method includes: Receive a PDU session establishment request sent by the terminal; Send the PDU session establishment request to the second network function; Receive a PDU session request sent by the second network function, wherein the PDU session request includes: Quality of Service (QoS) information; Based on the QoS information, determine the first number of sub-security associations (SAs) that need to be established with the terminal; Establish the first number of SAs between the first network function and the terminal.

10. The method according to claim 9, characterized in that, The method further includes: Generate a PDU session response, wherein the PDU session response is used to indicate that the network-side session resources have been configured. Send a PDU session response to the second network function, wherein the PDU session response includes: access network side channel information provided by the first network function.

11. The method according to claim 9, characterized in that, The method further includes: The Quality of Service (QoS) stream is mapped to the established sub-SA for transmission.

12. A method for establishing a PDU session, characterized in that, Performed by a second network function, the method includes: Receive a PDU session establishment request sent by the first network function; Send a PDU session establishment request to the fourth network function; Receive a PDU session request sent by the fourth network function, wherein the PDU session request includes: Quality of Service (QoS) information; Send the PDU session request to the first network function.

13. The method according to claim 12, characterized in that, The method further includes: Receive a PDU session response sent by a first network function, wherein the PDU session response includes: access network side channel information provided by the first network function.

14. A method for establishing a PDU session, characterized in that, The method, executed by a terminal, includes: Send a PDU session establishment request to the first network function.

15. A network registration device, characterized in that, The device includes: The first receiving module is configured to receive a first authentication request message sent by the terminal, wherein the first authentication request message indicates that the network and the terminal are authenticated based on a target authentication policy; The first sending module is used to send the first authentication request message to the second network function; The second receiving module is used to receive a first request message sent by the second network function, wherein the first request message is used to indicate the triggering of two-way authentication between the network and the terminal; The first conversion module is used to convert the first request message into a terminal-compatible second request message; The second sending module is used to send the second request message to the terminal; The third receiving module is used to receive a first response message sent by the terminal, wherein the first response message is used to indicate that the network and the terminal are legitimate. The second conversion module is used to convert the first response message into a second response message that is compatible with the second network function; The third sending module is used to send the second response message to the second network function.

16. A network registration device, characterized in that, include: The fourth receiving module is used to receive the first authentication request message sent by the first network function, wherein the first authentication request message indicates that the network and the terminal are authenticated based on the target authentication policy; The fourth sending module is used to send the first authentication request message to the third network function; The fifth receiving module is used to receive the second response message sent by the first network function; The fifth sending module is used to send the second response message to the third network function.

17. A network registration device, characterized in that, include: The sixth sending module is used to send a first authentication request message to the first network function, wherein the first authentication request message is used to trigger two-way identity authentication between the terminal and the network; The sixth receiving module is used to receive the second request message sent by the first network function, wherein the second request message is a message used by the terminal to request verification of whether the network is legitimate; The first generation module is configured to generate a first response message based on the second request message, wherein the first response message is used to indicate that the network and terminal identities are legitimate; The seventh sending module is used to send the first response message to the first network function.

18. A PDU session establishment device, characterized in that, The device includes: The seventh receiving module is used to receive PDU session establishment requests sent by the terminal; The eighth sending module is used to send the PDU session establishment request to the second network function; The eighth receiving module is used to receive a PDU session request sent by the second network function, wherein the PDU session request includes: Quality of Service (QoS) information; The determining module is used to determine, based on the QoS information, a first number of sub-security associations (SAs) that need to be established with the terminal; A module is established to establish the first number of SAs between the first network function and the terminal.

19. A PDU session establishment device, characterized in that, include: The ninth receiving module is used to receive the PDU session establishment request sent by the first network function; The ninth sending module is used to send a PDU session establishment request to the fourth network function; The tenth receiving module is used to receive the PDU session request sent by the fourth network function, wherein the PDU session request includes: Quality of Service (QoS) information; The tenth sending module is used to send the PDU session request to the first network function.

20. A PDU session establishment device, characterized in that, include: The eleventh receiving module is used to send a PDU session establishment request to the first network function.

21. A terminal, characterized in that, Includes memory, transceiver, and processor: Memory, used to store computer programs; A transceiver is used to send and receive data under the control of the processor; the processor is used to read the computer program in the memory and execute the steps of the network registration method according to any one of claims 7 to 8, or execute the steps of the PDU session establishment method according to claim 14.

22. A first network function, characterized in that, Includes memory, transceiver, and processor: Memory, used to store computer programs; A transceiver is used to send and receive data under the control of the processor; the processor is used to read the computer program in the memory and execute the steps of the network registration method according to any one of claims 7 to 8, or execute the steps of the PDU session establishment method according to any one of claims 7 to 11.

23. A second network function, characterized in that, Includes memory, transceiver, and processor: A memory for storing a computer program; a transceiver for sending and receiving data under the control of the processor; a processor for reading the computer program in the memory and executing the steps of the network registration method according to any one of claims 4 to 6, or executing the steps of the PDU session establishment method according to any one of claims 12 to 13.

24. An electronic device comprising a processor and a memory storing a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the network registration method according to any one of claims 1 to 8, or the steps of the PDU session establishment method according to any one of claims 9 to 14.

25. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the network registration method according to any one of claims 1 to 8, or the steps of the PDU session establishment method according to any one of claims 9 to 14.

26. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the network registration method according to any one of claims 1 to 8, or the steps of the PDU session establishment method according to any one of claims 9 to 14.

Images