CN114745717A

CN114745717A - Checking method, checking device, communication equipment and computer storage medium

Info

Publication number: CN114745717A
Application number: CN202011535908.4A
Authority: CN
Inventors: 黄震宁; 金晨光; 尚宇翔; 韩延涛; 王玮; 陈旭; 魏彬; 张翀
Original assignee: China Mobile Communications Group Co Ltd; China Mobile Communications Ltd Research Institute
Current assignee: China Mobile Communications Group Co Ltd; China Mobile Communications Ltd Research Institute
Priority date: 2020-12-23
Filing date: 2020-12-23
Publication date: 2022-07-12

Abstract

The embodiment of the invention discloses a checking method, a checking device, communication equipment and a computer storage medium. The method comprises the following steps: and the core network equipment sends a UE Routing Strategy (URSP) to the terminal, wherein the URSP comprises verification information.

Description

Checking method, checking device, communication equipment and computer storage medium

Technical Field

The present invention relates to the field of wireless communication technologies, and in particular, to a verification method, an apparatus, a communication device, and a computer storage medium.

Background

A User Equipment (UE) routing Policy (URSP) gives a terminal the capability of performing routing based on a rule issued by a network side. In the 5G system, the URSP is generated in the slice ordering and opening process, acts on a terminal in the slice service flow, and an auxiliary terminal puts correct service on a proper slice for bearing.

Currently, in the terminal activation process, a network side is requested to issue a URSP. If the information carried in the terminal activation request process is false information, the network side cannot identify the false information and still issues the URSP, and the terminal may acquire a policy beyond the authority limit of the terminal, so that a fraud risk exists.

Disclosure of Invention

In order to solve the existing technical problem, embodiments of the present invention provide a verification method, an apparatus, a communication device, and a computer storage medium.

In order to achieve the above purpose, the technical solution of the embodiment of the present invention is realized as follows:

in a first aspect, an embodiment of the present invention provides a verification method, where the method includes:

and the core network equipment sends URSP to the terminal, wherein the URSP comprises verification information.

In the above scheme, the verification information is generated based on the relevant information of the terminal.

In the foregoing solution, the core network device includes a Policy Control Function (PCF);

the core network equipment sends a UE routing strategy URSP to the terminal, and the method comprises the following steps:

the PCF receives a first request sent by an Access and Mobility Management Function (AMF), wherein the first request is used for requesting to acquire a URSP; the first request comprises the relevant information of the terminal;

and the PCF generates verification information based on the relevant information of the terminal and a preset algorithm, and sends the URSP carrying the verification information to the terminal through the AMF.

In the foregoing scheme, the URSP carrying the check information is transmitted to the terminal through a Non-Access Stratum (NAS) signaling.

In the foregoing solution, the sending, to the terminal through the AMF, the URSP carrying the verification information includes: and the PCF adds the check information to an extension field of the URSP and sends the URSP carrying the check information to the terminal through the AMF.

In the above solution, the PCF adding the check information to the extension field of the URSP includes: and the PCF adds the check information and the application identification to an extension field of the URSP, or adds the check information, the application identification and an Operating System (OS) identification to the extension field of the URSP.

In the above scheme, the method further comprises: the core network equipment receives a first message from the terminal; the first message is a registration completion message, and the registration completion message is sent after the verification of the verification information is passed by the terminal; or, the first message is a registration failure message, the registration failure message is sent after the terminal fails to verify the verification information, and the registration failure message carries a cause value.

In a second aspect, an embodiment of the present invention further provides a verification method, where the method includes:

a terminal receives URSP from core network equipment, wherein the URSP comprises verification information;

and the terminal verifies the verification information to obtain a verification result.

In the above scheme, the core network device includes a PCF;

the receiving the UE routing policy URSP from the core network device includes:

and the terminal receives the URSP sent by the PCF through the AMF, and the extended field of the URSP carries the verification information.

In the above scheme, the terminal receives, through NAS signaling, the URSP carrying the check information and transmitted by the AMF.

In the above scheme, the extension field of the URSP carries the check information and the application identifier, or the extension field of the URSP carries the check information, the application identifier, and the OS identifier.

In the above scheme, the check information is a check value; the terminal verifies the verification information to obtain a verification result, and the verification result comprises the following steps:

the terminal analyzes the check value according to a preset algorithm to obtain first information;

the terminal compares the information with the relevant information of the terminal, and under the condition of consistent comparison, a verification result representing that the verification passes is obtained; and under the condition of inconsistent comparison, obtaining a verification result that the representation verification fails.

In the above scheme, the verification information is signature information; the terminal verifies the verification information to obtain a verification result, and the verification result comprises the following steps:

the terminal sends the signature information to network equipment, and the network equipment is used for verifying the signature information;

and the terminal receives the verification result sent by the network equipment.

In the above scheme, the method further comprises: the terminal sends a first message to the core network equipment; the first message is a registration completion message, and the registration completion message is sent after the verification of the verification information is passed by the terminal; or, the first message is a registration failure message, the registration failure message is sent after the terminal fails to verify the verification information, and the registration failure message carries a cause value.

In the above scheme, the method further comprises: and under the condition that the verification result represents that the verification fails, the terminal initiates the service by using a Protocol Data Unit (PDU) session, or initiates the service according to a default URSP in the URSP.

In a third aspect, an embodiment of the present invention further provides a verification apparatus, where the apparatus includes: a first sending unit, configured to send a URSP to the terminal, where the URSP includes check information.

In the above scheme, the checking device is applied to PCF;

the device further comprises a first receiving unit and a first processing unit; wherein the content of the first and second substances,

the first receiving unit is configured to receive a first request sent by the AMF, where the first request is used to request to acquire a URSP; the first request comprises the relevant information of the terminal;

the first processing unit is used for generating verification information based on the relevant information of the terminal and a preset algorithm;

the first sending unit is configured to send, to the terminal, the URSP carrying the verification information through the AMF.

In the above scheme, the URSP carrying the check information is transmitted to the terminal through NAS signaling.

In the foregoing solution, the first processing unit is configured to add the check information to an extension field of the URSP.

In the foregoing solution, the first processing unit is configured to add the check information and the application identifier to an extension field of the URSP, or add the check information, the application identifier, and the OS identifier to an extension field of the URSP.

In the above solution, the apparatus further includes a second receiving unit, configured to receive a first message from the terminal; the first message is a registration completion message, and the registration completion message is sent after the verification of the verification information is passed by the terminal; or, the first message is a registration failure message, the registration failure message is sent after the terminal fails to verify the verification information, and the registration failure message carries a cause value.

In a fourth aspect, an embodiment of the present invention further provides a verification apparatus, where the verification apparatus includes a third receiving unit and a second processing unit; wherein the content of the first and second substances,

the third receiving unit is configured to receive a URSP from a core network device, where the URSP includes check information;

and the second processing unit is used for verifying the verification information to obtain a verification result.

In the above scheme, the core network device includes a PCF;

and the third receiving unit is configured to receive, through the AMF, the URSP sent by the PCF, where an extension field of the URSP carries the check information.

In the foregoing solution, the third receiving unit is configured to receive, through NAS signaling, the URSP that carries the check information and is transmitted by the AMF.

In the above scheme, the check information is a check value;

the second processing unit is used for analyzing the check value according to a preset algorithm to obtain first information; comparing the information with the related information of the terminal, and obtaining a verification result representing that the verification passes under the condition of consistent comparison; and under the condition of inconsistent comparison, obtaining a verification result that the representation verification fails.

In the above scheme, the verification information is signature information;

the apparatus further comprises a second transmitting unit;

the second processing unit is configured to send the signature information to a network device through the second sending unit, where the network device is configured to verify the signature information; and receiving the verification result sent by the network equipment through the third receiving unit.

In the foregoing solution, the apparatus further includes a third sending unit, configured to send a first message to the core network device; the first message is a registration completion message, and the registration completion message is sent after the verification of the verification information is passed by the terminal; or, the first message is a registration failure message, the registration failure message is sent after the terminal fails to verify the verification information, and the registration failure message carries a cause value.

In the foregoing solution, the second processing unit is further configured to initiate a service by using a default PDU session or initiating a service according to a default URSP in the URSP when the verification result indicates that the verification fails.

In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored, where the computer program, when executed by a processor, implements the steps of the method according to the foregoing first aspect; alternatively, the program is executed by a processor to implement the steps of the method according to the aforementioned second aspect of the embodiment of the present invention.

In a fifth aspect, an embodiment of the present invention further provides a communication device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, where the processor executes the computer program to implement the steps of the method according to the foregoing first aspect; alternatively, the processor implements the steps of the method according to the foregoing second aspect when executing the program.

The embodiment of the invention provides a checking method, a checking device, communication equipment and a computer storage medium, wherein the method comprises the following steps: the core network equipment sends URSP to the terminal, wherein the URSP comprises check information; and the terminal verifies the verification information to obtain a verification result. Therefore, the embodiment of the invention checks the authenticity of the terminal by using the check information carried in the URSP issued by the core network equipment, and the terminal checks the check information, thereby effectively avoiding the terminal from providing false information to acquire the URSP out of the authority, and reducing the fraud risk.

Drawings

FIG. 1 is a first flowchart illustrating a verification method according to an embodiment of the present invention;

FIG. 2 is a second flowchart illustrating a verification method according to an embodiment of the present invention;

FIG. 3 is a schematic diagram illustrating an interaction flow of a verification method according to an embodiment of the present invention;

FIG. 4 is a first schematic structural diagram of a verification apparatus according to an embodiment of the present invention;

FIG. 5 is a schematic diagram of a second exemplary embodiment of a calibration apparatus;

FIG. 6 is a third schematic structural diagram of a verification apparatus according to an embodiment of the present invention;

FIG. 7 is a fourth schematic structural diagram of a verifying apparatus according to an embodiment of the present invention;

FIG. 8 is a fifth schematic structural diagram of a verifying apparatus according to an embodiment of the present invention;

fig. 9 is a schematic diagram of a hardware component structure of a communication device according to an embodiment of the present invention.

Detailed Description

The present invention will be described in further detail with reference to the accompanying drawings and specific embodiments.

The embodiment of the invention provides a checking method. FIG. 1 is a first flowchart illustrating a verification method according to an embodiment of the present invention; as shown in fig. 1, the method includes:

step 101: and the core network equipment sends URSP to the terminal, wherein the URSP comprises verification information.

In some optional embodiments, the verification information is generated based on relevant information of the terminal.

In some optional embodiments, the core network device comprises a PCF; the core network equipment sends URSP to the terminal, and the method comprises the following steps: the PCF receives a first request sent by the AMF, wherein the first request is used for requesting to acquire the URSP; the first request comprises the relevant information of the terminal; and the PCF generates verification information based on the relevant information of the terminal and a preset algorithm, and sends the URSP carrying the verification information to the terminal through the AMF.

In this embodiment, in a process that the terminal initiates a Registration process to the network, for example, the terminal initiates the Registration process and sends a Registration Request (Registration Request) message to the network, and a core network device of the network performs information interaction. After AMF obtains user subscription information from UDM, user equipment Policy (UE Policy) connection is established between AMF and PCF, PCF can send URSP to AMF through the connection, and AMF sends URSP to terminal. In this embodiment, the PCF generates the check information according to the relevant information of the terminal, and the check information is carried in the URSP. Illustratively, the related information of the terminal includes at least one of: user subscription information, type information of the terminal, policy configuration information, and the like. The user Subscription information is Subscription information related to a general Public user identity (GPSI) and/or a user Permanent identity (SUPI), and is stored in a Unified Data Repository (UDR). Illustratively, the type information of the terminal may be represented by a Permanent Equipment Identifier (PEI).

Therefore, the verification information of the embodiment is generated based on the relevant information of the terminal, is carried in the URSP and transmitted to the terminal, and the terminal verifies the verification information, so that the terminal is effectively prevented from providing false information to acquire the URSP out of the authority, and the fraud risk is reduced.

In some optional embodiments, the verification information is a check value. The AMF initiates a user equipment Policy Association (UE Policy Association) establishment flow to the PCF, and the sent message can carry the relevant information of the terminal; PCF generates the check value according to the related information of the terminal and the preset algorithm, and writes the check value into URSP.

In other alternative embodiments, the verification information is signature information. The AMF initiates a user equipment Policy Association (UE Policy Association) establishment flow to the PCF, and the sent message can carry the relevant information of the terminal; PCF generates signature information according to the related information of the terminal and a preset algorithm, and writes the signature information into URSP.

In some optional embodiments of the present invention, the sending, to the terminal through the AMF, the URSP carrying the check information includes: and the PCF adds the check information to an extension field of the URSP and sends the URSP carrying the check information to the terminal through the AMF.

For example, if the check information is a check value, the PCF adds a check value field to the URSP, where the definition of the check value field (extension field) is shown in table 1, and fills the check value generated by the PCF in the field.

TABLE 1

In some optional embodiments, the PCF adds the check information to an extension field of the URSP, including: and the PCF adds the check information and the application identification to an extension field of the URSP, or adds the check information, the application identification and an Operating System (OS) identification to the extension field of the URSP.

In some optional embodiments of the present invention, the URSP carrying the check information is transmitted to the terminal through NAS signaling.

In this embodiment, the PCF sends the URSP carrying the verification information to the AMF, and the AMF sends the URSP to the terminal through the access network device. And the AMF can transmit the URSP carrying the check information to the terminal through NAS signaling.

In some optional embodiments of the invention, the method further comprises: the core network equipment receives a first message from the terminal; the first message is a registration completion message, and the registration completion message is sent after the verification of the verification information is passed by the terminal; or, the first message is a registration failure message, the registration failure message is sent after the terminal fails to verify the verification information, and the registration failure message carries a cause value.

In this embodiment, if the verification result obtained by the terminal is that the verification is passed, the terminal may send a Registration Complete message to the PCF sequentially via the access network device and the AMF; if the verification result obtained by the terminal is that the verification fails, the registration process is ended or interrupted, which indicates that the registration fails, and optionally, the terminal may send a registration failure message or a verification failure message to the PCF sequentially through the access network device and the AMF; the registration failure message or the verification failure message may carry a cause value, where the cause value indicates that the terminal fails to verify the verification information. Accordingly, the PCF may receive a registration complete message or a registration failure message (or a resolution failure message) from the terminal.

In some alternative embodiments, if the PCF receives a registration failure message (or a resolution failure message), the PCF determines whether to change the URSP.

Based on the foregoing embodiment, the embodiment of the present invention further provides a verification method. FIG. 2 is a second flowchart illustrating a verification method according to an embodiment of the present invention; as shown in fig. 2, the method includes:

step 201: a terminal receives URSP from core network equipment, wherein the URSP comprises verification information;

step 202: and the terminal verifies the verification information to obtain a verification result.

In some optional embodiments, the verification information is generated based on information related to the terminal.

In some optional embodiments of the invention, the core network device comprises a PCF; the receiving the URSP from the core network device includes: and the terminal receives the URSP sent by the PCF through the AMF, and the extended field of the URSP carries the verification information.

In this embodiment, in the process that the terminal initiates the Registration process to the network, for example, the terminal sends a Registration Request (Registration Request) message to the network, and the core network devices of the network perform information interaction. After AMF obtains user subscription information from UDM, user equipment Policy (UE Policy) connection is established between AMF and PCF, PCF can send URSP to AMF through the connection, and AMF sends URSP to terminal. In this embodiment, the PCF generates the check information, which is carried in the URSP.

In some optional embodiments, the check information is a check value; the terminal verifies the verification information to obtain a verification result, and the verification result comprises the following steps: the terminal analyzes the check value according to a preset algorithm to obtain first information; the terminal compares the information with the related information of the terminal, and under the condition of consistent comparison, a verification result representing that the verification passes is obtained; and under the condition of inconsistent comparison, obtaining a verification result which represents that the verification fails.

In the embodiment, the PCF generates a check value according to the relevant information of the terminal and a preset algorithm, writes the check value into the URSP, and sends the URSP carrying the check value to the terminal; the terminal obtains the check value and analyzes the check value according to a preset algorithm to obtain first information; if the terminal compares that the first information is consistent with the related information of the terminal, determining that the verification is passed; otherwise, if the terminal compares that the first information is inconsistent with the related information of the terminal, determining that the verification fails.

Illustratively, the terminal is pre-configured with an algorithm matched with the PCF, and the algorithm in the PCF is used for encrypting according to the relevant information of the terminal; the algorithm in the terminal is used to decrypt the check value.

In other optional embodiments, the verification information is signature information; the terminal verifies the verification information to obtain a verification result, and the verification result comprises the following steps: the terminal sends the signature information to network equipment, and the network equipment is used for verifying the signature information; and the terminal receives the verification result sent by the network equipment.

In this embodiment, the network device may be a third-party verification device or a trusted verification device. After the terminal obtains the signature information, the terminal sends the signature information to the network equipment, and the network equipment verifies the signature information; and the terminal obtains a verification result aiming at the signature information sent by the network equipment. Illustratively, the PCF and the network device are pre-configured with an algorithm like matching, the algorithm in the PCF is used to generate signature information according to the relevant information of the terminal; an algorithm in the network device is used to decrypt the signature information.

Illustratively, the related information of the terminal includes at least one of: user subscription information, type information of the terminal, policy configuration information, and the like. Wherein the user subscription information is subscription information related to GPSI and/or SUPI, and the user subscription information is stored in the UDR. Illustratively, the type information of the terminal may be represented by PEI.

Therefore, the verification information of the embodiment is generated by the PCF based on the relevant information of the terminal and carried in the URSP to be transmitted to the terminal, and the terminal verifies the verification information, thereby effectively avoiding the terminal providing false information to acquire the URSP beyond the authority, and reducing the risk of fraud.

In some optional embodiments of the present invention, the extension field of the URSP carries the check information and the application identifier, or the extension field of the URSP carries the check information, the application identifier, and the OS identifier.

In some optional embodiments of the present invention, the terminal receives, through NAS signaling, the URSP carrying the check information and transmitted by the AMF.

In this embodiment, the PCF sends the URSP carrying the verification information to the AMF, and the AMF sends the URSP to the terminal through the access network device. The AMF may transmit the URSP carrying the check information to the terminal through NAS signaling, that is, the terminal receives the URSP carrying the check information and transmitted by the AMF through NAS signaling.

In some optional embodiments of the invention, the method further comprises: the terminal sends a first message to the core network equipment; the first message is a registration completion message, and the registration completion message is sent after the verification of the verification information is passed by the terminal; or, the first message is a registration failure message, the registration failure message is sent after the terminal fails to verify the verification information, and the registration failure message carries a cause value.

In this embodiment, if the verification result obtained by the terminal is that the verification is passed, the terminal may sequentially pass through the access network device and the AMF, and send a Registration Complete message to the PCF; if the verification result obtained by the terminal is that the verification is not passed, the registration process is ended or interrupted, and the registration failure is indicated, optionally, the terminal can send a registration failure message or a verification failure message to the PCF through the access network equipment and the AMF in sequence; the registration failure message or the verification failure message may carry a cause value, where the cause value indicates that the terminal fails to verify the verification information.

In some optional embodiments of the invention, the method further comprises: and under the condition that the verification result represents that the verification fails, the terminal initiates the service by using a default PDU session or initiates the service according to a default URSP in the URSPs.

In this embodiment, if the check result obtained by the terminal is that the check fails, the terminal initiates the service using a default PDU session, or initiates the service according to a default URSP in the URSP.

The embodiment of the invention checks the authenticity of the terminal by using the check information carried in the URSP issued by the core network equipment, and because the core network equipment generates the check information by using the relevant information provided by the terminal and carries the check information in the URSP, the terminal checks the check information, thereby effectively avoiding the problem that the terminal provides false information to obtain the URSP outside the authority, and reducing the fraud risk.

The following describes a verification method according to an embodiment of the present invention with reference to a specific example.

FIG. 3 is a schematic diagram illustrating an interaction flow of a verification method according to an embodiment of the present invention; as shown in fig. 3, the method may include:

step 1: the UE initiates a Registration Request (Registration Request), which may be for initial Registration, or periodic Registration, or mobile update Registration, and the like, and parameters carried in the Registration Request may be different in different Registration types and scenarios.

Step 2: and the access network selects a proper AMF according to the parameters carried by the UE.

The Access Network device may be a Radio Access Network (RAN) or AN Access Network (AN), which is abbreviated as (R) AN in the figure. Illustratively, the access network device may be a gNB.

And 3, step 3: the access network sends a Registration Request (Registration Request) to the new AMF via an N2 message.

Step 4-step 5: the new AMF acquires context information of the UE from the old AMF. That is, the new AMF sends a transfer UE context (Namf _ Communication _ UEContextTransfer) message to the old AMF, and the old AMF sends a transfer UE context response (Namf _ Communication _ UEContextTransfer response) message to the new AMF.

Step 6-step 7: the new AMF acquires ID information to the UE. That is, the new AMF sends an ID Request (Identity Request) to the UE, and the UE sends an ID Response (Identity Response) to the new AMF.

And 8: the new AMF selects an Authentication service Function (AUSF).

And step 9: authentication procedure between UE and core network.

Step 10: the new AMF informs the old AMF of the registration result of the UE. That is, the new AMF sends a Registration result notification (Namf _ Communication _ Registration completion notification) message to the old AMF.

Step 11: and the new AMF performs message interaction with the UE, the new AMF sends an ID Request (Identity Request) to the UE, and the UE sends an ID Response (Identity Response) to the new AMF.

Step 12: the new AMF requests an Equipment Identity Registry (EIR) to Check the validity of the Equipment Identity, i.e. the new AMF sends an Equipment Identity Check (N5g-EIR _ Equipment Identity Check _ Get) message to the EIR.

Step 13: the new AMF selects the UDM.

Step 14 a-step 14 c: the new AMF registers the UE to the UDM, i.e. the new AMF initiates Registration (numm UECM Registration) with the UDM; the new AMF acquires UE access and mobile subscription data from the UDM, SMF selects subscription data, UE context information of the SMF and the like, namely a Nudm _ SDM _ GET between the new AMF and the UDM; the new AMF sends a Subscribe (numm _ SDM _ Subscribe) message to the UDM.

Step 14 d: the UDM sends a deregistration (numm UECM deregistration notification) message to the old AMF, which deletes the UE context and the like.

Step 14 e: the old AMF sends a Unsubscribe (Nudm _ SDM _ unscubscript) message to the UDM.

Step 15: the new AMF selects the PCF.

Step 16: the new AMF does not have effective access and mobility policy information of the UE, interacts with the PCF, and acquires the access and mobility policy information of the UE from the PCF. The interactive messages are access and mobility Policy Association Establishment (AM Policy Association) messages during Registration.

And step 17: and performing message interaction between the new AMF and the SMF for performing PDU session update. The interactive message is a PDU session update or PDU session release (Nsmf _ PDUSESION _ UpdateSMContext/Nsmf _ PDUSESS _ ReleasesMContext) message.

Step 18-step 19: the new AMF sends a UE Context Modification Request (UE _ Context Modification Request) message to a Non-3GPP InterWorking Function (N3 IWF), and the N3IWF sends a UE Context Modification Response (UE _ Context Modification Response) message to the new AMF.

Step 19 a-step 19 c: the new AMF initiates Registration (Nudm _ UECM _ Registration) with the UDM; the UDM sends a Deregistration (numdm UECM registration) message to the old AMF, which sends a Unsubscribe (numdm SDM unsubscripte) message to the UDM.

Step 21: the new AMF sends a Registration Accept message to the UE.

Step 21 b: and a UE Policy Association Establishment (UE Policy Association Establishment) process is carried out between the new AMF and the PCF.

Specifically, the new AMF initiates a UE Policy Association establishment request to the PCF, wherein the request carries the relevant information of the UE; the PCF generates check information (such as a check value or signature information) based on the relevant information of the UE and a preset algorithm, writes the check information into an extension field of the URSP, and sends the URSP carrying the check information to the new AMF.

Step 21 c: and (5) terminal verification process.

Specifically, the new AMF sends the URSP carrying the verification information to the UE through NAS signaling, and the UE verifies the verification information. In one example, the UE may analyze the check value according to a preset algorithm to obtain first information, compare the first information with related information of the UE, and if the first information is consistent with the related information of the UE, indicate that the check is passed; otherwise, if the comparison is not consistent, the verification is not passed. In another example, the UE may send the signature information to the network device, and the network device checks the signature information and returns the check result to the UE.

Step 22: the UE sends a Registration Complete message to the new AMF.

Step 23: the new AMF performs message interaction with the UDM, and the interacted message is a (Nudm _ SDM _ Info) message used for confirming the UDM.

Step 23 a: the new AMF sends an N2 message (N2 message) to the access network.

Step 24: the new AMF performs a message interaction with the UDM, the interacted message being a (numdm UECM Update) message for indication of homogeneous support of IMS voice over PS session.

Step 25: authentication and Authorization of a particular Network Slice (Network Slice-Specific Authentication and Authorization).

The embodiment of the invention also provides a checking device which is applied to the core network equipment, and the core network equipment can be PCF specifically. Fig. 4 is a schematic view of a first structural diagram of a verification apparatus according to an embodiment of the present invention, as shown in fig. 4, the apparatus includes: a first sending unit 31, configured to send a URSP to the terminal, where the URSP includes check information.

In some optional embodiments of the invention, the check information is generated based on information related to the terminal.

In some optional embodiments of the invention, the checking means is applied in the PCF;

the apparatus further comprises a first receiving unit 32 and a first processing unit 33; wherein the content of the first and second substances,

the first receiving unit 32 is configured to receive a first request sent by the AMF, where the first request is used to request to acquire a URSP; the first request comprises the relevant information of the terminal;

the first processing unit 33 is configured to generate verification information based on the relevant information of the terminal and a preset algorithm;

the first sending unit 31 is configured to send, to the terminal, the URSP carrying the check information through the AMF.

In some optional embodiments of the present invention, the first processing unit 33 is configured to add the check information to an extension field of the URSP.

In some optional embodiments of the present invention, the first processing unit 33 is configured to add the check information and the application identifier to an extension field of the URSP, or add the check information, the application identifier and the OS identifier to an extension field of the URSP.

In some optional embodiments of the present invention, as shown in fig. 5, the apparatus further comprises a second receiving unit 34, configured to receive the first message from the terminal; the first message is a registration completion message, and the registration completion message is sent after the verification of the verification information is passed by the terminal; or, the first message is a registration failure message, the registration failure message is sent after the terminal fails to verify the verification information, and the registration failure message carries a cause value.

In the embodiment of the present invention, the first Processing Unit 33 in the apparatus may be implemented by a Central Processing Unit (CPU), a Digital Signal Processor (DSP), a Micro Control Unit (MCU) or a Programmable Gate Array (FPGA) in practical application; the first sending unit 31, the first receiving unit 32 and the second receiving unit 34 of the device can be realized by a communication module (including a basic communication suite, an operating system, a communication module, a standardized interface, a standardized protocol and the like) and a transceiving antenna in practical application.

The embodiment of the invention also provides a checking device. FIG. 6 is a third schematic structural diagram of a verification apparatus according to an embodiment of the present invention; as shown in fig. 6, the apparatus includes a third receiving unit 41 and a second processing unit 42; wherein the content of the first and second substances,

the third receiving unit 41 is configured to receive a URSP from a core network device, where the URSP includes check information;

the second processing unit 42 is configured to verify the verification information to obtain a verification result.

In some optional embodiments of the invention, the core network device comprises a PCF;

the third receiving unit 41 is configured to receive, through the AMF, the URSP sent by the PCF, where an extension field of the URSP carries the check information.

In some optional embodiments of the present invention, the third receiving unit 41 is configured to receive, through NAS signaling, the URSP that carries the check information and is transmitted by the AMF.

In some optional embodiments of the invention, the check information is a check value;

the second processing unit 42 is configured to analyze the check value according to a preset algorithm to obtain first information; comparing the information with the related information of the terminal, and obtaining a verification result representing that the verification passes under the condition of consistent comparison; and under the condition of inconsistent comparison, obtaining a verification result which represents that the verification fails.

In some optional embodiments of the present invention, the verification information is signature information;

in some alternative embodiments of the present invention, as shown in fig. 7, the apparatus further comprises a second transmitting unit 43;

the second processing unit 42 is configured to send the signature information to a network device through the second sending unit 43, where the network device is configured to verify the signature information; the third receiving unit 41 receives the verification result sent by the network device.

In some optional embodiments of the present invention, as shown in fig. 8, the apparatus further includes a third sending unit 44, configured to send a first message to the core network device; the first message is a registration completion message, and the registration completion message is sent after the verification of the verification information is passed by the terminal; or, the first message is a registration failure message, the registration failure message is sent after the terminal fails to verify the verification information, and the registration failure message carries a cause value.

In some optional embodiments of the present invention, the second processing unit 42 is further configured to initiate a service using a default PDU session, or initiate a service according to a default URSP in the URSPs, if the verification result indicates that the verification fails.

In the embodiment of the present invention, the second processing unit 42 in the apparatus can be implemented by a CPU, a DSP, an MCU or an FPGA in practical application; the third receiving unit 41, the second transmitting unit 43 and the third transmitting unit 44 in the device can be realized by a communication module (including a basic communication suite, an operating system, a communication module, a standardized interface, a protocol and the like) and a transceiving antenna in practical application.

It should be noted that: in the verification apparatus provided in the above embodiment, only the division of each program module is illustrated when performing verification, and in practical applications, the processing allocation may be completed by different program modules as needed, that is, the internal structure of the apparatus is divided into different program modules, so as to complete all or part of the processing described above. In addition, the verification apparatus and the verification method provided by the above embodiments belong to the same concept, and specific implementation processes thereof are described in the method embodiments in detail and are not described herein again.

The embodiment of the invention also provides communication equipment, which can be core network equipment or a terminal specifically; the core network device may be, for example, a PCF. Fig. 9 is a schematic diagram of a hardware structure of a communication device according to an embodiment of the present invention, as shown in fig. 9, the communication device includes a memory 52, a processor 51, and a computer program stored in the memory 52 and operable on the processor 51, and when the processor 51 executes the computer program, the steps of the foregoing verification method applied to the core network device according to an embodiment of the present invention are implemented; alternatively, when the processor 51 executes the program, the steps of the verification method applied to the terminal according to the embodiment of the present invention are implemented.

Wherein the communication device further comprises one or more network interfaces 53. It will be appreciated that the various components of the communication device are coupled together by a bus system 54. It will be appreciated that the bus system 54 is used to enable communications among the connections between these components. The bus system 54 includes a power bus, a control bus, and a status signal bus in addition to the data bus. For clarity of illustration, however, the various buses are labeled as bus system 54 in fig. 9.

It will be appreciated that the memory 52 can be either volatile memory or nonvolatile memory, and can include both volatile and nonvolatile memory. Among them, the nonvolatile Memory may be a Read Only Memory (ROM), a Programmable Read Only Memory (PROM), an Erasable Programmable Read-Only Memory (EPROM), an Electrically Erasable Programmable Read-Only Memory (EEPROM), a magnetic random access Memory (FRAM), a Flash Memory (Flash Memory), a magnetic surface Memory, an optical disk, or a Compact Disc Read-Only Memory (CD-ROM); the magnetic surface storage may be disk storage or tape storage. Volatile Memory can be Random Access Memory (RAM), which acts as external cache Memory. By way of illustration and not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Synchronous Static Random Access Memory (SSRAM), Dynamic Random Access Memory (DRAM), Synchronous Dynamic Random Access Memory (SDRAM), Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM), Enhanced Synchronous Dynamic Random Access Memory (ESDRAM), Enhanced Synchronous Dynamic Random Access Memory (Enhanced DRAM), Synchronous Dynamic Random Access Memory (SLDRAM), Direct Memory (DRmb Access), and Random Access Memory (DRAM). The memory 52 described in connection with the embodiments of the invention is intended to comprise, without being limited to, these and any other suitable types of memory.

The method disclosed in the above embodiments of the present invention may be applied to the processor 51, or implemented by the processor 51. The processor 51 may be an integrated circuit chip having signal processing capabilities. In implementation, the steps of the above method may be performed by integrated logic circuits of hardware or instructions in the form of software in the processor 51. The processor 51 described above may be a general purpose processor, a DSP, or other programmable logic device, discrete gate or transistor logic device, discrete hardware components, or the like. The processor 51 may implement or perform the methods, steps, and logic blocks disclosed in the embodiments of the present invention. A general purpose processor may be a microprocessor or any conventional processor or the like. The steps of the method disclosed by the embodiment of the invention can be directly implemented by a hardware decoding processor, or can be implemented by combining hardware and software modules in the decoding processor. The software modules may be located in a storage medium located in the memory 52, and the processor 51 reads the information in the memory 52 and performs the steps of the aforementioned method in combination with its hardware.

In an exemplary embodiment, the communication Device may be implemented by one or more Application Specific Integrated Circuits (ASICs), DSPs, Programmable Logic Devices (PLDs), Complex Programmable Logic Devices (CPLDs), FPGAs, general purpose processors, controllers, MCUs, microprocessors (microprocessors), or other electronic components for performing the aforementioned methods.

In an exemplary embodiment, the present invention further provides a computer readable storage medium, such as a memory 52, including a computer program, which can be executed by a processor 51 of a communication device to implement the steps of the foregoing method. The computer readable storage medium can be Memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface Memory, optical disk, or CD-ROM; or may be various devices including one or any combination of the above memories.

The embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored, where the computer program, when executed by a processor, implements the steps of the foregoing verification method applied to the core network device in the embodiment of the present invention; alternatively, the program is executed by a processor to implement the steps of the verification method applied to the terminal according to the embodiment of the present invention.

The methods disclosed in the several method embodiments provided in the present application may be combined arbitrarily without conflict to obtain new method embodiments.

The features disclosed in the several product embodiments presented in this application can be combined arbitrarily, without conflict, to arrive at new product embodiments.

The features disclosed in the several method or apparatus embodiments provided in the present application may be combined arbitrarily, without conflict, to arrive at new method embodiments or apparatus embodiments.

In the several embodiments provided in the present application, it should be understood that the disclosed apparatus and method may be implemented in other ways. The above-described device embodiments are merely illustrative, for example, the division of the unit is only a logical functional division, and there may be other division ways in actual implementation, such as: multiple units or components may be combined, or may be integrated into another system, or some features may be omitted, or not implemented. In addition, the coupling, direct coupling or communication connection between the components shown or discussed may be through some interfaces, and the indirect coupling or communication connection between the devices or units may be electrical, mechanical or other forms.

The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed on a plurality of network units; some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, all the functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may be separately regarded as one unit, or two or more units may be integrated into one unit; the integrated unit can be realized in a form of hardware, or in a form of hardware plus a software functional unit.

Those of ordinary skill in the art will understand that: all or part of the steps for implementing the method embodiments may be implemented by hardware related to program instructions, and the program may be stored in a computer readable storage medium, and when executed, the program performs the steps including the method embodiments; and the aforementioned storage medium includes: a removable storage device, a ROM, a RAM, a magnetic or optical disk, or various other media that can store program code.

Alternatively, the integrated unit of the present invention may be stored in a computer-readable storage medium if it is implemented in the form of a software functional module and sold or used as a separate product. Based on such understanding, the technical solutions of the embodiments of the present invention may be essentially implemented or a part contributing to the prior art may be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the methods described in the embodiments of the present invention. And the aforementioned storage medium includes: a removable storage device, a ROM, a RAM, a magnetic or optical disk, or various other media that can store program code.

The above description is only for the specific embodiments of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily conceive of the changes or substitutions within the technical scope of the present invention, and all the changes or substitutions should be covered within the scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the appended claims.

Claims

1. A method of verification, the method comprising:

and the core network equipment sends a UE routing strategy URSP to the terminal, wherein the URSP comprises verification information.

2. The method of claim 1, wherein the verification information is generated based on information related to the terminal.

3. The method according to claim 1 or 2, characterized in that the core network device comprises a policy control function, PCF;

4. The method of claim 3, wherein the URSP carrying the check information is transmitted to the terminal through non-access stratum (NAS) signaling.

5. The method according to claim 3, wherein the sending the URSP carrying the check information to the terminal through the AMF comprises:

and the PCF adds the check information into an extension field of the URSP and sends the URSP carrying the check information to the terminal through the AMF.

6. The method of claim 3, wherein the PCF adding the check information to an extension field of the URSP comprises:

and the PCF adds the check information and the application identification to an extension field of the URSP, or adds the check information, the application identification and the OS identification to the extension field of the URSP.

7. The method of claim 1, further comprising:

the core network equipment receives a first message from the terminal; the first message is a registration completion message, and the registration completion message is sent after the verification of the verification information is passed by the terminal; or, the first message is a registration failure message, the registration failure message is sent after the terminal fails to verify the verification information, and the registration failure message carries a cause value.

8. A method of verification, the method comprising:

9. The method of claim 8, wherein the verification information is generated based on information related to the terminal.

10. The method of claim 8 or 9, wherein the core network device comprises a PCF;

the receiving the UE routing policy URSP from the core network device includes:

11. The method of claim 10, wherein the terminal receives the URSP carrying the check information for the AMF transmission via non-access stratum NAS signaling.

12. The method of claim 10, wherein the extension field of the URSP carries the check information and the application identifier, or wherein the extension field of the URSP carries the check information, the application identifier and the OS identifier.

13. The method of claim 8, wherein the check information is a check value; the terminal verifies the verification information to obtain a verification result, and the verification result comprises the following steps:

the terminal compares the information with the related information of the terminal, and under the condition of consistent comparison, a verification result representing that the verification passes is obtained; and under the condition of inconsistent comparison, obtaining a verification result that the representation verification fails.

14. The method of claim 8, wherein the verification information is signature information; the terminal verifies the verification information to obtain a verification result, and the verification result comprises the following steps:

15. The method of claim 8, further comprising: the terminal sends a first message to the core network equipment; the first message is a registration completion message, and the registration completion message is sent after the verification of the verification information is passed by the terminal; or, the first message is a registration failure message, the registration failure message is sent after the terminal fails to verify the verification information, and the registration failure message carries a cause value.

16. The method of claim 8, further comprising:

and under the condition that the verification result represents that the verification fails, the terminal initiates the service by using a PDU session of a default protocol data unit, or initiates the service according to a default URSP in the URSP.

17. A verification apparatus, the apparatus comprising: a first sending unit, configured to send a UE routing policy URSP to the terminal, where the URSP includes check information.

18. The apparatus of claim 17, wherein the verification information is generated based on information related to the terminal.

19. The apparatus according to claim 17 or 18, wherein the verifying means is applied in PCF;

the device further comprises a first receiving unit and a first processing unit; wherein, the first and the second end of the pipe are connected with each other,

20. The apparatus of claim 19, wherein the URSP carrying the check information is transmitted to the terminal via non-access stratum NAS signaling.

21. The apparatus as claimed in claim 19, wherein the first processing unit is configured to add the check information to an extension field of the URSP.

22. The apparatus of claim 19, wherein the first processing unit is configured to add the check information and the application identifier to an extension field of the URSP, or to add the check information, the application identifier and the OS identifier to an extension field of the URSP.

23. The apparatus of claim 17, further comprising a second receiving unit configured to receive a first message from the terminal; the first message is a registration completion message, and the registration completion message is sent after the verification of the verification information is passed by the terminal; or, the first message is a registration failure message, the registration failure message is sent after the terminal fails to verify the verification information, and the registration failure message carries a cause value.

24. A checking apparatus, characterized in that the apparatus comprises a third receiving unit and a second processing unit; wherein the content of the first and second substances,

25. The apparatus of claim 24, wherein the verification information is generated based on information related to the terminal.

26. The apparatus of claim 24 or 25, wherein the core network device comprises a PCF;

27. The apparatus of claim 26, wherein the third receiving unit is configured to receive, through non-access stratum NAS signaling, the URSP carrying the check information of the AMF transmission.

28. The apparatus of claim 26, wherein the extension field of the URSP carries the check information and an application identifier, or wherein the extension field of the URSP carries the check information, an application identifier, and an OS identifier.

29. The apparatus of claim 24, wherein the check information is a check value;

30. The apparatus of claim 24, wherein the verification information is signature information;

the apparatus further comprises a second transmitting unit;

31. The apparatus according to claim 24, wherein the apparatus further comprises a third sending unit, configured to send a first message to the core network device; the first message is a registration completion message, and the registration completion message is sent after the verification of the verification information is passed by the terminal; or, the first message is a registration failure message, the registration failure message is sent after the terminal fails to verify the verification information, and the registration failure message carries a cause value.

32. The apparatus of claim 24, wherein the second processing unit is further configured to initiate traffic using a default Protocol Data Unit (PDU) session or according to a default URSP of the URSPs if the checking result indicates a failure.

33. A computer-readable storage medium, on which a computer program is stored which, when being executed by a processor, carries out the steps of the method according to any one of claims 1 to 7; alternatively, the program when executed by a processor implements the steps of the method of any one of claims 8 to 16.

34. A communication device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the steps of the method of any one of claims 1 to 7 are implemented when the program is executed by the processor; alternatively, the processor implements the steps of the method of any one of claims 8 to 16 when executing the program.