Communication method and apparatus

Abstract

Embodiments of the present application relate to the technical field of communications, and provide a communication method and apparatus, for use in enabling terminal devices to remotely access campuses over operator networks, without requiring the terminal devices and the campuses to support non-3GPP access, achieving simple implementation. In the method, a first control plane network element in a first network receives a first request from a first terminal device, wherein the first request is used for the first terminal device to request access to a second network; on the basis of the first request, the first control plane network element sends a second request to a second control plane network element in the second network, wherein the second request is used for the first control plane network element to request to access of the first terminal device to the second network; the first control plane network element receives a second response from the second control plane network element, wherein the second response is used for indicating that the first terminal device is allowed to access the second network over the first network; and the first control plane network element sends a first response to the first terminal device, wherein the first response is used for indicating that the first terminal device successfully accesses the second network.

Description

Communication method and device

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office of China on June 28, 2023, with application number 202310778234.8 and application name “A Communication Method and Device”, the entire contents of which are incorporated by reference into this application. Technical Field

[0003] The present application relates to the field of communication technology, and in particular to a communication method and device. Background Art

[0004] Currently, when a terminal device within a campus moves outside the campus and wants to communicate with the campus, the terminal device must first access the operator's network and establish a packet data unit (PDU) session. This PDU session is then used to establish a tunnel with a non-3rd Generation Partnership Project interworking function (N3IWF) device in order to register with the campus. In this solution, both the terminal device and the campus network need to support non-3GPP access, making implementation more complex.

[0005] Summary of the Invention

[0006] The embodiments of the present application provide a communication method and apparatus for enabling a terminal device to remotely access a campus through an operator network, without requiring the terminal device and the campus to support non-3GPP access, and the implementation is simple.

[0007] In a first aspect, the present application provides a communication method, which can be executed by a first control plane network element in a first network, or by a component in the first control plane network element. The first control plane network element can be, for example, an access and mobility management function network element, or a combined network element of an access and mobility management function network element and a session management function network element, without limitation. In this method, the first control plane network element receives a first request from a first terminal device, the first request being used for the first terminal device to request access to a second network; based on the first request, a second request is sent to a second control plane network element in the second network, the second request being used for the first control plane network element to request access of the first terminal device to the second network; a second response is received from the second control plane network element, the second response being used to indicate that the first terminal device is allowed to access the second network through the first network; and a first response is sent to the first terminal device, the first response being used to indicate that the first terminal device has successfully accessed the second network.

[0008] Using the above method, the first control plane network element in the first network can send a second request to the second control plane network element in the second network in response to the first request of the first terminal device, so that the first terminal device can access the second network through the first network. The implementation is simple. For example, the first network is a carrier network, the second network is a campus, and the terminal device is located outside the coverage area of ​​the campus. Using the above method, the terminal device can remotely access the campus through the carrier network without requiring the terminal device and the campus to support non-3GPP access technologies. The implementation is simple and can reduce the complexity of the terminal device remotely accessing the campus through the carrier network element.

[0009] In one possible implementation, the first request includes an identifier of the second network. Before sending the second request to the second control plane network element in the second network based on the first request, the first control plane network element may also obtain first information based on the identifier of the second network, where the first information is used to indicate that at least one terminal device is allowed to communicate with the second network through the first network, and the first terminal device belongs to at least one terminal device; and, based on the first information, determine to send the second request to the second control plane network element.

[0010] Through the above implementation, the first control plane network element can determine whether to send the second request to the second control plane network element in the second network by obtaining the first information, which can reduce the problem of malicious terminal devices accessing the first network through the first network.

[0011] In one possible implementation, the first request includes an identifier of the second network. Before sending the second request to the second control plane network element in the second network based on the first request, the first control plane network element can also obtain the range information of the second network based on the identifier of the second network. The range information is used to indicate the range in which at least one terminal device is allowed to access the second network, and the first terminal device belongs to at least one terminal device; based on the range information and the location information of the first terminal device, it is determined to send the second request to the second control plane network element.

[0012] Through the above implementation, the first control plane network element can determine whether to send the second request to the second control plane network element in the second network by obtaining the range information of the second network. For example, if the first terminal device is outside the range indicated by the range information, it means that the first request is an invalid request. The first control plane network element can refuse the first terminal device from accessing the second network through the first network, that is, not sending the second request to the second control plane network element. For another example, if the first terminal device is within the range indicated by the range information, it means that the first request is a valid request. The first control plane network element can send the second request to the second control plane network element.

[0013] In one possible implementation, the first control plane network element may also, before receiving a second response from the second control plane network element, restrict messages transmitted between the first terminal device and the second network through the first network based on restriction information, wherein the restriction information includes one or more of the following: the type of messages allowed to be transmitted between the first terminal device and the second network through the first network, the number of messages allowed to be transmitted between the first terminal device and the second network through the first network, or the duration allowed for the first terminal device and the second network to communicate through the first network; after receiving the second response, the restriction on messages transmitted between the first terminal device and the second network through the first network is lifted.

[0014] Through the above implementation method, before the first control plane network element receives the authorization indication from the second network element to the first terminal device (i.e., an indication to allow the first terminal device to access the second network through the first network), it indicates to allow the first terminal device to pass, and can restrict the messages transmitted between the first network and the second network by the first terminal device based on the restriction information, thereby reducing problems such as malicious terminal devices accessing the second network through the first network, causing waste of network resources, and so on.

[0015] In one possible implementation, before sending the second request to the second control plane network element in the second network based on the first request, the first control plane network element may further establish a secure connection with the second control plane network element. The secure connection is used for message transmission between the first control plane network element and the second control plane network element. For example, a security gateway in the first network establishes the secure connection with a security gateway in the second network. Subsequently, messages can be transmitted between the first control plane network element and the second control plane network element via the secure connection.

[0016] In one possible implementation, the first control plane network element can also obtain a first quantity, where the first quantity is the total number of terminal devices that access the second network through the first network; based on the first quantity and the second information, determine whether the first terminal device is allowed to access the second network through the first network, and the second information includes the maximum number of terminal devices allowed to access the second network through the first network.

[0017] Through the above implementation, the first control plane network element can determine whether to allow the first terminal device to access the second network through the first network based on the first number and the second information. For example, if the first number is greater than the maximum number, the first control plane network element can determine to deny the first terminal device access to the second network through the first network. For another example, if the first number is less than or equal to the maximum number, the first control plane network element can determine to allow the first terminal device to access the second network through the first network.

[0018] In one possible implementation, the first control plane network element may further add 1 to the first number. For example, the first number is maintained by the first control plane network element. If the first control plane network element determines that the first terminal device is allowed to access the second network through the first network, the first control plane network element may add 1 to the first number to update the total number of terminal devices that access the second network through the first network.

[0019] In one possible implementation, the first control plane network element may further receive a first key from a second control plane network element, the first key being used for secure transmission between the first terminal device and the first network; determine a second key based on the first key, the second key being used for secure transmission between the first terminal device and a first access network element of the first network, through which the first terminal device accesses; and send the second key to the first access network element. This implementation can achieve secure transmission between the first terminal device and the first access network element.

[0020] In one possible implementation, the first control plane network element may further determine a third key based on the first key, where the third key is used to securely protect non-access stratum (NAS) messages transmitted between the first control plane network element and the first terminal device; and send third information to the first terminal device, where the third information is used to instruct the first terminal device to initiate security protection for NAS messages transmitted between the first control plane network element and the first terminal device. This implementation can implement security protection for NAS messages transmitted between the first control plane network element and the first terminal device.

[0021] In one possible implementation, the first control plane network element may further obtain fourth information, where the fourth information includes one or more of the following: the number of terminal devices accessing the second network through the first network, the number of messages transmitted between the first terminal device and the second network, or the traffic consumed by the first terminal device transmitting messages between the first network and the second network; and send the fourth information to the billing system. This implementation enables the billing system to bill for the service of the first terminal device accessing the second network through the first network.

[0022] In one possible implementation, after the first terminal device accesses the second network through the first network, the first control plane network element may further receive a third request from the first terminal device, where the third request is used to request establishment of a first session from the first terminal device to the second network; based on the third request, send a fourth request to a fourth control plane network element in the second network, where the fourth request is used to request establishment of the first session, where the fourth request includes endpoint information of the first user plane network element in the first network; receive a fourth response from the fourth control plane network element, where the fourth response includes endpoint information of the second user plane network element in the second network; and send a third response to the first terminal device, where the third response is used to indicate that the first session was successfully established.

[0023] Through the above implementation, after the first terminal device accesses the second network through the first network, a first session can be established between the first terminal device and the second network through the first network.

[0024] In one possible implementation, before sending the third response to the first terminal device, the first control plane network element may also obtain the contract information of the second network, the contract information including one or more of the following: maximum bandwidth, scheduling priority, preemption priority, or quality of service QoS level; receive the first QoS parameter corresponding to the first session from the fourth control plane network element; and determine, based on the contract information, whether to allow the establishment of the first session based on the first QoS parameter.

[0025] Through the above implementation, the first control plane network element may verify the first QoS parameter from the fourth control plane network element using the subscription information of the second network to determine whether to allow establishment of the first session according to the first QoS parameter.

[0026] In a possible implementation manner, the first control plane network element may further select a second user plane network element according to the third request; and obtain endpoint information of the second user plane network element.

[0027] In a second aspect, the present application provides a communication method, which can be executed by a second control plane network element in a second network, or by a component in the second control plane network element. The first control plane network element can be, for example, an access and mobility management function network element, or a combined network element of an access and mobility management function network element and a session management function network element, without limitation. In this method, the second control plane network element receives a second request from the first control plane network element in the first network, and the second request is used for the first control plane network element to request that the first terminal device access the second network; according to the second request, a second response is sent to the first control plane network element, and the second response is used to indicate that the first terminal device is allowed to access the second network through the first network.

[0028] Using the above method, the second control plane network element in the second network responds to the second request of the first control plane network element in the first network and sends a second response to the first control plane network element to indicate that the first terminal device is allowed to access the second network through the first network. In this way, the first terminal device can access the second network through the first network, and the implementation is simple. For example, the first network is an operator network, the second network is a campus, and the terminal device is located outside the coverage area of ​​the campus. Using the above method, the terminal device can remotely access the campus through the operator network without the terminal device and the campus supporting non-3GPP access technologies. The implementation is simple and can reduce the complexity of the terminal device remotely accessing the campus through the operator network element.

[0029] In one possible implementation, before sending a second response to the first control plane network element based on the second request, the second control plane network element may also obtain a second quantity, where the second quantity is the total number of terminal devices that access the second network through the first network; based on the second quantity and the second information, it is determined that the first terminal device is allowed to access the second network through the first network, and the second information includes the maximum number of terminal devices allowed to access the second network through the first network.

[0030] In one possible implementation, the second control plane network element may further add 1 to the second number. For example, the second number is maintained by the second control plane network element. If the second control plane network element determines that the first terminal device is allowed to access the second network through the first network, the second control plane network element may add 1 to the first number to update the total number of terminal devices that access the second network through the first network.

[0031] In one possible implementation, before sending the second response to the first control plane network element based on the second request, the second control plane network element may further authenticate and authorize the first terminal device. For example, the second control plane network element may interact with the first terminal device through the first control plane network element to authenticate and authorize the first terminal device.

[0032] In a possible implementation, the second control plane network element may further establish a secure connection with the first control plane network element, where the secure connection is used for message transmission between the first control plane network element and the second control plane network element.

[0033] In a possible implementation, the second control plane network element may further allocate a first key to the first control plane network element, where the first key is used for secure transmission between the first terminal device and the first network; and send the first key to the first control plane network element.

[0034] In one possible implementation, after the first terminal device accesses the second network through the first network, the second control plane network element may also receive a fourth request from the first control plane network element, where the fourth request is used to request establishment of a first session from the first terminal device to the second network, and the fourth request includes endpoint information of the first user plane network element in the first network; based on the fourth request, a fourth response is sent to the first control plane network element, and the fourth response includes endpoint information of the second user plane network element in the second network.

[0035] In one possible implementation, the second control plane network element can also obtain the contract information of the first terminal device, the contract information including one or more of the following: maximum bandwidth, scheduling priority, preemption priority, or quality of service QoS level; determine the first QoS parameter corresponding to the first session based on the contract information; and send the first QoS parameter to the first control plane network element.

[0036] In a possible implementation manner, the second control plane network element may further select a second user plane network element according to the fourth request; and obtain endpoint information of the second user plane network element.

[0037] For the beneficial effects of any possible implementation of the second aspect, please refer to the beneficial effects of any possible implementation of the first aspect, and no further details will be given.

[0038] In a third aspect, the present application provides a communication method, which can be performed by a first terminal device or by a component in the first terminal device. In this method, the first terminal device sends a first request to a first control plane network element in a first network, the first request including an identifier of a second network, and the first request is used by the first terminal device to request access to the second network; and receives a first response from the first control plane network element, the first response being used to indicate that the first terminal device has successfully accessed the second network.

[0039] By adopting the above method, the first terminal device carries the identifier of the second network in the first request sent to the first control plane network element in the first network, so that the first control plane network element determines that the first terminal device requests access to the second network instead of requesting access to the first network based on the identifier of the second network, thereby enabling the first terminal device to access the second network through the first network, and the implementation method is simple. For example, the first network is an operator network, the second network is a campus, and the terminal device is located outside the coverage area of ​​the campus. By adopting the above method, the terminal device can remotely access the campus through the operator network without the terminal device and the campus supporting non-3GPP access technology. The implementation method is simple and can reduce the complexity of the terminal device remotely accessing the campus through the operator network element.

[0040] In one possible implementation, the first terminal device may also generate a fourth key, which is a key generated after the first terminal device successfully authenticates the second network; determine a fifth key and / or a sixth key based on the fourth key, wherein the fifth key is used for secure transmission between the first terminal device and the first access network element of the first network, and the first terminal device accesses through the first access network element, and the sixth key is used to securely protect the non-access layer NAS message transmitted between the first control plane network element and the first terminal device.

[0041] In one possible implementation, the first terminal device may also receive third information from the first control plane network element, where the third information is used to instruct the first terminal device to initiate security protection of NAS messages transmitted between the first control plane network element and the first terminal device; and in response to the third information, start using the sixth key to perform security protection on NAS messages between the first control plane network element and the first terminal device.

[0042] In one possible implementation, the first terminal device may also send a third request to the first control plane network element after receiving the first response from the first control plane network element, where the third request is used to request establishment of a first session from the first terminal device to the second network; and receive a fourth response from the first control plane network element, where the third response is used to indicate that the first session is successfully established.

[0043] For the beneficial effects of any possible implementation of the third aspect, please refer to the beneficial effects of any possible implementation of the first aspect, and no further details will be given.

[0044] In a fourth aspect, the present application provides a communication method, which can be executed by a third control plane network element in the first network, or by a component in the third control plane network element. The third control plane network element can be, for example, a session management function network element, or a combined network element of an access and mobility management function network element and a session management function network element, without limitation. In this method, the third control plane network element receives a fifth request from a fourth control plane network element in the second network, the fifth request being used to request the establishment of a second session from a second terminal device to the first network, the second terminal device being a terminal device that has been registered with the second network, the fifth request including a first identifier, the first identifier being used to indicate a third quality of service (QoS) parameter assigned by the second network to the second session; determining a second QoS parameter based on the first identifier, the second QoS parameter being a QoS parameter used when establishing the second session; and sending a fifth response to the fourth control plane network element, the fifth response including the second QoS parameter.

[0045] By adopting the above method, the third control plane network element in the first network responds to the fifth request of the fourth control plane network element in the second network, determines the second QoS parameters for establishing the second session from the second terminal device to the first network, and sends the second QoS parameters to the fourth control plane network element, thereby enabling the establishment of the second session from the second terminal device to the first network, thereby enabling the second terminal device in the second network to access the services of the first network through the second network, and the implementation method is simple. For example, the first network is an operator network, and the second network is a campus. By adopting the above method, the terminal devices in the campus can access the operator network through the campus, without the need for the terminal devices and the operator network to support non-3GPP access technology. The implementation method is simple and can reduce the complexity of the terminal devices accessing the operator network through the campus.

[0046] In one possible implementation, the fifth request further includes an identifier of the second network, and the third control plane network element determining the second QoS parameter corresponding to the second session based on the first identifier may include: the third control plane network element obtaining the third QoS parameter based on the identifier of the second network and the first identifier; and determining the second QoS parameter based on the third QoS parameter. With this implementation, the third control plane network element may determine the second QoS parameter based on the identifier of the second network and the first identifier.

[0047] In one possible implementation, the third control plane network element may determine the second QoS parameter corresponding to the second session based on the first identifier by: the third control plane network element sending fifth information to a first policy control network element in the first network, the fifth information including the identifier of the second network and the first identifier, the fifth information being used by the first policy control network element to determine policy control and charging information for the second session; receiving the policy control and charging information from the first policy control network element; and determining the second QoS parameter based on the policy control and charging information. In this implementation, the third control plane network element may determine the second QoS parameter based on the policy control and charging information.

[0048] In one possible implementation, the QoS parameter includes one or more of the following: maximum bandwidth, scheduling priority, preemption priority, or QoS level.

[0049] In a possible implementation manner, the first identifier is an identifier of a QoS profile subscribed by the second network in the first network, and the QoS profile includes a third QoS parameter.

[0050] In a fifth aspect, the present application provides a communication method, which can be executed by a fourth control plane network element in a second network, or by a component in the fourth control plane network element. The fourth control plane network element can be, for example, a session management function network element, or a combined access and mobility management function network element and a session management function network element, without limitation. In this method, the fourth control plane network element receives a sixth request from a second terminal device, the sixth request being used to request establishment of a second session from the second terminal device to the first network, where the second terminal device is a terminal device that has already registered with the second network; based on the sixth request, the fourth control plane network element sends a fifth request to a third control plane network element in the first network, the fifth request being used to request the fourth control plane network element to establish the second session, the fifth request including a first identifier, the first identifier being used to indicate a third quality of service (QoS) parameter assigned by the second network for the second session; receives a fifth response from the third control plane network element, the fifth response including a second QoS parameter, the second QoS parameter being the QoS parameter used when establishing the second session; and sends a sixth response to the second terminal device, the sixth response being used to indicate that the second session was successfully established.

[0051] By adopting the above method, the fourth control plane network element in the second network sends a fifth request to the fourth control plane network element in the first network in response to the sixth request of the second terminal device, so that the fourth control plane network element determines the second QoS parameters for establishing the second session from the second terminal device to the first network, and sends the second QoS parameters to the fourth control plane network element, which can realize the establishment of the second session from the second terminal device to the first network, thereby realizing the second terminal device in the second network accessing the service of the first network through the second network, and the implementation method is simple. For example, the first network is an operator network, and the second network is a campus. By adopting the above method, the terminal devices in the campus can access the operator network through the campus, without the need for the terminal devices and the operator network to support non-3GPP access technology. The implementation method is simple and can reduce the complexity of the terminal devices accessing the operator network through the campus.

[0052] In one possible implementation, before sending the fifth request to the third control plane network element in the first network based on the sixth request, the fourth control plane network element may further obtain sixth information indicating that the second terminal device is permitted to communicate with the first network through the second network; and determine, based on the sixth information, whether to send the fifth request to the third control plane network element. With this implementation, the fourth control plane network element may determine, based on the sixth information, whether to send the fifth request to the third control plane network element in the first network.

[0053] In one possible implementation, the sixth request includes a second identifier, where the second identifier is used to indicate the fourth QoS parameter requested by the second terminal device. Before sending the fifth request to the third control plane network element in the first network, the fourth control plane network element may further determine the first identifier based on the second identifier. With this implementation, the fourth control plane network element may consider the second identifier from the second terminal device when determining the first identifier.

[0054] In one possible implementation, before sending the fifth request to the third control plane network element in the first network, the fourth control plane network element may further obtain subscription information of the second terminal device, where the subscription information includes at least one identifier, each of the at least one identifier being used to indicate a QoS parameter subscribed to by the second terminal device; and determine the first identifier from the at least one identifier. In this implementation, the fourth control plane network element may determine the first identifier based on the subscription information of the second terminal device in the second network.

[0055] In one possible implementation, the QoS parameter includes one or more of the following: maximum bandwidth, scheduling priority, preemption priority, or QoS level.

[0056] In a sixth aspect, the present application provides a communication method, which can be executed by a third control plane network element in a first network, or by a component in the third control plane network element. The third control plane network element can be, for example, a session management function network element, or a combined access and mobility management function network element and a session management function network element, without limitation. In this method, the third control plane network element receives a third request from a first terminal device, the third request being used to request establishment of a first session from the first terminal device to a second network, where the first terminal device is a terminal device that has registered with the second network through the first network; based on the third request, the third control plane network element sends a fourth request to a fourth control plane network element in the second network, the fourth request being used to request the third control plane network element to establish the first session, the fourth request including endpoint information of the first user plane network element in the first network; receives a fourth response from the third control plane network element, the fourth response including endpoint information of the second user plane network element in the second network; and sends a third response to the first terminal device, the third response being used to indicate that the first session was successfully established.

[0057] In one possible implementation, before sending the third response to the first terminal device, the third control plane network element may also obtain the contract information of the second network, the contract information including one or more of the following: maximum bandwidth, scheduling priority, preemption priority, or QoS level; receive the first QoS parameter corresponding to the first session from the fourth control plane network element; and determine, based on the contract information, whether to allow the establishment of the first session based on the first QoS parameter.

[0058] In one possible implementation, before receiving the third request from the first terminal device, the third control plane network element may also receive a first request from the first terminal device, where the first request is used by the first terminal device to request access to the second network; based on the first request, a second request is sent to the second control plane network element in the second network, where the second request is used by the first control plane network element to request that the first terminal device access the second network; a second response is received from the second control plane network element, where the second response is used to indicate that the first terminal device is allowed to access the second network through the first network; and a first response is sent to the first terminal device, where the first response is used to indicate that the first terminal device has successfully accessed the second network.

[0059] In one possible implementation, the first request includes an identifier of the second network. Before sending the second request to the second control plane network element in the second network based on the first request, the third control plane network element can also obtain first information based on the identifier of the second network, where the first information is used to indicate that at least one terminal device is allowed to communicate with the second network through the first network, and the first terminal device belongs to at least one terminal device; based on the first information, determine to send the second request to the second control plane network element.

[0060] In one possible implementation, the first request includes an identifier of the second network. Before sending the second request to the second control plane network element in the second network based on the first request, the third control plane network element can also obtain the range information of the second network based on the identifier of the second network. The range information is used to indicate the range in which at least one terminal device is allowed to access the second network, and the first terminal device belongs to at least one terminal device; based on the range information and the location information of the first terminal device, it is determined to send the second request to the second control plane network element.

[0061] In one possible implementation, the third control plane network element may also, before receiving the second response from the second control plane network element, restrict messages transmitted between the first terminal device and the second network through the first network based on restriction information, wherein the restriction information includes one or more of the following: the type of messages allowed to be transmitted between the first terminal device and the second network through the first network, the number of messages allowed to be transmitted between the first terminal device and the second network through the first network, or the duration allowed for the first terminal device and the second network to communicate through the first network; after receiving the second response, the restriction on messages transmitted between the first terminal device and the second network through the first network is lifted.

[0062] In one possible implementation, before sending the second request to the second control plane network element in the second network according to the first request, the third control plane network element may also establish a secure connection with the second control plane network element, and the secure connection is used for message transmission between the first control plane network element and the second control plane network element.

[0063] In one possible implementation, the third control plane network element can also obtain a first quantity, where the first quantity is the total number of terminal devices that access the second network through the first network; based on the first quantity and the second information, determine whether the first terminal device is allowed to access the second network through the first network, and the second information includes the maximum number of terminal devices allowed to access the second network through the first network.

[0064] In a possible implementation, the third control plane network element may further add 1 to the first number.

[0065] In one possible implementation, the third control plane network element can also receive a first key from the second control plane network element, where the first key is used for secure transmission between the first terminal device and the first network; determine a second key based on the first key, where the second key is used for secure transmission between the first terminal device and an access network element of the first network, where the first terminal device accesses the network through the access network element; and send the second key to the access network element.

[0066] In one possible implementation, the third control plane network element may also determine a third key based on the first key, and the third key is used to perform security protection on NAS messages between the first control plane network element and the first terminal device; and send third information to the first terminal device, and the third information is used to instruct the first terminal device to initiate security protection on NAS messages between the first control plane network element and the first terminal device.

[0067] In one possible implementation, the third control plane network element can also obtain fourth information, and the fourth information includes one or more of the following: the number of terminal devices accessing the second network through the first network, the number of messages transmitted by the first terminal device between the first network and the second network, or the traffic consumed by the messages transmitted by the first terminal device between the first network and the second network; and send the fourth information to the billing system.

[0068] For the beneficial effects of the sixth aspect and any possible implementation thereof, please refer to the beneficial effects of the first aspect and any possible implementation thereof, and no further details will be given.

[0069] In a seventh aspect, the present application provides a communication method, which can be executed by a fourth control plane network element in the second network, or by a component in the fourth control plane network element. The fourth control plane network element can be, for example, a session management function network element, or a combined network element of an access and mobility management function network element and a session management function network element, without limitation. In this method, the fourth control plane network element receives a fourth request from a third control plane network element in the first network, the fourth request being used to request the establishment of a first session from a first terminal device to a second network, the first terminal device being a terminal device that has registered with the second network through the first network, the fourth request including the endpoint information of the first user plane network element in the first network; according to the fourth request, a fourth response is sent to the first control plane network element, the fourth response including the endpoint information of the second user plane network element in the second network.

[0070] In one possible implementation, the fourth control plane network element can also obtain the contract information of the first terminal device, the contract information including one or more of the following: maximum bandwidth, scheduling priority, preemption priority, or QoS level; determine the first QoS parameter corresponding to the first session based on the contract information; and send the first QoS parameter to the first control plane network element.

[0071] In one possible implementation, before receiving the fourth request from the first control plane network element in the first network, the fourth control plane network element may also receive a second request from the first control plane network element, where the second request is used by the first control plane network element to request that the first terminal device access the second network; based on the second request, a second response is sent to the first control plane network element, where the second response is used to indicate that the first terminal device is allowed to access the second network through the first network.

[0072] In one possible implementation, before sending a second response to the first control plane network element based on the second request, the fourth control plane network element may also obtain a second quantity, where the second quantity is the total number of terminal devices that access the second network through the first network; based on the second quantity and the second information, determine that the first terminal device is allowed to access the second network through the first network, and the second information includes the maximum number of terminal devices allowed to access the second network through the first network.

[0073] In a possible implementation manner, the fourth control plane network element may further add 1 to the second number.

[0074] In a possible implementation, before sending the second response to the first control plane network element according to the second request, the fourth control plane network element may further authenticate and authorize the first terminal device.

[0075] In a possible implementation, the fourth control plane network element may further establish a secure connection with the first control plane network element, where the secure connection is used for message transmission between the first control plane network element and the second control plane network element.

[0076] In a possible implementation, the fourth control plane network element may further allocate a first key to the first control plane network element, where the first key is used for secure transmission between the first terminal device and the first network; and send the first key to the first control plane network element.

[0077] For the beneficial effects of the seventh aspect and any possible implementation thereof, please refer to the beneficial effects of the second aspect and any possible implementation thereof, and no further details will be given.

[0078] In an eighth aspect, an embodiment of the present application provides a communication device. The communication device is used to perform the method in any one of the above-mentioned aspects from the first to the seventh aspect and any possible implementation thereof. The communication device is, for example, a first control plane network element (or a second control plane network element, or a first terminal device, or a third control plane network element, or a fourth control plane network element), or a functional module in the first control plane network element (or a second control plane network element, or a first terminal device, or a third control plane network element, or a fourth control plane network element), such as a baseband device or a chip system. In one possible implementation, the communication device includes a baseband device and a radio frequency device.

[0079] In another possible implementation, the communication device includes a processing unit (sometimes also referred to as a processing module) and a transceiver unit (sometimes also referred to as a transceiver module). The transceiver unit is capable of performing both sending and receiving functions. When the transceiver unit performs the sending function, it may be referred to as a sending unit (sometimes also referred to as a sending module); when the transceiver unit performs the receiving function, it may be referred to as a receiving unit (sometimes also referred to as a receiving module). The sending unit and the receiving unit may be the same functional unit, referred to as the transceiver unit, which is capable of both sending and receiving functions; alternatively, the sending unit and the receiving unit may be different functional units, with the transceiver unit being a collective term for these functional units.

[0080] In the ninth aspect, an embodiment of the present application further provides a communication device. The communication device may include one or more processors. Optionally, the communication device may also include a memory. The memory is used to store one or more computer programs or instructions. The one or more processors are used to execute the one or more computer programs or instructions stored in the memory, so that the communication device performs the method described in the first aspect and any possible implementation thereof, or performs the method described in the second aspect and any possible implementation thereof, or performs the method described in the third aspect and any possible implementation thereof, or performs the method described in the fourth aspect and any possible implementation thereof, or performs the method described in the fifth aspect and any possible implementation thereof, or performs the method described in the sixth aspect and any possible implementation thereof, or performs the method described in the seventh aspect and any possible implementation thereof.

[0081] In a tenth aspect, embodiments of the present application further provide a communications system. The communications system includes one or more of the following: a first control plane network element, a second control plane network element, or a first terminal device. The first control plane network element is configured to execute the method described in the first aspect and any possible implementation thereof, the second control plane network element is configured to execute the method described in the second aspect and any possible implementation thereof, and the first terminal device is configured to execute the method described in the first aspect and any possible implementation thereof.

[0082] In an eleventh aspect, an embodiment of the present application further provides a communications system. The communications system includes one or more of the following: a third control plane network element, or a fourth control plane network element. The third control plane network element is configured to execute the method described in the fourth aspect and any possible implementation thereof, and the fourth control plane network element is configured to execute the method described in the fifth aspect and any possible implementation thereof; alternatively, the third control plane network element is configured to execute the method described in the sixth aspect and any possible implementation thereof, and the fourth control plane network element is configured to execute the method described in the seventh aspect and any possible implementation thereof.

[0083] In the twelfth aspect, an embodiment of the present application provides a computer-readable storage medium, which is used to store computer programs or instructions. When the computer-readable storage medium is executed, the method described in the first aspect and any possible implementation thereof is implemented, or the method described in the second aspect and any possible implementation thereof is implemented, or the method described in the third aspect and any possible implementation thereof is implemented, or the method described in the fourth aspect and any possible implementation thereof is implemented, or the method described in the fifth aspect and any possible implementation thereof is implemented, or the method described in the sixth aspect and any possible implementation thereof is implemented, or the method described in the seventh aspect and any possible implementation thereof is implemented.

[0084] In a thirteenth aspect, an embodiment of the present application further provides a computer program product comprising instructions, which, when run on a computer, enables the method described in the first aspect and any possible implementation thereof to be implemented, or enables the method described in the second aspect and any possible implementation thereof to be implemented, or enables the method described in the third aspect and any possible implementation thereof to be implemented, or enables the method described in the fourth aspect and any possible implementation thereof to be implemented, or enables the method described in the fifth aspect and any possible implementation thereof to be implemented, or enables the method described in the sixth aspect and any possible implementation thereof to be implemented, or enables the method described in the seventh aspect and any possible implementation thereof to be implemented.

[0085] In the fourteenth aspect, an embodiment of the present application also provides a chip, which is coupled to a memory and is used to read and execute program instructions in the memory, so that the device where the chip is located implements the method described in the above-mentioned first aspect and any possible implementation thereof, or implements the method described in the above-mentioned second aspect and any possible implementation thereof, or implements the method described in the above-mentioned third aspect and any possible implementation thereof, or implements the method described in the above-mentioned fourth aspect and any possible implementation thereof, or implements the method described in the above-mentioned fifth aspect and any possible implementation thereof, or implements the method described in the above-mentioned sixth aspect and any possible implementation thereof, or implements the method described in the above-mentioned seventh aspect and any possible implementation thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0086] FIG1 is a schematic diagram of a network architecture of a communication system;

[0087] Figure 2 is a network architecture diagram for interconnection between a park and an operator network;

[0088] FIG3 is a schematic diagram of the architecture of a communication system provided in an embodiment of the present application;

[0089] FIG4 is a flow chart of a first communication method provided in an embodiment of the present application;

[0090] FIG5 is another flow chart of the first communication method provided in an embodiment of the present application;

[0091] FIG6 is a flow chart of a second communication method provided in an embodiment of the present application;

[0092] FIG7 is another flow chart of the second communication method provided in an embodiment of the present application;

[0093] FIG8 is a schematic diagram of a flow chart of a third communication method provided in an embodiment of the present application;

[0094] FIG9 is another flow chart of the third communication method provided in an embodiment of the present application;

[0095] FIG10 is a schematic structural diagram of a communication device provided in an embodiment of the present application;

[0096] FIG11 is a schematic structural diagram of another communication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0097] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the embodiments of the present application will be further described in detail below with reference to the accompanying drawings.

[0098] The network architecture and business scenarios described in this application are intended to more clearly illustrate the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. Ordinary technicians in this field will know that with the evolution of network architecture and the emergence of new business scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0099] In the embodiments of the present application, "multiple" may refer to two or more. In view of this, in the embodiments of the present application, "multiple" may also be understood as "at least two". "At least one" may be understood as one or more, for example, one, two or more. For example, "including at least one" means including one, two or more. For example, including at least one of A, B and C, then included may be A, B, C, A and B, A and C, B and C, or A, B and C. "And / or" describes the association relationship of associated objects. Specifically, there may be three relationships. For example, A and / or B may represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / ", unless otherwise specified, generally indicates that the previous and subsequent associated objects are in an "or" relationship.

[0100] In addition, the terms "system" and "network" in the embodiments of the present application may be used interchangeably, and "according to" and "based on" may be used interchangeably.

[0101] In the embodiments of this application, ordinal numbers such as "first" and "second" are generally used to distinguish different objects and are not used to define the order, timing, priority, or importance of multiple objects. For example, in the embodiments of this application, "first network" and "second network" are used to distinguish two networks and do not define the priority or importance of the two networks.

[0102] The embodiments of the present application will be presented around a system including multiple devices, components, modules, etc. It should be understood that the system may include other devices, components, modules, etc. not mentioned, or may only include some of the devices, components, or modules, etc. mentioned in the embodiments.

[0103] The following first introduces a communication system to which the embodiments of the present application are applicable.

[0104] The technical solutions of the embodiments of the present application can be applied to various communication systems, for example, universal mobile telecommunications system (UMTS), wireless local area network (WLAN), short-range wireless communication systems (such as sidelink, wireless fidelity (Wi-Fi), Bluetooth, etc.), wired networks, vehicle-to-everything (V2X) communication systems, device-to-device (D2D) communication systems, Internet of Vehicles communication systems, third-generation (3G) communication systems, fourth-generation (4G) mobile communication systems (such as long-term evolution (LTE) systems), LTE frequency division duplex (FDD) systems, LTE time division duplex (TDD) systems, worldwide interoperability for microwave access (WiMAX) communication systems, fifth-generation (5G) mobile communication systems (such as new radio (NR) systems), future communication systems (such as sixth-generation (6G) systems), and the like. The present invention relates to a mobile communication system (generation, 6G) or other similar communication systems, without limitation. The embodiments of the present application are described using the communication system shown in FIG1 as an example. When the technical solutions of the embodiments of the present application are applied to other communication systems, the devices, components, modules, etc. in the embodiments can be replaced with corresponding devices, components, modules in other communication systems without limitation.

[0105] Figure 1 provides a network architecture for a 5G communication system based on a service-oriented architecture. The network architecture may include user equipment (UE) and an operator network. The network architecture may also include a data network (DN) and / or application function (AF) network elements. The operator network may also be referred to as a universal network, a public network, a public data network, or a public land mobile network (PLMN), without limitation.

[0106] A UE, also known as a terminal device or terminal, is a device with wireless transceiver capabilities that can be deployed on land, including indoors or outdoors, handheld or vehicle-mounted; on water (such as ships); or in the air (such as on airplanes, balloons, and satellites). Specifically, a UE can be a mobile phone, a tablet, a computer with wireless transceiver capabilities, a virtual reality (VR) terminal, an augmented reality (AR) terminal, a wireless terminal used in industrial control, a wireless terminal used in self-driving cars, a wireless terminal used in remote medical care, a wireless terminal used in smart grids, a wireless terminal used in transportation safety, a wireless terminal used in smart cities, a wireless terminal used in smart homes, a terminal device used in the Internet of Things (IoT) (such as terminal devices in smart factories and smart manufacturing), or a terminal device supporting SparkLink short-range communication technology.

[0107] The operator network may include, but is not limited to, one or more of the following network elements: a network storage function network element, an access management function network element, a policy control function network element, a unified data management network element, a session management function network element, a user plane function network element, and an access network (AN). The portion of the operator network other than the access network may be referred to as the core network (CN). In one possible implementation, the operator network may also include an AF.

[0108] The above-mentioned terminal device can establish a connection with the operator network through the interface provided by the operator network (such as N1, etc.), and use the data and / or voice services provided by the operator network. The terminal device can also access the DN through the operator network, use the operator services deployed on the DN, and / or services provided by a third party. Among them, the above-mentioned third party may be a service provider other than the operator network and the terminal device, and can provide data and / or voice services to the terminal device. Among them, the specific form of the above-mentioned third party can be determined according to the actual application scenario and is not limited here.

[0109] Core network elements can be divided into control plane elements and user plane elements. Examples of control plane elements include access management function elements, unified data management elements, session management function elements, policy control function elements, and network storage function elements. User plane elements include user plane function elements. The following describes some of the core network elements.

[0110] The access management function (AMF) network element is responsible for access control and mobility management for terminal devices accessing the operator's network. For example, it performs functions such as mobility status management, allocating temporary user identities, authentication, and authorization. In 5G communication systems, this AMF network element may be the access and mobility management function (AMF) network element. In future communication systems, the AMF network element may have other names, which are not limited.

[0111] The unified data management network element is responsible for generating authentication credentials, user identification processing (such as storing and managing user permanent identities), and contract data management. In 5G communication systems, this unified data management network element can be a unified data management (UDM) network element. In future communication systems, this unified data management network element can also have other names, which are not limited.

[0112] The session management function (SMF) network element is primarily responsible for session management in mobile networks, such as session establishment, modification, or release. The SMF network element can also allocate Internet Protocol (IP) addresses to users and select user plane function network elements that provide message forwarding functions. In 5G communication systems, the SMF network element can be a session management function (SMF) network element. In future communication systems, the SMF network element can also have other names, which are not limited.

[0113] The policy control function network element mainly provides policy rules and is responsible for obtaining user subscription information related to policy decisions. In the 4G communication system, the policy control function network element can be a policy and charging rules function (PCRF) network element. In the 5G communication system, the policy control function network element can be a policy control function (PCF) network element. In future communication systems, the policy control function network element can also have other names, without limitation. The PCFs to which the AMF and SMF are connected correspond to AM PCF (PCF for access and mobility control) and SM PCF (PCF for session management), respectively, and may not be the same PCF entity in actual deployment scenarios.

[0114] The network storage function network element is responsible for providing network element discovery functions and providing network element information corresponding to the network element type based on requests from other network elements. Optionally, the network storage function network element can also provide network element management services, such as network element registration, update, deregistration, and network element status subscription and push. In the 5G communication system, the network storage function network element can be a network storage function network element (network repository function, NRF) network element. In future communication systems, the network storage function network element can also have other names, which are not limited.

[0115] The user plane function network element is responsible for receiving and forwarding user data. For example, it can receive user data from the DN and transmit it to the terminal device via the access network equipment. The user plane function network element can also receive user data from the terminal device via the access network equipment and forward it to the DN. In 5G communication systems, this user plane function network element can be a user plane function (UPF) network element. In future communication systems, the user plane function network element may also have other names, which are not limited.

[0116] AN includes AN equipment. The AN equipment is used to connect the terminal device to the wireless network. As a node in the access network, the AN equipment can also be called an access network element, a base station, a radio access network (RAN) node (or device, or network element), an access point (AP), a small tower, etc. For example, the next generation node B (gNB) in the 5G communication system, the evolved node B (eNB) in the LTE system, the radio network controller (RNC), the node B (NB), the base station controller (BSC), the base transceiver station (BTS), the home node B (HNB), the baseband unit (BBU), the wireless fidelity (WiFi) access point, the transmission reception point (TRP), the transmission point (TP), or the mobile switching center, etc.

[0117] It should be noted that in communication systems using different radio access technologies, the devices that function as base stations may vary. For example, in 5G communication systems, this device may be called a gNB or 5G NodeB; in LTE systems, this device may be called an evolved NodeB (eNB or eNodeB); and in 3G communication systems, it may be called a NodeB.

[0118] A DN is a network located outside of a mobile communications system that provides services to users. For example, a DN can be a packet data network (PDN), such as the Internet, an Internet Protocol Multimedia Service (IMS) network, certain application-specific data networks, Ethernet, or an Internet Protocol (IP) local network. A DN can deploy a variety of services, providing data and / or voice services to terminal devices. A DN can contain multiple application servers (ASs), each of which can provide at least one service.

[0119] The AF primarily communicates application-side requirements to the network, such as quality of service (QoS) requirements or user status event subscriptions. The AF can be a third-party functional entity or an application service deployed by an operator, such as the IMS voice call service.

[0120] As mentioned above, Figure 1 mainly introduces the network elements that may be involved in the various embodiments of the present application. The communication system shown in Figure 1 may also involve other network elements. For example, the core network may also include one or more of the following: a unified data repository (UDR) network element, a network slice selection function (NSSF) network element, an authentication server function (AUSF) network element, or a network exposure function (NEF) network element, etc., which are not shown in Figure 1.

[0121] In Figure 1, Nnrf, Namf, Npcf, Nsmf, Nudm, Naf, N1, N2, N3, N4, and N6 are interface serial numbers. The meanings of these interface serial numbers can be found in the definitions of the 3rd Generation Partnership Project (3GPP) standard protocol and are not limited here.

[0122] It is understood that the network element or function shown in Figure 1 can be a network element in a hardware device, a software function running on dedicated hardware, or a virtualized function instantiated on a platform (e.g., a cloud platform). In one possible implementation, the network element or function can be implemented by a single device, by multiple devices, or as a functional module within a single device, without specific limitation.

[0123] In addition, the embodiments of the present application do not limit the names of the network elements in the communication system. For example, in communication systems of different standards, each network element may have other names. For another example, when multiple network elements are integrated into the same physical device, the physical device may also have other names. For the convenience of description, the device names mentioned in the embodiments of the present application may omit "network element". For example, AMF network element and AMF have the same meaning. For another example, SMF network element and SMF have the same meaning. For another example, UPF network element and UPF have the same meaning.

[0124] In future networks, the functions of the core network and the access network may be split and reorganized. For example, the mobility management function of AMF may be split and merged into the access network, and the functions of AMF and SMF may be merged. The embodiment of this application is illustrated using the architecture of Figure 1 as an example.

[0125] Next, the technical features involved in the embodiments of this application are introduced.

[0126] A private network typically refers to an internal network, which can be a company's network, a campus network, or a supermarket network. The embodiments of this application do not limit the specific implementation of the private network. The private network may also be referred to as a non-public network, a campus network, a dedicated network, or a private network, without limitation. The following description uses a campus network (referred to as a campus) as an example.

[0127] Figure 2 provides a network architecture diagram for interconnection between a campus network and an operator network. In Figure 2, the operator network is taken as PLMN as an example. Unless otherwise specified, the following description will also take the operator network as PLMN as an example. As shown in Figure 2, the campus network may include but is not limited to: AMF, SMF, RAN, or UPF, etc. Among them, please refer to the above content for the description of AMF, SMF, RAN and UPF, which will not be repeated here. Please also refer to the above content for the description of PLMN, which will not be repeated here. In Figure 2, N1, N2, N3, N4, N11 and Nwu are interface serial numbers. The meanings of these interface serial numbers can be found in the meanings defined in the 3GPP standard protocol and are not limited here. The access path is represented by a thick black line in Figure 2.

[0128] Terminal devices in the campus (such as UE2 shown in (a) of Figure 2) can access the PLMN. Currently, after accessing the campus network, terminal devices in the campus can access the PLMN through non-3GPP access technology and then access the PLMN. In this solution, terminal devices in the campus need to support non-3GPP access technology, and PLMN also needs to deploy support for non-3GPP access technology, such as N3IWF, which is responsible for connecting terminal devices accessed through non-3GPP to the PLMN. Accordingly, network elements such as the AMF of the PLMN also need to be upgraded accordingly to support UE access to the PLMN from the campus through non-3GPP access technology. The implementation method is complex and the cost is high.

[0129] When a terminal device in a campus (such as UE1 shown in (b) of Figure 2) moves outside the campus and wants to communicate with the campus, the terminal device needs to first access the PLMN and establish a PDU session. It then uses the PDU session to establish a tunnel with the N3IWF network element in order to register with the campus. In this solution, the terminal device needs to support non-3GPP access technologies, and the campus also needs to support non-3GPP access technologies. For example, network elements such as N3IWF are deployed to connect terminal devices that access the PLMN through non-3GPP access. Network elements such as AMF deployed in the campus also need to be upgraded accordingly to support non-3GPP access technologies. The implementation is complex and costly.

[0130] In view of this, an embodiment of the present application provides a communication method and device for enabling a terminal device to remotely access a campus through a PLMN, or to access a terminal device to a PLMN through a campus, without the need for the terminal device and the campus to support non-3GPP access technology. The implementation is simple and can reduce costs.

[0131] It should be pointed out that the method provided in the embodiment of the present application is not only applicable to the communication scenario of intercommunication between PLMN and campus, but also to the communication scenario of intercommunication between any other two networks (such as the first network and the second network) without limitation. Among them, the first network can be a PLMN or a campus, and the embodiment of the present application does not limit the specific implementation form of the first network. The second network can be a PLMN or a campus, and the embodiment of the present application does not limit the specific implementation form of the second network. The first network and the second network can be any combination of the above-mentioned different types of networks. Optionally, there is a contractual relationship or a contractual relationship between the first network and the second network. For example, the first network signs a contract with the second network to allow the terminal device of the first network to access the first network or access the services of the first network through the second network. For another example, the second network signs a contract with the first network to allow the terminal device of the second network to access the first network or access the services of the second network.

[0132] For ease of understanding, the following description will be based on the example of the first network being a PLMN and the second network being a campus, unless otherwise specified. When the technical solution of the embodiment of the present application is applied to an intercommunication scenario between other two networks, the PLMN and campus in the embodiment can be replaced with the other two networks accordingly, without limitation.

[0133] Before introducing the methods provided in the embodiments of the present application, we will first introduce the communication architecture to which the methods provided in the embodiments of the present application are applicable. Please refer to Figure 3, which is a schematic diagram of the architecture of a communication system provided in the embodiments of the present application. As shown in Figure 3, the communication system includes a PLMN 310 and a campus 320.

[0134] PLMN310 may include RAN1, control plane network elements (AMF1, SMF1, PCF1, and security gateway 1 are used as examples in FIG3 ), and user plane network elements (UPF1 is used as an example in FIG3 ). Optionally, PLMN310 may provide IMS services, internet services, etc., without limitation. It should be understood that PLMN310 may also involve other network elements, such as a subscription management function network element, UDR, or UDM, without limitation. In addition, for the description of each network element in PLMN310, please refer to the aforementioned description of FIG1 and will not be repeated here.

[0135] Campus 320 includes RAN2, control plane network elements (AMF2, SMF2, UDM2, and security gateway 2 are used as examples in Figure 3), and user plane network elements (UPF2 is used as an example in Figure 3). Optionally, campus 320 may also involve other network elements, such as enterprise servers, PCFs, or UDRs, without limitation. For the description of each network element in campus 320, please refer to the aforementioned description of Figure 1 and will not be repeated here.

[0136] The control plane signaling between PLMN 310 and campus 320 can be interconnected through a security gateway. The security network element can support network topology hiding, such as not exposing the address information of the control plane network element. This security network element can also ensure the security of data transmission between the operations network and campus 320, such as establishing a secure connection and encrypting and integrity-protecting data transmitted between PLMN 310 and campus 320.

[0137] A user plane interface exists between the user plane network element in the PLMN 310 and the user plane network element in the campus 320 , which can be used for data transmission.

[0138] It should be noted that, in specific deployments, two or more control plane network elements can be co-located or deployed separately, without restriction. For example, the AMF and SMF can be co-located, but their respective functional modules still exist. Figure 3 uses the example of separate deployment of the AMF and SMF. Another example is the UDM and PCF can be co-located or deployed separately.

[0139] In addition, in the embodiment of the present application, the deployment of UDM2 in campus 320 is used as an example for illustration, but it should be pointed out that the UDM function in campus 320 may be different from the UDM function in PLMN. For example, the contract information of the terminal device stored in UDM2 in campus 320 may not include the user permanent identifier (SUPI) of the terminal device.

[0140] The following is an explanation of some of the terms involved in the embodiments of this application.

[0141] The first terminal device can be a contracted terminal of the park, that is, a terminal device that has signed a contract with the park; or it can also be a terminal device that has been authorized to access the park. For example, the first terminal device is a terminal device that has been authorized to access the park by scanning a code to register. For another example, the first terminal device is a visitor to the park, for example, the first terminal device is a terminal device for a visitor to a museum, and the museum allows any visitor to access the museum's campus network without restriction. In an embodiment of the present application, the first terminal device expects to access the park through a PLMN. For example, the first terminal device is outside the coverage of the park and within the coverage of a PLMN, and expects to access the park through the PLMN. The first terminal device may be a contracted terminal of the PLMN, or it may not be a contracted terminal of the PLMN, without restriction. Exemplarily, the first terminal device may be UE1 in the communication system shown in Figure 3.

[0142] The second terminal device is a terminal device that has been registered with the campus. In this embodiment of the present application, the second terminal device desires to access the PLMN through the campus. For example, the second terminal device is located in the campus, has been registered with the campus, and desires to access the PLMN through the campus. For example, the second terminal device may be UE2 in the communication system shown in Figure 3.

[0143] The first control plane network element is a control plane network element in the PLMN. This first control plane network element has the functions of an AMF; or it has the functions of an AMF and an SMF, that is, the first control plane network element is a combined AMF and SMF network element, or it has the NAS message forwarding function and mobility management function of the AMF. Unless otherwise specified, the following description uses the example of the first control plane network element being an AMF. For example, this first control plane network element may be AMF1 in the communication system shown in Figure 3.

[0144] The second control plane network element is the control plane network element in the park. The second control plane network element has the function of AMF; or has the function of AMF and the function of SMF, that is, the second control plane network element is a combined network element of AMF and SMF; or the second control plane network element has the access management function of AMF, that is, supports the control and authorization of the access of terminal devices. Unless otherwise specified, the following description will take the second control plane network element as AMF as an example. For example, the first control plane network element can be AMF2 in the communication system shown in Figure 3.

[0145] The third control plane network element is a control plane network element in the PLMN. This third control plane network element has the functionality of an SMF; or it has the functionality of both an AMF and an SMF, i.e., the third control plane network element is a combined AMF and SMF network element. Unless otherwise specified, the following description uses the SMF as an example. For example, this third control plane network element may be SMF1 in the communication system shown in Figure 3.

[0146] The fourth control plane network element is a control plane network element in the campus. This fourth control plane network element has the functions of an SMF; or it has the functions of an AMF and an SMF, that is, the fourth control plane network element is a combined AMF and SMF network element. Unless otherwise specified, the following description uses the fourth control plane network element as an example of an SMF. For example, the first control plane network element can be SMF2 in the communication system shown in Figure 3.

[0147] The first user plane network element is a user plane network element in the PLMN, for example, UPF1 in the communication system shown in FIG3 .

[0148] The second user plane network element is a user plane network element in the campus, for example, UPF2 in the communication system shown in FIG3 .

[0149] In the embodiments of the present application, the terms "access," "registration," and "visit" may be used interchangeably. The subscription information of the second network (or campus) in the first network (or PLMN) may be referred to as the subscription information of the second network (or campus). The subscription information of the first terminal device in the second network (or campus) may be referred to as the subscription information of the first terminal device. The subscription information of the second terminal device in the second network (or campus) may be referred to as the subscription information of the second terminal device.

[0150] The embodiments of the present application involve two communication scenarios, which are denoted as communication scenario 1 and communication scenario 2. Communication scenario 1 refers to a communication scenario in which a first terminal device remotely accesses the campus through a PLMN. For example, the first terminal device is UE1 in the communication system shown in FIG3 , and the UE1 expects to remotely access the campus 320 through PLMN310. Communication scenario 2 refers to a communication scenario in which a second terminal device accesses the PLMN through the campus. For example, the second terminal device is UE2 in the communication system shown in FIG3 , and the UE2 expects to access PLMN310 through the campus 320, such as accessing the IMS service provided by PLMN310.

[0151] The following first introduces the method provided in the embodiment of the present application in conjunction with communication scenario 1.

[0152] Figure 4 is a flow chart illustrating a first communication method according to an embodiment of the present application. In this embodiment, a first terminal device accesses a campus through a PLMN. The method 400 illustrated in Figure 4 can be applied to the communication system illustrated in Figure 3 without limitation. As shown in Figure 4, the method 400 may include the following.

[0153] S401: A first terminal device sends a first request to a first control plane network element in a first network.

[0154] Correspondingly, the first control plane network element receives the first request from the first terminal device.

[0155] S401 can also be expressed as: the first terminal device sends a first request to the first control plane network element in the PLMN; accordingly, the first control plane network element receives the first request from the first terminal device.

[0156] The first request can be used by the first terminal device to request access to the second network, that is, to request access to the campus. For example, the first terminal device is a contracted terminal device of the campus. When the first terminal device moves out of the coverage of the campus and wants to access the campus, the first terminal device can send a first request to the first control plane network element in the first network (that is, PLMN) where it is located, such as sending the first request to the first control plane network element through the first access network network element (RAN1 as shown in Figure 3). The first request itself can be used by the first terminal device to request access to the campus. For example, the first request is a registration request message. Alternatively, the first request may also include information (or information element) for the first terminal device to request access to the campus. The embodiment of the present application does not limit the specific implementation method of the first request. Optionally, the first request may include an identifier of the second network, that is, an identifier of the campus.

[0157] It should be noted that the terms such as the first network, the second network, the PLMN, the campus, the first terminal device, and the first control plane network element involved in the embodiments of the present application can be referred to the previous terminology explanation section and will not be repeated here.

[0158] S402: The first control plane network element sends a second request to a second control plane network element in the second network according to the first request.

[0159] Correspondingly, the second control plane network element receives the second request from the first control plane network element.

[0160] S402 may also be expressed as: the first control plane network element sends a second request to the second control plane network element in the park according to the first request; correspondingly, the second control plane network element receives the second request from the first control plane network element.

[0161] The second request can be used by the first control plane network element to request the first terminal device to be connected to the second network, that is, to request the first terminal device to be connected to the campus. For example, after receiving the first request, the first control plane network element parses the first request, determines that the first terminal device needs to be connected to the campus, generates a second request, and sends the second request to the second control plane network element in the campus. The second request itself can be used to request the first terminal device to be connected to the campus. For example, the second request is a registration request message. Alternatively, the second request may also include information (information element) for requesting the first terminal device to be connected to the campus. The information (or information element) for requesting the first terminal device to be connected to the campus may be generated by the second control plane network element, or may come from the first terminal device, such as obtaining the information (or information element) by parsing the first request, without limitation. It should be understood that the embodiments of the present application do not limit the specific implementation method of the second request.

[0162] In a possible implementation, the first control plane network element may determine whether to allow or deny the first terminal device to access the campus. In one example, the first control plane network element may determine whether to allow or deny the first terminal device to access the campus based on the campus's contract status in the PLMN (such as contracted or not) or based on the cooperation between the campus and the PLMN (such as cooperation or not). For example, the first request includes the campus's identifier, and the first control plane network element fails to obtain the campus's contract information or the cooperation information between the campus and the PLMN based on the campus's identifier, which means that the campus has not signed a contract with the PLMN. In this case, the first control plane network element denies the first terminal device access to the campus. In other words, there is no need to send a second request to the second control plane network element. Alternatively, the first control plane network element obtains the campus's contract information based on the campus's identifier, which means that the campus has signed a contract with the PLMN. In this case, the first control plane network element allows the first terminal device to access the campus. In other words, it determines to send a second request to the second control plane network element. The campus's contract information refers to the campus's contract information in the PLMN. For ease of description, the campus contract information and the cooperation information between the campus and the PLMN will be collectively referred to as the campus contract information. That is, the cooperation information between the campus and the PLMN and the campus contract information can be used interchangeably. It should be noted that the contract information can be saved to the contract server (such as UDM) or as configuration information without pre-restriction.

[0163] In another example, the first request includes a campus identifier. The first control plane network element can obtain first information based on the campus identifier and, based on the first information, determine whether to allow or deny the first terminal device access to the campus. The first information can be used to indicate whether to allow or deny at least one terminal device to communicate with the campus via the PLMN, to which the first terminal device belongs. For example, if the first information indicates that at least one terminal device is denied communication with the campus via the PLMN, the first control plane network element denies the first terminal device access to the campus. In other words, there is no need to send the second request to the second control plane network element. Alternatively, if the first information indicates that at least one terminal device is allowed to communicate with the campus via the PLMN, the first control plane network element permits the first terminal device to access the campus. In other words, it determines to send the second request to the second control plane network element. The first information can be predefined, pre-agreed, or included in the campus's contract information, without limitation. It should be understood that the first information can be included in the campus's contract information, or can also be the campus's contract information, without limitation. For example, if the first control plane network element obtains the first information, the first control plane network element allows the first terminal device to access the campus; if the first information is not obtained, the first control plane network element may deny the first terminal device from accessing the campus.

[0164] In another example, the first request includes an identifier of the park. The first control plane network element can obtain the scope information of the park based on the identifier of the park, and determine whether to allow or deny the first terminal device to access the park based on the scope information of the park and the location information of the first terminal device. The scope information of the park can be used to indicate the scope within which at least one terminal device is allowed to access the park, and the first terminal device belongs to the at least one terminal device. For example, if the first terminal device is outside the scope indicated by the scope information of the park, the first control plane network element denies the first terminal device access to the park. In other words, there is no need to send a second request to the second control plane network element. Alternatively, if the first terminal device is within the scope indicated by the scope information of the park, the first control plane network element allows the first terminal device to access the park. In other words, it determines to send a second request to the second control plane network element. Optionally, the scope information of the park can be included in the contract information of the park without limitation. The scope information of the park can be one or more of a tracking area (TA), a TA list, a cell, and a cell list without limitation.

[0165] In another example, the first request includes the identifier of the park, and the first control plane network element determines the information of the second control plane network element in the second network (such as the address information of the second control plane network element, etc., without limitation) based on the identifier of the park, that is, determines the information of the second control plane network element in the park. For example, the first control plane network element can obtain the information of the second control plane network element by querying the NRF based on the identifier of the park. Through this example, the first control plane network element can determine the information of the second control plane network element in the park, so that the first control plane network element sends a second request to the second control plane network element.

[0166] It should be noted that the embodiment of the present application is described by taking the example of the first control plane network element allowing the first terminal device to access the campus.

[0167] In one possible implementation, a first control plane network element may establish a secure connection with a second control plane network element. Furthermore, the first control plane network element may communicate with the second control plane network element via the secure connection, such as by sending a second request. The secure connection is used for message transmission between the first and second control plane network elements, such as control signaling. The secure connection may be a connection between a security gateway in a PLMN and a security gateway in a campus. The security gateway in the PLMN may be security gateway 1 in the communication system shown in FIG3 . The security gateway in the campus may be security gateway 2 in the communication system shown in FIG3 . Exemplarily, the first control plane network element may send a campus identifier to the security gateway in the PLMN. In response, the security gateway in the PLMN receives the campus identifier, obtains information about the security gateway in the campus based on the campus identifier, and establishes a secure connection with the security gateway in the campus based on the information. Optionally, the secure connection may be a connection based on Hypertext Transfer Protocol Secure (HTTPS), such as where the security gateway in the PLMN and the security gateway in the campus perform mutual authentication to confirm each other's identities. It should be noted that the embodiment of the present application does not limit the specific process of establishing the secure connection between the first control plane network element and the second control plane network element.

[0168] S403: The second control plane network element sends a second response to the first control plane network element.

[0169] Correspondingly, the first control plane network element receives a second response from the second control plane network element.

[0170] The second response indicates whether the first terminal device is allowed (or supported) or denied (or prohibited) to access the second network through the first network, that is, whether the first terminal device is allowed or denied to access the campus through the PLMN. The second response can also be called an authorization indication, etc., without limitation. For example, after receiving the second request, the second control plane network element parses the second request, determines whether the first terminal device is allowed or denied to access the campus through the PLMN, generates a second response, and sends the second response to the first control plane network element. The second response itself can indicate whether the first terminal device is allowed or denied to access the campus through the PLMN. For example, the second response is a negative acknowledgement (NACK) message to indicate that the first terminal device is denied to access the campus through the PLMN; or, the second response is an acknowledgment (ACK) message to indicate that the first terminal device is allowed to access the campus through the PLMN, without limitation. Alternatively, the second response can also include information (information element) for indicating whether the first terminal device is allowed or denied to access the campus through the PLMN. The embodiment of the present application does not limit the specific implementation method of the second response.

[0171] After receiving the second request, the second control plane network element may determine whether to allow or deny the first terminal device access to the campus via the PLMN. In one example, the second control plane network element may determine whether to allow or deny the first terminal device access to the campus via the PLMN based on the seventh information. The seventh information may be used to indicate whether to allow or deny the first terminal device access to the campus via the PLMN. For example, if the seventh information indicates that the first terminal device accesses the campus via the PLMN is denied, the second control plane network element may determine, based on the seventh information, that the first terminal device accesses the campus via the PLMN is denied. Accordingly, the second response indicates that the first terminal device accesses the campus via the PLMN is denied. Alternatively, if the seventh information indicates that the first terminal device accesses the campus via the PLMN is permitted, the second control plane network element may determine, based on the seventh information, that the first terminal device accesses the campus via the PLMN. Accordingly, the second response indicates that the first terminal device accesses the campus via the PLMN is permitted. The seventh information may be predefined or included in the first terminal device's subscription information, without limitation. For example, the second control plane network element obtains the first terminal device's subscription information based on the second request, where the first terminal device's subscription information includes the seventh information. The subscription information of the first terminal device refers to the first terminal device's subscription information for the campus.

[0172] In another example, the second control plane network element may determine whether to allow or deny the first terminal device to access the campus through the PLMN based on the second number and the second information. The second number is the total number of terminal devices accessing the campus through the PLMN, such as the total number of terminal devices currently accessing the campus through the PLMN. The second information includes the maximum number of terminal devices allowed to access the campus through the PLMN. Exemplarily, the second control plane network element may obtain the second number and determine whether to allow or deny the first terminal device to access the campus through the PLMN based on the second number and the second information. For example, if the second number is greater than the maximum number of terminal devices allowed to access the campus through the PLMN, the second control plane network element may determine to deny the first terminal device access to the campus through the PLMN, and accordingly, the second response indicates that the first terminal device is denied access to the campus through the PLMN. Alternatively, if the second number is less than or equal to the maximum number of terminal devices allowed to access the campus through the PLMN, the second control plane network element may determine to allow the first terminal device to access the campus through the PLMN, and accordingly, the second response indicates that the first terminal device is allowed to access the campus through the PLMN.

[0173] The second information may be predefined or included in the contract information of the park, without limitation. The second quantity may be maintained (or stored) by the second control plane network element, or may be maintained by other network elements in the park. The other network element may be, for example, a data management network element in the park, such as a UDM or UDR. It should be understood that if the second quantity is maintained by other network elements in the park, then the second control plane network element may obtain the second quantity by interacting with the other network elements, without limitation.

[0174] Furthermore, if the second control plane network element determines that the first terminal device is allowed to access the campus through the PLMN, and the second number is maintained by the second control plane network element, then the second control plane network element may add 1 to the second number. Alternatively, if the second control plane network element determines that the first terminal device is allowed to access the campus through the PLMN, and the second number is maintained by other network elements in the campus, then the second control plane network element may send a notification message to the other network element, so that the other network element adds 1 to the second number.

[0175] The second number mentioned above is the total number of terminal devices accessing the campus through a PLMN, and the second information includes the maximum number of terminal devices allowed to access the campus through the PLMN. In another possible implementation, the campus may have contracts with multiple PLMNs, i.e., allowing a first terminal device to access the campus through multiple PLMNs. The campus has a contract with each of the multiple PLMNs for the total number of terminal devices allowed to access the campus through the PLMN. In this case, the second number is the total number of terminal devices accessing the campus through the multiple PLMNs, and the second information includes a third number, which is the sum of the total number of terminal devices allowed to access the campus through each of the multiple PLMNs. Furthermore, if the second number is greater than the third number, the terminal device is not allowed (or denied) to access the campus through any of the multiple PLMNs; otherwise, the terminal device is allowed to access the campus through any of the multiple PLMNs. The total number of terminal devices allowed to access the campus through the PLMNs, as contracted by the campus with each of the multiple PLMNs, can be the same or different. For example, the multiple PLMNs include PLMN1 and PLMN2. The total number of terminal devices that are allowed to access the campus through PLMN1 and that have signed a contract with the campus is recorded as number 1. The total number of terminal devices that are allowed to access the campus through PLMN2 and that have signed a contract with the campus is recorded as number 2. Number 1 and number 2 may be the same or different. If the second number is greater than the sum of number 1 and number 2, the terminal device is denied access to the campus through PLMN1 or PLMN2. Otherwise, the terminal device is allowed to access the campus through PLMN1 or PLMN2.

[0176] It should be noted that the embodiment of the present application is described by taking the example of the second response indicating that the first terminal device is allowed to access the campus through the PLMN.

[0177] In one possible implementation, if the second control plane network element determines that the first terminal device is allowed to access the campus through the PLMN, the second control plane network element may also authenticate and authorize the first terminal device. For example, the second control plane network element authenticates and authorizes the first terminal device before sending the second response to the first control plane network element. It is worth noting that the authentication information between the second control plane network element and the first terminal device is transmitted through the first control plane network element. The embodiment of the present application does not limit the specific implementation process of the second control plane network element authenticating and authorizing the first terminal device.

[0178] Exemplarily, the second control plane network element can obtain the identity information of the first terminal device and authenticate and authorize the first terminal device based on the identity information of the first terminal device. For example, the second control plane network element can complete the authentication and authorization of the first terminal device by interacting with the authentication network element (such as AUSF, etc.) in the park. For example, the second network can allocate and install an embedded subscriber identity module (eSIM) for the first terminal device. The eSIM includes information such as the identity of the first terminal device in the park and security parameters; further, the second control plane network element authenticates and authorizes the first terminal device based on the information. It should be understood that the second control plane network element can also use other mechanisms to authenticate and authorize the first terminal device, such as a certificate mechanism, that is, when the first terminal device signs a contract with the park, the park writes the certificate to the first terminal device, and the first terminal device can subsequently be authenticated and authorized through the certificate. When authenticating the first terminal device, the second control plane network element and the first terminal device exchange authentication messages through the first control plane network element in the first network. For example, the second control plane network element sends an authentication request message to the first terminal device via the first control plane network element in the first network; the first terminal device responds to the authentication request message by sending an authentication response message to the second control plane network element via the first control plane network element. This embodiment of the application does not limit the specific implementation process of authentication and authorization of the first terminal device.

[0179] Among them, the identity information of the first terminal device can be understood as the identity information of the first terminal device in the park, for example, it can be the identifier of the first terminal device, without limitation. The identity information of the first terminal device can be included in the first request, and sent by the first control plane network element to the second control plane network element in the second request; or, it can also be actively obtained by the second control plane network element, that is, the second control plane network element sends an ID request message to the first terminal device through the first control plane network element, and in response to the ID request message, the first terminal device sends the identity information to the second control plane network element through the first control plane network element, without limitation. The embodiment of the present application does not limit the acquisition of the identity information of the first terminal device by the second control plane network element. It should be pointed out that the first terminal device can encrypt the identity information when sending the identity information, so that the network elements in the first network, such as the first control plane network element, cannot obtain the identity information of the first terminal device, which can effectively prevent the behavior of park users from being tracked by the first network.

[0180] In one possible implementation, if the second control plane network element determines that the first terminal device is allowed to access the campus through the PLMN, the second control plane network element may also allocate a campus temporary identifier for the first terminal device and send it to the first terminal device through the first control plane network element. For example, the second control plane network element may carry the campus temporary identifier in the second response and send it to the first control plane network element, which then forwards it to the first terminal device through the first access network network element. Accordingly, the first control plane network element may save the campus temporary identifier. The campus temporary identifier can uniquely identify the first terminal device within the campus, thereby hiding the true identity information of the first terminal device in the campus. Optionally, the second control plane network element is a combined network element of AMF and SMF, and the campus temporary identifier can be a context identifier of the first terminal device, such as a mobility management context identifier. It should be noted that the campus temporary identifier can be a string or an integer, etc., without limitation. Optionally, the second control plane network element can also send the campus temporary identification of the first terminal device to the data management network element (such as UDM, or UDR, etc.) in the campus, so that other network elements in the campus can obtain the identity information of the first terminal device in the campus and the contract information of the first terminal device from the data management network element based on the campus temporary identification of the first terminal device.

[0181] In one possible implementation, the second control plane network element may further send an encrypted SUPI of the first terminal device to the first control plane network element; accordingly, the first control plane network element receives and stores the encrypted SUPI. Optionally, the encrypted SUPI may be included in the second response, without limitation.

[0182] Optionally, if the second control plane network element determines to allow the first terminal device to access the campus through the PLMN, the second control plane network element may also send a notification message to the data management network element in the campus to notify the first terminal device that it is in a registered state, enabling the data management network element to provide services for the first terminal device.

[0183] Before the second control plane network element determines to allow the first terminal device to access the campus through the PLMN, the first terminal device and the second control plane network element may need to interact with authentication messages and user identity information and other information. At this time, the first control plane network element should allow the first terminal device and the second control plane network element to transmit messages through the first control plane network element. However, since the first control plane network element has not yet received the authorization indication (i.e., the second response) allowing the first terminal device to access the campus through the PLMN, the first terminal device sending messages to the campus through the PLMN is prone to malicious use, causing the PLMN and / or the campus to be accessed by malicious terminal devices, resulting in a waste of network resources. To this end, in a possible implementation method, before receiving the second response from the second control plane network element, the first control plane network element can restrict the messages transmitted between the first terminal device and the campus through the PLMN based on the restriction information, so as to reduce the problem of terminal devices sending malicious messages before the first control plane network element receives the authorization indication from the campus, thereby reducing network resource consumption. Among them, the restriction information may include one or more of the following: the type of messages allowed to be transmitted between the terminal device (such as the first terminal device) and the park through the PLMN, the number of messages allowed to be transmitted between the terminal device (such as the first terminal device) and the park through the PLMN, or the duration allowed for the terminal device (such as the first terminal device) to communicate with the park through the PLMN. The restriction information may be predefined or included in the contract information of the park without restriction. For example, the first control plane network element may obtain the restriction information, such as obtaining the contract information of the park through the identification of the park, and obtaining the restriction information based on the contract information of the park without restriction.

[0184] Optionally, after the first control plane network element receives the second response, the first control plane network element may cancel the restriction on messages transmitted between the first terminal device and the campus through the PLMN.

[0185] It should be noted that the term "transmission" involved in the embodiments of the present application may include sending and / or receiving.

[0186] S404: The first control plane network element sends a first response to the first terminal device.

[0187] Correspondingly, the first terminal device receives a first response from the first control plane network element.

[0188] The first response can be used to indicate the success or failure of the first terminal device's access to the second network, that is, the success or failure of accessing the campus. Alternatively, the first response is used to indicate the success or failure of the first terminal device's access to the second network through the first network, that is, the success or failure of accessing the campus through the PLMN. The embodiments of the present application describe an example in which the first response is used to indicate the first terminal device's successful access to the campus. The first response can be, for example, a registration response message, without limitation. For example, after receiving the second response, the first control plane network element can generate a first response and send the first response to the first terminal device. For example, the first control plane network element sends the first response to the first access network element, which then forwards it to the first terminal device. The first response itself can be used to indicate the success or failure of the first terminal device's access to the second network. For example, if the first response is a NACK message, it can indicate that the first terminal device failed to access the campus; or, if the first response is an ACK message, it can indicate that the first terminal device successfully accessed the campus, without limitation. Alternatively, the first response can also include information (information element) indicating the success or failure of the first terminal device's access to the campus. The information indicating the success or failure of the first terminal device to access the campus can be generated by the first control plane network element; or can also come from the second control plane network element, for example, the second response includes the information. The embodiment of the present application does not limit the specific implementation method of the first response.

[0189] In one possible implementation, the second response indicates that the first terminal device is permitted to access the campus through the PLMN. After receiving the second response, the first control plane network element determines that the second control plane network element permits the first terminal device to access the campus through the PLMN. Furthermore, the first control plane network element may determine whether to permit or deny the first terminal device to access the campus through the PLMN based on the first number and the second information, thereby implementing multiple verifications and reducing the risk of malicious terminal devices accessing the campus through the PLMN. This embodiment of the present application uses the example of the first control plane network element determining that the first terminal device is permitted to access the campus through the PLMN. For a description of the second information, please refer to the preceding content and will not be repeated here. The first number is the total number of terminal devices that have accessed the campus through the PLMN. This first number may be maintained (or stored) by the first control plane network element or by other network elements in the PLMN, without limitation. The other network element may, for example, be a data management network element in the PLMN, such as a UDM or UDR. It should be understood that if the first number is maintained by other network elements in the PLMN, the first control plane network element may interact with the other network elements to obtain the first number, without limitation. In addition, the specific implementation process of the first control plane network element determining whether to allow or reject the first terminal device to access the campus through the PLMN based on the first quantity and the second information can refer to the aforementioned related content and will not be repeated here.

[0190] It should be pointed out that the park may sign contracts with multiple PLMNs, that is, the first terminal device is allowed to access the park through multiple PLMNs. In this case, the first number is the total number of terminal devices accessing the park through multiple PLMNs. Please refer to the above-mentioned related content for details and no further details will be given.

[0191] It should be noted that the first control plane network element can determine whether to allow or deny the first terminal device to access the campus through the PLMN based on the first quantity and the second information when receiving the second response message; or, the first control plane network element can also determine whether to allow or deny the first terminal device to access the campus through the PLMN based on the first quantity and the second information after receiving the first request sent by the first terminal device (i.e., after S401), without restriction. It should be understood that if the first control plane network element determines to deny the first terminal device to access the campus through the PLMN based on the first quantity and the second information after receiving the first request sent by the first terminal device, then the first control plane network element does not send the second request, but sends a denial indication to the first terminal device.

[0192] Furthermore, if the first control plane network element determines that the first terminal device is allowed to access the campus through the PLMN, and the first number is maintained by the second control plane network element, then the first control plane network element may add 1 to the first number. Alternatively, if the first control plane network element determines that the first terminal device is allowed to access the campus through the PLMN, and the first number is maintained by other network elements in the PLMN, then the first control plane network element may send a notification message to the other network element to cause the other network element to add 1 to the first number.

[0193] In one possible implementation, the first control plane network element may obtain fourth information and send the fourth information to a billing system so that the billing system charges for the service of the first terminal device accessing the park through the PLMN. The fourth information may include one or more of the following: the number of terminal devices accessing the park through the PLMN, the number of messages transmitted between the terminal devices (such as the first terminal device) accessing the park through the PLMN and the park, or the traffic consumed by the messages transmitted between the terminal devices (such as the first terminal device) accessing the park through the PLMN and the park.

[0194] It should be noted that in this embodiment, the first terminal device may or may not be a PLMN-subscribed terminal. If the first terminal device is a PLMN-subscribed terminal device, the first terminal device may also access the PLMN, such as by using a PLMN SIM card to access the PLMN and access PLMN services. Of course, the first terminal device may not be connected to the PLMN, and this is not a limitation.

[0195] In order to ensure the reliable transmission of messages when the first terminal device accesses, in a possible implementation method, the campus can assign a key to the first terminal device to ensure the security of messages when the first terminal device communicates with the campus through the PLMN. Exemplarily, the second control plane network element can determine the first key and send the first key to the first control plane network element. For example, after the second control plane network element successfully authenticates the first terminal device, it can assign the first key to the first terminal device. Correspondingly, the first control plane network element receives the first key from the second control plane network element. Optionally, the first key can be included in the second response, or the first key can also be sent to the first control plane network element together with the second response, without limitation. The second control plane network element can assign the first key to the first terminal device, or obtain the first key from other network elements in the campus, for example, obtain the first key from the AUSF in the campus. The embodiment of the present application does not limit the specific implementation process of the second control plane network element determining the first key.

[0196] Accordingly, on the first terminal device side, the first terminal device can generate a fourth key. The fourth key and the first key form a key pair, that is, the fourth key is the same as the first key, the fourth key is generated by the first terminal device, and the first key is generated by the campus side. For example, the first terminal device can generate the fourth key after the first terminal device successfully authenticates the campus. This embodiment of the application does not limit the specific implementation process of the first terminal device generating the fourth key.

[0197] Optionally, after receiving the first key, the first control plane network element can determine (or derive, or calculate, etc.) a second key based on the first key, and send the second key to the first access network network element in the PLMN to ensure the security of communication between the first terminal device and the first access network network element. Accordingly, the first access network network element receives the second key from the first control plane network element. For example, the first control plane network element can carry the second key in a create UE context request message and send it to the first access network network element. Optionally, the create UE context request message may also include a first response, which is not limited. The embodiment of the present application does not limit the specific implementation process of the first control plane network element determining the second key based on the first key.

[0198] Accordingly, on the first terminal device side, the first terminal device can determine (or derive, or calculate, etc.) a fifth key based on the fourth key, and the fifth key is used for secure transmission between the first terminal device and the first access network element. In other words, the fifth key and the second key form a key pair. The embodiment of the present application does not limit the specific implementation process of the first terminal device determining the fifth key based on the fourth key.

[0199] Optionally, the first control plane network element may also determine (or derive, or calculate, etc.) a third key based on the first key. The third key is used for secure transmission between the first terminal device and the first control plane network element. For example, the third key may be used to securely protect NAS messages transmitted between the first terminal device and the first control plane network element. The embodiment of the present application does not limit the specific implementation process of the first control plane network element determining the third key based on the first key.

[0200] Correspondingly, on the first terminal device side, the first terminal device can determine (or derive, or calculate, etc.) the sixth key based on the fourth key. The sixth key is used for secure transmission between the first terminal device and the first control plane network element. For example, the sixth key can be used to securely protect NAS messages transmitted between the first terminal device and the first control plane network element. In other words, the sixth key and the third key are a key pair. The embodiment of the present application does not limit the specific implementation process of the first terminal device determining the sixth key based on the fourth key.

[0201] Furthermore, the first control plane network element sends third information to the first terminal device, and accordingly, the first terminal device receives the third information. The third information can be used to instruct the first terminal device to start security protection for messages transmitted between the first control plane network element and the first terminal device. The message can be, for example, a non-access stratum (NAS) message, without limitation. For example, the first control plane network element can send a NAS security command request to the first terminal device, and the NAS security command request includes the third information or is the third information, thereby instructing the first terminal device to start security protection for NAS messages transmitted between the first control plane network element and the first terminal device. After receiving the third information, the first terminal device can respond to the third information and start using (or based on) the sixth key to perform security protection on the NAS messages between the first control plane network element and the first terminal device. Optionally, the first terminal device can also send a response message to the third information to the first control plane network element, such as a NAS security command completion message, to indicate that the first terminal device has started security protection for messages transmitted between the first control plane network element and the first terminal device. It should be understood that the first terminal device can generate the sixth key based on the fourth key after receiving the third information, or it can generate the sixth key based on the fourth key after the first terminal device successfully authenticates the campus and before receiving the third information, without limitation.

[0202] The following describes the process shown in FIG4 in detail, taking method 400 applied to the communication system shown in FIG3 as an example. The first network is PLMN 310 in the communication system shown in FIG3 . The second network is campus 320 in the communication system shown in FIG3 . The first terminal device is UE1 in the communication system shown in FIG3 . The first control plane network element is AMF1 in the communication system shown in FIG3 . The second control plane network element is AMF2 in the communication system shown in FIG3 . The first access network network element is RAN1 in the communication system shown in FIG3 .

[0203] Please refer to Figure 5, which is another flowchart of the first communication method provided in the embodiment of the present application. It should be understood that Figure 5 is an exemplary interaction diagram of method 400, and the embodiment of the present application is not limited thereto.

[0204] S501: UE1 sends a first request to AMF1; accordingly, AMF1 receives the first request.

[0205] The first request may be used by UE1 to request access to the campus 320. Optionally, the first request carries an identifier of the campus 320. For a description of the first request, please refer to the content of S401 and will not be repeated here.

[0206] S502: AMF1 determines that UE1 is allowed to access campus 320.

[0207] After receiving the first request, AMF1 may determine whether to allow or deny UE1 to access campus 320. For the specific implementation process, please refer to the relevant content of S402, which will not be repeated here. In this embodiment, AMF1 determines to allow UE1 to access campus 320 as an example for description.

[0208] S503: AMF1 establishes a secure connection with AMF2.

[0209] The secure connection is used for message transmission between the first control plane network element and the second control plane network element, such as transmission of control signaling. The secure connection can specifically be a connection between security gateway 1 in PLMN 310 and security gateway 2 in campus 320. Security gateway 1 and security gateway 2 are not shown in Figure 5.

[0210] S504: AMF1 restricts messages transmitted between UE1 and campus 320 through PLMN310 according to the restriction information.

[0211] S504 is an optional step, indicated by a dashed line in Figure 5 . The restriction information may include one or more of the following: the type of messages permitted to be transmitted between UE1 and campus 320 via PLMN 310, the number of messages permitted to be transmitted between UE1 and campus 320 via PLMN 310, or the duration of communication permitted between UE1 and campus 320 via PLMN 310. For the specific implementation of S504, please refer to the relevant content of S403 and will not be repeated here.

[0212] S505: AMF1 sends a second request to AMF2; accordingly, AMF2 receives the second request.

[0213] The second request may be used by AMF1 to request UE1 to access the campus 320. For the specific implementation process of S505, please refer to the relevant content of S402 and will not be repeated here.

[0214] S506: AMF2 authenticates and authorizes UE1.

[0215] For the specific implementation process of S506, please refer to the relevant content of S403 and will not be repeated here.

[0216] S507: UE1 generates a fourth key.

[0217] For example, after UE1 successfully authenticates AMF2, UE1 can generate the fourth key, or generate the fourth key when receiving the third information, without restriction.

[0218] S508: AMF2 determines that UE1 is allowed to access campus 320 through PLMN310.

[0219] AMF2 can determine whether to allow or deny UE1 access to campus 320 through PLMN 310. For the specific implementation process, please refer to the relevant content of S403 and will not be repeated here. In this embodiment, the example in which AMF2 determines to allow UE1 to access campus 320 through PLMN 310 is used for description. Optionally, AMF2 can add 1 to the second number, where the second number is the total number of UEs accessing campus 320 through PLMN 310.

[0220] S509: AMF2 allocates a first key to UE1.

[0221] The first key and the fourth key form a key pair.

[0222] Optionally, AMF2 can allocate a temporary campus identifier for UE1, which is not shown in Figure 5. Please refer to the relevant content of S403 for details and will not be repeated here.

[0223] S510: AMF2 sends a second response and the first key to AMF1; accordingly, AMF1 receives the second response and the first key from AMF2.

[0224] The second response may be used to indicate that UE1 is allowed to access campus 320 through PLMN 310. For the specific implementation process of S510, please refer to the relevant content of S403 and will not be repeated here. It should be understood that the sending of the second response and the sending of the first key can be performed in one step or in two separate steps, without limitation.

[0225] S511: AMF1 determines that UE1 is allowed to access campus 320 through PLMN310.

[0226] S511 is an optional step, indicated by a dotted line in FIG5 . For example, AMF1 may determine whether to allow or deny UE1 access to campus 320 through PLMN310 based on the first number and the second information. For the specific implementation process, please refer to the relevant content of S403 and will not be described in detail. In this embodiment, the example in which AMF1 determines that UE1 is allowed to access campus 320 through PLMN310 is used for description. Optionally, AMF1 may add 1 to the first number, where the first number is the total number of UEs accessing campus 320 through PLMN310.

[0227] S512: AMF1 cancels the restriction on messages transmitted between UE1 and campus 320 through PLMN310.

[0228] S512 is an optional step, which is indicated by a dotted line in Figure 5. For example, after AMF1 determines that UE1 is allowed to access campus 320 through PLMN 310, it can cancel the restriction on messages transmitted between UE1 and campus 320 through PLMN 310.

[0229] S513: AMF1 determines the second key and the third key according to the first key.

[0230] The second key can be used for secure transmission between UE1 and RAN1. The third key can be used for security protection of NAS messages transmitted between AMF1 and UE1. For the specific implementation of S513, please refer to the relevant content of S404 and will not be repeated here. It should be understood that the determination of the second key and the third key can be performed in a single step or in two separate steps, without limitation.

[0231] S514: AMF1 sends the first response, the second key, and the third information to RAN1. Correspondingly, RAN1 receives the first response, the second key, and the third information.

[0232] The first response may be used to indicate that UE1 has successfully accessed campus 320. The third information may be used to instruct UE1 to initiate security protection for NAS messages transmitted between AMF1 and UE1. It should be understood that the sending of the first response, the sending of the second key, and the sending of the third information may be performed in one step, or may be performed in two or three steps, without limitation.

[0233] S515: RAN1 sends the first response and the third information to UE1. Correspondingly, UE1 receives the first response and the third information.

[0234] It should be understood that the sending of the first response and the sending of the third information may be performed in one step, or may be performed separately in two steps, without limitation.

[0235] S516: UE1 determines the fifth key according to the fourth key.

[0236] The fifth key is used for secure transmission between UE1 and RAN1. The fifth key and the second key form a key pair.

[0237] S517: UE1 determines a sixth key according to the fourth key in response to the third information.

[0238] The sixth key can be used to securely protect NAS messages transmitted between AMF1 and UE1. The sixth key and the third key form a key pair. Furthermore, UE1 begins to securely protect NAS messages transmitted between AMF1 and UE1 based on the sixth key (not shown in FIG. 5 ).

[0239] For the specific implementation process of the above S513 to S517, please refer to the content of S404 and will not be repeated here.

[0240] It should be understood that the execution order of the various steps in Figure 5 is provided as an example and is not intended to be limiting. For example, AMF1 may remove restrictions on messages transmitted between UE1 and campus 320 via PLMN 310 before determining the second and third keys based on the first key. Alternatively, AMF1 may determine the second and third keys based on the first key after removing restrictions on messages transmitted between UE1 and campus 320 via PLMN 310. For another example, UE1 may generate the fourth key before or after receiving the first response.

[0241] Through the above-described method 400, a first terminal device can access a second network via a first network, and the implementation is simple. When the first network is a PLMN and the second network is a campus, and the terminal device is outside the coverage area of ​​the campus, the method 400 can enable the terminal device to remotely access the campus via the PLMN, without requiring the terminal device and the campus to support non-3GPP access technologies. This simple implementation can reduce the complexity of the terminal device remotely accessing the campus via the PLMN.

[0242] Figure 6 is a schematic flow chart of a second communication method provided in an embodiment of the present application. In this embodiment, a first terminal device requests to establish a session with the campus through a PLMN. The first terminal device is a terminal device that has already registered with the campus through the PLMN. Method 600 shown in Figure 6 can be applied to the communication system shown in Figure 3 without limitation. As shown in Figure 6, method 600 may include the following.

[0243] S601: The first terminal device sends a third request to a third control plane network element in the first network.

[0244] Correspondingly, the third control plane network element receives a third request from the first terminal device.

[0245] S601 can also be expressed as: the first terminal device sends a third request to the third control plane network element in the PLMN; accordingly, the third control plane network element receives the third request from the first terminal device.

[0246] The third request can be used to request the establishment of a first session from the first terminal device to the second network, that is, to request the establishment of a first session from the first terminal device to the campus. For example, after the first terminal device registers to the campus, it can send the third request to the third control plane network element in the first network (that is, the PLMN). The third request itself can be used by the first terminal device to request the establishment of the first session to the campus. For example, the third request is a session establishment request message. Alternatively, the third request may also include information (or information element) for the first terminal device to request the establishment of the first session to the campus. The embodiment of the present application does not limit the specific implementation method of the third request.

[0247] Optionally, the third request may include but is not limited to one or more of the following: data network name (DNN), or slice identifier, etc.

[0248] For example, if the third control plane network element is an SMF (which may be denoted as SMF1), then the first terminal device sending the third request to the third control plane network element may be as follows: the first terminal device sends the third request to the AMF (which may be denoted as AMF1) in the PLMN; AMF1 receives the third request from the first terminal device and sends the third request to SMF1. Accordingly, SMF1 receives the third request.

[0249] In one example, AMF1 may send the park identifier to SMF1, such as by including the park identifier in the third request. The park identifier may come from the first terminal device, or may come from AMF1, without limitation. For example, when the first terminal device registers to the park through the PLMN, AMF1 saves the identifier of the park where the first terminal device is registered. Accordingly, SMF1 receives the park identifier.

[0250] In one example, AMF1 can send the campus's subscription information to SMF1. Correspondingly, SMF1 receives the campus's subscription information sent by AMF1. Alternatively, SMF1 can obtain the campus's subscription information based on the campus's identifier, without AMF1 sending the campus's subscription information to SMF1. The campus's subscription information includes the QoS parameters of the campus's subscription in the PLMN. The QoS parameters may include, but are not limited to, maximum bandwidth, scheduling priority, preemption priority, or QoS level.

[0251] Optionally, AMF1 may also send the campus temporary identifier of the first terminal device to SMF1, and carry the campus temporary identifier of the first terminal device in the third request to SMF1. Please refer to the above content for the campus temporary identifier, which will not be repeated here.

[0252] Optionally, AMF1 may send the encrypted SUPI of the first terminal device to SMF1, such as by including the encrypted SUPI in a third request and sending it to SMF1. The encrypted SUPI is described above and will not be further described. It should be understood that the encrypted SUPI of the first terminal device and the campus temporary identifier of the first terminal device may be sent separately or together, such as by including both in the third request and sending it to SMF1, without limitation.

[0253] S602: The third control plane network element sends a fourth request to a fourth control plane network element in the second network according to the third request.

[0254] Correspondingly, the fourth control plane network element receives the fourth request from the third control plane network element.

[0255] S602 may also be expressed as: the third control plane network element sends a fourth request to the fourth control plane network element in the park according to the third request; correspondingly, the fourth control plane network element receives the fourth request from the third control plane network element.

[0256] The fourth request can be used for the third control plane network element to request the establishment of the first session. For example, after receiving the third request, the third control plane network element parses the third request, generates a fourth request, and sends the fourth request to the fourth control plane network element. For example, the third control plane network element can send the fourth request to the fourth control plane network element via a secure connection. For the description of the secure connection, please refer to the aforementioned content and will not be repeated here. Among them, the fourth request itself can be used to request the establishment of the first session. For example, the fourth request is a session establishment request message. Alternatively, the fourth request may also include information (or information element) for establishing the first session. Optionally, the information (or information element) for establishing the first session comes from the first terminal device and is not limited. The embodiment of the present application does not limit the specific implementation method of the fourth request.

[0257] The fourth request includes endpoint information 1 of the first user plane network element in the first network, that is, endpoint information 1 of the first user plane network element in the PLMN. Endpoint information 1 of the first user plane network element is used to establish a tunnel between the PLMN and the campus. Exemplarily, in response to the third request, the third control plane network element may select a first user plane network element in the PLMN to provide services for the first terminal device and establish a connection with the first user plane network element for the first session. For example, the third control plane network element may select the first user plane network element based on one or more of the campus identifier, DNN, or slice to select a user plane network element that can support the session from the first terminal device to the campus. The specific implementation process is not limited. During the process of the first user plane network element establishing the connection for the first session, the first user plane network element may allocate endpoint information for the inter-campus interface (denoted as endpoint information 1 of the first user plane network element) for the first session and send the endpoint information to the third control plane network element. Accordingly, the third control plane network element obtains the endpoint information of the first user plane network element. Optionally, the first user plane network element may further allocate endpoint information of an interface with the first access network network element for the first session (denoted as endpoint information 2 of the first user plane network element), and send the endpoint information to the first access network network element. The endpoint information may include an IP address and a general packet radio service tunneling protocol-user plane (GTP-U) identifier, without limitation.

[0258] Optionally, the fourth request may further include the campus temporary identity and / or encrypted SUPI of the first terminal device.

[0259] In one example, the fourth control plane network element obtains the contract information of the first terminal device in the campus based on the campus temporary identifier or encrypted SUPI of the first terminal device. For example, the fourth control plane network element can obtain the contract information of the first terminal device from the UDM in the campus. Furthermore, the fourth control plane network element determines whether to allow the first terminal device to establish the first session based on the contract information of the first terminal device. For example, the fourth control plane network element can determine whether the DNN requested by the first terminal device to access is included in the contract information of the first terminal device based on the contract information of the first terminal device. If not, the first terminal device is not allowed to establish the first session.

[0260] S603: The fourth control plane network element sends a fourth response to the third control plane network element according to the fourth request.

[0261] Correspondingly, the third control plane network element receives a fourth response from the fourth control plane network element.

[0262] The fourth response includes endpoint information of the second user plane network element in the second network, that is, endpoint information of the second user plane network element in the campus. This second user plane endpoint information is used to establish a tunnel between the PLMN and the campus. The fourth response can be a session establishment response message, without limitation.

[0263] Exemplarily, in response to the fourth request, the fourth control plane network element may select a second user plane network element in the campus to provide services for the first terminal device, and establish a connection with the second user plane network element for the first session. For example, the fourth control plane network element may select a user plane network element from the campus that can support sessions accessed from the PLMN. For example, the fourth control plane network element may select a user plane network element located in a demilitarized zone (DMZ) within the campus to isolate terminal devices accessing from the PLMN and prevent security issues in the campus. During the process of the second user plane network element establishing a connection for the first session, the second user plane network element may allocate endpoint information of the interface with the PLMN for the first session (referred to as the endpoint information of the second user plane network element) and send the endpoint information to the fourth control plane network element. Accordingly, the fourth control plane network element obtains the endpoint information of the second user plane network element. This embodiment of the present application does not limit the specific implementation process of the fourth control plane network element selecting the second user plane network element and the second user plane network element allocating the endpoint information.

[0264] In one possible implementation, the fourth control plane network element may allocate (or determine, or configure) a first QoS parameter for the first session and send the first QoS parameter to the third control plane network element. The first QoS parameter is used to establish the first session. The first QoS parameter may include, but is not limited to, one or more of the following: maximum bandwidth, scheduling priority, preemption priority, or QoS level. Exemplarily, the fourth control plane network element may determine the first QoS parameter corresponding to the first session based on the subscription information and / or policy control and charging (PCC) information of the first terminal device.

[0265] In one example, the fourth control plane network element can obtain the contract information of the first terminal device in the park, and determine the first QoS parameter based on the contract information. For example, the fourth control plane network element can determine the first QoS parameter based on the QoS parameter signed by the first terminal device in the park. For example, the fourth control plane network element can obtain the contract information of the first terminal device based on the encrypted SUPI of the first terminal device. For another example, the fourth control plane network element can obtain the contract information of the first terminal device based on the park temporary identifier of the first terminal device. For example, the fourth control plane network element determines the real park identifier of the first terminal device based on the park temporary identifier of the first terminal device, and obtains the contract information of the first terminal device based on the real park identifier; or, if the park temporary identifier of the first terminal device is registered in the data management network element of the park, the fourth control plane network element can obtain the contract information of the first terminal device based on the park temporary identifier.

[0266] In another example, the fourth control plane network element may obtain PCC information and determine the first QoS parameter based on the PCC information. For example, the fourth control plane network element may obtain the PCC information from a data management network element in the campus based on the campus temporary identifier or encrypted SUPI of the first terminal device, or may also obtain the PCC information from a PCF in the campus, without limitation. The PCC information may include, but is not limited to, one or more of the following: priority, maximum bandwidth, guaranteed bandwidth, maximum data volume, etc.

[0267] Optionally, the fourth control plane network element may carry the first QoS parameter in a fourth response and send it to the third control plane network element, that is, the fourth response includes the first QoS parameter, which is not limited.

[0268] S604: The third control plane network element sends a third response to the first terminal device.

[0269] Correspondingly, the first terminal device receives a third response from the third control plane network element.

[0270] The third response can be used to indicate the success or failure of the first session establishment. This embodiment of the present application uses the example of the third response indicating the successful establishment of the first session. The third response can be, for example, a session establishment response message, without limitation. Exemplarily, after receiving the fourth response, the third control plane network element can generate a third response and send the third response to the first terminal device. For example, the third control plane network element sends the third response to the first access network element, which then forwards it to the first terminal device. The third response itself can be used to indicate the success or failure of the first session establishment. For example, the third response can be a NACK message, indicating that the first session establishment failed; or an ACK message, indicating that the first session establishment was successful, without limitation. Alternatively, the third response can include information (information element) indicating the success or failure of the first session establishment. This information indicating the success or failure of the first session establishment can be generated by the third control plane network element, or can be received from a fourth control plane network element, for example, included in the fourth response. This embodiment of the present application does not limit the specific implementation of the third response.

[0271] In one possible implementation, the third control plane network element receives the first QoS parameter from the fourth control plane network element and determines, based on the campus's contract information, whether to allow or deny establishment of the first session based on the first QoS parameter. This embodiment of the present application is described using the example of the third control plane network element determining that the first session is allowed to be established based on the first QoS parameter. Through this implementation, the third control plane network element can further verify the QoS parameters configured by the fourth control plane network element to avoid a mismatch between the QoS parameters configured by the fourth control plane network element and the QoS parameters contracted by the campus.

[0272] Exemplarily, the third control plane network element can obtain the contract information of the campus, receive the first QoS parameter from the fourth control plane network element, and determine whether to allow or refuse to establish the first session according to the first QoS parameter based on the contract information of the campus. For example, if the maximum bandwidth in the first QoS parameter exceeds the maximum bandwidth of the campus contract, the third control plane network element refuses to establish the first session according to the first QoS parameter; or, if the maximum bandwidth in the first QoS parameter does not exceed the maximum bandwidth of the campus contract, the third control plane network element allows the first session to be established according to the first QoS parameter. For another example, if the priority in the first QoS parameter is outside the priority range of the campus contract, the third control plane network element refuses to establish the first session according to the first QoS parameter; or, if the priority in the first QoS parameter is within the priority range of the campus contract, the third control plane network element allows the first session to be established according to the first QoS parameter.

[0273] The third control plane network element may send a seventh request to the first access network element. The seventh request is used to request establishment of a first session. The seventh request may include endpoint information of the interface between the first user plane network element and the first access network element (denoted as endpoint information 2 of the first user plane network element). Optionally, the seventh request includes the first QoS parameter. Accordingly, the first access network element receives the seventh request. The seventh request may be, for example, a session establishment request message, without limitation. Further, in response to the seventh request, the first access network element allocates endpoint information of the interface between the first user plane network element and the first user plane network element (denoted as endpoint information of the first access network element), and sends a seventh response to the third control plane network element. The seventh response may include the endpoint information of the first access network element. Accordingly, the third control plane network element receives the seventh response from the first access network element and sends the endpoint information of the first access network element to the first user plane network element. The first user plane network element receives the endpoint information of the first access network element. The seventh response may be, for example, a session establishment response message, without limitation.

[0274] Optionally, the first access network element may further configure air interface resources in response to the seventh request, such as configuring the air interface resources according to the first QoS parameter.

[0275] Optionally, the seventh request may include a third response, that is, the third control plane network element carries the third response in the seventh request and sends it to the first access network network element; or, the third control plane network element may also send the third response and the seventh request to the first access network network element respectively, without restriction.

[0276] After receiving the third response, the first terminal device can transmit data with the campus through the first session.

[0277] The following describes the process shown in FIG6 in detail, taking method 600 applied to the communication system shown in FIG3 as an example. The first network is PLMN 310 in the communication system shown in FIG3 . The second network is campus 320 in the communication system shown in FIG3 . The first terminal device is UE1 in the communication system shown in FIG3 . The third control plane network element is SMF1 in the communication system shown in FIG3 . The fourth control plane network element is SMF2 in the communication system shown in FIG3 . The first access network network element is RAN1 in the communication system shown in FIG3 .

[0278] Please refer to Figure 7, which is another flowchart of the second communication method provided in the embodiment of the present application. It should be understood that Figure 7 is an exemplary interaction diagram of method 600, and the embodiment of the present application is not limited thereto.

[0279] S701: UE1 sends a third request to AMF1. Accordingly, AMF1 receives the third request from UE1. The third request may be used to request establishment of a first session from UE1 to campus 320.

[0280] S702: AMF1 sends a third request to SMF1. Correspondingly, SMF1 receives the third request from AMF1.

[0281] The specific implementation process of the above S701 and S702 can refer to the content of S601 and will not be repeated here.

[0282] S703: SMF1 selects UPF1.

[0283] S704: SMF1 and UPF1 establish a connection for the first session. During the process of establishing the connection between SMF1 and UPF1 for the first session, SMF1 may obtain endpoint information 1 and endpoint information 2 of UPF1. Endpoint information 1 of UPF1 is used to establish a tunnel between UPF1 and campus 320. Endpoint information 2 of UPF1 is used to establish a tunnel between UPF1 and RAN1.

[0284] S705: SMF1 sends a fourth request to SMF2. In response, SMF2 receives the fourth request from SMF1. The fourth request is used by SMF1 to request the establishment of the first session. The fourth request includes the endpoint information of UPF1.

[0285] The specific implementation process of the above S703 and S705 can refer to the content of S602 and will not be repeated here.

[0286] S706: SMF2 selects UPF2.

[0287] S707: SMF2 and UPF2 establish a connection for the first session. During the process of SMF2 and UPF2 establishing a connection for the first session, SMF2 may obtain endpoint information of UPF2.

[0288] S708: SMF2 allocates a first QoS parameter for the first session. The first QoS parameter can be used to establish the first session.

[0289] S709: SMF2 sends a fourth response and the first QoS parameter to SMF1. In response, SMF1 receives the fourth response and the first QoS parameter from SMF2. The fourth response includes the endpoint information of UPF2. At this point, the tunnel between UPF1 and UPF2 is established.

[0290] The specific implementation process of the above S706 and S709 can refer to the content of S603 and will not be repeated here.

[0291] S710: SMF1 determines that the first session can be established based on the first QoS parameters. S710 is an optional step, indicated by a dashed line in Figure 7 . For example, SMF1 can determine that the first session can be established based on the first QoS parameters based on the campus's contract information and / or the PCC. The specific implementation process can be found in S604 and is not further described here.

[0292] S711: SMF1 sends a seventh request to RAN1. In response, RAN1 receives the seventh request from SMF1. The seventh request includes endpoint information 2 of UPF1 and a third response. The third response indicates that the first session was successfully established. Optionally, the seventh request also includes a first QoS parameter, which is not shown in Figure 7.

[0293] S712: RAN1 sends a seventh response to SMF1. Accordingly, SMF1 receives the seventh response from RAN1. The seventh response includes RAN1's ​​endpoint information. For example, in response to the seventh request, RAN1 allocates endpoint information for the interface with UPF1 and sends the endpoint information to SMF1 in the seventh response.

[0294] Optionally, RAN1 may configure air interface resources for the first session, such as configuring air interface resources according to the first QoS parameter, which is not shown in FIG7 .

[0295] S713: SMF1 sends RAN1's ​​endpoint information to UPF1. Accordingly, UPF1 receives RAN1's ​​endpoint information from SMF1. Thus, the tunnel between RAN1 and UPF1 is established.

[0296] S714: RAN1 sends a third response to UE1. Correspondingly, UE1 receives the third response from RAN1.

[0297] For the specific implementation process of the above S711 to S714, please refer to the content of S604 and will not be repeated here.

[0298] It is understood that the execution order of the steps in Figure 7 is an example and is not limited to this. For example, SMF2 may first select UPF2 and then assign the first QoS parameters to the first session; or the first QoS parameters may first be assigned to the first session and then AMF1 may select UPF2.

[0299] It should be noted that method 400 and method 600 can be used separately or in combination without limitation. For example, after S404, that is, after the first terminal device accesses the second network element through the first network, method 600 can also be executed.

[0300] It is worth noting that if the third control plane network element is a combined network element of AMF and SMF, that is, the third control plane network element has the functions of AMF and SMF, then the first control plane network element in method 400 can be replaced by the third control plane network element. Similarly, if the first control plane network element is a combined network element of AMF and SMF, that is, the first control plane network element has the functions of AMF and SMF, then the third control plane network element in method 600 can be replaced by the first control plane network element. If the fourth control plane network element is a combined network element of AMF and SMF, that is, the fourth control plane network element has the functions of AMF and SMF, then the second control plane network element in method 400 can be replaced by the fourth control plane network element. If the second control plane network element is a combined network element of AMF and SMF, that is, the second control plane network element has the functions of AMF and SMF, then the fourth control plane network element in method 600 can be replaced by the second control plane network element.

[0301] Through the above-described method 600, a first session can be established between a first terminal device and a second network via the first network, with simple implementation. When the first network is a PLMN and the second network is a campus, method 600 can enable the terminal device to remotely access campus services via the PLMN, without requiring the terminal device and the campus to support non-3GPP access technologies. This simple implementation can reduce the complexity of remotely accessing the campus via the PLMN.

[0302] The method provided in the embodiment of the present application is introduced in conjunction with communication scenario 1 above. Next, the method provided in the embodiment of the present application is introduced in conjunction with communication scenario 2.

[0303] Figure 8 is a schematic flow chart of a third communication method provided in an embodiment of the present application. In this embodiment, a second terminal device, which is already registered with the campus, requests to establish a session with the PLMN through the campus. Method 800 shown in Figure 8 can be applied to the communication system shown in Figure 3 without limitation. As shown in Figure 8, method 800 may include the following.

[0304] S801: The second terminal device sends a sixth request to the fourth control plane network element.

[0305] Correspondingly, the fourth control plane network element receives a sixth request from the second terminal device.

[0306] The sixth request can be used to request the establishment of a second session from the second terminal device to the first network, that is, to request the establishment of a second session from the second terminal device to the PLMN. The second terminal device is a terminal device that has been registered with the second network, that is, a terminal device registered with the campus. Among them, the sixth request itself can be used by the second terminal device to request the establishment of a second session to the PLMN. For example, the sixth request is a session establishment request message. Alternatively, the sixth request may also include information (or information element) for the second terminal device to request the establishment of a second session to the PLMN. The embodiment of the present application does not limit the specific implementation method of the sixth request.

[0307] Optionally, the sixth request may also include, but is not limited to, one or more of the following: DNN, slice identifier, or PLMN service indication information, etc. It should be understood that the DNN included in the sixth request is the DNN requested by the second terminal device. The slice indicated by the slice identifier included in the sixth request is the slice requested by the second terminal device. The PLMN service indication information can be used to indicate that the second session is used for PLMN service. Exemplarily, if the fourth control plane network element is SMF (which can be recorded as SMF2), then the second terminal device sending the sixth request to the fourth control plane network element can be: the second terminal device sends the sixth request to the AMF (which can be recorded as AMF2) in the park; AMF2 receives the sixth request from the second terminal device and sends the sixth request to SMF2. Accordingly, SMF2 receives the sixth request.

[0308] Optionally, the sixth request may also include a second identifier, which may be used to indicate the fourth QoS parameter requested by the second terminal device. In other words, the fourth QoS parameter may be understood as the second terminal device's expectation to establish a second session based on the fourth QoS parameter. The fourth QoS parameter may include, but is not limited to, one or more of the following: maximum bandwidth, scheduling priority, preemption priority, or QoS level, etc. Exemplarily, the second identifier may be an identifier of the QoS profile signed by the second terminal device (i.e., the QoS profile signed by the second terminal device in the campus). The QoS profile signed by the second terminal device includes the fourth QoS parameter.

[0309] S802: The fourth control plane network element sends a fifth request to the third control plane network element in the first network.

[0310] Correspondingly, the third control plane network element receives the fifth request from the fourth control plane network element.

[0311] S802 may also be expressed as: the fourth control plane network element sends a fifth request to the third control plane network element in the PLMN; correspondingly, the third control plane network element receives the fifth request from the fourth control plane network element.

[0312] The fifth request may be used by the fourth control plane network element to request the establishment of a second session. For example, after receiving the sixth request, the fourth control plane network element parses the sixth request, generates a fifth request, and sends the sixth request to the third control plane network element. For example, the fourth control plane network element may send the sixth request to the third control plane network element via a secure connection. For a description of the secure connection, please refer to the aforementioned content and will not be repeated here. The sixth request itself may be used to request the establishment of the second session. For example, the sixth request is a session establishment request message. Alternatively, the sixth request may include information (or information element) for establishing the second session. Optionally, the information (or information element) for establishing the second session comes from the second terminal device, without limitation. This embodiment of the present application does not limit the specific implementation of the sixth request. Optionally, the fifth request may include an identifier of the second network, that is, an identifier of the campus. Optionally, the fifth request may also include a DNN and / or a slice identifier. For example, the third control plane network element determines to include the DNN and / or slice identifier in the fifth request based on one or more of the second terminal device's subscription information, the DNN requested by the second terminal device, or the slice identifier requested by the second terminal device.

[0313] Optionally, the fifth request may include endpoint information 1 of the second user plane network element in the second network, that is, endpoint information 1 of the second user plane network element in the campus. The endpoint information 1 of the second user plane network element is used to establish a tunnel between the PLMN and the campus. Exemplarily, in response to the sixth request, the fourth control plane network element may select the second user plane network element in the campus to provide services for the second terminal device, and establish a connection with the second user plane network element for the second session. The specific implementation process of the fourth control plane network element selecting the second user plane network element can refer to the relevant content of S603 and will not be repeated here. In this embodiment, the second user plane network element can also allocate endpoint information of the interface between the second access network network element for the second session (recorded as endpoint information 2 of the second user plane network element), and send the endpoint information 2 to the second access network network element. The second terminal device accesses through the second access network network element.

[0314] Optionally, the fifth request may include a first identifier. The first identifier may be used to indicate a third QoS parameter for the second session (or determine, or configure). The third QoS parameter may include, but is not limited to, one or more of the following: maximum bandwidth, scheduling priority, preemption priority, or QoS level, etc. Exemplarily, the first identifier may be an identifier of a QoS profile contracted by the campus (i.e., a QoS profile contracted by the campus in the PLMN). The QoS profile contracted by the campus includes the third QoS parameter.

[0315] In one example, the fourth control plane network element may determine the first identifier based on the subscription information and / or PCC information of the second terminal device. For example, the fourth control plane network element may obtain the subscription information of the second terminal device, where the subscription information of the second terminal device includes at least one identifier, and determine the first identifier based on the at least one identifier. Each of the at least one identifier may be used to indicate a set of QoS parameters. For example, one of the at least one identifier has a mapping relationship with the first identifier, and the fourth control plane network element determines the first identifier based on the mapping relationship, or one of the at least one identifier is the first identifier. Optionally, the fourth control plane network element may further consider the second identifier when determining the first identifier. For example, when the at least one identifier includes the second identifier, the fourth control plane network element determines the first identifier based on the second identifier. For another example, when the sixth request includes the second identifier, the fourth control plane network element determines the first identifier based on the second identifier. The specific implementation process of the fourth control plane obtaining the subscription information of the second terminal device can refer to the relevant content of S603 and will not be repeated here.

[0316] In one possible implementation, the fourth control plane network element may determine whether to allow or deny the second terminal device access to the PLMN via the campus network. In one example, the fourth control plane network element may obtain sixth information, which may be used to indicate whether to allow or deny the second terminal device to communicate with the PLMN via the campus network, and determine whether to allow or deny the second terminal device access to the PLMN via the campus network based on the sixth information. In other words, the fourth control plane network element may obtain the sixth information and, based on the sixth information, determine whether to send a fifth request to the third control plane network element. For example, if the sixth information indicates that the second terminal device is denied access to the PLMN via the campus network, the fourth control plane network element denies the second terminal device access to the PLMN via the campus network. In other words, there is no need to send the fifth request to the third control plane network element. Alternatively, if the sixth information indicates that the second terminal device is denied access to the PLMN via the campus network, the fourth control plane network element allows the second terminal device access to the PLMN via the campus network, in other words, determines to send the fifth request to the third control plane network element. The sixth information may be predefined, preconfigured, preagreed, or included in the second terminal device's subscription information, without limitation. For example, the fourth control plane network element obtains the subscription information of the second terminal device, and obtains the sixth information based on the subscription information of the second terminal device.

[0317] S803: The third control plane network element sends a fifth response to the fourth control plane network element.

[0318] Correspondingly, the fourth control plane network element receives a fifth response from the third control plane network element.

[0319] The fifth response includes the second QoS parameter and / or the third identifier. The third identifier is used to indicate the second QoS parameter. The second QoS parameter is the QoS parameter used when establishing the second session. In other words, the fourth control plane network element establishes the second session based on the second QoS parameter. It should be understood that when the fifth response includes the third identifier but does not include the second QoS parameter, the fourth control plane network element can determine the second QoS parameter based on the third identifier. Optionally, the third identifier can be the identifier of the QoS profile subscribed by the campus (i.e., the QoS profile subscribed by the campus in the PLMN). The second QoS parameter is included in the QoS profile subscribed by the campus.

[0320] In one possible implementation, after receiving the fifth request, the third control plane network element may determine the third identifier (or the second QoS parameter) based on the first identifier and / or the identifier of the park. Optionally, the third control plane network element determines the second QoS parameter based on the third identifier. The third identifier may be the same as or different from the first identifier. When the third identifier is different from the first identifier, the second QoS parameter level indicated by the third identifier may be lower than the third QoS parameter indicated by the first identifier. For example, the third identifier is included in the subscription information of the park, and the third control plane network element may determine the third identifier in the subscription information of the park. For example, the fifth request includes the identifier of the park, and the third control plane network element may obtain the subscription information of the park based on the identifier of the park. The subscription information of the park may include at least one identifier, and each of the at least one identifier may be used to indicate the QoS parameters of the park subscribed to the PLMN.

[0321] Optionally, the fifth response may also include endpoint information of the first user plane network element in the first network. For the specific implementation process, reference may be made to the relevant content of S602 and will not be repeated here.

[0322] In one possible implementation, the third control plane network element may send fifth information to the first policy control network element in the first network, that is, send the fifth information to the first policy control plane network element in the PLMN. The fifth information includes the identifier of the second network and the first identifier (or the third identifier). The fifth information is used by the first policy control network element to determine PCC information for the second session. Accordingly, the first policy control network element receives the fifth information, determines PCC information for the second session based on the fifth information, and sends the PCC information to the third control plane network element. The third control plane network element determines the second QoS parameter based on the PCC information.

[0323] S804: The fourth control plane network element sends a sixth response to the second terminal device.

[0324] Correspondingly, the second terminal device receives a sixth response from the fourth control plane network element.

[0325] The sixth response can be used to indicate the success or failure of the second session establishment. The embodiment of the present application is described using the sixth response indicating the successful establishment of the second session as an example. The sixth response can be, for example, a session establishment response message, without limitation. Exemplarily, after receiving the fifth response, the fourth control plane network element can generate a sixth response and send the sixth response to the second terminal device. For example, the fourth control plane network element sends the sixth response to the second access network network element, which then forwards it to the second terminal device. The sixth response itself can be used to indicate the success or failure of the second session establishment, or the sixth response can also include information (information element) indicating the success or failure of the second session establishment. For details, please refer to the content of the third response and will not be repeated here. The information indicating the success or failure of the second session establishment can be generated by the fourth control plane network element; or it can also come from the third control plane network element, for example, the fifth response includes this information. The embodiment of the present application does not limit the specific implementation of the sixth response.

[0326] The fourth control plane network element may send an eighth request to the second access network network element. The eighth request is used to request establishment of a second session. The eighth request may include endpoint information of the interface between the second user plane network element and the second access network element (denoted as endpoint information 2 of the second user plane network element). Optionally, the eighth request includes a second QoS parameter. Accordingly, the second access network network element receives the eighth request. The eighth request may be, for example, a session establishment request message, without limitation. In response to the eighth request, the second access network network element allocates endpoint information of the interface between the second user plane network element and the second user plane network element (denoted as endpoint information of the second access network element), and sends an eighth response to the fourth control plane network element. The eighth response may include the endpoint information of the second access network element. Accordingly, the fourth control plane network element receives the eighth response from the second access network element and sends the endpoint information of the second access network element to the second user plane network element. The second user plane network element receives the endpoint information of the second access network element. The eighth response may be, for example, a session establishment response message, without limitation.

[0327] Optionally, the second access network element may further configure air interface resources in response to the eighth request, such as configuring the air interface resources according to the second QoS parameters.

[0328] Optionally, the eighth request may include a sixth response, that is, the fourth control plane network element carries the sixth response in the eighth request and sends it to the second access network network element; or, the fourth control plane network element may also send the sixth response and the eighth request to the second access network network element respectively, without restriction.

[0329] After receiving the sixth response, the second terminal device can transmit data with the PLMN through the second session.

[0330] The following describes the process shown in FIG8 in detail, taking method 800 applied to the communication system shown in FIG3 as an example. The first network is PLMN 310 in the communication system shown in FIG3 . The second network is campus 320 in the communication system shown in FIG3 . The second terminal device is UE2 in the communication system shown in FIG3 . The third control plane network element is SMF1 in the communication system shown in FIG3 . The fourth control plane network element is SMF2 in the communication system shown in FIG3 . The second access network network element is RAN2 in the communication system shown in FIG3 .

[0331] Please refer to Figure 9, which is another flowchart of the second communication method provided in the embodiment of the present application. It should be understood that Figure 9 is an exemplary interaction diagram of method 800, and the embodiment of the present application is not limited thereto.

[0332] S900: UE2 registers with the campus 320. The embodiment of the present application does not limit the specific implementation process of UE2 registering with the campus 320.

[0333] S901: UE2 sends a sixth request to AMF2. Accordingly, AMF2 receives the sixth request from UE2. The sixth request may be used to establish a second session from UE2 to PLMN310. Optionally, the sixth request may include a fourth QoS parameter.

[0334] S902: AMF2 sends a sixth request to SMF2. Correspondingly, SMF2 receives the sixth request from AMF2.

[0335] The specific implementation process of the above S901 and S902 can refer to the content of S801 and will not be repeated here.

[0336] S903: SMF2 selects UPF2.

[0337] S904: SMF2 and UPF2 establish a connection for the second session. During the process of establishing the connection for the second session, SMF2 may obtain endpoint information 1 and endpoint information 2 of UPF2. Endpoint information 1 of UPF2 is used to establish a tunnel between UPF2 and PLMN 310. Endpoint information 2 of UPF2 is used to establish a tunnel between UPF2 and RAN2.

[0338] S905: SMF2 obtains a first identifier, where the first identifier is used to indicate a third QoS parameter allocated by SMF2 to the second session.

[0339] S906: SMF2 sends a fifth request to SMF1. Correspondingly, SMF1 receives the fifth request from SMF2. The fifth request is used by SMF2 to request the establishment of a second session. The fifth request includes the endpoint information 1 of UPF2 and the first identifier.

[0340] The specific implementation process of the above S903 and S906 can refer to the content of S802 and will not be repeated here.

[0341] S907: SMF1 selects UPF1.

[0342] S908: SMF1 and UPF1 establish a connection for the second session. During the process of SMF1 and UPF1 establishing a connection for the second session, SMF1 may obtain endpoint information of UPF1.

[0343] S909: SMF1 determines a second QoS parameter according to the first identifier. The second QoS parameter may be used to establish a second session.

[0344] S910: SMF1 sends a fifth response to SMF2. In response, SMF2 receives the fifth response from SMF1. The fifth response includes the second QoS parameter and the endpoint information of UPF1. At this point, the tunnel between UPF1 and UPF2 is established.

[0345] The specific implementation process of the above S907 and S910 can refer to the content of S803 and will not be repeated here.

[0346] S911: SMF2 establishes a second session according to the second QoS parameters.

[0347] S912: SMF2 sends an eighth request to RAN2. In response, RAN2 receives the eighth request from SMF2. The eighth request includes endpoint information 2 of UPF2 and a sixth response. The sixth response indicates that the second session was successfully established. Optionally, the eighth request also includes a second QoS parameter, which is not shown in Figure 9.

[0348] S913: RAN2 sends an eighth response to SMF2. In response, SMF2 receives the eighth response from RAN2. The eighth response includes RAN2's endpoint information. For example, in response to the eighth request, RAN2 allocates endpoint information for the interface with UPF2 and sends the endpoint information to SMF2 in the eighth response.

[0349] Optionally, RAN2 may configure air interface resources for the second session, such as configuring air interface resources according to second QoS parameters, which is not shown in FIG9 .

[0350] S914: SMF2 sends RAN2's endpoint information to UPF2. Accordingly, UPF2 receives RAN2's endpoint information from SMF2. At this point, the tunnel between RAN2 and UPF2 is established.

[0351] S915: RAN2 sends a sixth response to UE2. Correspondingly, UE2 receives the sixth response from RAN2.

[0352] For the specific implementation process of the above S911 to S915, please refer to the content of S804 and will not be repeated here.

[0353] Through the above-described method 800, a second session can be established between the second terminal device and the first network via the second network, which is simple to implement. When the first network is a PLMN and the second network is a campus, the method 800 can enable terminal devices in the campus to access PLMN services through the campus, without requiring the terminal device and the PLMN to support non-3GPP access technologies. This simple implementation can reduce the complexity of terminal devices accessing the PLMN through the campus.

[0354] In this application, the methods provided in the embodiments of this application are described from the perspective of the interaction between multiple communication devices, such as a first control plane network element, a second control plane network element, a third control plane network element, a fourth control plane network element, and a first terminal device. To implement the methods provided in each embodiment of this application, each of the above-mentioned communication devices may include a hardware structure and / or a software module, and implement the above-mentioned functions in the form of a hardware structure, a software module, or a hardware structure plus a software module.

[0355] The following describes the communication device used to implement the above method in the embodiment of the present application with reference to the accompanying drawings. Therefore, the above contents can be used in subsequent embodiments, and repeated contents will not be repeated.

[0356] Figure 10 shows a schematic structural diagram of a communication device 1000. The communication device 1000 can implement the functions or steps implemented by the first control plane network element, the second control plane network element, the third control plane network element, the fourth control plane network element, or the first terminal device in the above-mentioned various method embodiments.

[0357] In one possible implementation, the communication device 1000 may include a processing module 1001 and a transceiver module 1002. The processing module 1001 may be configured to execute the steps of the first control plane network element, the second control plane network element, the third control plane network element, the fourth control plane network element, or the first terminal device in any of the above method embodiments; and the transceiver module 1002 may be configured to receive or send relevant data, information, or messages.

[0358] In another possible implementation, the communication device 1000 may include a transceiver module 1002, which can be used to execute the steps or methods of the first control plane network element, the second control plane network element, the third control plane network element, the fourth control plane network element, or the first terminal device in any of the above method embodiments.

[0359] In some possible implementations, the communication device 1000 can implement the behaviors and functions of the first control plane network element in the above-mentioned method embodiments. For example, the communication device 1000 can be a first control plane network element, or a component (such as a chip or circuit) used in the first control plane network element. The processing module 1001 is used to perform all operations except the transceiver operations performed by the first control plane network element in the above-mentioned various embodiments. The transceiver module 1002 can be used to perform all receiving or sending operations performed by the first control plane network element in the above-mentioned various embodiments.

[0360] Exemplarily, the transceiver module 1002 is used to receive a first request from a first terminal device, where the first request is used by the first terminal device to request access to a second network; based on the first request, send a second request to a second control plane network element in the second network, where the second request is used by the first control plane network element to request access of the first terminal device to the second network; receive a second response from the second control plane network element, where the second response is used to indicate that the first terminal device is allowed to access the second network through the first network; and send a first response to the first terminal device, where the first response is used to indicate that the first terminal device has successfully accessed the second network.

[0361] In one possible implementation, the first request includes an identifier of the second network. Before sending the second request to the second control plane network element in the second network according to the first request, the processing module 1001 is also used to obtain first information according to the identifier of the second network, the first information being used to indicate that at least one terminal device is allowed to communicate with the second network through the first network, and the first terminal device belongs to at least one terminal device; and, based on the first information, determine to send the second request to the second control plane network element.

[0362] In one possible implementation, the first request includes an identifier of the second network. Before sending the second request to the second control plane network element in the second network based on the first request, the processing module 1001 is also used to obtain range information of the second network based on the identifier of the second network, where the range information is used to indicate a range in which at least one terminal device is allowed to access the second network, and the first terminal device belongs to at least one terminal device; based on the range information and the location information of the first terminal device, determine to send the second request to the second control plane network element.

[0363] In one possible implementation, the processing module 1001 is also used to limit messages transmitted between the first terminal device and the second network through the first network based on restriction information before receiving a second response from the second control plane network element, wherein the restriction information includes one or more of the following: the type of messages allowed to be transmitted between the first terminal device and the second network through the first network, the number of messages allowed to be transmitted between the first terminal device and the second network through the first network, or the duration allowed for the first terminal device and the second network to communicate through the first network; after receiving the second response, cancel the restriction on messages transmitted between the first terminal device and the second network through the first network.

[0364] In one possible implementation, before sending the second request to the second control plane network element in the second network according to the first request, the processing module 1001 is further used to establish a secure connection with the second control plane network element, and the secure connection is used for message transmission between the first control plane network element and the second control plane network element.

[0365] In one possible implementation, the processing module 1001 is also used to obtain a first number, where the first number is the total number of terminal devices that access the second network through the first network; based on the first number and the second information, determine whether the first terminal device is allowed to access the second network through the first network, and the second information includes the maximum number of terminal devices allowed to access the second network through the first network.

[0366] In a possible implementation, the processing module 1001 is further configured to add 1 to the first number.

[0367] In one possible implementation, the transceiver module 1002 is also used to receive a first key from a second control plane network element, and the first key is used for secure transmission between the first terminal device and the first network; the processing module 1001 is also used to determine a second key based on the first key, and the second key is used for secure transmission between the first terminal device and a first access network element of the first network, and the first terminal device accesses through the first access network element; the transceiver module 1002 is also used to send the second key to the first access network element.

[0368] In one possible implementation, the processing module 1001 is further used to determine a third key based on the first key, and the third key is used to securely protect the non-access layer NAS message transmitted between the first control plane network element and the first terminal device; the transceiver module 1002 is further used to send third information to the first terminal device, and the third information is used to instruct the first terminal device to start security protection for the NAS message transmitted between the first control plane network element and the first terminal device.

[0369] In one possible implementation, the processing module 1001 is also used to obtain fourth information, and the fourth information includes one or more of the following: the number of terminal devices accessing the second network through the first network, the number of messages transmitted by the first terminal device between the first network and the second network, or the traffic consumed by the messages transmitted by the first terminal device between the first network and the second network; the transceiver module 1002 is also used to send the fourth information to the billing system.

[0370] In one possible implementation, after the first terminal device accesses the second network through the first network, the transceiver module 1002 is further used to receive a third request from the first terminal device, where the third request is used to request establishment of a first session from the first terminal device to the second network; based on the third request, a fourth request is sent to a fourth control plane network element in the second network, where the fourth request is used to request establishment of the first session, and the fourth request includes endpoint information of the first user plane network element in the first network; a fourth response is received from the fourth control plane network element, where the fourth response includes endpoint information of the second user plane network element in the second network; and a third response is sent to the first terminal device, where the third response is used to indicate that the first session is successfully established.

[0371] In one possible implementation, before sending the third response to the first terminal device, the processing module 1001 is also used to obtain the contract information of the second network, the contract information including one or more of the following: maximum bandwidth, scheduling priority, preemption priority, or quality of service QoS level; receiving the first QoS parameter corresponding to the first session from the fourth control plane network element; and determining, based on the contract information, whether to allow the establishment of the first session based on the first QoS parameter.

[0372] In a possible implementation, the processing module 1001 is further configured to select a second user plane network element according to the third request; and obtain endpoint information of the second user plane network element.

[0373] In some possible implementations, the communication device 1000 can implement the behaviors and functions of the second control plane network element in the above-mentioned method embodiments. For example, the communication device 1000 can be a second control plane network element, or a component (such as a chip or circuit) used in the second control plane network element. The processing module 1001 is used to perform all operations except the transceiver operations performed by the second control plane network element in the above-mentioned various embodiments. The transceiver module 1002 can be used to perform all receiving or sending operations performed by the second control plane network element in the above-mentioned various embodiments.

[0374] Exemplarily, the transceiver module 1002 is used to receive a second request from a first control plane network element in the first network, where the second request is used by the first control plane network element to request that the first terminal device be connected to the second network; and according to the second request, send a second response to the first control plane network element, where the second response is used to indicate that the first terminal device is allowed to access the second network through the first network.

[0375] In one possible implementation, before sending a second response to the first control plane network element according to the second request, the processing module 1001 is also used to obtain a second number, where the second number is the total number of terminal devices that access the second network through the first network; based on the second number and the second information, it is determined that the first terminal device is allowed to access the second network through the first network, and the second information includes the maximum number of terminal devices allowed to access the second network through the first network.

[0376] In a possible implementation, the processing module 1001 is further configured to add 1 to the second number.

[0377] In a possible implementation, before sending the second response to the first control plane network element according to the second request, the processing module 1001 is further configured to authenticate and authorize the first terminal device.

[0378] In a possible implementation, the processing module 1001 is further configured to establish a secure connection with the first control plane network element, where the secure connection is used for message transmission between the first control plane network element and the second control plane network element.

[0379] In one possible implementation, the processing module 1001 is further used to allocate a first key to the first control plane network element, and the first key is used for secure transmission between the first terminal device and the first network; the transceiver module 1002 is further used to send the first key to the first control plane network element.

[0380] In one possible implementation, after the first terminal device accesses the second network through the first network, the transceiver module 1002 is further used to receive a fourth request from the first control plane network element, where the fourth request is used to request establishment of a first session from the first terminal device to the second network, and the fourth request includes endpoint information of the first user plane network element in the first network; based on the fourth request, a fourth response is sent to the first control plane network element, and the fourth response includes endpoint information of the second user plane network element in the second network.

[0381] In one possible implementation, the processing module 1001 is also used to obtain the contract information of the first terminal device, the contract information including one or more of the following: maximum bandwidth, scheduling priority, preemption priority, or quality of service QoS level; determine the first QoS parameter corresponding to the first session based on the contract information; the transceiver module 1002 is also used to send the first QoS parameter to the first control plane network element.

[0382] In a possible implementation, the processing module 1001 is further configured to select a second user plane network element according to the fourth request; and obtain endpoint information of the second user plane network element.

[0383] In some possible implementations, the communication device 1000 can implement the behaviors and functions of the first terminal device in the above-described method embodiments. For example, the communication device 1000 can be the first terminal device, or it can be a component (e.g., a chip or circuit) used in the first terminal device. The processing module 1001 is configured to execute all operations performed by the first terminal device in the above-described various embodiments, except for the transceiver operations. The transceiver module 1002 can be configured to execute all receive or transmit operations performed by the first terminal device in the above-described various embodiments.

[0384] Exemplarily, the transceiver module 1002 is used to send a first request to a first control plane network element in the first network, where the first request includes an identifier of the second network, and the first request is used by the first terminal device to request access to the second network; and receive a first response from the first control plane network element, where the first response is used to indicate that the first terminal device has successfully accessed the second network.

[0385] In one possible implementation, the processing module 1001 is further used to generate a fourth key, which is a key generated after the first terminal device successfully authenticates the second network; determine the fifth key and / or determine the sixth key based on the fourth key, wherein the fifth key is used for secure transmission between the first terminal device and the first access network element of the first network, and the first terminal device accesses through the first access network element, and the sixth key is used to securely protect the non-access layer NAS message transmitted between the first control plane network element and the first terminal device.

[0386] In one possible implementation, the transceiver module 1002 is further used to receive third information from the first control plane network element, where the third information is used to instruct the first terminal device to initiate security protection of NAS messages transmitted between the first control plane network element and the first terminal device; the processing module 1001 is further used to respond to the third information and start using the sixth key to perform security protection on NAS messages between the first control plane network element and the first terminal device.

[0387] In one possible implementation, the transceiver module 1002 is also used to send a third request to the first control plane network element after receiving a first response from the first control plane network element, where the third request is used to request establishment of a first session from the first terminal device to the second network; and receive a fourth response from the first control plane network element, where the third response is used to indicate that the first session is successfully established.

[0388] In some possible implementations, the communication device 1000 can implement the behaviors and functions of the third control plane network element in the above-mentioned method embodiments. For example, the communication device 1000 can be a third control plane network element, or a component (e.g., a chip or circuit) used in the third control plane network element. The processing module 1001 is configured to execute all operations except the transceiver operations performed by the third control plane network element in the above-mentioned various embodiments. The transceiver module 1002 can be configured to execute all receive or transmit operations performed by the third control plane network element in the above-mentioned various embodiments.

[0389] Exemplarily, the transceiver module 1002 is used to receive a fifth request from a fourth control plane network element in the second network, where the fifth request is used to request establishment of a second session from a second terminal device to the first network, where the second terminal device is a terminal device that has been registered with the second network, and the fifth request includes a first identifier, where the first identifier is used to indicate a third quality of service (QoS) parameter assigned by the second network to the second session. The processing module 1001 is used to determine a second QoS parameter based on the first identifier, where the second QoS parameter is a QoS parameter used when establishing the second session. The transceiver module 1002 is also used to send a fifth response to the fourth control plane network element, where the fifth response includes the second QoS parameter.

[0390] In one possible implementation, the fifth request also includes an identifier of the second network. When determining the second QoS parameter corresponding to the second session based on the first identifier, the processing module 1001 is specifically used to: obtain a third QoS parameter based on the identifier of the second network and the first identifier; and determine the second QoS parameter based on the third QoS parameter.

[0391] In one possible implementation, when determining the second QoS parameter corresponding to the second session based on the first identifier, the sending module 1002 is specifically used to: send fifth information to the first policy control network element in the first network, the fifth information including the identifier of the second network and the first identifier, and the fifth information is used by the first policy control network element to determine policy control and billing information for the second session; receive policy control and billing information from the first policy control network element; the processing module 1001 is specifically used to: determine the second QoS parameter based on the policy control and billing information.

[0392] In one possible implementation, the QoS parameter includes one or more of the following: maximum bandwidth, scheduling priority, preemption priority, or QoS level.

[0393] In a possible implementation manner, the first identifier is an identifier of a QoS profile subscribed by the second network in the first network, and the QoS profile includes a third QoS parameter.

[0394] In some possible implementations, the communication device 1000 can implement the behaviors and functions of the fourth control plane network element in the above-mentioned method embodiments. For example, the communication device 1000 can be a fourth control plane network element, or a component (e.g., a chip or circuit) used in the fourth control plane network element. The processing module 1001 is configured to execute all operations except the transceiver operations performed by the fourth control plane network element in the above-mentioned various embodiments. The transceiver module 1002 can be configured to execute all receive or transmit operations performed by the fourth control plane network element in the above-mentioned various embodiments.

[0395] Exemplarily, the transceiver module 1002 is used to receive a sixth request from the second terminal device, the sixth request is used to request establishment of a second session from the second terminal device to the first network, and the second terminal device is a terminal device that has been registered with the second network; according to the sixth request, a fifth request is sent to the third control plane network element in the first network, the fifth request is used to request the fourth control plane network element to establish a second session, the fifth request includes a first identifier, and the first identifier is used to indicate the third quality of service QoS parameter allocated by the second network to the second session; a fifth response is received from the third control plane network element, the fifth response includes a second QoS parameter, and the second QoS parameter is the QoS parameter used when establishing the second session; a sixth response is sent to the second terminal device, and the sixth response is used to indicate that the second session is successfully established.

[0396] In one possible implementation, before sending the fifth request to the third control plane network element in the first network based on the sixth request, the processing module 1001 is also used to obtain sixth information, where the sixth information is used to indicate that the second terminal device is allowed to communicate with the first network through the second network; and based on the sixth information, determine to send the fifth request to the third control plane network element.

[0397] In one possible implementation, the sixth request includes a second identifier, which is used to indicate the fourth QoS parameter requested by the second terminal device; before sending the fifth request to the third control plane network element in the first network, the processing module 1001 is specifically used to determine the first identifier based on the second identifier.

[0398] In one possible implementation, before sending the fifth request to the third control plane network element in the first network, the processing module 1001 is specifically used to obtain the contract information of the second terminal device, the contract information includes at least one identifier, and each identifier of the at least one identifier is used to indicate the QoS parameters of the contract of the second terminal device; determine the first identifier from the at least one identifier.

[0399] In one possible implementation, the QoS parameter includes one or more of the following: maximum bandwidth, scheduling priority, preemption priority, or QoS level.

[0400] It should be noted that the above-mentioned units can be independently provided or partially or fully integrated. For example, the transceiver module 1002 can include a sending module and a receiving module.

[0401] A more detailed description of the processing module 1001 and the transceiver module 1002 can be directly obtained by referring to the relevant description of the method embodiment shown in any one of Figures 4 to 8, and will not be repeated here.

[0402] As shown in Figure 11, an embodiment of the present application provides a structural diagram of a communication device 1100. The communication device 1100 may include a processor 1120, which is used to implement or support the communication device 1100 to implement the functions of the first control plane network element, the second control plane network element, the third control plane network element, the fourth control plane network element, or the first terminal device in any method embodiment of the present application. For details, please refer to the detailed description in the aforementioned method embodiment, which will not be repeated here. For example, the processor 1120 is used to read and execute program instructions through a communication interface so that the communication device 1100 implements the corresponding method. The processor 1120 may include one or more processors without limitation.

[0403] Specifically, the communication device 1100 can be a first terminal device or a functional module located in the first terminal device, which can realize the function of the first terminal device in any method embodiment of the present application; or, the communication device 1100 can be a first control plane network element or a functional module located in the first control plane network element, which can realize the function of the first control plane network element in any method embodiment of the present application; or, the communication device 1100 can be a second control plane network element or a functional module located in the second control plane network element, which can realize the function of the second control plane network element in any method embodiment of the present application; or, the communication device 1100 can be a third control plane network element or a functional module located in the third control plane network element, which can realize the function of the third control plane network element in any method embodiment of the present application; or, the communication device 1100 can be a fourth control plane network element or a functional module located in the fourth control plane network element, which can realize the function of the fourth control plane network element in any method embodiment of the present application.

[0404] It should be noted that the above-mentioned functional modules can be implemented by hardware or by a combination of hardware and software without limitation.

[0405] For example, the communication device 1100 may be a chip system, wherein the chip system may be composed of a chip, or may include a chip and other discrete components, without limitation.

[0406] Optionally, communication device 1100 may further include memory 1130 for storing program instructions and / or data. Memory 1130 is coupled to processor 1120. Coupling can be understood as an indirect coupling or communication connection between devices, units, or modules, which can be electrical, mechanical, or other forms, for information exchange between devices, units, or modules. Processor 1120 may operate in conjunction with memory 1130. Memory 1130 may include one or more memories, without limitation.

[0407] Furthermore, the processor 1120 is configured to execute program instructions stored in the memory 1130 so that the communication device 1100 implements a corresponding method.

[0408] One or more memories in the memory 1130 may be included in the processor, or the memory 1130 may exist independently, such as an off-chip memory, and be connected to the processor 1120 via a communication bus (represented by a thick line 1140 in FIG. 11 ). The memory 1130 and the processor 1120 may also be integrated together.

[0409] Optionally, the communication device 1100 further includes a communication interface 1110 (indicated by a dotted line in FIG11 ), which is configured to communicate with other devices via a transmission medium, thereby enabling the device in the communication device 1100 to communicate with the other device. For example, when the communication device is a first control plane network element, the other device may be a second control plane network element, etc. The processor 1120 may use the communication interface 1110 to send and receive data.

[0410] The communication interface 1110 may be a transceiver. In hardware implementation, the transceiver may be used to implement the functions of the transceiver module 1402 . The transceiver is integrated into the communication device 1100 to form the communication interface 1110 .

[0411] It should be noted that the specific connection medium between the communication interface 1110, processor 1120, and memory 1130 is not limited in the embodiments of the present application. In FIG11 , the memory 1130, processor 1120, and communication interface 1110 are connected via a communication bus 1140. The connection methods between other components are merely schematic and not limiting. The communication bus 1140 can be divided into an address bus, a data bus, a control bus, and the like. For ease of illustration, FIG11 shows only one thick line, but this does not mean that there is only one communication bus or only one type of communication bus.

[0412] In the embodiments of the present application, the processor 1120 may be a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field-programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component. The general-purpose processor may be a microprocessor or any conventional processor. The methods disclosed in conjunction with the embodiments of the present application may be executed by hardware in the processor, or by a combination of hardware and software in the processor.

[0413] In the embodiment of the present application, the memory 1130 may be a non-volatile memory, such as a hard disk drive (HDD) or a solid-state drive (SSD), or a volatile memory, such as a random-access memory (RAM). The memory may also be any other medium for carrying or storing program code in the form of instructions or data structures and accessible by a computer; or a circuit or any other device capable of performing a storage function, for storing program instructions and / or data.

[0414] An embodiment of the present application also provides a communication system, which may include one or more of the following: a first terminal device, a first control plane network element, a second control plane network element, a third control plane network element, or a fourth control plane network element.

[0415] Among them, the first control plane network element, the second control plane network element, the third control plane network element, the fourth control plane network element, or the first terminal device can all refer to the description in the aforementioned method embodiments and will not be repeated here.

[0416] In an embodiment of the present application, a computer-readable storage medium is also provided, comprising program instructions, which, when executed on a computer, enables the computer to execute the method or steps of any communication device (for example, a first control plane network element, a second control plane network element, a third control plane network element, a fourth control plane network element, or a first terminal device) in the above-mentioned embodiments.

[0417] A computer program product is also provided in an embodiment of the present application, including program instructions, which, when run on a computer, enable the computer to execute the method or steps of any communication device in the above-mentioned embodiments (for example, the first control plane network element, the second control plane network element, the third control plane network element, the fourth control plane network element, or the first terminal device).

[0418] An embodiment of the present application provides a chip system, which includes a processor for implementing the functions of the first control plane network element, the second control plane network element, the third control plane network element, the fourth control plane network element, or the first terminal device in the aforementioned method (for example, executing the corresponding method or step). The chip system can be composed of a chip, or can include a chip and other discrete devices.

[0419] Optionally, the chip system further includes a memory for storing program instructions so that the above-mentioned processor reads and executes them to implement the corresponding method.

[0420] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0421] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0422] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0423] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0424] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0425] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0426] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0427] The above description is merely a specific embodiment of the present application, but the scope of protection of the embodiments of the present application is not limited thereto. Any person skilled in the art can easily conceive of changes or substitutions within the technical scope disclosed in the embodiments of the present application, and such changes or substitutions should be included in the scope of protection of the embodiments of the present application. Therefore, the scope of protection of the embodiments of the present application should be based on the scope of protection of the claims.

Claims

1. A communication method, applied to a first control plane network element in a first network, characterized in that: include: receiving a first request from a first terminal device, where the first request is used by the first terminal device to request access to the second network; Sending a second request to a second control plane network element in the second network according to the first request, where the second request is used by the first control plane network element to request that the first terminal device be connected to the second network; receiving a second response from the second control plane network element, where the second response is used to indicate that the first terminal device is allowed to access the second network through the first network; A first response is sent to the first terminal device, where the first response is used to indicate that the first terminal device has successfully accessed the second network.

2. The method according to claim 1, characterized in that The first request includes an identifier of the second network, and before sending the second request to a second control plane network element in the second network according to the first request, the method further includes: acquiring, according to an identifier of the second network, first information, where the first information is used to indicate that at least one terminal device is allowed to communicate with the second network through the first network, and the first terminal device belongs to the at least one terminal device; Determine, based on the first information, to send the second request to the second control plane network element.

3. The method according to claim 1 or 2, characterized in that: The first request includes an identifier of the second network, and before sending the second request to a second control plane network element in the second network according to the first request, the method further includes: Acquire, according to the identifier of the second network, range information of the second network, where the range information is used to indicate a range in which at least one terminal device is allowed to access the second network, and the first terminal device belongs to the at least one terminal device; According to the range information and the location information of the first terminal device, determine to send the second request to the second control plane network element.

4. The method according to any one of claims 1 to 3, characterized in that The method further comprises: Before receiving the second response from the second control plane network element, restricting messages transmitted between the first terminal device and the second network through the first network according to restriction information, wherein the restriction information includes one or more of the following: types of messages allowed to be transmitted between the first terminal device and the second network through the first network, the number of messages allowed to be transmitted between the first terminal device and the second network through the first network, or the duration of time allowed for the first terminal device and the second network to communicate through the first network; After receiving the second response, the restriction on messages transmitted between the first terminal device and the second network through the first network is cancelled.

5. The method according to any one of claims 1 to 4, characterized in that Before sending a second request to a second control plane network element in the second network according to the first request, the method further includes: A secure connection is established with the second control plane network element, where the secure connection is used for message transmission between the first control plane network element and the second control plane network element.

6. The method according to any one of claims 1 to 5, characterized in that The method further comprises: Acquire a first quantity, where the first quantity is the total number of terminal devices accessing the second network through the first network; According to the first number and second information, it is determined that the first terminal device is allowed to access the second network through the first network, and the second information includes a maximum number of terminal devices allowed to access the second network through the first network.

7. The method according to claim 6, characterized in that The method further comprises: The first number is increased by 1.

8. The method according to any one of claims 1 to 7, characterized in that: The method further comprises: receiving a first key from the second control plane network element, where the first key is used for secure transmission between the first terminal device and the first network; Determine a second key according to the first key, where the second key is used for secure transmission between the first terminal device and a first access network element of the first network, and the first terminal device accesses through the first access network element; Send the second key to the first access network element.

9. The method according to claim 8, characterized in that The method further comprises: Determine a third key according to the first key, where the third key is used to perform security protection on a non-access layer NAS message transmitted between the first control plane network element and the first terminal device; Sending third information to the first terminal device, wherein the third information is used to instruct the first terminal device to start the first control The NAS messages transmitted between the plane network element and the first terminal device are securely protected.

10. The method according to any one of claims 1 to 9, characterized in that: The method further comprises: Acquire fourth information, where the fourth information includes one or more of the following: the number of terminal devices accessing the second network through the first network, the number of messages transmitted between the first terminal device and the second network through the first network, or the traffic consumed by the first terminal device for transmitting messages between the first network and the second network through the first network; The fourth information is sent to the billing system.

11. The method according to any one of claims 1 to 10, characterized in that After the first terminal device accesses the second network through the first network, the method further includes: receiving a third request from the first terminal device, wherein the third request is used to request to establish a first session from the first terminal device to the second network; Sending a fourth request to a fourth control plane network element in the second network according to the third request, where the fourth request is used to request to establish the first session, and the fourth request includes endpoint information of the first user plane network element in the first network; receiving a fourth response from the fourth control plane network element, the fourth response including endpoint information of a second user plane network element in the second network; A third response is sent to the first terminal device, where the third response is used to indicate that the first session is successfully established.

12. The method according to claim 11, characterized in that Before sending the third response to the first terminal device, the method further includes: Acquire the subscription information of the second network, where the subscription information includes one or more of the following: maximum bandwidth, scheduling priority, preemption priority, or quality of service QoS level; Receiving a first QoS parameter corresponding to the first session from the fourth control plane network element; Determine, based on the subscription information, that establishment of the first session based on the first QoS parameter is allowed.

13. The method according to claim 11 or 12, characterized in that: The method further comprises: Selecting the second user plane network element according to the third request; Obtain endpoint information of the second user plane network element.

14. A communication method, applied to a second control plane network element in a second network, characterized in that: include: receiving a second request from a first control plane network element in the first network, where the second request is used by the first control plane network element to request that the first terminal device be connected to the second network; According to the second request, a second response is sent to the first control plane network element, where the second response is used to indicate that the first terminal device is allowed to access the second network through the first network.

15. The method according to claim 14, characterized in that Before sending a second response to the first control plane network element according to the second request, the method further includes: Acquire a second number, where the second number is the total number of terminal devices accessing the second network through the first network; According to the second number and second information, it is determined that the first terminal device is allowed to access the second network through the first network, and the second information includes a maximum number of terminal devices allowed to access the second network through the first network.

16. The method according to claim 15, characterized in that The method further comprises: The second number is incremented by 1.

17. The method according to any one of claims 14 to 16, characterized in that Before sending a second response to the first control plane network element according to the second request, the method further includes: The first terminal device is authenticated and authorized.

18. The method according to any one of claims 14 to 17, characterized in that The method further comprises: A secure connection is established with the first control plane network element, where the secure connection is used for message transmission between the first control plane network element and the second control plane network element.

19. The method according to any one of claims 14 to 18, characterized in that The method further comprises: Allocating a first key to the first control plane network element, where the first key is used for secure transmission between the first terminal device and the first network; Send the first key to the first control plane network element.

20. The method according to any one of claims 14 to 19, characterized in that After the first terminal device accesses the second network through the first network, the method further includes: receiving a fourth request from the first control plane network element, the fourth request being used to request establishment of a first session from the first terminal device to the second network, the fourth request including endpoint information of a first user plane network element in the first network; According to the fourth request, a fourth response is sent to the first control plane network element, where the fourth response includes endpoint information of a second user plane network element in the second network.

21. The method according to claim 20, characterized in that The method further comprises: Acquire the contract information of the first terminal device, where the contract information includes one or more of the following: maximum bandwidth, scheduling priority, preemption priority, or quality of service QoS level; Determine a first QoS parameter corresponding to the first session according to the subscription information; Send the first QoS parameter to the first control plane network element.

22. The method according to claim 20 or 21, characterized in that The method further comprises: Selecting the second user plane network element according to the fourth request; Obtain endpoint information of the second user plane network element.

23. A communication method, applied to a first terminal device, characterized in that: include: Sending a first request to a first control plane network element in the first network, where the first request includes an identifier of the second network, and the first request is used by the first terminal device to request access to the second network; Receive a first response from the first control plane network element, where the first response is used to indicate that the first terminal device has successfully accessed the second network.

24. The method according to claim 23, characterized in that The method further comprises: Generate a fourth key, where the fourth key is a key generated after the first terminal device successfully authenticates the second network; The fifth key and / or the sixth key are determined based on the fourth key, wherein the fifth key is used for secure transmission between the first terminal device and the first access network element of the first network, the first terminal device accesses through the first access network element, and the sixth key is used for security protection of non-access layer NAS messages transmitted between the first control plane network element and the first terminal device.

25. The method according to claim 24, characterized in that The method further comprises: receiving third information from the first control plane network element, where the third information is used to instruct the first terminal device to start security protection for a NAS message transmitted between the first control plane network element and the first terminal device; In response to the third information, start using the sixth key to securely protect NAS messages between the first control plane network element and the first terminal device.

26. The method according to any one of claims 23 to 25, characterized in that After receiving the first response from the first control plane network element, the method further includes: Sending a third request to the first control plane network element, where the third request is used to request establishment of a first session from the first terminal device to the second network; A fourth response is received from the first control plane network element, where the third response is used to indicate that the first session is successfully established.

27. A communication method, applied to a third control plane network element in a first network, characterized in that: include: receiving a fifth request from a fourth control plane network element in the second network, the fifth request being used to request establishment of a second session from a second terminal device to the first network, the second terminal device being a terminal device that has been registered with the second network, the fifth request including a first identifier, the first identifier being used to indicate a third quality of service QoS parameter allocated by the second network to the second session; Determine a second QoS parameter according to the first identifier, where the second QoS parameter is a QoS parameter used when establishing the second session; Send a fifth response to the fourth control plane network element, where the fifth response includes the second QoS parameter.

28. The method according to claim 27, characterized in that The fifth request further includes an identifier of the second network, and determining a second QoS parameter corresponding to the second session according to the first identifier includes: Acquire the third QoS parameter according to the identifier of the second network and the first identifier; The second QoS parameter is determined according to the third QoS parameter.

29. The method according to claim 27 or 28, characterized in that The determining, according to the first identifier, a second QoS parameter corresponding to the second session includes: Sending fifth information to a first policy control network element in the first network, where the fifth information includes an identifier of the second network and the first identifier, and the fifth information is used by the first policy control network element to determine policy control and charging information for the second session; receiving the policy control and charging information from the first policy control network element; The second QoS parameter is determined according to the policy control and charging information.

30. The method according to any one of claims 27 to 29, characterized in that The QoS parameters include one or more of the following: maximum bandwidth, scheduling priority, preemption priority, or QoS level.

31. The method according to any one of claims 27 to 30, characterized in that The first identifier is an identifier of a QoS profile to which the second network subscribes in the first network, and the QoS profile includes the third QoS parameter.

32. A communication method, applied to a fourth control plane network element in a second network, characterized in that: include: receiving a sixth request from a second terminal device, the sixth request being used to request establishment of a second session from the second terminal device to the first network, the second terminal device being a terminal device that has been registered with the second network; Sending a fifth request to a third control plane network element in the first network according to the sixth request, where the fifth request is used by the fourth control plane network element to request establishment of the second session, where the fifth request includes a first identifier, where the first identifier is used to indicate a third quality of service QoS parameter allocated by the second network to the second session; receiving a fifth response from the third control plane network element, wherein the fifth response includes a second QoS parameter, where the second QoS parameter is a QoS parameter used when establishing the second session; A sixth response is sent to the second terminal device, where the sixth response is used to indicate that the second session is successfully established.

33. The method according to claim 32, characterized in that Before sending a fifth request to a third control plane network element in the first network according to the sixth request, the method further includes: Acquire sixth information, where the sixth information is used to indicate that the second terminal device is allowed to communicate with the first network through the second network; According to the sixth information, determine to send the fifth request to the third control plane network element.

34. The method according to claim 32 or 33, characterized in that The sixth request includes a second identifier, where the second identifier is used to indicate a fourth QoS parameter requested by the second terminal device; Before sending the fifth request to the third control plane network element in the first network, the method further includes: The first identifier is determined according to the second identifier.

35. The method according to any one of claims 32 to 34, characterized in that Before sending the fifth request to the third control plane network element in the first network, the method further includes: Acquire subscription information of the second terminal device, where the subscription information includes at least one identifier, and each identifier of the at least one identifier is used to indicate a QoS parameter subscribed by the second terminal device; The first identification is determined from the at least one identification.

36. The method according to any one of claims 32 to 35, characterized in that The QoS parameters include one or more of the following: maximum bandwidth, scheduling priority, preemption priority, or QoS level.

37. A communication method, applied to a third control plane network element in a first network, characterized in that: include: receiving a third request from a first terminal device, the third request being used to request establishment of a first session from the first terminal device to a second network, the first terminal device being a terminal device that has registered with the second network through the first network; Sending a fourth request to a fourth control plane network element in the second network according to the third request, where the fourth request is used by the third control plane network element to request establishment of the first session, and the fourth request includes endpoint information of the first user plane network element in the first network; receiving a fourth response from the fourth control plane network element, the fourth response including endpoint information of a second user plane network element in the second network; A third response is sent to the first terminal device, where the third response is used to indicate that the first session is successfully established.

38. The method according to claim 37, characterized in that Before sending the third response to the first terminal device, the method further includes: Acquire subscription information of the second network, where the subscription information includes one or more of the following: maximum bandwidth, scheduling priority, preemption priority, or QoS level; Receiving a first QoS parameter corresponding to the first session from the fourth control plane network element; Determine, based on the subscription information, that establishment of a first session based on the first QoS parameter is allowed.

39. The method according to claim 37 or 38, characterized in that Before receiving the third request from the first terminal device, the method further includes: receiving a first request from the first terminal device, the first request being used by the first terminal device to request access to the second network Network; Sending a second request to a second control plane network element in the second network according to the first request, where the second request is used by the first control plane network element to request that the first terminal device be connected to the second network; receiving a second response from the second control plane network element, where the second response is used to indicate that the first terminal device is allowed to access the second network through the first network; A first response is sent to the first terminal device, where the first response is used to indicate that the first terminal device has successfully accessed the second network.

40. The method according to claim 39, characterized in that The first request includes an identifier of the second network, and before sending the second request to a second control plane network element in the second network according to the first request, the method further includes: acquiring, according to an identifier of the second network, first information, where the first information is used to indicate that at least one terminal device is allowed to communicate with the second network through the first network, and the first terminal device belongs to the at least one terminal device; Determine, based on the first information, to send the second request to the second control plane network element.

41. The method according to claim 39 or 40, characterized in that The first request includes an identifier of the second network, and before sending the second request to a second control plane network element in the second network according to the first request, the method further includes: Acquire, according to the identifier of the second network, range information of the second network, where the range information is used to indicate a range in which at least one terminal device is allowed to access the second network, and the first terminal device belongs to the at least one terminal device; According to the range information and the location information of the first terminal device, determine to send the second request to the second control plane network element.

42. The method according to any one of claims 39 to 41, characterized in that The method further comprises: Before receiving the second response from the second control plane network element, restricting messages transmitted between the first terminal device and the second network through the first network according to restriction information, wherein the restriction information includes one or more of the following: types of messages allowed to be transmitted between the first terminal device and the second network through the first network, the number of messages allowed to be transmitted between the first terminal device and the second network through the first network, or the duration of time allowed for the first terminal device and the second network to communicate through the first network; After receiving the second response, the restriction on messages transmitted between the first terminal device and the second network through the first network is cancelled.

43. The method according to any one of claims 39 to 42, characterized in that Before sending a second request to a second control plane network element in the second network according to the first request, the method further includes: A secure connection is established with the second control plane network element, where the secure connection is used for message transmission between the third control plane network element and the second control plane network element.

44. The method according to any one of claims 39 to 43, characterized in that The method further comprises: Acquire a first quantity, where the first quantity is the total number of terminal devices accessing the second network through the first network; According to the first number and second information, it is determined that the first terminal device is allowed to access the second network through the first network, and the second information includes a maximum number of terminal devices allowed to access the second network through the first network.

45. The method according to claim 44, characterized in that The method further comprises: The first number is increased by 1.

46. ​​The method according to any one of claims 39 to 45, characterized in that The method further comprises: receiving a first key from the second control plane network element, where the first key is used for secure transmission between the first terminal device and the first network; Determine a second key according to the first key, where the second key is used for secure transmission between the first terminal device and an access network element of the first network, and the first terminal device accesses the access network element through the access network element; Send the second key to the access network element.

47. The method according to claim 46, characterized in that The method further comprises: Determine a third key according to the first key, where the third key is used to securely protect a NAS message between the third control plane network element and the first terminal device; Send third information to the first terminal device, where the third information is used to instruct the first terminal device to start security protection for NAS messages between the third control plane network element and the first terminal device.

48. The method according to any one of claims 39 to 47, characterized in that The method further comprises: Acquire fourth information, where the fourth information includes one or more of the following: a terminal device accessing the second network through the first network; the number of the first terminal device, the number of messages transmitted between the first network and the second network by the first terminal device, or the traffic consumed by the messages transmitted between the first network and the second network by the first terminal device; The fourth information is sent to the billing system.

49. A communication method, applied to a fourth control plane network element in a second network, characterized in that: include: receiving a fourth request from a third control plane network element in the first network, the fourth request being used to request establishment of a first session from a first terminal device to the second network, the first terminal device being a terminal device that has registered with the second network through the first network, and the fourth request including endpoint information of a first user plane network element in the first network; According to the fourth request, a fourth response is sent to the third control plane network element, where the fourth response includes endpoint information of a second user plane network element in the second network.

50. The method according to claim 49, characterized in that The method further comprises: Acquire the contract information of the first terminal device, where the contract information includes one or more of the following: maximum bandwidth, scheduling priority, preemption priority, or QoS level; Determine a first QoS parameter corresponding to the first session according to the subscription information; Send the first QoS parameter to the third control plane network element.

51. The method according to claim 49 or 50, characterized in that Before receiving the fourth request from the first control plane network element in the first network, the method further includes: receiving a second request from a first control plane network element in the first network, where the second request is used by the first control plane network element to request that the first terminal device be connected to the second network; According to the second request, a second response is sent to the first control plane network element, where the second response is used to indicate that the first terminal device is allowed to access the second network through the first network.

52. The method according to claim 51, characterized in that Before sending a second response to the first control plane network element according to the second request, the method further includes: Acquire a second number, where the second number is the total number of terminal devices accessing the second network through the first network; According to the second number and second information, it is determined that the first terminal device is allowed to access the second network through the first network, and the second information includes a maximum number of terminal devices allowed to access the second network through the first network.

53. The method according to claim 52, characterized in that The method further comprises: The second number is incremented by 1.

54. The method according to any one of claims 51 to 53, characterized in that Before sending a second response to the first control plane network element according to the second request, the method further includes: The first terminal device is authenticated and authorized.

55. The method according to any one of claims 51 to 54, characterized in that The method further comprises: A secure connection is established with the first control plane network element, where the secure connection is used for message transmission between the first control plane network element and the fourth control plane network element.

56. The method according to any one of claims 51 to 55, characterized in that The method further comprises: Allocating a first key to the first control plane network element, where the first key is used for secure transmission between the first terminal device and the first network; Send the first key to the first control plane network element.

57. A communication device, characterized in that: Comprising a module for executing the method as described in any one of claims 1 to 13, or a module for executing the method as described in any one of claims 14 to 22, or a module for executing the method as described in any one of claims 23 to 26, or a module for executing the method as described in any one of claims 27 to 31, or a module for executing the method as described in any one of claims 32 to 36, or a module for executing the method as described in any one of claims 37 to 48, or a module for executing the method as described in any one of claims 49 to 56.

58. A communication device, characterized in that: including a processor and a memory; The memory is used to store one or more computer programs or instructions, and the processor is used to execute the one or more computer programs or instructions stored in the memory, so that the communication device performs the method as described in any one of claims 1 to 13, or the method as described in any one of claims 14 to 22, or the method as described in any one of claims 23 to 26, or the method as described in any one of claims 27 to 31, or the method as described in any one of claims 32 to 36, or the method as described in any one of claims 37 to 48, or the method as described in any one of claims 49 to 56.

59. A communication system, characterized in that: It includes a first control plane network element, a second control plane network element and a first terminal device, or includes a third control plane network element and a fourth control plane network element, wherein the first control plane network element is used to execute the method as described in any one of claims 1 to 13, the second control plane network element is used to execute the method as described in any one of claims 14 to 22, the first terminal device is used to execute the method as described in any one of claims 23 to 26, the third control plane network element is used to execute the method as described in any one of claims 27 to 31 or the method as described in any one of claims 37 to 48, and the fourth control plane network element is used to execute the method as described in any one of claims 32 to 36 or the method as described in any one of claims 49 to 56.

60. A computer-readable storage medium, characterized in that A computer program or instructions is stored, the computer program or instructions being used to implement the method as claimed in any one of claims 1 to 13, or the method as claimed in any one of claims 14 to 22, or the method as claimed in any one of claims 23 to 26, or the method as claimed in any one of claims 27 to 31, or the method as claimed in any one of claims 32 to 36, or the method as claimed in any one of claims 37 to 48, or the method as claimed in any one of claims 49 to 56.

61. A computer program product, characterized in that The computer program product comprises a computer program which, when run on a computer, causes the computer to perform the method according to any one of claims 1 to 13, or the method according to any one of claims 14 to 22, or the method according to any one of claims 23 to 26, or the method according to any one of claims 27 to 31, or the method according to any one of claims 32 to 36, or the method according to any one of claims 37 to 48, or the method according to any one of claims 49 to 56.

Images