Communication method and communication apparatus

Abstract

The present application provides a communication method and a communication apparatus, which are applied to a scenario in which a terminal device registers with a home network by means of a first mobility management function network element and a second mobility management function network element, respectively. The method comprises: when determining that primary authentication needs to be performed on a terminal device, a home network element sends an authentication notification to a first mobility management function network element, the authentication notification being used for requesting to perform primary authentication on the terminal device; when determining that the first mobility management function network element is unable to perform primary authentication on the terminal device, the home network element sends an authentication notification to a second mobility management function network element, the authentication notification being used for requesting to perform primary authentication on the terminal device; and when determining that the second mobility management function network element is able to perform primary authentication on the terminal device, the home network element sends to the first mobility management function network element a notification message for instructing to delete a first pending flag. Thus, the primary authentication for the terminal device is prevented from being re-triggered when the terminal device subsequently accesses the first mobility management function network element again, reducing signaling overhead.

Description

Communication method and communication device

[0001] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office of China on August 4, 2023, with application number 202310980906.3 and invention name “Communication Method and Communication Device”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of communications, and more particularly, to a communication method and a communication device. Background Art

[0003] To ensure network security, communication systems, such as those in the fifth generation (5G), require primary authentication for terminal devices accessing the network. This involves authenticating and authorizing the terminal device. Only after successful authentication can the terminal device access the network and further request a protocol data unit (PDU) session to access various services on the data network (DN).

[0004] For example, the terminal device can use the third generation partnership project (3GPP) technology and non-3GPP technology to access the network through the first mobility management function network element and the second mobility management function network element respectively. When the home network element determines that the terminal device needs to be primarily authenticated according to the operator's authentication policy, the home network element can request the mobility management function network element to perform primarily authentication on the terminal device. If the two mobility function network elements cannot initiate the primarily authentication of the terminal device, a suspension flag can be set locally to trigger the primarily authentication when the primarily authentication of the terminal device can be initiated. However, the two primarily authentication processes may result in unnecessary signaling overhead.

[0005] Summary of the Invention

[0006] The present application provides a communication method and a communication device, which can avoid redundant main authentication processes for terminal equipment and reduce signaling overhead.

[0007] In a first aspect, a communication method is provided, which can be executed by a home network element, or by a chip or circuit of the home network element, which is not limited in this application. For ease of description, the following description is based on an example of execution by the home network element.

[0008] The method includes: when a terminal device is registered with a network through a first mobility management function network element and a second mobility management function network element respectively, the home network element stores an identifier of the first mobility management function network element and an identifier of the second mobility management function network element; when it is determined that primary authentication of the terminal device is required, the home network element sends a first authentication notification message to the first mobility management function network element, the first authentication notification message is used to request triggering primary authentication of the terminal device; the home network element receives a first authentication response message from the first mobility management function network element, the first authentication response message is used to indicate that primary authentication of the terminal device cannot be initiated; In response to the first authentication response message, the hometown network element sends a second authentication notification message to the second mobility management function network element, where the second authentication notification message is used to request triggering of primary authentication of the terminal device; the hometown network element receives the second authentication response message from the second mobility management function network element; when it is determined based on the second authentication response message that the second mobility management function network element can initiate primary authentication of the terminal, the hometown network element sends a first notification message to the first mobility management function network element, where the first notification message is used for the first mobility management function network element to cancel a first suspension flag, where the first suspension flag is used to indicate that primary authentication of the terminal device needs to be triggered.

[0009] Canceling the first suspend flag can be understood as invalidating the first suspend flag. If the first suspend flag is indicated by a bit, such as 1 representing that the first suspend flag is valid and 0 representing that the first suspend flag is invalid, the first mobility management function network element changes the first suspend flag from 1 to 0; or, if the first suspend flag exists to indicate validity and no longer exists to indicate invalidity, the first mobility management function network element deletes the first suspend flag, etc.

[0010] It should be understood that the first suspension flag is used to indicate that when the terminal device re-registers with the network through the first mobility management function network element, or the terminal device is reachable, the first mobility management function network element determines to authenticate the terminal device based on the locally set first suspension flag.

[0011] Illustratively, when the terminal device reattaches to the same mobility management function network element or the terminal device becomes reachable, the mobility management function network element checks the authentication pending flag and performs re-authentication if necessary. After the terminal device re-authenticates, the mobility management function network element resets the authentication pending flag. If the terminal device attaches to a new mobility management function network element (for example, in a mobile scenario), the new mobility management function network element may retrieve the terminal device's context from the previous mobility management function network element, determine that the terminal device's authentication is pending, and perform re-authentication.

[0012] It should be understood that the embodiment of the present application does not limit how the home network element preferentially selects the first mobility management function network element to initiate an authentication request when the home network element stores both the first mobility management function network element and the second mobility management function network element.

[0013] In an embodiment of the present application, the inability to initiate the primary authentication of the terminal device can be understood as the terminal device being unreachable, or the first mobility management function network element not finding the terminal device. Among them, "cannot be initiated" can also be replaced by names such as "cannot be initiated", "cannot be triggered", and "cannot be triggered". Exemplarily, after receiving the first authentication notification message, the first mobility management function network element determines whether to trigger the primary authentication of the terminal device based on the local authentication policy and the status of the terminal device. For example, if the first mobility management function network element finds that the terminal device is unreachable, or the first mobility management function network element does not find the terminal device, the first mobility management function network element sends a first authentication response message to the home network element.

[0014] According to the solution provided in the present application, the hometown network element determines that the second mobility management function network element can initiate the main authentication of the terminal device based on the received second authentication response message, and then sends a first notification message to the first mobility management function network element serving the terminal device, which is used to notify the first mobility management function network element to delete or reset the suspension flag, or to notify the first mobility management function network element to cancel or terminate the hometown network's execution of the main authentication process, thereby avoiding the subsequent first mobility management function network element triggering the re-authentication process for the terminal device and reducing signaling overhead.

[0015] In combination with the first aspect, in some implementations of the first aspect, the first authentication response message includes a first cause value, and the first cause value is used to indicate that the first mobility management function network element cannot perform primary authentication on the terminal device.

[0016] Based on the above solution, the first authentication response message carries a first cause value, and the first cause value is used to indicate that the first mobility management function network element cannot initiate primary authentication for the terminal device. For example, the first cause value may indicate that the primary authentication for the terminal device has failed to be initiated, or the first cause value may indicate that the terminal device is unreachable. In this case, the home network element may determine, based on the first cause value, that the first mobility management function network element has not performed primary authentication for the terminal device.

[0017] In combination with the first aspect, in certain implementations of the first aspect, a first authentication suspension flag is set in response to a first authentication response message, and the first authentication suspension flag is used to indicate that a first suspension flag is set on the first mobility management function network element; wherein, the hometown network element sends a first notification message to the first mobility management function network element, including: the hometown network element sends the first notification message to the first mobility management function network element based on the first authentication suspension flag.

[0018] Optionally, a first authentication suspension flag is set according to the first reason value.

[0019] Among them, the first notification message itself has an indicative function, or carries a reason value with an indicative function, that is, it is used to instruct the first mobility management function network element to delete the first suspension flag, and the first suspension flag is used to indicate that the main authentication of the terminal device needs to be triggered; or, the first notification message is used to instruct the first mobility management function network element to cancel or terminate the home network to execute the main authentication process.

[0020] Exemplarily, the first notification message may be an authentication notification message carrying a reason value, or a first notification message carrying a reason value, or a first notification message not carrying a reason value, and the reason value may be used to indicate that the second mobility management function network element has performed primary authentication on the terminal device, or to indicate that the primary authentication of the terminal device is in progress, or to indicate that the primary authentication of the terminal device is successful, or to instruct the first mobility management function network element to delete the first suspension flag, or to indicate that the first mobility management function network element will no longer trigger the primary authentication process for the terminal device due to the locally set first suspension flag, that is, to instruct the first mobility management function network element to cancel or terminate the execution of the primary authentication process by the home network.

[0021] Optionally, the home network element sets the first authentication suspension flag only when it receives a specific failure cause value. For example, when the failure cause value received by the home network element indicates that the terminal device is reachable, the home network element sets the first authentication suspension flag.

[0022] Based on the above scheme, the hometown network element can know that the terminal device is unreachable according to the first cause value, or know that the first mobility management function network element has failed to start the main authentication of the terminal device, and then set the first authentication suspension flag, and can associate the first authentication suspension flag with the first mobility management function network element.

[0023] Illustratively, after receiving the second authentication response message that does not carry a cause value, the home network element may determine that the second mobility management function network element is capable of executing the primary authentication process for the terminal device. Furthermore, the home network element determines whether to send the first notification message to the first mobility management function network element. For example, the home network element determines whether the first mobility management function network element exists, and if so, further determines whether to send the first notification message to the first mobility management function network element that is determined to exist.

[0024] Exemplarily, when it is determined that a first notification message needs to be sent, the first notification message can be sent to notify the cancellation or termination of the execution of the home network triggered main authentication process, or to notify that the suspension flag set at the first mobility management function network element can be canceled.

[0025] With reference to the first aspect, in certain implementations of the first aspect, after sending the first notification message to the first mobility management function network element, the home network element deletes the first authentication suspension flag.

[0026] Exemplarily, the first authentication suspension flag may be deleted after the primary authentication of the terminal device is successful, or during the process of performing the primary authentication on the terminal device.

[0027] Based on the above solution, by deleting the first authentication suspension flag, if the first mobility management function network element subsequently requests primary authentication for the terminal device, the hometown network element can reject the authentication request of the first mobility management function network element based on the fact that the first authentication suspension flag is not stored locally, thereby avoiding redundant authentication processes and reducing signaling overhead.

[0028] In combination with the first aspect, in certain implementations of the first aspect, in response to the first authentication response message, a second authentication notification message is sent to the second mobility management function network element, including: in response to the first authentication response message, according to the identifier of the second mobility management function network element, a second authentication notification message is sent to the second mobility management function network element.

[0029] In combination with the first aspect, in certain implementations of the first aspect, when any of the following items is met, it is determined that the second mobility management function network element can initiate primary authentication of the terminal; the second authentication response message carries a response message to the second authentication notification message; or, the second authentication response message does not carry a second cause value, and the second cause value is used to indicate that the second mobility management function network element cannot perform primary authentication on the terminal device.

[0030] It should be understood that this application does not limit the timing of sending the first notification message.

[0031] In combination with the first aspect, in certain implementations of the first aspect, when it is determined based on the second authentication response message that the second mobility management function network element cannot initiate primary authentication of the terminal, the second authentication response message includes a third cause value, and the third cause value is used to indicate that the second mobility management function network element cannot perform primary authentication on the terminal device. For example, the third cause value includes that the second mobility management function network element cannot find the terminal device, or the terminal device is unreachable.

[0032] Exemplarily, when it is determined that the primary authentication of the terminal cannot be initiated based on the second authentication response message, and subsequently one of the first mobility management function network element and the second mobility management function network element initiates the primary authentication of the terminal, any of the following operations is performed on the other of the first mobility management function network element and the second mobility management function network element: notifying the fourth mobility management function network element to cancel the suspension flag; or rejecting the primary authentication request initiated by the fourth mobility management function network element.

[0033] That is, if both mobility management function network elements cannot access the terminal device, two pending flags are stored in the two mobility management function network elements. When the terminal device becomes reachable and one of the mobility management function network elements initiates the primary authentication process, the home network element can take appropriate action on the other mobility management function network element by rejecting the primary authentication due to the previous request, or notifying the other mobility management function network element to delete the pending flag, or the home network element can respond to the two primary authentication processes in sequence.

[0034] Based on the above solution, the home network element can determine, based on the cause value, that the second mobility management function network element failed to perform primary authentication on the terminal device. The cause value is used to indicate that the second mobility management function network element was unable to initiate primary authentication on the terminal device. For example, the failure cause value may indicate that primary authentication on the terminal device failed to be initiated, or the failure cause value may indicate that the terminal device is unreachable.

[0035] In combination with the first aspect, in certain implementations of the first aspect, when the terminal device registers with the network again through the second mobility management function network element, the hometown network element receives a first request message from the second authentication server function network element, the first request message is used to request a first primary authentication of the terminal device, the first request message includes a second service network name, and the second service network name is used to indicate the service network where the second mobility management function network element is located; the hometown network element determines that the first primary authentication comes from the second mobility management function network element based on the second service network name; the hometown network element sends a second notification message to the first authentication server function network element or the first mobility management function network element, and the second notification message is used to instruct the first mobility management function network element to cancel the first suspension flag.

[0036] Among them, the second notification message itself has an indicative function, or carries a reason value with an indicative function, that is, it is used to instruct the first mobility management function network element to delete or invalidate the first suspension flag, and the first suspension flag is used to indicate that the main authentication of the terminal device needs to be triggered; or, the second notification message is used to instruct the first mobility management function network element to cancel or terminate the home network to execute the main authentication process.

[0037] Exemplarily, the second notification message may be an authentication notification message carrying a reason value, or a second notification message carrying a reason value, or a second notification message without a reason value, and the reason value may be used to indicate that the second mobility management function network element has performed primary authentication on the terminal device, or to indicate that primary authentication of the terminal device is in progress, or to indicate that primary authentication of the terminal device is successful, or to indicate that the first mobility management function network element deletes the first suspension flag, or to indicate that the first mobility management function network element will no longer trigger the primary authentication process for the terminal device due to the locally set first suspension flag, that is, to instruct the first mobility management function network element to cancel or terminate the execution of the primary authentication process by the home network. Correspondingly, the first mobility management function network element may determine not to trigger the primary authentication of the terminal device based on the second notification message or the reason value carried in the second notification message, thereby avoiding redundant primary authentication processes and reducing signaling overhead.

[0038] Based on the above solution, the hometown network element determines which mobility management function network element the authentication comes from. After knowing that the current main authentication comes from the mobility management function network element of the service terminal device, after receiving the authentication request initiated by the first mobility management function network element from the service terminal device, it rejects the authentication request of the first mobility management function network element, thereby avoiding redundant authentication processes and reducing signaling overhead.

[0039] In combination with the first aspect, in certain implementations of the first aspect, the hometown network element sends a second notification message to the first authentication server function network element or the first mobility management function network element, including: the hometown network element sends a first notification message to the first mobility management function network element based on the stored identifier of the first mobility management function network element; or, the hometown network element sends a first notification message to the first mobility management function network element based on the set first authentication suspension flag, where the first authentication suspension flag is used to indicate that a first suspension flag is set on the first mobility management function network element.

[0040] Based on the above solution, the home network element determines which mobility management function network element the authentication originated from. Once it knows that the current primary authentication originated from the mobility management function network element of the serving terminal device, it directly sends a cancel pending flag to the first mobility management function network element of the serving terminal device that has not triggered the authentication request. This avoids triggering redundant authentication processes and reduces signaling overhead. Compared to rejecting an authentication request after receiving it from the first mobility management function network element, this can reduce unnecessary overhead.

[0041] In combination with the first aspect, in certain implementations of the first aspect, before the hometown network element sends the second notification message to the first authentication server function network element or the first mobility management function network element, the method also includes: the hometown network element determines to perform a first primary authentication on the terminal device; the hometown network element sends an authentication vector to the second authentication server function network element, and the authentication vector is used to perform the first primary authentication on the terminal device; the hometown network element receives the authentication result from the second authentication server function network element; wherein, the hometown network element sends the second notification message to the first authentication server function network element or the first mobility management function network element, including: when the authentication result indicates that the first primary authentication is successful, the hometown network element sends the second notification message to the first authentication server function network element or the first mobility management function network element.

[0042] Based on the above solution, when it is determined that the second mobility management function network element has successfully performed the primary authentication of the terminal device, the hometown network element sends a second notification message to the first authentication server function network element or the first mobility management function network element to avoid the subsequent first mobility management function network element re-triggering the primary authentication of the terminal device when the terminal device is reachable, avoiding redundant authentication processes and reducing signaling overhead.

[0043] In combination with the first aspect, in certain implementations of the first aspect, when the authentication result indicates that the first primary authentication is successful, the hometown network element deletes the second authentication suspension flag, and the second authentication suspension flag is used to indicate that a second suspension flag is set on the second mobility management function network element, and the second suspension flag is used to indicate that it is necessary to trigger the primary authentication of the terminal device.

[0044] Based on the above solution, if the first mobility management function network element subsequently requests primary authentication for the terminal device, the hometown network element can reject the authentication request of the first mobility management function network element based on the fact that the second authentication suspension flag is not stored locally, thereby avoiding redundant authentication processes and reducing signaling overhead.

[0045] In combination with the first aspect, in certain implementations of the first aspect, before the hometown network element receives the first request message from the second authentication server function network element, the method also includes: the hometown network element sets a second authentication suspension flag according to the third reason value, and the second authentication suspension flag is used to indicate that a second suspension flag is set on the second mobility management function network element; wherein, the hometown network element determines to perform a first main authentication on the terminal device, including: the hometown network element determines to perform a first main authentication on the terminal device based on the stored first authentication suspension flag and the second authentication suspension flag, and the first authentication suspension flag is used to indicate that a first suspension flag is set on the first mobility management function network element.

[0046] Based on the above scheme, when the hometown network element determines that neither the first mobility management function network element nor the second mobility management function network element serving the terminal device can perform primary authentication on the terminal device, a first authentication suspension flag and a second authentication suspension flag are set, which are used by the hometown network element to determine that the primary authentication of the current terminal device has not been performed or has not occurred. Then, after the first authentication request message thereafter, it can be determined that the primary authentication of the terminal device can be performed.

[0047] In combination with the first aspect, in certain implementations of the first aspect, the hometown network element determines that the first primary authentication comes from the second mobility management function network element based on the second service network name, including: the hometown network element determines that the first primary authentication comes from the second mobility management function network element based on the second service network name and the stored correspondence between the second service network name and the second mobility management function network element; or, the hometown network element determines that the first primary authentication comes from the second mobility management function network element based on the information used to indicate the service network of the second mobility management function network element contained in the second service network name and the correspondence between the stored information used to indicate the service network of the second mobility management function network element and the second mobility management function network element; or, the hometown network element determines that the first primary authentication comes from the second mobility management function network element based on the information used to indicate the service network of the second mobility management function network element contained in the second service network name and the information used to indicate the service network of the second mobility management function network element contained in the stored second mobility management function network element identifier.

[0048] With reference to the first aspect, in certain implementations of the first aspect, the information used to indicate the serving network of the first mobility management function network element includes an identifier of a public land mobile network corresponding to the first mobility management function network element.

[0049] In combination with the first aspect, in some implementations of the first aspect, the first request message also includes a fourth cause value, and the fourth cause value is used to indicate that the first primary authentication is determined based on the second suspension flag.

[0050] Based on the above solution, when the terminal device registers with the network again through the second mobility management function network element, the second mobility management function network element can trigger the primary authentication of the terminal device according to the second suspension flag set locally.

[0051] In combination with the first aspect, in certain implementations of the first aspect, before the hometown network element sends a second notification message to the first authentication server function network element, the method also includes: when the terminal device registers to the network again through the first mobility management function network element, the hometown network element receives a second request message from the first authentication server function network element, the second request message is used to request a second authentication of the terminal device, the second request message includes a first service network name, and the first service network name is used to indicate the service network where the first mobility management function network element is located.

[0052] Based on the above solution, when the hometown network element knows that the current primary authentication comes from the second mobility management function network element serving the terminal device, after receiving the authentication request initiated by the first mobility management function network element serving the terminal device, it can reject the authentication request of the first mobility management function network element based on the current primary authentication of the terminal device, thereby avoiding redundant primary authentication processes and reducing signaling overhead.

[0053] In combination with the first aspect, in some implementations of the first aspect, the second request message also includes a fifth cause value, and the fifth cause value is used to indicate that the second primary authentication is determined by the first suspension flag.

[0054] In combination with the first aspect, in some implementations of the first aspect, the second notification message includes a sixth reason value, which is used to indicate that when the terminal device registers to the network again through the first mobility management function network element, no primary authentication is performed on the terminal device, or in other words, to instruct the first mobility management function network element to cancel the first suspension flag.

[0055] In combination with the first aspect, in certain implementations of the first aspect, when it is determined that the primary authentication of the terminal device cannot be initiated based on the second authentication response message, and subsequently the third mobility management function network element initiates the primary authentication of the terminal, any of the following operations is performed on the fourth mobility management function network element: notifying the fourth mobility function network element to cancel the suspension flag; or rejecting the primary authentication request initiated by the fourth mobility function network element; wherein the third mobility management function network element is one of the first mobility management function network element and the second mobility management function network element, and the fourth mobility management function network element is the other of the first mobility management function network element and the second mobility management function network element except the third mobility management function network element.

[0056] In combination with the first aspect, in certain implementations of the first aspect, a first request message triggered by a third mobility management function network element is received, the first request message is used to request primary authentication of the terminal device, the first request message includes a second service network name, and the second service network name is used to indicate the service network where the third mobility management function network element is located; based on the second service network name, it is determined that an operation needs to be performed on the fourth mobility management function network element.

[0057] In combination with the first aspect, in certain implementations of the first aspect, based on the name of the second service network, it is determined that an operation needs to be performed on the fourth mobility management function network element, including: based on the second service network name, and the stored identifier of the first mobility management function network element and the identifier of the second mobility management function network element, it is determined that an operation needs to be performed on the fourth mobility management function network element; or, based on the second service network name, and the set first authentication suspension flag and second authentication suspension flag, it is determined that an operation needs to be performed on the fourth mobility management function network element, wherein the first authentication suspension flag is used to indicate that a first suspension flag is set on the first mobility management function network element, the second authentication suspension flag is used to indicate that a second suspension flag is set on the second mobility management function network element, and the second suspension flag is used to indicate that it is necessary to trigger the main authentication of the terminal device.

[0058] In combination with the first aspect, in certain implementations of the first aspect, before determining that an operation needs to be performed on the fourth mobility management function network element, the method also includes: determining that a primary authentication is required for the terminal device; sending an authentication vector to the third mobility management function network element, where the authentication vector is used to perform the primary authentication on the terminal device; receiving an authentication result for the terminal device; wherein, determining that an operation needs to be performed on the fourth mobility management function network element includes: determining that an operation needs to be performed on the fourth mobility management function network element when the authentication result indicates that the authentication of the terminal device is successful.

[0059] In combination with the first aspect, in certain implementations of the first aspect, before receiving a first request message triggered by a third mobility management function network element, the method also includes: when it is determined that the first mobility function network element and the second mobility function network element cannot initiate the primary authentication of the terminal device, setting a first authentication suspension flag and a second authentication suspension flag; wherein, determining to perform the primary authentication of the terminal device includes: determining to perform the primary authentication of the terminal device based on the stored first authentication suspension flag and the second authentication suspension flag.

[0060] In combination with the first aspect, in certain implementations of the first aspect, before determining that an operation needs to be performed on the fourth mobility management function network element based on the second service network name, the method further includes: determining that the first request message is triggered by the third mobility management function network element based on the second service network name and the stored correspondence between the second service network name and the third mobility management function network element; or determining that the first request message is triggered by the third mobility management function network element based on the identifier of the public land mobile network included in the second service network name and the stored correspondence between the identifier of the public land mobile network and the third mobility management function network element.

[0061] In combination with the first aspect, in certain implementations of the first aspect, before determining that an operation needs to be performed on the fourth mobility management function network element based on the second service network name, the method also includes: receiving a second request message triggered by the fourth mobility management function network element, the second request message being used to request primary authentication of the terminal device, the second request message including a third service network name, and the third service network name being used to indicate the service network where the fourth mobility management function network element is located.

[0062] In summary, when neither the first mobility management function network element nor the second mobility management function network element can initiate primary authentication for the terminal device, the first mobility management function network element and the second mobility management function network element locally set the first suspension flag and the second suspension flag. Optionally, the home network element sets the first authentication suspension flag and the second authentication suspension flag. Furthermore, when the terminal device is reachable or registers with the network through a third mobility management function network element, the third mobility management function network element triggers the primary authentication process for the terminal device based on the local suspension flag. Correspondingly, after receiving the authentication request sent by the third mobility management function network element, the home network element notifies the fourth mobility management function network element to cancel the suspension flag; or, alternatively, rejects subsequent primary authentication requests initiated by the fourth mobility function network element. If the third mobility management function network element is the first mobility management function network element, the fourth mobility management function network element is the second mobility management function network element; conversely, if the third mobility management function network element is the second mobility management function network element, the fourth mobility management function network element is the first mobility management function network element. For ease of description, in the embodiment of the present application, the second mobility management function network element requests to trigger the main authentication process for the terminal device, and the hometown network element notifies the first mobility management function to cancel the suspension flag; or, rejects the subsequent main authentication request initiated by the first mobility function network element as an example for explanation. For specific implementation methods, please refer to the relevant description in the specific embodiments below. If the first mobility management function network element requests to trigger the main authentication process for the terminal device, the hometown network element notifies the second mobility management function to cancel the suspension flag; or, rejects the main authentication request initiated by the second mobility function network element, the specific implementation method is similar.

[0063] That is, when primary authentication of a key device is required but both mobility management function network elements cannot reach the terminal device, two pending flags are stored in the two mobility management function network elements. When the terminal device becomes reachable and one of the mobility management function network elements initiates the primary authentication process, the home network element can take appropriate action on the other mobility management function network element by rejecting the primary authentication due to the previous request or notifying the other mobility management function network element to delete the pending flag, or the home network element can respond to the two primary authentication processes in sequence.

[0064] In a second aspect, a communication method is provided. The method may be executed by a first mobility management function network element, or may be executed by a chip or circuit of the first mobility management function network element, which is not limited in this application. For ease of description, the following description uses the method executed by the first mobility management function network element as an example.

[0065] The method includes: when a terminal device registers to a network through a first mobility management function network element and a second mobility management function network element respectively, the first mobility management function network element receives a first authentication notification message from a home network element, the first authentication notification message being used to request triggering of primary authentication of the terminal device; when it is determined that primary authentication of the terminal device cannot be performed, the first mobility management function network element sets a first suspension flag and sends a first authentication response message to the home network element, the first suspension flag being used to indicate that primary authentication of the terminal device needs to be triggered when the terminal device accesses the first mobility management function network element again; when the second mobility management function network element is able to perform primary authentication of the terminal device, the first mobility management function network element receives a notification message from the home network element, the notification message being used to indicate that primary authentication of the terminal device will not be performed when the terminal device registers to the network through the first mobility management function network element again; the first mobility management function network element deletes the first suspension flag according to the notification message, or the notification message is used to notify cancellation or termination of the home network's execution of the primary authentication process.

[0066] According to the solution provided in this application, the first mobility management function network element can determine to delete or reset the suspension flag, or cancel or terminate the execution of the main authentication process by the home network by receiving the first notification message, thereby avoiding subsequent triggering of the re-authentication process for the terminal device and reducing signaling overhead.

[0067] In combination with the second aspect, in some implementations of the second aspect, the first authentication response message includes a first cause value, and the first cause value is used to indicate that the first mobility management function network element cannot perform primary authentication on the terminal device.

[0068] In combination with the second aspect, in some implementations of the second aspect, the first request message also includes a second cause value, and the second cause value is used to indicate that the primary authentication is determined based on the first suspension flag.

[0069] In combination with the second aspect, in certain implementations of the second aspect, the first mobility management function network element receives a notification message from the hometown network element, including: when the primary authentication of the terminal device is successful, the first mobility management function network element receives a notification message from the hometown network element.

[0070] The beneficial effects of the above-mentioned second aspect and certain implementation methods of the second aspect can be referred to the corresponding description of the first aspect, and will not be repeated here.

[0071] According to a third aspect, a communication device is provided, such as a home network element, which includes: a processing unit, which is used for the home network element to store the identifier of the first mobility management function network element and the identifier of the second mobility management function network element when the terminal device is registered to the network through the first mobility management function network element and the second mobility management function network element respectively; a transceiver unit, which is used for the home network element to send a first authentication notification message to the first mobility management function network element when it is determined that the terminal device needs to be primarily authenticated, the first authentication notification message is used to request to trigger the primary authentication of the terminal device; the transceiver unit is also used for the home network element to receive a first authentication response message from the first mobility management function network element, the first authentication response message is used to indicate Unable to perform primary authentication on the terminal device; the transceiver unit is further used to respond to the first authentication response message, and the hometown network element sends a second authentication notification message to the second mobility management function network element, and the second authentication notification message is used to request to trigger the primary authentication of the terminal device; the transceiver unit is also used for the hometown network element to receive the second authentication response message from the second mobility management function network element; the transceiver unit is also used to determine that the second mobility management function network element can initiate the primary authentication of the terminal according to the second authentication response message, and the hometown network element sends a first notification message to the first mobility management function network element, and the first notification message is used to indicate that when the terminal device registers to the network again through the first mobility management function network element, the primary authentication of the terminal device will not be performed. For example, the first notification message is used to instruct the first mobility management function network element to delete the first suspension flag, and the first suspension flag is used to indicate that the primary authentication of the terminal device needs to be triggered; or the first notification message is used to notify the first mobility management function network element to cancel or terminate the hometown network's execution of the primary authentication process.

[0072] The transceiver unit can perform the reception and transmission processing in the aforementioned first aspect, and the processing unit can perform other processing except reception and transmission in the aforementioned first aspect.

[0073] According to a fourth aspect, a communication device is provided, such as a first mobility management function network element, which includes: a transceiver unit, which is used for the first mobility management function network element to receive a first authentication notification message from a home network element when the terminal device is registered to the network through the first mobility management function network element and the second mobility management function network element respectively, and the first authentication notification message is used to request triggering a primary authentication of the terminal device; a processing unit, which is used for the first mobility management function network element to set a first suspension flag and send a request to the home network element when it is determined that the terminal device cannot be primarily authenticated. The first authentication response message, the first suspension flag is used to indicate that when the terminal device accesses the first mobility management function network element again, it is necessary to trigger the main authentication of the terminal device; the transceiver unit is also used for the first mobility management function network element to receive a notification message from the hometown network element when the second mobility management function network element is able to perform the main authentication on the terminal device, and the notification message is used to instruct the first mobility management function network element to delete the first suspension flag; the processing unit is also used for the first mobility management function network element to delete the first suspension flag according to the notification message, or to cancel or terminate the execution of the main authentication process of the hometown network according to the notification message.

[0074] The transceiver unit can perform the reception and transmission processing in the aforementioned second aspect, and the processing unit can perform other processing except reception and transmission in the aforementioned second aspect.

[0075] In a fifth aspect, a communication device is provided, comprising a processor, the processor being coupled to a memory, the memory being used to store a computer program, and the processor being used to call and run the computer program from the memory, so that the device executes the method of the above-mentioned first aspect or second aspect and any possible implementation thereof.

[0076] Optionally, there are one or more processors and one or more memories.

[0077] Optionally, the memory may be integrated with the processor, or the memory may be provided separately from the processor.

[0078] Optionally, the communication device further includes a transceiver.

[0079] In the sixth aspect, a communication system is provided, including a home network element and a first mobility management function network element, the home network element is used to execute the method in the above-mentioned first aspect and any possible implementation thereof, and the first mobility management function network element is used to execute the method in the above-mentioned second aspect and any possible implementation thereof.

[0080] Optionally, the communication system further includes a first authentication server function network element, a second authentication server function network element or a terminal device.

[0081] In the seventh aspect, a computer-readable storage medium is provided, which stores a computer program or code. When the computer program or code is run on a computer, the computer executes the method in the above-mentioned first aspect or second aspect and any possible implementation thereof.

[0082] In the eighth aspect, a chip is provided, comprising at least one processor, wherein the at least one processor is coupled to a memory, the memory being used to store a computer program, and the processor being used to call and run the computer program from the memory, so that a device equipped with the chip system executes the method in the above-mentioned first aspect or second aspect and any possible implementation thereof.

[0083] The chip may include an input circuit or interface for sending information or data, and an output circuit or interface for receiving information or data.

[0084] In a ninth aspect, a computer program product is provided, comprising: a computer program code, which, when executed on a computer, enables the computer to execute the method in the first aspect or the second aspect and any possible implementation thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0085] FIG1 is a schematic diagram of a network architecture 100 .

[0086] FIG2 is a schematic diagram of a UE registering with a network.

[0087] FIG3 is a schematic diagram of a UDM-initiated home network-triggered master authentication process.

[0088] FIG4 is a flow chart of a communication method 400 provided in an embodiment of the present application.

[0089] FIG5 is a flow chart of a communication method 500 provided in an embodiment of the present application.

[0090] FIG6 is a flow chart of a communication method 600 provided in an embodiment of the present application.

[0091] FIG7 is a flow chart of a communication method 700 provided in an embodiment of the present application.

[0092] FIG8 is a schematic structural diagram of a communication device 1000 provided in an embodiment of the present application.

[0093] FIG9 is a schematic structural diagram of a communication device 2000 provided in an embodiment of the present application.

[0094] FIG10 is a schematic structural diagram of a chip system 3000 provided in an embodiment of the present application. DETAILED DESCRIPTION

[0095] The technical solution in this application will be described below with reference to the accompanying drawings.

[0096] The technical solutions provided in this application can be applied to various communication systems, such as new radio (NR) systems, long term evolution (LTE) systems, LTE frequency division duplex (FDD) systems, LTE time division duplex (TDD) systems, etc. The technical solutions provided in this application can also be applied to device-to-device (D2D) communication, vehicle-to-everything (V2X) communication, machine-to-machine (M2M) communication, machine type communication (MTC), and Internet of Things (IoT) communication systems or other communication systems.

[0097] In a communication system, the part operated by an operator may be referred to as a public land mobile network (PLMN), or as an operator network, etc. PLMN is a network established and operated by the government or an operator approved by it for the purpose of providing land mobile communication services to the public. It is mainly a public network in which mobile network operators (MNOs) provide mobile broadband access services to users. The PLMN described in the embodiments of the present application may specifically be a network that complies with the standards of the 3rd Generation Partnership Project (3GPP), referred to as a 3GPP network. 3GPP networks generally include but are not limited to fifth-generation mobile communication (5th-generation, 5G) networks, fourth-generation mobile communication (4th-generation, 4G) networks, and other future communication systems, such as sixth-generation mobile communication (6th-generation, 6G) networks.

[0098] For ease of description, the embodiments of the present application will be described using PLMN or 5G network as an example.

[0099] Figure 1 is a schematic diagram of a network architecture 100, using the 5G network architecture based on a service-based architecture (SBA) in a non-roaming scenario as defined in the 3GPP standardization process as an example. As shown in Figure 1 , the network architecture may include a terminal device component, a data network (DN) component, and a carrier network (PLMN) component. The carrier network PLMN component may include, but is not limited to, a (radio) access network (R)AN) 120 and a core network (CN) component.

[0100] The following is a brief description of the functions of the network elements in each part.

[0101] The terminal device portion may include a terminal device 110, which is a device that provides voice and / or data connectivity to the user. The terminal device 110 may also be referred to as a user equipment UE. The terminal device 110 in this application is a device with wireless transceiver functions, which can communicate with one or more core network (CN) devices via an access network device (or also referred to as an access device) in a (radio) access network (R)AN 120. The terminal device 110 may also be referred to as an access terminal, terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, user agent or user device, etc. The terminal device 110 may be deployed on land, including indoors or outdoors, handheld or vehicle-mounted; it may also be deployed on water (such as a ship, etc.); it may also be deployed in the air (such as an airplane, balloon and satellite, etc.). The terminal device 110 may be a cellular phone, a cordless phone, a Session Initiation Protocol (SIP) phone, a smartphone, a mobile phone, a wireless local loop (WLL) station, a personal digital assistant (PDA), or the like. Alternatively, the terminal device 110 may be a handheld device with wireless communication capabilities, a computing device, or other device connected to a wireless modem, an in-vehicle device, a wearable device, an unmanned aerial vehicle (UAV), or a terminal in the Internet of Things (IoT), the Internet of Vehicles (IoV), any terminal in a 5G network or future networks, a relay user device, or a terminal in a future evolving 6G network. The relay user device may be, for example, a 5G residential gateway (RG). For example, the terminal device 110 may be a virtual reality (VR) terminal, an augmented reality (AR) terminal, a wireless terminal in industrial control, a wireless terminal in unmanned driving, a wireless terminal in telemedicine, a wireless terminal in a smart grid, a wireless terminal in transportation safety, a wireless terminal in a smart city, or a wireless terminal in a smart home. The terminal device here refers to a 3GPP terminal. The embodiments of the present application do not limit the type or category of terminal devices. For ease of explanation, the present application will use UE to represent terminal devices as an example for explanation.

[0102] (R)AN 120 may include one or more access network elements or access network devices, and the interface between the access network device and the terminal device may be a Uu interface (or air interface, i.e., the messages exchanged between the access network device and the terminal device may be called air interface messages). Of course, in future communications, the interface name may remain unchanged or may be replaced by other names, and this application does not limit this. (R)AN 120 is a device that provides wireless communication functions for the terminal device 110, which can connect the terminal device to a node or device of a wireless network, and may also be called a network device. (R)AN 120 can be regarded as a subnet of the operator network, and is an implementation system between a service node in the operator network and the terminal device 110. For example, the terminal device 110 can connect to a service node of the operator network through (R)AN 120, thereby obtaining the services provided by the service node. For the convenience of description, in all embodiments of this application, the above-mentioned device that provides wireless communication functions for the terminal device 110 is collectively referred to as an access network device or simply referred to as RAN. It should be understood that this document does not limit the specific type of access network device.

[0103] The CN part may include but is not limited to the following network functions (NF): user plane function (UPF) 130, network exposure function (NEF) 131, network function repository function (NRF) 132, policy control function (PCF) 133, unified data management function (UDM) 134, unified data repository function (UDR) 135, application function (AF) 136, authentication server function (AUSF) 137, access and mobility management function (AMF) 138, and session management function (SMF) 139.

[0104] The data network DN 140, also called a packet data network (PDN), is typically a network outside the operator's network, such as a third-party network.

[0105] The following is a brief description of the NF functions included in CN.

[0106] 1. UPF 130 is a gateway provided by the operator, serving as the gateway for communication between the operator network and DN 140. UPF 130 network functions include packet routing and transmission, packet inspection, service usage reporting, Quality of Service (QoS) processing, lawful interception, uplink packet inspection, downlink packet storage, and other user-plane-related functions.

[0107] 2. NEF 131 is a control plane function provided by the operator. It mainly enables third parties to use the services provided by the network, supports the network to open its capabilities, event and data analysis, provide PLMN security configuration information from external applications, and convert interactive information within and outside the PLMN.

[0108] 3. NRF 132 is a control plane function provided by the operator, which can be used to maintain real-time information of network functions and services in the network.

[0109] 4. PCF 133 is the control plane function provided by the operator. It mainly supports providing a unified policy framework to control network behavior, provides policy rules to the control layer network function, and is responsible for obtaining user subscription information related to policy decisions.

[0110] 5. UDM 134 is a control plane function provided by the operator and is responsible for storing information such as the subscriber permanent identifier (SUPI), the generic public subscription identifier (GPSI), and credentials of subscribers in the operator's network.

[0111] 6. UDR 135 is a control plane function provided by the operator. It provides the UDM with the function of saving and retrieving subscription data, the PCF with the function of saving and retrieving policy data, and the user's NF group ID information.

[0112] 7. AF 136 is a control plane function provided by the operator. It mainly provides corresponding services by interacting with other NFs in the PLMN, such as providing roaming UE with visitor network selection information, guiding the routing of data flows, and accessing NEF 131.

[0113] 8. AUSF 137 is a control plane function provided by the operator, and is usually used for level 1 authentication, i.e., authentication between the terminal device 110 (subscriber) and the operator's network.

[0114] 9. AMF 138 is a control plane network function provided by the operator network, responsible for access control and mobility management of the terminal device 110 accessing the operator network, such as mobility status management, allocation of user temporary identity, authentication and authorization of users, etc.

[0115] 10. SMF 139 is a control plane network function provided by the operator network. It is responsible for managing the protocol data unit (PDU) sessions of the terminal device 110 (including session establishment, modification, and release). This function is used for the selection and reselection of user plane function network elements, the allocation of Internet Protocol (IP) addresses for the terminal device, and quality of service (QoS) control. A PDU session is a channel for transmitting PDUs. The terminal device exchanges PDUs with the DN 140 through a PDU session. The SMF network function 139 is responsible for establishing, maintaining, and deleting PDU sessions. The SMF network function 139 includes session management (such as session establishment, modification, and release, including tunnel maintenance between the user plane function (UPF) 130 and the (R)AN 120), selection and control of the UPF network function 130, service and session continuity (SSC) mode selection, roaming, and other session-related functions.

[0116] It is understood that the above network elements or functions can be physical entities in hardware devices, software instances running on dedicated hardware, or virtualized functions instantiated on a shared platform (e.g., a cloud platform). Simply put, an NF can be implemented by hardware or software.

[0117] In Figure 1, Nnef, Nnrf, Npcf, Nudm, Nudr, Naf, Nausf, Namf, Nsmf, N1, N2, N3, N4, and N6 are interface serial numbers. For example, the meaning of the above interface serial numbers can be found in the meaning defined in the 3GPP standard protocol, and this application does not limit the meaning of the above interface serial numbers. It should be noted that the interface name between the various network functions in Figure 1 is only an example. In a specific implementation, the interface name of the system architecture may also be other names, which is not limited by this application. In addition, the name of the message (or signaling) transmitted between the above-mentioned network elements is only an example and does not constitute any limitation on the function of the message itself.

[0118] It should be noted that in the architecture shown in Figure 1, the interface between the (R)AN and CN can also be called the NG interface (not shown in the figure), and the (R)AN and CN are connected via the NG interface. The NG interface can include the NG-C interface and the NG-U interface. The NG-C interface is a control plane interface, connecting the (R)AN and AMF, and is used to transmit control plane data; the NG-U interface is a user plane interface, connecting the (R)AN and UPF, and is used to transmit user plane data.

[0119] It should be understood that the above network architecture 100 is only described from the perspective of a service-based architecture. In this service-based architecture, the PLMN can combine some or all network functions in an orderly manner according to specific scenario requirements, realizing customized network capabilities and services, thereby deploying dedicated networks for different services, that is, realizing 5G network slicing. Network slicing technology enables operators to respond to customer needs more flexibly and quickly, and supports flexible allocation of network resources.

[0120] For ease of explanation, in the embodiments of the present application, network functions (such as NEF 131...SMF 139) are collectively referred to as NFs. That is, the NFs described later in the embodiments of the present application can be replaced by any network function. In addition, in the embodiments of the present application, the session management function SMF 139 is referred to as SMF, and the terminal device 110 is referred to as UE. That is, the SMFs described later in the embodiments of the present application can be replaced by session management functions, and the UE can be replaced by a terminal device. Figure 1 only schematically illustrates some network functions, and the NFs described later are not limited to the network functions shown in Figure 1.

[0121] It should be understood that the AMF, SMF, UPF, NEF, AUSF, NRF, PCF, and UDM shown in Figure 1 can be understood as network elements used to implement different functions in the core network, for example, they can be combined into network slices as needed. These core network network elements can be independent devices or integrated into the same device to implement different functions. This application does not limit the specific form of the above network elements.

[0122] It should also be understood that the above naming is defined only to facilitate the distinction between different functions and should not constitute any limitation to this application. This application does not exclude the possibility of adopting other naming in 5G networks and other future networks. For example, in a 6G network, some or all of the above network elements may continue to use the terminology used in 5G, or may adopt other names.

[0123] Currently, to ensure network security, a primary authentication process is required for terminal devices that access the network. This involves identity verification and authorization. Only after successful authentication can a terminal device access the network.

[0124] Figure 2 is a schematic diagram of a process for a UE to register with a network. As shown in Figure 2, the method 200 includes the following steps. For parts not fully described, please refer to the relevant description of the existing protocol.

[0125] S210, the UE registers with the network.

[0126] Exemplarily, the UE sends an N1 message to the Security Anchor Function (SEAF) to request registration with the network. Optionally, the N1 message may be a registration request message, which carries the UE's Subscription Concealed Identifier (SUCI) or the 5G Globally Unique Temporary Identifier (5G-GUTI). SEAF and AMF are jointly established, and it can be understood that SEAF is part of AMF, that is, the UE can request registration with the network by sending a registration request message to the AMF.

[0127] Correspondingly, after receiving the N1 message from the UE, SEAF can initiate identity authentication to the UE according to local policies during any process of establishing a signaling connection with the UE.

[0128] Exemplarily, when SEAF wants to start authentication of UE, SEAF sends a Nausf_UEAuthentication_Authenticate Request message to AUSF to invoke the Nausf_UEAuthentication service. The message carries the serving network name (SN Name) and SUCI or SUPI. The SN Name is used to bind the anchor key to the serving network through the serving network identifier to ensure that the anchor key is used for secure communication between the UE and the 5G core network. It should be understood that if SEAF receives SUCI from the UE, the message carries SUCI; if SEAF receives 5G-GUTI from the UE, SEAF determines SUPI based on the 5G-GUTI and carries SUPI in the message.

[0129] It should be understood that SUPI consists of a SUPI type and a value. There are four SUPI types: IMSI, NSI (network specific identifier), a Global Line Identifier (GLI), or a Global Cable Identifier (GCI). There are two SUPI value formats: IMSI and NAI. To prevent the user's SUPI from being exposed over the air interface, the SUPI component excluding the SUPI type is typically calculated to produce a result that becomes part of the SUCI.

[0130] Correspondingly, after AUSF receives the Nausf_UEAuthentication_Authenticate Request message from SEAF, AUSF can check whether the SEAF in the service network that makes the authentication request has the right to use the SN Name in the Nausf_UEAuthentication_Authenticate Request by comparing the SN Name carried in the message with the expected SN Name. AUSF can temporarily store the received service network name. If the service network does not have the right to use the SN Name, AUSF sends a Nausf_UEAuthentication_Authenticate Response message to SEAF, which is used to indicate that "the service network is not authorized", that is, SEAF can reject the UE's registration process. If the service network has the right to use the SN Name, AUSF sends a Nudm_UEAuthentication_Get Request message to UDM to request primary authentication of the UE. The message carries SUCI or SUPI, and SN Name.

[0131] Correspondingly, after receiving the Nudm_UEAuthentication_Get Request message from AUSF, if the message carries SUCI, UDM first needs to parse the message to obtain SUPI, and then select an authentication method based on the SUPI, such as the 5G-AKA authentication method or the EAP-AKA' authentication method.

[0132] It should be understood that the current 5G network supports two authentication methods, namely the 5G Authentication and Key Agreement (5G-AKA) authentication method and the Extensible Authentication Protocol-Authentication and Key Agreement (EAP-AKA') authentication method. This application does not limit how UDM selects the authentication method based on SUPI. For example, the implementation method of UDM selecting the authentication method based on the SUPI includes: the operator can configure the authentication method to the contract data, and then the UDM can specify the authentication method after obtaining the UE's SUPI; or, the UDM selects according to the SUPI type in the SUPI. For example, if the SUPI type is IMSI, 5G-AKA is selected. If the SUPI type is NAI, EAP-AKA' is selected.

[0133] S220, UDM executes the main authentication process.

[0134] Exemplarily, UDM sends an authentication vector to AUSF, such as the authentication vector of 5G-AKA or the authentication vector of EAP-AKA', in response to the authentication request message of AUSF, and then performs the main authentication with the UE. The specific authentication implementation method can refer to the relevant description in Chapter 6 of the existing protocol TS 33.501.

[0135] S230, main authentication result confirmation process.

[0136] Exemplarily, an authentication result can be obtained based on the above-mentioned primary authentication of the UE, and then the AUSF and UDM perform the primary authentication result confirmation process.

[0137] In one example, if the above-mentioned UDM selects the EAP-AKA' authentication method to authenticate the UE, after AUSF receives the EAP-Response / AKA'-Challenge message from the UE or SEAF and completes the authentication of the UE, AUSF sends a Nudm_UEAuthentication_ResultConfirmation Request message to the UDM.

[0138] In another example, if the UDM selects the 5G-AKA authentication method to authenticate the UE, after the AUSF receives the Nausf_UEAuthentication_Authenticate Request message from the SEAF and the AUSF successfully authenticates the UE, the AUSF sends a Nudm_UEAuthentication_ResultConfirmation Request message to the UDM.

[0139] The Nudm_UEAuthentication_ResultConfirmation Request message carries the UE's authentication status, including the UE's SUPI, authentication timestamp, authentication result (e.g., authentication success or failure), authentication method (or authentication type (e.g., EAP-AKA' authentication method or 5G-AKA authentication method)), and serving network name (SN Name). Optionally, to prevent fraud, the AUSF may only carry information about successful authentication in the message based on operator policy.

[0140] Correspondingly, the UDM stores the UE's authentication status, including SUPI, authentication timestamp, authentication result, and serving network name (SN Name).

[0141] It should be noted that a UE can register with different AMFs, such as AMF1 and AMF2, using 3GPP and non-3GPP access technologies. This means that AMF1 and AMF2 can provide services to the same UE. Based on the above registration and authentication process, the UDM stores the two authentication results, the identity verification timestamp, and the information of SN Name#1 and SN Name#2. This application does not limit the number of AMFs.

[0142] Furthermore, UDM sends a Nudm_UEAuthentication_ResultConfirmation Response message to AUSF.

[0143] It should be understood that UDM may detect and accept certain types of spoofing attacks based on operator policies. For example, UDM stores the ID and time of the visited network. Optionally, the operator can classify the visited networks: for example, in the first category, AMF needs to send the Nudm_UECM_Registration Request message immediately; in the second category, it only needs to check whether the Nudm_UECM_Registration Request message is received within a short time after the authentication process is completed; in the third category, no check is required. If UDM receives a new Nudm_UECM_Registration Request message, UDM checks whether the new visited network is the same as the previously stored one. If they are the same, the registration request is accepted; if they are different, a rejection request message is sent with a reason value to notify AMF that it needs to send a Nausf_UEAuthentication_Authenticate Request message to AUSF to trigger the main authentication process.

[0144] S240: Optionally, execute a NAS SMC process.

[0145] It should be understood that the NAS SMC procedure is intended to protect the UE registration request from a man-in-the-middle attack, preventing an attacker from modifying the information element IE containing the UE security capabilities provided by the UE in the registration request.

[0146] Exemplarily, the AMF activates NAS integrity protection and sends a NAS security mode command message to the UE. Correspondingly, after receiving the NAS security mode command message from the AMF, the UE needs to verify the NAS security mode command message, including checking whether the UE security functions sent by the AMF match the security functions stored in the UE to ensure that attackers do not modify these functions, and verify the integrity protection using the indicated NAS integrity algorithm and the NAS integrity key of the KAMF indicated by the ngKSI. In addition, after sending the NAS security mode command message, the AMF activates NAS uplink decryption. If the integrity verification of the NAS security mode command message is successful, the UE should start NAS integrity protection and encryption / decryption using the security context indicated by the ngKSI. Further, the UE sends the NAS security mode completion message to the AMF for encryption and integrity protection, and the AMF activates NAS downlink encryption.

[0147] S250, the remaining registration process.

[0148] During the remaining registration process, the AMF may register with the UDM. This process registers the AMF currently serving the UE with the UDM. After receiving the AMF registration information, the UDM stores AMF-related information, such as the AMF ID. It should be noted that a UE can register with different AMFs, such as AMF1 and AMF2, using both 3GPP and non-3GPP access technologies. This means that AMF1 and AMF2 can serve the same UE. The UDM can store information related to multiple AMFs, such as AMF1ID and AMF2ID.

[0149] Exemplarily, SEAF sends a registration response message to the UE to indicate that the UE has successfully registered, and the UE can then request to establish a session to access various services on the data network.

[0150] Figure 3 is a schematic diagram of a home network (eg, a UDM in the home network) initiating a triggering process for primary authentication. As shown in Figure 3, the method 300 includes the following steps. For parts not fully described, please refer to the relevant description of the existing protocol.

[0151] S310, optionally, the UDM pre-configures an operator authentication policy to determine the initiating network to trigger a primary authentication process for the UE.

[0152] S320: When the UDM determines that the home network is initiated to trigger the primary authentication process, it determines the AMF1 that provides services for the UE.

[0153] Exemplarily, the UDM decides to trigger and execute the home network authentication process for the UE based on an event (e.g., SoR / UPU or AAnF request) or authentication policy. For example, the AAnF sends a Nudm_UECM_AuthTrigger request to the UDM, instructing the UDM to perform primary authentication. Correspondingly, the UDM determines to initiate the home network trigger primary authentication process for the UE based on the received event and the pre-configured operator authentication policy, and then the UDM determines the serving AMF / SEAF for the UE.

[0154] Based on the above method 200, it can be known that the UE can register with AMF1 and AMF2 through 3GPP access technology or non-3GPP access technology, indicating that the current UE is served by the AMF1 and AMF2. In other words, the current UE is on AMF1 and AMF2, or in other words, the UE can be found through AMF1 and AMF2. Correspondingly, after the main authentication, the UDM stores the information of AMF1 and AMF2, such as AMF1ID and AMF2ID. That is, the UDM knows that the AMF1 and AMF2 are providing services for the UE, and subsequently when the UDM determines to trigger re-authentication of the UE, it can find the AMF1 and AMF2 serving the UE. For example, the UDM selects AMF1 to re-authenticate the UE according to the operator's authentication policy.

[0155] S330, UDM sends an authentication notification message to AMF1, and correspondingly, AMF1 receives the authentication notification message from UDM.

[0156] The authentication notification message is used to request AMF1 to trigger authentication of the UE, and the authentication notification message includes the UE's SUPI.

[0157] Correspondingly, after receiving the authentication response message from the UDM, AMF1 determines whether to trigger primary authentication of the UE based on the local authentication policy and UE status. If it can be initiated, AMF1 determines to perform primary authentication of the UE.

[0158] S340, AMF1 executes the main authentication process.

[0159] Among them, the specific implementation method of AMF1 performing primary authentication can refer to the relevant description of the above method 200.

[0160] It should be noted that in this application, "authentication" and "authentication" can be replaced. For example, "primary authentication" can be replaced by "primary authentication", and "authentication suspension flag" can be replaced by "authentication suspension flag". For ease of description, the following uniformly uses "authentication, primary authentication, suspension flag, authentication suspension flag", etc.

[0161] Furthermore, AMF1 may send an authentication response message to UDM.

[0162] S350, AMF1 sends an authentication response message to UDM, and correspondingly, UDM receives the authentication response message from AMF1.

[0163] In response to the Authentication Notification message, AMF1 sends an Authentication Response message to the UDM. This message notifies the UDM of the success or failure of the request. If the Authentication Response message does not carry a Failure Cause value, this means that the AMF can perform primary authentication of the UE. This is the process of step S340. If AMF1 is unable to perform the primary authentication process according to step S340, for example, if the UE is unreachable or AMF1 cannot find the UE, the Authentication Response message carries a Failure Cause value, indicating that AMF1 cannot initiate primary authentication of the UE.

[0164] S360, AMF1 sets the suspend flag.

[0165] Exemplarily, if AMF1 determines that it cannot perform primary authentication of the UE, for example, if the UE is unreachable, AMF1 sets Suspend Flag #1 in the UE context. It should be understood that the meaning of Suspend Flag #1 is that when the UE re-registers or accesses the AMF1, or when the UE is reachable, AMF1 first needs to perform primary authentication of the UE according to the locally set Suspend Flag.

[0166] It should be understood that if the above-mentioned AMF1 sends an authentication response message to the UDM to indicate that AMF1 cannot start the primary authentication for the UE, then the UDM can check whether there are other AMFs providing services to the UE, for example, determining AMF2 through the locally stored AMF2ID. At this time, the UDM will send an authentication notification message to AMF2 to request AMF2 to perform the primary authentication for the UE. For the specific implementation method, please refer to the above-mentioned relevant description. If AMF2 is also unable to start the primary authentication for the UE, AMF2 sends an authentication response message to the UDM, carrying a failure reason value, to indicate that AMF2 cannot start the primary authentication process for the UE. In addition, AMF2 can set the suspension flag #2 in the UE context. At this time, since both AMF1 and AMF2 cannot start the primary authentication for the UE, AMF1 and AMF2 are locally set with a suspension flag.

[0167] Optionally, when the UE re-accesses or registers with AMF1 or when the UE is reachable, AMF1 checks that the suspend flag #1 is set locally and sends a re-authentication request to the UDM through AUSF. If the UE re-authentication is completed, or the AMF determines to execute the main authentication process, AMF1 cancels (deletes or resets) the suspend flag #1. When the UE accesses a new AMF3 (for example, in a mobile scenario), AMF3 can retrieve the UE context from the original AMF1 or AMF2, determine the UE's suspend flag, and execute the re-authentication process.

[0168] It should be noted that the execution order of step S340, step S350 and the steps is not limited.

[0169] Considering that both AMF1 and AMF2 are locally set with suspension flags, when the UE accesses AMF1 and AMF2 again, AMF1 and AMF2 will trigger the main authentication process of the UE based on their respective suspension flags. Since the two suspension flags are set by the same UDM request, and the UDM essentially only needs to authenticate the UE once, the two main authentications of the UE are unnecessary, resulting in unnecessary signaling overhead.

[0170] In view of this, the present application provides a communication method and a communication device, in which the hometown network element determines, based on the received second authentication response message, that the second mobility management function network element can initiate the main authentication of the terminal device, and then sends a first notification message to the first mobility management function network element serving the terminal device, for notifying the first mobility management function network element to delete or reset the suspension flag, or to notify the first mobility management function network element to cancel or terminate the hometown network's execution of the main authentication process, thereby avoiding subsequent triggering of the re-authentication process for the terminal device and reducing signaling overhead.

[0171] The communication method provided by the embodiment of the present application will be described in detail below with reference to the accompanying drawings. The embodiment provided by the present application can be applied to any communication scenario in which a transmitting device and a receiving device communicate, for example, it can be applied to the communication system shown in Figure 1 above. The present application proposes the following methods shown in Figures 4 to 7. It should be understood that the method embodiments shown in Figures 4 to 7 can be combined with each other, and the steps in the method embodiments shown in Figures 4 to 7 can be referenced to each other. For example, in the embodiment of the present application, the method embodiments shown in Figures 5 to 7 can be regarded as possible implementation methods for implementing the functions of the method embodiment shown in Figure 4. Figure 6 mainly illustrates that after the UDM knows that the current UE can perform primary authentication at AMF1, after receiving the authentication request initiated by the AMF2 serving the UE, it rejects the authentication request of the AMF2. Figure 7 mainly illustrates that after the UDM knows that the UE can perform primary authentication at AMF1, it sends a cancel suspension flag to other AMF2s that have not triggered the authentication request based on the information of multiple AMFs serving the UE stored locally to avoid triggering redundant authentication processes.

[0172] Figure 4 is a flow chart of a communication method 400 provided in an embodiment of the present application. As shown in Figure 4, the method flow can be executed by the home network element, the first mobility management function network element, and the second mobility management function network element, or by modules and / or devices (for example, chips or integrated circuits, etc.) with corresponding functions installed in the home network element, the first mobility management function network element, and the second mobility management function network element, and this application does not limit this. For ease of description, the following description is based on the home network element, the first mobility management function network element, and the second mobility management function network element as the execution entities. The method includes the following multiple steps. For parts not fully described, please refer to the relevant description of the existing protocol.

[0173] S410: When the terminal device registers with the network through the first mobility management function network element and the second mobility management function network element respectively, the home network element stores the identifier of the first mobility management function network element and the identifier of the second mobility management function network element.

[0174] In one implementation, the terminal device accesses the first mobility management function network element and the second mobility management function network element through 3GPP access technology and non-3GPP access technology respectively to register with the network. For specific implementation, reference may be made to the relevant description of the above method 200. During the process of registering with the network through the first mobility management function network element and the second mobility management function network element respectively and performing the authentication process, the first mobility management function network element and the second mobility management function network element may use the same or different authentication server function network elements.

[0175] S420, when it is determined that the terminal device needs to be authenticated, the home network element sends a first authentication notification message to the first mobility management function network element, where the first authentication notification message is used to request triggering of the primary authentication of the terminal device.

[0176] Among them, the specific implementation of the hometown network element determining that the terminal device needs to be authenticated by the master can refer to the relevant description of step S320 of the above method 300.

[0177] Exemplarily, the first authentication notification message includes an identifier of the terminal device, such as a SUPI. It should be understood that the embodiments of the present application do not limit how the home network element prioritizes the first mobility management function network element to initiate the authentication request when both the first mobility management function network element and the second mobility management function network element are stored in the home network element.

[0178] S430: The first mobility management function network element determines that the primary authentication of the terminal device cannot be started.

[0179] Among them, the inability to start the main authentication of the terminal device can be understood as the terminal device is unreachable, or the first mobility management function network element cannot find the terminal device.

[0180] Exemplarily, after receiving the first authentication notification message, the first mobility management function network element determines whether to trigger primary authentication of the terminal device based on the local authentication policy and the status of the terminal device. For example, if the first mobility management function network element finds that the terminal device is unreachable, or the first mobility management function network element fails to find the terminal device, the first mobility management function network element sends a first authentication response message to the home network element.

[0181] S440, the home network element receives a first authentication response message from the first mobility management function network element, where the first authentication response message is used to indicate that the first mobility management function network element cannot initiate primary authentication for the terminal device.

[0182] Exemplarily, the first authentication response message includes a first cause value, and the first cause value is used to indicate that the first mobility management function network element cannot initiate primary authentication of the terminal device. For example, the failure cause value may indicate that the primary authentication of the terminal device failed to be initiated, or the failure cause value may indicate that the terminal device is unreachable. This embodiment does not limit the definition and value-taking method of the failure cause value.

[0183] Optionally, the hometown network element may set a first authentication suspension flag according to the first reason value. The first authentication suspension flag is used to indicate that a first suspension flag is set on the first mobility management function network element. For example, the hometown network element may know that the terminal device is unreachable according to the first reason value, or know that the first mobility management function network element has failed to start the main authentication of the terminal device, and then set the first authentication suspension flag, and may associate the first authentication suspension flag with the first mobility management function network element, for example, by associating the first authentication suspension flag with one or more of the AMF1ID, the service network where the first mobility management function network element is located, and the PLMN ID corresponding to the first mobility management function network element. For specific implementation methods, please refer to the relevant description of method 500.

[0184] Optionally, the home network element sets the first authentication suspension flag only when it receives a specific failure cause value. For example, when the failure cause value received by the home network element indicates that the terminal device is reachable, the home network element sets the first authentication suspension flag.

[0185] It should be understood that the hometown network element sets the first authentication suspension flag according to the first cause value, which can be executed explicitly or implicitly. For example, the first authentication suspension flag can be indicated by a bit, such as 1 represents that the authentication suspension flag is valid, and 0 represents that the authentication suspension flag is invalid. In the case where it is determined that the first mobility management function network element cannot start the main authentication of the terminal device, the hometown network element can change the first authentication suspension flag from 0 to 1. For another example, the first authentication suspension flag represents validity when it appears, and represents invalidity when it does not appear. In the case where it is determined that the first mobility management function network element cannot start the main authentication of the terminal device, the hometown network element stores the association relationship between the first authentication suspension flag, the first mobility management function network element, and the terminal device.

[0186] S450: The first mobility management function network element sets a first suspension flag.

[0187] Exemplarily, if the first mobility management function network element confirms that the primary authentication of the terminal device cannot be started, a first pending flag is set in the context of the terminal device.

[0188] It should be understood that the first suspension flag is used to indicate that when the terminal device re-registers with the network through the first mobility management function network element, or the terminal device is reachable, the first mobility management function network element determines to authenticate the terminal device based on the locally set first suspension flag.

[0189] It should be noted that this application does not limit the order in which the above steps S440 and S450 are executed.

[0190] S460, in response to the first authentication response message, the home network element sends a second authentication notification message to the second mobility management function network element, where the second authentication notification message is used to request triggering of a primary authentication of the terminal device.

[0191] Exemplarily, the hometown network element first determines whether there are multiple mobility management function network elements serving the terminal device. Based on the above scheme, it can be known that there are two mobility management function network elements. Then, when it is determined that a second mobility management function network element also provides services for the terminal device, the hometown network element continues to execute the hometown network trigger main authentication process and executes step S460.

[0192] S470: The home network element receives a second authentication response message from the second mobility management function network element.

[0193] Among them, the second authentication response message is used to indicate whether the second mobility management function network element performs the main authentication process for the UE. In other words, the second authentication response message can be used by the hometown network element to determine whether the second mobility management function network element can or cannot perform the main authentication for the terminal. For example, if it is determined that the main authentication can be performed on the terminal, the following steps S480 and S490 are executed; if it is determined that the main authentication cannot be performed on the terminal, the hometown network element can locally set the second authentication suspension flag, which means that the two mobility management function network elements serving the terminal device are unable to perform the main authentication for the terminal device, and both mobility management function network elements have set the suspension flag locally, which specifically corresponds to branch two of the following method 500. The specific implementation method can refer to the relevant descriptions of methods 500 to 700, which will not be explained here.

[0194] Exemplarily, in step S460, the second mobility management function network element decides whether to execute the main authentication process for the terminal device based on the local authentication policy and the status of the terminal device. For the specific implementation method, please refer to the relevant description of the above method 300. If the second mobility management function network element cannot start the main authentication of the terminal device, the second authentication response message carries a rejection reason value to indicate that the main authentication of the UE has failed, or indicates that the terminal device is unreachable. If the second authentication response message can start the main authentication of the terminal device, the second authentication response message does not carry a rejection reason value, which is used to inform the home network element that the second authentication notification message has been received.

[0195] It is understandable that determining that the second mobility management function network element is capable of performing primary authentication on the terminal includes any of the following situations: the second authentication response message carries a response message to the second authentication notification message; or the second authentication response message does not carry a second cause value, the second cause value being used to indicate that the second mobility management function network element cannot initiate primary authentication on the terminal device; or after the second mobility management function network element successfully performs primary authentication on the terminal device, or while the second mobility management function network element is performing primary authentication on the terminal device. In other words, this application does not specifically limit the timing of sending the first notification message.

[0196] S480: When it is determined according to the second authentication response message that the second mobility management function network element can initiate primary authentication for the terminal, the home network element sends a first notification message to the first mobility management function network element.

[0197] Among them, the first notification message itself has an indicative function, or carries a reason value with an indicative function, that is, it is used to instruct the first mobility management function network element to cancel the first suspension flag, and the first suspension flag is used to indicate that the main authentication of the terminal device needs to be triggered; or, the first notification message is used to instruct the first mobility management function network element to cancel or terminate the home network to execute the main authentication process.

[0198] Canceling the first suspend flag can be understood as invalidating the first suspend flag. If the first suspend flag is indicated by a bit, such as 1 representing that the first suspend flag is valid and 0 representing that the first suspend flag is invalid, the first mobility management function network element changes the first suspend flag from 1 to 0; or, if the first suspend flag exists to indicate validity and no longer exists to indicate invalidity, the first mobility management function network element deletes the first suspend flag, etc.

[0199] In an embodiment of the present application, there are multiple ways to implement the first notification message. For example, the first notification message may be an authentication notification message carrying a reason value, or a first notification message carrying a reason value, or a first notification message not carrying a reason value. The reason value may be used to indicate that the second mobility management function network element has performed primary authentication on the terminal device, or to indicate that the primary authentication of the terminal device is in progress, or to indicate that the primary authentication of the terminal device is successful, or to instruct the first mobility management function network element to delete the first suspension flag, or to instruct the first mobility management function network element to no longer trigger the primary authentication process for the terminal device due to the locally set first suspension flag, that is, to instruct the first mobility management function network element to cancel or terminate the execution of the primary authentication process by the home network.

[0200] Exemplarily, the hometown network element may determine that the second mobility management function network element is capable of executing the main authentication process for the terminal device after receiving the second authentication response message that does not carry a failure reason value. Furthermore, the hometown network element determines whether to send a first notification message to the first mobility management function network element. For example, the hometown network element determines whether a first mobility management function network element exists, and if so, further determines whether to send a first notification message to the first mobility management function network element that is determined to exist. In other words, the hometown network element may first determine whether a first mobility management function network element exists, and then determine whether it is necessary to send the first notification message, or it may first determine whether it is necessary to send the first notification message, and then determine whether it is necessary to exist. This application does not limit this.

[0201] For example, when it is determined that a first notification message needs to be sent, the first notification message can be sent to notify the cancellation or termination of the execution of the home network triggered main authentication process, or to notify that the suspension flag set at the first mobility management function network element can be canceled.

[0202] For example, if there is no need to send the first notification message, the judgment action may not be performed. The home network element may determine whether to send the first notification message to the first mobility management function network element based on a local pre-configuration policy; or the home network element may determine whether to send the first notification message to the first mobility management function network element based on whether a first authentication suspension flag corresponding to the first mobility management function network element is set locally; or the home network element determines to send the first notification message to the first mobility management function network element based on a locally stored identifier of the first mobility management function network element.

[0203] S450: The first mobility management function network element deletes the first suspension flag, or cancels or terminates the home network's execution of the main authentication process.

[0204] Exemplarily, the first mobility management function network element cancels (e.g., deletes or resets) the first suspension flag, or determines to cancel or terminate the request to the home network to execute the main authentication process based on the first notification message itself or the reason value carried in the first notification message.

[0205] Canceling the first suspend flag can be understood as invalidating the first suspend flag. If the first suspend flag is indicated by a bit, such as 1 representing that the first suspend flag is valid and 0 representing that the first suspend flag is invalid, the first mobility management function network element changes the first suspend flag from 1 to 0; or, if the first suspend flag exists to indicate validity and no longer exists to indicate invalidity, the first mobility management function network element deletes the first suspend flag, etc.

[0206] The solution provided by the present application is that the hometown network element determines that the second mobility management function network element can initiate the main authentication of the terminal device based on the received second authentication response message, and then can send a notification message to other first mobility management function network elements serving the terminal device to notify the first mobility management function network element to delete or reset the suspension flag, or cancel or terminate the hometown network's execution of the main authentication process, so as to avoid subsequent triggering of the re-authentication process of the terminal device and reduce signaling overhead.

[0207] Figure 5 is a flow chart of a communication method 500 provided in an embodiment of the present application. As shown in Figure 5, the method flow can be executed by a home network element (such as UDM), AMF1, AMF2, an authentication server function network element (such as AUSF), a terminal device (such as UE), or by a module and / or device (such as a chip or integrated circuit, etc.) with corresponding functions installed in UDM, AMF1, AMF2, AUSF, or UE, which is not limited by the present application. For ease of description, the following description is based on UDM, AMF1, AMF2, AUSF, and UE as the execution subjects. The method includes the following multiple steps. For the parts not described in detail, please refer to the relevant description of the existing protocol.

[0208] S501, UE registers to the network through AMF1.

[0209] S502, the UE registers with the network through AMF2.

[0210] Exemplarily, the UE accesses AMF1 and AMF2 through 3GPP access technology and non-3GPP access technology respectively to register with the network. For specific implementation methods, please refer to the relevant description of the above method 200. In the process of registering with the network through AMF1 and AMF2 respectively and performing the authentication process, AMF1 and AMF2 can use the same AUSF or different AUSFs.

[0211] It should be understood that the UE registers with the network through AMF1 or AMF2, which means that the UE has a registration process with AMF1 or AMF2. After the UE is successfully registered, AMF1 or AMF2 has the context information of the UE.

[0212] S503: UDM stores information of AMF1 and AMF2.

[0213] Exemplarily, when the UE is registered with AMF1 and AMF2, the UDM stores the AMF1ID and AMF2ID. The AMF ID can be implemented in a variety of ways, such as the PLMN ID where the AMF is located or the serving PLMN ID. For example, the AMF ID is a globally unique AMF identifier (GUAMI).

[0214] S504: UDM determines to initiate a home network to trigger a primary authentication process.

[0215] For specific implementation, please refer to the relevant description of step S320 of the above method 300.

[0216] S505: The UDM sends a first authentication notification message to AMF1. In response, AMF1 receives the first authentication notification message from the UDM. The first authentication notification message is used to request triggering the third primary authentication procedure for the UE. The first authentication notification message includes the UE's SUPI.

[0217] Exemplarily, the UDM initiates the home network to trigger the primary authentication process based on the operator's authentication policy, and selects AMF1 to trigger the primary authentication process. The UDM then sends a first authentication notification message to AMF1. The embodiment of the present application does not limit how the UDM prioritizes AMF1 when both AMF1 and AMF2 are stored.

[0218] S506, AMF1 sends a first authentication response message to UDM, and correspondingly, UDM receives the first authentication response message from AMF1.

[0219] The first authentication response message carries a failure cause value, which is used to indicate that AMF1 cannot start the primary authentication of the UE.

[0220] Exemplarily, after receiving the first authentication notification message, AMF1 determines whether to trigger the primary authentication of the UE based on the local authentication policy and the UE status. For example, if AMF1 finds that the UE is unreachable, or AMF1 fails to find the UE, AMF1 sends a first authentication response message to the UDM and carries a failure cause value in the first authentication response message. The failure cause value is used to indicate that AMF1 cannot start the primary authentication of the UE. For example, the failure cause value may indicate that the primary authentication of the UE has failed to start, or the failure cause value may indicate that the UE is unreachable. This embodiment does not limit the definition and value-taking method of the failure cause value.

[0221] S507, AMF1 sets a first pending flag (eg, pending flag).

[0222] Exemplarily, if the AMF1 confirms that it cannot start the primary authentication process for the UE, a first suspension flag is set in the UE context. It should be understood that the first suspension flag is used to indicate that when the UE re-registers or accesses the network through the AMF1, or when the UE is reachable, the AMF1 determines to authenticate the UE based on the locally set first suspension flag.

[0223] It should be noted that this application does not limit the order in which the above steps S506 and S507 are executed.

[0224] S508, optionally, the UDM sets a first authentication suspension flag.

[0225] This step can be performed explicitly or implicitly.

[0226] Exemplarily, the UDM can determine that the primary authentication startup of the UE has failed based on the failure cause value in the first authentication response message of AMF1. For example, the failure cause value can indicate that the UE is unreachable, or that AMF1 has not found the UE and cannot start the primary authentication process for the UE. Correspondingly, after obtaining the failure cause value, the UDM sets a first authentication suspension flag based on the failure cause value, and can associate the first authentication suspension flag with AMF1. The first authentication suspension flag is used to indicate that the UDM has requested AMF1 to trigger the primary authentication process, and AMF1 sets the first suspension flag because it cannot start the primary authentication process for the UE, or in other words, the first authentication suspension flag is used to indicate that AMF1 cannot start the primary authentication process for the UE, or in other words, the first authentication suspension flag is used to indicate that the first suspension flag is set on the first mobility management function network element, or in other words, the first authentication suspension flag is used to indicate that the UE is unreachable, or that AMF1 has not found the UE, etc. This application does not limit this.

[0227] It should be understood that setting the first authentication suspension flag facilitates the subsequent UDM to determine that the associated AMF1 has the first suspension flag set and that the AMF1 has not yet executed the main authentication process for the UE. Optionally, further, the UDM will only set the first authentication suspension flag when it receives a specific failure cause value. For example, when the failure cause value received by the UDM indicates that the UE is unreachable, the UDM sets the first authentication suspension flag. There are multiple ways to associate the first authentication suspension flag with the AMF1, such as the UDM associating and storing the first authentication suspension flag with the AMF1ID; for another example, the UDM associating and storing the first authentication suspension flag with the first serving network name SN Name#1 corresponding to the AMF1ID; for another example, the UDM associating and storing the first authentication suspension flag with the PLMN ID#1 corresponding to the AMF1ID; for another example, the UDM associating and storing the first authentication suspension flag with at least two parameters among the AMF1ID, SN Name#1, and the PLMN ID#1 corresponding to the AMF1ID.

[0228] For example, if the first authentication suspension flag is explicitly stored, the first authentication suspension flag can be indicated using a bit, for example, 1 represents that the authentication suspension flag is valid, and 0 represents that the authentication suspension flag is invalid. Then, when it is determined that AMF1 triggers the main authentication for the UE, the UDM can change the first authentication suspension flag from 1 to 0.

[0229] For example, if the first authentication suspension flag is implicitly stored, the first authentication suspension flag represents validity when it appears, and represents invalidity when it does not appear. In the case of determining that AMF1 triggers the main authentication of the UE, the UDM can delete the first authentication suspension flag.

[0230] It should be understood that the above-mentioned manner of associating the first authentication suspension flag with AMF1 and the manifestation of the authentication suspension flag are merely examples, and this application does not make any specific limitations on this.

[0231] For example, if the first authentication suspension flag is explicitly stored, the UDM can subsequently check whether there is another AMF serving the UE. If another AMF is determined to exist, since the UDM knows that there are two AMFs serving the UE, the UDM can request another AMF serving the UE, such as AMF2, to perform the primary authentication procedure if it determines that the primary authentication initiation for AMF1 has failed. In this case, the UDM needs to implicitly record or be aware that the home network triggered primary authentication procedure has been executed through AMF1 and that the failure cause value has been received from AMF1.

[0232] S509: The UDM sends a second authentication notification message to the AMF2. In response, the AMF2 receives the second authentication notification message from the UDM. The second authentication notification message is used to request triggering the fourth primary authentication process for the UE. The second authentication notification message includes the UE's SUPI.

[0233] Exemplarily, as described in step S508, when the UDM determines that AMF2 also provides services for the UE, the UDM continues to execute the home network triggering main authentication process and determines to initiate a request to AMF2.

[0234] S510, AMF2 sends a second authentication response message to UDM, and correspondingly, UDM receives the second authentication response message from AMF2.

[0235] The second authentication response message is used to indicate whether AMF2 executes the primary authentication process for the UE. Exemplarily, AMF2 decides whether to execute the primary authentication process for the UE based on the local authentication policy and the UE status. For the specific implementation method, please refer to the relevant description of the above method 300. If AMF2 cannot perform the primary authentication for the UE, the second authentication response message carries a rejection reason value to indicate that the primary authentication of the UE has failed. If AMF2 can perform the primary authentication for the UE, the second authentication response message does not carry a rejection reason value, which is used to inform the UDM that the second authentication notification message has been received.

[0236] Based on the above solution, the current AMF1 cannot execute the main authentication process for the UE, and the AMF1 is locally set with a first suspension flag. Optionally, the UDM is locally set with a first authentication suspension flag.

[0237] In combination with branches 1 and 2, the following specifically describes whether AMF2 can perform the primary authentication process for the UE, how UDM determines which AMF the primary authentication process comes from, and which AMF to notify to cancel the suspension flag. In other words, how UDM determines the AMF that is currently serving the UE.

[0238] Branch 1: AMF2 can initiate the main authentication process for the UE.

[0239] S511, UDM sends a first notification message to AMF1, and correspondingly, AMF1 receives the first notification message from UDM.

[0240] Before executing step S511, the UDM receives the S510 message, and the second authentication response message in step S510 is used to notify the user of the receipt of the second authentication notification message. Accordingly, after receiving the second authentication response message, the UDM determines that AMF2 can perform the primary authentication process for the UE.

[0241] Furthermore, the UDM optionally determines whether to send a notification message to another AMF. For example, the UDM determines whether another AMF exists, and if so, further determines whether to send a notification message to the confirmed AMF. That is, the UDM may first determine whether another AMF exists and then determine whether to send a notification message, or it may first determine whether to send a notification message and then determine whether another AMF exists. If sending a notification message is necessary, the notification message may be sent to notify the cancellation or termination of the home network-triggered primary authentication process, or to notify the cancellation of the pending flag set at the AMF. If sending a notification message is not necessary, this determination may not be performed. The UDM may determine whether to send a notification message to the confirmed AMF based on a local preconfigured policy. The preconfigured policy may be a local policy preconfigured by the operator or implemented as a product code. This embodiment does not specifically limit the preconfigured policy. Alternatively, the UDM may determine whether to send a notification message to another AMF based on whether the authentication pending flag of the other AMF is locally set; or the UDM may determine whether to send a notification message to another AMF based on a locally stored ID of another AMF serving the UE.

[0242] In this embodiment, the UDM determines whether it needs to send a notification message to the AMF1. For example, if the UDM determines that there is still AMF1 that can serve the UE, then the UDM further determines whether the first authentication suspension flag is explicitly stored locally, or implicitly knows that the home network triggered main authentication process has been executed through AMF1 and the failure cause value has been received from AMF1. If there is a first authentication suspension flag, or if it is known that the failure cause value has been received from AMF1, the UDM sends a first notification message to the AMF1. The first notification message is used to indicate the cancellation or termination of the execution of the home network triggered main authentication process, or to notify that the suspension flag set at the AMF can be canceled.

[0243] Optionally, the first notification message itself has an indicative function, or carries a cause value that has an indicative function. That is to say, there are multiple ways to implement the first notification message. For example, the first notification message can be an authentication notification message carrying a cause value, or a first notification message carrying a cause value, or a first notification message not carrying a cause value. The cause value can be used to indicate that AMF2 has performed primary authentication on the UE, or to indicate that primary authentication of the UE is in progress, or to indicate that the primary authentication of the UE is successful, or to instruct AMF1 to delete the first suspension flag, or to instruct AMF1 not to request primary authentication of the UE due to the locally set first suspension flag.

[0244] S512a, AMF1 cancels the first suspension flag.

[0245] Exemplarily, after receiving the first notification message, AMF1 cancels the first suspension flag according to the first notification message, for example, according to the first notification message itself or a cause value carried in the first notification message.

[0246] Among them, canceling the first suspend flag can be understood as invalidating the first suspend flag. If the first suspend flag is indicated by a bit, such as 1 representing the first suspend flag is valid and 0 representing the first suspend flag is invalid, then AMF1 changes the first suspend flag from 1 to 0; or, if the first suspend flag exists, indicating validity, and no longer exists, indicating invalidity, then AMF1 deletes the first suspend flag.

[0247] S512b, optionally, the UDM cancels the first authentication suspension flag.

[0248] Among them, canceling the first authentication suspension flag can be understood as invalidating the first authentication suspension flag. If the first authentication suspension flag is indicated by a bit, for example, 1 represents the first authentication suspension flag is valid and 0 represents the first authentication suspension flag is invalid, then the UDM changes the first authentication suspension flag corresponding to AMF1 from 1 to 0; or, if the first authentication suspension flag exists, indicating validity, and no longer exists, indicating invalidity, then the UDM deletes the first authentication suspension flag corresponding to AMF1.

[0249] For example, if the UDM locally sets the first authentication pending flag after receiving the message from AMF1 indicating that UE authentication failed in step S508, the UDM may delete the previously set first authentication pending flag after determining that AMF2 can perform the primary authentication process on the UE. For example, after receiving the second authentication response message, where the second authentication response message does not carry a failure cause value; or after determining that UE authentication was successful; or during the execution of the UE authentication process. This embodiment does not limit the specific timing for canceling the first authentication pending flag.

[0250] It should be noted that step S512b can be performed before step S511, during step S511, or after step S511 and before step S512.

[0251] That is to say, based on the above scheme, after UDM determines that AMF2 serving the UE triggers the main authentication of the UE, it can send a notification message to AMF1 based on the stored information of AMF1 and AMF2 serving the UE, so as to avoid AMF1 triggering re-authentication of the UE due to the first suspension flag set locally when the UE accesses AMF1 again, thereby reducing unnecessary UE authentication processes and reducing signaling overhead.

[0252] Branch 2: AMF2 cannot start the main authentication process for the UE.

[0253] S513, AMF2 sets a second pending flag (eg, pending flag).

[0254] For specific implementation, please refer to the description of step S507.

[0255] Accordingly, the second authentication response message in step S510 carries the rejection reason value. At this time, the specific implementation of step S510 can refer to the description of step S506. S514, optionally, the UDM sets the second authentication suspension flag.

[0256] For specific implementation, please refer to the description of step S508.

[0257] Based on the above scheme, neither AMF1 nor AMF2 serving the UE triggers authentication of the UE, and AMF1 is locally set with a first suspension flag, and AMF2 is locally set with a second suspension flag. Optionally, the UDM is locally set with a first authentication suspension flag and a second authentication suspension flag.

[0258] It should be understood that since AMF2 is locally set with a second suspension flag, when the UE accesses AMF2 again, AMF2 triggers authentication of the UE based on the second suspension flag.

[0259] S515, the UE sends a first registration request message to AMF2, and correspondingly, AMF2 receives the first registration request message from the UE.

[0260] The first registration request message carries the UE's 5G-GUTI.

[0261] S516, AMF2 determines to trigger the main authentication process based on the second suspension flag.

[0262] Exemplarily, when AMF2 locally checks and finds that there is a second suspension flag on AMF2, AMF2 needs to trigger the main authentication process, that is, execute the following step S517.

[0263] It should be noted that the above steps S515 and S516 are for describing the process in which the UE accesses the network again through AMF2, and then AMF2 triggers the main authentication according to the second suspension flag. Optionally, the UE can also send a registration request to other AMFs in the operator network where AMF2 is located, such as AMF4, that is, request access to the network through AMF4. It should be understood that when the UE initiates a registration request to AMF4, AMF4 will obtain the second suspension flag from AMF2 and trigger the main authentication process for the UE based on the second suspension flag, so the second suspension flag will be used by AMF4. In other words, this embodiment does not limit the UE to access the network through AMF2 again after failing to access the network through AMF2, and can also access the network through other AMF4 in the operator network where AMF2 is located. For the sake of ease of description, the embodiment of the present application takes the UE accessing the network through the same AMF, namely AMF2, as an example. It should be understood that if the UE fails to access the network through AMF2 and requests to access the network through AMF4, AMF4 can obtain relevant parameters in the UE context on AMF2, such as the second suspension flag, and trigger the primary authentication of the UE. The specific implementation method is similar to the way AMF2 triggers the primary authentication, which will not be repeated here.

[0264] S517, AMF2 sends a first authentication request message to AUSF, and correspondingly, AUSF receives the first authentication request message from AMF2.

[0265] Exemplarily, AMF2 selects an AUSF and sends a Nausf_UEAuthentication_Authenticate Request message to the AUSF. For specific implementation methods, please refer to the relevant description of step S210 of the above method 200.

[0266] The first authentication request message is used to request a first primary authentication for the UE. The first authentication request message includes the UE's SUPI and the second serving network name, SN Name#2. For SN Name#2, reference is made to the description of step S210 of method 200. It should be noted that if the UE accesses AMF4, the first authentication request message may still use SN Name#2; or the first authentication request message may use SN Name#4, but SN Name#4 may be associated with SN Name#2. For example, SN Name#4 and SN Name#2 have the same PLMN ID.

[0267] Exemplarily, the first authentication request message may be a Nausf_UEAuthentication_GetRequest message.

[0268] Optionally, the first authentication request message may also carry a cause value to inform the UDM that the primary authentication process is initiated in response to the second suspension flag set locally by AMF2. It should be understood that the cause value is optional and may not need to be carried in the first authentication request message to reduce changes to existing standards. If the first authentication request message carries the cause value, the UDM will be aware that the reason for triggering the primary authentication process is the presence of the second suspension flag, indicating that the primary authentication process is an authentication process initiated by AMF2 in response to the UDM's previous authentication notification request.

[0269] Optionally, before sending the first authentication request message, AMF2 may further determine whether there are other factors that trigger the primary authentication process. If so, it means that the initiation of the primary authentication process is not solely due to the second suspension flag. In this case, the first authentication request message may not carry a cause value. If not, the first authentication request message may carry the cause value.

[0270] S518: The AUSF sends a second authentication request message to the UDM. The UDM receives the second authentication request message from the AUSF. The second authentication request message is used to request an authentication vector from the UDM. The authentication vector is used to perform primary authentication of the UE. The second authentication request message includes the UE's SUPI and SN Name#2.

[0271] Exemplarily, the second authentication request message may be a Nudm_UEAuthentication_GetRequest message.

[0272] Optionally, if a reason value is carried in step S517, a reason value may also be carried in step S518.

[0273] S519, UDM determines that the first primary authentication comes from AMF2 based on SN Name#2.

[0274] Optionally, after determining that the first primary authentication comes from AMF2, it can further determine whether primary authentication needs to be performed on the UE, that is, whether the UDM needs to select an authentication method and send an authentication vector to the AUSF for primary authentication of the UE. If the UDM determines that neither AMF1 nor AMF2 has authenticated the UE, it executes the following steps S520 to S522. There are multiple ways for the UDM to determine that neither AMF1 nor AMF2 has authenticated the UE, such as through an explicit authentication suspension flag or through implicit internal judgment logic. When using the authentication suspension flag, optionally, if the UDM sets a second authentication suspension flag in step S514 above, then after the UDM receives the second authentication request message, the UDM sets the second authentication suspension flag corresponding to AMF2 to invalid. For example, after the UDM determines that the authentication request comes from AMF2 and determines that AMF2 performs primary authentication, the UDM cancels the second authentication suspension flag. Canceling the second authentication suspension flag can be understood as invalidating the second authentication suspension flag. If the second authentication suspension flag uses a bit indication, for example, 1 represents that the second authentication suspension flag is valid, and 0 represents that the second authentication suspension flag is invalid, then UDM changes the second authentication suspension flag corresponding to AMF2 from 1 to 0; or, if the second authentication suspension flag exists to indicate validity, and no longer exists to indicate invalidity, then UDM deletes the second authentication suspension flag corresponding to AMF2.

[0275] Exemplarily, when the cause value is carried in S519, the UDM needs to determine which AMF the authentication request comes from. For example, the UDM can determine that the authentication request comes from AMF2 based on the SN Name#2 carried in the second authentication request message. For example, if the UDM locally stores the correspondence between SN Name and AMF, the UDM can determine the corresponding AMF2 based on the SN Name#2 carried in the second authentication request message and the correspondence between SN Name#2 and AMF2 stored locally, and further determine that the authentication request comes from AMF2. For another example, if the UDM locally stores the correspondence between PLMN ID and AMF, the UDM can determine the AMF2 corresponding to PLMN ID#2 based on the PLMN ID#2 in SN Name#2 and the correspondence between PLMN ID#2 and AMF2 stored locally, and further determine that the authentication request comes from AMF2. For another example, if the UDM only stores the AMF ID locally and does not store the SN Name or PLMN ID information corresponding to the AMF, the UDM can determine it based on the information in the AMF ID and the information in SN Name#2. For example, if both the AMF ID and SN Name#2 contain PLMN ID#2, the UDM can determine that the authentication request comes from AMF2 based on the same PLMN ID#2.

[0276] Optionally, if the UE accesses AMF4, assuming that the authentication request message sent by AMF4 carries SN Name#2, the UDM can determine that the authentication request comes from AMF2 based on SN Name#2 carried in the authentication request message. Assuming that the authentication request message sent by AMF4 carries SN Name#4, the UDM can further determine that the authentication request comes from AMF2 based on SN Name#4 carried in the authentication request message. This is because in steps S516 and S517 above, SN Name#4 is associated with SN Name#2, or in other words, SN Name#4 and SN Name#2 have the same PLMN ID. Therefore, after receiving SN Name#4, the UDM can determine that the authentication request comes from AMF2 based on SN Name#2 determined from SN Name#4. Alternatively, the UDM can determine the corresponding SN Name#2 based on the PLMN ID in SN Name#4 and determine that the authentication request comes from AMF2. Alternatively, the UDM can match the PLMN ID in SN Name#4 with the PLMN in the locally stored AMF2ID to determine that the authentication request comes from AMF2, etc.

[0277] It should be understood that if the UE registers with AMF1 and AMF2 at the same time, then AMF1 and AMF2 will initiate authentication of the UE at the same time. At this time, after determining which AMF the authentication occurs in, UDM can suspend processing of the other AMF, or UDM can reject the authentication request of another AMF (for example, AMF1 requests UDM to execute the main authentication process through AUSF, then UDM can reject AMF2's authentication request after receiving the authentication result sent by AUSF, or UDM directly rejects AMF2's authentication request after receiving the authentication request from AUSF), or continue to execute the authentication request of another AMF (for example, UDM executes AMF2's authentication request after receiving the authentication result sent by AUSF). This application does not limit this.

[0278] S520: UDM determines that neither AMF1 nor AMF2 has authenticated the UE.

[0279] Optionally, after determining that the authentication request originated from AMF2, the UDM further determines whether to perform a primary authentication procedure for the UE. This can also be understood as the UDM determining whether to perform steps such as selecting an authentication method and generating an authentication vector. For example, the UDM may check whether the first and second authentication suspension flags corresponding to AMF1 and AMF2 are locally stored. If both the first and second authentication suspension flags are present, the UDM determines that the primary authentication procedure can be performed. If the second authentication suspension flag corresponding to AMF2 is present, but the first authentication suspension flag corresponding to AMF1 is absent, this indicates that AMF1 has performed a primary authentication with the UE, and the UDM determines that the primary authentication procedure will not be performed. If the second authentication suspension flag corresponding to AMF2 is absent, but the first authentication suspension flag corresponding to AMF1 is present, this indicates that AMF2 has performed a primary authentication with the UE, and the UDM determines that the primary authentication procedure will not be performed. If the primary authentication procedure is determined to be performed for the UE, steps S521 and S522 are continued, and S523 may also be performed.

[0280] Optionally, if the UDM determines in step S520 that the primary authentication of the UE has been performed, or the primary authentication of the UE is in progress, there is no need to perform the following steps S512 and S522, and the first and second methods can be continued to be performed.

[0281] S521, execute the main authentication process.

[0282] S522, executing the main authentication confirmation process.

[0283] For the specific implementation of the above steps S521 and S522, please refer to the relevant description of the above method 200.

[0284] S523, UDM cancels the second authentication suspension flag.

[0285] Optionally, if the authentication result received by UDM from AUSF in step S522 indicates that AMF2's primary authentication of the UE is successful, UDM may cancel the second authentication suspension flag previously set.

[0286] It should be noted that if after the above step S518, after the UDM receives the second authentication request message, the second authentication suspension flag corresponding to AMF2 is canceled, deleted or set to invalid, then step S523 may not be executed; if AMF2 does not cancel the second authentication suspension flag after the above step S518, then the UDM may cancel the second authentication suspension flag in step S523.

[0287] Based on the above scheme, UDM can determine in step S519 that the first primary authentication comes from AMF2, or UDM can determine in step S522 that the first primary authentication is successful, and directly send a notification message to AMF1 to notify the cancellation or termination of the execution of the home network triggered primary authentication process, or to notify that the suspension flag set at the AMF can be canceled. Accordingly, AMF1 can cancel the first suspension flag set locally, and there is no need to initiate the primary authentication process for the UE subsequently, that is, execute step S531; or, UDM can also determine in step S522 that the first primary authentication is successful, or, UDM can also determine in step S522 that the first primary authentication is successful, and wait for AMF1 to initiate the authentication process before rejecting AMF1's authentication request, so as to avoid repeated execution of the primary authentication process for the UE and reduce signaling overhead.

[0288] The following describes in detail how the UDM notifies AMF1 to cancel the pending flag when it determines that the first primary authentication comes from AMF2, combining Method 1 and Method 2. In Method 1, the UE accesses AMF1 again. AMF1 triggers an authentication request due to the locally set first pending flag. Knowing that AMF2 has performed primary authentication on the UE, the UDM rejects AMF1's authentication request. In Method 2, when the UDM determines that the first primary authentication comes from AMF2, it directly notifies AMF1 that the primary authentication of the UE is in progress or has been successfully performed. This means that AMF1 does not need to trigger authentication of the UE subsequently.

[0289] Method 1:

[0290] S524, the UE sends a second registration request message to AMF1, and correspondingly, AMF1 receives the second registration request message from the UE.

[0291] The second registration request message carries the UE's 5G-GUTI.

[0292] S525, AMF1 determines to trigger the main authentication process based on the first suspension flag, that is, executes the following step S526.

[0293] Exemplarily, when AMF1 locally checks and finds that there is a first suspension flag on AMF1, AMF1 triggers the main authentication process, that is, executes the following step S526.

[0294] It should be noted that the above steps S524 and S525 are for describing the process in which the UE accesses the network again through AMF1, and then AMF1 triggers the main authentication according to the first suspension flag. Optionally, the UE can also send a registration request to other AMFs in the operator network where AMF1 is located, such as AMF3, that is, request access to the network through AMF3. It should be understood that when the UE initiates registration with AMF3, AMF3 will obtain the first suspension flag from AMF1 and trigger the main authentication process for the UE based on the first suspension flag, so the first suspension flag will be used by AMF3. In other words, this embodiment does not limit the UE to access the network through AMF1 again after failing to access the network through AMF1, and can also access the network through other AMF3 in the operator network where AMF1 is located. For the sake of convenience of description, the embodiment of the present application takes the UE accessing the network through the same AMF, namely AMF1, as an example. It should be understood that if the UE fails to access the network through AMF1 and requests to access the network through AMF3, AMF3 can obtain relevant parameters in the UE context on AMF1, such as the first suspension flag, and trigger the primary authentication of the UE. The specific implementation method is similar to the way AMF1 triggers the primary authentication, which will not be repeated here.

[0295] At step S526, AMF1 sends a third authentication request message to the AUSF. In response, the AUSF receives the third authentication request message from AMF1. The third authentication request message is used to request a second primary authentication of the UE. The third authentication request message includes the UE's SUPI and SN Name#1. SN Name#1 indicates the name of the serving network where AMF1 is located. For details about SN Name#1, refer to the description of step S210.

[0296] In a possible implementation, SN Name#1 contains PLMN ID#1 corresponding to AMF1.

[0297] Exemplarily, the third authentication request message may be a Nausf_UEAuthentication_GetRequest message.

[0298] Optionally, the third authentication request message may also carry a reason value to notify UDM that the main authentication process is initiated in response to the first suspension flag set locally by AMF1. If the third authentication request message carries the reason value, UDM can know that the reason for triggering the main authentication process is the existence of the first suspension flag, which means that the main authentication process is an authentication process initiated by AMF1 in response to UDM's previous authentication notification request.

[0299] It should be noted that this embodiment is described from the perspective that AMF1 and AMF2 send an authentication request message to the same AUSF. However, in actual scenarios, AMF1 and AMF2 can select different AUSFs. For ease of understanding and description, this embodiment is described as follows: AMF1 and AMF2 happen to select the same AUSF. In other words, this embodiment of the application does not limit AMF1 and AMF2 to using the same or different AUSFs.

[0300] At step S527, the AUSF sends a fourth authentication request message to the UDM. In response, the UDM receives the fourth authentication request message from the AUSF. The fourth authentication request message is used to request an authentication vector from the UDM, which is used to perform primary authentication of the UE. The fourth authentication request message carries the UE's SUPI and SN Name #1. If the cause value #2 was included in step S517, authentication request message #4 also includes cause value #2.

[0301] Exemplarily, the authentication request message #4 may be a Nudm_UEAuthentication_GetRequest message.

[0302] Optionally, if a reason value is carried in step S526, a reason value may also be carried in step S527.

[0303] S528, UDM determines that AMF2 has authenticated the UE.

[0304] Optionally, the UDM can find out based on the local query that there is no second authentication suspension flag, and determine that AMF2 has authenticated the UE; or, the UDM determines that AMF2 has authenticated the UE based on the authentication result received in step S522; or, the UDM can determine that the first authentication comes from AMF2 based on step S519, and then obtain the authentication of the UE by AMF2.

[0305] S529, UDM sends a third authentication response message to AUSF, and correspondingly, AUSF receives the third authentication response message from UDM.

[0306] The third authentication response message is used to indicate the rejection of the authentication request. Optionally, the third authentication response message includes a rejection reason value, which is used to indicate that AMF2 has authenticated the UE or that the UE's primary authentication is successful.

[0307] S530, AUSF sends a fourth authentication response message to AMF1, and correspondingly, AMF1 receives the fourth authentication response message from UDM.

[0308] The fourth authentication response message is used to indicate the rejection of AMF1's authentication request. Optionally, the fourth authentication response message includes a rejection reason value, which is used to indicate that AMF2 has authenticated the UE or that the UE's primary authentication is successful.

[0309] S530a, AMF1 cancels the first suspension flag.

[0310] Exemplarily, AMF1 cancels the first suspension flag set in step S507 according to the received rejection reason value. For the specific implementation method of cancellation, please refer to the relevant description of the above step S512a.

[0311] Method 2:

[0312] S531, UDM sends a second notification message to AMF1, and correspondingly, AMF1 receives the notification message from UDM.

[0313] The second notification message is used to notify the cancellation or termination of the home network triggered primary authentication process, or to notify that the suspension flag set at the AMF can be cancelled. That is, accordingly, AMF1 can cancel the first suspension flag previously set in step S507.

[0314] S532, AMF1 cancels the first suspension flag.

[0315] Exemplarily, AMF1 cancels the first suspension flag set in step S507 according to the second notification message. For the specific implementation method of the cancellation, refer to the relevant description of the above step S512a.

[0316] The solution provided by the present application is that the UDM determines that AMF2 can execute the main authentication process for the UE based on the authentication response message of AMF2, and then can send a notification message of canceling the suspension flag to other AMF1s serving the UE, thereby avoiding the subsequent AMF1 triggering a re-authentication request for the UE. In addition, by determining which AMF the authentication comes from, after knowing that the current main authentication comes from the AMF2 serving the UE, the UDM can directly send a notification message of canceling the suspension flag to other AMF1s serving the UE that have not triggered the authentication request, thereby avoiding the subsequent AMF1 triggering a re-authentication request for the UE; or, after receiving the authentication request initiated by the AMF1 serving the UE, the UDM will reject the authentication request of the AMF1, thereby avoiding redundant authentication processes and reducing signaling overhead.

[0317] Below, the method 1 and the method 2 in the above method 500 are specifically described in conjunction with Figures 6 and 7. Take the example of the UE accessing AMF1 and AMF2 through 3GPP access technology and non-3GPP access technology respectively for explanation, indicating that the current UE is served by the AMF1 and AMF2, or the UE can be found through AMF1 and AMF2. Based on the above method 200, it can be known that at this time, the UDM has stored the information of AMF1 and AMF2 that provide services to the UE, such as AMF1ID and AMF2ID, and the UDM can determine the AMF1 and AMF2 that serve the UE based on the AMF ID. Further, based on step S330 of the method 300 shown in Figure 3 above, the UDM can determine the triggering of the main authentication process based on an event or operator authentication policy.

[0318] Figure 6 is a flow chart of a communication method 600 provided in an embodiment of the present application. As shown in Figure 6, with UDM, AMF1, AMF2, AUSF, and UE as the execution entities, the implementation method is mainly described by UDM rejecting the authentication request of AMF2 after receiving the authentication request initiated by AMF2 from the service UE after knowing that the current main authentication comes from AMF1 serving the UE. The method includes the following steps, and the parts not described in detail can refer to the existing protocol. It should be understood that the relevant description in the embodiment shown in Figure 6 above is also applicable to this implementation method, and the same or similar technical means may exist between Figures 4 and 6, and the contents described in the embodiments shown in Figures 4 and 5 will not be repeated.

[0319] S601, UDM sends authentication notification message #1 to AMF1, and correspondingly, AMF1 receives authentication notification message #1 from UDM.

[0320] The authentication notification message #1 includes the UE's SUPI.

[0321] Exemplarily, UDM determines to trigger the main authentication process based on the operator's authentication policy, and chooses to trigger the main authentication process through AMF1, then UDM sends authentication notification message #1 to AMF1.

[0322] S602, AMF1 sends authentication response message #1 to UDM, and UDM receives authentication response message #1 from AMF1.

[0323] Exemplarily, if AMF1 finds that the UE is unreachable, or AMF1 fails to find the UE, AMF1 sends an authentication response message #1 to the UDM, and carries a failure cause value in the authentication response message #1.

[0324] S603a, AMF1 sets the suspend flag #1.

[0325] For example, since AMF1 cannot initiate primary authentication for the UE, AMF1 may set a suspend flag #1 in the UE context. The specific meaning of the suspend flag #1 may refer to the relevant description of the above method 400.

[0326] This embodiment does not limit the execution order of steps S602 and S603a, that is, AMF2 may execute step S602 first and then step S603a, or execute step S603a first and then step S602.

[0327] The specific implementation of the above steps S601, S602 and S603a can refer to the relevant description of steps S340, S360 and S370 of the above method 300.

[0328] S603b, optionally, UDM sets the authentication suspension flag #1.

[0329] Exemplarily, the UDM can determine that the primary authentication of the UE has failed to start based on the failure cause value in the authentication response message #1 of AMF1, and then set the authentication suspension flag #1 and associate the authentication suspension flag #1 with AMF1. The authentication suspension flag #1 is used to indicate that the UDM has requested AMF1 to trigger the primary authentication process, and AMF1 sets the suspension flag #1 because it cannot start the primary authentication process for the UE. The setting of the authentication suspension flag #1 facilitates the subsequent UDM to determine that the associated AMF1 has set the suspension flag #1 and that the AMF1 has not yet executed the primary authentication process for the UE.

[0330] Among them, the ways of associating the authentication suspension flag #1 with AMF1 can refer to the relevant description of the above method 400, and there are many, such as UDM associates and stores the authentication suspension flag #1 with AMF1ID; for another example, UDM associates and stores the authentication suspension flag #1 with the SN Name#1 corresponding to the AMF1ID; for another example, UDM stores the authentication suspension flag #1 with the PLMN ID#1 corresponding to the AMF1ID; for another example, UDM associates and stores the authentication suspension flag #1 with at least two parameters of AMF1ID, SN Name#1 and PLMN ID#1 corresponding to AMF1.

[0331] Among them, the expression of the authentication suspension flag #1 can refer to the relevant description of the above method 400, and this application does not make any specific limitations on this.

[0332] Since UDM knows that there are two AMFs serving the UE, if UDM determines that the primary authentication startup of AMF1 fails, it can request other AMFs serving the UE, such as AMF2, to execute the primary authentication process.

[0333] S604, UDM sends authentication notification message #2 to AMF2, and correspondingly, AMF2 receives authentication notification message #2 from UDM.

[0334] The authentication notification message #2 includes the UE's SUPI.

[0335] S605, AMF2 sends authentication response message #2 to UDM, and UDM receives authentication response message #2 from AMF2.

[0336] S606a, AMF2 sets the suspend flag #2.

[0337] S606b, optionally, UDM sets authentication suspension flag #2.

[0338] It should be noted that this application does not limit the order in which the above steps S605 and S606a are executed.

[0339] The specific implementation of the above steps S604 to S606b can refer to the relevant description of the above methods S601 to S603b, and for the sake of brevity, they are not repeated here.

[0340] It should be understood that since AMF2 has a local suspend flag #2 set, when the UE accesses AMF2 again, AMF2 performs the main authentication process for the UE based on the local suspend flag #2. For example, AMF1 selects an AUSF and sends a Nausf_UEAuthentication_Authenticate Request message to the AUSF, as described in step S210.

[0341] S607, the UE sends a registration request message #1 to AMF2, and correspondingly, AMF2 receives the registration request message #1 from the UE.

[0342] Among them, the registration request message #1 carries the UE's 5G-GUTI.

[0343] S608, AMF2 checks whether there is a suspension flag #2 to determine whether to trigger the main authentication process.

[0344] For example, when AMF2 locally checks and finds that there is a suspension flag #2 on AMF2, AMF2 first needs to trigger the main authentication process, that is, execute the following step S609.

[0345] S609, AMF2 sends authentication request message #1 to AUSF, and correspondingly, AUSF receives authentication request message #1 from AMF2.

[0346] Authentication Request Message #1 is used to request primary authentication for the UE. It carries the UE's SUPI and SN Name #2. SN Name #2 indicates the serving network name of AMF2, including PLMN ID #2 corresponding to AMF2. For details about SN Name #2, refer to the description of step S210.

[0347] For example, SN Name#2 contains the PLMN ID corresponding to AMF2.

[0348] Exemplarily, the authentication request message #1 may be a Nausf_UEAuthentication_GetRequest message.

[0349] Optionally, the authentication request message #1 may also carry a reason value #1, which is used to inform the UDM that the primary authentication process is initiated in response to the suspend flag #2 set locally by the AMF2. It should be understood that the reason value #1 is optional and does not need to be carried in the authentication request message #1 in order to reduce changes to the existing standard. If the authentication request message #1 carries the reason value #1, the UDM can be informed that the reason for triggering the primary authentication process is the presence of the suspend flag #2, which means that the primary authentication process is an authentication process initiated by the AMF2 in response to the UDM's previous authentication notification request.

[0350] Optionally, before sending Authentication Request Message #1, AMF2 may further determine whether other factors trigger the primary authentication process. If so, it means that the initiation of the primary authentication process is not solely due to Suspend Flag #2. In this case, Authentication Request Message #1 may not carry Cause Value #1. If not, Authentication Request Message #1 may carry Cause Value #1.

[0351] S610, AUSF sends an authentication request message #2 to UDM, and correspondingly, UDM receives the authentication request message #2 from AUSF.

[0352] Authentication Request Message #2 is used to request an authentication vector from the UDM, which is used to perform primary authentication of the UE. Authentication Request Message #2 carries the UE's SUPI and SN Name #2. If Cause Value #1 was included in step S609, Authentication Request Message #2 also includes Cause Value #1.

[0353] Exemplarily, the authentication request message #2 may be a Nudm_UEAuthentication_GetRequest message.

[0354] S611, UDM determines that the authentication request comes from AMF2 based on SN Name#2.

[0355] For example, when the reason value #1 is carried in S610, the UDM needs to determine which AMF the authentication request comes from. For the specific implementation method, please refer to the relevant description of the above method 500.

[0356] Optionally, after determining which AMF the authentication request comes from, such as AMF2, the UDM further determines whether to perform a primary authentication procedure for the UE. This can also be understood as the UDM determining whether it is necessary to perform steps such as selecting an authentication method and generating an authentication vector. For specific implementations, refer to the relevant description of the above method 500. If it is determined that the primary authentication procedure is to be performed for the UE, the following step S612 is continued. If it is determined that the primary authentication procedure is not to be performed for the UE, the following step S620 may be performed.

[0357] Optionally, if the UDM is set with an authentication suspension flag, then after the UDM receives the authentication request message, the UDM sets the authentication suspension flag corresponding to the AMF to invalid. For example, after the UDM determines that the authentication request comes from AMF2 and determines to perform primary authentication on AMF2, the UDM cancels the authentication suspension flag #2. Here, canceling the authentication suspension flag #2 can be understood as the invalidation of the authentication suspension flag #2. If the authentication suspension flag #2 is indicated by a bit, such as 1 represents that the authentication suspension flag #2 is valid and 0 represents that the authentication suspension flag #2 is invalid, then the UDM changes the authentication suspension flag #2 of AMF2 from 1 to 0; or, if the authentication suspension flag #2 exists to indicate validity and no longer exists to indicate invalidity, then the UDM deletes the authentication suspension flag #2 of AMF2.

[0358] It should be understood that if the UE registers with AMF1 and AMF2 at the same time, then AMF1 and AMF2 will initiate authentication of the UE at the same time. At this time, after determining which AMF the authentication occurs in, UDM can suspend processing of the other AMF, or UDM can reject the authentication request of another AMF (for example, AMF1 requests UDM to execute the main authentication process through AUSF, then UDM can reject AMF2's authentication request after receiving the authentication result sent by AUSF, or UDM directly rejects AMF2's authentication request after receiving the authentication request from AUSF), or continue to execute the authentication request of another AMF (for example, UDM executes AMF2's authentication request after receiving the authentication result sent by AUSF). This application does not limit this.

[0359] S612, executing the main authentication process.

[0360] S613, executing the main authentication confirmation process.

[0361] The specific implementation of the above steps S612 and S613 can refer to the relevant description of the above method 200.

[0362] S614, optionally, UDM cancels authentication suspension flag #2.

[0363] Exemplarily, if the UDM cancels the authentication suspension flag #2 in step S611, this step does not need to be performed; if the UDM does not cancel the authentication suspension flag #2 in step S611, this step can be performed.

[0364] Optionally, step S611 may not be performed. That is, in step S614, the UDM may determine which AMF triggered the authentication process. For example, the UDM may determine that the authentication process was triggered by AMF2 based on the serving network name in the authentication response in step S613. For the specific confirmation method, please refer to the description of step S611.

[0365] It should be understood that since AMF2 is locally set with a suspension flag #2, when the UE accesses AMF2 again, AMF2 will trigger the main authentication process for the UE through the AUSF request to the UDM based on the local suspension flag #2. Optionally, AMF1 and AMF2 send an authentication request message to the same AUSF, but in actual scenarios, AMF1 and AMF2 can select different AUSFs. For ease of understanding and description, it is taken as an example that AMF1 and AMF2 happen to select the same AUSF. In other words, the embodiment of the present application does not limit AMF1 and AMF2 to using the same or different AUSFs.

[0366] S615, the UE sends a registration request message #2 to AMF1. Correspondingly, AMF1 receives the registration request message #2 from the UE.

[0367] Among them, the registration request message #2 carries the UE's 5G-GUTI.

[0368] S616, AMF1 checks whether there is a suspension flag #1 to determine whether to trigger the main authentication process.

[0369] Exemplarily, when AMF1 locally checks and finds that there is a suspension flag #1 on AMF1, AMF1 first needs to trigger the main authentication process, that is, execute the following step S617.

[0370] S617, AMF1 sends authentication request message #3 to AUSF, and correspondingly, AUSF receives authentication request message #3 from AMF1.

[0371] Authentication Request Message #3 is used to request primary authentication for the UE. It carries the UE's SUPI and SN Name #1. SN Name #1 represents the serving network name of AMF1, which includes the PLMN ID #1 corresponding to AMF1. For details about SN Name #1, refer to the description of step S210.

[0372] Exemplarily, the authentication request message #3 may be a Nausf_UEAuthentication_GetRequest message.

[0373] Optionally, the authentication request message #3 may also carry a reason value #2. The reason value #2 is used to notify the UDM that the main authentication process is initiated in response to the suspension flag #1 set locally by AMF1. If the authentication request message #3 carries the reason value #2, the UDM can know that the reason for triggering the main authentication process is the existence of the suspension flag #1, which means that the main authentication process is an authentication process initiated by AMF1 in response to the previous authentication notification request of the UDM. For specific interpretations, please refer to the relevant description of the above step S609.

[0374] S618, AUSF sends an authentication request message #4 to UDM, and correspondingly, UDM receives the authentication request message #4 from AUSF.

[0375] Authentication Request Message #4 is used to request an authentication vector from the UDM. The authentication vector is used to perform primary authentication of the UE. Authentication Request Message #4 carries the UE's SUPI and SN Name #1. If Cause Value #2 was included in step S617, Authentication Request Message #4 also includes Cause Value #2.

[0376] Exemplarily, the authentication request message #4 may be a Nudm_UEAuthentication_GetRequest message.

[0377] S619, UDM determines that the primary authentication through AMF2 is successful.

[0378] Optionally, if a reason value can be carried, and if reason value #2 is carried in step S618, the UDM determines that the authentication process was triggered by suspend flag #1, and then the UDM checks whether authentication has already occurred, for example, according to the relevant description of step S611 or step S614. If the UDM determines that authentication has already occurred, to avoid repeated authentication, the subsequent authentication process may be rejected and rejection reason value #3 may be sent in the subsequent authentication request process. If the UDM determines that authentication has not occurred, for example, according to the relevant description of step S611 above, the authentication process may continue, for example, executing step S612 above.

[0379] Optionally, if the authentication reason value can be carried, and if the reason value #2 is not carried in step S618, the UDM continues to perform subsequent authentication procedures. Optionally, the UDM can further cancel the relevant flags for AMF1, such as the authentication pending flag #1 set in step S603b.

[0380] Optionally, when the reason value cannot be carried, UDM can have at least two processing logics. For example, UDM can continue the authentication process according to the relevant description of the existing protocol. For another example, when UDM determines whether the authentication process has been requested, but the request fails (for example, there is a suspension flag #1 recorded on AMF1), it then determines whether authentication has occurred (for example, there is no suspension flag #2 on another AMF2). If it has occurred, the authentication process can be rejected first, and the rejection reason value #3 is replied; at the same time, UDM cancels the authentication suspension flag, which means that UDM has not requested authentication of the UE from AMF, so any other authentication requests from AMF need to be processed.

[0381] S620, UDM sends an authentication response message #3 to AUSF, and correspondingly, AUSF receives an authentication response message #3 from UDM.

[0382] Authentication Response Message #3 carries a Rejection Reason value of #3, indicating that AMF1's authentication request has been rejected. This means that AMF2 has requested primary authentication and has successfully authenticated the authentication request, so AMF1's authentication request can be terminated.

[0383] S621, AUSF sends an authentication response message #4 to AMF1, and correspondingly, AMF1 receives an authentication response message #4 from AUSF.

[0384] Among them, the authentication response message #4 carries the failure reason value #3.

[0385] S622, AMF1 cancels the suspension flag #1.

[0386] For example, if the authentication reason value can be carried, after AMF1 receives the failure reason value #3, AMF1 cancels the suspension flag #1 according to the rejection reason value #3 and continues to provide services to the UE.

[0387] In the solution provided by this application, UDM determines which AMF the authentication comes from. After knowing that the current primary authentication comes from AMF2 serving the UE, after receiving the authentication request initiated by AMF1 serving the UE, it rejects the authentication request of AMF1, thereby avoiding redundant authentication processes and reducing signaling overhead.

[0388] Figure 7 is a flow chart of the communication method 700 provided in an embodiment of the present application. With UDM, AMF1, AMF2, AUSF, and UE as the execution entities, the implementation method is mainly that after the UDM knows that the current main authentication comes from the AMF1 serving the UE, based on the information of multiple AMFs serving the UE stored locally, it sends a cancel suspension flag to other AMF2s that have not triggered the authentication request, so as to avoid triggering redundant authentication processes. For explanation, the method includes the following multiple steps, and the parts that are not described in detail can refer to the existing protocols. It should be understood that the relevant descriptions in the embodiments shown in Figures 4 to 6 above are also applicable to this implementation method, and the same or similar technical means may exist between Figures 4 to 7, and the contents described in the embodiments shown in Figures 7 and 4 to 6 above will not be repeated.

[0389] S701, UDM sends authentication notification message #1 to AMF1, and correspondingly, AMF1 receives authentication notification message #1 from UDM.

[0390] S702, AMF1 sends authentication response message #1 to UDM, and UDM receives authentication response message #1 from AMF1.

[0391] S703a, AMF1 sets the suspend flag #1.

[0392] S703b, optionally, UDM sets the authentication suspension flag #1.

[0393] S704, UDM sends authentication notification message #2 to AMF2, and correspondingly, AMF2 receives authentication notification message #2 from UDM.

[0394] S705, AMF2 sends authentication response message #2 to UDM, and UDM receives authentication response message #2 from AMF2.

[0395] S706a, AMF2 sets the suspend flag #2.

[0396] S706b, optionally, UDM sets authentication suspension flag #2.

[0397] S707, the UE sends a registration request message #1 to AMF2. Correspondingly, AMF2 receives the registration request message #1 from the UE.

[0398] S708, AMF2 checks whether there is a suspension flag #1 to determine whether to trigger the main authentication process.

[0399] S709, AMF2 sends authentication request message #1 to AUSF, and correspondingly, AUSF receives authentication request message #1 from AMF2.

[0400] S710, AUSF sends an authentication request message #2 to UDM, and correspondingly, UDM receives the authentication request message #2 from AUSF.

[0401] S711, UDM determines that the authentication request comes from AMF2 based on SN Name#2.

[0402] S712, execute the main authentication process.

[0403] S713, execute the main authentication confirmation process.

[0404] S714, optionally, UDM cancels authentication suspension flag #2.

[0405] The specific implementation of steps S701 to S714 can refer to the relevant description of steps S601 to S614 of method 600, which will not be repeated here for the sake of brevity.

[0406] Based on the above implementation, UDM knows that AMF2 has successfully triggered the primary authentication of the UE. In order to avoid subsequent redundant authentication processes, UDM can directly send a notification to cancel the suspension flag #1 to other AMF1 serving the UE, that is, execute step S715.

[0407] S715, UDM sends a notification message to AMF1, and correspondingly, AMF1 receives the notification message from UDM.

[0408] The notification message is used to notify AMF1 to cancel the suspension flag #1, so that if the UE accesses the AMF1 again later, AMF1 may not trigger the primary authentication of the UE. The notification message includes the UE's SUPI.

[0409] Exemplarily, when the UDM determines that the authentication comes from AMF2, the UDM sends a notification message to another AMF1 serving the UE to notify AMF1 to cancel the suspension flag #1.

[0410] S716, AMF1 cancels the suspension flag #1.

[0411] Exemplarily, AMF1 cancels the suspension flag #1 according to the received notification message.

[0412] S717, AMF1 sends a response message to UDM, and correspondingly, AMF1 receives a response message from UDM.

[0413] It should be noted that, in one example, step S715 may occur after step S711, that is, when the UDM knows that the primary authentication of the UE has occurred, it can send a cancellation (e.g., deletion or reset) process to another AMF1 serving the UE. In another example, after step S714, the UDM may determine that the AMF2 authentication is successful, and then send a cancellation (e.g., deletion or reset) process to another AMF 1 serving the UE. This application is not limited to this.

[0414] In the solution provided by this application, UDM determines which AMF the authentication comes from. After knowing that the current primary authentication comes from the AMF2 serving the UE, it directly sends a cancel suspension flag to the AMF1 of other serving UEs that have not triggered the authentication request, so as to avoid triggering redundant authentication processes and reduce signaling overhead.

[0415] The above description, in conjunction with Figures 1 to 6 , details the communication method embodiment of the present application. The following description, in conjunction with Figures 7 to 9 , details the communication device embodiment of the present application. It should be understood that the description of the device embodiment corresponds to the description of the method embodiment. Therefore, for portions not described in detail, reference can be made to the preceding method embodiment.

[0416] Figure 8 is a schematic diagram of the structure of a communication device 1000 provided in an embodiment of the present application. As shown in Figure 8, the device 1000 may include a transceiver unit 1010 and a processing unit 1020. The transceiver unit 1010 can communicate with the outside world, and the processing unit 1020 is used to process data. The transceiver unit 1010 may also be referred to as a communication interface or a transceiver unit.

[0417] In one possible design, the device 1000 can implement steps or processes corresponding to those executed by the home network element in the above method embodiment, wherein the processing unit 1020 is used to execute operations related to the processing of the home network element in the above method embodiment, and the transceiver unit 1010 is used to execute operations related to the transmission and reception of the home network element in the above method embodiment.

[0418] Exemplarily, the processing unit 1020 is used to, when the terminal device is registered to the network through the first mobility management function network element and the second mobility management function network element respectively, the hometown network element stores the identifier of the first mobility management function network element and the identifier of the second mobility management function network element; the transceiver unit 1010 is used to, when it is determined that the terminal device needs to be primarily authenticated, the hometown network element sends a first authentication notification message to the first mobility management function network element, the first authentication notification message is used to request to trigger the primary authentication of the terminal device; the transceiver unit 1010 is also used for the hometown network element to receive a first authentication response message from the first mobility management function network element, the first authentication response message is used to indicate that the first mobility management function network element cannot initiate the primary authentication of the terminal device. The transceiver unit 1010 is also used to respond to the first authentication response message, and the hometown network element sends a second authentication notification message to the second mobility management function network element, and the second authentication notification message is used to request to trigger the main authentication of the terminal device; the transceiver unit 1010 is also used for the hometown network element to receive the second authentication response message from the second mobility management function network element; the transceiver unit 1010 is also used to determine that the second mobility management function network element can initiate the main authentication of the terminal according to the second authentication response message, and the hometown network element sends a first notification message to the first mobility management function network element, and the first notification message is used to indicate that when the terminal device registers to the network again through the first mobility management function network element, the main authentication of the terminal device will not be performed.

[0419] In another possible design, the device 1000 can implement steps or processes corresponding to those executed by the first mobility management function network element in the above method embodiment, wherein the transceiver unit 1010 is used to perform operations related to transceiver transmission of the first mobility management function network element in the above method embodiment, and the processing unit 1020 is used to perform operations related to processing of the first mobility management function network element in the above method embodiment.

[0420] It should be understood that the device 1000 here is embodied in the form of a functional unit. The term "unit" here can refer to an application specific integrated circuit (ASIC), an electronic circuit, a processor (such as a shared processor, a dedicated processor or a group processor, etc.) and a memory for executing one or more software or firmware programs, a merging logic circuit and / or other suitable components that support the described functions. In an optional example, those skilled in the art can understand that the device 1000 can be specifically the transmitting end in the above embodiment, and can be used to execute the various processes and / or steps corresponding to the transmitting end in the above method embodiment, or the device 2000 can be specifically the receiving end in the above embodiment, and can be used to execute the various processes and / or steps corresponding to the receiving end in the above method embodiment. To avoid repetition, it will not be repeated here.

[0421] The apparatus 1000 of each of the above-mentioned solutions has the function of implementing the corresponding steps performed by the transmitting end in the above-mentioned method, or the apparatus 1000 of each of the above-mentioned solutions has the function of implementing the corresponding steps performed by the receiving end in the above-mentioned method. The functions can be implemented by hardware, or can be implemented by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above-mentioned functions; for example, the transceiver unit can be replaced by a transceiver (for example, the transmitting unit in the transceiver unit can be replaced by a transmitter, and the receiving unit in the transceiver unit can be replaced by a receiver), and other units, such as the processing unit, can be replaced by a processor to respectively perform the transceiver operations and related processing operations in each method embodiment.

[0422] In addition, the above-mentioned transceiver unit can also be a transceiver circuit (for example, it can include a receiving circuit and a transmitting circuit), and the processing unit can be a processing circuit. In an embodiment of the present application, the device in Figure 8 can be the receiving end or the transmitting end in the aforementioned embodiment, or it can be a chip or a chip system, such as a system on chip (SoC). Among them, the transceiver unit can be an input and output circuit or a communication interface. The processing unit is a processor or microprocessor or integrated circuit integrated on the chip. This is not limited here.

[0423] Figure 9 is a schematic diagram of the structure of a communication device 2000 provided in an embodiment of the present application. As shown in Figure 9, the device 2000 includes a processor 2010 and a transceiver 2020. The processor 2010 and the transceiver 2020 communicate with each other via an internal connection path. The processor 2010 is used to execute instructions to control the transceiver 2020 to send and / or receive signals.

[0424] Optionally, the apparatus 2000 may further include a memory 2030, which communicates with the processor 2010 and the transceiver 2020 via an internal connection path. The memory 2030 is used to store instructions, and the processor 2010 may execute the instructions stored in the memory 2030.

[0425] In a possible implementation, the apparatus 2000 is used to implement various processes and steps corresponding to the home network element in the above method embodiment.

[0426] In another possible implementation, the apparatus 2000 is used to implement various processes and steps corresponding to the first mobility management function network element in the above method embodiment.

[0427] It should be understood that the device 2000 can be specifically the transmitting end or receiving end in the above-mentioned embodiments, or can also be a chip or chip system. Correspondingly, the transceiver 2020 can be the transceiver circuit of the chip, which is not limited here. Specifically, the device 2000 can be used to perform the various steps and / or processes corresponding to the transmitting end or receiving end in the above-mentioned method embodiments.

[0428] Optionally, the memory 2030 may include a read-only memory and a random access memory, and provide instructions and data to the processor. A portion of the memory may also include non-volatile random access memory. For example, the memory may also store device type information. The processor 2010 may be configured to execute instructions stored in the memory. When the processor 2010 executes the instructions stored in the memory, the processor 2010 is configured to perform the various steps and / or processes of the above-described method embodiments corresponding to the transmitting end or the receiving end.

[0429] During implementation, each step of the above method can be completed by an integrated logic circuit of the hardware in the processor or an instruction in the form of software. The steps of the method disclosed in conjunction with the embodiments of the present application can be directly embodied as being executed by a hardware processor, or can be executed by a combination of hardware and software modules in the processor. The software module can be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in a memory, and the processor reads the information in the memory and completes the steps of the above method in conjunction with its hardware. To avoid repetition, it will not be described in detail here.

[0430] It should be noted that the processor in the embodiments of the present application can be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above-mentioned method embodiment can be completed by hardware integrated logic circuits in the processor or by software instructions. The above-mentioned processor can be a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field-programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component. The processor in the embodiments of the present application can implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the embodiments of the present application can be directly implemented and executed by a hardware decoding processor, or by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium well-known in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. The storage medium is located in the memory, and the processor reads the information in the memory and, in conjunction with its hardware, completes the steps of the above-mentioned method.

[0431] It will be understood that the memory in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static random access memory, dynamic random access memory, synchronous dynamic random access memory, double data rate synchronous dynamic random access memory, enhanced synchronous dynamic random access memory, synchronous linked dynamic random access memory, and direct memory bus random access memory. It should be noted that the memory of the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0432] FIG10 is a schematic diagram of the structure of a chip system 3000 provided in an embodiment of the present application. As shown in FIG10 , the chip system 3000 (or also referred to as a processing system) includes a logic circuit 3010 and an input / output interface 3020 .

[0433] The logic circuit 3010 may be a processing circuit in the chip system 3000. The logic circuit 3010 may be coupled to a storage unit and call instructions in the storage unit so that the chip system 3000 can implement the methods and functions of the various embodiments of the present application. The input / output interface 3020 may be an input / output circuit in the chip system 3000, outputting information processed by the chip system 3000 or inputting data or signaling information to be processed into the chip system 3000 for processing.

[0434] As a solution, the chip system 3000 is used to implement the operations performed by the home network element in each of the above method embodiments.

[0435] As a solution, the chip system 3000 is used to implement the operations performed by the first mobility management function network element in the above various method embodiments.

[0436] An embodiment of the present application further provides a computer-readable storage medium on which computer instructions for implementing the methods executed by the home network element and the first mobility management function network element in the above-mentioned method embodiments are stored.

[0437] An embodiment of the present application further provides a computer program product, comprising computer program code or instructions. When the computer program code or instructions are executed on a computer, the computer implements the methods performed by the home network element and the first mobility management function network element in the above-mentioned method embodiments.

[0438] An embodiment of the present application also provides a communication system, including the aforementioned home network element and a first mobility management function network element.

[0439] The explanation of the relevant contents and beneficial effects of any of the above-mentioned devices can be referred to the corresponding method embodiments provided above, which will not be repeated here.

[0440] To facilitate understanding of the above embodiments provided in this application, the following points are explained:

[0441] 1) In this application, unless otherwise specified or there is a logical conflict, the terms and / or descriptions between different embodiments are consistent and can be referenced by each other. The technical features in different embodiments can be combined to form new embodiments according to their inherent logical relationships.

[0442] 2) In this application, "at least one" means one or more, and "more" means two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. In the text description of this application, the character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b and c can mean: a, or b, or c, or a and b, or a and c, or b and c, or a, b and c. Where a, b and c can be single or multiple, respectively.

[0443] 3) Throughout this application, the terms "first," "second," and various numerical references (e.g., #1, #2, etc.) are used to distinguish between different messages for ease of description and are not intended to limit the scope of the embodiments of this application. For example, they are used to distinguish between different messages, rather than to describe a specific order or precedence. It should be understood that such references are interchangeable, where appropriate, to allow for the description of scenarios beyond the embodiments of this application.

[0444] 4) In this application, descriptions such as "when...", "in the case of...", and "if" all mean that the device will perform corresponding processing under certain objective circumstances. They do not limit the time, nor do they require the device to perform judgment actions when implementing them, nor do they mean that there are other limitations.

[0445] 5) In this application, "used to indicate" can include being used for direct indication and being used for indirect indication. When describing that a certain indication information is used to indicate A, it can include that the indication information directly indicates A or indirectly indicates A, and it does not mean that the indication information must carry A.

[0446] The indication methods involved in the embodiments of this application should be understood to encompass various methods that enable the party to be indicated to obtain information to be indicated. The information to be indicated can be sent as a whole or divided into multiple sub-information and sent separately. The transmission period and / or timing of these sub-information can be the same or different. This application does not limit the specific transmission method.

[0447] In the embodiments of the present application, the "indication information" may be an explicit indication, i.e., a direct indication via signaling, or may be obtained based on parameters indicated by the signaling, in combination with other rules, other parameters, or by deduction. It may also be an implicit indication, i.e., based on a rule or relationship, or based on other parameters, or by deduction. This application does not impose specific limitations on this.

[0448] 6) In this application, "protocol" may refer to a standard protocol in the field of communications, such as 5G protocol, NR protocol, and related protocols used in future communication systems, which are not limited in this application. "Predefined" may include pre-definition. For example, protocol definition. "Preconfiguration" can be implemented by pre-saving corresponding codes, tables, or other methods that can be used to indicate relevant information in the device. This application does not limit its specific implementation method.

[0449] 7) In this application, "communication" may also be described as "data transmission", "information transmission", "data processing", etc. "Transmission" includes "sending" and "receiving".

[0450] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0451] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0452] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the explicit or discussed mutual coupling or direct coupling or communication connection can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0453] The units described as separate components may or may not be physically separate, and the components explicitly described as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of the solution of this embodiment according to actual needs.

[0454] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0455] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory, a random access memory, a magnetic disk, or an optical disk.

[0456] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A communication method, characterized in that: include: When the terminal device registers with the network through the first mobility management function network element and the second mobility management function network element respectively, storing the identifier of the first mobility management function network element and the identifier of the second mobility management function network element; In the case where it is determined that the terminal device needs to be primary authenticated, sending a first authentication notification message to the first mobility management function network element, where the first authentication notification message is used to request triggering primary authentication of the terminal device; Receiving a first authentication response message from the first mobility management function network element, where the first authentication response message is used to indicate that the first mobility management function network element cannot initiate primary authentication for the terminal device; In response to the first authentication response message, sending a second authentication notification message to the second mobility management function network element, where the second authentication notification message is used to request triggering a primary authentication of the terminal device; Receiving a second authentication response message from the second mobility management function network element; When it is determined based on the second authentication response message that the second mobility management function network element can initiate the primary authentication of the terminal, a first notification message is sent to the first mobility management function network element, and the first notification message is used to instruct the first mobility management function network element to cancel the first suspension flag, and the first suspension flag is used to indicate the need to trigger the primary authentication of the terminal device.

2. The method according to claim 1, characterized in that: The first authentication response message includes a first cause value, and the first cause value is used to indicate that the first mobility management function network element cannot initiate primary authentication for the terminal device.

3. The method according to claim 1 or 2, characterized in that: The method further comprises: In response to the first authentication response message, setting a first authentication suspension flag, where the first authentication suspension flag is used to indicate that the first suspension flag is set on the first mobility management function network element; The sending of a first notification message to the first mobility management function network element includes: According to the first authentication suspension flag, the first notification message is sent to the first mobility management function network element.

4. The method according to claim 3, characterized in that After sending the first notification message to the first mobility management function network element, the method further includes: Delete the first authentication suspension flag.

5. The method according to claim 1 or 2, characterized in that: The sending a second authentication notification message to the second mobility management function network element in response to the first authentication response message includes: In response to the first authentication response message, a second authentication notification message is sent to the second mobility management function network element according to the identifier of the second mobility management function network element.

6. The method according to any one of claims 1 to 5, characterized in that The method further comprises: Under the condition that any one of the following conditions is met, determining that the second mobility management function network element can initiate primary authentication for the terminal; The second authentication response message carries a response message to the second authentication notification message; or, The second authentication response message does not carry a second cause value, and the second cause value is used to indicate that the second mobility management function network element cannot initiate the primary authentication of the terminal device.

7. The method according to any one of claims 1 to 6, characterized in that When it is determined that the primary authentication for the terminal device cannot be started according to the second authentication response message, and the third mobility management function network element subsequently starts the primary authentication for the terminal, performing any of the following operations on the fourth mobility management function network element: Notify the fourth mobility management function network element to cancel the suspension mark; or, rejecting the primary authentication request initiated by the fourth mobility management function network element; The third mobility management function network element is one of the first mobility management function network element and the second mobility management function network element, and the fourth mobility management function network element is the other one of the first mobility management function network element and the second mobility management function network element except the third mobility management function network element.

8. The method according to claim 7, characterized in that The method further comprises: Receiving a first request message triggered by the third mobility management function network element, where the first request message is used to request primary authentication of the terminal device, and the first request message includes a second service network name, where the second service network name is used to indicate a service network where the third mobility management function network element is located; According to the second service network name, it is determined that the operation needs to be performed on the fourth mobility management function network element.

9. The method according to claim 8, characterized in that The determining, according to the second service network name, that the operation needs to be performed on the fourth mobility management function network element includes: determining, according to the second service network name, and the stored identifier of the first mobility management function network element and the identifier of the second mobility management function network element, that the operation needs to be performed on the fourth mobility management function network element; or, According to the name of the second service network, and the set first authentication suspension flag and second authentication suspension flag, it is determined that the operation needs to be performed on the fourth mobility management function network element, wherein the first authentication suspension flag is used to indicate that the first suspension flag is set on the first mobility management function network element, and the second authentication suspension flag is used to indicate that the second suspension flag is set on the second mobility management function network element, and the second suspension flag is used to indicate that it is necessary to trigger the main authentication of the terminal device.

10. The method according to claim 8 or 9, characterized in that: Before determining that the operation needs to be performed on the fourth mobility management function network element, the method further includes: Determining to perform primary authentication on the terminal device; Sending an authentication vector to the third mobility management function network element, where the authentication vector is used to perform primary authentication on the terminal device; Receiving an authentication result for the terminal device; The determining that the fourth mobility management function network element is required includes: When the authentication result indicates that the authentication of the terminal device is successful, it is determined that the operation needs to be performed on the fourth mobility management function network element.

11. The method according to claim 10, characterized in that Before receiving the first request message triggered by the third mobility management function network element, the method further includes: In the case of determining that the first mobility management function network element and the second mobility management function network element cannot start the primary authentication of the terminal device, setting the first authentication suspension flag and the second authentication suspension flag; The determining to perform primary authentication on the terminal device includes: According to the first authentication suspension flag and the second authentication suspension flag stored, it is determined to perform a primary authentication on the terminal device.

12. The method according to any one of claims 8 to 11, characterized in that Before determining, according to the second service network name, that the operation needs to be performed on the fourth mobility management function network element, the method further includes: determining, according to the second service network name and the stored correspondence between the second service network name and the third mobility management function network element, that the first request message is triggered by the third mobility management function network element; or, According to the identifier of the public land mobile network included in the second service network name and the stored correspondence between the identifier of the public land mobile network and the third mobility management function network element, it is determined that the first request message is triggered by the third mobility management function network element.

13. The method according to any one of claims 8 to 12, characterized in that Before determining, according to the second service network name, that the operation needs to be performed on the fourth mobility management function network element, the method further includes: Receive a second request message triggered by the fourth mobility management function network element, the second request message is used to request primary authentication of the terminal device, the second request message includes a third service network name, and the third service network name is used to indicate the service network where the fourth mobility management function network element is located.

14. A communication method, characterized in that: The method comprises: In the case where the terminal device registers with the network through the first mobility management function network element and the second mobility management function network element respectively, the home network element stores the identifier of the first mobility management function network element and the identifier of the second mobility management function network element; In the case where it is determined that the terminal device needs to be authenticated, the home network element sends a first authentication notification message to the first mobility management function network element, and the first mobility management function network element receives the first authentication notification message from the home network element, where the first authentication notification message is used to request triggering of the primary authentication of the terminal device; In the case of determining that the primary authentication for the terminal device cannot be started, the first mobility management function network element sends a first authentication response message to the home network element, and the home network element receives the first authentication response message from the first mobility management function network element, where the first authentication response message is used to indicate that the first mobility management function network element cannot start the primary authentication for the terminal device; In response to the first authentication response message, the home network element sends a second authentication notification message to the second mobility management function network element, and the second mobility management function network element receives the second authentication notification message from the home network element, where the second authentication notification message is used to request triggering a primary authentication of the terminal device; The home network element sends a second authentication response message to the second mobility management function network element, and the home network element receives the second authentication response message from the second mobility management function network element; After determining, according to the second authentication response message, that the second mobility management function network element can initiate primary authentication for the terminal In this case, the home network element sends a first notification message to the first mobility management function network element, and the first mobility management function network element receives the first notification message from the home network element, where the first notification message is used to instruct the first mobility management function network element to delete a first suspension flag, where the first suspension flag is used to indicate that a primary authentication of the terminal device needs to be triggered; The first mobility management function network element deletes the first suspension flag according to the first notification message.

15. The method according to claim 14, characterized in that The first authentication response message includes a first cause value, and the first cause value is used to indicate that the first mobility management function network element cannot initiate primary authentication for the terminal device.

16. The method according to claim 14 or 15, characterized in that The method further comprises: In response to the first authentication response message, the home network element sets a first authentication suspension flag, where the first authentication suspension flag is used to indicate that the first suspension flag is set on the first mobility management function network element; The home network element sending a first notification message to the first mobility management function network element includes: The home network element sends the first notification message to the first mobility management function network element according to the first authentication suspension flag.

17. The method according to claim 16, characterized in that The method further comprises: When it is determined that the primary authentication of the terminal device by the second mobility management function network element is successful, the home network element deletes the first authentication suspension flag.

18. The method according to any one of claims 14 to 17, characterized in that When it is determined according to the second authentication response message that the primary authentication for the terminal cannot be started, and subsequently one of the first mobility management function network element and the second mobility management function network element starts the primary authentication for the terminal, the home network element performs any of the following operations on the other of the first mobility management function network element and the second mobility management function network element: The home network element notifies the other one of the first mobility management function network element and the second mobility management function network element to cancel the suspension flag; or, The home network element rejects a primary authentication request initiated by the other of the first mobility management function network element and the second mobility management function network element.

19. The method according to claim 18, characterized in that The method further comprises: The third mobility management function network element sends a first request message to the home network element, and the home network element receives the first request message triggered by the third mobility management function network element, where the first request message is used to request a primary authentication for the terminal device, and the first request message includes a second service network name, where the second service network name is used to indicate a service network where the third mobility management function network element is located; The home network element determines, according to the second service network name, that the operation needs to be performed on the fourth mobility management function network element.

20. The method according to claim 19, characterized in that The home network element determines, according to the second service network name, that the operation needs to be performed on the fourth mobility management function network element, including: The home network element determines, according to the second service network name, and the stored identifier of the first mobility management function network element and the identifier of the second mobility management function network element, that the operation needs to be performed on the fourth mobility management function network element; or, The hometown network element determines that the operation needs to be performed on the fourth mobility management function network element based on the second service network name, and the set first authentication suspension flag and second authentication suspension flag, wherein the first authentication suspension flag is used to indicate that the first suspension flag is set on the first mobility management function network element, the second authentication suspension flag is used to indicate that the second suspension flag is set on the second mobility management function network element, and the second suspension flag is used to indicate that it is necessary to trigger the main authentication of the terminal device.

21. The method according to claim 19 or 20, characterized in that Before determining that the operation needs to be performed on the fourth mobility management function network element, the method further includes: The home network element determines to perform primary authentication on the terminal device; The home network element sends an authentication vector to the third mobility management function network element, and the third mobility management function network element receives the authentication vector from the home network element, where the authentication vector is used to perform primary authentication on the terminal device; The third mobility management function network element sends an authentication result for the terminal device to the home network element, and the home network element receives the authentication result for the terminal device from the third mobility management function network element; The determining that the fourth mobility management function network element is required includes: In a case where the authentication result indicates that the primary authentication of the terminal device is successful, the home network element determines that the operation needs to be performed on the fourth mobility management function network element.

22. The method according to claim 20, characterized in that Before the home network element receives the first request message triggered by the third mobility management function network element, the method further includes: In the case of determining that the first mobility management function network element and the second mobility management function network element cannot start the primary authentication of the terminal device, the home network element sets the first authentication suspension flag and the second authentication suspension flag; The home network element determines to perform primary authentication on the terminal device, including: The home network element determines to perform primary authentication on the terminal device according to the first authentication suspension flag and the second authentication suspension flag stored therein.

23. The method according to any one of claims 19 to 22, characterized in that Before the home network element determines, according to the second service network name, that the operation needs to be performed on the fourth mobility management function network element, the method further includes: The home network element determines that the triggering of the first request message comes from the third mobility management function network element according to the second service network name and the stored correspondence between the second service network name and the third mobility management function network element; or, The home network element determines that the triggering of the first request message comes from the third mobility management function network element according to the identifier of the public land mobile network included in the second service network name and the correspondence between the saved identifier of the public land mobile network and the third mobility management function network element.

24. The method according to any one of claims 19 to 23, characterized in that Before the home network element determines, according to the second service network name, that the operation needs to be performed on the fourth mobility management function network element, the method further includes: The home network element receives a second request message from the fourth mobility management function network element, where the second request message is used to request primary authentication of the terminal device, and the second request message includes a third service network name, where the third service network name is used to indicate the service network where the fourth mobility management function network element is located.

25. A communication device, characterized in that: include: One or more functional modules, wherein the one or more functional modules are used to execute the method according to any one of claims 1 to 13.

26. A communication device, characterized in that: include: a processor coupled to the memory; The processor is configured to execute the computer program stored in the memory, so that the apparatus performs the method according to any one of claims 1 to 13.

27. A computer-readable storage medium, characterized in that: include: The computer-readable storage medium stores a computer program, and when the computer program is executed on a computer, the computer is caused to execute the method according to any one of claims 1 to 13.

Images