COMMUNICATION METHOD, RELATED DEVICE AND SYSTEM

Abstract

The present invention discloses a communication method, related apparatus, and system for reducing the occupation of N32c link resources in an error report sending process. The method in the present invention includes: a first security edge protection proxy (SEPP) device receives a roaming message from an IP exchange (IPX) operator device, the roaming message is used to implement a roaming service between the first SEPP device and a second SEPP device; the first SEPP device determines that the roaming message cannot be processed and sends a feedback message to the IPX device, the feedback message is used to indicate that the first SEPP device cannot process the roaming message.

Description

[Technical field]

[0001] [CROSS-REFERENCE TO RELATED APPLICATIONS] This application claims priority to China Patent Application No. 202011232419.1, entitled “COMMUNICATION METHOD, RELATED APPARATUS, AND SYSTEM”, filed with the China National Intellectual Property Office on November 6, 2020, the entire contents of which are incorporated by reference.

[0002] [Technical field] This application relates to the field of communications technologies, and in particular to communications methods, related devices and systems. [Background technology]

[0003] Currently, the 3rd Generation Partnership Project (3rd generation partnership The 3GPP Security Edge Protection Proxy (SEP) is a e The 5G 5G core network (5G core, 5GC) defines a 5G edge protection proxy (SEPP) device as an edge security gateway of the 5G core network (5G core, 5GC). As shown in FIG. 1, the SEPP device 101 and the SEPP device 102 communicate with each other by using an N32-C (abbreviated as N32c) link and an N32-F (abbreviated as N32f) link.

[0004] In the prior art, the SEPP device 102 communicates with one or more IP exchanges contained on the N32f link. e, IPX) service Receive roaming signaling from the SEPP device 101 forwarded by the device. If the SEPP device 102 determines that it cannot process the roaming signaling, the SEPP device 102 sends an error report to the SEPP device 101 by using the N32c link, and indicates by using the error report that the SEPP device 102 cannot process the roaming signaling.

[0005] In the existing technical solutions, when an error report is transmitted between SEPP devices, the N32c link resource needs to be maintained and used. Summary of the Invention

[0006] The embodiments of this application provide a communication method, related apparatus and system for reducing the occupation of N32c link resources in an error report sending process.

[0007] According to a first aspect, an embodiment of the present invention provides a communication method, the method including: a first security edge protection proxy (SEPP) device receives a roaming message from an IP exchange (IPX) operator device; the roaming message is used to implement a roaming service between the first SEPP device and a second SEPP device; the first SEPP device determines that the roaming message cannot be processed and sends a feedback message to the IPX device; the feedback message is used to indicate that the first SEPP device cannot process the roaming message.

[0008] It can be seen that when the first SEPP device determines that the roaming message from the second SEPP device cannot be processed, the first SEPP device may send a feedback message to the second SEPP device, which is used to indicate that the first SEPP device cannot process the roaming message, to send an error report by sending a feedback message, by using the N32f link. It can be seen that the feedback message is transmitted by using the N32f link, so that the transmission of the feedback message does not need to occupy the N32c link resource. The roaming message and the feedback message can be transmitted by using the N32f link, which reduces the difficulty and improves the efficiency in indicating that the roaming message cannot be processed by the first SEPP device to the second SEPP device. Furthermore, the feedback message is transmitted to the second SEPP device by using an IPX device included on the N32f link. In this way, the utilization rate of each IPX device can be improved, and each IPX device on the N32f link can be fully used, thereby avoiding the wasteful occupation of system resources by IPX devices when feedback messages are transmitted by using the N32c link, improving the utilization rate of system resources, and avoiding the waste of system resources.

[0009] According to the first aspect, in an optional implementation manner, the method further includes: when the first SEPP device and the second SEPP device exchange a target shared key by using the N32c link, the first SEPP device releases the N32c link. The target shared key is used to implement secure communication between the first SEPP device and the second SEPP device.

[0010] Based on the first aspect, in an optional implementation manner, the method further includes: the first SEPP device sends a release request message to the second SEPP device by using an N32c link. The release request message is used to request the second SEPP device to release the N32c link.

[0011] According to the first aspect, in an optional implementation manner, the method further includes: the first SEPP device releases a connection relationship between a transport layer security (TLS) link and an N32c link, clears resources related to the N32c link, and releases the N32c link. After the N32c link is released, the TLS link can be released.

[0012] It can be seen that the first SEPP device and the second SEPP device perform a feedback message transmission procedure by using an N32f link. In this case, when the N32f link is successfully established, the first SEPP device and the second SEPP device may release the N32c link, thereby effectively reducing the overhead for maintaining the long-life connection of the N32c link.

[0013] Based on the first aspect, in an optional implementation manner, before the first security edge protection proxy (SEPP) device receives a roaming message from an IP exchange (IPX) operator device, the method further includes: the first SEPP device sends a roaming request message to the IPX device; the roaming request message is used to request a roaming service from a second SEPP device, and the roaming request message includes an address of the second SEPP device; and the roaming message is a roaming response message generated by the second SEPP device based on the roaming request message.

[0014] It can be seen that in this implementation, the first SEPP device acts as a roaming service requester, and the second SEPP device acts as a roaming service responder. The first SEPP device requests a roaming service from the second SEPP device by using a roaming request message.

[0015] Based on the first aspect, in an optional implementation manner, the method further includes: the first SEPP device determines a corresponding address of the second SEPP device based on an N32f context identifier included in the roaming message; the first SEPP device generates a feedback message; the feedback message includes an address of the second SEPP device, and the feedback message is used to indicate that the first SEPP device cannot process the roaming response message.

[0016] When the first SEPP device determines that the roaming response message cannot be processed, the first SEPP device knows to send a feedback message to the second SEPP device by using the N32f link. The feedback message is sent to the second SEPP device by using the N32f link, so that the N32c link resource does not need to be occupied, and therefore N32f Improves utilization of each IPX device involved on the link.

[0017] Based on the first aspect, in an optional implementation manner, the roaming message is a roaming request message used to request a roaming service from a first SEPP device, and the roaming message includes an address of the first SEPP device.

[0018] It can be seen that in this implementation, the first SEPP device acts as a responder of the roaming service, and the second SEPP device acts as a requester of the roaming service. The second SEPP device requests the roaming service from the first SEPP device by using a roaming message.

[0019] Based on the first aspect, in an optional implementation manner, the method further includes: If the first SEPP device determines that the roaming message meets at least one of the following: the roaming message cannot be decrypted, an integrity check on the roaming message fails, an integrity check on a modified block of the roaming message fails, a JSON patch program fails to be applied to the modified block of the roaming message, or a HyperText Transfer Protocol version 2 (HTTP / 2) message fails to be reconstructed based on the roaming message, the first SEPP device determines that the first SEPP device cannot process the roaming message.

[0020] Based on the first aspect, in an optional implementation, the feedback message is further used to indicate the reason why the first SEPP device cannot process the roaming message, which may be one or more of the following: the roaming message cannot be decrypted, an integrity check on the roaming message fails, an integrity check on a modified block of the roaming message fails, a JSON patch program fails to be applied to the modified block of the roaming message, or a HyperText Transfer Protocol version 2 (HTTP / 2) message fails to be reconstructed based on the roaming message.

[0021] Reconstructing the HTTP / 2 message based on the roaming message may involve extracting the HTTP / 2 message from a message body of the roaming message.

[0022] Based on the first aspect, in an optional implementation manner, the feedback message includes an N32f context identifier, and the N32f context identifier is used to indicate the target shared key used to decrypt the feedback message.

[0023] Based on the first aspect, in an optional implementation manner, after the first SEPP device determines that the roaming message cannot be processed, the method further includes: the first SEPP device sends a feedback message to a network function (NF).

[0024] According to a second aspect, an embodiment of the present invention provides a communication method, the method including: a second security edge protection proxy (SEPP) device receives a signaling message sent by a network function device (NF) and sends a roaming message to an IP exchange (IPX) operator device. The roaming message is used to implement a roaming service between the first SEPP device and the second SEPP device, and the roaming message includes the signaling message; the second SEPP device receives a feedback message from the IPX device. The feedback message is used to indicate that the first SEPP device cannot process the roaming message.

[0025] For the description of the beneficial effects in this embodiment, please refer to the first embodiment, and the details will not be described again.

[0026] According to the second aspect, in an optional implementation manner, the method further includes: when the first SEPP device and the second SEPP device exchange a target shared key by using the N32c link, the second SEPP device releases the N32c link. The target shared key is used to implement secure communication between the first SEPP device and the second SEPP device.

[0027] Based on the second aspect, in an optional implementation manner, a second SEPP device receives a release request message from a first SEPP device. The release request message is used to request the second SEPP device to release an N32c link.

[0028] According to the second aspect, in an optional implementation manner, the second SEPP device releases the N32c link according to the release request message, and clears the resources related to the N32c link at the second SEPP device side. After the N32c link is released, the TLS link can be released.

[0029] Based on the second aspect, in an optional implementation manner, before the second security edge protection proxy (SEPP) device sends a roaming message to the IP exchange (IPX) operator device, the method further includes: the second SEPP device receives a roaming request message from the IPX device; the roaming request message is used to request a roaming service from the second SEPP device, and the roaming request message includes an address of the second SEPP device; the second SEPP device generates a roaming response message based on the roaming request message; the roaming response message is a roaming message.

[0030] Based on the second aspect, in an optional implementation manner, the feedback message includes an address of the second SEPP device, and the feedback message is used to indicate that the first SEPP device cannot process the roaming response message.

[0031] Based on the second aspect, in an optional implementation manner, the roaming message is a roaming request message used to request a roaming service from a first SEPP device, and the roaming message includes an address of the first SEPP device.

[0032] Based on the second aspect, in an optional implementation manner, the feedback message is further used to indicate the reason why the first SEPP device cannot process the roaming message.

[0033] Based on the second aspect, in an optional implementation manner, the reason is at least one of the following: the roaming message cannot be decrypted, an integrity check on the roaming message fails, an integrity check on a modified block of the roaming message fails, a JSON patch program fails to be applied to the modified block of the roaming message, or a Hypertext Transfer Protocol Secure / 2 (HTTP / 2) message fails to be reconstructed based on the roaming message.

[0034] According to the second aspect, in an optional implementation manner, the feedback message includes an N32f context identifier, and after the second SEPP device receives the feedback message from the IPX device, the method further includes: The second SEPP device obtains a target shared key corresponding to the N32f context identifier; The second SEPP device decrypts the feedback message by using the target shared key.

[0035] According to a third aspect, an embodiment of the present invention provides a Security Edge Protection Proxy (SEPP) device including at least one processor and a memory coupled to each other, the memory storing computer program code and the processor calling and executing the computer program code in the memory to enable the SEPP device to perform a method according to the first aspect or a method according to the second aspect.

[0036] According to a fourth aspect, an embodiment of the present invention provides a security edge protection proxy (SEPP) device, including a receiving unit, a processing unit, and a transmitting unit, where the receiving unit is configured to perform the receiving-related steps of the first aspect or the second aspect, the processing unit is configured to perform the processing-related steps of the first aspect or the second aspect, and the transmitting unit is configured to perform the transmitting-related steps of the first aspect or the second aspect.

[0037] According to a fifth aspect, an embodiment of the present invention provides a computer readable storage medium storing a computer program which, when executed by a processor, is capable of performing the method according to the first aspect or the method according to the second aspect.

[0038] According to a sixth aspect, an embodiment of the present invention provides a communication system including a first Security Edge Protection Proxy (SEPP) device and a second SEPP device, the first SEPP device configured to perform a method according to the first aspect and the second SEPP device configured to perform a method according to the second aspect.

[0039] According to a seventh aspect, an embodiment of the present invention provides a communication apparatus including at least one input device, a processor and at least one output device, the input device configured to perform the receiving related steps of the first or second aspect, the processor configured to perform the processing related steps of the first or second aspect and the output device configured to perform the transmitting related steps of the first or second aspect.

[0040] According to an eighth aspect, an embodiment of the present invention provides a communication apparatus including an input interface circuit, a logic circuit, and an output interface circuit, the logic circuit being configured to perform a method performed by a first SEPP device according to a first aspect of the embodiment of the present application, or the logic circuit being configured to perform a method performed by a second SEPP device according to a second aspect of the embodiment of the present application.

[0041] According to a ninth aspect, an embodiment of the present invention provides a computer program product comprising instructions which, when executed on a computing device, enable the computing device to perform a method according to the first aspect executable by a first SEPP device, or alternatively enable the computing device to perform a method according to the second aspect executable by a second SEPP device.

[0042] According to a tenth aspect, an embodiment of the present invention provides a communication system including a first security edge protection proxy (SEPP) device and an IPX device. The IPX device is configured to send a roaming message to the first SEPP device. The roaming message is used to implement a roaming service between the first SEPP device and a second SEPP device. The first SEPP device is configured to perform a method according to the first aspect.

[0043] According to an eleventh aspect, an embodiment of the present invention provides a communication system including a network function device (NF) and a second security edge protection proxy (SEPP) device. The network function device (NF) is configured to perform a step of sending a signaling message to the second SEPP device. The second SEPP device is configured to perform a method according to the second aspect.

[0044] In the technical solution in any one of the above aspects, the address of the SEPP device may be a fully qualified domain name (FQDN), a physical address, an IP address, etc. of the SEPP device. The address of the SEPP device may be referred to as an identifier of the SEPP device.

[0045] In the technical solution in any one of the above aspects, the roaming message may be a service discovery request or a network slice request. [Brief description of the drawings]

[0046] [Figure 1] 1 is an exemplary diagram of the structure of a communication system; [Diagram 2] FIG. 1 is a schematic diagram of a 5G network architecture according to an embodiment of this application. [Diagram 3] FIG. 2 is an exemplary diagram of another structure of a communication system. [Figure 4] 2 is a flowchart of steps of a communication method according to an embodiment of the present application. [Diagram 5] 4 is a flowchart of steps of another communication method according to an embodiment of the present application. [Figure 6A] 4 is a flowchart of steps of another communication method according to an embodiment of the present application. [Figure 6B] 4 is a flowchart of steps of another communication method according to an embodiment of the present application. [Figure 7] 1 shows an example of a structure of a SEPP device according to an embodiment of the present application. [Figure 8] 1 is a schematic diagram of the structure of a communication device according to an embodiment of this application; [Figure 9] 2 is a schematic diagram of an interface of a board in a communication device according to an embodiment of the present application; [Figure 10] 13 shows another example structure of a SEPP device according to an embodiment of the present application. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0047] The following clearly and completely describes the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. It is clear that the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0048] In the specification, claims, and accompanying drawings of this application, terms such as "first" and "second" are intended to distinguish between similar objects and do not necessarily indicate a particular order or sequence. The objects so used are interchangeable, under appropriate circumstances, and it should be understood that the embodiments described herein may be practiced in orders other than those illustrated or described herein.

[0049] 2 is a schematic diagram of an example of a 5G network architecture according to an embodiment of this application. In a 5G network, some functional devices in a 4G network (e.g., a mobility management entity (MME)) are split and a service-oriented architecture is defined. In the network architecture shown in FIG. 2, functions similar to those of the MME in a 4G network are split into an access and mobility management function (AMF), a session management function (SMF), etc.

[0050] The 5G network architecture is described below.

[0051] A user equipment (UE) accesses a data network (DN) by accessing an operator network, so that the UE can use services provided by the operator or a third party on the data network.

[0052] For ease of description, in the embodiments of this application, a user terminal, a user equipment, a terminal device, a mobile terminal or a terminal may be collectively referred to as a UE. That is, unless otherwise specified, the UE described below in the embodiments of this application may be replaced with a user terminal, a user equipment, a terminal device, a mobile terminal or a terminal. Obviously, they may also be interchanged with each other.

[0053] The access and mobility management function (AMF) is a control plane functional device in a 3GPP network, and is mainly responsible for access control and mobility management when a UE accesses an operator network. A security anchor function (SEAF) may be deployed in the AMF, or the SEAF may be deployed in other devices different from the AMF. In FIG. 2, for example, the SEAF is deployed in the AMF. When the SEAF is deployed in the AMF, the SEAF and the AMF may be collectively referred to as the AMF.

[0054] Session management function (SMF) is a control plane functional device in 3GPP network. SMF is mainly configured to manage packet data unit (PDU) sessions of UE. PDU session is a channel for transmitting PDU. UE and DN may send PDU to each other by using PDU session. SMF is responsible for management such as establishment, maintenance and deletion of PDU session.

[0055] A data network, also called a packet data network (PDN), is a network located outside the 3GPP network. Multiple DNs may be connected to the 3GPP network, and multiple services provided by an operator or a third party may be deployed on the DNs.

[0056] The unified data management (UDM) entity is also a control plane functional device in a 3GPP network. The UDM manages subscription data, credentials, and subscription persistent identifiers (PMIs) of a subscriber (UE) in a 3GPP network. subscription The UDM is mainly configured to store the UE's home address, the UE's permanent identifier (SUPI), etc. The data may be used for authentication and authorization when the UE accesses the operator's 3GPP network. Furthermore, the UDM may further integrate the functions of a home subscriber server (HSS) and a home location register (HLR) in the network.

[0057] The authentication server function (AUSF) is also a control plane functional device in a 3GPP network. The AUSF is mainly responsible for the first level authentication (i.e., authentication performed by the 3GPP network for a subscriber of the 3GPP network).

[0058] The network exposure function (NEF) is also a control plane functional device in a 3GPP network. The NEF is mainly configured to expose the external interface of the 3GPP network to third parties in a secure manner.

[0059] A network repository function (NRF) is also a control plane functional device in a 3GPP network, and is primarily configured to store configurations and service profiles of accessible network functions (NFs) and to provide network function discovery services to other network elements.

[0060] The user plane function (UPF) is the gateway for communication between the 3GPP network and the DN.

[0061] A policy control function (PCF) is a control plane functional device in a 3GPP network and is configured to provide PDU session policies to the SMF. The policies may include charging, quality of service (QoS), or admission-related policies, etc.

[0062] An access network (AN) is a subnetwork of a 3GPP network. A UE needs to access a 3GPP network through an AN. In a wireless access scenario, the AN is also called a radio access network (RAN).

[0063] As an edge security gateway of the 5G core network (5GC), the SEPP device mainly functions as a proxy for interconnection between operator networks. Signaling messages between the internal network functions (NFs) of the 5G core network and roaming networks are forwarded by the SEPP device.

[0064] A 3GPP network is a network that complies with 3GPP specifications. In FIG. 2, parts other than the UE and the DN may be considered as a 3GPP network. The 3GPP network is not limited to a 5G network, and may alternatively include a 2G network, a 3G network, or a 4G network. Typically, a 3GPP network is operated by an operator. Furthermore, N1, N2, N3, N4, N6, etc. in the architecture shown in FIG. 2 each represent a reference point between related entities or network functions. Nausf, Namf, etc. each represent a service-oriented interface of related network functions.

[0065] Obviously, 3GPP networks and non-3GPP networks may coexist, and some network elements in a 5G network may also be used in some non-5G networks.

[0066] 1 and 2, as an edge security gateway, the SEPP device supports integrity and confidentiality protection for a transmission message, and further supports at least one of identifying or modifying the content of the transmission message by the IPX device. Modifying the transmission message by the SEPP device may be the SEPP device modifying a message header of the transmission message.

[0067] An IPX device may include a Diameter routing agent (DRA) device or a domain name server (DNS). Additionally, an IPX device may be referred to as a hypertext transfer protocol (HTTP) proxy.

[0068] In embodiments of this application, a SEPP device may also be abbreviated as SEPP (e.g., a first SEPP device may be abbreviated as first SEPP, a second SEPP device may be abbreviated as second SEPP, and so on). In other words, SEPP and SEPP devices may be interchangeable. An IPX device may be abbreviated as IPX (e.g., a first IPX device may be abbreviated as first IPX, a second IPX device may be abbreviated as second IPX, and so on). In other words, IPX and IPX devices may be interchangeable.

[0069] When the UE roams between different operator networks, the SEPP device is connected to the visited SEPP device ( visited SEPP devices may also be classified into types: SEPP device (vSEPP device) and home SEPP device (hSEPP device).

[0070] Refer to Fig. 1. When the SEPP device 101 and the SEPP device 102 belong to different operator networks, the SEPP device 101 and the SEPP device 102 may be connected through an N32 interface. For example, in an example where the SEPP device 101 functions as a vSEPP device and the SEPP device 102 functions as an hSEPP device, the SEPP device 101 and the SEPP device 102 are directly connected through an N32-C (abbreviated as N32c) interface, and the link for communication between the SEPP device 101 and the SEPP device 102 based on the N32c interface is the N32c link, which is used to perform the initial handshake and negotiation between the SEPP device 101 and the SEPP device 102 and transmit the N32 message.

[0071] Alternatively, the SEPP device 102 may be connected to an IPX device through an N32-F (abbreviated as N32f) interface, and the IPX device is then connected to the SEPP device 101 through the N32f interface. The link for communication between the SEPP device 101 and the SEPP device 102 based on the N32f interface is the N32f link. The N32f interface is configured to implement communication between the network function 103 and the network function 104. The network function 103 is a network function connected to the SEPP device 101, and the network function 104 is a network function connected to the SEPP device 102.

[0072] One or more IPX devices may be connected between the SEPP device 101 and the SEPP device 102. The number of IPX devices connected between the SEPP device 101 and the SEPP device 102 is not limited in the embodiment. For example, as shown in FIG. 1, the IPX device 105 and the IPX device 106 are connected in sequence between the SEPP device 101 and the SEPP device 102.

[0073] It should be noted that in the embodiment, the types of the two connected SEPP devices (e.g., SEPP device 101 and SEPP device 102 shown in FIG. 1) are described as optional examples and are not limited. For example, from the perspective of service provision and service consumption, the SEPP devices may be classified as consumer SEPP devices. r SEPP device, cSEPP) and producer SEPP device r A vSEPP device may be a pSEPP device and an hSEPP device may be a cSEPP device. Alternatively, a vSEPP device may be a cSEPP device and an hSEPP device may be a pSEPP device.

[0074] It should be noted that in the examples shown in Figures 1 and 2, an example in which one SEPP device is deployed in one 5GC is used for explanation. The number of SEPP devices deployed in one 5GC is not limited in the embodiment. For example, as shown in Figure 3, a public land mobile network (PLMN) of an operator A includes a 5GC 310, a SEPP device 311, ..., and a SEPP device 31N connected to the 5GC 310. The specific value of N is not limited in the embodiment, provided that N is a positive integer greater than 1.

[0075] An operator A is interconnected with multiple other operator networks (or called roaming partners for short). Different roaming partners have different PLMNs. As shown in FIG. 3, an example in which an operator A corresponds to a roaming partner 1 and a roaming partner C is used for explanation. The PLMN of the roaming partner 1 includes a 5GC 320, a SEPP device 321, ..., and a SEPP device 32M connected to the 5GC 320. The PLMN of the roaming partner C includes a 5GC 330, a SEPP device 331, ..., and a SEPP device 33P connected to the 5GC 330. The specific values ​​of M and P are not limited in the embodiment, provided that M and P are positive integers greater than 1.

[0076] For example, when operator A is interconnected with roaming partner 1, the SEPP device 311 of operator A communicates with the SEPP device 321 of roaming partner 1 by using the N32c link and the N32f link. In another example, when operator A is interconnected with roaming partner C, the SEPP device 31N of operator A communicates with the SEPP device 33P of roaming partner C by using the N32c link and the N32f link. For the description of the N32c link and the N32f link, please refer to the above description. The details will not be described again.

[0077] Based on the above network architecture, an embodiment of this application provides a communication method. According to the communication method in this embodiment, in the process of performing an error reporting procedure between two SEPP devices, coordination between the N32c link and the N32f link is not required, thereby effectively reducing the complexity of the error reporting procedure and improving the efficiency. With reference to Figure 4, the following describes the execution process of the communication method provided in this application.

[0078] Step 401: Establish an N32c link and an N32f link between a first SEPP device and a second SEPP device.

[0079] The first SEPP device and the second SEPP device in this embodiment may belong to PLMNs of different operators, and the first SEPP device in this embodiment is a requester of a roaming service, and the second SEPP device is a responder of a roaming service.

[0080] For example, in this embodiment, the first SEPP device is a cSEPP and the second SEPP device is a pSEPP. In another example, the first SEPP device is a vSEPP device and the second SEPP device is a hSEPP device.

[0081] It should be noted that in other examples, the "first" and "second" in the first SEPP device and the second SEPP device are used to distinguish between two different SEPP devices. It should be understood that the first SEPP device and the second SEPP device are interchangeable, i.e., the first SEPP device is a responder of the roaming service and the second SEPP device is a requester of the roaming service.

[0082] The purpose of establishing an N32c link between a first SEPP device and a second SEPP device will then be described.

[0083] When an N32c link is established between a first SEPP device and a second SEPP device, the first SEPP device and the second SEPP device may agree on a security mechanism for protecting messages transmitted over N32f.

[0084] Further, a process of establishing an N32c link between a first SEPP device and a second SEPP device is described with reference to the following steps.

[0085] Step a1: A first SEPP device sends a first request message to a second SEPP device, where the first request message includes at least initial security negotiation data and an address of the first SEPP device.

[0086] The initial security negotiation data is security negotiation data supported by the first SEPP device, and the security negotiation data may be at least one of protocol for N32 interconnect security (PRINS) parameters or transport layer security (TLS) parameters.

[0087] Specifically, the first SEPP device may pre-store the address of the second SEPP device, and when an N32c link between the first SEPP device and the second SEPP device is established, the first SEPP device may send a first request message to the second SEPP device having the address of the second SEPP device.

[0088] Optionally, the first request message may further include information about the operator to which the first SEPP device belongs, an identifier of the first SEPP device, etc. The first request message may further carry an address of the second SEPP device.

[0089] Step a2: The second SEPP device sends a first response message to the first SEPP device.

[0090] The first response message includes a "200" status code and the target security negotiation data selected by the second SEPP device.

[0091] The target security negotiation data is security negotiation data determined by the second SEPP device and supported by both the first SEPP device and the second SEPP device.

[0092] Specifically, the second SEPP device may send a first response message to the first SEPP device based on the address of the first SEPP device included in the first request message.

[0093] The first SEPP device and the second SEPP device perform steps a1 and a2 to establish an N32c link.

[0094] The first SEPP device and the second SEPP device perform an initial handshake and negotiation between the first SEPP device and the second SEPP device by using the N32c link to transmit N32 messages, and then establish an N32f link.

[0095] Step 402: The first NF sends a first signaling message to the first SEPP device.

[0096] The first NF and the first SEPP device belong to the same PLMN, and the first NF requests a roaming service from the PLMN to which the second SEPP device belongs by using a first signaling message. It should be noted that the specific service type of the roaming service is not limited in this embodiment.

[0097] For example, the roaming service may be any one of a roaming registration service, a roaming deregistration service, or a roaming location service.

[0098] The roaming registration service means that a UE belonging to a PLMN of a first SEPP device moves to a PLMN to which a second SEPP device belongs, in which case the first signaling message is used to request the UE to register in the PLMN of the second SEPP device, so that the UE uses the roaming service of the PLMN to which the second SEPP device belongs.

[0099] The roaming deregistration service means that the UE deregisters from the PLMN to which the second SEPP device belongs, and does not use the roaming service of the PLMN to which the second SEPP device belongs.

[0100] The roaming location service means that a UE belonging to a PLMN of a first SEPP moves to a PLMN to which a second SEPP device belongs, and in this case, a first signaling message is used to request the second SEPP device to send the location information of the UE.

[0101] The execution time sequence between step 401 and step 402 in this embodiment is not limited.

[0102] Step 403: The first SEPP device sends a roaming request message to the IPX device.

[0103] The roaming request message in this embodiment is a roaming message used to request a roaming service from the second SEPP.

[0104] Specifically, the first signaling message is a signal according to the Hypertext Transfer Protocol version 2 (HTP2). version 2, HTTP / 2) message. The first SEPP device may convert the first signaling message into a roaming request message that can be transmitted over an N32f interface. The roaming request message satisfies an N32f interface protocol, so that the roaming request message can be transmitted over the N32f interface.

[0105] The following describes a process in which the first SEPP device converts the first signaling message into a roaming request message.

[0106] When the first SEPP device receives the first signaling message from the first NF, the first SEPP device may convert the first signaling message into a roaming request message, specifically, the roaming request message includes at least the encrypted first signaling message, the address of the second SEPP device, and an N32f context identifier.

[0107] Specifically, the first SEPP device may encrypt the first signaling message by using a target shared key (short for shared key) to generate a roaming request message. The target shared key is described below.

[0108] In this embodiment, the first SEPP device and the second SEPP device invoke a transport layer security (TLS) protocol stack to establish a TLS link between the first SEPP device and the second SEPP device.

[0109] The TLS link is first SEPPWhen the first SEPP device and the second SEPP device are established, the first SEPP device and the second SEPP device may perform secure communication by using a TLS link to establish an N32c link and an N32f link between the first SEPP device and the second SEPP device. For the specific process of establishing an N32c link and an N32f link, refer to step 401. The details will not be described again.

[0110] After the TLS link is successfully established, the first SEPP device and the second SEPP device export a target shared key by using the TLS link, which is used to protect the transmission of related messages on the N32f link.

[0111] In this embodiment, when the first SEPP device and the second SEPP device establish an N32f link, the first SEPP device and the second SEPP device each create an N32f context. The N32f context stored in the first SEPP device includes at least a correspondence relationship between an N32f context identifier, a target shared key, and an address of the second SEPP device. The N32f context stored in the second SEPP device includes at least a correspondence relationship between an N32f context identifier, a target shared key, and an address of the first SEPP device.

[0112] The first SEPP device and the second SEPP device may exchange messages by using the N32f link based on the N32f context.

[0113] The correspondence in this embodiment may be stored or recorded by using a function relationship, a table, a mapping relationship, or the like.

[0114] When the second SEPP device receives the N32f context identifier, the second SEPP device may decrypt the encrypted first signaling message by using the target shared key corresponding to the N32f context identifier to obtain the first signaling message.

[0115] When the first SEPP device obtains the roaming request message, the first SEPP device sends the roaming request message to the second SEPP device in the following manner.

[0116] (1) If the N32f link between the first SEPP device and the second SEPP device includes one IPX device, the first SEPP device sends a roam request message to the IPX device through the N32f interface.

[0117] Specifically, the first SEPP device may pre-store the address of the IPX device, and the first SEPP device may send a roaming request message to the IPX device having the IPX address.

[0118] The IPX device sends a roaming request message to a second SEPP device having an address of the second SEPP device based on the address of the second SEPP device included in the roaming request message.

[0119] (2) If the N32f link between the first SEPP device and the second SEPP device includes multiple IPX devices, for example, as shown in FIG. 1, if the N32f link includes two IPX devices, namely, IPX device 105 and IPX device 106, the first SEPP device sends a roaming request message to IPX device 105 connected to the first SEPP device via the N32f interface.

[0120] IPX Devices 105may determine, based on the address of the second SEPP device included in the roaming request message, that the next hop IPX device for sending the roaming request message to the second SEPP device is IPX device 106, and then IPX device 105 may send the roaming request message to IPX device 106.

[0121] The IPX device 106 sends a roaming request message to the second SEPP device having the address of the second SEPP device by using the address of the second SEPP device included in the roaming request message.

[0122] A specific format of the roaming request message is described below. It should be explicitly noted that the format of the roaming request message in this embodiment is described as an optional example, and is not limited.

[0123] The roaming request message in this embodiment mainly includes two parts: a request header and a request body.

[0124] The request header includes at least an HTTP / 2 protocol version used to exchange messages between the first SEPP device and the second SEPP device. The request body includes a roaming request message.

[0125] Step 404: The IPX device sends a roaming request message to the second SEPP device.

[0126] Step 405: The second SEPP device determines whether the roaming request message can be processed, and executes step 406 if the roaming request message can be processed, or executes step 407 if the roaming request message cannot be processed.

[0127] Specifically, if the second SEPP device determines that the received roaming request message satisfies at least one of the following: the second SEPP device is unable to decrypt the roaming request message; the second SEPP device fails to perform an integrity check on the roaming request message; the second SEPP device fails to perform an integrity check on a modification block of the roaming request message; the second SEPP device fails to apply a JSON patch program to the modification block of the roaming request message; or the second SEPP device fails to reconstruct an HTTP / 2 message based on the roaming message, the second SEPP device may determine that the second SEPP device is unable to process the roaming request message.

[0128] The second SEPP device cannot decrypt the roaming request message may be as follows: The second SEPP device obtains a target shared key corresponding to the N32f context identifier based on the N32f context identifier included in the roaming request message, and then decrypts the encrypted first signaling message by using the target shared key. If the second SEPP device determines that the encrypted first signaling message cannot be decrypted based on the shared key, the second SEPP device determines that the second SEPP device cannot decrypt the roaming request message.

[0129] The second SEPP device fails to perform an integrity check on the roaming request message may be as follows: If the second SEPP device fails to perform an integrity check on the roaming request message, it is determined that the roaming request message has been tampered with.

[0130] The second SEPP device fails to perform an integrity check on the modified block of the roaming request message specifically means that: the modified block of the roaming request message is a modified part of the roaming request message; if the second SEPP device fails to perform an integrity check on the modified block of the roaming request message, it is determined that the modified block of the roaming request message has been tampered with.

[0131] The failure of the second SEPP device to reconstruct the HTTP / 2 message based on the roaming request message specifically means that: In this embodiment, in order to enable the PLMN to which the second SEPP device belongs to implement the roaming service requested by the roaming request message from the first SEPP device, the second SEPP device may reconstruct the roaming request message as an HTTP / 2 message, so that the second NF belonging to the second PLMN of the second SEPP device can process the second signaling message to implement the roaming service requested by the first SEPP. It can be seen that if the second SEPP device cannot successfully reconstruct the roaming request message as an HTTP / 2 message, the second SEPP device determines that the HTTP / 2 message fails to be reconstructed.

[0132] Step 406: The second SEPP device sends a second signaling message to the second NF.

[0133] When the second SEPP device can process the roaming request message, the second SEPP device may obtain the second signaling message and send the second signaling message to the second NF, so that the second NF performs a corresponding roaming service based on the second signaling message.

[0134] For example, if the second signaling message is used to register the UE to the second PLMN, the second NF may register the UE to the second PLMN, so that the second PLMN provides roaming services to the UE. In another example, if the second signaling message is used to deregister the UE from the second PLMN to which the second NF belongs, the second NF may deregister the UE from the second PLMN, so that the second PLMN does not provide roaming services to the UE.

[0135] Step 407: The second SEPP device sends a first roaming response message to the IPX device.

[0136] In this embodiment, when the second SEPP device determines that the roaming request message cannot be processed, the second SEPP device may generate a first roaming response message. The first roaming response message is a feedback message used to indicate that the second SEPP device cannot process the roaming request message.

[0137] Specifically, the first roaming response message includes a first indication message, and the first indication message is used to indicate an event that the second SEPP device cannot process the roaming request message.

[0138] The specific content of the first indication message is not limited in this embodiment, provided that both the first SEPP device and the second SEPP device determine that the first indication message is used to indicate an event in which the roaming request message cannot be processed.

[0139] In order to reduce the complexity and improve efficiency of indicating to the first SEPP device that the second SEPP device cannot process the roaming request message, in this embodiment, the first roaming response message is transmitted by using an N32f link between the first SEPP device and the second SEPP device. The first roaming response message in this embodiment meets the N32f interface protocol, so that it can be seen that the first roaming response message can be transmitted through the N32f interface.

[0140] In this embodiment, the second SEPP device returns the first roaming response message along the same path that it receives the roaming request message. For example, as shown in FIG. 1, if the first SEPP device 101 sends a roaming request message to the second SEPP device 102 by using the IPX device 105 and the IPX device 106 in sequence, the second SEPP device 102 returns the first roaming response message to the first SEPP device 101 by using the IPX device 106 and the IPX device 105 in sequence.

[0141] Specifically, the second SEPP device determines a target IPX device, which is an IPX device that sends a roam request message to the second SEPP device. In this embodiment, the target IPX device is IPX device 106.

[0142] When the second SEPP device sends the first roaming response message to the first SEPP device, the first roaming response message may be sent to the target IPX, so that the first roaming response message is returned to the first SEPP device along the same route. It can be seen that when the target IPX device (i.e., IPX device 106) receives the first roaming response message, IPX device 106 may send a first roaming response message to IPX device 105, and IPX device 105 may send the first roaming response message to the first SEPP device.

[0143] Step 408: The IPX device sends a first roaming response message to the first SEPP device.

[0144] When the first SEPP device receives the first roaming response message, the first SEPP device may determine that the second SEPP device is unable to process the roaming request message based on the first indication message included in the first roaming response message.

[0145] Optionally, when the first roaming response message includes the second indication message, the first SEPP device may perform corresponding processing. For example, if the second indication message is used to indicate that the second SEPP device cannot decrypt the roaming request message, the first SEPP device may re-encrypt the first signaling message based on the shared key to regenerate the roaming request message, and send the regenerated roaming request message to the second SEPP by using the N32f link.

[0146] Step 409: The second SEPP sends a first indication message to the second NF.

[0147] Step 409 in this embodiment is an optional step. If this step is performed, the execution time sequence between step 409 and step 407 is not limited in this embodiment.

[0148] Upon receiving the first indication message, the second NF may determine that the second SEPP device cannot process the roaming request message from the first SEPP device, and then determine that the second SEPP device cannot implement roaming services between the second SEPP device and the first SEPP device.

[0149] Optionally, the second SEPP may further send a second indication message to the second NF. The second indication message is used to indicate the reason why the second SEPP device cannot process the roaming request message. The second NF may determine a specific reason why the second SEPP device cannot process the roaming request message based on the second indication message.

[0150] Step 410: The first SEPP device sends a first indication message to the first NF.

[0151] This step is an optional step. Specifically, the first SEPP device obtains a first indication message from the first roaming response message, and converts the format of the first indication message into HTTP 1 / 2 message, so that the first NF can receive and process the first indication message.

[0152] Optionally, when the first roaming response message includes a second indication message, the first SEPP device may also send a second indication message to the first NF. For a specific sending process, refer to the process of sending the first indication message. Details will not be described again.

[0153] According to the communication method in this embodiment, when the second SEPP device determines that the roaming request message from the first SEPP device cannot be processed, the second SEPP device may send a first roaming response message to the first SEPP device by using the N32f link, which is used to indicate that the second SEPP device cannot process the roaming request message. It can be seen that the first roaming response message is transmitted by using the N32f link, so that the transmission of the first roaming response message does not need to occupy the N32c link resource. The roaming request message and the first roaming response message can be transmitted by using the N32f link, which reduces the difficulty of the second SEPP device to indicate to the first SEPP device that the roaming request message cannot be processed, and improves efficiency.

[0154] In addition, the IPX device included on the N32f link sends a first roaming response message to the first SEPP device. In this way, the utilization rate of each IPX device can be improved, and each IPX device on the N32f link can be fully used, thereby avoiding the wasteful occupation of system resources by the IPX device when the first roaming response message is transmitted by using the N32c link, improving the utilization rate of system resources and avoiding the waste of system resources.

[0155] The specific message format of the first roaming response message is not limited in this embodiment, provided that the first roaming response message is used to indicate to the first SEPP device that the second SEPP device cannot process the roaming request message. The first roaming response message is described in detail below with reference to a specific example.

[0156] Example 1

[0157] The first roaming response message in this example mainly includes two parts: a response header and a response body.

[0158] The response header may include a status code. The status code includes three decimal digits, the first decimal digit defines the type of the status code, and the last two decimal digits have a classification function. Different status codes represent different meanings. The specific value of the status code included in the first roaming response message in this embodiment may be "200" or "400", and is not limited in this embodiment.

[0159] The response body includes an event that is used to indicate that the second SEPP device cannot process the roaming request message.

[0160] Optionally, in order to help the first SEPP determine the reason why the second SEPP device cannot process the roaming request message, the response header or the response body may further include a second indication message, and the second indication message indicates the reason why the second SEPP device cannot process the roaming request message. In this embodiment, an example in which the response body includes the second indication message is used for explanation.

[0161] Specifically, the second SEPP device may predetermine the correspondence between different fields and the reasons why the second SEPP device cannot process the roaming request message. The contents included in each field are not limited in this embodiment, provided that the first SEPP device and the second SEPP device can agree on the reasons why the roaming request message cannot be processed, which are indicated by each field.

[0162] For example, if the second SEPP device determines that the reason the roaming request message cannot be processed is that the roaming request message cannot be decoded, the second SEPP device may obtain a first field used to indicate that the roaming request message cannot be decoded, and the second SEPP device may set the first field in the second indication message.

[0163] In another example, if the second SEPP device determines that the reason the roaming request message cannot be processed is that an integrity check on a modification block of the roaming request message has failed, the second SEPP device may obtain a second field used to indicate that the integrity check on the modification block of the roaming message has failed, and the second SEPP device may set the second field in the second indication message.

[0164] Example 2

[0165] In this embodiment, the first SEPP device and the second SEPP device may pre-agree on the format of the first roaming response message, under the condition that the first roaming response message can be transmitted by using the N32f link. For the description of the specific content of the first roaming response message, please refer to the above description. The details will not be described again.

[0166] Hereinafter, another embodiment of the communication method provided in this application will be described with reference to Figure 5. In the embodiment shown in Figure 4, when the second SEPP device cannot process the roaming request message, how the second SEPP device indicates to the first SEPP an event that the second SEPP device cannot process the roaming request message. In the embodiment shown in Figure 5, when the second SEPP device can successfully process the roaming request message, how the first SEPP device indicates to the second SEPP device an event that the first SEPP device cannot process the roaming response message, which is specifically described as follows:

[0167] Step 501: Establish an N32c link and an N32f link between a first SEPP device and a second SEPP device.

[0168] Step 502: The first NF sends a first signaling message to the first SEPP device.

[0169] Step 503: The first SEPP device sends a roaming request message to the IPX device.

[0170] Step 504: The IPX device sends a roaming request message to the second SEPP device.

[0171] For a description of the specific execution process of steps 501 to 504 in this embodiment, please refer to steps 401 to 404 shown in Fig. 4. The specific execution process will not be described in this embodiment.

[0172] Step 505: The second SEPP device sends a second signaling message to the second NF.

[0173] For the description of the execution process of step 505 in this embodiment, please refer to step 406 shown in Figure 4. The specific execution process is not described in this embodiment.

[0174] Step 506: The second SEPP device sends a second roaming response message to the IPX device.

[0175] Step 507: The IPX device sends a second roaming response message to the first SEPP device.

[0176] In this embodiment, the second roaming response message is a roaming response message between the first SEPP device and the second SEPP device. service This is a roaming message used to implement the above.

[0177] The second SEPP device can successfully process the roaming request message from the first SEPP device. It can be seen that the second roaming response message in this embodiment includes a third indication message, and the third indication message is used to indicate that the second SEPP device can successfully process the roaming request message.

[0178] The second roaming response message in this embodiment includes a third indication message. In this embodiment, the process of the second SEPP device sending the second roaming response message to the first SEPP device refers to the process shown in step 408 of Figure 4, in which the second SEPP device sends the first roaming response message to the first SEPP device. Details are not described again.

[0179] For a description of the specific format of the second roaming response message in this embodiment, please refer to the embodiment shown in Figure 4. The details will not be described again in this embodiment.

[0180] Step 508: The first SEPP device determines whether the second roaming response message can be processed, and if the second roaming response message can be processed, executes step 509, or if the second roaming response message cannot be processed, executes step 510.

[0181] Specifically, when the first SEPP device determines that the received second roaming response message satisfies at least one of the following: the first SEPP device cannot decrypt the second roaming response message; the first SEPP device fails to perform an integrity check on the second roaming response message; the first SEPP device fails to perform an integrity check on a modified block of the second roaming response message; the first SEPP device fails to apply a JSON patch program to the modified block of the second roaming response message; or the first SEPP device fails to reconstruct an HTTP / 2 message based on the roaming message; the first SEPP device determines that the first SEPP device Second Roaming Response Message For a specific description of when the first SEPP device cannot process the roaming request message, please refer to the embodiment shown in Figure 4. Details will not be described again in this embodiment.

[0182] Step 509: The first SEPP device sends a third indication message to the first NF.

[0183] When the first SEPP device can process the second roaming response message, the first SEPP device may obtain a third indication message and send the third indication message to the first NF, so that the first NF determines that the second NF can implement the roaming service requested by the first NF. For a description of the roaming service, please refer to the embodiment shown in Figure 4. The details will not be described again.

[0184] Step 510: The first SEPP device sends a third roaming response message to the IPX device.

[0185] In this embodiment, when the first SEPP device determines that the second roaming response message cannot be processed, the first SEPP device may generate a third roaming response message, the third roaming response message includes a fourth indication message, and the fourth indication message is used to indicate an event that the first SEPP device cannot process the second roaming response message.

[0186] For a description of the specific format of the third roaming response message, please refer to the description of the format of the first roaming response message shown in Figure 4. The details will not be described again.

[0187] Step 511: The IPX device sends a third roaming response message to the second SEPP device.

[0188] In this embodiment, the first SEPP device returns the third roaming response message along the same path along which it receives the second roaming response message. For example, as shown in FIG. 1, if the second SEPP device 102 sends the second roaming response message to the first SEPP device 101 by using the IPX device 106 and the IPX device 105 in sequence, the first SEPP device 101 sends the third roaming response message to the second SEPP device 102 by using the IPX device 105 and the IPX device 106 in sequence.

[0189] Specifically, the first SEPP device may store a correspondence relationship between the N32f context identifier, the target shared key, and the address of the second SEPP device, and the first SEPP device may determine the corresponding address of the second SEPP device based on the N32f context identifier included in the second roaming response message. The first SEPP device sends a third roaming response message to the second SEPP device based on the address of the second SEPP device.

[0190] When the second SEPP device receives the third roaming response message, the first SEPP device response It is understood that it may be determined that the message cannot be processed.

[0191] For the description of the content and format of the fourth instruction message, please refer to the description of the first instruction message in the embodiment shown in Figure 4. The details will not be described again.

[0192] In order to reduce the complexity and improve efficiency of indicating to the second SEPP device that the first SEPP device cannot process the second roaming response message, in this embodiment, the third roaming response message is transmitted by using the N32f link between the first SEPP device and the second SEPP device. The third roaming response message in this embodiment meets the N32f interface protocol, so that it can be seen that the third roaming response message can be transmitted through the N32f interface.

[0193] Steps 510 and 511 in this embodiment are optional steps, that is, when the first SEPP device determines that the second roaming response message cannot be processed, the first SEPP device may send a third indication message to the first NF, but does not send the third roaming response message to the second SEPP device.

[0194] Step 512: The second SEPP sends a fourth indication message to the second NF.

[0195] This step is an optional step. Specifically, the second SEPP device parses the fourth indication message from the third roaming response message and determines the format of the fourth indication message. HTTP / 2 message, so that the second NF can receive and process the fourth instruction message. For the specific processing process, refer to the process of the first NF processing the first instruction message shown in Figure 4. The details will not be described again in this embodiment.

[0196] According to the communication method in this embodiment, when the first SEPP device determines that the second roaming response message from the second SEPP device cannot be processed, the first SEPP device may send a third roaming response message to the second SEPP device by using the N32f link, which is used to indicate that the first SEPP device cannot process the second roaming response message. It can be seen that the third roaming response message is transmitted by using the N32f link, so that the transmission of the third roaming response message does not need to occupy the N32c link resource. The third roaming response message can be transmitted by using the N32f link, which reduces the difficulty of the first SEPP device in indicating to the second SEPP device that the second roaming response message cannot be processed, and improves efficiency.

[0197] In addition, the third roaming response message is sent to the second SEPP device by using an IPX device included on the N32f link, in this way, the utilization rate of each IPX device can be improved, and each IPX device on the N32f link can be fully used, thereby avoiding the wasteful occupation of system resources by the IPX device when the third roaming response message is transmitted by using the N32c link, improving the utilization rate of system resources, and avoiding the waste of system resources.

[0198] Based on the embodiment shown in FIGS. 4 and 5, a process for reducing communication system overhead will now be described with reference to FIGS. 6A and 6B.

[0199] Step 601: Establish an N32c link and an N32f link between a first SEPP device and a second SEPP device.

[0200] For the specific execution process of step 601 in this embodiment, please refer to step 401 shown in Figure 4. The specific execution process will not be described again.

[0201] Step 602: The first SEPP device sends a release request message to the second SEPP device.

[0202] Specifically, in this embodiment, when the N32f link is successfully established between the first SEPP device and the second SEPP device, it can be seen from the embodiment shown in Figures 4 and 5 that an error reporting procedure may be performed between the first SEPP device and the second SEPP device based on the N32f link. In order to reduce communication system overhead, the N32c link may be released in this embodiment.

[0203] To release the N32c link, the first SEPP device sends a release request message to the second SEPP device by using the N32c link. The release request message is used to request the second SEPP device to release the N32c link.

[0204] Optionally, the release request message at least includes an address of the second SEPP device and a fifth indication message. The fifth indication message is used to indicate an event in which the second SEPP device releases the N32c link.

[0205] Step 603: The second SEPP device releases the N32c link based on the release request message.

[0206] In this embodiment, when receiving the release request message, the second SEPP device may decide to release the N32c link based on the fifth indication message.

[0207] Specifically, the second SEPP device clears resources related to the N32c link on the second SEPP device side according to the release request message N32c link. After the N32c link is released, the TLS link is also released.

[0208] Step 604: The first SEPP device releases the N32c link.

[0209] The execution time sequence between step 604 and step 602 is not limited in this embodiment. When the N32f link is successfully established, the first SEPP device may release the connection relationship between the TLS link and the N32c link, and the second SEPP device may clear the resources related to the N32c link and release the N32c link.

[0210] Step 605: The first NF sends a first signaling message to the first SEPP device.

[0211] The execution time sequence between step 605 and steps 602 to 604 is not limited in this embodiment.

[0212] Step 606: The first SEPP device sends a roaming request message to the IPX device.

[0213] Step 607: The IPX device sends a roaming request message to the second SEPP device.

[0214] Step 608: The second SEPP device determines whether the roaming request message can be processed, and executes step 609 if the roaming request message can be processed, or executes step 610 if the roaming request message cannot be processed.

[0215] Step 609: The second SEPP device sends a second signaling message to the second NF.

[0216] Step 610: The second SEPP device sends a first roaming response message to the IPX device.

[0217] Step 611: The IPX device sends a first roaming response message to the first SEPP device.

[0218] Step 612: The second SEPP sends a first indication message to the second NF.

[0219] Step 613: The first SEPP device sends a first indication message to the first NF.

[0220] For a description of the specific execution process of Step 605 to Step 613 in this embodiment, please refer to Step 402 to Step 410 shown in Fig. 4. The details will not be described again in this embodiment.

[0221] It can be seen that according to the method in this embodiment, the first SEPP device and the second SEPP device may perform an error reporting procedure by using an N32f link. In this case, when the N32f link is successfully established, the first SEPP device and the second SEPP device may release the N32c link, thereby effectively reducing the overhead of maintaining the long-life connection of the N32c link.

[0222] With reference to FIG. 7, the structure of a SEPP device configured to carry out embodiments of the above method will now be described.

[0223] The SEPP device 700 specifically includes a receiving unit 701, a processing unit 702, and a transmitting unit 703.

[0224] When the SEPP device 700 functions as a first SEPP device, The receiving unit 701 is configured to receive a roaming message from an IP exchange (IPX) operator device, where the roaming message is used to implement a roaming service between the first SEPP device and the second SEPP device; The processing unit 702 is configured to determine that the roaming message cannot be processed; The sending unit 703 is configured to send a feedback message to the IPX device, where the feedback message is used to indicate that the roaming message cannot be processed.

[0225] The receiving unit 701, the processing unit 702 and the sending unit 703 cooperate with each other to implement the communication method performed by the first SEPP device provided in the above embodiment. For the specific implementation process and beneficial effects, please refer to the description of the above aspect.

[0226] Optionally, the processing unit 702 is configured to release, by the first SEPP device, the N32c link when the first SEPP device and the second SEPP device have exchanged a target shared key by using the N32c link, The target shared key is used to implement secure communication between the first SEPP device and the second SEPP device.

[0227] Optionally, the sending unit 703 is configured to send a roaming request message to the IPX device. The roaming request message is used to request a roaming service from a second SEPP device, and the roaming request message includes an address of the second SEPP device. The roaming message is a roaming response message generated by the second SEPP device based on the roaming request message.

[0228] Optionally, the receiving unit 701 is configured to obtain a feedback message, the feedback message including an address of the second SEPP device, and the feedback message is used to indicate that the first SEPP device cannot process the roaming response message.

[0229] Optionally, the processing unit 702 is configured to determine that the first SEPP device cannot process the roaming message if it determines that the roaming message satisfies at least one of the following: the roaming message cannot be decrypted, an integrity check on the roaming message fails, an integrity check on a modified block of the roaming message fails, a JSON patch program fails to be applied to the modified block of the roaming message, or a HyperText Transfer Protocol Secure / 2 (HTTP / 2) message fails to be reconstructed based on the roaming message.

[0230] Optionally, the feedback message is further used to indicate the reason why the first SEPP device cannot process the roaming message.

[0231] Optionally, the feedback message includes an N32f context identifier, which is used to indicate the target shared key used to decrypt the feedback message.

[0232] Optionally, the sending unit 703 is further configured to send the feedback message to a Network Function (NF).

[0233] When the SEPP device 700 functions as a second SEPP device: The sending unit 703 is configured to send a roaming message to an IP exchange (IPX) operator device, where the roaming message is used to implement a roaming service between the first SEPP device and the second SEPP device; The receiving unit 701 is configured to receive a feedback message from the IPX device, where the feedback message is used to indicate that the first SEPP device cannot process the roaming message.

[0234] The receiving unit 701, the processing unit 702 and the sending unit 703 cooperate with each other to implement the communication method performed by the second SEPP device provided in the above embodiment. For the specific implementation process and beneficial effects, please refer to the description of the above aspect.

[0235] Optionally, the processing unit 702 is configured to release the N32c link when the first SEPP device and the second SEPP device exchange a target shared key by using the N32c link. The target shared key is used to implement secure communication between the first SEPP device and the second SEPP device.

[0236] Optionally, the receiving unit 701 is configured to receive a roaming request message from the IPX device, where the roaming request message is used to request a roaming service from a second SEPP device, where the roaming request message includes an address of the second SEPP device; The processing unit 702 is configured to generate a roaming response message based on the roaming request message, where the roaming response message is a roaming message.

[0237] Optionally, the feedback message includes an address of the second SEPP device, and the feedback message is used to indicate that the first SEPP device cannot process the roaming response message.

[0238] Optionally, the roaming message is a roaming request message used to request roaming service from the first SEPP device, and the roaming message includes an address of the first SEPP device.

[0239] Optionally, the feedback message is further used to indicate the reason why the first SEPP device cannot process the roaming message.

[0240] The reason is at least one of the following: the roaming message cannot be decrypted, an integrity check on the roaming message fails, an integrity check on a modified block of the roaming message fails, a JSON patch program fails to be applied to a modified block of the roaming message, or a Hypertext Transfer Protocol Secure / 2 (HTTP / 2) message fails to be reconstructed based on the roaming message.

[0241] Optionally, the processing unit 702 is configured to obtain a target shared key corresponding to the N32f context identifier, and decrypt the feedback message by using the target shared key.

[0242] The structure of the communication device provided in this application will be described below with reference to Figures 8 and 9. Figure 8 is an exemplary diagram of the structure of a communication device according to an embodiment of this application. Figure 9 is an exemplary diagram of the interface of a communication board 830 in a communication device according to an embodiment of the present invention.

[0243] The communication device mainly includes a cabinet 800 and a communication board 830 installed in the cabinet. The communication board 830 mainly includes a circuit board and chips and electronic components implemented on the circuit board, and may provide communication services. The number of communication boards 830 may be increased or decreased based on actual requirements, and the specific number is not limited in this embodiment.

[0244] In addition, the cabinet 800 further includes a fan assembly 820 for installing a heat dissipation fan, and a cabinet management board 810 for managing the cabinet. The cabinet management board 810 is configured to manage the operating state of the entire cabinet, for example, the power-on state, operating temperature, and alarm state of the cabinet.

[0245] 9, the communication board 830 includes multiple input / output interfaces, such as a display interface 832 configured to connect to an external display, network interfaces 831 and 833 for connecting to a communication network, and a Universal Serial Bus (USB) interface 834. The network interface 833 may be an Ethernet interface, and the network interface 831 may be a fiber interface.

[0246] Additionally, the communication board 830 further includes a power interface 836 connected to a power source, and an expansion slot 835 configured to expand the functionality of the communication board 830 .

[0247] The communication device may implement different functions by installing different communication boards 830, for example, implementing the functions of the first SEPP device and the second SEPP device in the embodiments of this application. A control element such as a general-purpose processor / control chip / logic circuit is installed on the communication board 830. A memory such as a storage chip may also be installed on the communication board 830. The processor and memory, in cooperation with an associated communication interface, may perform some or all of the operations of any method that may be performed by the first SEPP device or the second SEPP device in the embodiments of this application.

[0248] From the perspective of the entity's hardware, the structure of the SEPP device provided in this application will now be described with reference to FIG.

[0249] The SEPP device provided in this embodiment may be the first SEPP device or the second SEPP device in the above method embodiment. For the specific process of implementing the communication method in this application, please refer to the above method embodiment. Details will not be described again.

[0250] The SEPP device may be a general-purpose computer and includes a processor 1001 , memory 1002 , a bus 1003 , input devices 1004 , output devices 1005 and a network interface 1006 .

[0251] In particular, the memory 1002 may include computer storage media in the form of volatile and / or nonvolatile memory, such as read-only memory and / or random access memory. The memory 1002 may store an operating system, application programs, other program modules, executable code, and program data.

[0252] The input device 1004 may be configured to input commands and information into the SEPP device. The input device 1004 may be, for example, a keyboard or a pointer device such as a mouse, a trackball, a touchpad, a microphone, a joystick, a gamepad, a satellite TV dish, a scanner, or similar devices. These input devices may be connected to the processor 1001 using a bus 1003.

[0253] The output device(s) 1005 may be configured to output information via the SEPP device. In addition to a monitor, the output device(s) 1005 may be other peripheral output devices, such as speakers and / or a printing device. These output devices may also be connected to the processor 1001 using the bus 1003.

[0254] The SEPP device may be connected to a communications network, such as a local area network (LAN), using the network interface 1006. In a networked environment, the computer-executable instructions stored on the SEPP device may be stored in a remote storage device and are not limited to being stored locally.

[0255] When the processor 1001 in the SEPP device executes the executable code or application program stored in the memory 1002, the SEPP device may execute the operation of the method on the first SEPP device side in the above method embodiment, or may execute the operation of the method on the second SEPP device side in the above method embodiment. For the specific execution process, please refer to the above method embodiment. Details will not be described again here.

[0256] A computer may be implemented using actual hardware or may be implemented using virtualized hardware, such as a virtual machine, which provides virtual CPU, storage, network, and other resources, which are obtained based on the virtualization of the underlying hardware resources.

[0257] In this case, a software package corresponding to the SEPP device may be deployed on a virtual machine, and the SEPP device may be referred to as a virtualized network function (VNF) device. VNF The device may have the same functional behavior and external interfaces as a conventional network function device, for example, it may have an N32-F interface.

[0258] The above embodiments are merely intended to illustrate the technical solutions of the present invention, and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the above embodiments, it should be understood that those skilled in the art may still make modifications to the technical solutions described in the above embodiments, or make equivalent substitutions to some technical features thereof, without departing from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. 1. A communication method comprising: receiving, by a first security edge protection proxy (SEPP) device, a roaming message from an IP exchange (IPX) operator device, the roaming message being used to implement a roaming service between the first SEPP device and a second SEPP device; determining, by the first SEPP device, that the roaming message cannot be processed and sending a feedback message to the IPX device, the feedback message being used to indicate that the first SEPP device cannot process the roaming message; The method includes:

2. 2. The method of claim 1, further comprising the step of: when the first SEPP device and the second SEPP device are exchanging a target shared key by using an N32c link, releasing the N32c link by the first SEPP device, wherein the target shared key is used to implement secure communication between the first SEPP device and the second SEPP device.

3. by a first security edge protection proxy (SEPP) device, prior to receiving a roaming message from an IP exchange (IPX) operator device; sending a roaming request message to the IPX device by the first SEPP device, the roaming request message being used to request the roaming service from the second SEPP device, the roaming request message including an address of the second SEPP device; The method of claim 1 or 2, wherein the roaming message is a roaming response message generated by the second SEPP device based on the roaming request message.

4. 4. The method of claim 3, further comprising: determining, by the first SEPP device, the address of the second SEPP device based on the roaming message, the feedback message including the address of the second SEPP device, the feedback message being used to indicate that the first SEPP device is unable to process the roaming response message.

5. 3. The method of claim 1, wherein the roaming message is a roaming request message used to request the roaming service from the first SEPP device, and the roaming message includes an address of the first SEPP device.

6. 6. The method of claim 1, further comprising: determining, by the first SEPP device, that the first SEPP device cannot process the roaming message if the first SEPP device determines that the roaming message satisfies at least one of the following: the roaming message cannot be decrypted, an integrity check on the roaming message fails, an integrity check on a modified block of the roaming message fails, a JSON patch program fails to be applied to the modified block of the roaming message, or a HyperText Transfer Protocol version 2 (HTTP / 2) message fails to be reconstructed based on the roaming message.

7. The method of claim 1 , wherein the feedback message is further used to indicate a reason why the first SEPP device is unable to process the roaming message.

8. The method of claim 1 , wherein the feedback message includes an N32f context identifier, the N32f context identifier being used to indicate a target shared key used to decrypt the feedback message.

9. After determining, by the first SEPP device, that the roaming message cannot be processed, 9. The method of claim 1, further comprising the step of transmitting, by the first SEPP device, the feedback message to a Network Function (NF).

10. 1. A communication method comprising: receiving, by a second security edge protection proxy (SEPP) device, a signaling message sent by a network function device (NF) and sending a roaming message to an IP exchange (IPX) operator device, the roaming message being used to implement a roaming service between the first SEPP device and the second SEPP device, the roaming message including the signaling message; receiving, by the second SEPP device, a feedback message from the IPX device, the feedback message being used to indicate that the first SEPP device is unable to process the roaming message; The method includes:

11. 11. The method of claim 10, further comprising the step of: when the first SEPP device and the second SEPP device have exchanged a target shared key by using an N32c link, releasing the N32c link by the second SEPP device, wherein the target shared key is used to implement secure communication between the first SEPP device and the second SEPP device.

12. A second security edge protection proxy (SEPP) device may then transmit the roaming message to the IP exchange (IPX) operator device before sending the roaming message to the IP exchange (IPX) operator device. receiving, by the second SEPP device, a roaming request message from the IPX device, the roaming request message being used to request the roaming service from the second SEPP device, the roaming request message including an address of the second SEPP device; generating, by the second SEPP device, a roaming response message based on the roaming request message, the roaming response message being the roaming message; The method of claim 10 or 11, further comprising:

13. 13. The method of claim 12, wherein the feedback message includes the address of the second SEPP device, and the feedback message is used to indicate that the first SEPP device is unable to process the roaming response message.

14. The method of claim 10 or 11, wherein the roaming message is a roaming request message used to request the roaming service from the first SEPP device, and the roaming message includes an address of the first SEPP device.

15. The method of claim 10 , wherein the feedback message is further used to indicate a reason why the first SEPP device is unable to process the roaming message.

16. 16. The method of claim 15, wherein the reason is at least one of the following: the roaming message cannot be decrypted, an integrity check on the roaming message has failed, an integrity check on a modified block of the roaming message has failed, a JSON patch program has failed to be applied to the modified block of the roaming message, or a HyperText Transfer Protocol version 2 (HTTP / 2) message has failed to be reconstructed based on the roaming message.

17. the feedback message includes an N32f context identifier, and after receiving the feedback message from the IPX device, by the second SEPP device: obtaining, by the second SEPP device, a target shared key corresponding to the N32f context identifier; decrypting, by the second SEPP device, the feedback message by using the target shared key; 17. The method of any one of claims 10 to 16, further comprising:

18. A security edge protection proxy (SEPP) device, comprising: a receiving unit configured to receive a roaming message from an IP exchange (IPX) operator device, the roaming message being used to implement a roaming service between the SEPP device and other SEPP devices; a processing unit configured to determine that the roaming message cannot be processed and to send a feedback message to the IPX device by using a sending unit, the feedback message being used to indicate that the SEPP device cannot process the roaming message; The device that contains

19. 20. The device of claim 18, wherein the processing unit is further configured to release an N32c link when the SEPP device and the other SEPP device are exchanging a target shared key by using the N32c link, the target shared key being used to implement secure communication between the SEPP device and the other SEPP device.

20. The sending unit is further configured to send a roaming request message to the IPX device, the roaming request message is used to request the roaming service from the other SEPP device, and the roaming request message includes an address of the other SEPP device; 20. The device of claim 18 or 19, wherein the roaming message is a roaming response message generated by the other SEPP device based on the roaming request message.

21. 21. The device of claim 20, wherein the processing unit is further configured to determine the address of the other SEPP device based on the roaming message, the feedback message including the address of the other SEPP device, and the feedback message is used to indicate that the SEPP device is unable to process the roaming response message.

22. 20. The device of claim 18 or 19, wherein the roaming message is a roaming request message used to request the roaming service from the SEPP device, and the roaming message includes an address of the SEPP device.

23. 23. The device of claim 18, further configured to determine that the roaming message cannot be processed if the processing unit determines that the roaming message satisfies at least one of the following: the roaming message cannot be decoded, an integrity check on the roaming message fails, an integrity check on a modified block of the roaming message fails, a JSON patch program fails to be applied to the modified block of the roaming message, or a HyperText Transfer Protocol version 2 (HTTP / 2) message fails to be reconstructed based on the roaming message.

24. 24. The device of claim 18, wherein the feedback message is further used to indicate the reason why the SEPP device is unable to process the roaming message.

25. 25. The device of claim 18, wherein the feedback message includes an N32f context identifier, the N32f context identifier being used to indicate a target shared key used to decrypt the feedback message.

26. 26. The device of claim 18, wherein the sending unit is further configured to send the feedback message to a Network Function (NF).

27. A security edge protection proxy (SEPP) device including a receiving unit, a transmitting unit, and a processing unit, The receiving unit is configured to receive a signaling message sent by a network function device (NF); The processing unit is configured to send a roaming message to an IP exchange (IPX) operator device by using the sending unit, the roaming message being used to implement a roaming service between another SEPP device and the SEPP device, the roaming message including the signaling message; The device, wherein the receiving unit is further configured to receive a feedback message from the IPX device, the feedback message being used to indicate that the other SEPP device is unable to process the roaming message.

28. 28. The device of claim 27, wherein the processing unit is further configured to release an N32c link when the other SEPP device and the SEPP device have exchanged a target shared key by using an N32c link, and the target shared key is used to implement secure communication between the other SEPP device and the SEPP device.

29. The receiving unit is further configured to receive a roaming request message from the IPX device, the roaming request message being used to request the roaming service from the SEPP device, the roaming request message including an address of the SEPP device; 29. The device of claim 27 or 28, wherein the processing unit is further configured to generate a roaming response message based on the roaming request message, the roaming response message being the roaming message.

30. 30. The device of claim 29, wherein the feedback message includes the address of the SEPP device, and the feedback message is used to indicate that the other SEPP device is unable to process the roaming response message.

31. 29. The device of claim 27 or 28, wherein the roaming message is a roaming request message used to request the roaming service from the other SEPP device, and the roaming message includes an address of the other SEPP device.

32. 32. The device of claim 27, wherein the feedback message is further used to indicate the reason why the other SEPP device is unable to process the roaming message.

33. 33. The device of claim 32, wherein the reason is at least one of the following: the roaming message cannot be decrypted, an integrity check on the roaming message fails, an integrity check on a modified block of the roaming message fails, a JSON patch program fails to be applied to the modified block of the roaming message, or a HyperText Transfer Protocol version 2 (HTTP / 2) message fails to be reconstructed based on the roaming message.

34. The processing unit includes: Obtain a target shared key corresponding to the N32f context identifier; 34. The device of any one of claims 27 to 33, further configured to decrypt the feedback message by using the target shared key.

35. A security edge protection proxy (SEPP) device, comprising: at least one processor and a memory coupled to each other; The memory stores computer program code, and the processor invokes and executes the computer program code in the memory to operate the SEPP device.

20. A device enabling a processor to carry out the method according to any one of claims 1 to 17.

36. 1. A computer-readable storage medium, comprising:

18. A computer readable storage medium storing a computer program which, when executed by a processor, enables the method of any one of claims 1 to 17 to be completed.

37. A communication system including a first security edge protection proxy (SEPP) device and an IPX device, the IPX device is configured to send a roaming message to the first SEPP device, the roaming message being used to implement a roaming service between the first SEPP device and a second SEPP device; 10. A communication system, wherein the first SEPP device is configured to perform the method according to any one of claims 1 to 9.

38. A communication system including a network function device (NF) and a second security edge protection proxy (SEPP) device, The network function device (NF) is configured to perform a step of sending a signaling message to the second SEPP device; 18. A communication system, wherein the second SEPP device is configured to perform the method of any one of claims 10 to 17.

Images