Communication method, communication device and communication system

Abstract

The invention provides a communication method, a communication device and a communication system. The method comprises the following steps: a user plane network element can obtain identity information of each application function network element in at least one application function network element in advance, and when a service request is received subsequently, the service request is sent to the user plane network element on the basis of the identity information of each application function network element in the at least one application function network element and address information of the application function network element carried in the service request; and judging whether MASQUE connection with the application function network element can be established or not. Therefore, according to the scheme, the MSAQUE connection is established on demand, and the service message is transmitted through the established MASQUE connection instead of establishing and maintaining the MASQUE connection in advance before the service request is received, so that the resource overhead of a user plane network element can be reduced, the MASQUE connection can be prevented from being attacked due to long-time exposure, and the security of the MSAQUE connection is improved.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a communication method, communication device and communication system. Background Technology

[0002] User plane network elements support the awareness of address information of application function network elements, and can establish multiplexed application substrate over QUIC encryption (MASQUE) connections with application function network elements based on the awareness of their address information. Here, QUIC refers to Quick UDP internet connections.

[0003] Currently, after the user plane network element senses the address information of the application function network element, it immediately establishes and maintains a MASQUE connection between the user plane network element and the application function network element. The MASQUE connection can be used for service transmission when needed.

[0004] The problem with the above approach is that user plane network elements need to maintain a large number of MASQUE connections for a long time, which not only brings significant resource overhead to user plane network elements, but also exposes MASQUE connections for a long time, making them vulnerable to attacks. Summary of the Invention

[0005] This application provides a communication method, communication device, and communication system to reduce the resource overhead of user plane network elements and improve the security of MSAQUE connections.

[0006] In a first aspect, embodiments of this application provide a communication method that can be applied to the network side, such as user plane network elements, modules (e.g., circuits, chips, or chip systems) within user plane network elements, or logical nodes, logical modules, or software capable of implementing all or part of the functions of user plane network elements. The method includes: obtaining identity information of each application function network element in at least one application function network element, the identity information of each application function network element including at least one address information supporting a MASQUE connection; receiving a first service request from a first terminal, the first service request including address information of the application function network element corresponding to the first service request; and, if the at least one address information supporting a MASQUE connection includes the address information of the application function network element corresponding to the first service request, establishing a first MASQUE connection between the application function network element corresponding to the first service request and the application function network element corresponding to the first service request, based on the address information of the application function network element corresponding to the first service request, the first MASQUE connection being used to transmit service packets corresponding to the first service request.

[0007] Based on the above scheme, user plane network elements can pre-obtain the identity information of each application function network element in at least one application function network element. Subsequently, upon receiving a service request, based on the identity information of each application function network element in the at least one application function network element and the address information of the application function network element carried in the service request, it determines whether a MASQUE connection can be established with that application function network element. Therefore, this scheme realizes the establishment of MSAQUE connections on demand and the transmission of service packets through the established MASQUE connections, instead of establishing and maintaining MASQUE connections in advance before receiving service requests. This reduces the resource overhead of user plane network elements and avoids attacks due to prolonged exposure of MASQUE connections, thus improving the security of MSAQUE connections.

[0008] In one possible implementation, the address information supporting MASQUE connections includes an Internet Protocol (IP) address, or includes an IP address and a port number.

[0009] In one possible implementation, after establishing a first MASQUE connection between the application function network element corresponding to the first service request, the method further includes: establishing a first service flow for the first service request based on the first MASQUE connection, wherein the first service flow is used to transmit the service message corresponding to the first service request.

[0010] In one possible implementation, the method further includes: obtaining first indication information, the first indication information indicating that the first MASQUE connection does not support the establishment of multiple service flows.

[0011] Based on the above scheme, the first indication information explicitly indicates that the first MASQUE connection does not support the establishment of multiple service flows. As a result, subsequent user plane network elements only establish one service flow on the first MASQUE connection, instead of establishing multiple service flows, thus avoiding transmission failure due to incorrect establishment of service flows and saving resource overhead.

[0012] In one possible implementation, the method further includes: receiving a second service request from a second terminal, the second service request including address information of an application function network element corresponding to the second service request; if the address information of the application function network element corresponding to the second service request is the same as the address information of the application function network element corresponding to the first service request, establishing a second MASQUE connection with the application function network element corresponding to the second service request based on the address information of the application function network element corresponding to the second service request and the first indication information, the second MASQUE connection being used to transmit service packets corresponding to the second service request; and establishing a second service flow for the second service request based on the second MASQUE connection, the second service flow being used to transmit service packets corresponding to the second service request.

[0013] Based on this scheme, after establishing a first MASQUE connection between a user plane network element and an application function network element, if a service request is received again, and the application function network element corresponding to this service request is the same as the application function network element corresponding to the first MASQUE connection, and the address information of the application function network element corresponding to this service request is the same as the address information of the application function network element corresponding to the first MASQUE connection, but the first MASQUE connection does not support the establishment of multiple service flows, then the user plane network element will establish a second MASQUE connection between the user plane network element and the application function network element for this service request. In this method, each MASQUE connection is used to transmit only one service flow, which can guarantee the transmission quality and latency of the service flow and improve the service experience.

[0014] In one possible implementation, the first service request includes tuple information corresponding to the first service, and the tuple information includes address information of the application function network element corresponding to the first service request; the method further includes: determining first mapping information, the first mapping information being used to indicate the mapping relationship between the tuple information corresponding to the first service request and the first MASQUE connection, or the first mapping information being used to indicate the mapping relationship between the tuple information corresponding to the first service request, the address information of the application function network element corresponding to the first service request, and the first MASQUE connection; the first mapping information is used to forward the service packet corresponding to the first service request transmitted between the first terminal and the application function network element corresponding to the first service request.

[0015] Based on the above scheme, by establishing the first mapping information, a mapping relationship can be established between the first MASQUE connection and the tuple information corresponding to the first service request. Subsequently, user plane network elements can forward service packets transmitted between the first terminal and the application function network elements based on the first mapping information, which helps to achieve the correct transmission of service packets.

[0016] In one possible implementation, the method further includes: receiving a service message corresponding to the first service request from an application function network element corresponding to the first service request via the first MASQUE connection; and sending the service message corresponding to the first service request to the first terminal according to the first mapping information.

[0017] Based on the above scheme, user plane network elements can forward service packets transmitted between terminals and application function network elements based on the first mapping relationship, which helps to achieve correct transmission of service packets.

[0018] In one possible implementation, the method further includes: obtaining second indication information, the second indication information indicating that the first MASQUE connection supports the establishment of multiple service flows.

[0019] Based on the above scheme, the second indication information explicitly indicates that the first MASQUE connection supports the establishment of multiple service flows, so that subsequent user plane network elements can establish multiple service flows on the first MASQUE connection, which helps to improve the utilization of the MASQUE connection and thus save resource overhead.

[0020] In one possible implementation, the method further includes: receiving a second service request from a second terminal, the second service request including address information of an application function network element corresponding to the second service request; if the address information of the application function network element corresponding to the second service request is the same as the address information of the application function network element corresponding to the first service request, establishing a second service flow for the second service request based on the first MASQUE connection and the second indication information, the second service flow being used to transmit service packets corresponding to the second service request.

[0021] Based on this scheme, after establishing a first MASQUE connection between a user plane network element and an application function network element, if a service request is received again, and the application function network element corresponding to this service request is the same as the application function network element corresponding to the first MASQUE connection, and the address information of the application function network element corresponding to this service request is the same as the address information of the application function network element corresponding to the first MASQUE connection, and the first MASQUE connection supports the establishment of multiple service flows, then the user plane network element does not need to create a new MASQUE connection between itself and the application function network element for this service request. Instead, it creates a new service flow corresponding to the second service request on the first MASQUE connection. In this method, each MASQUE connection can be used to transmit multiple service flows, which can improve resource utilization and save resources.

[0022] In one possible implementation, the first service request includes tuple information corresponding to the first service, and the tuple information includes address information of the application function network element corresponding to the first service request; the method further includes: determining second mapping information, the second mapping information being used to indicate the mapping relationship between the tuple information corresponding to the first service request and the first service flow, or the second mapping information being used to indicate the mapping relationship between the tuple information corresponding to the first service request, the address information of the application function network element corresponding to the first service request, and the first service flow; the second mapping information is used to forward the service packets of the first service flow corresponding to the first service request transmitted between the first terminal and the application function network element corresponding to the first service request.

[0023] Based on the above scheme, by establishing the second mapping information, a mapping relationship can be established between the first service flow and the tuple information corresponding to the first service request. Subsequently, the user plane network element can forward the service packets of the first service flow transmitted between the first terminal and the application function network element based on the second mapping information, which helps to achieve the correct transmission of service packets.

[0024] In one possible implementation, the method further includes: receiving a service packet corresponding to the first service request from an application function network element corresponding to the first service request via the first MASQUE connection; and sending a service packet of the first service flow corresponding to the first service request to the first terminal according to the second mapping information.

[0025] Based on the above scheme, the user plane network element can forward the service packets of the first service flow transmitted between the first terminal and the application function network element based on the second mapping information, which helps to achieve the correct transmission of service packets.

[0026] In one possible implementation, the method further includes: releasing the first MASQUE connection if no service packets are transmitted in the first MASQUE connection.

[0027] Based on the above scheme, releasing the first MASQUE connection can save the resource overhead caused by maintaining the MASQUE connection for a long time.

[0028] Secondly, embodiments of this application provide a communication method that can be applied to the network side, such as application function network elements, modules (e.g., circuits, chips, or chip systems) within application function network elements, or logical nodes, logical modules, or software capable of implementing all or part of the functions of application function network elements. The method includes: obtaining the identity information of the application function network element, wherein the identity information includes at least one address information supporting MASQUE connections; and sending the identity information of the application function network element to a user plane network element.

[0029] Based on the above scheme, application function network elements can send their identity information to user plane network elements. Subsequently, when a user plane network element receives a service request, it can determine whether a MASQUE connection can be established with that application function network element based on the application function network element's identity information and the address information of the application function network element carried in the service request. Therefore, this scheme achieves on-demand establishment of MASQUE connections and transmission of service packets through established MASQUE connections, rather than establishing and maintaining MASQUE connections in advance before receiving service requests. This reduces the resource overhead of user plane network elements and avoids attacks due to prolonged exposure of MASQUE connections, thus improving the security of MASQUE connections.

[0030] In one possible implementation, the method further includes: sending a first indication message to the user plane network element, the first indication message indicating that the MASQUE connection on the application function network element does not support the establishment of multiple service flows.

[0031] Based on the above scheme, the first indication information explicitly indicates that the first MASQUE connection does not support the establishment of multiple service flows. As a result, subsequent user plane network elements only establish one service flow on the first MASQUE connection, instead of establishing multiple service flows, thus avoiding transmission failure due to incorrect establishment of service flows and saving resource overhead.

[0032] In one possible implementation, the method further includes: sending a second indication message to the user plane network element, the second indication message indicating that the MASQUE connection on the application function network element supports the establishment of multiple service flows.

[0033] Based on the above scheme, the second indication information explicitly indicates that the first MASQUE connection supports the establishment of multiple service flows, so that subsequent user plane network elements can establish multiple service flows on the first MASQUE connection, which helps to improve the utilization of the MASQUE connection and thus save resource overhead.

[0034] In one possible implementation, the address information supporting MASQUE connections includes an IP address, or includes an IP address and a port number.

[0035] Thirdly, this application provides a communication device that has the functions of the first aspect above. For example, the communication device includes modules, units or means corresponding to the operations involved in the first aspect above. The modules, units or means can be implemented by software, or by hardware, or by a combination of software and hardware.

[0036] Fourthly, this application provides a communication device that has the functions of the second aspect above. For example, the communication device includes modules, units or means corresponding to the operations involved in the second aspect above. The modules, units or means can be implemented by software, hardware or a combination of software and hardware.

[0037] Fifthly, this application provides a communication device including an interface circuit and one or more processors. The one or more processors are coupled to a memory. The memory stores part or all of the necessary computer program or instructions for implementing the functions described in the first aspect. The one or more processors can execute the computer program or instructions, causing the communication device to implement the methods in any possible design or implementation of the first aspect. The interface circuit is used to implement the communication functions within the communication device and / or the communication functions between the communication device and other devices or components.

[0038] The aforementioned communication device may be a user plane network element, a module (e.g., a circuit, chip, or chip system) within a user plane network element, or a logic node, logic module, or software capable of implementing all or part of the functions of a user plane network element.

[0039] Sixthly, this application provides a communication device including an interface circuit and one or more processors. The one or more processors are coupled to a memory. The memory stores part or all of the necessary computer program or instructions for implementing the functions described in the second aspect above. The one or more processors are executable to carry out the computer program or instructions, causing the communication device to implement the methods in any possible design or implementation of the second aspect above. The interface circuit is used to implement the communication functions within the communication device and / or the communication functions between the communication device and other devices or components.

[0040] The aforementioned communication device may be an application function network element, a module (e.g., a circuit, chip, or chip system) within an application function network element, or a logic node, logic module, or software capable of implementing all or part of the functions of the application function network element.

[0041] In a seventh aspect, this application provides a computer-readable storage medium storing a computer program or instructions that, when executed, implement the method in any of the possible designs of the first to second aspects described above.

[0042] Eighthly, this application provides a computer program product comprising a computer program or instructions that, when executed, implement the method in any of the possible designs of the first to second aspects described above.

[0043] Ninthly, this application provides a communication system including a user plane network element for performing any possible implementation of the first aspect above, and an application function network element for performing any possible implementation of the second aspect above. Attached Figure Description

[0044] Figure 1 This is a schematic diagram of a service-oriented architecture-based network architecture;

[0045] Figure 2 This is a schematic diagram of the protocol stack structure;

[0046] Figure 3 A flowchart illustrating a communication method provided in an embodiment of this application;

[0047] Figure 4 A flowchart illustrating a communication method provided in an embodiment of this application;

[0048] Figure 5 A flowchart illustrating a communication method provided in an embodiment of this application;

[0049] Figure 6The following is a possible exemplary block diagram of the communication device involved in the embodiments of this application;

[0050] Figure 7 This is a possible exemplary block diagram of the communication device involved in the embodiments of this application. Detailed Implementation

[0051] Figure 1 This is a schematic diagram of a network architecture based on a service-oriented architecture. Figure 1 The network architecture shown may include access network equipment and core network equipment. Terminals access the data network (DN) through the access network equipment and core network equipment. The core network equipment includes, but is not limited to, some or all of the following network elements: authentication server function (AUSF) network element, unified data management (UDM) network element, unified data repository (UDR) network element, network repository function (NRF) network element, network exposure function (NEF) network element, application function (AF) network element, policy control function (PCF) network element, access and mobility management function (AMF) network element, session management function (SMF) network element, and user plane function (UPF) network element.

[0052] It should be noted that the term "network element" can be omitted in the description of the above network elements (such as SMF network elements, UPF network elements, etc.). For example, an SMF network element can be abbreviated as SMF, a UPF network element as UPF, and so on. Furthermore... Figure 1 This abbreviated description is also used in Chinese.

[0053] Access network equipment, sometimes also called RAN nodes, RAN entities, or access nodes, is used to help terminals achieve wireless access.

[0054] In one possible scenario, the access network device can be a base station, an evolved NodeB (eNodeB), an access point (AP), a transmission reception point (TRP), a next-generation NodeB (gNB), a base station in a future mobile communication system, or an access node in a wireless fidelity (WiFi) system. The access network device can be a macro base station, a micro base station, an indoor station, a relay node, or a donor node. Optionally, the access network device can also be a server, a wearable device, a vehicle, or an in-vehicle device. For example, the access network device in vehicle-to-everything (V2X) technology can be a roadside unit (RSU). All or part of the functions of the access network device in this application can also be implemented through software functions running on hardware, or through virtualization functions instantiated on a platform (e.g., a cloud platform). The access network device can also be equipped with communication modules, circuits, or chips that perform corresponding communication functions. The access network device can also be configured with program instructions for performing corresponding communication functions and corresponding program instructions. The access network device in this application may also be a logical node, logical module, or software that can implement all or part of the functions of the access network device.

[0055] In another possible scenario, multiple access network devices collaborate to assist the terminal in achieving wireless access, with each device performing a portion of the base station's functions. For example, the access network devices can be a central unit (CU), a distributed unit (DU), a CU-control plane (CP), a CU-user plane (UP), or a radio unit (RU). The CU and DU can be separate entities or included in the same network element, such as a baseband unit (BBU). The RU can be included in radio frequency equipment or radio frequency units, such as a remote radio unit (RRU), an active antenna unit (AAU), or a remote radio head (RRH).

[0056] In different systems, CU (or CU-CP and CU-UP), DU, or RU may have different names, but those skilled in the art will understand their meaning. For example, in an open radio access network (ORAN) system, CU can also be called O-CU (open CU), DU can also be called O-DU, CU-CP can also be called O-CU-CP, CU-UP can also be called O-CU-UP, and RU can also be called O-RU. For ease of description, this application uses CU, CU-CP, CU-UP, DU, and RU as examples. Any of the units among CU (or CU-CP, CU-UP), DU, and RU in this application can be implemented through a software module, a hardware module, or a combination of software and hardware modules.

[0057] A terminal can also be called a terminal device, user equipment (UE), mobile station, mobile terminal, etc. Terminals can be widely used in various scenarios, such as device-to-device (D2D), vehicle-to-everything (V2X) communication, machine-type communication (MTC), Internet of Things (IoT), virtual reality, augmented reality, industrial control, autonomous driving, telemedicine, smart grids, smart furniture, smart offices, smart wearables, smart transportation, smart cities, etc. Terminals can be mobile phones, tablets, computers with wireless transceiver capabilities, wearable devices, vehicles, drones, helicopters, airplanes, ships, robots, robotic arms, smart home devices, transportation vehicles with wireless communication capabilities, communication modules, etc. The embodiments of this application do not limit the device form of the terminal. Terminals typically contain communication modules, circuits, or chips that perform corresponding communication functions. The terminal can also be configured with program instructions for performing corresponding communication functions.

[0058] Access network devices and terminals can be fixed in location or mobile. They can be deployed on land, including indoors or outdoors, handheld or vehicle-mounted; they can also be deployed on water; and they can be deployed in the air on aircraft, balloons, and artificial satellites. The embodiments of this application do not limit the application scenarios of the access network devices and terminals.

[0059] The AMF (Automatic Mobility Management) network element includes functions such as performing mobility management or access authentication / authorization. In addition, it is responsible for transmitting user policies between the terminal and the PCF (Programmable Default Function) network element.

[0060] SMF network elements include functions such as performing session management, executing control policies issued by PCF network elements, selecting UPF network elements, or allocating IP addresses for terminals.

[0061] UPF network elements include functions such as user plane data forwarding, session / flow-level billing statistics, and bandwidth limiting.

[0062] UDM network elements include functions such as managing contracted data or authorizing user access.

[0063] UDR includes functions for accessing data of various types, such as contract data, policy data, or application data.

[0064] NEF network elements are used to support the opening of capabilities and events.

[0065] AF (Application Provider) network elements convey application-side requests to the network side, such as Quality of Service (QoS) requirements or user state event subscriptions. AFs can be third-party functional entities or application services deployed by operators, such as IP Multimedia Subsystem (IMS) voice call services. AF network elements include those within the core network (i.e., operator-owned AFs) and third-party AFs (such as an enterprise's application server (AS)).

[0066] PCF network elements include policy control functions such as billing at the session and service flow levels, QoS bandwidth guarantee and mobility management, or terminal policy decisions.

[0067] NRF network elements can be used to provide network element discovery functionality, providing network element information corresponding to the network element type based on requests from other network elements. NRF network elements also provide network element management services, such as network element registration, updates, deregistration, or network element status subscription and push.

[0068] The AUSF network element is responsible for authenticating users to determine whether to allow users or devices to access the network.

[0069] A Domain Provider (DN) is a network located outside the carrier's network. A carrier's network can connect to multiple DNs, and various services can be deployed on a DN, providing data and / or voice services to terminals. For example, a DN might be the private network of a smart factory. Sensors installed in the workshop can act as terminals, and a control server for these sensors is deployed within the DN. The control server provides services to the sensors. Sensors can communicate with the control server, receive instructions from it, and transmit the collected sensor data back to the control server accordingly. Another example is a DN serving as an internal office network for a company. Employees' mobile phones or computers can act as terminals, accessing information and data resources on the company's internal office network.

[0070] Figure 1 Nausf, Npcf, Nudr, Nudm, Naf, Namf, Nsmf, Nnef, and Nnrf are the service-based interfaces (SBIs) provided by AUSF, PCF, UDR, UDM, AF, AMF, SMF, NEF, and NRF, respectively, used to invoke the corresponding service-based operations. N1, N2, N3, N4, and N6 are interface sequence numbers, with the following meanings:

[0071] 1) N1: The interface between the AMF network element and the terminal, which can be used to transmit non-access stratum (NAS) signaling (such as QoS rules from the AMF network element) to the terminal.

[0072] 2) N2: The interface between the AMF network element and the access network equipment, which can be used to transmit radio bearer control information from the core network side to the access network equipment.

[0073] 3) N3: The interface between the access network equipment and the UPF network element, mainly used to transmit uplink and downlink user plane data between the access network equipment and the UPF network element.

[0074] 4) N4: The interface between SMF network elements and UPF network elements. It can be used to transmit information between the control plane and the user plane, including the distribution of forwarding rules, QoS rules, traffic statistics rules, etc. from the control plane to the user plane, as well as the reporting of information from the user plane.

[0075] 5) N6: The interface between the UPF network element and the DN, used to transmit uplink and downlink user data streams between the UPF network element and the DN.

[0076] Figure 1In the illustrated architecture, the various network functional elements are connected via a service-oriented bus and interact through service-oriented interfaces. The advantages of a service-oriented bus include improved network flexibility, openness, scalability, and intelligence, enabling support for diverse service scenarios and requirements. The service-oriented bus can be used to transmit various types of data and signaling. For example, it can be used to transmit latency-sensitive real-time signaling (e.g., service-oriented interface call signaling between functional network elements), latency-sensitive real-time data (e.g., real-time AI inference data), and non-real-time data (e.g., offline AI training data). Furthermore, when transmitting this data or signaling, the service-oriented bus couples the data or signaling together; that is, the service-oriented bus can simultaneously transmit real-time signaling, real-time data, and non-real-time data.

[0077] It is understood that the aforementioned network element or function can be a network component in a hardware device, a software function running on dedicated hardware, or a virtualized function instantiated on a platform (e.g., a cloud platform). Optionally, the aforementioned network element or function can be implemented by one device, multiple devices working together, or a functional module within a single device; this application embodiment does not specifically limit this.

[0078] The user plane network element and application function network element in this application can be respectively... Figure 1 The UPF and AF network elements mentioned above can also be network elements in future communication networks that have the functions of the aforementioned UPF and AF network elements; this application does not limit this.

[0079] To facilitate understanding of the contents of this application, the following explanations are provided for the nouns or terms used in this application.

[0080] 1) QUIC

[0081] QUIC, also known as Google QUIC (gQUIC), is a reliable UDP transport protocol designed by Google in 2012. It aims to provide a secure, reliable, efficient, and low-latency communication guarantee for the Hypertext Transfer Protocol (HTTP). The QUIC protocol has been adopted as a standard by the Internet Engineering Task Force (IETF), and HTTP / 3 has chosen to use QUIC instead of the Transmission Control Protocol (TCP) as its transport layer protocol.

[0082] Figure 2This is a schematic diagram of the protocol stack structure. Because the QUIC protocol is built on top of UDP, it offers greater customizability and optimization potential compared to other protocols built on top of TCP, such as HTTP 1.1 or HTTP / 2 (also known as HTTP / 2). At the UDP layer, QUIC provides reliable, ordered, secure, and faster transmission services. Currently, a large number of business request and response communications are carried through QUIC, making it a next-generation transport layer protocol. Figure 2 In this context, TLS refers to Transport Layer Security, and IP refers to Internet Protocol.

[0083] 2) MASQUE

[0084] In live network implementations, proxies are required in many scenarios. For example, proxies are needed when end-to-end connections cannot communicate directly, when encrypted communication via a virtual private network (VPN) requires a proxy, and when proxies are needed for reasons such as security isolation or privacy protection.

[0085] Existing HTTP connections only support TCP connections, and the firewall secure session traversal protocol (Socks) signaling is not encrypted. Against this backdrop, the scenario of HTTP / 3 over QUIC has emerged, requiring the introduction of a new proxy protocol. HTTP / 3 can also be referred to as HTTP3 or HTTP over QUIC.

[0086] MASQUE is a framework that allows multiple web applications to run concurrently within an HTTP / 3 connection. For example, MASQUE can allow a QUIC client to negotiate proxy functionality with an HTTP / 3 server and then use this functionality while concurrently processing HTTP / 3 requests and responses.

[0087] User plane network elements (such as UPF network elements) can be aware of the address information of application function network elements (such as HTTP / 3 servers), and user plane network elements can establish MASQUE connections with application function network elements based on the address information of the application function network elements they are aware of.

[0088] Currently, after the user plane network element senses the address information of the application function network element, it immediately establishes and maintains a MASQUE connection between the user plane network element and the application function network element. The MASQUE connection can be used for service transmission when needed.

[0089] The problem with the above approach is that user plane network elements need to maintain a large number of MASQUE connections for a long time, which not only brings significant resource overhead to user plane network elements, but also exposes MASQUE connections for a long time, making them vulnerable to attacks.

[0090] To address the aforementioned issues, this application provides corresponding solutions.

[0091] The communication method, communication device, and communication system provided in this application will be described below with reference to the accompanying drawings. It is understood that this application uses user plane network elements and application function network elements as examples to illustrate the execution of this interaction, but this application does not limit the execution entities of the interaction. The method executed by the user plane network elements in this application can also be implemented by modules (e.g., circuits, chips, or chip systems) within the user plane network elements, or by logic nodes, logic modules, or software capable of implementing all or part of the user plane network element functions. Similarly, the method executed by the application function network elements in this application can also be implemented by modules (e.g., circuits, chips, or chip systems) within the application function network elements, or by logic nodes, logic modules, or software capable of implementing all or part of the application function network element functions.

[0092] Figure 3 This is a flowchart illustrating a communication method provided in an embodiment of this application. The method includes the following steps:

[0093] Step 301: The user plane network element obtains the identity information of each application function network element in at least one application function network element.

[0094] Specifically, the identity information of each application function network element in at least one application function network element includes at least one address information that supports MASQUE connections. The address information of each MASQUE connection can be used to establish one or more MASQUE connections.

[0095] For example, the user plane network element obtains the identity information of application function network element #1, application function network element #2, and application function network element #3. The identity information of application function network element #1 includes address information #1_1, #1_2, and #1_3 that support MASQUE connections. The identity information of application function network element #2 includes address information #2_1, #2_2, and #2_3 that support MASQUE connections. The identity information of application function network element #3 includes address information #3_1, #3_2, and #3_3 that support MASQUE connections.

[0096] For example, each address information supporting a MASQUE connection includes one or more of the following:

[0097] 1) IP address of the application function network element.

[0098] 2) Port number of the application function network element.

[0099] 3) Fully qualified domain name (FQDN) of application function network elements.

[0100] For example, the address information for application function network elements supporting MASQUE connections may include an IP address, or an IP address and port number, or an IP address, port number, and FQDN, or an IP address and FQDN, or an FQDN.

[0101] For example, Table 1 below provides an example of the identity information of application function network element #1.

[0102] Table 1

[0103] Identity information of application function network element #1 IP#1 IP2#, Port#2 IP#3

[0104] As shown in Table 1, the identity information of application function network element #1 includes three address information that support MASQUE connection, namely address information #1_1 (i.e., IP#1), address information #1_2 (i.e., IP2# and Port#2), and address information #1_3 (i.e., IP#3).

[0105] Application function network element #1 can establish one or more MASQUE connections using IP#1, one or more MASQUE connections using IP2# and Port#2, and one or more MASQUE connections using IP#3.

[0106] Examples of identity information for other application function network elements are similar and will not be repeated.

[0107] This application does not limit the specific implementation method by which user plane network elements obtain the identity information of each application function network element in at least one application function network element. For example, the at least one application function network element sends its own identity information to the user plane network element through a capability open network element (e.g., a NEF network element). Another example is that the at least one application function network element sends its own identity information to a policy control network element (e.g., a PCF network element) through a NEF network element, and then the policy control network element sends the identity information of each application function network element in the at least one application function network element to the user plane network element through a session management network element (e.g., a SMF network element). Yet another example is that the user plane network element obtains the identity information of each application function network element in the at least one application function network element from a unified data storage network element (e.g., a UDR network element). Still another example is that the identity information of each application function network element in the at least one application function network element is pre-configured on the user plane network element by network administrators.

[0108] In one possible implementation, before, after, or simultaneously with step 301, the user plane network element also obtains indication information indicating whether the MASQUE connection established by each application function network element in the at least one application function network element supports the establishment of multiple service flows. The specific method by which the user plane network element obtains this indication information is similar to that of obtaining the identity information of each application function network element in the at least one application function network element, and will not be described in detail here.

[0109] In one implementation method, for a certain application function network element, if the identity information of the application function network element includes multiple address information supporting MASQUE connections, and all MASQUE connections corresponding to these multiple address information do not support the establishment of multiple service flows, then the user plane network element only needs to obtain one indication information (e.g., a first indication information) corresponding to the application function network element. This first indication information indicates that the MASQUE connection established by the application function network element does not support the establishment of multiple service flows. Alternatively, if the identity information of the application function network element includes multiple address information supporting MASQUE connections, and all MASQUE connections corresponding to these multiple address information support the establishment of multiple service flows, then the user plane network element only needs to obtain one indication information (e.g., a second indication information) corresponding to the application function network element. This second indication information indicates that the MASQUE connection established by the application function network element supports the establishment of multiple service flows.

[0110] In another implementation method, for a certain application function network element, if the identity information of the application function network element includes multiple address information that supports MASQUE connections, and among the multiple MASQUE connections corresponding to the address information that supports MASQUE connections, some MASQUE connections do not support the establishment of multiple service flows, while other MASQUE connections support the establishment of multiple service flows, then the user plane network element can obtain two indication information. One indication information is used to indicate which MASQUE connections corresponding to the identity information of the application function network element do not support the establishment of multiple service flows, and the other indication information is used to indicate which MASQUE connections corresponding to the identity information of the application function network element support the priority establishment of multiple service flows. Alternatively, each identity information of the application function network element can correspond to a separate indication information, which is used to indicate whether the MASQUE connection corresponding to the identity information supports the establishment of multiple service flows.

[0111] Step 302: The first terminal sends a first service request to the user plane network element. Correspondingly, the user plane network element receives the first service request.

[0112] The first service request includes the address information of the application function network element corresponding to the first service request. The address information of the application function network element corresponding to the first service request includes one or more of the following: IP address, port number, or FQDN of the application function network element. For example, the address information of the application function network element corresponding to the first service request includes an IP address, or includes an IP address and port number, or includes an IP address, port number, and FQDN, or includes both IP address and FQDN, or includes only the FQDN.

[0113] For example, the first service request includes tuple information corresponding to the first service, which includes the address information of the application function network element corresponding to the first service request. This tuple information can be a four-tuple, including the source IP address (i.e., the terminal's IP address), the source port number (i.e., the terminal's port number), the destination IP address (i.e., the application function network element's IP address), and the destination port number (i.e., the application function network element's port number). The address information of the application function network element can include the destination IP address, or it can include both the destination IP address and the destination port number.

[0114] For example, the first service request includes tuple information corresponding to the first service. This tuple information can also be a five-tuple, which includes the source IP address (i.e., the terminal's IP address), the source port number (i.e., the terminal's port number), the destination IP address (i.e., the application function network element's IP address), the destination port number (i.e., the application function network element's port number), and the protocol type (i.e., the QUIC protocol). The address information of the application function network element may include the destination IP address, or may include both the destination IP address and the destination port number.

[0115] As one implementation method, when the first terminal has a transmission requirement for the first service, the first terminal sends the aforementioned first service request to the user plane network element. The transmission requirement for the first service can be triggered by the launch of an application (such as a video application) on the first terminal, or by the activation of a function option of the application (such as the activation of the function option to play a video in a video application), etc., and this application does not impose any limitations on this.

[0116] Step 303: If at least one address information supporting a MASQUE connection includes the address information of the application function network element corresponding to the first service request, the user plane network element establishes a first MASQUE connection with the application function network element corresponding to the first service request based on the address information of the application function network element corresponding to the first service request.

[0117] The address information that supports MASQUE connection here is the address information that supports MASQUE connection in the identity information of each application function network element obtained by the user plane network element in step 301 above.

[0118] The first MASQUE connection is used to transmit the service message corresponding to the first service request.

[0119] Taking the example in step 301, the user plane network element obtains the identity information of application function network element #1, application function network element #2, and application function network element #3. The identity information of application function network element #1 includes address information #1_1, #1_2, and #1_3 that support MASQUE connections. The identity information of application function network element #2 includes address information #2_1, #2_2, and #2_3 that support MASQUE connections. The identity information of application function network element #3 includes address information #3_1, #3_2, and #3_3 that support MASQUE connections.

[0120] If the identity information of at least one application function network element obtained by the user plane network element includes the address information of the application function network element corresponding to the first service request, then the user plane network element determines that it can establish a MASQUE connection with the application function network element corresponding to the first service request, and thus establishes a first MASQUE connection between the user plane network element and the application function network element corresponding to the first service request. For example, if the address information #1_3 supporting MASQUE connection is the same as the address information of the application function network element corresponding to the first service request, then the application function network element corresponding to the first service request is application function network element #1, and the user plane network element can establish a MASQUE connection with application function network element #1 based on the address information #1_3 supporting MASQUE connection.

[0121] If the identity information of each application function network element obtained by the user plane network element does not include the address information of the application function network element corresponding to the first service request, then the user plane network element determines that it cannot establish a MASQUE connection with the application function network element corresponding to the first service request. Consequently, the user plane network element can reject the first service request, for example, by sending a service rejection message to the first terminal.

[0122] Based on the above scheme, user plane network elements can pre-obtain the identity information of each application function network element in at least one application function network element. Subsequently, upon receiving a service request, based on the identity information of each application function network element in the at least one application function network element and the address information of the application function network element carried in the service request, it determines whether a MASQUE connection can be established with that application function network element. Therefore, this scheme realizes the establishment of MSAQUE connections on demand and the transmission of service packets through the established MASQUE connections, instead of establishing and maintaining MASQUE connections with application function network elements in advance before receiving service requests. This reduces the resource overhead of user plane network elements and avoids attacks due to prolonged exposure of MASQUE connections, thus improving the security of MSAQUE connections.

[0123] Optionally, after step 303 above, step 304 may also be performed.

[0124] Step 304: The user plane network element establishes a first service flow for the first service request based on the first MASQUE connection.

[0125] The first service flow is used to transmit the service message corresponding to the first service request.

[0126] Alternatively, this can be understood as the first MASQUE connection being used to transmit the first service stream corresponding to the first service request.

[0127] In one possible implementation, the user plane network element can also receive a second service request from a second terminal (which may be the same terminal as the first terminal or a different terminal). The second service request includes the address information of the application function network element corresponding to the second service request. The address information of the application function network element corresponding to the second service request is the same as the address information of the application function network element corresponding to the aforementioned first service request. The user plane network element can then have two different processing methods, and can choose one of them. These methods are described below.

[0128] In the first processing method, if the first MASQUE connection established by the user plane network element based on the address information of the application function network element corresponding to the first service request does not support the transmission of multiple service flows, then the user plane network element establishes a second MASQUE connection with the application function network element corresponding to the second service request. This second MASQUE connection is used to transmit the service message corresponding to the second service request.

[0129] For example, if a user plane network element can obtain first indication information indicating that the first MASQUE connection does not support the establishment of multiple service flows, then the user plane network element can establish a second MASQUE connection with the application function network element corresponding to the second service request based on the address information of the application function network element corresponding to the second service request and the first indication information.

[0130] For example, after establishing the second MASQUE connection, the user plane network element can establish a second service flow for the second service request based on the second MASQUE connection. This second service flow is used to transmit the service packets corresponding to the second service request. Alternatively, it can be understood that the second MASQUE connection established by the user plane network element is used to transmit the service packets of the second service flow corresponding to the second service request. The first service flow and the second service flow are used to transmit service packets for different services, for example, the first service flow is a video stream and the second service flow is an audio stream, or the first service flow is video stream #1 and the second service flow is video stream #2, etc.

[0131] Based on this scheme, after establishing a first MASQUE connection between a user plane network element and an application function network element, if a service request is received again, and the application function network element corresponding to this service request is the same as the application function network element corresponding to the first MASQUE connection, and the address information of the application function network element corresponding to this service request is the same as the address information of the application function network element corresponding to the first MASQUE connection, but the first MASQUE connection does not support the establishment of multiple service flows, then the user plane network element will establish a second MASQUE connection between the user plane network element and the application function network element for this service request. In this method, each MASQUE connection is used to transmit only one service flow, which can guarantee the transmission quality and latency of the service flow and improve the service experience.

[0132] The first processing method addresses the scenario where each MASQUE connection is used to transmit only one service flow. Based on this scenario, after establishing the first MASQUE connection, the user plane network element can further determine first mapping information. This first mapping information indicates the mapping relationship between the tuple information corresponding to the first service request and the first MASQUE connection, or it indicates the mapping relationship between the tuple information corresponding to the first service request, the address information of the application function network element corresponding to the first service request, and the first MASQUE connection. Optionally, the first mapping information also indicates the status of the first MASQUE connection. This first mapping information is used to forward the service packet corresponding to the first service request transmitted between the first terminal and the application function network element corresponding to the first service request. The meaning of the tuple information corresponding to the first service request can be referred to the foregoing description and will not be repeated here. Subsequently, when the user plane network element receives the service packet corresponding to the first service request from the application function network element corresponding to the first service request through the first MASQUE connection, it can send the service packet corresponding to the first service request to the first terminal according to the first mapping information. For example, when a user plane network element receives a service message of a first service flow from an application function network element through a first MASQUE connection, the header of the service message carries the identifier of the first MASQUE connection. The user plane network element determines the corresponding four-tuple information or five-tuple information based on the identifier of the first MASQUE connection and the first mapping information, and forwards the service message to the first terminal based on the four-tuple information or five-tuple information.

[0133] As one implementation method, the user plane network element determines the first mapping information. For example, the user plane network element may obtain initial information before establishing the first MASQUE connection. This initial information is used to instruct the user plane network element to obtain the identity information of each application function network element in at least one application function network element. After establishing the first MASQUE connection, the user plane network element determines the address information of the application function network element corresponding to the first service request in the initial information. Then, based on the address information of the application function network element corresponding to the first service request, it adds information about the first MASQUE connection (such as identifier or status) and tuple information corresponding to the first service request, thereby obtaining the first mapping information.

[0134] For example, assuming that the application function network element corresponding to the first service request is application function network element #1 as shown in Table 1 above, and the address information of the application function network element corresponding to the first service request is IP #1, then the first mapping information can be as shown in Table 2.

[0135] Table 2

[0136]

[0137] Where S-IP1 is the IP address of the first terminal, S-Port1 is the port number of the first terminal, D-IP1 is the IP address of application function network element #1, and D-Port1 is the port number of application function network element #1. D-IP1 is the same as IP#1. MASQUEID#1 is the unique identifier of the first MASQUE connection, which the user plane network element can obtain from application function network element #1. An enabled MASQUE connection status indicates that the first MASQUE connection indicated by MASQUE ID#1 can currently communicate normally.

[0138] The first processing method is for scenarios where each MASQUE connection is used to transmit only one service flow. Based on this scenario, after establishing the second MASQUE connection, the user plane network element can also determine third mapping information. This third mapping information indicates the mapping relationship between the tuple information corresponding to the second service request and the second MASQUE connection, or it indicates the mapping relationship between the tuple information corresponding to the second service request, the address information of the application function network element corresponding to the second service request, and the second MASQUE connection. Optionally, the third mapping information also indicates the status of the second MASQUE connection. This third mapping information is used to forward the service packets corresponding to the second service request transmitted between the second terminal and the application function network element corresponding to the second service request. The meaning of the tuple information corresponding to the second service request is similar to that of the tuple information corresponding to the first service request, and can be referred to the aforementioned description, which will not be repeated here. Subsequently, when the user plane network element receives the service packets corresponding to the second service request from the application function network element corresponding to the second service request through the second MASQUE connection, it can send the service packets corresponding to the second service request to the second terminal according to the third mapping information. For example, when a user plane network element receives a service message of a second service flow from an application function network element through a second MASQUE connection, the header of the service message carries the identifier of the second MASQUE connection. The user plane network element determines the corresponding four-tuple information or five-tuple information based on the identifier of the second MASQUE connection and the third mapping information, and forwards the service message to the second terminal based on the four-tuple information or five-tuple information.

[0139] For example, assuming that the application function network element corresponding to the second service request is application function network element #1 shown in Table 2 above, and the address information of the application function network element corresponding to the second service request is IP #1, then a third mapping information can be added based on the first mapping information shown in Table 2 to obtain Table 3.

[0140] Table 3

[0141]

[0142] Wherein, S-IP1 is the IP address of the first terminal, S-Port1 and S-Port2 are two different port numbers of the first terminal, D-IP1 is the IP address of application function network element #1, and D-Port1 is the port number of application function network element #1. D-IP1 is the same as IP#1. MASQUE ID#1 is the unique identifier of the first MASQUE connection, and MASQUE ID#2 is the unique identifier of the second MASQUE connection. User plane network elements can obtain MASQUE ID#1 and MASQUE ID#2 from application function network element #1. The status of the MASQUE connection is enabled, indicating that the first MASQUE connection indicated by MASQUE ID#1 and the second MASQUE connection indicated by MASQUE ID#2 can currently communicate normally.

[0143] When a user plane network element receives a service packet #1 of the first service flow from an application function network element #1, if the header of the service packet #1 carries a MASQUE ID #1, the user plane network element determines the tuple information corresponding to the MASQUE ID #1 as (S-IP1, S-Port1, D-IP1, D-Port1) based on the first mapping information, and then forwards the service packet #1 to the first terminal based on the tuple information.

[0144] When a user plane network element receives a service packet #2 of the second service flow from an application function network element #1, if the header of the service packet #2 carries a MASQUE ID #2, the user plane network element determines the tuple information corresponding to the MASQUE ID #2 as (S-IP1, S-Port2, D-IP1, D-Port1) based on the third mapping information, and then forwards the service packet #2 to the first terminal based on the tuple information.

[0145] It should be noted that in Table 3 above, the target port number in the tuple information corresponding to MASQUE ID#1 is the same as the target port number in the tuple information corresponding to MASQUE ID#2, both being D-port1. In another implementation method, the target port number in the tuple information corresponding to MASQUE ID#1 can also be different from the target port number in the tuple information corresponding to MASQUE ID#2. For example, the target port number in the tuple information corresponding to MASQUE ID#1 is D-port1, and the target port number in the tuple information corresponding to MASQUE ID#2 is D-port2.

[0146] Regarding the first processing method described above, as an implementation, if a user plane network element or application function network element detects that the first MASQUE connection is not transmitting service packets, then the user plane network element or application function network element can release the first MASQUE connection. This method can save resource overhead for both the user plane network element and the application function network element. Detecting that the first MASQUE connection is not transmitting service packets could be, for example, detecting that the first MASQUE connection has not transmitted service packets within a set time period, or detecting that the service packets transmitted on the first MASQUE connection carry a marker indicating that the service packet is the last service packet in the first service flow. After releasing the first MASQUE connection, the user plane network element can also delete the aforementioned first mapping information.

[0147] Regarding the first processing method described above, as an implementation approach, if a user plane network element or application function network element detects that the second MASQUE connection is not transmitting service packets, then the user plane network element or application function network element can release the second MASQUE connection. This method can save resource overhead for both the user plane network element and the application function network element. Detecting that the second MASQUE connection is not transmitting service packets could be, for example, detecting that the second MASQUE connection has not transmitted service packets within a set time period, or detecting that the service packets transmitted on the second MASQUE connection carry a marker indicating that the service packet is the last service packet in the second service flow. After releasing the second MASQUE connection, the user plane network element can also delete the aforementioned third mapping information.

[0148] In the second processing method, if the first MASQUE connection established by the user plane network element based on the address information of the application function network element corresponding to the first service request supports the transmission of multiple service flows, then the user plane network element establishes a second service flow for the second service request based on the first MASQUE connection. The second service flow is used to transmit the service packets corresponding to the second service request. That is, the first MASQUE connection is used to transmit both the service packets of the first service flow corresponding to the first service request and the service packets of the second service flow corresponding to the second service request.

[0149] For example, if a user plane network element obtains second indication information indicating that the first MASQUE connection supports the establishment of multiple service flows, then the user plane network element can establish a second service flow on the first MASQUE connection based on the first MASQUE connection and the second indication information. This second service flow is used to transmit the service packets corresponding to the second service request. Alternatively, it can be understood that the first MASQUE connection is also used to transmit the service packets of the second service flow corresponding to the second service request.

[0150] Based on this scheme, after establishing a first MASQUE connection between a user plane network element and an application function network element, if a service request is received again, and the application function network element corresponding to this service request is the same as the application function network element corresponding to the first MASQUE connection, and the address information of the application function network element corresponding to this service request is the same as the address information of the application function network element corresponding to the first MASQUE connection, and the first MASQUE connection supports the establishment of multiple service flows, then the user plane network element does not need to create a new MASQUE connection between itself and the application function network element for this service request. Instead, it creates a new service flow corresponding to the second service request on the first MASQUE connection. In this method, each MASQUE connection can be used to transmit multiple service flows, which can improve resource utilization and save resources.

[0151] The second processing method is for scenarios where each MASQUE connection can be used to transmit multiple service flows. Based on this scenario, after establishing the first MASQUE connection and the first service flow, the user plane network element can also determine second mapping information. This second mapping information indicates the mapping relationship between the tuple information corresponding to the first service request and the first service flow, or it indicates the mapping relationship between the tuple information corresponding to the first service request, the address information of the application function network element corresponding to the first service request, and the first service flow. Optionally, this second mapping information also indicates the status of the first MASQUE connection. This second mapping information is used to forward the service packets of the first service flow corresponding to the first service request transmitted between the first terminal and the application function network element corresponding to the first service request. The meaning of the tuple information corresponding to the first service request can be referred to the foregoing description and will not be repeated here. Subsequently, when the user plane network element receives the service packets of the first service flow from the application function network element corresponding to the first service request through the first MASQUE connection, it can send the service packets of the first service flow corresponding to the first service request to the first terminal according to the second mapping information. For example, when a user plane network element receives a service packet of a first service flow from an application function network element through a first MASQUE connection, the header of the service packet carries the identifier of the first MASQUE connection and the identifier of the first service flow. The user plane network element determines the corresponding four-tuple information or five-tuple information based on the identifier of the first MASQUE connection, the identifier of the first service flow, and the second mapping information, and forwards the service packet to the first terminal based on the four-tuple information or five-tuple information.

[0152] For example, assuming that the application function network element corresponding to the first service request is application function network element #1 as shown in Table 1 above, and the address information of the application function network element corresponding to the first service request is IP #1, then the second mapping information can be as shown in Table 4.

[0153] Table 4

[0154]

[0155] Wherein, S-IP1 is the IP address of the first terminal, S-Port1 is the port number of the first terminal, D-IP1 is the IP address of application function network element #1, and D-Port1 is the port number of application function network element #1. D-IP1 is the same as IP#1. MASQUEID#1 is the unique identifier of the first MASQUE connection, and stream ID#1 is the identifier of the first service flow within the first MASQUE connection. MASQUE ID#1 and stream ID#1 jointly identify the first service flow. Alternatively, in another implementation, only stream ID#1 can be used to uniquely identify the first service flow; in this case, different service flows within different MASQUE connections need to use different stream IDs. User plane network elements can obtain MASQUE ID#1 and stream ID#1 from application function network element #1. The status of the MASQUE connection is enabled, indicating that the first MASQUE connection indicated by MASQUE ID#1 can currently communicate normally.

[0156] The second processing method is for scenarios where each MASQUE connection can be used to transmit multiple service flows. Based on this scenario, after establishing the first MASQUE connection and the second service flow, the user plane network element can also determine fourth mapping information. This fourth mapping information indicates the mapping relationship between the tuple information corresponding to the second service request and the second service flow, or it indicates the mapping relationship between the tuple information corresponding to the second service request, the address information of the application function network element corresponding to the second service request, and the second service flow. Optionally, this fourth mapping information also indicates the status of the first MASQUE connection. This fourth mapping information is used to forward the service packets of the second service flow corresponding to the second service request transmitted between the second terminal and the application function network element corresponding to the second service request. The meaning of the tuple information corresponding to the second service request is similar to that of the tuple information corresponding to the first service request, and can be referred to the foregoing description, which will not be repeated here. Subsequently, when the user plane network element receives the service packets of the second service flow from the application function network element corresponding to the second service request through the first MASQUE connection, it can send the service packets of the second service flow corresponding to the second service request to the second terminal according to the fourth mapping information. For example, when a user plane network element receives a service message of the second service flow from an application function network element through the first MASQUE connection, the header of the service message carries the identifier of the first MASQUE connection and the identifier of the second service flow. The user plane network element determines the corresponding four-tuple information or five-tuple information based on the identifier of the first MASQUE connection, the identifier of the second service flow, and the fourth mapping information, and forwards the service message to the second terminal based on the four-tuple information or five-tuple information.

[0157] For example, assuming that the application function network element corresponding to the second service request is application function network element #1 as shown in Table 4 above, and the address information of the application function network element corresponding to the second service request is IP #1, then a fourth mapping information can be added based on the second mapping information shown in Table 4 to obtain Table 5.

[0158] Table 5

[0159]

[0160] S-IP1 is the IP address of the first terminal, S-Port1 and S-Port2 are two different port numbers of the first terminal, D-IP1 is the IP address of application function network element #1, and D-Port1 is the port number of application function network element #1. D-IP1 is the same as IP#1. MASQUE ID#1 is the unique identifier of the first MASQUE connection, stream ID#1 is the identifier of the first service flow within the first MASQUE connection, and MASQUE ID#1 and stream ID#1 jointly identify the first service flow. stream ID#2 is the identifier of the second service flow within the first MASQUE connection, and MASQUE ID#1 and stream ID#2 jointly identify the second service flow. Alternatively, in another implementation, only stream ID#1 can be used to uniquely identify the first service flow, and only stream ID#2 can be used to uniquely identify the second service flow. In this case, different service flows within different MASQUE connections need to use different stream IDs. User plane network elements can obtain MASQUE ID#1, stream ID#1, and stream ID#2 from application function network element #1. The status of the MASQUE connection is enabled, indicating that the first MASQUE connection indicated by MASQUE ID#1 can currently communicate normally.

[0161] Regarding the second processing method described above, as an implementation, if a user plane network element or application function network element detects that the first MASQUE connection is not transmitting service packets, the user plane network element or application function network element can release the first MASQUE connection. This method can save resource overhead for both the user plane network element and the application function network element. Detecting that the first MASQUE connection is not transmitting service packets can be, for example, detecting that the first MASQUE connection has not transmitted service packets within a set time period, or it can also be: detecting that a service packet transmitted on the first MASQUE connection carries a marker indicating that the service packet is the last service packet in the first service flow, and detecting that another service packet transmitted on the first MASQUE connection carries a marker indicating that the service packet is the last service packet in the second service flow. After releasing the first MASQUE connection, the user plane network element can also delete the aforementioned second and fourth mapping information.

[0162] The following section, in conjunction with the accompanying drawings, discusses... Figure 3 The following are specific examples. Figure 4 Implementation examples and Figure 5 All of the embodiments are Figure 3 Specific examples of embodiments are provided below. The following embodiments use an application function network element (AF) and a user plane network element (UPF) as an example for illustration.

[0163] Figure 4 This is a flowchart illustrating a communication method provided in an embodiment of this application. In this embodiment, multiple service flows are not supported on the MASQUE connection of the AF.

[0164] The method includes the following steps:

[0165] Step 401: The AF sends its identity information to the NEF. Correspondingly, the NEF receives the AF's identity information.

[0166] The identity information of an AF includes at least one address that supports MASQUE connections. Each address can be used to establish one or more MASQUE connections. For example, if the identity information of an AF includes address information #1, address information #2, and address information #3 that support MASQUE connections, then the AF can establish one or more MASQUE connections using each of these three address information.

[0167] For example, the address information supporting a MASQUE connection includes one or more of the following:

[0168] 1) AF's IP address.

[0169] 2) AF port number.

[0170] 3) AF's FQDN.

[0171] For example, the address information supporting MASQUE connections may include an IP address, or an IP address and port number, or an IP address, port number, and FQDN, or an IP address and FQDN, or an FQDN.

[0172] Optionally, in this step, the AF also sends a first indication message to the NEF, which indicates that the MASQUE connection on the AF does not support the establishment of multiple service flows. Here, "the MASQUE connection on the AF does not support the establishment of multiple service flows" means that a single MASQUE connection can only support one service flow.

[0173] Step 402: The terminal sends a PDU session establishment request to the AMF. Correspondingly, the AMF receives the PDU session establishment request.

[0174] After receiving a PDU session establishment request from the terminal, the AMF can select the SMF, and then the SMF can obtain the terminal's subscription information, etc. from the UDM.

[0175] Step 403: The NEF sends the AF's identity information to the PCF. Correspondingly, the PCF receives the AF's identity information.

[0176] In one possible implementation, if the NEF also receives the first instruction information from the AF, the NEF can also send the first instruction information to the PCF in step 403.

[0177] It should be understood that the order of steps 402 and 403 is not limited in the embodiments of this application. Step 403 may occur before step 402, after step 402, or simultaneously with step 402.

[0178] For example, NEF sends the AF's identity information to PCF through the Npcf_PolicyAuthorization service.

[0179] In step 404, the PCF sends the AF's identity information to the SMF. Correspondingly, the SMF receives the AF's identity information.

[0180] During the PDU session establishment process, the SMF can request policy and charging control (PCC) rule information from the PCF. The PCF can carry the AF's identity information with the PCC rule information and send it to the SMF through the Session Management (SM) policy control service (Npcf_SMPolicyControl service) message.

[0181] In one possible implementation, if the PCF also receives the first instruction information from the NEF, the PCF may also send the first instruction information and the AF's identity information together with the PCC rule information to the SMF.

[0182] For example, the PCF sends the AF's identity information to the SMF via Npcf_SMPolicyControlservice.

[0183] Step 405, SMF selects UPF.

[0184] SMF selects a UPF that supports the MASQUE function. Here, UPF support for the MASQUE function means that the UPF supports establishing an MSAQUE connection.

[0185] Step 406: The SMF sends the AF's identity information to the UPF. Correspondingly, the UPF receives the AF's identity information.

[0186] For example, after selecting a UPF, the SMF can establish an N4 session connection with the UPF. The SMF sends the identity information of the AF to the UPF through the N4 interface (such as session establishment / modification messages transmitted through N4), and the UPF can save the identity information of the AF.

[0187] In one possible implementation, if the SMF also receives the first instruction information from the PCF, the SMF can also send the first instruction information and the identity information of the AF along with the PCC rule information to the UPF, and the UPF can save the first instruction information and the identity information of the AF.

[0188] It should be noted that steps 401 to 406 above can be executed multiple times, and the UPF will obtain the identity information of different AFs. For example, the UPF may obtain the identity information of AF#1, AF#2, AF#3, and AF#4. Alternatively, the UPF may obtain the identity information of AF#1, AF#2, AF#3, and AF#4, as well as the first indication information corresponding to AF#1, AF#2, AF#3, and AF#4.

[0189] Step 407: The terminal establishes a user plane connection with the UPF.

[0190] For example, after the SMF establishes an N4 session connection with the UPF, it can transmit N1N2 messages with the AMF. These N1N2 messages carry a PDU session identifier (PDU SessionID) and a PDU session establishment acceptance message. The AMF can then send the PDU session establishment acceptance message to the terminal through the access network equipment. Upon receiving the PDU session establishment acceptance message, the terminal completes the establishment of a user plane connection with the UPF.

[0191] Step 408: The terminal sends a first service request to the UPF. Correspondingly, the UPF receives the first service request.

[0192] This first service request is also known as the first UDP packet transmission request.

[0193] The first service request includes the address information of the AF. The address information of the AF may include one or more of the AF's IP address, AF's port number, or AF's FQDN. For example, the first service request may include the AF's IP address, or include the AF's IP address and AF's port number, or include the AF's IP address, AF's port number, and AF's FQDN, or include the AF's IP address and AF's FQDN, or include only the AF's FQDN.

[0194] As one implementation method, the first service request includes tuple information corresponding to the first service, and the tuple information includes the address information of the AF.

[0195] This tuple information can be a four-tuple, which includes the source IP address (i.e., the terminal's IP address), the source port number (i.e., the terminal's port number), the destination IP address (i.e., the AF's IP address), and the destination port number (i.e., the AF's port number). The destination IP address constitutes the AF's address information, or the destination IP address and the destination port number constitute the AF's address information.

[0196] For example, this tuple information can also be a 5-tuple, which includes the source IP address (i.e., the terminal's IP address), the source port number (i.e., the terminal's port number), the destination IP address (i.e., the AF's IP address), the destination port number (i.e., the AF's port number), and the protocol type (i.e., the QUIC protocol). The destination IP address constitutes the AF's address information, or the destination IP address and the destination port number constitute the AF's address information.

[0197] For example, when a terminal has a transmission requirement for a first service, the terminal can establish a QUIC connection with the UPF and send the aforementioned first service request to the UPF during or after the establishment of the QUIC connection.

[0198] Step 409: UPF determines to establish the first MASQUE connection between UPF and AF based on the address information of AF corresponding to the first service request and the identity information of AF.

[0199] If the identity information of the AF includes the address information of the AF corresponding to the first service request, then the first MASQUE connection between the UPF and the AF is established.

[0200] For example, the UPF receives and saves the identity information of AF#1, the identity information of AF#2, and the identity information of AF#3. The first service request contains the address information #1 of AF#1. If the UPF determines that the identity information of AF#1 contains the address information #1 of AF#1, then it determines to establish the first MASQUE connection between the UPF and AF#1 based on the address information #1 of AF#1.

[0201] Step 410: Based on the address information of the AF corresponding to the first service request, the UPF establishes the first MASQUE connection between the UPF and the AF corresponding to the first service request.

[0202] The first MASQUE connection can be used to transmit service messages for the first service flow.

[0203] After establishing the first MASQUE connection, the UPF can determine the first mapping information. This first mapping information indicates the mapping relationship between the tuple information corresponding to the first service request and the first MASQUE connection, or it indicates the mapping relationship between the tuple information corresponding to the first service request, the address information of the AF corresponding to the first service request, and the first MASQUE connection. Optionally, the first mapping information also indicates the status of the first MASQUE connection. This first mapping information is used to forward the service packets corresponding to the first service request transmitted between the terminal and the AF corresponding to the first service request. The meaning of the tuple information corresponding to the first service request can be referred to the foregoing description and will not be repeated here. Subsequently, when the UPF receives the service packets of the first service flow corresponding to the first service request from the AF corresponding to the first service request through the first MASQUE connection, it can send the service packets of the first service flow corresponding to the first service request to the terminal according to the first mapping information. For an example of this first mapping information, please refer to Table 2 above.

[0204] Step 411: The terminal sends a second service request to the UPF. Accordingly, the UPF receives the second service request.

[0205] This second service request is also known as the second UDP message transmission request.

[0206] The second service request includes the address information of the AF. The address information of the AF may include one or more of the AF's IP address, AF's port number, or AF's FQDN. For example, the first service request may include the AF's IP address, or include the AF's IP address and AF's port number, or include the AF's IP address, AF's port number, and AF's FQDN, or include the AF's IP address and AF's FQDN, or include only the AF's FQDN.

[0207] In the second service request, the address information of the AF is the same as that of the AF in the first service request.

[0208] As one implementation method, the second service request includes tuple information corresponding to the second service, which includes the address information of the AF.

[0209] This tuple information can be a four-tuple, which includes the source IP address (i.e., the terminal's IP address), the source port number (i.e., the terminal's port number), the destination IP address (i.e., the AF's IP address), and the destination port number (i.e., the AF's port number). The destination IP address constitutes the AF's address information, or the destination IP address and the destination port number constitute the AF's address information.

[0210] For example, this tuple information can also be a 5-tuple, which includes the source IP address (i.e., the terminal's IP address), the source port number (i.e., the terminal's port number), the destination IP address (i.e., the AF's IP address), the destination port number (i.e., the AF's port number), and the protocol type (i.e., the QUIC protocol). The destination IP address constitutes the AF's address information, or the destination IP address and the destination port number constitute the AF's address information.

[0211] For example, when the terminal has a transmission requirement for a second service, it sends the aforementioned second service request to the UPF.

[0212] It should be noted that if both the first service request and the second service request carry quaternion information, the quaternion information in the first service request is not completely the same as that in the second service request. For example, the source IP address (i.e., the terminal's IP address) of the quaternion information in the first service request is different from that in the second service request, and / or the source port number (i.e., the terminal's port number) of the quaternion information in the first service request is different from that in the second service request.

[0213] If both the first service request and the second service request carry 5-tuple information, then the 5-tuple information in the first service request is not completely the same as that in the second service request. For example, the source IP address (i.e., the terminal's IP address) of the 5-tuple information in the first service request is different from that in the second service request, and / or the source port number (i.e., the terminal's port number) of the 5-tuple information in the first service request is different from that in the second service request.

[0214] Step 412: UPF determines to establish a second MASQUE connection between UPF and AF based on the address information of AF corresponding to the second service request and the identity information of AF.

[0215] The address information of the AF corresponding to the second service request is the same as the address information of the AF corresponding to the first service request.

[0216] Since the address information of the AF corresponding to the second service request is the same as the address information of the AF corresponding to the first service request, the UPF determines that the identity information of the obtained AF contains the address information of the AF corresponding to the second service request, and thus the UPF determines to establish a second MASQUE connection between the UPF and the AF.

[0217] For example, the UPF receives and saves the identity information of AF#1, the identity information of AF#2, and the identity information of AF#3. The second service request contains the address information #1 of AF#1. If the UPF determines that the identity information of AF#1 contains the address information #1 of AF#1, then it determines to establish a second MASQUE connection between the UPF and AF#1 based on the address information #1 of AF#1.

[0218] In this method, although the address information of the AF corresponding to the second service request is the same as the address information of the AF corresponding to the first service request, and a first MASQUE connection has been established based on the address information of the AF corresponding to the first service request, the UPF still needs to establish a new MASQUE connection (i.e., a second MASQUE connection) based on the address information of the AF corresponding to the second service request. This second MASQUE connection can be used to transmit the service packets of the second service flow.

[0219] Step 413: Based on the address information of the AF corresponding to the second service request, the UPF establishes a second MASQUE connection between the UPF and the AF corresponding to the second service request.

[0220] The second MASQUE connection can be used to transmit service messages for the second service stream.

[0221] After establishing the second MASQUE connection, the UPF can determine the third mapping information. This third mapping information indicates the mapping relationship between the tuple information corresponding to the second service request and the second MASQUE connection, or it indicates the mapping relationship between the tuple information corresponding to the second service request, the address information of the AF corresponding to the second service request, and the second MASQUE connection. Optionally, the third mapping information also indicates the status of the second MASQUE connection. This third mapping information is used to forward the service packets corresponding to the second service request transmitted between the terminal and the AF corresponding to the second service request. The meaning of the tuple information corresponding to the second service request is similar to that of the tuple information corresponding to the first service request, and can be referred to the foregoing description, which will not be repeated here. Subsequently, when the UPF receives the service packets of the second service flow from the AF corresponding to the second service request through the second MASQUE connection, it can send the service packets of the second service flow corresponding to the second service request to the terminal according to the third mapping information. For an example of this third mapping information, please refer to Table 3 above.

[0222] Step 414: UPF forwards the service messages transmitted between the terminal and AF according to the first mapping information and the third mapping information.

[0223] When the UPF receives a service packet of the first service flow from the AF through the first MASQUE connection, the header of the service packet carries the identifier of the first MASQUE connection. The UPF determines the corresponding four-tuple information or five-tuple information based on the identifier of the first MASQUE connection and the first mapping information, and forwards the service packet to the terminal based on the four-tuple information or five-tuple information.

[0224] When the UPF receives a service message of the second service flow from the AF through the second MASQUE connection, the header of the service message carries the identifier of the second MASQUE connection. The UPF determines the corresponding four-tuple information or five-tuple information based on the identifier of the second MASQUE connection and the third mapping information, and forwards the service message to the terminal based on the four-tuple information or five-tuple information.

[0225] Optionally, the UPF or AF can also release the first MASQUE connection and / or the second MASQUE connection. For example, if the UPF or AF detects that the first MASQUE connection is not transmitting service packets, it can release the first MASQUE connection. This method can save resource overhead for the UPF and AF. Detecting that the first MASQUE connection is not transmitting service packets could be, for example, detecting that the first MASQUE connection has not transmitted service packets within a set time period, or detecting that the service packets transmitted on the first MASQUE connection carry a marker indicating that the service packet is the last service packet in the first service flow. After releasing the first MASQUE connection, the UPF can also delete the aforementioned first mapping information. For another example, if the UPF or AF detects that the second MASQUE connection is not transmitting service packets, it can release the second MASQUE connection. This method can save resource overhead for the UPF and AF. Specifically, detecting that the second MASQUE connection is not transmitting service packets could be achieved in several ways. For example, it could be that the second MASQUE connection has not transmitted any service packets within a set time period, or that a service packet transmitted on the second MASQUE connection carries a marker indicating that the service packet is the last service packet in the second service flow. After releasing the second MASQUE connection, the UPF can also delete the aforementioned third mapping information.

[0226] Based on the above scheme, the UPF can pre-obtain the identity information of each AF in at least one AF. Subsequently, upon receiving a service request, it determines whether a MASQUE connection can be established with that AF based on the identity information of each AF in the at least one AF and the address information of the AF carried in the service request. Therefore, this scheme achieves on-demand establishment of MASQUE connections and transmits service packets through the established MASQUE connections, instead of establishing and maintaining MASQUE connections in advance before receiving service requests. This reduces the resource overhead of the UPF and avoids attacks due to prolonged exposure of MASQUE connections, thus improving the security of MASQUE connections. Furthermore, this scheme only supports one service flow per MASQUE connection, ensuring the transmission quality and latency of the service flow, which is beneficial for improving the service experience.

[0227] Figure 5 This is a flowchart illustrating a communication method provided in an embodiment of this application. In this embodiment, multiple service flows are supported on the MASQUE connection of the AF.

[0228] The method includes the following steps:

[0229] Step 501: The AF sends its identity information to the NEF. Correspondingly, the NEF receives the AF's identity information.

[0230] The identity information of an AF includes at least one address that supports MASQUE connections. Each address can be used to establish one or more MASQUE connections. For example, if the identity information of an AF includes address information #1, address information #2, and address information #3 that support MASQUE connections, then the AF can establish one or more MASQUE connections using each of these three address information.

[0231] For example, the address information supporting a MASQUE connection includes one or more of the following:

[0232] 1) AF's IP address.

[0233] 2) AF port number.

[0234] 3) AF's FQDN.

[0235] For example, the address information supporting MASQUE connections may include an IP address, or an IP address and port number, or an IP address, port number, and FQDN, or an IP address and FQDN, or an FQDN.

[0236] Optionally, in this step, the AF also sends a second indication message to the NEF, which indicates that the MASQUE connection on the AF supports the establishment of multiple service flows.

[0237] In another implementation, if the AF does not send the second indication information, it is assumed that the MASQUE connection on the AF supports the establishment of multiple service flows.

[0238] Step 502: The terminal sends a PDU session establishment request to the AMF. Correspondingly, the AMF receives the PDU session establishment request.

[0239] After receiving a PDU session establishment request from the terminal, the AMF can select the SMF, and then the SMF can obtain the terminal's subscription information, etc. from the UDM.

[0240] Step 503: The NEF sends the AF's identity information to the PCF. Correspondingly, the PCF receives the AF's identity information.

[0241] In one possible implementation, if the NEF also receives a second instruction from the AF, the NEF can also send the second instruction to the PCF in step 503.

[0242] It should be understood that the order of steps 502 and 503 is not limited in the embodiments of this application. Step 503 may occur before step 502, after step 502, or simultaneously with step 502.

[0243] For example, NEF sends the AF's identity information to PCF through the Npcf_PolicyAuthorization service.

[0244] Step 504: The PCF sends the AF's identity information to the SMF. Correspondingly, the SMF receives the AF's identity information.

[0245] During the PDU session establishment process, SMF can request PCC rule information from PCF. PCF can carry the AF's identity information with the PCC rule information and send it to SMF through Npcf_SMPolicyControl service messages, etc.

[0246] In one possible implementation, if the PCF also receives a second instruction from the NEF, the PCF may also send the second instruction and the AF’s identity information together with the PCC rule information to the SMF.

[0247] For example, the PCF sends the AF's identity information to the SMF via Npcf_SMPolicyControlservice.

[0248] Step 505, SMF selects UPF.

[0249] SMF selects a UPF that supports the MASQUE function. Here, UPF support for the MASQUE function means that the UPF supports establishing an MSAQUE connection.

[0250] Step 506: The SMF sends the AF's identity information to the UPF. Correspondingly, the UPF receives the AF's identity information.

[0251] For example, after the SMF selects the UPF, it can establish an N4 session connection with the UPF. The SMF sends the identity information of the AF to the UPF through the N4 interface (such as session establishment / modification messages transmitted through N4), and the UPF can save the identity information of the AF.

[0252] In one possible implementation, if the SMF also receives a second instruction from the PCF, the SMF can also send the second instruction and the AF's identity information together with the PCC rule information to the UPF, and the UPF can save the second instruction and the AF's identity information.

[0253] It should be noted that steps 501 to 506 above can be executed multiple times, and the UPF will obtain the identity information of different AFs. For example, the UPF may obtain the identity information of AF#1, AF#2, AF#3, and AF#4. Alternatively, the UPF may obtain the identity information of AF#1, AF#2, AF#3, and AF#4, as well as the second indication information corresponding to AF#1, AF#2, AF#3, and AF#4.

[0254] Step 507: The terminal establishes a user plane connection with the UPF.

[0255] For example, after the SMF establishes an N4 session connection with the UPF, it can transmit N1N2 messages with the AMF. These N1N2 messages carry a PDU session identifier, a PDU session establishment acceptance message, etc. The AMF can then send the PDU session establishment acceptance message to the terminal through the access network equipment. Upon receiving the PDU session establishment acceptance message, the terminal completes the establishment of a user plane connection with the UPF.

[0256] Step 508: The terminal sends a first service request to the UPF. Correspondingly, the UPF receives the first service request.

[0257] This first service request is also known as the first UDP packet transmission request.

[0258] The first service request includes the address information of the AF. The address information of the AF may include one or more of the AF's IP address, AF's port number, or AF's FQDN. For example, the first service request may include the AF's IP address, or include the AF's IP address and AF's port number, or include the AF's IP address, AF's port number, and AF's FQDN, or include the AF's IP address and AF's FQDN, or include only the AF's FQDN.

[0259] As one implementation method, the first service request includes tuple information corresponding to the first service, and the tuple information includes the address information of the AF.

[0260] This tuple information can be a four-tuple, which includes the source IP address (i.e., the terminal's IP address), the source port number (i.e., the terminal's port number), the destination IP address (i.e., the AF's IP address), and the destination port number (i.e., the AF's port number). The destination IP address constitutes the AF's address information, or the destination IP address and the destination port number constitute the AF's address information.

[0261] For example, this tuple information can also be a 5-tuple, which includes the source IP address (i.e., the terminal's IP address), the source port number (i.e., the terminal's port number), the destination IP address (i.e., the AF's IP address), the destination port number (i.e., the AF's port number), and the protocol type (i.e., the QUIC protocol). The destination IP address constitutes the AF's address information, or the destination IP address and the destination port number constitute the AF's address information.

[0262] For example, when a terminal has a transmission requirement for a first service, the terminal can establish a QUIC connection with the UPF and send the aforementioned first service request to the UPF during or after the establishment of the QUIC connection.

[0263] Step 509: UPF determines to establish the first MASQUE connection between UPF and AF based on the address information of AF corresponding to the first service request and the identity information of AF.

[0264] If the identity information of the AF includes the address information of the AF corresponding to the first service request, then the first MASQUE connection between the UPF and the AF is established.

[0265] For example, the UPF receives and saves the identity information of AF#1, the identity information of AF#2, and the identity information of AF#3. The first service request contains the address information #1 of AF#1. If the UPF determines that the identity information of AF#1 contains the address information #1 of AF#1, then it determines to establish the first MASQUE connection between the UPF and AF#1 based on the address information #1 of AF#1.

[0266] Step 510: Based on the address information of the AF corresponding to the first service request, the UPF establishes the first MASQUE connection between the UPF and the AF corresponding to the first service request.

[0267] The first MASQUE connection can be used to transmit service messages for the first service flow.

[0268] After establishing the first MASQUE connection, the UPF can determine the second mapping information. This second mapping information indicates the mapping relationship between the tuple information corresponding to the first service request and the first service flow, or it indicates the mapping relationship between the tuple information corresponding to the first service request, the address information of the AF corresponding to the first service request, and the first service flow. Optionally, the second mapping information also indicates the status of the first MASQUE connection. This second mapping information is used to forward the service packets of the first service flow corresponding to the first service request transmitted between the terminal and the AF corresponding to the first service request. The meaning of the tuple information corresponding to the first service request can be referred to the foregoing description and will not be repeated here. Subsequently, when the UPF receives the service packets of the first service flow corresponding to the first service request from the AF corresponding to the first service request through the first MASQUE connection, it can send the service packets of the first service flow corresponding to the first service request to the terminal according to the first mapping information. For an example of this first mapping information, please refer to Table 4 above.

[0269] Step 511: The terminal sends a second service request to the UPF. Correspondingly, the UPF receives the second service request.

[0270] This second service request is also known as the second UDP message transmission request.

[0271] The second service request includes the address information of the AF. The address information of the AF may include one or more of the AF's IP address, AF's port number, or AF's FQDN. For example, the first service request may include the AF's IP address, or include the AF's IP address and AF's port number, or include the AF's IP address, AF's port number, and AF's FQDN, or include the AF's IP address and AF's FQDN, or include only the AF's FQDN.

[0272] In the second service request, the address information of the AF is the same as that of the AF in the first service request.

[0273] As one implementation method, the second service request includes tuple information corresponding to the second service, which includes the address information of the AF.

[0274] This tuple information can be a four-tuple, which includes the source IP address (i.e., the terminal's IP address), the source port number (i.e., the terminal's port number), the destination IP address (i.e., the AF's IP address), and the destination port number (i.e., the AF's port number). The destination IP address constitutes the AF's address information, or the destination IP address and the destination port number constitute the AF's address information.

[0275] For example, this tuple information can also be a 5-tuple, which includes the source IP address (i.e., the terminal's IP address), the source port number (i.e., the terminal's port number), the destination IP address (i.e., the AF's IP address), the destination port number (i.e., the AF's port number), and the protocol type (i.e., the QUIC protocol). The destination IP address constitutes the AF's address information, or the destination IP address and the destination port number constitute the AF's address information.

[0276] For example, when the terminal has a transmission requirement for a second service, it sends the aforementioned second service request to the UPF.

[0277] It should be noted that if both the first service request and the second service request carry quaternion information, the quaternion information in the first service request is not completely the same as that in the second service request. For example, the source IP address (i.e., the terminal's IP address) of the quaternion information in the first service request is different from that in the second service request, and / or the source port number (i.e., the terminal's port number) of the quaternion information in the first service request is different from that in the second service request.

[0278] If both the first service request and the second service request carry 5-tuple information, then the 5-tuple information in the first service request is not completely the same as that in the second service request. For example, the source IP address (i.e., the terminal's IP address) of the 5-tuple information in the first service request is different from that in the second service request, and / or the source port number (i.e., the terminal's port number) of the 5-tuple information in the first service request is different from that in the second service request.

[0279] Step 512: UPF determines to establish a second service flow on the first MASQUE connection based on the address information of the AF corresponding to the second service request and the identity information of the AF.

[0280] The address information of the AF corresponding to the second service request is the same as the address information of the AF corresponding to the first service request.

[0281] Since the address information of the AF corresponding to the second service request is the same as the address information of the AF corresponding to the first service request, the UPF determines that the identity information of the obtained AF contains the address information of the AF corresponding to the second service request, and thus the UPF determines to establish the second service flow on the first MASQUE connection.

[0282] For example, the UPF receives and saves the identity information of AF#1, the identity information of AF#2, and the identity information of AF#3. The second service request contains the address information #1 of AF#1. If the UPF determines that the identity information of AF#1 contains the address information #1 of AF#1, then it determines to establish the second service flow on the first MASQUE connection.

[0283] In this method, since the address information of the AF corresponding to the second service request is the same as the address information of the AF corresponding to the first service request, and a first MASQUE connection has already been established based on the address information of the AF corresponding to the first service request, and the first MASQUE connection supports the establishment of multiple service flows (for example, indicated by the aforementioned second indication information, or by default, the MASQUE connection of the AF supports the establishment of multiple service flows), the UPF does not need to establish a new MASQUE connection based on the address information of the AF corresponding to the second service request. Instead, it can reuse the first MASQUE connection and establish the second service flow corresponding to the second service request on the first MASQUE connection. That is, the first MASQUE can be used to transmit both the first service flow and the second service flow.

[0284] Step 513: UPF establishes a second service flow on the first MASQUE connection.

[0285] After establishing the second service flow on the first MASQUE connection, the UPF can determine fourth mapping information. This fourth mapping information indicates the mapping relationship between the tuple information corresponding to the second service request and the second service flow, or it indicates the mapping relationship between the tuple information corresponding to the second service request, the address information of the AF corresponding to the second service request, and the second service flow. Optionally, this fourth mapping information also indicates the status of the first MASQUE connection. This fourth mapping information is used to forward the service packets of the second service flow corresponding to the second service request transmitted between the terminal and the AF corresponding to the second service request. The meaning of the tuple information corresponding to the second service request is similar to that of the tuple information corresponding to the first service request, and can be referred to the foregoing description, which will not be repeated here. Subsequently, when the UPF receives the service packets of the second service flow from the AF corresponding to the second service request through the first MASQUE connection, it can send the service packets of the second service flow corresponding to the second service request to the terminal according to the fourth mapping information. For an example of this fourth mapping information, please refer to Table 5 above.

[0286] Step 514: UPF forwards the service messages transmitted between the terminal and AF according to the second mapping information and the fourth mapping information.

[0287] When the UPF receives a service message of the first service flow from the AF through the first MASQUE connection, the header of the service message carries the identifier of the first MASQUE connection and the identifier of the first service flow. The UPF determines the corresponding four-tuple information or five-tuple information based on the identifier of the first MASQUE connection, the identifier of the first service flow, and the second mapping information, and forwards the service message to the terminal based on the four-tuple information or five-tuple information.

[0288] When the UPF receives a service message of the second service flow from the AF through the first MASQUE connection, the header of the service message carries the identifier of the first MASQUE connection and the identifier of the second service flow. The UPF determines the corresponding four-tuple information or five-tuple information based on the identifier of the first MASQUE connection, the identifier of the second service flow and the fourth mapping information, and forwards the service message to the terminal based on the four-tuple information or five-tuple information.

[0289] Optionally, the UPF or AF can also release the first MASQUE connection. For example, if the UPF or AF detects that the first MASQUE connection is not transmitting service packets, it can release the first MASQUE connection. This method can save resource overhead for the UPF and AF. Detecting that the first MASQUE connection is not transmitting service packets can be, for example, detecting that the first MASQUE connection has not transmitted service packets within a set time period, or it can also be: detecting that a service packet transmitted on the first MASQUE connection carries a marker indicating that the service packet is the last service packet in the first service flow, and detecting that another service packet transmitted on the first MASQUE connection carries a marker indicating that the service packet is the last service packet in the second service flow. After releasing the first MASQUE connection, the UPF can also delete the aforementioned second and fourth mapping information.

[0290] Based on the above scheme, the UPF can pre-obtain the identity information of each AF in at least one AF. Subsequently, upon receiving a service request, it determines whether a MASQUE connection can be established with that AF based on the identity information of each AF in the at least one AF and the address information of the AF carried in the service request. Therefore, this scheme achieves on-demand establishment of MASQUE connections and transmits service packets through the established MASQUE connections, instead of establishing and maintaining MASQUE connections in advance before receiving service requests. This reduces the resource overhead of the UPF and avoids attacks due to prolonged exposure of MASQUE connections, thus improving the security of MASQUE connections. Furthermore, this scheme supports establishing multiple service flows for each MASQUE connection, which can improve resource utilization and help save resources.

[0291] Figure 6 A possible exemplary block diagram of the communication device involved in the embodiments of this application is shown. Figure 6 The communication device 600 shown may include modules or units for implementing the methods described in the embodiments above. In one possible design, the communication device 600 includes a processing unit 602 and a communication unit 603. Optionally, the communication device 600 may further include a storage unit 601 for storing device program code and / or data.

[0292] The communication device 600 can also be a network-side device in the above embodiments, such as a user plane network element on the network side, a module (e.g., circuit, chip or chip system) in the user plane network element, or a logic node, logic module or software that can implement all or part of the functions of the user plane network element.

[0293] For example, in one embodiment, processing unit 602 is configured to obtain the identity information of each application function network element in at least one application function network element, wherein the identity information of each application function network element includes at least one address information supporting a MASQUE connection; communication unit 603 is configured to receive a first service request from a first terminal, wherein the first service request includes the address information of the application function network element corresponding to the first service request; processing unit 602 is further configured to, when the at least one address information supporting a MASQUE connection includes the address information of the application function network element corresponding to the first service request, establish a first MASQUE connection with the application function network element corresponding to the first service request based on the address information of the application function network element corresponding to the first service request, wherein the first MASQUE connection is used to transmit the service message corresponding to the first service request.

[0294] In one possible implementation, the address information supporting MASQUE connections includes an IP address, or includes an IP address and a port number.

[0295] In one possible implementation, after establishing the first MASQUE connection between the application function network element corresponding to the first service request, the processing unit 602 is further configured to establish a first service flow for the first service request based on the first MASQUE connection, wherein the first service flow is used to transmit the service message corresponding to the first service request.

[0296] In one possible implementation, the processing unit 602 is further configured to obtain first indication information, which indicates that the first MASQUE connection does not support the establishment of multiple service flows.

[0297] In one possible implementation, the communication unit 603 is further configured to receive a second service request from a second terminal, the second service request including address information of the application function network element corresponding to the second service request; the processing unit 602 is further configured to, when the address information of the application function network element corresponding to the second service request is the same as the address information of the application function network element corresponding to the first service request, establish a second MASQUE connection with the application function network element corresponding to the second service request based on the address information of the application function network element corresponding to the second service request and the first indication information, the second MASQUE connection being used to transmit the service message corresponding to the second service request; and establish a second service flow for the second service request based on the second MASQUE connection, the second service flow being used to transmit the service message corresponding to the second service request.

[0298] In one possible implementation, the first service request includes tuple information corresponding to the first service, and the tuple information includes address information of the application function network element corresponding to the first service request; the processing unit 602 is further configured to determine first mapping information, the first mapping information being used to indicate the mapping relationship between the tuple information corresponding to the first service request and the first MASQUE connection, or the first mapping information being used to indicate the mapping relationship between the tuple information corresponding to the first service request, the address information of the application function network element corresponding to the first service request, and the first MASQUE connection; the first mapping information is used to forward the service packet corresponding to the first service request transmitted between the first terminal and the application function network element corresponding to the first service request.

[0299] In one possible implementation, the communication unit 603 is further configured to receive, via the first MASQUE connection, a service message corresponding to the first service request from the application function network element corresponding to the first service request; and to send the service message corresponding to the first service request to the first terminal according to the first mapping information.

[0300] In one possible implementation, the processing unit 602 is further configured to acquire second indication information, which indicates that the first MASQUE connection supports the establishment of multiple service flows.

[0301] In one possible implementation, the communication unit 603 is further configured to receive a second service request from a second terminal, the second service request including address information of the application function network element corresponding to the second service request; the processing unit 602 is further configured to, when the address information of the application function network element corresponding to the second service request is the same as the address information of the application function network element corresponding to the first service request, establish a second service flow for the second service request based on the first MASQUE connection and the second indication information, the second service flow being used to transmit the service message corresponding to the second service request.

[0302] In one possible implementation, the first service request includes tuple information corresponding to the first service, and the tuple information includes address information of the application function network element corresponding to the first service request; the processing unit 602 is further configured to determine second mapping information, the second mapping information being used to indicate the mapping relationship between the tuple information corresponding to the first service request and the first service flow, or the second mapping information being used to indicate the mapping relationship between the tuple information corresponding to the first service request, the address information of the application function network element corresponding to the first service request, and the first service flow; the second mapping information is used to forward the service packets of the first service flow corresponding to the first service request transmitted between the first terminal and the application function network element corresponding to the first service request.

[0303] In one possible implementation, the communication unit 603 is further configured to receive, via the first MASQUE connection, a service message corresponding to the first service request from the application function network element corresponding to the first service request; and to send, according to the second mapping information, a service message of the first service flow corresponding to the first service request to the first terminal.

[0304] In one possible implementation, the processing unit 602 is further configured to release the first MASQUE connection if it detects that the first MASQUE connection is not transmitting service packets.

[0305] The communication device 600 can also be a network-side device in the above embodiments, such as an application function network element on the network side, a module (e.g., a circuit, chip, or chip system) in the application function network element, or a logic node, logic module, or software that can implement all or part of the application function network element functions.

[0306] For example, in one embodiment, the processing unit 602 is used to obtain the identity information of the application function network element, the identity information of the application function network element includes at least one address information supporting MASQUE connection; the communication unit 603 is used to send the identity information of the application function network element to the user plane network element.

[0307] In one possible implementation, the communication unit 603 is further configured to send a first indication message to the user plane network element, the first indication message indicating that the MASQUE connection on the application function network element does not support the establishment of multiple service flows.

[0308] In one possible implementation, the communication unit 603 is further configured to send a second indication message to the user plane network element, the second indication message indicating that the MASQUE connection on the application function network element supports the establishment of multiple service flows.

[0309] In one possible implementation, the address information supporting MASQUE connections includes an IP address, or includes an IP address and a port number.

[0310] It is understood that the division of units in the above-described device is merely a logical functional division. One function can correspond to one functional unit, or two or more functions can be integrated into one functional unit. In actual implementation, all or some units can be integrated onto a single physical entity, or distributed across different physical entities. Furthermore, the aforementioned functional units can be implemented in hardware, software, or a combination of both. Whether a function is executed in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for specific applications, but such implementations should not be considered beyond the scope of this application.

[0311] In one example, the functional unit in any of the above devices may be one or more integrated circuits configured to implement the above methods, such as: one or more application-specific integrated circuits (ASICs), or one or more central processing units (CPUs), one or more microcontroller units (MCUs), one or more digital signal processors (DSPs), or one or more field-programmable gate arrays (FPGAs), or a combination of at least two of these integrated circuit forms.

[0312] In one example, storage unit 601 may include random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory and / or registers, etc.

[0313] Figure 7 A possible exemplary block diagram of the communication device involved in the embodiments of this application is shown. Figure 7 The communication device 700 shown includes a processor 710 and an interface circuit 720. The processor 710 and the interface circuit 720 are coupled to each other. It is understood that the interface circuit 720 can be a transceiver or an input / output interface. Optionally, the communication device 700 may also include a memory 730 for storing instructions executed by the processor 710, or storing input data required for the processor 710 to execute instructions, or storing data generated after the processor 710 executes instructions.

[0314] When the communication device 700 is used to implement the above method embodiment, the processor 710 is used to implement the function of the processing unit 602, and the interface circuit 720 is used to implement the function of the communication unit 603.

[0315] It is understood that the processor in the embodiments of this application can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. A general-purpose processor can be a microprocessor or any conventional processor.

[0316] The method steps in the embodiments of this application can be implemented in hardware or by a processor executing software instructions. The software instructions can consist of corresponding software modules, which can be stored in random access memory, flash memory, read-only memory, programmable read-only memory, erasable programmable read-only memory, electrically erasable programmable read-only memory, registers, hard disks, portable hard disks, compact disc read-only memory (CD-ROM), or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor, enabling the processor to read information from and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and storage medium can reside in an ASIC. Furthermore, the ASIC can reside in a first network element or a store-and-forward ground function network element. Alternatively, the processor and storage medium can exist as discrete components in a user plane network element or an application function network element.

[0317] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer programs or instructions. A computer program is a set of instructions that directs each step of an action of an electronic computer or other device with message processing capabilities. It is typically written in a programming language and runs on a target architecture. When the computer program or instructions are loaded and executed on a computer, the processes or functions described in the embodiments of this application are performed, in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer program or instructions can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another. For example, the computer program or instructions can be transferred from one website, computer, server, or data center to another website, computer, server, or data center via wired or wireless means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center integrating one or more available media. The available medium can be a magnetic medium, such as a floppy disk, hard disk, or magnetic tape; it can also be an optical medium, such as a digital video optical disc; or it can be a semiconductor medium, such as a solid-state drive. The computer-readable storage medium can be volatile or non-volatile, or it can include both types of storage media.

[0318] In the various embodiments of this application, unless otherwise specified or in case of logical conflict, the terminology and / or descriptions of different embodiments are consistent and can be referenced by each other. The technical features of different embodiments can be combined to form new embodiments according to their inherent logical relationship.

[0319] In this application, "at least one" means one or more, and "more than one" means two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone, where A and B can be singular or plural. In the textual description of this application, the character " / " generally indicates an "or" relationship between the preceding and following related objects; in the formulas of this application, the character " / " indicates a "division" relationship between the preceding and following related objects.

[0320] It is understood that the various numerical designations used in the embodiments of this application are merely for descriptive convenience and are not intended to limit the scope of the embodiments of this application. The order of the process numbers described above does not imply the order of execution; the execution order of each process should be determined by its function and internal logic.

[0321] The terms "system" and "network" in this application embodiment are used interchangeably. "At least one" refers to one or more, and "multiple" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, "at least one of A, B, or C" includes A, B, C, AB, AC, BC, or ABC; "at least one of A, B, and C" can also be understood as including A, B, C, AB, AC, BC, or ABC. Furthermore, unless otherwise specified, the ordinal numbers such as "first" and "second" mentioned in this application embodiment are used to distinguish multiple objects and are not used to limit the order, sequence, priority, or importance of multiple objects.

[0322] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, optical storage, etc.) containing computer-usable program code.

[0323] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0324] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0325] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0326] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A communication method characterized by comprising: The method comprises: obtaining identity information of each application function network element in at least one application function network element, the identity information of each application function network element comprising at least one address information of a multiplexing application (MASQUE) connection supporting quick user datagram protocol (UDP) network connection encryption; receiving a first service request from a first terminal, the first service request comprising address information of an application function network element corresponding to the first service request; in a case where the at least one address information supporting the MASQUE connection comprises the address information of the application function network element corresponding to the first service request, establishing a first MASQUE connection between the application function network element corresponding to the first service request based on the address information of the application function network element corresponding to the first service request, the first MASQUE connection being used for transmitting service packets corresponding to the first service request.

2. The method of claim 1, wherein, The address information supporting the MASQUE connection comprises an Internet protocol (IP) address or comprises an IP address and a port number.

3. The method of claim 1 or 2, wherein, After the first MASQUE connection between the application function network element corresponding to the first service request is established, the method further comprises: establishing a first service flow for the first service request based on the first MASQUE connection, the first service flow being used for transmitting service packets corresponding to the first service request.

4. The method of claim 3, wherein, The method further comprises: obtaining first indication information, the first indication information indicating that the first MASQUE connection does not support establishment of multiple service flows.

5. The method of claim 4, wherein, The method further comprises: receiving a second service request from a second terminal, the second service request comprising address information of an application function network element corresponding to the second service request; in a case where the address information of the application function network element corresponding to the second service request is the same as the address information of the application function network element corresponding to the first service request, establishing a second MASQUE connection between the application function network element corresponding to the second service request based on the address information of the application function network element corresponding to the second service request and the first indication information, the second MASQUE connection being used for transmitting service packets corresponding to the second service request; establishing a second service flow for the second service request based on the second MASQUE connection, the second service flow being used for transmitting service packets corresponding to the second service request.

6. The method of any one of claims 1 to 5, wherein, The first service request comprises tuple information corresponding to the first service, the tuple information comprising the address information of the application function network element corresponding to the first service request. The method further comprises: determining first mapping information, the first mapping information being used for indicating a mapping relationship between the tuple information corresponding to the first service request and the first MASQUE connection, or the first mapping information being used for indicating a mapping relationship between the tuple information corresponding to the first service request, the address information of the application function network element corresponding to the first service request, and the first MASQUE connection; and the first mapping information being used for forwarding service packets corresponding to the first service request transmitted between the first terminal and the application function network element corresponding to the first service request.

7. The method of claim 6, wherein, The method further comprises: receiving, through the first MASQUE connection, a service packet corresponding to the first service request from an application function network element corresponding to the first service request; sending, to the first terminal, the service packet corresponding to the first service request according to the first mapping information.

8. The method of claim 3, wherein, The method further comprises: obtaining second indication information, the second indication information indicating that the first MASQUE connection supports establishment of multiple service flows.

9. The method of claim 8, wherein, The method further comprises: receiving a second service request from a second terminal, the second service request including address information of an application function network element corresponding to the second service request; in a case where the address information of the application function network element corresponding to the second service request is the same as the address information of the application function network element corresponding to the first service request, establishing, based on the first MASQUE connection and the second indication information, a second service flow for the second service request, the second service flow being used for transmission of a service packet corresponding to the second service request.

10. The method of any one of claims 3, 8, 9, wherein, The first service request includes tuple information corresponding to the first service, and the tuple information includes address information of an application function network element corresponding to the first service request. The method further comprises: determining second mapping information, the second mapping information being used for indicating a mapping relationship between the tuple information corresponding to the first service request and the first service flow, or the second mapping information being used for indicating a mapping relationship between the tuple information corresponding to the first service request, the address information of the application function network element corresponding to the first service request, and the first service flow; and the second mapping information being used for forwarding a service packet of the first service flow corresponding to the first service request transmitted between the first terminal and the application function network element corresponding to the first service request.

11. The method of claim 10, wherein, The method further comprises: receiving, through the first MASQUE connection, a service packet corresponding to the first service request from an application function network element corresponding to the first service request; sending, to the first terminal, the service packet of the first service flow corresponding to the first service request according to the second mapping information.

12. The method of any one of claims 1 to 11, wherein, The method further comprises: detecting that the first MASQUE connection has no service packet to be transmitted, and releasing the first MASQUE connection.

13. A method of communication, comprising: The method further comprises: obtaining identity information of an application function network element, the identity information of the application function network element including at least one address information of a multiplexing application (MASQUE) connection supporting fast Internet Protocol (IP) network connection encryption; sending, to a user plane network element, the identity information of the application function network element.

14. The method of claim 13, wherein, The method further comprises: sending, to the user plane network element, first indication information, the first indication information indicating that a MASQUE connection on the application function network element does not support establishment of multiple service flows.

15. The method of claim 13, wherein, The method further comprises: sending, to the user plane network element, second indication information, the second indication information indicating that the MASQUE connection on the application function network element supports establishment of multiple service flows.

16. The method of any one of claims 13 to 15, wherein, The address information of the MASQUE connection includes an IP address, or includes an IP address and a port number.

17. A communications device, characterized by comprising a module for performing the method of any one of claims 1 to 12, or a module for performing the method of any one of claims 13 to 16.

18. A computer program product, characterised in that, The computer program product comprises instructions which, when executed, implement the method of any one of claims 1 to 12, or implement the method of any one of claims 13 to 16.

19. A computer-readable storage medium, characterized in that, The storage medium stores a computer program or instructions which, when executed, implement the method of any one of claims 1 to 12, or implement the method of any one of claims 13 to 16.

20. A communication system, characterized by comprising a user plane network element for implementing the method of any one of claims 1 to 12, and an application function network element for implementing the method of any one of claims 13 to 16.

Images