Communication method and communication apparatus

Abstract

Provided in the present application are a communication method and a communication apparatus, which are applied to a scenario in which a terminal device (e.g., an IoT device) accesses a 5GC by means of a user equipment (e.g., a UE), or the user equipment accesses the 5GC. After the user equipment is registered with the 5GC, during the process of the user equipment triggering session establishment or session updating, the method comprises: receiving an NAS request message from a user equipment; acquiring user identity information according to the NAS request message; and establishing or updating a session according to the user identity information, wherein the user identity information is used for indicating a user of the user equipment. In the technical solution of the present application, authentication and authorization are performed on user identity information, so as to support a terminal device or a user equipment to access a 5GC, i.e., acquiring a connection service and traffic management and control, which are provided by means of the 5GC, thereby avoiding or reducing potential network security risks.

Description

Communication method and communication device

[0001] This application claims priority to the Chinese patent application with application number 202311190383.9 filed with the State Intellectual Property Office of China on September 14, 2023, and priority to the Chinese patent application with the invention name “Communication Method and Communication Device”, all contents of which are incorporated by reference into this application. Technical Field

[0002] The embodiments of the present application relate to the field of communications, and more specifically, to a communication method and a communication device. Background Art

[0003] In a communication system, for example, the fifth-generation (5G) mobile communication network not only supports user equipment (UE) to access the 5G core network (5G core, 5GC) through the wireless technology defined by the 3rd generation partnership project (3GPP), but also supports UE to access the 5GC through non-3GPP access technology. Among them, the UE is a terminal device that supports a subscriber identity module (SIM) card and a non-access stratum (NAS) signaling module. For example, after the UE establishes a communication connection with a cellular wireless network, the UE sends NAS signaling to the control plane network element of the 5GC, and the control plane network element performs security authentication on the UE based on the authentication vector in the NAS signaling. For UEs that have successfully authenticated, the registration process from the UE to the 5GC is completed based on the NAS signaling. The 5GC can generate context information for the UE, perform mobility management on the UE, and provide network connection services and business control.

[0004] With the development of mobile networks, 5GC has evolved from being consumer-oriented (2C) to business-oriented (2B), and can be used in scenarios such as campuses, factories, and museums. However, Internet of Things (IoT) devices in 2B scenarios cannot access 5GC because they lack cellular access technology, SIM cards, and NAS signaling modules. As a result, mobile operators are unable to provide 5GC-based connectivity services and business management for IoT devices.

[0005] Summary of the Invention

[0006] The present application provides a communication method and a communication device, in which a core network element establishes or updates a session based on user identity information, so that a terminal device or user device can obtain connection services and business management provided by the network based on the session.

[0007] In a first aspect, a communication method is provided. The method may be executed by a core network element, or may be executed by a chip or circuit of the core network element, which is not limited in this application. For ease of description, the following description is based on an example of execution by a core network element.

[0008] The method includes: receiving a NAS request message from a user device, the NAS message being used to request establishing a session or updating a session; obtaining user identity information according to the NAS request message, the user identity information being used to indicate a user of the user device; and establishing or updating a session according to the user identity information.

[0009] It should be understood that this method is applied when a user device triggers the establishment or update of a session after registering with the core network. In other words, the session establishment or update is triggered based on the user identity information, and the core network element can determine whether the session establishment or update is successful by verifying the user identity information.

[0010] Exemplarily, the user of a user device includes: the user of the user device being the user of the user device, and the user identity information being the user identity information of the user of the user device; or, the terminal device being in communication with the user device, the user of the user device being the user of the terminal device, and the user identity information being the user identity information of the user of the terminal device. The terminal device is a terminal device that supports a non-3GPP access technology and does not support NAS signaling. In other words, the terminal device may not have cellular access capabilities, does not support NAS signaling, and does not support a SIM card.

[0011] It should be noted that the communication connection between the terminal device and the user device can be understood as follows: the user turns on the Wi-Fi hotspot function of the user device. Assuming that the access point identifier of the above Wi-Fi hotspot is A, this access point identifier A can be identification information set at the user's granularity, such as an access point identifier set by the user at will, or it can also be identification information set at the 2B business granularity, such as using the company name as a unified access point identifier. The terminal device (such as a laptop, iPad, etc.) scans for available Wi-Fi hotspots, selects the Wi-Fi hotspot with access point identifier A, and initiates the connection process to the above Wi-Fi hotspot. That is, the terminal device and the user device complete the establishment of a layer 2 (L2) connection. The specific implementation method of the connection process can refer to the existing protocol.

[0012] Exemplarily, the terminal device may be an IoT device (such as a laptop), and the user device may be a UE (such as a mobile phone). For ease of description and distinction, the embodiments of the present application use terminal device and user device to represent IoT device and UE, respectively. The difference between the two is that the user device supports cellular access technology, SIM card and NAS signaling module, while the IoT device does not support cellular access technology, supports non-3GPP access technology, does not support SIM card, and does not have a NAS signaling module. Among them, non-3GPP access technology includes wireless local area network (WLAN) access technology, Bluetooth access technology, wired access technology, fixed network access technology, or short-range access technology.

[0013] Optionally, the NAS request message may be an uplink non-access stratum transport (UL NAS transport) message or a protocol data unit (PDU) session establishment / update request message. For example, the NAS request message received by the access and mobility management function (AMF) from the UE may be a UL NAS transport message, and the UL NAS transport message may include a session establishment / update request message (for example, PDU session establishment / modification request). The AMF continues to send the session establishment / update request message to the session management function (SMF), and the SMF is responsible for managing the establishment, modification, and release of the PDU session.

[0014] Optionally, when the UL NAS transport message contains user identity information, the AMF obtains the user identity information from the above UL NAS transport message, and then the AMF continues to send the user identity information to the SMF through the interface between the AMF and the SMF. Alternatively, the PDU session establishment / update request message contains user identity information, and the AMF continues to forward the PDU session establishment / update request message to the SMF through the interface between the AMF and the SMF, and the SMF obtains the user identity information from the PDU session establishment / update request message.

[0015] Exemplarily, the NAS request message includes a data network name (DNN) and slice information.

[0016] Furthermore, the NAS request message may also include identification information of the user device and / or user identity information (User ID). It should be understood that the user identity information is used to indicate the user using the terminal device, and the user identity information is different from the identification information of the terminal device. The identification information of the terminal device may be an identity document (ID) of the device, or may be the address information of the device, such as an Internet Protocol (IP) address or a Media Access Control (MAC) address, or may be other forms of expression used to identify the terminal device. The user identity information may be the identity information of the user to whom the terminal device belongs, or may be the identification information of the user (or the identity information of the user using the IoT device), such as an employee's work number, or a user name, or a user ID number, or may be other forms of expression used to identify the user using the terminal device. In other words, the user identity information is used to identify the user, indicating a "person", while the identification information of the terminal device is used to identify the device.

[0017] Optionally, user identity information (User ID) can be restricted to terminal devices (IoT devices, or devices without 5GC access capabilities), or it can be unrestricted to terminal devices. For example, when a user logs in to an application (APP) on a user device (mobile phone), the user ID is used, and 5GC can also determine whether to allow the user to use this APP based on the user ID. Therefore, user identity information can be used on devices that do not support 5GC (non 5GC capable device) (such as IoT devices) or on devices that support 5GC (5GC capable device) (such as UE), and this application does not impose any restrictions on this.

[0018] That is to say, the technical solution of the present application can be applicable to scenarios where a terminal device (IoT device) requests access to 5GC by connecting to a user device, and 5GC determines whether to establish or update a session corresponding to the user identity information by authenticating the user identity information of the terminal device, that is, whether the terminal device is allowed to access 5GC. Alternatively, it can also be applicable to scenarios where a user device requests access to 5GC by carrying user identity information, and 5GC determines whether to establish or update a session corresponding to the user identity information by authenticating the user identity information of the user device, that is, whether the user device is allowed to access 5GC.

[0019] In an embodiment of the present application, for a scenario where a terminal device (IoT device) accesses a core network (such as 5GC) through a user device (such as UE), the user identity information (User ID) of the terminal device is authenticated to determine whether the terminal device is allowed to access the core network, that is, whether the core network supports providing network access services and business management to the terminal device. In addition, authenticating the user identity information is more secure than authenticating the terminal device. Verifying the user identity information can prevent illegal users from accessing the core network, or prevent illegal users from maliciously attacking the core network, or enable the core network to clearly identify which user uses which services, thereby facilitating business management and control, and avoiding or reducing potential security risks.

[0020] Optionally, the core network element sends a NAS response message to the user equipment, and the NAS response message is used to indicate that the session establishment or update is successful. Exemplarily, the session establishment / update process may include: the user equipment sends an Uplink NAS transport message to the AMF, carrying a PDU session establishment / modification request message, and the AMF forwards the PDU session establishment / modification request to the SMF. The Uplink NAS transport message carries DNN and slice information. The AMF selects the SMF and sends the DNN and slice information to the SMF. The SMF is responsible for managing the establishment, modification, maintenance and release of the PDU session of the terminal device. The specific implementation method can refer to the existing protocol. Furthermore, the terminal device or user equipment can interact with the data network through the session.

[0021] In combination with the first aspect, in some implementations of the first aspect, obtaining user identity information according to a NAS request message includes: receiving user identity information from a data network-authentication, authorization, and accounting (DN-AAA) server according to the NAS request message; or receiving user identity information from a user device according to the NAS request message.

[0022] In combination with the first aspect, in certain implementations of the first aspect, the NAS request message includes a data network name, and the method further includes: sending a first authentication and authorization message (e.g., EAP-Request / Identity) to a user device based on the data network name, the first authentication and authorization message being used to request authentication of a terminal device or a user device; and receiving a first authentication response message (e.g., EAP-Response / Identity) from the user device, the first authentication response message including user identity information.

[0023] Receiving user identity information from the DN-AAA server according to the NAS request message includes: determining the address of the DN-AAA server according to the data network name; sending a second authentication message to the DN-AAA server according to the address of the DN-AAA server, the second authentication message including the first authentication response message, the second authentication message being used to request authentication of the user identity information; and receiving a first message from the DN-AAA server when the user identity information authentication is successful, the first message including the user identity information and the second message being used to indicate that the user identity information authentication is successful.

[0024] Exemplarily, the implementation method in which the above-mentioned core network element determines the address of the DN-AAA server based on the data network name can be that the core network element obtains the DN-AAA server address from the DNN-related contract data, where the DNN-related contract data can be obtained from the unified data management function (UDM) or the policy control function (PCF), or the core network element obtains the DN-AAA server address from the UE. This application does not limit this.

[0025] It should be noted that this application does not limit the message names such as the first authentication message, the second authentication message, and the first authentication response message.

[0026] Exemplarily, before the SMF sends the second authentication and authorization message to the DN-AAA server, the SMF obtains user identity information from the NAS request message, or obtains user identity information from the message sent by the AMF. The SMF then generates a first authentication response message containing the user identity information and sends it to the DN-AAA via a second authentication and authorization message containing the first authentication response message. Alternatively, the SMF sends the first authentication and authorization message to the user equipment, and the user equipment replies with the first authentication and authorization message, carrying the user identity information in the first authentication and authorization message. The SMF then forwards the first authentication and authorization message carrying the user identity information to the DN-AAA via a second authentication and authorization message.

[0027] Optionally, the above-mentioned NAS request message may not include the data network name. In this case, after receiving the NAS request message, the AMF or SMF can determine the subscription data of the user device and / or the subscription data of the user identity information based on the identification information of the user device and / or the user identity information carried in the NAS request message, and then obtain the default data network name in the NAS request message from the subscription data of the user device or the subscription data of the user identity information. Then, the AMF or SMF can trigger the authentication process for the user device or terminal device based on the data network name.

[0028] Among them, the contract data of the user device or the contract data of the user identity information can be configured by the core network management system to the policy control function network element or the unified data management function network element, or sent by the application function network element to the policy control function network element or the unified data management function network element through the network open function network element. Then the core network network element can query the policy control function network element or the unified data management function network element by carrying the identification information and / or user identity information of the user device to obtain the contract data of the user device or the contract data of the user identity information.

[0029] Based on the above solution, the core network element can trigger the authentication process for the terminal device based on the NAS request message and, after receiving the authentication response, request the DN-AAA server to authenticate the user's identity information. In other words, the core network element will only obtain the user's identity information from the DN-AAA server if the user's identity information is authenticated successfully. The terminal device can then access the core network, providing enhanced security and avoiding or reducing potential network security risks.

[0030] In combination with the first aspect, in certain implementations of the first aspect, the first message further includes one or more of the following: the IP address of the session, the user level, the quality of service (QoS) parameter, or the second indication information, the QoS parameter indicating the QoS control parameter for the service data flow of the session, the second indication information being used to indicate statistics on the service flow or data flow of the session, and the user level being used to indicate the service level of the user. The method further includes: the core network element determining policy information corresponding to the user identity information based on the user level and / or QoS parameter. The policy information may be a QoS policy, including at least one of the maximum bandwidth of the service, the guaranteed bandwidth of the service, the latency, the packet loss rate, and the traffic volume, for example, reporting the number of packet losses to the core network every T1 time period, and detecting the duration, traffic volume, bandwidth, and other information used by the terminal device to access the target website every T2 time period.

[0031] Optionally, the core network network element can determine the session used by the terminal device or user device to access the core network based on the IP address of the session carried in the first message. Subsequently, the terminal device or user device can access the core network based on the IP address and obtain the services provided by the core network.

[0032] Optionally, the core network network element can determine to perform statistics on the service flow or data flow after the terminal device or user device accesses the core network based on the second indication information carried in the first message. For example, after the terminal device or user device accesses the core network, the core network element can perform statistics on one or more web pages or applications logged in by the terminal device or user device, as well as information such as the duration or traffic of using the web pages or applications. This also facilitates the core network side to accurately schedule and allocate resources for the terminal device or user device in real time, thereby ensuring network transmission bandwidth, reducing network transmission delay, and improving the utilization of network resources.

[0033] Based on the above solution, core network elements can independently determine policy information and accurately schedule and allocate resources for terminal devices in real time, thereby ensuring network transmission bandwidth, reducing network transmission latency, and improving network resource utilization.

[0034] In combination with the first aspect, in certain implementations of the first aspect, a request message is sent to a policy control function network element or a unified data management function network element, where the request message is used to request policy information corresponding to user identity information, and the request message includes user identity information; and policy information is received from the policy control function network element or the unified data management function network element, where the policy information is determined based on the user level and / or QoS parameters corresponding to the user identity information.

[0035] Based on the above solution, core network elements can obtain policy information from policy control function elements or unified data management function elements, which can be used for subsequent resource scheduling and allocation for terminal devices, etc., to ensure network transmission bandwidth, reduce network transmission delay, and improve network resource utilization.

[0036] In combination with the first aspect, in certain implementations of the first aspect, an IP address of the session is obtained; and user identity information and the IP address are sent to the DN-AAA server.

[0037] Based on the above solution, the DN-AAA server can assign an IP address to the user identity information and send it to the core network element. Alternatively, the core network element or user plane function (UPF) can assign the IP address to the user identity information. It should be understood that an IP address generally represents a unique address used to identify a device on the Internet or a local network.

[0038] In combination with the first aspect, in certain implementations of the first aspect, the user identity information is carried in the NAS request message.

[0039] For example, a user device, acting as an authenticator, sends an EAP-Request / Identity message to a terminal device, requesting authentication of the terminal device. In response, the terminal device parses the EAP-Request / Identity message and sends an EAP-Response / Identity message to the user device. The EAP-Response / Identity message carries the user ID. Furthermore, based on the user ID, the user device triggers a session establishment / update process for the terminal device.

[0040] In combination with the first aspect, in certain implementations of the first aspect, establishing or updating a session based on user identity information includes: obtaining contract data of a user device or contract data of user identity information based on the user identity information; establishing or updating a session based on the contract data of the user device or contract data of the user identity information.

[0041] Optionally, the contract data of the user device or the contract data of the user identity information can be configured by the core network management system to the policy control function network element or the unified data management function network element, or sent by the application function network element to the policy control function network element or the unified data management function network element through the network open function network element. Then the core network network element can obtain the contract data of the user device or the contract data of the user identity information by querying the policy control function network element or the unified data management function network element.

[0042] In combination with the first aspect, in certain implementations of the first aspect, the subscription data of the user device includes a user identity information list and / or third indication information, the user identity information list contains at least one user identity information, the at least one user identity information is used to indicate at least one user identity information that the user device is allowed to access, and the third indication information is used to indicate that any user identity information is allowed to access the core network from the user device.

[0043] Among them, establishing or updating a session based on the subscription data of the user device includes: establishing or updating a session when the user identity information is included in the user identity information list, or when the subscription data of the user device includes the third indication information; or sending a NAS response message to the user device when the user identity information is not included in the user identity information list and the subscription data of the user device does not include the third indication information, the NAS response message is used to indicate that the session establishment failed or the update failed. Optionally, the NAS response message may carry a failure reason value to indicate that the user identity information is not included in the user identity information list and the subscription data of the user device does not include the third indication information, that is, the core network element refuses to establish or update the session corresponding to the user identity information, and thus the user device or terminal device cannot access 5GC, and cannot obtain the connection service and business control provided by 5GC.

[0044] Based on the above solution, the core network network element determines whether to establish or update a session by judging whether the user identity information is included in the user identity information list, or by judging whether the subscription data of the user device contains the third indication information, so that subsequent terminal devices or user devices can access the core network while ensuring network security.

[0045] In combination with the first aspect, in certain implementations of the first aspect, the subscription data of the user identity information includes a user device identification list and / or first indication information, the user device identification list contains at least one user device identification, and the at least one user device identification is used to indicate at least one user device that the user identity information allows access to, and the first indication information is used to indicate that the user identity information allows access to the core network from any user device.

[0046] Among them, establishing or updating a session based on the subscription data of the user identity information includes: establishing or updating a session when the identifier of the user device is included in the user device identifier list, or when the subscription data of the user identity information includes the first indication information; or sending a NAS response message to the user device when the identifier of the user device is not included in the user device identifier list and the subscription data of the user identity information does not include the first indication information, the NAS response message is used to indicate that the session establishment failed or the update failed. Optionally, the NAS response message may carry a failure reason value, and the failure reason value is used to indicate that the identifier of the user device is not included in the user device identifier list and the subscription data of the user identity information does not include the first indication information, that is, the core network element refuses to establish or update the session corresponding to the user identity information, and thus the user device or terminal device cannot access the 5GC, and cannot obtain the connection service and business control provided by the 5GC.

[0047] Based on the above solution, the core network network element determines whether to establish or update a session by judging whether the user device identifier is included in the user device identifier list, or by judging whether the contract data of the user identity information contains the first indication information, so that subsequent user devices or terminal devices can access the core network while ensuring network security.

[0048] In a second aspect, a communication method is provided, which can be executed by a user device, or by a chip or circuit of the user device, which is not limited in this application. For ease of description, the following description is based on an example of execution by a user device.

[0049] The method includes: acquiring user identity information, where the user identity information is used to indicate a user of a user device; and sending an NAS request message to a core network element based on the user identity information, where the NAS request message is used to request to establish a session or update a session.

[0050] Optionally, the NAS request message includes user identity information.

[0051] It should be understood that this method is applied when a user device triggers the establishment or update of a session after registering with the core network. In other words, the session establishment or update is triggered based on the user identity information, and the core network element can determine whether the session establishment or update is successful by verifying the user identity information.

[0052] According to the solution provided by this application, for the scenario where a terminal device (IoT device) accesses a core network (such as 5GC) through a user device (such as UE), the user identity information (User ID) of the terminal device is authenticated to determine whether the terminal device is allowed to access the core network, that is, whether the core network supports providing network access services and business management to the terminal device. In addition, by authenticating the user identity information, compared with authenticating the terminal device, security is higher, and verifying the user identity information can prevent illegal users from accessing the core network, or prevent illegal users from maliciously attacking the core network, or enable the core network to clearly understand which user uses which services, facilitate business management and control, and avoid or reduce potential security risks.

[0053] In combination with the second aspect, in certain implementations of the second aspect, the user device obtains user identity information, including obtaining user identity information of the user of the user device, where the user of the user device is the user of the user device, and the user identity information is the user identity information of the user of the user device; or, when the user device establishes a communication connection with a terminal device, obtaining the user identity information from the terminal device, where the user of the user device is the user of the terminal device, and the user identity information is the user identity information of the user of the terminal device, and the terminal device is a terminal device that supports non-3GPP access technology and does not support NAS signaling.

[0054] In combination with the second aspect, in certain implementations of the second aspect, obtaining user identity information includes: sending a request message to a terminal device, the request message is used to request obtaining user identity information; receiving a response message from the terminal device, the response message includes user identity information, and the user identity information is used to indicate the user using the terminal device.

[0055] In combination with the second aspect, in certain implementations of the second aspect, before the user equipment triggers the establishment or update of a session, the method also includes: receiving a routing selection policy from a core network element, the routing selection policy including an access point identifier and / or user identity information, the access point identifier being used to indicate an access point name provided by the user equipment.

[0056] In conjunction with the second aspect, in certain implementations of the second aspect, sending a NAS request message to a core network element based on user identity information includes: sending a NAS request message to the core network element when the access point used by the terminal device for communication with the user device is the same as the access point indicated by the access point identifier included in the routing policy; and / or sending a NAS request message to the core network element when the user identity information obtained by the user device is the same as the user identity information included in the routing policy.

[0057] In combination with the second aspect, in certain implementations of the second aspect, the routing selection strategy also includes indication information, and sends an NSA request message to the core network network element based on the user identity information, including: when the indication information is used to instruct the terminal device to establish a communication connection with the user device from the access point corresponding to the access point identifier, or the indication information is used to indicate when obtaining the user identity identification information, a NAS request message is sent to the core network network element.

[0058] Optionally, when different terminal devices access from access points in the routing policy, the user equipment initiates different session establishment / update request processes. Alternatively, when the user equipment obtains different user identity information, the user equipment initiates different session establishment / update request processes.

[0059] The beneficial effects of the above-mentioned second aspect and certain implementation methods of the second aspect can be referred to the corresponding description of the first aspect, and will not be repeated here.

[0060] In a third aspect, a communication device is provided, comprising: a transceiver unit for receiving a NAS request message from a user device, the NAS request message being used to request establishing or updating a session; a processing unit for obtaining user identity information based on the NAS request message, the user identity information being used to indicate a user of the user device; and the processing unit further for establishing or updating a session based on the user identity information.

[0061] The transceiver unit can perform the reception and transmission processing in the aforementioned first aspect, and the processing unit can perform other processing except reception and transmission in the aforementioned first aspect.

[0062] In a fourth aspect, a communication device is provided, which includes: a transceiver unit for obtaining user identity information, where the user identity information is used to indicate a user of a user device; the transceiver unit is also used to send a NAS request message to a core network element based on the user identity information, where the NAS request message is used to request to establish a session or update a session.

[0063] The transceiver unit can perform the reception and transmission processing in the aforementioned second aspect, and the processing unit can perform other processing except reception and transmission in the aforementioned second aspect.

[0064] In a fifth aspect, a communication device is provided, comprising a processor coupled to a memory, the memory being used to store a computer program, and the processor being used to call and run the computer program from the memory, so that the device executes the method of the above-mentioned first aspect or second aspect and any possible implementation thereof.

[0065] Optionally, there are one or more processors and one or more memories.

[0066] Optionally, the memory may be integrated with the processor, or the memory may be provided separately from the processor.

[0067] Optionally, the communication device further includes a transceiver.

[0068] In a sixth aspect, a communication system is provided, comprising: a core network element, the core network element being used to execute the method in the above-mentioned first aspect and any possible implementation thereof.

[0069] Optionally, the communication system further includes a user device, and the user device is used to execute the method in the above-mentioned second aspect and any possible implementation manner thereof.

[0070] Optionally, the communication system further includes a unified data management function network element, a policy control function network element, an access and mobility management function network element, a session management function network element, a data network-authentication and billing server, or a terminal device.

[0071] In the seventh aspect, a computer-readable storage medium is provided, which stores a computer program or code. When the computer program or code is run on a computer, the computer executes the method in the above-mentioned first aspect or second aspect and any possible implementation thereof.

[0072] In the eighth aspect, a chip is provided, comprising at least one processor, wherein the at least one processor is coupled to a memory, the memory being used to store a computer program, and the processor being used to call and run the computer program from the memory, so that a device equipped with the chip system executes the method in the above-mentioned first aspect or second aspect and any possible implementation thereof.

[0073] The chip may include an input circuit or interface for sending information or data, and an output circuit or interface for receiving information or data.

[0074] In a ninth aspect, a computer program product is provided, comprising: a computer program code, which, when running on the computer, executes the method in the first aspect or the second aspect and any possible implementation thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] 1 to 3 are schematic diagrams of the network architecture applicable to the present application.

[0076] FIG4 is a flow chart of a communication method 400 provided in an embodiment of the present application.

[0077] FIG5 is a flow chart of a communication method 500 provided in an embodiment of the present application.

[0078] FIG6 is a flow chart of a communication method 600 provided in an embodiment of the present application.

[0079] FIG7 is a flow chart of a communication method 700 provided in an embodiment of the present application.

[0080] FIG8 is a schematic structural diagram of a communication device 1000 provided in an embodiment of the present application.

[0081] FIG9 is a schematic structural diagram of a communication device 2000 provided in an embodiment of the present application.

[0082] FIG10 is a schematic structural diagram of a chip system 3000 provided in an embodiment of the present application. DETAILED DESCRIPTION

[0083] The technical solution in this application will be described below with reference to the accompanying drawings.

[0084] The technical solutions provided in this application can be applied to various communication systems, such as new radio (NR) systems, long term evolution (LTE) systems, LTE frequency division duplex (FDD) systems, LTE time division duplex (TDD) systems, etc. The technical solutions provided in this application can also be applied to device-to-device (D2D) communication, vehicle-to-everything (V2X) communication, machine-to-machine (M2M) communication, machine type communication (MTC), and Internet of Things (IoT) communication systems or other communication systems.

[0085] In a communication system, the part operated by an operator may be referred to as a public land mobile network (PLMN), or as an operator network, etc. PLMN is a network established and operated by the government or an operator approved by it for the purpose of providing land mobile communication services to the public. It is mainly a public network in which mobile network operators (MNOs) provide mobile broadband access services to users. The PLMN described in the embodiments of the present application may specifically be a network that complies with the requirements of the 3GPP standard, referred to as a 3GPP network. 3GPP networks generally include but are not limited to 5G networks, fourth-generation mobile communication (4th-generation, 4G) networks, and other future communication systems, such as sixth-generation mobile communication (6th-generation, 6G) networks.

[0086] For ease of description, the embodiments of this application will be described using PLMN or 5G network as an example.

[0087] Figure 1 is a schematic diagram of a network architecture 100 applicable to the present application, taking the 5G network architecture based on the service-based architecture (SBA) in a non-roaming scenario defined in the 3GPP standardization process as an example. As shown in Figure 1, the network architecture may include a terminal device portion, a data network (DN) portion, and an operator network PLMN portion. The operator network PLMN portion may include, but is not limited to, a (radio) access network (R)AN) 120 and a core network (CN) portion.

[0088] The following is a brief description of the functions of the network elements in each part.

[0089] The terminal equipment portion may include UE 110, which is a device that provides voice and / or data connectivity to users. In this application, UE 110 is a device with wireless transceiver capabilities that can communicate with one or more core network (CN) devices via access network equipment (or access equipment) in (radio) access network (R)AN 120. UE 110 may also be referred to as an access terminal, terminal, subscriber unit, subscriber station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, user agent, or user device. UE 110 may be deployed on land, including indoors or outdoors, handheld or vehicle-mounted; on water (e.g., on ships); or in the air (e.g., on airplanes, balloons, and satellites). UE 110 may be a cellular phone, a cordless phone, a Session Initiation Protocol (SIP) phone, a smartphone, a mobile phone, a wireless local loop (WLL) station, a personal digital assistant (PDA), or the like. Alternatively, UE 110 may also be a handheld device with wireless communication capabilities, a computing device, or other device connected to a wireless modem, an in-vehicle device, a wearable device, an unmanned aerial vehicle device, or a terminal in the Internet of Things, the Internet of Vehicles, a terminal of any form in a 5G network and future networks, a relay user device, or a terminal in a future evolved 6G network, etc. Among them, the relay user device may be, for example, a 5G residential gateway (RG). The embodiment of the present application does not limit the type or category of UE. For ease of description and distinction, the embodiment of the present application uses terminal device and user device to represent two types of terminals, respectively, wherein the terminal device may be a desktop computer, printer, portable notebook, etc. commonly used in corporate offices, which may be collectively referred to as an IoT device (or terminal device), and the user device may be the UE 110 described above. The difference between the two is that the user device supports cellular access technology, has a SIM card and a NAS signaling module, while the IoT device does not support cellular access technology, does not support a SIM card, does not have a NAS signaling module, and supports non-3GPP access technology. Among them, non-3GPP access technologies include WLAN access technology, Bluetooth access technology, wired access technology, fixed network access technology, or short-distance access technology.

[0090] (R)AN 120 may include one or more access network elements or access network devices, and the interface between the access network device and the terminal device may be a Uu interface (or air interface, that is, the messages exchanged between the access network device and the terminal device may be called air interface messages). Of course, in future communications, the interface name may remain unchanged or may be replaced by other names, and this application is not limited to this. (R)AN 120 is a device that provides wireless communication functions for UE 110, and can connect the terminal device to a node or device of a wireless network, and may also be called a network device. (R)AN 120 can be regarded as a subnet of the operator network, and is an implementation system between the service node in the operator network and UE 110. For example, UE 110 can connect to the service node of the operator network through (R)AN 120, thereby obtaining the services provided by the service node. (R)AN 120 includes but is not limited to: next generation node base station (gNB) in 5G system, evolved node B (eNB) in LTE, radio network controller (RNC), node B (NB), base station controller (BSC), base transceiver station (BTS), home base station (for example, home evolved nodeB, or home node B, HNB), base band unit (BBU), transmitting and receiving point (TRP), transmitting point (TP), small base station equipment, mobile switching center, or network equipment in future networks, etc. The access network equipment may also be a module or unit that performs the functions of a base station, such as a centralized unit (CU) and a distributed unit (DU); for example, the CU may be used to support communications under protocols such as radio resource control (RRC), packet data convergence protocol (PDCP), and service data adaptation protocol (SDAP); and the DU may be used to support communications under radio link control (RLC) layer protocols, MAC layer protocols, and physical layer protocols. The embodiments of the present application do not limit the specific technology and specific device form used by the access network equipment.In systems using different wireless access technologies, the names of devices with access network device functions may vary. For ease of description, in all embodiments of the present application, the above-mentioned devices providing wireless communication functions for UE 110 are collectively referred to as access network devices or RAN for short.

[0091] The CN part may include but is not limited to the following network functions (NF): user plane function UPF130, network exposure function (NEF) 131, network function repository function (NRF) 132, policy control function PCF133, unified data management function UDM134, unified data repository function (UDR) 135, application function (AF) 136, authentication server function (AUSF) 137, access and mobility management function AMF138, and session management function SMF139.

[0092] The data network DN 140, also known as a packet data network (PDN), is usually a network located outside the operator's network, such as a third-party network or an Internet service. For ease of description, the embodiment of the present application uses the network in DN 140 for providing authentication, certification, and billing services, and the wired network includes fixed home network access, etc. The network side architecture is similar to the non-trusted non-3GPP access architecture, and the non-trusted non-3GPP access gateway (such as the N3IWF shown in Figure 2) is replaced with a trusted WLAN access gateway (trusted non-3GPP gateway function, TNGF), or replaced with a wired network access gateway (wireline access gateway function, W-AGF). The access network equipment between the UE and the above-mentioned access gateway includes: a wireless access point (WLAN access point, WLAN AP), a wired network access network device (fixed Access network, FAN), a switch, or a router, etc.

[0093] In other words, N3G access technologies include trusted WLAN access, untrusted WLAN access, and wired access. For both trusted and untrusted non-3GPP access, 5GC can use a point-to-point interface protocol as shown in Figure 2, or a service-based interface consistent with the 3GPP access core network architecture shown in Figure 1 above.

[0094] In summary, 5GC not only supports UE access to 5GC through 3GPP-defined wireless technologies (such as LTE, 5G RAN, etc.), but also supports UE access to 5GC through non-3GPP access technologies (such as N3IWF or next generation packet data gateway (ngPDG)).

[0095] Figure 3 is a schematic diagram of another network architecture 300 using the present application. The application scenario of the present application can be an enterprise campus 2B scenario, where the enterprise campus is covered by a network deployed by a mobile operator. The types of terminal devices in the enterprise campus are very different from those in the 2C scenario. For example, the terminal devices commonly used in corporate offices are desktop computers, printers, portable notebooks, etc., which can be collectively referred to as IoT devices. In addition, the enterprise campus also includes a DN-AAA server and 5GC, where the control plane network elements of the 5GC include AUSF, UDM, PCF, AMF and SMF, etc. For specific network element introductions, please refer to the relevant description in Figure 1. For example, an IoT device can access the 5GC via a WLAN hotspot provided by a mobile phone (e.g., User 1). For example, User 1 or User 2 logs into the IoT device, and the IoT device accesses the AMF in the 5GC via the WLAN hotspot provided by User 1's mobile phone. Alternatively, an IoT device can access the 5GC via WLAN or wired access technology provided by 5G customer premises equipment (CPE). For example, User 4 logs into the IoT device, and the IoT device accesses the UPF, SMF, or DN-AAA in the 5GC via the WLAN hotspot provided by the 5G CPE. The 5G CPE can be deployed indoors (e.g., in an employee office) and can connect to the IoT device via a WLAN interface or a wired interface. Alternatively, the two can establish a communication connection via wireless access technology. It should be understood that a CPE is a mobile signal access device that receives mobile signals and forwards them as wireless Wi-Fi signals. It is typically located at the customer's premises and can be a telephone or other service.

[0096] Considering that currently supported UE access to 5GC in consumer (2C) scenarios, these UEs are terminal devices that support SIM cards and NAS signaling modules, such as smartphones. With the development of mobile networks, mobile operators are gradually deploying 5GC for enterprise (2B) scenarios. Unlike UEs, IoT devices in enterprises generally support WLAN or Bluetooth access technologies. Since IoT devices do not support cellular access, lack SIM cards, or NAS signaling modules, they cannot access 5GC using existing solutions. This means that mobile operators cannot provide connectivity services to IoT devices based on 5GC. Furthermore, 5GC authentication of UEs is based on the UE authentication vector, which is carried in the UE's SIM card. As IoT devices lack SIM cards, the network cannot authenticate the IoT device itself when accessing the network. Instead, authentication must be performed on the user using the IoT device. In other words, the attributes of an IoT device are not a factor in determining whether it can access 5GC. For example, if an employee uses a laptop to access the enterprise campus network, authentication should be successful as long as the employee is a legitimate user of the enterprise, regardless of the laptop used. Therefore, when IoT devices are connected to 5GC, the network side needs to authenticate the users who use the IoT devices, rather than the IoT devices themselves, to prevent illegal users from accessing the network or launching malicious attacks on the network, thereby ensuring network security.

[0097] In view of this, an embodiment of the present application provides a communication method and device, which authenticates the user identity information of a terminal device (or user device) to determine whether to establish or update a session associated with the user identity information, thereby avoiding or reducing potential security risks.

[0098] The communication method provided by the embodiment of the present application will be described in detail below with reference to the accompanying drawings. The embodiment provided by the present application can be applied to any communication scenario in which a transmitting device and a receiving device communicate, for example, it can be applied to the communication system shown in Figures 1 to 3 above. In order to realize the communication between the core network element and the communication device in the RAN service-oriented architecture, the present application proposes the following methods shown in Figures 4 to 7. It should be understood that the method embodiments shown in Figures 4 to 7 can be combined with each other, and the steps in the method embodiments shown in Figures 4 to 7 can be referenced to each other. For example, in the embodiment of the present application, the method embodiments shown in Figures 5 to 7 can be regarded as possible implementation methods for realizing the functions of the method embodiment shown in Figure 4, wherein Figure 5 mainly illustrates the authentication and authorization of the user identity information sent by the DN-AAA server to the core network element, and Figure 6 mainly illustrates the authentication and authorization of the user equipment of the terminal device to the core network element based on the extension of the NAS message. In addition, Figure 7 mainly illustrates the user equipment using the user identity information to access the core network network.

[0099] Figure 4 is a flow chart of a communication method 400 provided in an embodiment of the present application. As shown in Figure 4, the method flow can be executed by a terminal device, a user device, a core network element, and a data network-authentication and billing server, or by a module and / or device (for example, a chip or integrated circuit, etc.) with corresponding functions installed in the terminal device, the user device, the core network element, and the data network-authentication and billing server, and the present application does not limit this. For ease of description, the following description is based on the terminal device, the user device, the core network element, and the data network-authentication and billing server as the execution entities. The method includes the following multiple steps. For parts not fully described, reference can be made to existing protocols.

[0100] S410: The user equipment obtains user identity information, where the user identity information is used to indicate a user of the user equipment.

[0101] It should be understood that the term "user of a user device" includes: the user of the user device being the user of the user device, and the user identity information being the user identity information of the user of the user device; or, the user device being the user of the terminal device, and the user identity information being the user identity information of the user of the terminal device, in a communication connection between the terminal device and the user device. The terminal device is a terminal device that supports non-3GPP access technologies and does not support NAS signaling. In other words, the terminal device may not have cellular access capabilities, support NAS, or support SIM cards.

[0102] Exemplarily, the terminal device may be an IoT device (such as a personal computer (PC)), and the user equipment may be a UE (such as a mobile phone). The difference between the two is that the user equipment supports cellular access, SIM card, and NAS signaling module, while the terminal device does not support cellular access, SIM card, and NAS signaling module. In other words, the terminal device is a terminal device that does not support SIM card and NAS signaling module when accessing the core network through 3GPP technology. It should be understood that the terminal device supports non-3GPP access technology, which includes WLAN access technology, Bluetooth access technology, wired access technology, fixed network access technology, or short-range access technology.

[0103] In one example, a user device sends a request message to a terminal device, such as an EAP request message (such as an EAP-identity request message), where the request message is used to obtain user identity information; correspondingly, the user device receives a reply message from the terminal device, where the reply message includes user identity information, where the user identity information is used to indicate a user using the terminal device.

[0104] In another example, the user device locally obtains user identity information, where the user identity information is used to indicate a user using the user device.

[0105] S420: The user equipment sends a NAS request message to the core network element based on the user identity information. Correspondingly, the core network element receives the NAS request message from the user equipment. The NAS message is used to request to establish a session or update a session.

[0106] It should be understood that the session is triggered to be established or updated based on the user identity information. The success of the session establishment or update is determined by verifying the user identity information. In the embodiment of the present application, if the session establishment or update is unsuccessful, the terminal device cannot access the 5GC.

[0107] Exemplarily, the NAS request message includes the data network name DNN and slice information.

[0108] It should be understood that the NAS request message also includes the identification information of the user device and / or user identity information (User ID). It should be understood that the user identity information is used to indicate the user using the terminal device, and the user identity information is different from the identification information of the terminal device. The identification information of the terminal device can be a device ID, or it can also be the address information of the device, such as an IP address or a MAC address, or it can also be other forms of expression for identifying the terminal device. The user identity information can be the identity information of the user to whom the terminal device belongs, or it can also be the identification information of the user (or the identity information of the user using the IoT device), such as an employee's work number, or a user name, or a user ID number, or it can also be other forms of expression for identifying the user using the terminal device. In other words, the user identity information is used to identify the user, indicating a "person", while the identification information of the terminal device is used to identify the device.

[0109] Optionally, the NAS request message may be a UL NAS transport message or a PDU session establishment / modification request message. For example, the NAS request message received by the AMF from the user equipment may be a UL NAS transport message, which includes a session establishment / modification request message (PDU session establishment / modification request). The AMF then sends the session establishment / modification request message to the SMF, which is responsible for managing the establishment, modification, and release of the PDU session.

[0110] Optionally, when the UL NAS transport message contains user identity information, the AMF obtains the user identity information from the above UL NAS transport message, and then the AMF continues to send the user identity information to the SMF through the interface between the AMF and the SMF. Alternatively, the PDU session establishment / update request message contains user identity information, and the AMF continues to forward the PDU session establishment / update request message to the SMF through the interface between the AMF and the SMF, and the SMF obtains the user identity information from the PDU session establishment / update request message.

[0111] Exemplarily, the PDU session establishment / update process includes: the user equipment sends an Uplink NAS transport message to the AMF, carrying a PDU session establishment / modification request message, and the AMF forwards the PDU session establishment / modification request to the SMF. The Uplink NAS transport message carries DNN and slice information. The AMF selects the SMF and sends the DNN and slice information to the SMF. The SMF is responsible for managing the establishment, modification, maintenance and release of the PDU session of the terminal device. The specific implementation method can refer to the existing protocol. Furthermore, the terminal device or user equipment can communicate with the core network element based on the PDU session to obtain the connection service provided by the core network.

[0112] Optionally, user identity information (User ID) can be restricted to terminal devices (IoT devices, or devices without 5GC access capabilities), or it can be unrestricted to terminal devices. For example, when a user logs in to an APP on a user device (mobile phone), the user ID is used, and 5GC can also determine whether to allow the user to use this APP based on the user ID. Therefore, user identity information can be used on devices that do not support 5GC (non5GC capable device) (such as IoT devices) or on devices that support 5GC (5GC capable device) (such as UE), and this application does not impose any restrictions on this.

[0113] That is to say, the technical solution of the present application can be applicable to scenarios where a terminal device (IoT device) requests access to 5GC through a user device, and 5GC determines whether to establish or update a session corresponding to the user identity information by authenticating the user identity information of the terminal device, that is, whether the terminal device is allowed to access 5GC. Alternatively, it can also be applicable to scenarios where a user device requests access to 5GC by carrying user identity information, and 5GC determines whether to establish or update a session corresponding to the user identity information by authenticating the user identity information of the user device, that is, whether the user device is allowed to access 5GC.

[0114] Before executing step S410, the method 400 may further include S401 and S402.

[0115] S401: User equipment registers with the core network.

[0116] Exemplarily, the user equipment sends an N1 message to the AMF to request registration with the 5GC. For example, the N1message is a registration request message, carrying the user equipment's Subscription Concealed Identifier (SUCI) or the 5G Globally Unique Temporary Identifier (5G-GUTI). Correspondingly, the AMF initiates identity authentication to the user equipment, for example, using the 5G Authentication and Key Agreement (5G-AKA) authentication method or the Extensible Authentication Protocol-Authentication and Key Agreement (EAP-AKA') authentication method. Only when the user equipment's authentication is passed can the user equipment complete the registration process. For specific implementation methods, please refer to the existing protocol.

[0117] It should be noted that after the user equipment is registered with the 5GC, the user equipment can obtain the user equipment's route selection policy (URSP) from the core network element. For example, the PCF sends the URSP policy to the AMF, and then the AMF sends the URSP policy to the user equipment through a NAS message. Furthermore, the user equipment can use the URSP to determine which path its data traffic is sent through. For example, the user equipment can use the URSP rules to select an existing session connected to a data network (DN) to send its data traffic, or it can send its data traffic by establishing a new session in a specific network slice.

[0118] Exemplarily, the URSP policy includes an access point identifier and / or user identity information. The access point identifier is used to indicate the access point provided by the user equipment. For example, the access point identifier can be at least one of a service set identifier (SSID), a homogeneous extended service set identifier (HESSID), and a basic service set identifier (BSSID). Optionally, this application does not limit the number and specific form of the access point identifier and / or user identity information carried in the URSP policy.

[0119] Optionally, the URSP policy also includes indication information #1, which is used to indicate that when the terminal device accesses the access point represented by the above-mentioned access point identifier, the user device establishes / updates an independent PDU session for the terminal device. Alternatively, indication information #1 is used to indicate that the user device establishes / updates a PDU session for the terminal device corresponding to the user identity information (for example, indicating a user using the terminal device, or a user logging into the terminal device using user identity information). It should be noted that when the URSP policy does not include indication information #1, the access point identifier or user identity information can be used as indication information #1. At this time, the access point identifier or user identity information includes the function of indication information #1 in addition to its own meaning.

[0120] Optionally, when different terminal devices access from the access point in the URSP policy, the user device initiates different session establishment / update request processes. Alternatively, when the user device obtains different user identity information, the user device initiates different session establishment / update request processes. For example, when initiating different session establishment / update request processes, the user device carries different terminal device identifiers in different session establishment / update request messages, and / or carries different DNN or slice information in session establishment requests for different terminal devices, and / or carries different session identifiers in session establishment / update requests for different terminal devices, so as to ensure a one-to-one correspondence between different terminal devices and different sessions.

[0121] S402, optionally, the terminal device is connected to the user device for communication.

[0122] For example, a user activates the Wi-Fi hotspot function on a user device. Assuming the access point identifier for the Wi-Fi hotspot is A, this access point identifier A can be user-defined at a granular level, such as a user-defined access point identifier, or it can be granularly defined at a 2B service level, such as using a company name as the access point identifier. The terminal device (e.g., a PC, laptop, iPad, etc.) scans for available Wi-Fi hotspots, selects the Wi-Fi hotspot with access point identifier A, and initiates a connection to the Wi-Fi hotspot. The specific implementation method can refer to existing protocols, i.e., the terminal device and the user device complete the establishment of an L2 connection.

[0123] Next, a specific implementation method of the user equipment sending the NAS request message to the core network element in the above step S420 is described.

[0124] Exemplarily, after the user equipment establishes an L2 connection with the terminal device, the user equipment sends a NAS request message to the core network element according to the URSP policy.

[0125] In one implementation, when the access point used by the terminal device to communicate with the user equipment matches the access point indicated by the access point identifier included in the URSP policy, the user equipment sends an NAS request message to the core network element. For example, if the terminal device connects to the user equipment using a Wi-Fi hotspot with access point identifier A, which is included in the URSP policy, the user equipment triggers the establishment / update of a PDU session for the terminal device.

[0126] In another implementation, the user device, acting as an authenticator, sends an EAP-Request / Identity message to the terminal device requesting authentication of the terminal device; in response, it receives an EAP-Response / Identity message from the terminal device. If the user identity information carried in the EAP-Response / Identity message matches the user identity information included in the URSP policy, the user device sends an NAS request message to the core network element. For example, if the EAP-Response / Identity message carries user identity information #1, and this user identity information #1 is included in the URSP policy, the user device triggers the establishment / update of a PDU session for the terminal device. In other words, if the user device successfully authenticates the terminal device, the user device sends a NAS request message to the core network element.

[0127] In yet another implementation, the user equipment triggers the establishment / update of a PDU session for the terminal device according to the indication information #1 carried in the URSP policy.

[0128] Optionally, the user device may save the L2 connection between the user device and the terminal device, and the correspondence between the PDU session initiated by the user device for the terminal device, and / or the user device may save the correspondence between the terminal device and the PDU session. For example, the user device assigns a PDU session ID to this PDU session, and the user device may store the correspondence between the L2 connection and the PDU session ID. The L2 connection between the user device and the terminal device may be a MAC address identifier of the terminal device or an L2 identifier of the terminal device, that is, the user device may store the correspondence between the MAC address of the terminal device and the PDU session ID, or the correspondence between the L2 identifier of the terminal device and the PDU session ID.

[0129] S430: The core network element obtains user identity information according to the NAS request message.

[0130] Method 1:

[0131] Exemplarily, the core network element receives user identity information from the user equipment according to the NAS request message. For example, the user identity information is carried in the NAS request message in step S420.

[0132] For example, after executing step S402, the user device acts as an authenticator and sends an EAP-Request / Identity message to the terminal device to request authentication of the terminal device; correspondingly, the terminal device parses the EAP-Request / Identity message and replies with an EAP-Response / Identity message to the user device. The EAP-Response / Identity message carries the user identity information User ID. Furthermore, the user device triggers a session establishment / update process for the terminal device based on the user identity information User ID and the URSP policy. For example, the UE sends a UL NAS transport message to the AMF, and the UL NAS transport message carries a PDU session establishment request message, wherein the UL NAS transport and / or PDU session establishment request message carries the User ID. Correspondingly, after obtaining the UL NAS transport message, the AMF continues to forward the PDU session establishment request message to the SMF, that is, the core network element obtains the User ID of the terminal device.

[0133] Method 2:

[0134] Exemplarily, the core network element receives user identity information from the DN-AAA server according to the NAS request message.

[0135] Optionally, the NAS request message may be a UL NAS transport message or a PDU session establishment / update request message. For example, the AMF receives a UL NAS transport message sent by the user equipment, which may carry a PDU session establishment / modification request message. The AMF then sends the PDU session establishment / modification request message to the SMF, which is responsible for managing the establishment, modification, and release of the PDU session.

[0136] First, in response to a NAS request message received from a user equipment (UE), the core network element triggers the terminal device authentication process based on the DNN carried in the NAS request message. Specifically, the core network element sends a NAS message to the UE, which carries an EAP-Request / Identity message requesting authentication for the UE.

[0137] For example, the SMF first sends the EAP-Request / Identity message to the AMF, and then the AMF encapsulates the EAP-Request / Identity message in a NAS message and sends it to the user device. Correspondingly, the user device receives and parses the NAS message to obtain the EAP-request / identify message. Then, based on the correspondence between the locally stored L2 connection and the PDU session, or the correspondence between the terminal device and the PDU session (for example, the correspondence between the MAC address of the terminal device and the PDU session ID), and the PDU session information (for example, the PDU session ID) carried in the NAS message, the user device can determine that the PDU session is established / updated for the terminal device, and then forward the parsed EAP-request / identify message to the terminal device based on the MAC address of the terminal device. For example, the user device can send the EAP-Request / Identify through the L2 connection established between it and the terminal device, or the user device can also send the EAP-Request / Identify through the WLAN air interface between the user device and the terminal device. Correspondingly, after parsing the EAP-Request / Identity message, the terminal device replies with an EAP-Response / Identity message to the user device. This EAP-Response / Identity message carries the user identity information (User ID). Correspondingly, the user device encapsulates the received EAP-Response / Identity message in a NAS message and sends this NAS message to the core network element. This EAP-Response / Identity message carries the User ID. For example, the user device sends a NAS message carrying the EAP-Request / Identity message to the AMF, which then forwards the EAP-Request / Identity message to the SMF. It should be understood that the EAP-Response / Identity message can be understood as being sent from the terminal device to the core network element via the user device. In other words, the EAP-Response / Identity message is transparently transmitted to the core network element by the user device. The user device does not parse the EAP-Response / Identity message and is therefore unaware of the user identity information carried in the EAP-Response / Identity message.

[0138] Furthermore, after receiving the EAP-Response / Identity message, the core network element determines the address of the DN-AAA server based on the DNN carried in the NAS request message in step S420, and then sends an authentication message to the DN-AAA server, carrying the user identity information, requesting the DN-AAA server to perform an authentication process with the terminal device based on the identity information. After parsing the authentication message, the DN-AAA server obtains corresponding context information based on the user identity information, and then performs an authentication process with the terminal device to determine whether to establish or update a session.

[0139] For example, the SMF sends an authentication and authorization message to the DN-AAA server through the interface between the SMF and the DN-AAA, carrying the above-mentioned received EAP-Response / Identity message. Alternatively, the SMF sends the authentication and authorization message to the UPF, and the UPF forwards the authentication and authorization message to the DN-AAA server, which is not limited in this application. In addition, the authentication and authorization message may also include identification information of the user device, such as the GPSI identifier of the user device, or the SUPI identifier of the user device. Optionally, the address of the DN-AAA server can be obtained from the contract data of the DNN by the core network element, or it can be obtained from the user device, which is not limited in this application. Correspondingly, the DN-AAA server parses the authentication and authorization message to obtain the identification information of the user device and the User ID contained in the EAP-Response / Identity. The DN-AAA searches for the corresponding context information based on the User ID, and performs the authentication process based on the User ID and its user password to determine whether to establish or update the session. For example, DN-AAA interacts with the terminal device to obtain the user password corresponding to the User ID and checks whether the User ID and password match the User ID context information. If so, a session is established or updated, and the user identity information is sent to the core network element. Otherwise, the session establishment / update request is rejected, and access services are denied to the terminal device or user equipment. The specific implementation of the authentication process can be referenced in existing protocols.

[0140] Exemplarily, the context information of the User ID (or the User ID subscription data) includes one or more of the following:

[0141] 1) User ID

[0142] For example, user identity information is used to identify the user using the terminal device. In other words, the user identity information is the identity information of the user to whom the terminal device belongs. Alternatively, it can be user identification information, such as an employee's work ID, username, or ID number. It should be understood that user identity information is used to identify the user, representing a "person," rather than to identify the device.

[0143] 2) User password (password)

[0144] For example, user passwords are usually used together with user identity information to ensure the confidentiality of information. The security authentication function of the password is used to achieve the authenticity of information, the integrity of data and the non-repudiation of behavior, and avoid or reduce potential network security risks.

[0145] 3) User equipment identification list (e.g., allowed UE ID list)

[0146] Exemplarily, the user equipment identifier list includes at least one user equipment identifier, which is used to indicate identifiers of user equipment that are allowed to access by the user identity information.

[0147] 4) First indication information (e.g., any UE ID indication)

[0148] Exemplarily, the first indication information indicates that the user identity information can be accessed through any user equipment.

[0149] 5) User Level

[0150] Exemplarily, the user level is used to indicate the service level of the user, such as gold user, silver user, bronze user, etc.

[0151] 6)QoS parameters.

[0152] Exemplarily, the QoS parameter is used to represent QoS parameter information of the data flow of this session, such as at least one of the parameters including the maximum bandwidth of the service, the guaranteed bandwidth of the service, delay, and packet loss rate.

[0153] Optionally, the above-mentioned NAS request message may not include the data network name. In this case, after receiving the NAS request message, the AMF or SMF can determine the subscription data of the user device and / or the subscription data of the user identity information based on the identification information of the user device and / or the user identity information carried in the NAS request message, and then obtain the default data network name in the NAS request message from the subscription data of the user device or the subscription data of the user identity information. Then, the AMF or SMF can trigger the authentication process for the user device or terminal device based on the data network name. The specific implementation method can be referred to the relevant description above and will not be repeated here.

[0154] Exemplarily, the contract data of the user device or the contract data of the user identity information can be configured by the core network management system to the policy control function network element or the unified data management function network element, or sent by the application function network element to the policy control function network element or the unified data management function network element through the network open function network element. Then the core network network element can query the policy control function network element or the unified data management function network element by carrying the identification information and / or user identity information of the user device to obtain the contract data of the user device or the contract data of the user identity information.

[0155] S440: The core network element establishes or updates a session according to the user identity information.

[0156] The following describes how a core network element and a DN-AAA server authenticate user identity information of a terminal device to determine whether to establish or update a session.

[0157] Method 1:

[0158] Exemplarily, the core network element determines whether to establish or update a session based on the user identity information (User ID) in the NAS request message in S420 and the acquired subscription data of the user device or the subscription data of the user identity information. It should be understood that if it is determined that the session is to be established or updated, the user device or terminal device can access the core network.

[0159] Optionally, the subscription data of the user equipment or the subscription data of the user identity information can be configured into the UDM or PCF by the core network management system, or sent by the AF to the UDM or PCF through the NEF. For example, the AMF sends a subscription request message to the UDM / PCF, carrying the identifier of the user equipment (e.g., UE ID) and / or User ID to obtain the subscription data of the user equipment or the subscription data of the user identity information.

[0160] Exemplarily, the subscription data of the user device (or the context information of the user device) includes one or more of the following: user identity information, user password, allowed User ID list (i.e., user identity information list), any User ID indication (i.e., third indication information), user level, and QoS parameters. Among them, the allowed User ID list contains at least one User ID, which is used to indicate the User ID information that this user device is allowed to access. The Any User ID indication is used to indicate that this user device allows any User ID to access. The interpretation of other parameters can be referred to the relevant description of the User ID subscription data above and will not be explained here.

[0161] In one implementation, when the user identity information is included in the allowed User ID list, or the subscription data of the user device includes the any User ID indication, the core network element establishes or updates the session; or, when the user identity information is not included in the user identity information list, and the subscription data of the user device does not include the any User ID indication, the core network element may send a NAS response message to the user device, and the NAS response message is used to indicate that the session establishment or update failed. Optionally, the NAS response message may carry a failure reason value, and the failure reason value is used to indicate that the user identity information is not included in the user identity information list and the subscription data of the user device does not include the any User ID indication, that is, the core network element refuses to establish or update the session corresponding to the User ID, that is, the terminal device or user device is not allowed to access the core network. For example, the allowed User ID list contains User ID#1 and User ID#2, indicating that User ID#1 and User ID#2 are allowed to access 5GC through the user device. If the User ID in the NAS request message is equal to User ID#1 or User ID#2, the SMF establishes or updates the session. If the User ID in the NAS request message is equal to User ID#3, the SMF determines that the terminal device is not allowed to access 5GC. Optionally, the SMF can send a rejection message to the user device, carrying a rejection reason value, to refuse to provide access services to the terminal device. For another example, if the subscription data of the user device contains the any User ID indication, indicating that any User ID is allowed to access 5GC through the user device, then as long as the NAS request message carries the User ID, the SMF can establish or update a session for the terminal device to access 5GC through the user device.

[0162] In another implementation, when the identifier of the user equipment is included in the allowed UE ID list, or the User ID subscription data includes the any UE ID indication, a session is established or updated; or, when the identifier of the user equipment is not included in the user equipment identifier list, and the User ID subscription data does not include the any User ID indication, the core network element may send a NAS response message to the user equipment, and the NAS response message is used to indicate that the session establishment or update failed. Optionally, the NAS response message may carry a failure cause value, and the failure cause value is used to indicate that the identifier of the user equipment is not included in the user equipment identifier list and the User ID subscription data does not include the any User ID indication, that is, the core network element refuses to establish or update the session corresponding to the User ID, that is, the terminal device or user equipment is not allowed to access the core network. For example, the allowed UE ID list includes the identifier of user device 1 and the identifier of user device 2, indicating that the User ID is allowed to access 5GC through user device 1 or user device 2. If the identifier of the user device in the NAS request message is the same as the identifier of user device 1 or the identifier of user device 2, the SMF determines that the terminal device is allowed to access 5GC; if the identifier of the user device in the NAS request message is equal to the identifier of user device 3, the SMF determines that the terminal device is not allowed to access 5GC. Optionally, the SMF can send a rejection message to the user device, carrying a rejection reason value, to refuse to provide access services to the terminal device. For another example, if the User ID subscription data includes the any UE ID indication, indicating that the User ID is allowed to access 5GC through any user device, then as long as the NAS request message carries the identifier of the user device, the SMF can determine that the user device is allowed to access 5GC.

[0163] Method 2:

[0164] Exemplarily, the DN-AAA server searches for the contract data of the User ID based on the User ID, and determines whether to establish or update the session based on the contract data of the User ID, that is, determines whether the user equipment or terminal equipment is allowed to access the core network network core network element. The specific implementation method can refer to the authentication process of the above-mentioned core network element.

[0165] It should be noted that user authentication is typically based on a username and password. For example, the username is the employee's work ID, and the password is a personal login password. For example, if an employee uses a PC to access the enterprise campus network, authentication should succeed regardless of the PC used, as long as the employee is a legitimate user of the enterprise.

[0166] Furthermore, for a terminal device that has successfully authenticated the user identity information, in response to an authentication and authorization message (i.e., a first message) received from a core network element, the DN-AAA server replies to the core network element with an authentication and authorization response message that carries the user identity information and an EAP-Success message (i.e., a second message) to indicate successful authentication of the user identity information. For example, the DN-AAA server sends the authentication and authorization message via the interface between the SMF and the DN-AAA server, or sends the authentication and authorization message to the SMF via the UPF.

[0167] Optionally, the authentication and authorization message may further include one or more of the following parameters: IP address; user level; QoS parameters; and indication information #2 (i.e., second indication information). Indication information #2 is used to indicate that statistics should be collected on the data flow or service flow of the session, such as at least one of traffic flow statistics, duration statistics, and statistics on target website visits. For the meanings of the other parameters, see the relevant descriptions above.

[0168] Optionally, the core network network element can determine the session used by the terminal device or user device to access the core network based on the IP address of the session carried in the first message. Subsequently, the terminal device or user device can access the core network based on the IP address and obtain the services provided by the core network.

[0169] Optionally, the core network network element can determine to perform statistics on the service flow or data flow after the terminal device or user device accesses the core network based on the second indication information carried in the first message. For example, after the terminal device or user device accesses the core network, the core network element can perform statistics on one or more web pages or applications logged in by the terminal device or user device, as well as information such as the duration or traffic of using the web pages or applications. This also facilitates the core network side to accurately schedule and allocate resources for the terminal device or user device in real time, thereby ensuring network transmission bandwidth, reducing network transmission delay, and improving the utilization of network resources.

[0170] It should be noted that the above technical solution is described in the scenario where a terminal device requests access to 5GC through a user device, and 5GC determines whether to establish or update a session corresponding to the user identity information by authenticating the user identity information of the terminal device, that is, whether the terminal device is allowed to access 5GC. Optionally, the present application is also applicable to a scenario where a user device requests access to 5GC by carrying user identity information, and 5GC determines whether to establish or update a session corresponding to the user identity information by authenticating the user identity information of the user device, that is, whether the user device is allowed to access 5GC. For specific implementation methods, please refer to method 700 below, which will not be described here. It should be understood that compared to the existing solution of verifying the identity of the user device (such as UE ID) to determine whether the user device is allowed to access 5GC, authenticating the user identity information can be an additional verification based on verifying the identity of the user device, which is more secure, and verifying the user identity information can prevent illegal users from using 5GC, or prevent illegal users from maliciously attacking the network, or can enable 5GC to clearly understand which user uses which services, facilitating service management and control.

[0171] Optionally, when the user identity information authentication is passed, the method 400 further includes: the core network element obtaining the IP address corresponding to the user identity information.

[0172] In one implementation, the IP address is included in the authentication and authorization message sent by the DN-AAA server to the core network element. In other words, the DN-AAA server allocates an IP address for the user identity information and sends it to the core network element.

[0173] In another implementation, if the core network element does not receive an IP address assigned by the DN-AAA server, the core network element can assign an IP address for the user identity information, or the UPF can assign an IP address. For specific implementations, refer to existing protocols. Optionally, the SMF sends a notification message to the DN-AAA server, where the notification message carries the user identity information and IP address. The DN-AAA server then resolves and obtains the IP address and stores it in the context information corresponding to the User ID. In other words, the core network element or the UPF assigns the IP address for the user identity information.

[0174] It should be understood that an IP address generally represents a unique address used to identify a device on the Internet or a local network, ie, a terminal device.

[0175] Optionally, if the user identity information authentication is successful, the 5GC can perform differentiated management and control based on user attributes (i.e., the user identity information (User ID) of the terminal device), or perform differentiated service QoS control based on different user levels. In other words, the method 400 further includes: the core network element obtains policy information.

[0176] In one implementation, a core network element determines policy information corresponding to user identity information according to a user class and / or QoS parameters.

[0177] In another implementation, a core network element sends a request message to the PCF / UDM to request policy information corresponding to the user identity information. The request message includes the user identity information. In response, the PCF / UDM sends the policy information to the core network element. Optionally, the policy information is determined based on the user class and / or QoS parameters corresponding to the user identity information.

[0178] Among them, the policy information can be a QoS policy, including at least one of the maximum bandwidth of the service, the guaranteed bandwidth of the service, delay, packet loss rate, and traffic. For example, the number of packet losses is reported to the core network every T1 time period, and the core network detects the duration, traffic, bandwidth, and other information statistics used by the terminal device to access the target website every T2 time period, so as to facilitate real-time and accurate resource scheduling and allocation for the terminal device, etc., to ensure network transmission bandwidth, reduce network transmission delay, and improve network resource utilization. In addition, the specific implementation method of the core network network element or PCF / UDM to determine the policy information according to the user level and / or QoS parameters can refer to the existing protocol, and this application does not limit this.

[0179] Further optionally, when the user identity information authentication is passed, that is, after the core network element receives the EAP-Success message from the DN-AAA server, the core network element continues to execute the subsequent PDU session establishment / update process. For example, the SMF sends a PDU session establishment / modification accept message to the AMF, carrying the EAP-Success message. The AMF can encapsulate the PDU session establishment / modification accept message in a DL NAS transport message and send it to the user device. The user device then parses the DL NAS transport message and the PDU session establishment / modification accept message to obtain the EAP-Success message. Finally, the user device can determine that the PDU session is established / updated for the terminal device based on the correspondence between the locally stored MAC address and the PDU session ID, and the PDU session ID carried in the DL NAS transport message or the PDU session establishment / modification accept message, and therefore forwards the EAP-Success message to the terminal device. The terminal device can then request the core network to provide access services based on the EAP-Success message.

[0180] In the technical solution of this application, in scenarios where a terminal device accesses 5GC through a user device, or a user device accesses 5GC, 5GC authenticates the user identity information of the terminal device or user device to determine whether to allow the terminal device or user device to access 5GC, that is, whether to provide network access services and business management to the terminal device or user device. In addition, authenticating user identity information can avoid or reduce potential security risks.

[0181] Figure 5 is a flow chart of the communication method 500 provided in an embodiment of the present application. As shown in Figure 5, taking the terminal device as PC, the user device as UE, the core network element as AMF / SMF, the data network authentication and billing server as DN-AAA server, and the core network as 5GC as an example, the implementation method mainly involves the DN-AAA server authenticating the User ID, and sending the user identity information User ID to the AMF / SMF if the authentication is successful. The method includes the following multiple steps, and the parts not described in detail can refer to the existing protocol. It should be understood that the relevant description in the embodiment shown in Figure 4 above is also applicable to this implementation method, and the same or similar technical means may exist between Figure 4 and Figure 5. The content described in the embodiment shown in Figure 4 will not be repeated here.

[0182] S501, UE registers to 5GC.

[0183] S502: The UE obtains the URSP policy of the UE.

[0184] For example, the UE may request the AMF to obtain the UE's URSP policy, and then the AMF may obtain the UE's URSP policy by querying the PCF; alternatively, the PCF may pre-configure the URSP policy to the AMF, and then the AMF may send the URSP policy to the UE through a NAS message.

[0185] Among them, the URSP policy includes access point identification and / or user identity information. For specific interpretation, please refer to the relevant description above. It should be understood that after the UE registers with the 5GC, the UE can obtain the UE's URSP from the AMF. Further, the UE can determine which path its data traffic is sent to the core network side based on the URSP policy. For example, the UE can select an existing session connected to a data network through the URSP policy to send its data traffic, or it can also send its data traffic by establishing a new session in a specific network slice.

[0186] S503: The PC establishes an L2 connection with the UE.

[0187] Among them, the URSP policy includes an access point identifier (such as specific-SSID) or a User ID. Optionally, the URSP policy also includes one or more of indication information #1, DNN, or slice information. The specific interpretation of the parameters can be found in the relevant description of 400 above.

[0188] The specific implementation of the above steps S501 to S503 may refer to the relevant description of the above steps S401 and S402.

[0189] S504, the UE sends a PDU session establishment / update request to the AMF / SMF, and correspondingly, the AMF / SMF receives the PDU session establishment / update request from the UE.

[0190] Among them, the PDU session establishment / update request carries DNN and slice information.

[0191] Exemplarily, the UE triggers a PDU session establishment / update process for the PC based on the URSP policy obtained in step S502. For example, when the UE determines that a new device (i.e., a PC) is connected to a Wi-Fi hotspot, and the access point identifier A of the Wi-Fi hotspot matches the access point identifier A included in the URSP policy in step S502, the UE initiates a PDU session establishment / update process for the PC. For specific implementation methods, refer to the relevant description of step S410 of the above method 400.

[0192] Optionally, the UE stores the correspondence between the L2 connection and the PDU session, or the UE stores the correspondence between the PC and the PDU session. For example, the UE allocates a PDU session ID for this PDU session, and the UE may store the correspondence between the L2 connection and the PDU session ID. The L2 connection between the UE and the PC may be identified by the PC's MAC address or the PC's L2 identifier. That is, the UE may store the correspondence between the PC's MAC address and the PDU session ID, or the correspondence between the PC's L2 identifier and the PDU session ID.

[0193] Furthermore, AMF / SMF triggers a secondary authentication process based on the DNN carried in the PDU session establishment / update request received in step S504, that is, executes the following step S505.

[0194] S505, AMF / SMF sends an EAP-request / identify message to the UE, and correspondingly, the UE receives the EAP-request / identify message from the AMF / SMF.

[0195] For example, the SMF first sends an EAP-request / identify message to the AMF, and then the AMF encapsulates the EAP-request / identify message in a NAS message and sends it to the UE to request authentication of the PC.

[0196] S506: The UE parses the NAS message.

[0197] Exemplarily, the UE can obtain an EAP-request / identify message by parsing the NAS message to obtain an EAP-request / identify message. Then, based on the correspondence between the locally stored MAC address of the PC and the PDU session ID, and the PDU session ID carried in the NAS message, the UE can determine that the PDU session is established for the PC, and then perform the following step S507.

[0198] S507 , the UE sends an EAP-request / identify message to the PC, and correspondingly, the PC receives the EAP-request / identify message from the UE.

[0199] Exemplarily, the UE sends an EAP-Request / Identity message to the PC through a WLAN air interface or an L2 connection between the UE and the PC.

[0200] S508: The PC parses the EAP-Request / Identity message.

[0201] S509 , the PC sends an EAP-Response / Identity message to the UE, and correspondingly, the UE receives the EAP-Response / Identity message from the PC.

[0202] The specific implementation method for the PC to parse the EAP-Request / Identity message can be referenced in existing protocols and is not described here. For example, in response to the EAP-Request / Identity message, the PC sends an EAP-Response / Identity message to the UE. The EAP-Response / Identity message includes the PC's user identity information, i.e., a User ID. The User ID is used to indicate the identity information of the user to which the PC belongs or the user's identification information, such as an employee ID or username; or the User ID is used to indicate the user using the PC, or the User ID is used to indicate the identity information of the user of the PC.

[0203] S510, the UE sends the EAP-Response / Identity message to the AMF / SMF, and correspondingly, the AMF / SMF receives the EAP-Response / Identity message from the UE.

[0204] For example, the UE sends an EAP-Response / Identity message to the AMF. The AMF then encapsulates the EAP-Response / Identity message in a NAS message and sends the NAS message to the SMF. It should be understood that the UE does not parse the EAP-Response / Identity message. It can be understood that the PC transparently transmits the EAP-Response / Identity message to the AMF / SMF through the UE.

[0205] S511, AMF / SMF determines the DN-AAA server address based on DNN.

[0206] Exemplarily, the DN-AAA server address can be obtained from the subscription data of the DNN, or obtained from the UE, which is not limited in this application.

[0207] S512, AMF / SMF sends an authentication and authorization message to the DN-AAA server. Correspondingly, the DN-AAA server receives an authentication and authorization message from AMF / SMF.

[0208] The authentication and authorization message includes the EAP-Response / Identity message received in step S510 and the UE identification information. The EAP-Response / Identity message includes the User ID. The UE identification information may be the GPSI identifier of the UE or the SUPI identifier of the UE.

[0209] Exemplarily, the SMF sends the authentication and authorization message to the DN-AAA server through the interface between the SMF and the DN-AAA server, or the SMF first sends the authentication and authorization message to the UPF, and then the UPF forwards the authentication and authorization message to the DN-AAA server. This application is not limited to this.

[0210] S513: The DN-AAA server parses the authentication and authorization message.

[0211] Exemplarily, the DN-AAA server may obtain the UE identification information (eg, the GPSI identifier of the UE or the SUPI identifier of the UE) and the User ID in the EAP-Response / Identity message by parsing the authentication and authorization message.

[0212] Furthermore, the DN-AAA server searches for user context information for the user ID based on the user ID. The user context information for the user ID (or the subscription data for the user ID) includes one or more of the following parameters: user ID, user password, allowed UE ID list, any UE ID indication, user level, or QoS parameter. For specific definitions of these parameters, refer to the description of method 400 above.

[0213] S514: The DN-AAA server and the PC perform an EAP authentication process.

[0214] Exemplarily, the DN-AAA server completes the authentication of the PC based on the User ID and its corresponding user password. The specific implementation method can refer to the existing protocol and will not be described here.

[0215] Optionally, for a PC that has successfully been authenticated, the DN-AAA server may allocate an IP address for the User ID.

[0216] S515, the DN-AAA server sends an authentication and authorization response message to the AMF / SMF. Correspondingly, the AMF / SMF receives an authentication and authorization response message from the DN-AAA server.

[0217] For example, the DN-AAA server sends the authentication and authorization response message to the SMF through the interface between the SMF and the DN-AAA, or the DN-AAA first sends the authentication and authorization response message to the UPF, and then the UPF forwards the authentication and authorization response message to the SMF. This application is not limited to this.

[0218] The authentication and authorization response message includes the User ID and an EAP-Success message. Optionally, the authentication and authorization response message may also include one or more of the following parameters: the IP address corresponding to the User ID, indication information #2, user level, or QoS parameters. For specific explanations of the parameters, please refer to the relevant description of method 400 above.

[0219] S516, AMF / SMF parses the authentication and authorization response message.

[0220] Illustratively, the SMF can obtain the information carried in step S515, such as the User ID and EAP-Success message, by parsing the authentication and authorization response message. Optionally, at least one of the following parameters is also included: an IP address, indication information, user level, or QoS parameter. For specific interpretations, please refer to the relevant description above.

[0221] Optionally, if the AMF / SMF does not receive the IP address assigned by the DN-AAA server for the User ID in step S515, the AMF / SMF may assign an IP address for the User ID, or the UPF may assign an IP address for the User ID. This application does not limit this. Further, the AMF / SMF sends the IP address to the DN-AAA server and stores it in the context information of the User ID. For specific implementation methods, refer to step S521.

[0222] S517, optionally, AMF / SMF sends an SM policy request to PCF / UDM, and correspondingly, PCF / UDM receives the SM policy request from AMF / SMF to obtain policy information corresponding to the User ID.

[0223] The SM policy request includes the User ID and, optionally, at least one of the following parameters: an IP address corresponding to the User ID, indication information #2, a QoS parameter, or a user level.

[0224] S518, optionally, the PCF / UDM obtains context information corresponding to the User ID.

[0225] In other words, PCF / UDM searches for the context information corresponding to the User ID based on the User ID.

[0226] The context information corresponding to the User ID includes the User ID, and optionally, also includes at least one of the following parameters: the IP address corresponding to the User ID, indication information #2, QoS parameters, or user level; or, the PCF / UDM adds or updates at least one of the following parameters in the context information: the IP address corresponding to the User ID, indication information #2, QoS parameters, or user level.

[0227] S519, optionally, the PCF / UDM determines a QoS policy for the service corresponding to the User ID.

[0228] Exemplarily, if PCF / UDM receives the user level or QoS parameter corresponding to the User ID in the above step S517, UDM / PCF can determine the QoS policy for the service of the User ID based on the user level or QoS parameter. The specific implementation method can refer to the existing protocol.

[0229] S520, optionally, UDM / PCF sends a QoS policy to AMF / SMF, and correspondingly, AMF / SMF receives the QoS policy from UDM / PCF.

[0230] Exemplarily, the QoS policy may include one or more of the maximum bandwidth of the service, the guaranteed bandwidth of the service, the delay, the packet loss rate, and the flow rate.

[0231] S521, optionally, the AMF / SMF sends a Notification message to the DN-AAA server, and correspondingly, the DN-AAA server receives the Notification message from the AMF / SMF, wherein the Notification message carries the User ID and its corresponding IP address.

[0232] Furthermore, the DN-AAA server may store the IP address in the context information corresponding to the User ID.

[0233] It should be understood that for the User ID that has successfully been authenticated, AMF / SMF will continue to execute the PDU session establishment / update process, that is, execute step S522.

[0234] S522, AMF / SMF sends an EAP-Success message to the UE, and correspondingly, the UE receives the EAP-Success message from the AMF / SMF.

[0235] Exemplarily, the SMF first sends a PDU session establishment accept message to the AMF. Correspondingly, the AMF receives the PDU session establishment accept message from the SMF. The PDU session establishment accept message includes an EAP-Success message. The AMF then encapsulates the PDU session establishment accept message in a DL NAS transport message and sends it to the UE.

[0236] S523: The UE parses the NAS message.

[0237] For example, the UE can parse the DL NAS transport message to obtain the PDU session establishment accept message, and thus obtain the EAP-Success message. The UE can then determine that the PDU session is established for the PC based on the correspondence between the MAC address and the PDU session ID stored in step S504 and the PDU session ID carried in the DL NAS transport, and then execute step S524.

[0238] S524, the UE sends an EAP-Success message to the PC, and correspondingly, the PC receives the EAP-Success message from the UE.

[0239] At this point, the PC can access the 5GC based on the EAP-Success message and obtain the network access service provided by the 5GC.

[0240] Based on the above technical solution, when a PC accesses 5GC via a UE, the 5GC identifies the PC's User ID, and the DN-AAA server authenticates the User ID. This ensures that the PC is allowed to access the 5GC only if the User ID authentication is successful. Mobile operators can then provide connection services to the PC based on the 5GC. Furthermore, the 5GC can implement differentiated control and management of PC services based on the User ID. Furthermore, by authenticating the User ID, potential network security risks can be avoided or reduced.

[0241] Figure 6 is a flow chart of a communication method 600 provided in an embodiment of the present application. Taking the terminal device as a PC, the user device as a UE, the core network element as an AMF / SMF, the data network authentication and billing server as a DN-AAA server, and the core network as a 5GC as an example, this implementation method mainly involves the UE sending a User ID to the AMF / SMF during the PDU session establishment / update process of the terminal device, so that the AMF / SMF performs authentication based on the User ID, UE subscription data or User ID subscription data, and then determines whether to allow the PC to access the 5GC. The method includes the following multiple steps, and the parts not described in detail can refer to the existing protocol. It should be understood that the relevant descriptions in the embodiments shown in Figures 4 or 5 above are also applicable to this implementation method, and the same or similar technical means may exist between Figures 4 to 6. The contents described in the embodiments shown in Figures 4 to 5 will not be repeated here.

[0242] S600: UDM / PCF adds UE subscription data or User ID subscription data.

[0243] Among them, the parameters and their interpretations included in the UE's subscription data or the User ID's subscription data can refer to the relevant description of the above method 400.

[0244] Optionally, the above User ID related information or User ID subscription data can be configured into the UDM / PCF by the core network management system, or sent to the UDM / PCF by the AF or DN-AAA server through the NEF.

[0245] S601, UE registers to 5GC.

[0246] S602: The UE obtains the URSP policy of the UE.

[0247] S603: An L2 connection is established between the PC and the UE.

[0248] The specific implementation of the above steps S601 to S603 may refer to the relevant description of the above steps S501 to S503.

[0249] At this time, the UE acts as an authenticator and sends an EAP-Request / Identity message to the PC to authenticate the PC.

[0250] S604: The UE sends an EAP-Request / Identify message to the PC. Correspondingly, the PC receives the EAP-Request / Identify message from the UE.

[0251] Exemplarily, the UE sends an EAP-Request / Identity message to the PC through the WLAN air interface between the UE and the PC.

[0252] S605 , the PC sends an EAP-Response / Identity message to the UE, and correspondingly, the UE receives the EAP-Response / Identity message from the PC.

[0253] Exemplarily, the PC parses the EAP-Request / Identify message, calculates the response RES, and then replies with an EAP-Response / Identify message to the UE, wherein the EAP-Response / Identity message includes the User ID.

[0254] S606: The UE parses the EAP-Response / Identity message.

[0255] Exemplarily, the UE may obtain the User ID by parsing the EAP-Response / Identity message, and then initiate a PDU session establishment / update process for the PC based on the URSP policy obtained in step S602, that is, executing the following step S607.

[0256] S607, the UE sends a PDU session establishment / update request to the AMF / SMF, and correspondingly, the AMF / SMF receives the PDU session establishment / update request from the UE.

[0257] Among them, the parameters carried in the PDU session establishment / update request and their interpretations, as well as the specific implementation method of triggering the PDU session establishment / update process can be achieved by referring to the relevant description of step S504 of the above method 500.

[0258] S608: AMF / SMF obtains the UE's subscription data or the User ID's subscription data, and determines whether to allow the PC to access the 5GC based on the UE's subscription data or the User ID's subscription data. This is specifically done in the following two ways:

[0259] Exemplarily, if the UL NAS transport message in step S607 includes a User ID, the AMF / SMF obtains the UE's subscription data from the UDM, or obtains the User ID's subscription data based on the User ID, and then the AMF / SMF determines whether to allow the PC to access the 5GC based on the UE's subscription data or the User ID's subscription data. The parameters and their interpretations included in the UE's subscription data or the User ID's subscription data may refer to the relevant description of step S600 above, and the specific implementation method may refer to the relevant description of step S430 of the above method 400. For the sake of brevity, they will not be described here.

[0260] For example, if the PDU session establishment request message in step S607 contains the User ID, after obtaining the User ID, the AMF can continue to forward the User ID to the SMF through the interface between the AMF and the SMF, and then the SMF determines whether to allow the PC to access the 5GC based on the UE's contract data or the User ID's contract data. For specific implementation methods, please refer to the relevant description of step S430 of the above method 400. For the sake of brevity, it will not be described here. Optionally, if the AMF receives the User ID, the AMF can also make the above judgment based on the UE's contract data or the User ID's contract data. The specific implementation method is similar to the processing on the SMF side and will not be repeated here.

[0261] Furthermore, AMF / SMF triggers the authentication process based on the DNN carried in the PDU session request received in step S607, that is, executes the following step S609.

[0262] S609: The AMF / SMF sends an EAP-Response / Identity message to the DN-AAA server. In response, the DN-AAA server receives the EAP-Response / Identity message from the AMF / SMF. The EAP-Response / Identity message includes the User ID.

[0263] S610: An EAP authentication process is performed between the DN-AAA server and the PC.

[0264] S611, the DN-AAA server sends an EAP-Success message to the AMF / SMF. Correspondingly, the AMF / SMF receives the EAP-Success message from the DN-AAA server.

[0265] For the specific implementation of steps S609 to S611 , reference may be made to the relevant descriptions of steps S512 to S515 of the method 500 .

[0266] S612, optionally, AMF / SMF determines the QoS policy corresponding to the User ID.

[0267] Exemplarily, the SMF determines the QoS policy based on the user level or QoS parameter corresponding to the User ID. The specific implementation method can refer to the existing protocol, and the specific interpretation of the QoS policy can refer to the relevant description of step S520 of the above method 500.

[0268] S613, optionally, the AMF / SMF sends a Notification message to the DN-AAA server, and correspondingly, the DN-AAA server receives the Notification message from the AMF / SMF, wherein the Notification message carries the User ID and its corresponding IP address.

[0269] Furthermore, DN-AAA may store the IP address in the context information corresponding to the User ID.

[0270] It should be understood that for the User ID that has successfully been authenticated, AMF / SMF will continue to execute the PDU session establishment / update process.

[0271] S614, AMF / SMF sends an EAP-Success message to the UE, and correspondingly, the UE receives the EAP-Success message from the AMF / SMF.

[0272] S615: The UE parses the NAS message.

[0273] S616 , the UE sends an EAP-Success message to the PC, and correspondingly, the PC receives the EAP-Success message from the UE.

[0274] At this point, the PC can access the 5GC based on the EAP-Success message and obtain the network access service provided by the 5GC.

[0275] The specific implementation of steps S614 to S616 can refer to the relevant description of steps S522 to S524 of the above method 500, which will not be repeated here.

[0276] Based on the above technical solution, when a PC accesses 5GC via a UE, 5GC identifies the PC's User ID, and the AMF / SMF authenticates the User ID. This ensures that PC access to 5GC is only permitted if the User ID authentication passes. Mobile operators can then provide connectivity services to PCs based on 5GC. Furthermore, 5GC can implement differentiated control and management of PC services based on the User ID. Furthermore, by authenticating the User ID, potential network security risks can be avoided or reduced.

[0277] It should be noted that the above Figures 5 and 6 are both described using the scenario of PC accessing 5GC through UE as an example. Optionally, this application is also applicable to the scenario where UE requests access to 5GC by carrying User ID (the user using the UE), that is, the following Figure 7 is combined with 5GC to illustrate whether UE is allowed to access 5GC by authenticating the User ID of the UE. It should be understood that compared to the existing solution of verifying the UE's identification information (such as UE ID) to determine whether UE is allowed to access 5GC, authenticating the User ID can be an additional verification on the basis of verifying the UE ID, which is more secure. In addition, verifying the User ID can prevent illegal users from using 5GC, or prevent illegal users from maliciously attacking the network, or it can enable 5GC to clearly understand which user uses which services, which is convenient for business management and control.

[0278] Figure 7 is a flow chart of a communication method 700 provided in an embodiment of the present application. As shown in Figure 7, taking the user equipment as UE, the core network element as AMF / SMF, the data network authentication and billing server as DN-AAA server, and the core network as 5GC as an example, the implementation method includes the DN-AAA server or AMF / SMF authenticating the User ID of the UE, and allowing the UE to access the 5GC if the authentication is successful. The method includes the following multiple steps, and the parts not described in detail can refer to the existing protocol. It should be understood that the relevant descriptions in the embodiments shown in Figures 4 to 6 above are also applicable to this implementation method, and the same or similar technical means may exist between Figures 4 to 7. The contents described in the embodiments shown in Figures 4 to 6 will not be repeated here.

[0279] S701, UE registers to 5GC.

[0280] S702: The UE obtains the URSP policy of the UE.

[0281] Optionally, the URSP policy may not carry the access point identifier. For other carried parameters and their interpretations, reference may be made to the relevant description of the above method 500.

[0282] S703, the UE sends a PDU session establishment / update request to the AMF / SMF according to the URSP policy. Correspondingly, the AMF / SMF receives the PDU session establishment / update request from the UE.

[0283] Among them, the PDU session establishment / update request carries DNN and slice information. The PDU session establishment / update request is used to request the establishment / update of a PDU session for the UE. The specific PDU session establishment / update process can refer to the relevant description of step S504 of the above method 500, except that the PDU session in step S703 is established / updated for the UE.

[0284] The following describes two implementation methods for determining whether to allow UE access to 5GC based on the User ID. It should be understood that in method one, the DN-AAA server authenticates the User ID. For details not included, refer to the description of methods 400 or 500 above. In method two, the AMF / SMF authenticates the User ID. For details not included, refer to the description of methods 400 or 600 above.

[0285] Method 1:

[0286] Furthermore, AMF / SMF triggers a secondary authentication process based on the DNN carried in the received PDU session establishment / update request.

[0287] S704: The AMF / SMF sends an EAP-request / identify message to the UE. Correspondingly, the UE receives the EAP-request / identify message from the AMF / SMF. For example, the AMF encapsulates the EAP-request / identify message in a NAS message and sends it to the UE.

[0288] S705: The UE parses the NAS message.

[0289] S706: The UE sends an EAP-Response / Identity message to the AMF / SMF. In response, the AMF / SMF receives the EAP-Response / Identity message from the UE. For example, the UE encapsulates the EAP-Response / Identity message in a NAS message and sends it to the AMF.

[0290] S707, AMF / SMF determines the DN-AAA server address based on DNN.

[0291] S708, AMF / SMF sends an authentication and authorization message to the DN-AAA server. Correspondingly, the DN-AAA server receives the authentication and authorization message from AMF / SMF.

[0292] The authentication and authorization message includes the EAP-Response / Identity message.

[0293] S709: The DN-AAA server parses the authentication and authorization message.

[0294] S710: The DN-AAA server and the UE perform an EAP authentication process.

[0295] S711, the DN-AAA server sends an authentication and authorization response message to the AMF / SMF. Correspondingly, the AMF / SMF receives an authentication and authorization response message from the DN-AAA server.

[0296] The authentication and authorization response message contains the User ID and EAP-Success message.

[0297] S712, AMF / SMF parses the authentication and authorization response message.

[0298] Method 2:

[0299] At this time, the PDU session establishment / update request in step S703 also includes a User ID, which is used to indicate the user using the UE.

[0300] S713, UDM / PCF adds the subscription data of the UE or the subscription data of the User ID.

[0301] S714, AMF / SMF obtains the UE's contract data or the User ID's contract data, and determines whether the UE is allowed to access the 5GC based on the UE's contract data or the User ID's contract data. For specific implementation methods, please refer to the relevant description of step S608 of the above method 600.

[0302] Furthermore, AMF / SMF triggers a secondary authentication process based on the DNN carried in the PDU session request, that is, executes the following step S715.

[0303] S715: The AMF / SMF sends an EAP-Response / Identity message to the DN-AAA server. In response, the DN-AAA server receives the EAP-Response / Identity message from the AMF / SMF. The EAP-Response / Identity message includes the User ID.

[0304] S716: The DN-AAA server and the UE perform an EAP authentication process.

[0305] S717, the DN-AAA server sends an EAP-Success message to the AMF / SMF. Correspondingly, the AMF / SMF receives the EAP-Success message from the DN-AAA server.

[0306] S718, optionally, AMF / SMF determines the QoS policy corresponding to the User ID.

[0307] S719, optionally, the AMF / SMF sends a Notification message to the DN-AAA server, and correspondingly, the DN-AAA server receives the Notification message from the AMF / SMF, wherein the Notification message carries the User ID and its corresponding IP address.

[0308] Furthermore, DN-AAA may store the IP address in the context information corresponding to the User ID.

[0309] It should be understood that for the User ID that has successfully been authenticated, AMF / SMF will continue to execute the PDU session establishment / update process.

[0310] S720, AMF / SMF sends an EAP-Success message to the UE, and correspondingly, the UE receives the EAP-Success message from the AMF / SMF.

[0311] At this point, the UE can access the 5GC based on the EAP-Success message and obtain the network access service provided by the 5GC.

[0312] Based on the above technical solution, when a UE accesses 5GC, 5GC identifies the UE's User ID and authenticates it. This ensures that the UE is allowed to access 5GC only if the User ID authentication is successful. Mobile operators can then provide connectivity services to the UE based on 5GC. Furthermore, 5GC can implement differentiated control and management of UE services based on the User ID. Furthermore, by authenticating the User ID, potential network security risks can be avoided or reduced.

[0313] The above description, in conjunction with Figures 1 to 7 , details the communication method embodiment of the present application. The following description, in conjunction with Figures 8 to 10 , details the communication device embodiment of the present application. It should be understood that the description of the device embodiment corresponds to the description of the method embodiment. Therefore, for portions not described in detail, reference can be made to the preceding method embodiment.

[0314] Figure 8 is a schematic diagram of the structure of a communication device 1000 provided in an embodiment of the present application. As shown in Figure 8, the device 1000 may include a transceiver unit 1010 and a processing unit 1020. The transceiver unit 1010 can communicate with the outside world, and the processing unit 1020 is used to process data. The transceiver unit 1010 may also be referred to as a communication interface or a transceiver unit.

[0315] In one possible design, the device 1000 can implement steps or processes corresponding to those executed by the core network network element in the above method embodiment, wherein the processing unit 1020 is used to perform operations related to the processing of the core network network element in the above method embodiment, and the transceiver unit 1010 is used to perform operations related to the transmission and reception of the core network element in the above method embodiment.

[0316] In another possible design, the device 1000 can implement steps or processes corresponding to those performed by the user equipment in the above method embodiments, wherein the transceiver unit 1010 is used to perform transceiver-related operations of the user equipment in the above method embodiments, and the processing unit 1020 is used to perform processing-related operations of the user equipment in the above method embodiments.

[0317] It should be understood that the device 1000 here is embodied in the form of a functional unit. The term "unit" here can refer to an application specific integrated circuit (ASIC), an electronic circuit, a processor (such as a shared processor, a dedicated processor or a group processor, etc.) and a memory for executing one or more software or firmware programs, a merging logic circuit and / or other suitable components that support the described functions. In an optional example, those skilled in the art can understand that the device 1000 can be specifically the transmitting end in the above embodiment, and can be used to execute the various processes and / or steps corresponding to the transmitting end in the above method embodiment, or the device 2000 can be specifically the receiving end in the above embodiment, and can be used to execute the various processes and / or steps corresponding to the receiving end in the above method embodiment. To avoid repetition, it will not be repeated here.

[0318] The apparatus 1000 of each of the above-mentioned solutions has the function of implementing the corresponding steps performed by the transmitting end in the above-mentioned method, or the apparatus 1000 of each of the above-mentioned solutions has the function of implementing the corresponding steps performed by the receiving end in the above-mentioned method. The functions can be implemented by hardware, or can be implemented by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above-mentioned functions; for example, the transceiver unit can be replaced by a transceiver (for example, the transmitting unit in the transceiver unit can be replaced by a transmitter, and the receiving unit in the transceiver unit can be replaced by a receiver), and other units, such as the processing unit, can be replaced by a processor to respectively perform the transceiver operations and related processing operations in each method embodiment.

[0319] In addition, the above-mentioned transceiver unit can also be a transceiver circuit (for example, it can include a receiving circuit and a transmitting circuit), and the processing unit can be a processing circuit. In an embodiment of the present application, the device 1000 can be a receiving device or a transmitting device in the aforementioned embodiment, or it can be a chip or chip system in a receiving device or a transmitting device, such as a system on chip (SoC). Among them, the transceiver unit can be an input and output circuit or a communication interface. The processing unit is a processor or microprocessor or integrated circuit integrated on the chip. This is not limited here.

[0320] Figure 9 is a schematic diagram of the structure of a communication device 2000 provided in an embodiment of the present application. As shown in Figure 9, the device 2000 includes a processor 2010 and a transceiver 2020. The processor 2010 and the transceiver 2020 communicate with each other via an internal connection path. The processor 2010 is used to execute instructions to control the transceiver 2020 to send and / or receive signals.

[0321] Optionally, the apparatus 2000 may further include a memory 2030, which communicates with the processor 2010 and the transceiver 2020 via an internal connection path. The memory 2030 is used to store instructions, and the processor 2010 may execute the instructions stored in the memory 2030.

[0322] In a possible implementation, the device 2000 is used to implement various processes and steps corresponding to the core network elements in the above method embodiment.

[0323] In another possible implementation, the apparatus 2000 is used to implement various processes and steps corresponding to the user equipment in the above method embodiment.

[0324] It should be understood that the device 2000 can be specifically the transmitting end or receiving end in the above-mentioned embodiments, or can also be a chip or chip system. Correspondingly, the transceiver 2020 can be the transceiver circuit of the chip, which is not limited here. Specifically, the device 2000 can be used to perform the various steps and / or processes corresponding to the transmitting end or receiving end in the above-mentioned method embodiments.

[0325] Optionally, the memory 2030 may include a read-only memory and a random access memory, and provide instructions and data to the processor. A portion of the memory may also include non-volatile random access memory. For example, the memory may also store device type information. The processor 2010 may be configured to execute instructions stored in the memory. When the processor 2010 executes the instructions stored in the memory, the processor 2010 is configured to perform the various steps and / or processes of the above-described method embodiments corresponding to the transmitting end or the receiving end.

[0326] During implementation, each step of the above method can be completed by an integrated logic circuit of the hardware in the processor or by instructions in the form of software. The steps of the method disclosed in conjunction with the embodiments of the present application can be directly embodied as being executed by a hardware processor, or can be executed by a combination of hardware and software modules in the processor. The software module can be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in conjunction with its hardware. To avoid repetition, it will not be described in detail here.

[0327] It should be noted that the processor in the embodiments of the present application can be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above-described method embodiment can be completed by hardware integrated logic circuits in the processor or by software instructions. The above-described processor can be a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field-programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component. The processor in the embodiments of the present application can implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the embodiments of the present application can be directly implemented and executed by a hardware decoding processor, or by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium well-known in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. The storage medium is located in the memory, and the processor reads the information in the memory and, in conjunction with its hardware, completes the steps of the above-described method.

[0328] It will be understood that the memory in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static random access memory, dynamic random access memory, synchronous dynamic random access memory, double data rate synchronous dynamic random access memory, enhanced synchronous dynamic random access memory, synchronous linked dynamic random access memory, and direct memory bus random access memory. It should be noted that the memory of the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0329] FIG10 is a schematic diagram of the structure of a chip system 3000 provided in an embodiment of the present application. As shown in FIG10 , the chip system 3000 (or also referred to as a processing system) includes a logic circuit 3010 and an input / output interface 3020 .

[0330] The logic circuit 3010 may be a processing circuit in the chip system 3000. The logic circuit 3010 may be coupled to a storage unit and call instructions in the storage unit so that the chip system 3000 can implement the methods and functions of the various embodiments of the present application. The input / output interface 3020 may be an input / output circuit in the chip system 3000, outputting information processed by the chip system 3000 or inputting data or signaling information to be processed into the chip system 3000 for processing.

[0331] As a solution, the chip system 3000 is used to implement the operations performed by the core network elements in the above method embodiments.

[0332] As a solution, the chip system 3000 is used to implement the operations performed by the user equipment in the above various method embodiments.

[0333] An embodiment of the present application also provides a computer-readable storage medium on which computer instructions for implementing the methods executed by the core network element and the user equipment in the above-mentioned method embodiments are stored.

[0334] An embodiment of the present application also provides a computer program product, comprising computer program code or instructions. When the computer program code or instructions are executed on a computer, the computer implements the methods executed by the core network element and the user equipment in the above-mentioned method embodiments.

[0335] An embodiment of the present application also provides a communication system, including the aforementioned core network network element and user equipment, and optionally, may also include a unified data management function network element, a policy control function network element, an access and mobility management function network element, a session management function network element, a data network-authentication and billing server, or a terminal device.

[0336] The explanation of the relevant contents and beneficial effects of any of the above-mentioned devices can be referred to the corresponding method embodiments provided above, which will not be repeated here.

[0337] To facilitate understanding of the above embodiments provided in this application, the following points are explained:

[0338] 1) In this application, unless otherwise specified or there is a logical conflict, the terms and / or descriptions between different embodiments are consistent and can be referenced by each other. The technical features in different embodiments can be combined to form new embodiments according to their inherent logical relationships.

[0339] 2) In this application, "at least one" means one or more, and "more" means two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. In the text description of this application, the character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b and c can mean: a, or b, or c, or a and b, or a and c, or b and c, or a, b and c. Where a, b and c can be single or multiple, respectively.

[0340] 3) Throughout this application, the terms "first," "second," and various numerical references (e.g., #1, #2, etc.) are used to distinguish between different messages for ease of description and are not intended to limit the scope of the embodiments of this application. For example, they are used to distinguish between different messages, rather than to describe a specific order or precedence. It should be understood that such references are interchangeable, where appropriate, to allow for the description of scenarios beyond the embodiments of this application.

[0341] 4) In this application, descriptions such as "when...", "in the case of...", and "if" all mean that the device will perform corresponding processing under certain objective circumstances. They do not limit the time, nor do they require the device to perform judgment actions when implementing them, nor do they mean that there are other limitations.

[0342] 5) In this application, "used to indicate" can include being used for direct indication and being used for indirect indication. When describing that a certain indication information is used to indicate A, it can include that the indication information directly indicates A or indirectly indicates A, and it does not mean that the indication information must carry A.

[0343] The indication methods involved in the embodiments of this application should be understood to encompass various methods that enable the party to be indicated to obtain information to be indicated. The information to be indicated can be sent as a whole or divided into multiple sub-information and sent separately. The transmission period and / or timing of these sub-information can be the same or different. This application does not limit the specific transmission method.

[0344] In the embodiments of the present application, the "indication information" may be an explicit indication, i.e., a direct indication via signaling, or may be obtained based on parameters indicated by the signaling, in combination with other rules, other parameters, or by deduction. It may also be an implicit indication, i.e., based on a rule or relationship, or based on other parameters, or by deduction. This application does not impose specific limitations on this.

[0345] 6) In this application, "protocol" may refer to a standard protocol in the field of communications, such as 5G protocol, NR protocol, and related protocols used in future communication systems, which are not limited in this application. "Predefined" may include pre-definition. For example, protocol definition. "Preconfiguration" can be implemented by pre-saving corresponding codes, tables, or other methods that can be used to indicate relevant information in the device. This application does not limit its specific implementation method.

[0346] 7) In this application, "communication" may also be described as "data transmission", "information transmission", "data processing", etc. "Transmission" includes "sending" and "receiving".

[0347] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0348] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0349] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0350] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0351] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0352] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for enabling a computer device to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory, a random access memory, a magnetic disk, or an optical disk.

[0353] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A communication method, characterized in that: Applied to after the user equipment registers with the core network, during the process of the user equipment triggering the establishment or update of a session, the method includes: receiving a non-access stratum NAS request message from the user equipment, where the NAS request message is used to request to establish a session or update a session; Acquire user identity information according to the NAS request message, where the user identity information is used to indicate a user of the user equipment; The session is established or updated according to the user identity information.

2. The method according to claim 1, characterized in that The user of the user equipment includes: The user of the user device is the user of the user device, and the user identity information is the user identity information of the user of the user device; or The terminal device is communicatively connected with the user device, the user of the user device is the user of the terminal device, the user identity information is the user identity information of the user of the terminal device, and the terminal device is a terminal device that supports non-3rd Generation Partnership Project 3GPP access technology and does not support NAS signaling.

3. The method according to claim 1 or 2, characterized in that: The acquiring the user identity information according to the NAS request message includes: Receive the user identity information from the data network-authentication and accounting DN-AAA server according to the NAS request message; or, The user identity information is received from the user equipment according to the NAS request message.

4. The method according to claim 3, characterized in that The NAS request message includes a data network name, and the method further includes: Sending a first authentication message to the user equipment according to the data network name, wherein the first authentication message is used to request authentication of the terminal device or the user equipment; Receiving a first authentication response message from the user equipment, wherein the first authentication response message includes the user identity information; The receiving the user identity information from the DN-AAA server according to the NAS request message includes: Determining the address of the DN-AAA server according to the data network name; Sending a second authentication message to the DN-AAA server according to the address of the DN-AAA server, where the second authentication message includes the first authentication response message, and the second authentication message is used to request authentication of the user identity information; In response to the second authentication message, when the user identity information authentication is successful, a first message is received from the DN-AAA server, the first message including the user identity information and a second message, the second message being used to indicate that the user identity information authentication is successful.

5. The method according to claim 4, characterized in that The first message further includes one or more of the following: an Internet Protocol IP address, a user level, a quality of service QoS parameter or second indication information of the session, the QoS parameter represents a QoS control parameter for a data flow of the session, the second indication information is used to indicate statistics for the data flow of the session, and the user level is used to indicate a service level of the user; Wherein, the method further comprises: According to the user level and / or the QoS parameter, policy information corresponding to the user identity information is determined.

6. The method according to claim 4, characterized in that The method further comprises: Sending a request message to a policy control function network element or a unified data management function network element, where the request message is used to obtain policy information corresponding to the user identity information, and the request message includes the user identity information; The policy information is received from the policy control function network element or the unified data management function network element, where the policy information is determined according to the user level and / or QoS parameter corresponding to the user identity information.

7. The method according to claim 4 or 6, characterized in that: The method further comprises: Obtaining an Internet Protocol (IP) address for the session; Send the user identity information and the IP address to the DN-AAA server.

8. The method according to claim 1 or 2, characterized in that: The user identity information is carried in the NAS request message.

9. The method according to any one of claims 1 to 8, characterized in that The establishing or updating the session according to the user identity information includes: Acquire the subscription data of the user device or the subscription data of the user identity information according to the user identity information; The session is established or updated according to the subscription data of the user equipment or the subscription data of the user identity information.

10. The method according to claim 9, characterized in that The subscription data of the user equipment includes a user identity information list and / or third indication information, the user identity information list includes at least one user identity information, the at least one user identity information is used to indicate at least one user identity information allowed to be accessed by the user equipment, and the third indication information is used to indicate that any user identity information is allowed to access the core network from the user equipment; The establishing or updating of the session according to the subscription data of the user equipment includes: In a case where the user identity information is included in the user identity information list, or the subscription data of the user equipment includes the third indication information, the session is established or updated.

11. The method according to claim 9, characterized in that The subscription data of the user identity information includes a user equipment identifier list and / or first indication information, the user equipment identifier list includes at least one user equipment identifier, the at least one user equipment identifier is used to indicate at least one user equipment that the user identity information allows to access, and the first indication information is used to indicate that the user identity information allows access to the core network from any user equipment; Wherein, establishing or updating the session according to the contract data of the user identity information includes: The session is established or updated when the identifier of the user equipment is included in the user equipment identifier list or the subscription data of the user identity information includes the first indication information.

12. The method according to any one of claims 1 to 11, characterized in that The method further comprises: In the case where the user identity information authentication is successful, a NAS response message is sent to the user equipment, where the NAS response message is used to indicate that the session establishment or update is successful.

13. A communication method, characterized in that: Applied to after the user equipment registers with the core network, during the process of the user equipment triggering the establishment or update of a session, the method includes: Acquire user identity information, where the user identity information is used to indicate a user of the user device; A non-access layer NAS request message is sent to a core network element according to the user identity information, where the NAS request message is used to request to establish a session or request to update a session.

14. The method according to claim 13, characterized in that The method further comprises: In the case where the user identity information authentication is successful, a NAS response message is received from the core network element, where the NAS response message is used to indicate that the session is successfully established or updated.

15. The method according to claim 13 or 14, characterized in that The obtaining of user identity information includes: Acquire user identity information of a user of the user device, wherein the user of the user device is the user of the user device, and the user identity information is the user identity information of the user of the user device; or, When the user equipment establishes a communication connection with the terminal equipment, the user identity information is obtained from the terminal equipment, the user of the user equipment is the user of the terminal equipment, the user identity information is the user identity information of the user of the terminal equipment, and the terminal equipment is a terminal equipment that supports non-3rd Generation Partnership Project 3GPP access technology and does not support NAS signaling.

16. The method according to any one of claims 13 to 15, characterized in that The NAS request message includes the user identity information.

17. The method according to any one of claims 13 to 16, characterized in that Before the user equipment triggers establishment or update of the session, the method further includes: A routing selection policy is received from the core network element, where the routing selection policy includes an access point identifier and / or the user identity information, and the access point identifier is used to indicate an access point name provided by the user equipment.

18. The method according to claim 17, characterized in that The sending a NAS request message to a core network element based on the user identity information includes: When the access point used by the terminal device to establish a communication connection with the user equipment is the same as the access point indicated by the access point identifier included in the routing selection policy, sending the NAS request message to the core network element; and / or, When the user identity information acquired by the user equipment is the same as the user identity information included in the routing selection policy, the NAS request message is sent to the core network element.

19. The method according to claim 17 or 18, characterized in that The routing selection strategy further includes indication information, and the sending the NAS request message to the core network element based on the user identity information includes: When the indication information is used to instruct the terminal device to establish a communication connection with the user equipment from the access point corresponding to the access point identifier, or the indication information is used to instruct to send the NAS request to the core network element when acquiring the user identity information. Ask for news.

20. A communication method, characterized in that: Applied to after the user equipment registers with the core network, during the process of the user equipment triggering the establishment or update of a session, the method includes: The user equipment acquires user identity information, where the user identity information is used to indicate a user of the user equipment; The user equipment sends a non-access layer NAS request message to a core network element according to the user identity information, and the core network element receives the NAS request message from the user equipment, where the NAS request message is used to request to establish a session or update a session; The core network element obtains user identity information according to the NAS request message; The core network element establishes or updates the session according to the user identity information.

21. The method according to claim 20, characterized in that The user of the user equipment includes: The user of the user device is the user of the user device, and the user identity information is the user identity information of the user of the user device; or The terminal device is communicatively connected with the user device, the user of the user device is the user of the terminal device, the user identity information is the user identity information of the user of the terminal device, and the terminal device is a terminal device that supports non-3rd Generation Partnership Project 3GPP access technology and does not support NAS signaling.

22. The method according to claim 20 or 21, characterized in that The core network element obtains the user identity information of the terminal device according to the NAS request message, including: The core network element receives the user identity information from the data network-authentication and accounting DN-AAA server according to the NAS request message; or, The core network element receives the user identity information from the user equipment according to the NAS request message.

23. The method according to claim 22, characterized in that The NAS request message includes a data network name, and the method further includes: The core network element sends a first authentication message to the user equipment according to the data network name, and the user equipment receives the first authentication message from the core network element, where the first authentication message is used to request authentication of the terminal device or the user equipment; The user equipment sends a first authentication response message to the core network element, and the core network element receives the first authentication response message from the user equipment, where the first authentication response message includes the user identity information; The core network element receiving the user identity information from the DN-AAA server according to the NAS request message includes: The core network element determines the address of the DN-AAA server according to the data network name; The core network element triggers an authentication process for the user equipment or terminal equipment according to the data network name; The core network element sends a second authentication message to the DN-AAA server according to the address of the DN-AAA server, and the DN-AAA server receives the second authentication message from the core network element, where the second authentication message includes the first authentication response message, and the second authentication message is used to request an authentication process for the user identity information; In response to the second authentication message, if the user identity information authentication is successful, the DN-AAA server sends a first message to the core network network element, and the core network network element receives the first message from the DN-AAA server, the first message including the user identity information and a second message, and the second message is used to indicate that the user identity information authentication is successful.

24. The method according to claim 20 or 21, characterized in that The user identity information is carried in the NAS request message.

25. The method according to any one of claims 20 to 24, characterized in that Before the user equipment sends a NAS request message to a core network element based on the user identity information, the method further includes: The user equipment sends a request message to the terminal equipment, and the terminal equipment receives the request message from the user equipment, where the request message is used to obtain the user identity information; The terminal device sends a response message to the user device, and the user device receives the response message from the terminal device, wherein the response message includes the user identity information, and the user identity information is the user identity information of the user of the terminal device.

26. The method according to any one of claims 20 to 25, characterized in that The core network element establishing or updating the session according to the user identity information includes: The core network element acquires the subscription data of the user equipment or the subscription data of the user identity information according to the user identity information; The core network element establishes or updates the session according to the subscription data of the user equipment or the subscription data of the user identity information.

27. The method according to claim 26, characterized in that The subscription data of the user equipment includes a user identity information list and / or third indication information, the user identity information list includes at least one user identity information, the at least one user identity information is used to indicate at least one user identity information allowed to be accessed by the user equipment, and the third indication information is used to indicate that any user identity information is allowed to access the core network from the user equipment; The core network element establishes or updates the session according to the subscription data of the user equipment, including: In a case where the user identity information is included in the user identity information list, or the subscription data of the user equipment includes the third indication information, the core network element establishes or updates the session.

28. The method according to claim 26, characterized in that The subscription data of the user identity information includes a user equipment identifier list and / or first indication information, the user equipment identifier list includes at least one user equipment identifier, the at least one user equipment identifier is used to indicate at least one user equipment that the user identity information allows to access, and the first indication information is used to indicate that the user identity information allows access to the core network from any user equipment; The core network element establishes or updates the session according to the subscription data of the user identity information, including: When the identifier of the user equipment is included in the user equipment identifier list, or when the subscription data of the user identity information includes the first indication information, the core network element establishes or updates the session.

29. A communication device, characterized in that: include: One or more functional modules, wherein the one or more functional modules are used to execute the method according to any one of claims 1 to 12, or the one or more functional modules are used to execute the method according to any one of claims 13 to 19.

30. A communication device, characterized in that: include: a processor coupled to the memory; The processor is configured to execute the computer program stored in the memory so that the apparatus performs the method according to any one of claims 1 to 12, or the apparatus performs the method according to any one of claims 13 to 19.

31. A computer-readable storage medium, characterized in that: include: The computer-readable storage medium stores a computer program, which, when executed on a computer, enables the computer to execute the method according to any one of claims 1 to 12, or enables the computer to execute the method according to any one of claims 13 to 19.

32. A communication system, characterized in that: It comprises a core network element, and the core network element is used to execute the method as described in any one of claims 1 to 12.

33. The communication system according to claim 32, characterized in that The communication system further includes at least one of a user equipment, a terminal device, or a DN-AAA server, wherein the user equipment is configured to execute the method according to any one of claims 13 to 19.

34. A computer program product, characterized in that When the computer program product is executed by a communication device, the method according to any one of claims 1 to 12 is implemented, or the method according to any one of claims 13 to 19 is implemented.

Images