Communication method and apparatus

Abstract

A communication method and apparatus. The communication method comprises: an access network device sending a first message to a first network element, wherein the first message comprises an NAS message; the first network element sending a second message to the access network device, wherein the second message is used for requesting the access network device to establish a connection with at least one NF; and the access network device sending a first request message to a first NF, wherein the first request message comprises a first identifier and identification information of a terminal device, and is used for requesting the establishment of a connection with the first NF, and the first identifier is a unique identifier allocated to the terminal device by the access network device. By means of the method, connections between an access network device and a plurality of NFs (or core network elements) can be established. Therefore, a terminal device can perform reliable and secure communication with the NFs by means of the access network device. Compared with the mode in which the interaction between the terminal device and the core network element is implemented by using an AMF as an anchor point, AMF congestion can be reduced, data isolation from the terminal device to each NF can be implemented, and the processing complexity can be reduced.

Description

Communication method and apparatus

[0001] Cross-reference to Related Applications

[0002] This application claims priority to the Chinese Patent Application No. 202411235138.X, filed on September 3, 2024, and entitled "A Communication Method and Apparatus", the content of which is incorporated herein by reference in its entirety. TECHNICAL FIELD

[0003] The present application relates to the field of communication technology, and in particular to a communication method and apparatus. BACKGROUND

[0004] Currently, when a terminal device communicates with a core network element, it needs to pass through an access and mobility management function (AMF). The AMF can be regarded as an anchor point of the core network. That is, if the terminal device needs to communicate with a core network element other than the AMF (for example, a session management function (SMF)), the terminal device first needs to establish a connection between the AMFs, and then forwards data between the terminal device and the SMF through the AMF.

[0005] For a future architecture based on (radio) access network (RAN) service, a terminal device can directly communicate with a core network element (including an AMF) without using the AMF as an anchor point, that is, without passing through the AMF. However, for the architecture based on RAN service, how to establish a connection between the terminal device and the core network element still needs further research. SUMMARY

[0006] Embodiments of the present application provide a communication method and apparatus, which provide a method for a terminal device to establish a connection with a core network element, to ensure the reliability and security of information transmission.

[0007] To achieve the above object, the embodiments of the present application adopt the following technical solutions:

[0008] In a first aspect, a communication method is provided, which can be applied to an access network side device (which can be referred to as an access network device for short). The access network device can be an access network equipment, a component (such as a circuit, a chip or a chip system, etc.) in the access network equipment; or the access network device can be a module or a unit that completes part or all functions of the access network equipment, for example, a central unit (CU), a distributed unit (DU) or a radio unit (RU). Alternatively, the access network device can be a logic node, a logic module or software that implements all or part of the functions of the access network equipment. For the convenience of description, the access network device is taken as an access network equipment in the following.

[0009] The method comprises: sending, by the access network equipment, a first message to a first network element, receiving a second message from the first network element, and sending a first request message to a first NF. The first network element can be a core network element, for example, the first network element is an AMF. The first message comprises a non-access stratum (NAS) message. The second message is used to request the access network equipment to establish a connection between at least one network function (NF). The second message comprises identification information of the at least one NF or type information of the at least one NF. The first request message comprises a first identification and identification information of a terminal device, and is used to request to establish a connection with the first NF. The first identification is a unique identification allocated by the access network equipment for the terminal device. The first NF belongs to the at least one NF.

[0010] In the method, the first message can be used to trigger the first network element to request the access network device to establish a connection between the terminal device and the at least one NF. Alternatively, the first message can be used to trigger the first network element to request the access network device to create a context with the at least one NF. If the first message received from the RAN includes a NAS message, the terminal device is considered to need to establish a connection with the core network element by the first network element. Therefore, the first network element triggers the access network device to establish a connection to the at least one NF based on the first message. The access network device establishes a connection with the at least one NF in response to the request of the first network element. For example, the access network device sends a first request message to the first NF to establish a connection with the first NF. By this method, the access network device can establish a connection with multiple NFs (or core network elements) other than the first network element, so that the terminal device can communicate with the NFs through the access network device. For example, the first network element is an AMF. Compared with the method of using the AMF as an anchor point to implement the interaction between the terminal device and the core network element, the method can reduce the congestion of the AMF, implement data isolation of the terminal device to each NF, and reduce the processing complexity. In addition, compared with using the AMF as an anchor point, the operator needs to maintain a set of protocols between the access network device and the AMF and a set of protocols between the AMF and other NFs. The operator only needs to maintain a set of protocols between the access network device and the NFs, and needs to maintain fewer protocols and has lower complexity.

[0011] In an implementation manner, the NAS message includes information of the NF, and the NAS message is used to request to establish a connection between the terminal device and the NF. The information of the NF includes type information of the NF or identification information of the NF.

[0012] By carrying the information of the NF in the NAS message, the first network element can be aware of the NF that the terminal device needs to establish a connection with, and then the first network element requests the access network device to establish a connection with the NF. By this solution, the NF that the access network device establishes a connection with can be the NF that the terminal device needs to establish a connection with as much as possible, so as to meet the connection requirement of the terminal device.

[0013] In an implementation manner, the first message further includes identification information of the terminal device and a first identifier.

[0014] The access network device informs the first network element of the identification information of the terminal device, so that the first network element can be aware of the terminal device that needs to establish a connection. The access network device informs the first network element of the first identifier, so that the first network element can maintain a connection with the access network device based on the first identifier. For example, the first network element can determine the terminal device that has established a connection based on the first identifier, and does not need to trigger network paging.

[0015] In an implementation, the method further includes: receiving, by the access network device, a first response message from the first NF, the first response message including the first identifier and a second identifier. The second identifier is a unique identifier allocated by the first NF for the terminal device. The first response message is used to indicate that the connection establishment between the first NF and the access network device is completed.

[0016] When the first NF completes the connection establishment with the access network device in response to the request of the access network device, the access network device can be explicitly informed by the first response message. In addition, the first response message can include the first identifier and the second identifier, so as to facilitate the access network device to maintain the correspondence between the terminal device and the NF according to the first identifier and the second identifier, and facilitate the access network device to determine a suitable NF to provide services for the terminal device.

[0017] In an implementation, the second message further includes the first identifier and a third identifier, the third identifier being a unique identifier allocated by the first network element for the terminal device.

[0018] In an implementation, the method further includes: receiving, by the access network device, a third message from the terminal device, and sending the third message to the first NF, the third message being used to indicate an identifier of the first NF or a type of the first NF.

[0019] The third message is a message that needs to be sent by the terminal device to the first NF, and the terminal device can forward the third message to the first NF through the access network device. In order to make the access network device clear the first NF, the third message also indicates the first NF, so as to avoid the access network device forwarding errors.

[0020] In a possible implementation, if the third message indicates the type of the first NF, before sending the third message to the first NF, the method further includes: determining the second identifier according to the identifier information of the terminal device and the information of the first NF, and determining the first NF according to the second identifier.

[0021] It is considered that the terminal device can not know which NFs to establish a connection with the access network device. In this case, the terminal device cannot explicitly send the third message to a specific NF. For the access network device, a suitable first NF can be selected for the terminal device according to the relationship between the identifier of the terminal device, the second identifier, the type information of the first NF and the identifier information of the first NF, so as to ensure that the service of the terminal device is carried out as much as possible.

[0022] In a second aspect, a communication method is provided, which can be applied to a core network side device (which can be referred to as a core network device for short). The core network device can be an AMF, a component (such as a circuit, a chip or a chip system, etc.) in the AMF, or a logic node, a logic module or software for completing part or all functions of the AMF. For the convenience of description, the core network device is taken as an example of a first network element in the following.

[0023] The method comprises: receiving, by the first network element, a first message, and sending, by the first network element, a second message to an access network device in response to the first message. The first message comprises a NAS message. The second message is used to request the access network device to establish a connection between the terminal device and at least one NF, and the second message comprises identification information of the at least one NF or type information of the at least one NF.

[0024] In an implementation manner, the NAS message comprises information of the NF, and the NAS message is used to request to establish a connection between the terminal device and the NF. The information of the NF comprises type information or identification information of the NF.

[0025] In an implementation manner, the first message further comprises identification information of the terminal device and a first identifier, and the first identifier is a unique identifier allocated by the access network device for the terminal device.

[0026] In an implementation manner, the second message further comprises the first identifier and / or a third identifier, and the third identifier is a unique identifier allocated by the first network element for the terminal device.

[0027] In an implementation manner, the method further comprises: sending, by the first network element, a fourth message to the terminal device, and the fourth message comprises the type information of the NF, and is used to indicate that the NF corresponding to the type information has established a connection with the terminal device. Alternatively,

[0028] In an implementation manner, the method further comprises: sending, by the first network element, a fourth message to the terminal device, and the fourth message comprises the identification information of the NF, and is used to indicate that the NF has established a connection with the terminal device.

[0029] In an implementation manner, before sending, by the first network element, the second message to the access network device in response to the first message, the method further comprises: sending, by the first network element, a security mode command message to the terminal device, and receiving a security mode complete message from the terminal device. The security mode command message comprises a key identifier and information of at least one NF, and is used to activate a security context of the terminal device to the at least one NF. The security mode complete message is used to indicate that a security mode control process is completed.

[0030] In the method, the first network element can activate the security context between the at least one NF and the terminal device, so that the creation of the security context in each NF can be completed. In this way, when the terminal device sends information to a certain NF, the information can be encrypted and integrity protected according to the security context between the terminal device and the NF. Through the method, the security of information interaction can be improved.

[0031] In an implementation manner, the security mode complete message includes information of the first NF, used to indicate that the security context between the terminal device and the first NF is activated.

[0032] In an implementation manner, the security mode command message includes information of a security algorithm between the terminal device and each NF.

[0033] The beneficial effects of the second aspect and each implementation manner thereof can refer to the beneficial effects of the foregoing first aspect and each implementation manner thereof, which will not be described herein again.

[0034] In a third aspect, a communication method is provided, which can be applied to a terminal-side device (which can be referred to as a terminal device for short). The terminal device can be a terminal device, or a module or unit that completes part of the function of the terminal device, for example, a circuit or a chip / chip system (for example, a modem chip, also referred to as a baseband chip, or a system on chip (SoC) chip or a system in package (SIP) chip containing a modem core) or other functional modules in the terminal device. For the convenience of description, the terminal device is taken as an example of a terminal device in the following.

[0035] The method includes: sending, by the terminal device, a fifth message to a first network element, the fifth message including information of a first NF, used to request to establish a connection between the terminal device and the first NF. Wherein, the terminal device and the first NF do not have a NAS signaling connection.

[0036] In the method, when the terminal device and the first NF do not have a NAS signaling connection, the terminal device can request the first network element to establish a connection between the terminal device and the first NF, so as to trigger the first network element to request an access network device to establish a connection to the first NF. Through the method, the connection between the terminal device and other network elements based on the first network element can be established, and the security of the AS layer can be activated, so as to ensure the security and reliability of the message transmission of the terminal device. In addition, compared with forwarding the message of the terminal device with the first network element as an anchor point, the congestion of the first network element can be reduced.

[0037] In an implementation manner, the method further includes: receiving, by the terminal device, a sixth message from the first network element, the sixth message including information of the first NF, used to indicate that the first NF establishes the connection.

[0038] The first network element can inform the terminal device of the first NF that the connection is established, thereby avoiding the terminal device from sending a message to the NF that has not established the connection, and causing waste of signaling.

[0039] In an implementation manner, the information of the first NF includes identification information of the first NF or type information of the first NF.

[0040] In an implementation manner, before the fifth message is sent to the first network element, the method further includes: receiving, by the terminal device, a fourth message from the first network element, the fourth message including information of at least one NF, the at least one NF including the first NF.

[0041] In an implementation manner, before the fourth message is received from the first network element, the method further includes: receiving, by the terminal device, a security mode command message from the first network element, and sending a security mode complete message to the first network element. The security mode command message includes a key identifier and / or information of at least one NF, and is used to activate a security context of the terminal device to the at least one NF. The security mode complete message is used to indicate that a security mode control process is completed.

[0042] In an implementation manner, the security mode complete message includes information of the first NF, and is used to indicate that the security context of the terminal device to the first NF is activated.

[0043] In an implementation manner, the security mode command message includes information of a security algorithm between the terminal device and each NF.

[0044] The beneficial effects of the third aspect and the respective implementation manners can refer to the beneficial effects of the first aspect to the second aspect and the respective implementation manners, which will not be described herein.

[0045] In a fourth aspect, a communication method is provided, which can be applied to a terminal-side device (which can be referred to as a terminal device for short). The terminal device can refer to the description of the terminal device in the third aspect, which will not be described herein. For convenience of description, the terminal device is taken as an example of a terminal device in the following.

[0046] The method includes: sending, by the terminal device, a seventh message to a first NF, receiving a security mode command message sent by the first NF, and activating a security context between the terminal device and the first NF based on information of the first NF. The seventh message is used to request to activate the first NF. The security mode command message includes a key identifier and information of the first NF, and is used to activate the security context between the terminal device and the first NF. The first NF can activate the security context between the terminal device and the first NF.

[0047] In an implementation manner, the security mode command message further includes information of the first NF.

[0048] In an implementation form, the information of the first NF comprises type information of the first NF.

[0049] In an implementation form, the security mode command message comprises a security algorithm of the terminal device to the first NF.

[0050] In an implementation form, the method further comprises: sending, by the terminal device, a security mode complete message to the first network element, the security mode complete message being used to indicate that the security mode control procedure is completed.

[0051] In an implementation form, the security mode complete message comprises information of the first NF, and is used to indicate that a security context of the terminal device with the first NF is activated.

[0052] The advantages of the fourth aspect and the respective implementation forms can be referred to the advantages of the preceding second aspect to the third aspect and the respective implementation forms, which will not be described here again.

[0053] In a fifth aspect, a communication method is provided, which can be applied to a core network side device (which can be referred to as a core network device for short). The core network device is, for example, an AMF, a component (such as a circuit, a chip or a chip system, etc.) in the AMF; or the core network device can be a logical node, a logical module or software used to complete part or all functions of the AMF. For the convenience of description, the following takes the core network device as the first NF as an example.

[0054] The method comprises: receiving, by the first NF, a seventh message from a terminal device, and sending a security mode command message to the terminal device. The seventh message is used to request to activate the first NF. The security mode command message comprises a key identifier and information of the first NF, and is used to activate a security context between the terminal device and the first NF.

[0055] In an implementation form, the security context between the terminal device and the first NF is activated based on type information of the first NF.

[0056] In an implementation form, the security mode command message further comprises information of the first NF.

[0057] In an implementation form, the information of the first NF comprises type information of the first NF.

[0058] In an implementation form, the security mode command message comprises a security algorithm of the terminal device to the first NF.

[0059] In a sixth aspect, a communication method is provided, which can be applied to an access network side device (which can be referred to as an access network device for short). The access network device can refer to the related description of the access network device in the preceding first aspect, which will not be described here again. For the convenience of description, the following takes the access network device as an access network device as an example.

[0060] The method comprises: receiving, by the access network device, a release message from the first NF, the release message being used to request to release a connection between the terminal device and the first NF; if the terminal device is also connected with a second NF, releasing, by the access network device, the connection between the access network device and the first NF, and sending a first message to the terminal device. The first message comprises information of the first NF, and is used to indicate that the connection of the terminal device to the first NF is released.

[0061] In the method, the connection release can be triggered by the first NF. When the first NF triggers the connection release, if the UE is connected with more than one NF, the access network device can release the connection with the first NF, so as to release unnecessary connections as much as possible and save resources.

[0062] In an implementation manner, if the terminal device is connected with only the first NF, the access network device releases the connection between the first NF and the radio access network, releases a radio resource control (RRC) connection of the terminal device, and sends a second message to the terminal device. The second message is used to instruct the terminal device to release the connection with the access network device.

[0063] In the method, when the first NF triggers the connection release, if the UE is connected with only the first NF, the access network device can release the connection with the first NF and release the RRC connection of the terminal device, so as to release more connections as much as possible and save more resources.

[0064] In an implementation manner, the information of the first NF comprises type information of the first NF or identification information of the first NF.

[0065] In a seventh aspect, a communication method is provided, which can be applied to a terminal-side device (which can be referred to as a terminal device for short). The terminal device can refer to the related description of the terminal device in the third aspect described above, which will not be described here again. For the convenience of description, the terminal device is taken as an example of a terminal device below.

[0066] The method comprises: receiving, by the terminal device, a first message from the access network device, and recording, according to the first message, that the first NF is in an idle state or a deactivated state, wherein the first message comprises identification information or type information of the first NF, and is used to instruct the terminal device to release the connection to the first NF. Alternatively,

[0067] The method comprises: receiving, by the terminal device, a second message from the access network device, and recording, according to the second message, that all NFs are in an idle state or a deactivated state, wherein the second message is used to instruct the terminal device to release the connection to the access network device.

[0068] It should be understood that the first NF being in the idle state or the deactivated state means that there is no end-to-end connection between the UE and the first NF. The terminal device can record the connection state of the NF, and can determine the NF in the idle state or the deactivated state, so that the terminal device can re-establish a connection with the NF when the terminal device needs to communicate with the NF. In this way, the terminal device can avoid directly sending information to the NF, thereby avoiding waste of signaling.

[0069] In an eighth aspect, an embodiment of the present application provides a communication apparatus having functions to implement the behaviors in any of the method examples of the first aspect to the seventh aspect, and the beneficial effects can be referred to the related descriptions of the first aspect to the seventh aspect and will not be described here. For example, the communication apparatus can be the access network device in the first aspect or the sixth aspect, or the communication apparatus can be an apparatus capable of supporting the functions required by the access network device to implement the method provided in the first aspect or the sixth aspect, for example, the communication apparatus can be a chip or a chip system in the access network device. For another example, the communication apparatus can be the AMF in the second aspect, or the communication apparatus can be an apparatus capable of supporting the functions required by the AMF to implement the method provided in the second aspect, for example, the communication apparatus can be a chip or a chip system in the AMF. For another example, the communication apparatus can be the terminal device in the third aspect, the fourth aspect or the seventh aspect, or the communication apparatus can be an apparatus capable of supporting the functions required by the terminal device to implement the method provided in the third aspect, the fourth aspect or the seventh aspect, for example, the communication apparatus can be a chip or a chip system in the terminal device. For another example, the communication apparatus can be the first NF in the fifth aspect, or the communication apparatus can be an apparatus capable of supporting the functions required by the NF to implement the method provided in the fifth aspect, for example, the communication apparatus can be a chip or a chip system in the NF.

[0070] In one possible design, the communication apparatus is the access network device or the terminal device, and the communication apparatus includes a baseband apparatus and a radio frequency apparatus.

[0071] In a possible design of the present disclosure, the communication apparatus includes corresponding means or modules or units for performing the methods in any of the first aspect to the seventh aspect. The modules or means or units can be implemented by software or by hardware or by a combination of software and hardware. For example, the communication apparatus includes a processing unit (also referred to as processing module or processor) and / or a transceiver unit (also referred to as transceiver module or transceiver). The transceiver unit is capable of implementing the sending function and the receiving function. When the transceiver unit implements the sending function, it can be referred to as a sending unit (also referred to as sending module). When the transceiver unit implements the receiving function, it can be referred to as a receiving unit (also referred to as receiving module). The sending unit and the receiving unit can be the same functional unit, which is referred to as a transceiver unit and is capable of implementing the sending function and the receiving function. Alternatively, the sending unit and the receiving unit can be different functional units, and the transceiver unit refers to both of the functional units. The units (modules) can perform the corresponding functions in the method examples of the first aspect to the seventh aspect. For details, refer to the detailed description of the method examples.

[0072] For example, the communication apparatus is used to implement the corresponding functions in the method examples of the first aspect. Accordingly, the transceiver module is configured to send a first message to a first network element, receive a second message from the first network element, and send a first request message to a first NF. The first message includes a NAS message. The second message is used to request the communication apparatus to establish a connection between the communication apparatus and at least one NF. The second message includes identification information of the at least one NF or type information of the at least one NF. The first request message includes a first identifier and identification information of a terminal device, and is used to request the first NF to establish a connection. The first identifier is a unique identifier allocated by the communication apparatus to the terminal device. The first NF belongs to the at least one NF.

[0073] For another example, the communication apparatus is used to implement the corresponding functions in the method examples of the second aspect. Accordingly, the transceiver module is configured to receive a first message and send a second message to an access network device in response to the first message. The first message includes a NAS message. The second message is used to request the access network device to establish a connection between the access network device and at least one NF. The second message includes identification information of the at least one NF or type information of the at least one NF.

[0074] For another example, the communication apparatus is used to implement the corresponding functions in the method examples of the third aspect. Accordingly, the transceiver module is configured to send a fifth message to a first network element. The fifth message includes information of a first NF and is used to request the first network element to establish a connection between the communication apparatus and the first NF. The communication apparatus does not have a NAS signaling connection with the first NF.

[0075] For another example, the communication apparatus is configured to implement the corresponding functions in the method examples of the fourth aspect. Correspondingly, the transceiver is configured to send a seventh message to the first NF, receive a security mode command message sent by the first NF, and activate the security context between the communication apparatus and the first NF based on the information of the first NF. The seventh message is configured to request to activate the first NF. The security mode command message comprises the key identifier and the information of the first NF, and is configured to activate the security context between the communication apparatus and the first NF.

[0076] For another example, the communication apparatus is configured to implement the corresponding functions in the method examples of the fifth aspect. Correspondingly, the transceiver is configured to receive a seventh message from the terminal device, and send a security mode command message to the terminal device. The seventh message is configured to request to activate the first NF. The security mode command message comprises the key identifier and the information of the communication apparatus, and is configured to activate the security context between the terminal device and the communication apparatus.

[0077] For another example, the communication apparatus is configured to implement the corresponding functions in the method examples of the sixth aspect. Correspondingly, the transceiver is configured to receive a release message from the first NF, the release message being configured to request to release the connection between the terminal device and the first NF; and the processor is configured to release the connection between the communication apparatus and the first NF, and send a first message to the terminal device if the terminal device is also connected to the second NF. The first message comprises the information of the first NF, and is configured to indicate the release of the connection between the terminal device and the first NF.

[0078] For another example, the communication apparatus is configured to implement the corresponding functions in the method examples of the seventh aspect. Correspondingly, the transceiver is configured to receive a first message from the access network device, and record that the first NF is in the idle state according to the first message. The first message comprises the identification information or the type information of the first NF, and is configured to indicate the release of the connection between the communication apparatus and the first NF. Alternatively, the transceiver is configured to receive a second message from the access network device, and record that all the NFs are in the idle state according to the second message. The second message is configured to indicate the release of the connection between the communication apparatus and the access network device.

[0079] In the ninth aspect, the embodiments of the present application provide a communication apparatus. The communication apparatus comprises a processor configured to cause the communication apparatus to perform the method in any of the first aspect to the seventh aspect and any of the implementation manners thereof. Optionally, the communication apparatus further comprises a communication interface. Optionally, the communication apparatus further comprises a memory configured to store a computer program (which can also be referred to as code or instruction), data, etc. The processor is coupled with the memory and the communication interface. When the processor reads the computer program, data, etc. from the memory, the communication apparatus is caused to perform the method in any of the first aspect to the seventh aspect and any of the implementation manners thereof.

[0080] In a tenth aspect, an embodiment of the present application provides a communication apparatus, which comprises an input / output interface and a logic circuit. The input / output interface is configured to input and / or output information. The input / output interface can be an interface circuit, an output circuit, an input circuit, a pin or related circuit, etc. The logic circuit is configured to perform the method in any of the first aspect to the seventh aspect.

[0081] In the ninth aspect and the tenth aspect, the communication apparatus can be the access network device in the first aspect or the sixth aspect. Alternatively, the communication apparatus can be an apparatus capable of supporting the functions required by the access network device to implement the method provided in the first aspect or the sixth aspect, for example, the communication apparatus can be a chip or a chip system in the access network device. The chip can be a baseband chip and / or a radio frequency chip, and the chip system can be composed of a chip or can contain a chip and other discrete devices. Alternatively, the communication apparatus can be the AMF in the second aspect. Alternatively, the communication apparatus can be an apparatus capable of supporting the functions required by the AMF to implement the method provided in the second aspect, for example, the communication apparatus can be a chip or a chip system in the terminal device. Alternatively, the communication apparatus can be the terminal device in the third aspect, the fourth aspect or the sixth aspect. Alternatively, the communication apparatus can be an apparatus capable of supporting the functions required by the terminal device to implement the method provided in the third aspect, the fourth aspect or the sixth aspect, for example, the communication apparatus can be a chip or a chip system in the terminal device. Alternatively, the communication apparatus can be the first NF in the fifth aspect. Alternatively, the communication apparatus can be an apparatus capable of supporting the functions required by the NF to implement the method provided in the fifth aspect, for example, the communication apparatus can be a chip or a chip system in the NF. The chip can be a baseband chip and / or a radio frequency chip, and the chip system can be composed of a chip or can contain a chip and other discrete devices.

[0082] In an implementation form of the tenth aspect, when the communication apparatus is a terminal device, the interface circuit can be a radio frequency processing chip in the terminal device, and the processing circuit can be a baseband processing chip in the terminal device. When the communication apparatus is a network device, the interface circuit can be a radio frequency processing chip in the network device, and the processing circuit can be a baseband processing chip in the network device.

[0083] In an implementation process of the tenth aspect, when the communication apparatus is a chip or a chip system, the input circuit can be an input pin, the output circuit can be an output pin, and the logic circuit can be a transistor, a gate circuit, a flip-flop, various logic circuits, etc. The input signal received by the input circuit can be received and input by, for example but not limited to, a receiver, the output signal output by the output circuit can be output to and transmitted by, for example but not limited to, a transmitter, and the input circuit and the output circuit can be the same circuit which is used as the input circuit and the output circuit at different times. The specific implementation of the input / output interface and the logic circuit is not limited in the present application.

[0084] In an eleventh aspect, embodiments of the present application provide a communication system, comprising a terminal device, an access network device and a plurality of core network elements, the plurality of core network elements comprising a first network element. The access network device is configured to implement the functions of the method of the first aspect, the first network element is configured to implement the functions of the method of the second aspect, and the terminal device is configured to implement the functions of the method of the third aspect or the fourth aspect. Alternatively, the communication system comprises a terminal device, an access network device and a plurality of core network elements, the plurality of core network elements comprising a first network element. The access network device is configured to implement the functions of the method of the sixth aspect, the first network element is configured to implement the functions of the method of the second aspect, and the terminal device is configured to implement the functions of the method of the seventh aspect. The communication system further comprises a first NF configured to implement the functions of the method of the fifth aspect.

[0085] In a twelfth aspect, embodiments of the present application provide a computer readable storage medium for storing a computer program or instructions, which, when executed, cause the method of any of the first aspect to the seventh aspect and any implementation thereof to be implemented.

[0086] In a thirteenth aspect, embodiments of the present application further provide a computer program product comprising instructions which, when executed on a computer, cause the method of any of the first aspect to the seventh aspect and any implementation thereof to be implemented.

[0087] The beneficial effects of the eighth aspect to the thirteenth aspect and the implementation manners thereof can refer to the beneficial effects of any of the first aspect to the seventh aspect and any implementation thereof. BRIEF DESCRIPTION OF DRAWINGS

[0088] FIG. 1 is a 5G network architecture based on a service-oriented architecture;

[0089] FIG. 2 is a flow diagram of establishing a connection between a terminal device and an NF;

[0090] FIG. 3 is a schematic diagram of a service-oriented architecture based on a RAN;

[0091] FIG. 4 is a flow diagram of a communication method 400 according to an embodiment of the present disclosure;

[0092] FIG. 5 is a flow diagram of a communication method 400A according to an embodiment of the present disclosure;

[0093] FIG. 6 is a flow diagram of a communication method 400B according to an embodiment of the present disclosure;

[0094] FIG. 7 is a flow diagram of a communication method 400C according to an embodiment of the present disclosure;

[0095] FIG. 8 is a flow diagram of a communication method 400D according to an embodiment of the present disclosure;

[0096] FIG. 9 is a flow diagram of a communication method 900 according to an embodiment of the present disclosure;

[0097] FIG. 10 is a flow diagram of a communication method 900A according to an embodiment of the present disclosure;

[0098] FIG. 11 is a flow diagram of a communication method 900B according to an embodiment of the present disclosure;

[0099] FIG. 12 is a flow diagram of a communication method 1200 according to an embodiment of the present disclosure;

[0100] FIG. 13 is a schematic diagram of a structure of a communication apparatus according to an embodiment of the present disclosure;

[0101] FIG. 14 is a schematic diagram of another structure of a communication apparatus according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0102] The 3rd Generation Partnership Project (3GPP) standard group formulates a 5G network architecture. The architecture supports wireless access technologies defined by the 3GPP standard group (such as long term evolution (LTE) access technology, 5th generation (5G) (radio) access network (R)AN access technology, etc.) to access a 5G core network (CN). The (R)AN can be replaced by a RAN for convenience of description. In the following, the RAN is taken as an example.

[0103] Please refer to FIG. 1, which is a 5G network architecture based on a service-oriented architecture. FIG. 1 shows the interaction relationship between network functions and entities and the corresponding interfaces, for example, a terminal (for example, a user equipment (UE)) and an AMF can interact through an N1 interface, and the interaction message is called an N1 message. Some interfaces in FIG. 1 are implemented in the form of a service-oriented interface. The network architecture includes three parts, namely a terminal device part, a data network (DN) part, and an operator network part. The functions of some network elements in the network architecture are briefly introduced below.

[0104] (1) Terminal device

[0105] A terminal device that can communicate data with a RAN device can be regarded as a terminal device. The terminal device is also called a terminal, a terminal apparatus, a UE, a user apparatus, a mobile station, or a mobile terminal, etc. The terminal device can be widely applied to various scenarios, for example, the terminal device can be a mobile phone, a computer, a mobile internet device (MID), a wearable device, a virtual reality (VR) device, an augmented reality (AR) device, a station (STA), a mechanical arm, a camera, a robot, a vehicle, a drone, a helicopter, an airplane, a ship, or a smart home device (for example, a television, an air conditioner, a sweeper, a sound box, a set-top box), a relay, a customer premise equipment (CPE), etc.

[0106] In addition, in the embodiments of the present application, the terminal device can also be a terminal device in an IoT system, for example, a water meter, an electricity meter, etc. IoT is an important part of the future information technology development, and its main technical feature is to connect objects through communication technology and network, so as to realize the intelligent network of man-machine interconnection and object-object interconnection.

[0107] The terminal device can be applied to V2X, also known as V2X device, for example, smart car or intelligent car, unmanned car or driverless car or pilotless car or automobile, road site unit (RSU) and the like. As introduced above, various terminal devices, if located on a vehicle (for example, placed / installed in the vehicle), can be considered as a vehicle-mounted terminal device. The vehicle-mounted terminal device can be built-in as one or more components or units in the vehicle-mounted module, vehicle-mounted module group, vehicle-mounted component, vehicle-mounted chip or vehicle-mounted unit of the vehicle, and the vehicle can implement the method of the present application through the built-in vehicle-mounted module, vehicle-mounted module group, vehicle-mounted component, vehicle-mounted chip or vehicle-mounted unit. The vehicle-mounted terminal device can be a whole vehicle device, vehicle-mounted module, vehicle, on board unit (OBU), RSU, telematics box (T-box), chip or SoC, etc. The above-mentioned chip or SoC can be installed in the vehicle, OBU, RSU or T-box.

[0108] The terminal device can establish a connection with the operator network through an interface (such as N1, etc.) provided by the operator network, and use data and / or voice services provided by the operator network. The terminal device can also access the DN through the operator network, use the operator services deployed on the DN, and / or third-party services. The third party can be a service provider other than the operator network and the terminal device, and can provide data and / or voice services to the terminal device. The specific form of the third party can be determined according to the actual application scenario, which is not limited here.

[0109] (2) DN

[0110] The DN can also be referred to as a packet data network (PDN), which is a network located outside the operator network. The operator network can access multiple DNs, and multiple services can be deployed on the DN to provide data and / or voice services to the terminal device. For example, the DN is a private network of a smart factory, and the sensors installed in the workshop of the smart factory can be terminal devices. The control server of the sensor is deployed in the DN, and the control server can provide services to the sensor. The sensor can communicate with the control server, obtain instructions from the control server, and transmit the collected sensor data to the control server, etc. For example, the DN is an internal office network of a company, and the mobile phones or computers of the employees of the company can be terminal devices, and the mobile phones or computers of the employees can access information and data resources on the internal office network of the company.

[0111] (3) RAN

[0112] The RAN is a subnetwork of the operator network and is an implementation system between the service nodes and the terminal devices in the operator network. To access the operator network, the terminal device first passes through the RAN and then can be connected to the service nodes of the operator network through the RAN. The RAN in the embodiments of the present application can be a 3GPP related cellular system, for example, a 5G / new radio (NR) mobile communication system or a future-oriented evolved system. The RAN can also be an open access network (open RAN, O-RAN or ORAN), a cloud radio access network (CRAN), or a virtualized RAN (vRAN), a non-terrestrial network (NTN), etc. The RAN can also be a communication system in which two or more of the above systems are fused. In the embodiments of the present application, the RAN device can also be referred to as a RAN node, a RAN entity, or an access node, etc.

[0113] In a possible scenario, the RAN node can be a base station, an evolved NodeB (eNodeB), an access point (AP), a transmission reception point (TRP), a next generation NodeB (gNB), a base station in a future mobile communication system, etc. The RAN node can be a macro base station, a micro base station, an indoor station, a relay node, a donor node / host node, or a radio controller, etc. The RAN node can also be a server, a wearable device, a vehicle or a vehicle-mounted device, etc. For example, the RAN node in the V2X technology can be a road side unit (RSU).

[0114] In another possible scenario, a RAN node can be a module or unit that completes part of the function of a base station; or multiple RAN nodes cooperate to assist a terminal device to implement wireless access, and different RAN nodes respectively implement part of the function of a base station. For example, a RAN node can be a CU, a DU, or a RU, etc. The function of the CU can be implemented by one entity, or also can be implemented by different entities. For example, the function of the CU can be further divided, that is, the control plane and the user plane are separated and implemented by different entities, respectively, as a control plane CU entity (that is, a CU-control plane (CP) entity) and a user plane CU entity (that is, a CU-user plane (UP) entity). The CU-CP entity and the CU-UP entity can be coupled with the DU to jointly complete the function of the RAN node. The CU and the DU can be separately arranged, or also can be included in the same network element, for example, in a baseband unit (BBU). Any one of the CU (or the CU-CP, the CU-UP), the DU, and the RU in this application can be implemented by a software module, a hardware module, or a combination of a software module and a hardware module.

[0115] In different systems, the CU (or the CU-CP and the CU-UP), the DU, or the RU can also have different names, but those skilled in the art can understand their meanings. For example, in an ORAN system, the CU can also be referred to as an O-CU (open CU), the DU can also be referred to as an O-DU, the CU-CP can also be referred to as an O-CU-CP, the CU-UP can also be referred to as an O-CU-UP, and the RU can also be referred to as an O-RU. For the convenience of description, the CU, the CU-CP, the CU-UP, the DU, and the RU are taken as examples for description in this application.

[0116] The CU and the DU can be configured according to the protocol layer function of the wireless network they implement: for example, the CU is configured to implement the function of the packet data convergence protocol (PDCP) layer and the protocol layer above (such as the radio resource control (RRC) layer and / or the service data adaptation protocol (SDAP) layer, etc.); and the DU is configured to implement the function of the protocol layer below the PDCP layer (such as the radio link control (RLC), the media access control (MAC) layer, and / or the physical (PHY) layer, etc.). For specific description of the above-mentioned various protocol layers, reference can be made to the relevant technical specifications of 3GPP or the technical specifications of other applicable communication protocols.

[0117] The above-mentioned processing functions of the CU and the DU are merely examples according to the protocol layer division, and the division can be performed in other manners, which is not limited in the application. For example, in one design, the CU or the DU can also be divided into partial processing functions with protocol layers. In one design, partial functions of the RLC layer and functions of the protocol layers above the RLC layer are arranged in the CU, and the remaining functions of the RLC layer and functions of the protocol layers below the RLC layer are arranged in the DU.

[0118] In another possible design, the functions of the PHY layer are jointly implemented by the DU and the RU, or described as moving part of the PHY layer functions of the DU to the RU. One DU can be connected with one or more RUs. The functions of the DU and the RU can be configured in multiple manners according to the design. For example, the DU is configured to implement baseband functions, and the RU is configured to implement intermediate frequency functions. For another example, the DU is configured to implement high-layer functions in the PHY layer, and the RU is configured to implement low-layer functions in the PHY layer or implement the low-layer functions and the intermediate frequency functions. The high-layer functions in the PHY layer can include part of the functions of the PHY layer, which are closer to the MAC layer, and the low-layer functions in the PHY layer can include another part of the functions of the PHY layer, which are closer to the intermediate frequency side. The application does not limit the specific functions of the DU and the RU. The interface between the DU and the RU can be referred to as a front-haul interface. In one design, the CU can have no PDCP layer, for example, the CU only includes the RRC layer. The CU-CP has no PDCP-C. The CU-UP can have no PDCP-U, or have no CU-UP. In one design, the DU can have no RLC layer, for example, the DU only has the MAC and the higher PHY layer.

[0119] When the RAN is an O-RAN, it can also have an artificial intelligence (AI) function, for example, the O-RAN includes an intelligent controller. The intelligent controller can be a non-real time RAN intelligent controller (non-RT RIC / non-RT RIC / NRT RIC), or a near-real time RAN intelligent controller (near-RT RIC / near-RT RIC / nRT RIC). The non-real time RIC can be used to implement non-real time intelligent management of the RAN function, can implement a workflow including model training and model updating, and guide applications / functions in the nRT RIC based on a policy. The near-real time RIC can be used to implement near-real time intelligent management of the RAN. Through data collection and related operations on the E2 interface, near-real time control and optimization of modules and resources of the O-RAN are implemented.

[0120] (4) Operator network

[0121] The operator network also includes a plurality of core network parts, or parts of the operator network other than the (wireless) access network part can be referred to as core network parts.

[0122] The core network part includes a plurality of core network elements, for example, the core network part can include a network exposure function (network exposure function, NEF) element, a network function repository function (network function repository function, NRF) element, a policy control function (policy control function, PCF) element, a unified data management (unified data management, UDM) element, an application function (application function, AF) element, a network slice selection function (Network Slice Selection Function, NSSF) element, an authentication server function (authentication server function, AUSF) element, an AMF element, an SMF element, a user plane function (user plane function, UPF) element, an authentication server function (authentication server function, AUSF) element, a network slice selection function (network slice selection function, NSSF) element, a (wireless) access network ((radio) access network, (R)AN) and the like. For convenience of description, the (R)AN is referred to as RAN in the following description. It should be noted that the above-mentioned network elements included in the operator network are only examples, and the operator network can further include more network elements, for example, the operator network can further include a network data analysis function (network data analytics function, NWDAF) element.

[0123] Among them, the AMF element is responsible for the mobility management of the UE, including the management of the mobile state, the allocation of the temporary identity of the UE, the authentication and authorization of the UE. The SMF element is responsible for the selection of the UPF element, the reselection of the UPF element, the IP address allocation, and is responsible for the establishment, modification and release of the bearer, the quality of service (quality of service, QoS) control. The UPF element supports all or part of the following functions: interconnection of protocol data unit (protocol data unit, PDU) sessions and data networks; packet routing and forwarding (for example, supporting uplink classification (uplink classifier) of traffic and forwarding to a data network); packet detection. The UDM element is responsible for managing subscription data and notifying the corresponding network element when the subscription data is modified.

[0124] Nnef, Nudsf, Nnrf, Npcf, Nudm, Naf, Namf, Nnvaf, Nsmf, Nnwdaf, N1, N2, N3, N4, and N6 in FIG. 1 are interface sequence numbers. The meanings of these interface sequence numbers can be referred to the meanings defined in the 3GPP standard protocol, which are not limited here.

[0125] It should be noted that the communication system shown in FIG. 1 does not constitute a limitation on the communication system to which the embodiments of the present application can be applied. In addition, the communication system provided in the present application can be used in a terrestrial network (TN) and / or a non-terrestrial network (NTN), without limitation. In addition, it should also be noted that the embodiments of the present application also do not limit the names of the network elements in the communication system. For example, in different communication systems of different standards, the network elements can have other names. For another example, when multiple network elements are integrated in the same physical device, the physical device can also have other names.

[0126] In the embodiments of the present application, the core network element can also be referred to as an NF network element, simply referred to as NF (hereinafter taken as an example). In the architecture shown in FIG. 1, the UE and the AMF maintain a NAS connection through the (R)AN, and the (R)AN forwards the NAS message between the UE and the AMF. For example, the (R)AN forwards the mobility management (MM) NAS message or the service request (SR) NAS message between the UE and the AMF. The AMF receives the NAS message and parses the corresponding request, and then sends the request to the corresponding NF. Under the service architecture, the NF can also be referred to as a NS (Network service) network service.

[0127] Currently, the AMF is used as an anchor point in the process of establishing a connection between the UE and the core network element. For example, please refer to FIG. 2, which is a flowchart of establishing a connection between the UE and the core network element.

[0128] As shown in FIG. 2, when the UE is in an RRC idle state, a connection between the UE and the AMF network element can be established through an initial NAS message. For example, the UE can send an SR message to the AMF network element to establish a connection between the UE and the AMF network element. The AMF network element feeds back an SR acceptance message to the UE, and the UE receives the SR acceptance message and can send a message to a certain NF. When the UE needs to send a message to a certain NF, the UE can send the message to the AMF, and the AMF forwards the message to the NF. Taking the NF as an example of the SMF, for example, if the UE initiates session service, the UE sends a session request as an SM container in a non-initial NAS message to the AMF, the AMF parses the NAS message, selects the SMF, and initiates a session request to the SMF.

[0129] Based on the flow of FIG. 2, when the UE is in an RRC idle state, the UE can only establish a connection between the UE and the AMF by initiating an SR message to the AMF. If the terminal device needs to communicate with other core network elements (for example, the SMF) in addition to the AMF, the terminal device first needs to establish a connection between the AMF, and then forwards data between the terminal device and the SMF through the AMF.

[0130] In the future, RAN-based services will be supported. Please refer to FIG. 3, which is a RAN-based service-oriented architecture provided by an embodiment of the present application. FIG. 3 only lists some NFs, for example, a short message service function (SMSF), a PCF, an SMF, an AMF, a UPF, and the like. The dashed line in FIG. 3 indicates that the connection has not been established.

[0131] As can be seen from FIG. 3, in the RAN-based service-oriented architecture, the UE can directly communicate with the NF through the RAN without using the AMF as an anchor point. In this way, the congestion of the AMF can be reduced. In addition, since the AMF is not used as an anchor point, data from the UE to other NFs does not need to pass through the AMF, data isolation can be achieved, and it is simpler. For the RAN, the N2 interface can also be based on a service-oriented interface protocol, and the AMF does not need to be used as an anchor point, so that the RAN only needs to maintain a set of protocols to each NF. Compared with using the AMF as an anchor point, the operator needs to maintain a set of protocols between the access network device and the AMF and a set of protocols between the AMF and other NFs, and the operator only needs to maintain a set of protocols between the access network device and the NF, and the number of protocols to be maintained is less and the complexity is lower. However, how to establish a connection between the UE and the NF based on the architecture shown in FIG. 3 still needs further research.

[0132] In addition, in the process of sending a message (for example, an SR) by the terminal device to establish a connection to the AMF, security of an access stratum (AS) can be activated to ensure the security of the connection. In addition, an RRC connection and an N2 interface connection can be established to ensure reliable transmission of messages in a connected state. In the service-based architecture of the RAN, messages between the UE and the NF do not pass through the AMF, and the security of the AS cannot be activated. How to ensure the secure transmission between the UE and the NF also needs further research.

[0133] In view of this, the embodiments of the present application provide a method for establishing a connection between a UE and an NF for the architecture shown in FIG. 3, which can reduce AMF congestion, realize isolation of data between different NFs, and reduce data processing complexity. In addition, in the initial registration process of the UE, the AMF can start a security activation process to activate a security context between at least one NF and the UE. The UE and the NF activate the security between the UE and the NF based on information (for example, the type of the NF) of the NF, so that when the UE sends information to a certain NF, the information can be encrypted and integrity protected according to the security context between the UE and the NF, thereby improving the security of the information in the transmission process. Alternatively, in the initial registration process of the UE, the AMF can activate a security context between the AMF and the terminal device. Then, other NFs can obtain a basic key from the AMF, and based on the basic key, an encryption key can be derived according to the information (for example, the type of the NF) of the NF to activate the security context between the NF and the terminal device. In this way, when the UE needs to communicate with a certain NF, the UE can request to activate the NF, so that the information can be encrypted and integrity protected according to the activated security context between the UE and the NF, thereby improving the security of the information in the transmission process.

[0134] In the embodiments of the present application, the security includes encryption processing and / or integrity protection processing. The "integrity protection" can also be referred to as integrity verification, simply referred to as integrity verification. The "encryption" and "integrity protection" can be independent algorithms. Alternatively, the "encryption" also includes the "integrity protection". That is, the "encryption" includes both encryption and integrity protection.

[0135] The encryption processing refers to that the sending end converts the data plaintext into ciphertext through calculation processing according to the input parameters such as the key through an algorithm. The decryption processing refers to that the receiving end converts the ciphertext into data plaintext through inverse operation processing according to the input parameters such as the key through an algorithm. When the input parameters used by the sending end are the same as the input parameters used by the receiving end, the information that has been encrypted at the sending end can be successfully decrypted at the receiving end.

[0136] The integrity protection processing refers to that a sending end calculates an integrity protection parameter (such as parameter A) according to input parameters such as a data packet and a key through an algorithm. The integrity verification refers to that a receiving end calculates parameter B according to input parameters such as a data packet and a key through an algorithm. If parameter A and B are consistent, the integrity verification is successful. If parameter A and B are inconsistent, the integrity verification fails. When the input parameters used by the sending end and the input parameters used by the receiving end are the same, the information that has undergone the integrity protection at the sending end can be successfully integrity-verified by the receiving end.

[0137] In the embodiments of the present application, the request for the RAN to establish the connection between the at least one NF can also be replaced by the request for the RAN to create a context with the at least one NF. In other words, in the embodiments of the present application, the meaning of the RAN establishing the connection between the NFs includes the RAN creating a context with the NFs.

[0138] The technical solutions provided by the embodiments of the present application can be applied to various communication systems, for example, an LTE communication system, a 5G mobile communication system / NR communication system, or can also be applied to a future mobile communication system or other similar communication systems, as long as the communication system supports a RAN-based service. The other similar communication systems can include a wireless fidelity (WIFI), a vehicle to everything (V2X), an internet of things (IoT) system, and the like.

[0139] For the convenience of description, the embodiments of the present application take the network architecture combined with FIG. 1 and FIG. 3 as an example. The system described in the embodiments of the present application is for more clearly illustrating the technical solutions of the embodiments of the present application, and does not constitute a limitation on the technical solutions provided by the embodiments of the present application. Those skilled in the art can know that, with the evolution of the network architecture, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems. It should be noted that the network elements or functions or services in the above-mentioned FIG. 1 and FIG. 3 can be network elements in a hardware device, or can be software functions running on a special hardware, or can be virtualized functions instantiated on a platform (for example, a cloud platform). Optionally, the above-mentioned network elements or functions or services can be realized by one device, or can be realized by multiple devices together, or can be a functional module in one device, and the embodiments of the present application do not make a specific limitation thereon. In addition, some English abbreviations in the text are described by taking the current 5G network as an example, which can change with the evolution of the network, and the specific evolution can be referred to the description in the corresponding standard.

[0140] In the embodiments of the present application, “transmit” includes “send” and / or “receive”. Among them, “send” and “receive” represent the direction of signal transmission. For example, “sending information to XX” can be understood as that the destination of the information is XX, which can include direct sending through the air interface, and also includes indirect sending through the air interface by other units or modules. “Receiving information from YY” can be understood as that the source of the information is YY, which can include direct receiving from YY through the air interface, and also can include indirect receiving from YY through the air interface by other units or modules. “Sending” can also be understood as the “output” of the chip interface, and “receiving” can also be understood as the “input” of the chip interface. In other words, sending and receiving can be carried out between devices, for example, between an access network device and a terminal device, or can be carried out within a device, for example, between components, between modules, between chips, between software modules or between hardware modules in the device through a bus, a wire or an interface.

[0141] In the embodiments of the present application, the number of nouns represents “singular noun or plural noun” unless otherwise specified, that is, “one or more”. “At least one” means one or more, and “multiple” means two or more. “And / or” describes the association relationship of the associated objects, which means that there can be three kinds of relationships, for example, A and / or B can represent the following three cases: A exists alone, A and B exist together, and B exists alone. The character “ / ” generally represents an “or” relationship between the associated objects. For example, A / B means A or B. “At least one of the following” or similar expressions means any combination of these items, including any combination of single item or multiple items. For example, at least one of a, b and / or c means the following combinations: a exists alone, b exists alone, c exists alone, a and b exist together, a and c exist together, b and c exist together, or a and b and c exist together, where a, b and c can be single or multiple.

[0142] In the embodiments of the present application, “when”, “if” and “whether” all mean that the device will make corresponding processing under certain objective circumstances, and are not limited to time, and do not require the device to have a judgment action when it is implemented, nor does it mean that there are other limitations. Unless otherwise specified, “if” and “whether” can be replaced, and “when” and “in the case of” can be replaced. “When” and “if” / “whether” can be replaced.

[0143] In the embodiments of the present application, the ordinal numbers such as “first”, “second” and the like are used to distinguish a plurality of objects, and are not used to limit the size, content, order, time sequence, priority or importance of the plurality of objects. For example, the first identifier and the second identifier refer to two different identifiers, and do not mean that the priority or importance of the two identifiers is different.

[0144] In the embodiments of the present application, the schemes in various embodiments can be reasonably combined, and the explanation or description of each term, similar operations, or steps appearing in the embodiments can be mutually referenced or explained in various embodiments, without limitation.

[0145] The scheme provided by the embodiments of the present application will be described below with reference to the drawings.

[0146] The embodiments of the present application relate to a first network element, a first NF, an access network device, and a terminal device. The first network element can be a core network element, for example, the first network element is an AMF or other network element capable of similar functions. The steps performed by the first network element can be performed by the first network element itself, or by a component (such as a processor, a chip, or a logic function module) in the first network element. The first NF can be a core network element, for example, the first NF can be an SMF, a PCF, a UPF, an SMSF, etc. The steps performed by the first NF can be performed by the first NF itself, or by a component (such as a processor, a chip, or a logic function module) in the first NF. The access network device can be a RAN device, for example, the access network element is a station. The steps performed by the access network device can be performed by the access network device, or by a component (such as a CU, a DU, or a RU) that completes part or all of the functions of the access network device. The steps performed by the terminal device can be performed by the terminal device, or by a component (such as a baseband chip, or other processing unit or processor module) in the terminal device.

[0147] It should be noted that the specific name of each NF is not limited. For example, in different communication systems, each network element can have other names. For example, in a 5G communication system, the access and mobility management function is called AMF, and in a future communication system, the access and mobility management function can also have other names.

[0148] For convenience of description, in each of the following embodiments, the first network element is taken as an example of AMF, and RAN refers to a RAN device. In the embodiments of the present application, the information of the first NF can include (or be) the identification information of the first NF. The information of the first NF can also include (or be) the type information of the first NF.

[0149] Please refer to FIG. 4, which is a flowchart of a communication method 400 provided by the embodiments of the present application. FIG. 4 introduces the method from the perspective of the interaction of AMF, UE, RAN, and first NF. The processing performed by a single execution subject can also be divided into processing performed by multiple execution subjects, which can be logically and / or physically separated. For example, the processing performed by the access network device can be divided into processing performed by at least one of the CU, the DU, the RU, etc.

[0150] As shown in FIG. 4, the flow of the communication method 400 includes the following steps.

[0151] S401, the RAN sends a first message to the AMF, the first message including a NAS message.

[0152] Correspondingly, the AMF receives the first message from the RAN. The first message can be used to trigger the AMF to request the RAN to establish a connection between the at least one NF. Alternatively, the first message can be used to trigger the AMF to request the RAN to create a context with the at least one NF. The specific name of the first message is not limited in the embodiments of the present application.

[0153] S401 can occur in the registration process of the UE. For example, when the UE requests registration, the UE sends a registration request to the RAN; the RAN receives the registration request and sends a first message to the AMF. The UE can send the registration request in a NAS message to the RAN, and the RAN receives the NAS message and forwards the NAS message to the AMF by default. For example, the first message includes a NAS message, and the NAS message includes the registration request. Alternatively, the first message can also include an identifier (ID) of the UE and a unique identifier allocated by the RAN for the UE. For the convenience of description, the unique identifier allocated by the RAN for the UE is referred to as the first identifier, which can be denoted as RAN UE ID.

[0154] S401 can also occur in the service process of the UE. For example, when the UE has a service requirement, the UE sends a service request message to the RAN; the RAN receives the service request message and sends a first message to the AMF. The UE can send the service request message in a NAS message to the RAN, and the RAN receives the NAS message and forwards the NAS message to the AMF by default. For example, the first message includes a NAS message, and the NAS message includes the service request message. The NAS message includes information of the NF, which is used to request to establish a connection between the UE and the NF. The information of the NF includes type information or identifier information of the NF, which can enable the AMF to determine the NF to which the UE needs to establish a connection. Further, the AMF requests the access network device to establish a connection with the NF, which can ensure that the NF to which the access network device establishes a connection is the NF to which the terminal device needs to establish a connection, thereby meeting the connection requirement of the terminal device.

[0155] Optionally, the first message further includes a UE ID and a RAN UE ID. The RAN UE ID is notified to the AMF by the access network device, so that the AMF can be aware of the UE that needs to establish a connection. The UE ID is notified to the AMF by the RAN, so that the AMF can maintain a connection with the access network device based on the UE ID. For example, the first network element can determine the terminal device that has been connected based on the first identifier, and does not need to trigger network paging.

[0156] Optionally, the first message further includes capability information of the UE, and the capability information can indicate the capability of the UE. For example, the capability information is included in the registration request, and the first message sent by the RAN to the AMF includes a NAS message, and the registration request included in the NAS message includes the capability information of the UE. For another example, the capability information is included in the service request message, and the first message sent by the RAN to the AMF includes a NAS message, and the service request message included in the NAS message includes the capability information of the UE.

[0157] Optionally, the first message further includes capability information of the UE, and the capability information is not included in the NAS message.

[0158] S402, the AMF sends a second message to the RAN, and the second message is used to request the RAN to establish a connection between the at least one NF.

[0159] The AMF receives the first message, and determines, according to the NAS message included in the first message, that the UE needs to establish a connection with the CN. Therefore, the AMF receives the first message, and sends a second message to the RAN, and the second message is used to request the RAN to establish a connection between the at least one NF. It needs to be noted that if the first message is used to trigger the AMF to request the RAN to establish a connection between the at least one NF, then the second message is used for the RAN to establish a connection between the at least one NF. If the first message is used to trigger the AMF to request the RAN to create a context with the at least one NF, then the second message is used to create a context of the RAN to the at least one NF. The specific name of the second message is not limited in the embodiments of the present application.

[0160] The second message includes information of the at least one NF. The information of the NF can be identification information (for example, NF ID) of the NF, or type information of the NF. That is, the second message can include the identification information of the at least one NF, or the second message can include the type information of the at least one NF. Optionally, the second message further includes the first identifier and a unique identifier allocated by the AMF for the UE. For the convenience of description, the unique identifier allocated by the AMF for the UE is referred to as a third identifier, for example, the third identifier can be denoted as AMF UE ID. By carrying the AMF UE ID and the RAN UE ID in the second message, the RAN can be aware of that a connection is established with the AMF or a context is created with the AMF.

[0161] Optionally, if the first message comprises the capability information of the UE, the AMF can further select the at least one NF according to the capability information of the UE, the at least one NF matching the capability of the UE. In addition, the AMF can further generate a context of the at least one NF for the at least one NF.

[0162] S403, the RAN sends a first request message to the first NF, the first request message being used to request to establish a connection with the first NF.

[0163] The RAN receives the second message from the AMF, and establishes a connection with the at least one NF indicated by the second message or creates a context of the at least one NF to the RAN. For example, the RAN receives the second message, and sends a first request message to the first NF, the first request message being used to request to establish a connection with the first NF. Alternatively, the first request message can be used for the RAN to request to create a context of the at least one NF to the RAN.

[0164] The first request message comprises the UE ID and the RAN UE ID, so that the first NF knows which UE the connection requested by the RAN to establish is for. The specific name of the first request message is not limited in the embodiments of the present application. For example, the first request message can be referred to as a connection establishment request message or a context creation request message.

[0165] It should be noted that S403 takes the first NF as an example, and in fact, the RAN will send a first request message for each of the at least one NF. For example, the at least one NF comprises the first NF and a second NF, the RAN will send a first request message to the first NF, and the RAN will also send a first request message to the second NF.

[0166] S404, the first NF sends a first response message to the RAN, the first response message being used to indicate that the connection establishment between the first NF and the RAN is completed.

[0167] The first response message is a response message or a response message to the first request message. The first response message is used to indicate that the connection establishment between the first NF and the RAN is completed, or alternatively, the first response message can be used to indicate that the context creation of the first NF is completed. It should be understood that the first request message is used to request to establish a connection with the first NF, and the first response message is used to indicate that the connection establishment between the first NF and the RAN is completed. The first request message is used for the RAN to request to create a context of the at least one NF to the RAN, and the first response message is used to indicate that the context creation of the first NF is completed.

[0168] The first response message can include the RAN UE ID and a unique identifier allocated to the UE by the first NF. For the convenience of description, the unique identifier allocated to the UE by the first NF is referred to as a second identifier, which can be denoted as NF UE ID. For example, the first NF is an SMF, and the second identifier can be an SMF UE ID. The AMF feeds back the RAN UE ID and the SMF UE ID to the RAN, and the RAN can maintain the correspondence between the terminal device and the SMF by maintaining the correspondence between the SMF UE ID and the RAN UE ID.

[0169] S405, the AMF sends a fourth message to the UE, and correspondingly, the UE receives the fourth message from the AMF.

[0170] For a certain NF, if the AMF determines that the RAN has established a connection with the NF, the AMF can send a fourth message to the UE to indicate that a connection has been established between the NF and the UE, or to indicate that a context has been created between the NF and the UE. The specific name of the fourth message is not limited in the embodiments of the present application. For example, the first message includes a registration request, and the fourth message can be referred to as a registration accept message. For another example, the first message includes a service request message, and the fourth message can be referred to as a service accept message. FIG. 4 takes the first NF and the UE having established a connection as an example, and the fourth message can indicate that the first NF and the UE have established a connection.

[0171] As an example, the fourth message can include type information of the NF, to indicate that the NF corresponding to the type information has established a connection with the UE / established a connection completion, or to indicate that a context has been created between the NF corresponding to the type information and the UE. For another example, the fourth message can include identification information of the NF, to indicate that the NF has established a connection with the UE / established a connection completion, or to indicate that a context has been created between the NF and the UE. For another example, the fourth message can include type information of the NF and identification information of the NF, to indicate that a connection has been established with the NF of the type of the NF / established a connection completion, or to indicate that a context has been created between the NF of the type of the NF and the UE.

[0172] Optionally, in the registration request process, the fourth message includes type information of the NF and / or identification information of the NF.

[0173] As another example, the fourth message can not include information of the NF, for example, the fourth message does not include identification information of the NF. In this case, the UE can consider that a connection or a context has been established with all NFs that need to communicate, or the UE can consider that a connection or a context has been established with the requested NF.

[0174] Optionally, in the service request process, the fourth message can not include type information of the NF and / or identification information of the NF.

[0175] In a possible implementation, the fourth message includes NF type information and / or identification information of the NF, which can be used to inform the UE to send the third message to the RAN. The UE can determine the NF that has been established with the UE according to the NF type information and / or the identification information of the NF included in the fourth message, so as to decide to which NF to send information, or decide to send what information to the corresponding NF.

[0176] S406, the UE sends a third message to the RAN, where the third message is used to indicate the identification of the first NF or the type of the first NF.

[0177] Correspondingly, the RAN receives the third message from the UE. Based on S401-S405, the RAN establishes a connection with at least one NF, or the RAN creates a context to at least one NF. For the UE, when there is a service request, the corresponding message can be forwarded to a certain NF through the RAN. For example, taking that the UE needs to send a message to the first NF as an example, assuming that the UE needs to process a protocol data unit (PDU) (session management, SM) related requirement, the first NF can be an SMF.

[0178] When the UE needs to send a message (for example, the third message) to the first NF, the UE can send the third message to the RAN. In order to make the access network device clear the first NF, the third message further indicates the first NF, so as to avoid the access network device forwarding errors. For example, the third message further indicates the identification of the first NF or the type of the first NF. The third message includes the identification information of the first NF or the type information of the first NF.

[0179] S407, the RAN sends the third message to the first NF.

[0180] When the RAN receives the third message, the RAN can forward the third message to the first NF. Correspondingly, the first NF receives the third message from the RAN.

[0181] If the third message includes the identification of the first NF, the RAN can determine the first NF according to the third message, so as to forward the third message to the first NF. If the third message includes the type of the first NF, the RAN can select a NF matching the type as the first NF according to the third message, and forward the third message to the first NF. For example, the RAN determines a NF UE ID according to the UE ID and the type of the first NF, and then determines the first NF according to the NF UE ID.

[0182] In the communication method 400, the AMF can determine, based on the first message, that the UE needs to establish a connection with the NF, thereby requesting the RAN to establish a connection with the at least one NF or create a context of the at least one NF. Subsequently, the UE can forward information to the NF through the RAN, without the AMF as an anchor point, so as to reduce AMF congestion and also realize data isolation of the UE to each NF.

[0183] It can be understood that, in the current 5G network architecture, the AMF is used as an anchor point to realize communication between the UE and the NFs other than the AMF. In the process of initiating a registration request to the AMF, the UE performs authentication. After the UE authentication is passed, the AMF starts a security mode procedure, activates a security context, and completes creation of the security context on the AMF and the UE side, so that encryption and integrity protection between the UE and the AMF are activated.

[0184] In the embodiments of the present application, under the service architecture based on the RAN, the NFs other than the AMF do not have a key, and thus cannot create a security context, and cannot realize encryption and integrity protection with the UE. In order to improve the security between the UE and the at least one NF, the embodiments of the present application also propose two schemes for activating the security context between the UE and the NF. For example, the AMF can activate the security context between the at least one NF and the UE. When the UE sends information to a certain NF, the information can be encrypted and integrity protected according to the security context between the UE and the NF. For another example, the AMF can activate the security context between the AMF and the UE, and then other NFs can obtain a basic key from the AMF, derive an encryption key based on the basic key and information of the NF (such as the type of the NF), and use the encryption key to activate the security context between the NF and the UE. In this way, when the UE needs to communicate with a certain NF, the UE can request to activate the NF, and the NF can activate the security context with the UE, so as to encrypt and integrity protect the information using the security context.

[0185] Either of the two schemes for activating the security context between the UE and the NF described above can be combined with the communication method 400. For the convenience of understanding, the communication method 400 is further introduced below with specific examples.

[0186] Example 1: The AMF activates the security context between the at least one NF and the UE, and the first message includes a registration request.

[0187] Please refer to FIG. 5, which is a flowchart of the communication method 400A provided by the embodiments of the present application. FIG. 5 introduces the method from the perspective of the interaction among the AMF, the UE, the RAN, and the first NF. As shown in FIG. 5, the flow of the communication method 400A includes the following steps.

[0188] S501, the UE sends a registration request to the RAN, and the RAN receives the registration request from the UE accordingly.

[0189] The registration request is used to request registration to the network, so that the UE establishes a connection with the RAN or the CN. The registration request can include capability information of the UE, a registration type, and the like.

[0190] S502, the RAN sends a first message to the AMF, the first message including a NAS message.

[0191] S502 is the same as S401, and details can be referred to the foregoing related content of S401, which will not be described here.

[0192] S503, the AMF and the UE complete authentication and authorization.

[0193] The AMF receives the first message and determines that the UE needs to access the network. The AMF can send an authentication request to the UE through the RAN to request the UE to provide identity information of the UE, and the authentication request can include a random number. The UE receives the authentication request, obtains the random number therein, generates a new value according to a key stored by the UE and the random number, and carries the data in the authentication response to feed back to the AMF. The AMF receives the authentication response, determines the identity of the UE according to the value in the authentication response. If the identity of the UE is trusted, the AMF continues to process the first message; if the identity of the UE is not trusted, the AMF can refuse to process the first message to prevent unauthorized access.

[0194] S504, the AMF selects at least one NF according to the capability information of the UE.

[0195] If the first message includes the capability information of the UE, the AMF can select at least one NF according to the capability information, the at least one NF matching the capability of the UE. In addition, the AMF can also generate a context of the at least one NF.

[0196] S505, the AMF and the UE activate a security context of the at least one NF and the UE.

[0197] After the AMF selects the at least one NF, the AMF can initiate a security mode control (SMC) procedure for activating security context of the at least one NF with the UE. For example, the AMF can send a security mode command message to the UE, the security mode command message including a key identity and information of the at least one NF. Optionally, the security mode command message further includes information of security algorithms between the UE and the respective NFs. The UE receives the security mode command and can perform corresponding operations. For example, the UE can derive a new encryption key according to the key indicated by the key identity and the information of the NFs (e.g. NF type), and perform corresponding security configuration, e.g. update the encryption key. The encryption key derived by the UE is different for different NFs. After the UE completes the security configuration, the UE can send a security mode complete message to the AMF to indicate that the security mode control procedure is completed. Alternatively, the security mode complete message can indicate that the security operation has been successfully implemented.

[0198] S506, the AMF sends a second message to the RAN, and correspondingly, the RAN receives the second message from the AMF.

[0199] For S506, reference can be made to the related content of the aforementioned S402, and details are not repeated here.

[0200] S507, the RAN sends a first request message to the first NF, and correspondingly, the first NF receives the first request message from the RAN.

[0201] For S507, reference can be made to the related content of the aforementioned S403, and details are not repeated here.

[0202] S508, the first NF sends a first response message to the RAN, and correspondingly, the RAN receives the first response message from the first NF.

[0203] For S508, reference can be made to the related content of the aforementioned S404, and details are not repeated here.

[0204] S509, the RAN sends a reply message to the AMF, and correspondingly, the AMF receives the reply message from the RAN.

[0205] The reply message is a reply message to the second message, and is used to indicate that the RAN has established a connection with the first NF.

[0206] Optionally, the AMF receives the reply message, and considers that the RAN has established a connection with at least one NF indicated by the second message. In this case, the second message can not carry information of the NF. Alternatively, for any NF, the RAN establishes a connection with the NF, and sends a reply message to the AMF, which can include information of the NF to indicate that the RAN has established a connection with the NF. In other words, the RAN can send multiple reply messages to the AMF, one for one NF.

[0207] S510, the AMF sends a fourth message to the UE, and correspondingly, the UE receives the fourth message from the AMF

[0208] For S510, refer to the related content of the foregoing S405, which will not be repeated here.

[0209] S511, the UE sends a third message to the RAN, and correspondingly, the RAN receives the third message from the UE.

[0210] For S511, refer to the related content of the foregoing S406, which will not be repeated here.

[0211] S512, the RAN sends a third message to the first NF, and correspondingly, the first NF receives the third message.

[0212] For S512, refer to the related content of the foregoing S407, which will not be repeated here.

[0213] It should be noted that in possible implementation manners, S501-S505 can be executed alone (or only S501-S505 are executed), and S506-S512 are not executed.

[0214] Through the communication method 400A, the UE can forward information to the NF through the RAN, without taking the AMF as an anchor point, so as to reduce congestion of the AMF, and also realize data isolation of the UE to each NF. In addition, after the AMF determines the at least one NF, the AMF can activate a security context between the at least one NF and the UE. When the terminal device sends information to a certain NF, the information can be encrypted and integrity protected according to the security context between the terminal device and the NF, so as to improve the security of information interaction between the UE and the NF.

[0215] Example 2: The first message includes a service request message.

[0216] Example 2 differs from example 1 in that the UE triggers the RAN to send the first message to the AMF based on a service. In this case, the UE has registered to the network, and has established a security context with the AMF. Therefore, the flow of example 2 does not include an authentication and authorization process between the UE and the AMF, and does not include an SMC process, compared with the flow of example 1.

[0217] Please refer to Figure 6, the communication method 400B provided by the embodiment of the application is shown in the flow chart. Figure 6 introduces the method from the perspective of the interaction of AMF, UE, RAN and the first NF. As shown in Figure 6, the flow of the communication method 400B includes the following steps.

[0218] S601, the UE sends a service request message to the RAN, and the RAN receives the service request message from the UE.

[0219] The service request message can be used to request the RAN to provide corresponding service for the UE. The service request message can include the requested service type, service requirements, etc.

[0220] S602, the RAN sends a first message to the AMF, and the first message includes a NAS message.

[0221] S602 is the same as S401, and the specific content can be referred to the foregoing S401, which will not be described here.

[0222] S603, the AMF sends a second message to the RAN, and the RAN receives the second message from the AMF.

[0223] S603 can be referred to the foregoing S402, which will not be described here.

[0224] S604, the RAN sends a first request message to the first NF, and the first NF receives the first request message from the RAN.

[0225] S604 can be referred to the foregoing S403, which will not be described here.

[0226] S605, the first NF sends a first response message to the RAN, and the RAN receives the first response message from the first NF.

[0227] S605 can be referred to the foregoing S404, which will not be described here.

[0228] S606, the RAN sends a reply message to the AMF, and the AMF receives the reply message from the RAN.

[0229] S606 can be referred to the foregoing S509, which will not be described here.

[0230] S607, the AMF sends a fourth message to the UE, and the UE receives the fourth message from the AMF.

[0231] S607 can be referred to the foregoing S405, which will not be described here.

[0232] S608. The UE sends a third message to the RAN, where the third message is used to indicate an identity of the first NF or a type of the first NF.

[0233] The related content of S608 can be referred to the foregoing S406, and details are not described herein.

[0234] S609. The RAN sends the third message to the first NF.

[0235] The related content of S609 can be referred to the foregoing S407, and details are not described herein.

[0236] Through the communication method 400B, the UE can forward information to the NF through the RAN, without taking the AMF as an anchor point, so as to reduce AMF congestion, and also to realize data isolation of the UE to each NF.

[0237] Example 3: The AMF activates a security context between at least one NF and the UE, and the first message includes a registration request.

[0238] Example 3 is different from example 1 in that the fourth message sent by the AMF to the UE does not include information of the NF. In this case, the UE can consider that a connection or context is established with all NFs that need to communicate, or the UE can consider that a connection or context is established with the requested NF. However, if the UE has a message to send to the NF, it is not known in advance which NF should be sent. For example, if the UE wants to send a session message, but does not know which SMF to send the session message to. In this case, the RAN can select a suitable NF for the UE.

[0239] Please refer to FIG. 7, which is a flowchart of a communication method 400C provided by an embodiment of the application. FIG. 7 introduces the method from the perspective of interaction among the AMF, the UE, the RAN and the first NF. As shown in FIG. 7, the flow of the communication method 400C includes the following steps.

[0240] S701. The UE sends a registration request to the RAN, and correspondingly, the RAN receives the registration request from the UE.

[0241] S702. The RAN sends a first message to the AMF, where the first message includes a NAS message.

[0242] S703. The AMF and the UE complete authentication and authorization.

[0243] S704. The AMF selects at least one NF according to capability information of the UE.

[0244] S705. The AMF and the UE activate a security context of at least one NF and the UE.

[0245] S706, the AMF sends a second message to the RAN, and correspondingly, the RAN receives the second message from the AMF.

[0246] S707, the RAN sends a first request message to the first NF, and correspondingly, the first NF receives the first request message from the RAN.

[0247] S708, the first NF sends a first response message to the RAN, and correspondingly, the RAN receives the first response message from the first NF.

[0248] S709, the RAN sends a reply message to the AMF, and correspondingly, the AMF receives the reply message from the RAN.

[0249] As for S701-S709, refer to the foregoing S501-S509, which will not be repeated here.

[0250] S710, the AMF sends a fourth message to the UE, and correspondingly, the UE receives the fourth message from the AMF

[0251] The difference from S510 is that the fourth message in S710 does not include the information of the NF, for example, the fourth message does not include the identification information of the NF, nor the type information of the NF.

[0252] S711, the UE sends a third message to the RAN, which is used to indicate the type of the first NF.

[0253] As for S711, refer to the foregoing related content of S406, which will not be repeated here.

[0254] S712, the RAN determines the first NF according to the type of the first NF, the UE ID, and the type of the NF UE ID / NF.

[0255] S712 specifically refers to the related description in the foregoing S407, which will not be repeated here.

[0256] S713, the RAN sends a third message to the first NF.

[0257] As for S713, refer to the foregoing related content of S407, which will not be repeated here.

[0258] It should be noted that in possible implementation manners, S701-S705 can be executed alone (or only S701-S705 is executed), and S706-S713 is not executed.

[0259] Through the communication method 400C, the UE can forward the information to the NF through the RAN without taking the AMF as an anchor, which can reduce AMF congestion and also realize data isolation of the UE to each NF. In addition, the AMF activates the security context between at least one NF and the UE, so that the UE can encrypt and integrity protect the information according to the security context between the UE and the NF, thereby improving the security between the UE and the NF.

[0260] Example 4: The AMF activates the security context between at least one NF and the UE, and the first message includes a registration request.

[0261] Example 4 differs from example 1 in that the AMF activates the security context between the AMF and the UE after authentication between the AMF and the UE. In this case, when the UE needs to communicate with a certain NF, the UE can request to activate the NF, so that the NF activates the security context between the UE and the NF, so that the UE encrypts the information to be sent based on the security context, thereby improving the security.

[0262] Please refer to FIG. 8, which is a flowchart of the communication method 400D provided by the embodiments of the present application. FIG. 8 introduces the method from the perspective of the interaction between the AMF, the UE, the RAN and the first NF. As shown in FIG. 8, the flow of the communication method 400D includes the following steps.

[0263] S801, the UE sends a registration request to the RAN, and correspondingly the RAN receives the registration request from the UE.

[0264] S802, the RAN sends a first message to the AMF, and the first message includes a NAS message.

[0265] S803, the AMF and the UE complete authentication and authorization.

[0266] S801-S803 are the same as S501-S503, which will not be repeated here.

[0267] S804, the AMF and the UE activate the security context between the AMF and the UE.

[0268] After the AMF and the UE complete authentication and authorization, the SMC process can be started to activate the security context between the AMF and the UE. For example, the AMF can send a NAS security mode command message to the UE, and the NAS security mode command message includes a key identifier. The UE receives the NAS security mode command and can perform corresponding operations. For example, the UE can derive a new encryption key according to the key indicated by the key identifier, and perform corresponding security configuration, such as updating the encryption key. After the UE completes the security configuration, the UE can send a NAS security mode complete message to the AMF to indicate that the security mode control process is complete. Alternatively, the NAS security mode complete message can indicate that the security mode operation has been successfully implemented.

[0269] S805, the AMF sends a second message to the RAN, and correspondingly, the RAN receives the second message from the AMF.

[0270] S806, the RAN sends a first request message to the first NF, and correspondingly, the first NF receives the first request message from the RAN.

[0271] S807, the first NF sends a first response message to the RAN, and correspondingly, the RAN receives the first response message from the first NF.

[0272] S808, the RAN sends a reply message to the AMF, and correspondingly, the AMF receives the reply message from the RAN.

[0273] S809, the AMF sends a fourth message to the UE, and correspondingly, the UE receives the fourth message from the AMF.

[0274] As for S805-S809, refer to S506-S510, which will not be repeated here. S801-S809 are not necessarily executed steps, and thus, are illustrated in dashed lines in FIG. 8. In addition, when S801-S804 are executed, S805-S816 can also not be executed.

[0275] S810, the UE sends a seventh message to the first NF, which can be used to request to activate the first NF.

[0276] The first NF activates the security context between the UE and the first NF. When the UE wants to communicate with the first NF, the first NF can be requested to activate the NF for security enhancement. For example, the UE sends a seventh message to the first NF, which can be used to request to activate the NF, and the first NF sends a security mode command message to activate the security context between the UE and the first NF. The specific name of the seventh message is not limited in the embodiments of the present application. The seventh message can include a UE ID, so that the first NF can explicitly activate the security context between which UE and the first NF.

[0277] S811, the first NF determines a key identifier, which can be used to activate the security context between the UE and the first NF.

[0278] The first NF determines the key identifier includes that the first NF obtains the key identifier, which is associated with a set of security contexts and can be used to activate the security context between the UE and the first NF. After receiving the seventh message, the first NF can obtain the base key between the UE and the first NF from the AMF according to the UE ID. The first NF deduces the encryption key for activating the security context between the UE and the first NF according to the base key.

[0279] S812, the first NF sends a security mode command message to the UE, and correspondingly, the UE receives the security mode command message from the first NF.

[0280] The security mode command message can include a key identifier and information of the first NF, used to activate a security context between the terminal device and the first NF. The key identifier can indicate a cipher key derived by the first NF. The security mode command message can also include a security algorithm of the UE to the first NF.

[0281] S813, the UE activates the security context between the UE and the first NF according to the key identifier and the information of the first NF.

[0282] The information of the first NF includes type information of the first NF. The UE can activate the security context between the UE and the first NF according to the cipher key indicated by the key identifier.

[0283] S814, the UE sends a security mode complete message to the first NF, and correspondingly, the first NF receives the security mode complete message from the UE.

[0284] The security mode complete message is used to indicate that the security mode control procedure is completed. Optionally, the security mode complete message includes information of the first NF, used to indicate that the security context between the UE and the first NF is activated.

[0285] S815, the UE sends a third message to the RAN, and correspondingly, the RAN receives the third message from the UE.

[0286] S816, the RAN sends the third message to the first NF, and correspondingly, the first NF receives the third message from the RAN.

[0287] S815 and S816 can refer to the foregoing S406 and S407, which will not be described here.

[0288] Through the communication method 400D, the UE can forward the information to the NF through the RAN, without taking the AMF as an anchor point, so as to reduce the congestion of the AMF, and also to realize data isolation of the UE to each NF. In addition, the AMF activates the context between the AMF and the UE, so that the AMF and the UE obtain a basic key. In this case, other NFs can obtain a key from the AMF, derive a cipher key based on the key, and use the cipher key to activate the security context between the NF and the UE. In this way, when the UE needs to communicate with a certain NF, the UE can request to activate the NF, so that the NF can activate the security context with the UE, and thus encrypt and integrity protect the information using the security context.

[0289] In the communication method 400, the AMF triggers the RAN to establish or create a connection to the at least one NF based on the first message. Alternatively, the AMF can also trigger the RAN to establish or create a connection to the at least one NF based on a trigger of the UE. Details are described below with reference to the accompanying drawings.

[0290] Referring to FIG. 9, a flowchart of a communication method 900 provided by an embodiment of the present application is shown. FIG. 9 describes the method from the perspective of the interaction between the AMF, the UE, the RAN, and the first NF. The processing performed by a single execution subject can also be divided into processing performed by multiple execution subjects, which can be logically and / or physically separated. For example, the processing performed by the access network device can be divided into processing performed by at least one of the CU, the DU, the RU, and the like.

[0291] As shown in FIG. 9, the flow of the communication method 900 includes the following steps.

[0292] S901, the AMF sends a fourth message to the UE, and accordingly, the UE receives the fourth message from the AMF.

[0293] The fourth message can include information of the first NF, for example, the fourth message includes type information of the first NF and / or identification information of the first NF. Thus, the UE can determine the NF to which the UE has established a connection according to the fourth message, so as to facilitate the UE to determine which NF or which NFs to send the third message to subsequently.

[0294] S902, the UE sends a fifth message to the AMF, and accordingly, the AMF receives the fifth message from the UE.

[0295] The fifth message can be used to request to establish a connection between the UE and the first NF, and there is no NAS signaling connection between the UE and the first NF. The specific name of the fifth message is not limited in the embodiments of the present application. The fifth message can include information of the first NF, so that the AMF determines that the NF to which the UE needs to establish a connection is the first NF. The information of the first NF can be identification information of the first NF, or can be type information of the first NF. If the fourth message includes the identification information of the first NF, the information of the first NF in the fifth message can be the identification information of the first NF. If the fourth message includes the type information of the first NF, the information of the first NF in the fifth message can be the type information of the first NF.

[0296] S903, the AMF sends a second message to the RAN, and accordingly, the RAN receives the second message from the AMF.

[0297] S903 can refer to the related description of the preceding S402. The difference between S903 and the second message in S402 is that the second message in S903 can include information of the first NF. The repeated parts of S903 and S402 are not described herein.

[0298] S904, the RAN sends a first request message to the first NF, where the first request message can be used to request to establish a connection with the first NF.

[0299] S904 can refer to the related description of the preceding S403. The repeated parts are not described herein.

[0300] S905, the first NF sends a first response message to the RAN, where the first response message is used to indicate that the connection between the first NF and the RAN is established.

[0301] S905 can refer to the related description of the preceding S404. The repeated parts are not described herein.

[0302] S906, the RAN sends a reply message to the AMF, and accordingly, the AMF receives the reply message from the RAN.

[0303] S906 can refer to the related description of the preceding S509. The repeated parts are not described herein.

[0304] S907, the AMF sends a sixth message to the UE, and accordingly, the UE receives the sixth message from the AMF.

[0305] The sixth message can be a reply message of the fifth message, and is used to indicate that the first NF establishes the connection. The sixth message can include information of the first NF. For example, the sixth message includes type information of the first NF or identification information of the first NF.

[0306] S908, the UE sends a third message to the RAN, and accordingly, the RAN receives the third message from the UE.

[0307] S909, the RAN sends the third message to the first NF, and accordingly, the first NF receives the third message from the RAN.

[0308] S908 and S909 can refer to the preceding S406 and S407. The repeated parts are not described herein.

[0309] Through the communication method 900, the UE can forward information to the NF through the RAN, without using the AMF as an anchor point, which can reduce AMF congestion, and also can realize data isolation of the UE to each NF. In addition, the UE requests the AMF to establish a connection with the first NF according to actual needs, which can reduce unnecessary NF connections, and is beneficial to saving signaling overhead.

[0310] The communication method 900 can be combined with any of the two solutions of activating the security context between the UE and the NF described above. For the convenience of understanding, the communication method 900 is further introduced in the specific examples below.

[0311] Example 5: The AMF activates the security context between at least one NF and the UE.

[0312] Referring to FIG. 10, a flowchart of the communication method 900A provided by the embodiments of the present application is shown. FIG. 10 introduces the method from the perspective of the interaction of the AMF, the UE, the RAN and the first NF. As shown in FIG. 10, the flow of the communication method 900A includes the following steps.

[0313] S1001, the UE sends a registration request to the RAN, and correspondingly, the RAN receives the registration request from the UE.

[0314] S1002, the RAN sends a first message to the AMF, and the first message includes a NAS message.

[0315] S1003, the AMF and the UE complete the authentication and authorization.

[0316] S1004, the AMF selects at least one NF according to the capability information of the UE.

[0317] S1005, the AMF and the UE activate the security context between at least one NF and the UE.

[0318] S1001-S1005 are the same as S501-S505, which will not be repeated here.

[0319] S1006, the AMF sends a fourth message to the UE, and correspondingly, the UE receives the fourth message from the AMF.

[0320] For S1006, refer to the related description in the foregoing S901, which will not be repeated here.

[0321] S1007, the UE sends a fifth message to the AMF, and correspondingly, the AMF receives the fifth message from the UE.

[0322] S1007 is the same as S902, which will not be repeated here.

[0323] S1008, the AMF sends a second message to the RAN, and correspondingly, the RAN receives the second message from the AMF.

[0324] S1009, the RAN sends a first request message to the first NF, and the first request message can be used to request to establish a connection with the first NF.

[0325] S1010, the first NF sends a first response message to the RAN, the first response message being used to indicate that the connection establishment between the first NF and the RAN is completed.

[0326] S1011, the RAN sends a reply message to the AMF, and correspondingly, the AMF receives the reply message from the RAN.

[0327] S1012, the AMF sends a sixth message to the UE, and correspondingly, the UE receives the sixth message from the AMF.

[0328] S1013, the UE sends a third message to the RAN, and correspondingly, the RAN receives the third message from the UE.

[0329] S1014, the RAN sends the third message to the first NF, and correspondingly, the first NF receives the third message from the RAN.

[0330] S1008-S1014 are the same as S903-S909, and details are not repeated here.

[0331] It should be noted that in the possible implementation, S1001-S1005 (or only S1001-S1005) can be executed alone, and S1006-S1014 is not executed.

[0332] Example 6: The AMF activates the security context between the AMF and the UE.

[0333] Example 6 differs from example 5 in that the AMF activates the security context between the AMF and the UE after the authentication and authorization between the AMF and the UE. In this case, when the UE needs to communicate with a certain NF, the NF can be requested to activate the security context between the UE and the NF, so that the UE encrypts the information to be sent based on the security context, thereby improving security.

[0334] Please refer to FIG. 11, which is a flowchart of a communication method 900B provided by the embodiments of the present application. FIG. 11 introduces the method from the perspective of the interaction between the AMF, the UE, the RAN and the first NF. As shown in FIG. 11, the flow of the communication method 900B includes the following steps.

[0335] S1101, the UE sends a registration request to the RAN, and correspondingly, the RAN receives the registration request from the UE.

[0336] S1102, the RAN sends a first message to the AMF, the first message including a NAS message.

[0337] S1103, the AMF and the UE complete authentication and authorization.

[0338] S1101-S1103 refer to S501-S503, and details are not repeated here.

[0339] S1104, the AMF and the UE activate the security context of the AMF and the UE.

[0340] S1104 refers to S804, and details are not repeated here.

[0341] S1105, the AMF sends a fourth message to the UE, and correspondingly, the UE receives the fourth message from the AMF.

[0342] S1105 can refer to the related description in the foregoing S901, and details are not repeated here.

[0343] S1106, the UE sends a fifth message to the AMF, and correspondingly, the AMF receives the fifth message from the UE.

[0344] S1106 refers to S902, and details are not repeated here.

[0345] S1107, the AMF sends a second message to the RAN, and correspondingly, the RAN receives the second message from the AMF.

[0346] S1108, the RAN sends a first request message to the first NF, and the first request message can be used to request to establish a connection with the first NF.

[0347] S1109, the first NF sends a first response message to the RAN, and the first response message is used to indicate that the connection establishment between the first NF and the RAN is completed.

[0348] S1110, the RAN sends a reply message to the AMF, and correspondingly, the AMF receives the reply message from the RAN.

[0349] S1111, the AMF sends a sixth message to the UE, and correspondingly, the UE receives the sixth message from the AMF.

[0350] S1107-S1111 refer to S1008-S1012, and details are not repeated here.

[0351] S1112, the UE sends a seventh message to the first NF, and the seventh message can be used to request to activate the first NF.

[0352] S1113, the first NF determines a key identifier, and the key identifier can be used to activate the security context between the UE and the first NF.

[0353] S1114, the first NF sends a security mode command message to the UE, and correspondingly, the UE receives the security mode command message from the first NF.

[0354] S1115. The UE activates a security context between the UE and the first NF according to the key identifier and the information of the first NF.

[0355] S1116. The UE sends a security mode complete message to the first NF, and correspondingly, the first NF receives the security mode complete message from the UE.

[0356] S1112-S1116 are the same as S810-S814, and details are not repeated here.

[0357] S1117. The UE sends a third message to the RAN, and correspondingly, the RAN receives the third message from the UE.

[0358] S1118. The RAN sends the third message to the first NF, and correspondingly, the first NF receives the third message from the RAN.

[0359] S1117-S1118 are the same as S908-S909, and details are not repeated here.

[0360] It should be noted that S1101-S1111 are not necessarily executed steps, that is, in the communication method 900B, S1101-S1111 can not be executed.

[0361] The embodiment of the application further provides a communication method. Through the method, the connection relationship of NF granularity can be realized, which is beneficial to save resources and improve resource rate.

[0362] Please refer to FIG. 12, which is a flowchart of a communication method 1200 provided by the embodiment of the application. FIG. 12 introduces the method from the perspective of the interaction of the UE, the RAN and the first NF. The processing performed by a single execution subject can also be divided into processing performed by multiple execution subjects, which can be logically and / or physically separated. For example, the processing performed by the access network device can be divided into processing performed by at least one of the CU, the DU, the RU, etc.

[0363] As shown in FIG. 12, the flow of the communication method 1200 includes the following steps.

[0364] S1201. The first NF sends a release message to the RAN, and correspondingly, the RAN receives the release message from the first NF.

[0365] The release message can be used to request to release the connection between the UE and the first NF. The release message can include the information of the first NF.

[0366] S1202. If the UE is still connected with the second NF, the RAN releases the connection between the first NF.

[0367] If the UE is connected to more than the first NF, for example, the UE is also connected to a second NF. In this case, when the first NF requests the RAN to release the connection between the UE and the first NF, the RAN can release the connection between the UE and the first NF to release as many unnecessary connections as possible and save resources. Otherwise, S1205 can be performed, i.e., if the UE is connected to only the first NF, when the first NF requests the RAN to release the connection between the UE and the first NF, the RAN can release not only the connection between the UE and the first NF but also the RRC connection of the UE to release as many connections as possible and save resources.

[0368] S1203, the RAN sends a first message to the UE, and correspondingly, the UE receives the first message from the RAN.

[0369] The first message includes information of the first NF and is used to instruct the UE to release the connection to the first NF. After the RAN releases the connection with the first NF, the first message can be sent to the UE to make the UE explicitly disconnect from the first NF, so as to avoid the UE from sending information to the first NF and causing waste of signaling. It should be noted that S1202 and S1203 can be one step.

[0370] S1204, the UE records that the first NF is in an idle state or an inactive state.

[0371] When the connection between the UE and the first NF is released, the UE can record that the first NF is in an idle state or an inactive state, so that when the UE needs to communicate with the first NF, the UE can establish a connection with the first NF again, thereby avoiding the UE from sending information to the first NF and causing waste of signaling.

[0372] S1205, if the UE is connected to only the first NF, the RAN releases the connection with the first NF and releases the RRC connection of the UE.

[0373] S1206, the RAN sends a second message to the UE, and correspondingly, the UE receives the second message from the RAN.

[0374] When the RAN releases the RRC connection of the UE, the second message can be sent to the UE, and the second message can be used to instruct the UE to release the connection with the RAN. S1205 and S1206 can be one step.

[0375] S1207, the UE records that all NFs are in an idle state or an inactive state.

[0376] When the connection between the UE and the RAN is released, the UE can record that all NFs are in an idle state or an inactive state, so that when the UE needs to communicate with a certain NF, the UE can establish a connection with the NF again, thereby avoiding the UE from sending information to the NF and causing waste of signaling.

[0377] It should be noted that S1202-S1204 are executed, and S1205-S1207 are not executed; or S1205-S1207 are executed, and S1202-S1204 are not executed. FIG. 12 takes S1205-S1207 as an example, and takes a dashed line to schematically show that S1205-S1207 are not executed.

[0378] Optionally, the NF is not allowed to initiate connection release, and only the RRC connection release is allowed.

[0379] Optionally, when the NF initiates connection release, the RAN can release the connection of all associated NFs.

[0380] The above embodiments of the present application provide a method, which is described by taking a terminal device, an access network device, a first network element, and a first NF as examples. In the present application, each embodiment can be independently implemented or implemented based on certain internal relationship; different implementation manners in each embodiment can be combined or independently implemented. In order to implement each function in the above method provided by the embodiments of the present application, the steps executed by each subject can be implemented by the subject itself, or can be implemented by a functional entity including the subject, or can be implemented by different functional entities constituting the subject. For example, the steps executed by the access network device can be implemented by the network device itself, or can be implemented by different functional entities constituting the access network device, or can be implemented by a functional entity including the access network device. For example, the network access network is an access network device, which can be a CU-DU-RU architecture, the DU can generate the first message, and the RU can send the first message. In order to implement each function in the above method provided by the embodiments of the present application, the terminal device and the network device can include a hardware structure and / or a software module, and the above functions are implemented in the form of hardware structure, software module, or hardware structure plus software module. Whether a certain function in the above functions is implemented in the form of hardware structure, software module, or hardware structure plus software module depends on the specific application and design constraints of the technical solution.

[0381] Based on the same inventive concept as the method embodiments, the embodiments of the present application provide a communication device. The communication device used to implement the above method in the embodiments of the present application is described below with reference to the accompanying drawings. The above content can be used in the subsequent embodiments, and the repeated content will not be described again.

[0382] FIG. 13 is a schematic block diagram of a communication apparatus 1300 provided in embodiments of the present application. The communication apparatus 1300 can correspond to implement the functions or steps implemented by the terminal device in the above-described various method embodiments. For example, the communication apparatus 1300 can be the UE in FIG. 1; or the communication apparatus 1300 is a chip (system) in the UE; or the communication apparatus 1300 is a software module of the UE. Or the communication apparatus 1300 can correspond to implement the functions or steps implemented by the access network device in the above-described various method embodiments. For example, the communication apparatus 1300 can be the RAN in FIG. 1; or the communication apparatus 1300 is a chip (system) in the RAN; or the communication apparatus 1300 is a software module of the RAN. Or the communication apparatus 1300 can correspond to implement the functions or steps implemented by the first network element in the above-described various method embodiments. For example, the communication apparatus 1300 can be the AMF in FIG. 1; or the communication apparatus 1300 is a chip (system) in the AMF; or the communication apparatus 1300 is a software module of the AMF. Or the communication apparatus 1300 can correspond to implement the functions or steps implemented by the first NF in the above-described various method embodiments. For example, the communication apparatus 1300 can be the SMF in FIG. 1; or the communication apparatus 1300 is a chip (system) in the SMF; or the communication apparatus 1300 is a software module of the SMF.

[0383] The communication apparatus 1300 can include a processing module 1310 and a transceiver module 1320. Optionally, it can also include a storage module, which can be used to store instructions (codes or programs) and / or data. The storage module can be, for example, a memory. The processing module 1310 and the transceiver module 1320 can be coupled with the storage module. For example, the processing module 1310 can read the instructions (codes or programs) and / or data in the storage module to implement the corresponding method. When the communication apparatus 1300 is a chip in a terminal device (or an access network device or a core network device), the storage module can be a storage module in the chip, such as a register, a cache, etc. For example, the storage module can also be a storage module outside the chip in the terminal device (or the access network device or the core network device), such as a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM), etc. The above-described various units can be independently arranged, or partially or entirely integrated.

[0384] The processing module 1310 can be a processor or a controller, for example, a general-purpose central processing unit (CPU), a general-purpose processor, a digital signal processing (DSP), an application specific integrated circuits (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It can implement or execute the various exemplary logical blocks, modules and circuits described in combination with the disclosure. The processor can also be a combination of computing functions, such as one or more microprocessor combinations, combinations of DSP and microprocessor, and the like. The transceiver module 1320 is a transceiver, interface circuit, bus, pin or other possible communication interface for receiving signals from other devices. For example, when the device is implemented in the form of a chip, the transceiver module 1320 is an interface circuit of the chip for receiving signals from other chips or devices, or is an interface circuit of the chip for transmitting signals to other chips or devices.

[0385] In an implementation manner, the communication device 1300 can correspondingly implement the behaviors and functions of the RAN in the above method embodiments. The communication device 1300 can be an access network device, can be a component (such as a chip or circuit) in the access network device, can be a part of a chip or chip set in the access network device for executing related method functions, or can be a software module in the access network device capable of implementing the above communication method, without limitation. For details, reference can be made to the related contents of the above method embodiments, which will not be described here.

[0386] For example, the transceiver module 1320 is configured to send a first message to a first network element, receive a second message from the first network element, and send a first request message to a first NF. The first message includes a NAS message. The second message is used to request the communication device 1300 to establish a connection between the terminal device and at least one NF. The second message includes identification information of the at least one NF or type information of the at least one NF. The first request message includes a first identifier and identification information of the terminal device, and is used to request to establish a connection with the first NF. The first identifier is a unique identifier allocated by the communication device 1300 to the terminal device. The first NF belongs to the at least one NF.

[0387] As an optional implementation manner, the NAS message includes information of the NF, and the number of the information of the NF can be multiple. The NAS message is used to request to establish a connection between the terminal device and the NF. The information of the NF includes type information of the NF or identification information of the NF.

[0388] As an optional implementation, the first message further includes identification information of the terminal device and the first identifier.

[0389] As an optional implementation, the transceiver 1320 is further configured to receive a first response message from the first NF, the first response message including the first identifier and a second identifier. The second identifier is a unique identifier allocated to the terminal device by the first NF. The first response message is used to indicate that the connection establishment between the first NF and the communication apparatus 1300 is completed.

[0390] As an optional implementation, the second message further includes the first identifier and a third identifier, the third identifier being a unique identifier allocated to the terminal device by the first network element.

[0391] As an optional implementation, the transceiver 1320 is further configured to receive a third message from the terminal device, and transmit the third message to the first NF. The third message is used to indicate the identifier of the first NF or the type of the first NF.

[0392] As an optional implementation, before transmitting the third message to the first NF, the transceiver 1320 is further configured to determine the first identifier according to the identification information of the terminal device, determine the second identifier according to the first identifier and the information of the first NF, and determine the first NF according to the second identifier.

[0393] For another example, the transceiver 1320 is configured to receive a release message from the first NF. The release message is used to request to release the connection between the terminal device and the first NF. The processing module 1310 is configured to release the connection between the communication apparatus 1300 and the first NF if the terminal device is still connected with the second NF. The transceiver 1320 is further configured to transmit a first message to the terminal device. The first message includes the information of the first NF, and is used to indicate the terminal device to release the connection to the first NF.

[0394] As an optional implementation, the processing module 1310 is further configured to release the connection between the first NF and the radio access network, and release the RRC connection of the terminal device if the terminal device is only connected with the first NF. The transceiver 1320 is further configured to transmit a second message to the terminal device. The second message is used to indicate the terminal device to release the connection with the communication apparatus 1300.

[0395] As an optional implementation, the information of the first NF includes the type information of the first NF or the identifier information of the first NF.

[0396] In an implementation, the communication apparatus 1300 can correspond to implement the behaviors and functions of a first NF (e.g., an AMF) in the above method embodiments. The communication apparatus 1300 can be an AMF, or a component (e.g., a chip or circuit) in the AMF, or a part of a chip or chip set in the AMF for performing the related method functions, or a software module in the AMF capable of implementing the above communication method, without limitation. Details can be referred to the related content of the above method embodiments, which will not be repeated here.

[0397] For example, the transceiver 1320 is configured to receive a first message, and send a second message to an access network device in response to the first message. The first message includes a NAS message. The second message is used to request the access network device to establish a connection between the terminal device and at least one NF, and the second message includes identification information of the at least one NF or type information of the at least one NF.

[0398] As an optional implementation, the NAS message includes information of the NF, and the NAS message is used to request to establish a connection between the terminal device and the NF. The information of the NF includes type information of the NF or identification information of the NF.

[0399] As an optional implementation, the first message further includes identification information of the terminal device and a first identifier, and the first identifier is a unique identifier allocated by the access network device for the terminal device.

[0400] As an optional implementation, the second message further includes the first identifier and / or a third identifier, and the third identifier is a unique identifier allocated by the communication apparatus 1300 for the terminal device.

[0401] As an optional implementation, the transceiver 1320 is further configured to send a fourth message to the terminal device, and the fourth message includes the type information of the NF, and is used to indicate that the NF corresponding to the type information has established a connection with the terminal device. Or,

[0402] As an optional implementation, the transceiver 1320 is further configured to send a fourth message to the terminal device, and the fourth message includes the identification information of the NF, and is used to indicate that the NF has established a connection with the terminal device.

[0403] As an optional implementation, before sending the second message to the access network device in response to the first message, the transceiver 1320 is further configured to send a security mode command message to the terminal device, and receive a security mode complete message from the terminal device. The security mode command message includes a key identifier and information of at least one NF, and is used to activate a security context of the terminal device to the at least one NF. The security mode complete message is used to indicate that a security mode control procedure is completed.

[0404] As an optional implementation, the security mode complete message includes information of the first NF, for indicating that the security context of the terminal device and the first NF is activated.

[0405] As an optional implementation, the security mode command message includes information of security algorithms between the terminal device and each NF.

[0406] In an implementation, the communication apparatus 1300 can correspondingly implement the behaviors and functions of the UE in the above method embodiments. The communication apparatus 1300 can be the UE, or a component (for example, a chip or circuit) in the UE, or a part of a chip or chip set in the UE for performing related method functions, or a software module in the UE capable of implementing the above communication method, without limitation. For details, reference can be made to the related content of the foregoing method embodiments, which will not be described here again.

[0407] For example, the transceiver module 1320 is configured to send a fifth message to the first network element, the fifth message including information of the first NF, for requesting to establish a connection between the communication apparatus 1300 and the first NF. Wherein, the communication apparatus 1300 and the first NF do not have a NAS signaling connection.

[0408] As an optional implementation, the transceiver module 1320 is further configured to receive a sixth message from the first network element, the sixth message including information of the first NF, for indicating that the first NF establishes the connection.

[0409] As an optional implementation, the information of the first NF includes identification information of the first NF or type information of the first NF.

[0410] As an optional implementation, before sending the fifth message to the first network element, the transceiver module 1320 is further configured to receive a fourth message from the first network element, the fourth message including information of at least one NF, the at least one NF including the first NF.

[0411] As an optional implementation, before receiving the fourth message from the first network element, the transceiver module 1320 is further configured to receive a security mode command message from the first network element, and send a security mode complete message to the first network element. The security mode command message includes a key identifier and information of at least one NF, for activating a security context of the communication apparatus 1300 to the at least one NF. The security mode complete message is for indicating that the security mode control procedure is completed.

[0412] As an optional implementation, the security mode complete message includes information of the first NF, for indicating that the security context of the communication apparatus 1300 and the first NF is activated.

[0413] As an optional implementation, the security mode command message comprises information of a security algorithm between the communication apparatus 1300 and the first NF.

[0414] For another example, the transceiver 1320 is configured to send a seventh message to the first NF, receive a security mode command message sent by the first NF, and activate a security context between the communication apparatus 1300 and the first NF based on the information of the first NF. The seventh message is used to request to activate the first NF. The security mode command message comprises a key identifier and the information of the first NF, and is used to activate the security context between the communication apparatus 1300 and the first NF.

[0415] As an optional implementation, the security mode command message comprises a security algorithm between the communication apparatus 1300 and the first NF.

[0416] As an optional implementation, the transceiver 1320 is further configured to send a security mode complete message to the first network element, and the security mode complete message is used to indicate that the security mode control procedure is completed.

[0417] As an optional implementation, the security mode complete message comprises the information of the first NF, and is used to indicate that the security context between the communication apparatus 1300 and the first NF is activated.

[0418] For another example, the transceiver 1320 is configured to receive a first message from the access network device, and the first message comprises identification information or type information of the first NF, and is used to indicate that the connection between the communication apparatus 1300 and the first NF is released. The processing module 1310 is configured to record, according to the first message, that the first NF is in an idle state.

[0419] For another example, the transceiver 1320 is configured to receive a second message from the access network device, and the second message is used to indicate that the connection between the communication apparatus 1300 and the access network device is released. The processing module 1310 is configured to record, according to the second message, that all the NFs are in an idle state.

[0420] In an implementation, the communication apparatus 1300 can correspondingly implement the behaviors and functions of the first NF in the above method embodiments. The communication apparatus 1300 can be the first NF, or a component (such as a chip or a circuit) in the first NF, or a part of a chip or a chip set in the first NF for executing related method functions, or a software module in the first NF capable of implementing the above communication method, without limitation. For details, reference can be made to related contents in the foregoing method embodiments, which will not be repeated here.

[0421] For example, the transceiver module 1320 is configured to receive a seventh message from the terminal device, and transmit a security mode command message to the terminal device. The seventh message is used to request to activate the communication apparatus 1300. The security mode command message includes a key identifier and information of the communication apparatus 1300, and is used to activate a security context between the terminal device and the communication apparatus 1300.

[0422] In an implementation manner, the security mode command message includes a security algorithm of the terminal device to the communication apparatus 1300.

[0423] When the communication apparatus 1300 is a chip type device or circuit, the transceiver module can be an input / output circuit and / or a communication interface; and the processing module can be an integrated processor or microprocessor or integrated circuit.

[0424] FIG. 14 is a schematic block diagram of a communication apparatus 1400 provided in an embodiment of the present application. The communication apparatus 1400 can be a UE, a RAN device, an AMF or a first NF (such as an SMF) in the above-described embodiments. For example, the communication apparatus 1400 can be a UE or a chip (system) in the UE in FIG. 1. For another example, the communication apparatus 1400 can be a RAN device or a chip (system) in the RAN device in FIG. 1. For another example, the communication apparatus 1400 can be an AMF or a chip (system) in the AMF in FIG. 1. For another example, the communication apparatus 1400 can be an SMF or a chip (system) in the SMF in FIG. 1. In an embodiment of the present application, the chip system can be composed of a chip, or can include a chip and other discrete devices. For specific functions, refer to the description in the method embodiments.

[0425] The communication apparatus 1400 includes one or more processors 1401 configured to implement or support implementation of the function of the UE, the RAN device, the AMF or the first NF in the method provided in an embodiment of the present application. For specific descriptions, refer to the detailed description in the method embodiments, which will not be repeated here. The processor 1401 can also be referred to as a processing unit or a processing module, and can implement certain control functions. The processor 1401 can be a general purpose processor or a special purpose processor. For example, it includes a baseband processor, a central processing unit, an application processor, a modem processing unit, a graphics processing unit, an image signal processor, a digital signal processor, a video coding and decoding processor, a controller, a memory, and / or a neural network processing unit, etc. The baseband processor can be configured to process communication protocols and communication data. The central processing unit can be configured to control the communication apparatus 1400 (such as a terminal device or a network device), execute software programs and / or process data. Different processors can be independent devices, or can be integrated into one or more processors, for example, integrated into one or more application specific integrated circuits.

[0426] In one design, the processor 1401 can include a program 1403 (which can also be referred to as code or instructions at times) that can be run on the processor 1401 to cause the communication apparatus 1400 to perform the methods described in the following embodiments. In yet another possible design, the communication apparatus 1400 includes circuitry (not shown in FIG. 14) to implement the functions of a UE, a RAN device, an AMF, or a first NF in the above-described embodiments.

[0427] In one design, the communication apparatus 1400 can include one or more memories 1402 having a program 1404 (which can also be referred to as code or instructions at times) stored thereon that can be run on the processor 1401 to cause the communication apparatus 1400 to perform the methods described in the above-described method embodiments.

[0428] In one design, the processor 1401 and / or the memory 1402 can include an artificial intelligence (AI) module 1407, which can be used to implement AI-related functions. The AI module can be implemented in software, hardware, or a combination of software and hardware. For example, the AI module can include a RAN intelligent controller (RIC) module. The AI module can be a near-real-time RIC or a non-real-time RIC, for example.

[0429] In one possible design, the processor 1401 and / or the memory 1402 can also store data. The processor and the memory can be separately arranged or integrated together.

[0430] In one possible design, when the communication apparatus 1400 is a UE or a RAN device, the communication apparatus 1400 can further include a transceiver 1405 and / or an antenna 1406. The processor 1401 can also be referred to as a processing unit and can control the communication apparatus 1400. The transceiver 1405 can also be referred to as a transceiving unit, a transceiver, a transceiving circuit, or a transceiver, and can be used to implement the transceiving functions of the communication apparatus 1400 through the antenna 1406.

[0431] In a possible design, the communication apparatus 1400 can further include one or more of the following components: a wireless communication module, an audio module, an external storage interface, an internal storage, a universal serial bus (USB) interface, a power management module, an antenna, a speaker, a microphone, an input / output module, a sensor module, a motor, a camera, or a display screen, etc. It can be understood that, in some embodiments, the communication apparatus 1400 can include more or less components, or some components can be integrated, or some components can be split into multiple components. These components can be implemented by hardware, software, or a combination of hardware and software.

[0432] The communication apparatus in the above embodiments can be a UE, a RAN device, an AMF, or a first NF, can also be a circuit, and can also be a chip or other combination device, component, etc. applied to the UE, the RAN device, the AMF, or the first NF. When the communication apparatus is a UE or a RAN device, the transceiver can be a transceiver, and can include an antenna and a radio frequency circuit, etc. The processor can be a processor, for example, a CPU. When the communication apparatus is a chip system, the communication apparatus can be an FPGA, can be a special ASIC, can also be a SoC, can also be a CPU, can also be a network processor (NP), can also be a DSP, can also be a micro controller unit (MCU), can also be a programmable logic device (PLD) or other integrated chip. The processor can be a processor of the chip system. The transceiver or the communication interface can be an input / output interface or an interface circuit of the chip system. For example, the interface circuit can be a code / data read / write interface circuit. The interface circuit can be used to receive code instructions (the code instructions are stored in a memory, can be directly read from the memory, or can also be read from the memory through other devices) and transmit to the processor. The processor can be used to run the code instructions to perform the methods in the above method embodiments. For another example, the interface circuit can also be a signal transmission interface circuit between a communication processor and a transceiver.

[0433] The embodiments of the present application further provide a communication system, which includes at least one terminal device, at least one RAN device, a first network element, and a first NF. The terminal device, the RAN device, the first network element, and the first NF are devices used to implement the functions related to the above communication method.

[0434] The embodiments of the present application further provide a computer readable storage medium, which includes instructions, when running on a computer, causing the computer to perform the method performed by the UE, the RAN device, the AMF, or the first NF in the above communication method.

[0435] The embodiments of the present application further provide a computer program product, including computer program codes, which, when executed, cause a computer to perform the method executed by the UE, the RAN device, the AMF or the first NF in the above-mentioned communication method.

[0436] The embodiments of the present application provide a chip system, which includes a processor and can further include a memory, for realizing the functions of the UE, the RAN device, the AMF or the first NF in the above-mentioned communication method. The chip system can be composed of a chip or can contain a chip and other discrete devices.

[0437] In order to realize the functions of the communication apparatus in FIG. 13 and FIG. 14, the embodiments of the present application further provide a chip, including a processor, for supporting the communication apparatus to realize the functions involved by the UE, the RAN device, the AMF or the first NF in the above-mentioned method embodiments. In a possible design, the chip is connected with a memory or the chip includes the memory, which is used to save the computer programs or instructions and data necessary for the communication apparatus.

[0438] It should be understood that, in various embodiments of the present application, the size of the serial number of each process does not mean the order of execution, and the execution order of each process should be determined according to its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0439] Those of ordinary skill in the art can realize that the various illustrative logical blocks and steps described in connection with the embodiments disclosed herein can be implemented by electronic hardware, or a combination of computer software and electronic hardware. Whether the functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0440] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-mentioned system, apparatus and unit can refer to the corresponding processes in the above-mentioned method embodiments, which will not be described here.

[0441] In several embodiments provided in the present application, it should be understood that the disclosed system, device and method can be implemented in other manners. For example, the described device embodiments are merely schematic. For example, the division of the units is only a logical function division. There can be another division manner for the actual implementation, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections between the units can be indirect couplings or communication connections through some interfaces, devices or units, and can be in electrical, mechanical or other forms.

[0442] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, i.e., can be located in one place, or can be distributed on multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0443] If the functions are implemented in the form of software function units and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the part of the technical solutions of the present application that essentially contributes or the part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a ROM, a RAM, a magnetic disk or an optical disk, and various program code storage media.

[0444] Obviously, those skilled in the art can make various modifications and variations to the present application without departing from the scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalent technologies, the present application also intends to include these modifications and variations.

Claims

1. A communication method characterized by comprising: Comprising: sending a first message to a first network element, the first message comprising a non-access stratum (NAS) message; receiving a second message from the first network element, the second message being used to request an access network device to establish a connection between the access network device and at least one network function (NF), the second message comprising identification information of the at least one NF or type information of the at least one NF; sending a first request message to a first NF, the first request message comprising a first identifier and identification information of a terminal device, the first identifier being a unique identifier allocated to the terminal device by the access network device, the first NF belonging to the at least one NF, the first request message being used to request the first NF to establish a connection with the terminal device.

2. The method of claim 1, wherein, The NAS message comprises information of an NF, the NAS message being used to request to establish a connection between a terminal device and the NF, the information of the NF comprising type information of the NF or identification information of the NF.

3. The method of claim 1 or 2, wherein, The first message further comprises identification information of the terminal device and the first identifier.

4. The method of any one of claims 1-3, wherein, The method further comprises: receiving a first response message from the first NF, the first response message comprising the first identifier and a second identifier, the second identifier being a unique identifier allocated to the terminal device by the first NF, the first response message being used to indicate that the connection between the first NF and the access network device is established.

5. The method of any one of claims 1-4, wherein, The second message further comprises the first identifier and a third identifier, the third identifier being a unique identifier allocated to the terminal device by the first network element.

6. The method of any one of claims 1-5, wherein, The method further comprises: receiving a third message from the terminal device, the third message being used to indicate the identification of the first NF or the type of the first NF; sending the third message to the first NF.

7. The method of claim 6, wherein, When the third message is used to indicate the type of the first NF, the method further comprises, before sending the third message to the first NF: determining the first identifier according to the identification information of the terminal device; determining the second identifier according to the first identifier and the information of the first NF; determining the first NF according to the second identifier.

8. A communication method characterized by comprising: Comprising: receiving a first message, the first message comprising a non-access stratum (NAS) message; sending a second message to an access network device in response to the first message, the second message being used to request the access network device to establish a connection between the access network device and at least one network function (NF), the second message comprising identification information of the at least one NF or type information of the at least one NF.

9. The method of claim 8, wherein, The NAS message comprises information of an NF, the NAS message being used to request to establish a connection between a terminal device and the NF, the information of the NF comprising type information of the NF or identification information of the NF.

10. The method of claim 8, wherein, The first message further comprises identification information of the terminal device and a first identifier, the first identifier being a unique identifier allocated to the terminal device by the access network device.

11. The method of any one of claims 8-10, wherein, The second message further comprises the first identifier and / or a third identifier, the third identifier being a unique identifier allocated to the terminal device by the first network element.

12. The method of any one of claims 9-11, wherein, The method further comprises: sending a fourth message to the terminal device, the fourth message comprising type information of the NF, the type information being used to indicate that the NF corresponding to the type information has already established a connection with the terminal device; or sending a fourth message to the terminal device, the fourth message comprising identification information of the NF, the identification information being used to indicate that the NF has already established a connection with the terminal device.

13. The method of any one of claims 9-12, wherein, Before sending the second message to the access network device in response to the first message, the method further comprises: sending a security mode command message to the terminal device, the security mode command message comprising key identification and information of the at least one NF, the information being used to activate a security context of the terminal device to the at least one NF; receiving a security mode complete message from the terminal device, the security mode complete message being used to indicate that a security mode control procedure is completed.

14. The method of claim 13, wherein, The security mode complete message comprises information of the first NF, the information being used to indicate that the security context of the terminal device to the first NF is activated.

15. The method of claim 13 or 14, wherein, The security mode command message comprises information of security algorithms between the terminal device and each NF.

16. A method of communication, comprising: Comprising: sending a fifth message to a first network element, the fifth message comprising information of a first network function (NF), the information being used to request to establish a connection between a terminal device and the first NF, the terminal device and the first NF not having a non-access stratum (NAS) signaling connection.

17. The method of claim 16, wherein, The method further comprises: receiving a sixth message from the first network element, the sixth message comprising information of the first NF, the information being used to indicate that the first NF completes the establishment of the connection.

18. The method of claim 16 or 17, wherein, The information of the first NF comprises identification information of the first NF or type information of the first NF.

19. The method of any one of claims 16-18, wherein, Before sending the fifth message to the first network element, the method further comprises: receiving a fourth message from the first network element, the fourth message comprising information of at least one NF, the at least one NF comprising the first NF.

20. The method of claim 19, wherein, Before receiving the fourth message from the first network element, the method further comprises: receiving a security mode command message from the first network element, the security mode command message comprising key identification and information of the at least one NF, the information being used to activate a security context of the terminal device to the at least one NF; sending a security mode complete message to the first network element, the security mode complete message being used to indicate that a security mode control procedure is completed.

21. The method of claim 20, wherein, The security mode complete message comprises information of the first NF, the information being used to indicate that the security context of the terminal device to the first NF is activated.

22. A method of communication, comprising: Comprising: receiving a security mode command message sent by a first network element, the security mode command message comprising key identification, the key identification being used to activate a security context between a terminal device and the first NF; activating the security context between the terminal device and the first NF based on information of the first NF.

23. The method of claim 22, wherein, The security mode command message further comprises information of the first NF.

24. The method of claim 23, wherein, The information of the first NF comprises type information of the first NF.

25. The method of claim 23 or 24, wherein, The method further comprises: sending a security mode complete message to the first network element, the security mode complete message being used to indicate that a security mode control procedure is completed.

26. The method of any one of claims 23-25, wherein, The security mode complete message includes information of the first NF, and is used to indicate that a security context of the terminal device and the first NF is activated.

27. A communications device, characterized by Comprise: A transceiver unit is configured to send a first message to a first network element, receive a second message from the first network element, and send a first request message to a first network function (NF); wherein the first message comprises a non-access stratum (NAS) message; the second message is used to request an access network device to establish a connection between the access network device and at least one NF; the second message comprises identification information of the at least one NF or type information of the at least one NF; the first request message comprises a first identifier and identification information of a terminal device, and is used to request the establishment of a connection between the terminal device and the first NF; the first identifier is a unique identifier allocated to the terminal device by the access network device; and the first NF belongs to the at least one NF; A processing unit is configured to determine the first request message.

28. The apparatus of claim 27, wherein, The NAS message comprises information of an NF, and the NAS message is used to request the establishment of a connection between a terminal device and the NF; and the information of the NF comprises type information of the NF or identification information of the NF.

29. The apparatus of claim 27 or 28, wherein, The first message further comprises identification information of a terminal device and the first identifier.

30. The apparatus of any one of claims 27-29, wherein, The transceiver unit is further configured to: receive a first response message from the first NF, wherein the first response message comprises the first identifier and a second identifier, the second identifier is a unique identifier allocated to the terminal device by the first NF, and the first response message is used to indicate that the establishment of a connection between the first NF and the access network device is completed.

31. The apparatus of any one of claims 27-30, wherein, The second message further comprises the first identifier and a third identifier, and the third identifier is a unique identifier allocated to the terminal device by the first network element.

32. The apparatus of any one of claims 27-31, wherein, The transceiver unit is further configured to: receive a third message from the terminal device, wherein the third message is used to indicate the identification of the first NF or the type of the first NF; send the third message to the first NF.

33. The apparatus of claim 32, wherein, When the third message is used to indicate the type of the first NF, before sending the third message to the first NF, the processing unit is further configured to: determine the first identifier according to the identification information of the terminal device; determine the second identifier according to the first identifier and the information of the first NF; determine the first NF according to the second identifier.

34. A communications device, characterized by Comprise: A transceiver unit is configured to receive a first message, and send a second message to an access network device in response to the first message; wherein the first message comprises a non-access stratum (NAS) message; and the second message is used to request the access network device to establish a connection between the access network device and at least one network function (NF); the second message comprises identification information of the at least one NF or type information of the at least one NF; A processing unit is configured to determine the second message.

35. The apparatus of claim 34, wherein, The NAS message comprises information of an NF, and the NAS message is used to request the establishment of a connection between a terminal device and the NF; and the information of the NF comprises type information of the NF or identification information of the NF.

36. The apparatus of claim 34, wherein, The first message further comprises identification information of the terminal device and a first identifier, the first identifier being a unique identifier allocated to the terminal device by the access network device.

37. The apparatus of any one of claims 34-36, wherein, The second message further comprises the first identifier and / or a third identifier, the third identifier being a unique identifier allocated to the terminal device by the first network element.

38. The apparatus of any one of claims 35-37, wherein, The transceiver is further configured to: send, to the terminal device, a fourth message, the fourth message comprising type information of the NF, for indicating that the NF corresponding to the type information has established a connection with the terminal device; or send, to the terminal device, a fourth message, the fourth message comprising identification information of the NF, for indicating that the NF has established a connection with the terminal device.

39. The apparatus of any one of claims 35-38, wherein, Before sending, to the access network device, the second message in response to the first message, the transceiver is further configured to: send, to the terminal device, a security mode command message, the security mode command message comprising a key identifier and information of the at least one NF, for activating a security context of the terminal device to the at least one NF; receive, from the terminal device, a security mode complete message, the security mode complete message for indicating that a security mode control procedure is completed.

40. The apparatus of claim 39, wherein, The security mode complete message comprises information of the first NF, for indicating that the security context of the terminal device to the first NF is activated.

41. The apparatus of claim 39 or 40, wherein, The security mode command message comprises information of security algorithms between the terminal device and each NF.

42. A communications device, characterized by Comprise: a processing unit configured to determine a fifth message, the fifth message comprising information of a first network function (NF), for requesting to establish a connection between a terminal device and the first NF, the terminal device and the first NF not having a non-access stratum (NAS) signaling connection; a transceiver configured to send, to a first network element, the fifth message.

43. The apparatus of claim 42, wherein, The transceiver is further configured to: receive, from the first network element, a sixth message, the sixth message comprising information of the first NF, for indicating that the first NF completes the establishment of the connection.

44. The apparatus of claim 42 or 43, wherein, The information of the first NF comprises identification information of the first NF or type information of the first NF.

45. The apparatus of any one of claims 42-44, wherein, Before sending, to the first network element, the fifth message, the transceiver is further configured to: receive, from the first network element, a fourth message, the fourth message comprising information of at least one NF, the at least one NF comprising the first NF.

46. The apparatus of claim 45, wherein, Before receiving, from the first network element, the fourth message, the transceiver is further configured to: receive, from the first network element, a security mode command message, the security mode command message comprising a key identifier and information of the at least one NF, for activating a security context of the terminal device to the at least one NF; send, to the first network element, a security mode complete message, the security mode complete message for indicating that a security mode control procedure is completed.

47. The apparatus of claim 46, wherein, The security mode complete message comprises information of the first NF, for indicating that the security context of the terminal device to the first NF is activated.

48. A communications device, characterized by Comprise: The transceiver unit is configured to receive a security mode command message sent by a first network element, the security mode command message comprising a key identifier, and the security mode command message being used to activate a security context between the terminal device and the first NF. The processing unit is configured to activate the security context between the terminal device and the first NF based on information of the first NF.

49. The apparatus of claim 48, wherein, The security mode command message further comprises information of the first NF.

50. The apparatus of claim 49, wherein, The information of the first NF comprises type information of the first NF.

51. The apparatus of claim 49 or 50, wherein, The transceiver unit is further configured to: send a security mode complete message to the first network element, the security mode complete message being used to indicate that the security mode control procedure is completed.

52. The apparatus of any one of claims 49-51, wherein, The security mode complete message comprises information of the first NF, and the information of the first NF is used to indicate that the security context between the terminal device and the first NF is activated.

53. A communications device, characterized by The communication apparatus comprises a processor and a memory, the memory is configured to store a computer program, and the processor is configured to execute the computer program stored in the memory, so that the communication apparatus executes the method in any one of claims 1-7, or so that the communication apparatus executes the method in any one of claims 8-15, or so that the communication apparatus executes the method in any one of claims 16-21, or so that the communication apparatus executes the method in any one of claims 22-26.

54. A computer-readable storage medium, comprising: The computer readable storage medium is configured to store a computer program, and when the computer program runs on a computer, the method in any one of claims 1-7 is executed, or the method in any one of claims 8-15 is executed, or the method in any one of claims 16-21 is executed, or the method in any one of claims 22-26 is executed.

55. A computer program product, characterised in that, The computer program product comprises a computer program, and when the computer program runs on a computer, the method in any one of claims 1-7 is executed, or the method in any one of claims 8-15 is executed, or the method in any one of claims 16-21 is executed, or the method in any one of claims 22-26 is executed.

56. A chip system, characterized by The chip system comprises: a processor and an interface, the processor is configured to call and run instructions from the interface, and when the processor executes the instructions, the method in any one of claims 1-7 is implemented, or the method in any one of claims 8-15 is implemented, or the method in any one of claims 16-21 is implemented, or the method in any one of claims 22-26 is implemented.

Images