Communication method, communication apparatus and communication system

Abstract

A communication method, a communication apparatus and a communication system. The method comprises: a user plane network element can pre-acquire identity information of each application function network element amongst at least one application function network element; and when a service request is received subsequently, on the basis of the identity information of each application function network element amongst the at least one application function network element and address information of an application function network element carried in the service request, determining whether a MASQUE connection with the application function network element can be established. Thus, the solution establishes MSAQUE connections on demand, and transmits service messages by means of the established MASQUE connections, instead of establishing and maintaining MASQUE connections in advance before service requests are received, such that resource overheads of user plane network elements can be reduced, and attacks caused by long-term exposure of MASQUE connections can be avoided, thus improving the security of MSAQUE connections.

Description

Communication method, communication apparatus, and communication system

[0001] Cross Reference to Related Applications

[0002] This application claims priority to the Chinese Patent Application No. 202411252507.6, filed on September 6, 2024, and entitled “A communication method, a communication apparatus, and a communication system”, the content of which is incorporated herein by reference in its entirety. TECHNICAL FIELD

[0003] The present application relates to the field of communication technology, and in particular to a communication method, a communication apparatus, and a communication system. BACKGROUND

[0004] The user plane network element supports the address information of the sensing application function network element, and the user plane network element can establish a multiplexed application substrate over QUIC encryption (MASQUE) connection based on the address information of the sensing application function network element. QUIC refers to quick user datagram protocol (UDP) internet connections.

[0005] Currently, after the user plane network element senses the address information of the application function network element, the user plane network element immediately establishes and maintains the MASQUE connection between the user plane network element and the application function network element, and the MASQUE connection can be used for subsequent business transmission.

[0006] The problem of the above-mentioned method is that the user plane network element needs to maintain a large number of MASQUE connections for a long time, which not only brings a large resource overhead to the user plane network element, but also causes the MASQUE connection to be exposed for a long time, which is easy to be attacked. SUMMARY

[0007] The embodiments of the present application provide a communication method, a communication apparatus, and a communication system to reduce the resource overhead of the user plane network element and improve the security of the MASQUE connection.

[0008] In a first aspect, an embodiment of the present application provides a communication method, which can be applied to a network side, such as a user plane network element of the network side, a module (such as a circuit, a chip or a chip system, etc.) in the user plane network element, or a logic node, a logic module or software capable of realizing all or part of the functions of the user plane network element. The method comprises: obtaining identity information of each application function network element in at least one application function network element, wherein the identity information of each application function network element comprises at least one address information supporting MASQUE connection; receiving a first service request from a first terminal, wherein the first service request comprises address information of an application function network element corresponding to the first service request; and in a case where the at least one address information supporting MASQUE connection comprises the address information of the application function network element corresponding to the first service request, establishing a first MASQUE connection between the application function network element corresponding to the first service request based on the address information of the application function network element corresponding to the first service request, wherein the first MASQUE connection is used for transmitting service packets corresponding to the first service request.

[0009] Based on the above scheme, the user plane network element can obtain the identity information of each application function network element in at least one application function network element in advance, and subsequently, based on the identity information of each application function network element in the at least one application function network element and the address information of the application function network element carried in the service request, determine whether the MASQUE connection between the application function network element can be established. Therefore, the scheme realizes the on-demand establishment of the MASQUE connection, and transmits the service packets through the established MASQUE connection, instead of establishing and maintaining the MASQUE connection in advance before receiving the service request, which can reduce the resource consumption of the user plane network element, and can avoid the MASQUE connection from being exposed for a long time and being attacked, thereby improving the security of the MASQUE connection.

[0010] In a possible implementation method, the address information supporting the MASQUE connection comprises an internet protocol (IP) address, or comprises an IP address and a port number.

[0011] In a possible implementation method, after the first MASQUE connection between the application function network element corresponding to the first service request is established, the method further comprises: establishing a first service flow for the first service request based on the first MASQUE connection, wherein the first service flow is used for transmitting the service packets corresponding to the first service request.

[0012] In a possible implementation method, the method further comprises: obtaining first indication information, wherein the first indication information indicates that the first MASQUE connection does not support the establishment of multiple service flows.

[0013] Based on the above scheme, the first MASQUE connection is explicitly indicated by the first indication information as not supporting establishment of multiple service flows, so that a subsequent user plane network element only establishes one service flow on the first MASQUE connection, and multiple service flows are not established, avoiding transmission failure caused by erroneous establishment of service flows, and therefore resource overhead can be saved.

[0014] In a possible implementation method, the method further includes: receiving a second service request from a second terminal, the second service request including address information of an application function network element corresponding to the second service request; in a case where the address information of the application function network element corresponding to the second service request is the same as the address information of the application function network element corresponding to the first service request, establishing, based on the address information of the application function network element corresponding to the second service request and the first indication information, a second MASQUE connection between the application function network element corresponding to the second service request, the second MASQUE connection being used to transmit service packets corresponding to the second service request; and establishing, based on the second MASQUE connection, a second service flow for the second service request, the second service flow being used to transmit service packets corresponding to the second service request.

[0015] Based on this scheme, after a first MASQUE connection between a user plane network element and an application function network element is established, if a service request is received again, and the application function network element corresponding to the service request is the same as the application function network element corresponding to the first MASQUE connection, and the address information of the application function network element corresponding to the service request is the same as the address information of the application function network element corresponding to the first MASQUE connection, but the first MASQUE connection does not support establishment of multiple service flows, the user plane network element newly establishes a second MASQUE connection between the user plane network element and the application function network element for the service request. In this method, each MASQUE connection is used to transmit only one service flow, which can guarantee transmission quality and latency of the service flow, and is beneficial to improving service experience.

[0016] In a possible implementation method, the first service request includes tuple information corresponding to the first service, and the tuple information includes address information of an application function network element corresponding to the first service request; the method further includes: determining first mapping information, the first mapping information being used to indicate a mapping relationship between the tuple information corresponding to the first service request and the first MASQUE connection, or the first mapping information being used to indicate a mapping relationship between the tuple information corresponding to the first service request, the address information of the application function network element corresponding to the first service request, and the first MASQUE connection; and the first mapping information being used to forward service packets corresponding to the first service request transmitted between the first terminal and the application function network element corresponding to the first service request.

[0017] Based on the above scheme, by establishing the first mapping information, the mapping relationship between the first MASQUE connection and the tuple information corresponding to the first service request can be established, and the subsequent user plane network element can forward the service message transmitted between the first terminal and the application function network element based on the first mapping information, which helps to realize the correct transmission of the service message.

[0018] In a possible implementation method, the method further includes: receiving, through the first MASQUE connection, a service message corresponding to the first service request from the application function network element corresponding to the first service request; and transmitting, according to the first mapping information, the service message corresponding to the first service request to the first terminal.

[0019] Based on the above scheme, the user plane network element can forward the service message transmitted between the terminal and the application function network element based on the first mapping relationship, which helps to realize the correct transmission of the service message.

[0020] In a possible implementation method, the method further includes: obtaining second indication information, the second indication information indicating that the first MASQUE connection supports establishment of multiple service flows.

[0021] Based on the above scheme, the second indication information explicitly indicates that the first MASQUE connection supports establishment of multiple service flows, so that the subsequent user plane network element can establish multiple service flows on the first MASQUE connection, which helps to improve the utilization rate of the MASQUE connection, thereby saving resource overhead.

[0022] In a possible implementation method, the method further includes: receiving a second service request from a second terminal, the second service request including address information of an application function network element corresponding to the second service request; and in a case where the address information of the application function network element corresponding to the second service request is the same as the address information of the application function network element corresponding to the first service request, establishing, based on the first MASQUE connection and the second indication information, a second service flow for the second service request, the second service flow being used to transmit a service message corresponding to the second service request.

[0023] Based on the scheme, after a first MASQUE connection between the user plane network element and a certain application function network element is established, if a service request is received again, and the application function network element corresponding to the service request is the same as the application function network element corresponding to the first MASQUE connection, and the address information of the application function network element corresponding to the service request is the same as the address information of the application function network element corresponding to the first MASQUE connection, and the first MASQUE connection supports establishing multiple service flows, the user plane network element does not need to newly establish a MASQUE connection between the user plane network element and the application function network element for the service request, but newly establishes a service flow corresponding to the second service request on the first MASQUE connection. In the method, each MASQUE connection can be used to transmit multiple service flows, which can improve resource utilization and is beneficial to saving resources.

[0024] In a possible implementation method, the first service request includes tuple information corresponding to the first service, and the tuple information includes address information of the application function network element corresponding to the first service request; the method further includes: determining second mapping information, the second mapping information being used to indicate a mapping relationship between the tuple information corresponding to the first service request and the first service flow, or the second mapping information being used to indicate a mapping relationship between the tuple information corresponding to the first service request, the address information of the application function network element corresponding to the first service request, and the first service flow; and the second mapping information is used to forward service packets of the first service flow corresponding to the first service request transmitted between the first terminal and the application function network element corresponding to the first service request.

[0025] Based on the above scheme, by establishing the second mapping information, a mapping relationship between the first service flow and the tuple information corresponding to the first service request can be established, and a user plane network element can forward service packets of the first service flow transmitted between the first terminal and the application function network element based on the second mapping information, which is helpful to correctly transmitting the service packets.

[0026] In a possible implementation method, the method further includes: receiving, through the first MASQUE connection, service packets corresponding to the first service request from the application function network element corresponding to the first service request; and sending, according to the second mapping information, service packets of the first service flow corresponding to the first service request to the first terminal.

[0027] Based on the above scheme, the user plane network element can forward service packets of the first service flow transmitted between the first terminal and the application function network element based on the second mapping information, which is helpful to correctly transmitting the service packets.

[0028] In a possible implementation, the method further includes: detecting that the first MASQUE connection has no traffic message to transmit, and releasing the first MASQUE connection.

[0029] Based on the foregoing scheme, by releasing the first MASQUE connection, resource consumption caused by maintaining the MASQUE connection for a long time can be saved.

[0030] In a second aspect, an embodiment of the present application provides a communication method, which can be applied to a network side, for example, an application function network element on the network side, a module (for example, a circuit, a chip, or a chip system, etc.) in the application function network element, or a logic node, a logic module, or software capable of realizing all or part of the functions of the application function network element. The method includes: obtaining identity information of the application function network element, the identity information of the application function network element containing at least one address information supporting a MASQUE connection; and sending the identity information of the application function network element to a user plane network element.

[0031] Based on the foregoing scheme, the application function network element can send the identity information of the application function network element to the user plane network element, and subsequently, when receiving a service request, the user plane network element can determine whether a MASQUE connection between the user plane network element and the application function network element can be established based on the identity information of the application function network element and address information of the application function network element carried in the service request. Therefore, the scheme realizes on-demand establishment of a MASQUE connection, and transmits a service message through the established MASQUE connection, rather than establishing and maintaining a MASQUE connection in advance before receiving a service request, which can reduce resource consumption of the user plane network element, and can avoid a MASQUE connection being exposed for a long time and being attacked, thereby improving the security of the MASQUE connection.

[0032] In a possible implementation, the method further includes: sending first indication information to the user plane network element, the first indication information indicating that the MASQUE connection on the application function network element does not support establishment of multiple service flows.

[0033] Based on the foregoing scheme, the first indication information explicitly indicates that the first MASQUE connection does not support establishment of multiple service flows, so that subsequently, the user plane network element establishes only one service flow on the first MASQUE connection, rather than multiple service flows, thereby avoiding transmission failure caused by erroneous establishment of service flows, and therefore, resource consumption can be saved.

[0034] In a possible implementation, the method further includes: sending second indication information to the user plane network element, the second indication information indicating that the MASQUE connection on the application function network element supports establishment of multiple service flows.

[0035] Based on the above scheme, the first MASQUE connection is explicitly indicated to support establishment of multiple service flows through the second indication information, so that subsequent user plane network elements can establish multiple service flows on the first MASQUE connection, which helps to improve the utilization of the MASQUE connection, thereby saving resource overhead.

[0036] In a possible implementation method, the address information of the MASQUE connection includes an IP address, or includes an IP address and a port number.

[0037] In a third aspect, the present application provides a communication apparatus, which has the function of implementing the first aspect, for example, the communication apparatus includes a module, unit or means corresponding to the operation involved in the first aspect, which can be implemented by software, or by hardware, or by a combination of software and hardware.

[0038] In a fourth aspect, the present application provides a communication apparatus, which has the function of implementing the second aspect, for example, the communication apparatus includes a module, unit or means corresponding to the operation involved in the second aspect, which can be implemented by software, or by hardware, or by a combination of software and hardware.

[0039] In a fifth aspect, the present application provides a communication apparatus, which includes an interface circuit and one or more processors. The one or more processors are coupled with a memory. The memory is used to store part or all of the necessary computer programs or instructions for implementing the functions involved in the first aspect. The one or more processors can execute the computer programs or instructions, when the computer programs or instructions are executed, so that the communication apparatus implements the method in any possible design or implementation manner of the first aspect. The interface circuit is used to implement the communication function within the communication apparatus and / or the communication function of the communication apparatus with other devices or components.

[0040] The communication apparatus described above can be a user plane network element, a module (such as a circuit, a chip or a chip system, etc.) in the user plane network element, or a logic node, a logic module or software capable of implementing all or part of the functions of the user plane network element.

[0041] In a sixth aspect, the present application provides a communication apparatus, which comprises an interface circuit and one or more processors. The one or more processors are coupled with a memory. The memory is configured to store part or all of the computer programs or instructions necessary for implementing the functions related to the second aspect. The one or more processors can execute the computer programs or instructions, which, when executed, cause the communication apparatus to implement the method in any possible design or implementation manner of the second aspect. The interface circuit is configured to implement the communication function within the communication apparatus and / or the communication function of the communication apparatus with other apparatuses or components.

[0042] The communication apparatus described above can be an application function network element, a module (such as a circuit, a chip or a chip system, etc.) in the application function network element, or a logic node, a logic module or software capable of implementing all or part of the functions of the application function network element.

[0043] In a seventh aspect, the present application provides a computer readable storage medium, which stores computer programs or instructions, which, when executed, implement the method in any possible design of the first aspect to the second aspect.

[0044] In an eighth aspect, the present application provides a computer program product, which comprises computer programs or instructions, which, when executed, implement the method in any possible design of the first aspect to the second aspect.

[0045] In a ninth aspect, the present application provides a communication system, which comprises a user plane network element for executing the method in any possible implementation of the first aspect, and an application function network element for executing the method in any possible implementation of the second aspect. BRIEF DESCRIPTION OF DRAWINGS

[0046] FIG. 1 is a schematic diagram of a network architecture based on a service-oriented architecture;

[0047] FIG. 2 is a schematic diagram of a protocol stack structure;

[0048] FIG. 3 is a schematic diagram of a communication method provided by an embodiment of the present application;

[0049] FIG. 4 is a schematic diagram of a communication method provided by an embodiment of the present application;

[0050] FIG. 5 is a schematic diagram of a communication method provided by an embodiment of the present application;

[0051] FIG. 6 is a possible exemplary block diagram of a communication apparatus related in an embodiment of the present application;

[0052] FIG. 7 is a possible exemplary block diagram of a communication apparatus related in an embodiment of the present application. DETAILED DESCRIPTION

[0053] FIG. 1 is a schematic diagram of a network architecture based on a service-based architecture. The network architecture shown in FIG. 1 can include access network devices and core network devices. A terminal accesses a data network (DN) through the access network devices and the core network devices. The core network devices include, but are not limited to, some or all of the following network elements: an authentication server function (AUSF) network element, a unified data management (UDM) network element, a unified data repository (UDR) network element, a network repository function (NRF) network element, a network exposure function (NEF) network element, an application function (AF) network element, a policy control function (PCF) network element, an access and mobility management function (AMF) network element, a session management function (SMF) network element, and a user plane function (UPF) network element.

[0054] It should be noted that the above various network elements (such as the SMF network element, the UPF network element, etc.) can also omit the "network element" when described, for example, the SMF network element is simply referred to as SMF, the UPF network element is simply referred to as UPF, and the like. In FIG. 1, this brief description is also used.

[0055] The access network device, which can also be referred to as a RAN node, a RAN entity, or an access node, etc., is used to help the terminal to realize wireless access.

[0056] In a possible scenario, the access network device can be a base station, an evolved NodeB (eNodeB), an access point (AP), a transmission reception point (TRP), a next generation NodeB (gNB), a base station in a future mobile communication system, or an access node in a wireless fidelity (WiFi) system, etc. The access network device can be a macro base station, a micro base station, or an indoor station, a relay node or a donor node. Optionally, the access network device can also be a server, a wearable device, a vehicle or a vehicle-mounted device, etc. For example, the access network device in vehicle to everything (V2X) technology can be a road side unit (RSU). All or part of the functions of the access network device in this application can also be implemented by software functions running on hardware, or by virtualized functions instantiated on a platform (such as a cloud platform). The access network device can also be provided with a communication module, circuit or chip for performing corresponding communication functions, and program instructions for performing corresponding communication functions. The access network device in this application can also be a logical node, a logical module or software that can implement all or part of the functions of the access network device.

[0057] In another possible scenario, multiple access network devices cooperate to assist a terminal to implement wireless access, and different access network devices respectively implement part of the functions of a base station. For example, the access network device can be a central unit (CU), a distributed unit (DU), a CU-control plane (CP), a CU-user plane (UP), or a radio unit (RU), etc. The CU and the DU can be separately arranged, or can be included in the same network element, such as a baseband unit (BBU). The RU can be included in a radio frequency device or a radio frequency unit, such as a remote radio unit (RRU), an active antenna processing unit (AAU), or a remote radio head (RRH).

[0058] In different systems, the CU (or CU-CP and CU-UP), DU or RU can also have different names, but those skilled in the art can understand their meanings. For example, in an open radio access network (ORAN) system, the CU can also be referred to as an O-CU (open CU), the DU can also be referred to as an O-DU, the CU-CP can also be referred to as an O-CU-CP, the CU-UP can also be referred to as an O-CU-UP, and the RU can also be referred to as an O-RU. For the convenience of description, the CU, CU-CP, CU-UP, DU and RU are taken as examples for description in this application. Any one of the CU (or CU-CP, CU-UP), DU and RU in this application can be implemented by a software module, a hardware module, or a combination of a software module and a hardware module.

[0059] The terminal can also be referred to as a terminal device, user equipment (UE), mobile station, mobile terminal, etc. The terminal can be widely applied to various scenarios, such as device-to-device (D2D), vehicle to everything (V2X) communication, machine-type communication (MTC), internet of things (IOT), virtual reality, augmented reality, industrial control, autonomous driving, remote medical treatment, smart power grid, smart furniture, smart office, smart wear, smart transportation, smart city, etc. The terminal can be a mobile phone, tablet computer, computer with wireless transceiver function, wearable device, vehicle, unmanned aerial vehicle, helicopter, airplane, ship, robot, mechanical arm, smart home device, wireless communication function transport vehicle, communication module, etc. Embodiments of the present application do not limit the device form of the terminal. The terminal is usually provided with a communication module, circuit or chip for executing corresponding communication functions. The terminal is also configured with program instructions for executing corresponding communication functions.

[0060] The access network device and the terminal can be fixed in position or movable. The access network device and the terminal can be deployed on land, including indoors or outdoors, handheld or vehicle-mounted; can also be deployed on the water surface; can also be deployed on aircraft, balloons and artificial satellites in the air. Embodiments of the present application do not limit the application scenarios of the access network device and the terminal.

[0061] The AMF network element contains functions such as performing mobility management, or access authentication / authorization. In addition, it is also responsible for transmitting user policies between the terminal and the PCF network element.

[0062] SMF network element, containing functions such as performing session management, performing control policies issued by a PCF network element, selecting a UPF network element, or allocating an IP address of a terminal.

[0063] UPF network element, containing functions such as completing user plane data forwarding, session / stream level-based charging statistics, or bandwidth limitation.

[0064] UDM network element, containing functions such as performing management of subscription data or user access authorization.

[0065] UDR, containing functions such as access of types of data such as subscription data, policy data, or application data.

[0066] NEF network element, used for supporting opening of capabilities and events.

[0067] AF network element, delivering requirements of an application side to a network side, for example, quality of service (QoS) requirements or user state event subscription. The AF can be a third-party functional entity or an application service deployed by an operator, such as an IP Multimedia Subsystem (IMS) voice call service. The AF network element includes an AF network element in a core network (namely, an AF network element of an operator) and a third-party AF network element (such as an application server (AS) of an enterprise).

[0068] PCF network element, containing policy control functions such as charging, QoS bandwidth guarantee, and mobility management for a session or a service flow level, or terminal policy decision.

[0069] NRF network element, which can be used to provide a network element discovery function and provide network element information corresponding to a network element type based on a request of another network element. The NRF network element also provides network element management services such as network element registration, update, deregistration, or network element state subscription and push.

[0070] AUSF network element, responsible for authenticating a user to determine whether to allow the user or a device to access a network.

[0071] DN is a network located outside the operator network, the operator network can access multiple DN, and multiple services can be deployed on the DN to provide data and / or voice services for terminals. For example, the DN is a private network of a certain intelligent factory, the sensors installed in the workshop of the intelligent factory can be terminals, and the control server of the sensors is deployed in the DN, and the control server can provide services for the sensors. The sensor can communicate with the control server, obtain the instruction of the control server, and transmit the collected sensor data to the control server according to the instruction. For another example, the DN is an internal office network of a certain company, the mobile phone or computer of the employee of the company can be a terminal, and the mobile phone or computer of the employee can access information and data resources on the internal office network of the company.

[0072] Nausf, Npcf, Nudr, Nudm, Naf, Namf, Nsmf, Nnef and Nnrf in FIG. 1 are service-based interfaces (SBI) provided by the above-mentioned AUSF, PCF, UDR, UDM, AF, AMF, SMF, NEF and NRF, respectively, for invoking corresponding service-based operations. N1, N2, N3, N4 and N6 are interface serial numbers, and the meanings of these interface serial numbers are as follows:

[0073] 1) N1: the interface between the AMF network element and the terminal, which can be used to transmit non-access stratum (NAS) signaling (such as QoS rules from the AMF network element) to the terminal, etc.

[0074] 2) N2: the interface between the AMF network element and the access network device, which can be used to transmit wireless bearer control information from the core network side to the access network device, etc.

[0075] 3) N3: the interface between the access network device and the UPF network element, which is mainly used to transmit uplink and downlink user plane data between the access network device and the UPF network element.

[0076] 4) N4: the interface between the SMF network element and the UPF network element, which can be used to transmit information between the control plane and the user plane, including the downlink of the control plane to the user plane forwarding rules, QoS rules, traffic statistics rules, etc. and the information reporting of the user plane.

[0077] 5) N6: the interface between the UPF network element and the DN, which is used to transmit uplink and downlink user data flow between the UPF network element and the DN.

[0078] The various network function network elements in the architecture shown in FIG. 1 are connected through a service bus and interact through service interfaces. The service bus has the advantages of improving the flexibility, openness, scalability and intelligence of the network, and can support diversified business scenarios and requirements. The service bus can be used to transmit various types of data and signaling, such as real-time signaling (for example, service interface call signaling between network elements of the function network element) sensitive to latency, real-time data (for example, real-time artificial intelligence inference data) sensitive to latency, and non-real-time data (for example, data for offline artificial intelligence training). Moreover, when the service bus transmits these data or signaling, the data or signaling are coupled together, that is, the service bus can be used to transmit real-time signaling, real-time data and non-real-time data at the same time.

[0079] It can be understood that the above network element or function can be a network element in a hardware device, or a software function running on a dedicated hardware, or a virtualized function instantiated on a platform (for example, a cloud platform). Optionally, the above network element or function can be implemented by one device, or can be implemented by multiple devices together, or can be a functional module in a device, and the embodiments of the present application do not make specific limitations thereto.

[0080] The user plane network element and the application function network element in the present application can be the UPF network element and the AF network element in FIG. 1, or can be network elements having the functions of the above UPF network element and AF network element in future communication networks, and the present application does not make limitations thereto.

[0081] To facilitate understanding of the content of the present application, the following describes the terms or terms related to the present application.

[0082] 1) QUIC

[0083] QUIC can also be referred to as Google QUIC (gQUIC), which is a reliable UDP transport protocol designed by Google in 2012, aiming to provide a secure, reliable, efficient and low-latency communication guarantee for the hyper text transfer protocol (HTTP). The QUIC protocol has been adopted as a standard by the Internet Engineering Task Force (IETF), and HTTP / 3 has selected the QUIC protocol to replace the transmission control protocol (TCP) as its transport layer protocol.

[0084] Figure 2 is a schematic diagram of a protocol stack structure. Since the QUIC protocol is built on UDP, the space for customization and optimization of the QUIC protocol is greater relative to other protocols such as HTTP 1.1 or HTTP / 2 (also referred to as HTTP2) over TCP. At the upper layer of UDP, the QUIC protocol provides reliable, ordered, secure, and faster transmission services. At present, a large number of request responses of businesses are carried through QUIC, and it can be said that the QUIC protocol has become a new generation of transport layer protocol. The TLS in Figure 2 refers to transport layer security, and the IP refers to internet protocol.

[0085] 2) MASQUE

[0086] In the existing network implementation, a proxy is needed in many scenarios, for example, when end-to-end connections cannot directly interwork, when encryption communication through a virtual private network (VPN) is needed, and when a proxy is needed for reasons such as security isolation or privacy protection.

[0087] The existing HTTP connection supports only TCP connection and the signaling of a protocol for sessions traversal across firewall securely (socks) is not encrypted. Based on this background, a scenario of HTTP / 3 over QUIC is derived, and a new proxy protocol needs to be introduced. The HTTP / 3 can also be referred to as HTTP3 or HTTP over QUIC.

[0088] The MASQUE is a framework that allows multiple network applications to run concurrently within an HTTP / 3 connection. For example, the MASQUE can allow a QUIC client to negotiate proxy functionality with an HTTP / 3 server, and then use this functionality while concurrently handling HTTP / 3 requests and responses.

[0089] A user plane network element (for example, a UPF network element) supports address information of an application function network element (for example, an HTTP / 3 server), and the user plane network element can establish a MASQUE connection with the application function network element based on the perceived address information of the application function network element.

[0090] Currently, after the user plane network element perceives the address information of the application function network element, the user plane network element immediately establishes and maintains the MASQUE connection between the user plane network element and the application function network element, and the MASQUE connection can be used for subsequent service transmission.

[0091] The above-mentioned manner has the following problems: the user plane network element needs to maintain a large number of MASQUE connections for a long time, which not only brings a large resource overhead to the user plane network element, but also causes the MASQUE connection to be exposed for a long time and vulnerable to attacks.

[0092] To solve the above-mentioned problems, the present application provides corresponding solutions.

[0093] The communication method, communication device and communication system provided by the present application will be described below in conjunction with the accompanying drawings. It can be understood that the user plane network element and the application function network element are taken as an example of the execution subject of the interaction in the present application, but the present application does not limit the execution subject of the interaction. The method executed by the user plane network element in the present application can also be implemented by a module (such as a circuit, a chip or a chip system, etc.) in the user plane network element, or a logical node, a logical module or software capable of realizing all or part of the functions of the user plane network element. The method executed by the application function network element in the present application can also be implemented by a module (such as a circuit, a chip or a chip system, etc.) in the application function network element, or a logical node, a logical module or software capable of realizing all or part of the functions of the application function network element.

[0094] FIG. 3 is a flow diagram of a communication method provided by an embodiment of the present application. The method comprises the following steps:

[0095] Step 301: The user plane network element obtains the identity information of each application function network element in the at least one application function network element.

[0096] The identity information of each application function network element in the at least one application function network element comprises at least one address information supporting the MASQUE connection. The address information of each MASQUE connection can be used to establish one or more MASQUE connections.

[0097] For example, the user plane network element acquires the identity information of the application function network element #1, the identity information of the application function network element #2, and the identity information of the application function network element #3. The identity information of the application function network element #1 includes address information #1_1 supporting MASQUE connection, address information #1_2 supporting MASQUE connection, and address information #1_3 supporting MASQUE connection. The identity information of the application function network element #2 includes address information #2_1 supporting MASQUE connection, address information #2_2 supporting MASQUE connection, and address information #2_3 supporting MASQUE connection. The identity information of the application function network element #3 includes address information #3_1 supporting MASQUE connection, address information #3_2 supporting MASQUE connection, and address information #3_3 supporting MASQUE connection.

[0098] Exemplarily, each address information supporting MASQUE connection includes one or more of the following information:

[0099] 1) IP address of the application function network element.

[0100] 2) Port number of the application function network element.

[0101] 3) Fully qualified domain name (FQDN) of the application function network element.

[0102] For example, the address information supporting MASQUE connection of the application function network element includes an IP address, or includes an IP address and a port number, or includes an IP address, a port number, and a FQDN, or includes an IP and a FQDN, or includes a FQDN.

[0103] Exemplarily, Table 1 below gives an example of the identity information of the application function network element #1.

[0104] Table 1

[0105] As shown in Table 1, the identity information of the application function network element #1 includes three address information supporting MASQUE connection, which are address information #1_1 (i.e. IP #1) supporting MASQUE connection, address information #1_2 (i.e. IP2# and Port #2) supporting MASQUE connection, and address information #1_3 (i.e. IP #3) supporting MASQUE connection.

[0106] The application function network element #1 can establish one or more MASQUE connections using IP #1, establish one or more MASQUE connections using IP2# and Port #2, and establish one or more MASQUE connections using IP #3.

[0107] The examples of the identity information of other application function network elements are similar, and will not be listed here.

[0108] The present application does not limit the specific implementation of the user plane network element obtaining the identity information of each application function network element in the at least one application function network element. For example, the at least one application function network element respectively sends its own identity information to the user plane network element through a capability exposure network element (for example, a NEF network element). For another example, the at least one application function network element respectively sends its own identity information to a policy control network element (for example, a PCF network element) through a NEF network element, and then the policy control network element sends the identity information of each application function network element in the at least one application function network element to the user plane network element through a session management network element (for example, a SMF network element). For another example, the user plane network element obtains the identity information of each application function network element in the at least one application function network element from a unified data storage network element (for example, a UDR network element). For another example, the identity information of each application function network element in the at least one application function network element is pre-configured on the user plane network element by a network management personnel.

[0109] In a possible implementation method, before, after or at the same time of step 301, the user plane network element further obtains indication information indicating whether the MASQUE connection established by each application function network element in the at least one application function network element supports establishing multiple service flows. The specific way in which the user plane network element obtains the indication information is similar to that of obtaining the identity information of each application function network element in the at least one application function network element, and will not be repeated here.

[0110] In an implementation method, for a certain application function network element, if the identity information of the application function network element includes multiple address information supporting MASQUE connection, and the MASQUE connections corresponding to the multiple address information supporting MASQUE connection all do not support establishing multiple service flows, the user plane network element only needs to obtain one indication information (for example, first indication information) corresponding to the application function network element, and the first indication information indicates that the MASQUE connection established by the application function network element does not support establishing multiple service flows. Or, if the identity information of the application function network element includes multiple address information supporting MASQUE connection, and the MASQUE connections corresponding to the multiple address information supporting MASQUE connection all support establishing multiple service flows, the user plane network element only needs to obtain one indication information (for example, second indication information) corresponding to the application function network element, and the second indication information indicates that the MASQUE connection established by the application function network element supports establishing multiple service flows.

[0111] In another implementation method, for an application function network element, if the identity information of the application function network element includes multiple address information supporting MASQUE connection, and there are some MASQUE connections not supporting establishment of multiple service flows and some MASQUE connections supporting establishment of multiple service flows in the MASQUE connections corresponding to the multiple address information supporting MASQUE connection, the user plane network element can obtain two indication information, one of which is used to indicate which identity information of the application function network element corresponds to the MASQUE connection not supporting establishment of multiple service flows, and the other is used to indicate which identity information of the application function network element corresponds to the MASQUE connection supporting establishment of multiple service flows, or each identity information of the application function network element corresponds to an indication information, which is used to indicate whether the MASQUE connection corresponding to the identity information supports establishment of multiple service flows.

[0112] In step 302, the first terminal sends a first service request to the user plane network element. Correspondingly, the user plane network element receives the first service request.

[0113] The first service request includes address information of an application function network element corresponding to the first service request. The address information of the application function network element corresponding to the first service request includes one or more of an IP address, a port number or an FQDN of the application function network element. For example, the address information of the application function network element corresponding to the first service request includes an IP address, or includes an IP address and a port number, or includes an IP address, a port number and an FQDN, or includes an IP and an FQDN, or includes an FQDN.

[0114] For example, the first service request includes tuple information corresponding to the first service, which includes address information of an application function network element corresponding to the first service request. The tuple information can be four-tuple information, which includes a source IP address (i.e. the IP address of the terminal), a source port number (i.e. the port number of the terminal), a target IP address (i.e. the IP address of the application function network element) and a target port number (i.e. the port number of the application function network element). The address information of the application function network element can include a destination IP address, or include a target IP address and a target port number.

[0115] For example, the first service request includes tuple information corresponding to the first service, which can also be five-tuple information, which includes a source IP address (i.e. the IP address of the terminal), a source port number (i.e. the port number of the terminal), a target IP address (i.e. the IP address of the application function network element), a target port number (i.e. the port number of the application function network element) and a protocol type (i.e. the QUIC protocol). The address information of the application function network element can include a destination IP address, or include a target IP address and a target port number.

[0116] As an implementation method, when the first terminal has a transmission requirement of the first service, the first terminal sends the first service request to the user plane network element. The transmission requirement of the first service can be triggered by starting an application (such as a video application) of the first terminal, starting a function option of the application (such as starting a function option of playing a video in the video application), and the like, which are not limited in the present application.

[0117] In step 303, in the case that the at least one address information supporting the MASQUE connection includes the address information of the application function network element corresponding to the first service request, the user plane network element establishes the first MASQUE connection between the application function network element corresponding to the first service request based on the address information of the application function network element corresponding to the first service request.

[0118] The at least one address information supporting the MASQUE connection herein is the address information supporting the MASQUE connection in the identity information of each application function network element in the at least one application function network element obtained by the user plane network element in the foregoing step 301.

[0119] The first MASQUE connection is used for transmitting the service packet corresponding to the first service request.

[0120] Taking the example in step 301 as an example, the user plane network element obtains the identity information of the application function network element #1, the identity information of the application function network element #2, and the identity information of the application function network element #3. The identity information of the application function network element #1 includes the address information #1_1 supporting the MASQUE connection, the address information #1_2 supporting the MASQUE connection, and the address information #1_3 supporting the MASQUE connection. The identity information of the application function network element #2 includes the address information #2_1 supporting the MASQUE connection, the address information #2_2 supporting the MASQUE connection, and the address information #2_3 supporting the MASQUE connection. The identity information of the application function network element #3 includes the address information #3_1 supporting the MASQUE connection, the address information #3_2 supporting the MASQUE connection, and the address information #3_3 supporting the MASQUE connection.

[0121] If the address information of the application function network element corresponding to the first service request is included in the identity information of each of the at least one application function network element obtained by the user plane network element, the user plane network element determines that the MASQUE connection can be established with the application function network element corresponding to the first service request, and then the user plane network element establishes the first MASQUE connection between the user plane network element and the application function network element corresponding to the first service request. For example, the address information #1_3 supporting the MASQUE connection is the same as the address information of the application function network element corresponding to the first service request, the application function network element corresponding to the first service request is the application function network element #1, and the user plane network element can establish the MASQUE connection between the user plane network element and the application function network element #1 based on the address information #1_3 supporting the MASQUE connection.

[0122] If the address information of the application function network element corresponding to the first service request is not included in the identity information of each of the at least one application function network element obtained by the user plane network element, the user plane network element determines that the MASQUE connection cannot be established with the application function network element corresponding to the first service request, and then the user plane network element can reject the first service request, for example, sends a service rejection message to the first terminal.

[0123] Based on the above scheme, the user plane network element can obtain the identity information of each of the at least one application function network element in advance, and subsequently, based on the identity information of each of the at least one application function network element and the address information of the application function network element carried in the service request, it is judged whether the MASQUE connection can be established with the application function network element. Therefore, the scheme realizes the on-demand establishment of the MSAQUE connection, and transmits the service message through the established MASQUE connection, instead of establishing and maintaining the MASQUE connection with the application function network element in advance before receiving the service request, which can reduce the resource consumption of the user plane network element, and can avoid the MASQUE connection being exposed for a long time and being attacked, thereby improving the security of the MSAQUE connection.

[0124] Optionally, after the above step 303, the following step 304 can also be performed.

[0125] Step 304: The user plane network element establishes a first service flow for the first service request based on the first MASQUE connection.

[0126] The first service flow is used to transmit the service message corresponding to the first service request.

[0127] Or it is understood that the first MASQUE connection can be used to transmit the first service flow corresponding to the first service request.

[0128] In a possible implementation, the user plane network element can further receive a second service request from a second terminal (which can be the same terminal as the first terminal or a different terminal), the second service request including address information of an application function network element corresponding to the second service request, the address information of the application function network element corresponding to the second service request being the same as the address information of the application function network element corresponding to the first service request, and the user plane network element can have two different processing methods, and can select one of the two processing methods. The two processing methods are described below.

[0129] In a first processing method, if the first MASQUE connection established by the user plane network element based on the address information of the application function network element corresponding to the first service request does not support transmission of multiple service flows, the user plane network element establishes a second MASQUE connection between the user plane network element and the application function network element corresponding to the second service request, and the second MASQUE connection is used to transmit service packets corresponding to the second service request.

[0130] For example, the user plane network element can obtain first indication information indicating that the first MASQUE connection does not support establishment of multiple service flows, and the user plane network element can establish a second MASQUE connection between the user plane network element and the application function network element corresponding to the second service request based on the address information of the application function network element corresponding to the second service request and the first indication information.

[0131] For example, after establishing the second MASQUE connection, the user plane network element can establish a second service flow for the second service request based on the second MASQUE connection, and the second service flow is used to transmit service packets corresponding to the second service request. Alternatively, it can be understood that the second MASQUE connection established by the user plane network element is used to transmit service packets of the second service flow corresponding to the second service request. The first service flow and the second service flow are used to transmit service packets of different services, for example, the first service flow is a video stream, the second service is an audio stream, or the first service flow is a video stream #1, the second service flow is a video stream #2, and so on.

[0132] Based on the scheme, after establishing a first MASQUE connection between the user plane network element and an application function network element, if a service request is received again, the application function network element corresponding to the service request is the same as the application function network element corresponding to the first MASQUE connection, the address information of the application function network element corresponding to the service request is the same as the address information of the application function network element corresponding to the first MASQUE connection, but the first MASQUE connection does not support establishment of multiple service flows, the user plane network element newly establishes a second MASQUE connection between the user plane network element and the application function network element for the service request. In this method, each MASQUE connection is used to transmit only one service flow, which can guarantee the transmission quality and delay of the service flow, and is beneficial to improving the service experience.

[0133] The processing method is for a scenario where each MASQUE connection is used to transmit only one service flow. Based on the scenario, after establishing the first MASQUE connection, the user plane network element can also determine first mapping information, which is used to indicate a mapping relationship between the tuple information corresponding to the first service request and the first MASQUE connection, or the first mapping information is used to indicate a mapping relationship between the tuple information corresponding to the first service request, address information of the application function network element corresponding to the first service request, and the first MASQUE connection. Optionally, the first mapping information also indicates a state of the first MASQUE connection. The first mapping information is used to forward the service packet corresponding to the first service request transmitted between the first terminal and the application function network element corresponding to the first service request. The meaning of the tuple information corresponding to the first service request can be referred to the foregoing description, and will not be described herein. Subsequently, when the user plane network element receives the service packet corresponding to the first service request from the application function network element corresponding to the first service request through the first MASQUE connection, the user plane network element can send the service packet corresponding to the first service request to the first terminal according to the first mapping information. For example, when the user plane network element receives the service packet of the first service flow from the application function network element through the first MASQUE connection, the packet header of the service packet carries an identifier of the first MASQUE connection, and the user plane network element determines the corresponding four-tuple information or five-tuple information according to the identifier of the first MASQUE connection and the first mapping information, and forwards the service packet to the first terminal based on the four-tuple information or the five-tuple information.

[0134] As an implementation method, the user plane network element determines the first mapping information. For example, the user plane network element can obtain initial information before establishing the first MASQUE connection, the initial information being used to indicate that the user plane network element obtains identity information of each application function network element in the at least one application function network element, the user plane network element determines address information of the application function network element corresponding to the first service request in the initial information after establishing the first MASQUE connection, and then adds information (such as an identifier or a state, etc.) about the first MASQUE connection and the tuple information corresponding to the first service request on the basis of the address information of the application function network element corresponding to the first service request, to obtain the first mapping information.

[0135] Exemplarily, it is assumed that the application function network element corresponding to the first service request is the application function network element #1 shown in Table 1, and the address information of the application function network element corresponding to the first service request is IP#1, the first mapping information can be as shown in Table 2.

[0136] Table 2

[0137] S-IP1, S-Port1, D-IP1, D-Port1, MASQUE ID#1, and the state of the first MASQUE connection. The S-IP1 is the IP address of the first terminal, the S-Port1 is the port number of the first terminal, the D-IP1 is the IP address of the application function network element #1, and the D-Port1 is the port number of the application function network element #1. The D-IP1 is the same as the IP#1. The MASQUE ID#1 is the unique identifier of the first MASQUE connection, and the user plane network element can obtain the MASQUE ID#1 from the application function network element #1. The state of the first MASQUE connection is enabled, indicating that the first MASQUE connection indicated by the MASQUE ID#1 can currently communicate normally.

[0138] The processing method is for a scenario in which each MASQUE connection is used to transmit only one service flow. Based on this scenario, after establishing the second MASQUE connection, the user plane network element can also determine third mapping information, which is used to indicate the mapping relationship between the tuple information corresponding to the second service request and the second MASQUE connection, or the third mapping information is used to indicate the mapping relationship between the tuple information corresponding to the second service request, the address information of the application function network element corresponding to the second service request, and the second MASQUE connection. Optionally, the third mapping information also indicates the state of the second MASQUE connection. The third mapping information is used to forward the service packet corresponding to the second service request transmitted between the second terminal and the application function network element corresponding to the second service request. The meaning of the tuple information corresponding to the second service request is similar to that of the tuple information corresponding to the first service request, and can be referred to the foregoing description, which will not be described herein. Subsequently, when the user plane network element receives the service packet corresponding to the second service request from the application function network element corresponding to the second service request through the second MASQUE connection, the user plane network element can send the service packet corresponding to the second service request to the second terminal according to the third mapping information. For example, when the user plane network element receives the service packet of the second service flow from the application function network element through the second MASQUE connection, the packet header of the service packet carries the identifier of the second MASQUE connection, and the user plane network element determines the corresponding four-tuple information or five-tuple information according to the identifier of the second MASQUE connection and the third mapping information, and forwards the service packet to the second terminal based on the four-tuple information or the five-tuple information.

[0139] Exemplarily, assuming that the application function network element corresponding to the second service request is the application function network element #1 shown in Table 2, and the address information of the application function network element corresponding to the second service request is IP#1, the third mapping information can be added based on the first mapping information shown in Table 2 to obtain Table 3.

[0140] Table 3

[0141] Wherein, S-IP1 is the IP address of the first terminal, S-Port1 and S-Port2 are two different port numbers of the first terminal, D-IP1 is the IP address of the application function network element #1, and D-Port1 is the port number of the application function network element #1. Wherein, D-IP1 is the same as IP#1. MASQUE ID#1 is the unique identifier of the first MASQUE connection, and MASQUE ID#2 is the unique identifier of the second MASQUE connection. The user plane network element can obtain MASQUE ID#1 and MASQUE ID#2 from the application function network element #1. The state of the MASQUE connection is enabled, indicating that the first MASQUE connection indicated by MASQUE ID#1 can currently communicate normally, and the second MASQUE connection indicated by MASQUE ID#2 can currently communicate normally.

[0142] When the user plane network element receives service packet #1 of the first service flow from the application function network element #1, if the packet header of the service packet #1 carries MASQUE ID#1, the user plane network element determines that the tuple information corresponding to MASQUE ID#1 is (S-IP1, S-Port1, D-IP1, D-Port1) according to the first mapping information, and then the user plane network element forwards the service packet #1 to the first terminal according to the tuple information.

[0143] When the user plane network element receives service packet #2 of the second service flow from the application function network element #1, if the packet header of the service packet #2 carries MASQUE ID#2, the user plane network element determines that the tuple information corresponding to MASQUE ID#2 is (S-IP1, S-Port2, D-IP1, D-Port1) according to the third mapping information, and then the user plane network element forwards the service packet #2 to the first terminal according to the tuple information.

[0144] It should be noted that in the above Table 3, the target port number in the tuple information corresponding to MASQUE ID#1 is the same as the target port number in the tuple information corresponding to MASQUE ID#2, both of which are D-port1. In another implementation method, the target port number in the tuple information corresponding to MASQUE ID#1 and the target port number in the tuple information corresponding to MASQUE ID#2 can also be different, for example, the target port number in the tuple information corresponding to MASQUE ID#1 is D-port1, and the target port number in the tuple information corresponding to MASQUE ID#2 is D-port2.

[0145] For the processing method one, as an implementation method, if the user plane network element or the application function network element detects that the first MASQUE connection does not transmit service packets, the user plane network element or the application function network element can release the first MASQUE connection. This method can save the resource overhead of the user plane network element and the application function network element. Wherein, detecting that the first MASQUE connection does not transmit service packets, such as can be: detecting that the first MASQUE connection does not transmit service packets within a set time length, or detecting that a marking information is carried in the service packet transmitted on the first MASQUE connection, the marking information indicating that the service packet is the last service packet in the first service flow. After releasing the first MASQUE connection, the user plane network element can also delete the first mapping information.

[0146] For the processing method one, as an implementation method, if the user plane network element or the application function network element detects that the second MASQUE connection does not transmit service packets, the user plane network element or the application function network element can release the second MASQUE connection. This method can save the resource overhead of the user plane network element and the application function network element. Wherein, detecting that the second MASQUE connection does not transmit service packets, such as can be: detecting that the second MASQUE connection does not transmit service packets within a set time length, or detecting that a marking information is carried in the service packet transmitted on the second MASQUE connection, the marking information indicating that the service packet is the last service packet in the second service flow. After releasing the second MASQUE connection, the user plane network element can also delete the third mapping information.

[0147] Processing method two, if the user plane network element establishes the first MASQUE connection based on the address information of the application function network element corresponding to the first service request supports transmitting multiple service flows, the user plane network element establishes a second service flow based on the first MASQUE connection for a second service request, the second service flow is used for transmitting service packets corresponding to the second service request. That is, the first MASQUE connection is used for transmitting service packets of the first service flow corresponding to the first service request, and also used for transmitting service packets of the second service flow corresponding to the second service request.

[0148] For example, the user plane network element can obtain second indication information used for indicating that the first MASQUE connection supports establishing multiple service flows, and then the user plane network element can establish a second service flow based on the first MASQUE connection and the second indication information, the second service flow being used for transmitting service packets corresponding to a second service request. Or it can be understood that the first MASQUE connection is also used for transmitting service packets of the second service flow corresponding to the second service request.

[0149] Based on the scheme, after a first MASQUE connection between the user plane network element and a certain application function network element is established, if a service request is received again, and the application function network element corresponding to the service request is the same as the application function network element corresponding to the first MASQUE connection, and the address information of the application function network element corresponding to the service request is the same as the address information of the application function network element corresponding to the first MASQUE connection, and the first MASQUE connection supports establishment of multiple service flows, the user plane network element does not need to newly establish a MASQUE connection between the user plane network element and the application function network element for the service request, but newly establishes a service flow corresponding to the second service request on the first MASQUE connection. In the method, each MASQUE connection can be used to transmit multiple service flows, which can improve resource utilization and is beneficial to saving resources.

[0150] The second processing method is for a scenario in which each MASQUE connection can be used to transmit multiple service flows. Based on the scenario, after the first MASQUE connection and the first service flow are established, the user plane network element can further determine second mapping information, which is used to indicate a mapping relationship between the tuple information corresponding to the first service request and the first service flow, or the second mapping information is used to indicate a mapping relationship between the tuple information corresponding to the first service request, the address information of the application function network element corresponding to the first service request, and the first service flow. Optionally, the second mapping information further indicates a state of the first MASQUE connection. The second mapping information is used to forward service packets of the first service flow corresponding to the first service request transmitted between the first terminal and the application function network element corresponding to the first service request. The meaning of the tuple information corresponding to the first service request can be referred to the foregoing description and will not be described herein. Subsequently, when the user plane network element receives the service packets of the first service flow from the application function network element corresponding to the first service request through the first MASQUE connection, the user plane network element can send the service packets of the first service flow corresponding to the first service request to the first terminal according to the second mapping information. For example, when the user plane network element receives the service packets of the first service flow from the application function network element through the first MASQUE connection, the message header of the service packets carries an identifier of the first MASQUE connection and an identifier of the first service flow, and the user plane network element determines corresponding four-tuple information or five-tuple information according to the identifier of the first MASQUE connection, the identifier of the first service flow, and the second mapping information, and forwards the service packets to the first terminal based on the four-tuple information or the five-tuple information.

[0151] Exemplarily, assuming that the application function network element corresponding to the first service request is the application function network element #1 shown in Table 1, and the address information of the application function network element corresponding to the first service request is IP#1, the second mapping information can be as shown in Table 4.

[0152] Table 4

[0153] Wherein, S-IP1 is the IP address of the first terminal, S-Port1 is the port number of the first terminal, D-IP1 is the IP address of the application function network element #1, and D-Port1 is the port number of the application function network element #1. Wherein, D-IP1 is the same as IP#1. MASQUE ID#1 is the unique identifier of the first MASQUE connection, and stream ID#1 is the identifier of the first service flow in the first MASQUE connection. The MASQUE ID#1 and the stream ID#1 jointly identify the first service flow, or in another implementation method, the first service flow can also be uniquely identified by the stream ID#1 only. In this case, different service flows in different MASQUE connections need to use different stream IDs. The user plane network element can obtain the MASQUE ID#1 and the stream ID#1 from the application function network element #1. The state of the MASQUE connection is enabled, indicating that the first MASQUE connection indicated by the MASQUE ID#1 can currently communicate normally.

[0154] The second processing method is for the scenario that each MASQUE connection can be used to transmit multiple service flows. Based on this scenario, after establishing the first MASQUE connection and establishing the second service flow, the user plane network element can also determine fourth mapping information. The fourth mapping information is used to indicate the mapping relationship between the tuple information corresponding to the second service request and the second service flow, or the fourth mapping information is used to indicate the mapping relationship between the tuple information corresponding to the second service request, the address information of the application function network element corresponding to the second service request, and the second service flow. Optionally, the fourth mapping information also indicates the state of the first MASQUE connection. The fourth mapping information is used to forward the service packets of the second service flow corresponding to the second service request transmitted between the second terminal and the application function network element corresponding to the second service request. The meaning of the tuple information corresponding to the second service request is similar to that of the tuple information corresponding to the first service request, which can be referred to the foregoing description and will not be described here. Subsequently, when the user plane network element receives the service packets of the second service flow from the application function network element corresponding to the second service request through the first MASQUE connection, the user plane network element can send the service packets of the second service flow corresponding to the second service request to the second terminal according to the fourth mapping information. For example, when the user plane network element receives the service packets of the second service flow from the application function network element through the first MASQUE connection, the message header of the service packets carries the identifier of the first MASQUE connection and the identifier of the second service flow. The user plane network element determines the corresponding four-tuple information or five-tuple information according to the identifier of the first MASQUE connection, the identifier of the second service flow, and the fourth mapping information, and forwards the service packets to the second terminal based on the four-tuple information or the five-tuple information.

[0155] Exemplarily, assuming that the application function network element corresponding to the second service request is the application function network element #1 shown in Table 4, and the address information of the application function network element corresponding to the second service request is IP#1, fourth mapping information can be added on the basis of the second mapping information shown in Table 4 to obtain Table 5.

[0156] Table 5

[0157] S-IP1 is the IP address of the first terminal, S-Port1 and S-Port2 are two different port numbers of the first terminal, D-IP1 is the IP address of the application function network element #1, and D-Port1 is the port number of the application function network element #1. D-IP1 is the same as IP#1. MASQUE ID#1 is the unique identifier of the first MASQUE connection, stream ID#1 is the identifier of the first service flow in the first MASQUE connection, MASQUE ID#1 and stream ID#1 jointly identify the first service flow, stream ID#2 is the identifier of the second service flow in the first MASQUE connection, and MASQUE ID#1 and stream ID#2 jointly identify the second service flow. In another implementation method, stream ID#1 can be used to uniquely identify the first service flow, and stream ID#2 can be used to uniquely identify the second service flow, in which case different stream IDs need to be used for different service flows in different MASQUE connections. The user plane network element can obtain MASQUE ID#1, stream ID#1, and stream ID#2 from the application function network element #1. The state of the MASQUE connection is enabled, indicating that the first MASQUE connection indicated by MASQUE ID#1 can currently communicate normally.

[0158] For the second processing method described above, as an implementation method, if the user plane network element or the application function network element detects that the first MASQUE connection does not transmit service packets, the user plane network element or the application function network element can release the first MASQUE connection. This method can save resource overhead of the user plane network element and the application function network element. The detection that the first MASQUE connection does not transmit service packets can be, for example, detection that the first MASQUE connection does not transmit service packets within a set time length, or detection that a service packet transmitted by the first MASQUE connection carries a marking information indicating that the service packet is the last service packet in the first service flow, and detection that another service packet transmitted by the first MASQUE connection carries a marking information indicating that the service packet is the last service packet in the second service flow. After releasing the first MASQUE connection, the user plane network element can also delete the second mapping information and the fourth mapping information described above.

[0159] The embodiment of FIG. 3 is specifically described below in combination with the accompanying drawings. The embodiment of FIG. 4 and the embodiment of FIG. 5 are both specific examples of the embodiment of FIG. 3. In the following embodiments, it is taken as an example that the application function network element is AF and the user plane network element is UPF.

[0160] FIG. 4 is a flowchart of a communication method provided by an embodiment of the present application. In this embodiment, multiple service flows cannot be established on the MASQUE connection of the AF.

[0161] The method comprises the following steps:

[0162] Step 401, the AF sends identity information of the AF to the NEF. Correspondingly, the NEF receives the identity information of the AF.

[0163] The identity information of the AF comprises at least one address information of the AF supporting the MASQUE connection, and each address information of the MASQUE connection can be used to establish one or more MASQUE connections. For example, the identity information of the AF comprises address information #1 supporting the MASQUE connection, address information #2 supporting the MASQUE connection, and address information #3 supporting the MASQUE connection, then the AF can establish one or more MASQUE connections through each of the three address information.

[0164] Exemplarily, the address information supporting the MASQUE connection comprises one or more of the following information:

[0165] 1) IP address of the AF.

[0166] 2) Port number of the AF.

[0167] 3) FQDN of the AF.

[0168] For example, the address information supporting the MASQUE connection comprises the IP address, or comprises the IP address and the port number, or comprises the IP address, the port number and the FQDN, or comprises the IP and the FQDN, or comprises the FQDN.

[0169] Optionally, in this step, the AF further sends first indication information to the NEF, and the first indication information is used to indicate that the MASQUE connection on the AF does not support establishment of multiple service flows. Wherein, the MASQUE connection on the AF does not support establishment of multiple service flows means that one MASQUE connection only supports establishment of one service flow.

[0170] Step 402, the terminal sends a PDU session establishment request to the AMF. Correspondingly, the AMF receives the PDU session establishment request.

[0171] After the AMF receives the PDU session establishment request from the terminal, the AMF can select an SMF, and then the SMF can obtain subscription information of the terminal from a UDM.

[0172] In step 403, the NEF sends the identity information of the AF to the PCF. Accordingly, the PCF receives the identity information of the AF.

[0173] In a possible implementation, if the NEF also receives the first indication information from the AF, the NEF can also send the first indication information to the PCF in step 403.

[0174] It should be understood that the present embodiment does not limit the order of steps 402 and 403, and step 403 can occur before step 402, after step 402, or at the same time as step 402.

[0175] Exemplarily, the NEF sends the identity information of the AF to the PCF through an Npcf_PolicyAuthorization service.

[0176] In step 404, the PCF sends the identity information of the AF to the SMF. Accordingly, the SMF receives the identity information of the AF.

[0177] In the PDU session establishment process, the SMF can request policy and charging control (PCC) rule information from the PCF, and the PCF can carry the identity information of the AF in the PCC rule information and send the PCC rule information to the SMF through a Session Management (SM) policy control service (Npcf_SMPolicyControl service) message.

[0178] In a possible implementation, if the PCF also receives the first indication information from the NEF, the PCF can also carry the first indication information and the identity information of the AF in the PCC rule information and send the PCC rule information to the SMF.

[0179] Exemplarily, the PCF sends the identity information of the AF to the SMF through an Npcf_SMPolicyControl service.

[0180] In step 405, the SMF selects a UPF.

[0181] The SMF selects a UPF that supports the MASQUE function. The UPF supporting the MASQUE function means that the UPF supports establishing an MSAQUE connection.

[0182] At step 406, the SMF sends the identity information of the AF to the UPF. Accordingly, the UPF receives the identity information of the AF.

[0183] For example, after the SMF selects the UPF, the SMF can establish an N4 session connection with the UPF. The SMF sends the identity information of the AF to the UPF through the N4 interface (e.g., through a session establishment / modification message transmitted by the N4), and the UPF can save the identity information of the AF.

[0184] In a possible implementation, if the SMF also receives the first indication information from the PCF, the SMF can also carry the first indication information and the identity information of the AF in the PCC rule information and send them to the UPF, and the UPF can save the first indication information and the identity information of the AF.

[0185] It should be noted that the above steps 401 to 406 can be performed multiple times, and the UPF obtains the identity information of different AFs. For example, the UPF obtains the identity information of AF#1, the identity information of AF#2, the identity information of AF#3, and the identity information of AF#4. For another example, the UPF obtains the identity information of AF#1, the identity information of AF#2, the identity information of AF#3, and the identity information of AF#4, and also obtains the first indication information corresponding to AF#1, the first indication information corresponding to AF#2, the first indication information corresponding to AF#3, and the first indication information corresponding to AF#4.

[0186] At step 407, the terminal establishes a user plane connection with the UPF.

[0187] For example, after the SMF establishes an N4 session connection with the UPF, the SMF can perform N1N2 message transfer with the AMF. The N1N2 message carries a PDU session identifier (PDU Session ID), a PDU session establishment acceptance (PDU Session Establishment Accept) message, etc. The AMF can send the PDU session establishment acceptance message to the terminal through an access network device. After receiving the PDU session establishment acceptance message, the terminal completes the establishment of the user plane connection with the UPF.

[0188] At step 408, the terminal sends a first service request to the UPF. Accordingly, the UPF receives the first service request.

[0189] The first service request is also referred to as a first UDP packet transmission request.

[0190] The first service request includes address information of the AF. The address information of the AF can include one or more of an IP address of the AF, a port number of the AF, or an FQDN of the AF. For example, the first service request includes the IP address of the AF, or includes the IP address of the AF and the port number of the AF, or includes the IP address of the AF, the port number of the AF, and the FQDN of the AF, or includes the IP address of the AF and the FQDN of the AF, or includes the FQDN of the AF.

[0191] As an implementation method, the first service request includes tuple information corresponding to the first service, and the tuple information includes the address information of the AF.

[0192] The tuple information can be four-tuple information, which includes a source IP address (i.e., an IP address of the terminal), a source port number (i.e., a port number of the terminal), a target IP address (i.e., an IP address of the AF), and a target port number (i.e., a port number of the AF). The target IP address constitutes the address information of the AF, or the target IP address and the target port number constitute the address information of the AF.

[0193] For example, the tuple information can also be five-tuple information, which includes a source IP address (i.e., an IP address of the terminal), a source port number (i.e., a port number of the terminal), a target IP address (i.e., an IP address of the AF), a target port number (i.e., a port number of the AF), and a protocol type (i.e., a QUIC protocol). The target IP address constitutes the address information of the AF, or the target IP address and the target port number constitute the address information of the AF.

[0194] For example, when the terminal has a transmission requirement for the first service, the terminal can establish a QUIC connection with the UPF, and in the process of establishing the QUIC connection, or after the QUIC connection is established, the terminal sends the first service request to the UPF.

[0195] In step 409, the UPF determines to establish a first MASQUE connection between the UPF and the AF according to the address information of the AF corresponding to the first service request and the identity information of the AF.

[0196] When the identity information of the AF includes the address information of the AF corresponding to the first service request, it is determined to establish the first MASQUE connection between the UPF and the AF.

[0197] For example, the UPF receives and saves the identity information of AF#1, the identity information of AF#2, and the identity information of AF#3, and the first service request includes the address information #1 of AF#1. If the UPF determines that the address information #1 of AF#1 is included in the identity information of AF#1, it is determined to establish the first MASQUE connection between the UPF and AF#1 based on the address information #1 of AF#1.

[0198] At step 410, the UPF establishes a first MASQUE connection between the UPF and the AF corresponding to the first service request based on the address information of the AF corresponding to the first service request.

[0199] The first MASQUE connection can be used to transmit service packets of the first service flow.

[0200] After the first MASQUE connection is established, the UPF can determine first mapping information, which is used to indicate a mapping relationship between the tuple information corresponding to the first service request and the first MASQUE connection, or the first mapping information is used to indicate a mapping relationship between the tuple information corresponding to the first service request, the address information of the AF corresponding to the first service request, and the first MASQUE connection. Optionally, the first mapping information also indicates a state of the first MASQUE connection. The first mapping information is used to forward service packets corresponding to the first service request transmitted between the terminal and the AF corresponding to the first service request. The meaning of the tuple information corresponding to the first service request can be referred to the foregoing description, and will not be described herein. Subsequently, when the UPF receives service packets of the first service flow corresponding to the first service request from the AF corresponding to the first service request through the first MASQUE connection, the UPF can send the service packets of the first service flow corresponding to the first service request to the terminal according to the first mapping information. For examples of the first mapping information, refer to Table 2 described above.

[0201] At step 411, the terminal sends a second service request to the UPF. Correspondingly, the UPF receives the second service request.

[0202] The second service request is also referred to as a second UDP packet transmission request.

[0203] The second service request includes address information of the AF. The address information of the AF can include one or more of an IP address of the AF, a port number of the AF, or an FQDN of the AF. For example, the first service request includes the IP address of the AF, or includes the IP address of the AF and the port number of the AF, or includes the IP address of the AF, the port number of the AF, and the FQDN of the AF, or includes the IP address of the AF and the FQDN of the AF, or includes the FQDN of the AF.

[0204] The address information of the AF in the second service request is the same as the address information of the AF in the first service request.

[0205] As an implementation method, the second service request includes tuple information corresponding to the second service, and the tuple information includes the address information of the AF.

[0206] The tuple information can be four-tuple information, which includes a source IP address (i.e., an IP address of the terminal), a source port number (i.e., a port number of the terminal), a target IP address (i.e., an IP address of the AF), and a target port number (i.e., a port number of the AF). The target IP address constitutes the address information of the AF, or the target IP address and the target port number constitute the address information of the AF.

[0207] Exemplarily, the tuple information can also be five-tuple information, which includes a source IP address (i.e., an IP address of the terminal), a source port number (i.e., a port number of the terminal), a target IP address (i.e., an IP address of the AF), a target port number (i.e., a port number of the AF), and a protocol type (i.e., the QUIC protocol). The target IP address constitutes the address information of the AF, or the target IP address and the target port number constitute the address information of the AF.

[0208] Exemplarily, when the terminal has a transmission requirement of the second service, the above-mentioned second service request is sent to the UPF.

[0209] It should be noted that if the first service request and the second service request both carry four-tuple information, the four-tuple information in the first service request is not completely the same as the four-tuple information in the second service request, for example, the source IP address (i.e., the IP address of the terminal) of the four-tuple information in the first service request is not the same as the source IP address (i.e., the IP address of the terminal) of the four-tuple information in the second service request, and / or the source port number (i.e., the port number of the terminal) of the four-tuple information in the first service request is not the same as the source port number (i.e., the port number of the terminal) of the four-tuple information in the second service request.

[0210] If the first service request and the second service request both carry five-tuple information, the five-tuple information in the first service request is not completely the same as the five-tuple information in the second service request, for example, the source IP address (i.e., the IP address of the terminal) of the five-tuple information in the first service request is not the same as the source IP address (i.e., the IP address of the terminal) of the five-tuple information in the second service request, and / or the source port number (i.e., the port number of the terminal) of the five-tuple information in the first service request is not the same as the source port number (i.e., the port number of the terminal) of the five-tuple information in the second service request.

[0211] In step 412, the UPF determines to establish a second MASQUE connection between the UPF and the AF according to the address information of the AF corresponding to the second service request and the identity information of the AF.

[0212] The address information of the AF corresponding to the second service request is the same as the address information of the AF corresponding to the first service request.

[0213] Since the address information of the AF corresponding to the second service request is the same as the address information of the AF corresponding to the first service request, the UPF determines that the obtained identity information of the AF contains the address information of the AF corresponding to the second service request, so that the UPF determines to establish the second MASQUE connection between the UPF and the AF.

[0214] For example, the UPF receives and stores the identity information of AF#1, the identity information of AF#2, and the identity information of AF#3, the second service request contains the address information #1 of AF#1, and if the UPF determines that the identity information of AF#1 contains the address information #1 of AF#1, the UPF determines to establish the second MASQUE connection between the UPF and AF#1 based on the address information #1 of AF#1.

[0215] In the method, although the address information of the AF corresponding to the second service request is the same as the address information of the AF corresponding to the first service request, and the first MASQUE connection has been established based on the address information of the AF corresponding to the first service request, since the first MASQUE connection does not support multiple service flows (for example, it is indicated by the first indication information or it is defaulted that the MASQUE connection of the AF does not support establishment of multiple service flows), the UPF still needs to establish a new MASQUE connection (that is, the second MASQUE connection) based on the address information of the AF corresponding to the second service request, and the second MASQUE connection can be used to transmit service packets of the second service flow.

[0216] In step 413, the UPF establishes the second MASQUE connection between the UPF and the AF corresponding to the second service request based on the address information of the AF corresponding to the second service request.

[0217] The second MASQUE connection can be used to transmit service packets of the second service flow.

[0218] After the second MASQUE connection is established, the UPF can determine third mapping information, which indicates a mapping relationship between the tuple information corresponding to the second service request and the second MASQUE connection, or indicates a mapping relationship between the tuple information corresponding to the second service request, address information of the AF corresponding to the second service request, and the second MASQUE connection. Optionally, the third mapping information also indicates a state of the second MASQUE connection. The third mapping information is used to forward service packets corresponding to the second service request transmitted between the terminal and the AF corresponding to the second service request. The meaning of the tuple information corresponding to the second service request is similar to that of the tuple information corresponding to the first service request, and reference can be made to the foregoing description, which will not be repeated. Subsequently, when the UPF receives service packets of the second service stream from the AF corresponding to the second service request through the second MASQUE connection, the UPF can send the service packets of the second service stream corresponding to the second service request to the terminal according to the third mapping information. For examples of the third mapping information, reference can be made to Table 3.

[0219] In step 414, the UPF forwards service packets transmitted between the terminal and the AF according to the first mapping information and the third mapping information.

[0220] When the UPF receives service packets of the first service stream from the AF through the first MASQUE connection, the packet header of the service packets carries an identifier of the first MASQUE connection, the UPF determines corresponding four-tuple information or five-tuple information according to the identifier of the first MASQUE connection and the first mapping information, and forwards the service packets to the terminal based on the four-tuple information or the five-tuple information.

[0221] When the UPF receives service packets of the second service stream from the AF through the second MASQUE connection, the packet header of the service packets carries an identifier of the second MASQUE connection, the UPF determines corresponding four-tuple information or five-tuple information according to the identifier of the second MASQUE connection and the third mapping information, and forwards the service packets to the terminal based on the four-tuple information or the five-tuple information.

[0222] Optionally, the UPF or the AF can also release the first MASQUE connection and / or the second MASQUE connection. For example, if the UPF or the AF detects that the first MASQUE connection does not transmit service packets, the UPF or the AF can release the first MASQUE connection. This method can save resource overhead of the UPF and the AF. Wherein, detecting that the first MASQUE connection does not transmit service packets may, for example, be: detecting that the first MASQUE connection does not transmit service packets within a set time length, or detecting that a service packet transmitted on the first MASQUE connection carries a marking information indicating that the service packet is the last service packet in the first service flow. After releasing the first MASQUE connection, the UPF can also delete the first mapping information described above. For another example, if the UPF or the AF detects that the second MASQUE connection does not transmit service packets, the UPF or the AF can release the second MASQUE connection. This method can save resource overhead of the UPF and the AF. Wherein, detecting that the second MASQUE connection does not transmit service packets may, for example, be: detecting that the second MASQUE connection does not transmit service packets within a set time length, or detecting that a service packet transmitted on the second MASQUE connection carries a marking information indicating that the service packet is the last service packet in the second service flow. After releasing the second MASQUE connection, the UPF can also delete the third mapping information described above.

[0223] Based on the above scheme, the UPF can pre-acquire the identity information of each AF in the at least one AF, and subsequently, based on the identity information of each AF in the at least one AF and the address information of the AF carried in the service request, judge whether the MASQUE connection with the AF can be established. Therefore, this scheme realizes on-demand establishment of the MASQUE connection, and transmits service packets through the established MASQUE connection, instead of establishing and maintaining the MASQUE connection in advance before receiving the service request, which can reduce resource overhead of the UPF, and can avoid the MASQUE connection being exposed for a long time and being attacked, thereby improving the security of the MASQUE connection. Moreover, in this scheme, only one service flow is supported for each MASQUE connection, which can guarantee the transmission quality and latency of the service flow, and is beneficial to improving the service experience.

[0224] FIG. 5 is a flow diagram of a communication method provided by an embodiment of the present application. In this embodiment, the MASQUE connection of the AF supports establishment of multiple service flows.

[0225] The method comprises the following steps:

[0226] In step 501, the AF sends the identity information of the AF to the NEF. Correspondingly, the NEF receives the identity information of the AF.

[0227] The identity information of the AF includes at least one address information of the AF supporting the MASQUE connection, and each address information of the MASQUE connection can be used to establish one or more MASQUE connections. For example, the identity information of the AF includes address information #1 supporting the MASQUE connection, address information #2 supporting the MASQUE connection, and address information #3 supporting the MASQUE connection, and then the AF can establish one or more MASQUE connections through each of the three address information.

[0228] Exemplarily, the address information supporting the MASQUE connection includes one or more of the following information:

[0229] 1) IP address of the AF.

[0230] 2) Port number of the AF.

[0231] 3) FQDN of the AF.

[0232] For example, the address information supporting the MASQUE connection includes the IP address, or includes the IP address and the port number, or includes the IP address, the port number and the FQDN, or includes the IP and the FQDN, or includes the FQDN.

[0233] Optionally, in this step, the AF also sends second indication information to the NEF, and the second indication information is used to indicate that the MASQUE connection on the AF supports establishment of multiple service flows.

[0234] In another implementation method, if the AF does not send the second indication information, it is defaulted that the MASQUE connection on the AF supports establishment of multiple service flows.

[0235] Step 502, the terminal sends a PDU session establishment request to the AMF. Correspondingly, the AMF receives the PDU session establishment request.

[0236] After receiving the PDU session establishment request from the terminal, the AMF can select the SMF, and then the SMF can obtain the subscription information of the terminal from the UDM.

[0237] Step 503, the NEF sends the identity information of the AF to the PCF. Correspondingly, the PCF receives the identity information of the AF.

[0238] In a possible implementation, if the NEF also receives the second indication information from the AF, the NEF can also send the second indication information to the PCF in this step 503.

[0239] It needs to be understood that the embodiments of the present application do not make a prior limitation on the sequence of steps 502 and 503, step 503 can occur before step 502, or after step 502, or simultaneously with step 502.

[0240] Exemplarily, the NEF sends the identity information of the AF to the PCF through the Npcf_PolicyAuthorization service.

[0241] In step 504, the PCF sends the identity information of the AF to the SMF. Correspondingly, the SMF receives the identity information of the AF.

[0242] In the PDU session establishment process, the SMF can request the PCF for PCC rule information, and the PCF can carry the identity information of the AF in the PCC rule information and send it to the SMF through the Npcf_SMPolicyControl service message, etc.

[0243] In a possible implementation, if the PCF also receives second indication information from the NEF, the PCF can also carry the second indication information and the identity information of the AF in the PCC rule information and send them to the SMF.

[0244] Exemplarily, the PCF sends the identity information of the AF to the SMF through the Npcf_SMPolicyControl service.

[0245] In step 505, the SMF selects a UPF.

[0246] The SMF selects a UPF supporting the MASQUE function. Wherein, the UPF supporting the MASQUE function means that the UPF supports establishing the MSAQUE connection.

[0247] In step 506, the SMF sends the identity information of the AF to the UPF. Correspondingly, the UPF receives the identity information of the AF.

[0248] Exemplarily, after the SMF selects the UPF, the SMF can establish an N4 session connection with the UPF, and the SMF sends the identity information of the AF to the UPF through the N4 interface (such as a session establishment / modification message transmitted through N4), and the UPF can save the identity information of the AF.

[0249] In a possible implementation, if the SMF also receives second indication information from the PCF, the SMF can also carry the second indication information and the identity information of the AF in the PCC rule information and send them to the UPF, and the UPF can save the second indication information and the identity information of the AF.

[0250] It should be noted that the above steps 501 to 506 can be executed multiple times, and the UPF obtains the identity information of different AFs. For example, the UPF obtains the identity information of AF#1, the identity information of AF#2, the identity information of AF#3, and the identity information of AF#4. For another example, the UPF obtains the identity information of AF#1, the identity information of AF#2, the identity information of AF#3, and the identity information of AF#4, and also obtains the second indication information corresponding to AF#1, the second indication information corresponding to AF#2, the second indication information corresponding to AF#3, and the second indication information corresponding to AF#4.

[0251] Step 507, the terminal establishes a user plane connection with the UPF.

[0252] Exemplarily, after the SMF establishes the N4 session connection with the UPF, the SMF can perform N1N2 message transmission with the AMF, the N1N2 message carrying a PDU session identifier, a PDU session establishment acceptance message, etc. The AMF can send the PDU session establishment acceptance message to the terminal through the access network device. After receiving the PDU session establishment acceptance message, the terminal completes the establishment of the user plane connection with the UPF.

[0253] Step 508, the terminal sends a first service request to the UPF. Correspondingly, the UPF receives the first service request.

[0254] The first service request is also referred to as a first UDP message transmission request.

[0255] The first service request includes address information of the AF. The address information of the AF can include one or more of an IP address of the AF, a port number of the AF, or an FQDN of the AF. For example, the first service request includes the IP address of the AF, or includes the IP address of the AF and the port number of the AF, or includes the IP address of the AF, the port number of the AF, and the FQDN of the AF, or includes the IP address of the AF and the FQDN of the AF, or includes the FQDN of the AF.

[0256] As an implementation method, the first service request includes tuple information corresponding to the first service, and the tuple information includes the address information of the AF.

[0257] The tuple information can be four-tuple information, and the four-tuple information includes a source IP address (i.e., an IP address of the terminal), a source port number (i.e., a port number of the terminal), a target IP address (i.e., an IP address of the AF), and a target port number (i.e., a port number of the AF). The target IP address constitutes the address information of the AF, or the target IP address and the target port number constitute the address information of the AF.

[0258] Exemplarily, the tuple information can also be five-tuple information, which includes a source IP address (i.e., an IP address of the terminal), a source port number (i.e., a port number of the terminal), a target IP address (i.e., an IP address of the AF), a target port number (i.e., a port number of the AF), and a protocol type (i.e., the QUIC protocol). Among them, the target IP address constitutes the address information of the AF, or the target IP address and the target port number constitute the address information of the AF.

[0259] Exemplarily, when the terminal has a transmission requirement of the first service, the terminal can establish a QUIC connection with the UPF, and send the first service request to the UPF in the process of establishing the QUIC connection or after the QUIC connection is established.

[0260] In step 509, the UPF determines to establish a first MASQUE connection between the UPF and the AF according to the address information of the AF corresponding to the first service request and the identity information of the AF.

[0261] When the identity information of the AF includes the address information of the AF corresponding to the first service request, it is determined to establish the first MASQUE connection between the UPF and the AF.

[0262] For example, the UPF receives and saves the identity information of AF#1, the identity information of AF#2, and the identity information of AF#3, and the first service request includes the address information #1 of AF#1. If the UPF determines that the identity information of AF#1 includes the address information #1 of AF#1, it is determined to establish the first MASQUE connection between the UPF and AF#1 based on the address information #1 of AF#1.

[0263] In step 510, the UPF establishes a first MASQUE connection between the UPF and the AF corresponding to the first service request based on the address information of the AF corresponding to the first service request.

[0264] The first MASQUE connection can be used to transmit service packets of the first service flow.

[0265] After the first MASQUE connection is established, the UPF can determine second mapping information indicating a mapping relationship between the tuple information corresponding to the first service request and the first service flow, or indicating a mapping relationship between the tuple information corresponding to the first service request, address information of the AF corresponding to the first service request, and the first service flow. Optionally, the second mapping information also indicates a state of the first MASQUE connection. The second mapping information is used to forward service packets of the first service flow corresponding to the first service request transmitted between the terminal and the AF corresponding to the first service request. The meaning of the tuple information corresponding to the first service request can be referred to the foregoing description, and will not be described herein again. Subsequently, when the UPF receives service packets of the first service flow corresponding to the first service request from the AF corresponding to the first service request through the first MASQUE connection, the UPF can send the service packets of the first service flow corresponding to the first service request to the terminal according to the first mapping information. For examples of the first mapping information, reference can be made to Table 4.

[0266] At step 511, the terminal sends a second service request to the UPF. Correspondingly, the UPF receives the second service request.

[0267] The second service request is also referred to as a second UDP packet transmission request.

[0268] The second service request includes address information of the AF. The address information of the AF can include one or more of an IP address of the AF, a port number of the AF, or an FQDN of the AF. For example, the first service request includes the IP address of the AF, or includes the IP address of the AF and the port number of the AF, or includes the IP address of the AF, the port number of the AF, and the FQDN of the AF, or includes the IP address of the AF and the FQDN of the AF, or includes the FQDN of the AF.

[0269] The address information of the AF in the second service request is the same as the address information of the AF in the first service request.

[0270] As an implementation method, the second service request includes tuple information corresponding to the second service, and the tuple information includes the address information of the AF.

[0271] The tuple information can be four-tuple information, and the four-tuple information includes a source IP address (i.e., an IP address of the terminal), a source port number (i.e., a port number of the terminal), a target IP address (i.e., an IP address of the AF), and a target port number (i.e., a port number of the AF). The target IP address constitutes the address information of the AF, or the target IP address and the target port number constitute the address information of the AF.

[0272] Exemplarily, the tuple information can also be five-tuple information, which includes a source IP address (i.e., an IP address of the terminal), a source port number (i.e., a port number of the terminal), a target IP address (i.e., an IP address of the AF), a target port number (i.e., a port number of the AF), and a protocol type (i.e., the QUIC protocol). The target IP address constitutes the address information of the AF, or the target IP address and the target port number constitute the address information of the AF.

[0273] Exemplarily, when the terminal has a transmission requirement of the second service, the above-mentioned second service request is sent to the UPF.

[0274] It should be noted that if the first service request and the second service request both carry four-tuple information, the four-tuple information in the first service request is not completely the same as the four-tuple information in the second service request, for example, the source IP address (i.e., the IP address of the terminal) of the four-tuple information in the first service request is not the same as the source IP address (i.e., the IP address of the terminal) of the four-tuple information in the second service request, and / or the source port number (i.e., the port number of the terminal) of the four-tuple information in the first service request is not the same as the source port number (i.e., the port number of the terminal) of the four-tuple information in the second service request.

[0275] If the first service request and the second service request both carry five-tuple information, the five-tuple information in the first service request is not completely the same as the five-tuple information in the second service request, for example, the source IP address (i.e., the IP address of the terminal) of the five-tuple information in the first service request is not the same as the source IP address (i.e., the IP address of the terminal) of the five-tuple information in the second service request, and / or the source port number (i.e., the port number of the terminal) of the five-tuple information in the first service request is not the same as the source port number (i.e., the port number of the terminal) of the five-tuple information in the second service request.

[0276] In step 512, the UPF determines to establish the second service flow on the first MASQUE connection according to the address information of the AF corresponding to the second service request and the identity information of the AF.

[0277] The address information of the AF corresponding to the second service request is the same as the address information of the AF corresponding to the first service request.

[0278] Since the address information of the AF corresponding to the second service request is the same as the address information of the AF corresponding to the first service request, the UPF determines that the identity information of the AF obtained contains the address information of the AF corresponding to the second service request, so that the UPF determines to establish the second service flow on the first MASQUE connection.

[0279] For example, the UPF receives and stores the identity information of AF#1, the identity information of AF#2, and the identity information of AF#3, and the second service request contains the address information #1 of AF#1. If the UPF determines that the address information #1 of AF#1 is included in the identity information of AF#1, it is determined that the second service flow is established on the first MASQUE connection.

[0280] In the method, since the address information of the AF corresponding to the second service request is the same as the address information of the AF corresponding to the first service request, and the first MASQUE connection has been established based on the address information of the AF corresponding to the first service request, and the first MASQUE connection supports the establishment of multiple service flows (for example, indicated by the second indication information or by default that the MASQUE connection of the AF supports the establishment of multiple service flows), the UPF can not need to establish a new MASQUE connection based on the address information of the AF corresponding to the second service request, but reuse the first MASQUE connection to establish the second service flow corresponding to the second service request on the first MASQUE connection, that is, the first MASQUE can be used to transmit the first service flow and the second service flow.

[0281] In step 513, the UPF establishes the second service flow on the first MASQUE connection.

[0282] After the second service flow is established on the first MASQUE connection, the UPF can determine fourth mapping information, which is used to indicate the mapping relationship between the tuple information corresponding to the second service request and the second service flow, or the fourth mapping information is used to indicate the mapping relationship between the tuple information corresponding to the second service request, the address information of the AF corresponding to the second service request, and the second service flow. Optionally, the fourth mapping information also indicates the state of the first MASQUE connection. The fourth mapping information is used to forward the service packets of the second service flow corresponding to the second service request transmitted between the terminal and the AF corresponding to the second service request. The meaning of the tuple information corresponding to the second service request is similar to that of the tuple information corresponding to the first service request, which can be referred to the foregoing description and will not be described here. Subsequently, when the UPF receives the service packets of the second service flow from the AF corresponding to the second service request through the first MASQUE connection, it can send the service packets of the second service flow corresponding to the second service request to the terminal according to the fourth mapping information. For examples of the fourth mapping information, refer to Table 5 described above.

[0283] In step 514, the UPF forwards the service packets transmitted between the terminal and the AF according to the second mapping information and the fourth mapping information.

[0284] When the UPF receives a service packet of the first service flow from the AF through the first MASQUE connection, the packet header of the service packet carries the identity of the first MASQUE connection and the identity of the first service flow, the UPF determines the corresponding four-tuple information or five-tuple information according to the identity of the first MASQUE connection, the identity of the first service flow, and the second mapping information, and forwards the service packet to the terminal based on the four-tuple information or the five-tuple information.

[0285] When the UPF receives a service packet of the second service flow from the AF through the first MASQUE connection, the packet header of the service packet carries the identity of the first MASQUE connection and the identity of the second service flow, the UPF determines the corresponding four-tuple information or five-tuple information according to the identity of the first MASQUE connection, the identity of the second service flow, and the fourth mapping information, and forwards the service packet to the terminal based on the four-tuple information or the five-tuple information.

[0286] Optionally, the UPF or the AF can also release the first MASQUE connection. For example, if the UPF or the AF detects that the first MASQUE connection does not transmit service packets, the UPF or the AF can release the first MASQUE connection. This method can save resource overhead of the UPF and the AF. Wherein, detecting that the first MASQUE connection does not transmit service packets may be, for example, detecting that the first MASQUE connection does not transmit service packets within a set time period, or may also be detecting that a service packet transmitted by the first MASQUE connection carries a marking information indicating that the service packet is the last service packet in the first service flow, and detecting that another service packet transmitted by the first MASQUE connection carries a marking information indicating that the service packet is the last service packet in the second service flow. After releasing the first MASQUE connection, the UPF can also delete the second mapping information and the fourth mapping information mentioned above.

[0287] Based on the above scheme, the UPF can pre-acquire the identity information of each AF in the at least one AF, and subsequently, based on the identity information of each AF in the at least one AF and the address information of the AF carried in the service request, determine whether the MASQUE connection with the AF can be established when receiving the service request. Therefore, this scheme realizes on-demand establishment of the MASQUE connection, and transmits service packets through the established MASQUE connection, rather than establishing and maintaining the MASQUE connection in advance before receiving the service request, which can reduce the resource overhead of the UPF, and can avoid the MASQUE connection being exposed for a long time and being attacked, thereby improving the security of the MASQUE connection. In addition, this scheme supports establishment of multiple service flows for each MASQUE connection, which can improve resource utilization and save resources.

[0288] FIG. 6 shows a possible exemplary block diagram of a communication apparatus involved in the embodiments of the present application. The communication apparatus 600 shown in FIG. 6 can include modules or units for implementing the above-mentioned method embodiments. In one possible design, the communication apparatus 600 includes a processing unit 602 and a communication unit 603. Optionally, the communication apparatus 600 can further include a storage unit 601 for storing apparatus program code and / or data.

[0289] The communication apparatus 600 can also be a network-side apparatus in the above-mentioned embodiments, for example, a network-side user plane network element, a module (such as a circuit, a chip or a chip system, etc.) in the user plane network element, or a logic node, a logic module or software capable of implementing all or part of the functions of the user plane network element.

[0290] For example, in one embodiment, the processing unit 602 is configured to obtain identity information of each application function network element in at least one application function network element, wherein the identity information of each application function network element includes at least one address information supporting MASQUE connection; the communication unit 603 is configured to receive a first service request from a first terminal, wherein the first service request includes address information of an application function network element corresponding to the first service request; and the processing unit 602 is further configured to, in a case where the at least one address information supporting MASQUE connection includes the address information of the application function network element corresponding to the first service request, establish a first MASQUE connection between the application function network element corresponding to the first service request based on the address information of the application function network element corresponding to the first service request, wherein the first MASQUE connection is used to transmit service packets corresponding to the first service request.

[0291] In one possible implementation method, the address information supporting MASQUE connection includes an IP address, or includes an IP address and a port number.

[0292] In one possible implementation method, after the first MASQUE connection between the application function network element corresponding to the first service request is established, the processing unit 602 is further configured to establish a first service flow for the first service request based on the first MASQUE connection, wherein the first service flow is used to transmit service packets corresponding to the first service request.

[0293] In one possible implementation method, the processing unit 602 is further configured to obtain first indication information, wherein the first indication information indicates that the first MASQUE connection does not support establishment of multiple service flows.

[0294] In a possible implementation, the communication unit 603 is further configured to receive a second service request from a second terminal, the second service request comprising address information of an application function network element corresponding to the second service request; and the processing unit 602 is further configured to, in a case where the address information of the application function network element corresponding to the second service request is the same as the address information of the application function network element corresponding to the first service request, establish a second MASQUE connection between the application function network element corresponding to the second service request based on the address information of the application function network element corresponding to the second service request and the first indication information, the second MASQUE connection being used to transmit service packets corresponding to the second service request; and establish a second service flow for the second service request based on the second MASQUE connection, the second service flow being used to transmit service packets corresponding to the second service request.

[0295] In a possible implementation, the first service request comprises tuple information corresponding to the first service, the tuple information comprising address information of an application function network element corresponding to the first service request; and the processing unit 602 is further configured to determine first mapping information, the first mapping information being used to indicate a mapping relationship between the tuple information corresponding to the first service request and the first MASQUE connection, or the first mapping information being used to indicate a mapping relationship between the tuple information corresponding to the first service request, the address information of the application function network element corresponding to the first service request and the first MASQUE connection; and the first mapping information is used to forward service packets corresponding to the first service request transmitted between the first terminal and the application function network element corresponding to the first service request.

[0296] In a possible implementation, the communication unit 603 is further configured to receive, through the first MASQUE connection, service packets corresponding to the first service request from the application function network element corresponding to the first service request; and transmit, according to the first mapping information, the service packets corresponding to the first service request to the first terminal.

[0297] In a possible implementation, the processing unit 602 is further configured to obtain second indication information, the second indication information indicating that the first MASQUE connection supports establishment of multiple service flows.

[0298] In a possible implementation, the communication unit 603 is further configured to receive a second service request from a second terminal, the second service request comprising address information of an application function network element corresponding to the second service request; and the processing unit 602 is further configured to, in a case where the address information of the application function network element corresponding to the second service request is the same as the address information of the application function network element corresponding to the first service request, establish a second service flow for the second service request based on the first MASQUE connection and the second indication information, the second service flow being used to transmit service packets corresponding to the second service request.

[0299] In a possible implementation, the first service request comprises tuple information corresponding to the first service, the tuple information comprising address information of an application function network element corresponding to the first service request; and the processing unit 602 is further configured to determine second mapping information, the second mapping information being used to indicate a mapping relationship between the tuple information corresponding to the first service request and the first service flow, or the second mapping information being used to indicate a mapping relationship between the tuple information corresponding to the first service request, the address information of the application function network element corresponding to the first service request, and the first service flow; and the second mapping information being used to forward service packets of the first service flow corresponding to the first service request transmitted between the first terminal and the application function network element corresponding to the first service request.

[0300] In a possible implementation, the communication unit 603 is further configured to receive, through the first MASQUE connection, service packets corresponding to the first service request from the application function network element corresponding to the first service request; and transmit, according to the second mapping information, service packets of the first service flow corresponding to the first service request to the first terminal.

[0301] In a possible implementation, the processing unit 602 is further configured to, in a case where no service packet is transmitted through the first MASQUE connection, release the first MASQUE connection.

[0302] The communication apparatus 600 can also be a network side device in the above-described embodiments, for example, an application function network element on a network side, a module (for example, a circuit, a chip, or a chip system, etc.) in the application function network element, or a logic node, a logic module, or software capable of implementing all or part of the functions of the application function network element.

[0303] For example, in one embodiment, the processing unit 602 is configured to obtain identity information of an application function network element, the identity information of the application function network element comprising at least one address information supporting a MASQUE connection; and the communication unit 603 is configured to transmit the identity information of the application function network element to a user plane network element.

[0304] In a possible implementation, the communication unit 603 is further configured to send, to the user plane network element, first indication information indicating that the MASQUE connection on the application function network element does not support establishment of multiple service flows.

[0305] In a possible implementation, the communication unit 603 is further configured to send, to the user plane network element, second indication information indicating that the MASQUE connection on the application function network element supports establishment of multiple service flows.

[0306] In a possible implementation, the address information supporting the MASQUE connection includes an IP address, or includes an IP address and a port number.

[0307] It can be understood that the division of the units in the above apparatus is merely a logical function division, one function unit can be used for one function, or two or more functions can be integrated in one function unit. In actual implementation, all or part of the units can be integrated into one physical entity, or can be distributed on different physical entities. In addition, the function units can be implemented in the form of hardware, or in the form of software, or in the form of combination of hardware and software. Whether a certain function is implemented in the form of hardware or software depends on the specific application and design constraints of the technical solution. Professional technicians can use different methods to implement the described functions for specific applications, but such implementation should not be considered as beyond the scope of the present application.

[0308] In one example, the function units in any of the above apparatuses can be one or more integrated circuits configured to implement the above methods, for example, one or more application specific integrated circuits (ASICs), or one or more central processing units (CPUs), one or more microcontroller Units (MCUs), one or more digital signal processors (DSPs), or one or more field programmable gate arrays (FPGAs), or a combination of at least two of the integrated circuit forms.

[0309] In one example, the storage unit 601 can include a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an electrically erasable programmable memory, and / or a register, etc.

[0310] FIG. 7 shows a possible exemplary block diagram of a communication device involved in the embodiments of the present application. The communication device 700 shown in FIG. 7 includes a processor 710 and an interface circuit 720. The processor 710 and the interface circuit 720 are coupled to each other. It can be understood that the interface circuit 720 can be a transceiver or an input / output interface. Optionally, the communication device 700 can further include a memory 730 for storing instructions executed by the processor 710 or storing input data required by the processor 710 to run instructions or storing data generated after the processor 710 runs instructions.

[0311] When the communication device 700 is used to implement the method embodiments described above, the processor 710 is configured to implement the functions of the processing unit 602 described above, and the interface circuit 720 is configured to implement the functions of the communication unit 603 described above.

[0312] It can be understood that the processor in the embodiments of the present application can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSPs), application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. The general-purpose processor can be a microprocessor or any conventional processor.

[0313] The method steps in the embodiments of the present application can be implemented by means of hardware, or by means of a processor executing software instructions. The software instructions can be composed of corresponding software modules, and the software modules can be stored in a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an erasable programmable read-only memory, an electrically erasable programmable read-only memory, a register, a hard disk, a mobile hard disk, a compact disc read-only memory (CD-ROM) or any other form of storage medium well known in the art. An exemplary storage medium is coupled to the processor, so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be an integral part of the processor. The processor and the storage medium can be located in an ASIC. In addition, the ASIC can be located in the first network element or the store-and-forward ground function network element. Of course, the processor and the storage medium can also exist as discrete components in the user plane network element or the application function network element.

[0314] In the above embodiments, all or part of the embodiments can be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments can be implemented in the form of a computer program product. The computer program product includes one or more computer programs or instructions. The computer program refers to a set of instructions for instructing an electronic computer or other devices with message processing capability to perform each step. The computer program is usually written in a certain programming language and runs on a certain target architecture. When the computer program or instructions are loaded and executed on the computer, all or part of the processes or functions described in the embodiments of the present application are performed. The computer can be a general-purpose computer, a special-purpose computer, a computer network or other programmable devices. The computer program or instructions can be stored in a computer readable storage medium or transferred from one computer readable storage medium to another computer readable storage medium, for example, the computer program or instructions can be transferred from one website, computer, server or data center to another website, computer, server or data center through wired or wireless mode. The computer readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center and the like integrated with one or more available media. The available medium can be a magnetic medium, such as a floppy disk, a hard disk, a magnetic tape; or an optical medium, such as a digital video disc; or a semiconductor medium, such as a solid state disk. The computer readable storage medium can be a volatile or non-volatile storage medium, or can include both volatile and non-volatile storage media.

[0315] In various embodiments of the present application, the terms and / or descriptions of different embodiments are consistent and can be referred to each other if there is no special description and logical conflict. The technical features in different embodiments can be combined to form new embodiments according to their inherent logical relationship.

[0316] In the present application, "at least one" means one or more, and "multiple" means two or more. "And / or" describes the association relationship between the associated objects, which means that there can be three kinds of relationships, for example, A and / or B, which can represent the following three cases: A exists alone, A and B exist together, and B exists alone, where A and B can be singular or plural. In the literal description of the present application, the character " / ", generally represents that the front and rear associated objects have an "or" relationship; in the formula of the present application, the character " / ", represents that the front and rear associated objects have a "division" relationship.

[0317] It can be understood that various numerical numbers involved in the embodiments of the present application are only distinguished for convenience of description, and are not used to limit the scope of the embodiments of the present application. The size of the serial numbers of the above processes does not mean the order of execution, and the execution order of the processes should be determined according to their functions and inherent logic.

[0318] The terms "system" and "network" in the embodiments of the present application can be used interchangeably. "At least one" means one or more, and "multiple" means two or more. "And / or" describes the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B, which can represent the cases of A alone, A and B together, and B alone, where A and B can be singular or plural. The character " / " generally represents an "or" relationship between the front and rear associated objects. "At least one of the following" or similar expressions means any combination of these items, including any combination of single item or multiple items. For example, "at least one of A, B or C" includes A, B, C, AB, AC, BC or ABC, and "at least one of A, B and C" can also be understood to include A, B, C, AB, AC, BC or ABC. In addition, unless otherwise specified, the ordinal numbers "first", "second" and the like mentioned in the embodiments of the present application are used to distinguish a plurality of objects, and are not used to limit the order, time sequence, priority or importance of the plurality of objects.

[0319] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system or a computer program product. Therefore, the present application can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer usable storage media (including but not limited to magnetic disk storage, optical storage, etc.) containing computer usable program code.

[0320] The present application is described with reference to flowcharts and / or block diagrams according to the methods, devices (systems) and computer program products of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for implementing the functions specified in one or more flows of the flowcharts and / or one or more blocks of the block diagrams.

[0321] These computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture including instructions which implement the function specified in the flowchart or flowsheets and / or block or blocks of the block diagrams.

[0322] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart or flowsheets and / or block or blocks of the block diagrams.

[0323] Obviously, numerous modifications and variations of the present application are possible in light of the above teachings. It is therefore to be understood that within the scope of the claims and their equivalents, the application can be practiced otherwise than as specifically described.

Claims

1. A communication method characterized by comprising: The method comprises: obtaining identity information of each application function network element in at least one application function network element, the identity information of each application function network element comprising at least one address information of a multiplexing application (MASQUE) connection supporting quick user datagram protocol (UDP) network connection encryption; receiving a first service request from a first terminal, the first service request comprising address information of an application function network element corresponding to the first service request; in a case where the at least one address information supporting the MASQUE connection comprises the address information of the application function network element corresponding to the first service request, establishing a first MASQUE connection between the application function network element corresponding to the first service request based on the address information of the application function network element corresponding to the first service request, the first MASQUE connection being used for transmitting service packets corresponding to the first service request.

2. The method of claim 1, wherein, The address information supporting the MASQUE connection comprises an Internet protocol (IP) address or comprises an IP address and a port number.

3. The method of claim 1 or 2, wherein, After the first MASQUE connection between the application function network element corresponding to the first service request is established, the method further comprises: establishing a first service flow for the first service request based on the first MASQUE connection, the first service flow being used for transmitting service packets corresponding to the first service request.

4. The method of claim 3, wherein, The method further comprises: obtaining first indication information, the first indication information indicating that the first MASQUE connection does not support establishment of multiple service flows.

5. The method of claim 4, wherein, The method further comprises: receiving a second service request from a second terminal, the second service request comprising address information of an application function network element corresponding to the second service request; in a case where the address information of the application function network element corresponding to the second service request is the same as the address information of the application function network element corresponding to the first service request, establishing a second MASQUE connection between the application function network element corresponding to the second service request based on the address information of the application function network element corresponding to the second service request and the first indication information, the second MASQUE connection being used for transmitting service packets corresponding to the second service request; establishing a second service flow for the second service request based on the second MASQUE connection, the second service flow being used for transmitting service packets corresponding to the second service request.

6. The method of any one of claims 1 to 5, wherein, The first service request comprises tuple information corresponding to the first service, the tuple information comprising the address information of the application function network element corresponding to the first service request. The method further comprises: determining first mapping information, the first mapping information being used for indicating a mapping relationship between the tuple information corresponding to the first service request and the first MASQUE connection, or the first mapping information being used for indicating a mapping relationship between the tuple information corresponding to the first service request, the address information of the application function network element corresponding to the first service request, and the first MASQUE connection; and the first mapping information being used for forwarding service packets corresponding to the first service request transmitted between the first terminal and the application function network element corresponding to the first service request.

7. The method of claim 6, wherein, The method further comprises: receiving, through the first MASQUE connection, a service packet corresponding to the first service request from an application function network element corresponding to the first service request; sending, to the first terminal, the service packet corresponding to the first service request according to the first mapping information.

8. The method of claim 3, wherein, The method further comprises: obtaining second indication information, the second indication information indicating that the first MASQUE connection supports establishment of multiple service flows.

9. The method of claim 8, wherein, The method further comprises: receiving a second service request from a second terminal, the second service request including address information of an application function network element corresponding to the second service request; in a case where the address information of the application function network element corresponding to the second service request is the same as the address information of the application function network element corresponding to the first service request, establishing, based on the first MASQUE connection and the second indication information, a second service flow for the second service request, the second service flow being used for transmission of a service packet corresponding to the second service request.

10. The method of any one of claims 3, 8, 9, wherein, The first service request includes tuple information corresponding to the first service, and the tuple information includes address information of an application function network element corresponding to the first service request. The method further comprises: determining second mapping information, the second mapping information being used for indicating a mapping relationship between the tuple information corresponding to the first service request and the first service flow, or the second mapping information being used for indicating a mapping relationship between the tuple information corresponding to the first service request, the address information of the application function network element corresponding to the first service request, and the first service flow; and the second mapping information being used for forwarding a service packet of the first service flow corresponding to the first service request transmitted between the first terminal and the application function network element corresponding to the first service request.

11. The method of claim 10, wherein, The method further comprises: receiving, through the first MASQUE connection, a service packet corresponding to the first service request from an application function network element corresponding to the first service request; sending, to the first terminal, the service packet of the first service flow corresponding to the first service request according to the second mapping information.

12. The method of any one of claims 1 to 11, wherein, The method further comprises: detecting that the first MASQUE connection has no service packet to be transmitted, and releasing the first MASQUE connection.

13. A method of communication, comprising: The method further comprises: obtaining identity information of an application function network element, the identity information of the application function network element including at least one address information of a multiplexing application (MASQUE) connection supporting fast Internet Protocol (IP) network connection encryption; sending, to a user plane network element, the identity information of the application function network element.

14. The method of claim 13, wherein, The method further comprises: sending, to the user plane network element, first indication information, the first indication information indicating that a MASQUE connection on the application function network element does not support establishment of multiple service flows.

15. The method of claim 13, wherein, The method further comprises: sending, to the user plane network element, second indication information, the second indication information indicating that the MASQUE connection on the application function network element supports establishment of multiple service flows.

16. The method of any one of claims 13 to 15, wherein, The address information of the MASQUE connection includes an IP address, or includes an IP address and a port number.

17. A communications device, characterized by comprising a module for performing the method of any one of claims 1 to 12, or a module for performing the method of any one of claims 13 to 16.

18. A computer program product, characterised in that, The computer program product comprises instructions which, when executed, implement the method of any one of claims 1 to 12, or implement the method of any one of claims 13 to 16.

19. A computer-readable storage medium, characterized in that, The storage medium stores a computer program or instructions which, when executed, implement the method of any one of claims 1 to 12, or implement the method of any one of claims 13 to 16.

20. A communication system, characterized by comprising a user plane network element for implementing the method of any one of claims 1 to 12, and an application function network element for implementing the method of any one of claims 13 to 16.

Images