WO2017000140A1

WO2017000140A1 - Method and apparatus for authenticating user equipment

Info

Publication number: WO2017000140A1
Application number: PCT/CN2015/082707
Authority: WO
Inventors: 施密特·彼得; 周润泽
Original assignee: 华为技术有限公司
Priority date: 2015-06-29
Filing date: 2015-06-29
Publication date: 2017-01-05
Also published as: CN106688259B; CN106688259A

Abstract

The present invention relates to the technical field of communications. Provided are a method and apparatus for authenticating a user equipment, which are mainly used to provide a greater network access range to a second user equipment. In the present invention, a second user equipment can send, to a first user equipment, an establishment request for establishing a session with a target APN, so that the live first user equipment determines an APN that can be accessed by the second user equipment, thereby providing more choices for access of the second user equipment. The present invention is applicable to a network access process of a D2D device.

Description

Method and device for authenticating user equipment

Technical field

The present invention relates to the field of communications technologies, and in particular, to a method and an apparatus for authenticating a user equipment.

Background technique

As a kind of mobile cellular network technology, D2D (Device to Device) technology can be used to improve resource utilization and network capacity. In addition to the cell service in the cellular network, the cell users in the cellular network can communicate directly through the D2D link. D2D communication uses the same resources as cell users.

In D2D communication, relay communication is an important working mode. In its usage scenario, a relay UE (which may be called a relay UE) can provide forwarding of messages for two UEs outside the D2D communication range. Therefore, the relay UE can provide a service connected to the network for a UE (referred to as a remote UE) that is outside the network coverage. For example, the relay UE can forward the downlink data packet sent by the network to the remote UE.

Before the remote UE obtains the network service through the relay UE, it is necessary to find a relay UE that can provide services for the remote UE. During the discovery process, the remote UE can learn the PDN (Public Data Network) connection information that the relay UE has established. If the remote UE wishes to connect to the network through the PDN, the relay UE is selected to serve itself. That is to say, the remote UE can complete communication with the network by using the channel resources of the relay UE. However, the defect is also obvious, that is, the remote UE can only complete the network communication through the PDN of the relay UE, which greatly limits the network access range of the remote UE.

Summary of the invention

The embodiment of the invention provides a method and a device for authenticating a user equipment, which are used to provide a larger network access range for the second user equipment.

To achieve the above objective, the embodiment of the present invention adopts the following technical solutions:

In a first aspect, an embodiment of the present invention provides a method for authenticating a user equipment, which is applied to Device to device D2D network, the method includes:

Receiving, by the first user equipment, a request message sent by the second user equipment, where the request message includes an access point name APN;

In response to the request message, the first user equipment sends a response message to the second user equipment to indicate whether the second user equipment can establish a connection to the APN.

In conjunction with the first aspect, in a first possible implementation manner of the first aspect, before the sending, by the first user equipment, the response message to the second user equipment, the method further includes:

Determining, by the first user equipment, whether access authorization information of the APN is stored in the first user equipment;

If it is determined that the access authorization information of the APN is not stored in the first user equipment, the first user equipment sends an authentication request to the network device, where the authentication request is carried in response to the request message. The identification information of the APN or the authenticated user equipment is used to enable the network device to return an authentication reply message to the first user equipment after the authentication succeeds.

With the first possible implementation of the first aspect, in a second possible implementation manner of the first aspect, the sending, by the first user equipment, the response message to the second user equipment includes:

After receiving the authentication reply message returned by the network device, sending the response message to the second user equipment according to the authentication reply message, to indicate whether the second user equipment can connect to the The APN carried in the request message.

With the second possible implementation of the first aspect, in a third possible implementation manner of the first aspect, if it is determined that the access authorization information of the APN is stored in the first user equipment, The sending, by the first user equipment, the response message to the second user equipment includes:

The first user equipment sends the response message to the second user equipment according to the access authorization information of the APN, to indicate whether the second user equipment can connect to the APN carried in the request message.

In conjunction with the third possible implementation of the first aspect, the fourth possible aspect in the first aspect In an implementation manner, the sending, by the first user equipment, the authentication request to the network device, in response to the request message, includes:

When the APN is carried in the authentication request, the first user equipment sends a template for the second user equipment to connect to the APN. And the authentication reply message is used to indicate whether the second user equipment can access the APN;

When the authentication request carries the identifier information of the first user equipment, the first user equipment sends the first user equipment to the network device corresponding to the first user equipment for authenticating the first user equipment. The authentication request, the authentication reply message is used to indicate the APN that the first user equipment can access;

When the authentication request carries the identifier information of the second user equipment, the first user equipment sends the network device corresponding to the second user equipment to perform authentication on the second user equipment. The authentication reply message is used to indicate the APN that the second user equipment can access.

With the second possible implementation of the first aspect, in a fifth possible implementation manner of the first aspect, the authentication reply message includes all APNs that the second user equipment can access, and/or The first user equipment has all accessible APNs.

In a second aspect, an embodiment of the present invention provides an authentication device for a user equipment, which is applied to a device-to-device D2D network, where the device includes:

a receiving unit, configured to receive a request message sent by the second user equipment, where the request message includes an access point name APN;

The first sending unit is configured to send a response message to the second user equipment to indicate whether the second user equipment can establish a connection to the APN in response to the request message.

With reference to the second aspect, in a first possible implementation manner of the second aspect, the method further includes:

a determining unit, configured to determine whether access authorization information of the APN is stored in the first user equipment;

a second sending unit, configured to send an authentication request to the network device in response to the request message when determining that the access authorization information of the APN is not stored in the first user equipment, where the authentication request is The identifier information of the APN or the authenticated user equipment is carried, so that the network device returns an authentication reply message to the first user equipment after the authentication succeeds.

With reference to the first possible implementation manner of the second aspect, in a second possible implementation manner of the second aspect, the first sending unit is specifically configured to: after receiving the authentication reply message returned by the network device And sending, according to the authentication reply message, the response message to the second user equipment, to indicate whether the second user equipment can connect to the APN carried in the request message.

With the second possible implementation of the second aspect, in a third possible implementation manner of the second aspect, the first sending unit determines that the APN is stored in the first user equipment When the authorization information is used, the method further sends the response message to the second user equipment according to the access authorization information of the APN, to indicate whether the second user equipment can be connected to the request message. APN.

With the third possible implementation of the second aspect, in a fourth possible implementation manner of the second aspect, the second sending unit is further configured to: when the authentication request carries the APN Sending, to the network device corresponding to the second user equipment, an authentication request for whether the second user equipment can connect to the APN, where the authentication reply message is used to indicate the second user equipment Whether the access to the APN is enabled; when the authentication request carries the identifier information of the first user equipment, sending, to the network device corresponding to the first user equipment, the first user equipment The authentication request of the authentication, the authentication reply message is used to indicate the APN that the first user equipment can access; and when the authentication request carries the identifier information of the second user equipment, The network device corresponding to the second user equipment sends an authentication request for authenticating the second user equipment, where the authentication reply message is used to indicate the APN that the second user equipment can access.

With the second possible implementation of the second aspect, in a fifth possible implementation manner of the second aspect, the authentication reply message includes all the second user equipments that are accessible APN, and/or, all APNs that the first user equipment can access.

In a third aspect, an embodiment of the present invention provides an authentication device for a user equipment, which is applied to a device-to-device D2D network, where the device includes a transceiver:

The transceiver is configured to receive a request message sent by the second user equipment, where the request message includes an access point name APN, and configured to send a response to the second user equipment in response to the request message And a message, to indicate whether the second user equipment can establish a connection to the APN.

In conjunction with the third aspect, in a first possible implementation of the third aspect, the processor is further included:

The processor is configured to determine whether access authorization information of the APN is stored in the first user equipment;

The transceiver is further configured to: when determining that the access authorization information of the APN is not stored in the first user equipment, send an authentication request to the network device, where the authentication request is sent, in response to the request message The identifier information of the APN or the authenticated user equipment is carried in the network device, so that the network device returns an authentication reply message to the first user equipment after the authentication succeeds.

With the first possible implementation of the third aspect, in a second possible implementation manner of the third aspect, the transceiver is specifically configured to: after receiving the authentication reply message returned by the network device, according to The authentication reply message sends the response message to the second user equipment to indicate whether the second user equipment can connect to the APN carried in the request message.

In conjunction with the second possible implementation of the third aspect, in a third possible implementation manner of the third aspect, the transceiver determines, in the first user equipment, an access authorization of the APN The information is used to send the response message to the second user equipment according to the access authorization information of the APN, to indicate whether the second user equipment can connect to the APN carried in the request message.

In conjunction with the third possible implementation of the third aspect, the fourth possible aspect in the third aspect In an implementation manner, the transceiver is further configured to: when the APN is carried in the authentication request, send, to the network device corresponding to the second user equipment, whether the second user equipment can be connected The authentication reply message is used to indicate whether the second user equipment can access the APN, and the identifier of the first user equipment is carried in the authentication request. Sending an authentication request for authenticating the first user equipment to the network device corresponding to the first user equipment, where the authentication reply message is used to indicate that the first user equipment can be connected When the authentication request carries the identifier information of the second user equipment, the network device corresponding to the second user equipment sends a packet for authenticating the second user equipment. And the authentication reply message is used to indicate the APN that the second user equipment can access.

With the second possible implementation of the third aspect, in a fifth possible implementation manner of the third aspect, the authentication reply message includes all APNs that the second user equipment can access, and/or The first user equipment has all accessible APNs.

The method and device for authenticating a user equipment provided by the embodiment of the present invention, the second user equipment may send a setup request for establishing a session with the destination APN to the first user equipment, so that the first user equipment on the network The invention can determine the APN that the second user equipment can access. Compared with the prior art, the second user equipment can only use the same APN as the relay device for access. Compared with the access, the present invention can obtain the first from the network side. The APN that the user equipment can access can obtain a large number of APNs other than the APN that the relay device is using, thereby providing more options for accessing the second user equipment, and providing the second user equipment with the second user equipment. Greater network access.

DRAWINGS

In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings to be used in the embodiments will be briefly described below. It is obvious that the drawings in the following description are only some embodiments of the present invention. Those skilled in the art can also obtain other drawings based on these drawings without any creative work.

FIG. 1 is a flowchart of a method for authenticating a user equipment according to an embodiment of the present invention;

2 is a flowchart of another method for authenticating a user equipment according to an embodiment of the present invention;

FIG. 3 is a structural diagram of an apparatus for authenticating a user equipment according to an embodiment of the present invention;

FIG. 4 is a structural diagram of another method for authenticating a user equipment according to an embodiment of the present invention;

FIG. 5 is a structural diagram of another method for authenticating a user equipment according to an embodiment of the present invention;

FIG. 6 is a structural diagram of another method for authenticating a user equipment according to an embodiment of the present invention.

detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, but not all embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

A method for authenticating a user equipment according to an embodiment of the present invention is applicable to a D2D network. In the D2D network, a first user equipment (also referred to as a relay user equipment, and a Relay UE) is generally required. The network device, the first user equipment, as a device inside the D2D network, can be regarded as a network relay node, providing information forwarding and network for a second user equipment (Remote UE) outside the D2D network or in a pre-off-network state. Access instructions and other services. The network device is generally used to provide an access service for accessing an Access Point Name (APN) access to various types of user equipment, including the first user equipment and the second user equipment. In the implementation of the present invention, the network equipment is used. The ProSe function (Proximity-based service function) functional entity and the HSS (Home subscriber server) corresponding to the user equipment can be implemented together.

The method for authenticating the user equipment provided by the embodiment of the present invention is applicable to the process in which the second user equipment needs to establish an APN session connection with the network side to implement whether to allow access to the second user equipment. APN authentication. As shown in FIG. 1, the method is performed by the first user equipment, and the specific steps include:

101. Receive a request message sent by the second user equipment.

In this step, the request message generally carries an APN to indicate the access intention of the second user equipment.

102. Send a response message to the second user equipment to indicate whether the second user equipment can establish a connection to the APN in response to the request message.

A method for authenticating a user equipment according to an embodiment of the present invention, where the second user equipment may Sending, by the first user equipment, a setup request for establishing a session with the destination APN, so that the first user equipment on the network determines the APN that the second user equipment can access, compared to the second user equipment in the prior art. The APN can be accessed only by using the same APN as the relay device. Compared with the APN that the second user equipment can access, the present invention can obtain a large amount of the APN that the relay device is using. The APN outside the APN provides more options for access by the second user equipment, providing a larger network access range for the second user equipment.

In order to implement the authentication of the second user equipment to access the APN, the authentication information may be obtained in the first user equipment, or may be requested by the first user equipment. Obtain. The corresponding implementation process is as shown in FIG. 2, and needs to be performed before step 102, including:

103. Determine whether the access authorization information of the APN is stored in the first user equipment.

104. If it is determined that the access authorization information of the APN is not stored in the first user equipment, the first user equipment sends an authentication request to the network device, in response to the request message, to enable the network. After the device is successfully authenticated, the device returns an authentication reply message to the first user equipment, where the authentication reply message is used to indicate the APN that the first user equipment or the second user equipment can access. The APN mentioned in step 101 needs to be carried in the authentication request.

The authentication request may include the APN included in the foregoing request message, or the identification information of the authenticated device (that is, the identifier information of the first user equipment or the identifier information of the second user equipment).

Then, in step 102, in response to the request message, sending a response message to the second user equipment, to indicate whether the second user equipment can establish a connection to the APN, the specific execution flow is:

After receiving the authentication reply message returned by the network device, sending the response message to the second user equipment according to the authentication reply message, to indicate whether the second user equipment is connectable to the The APN carried in the request message.

In addition, if it is determined that the access authorization information of the APN is stored in the first user equipment, then in step 102, in response to the request message, sending a response message to the second user equipment, where Instructing the second user equipment to establish a connection to the APN The specific execution process is:

In the embodiment of the present invention, the authentication reply message may be used to indicate the function of the APN that the first or second user equipment can access, or directly indicate whether the second user equipment can access the APN of the request. . The content specified in the authentication reply message depends on the content carried in the authentication request. In this setting, the embodiment of the present invention provides three types of content that can be carried in the authentication request. Therefore, in step 104, the first user equipment sends an authentication request to the network device in response to the request message. It can be achieved in the following three ways:

The first mode is: when the APN is carried in the authentication request, the first user equipment sends, to the network device corresponding to the second user equipment, whether the second user equipment can be connected to The authentication request of the APN.

In this manner, the authentication reply message is used to indicate whether the second user equipment can access the APN.

The second mode is: when the authentication request carries the identifier information of the first user equipment, the first user equipment sends the first user equipment to the network device corresponding to the first user equipment, where the first The user equipment performs an authentication request for authentication.

In this manner, the authentication reply message is used to indicate an APN that the first user equipment can access.

The third mode is: when the authentication request carries the identifier information of the second user equipment, the first user equipment sends the second user equipment to the network device corresponding to the second user equipment, where the second The user equipment performs an authentication request for authentication.

In this manner, the authentication reply message is used to indicate an APN that the second user equipment can access.

In the first mode, the implementation principle is relatively simple, that is, which APN is requested by the first user equipment, and the network side authenticates the behavior of accessing the APN. In the second mode, the network device side generally determines the APN that the second user equipment can access. In the third mode, the first user equipment determines the APN that the second user equipment can access. However, at this time, the APN information that the second user equipment can access can only be selected from the APN information that the first user equipment can access, although the number may be compared with the APN that the second user equipment can access. The difference, but also much more than the choices available in the prior art to complete network access using only one APN that the first user equipment is using.

In addition, a brief description of the authentication process involved in the present invention is provided, and only a feasible implementation manner is provided. For example, if the first user equipment sends an authentication request for authenticating the second user equipment to the ProSe Function corresponding to the second user equipment, the authentication request generally carries the second user equipment. The identifier is used to facilitate the ProSe Function to perform the authentication. If the ProSe Function does not have the authentication information of the second user equipment, the ProSe Function sends an authentication check message to the HSS corresponding to the second user equipment, which is completed by the HSS. Subsequent authentication work. After the authentication is completed, the HSS sends the relevant authentication information to the ProSe Function, and then the ProSe Function completes the subsequent reply work.

If the authentication process of the first user equipment is involved, it is similar to the above process, except that the network device related to the first user equipment needs to initiate an authentication process.

Based on the description of the foregoing method flow, the embodiment of the present invention further provides an authentication device for the user equipment, which is used to implement the foregoing method flow. As shown in FIG. 3, the device includes:

The receiving unit 21 is configured to receive a request message sent by the second user equipment, where the request message includes an access point name APN.

The first sending unit 22 is configured to send a response message to the second user equipment to indicate whether the second user equipment can establish a connection to the APN in response to the request message.

Optionally, as shown in FIG. 4, the device further includes:

The determining unit 23 is configured to determine whether the access authorization information of the APN is stored in the first user equipment.

a second sending unit 24, configured to determine that the first user equipment is not stored in the When the access information of the APN is accessed, the authentication request is sent to the network device in response to the request message, where the authentication request carries the identifier information of the APN or the authenticated user equipment, so that the network device After the authentication succeeds, an authentication reply message is returned to the first user equipment.

Optionally, the first sending unit 22 is specifically configured to: after receiving the authentication reply message returned by the network device, send the response message to the second user equipment according to the authentication reply message. And indicating whether the second user equipment can connect to the APN carried in the request message.

Optionally, when the first sending unit 22 determines that the access authorization information of the APN is stored in the first user equipment, the first sending unit 22 is further configured to: according to the access authorization information of the APN, to the The second user equipment sends the response message to indicate whether the second user equipment can connect to the APN carried in the request message.

Optionally, the second sending unit 24 is further configured to send, to the network device corresponding to the second user equipment, the second user, when the APN is carried in the authentication request. Whether the device is capable of connecting to the authentication request of the APN, the authentication reply message is used to indicate whether the second user equipment can access the APN; when the authentication request carries the first And sending, by the network device corresponding to the first user equipment, an authentication request for authenticating the first user equipment, where the authentication reply message is used to indicate the first The APN that the user equipment can access; when the authentication request carries the identifier information of the second user equipment, sending, to the network device corresponding to the second user equipment, the second user equipment The authentication reply request is used to indicate the APN that the second user equipment can access.

Optionally, the authentication reply message includes all APNs that the second user equipment can access, and/or all the APNs that the first user equipment can access.

An authentication device for a user equipment is provided by the embodiment of the present invention. The second user equipment may send a setup request for establishing a session with the destination APN to the first user equipment, so that the first user equipment on the network determines The APN that the second user equipment can access, compared to the second user equipment in the prior art, can only use the same APN as the relay device to access. Compared to the second user, the present invention can obtain the second user from the network side. APN that the device can access, a large range An APN other than the APN being used by the relay device can be obtained, thereby providing more options for accessing the second user equipment and providing a larger network access range for the second user equipment.

The embodiment of the invention further provides an authentication device for the user equipment, which is applied to the device to the device D2D network. As shown in FIG. 5, the device includes a transceiver 31:

The transceiver 31 is configured to receive a request message sent by the second user equipment, where the request message includes an access point name APN, and configured to send to the second user equipment in response to the request message And a response message, configured to indicate whether the second user equipment can establish a connection to the APN.

Optionally, as shown in FIG. 6, the apparatus further includes a processor 32:

The processor 32 is configured to determine whether access authorization information of the APN is stored in the first user equipment.

The transceiver 31 is further configured to: when determining that the access authorization information of the APN is not stored in the first user equipment, send an authentication request to the network device according to the request message, where the authentication is performed. The request carries the identification information of the APN or the authenticated user equipment, so that the network device returns an authentication reply message to the first user equipment after the authentication succeeds.

Optionally, the transceiver 31 is configured to: after receiving the authentication reply message returned by the network device, send the response message to the second user equipment according to the authentication reply message, to Indicates whether the second user equipment is able to connect to the APN carried in the request message.

Optionally, the transceiver 31 is configured to send, according to the access authorization information of the APN, to the second user, when determining that the access authorization information of the APN is stored in the first user equipment. The device sends the response message to indicate whether the second user equipment can connect to the APN carried in the request message.

Optionally, the transceiver 31 is further configured to: when the authentication request carries the And sending, by the network device corresponding to the second user equipment, an authentication request for whether the second user equipment can connect to the APN, where the authentication reply message is used to indicate the second Whether the user equipment can access the APN; when the authentication request carries the identifier information of the first user equipment, send, to the network device corresponding to the first user equipment, the first user And the authentication reply message is used to indicate the APN that the first user equipment can access; when the authentication request carries the identifier information of the second user equipment, And sending, to the network device corresponding to the second user equipment, an authentication request for authenticating the second user equipment, where the authentication reply message is used to indicate that the second user equipment is accessible. APN.

An authentication device for a user equipment is provided by the embodiment of the present invention. The second user equipment may send a setup request for establishing a session with the destination APN to the first user equipment, so that the first user equipment on the network determines The APN that the second user equipment can access, compared to the second user equipment in the prior art, can only use the same APN as the relay device to access. Compared to the second user, the present invention can obtain the second user from the network side. The APN that the device can access can obtain a large number of APNs other than the APN that the relay device is using, thereby providing more options for accessing the second user device and providing greater access to the second user device. The scope of network access.

The various embodiments in the specification are described in a progressive manner, and the same or similar parts between the various embodiments may be referred to each other, and each embodiment focuses on the differences from the other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiment.

A person skilled in the art can understand that all or part of the process of implementing the above embodiment method can be completed by a computer program to instruct related hardware, and the program can be stored in a computer readable storage medium. When executed, the flow of an embodiment of the methods as described above may be included.

The above description is only a specific embodiment of the present invention, but the scope of protection of the present invention is not It is to be understood that those skilled in the art are susceptible to variations and substitutions within the scope of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

A method for authenticating a user equipment, which is characterized in that it is applied to a device to a device D2D network, and the method includes:

Receiving, by the first user equipment, a request message sent by the second user equipment, where the request message includes an access point name APN;

In response to the request message, the first user equipment sends a response message to the second user equipment to indicate whether the second user equipment can establish a connection to the APN.
The method according to claim 1, wherein before the first user equipment sends a response message to the second user equipment, the method further includes:

Determining, by the first user equipment, whether access authorization information of the APN is stored in the first user equipment;

If it is determined that the access authorization information of the APN is not stored in the first user equipment, the first user equipment sends an authentication request to the network device, where the authentication request is carried in response to the request message. The identification information of the APN or the authenticated user equipment is used to enable the network device to return an authentication reply message to the first user equipment after the authentication succeeds.
The method according to claim 2, wherein the sending, by the first user equipment, the response message to the second user equipment comprises:

After receiving the authentication reply message returned by the network device, sending the response message to the second user equipment according to the authentication reply message, to indicate whether the second user equipment is connectable to the The APN carried in the request message.
The method according to claim 3, wherein if it is determined that the access authorization information of the APN is stored in the first user equipment, the first user equipment sends a response to the second user equipment. The message includes:

Sending, by the first user equipment, the response message to the second user equipment according to the access authorization information of the APN, to indicate whether the second user equipment is able to connect to the request The APN carried in the message.
The method according to claim 4, wherein the sending, by the first user equipment, the authentication request to the network device in response to the request message comprises:

When the APN is carried in the authentication request, the first user equipment sends a template for the second user equipment to connect to the APN. And the authentication reply message is used to indicate whether the second user equipment can access the APN;

When the authentication request carries the identifier information of the first user equipment, the first user equipment sends the first user equipment to the network device corresponding to the first user equipment for authenticating the first user equipment. The authentication request, the authentication reply message is used to indicate the APN that the first user equipment can access;

When the authentication request carries the identifier information of the second user equipment, the first user equipment sends the network device corresponding to the second user equipment to perform authentication on the second user equipment. The authentication reply message is used to indicate the APN that the second user equipment can access.
The method according to claim 3, wherein the authentication reply message comprises all APNs accessible by the second user equipment, and/or all APNs that the first user equipment can access.
An authentication device for a user equipment, which is characterized in that it is applied to a device to a device D2D network, and the device includes:

a receiving unit, configured to receive a request message sent by the second user equipment, where the request message includes an access point name APN;

The first sending unit is configured to send a response message to the second user equipment to indicate whether the second user equipment can establish a connection to the APN in response to the request message.
The device according to claim 7, further comprising:

a determining unit, configured to determine whether access authorization information of the APN is stored in the first user equipment;

a second sending unit, configured to send an authentication request to the network device in response to the request message when determining that the access authorization information of the APN is not stored in the first user equipment, where the authentication request is The identifier information of the APN or the authenticated user equipment is carried, so that the network device returns an authentication reply message to the first user equipment after the authentication succeeds.
The device according to claim 8, wherein the first sending unit is configured to: after receiving the authentication reply message returned by the network device, according to the authentication reply message, to the second The user equipment sends the response message to indicate whether the second user equipment can connect to the APN carried in the request message.
The device according to claim 9, wherein the first sending unit is further configured to connect according to the APN when determining that the access authorization information of the APN is stored in the first user equipment. The authorization information is sent to the second user equipment to indicate whether the second user equipment can connect to the APN carried in the request message.
The device according to claim 10, wherein the second sending unit is further configured to send to the network device corresponding to the second user equipment when the APN is carried in the authentication request And the authentication reply message is used to indicate whether the second user equipment can access the APN, and the authentication request is sent to the second user equipment. When the identifier information of the first user equipment is carried, the authentication request for authenticating the first user equipment is sent to the network device corresponding to the first user equipment, and the authentication reply message is sent. The APN is used to indicate that the first user equipment can access; when the authentication request carries the identifier information of the second user equipment, the information is sent to the network device corresponding to the second user equipment. And the second user equipment performs an authentication request for authentication, where the authentication reply message is used to indicate an APN that the second user equipment can access.
The device according to claim 9, wherein the authentication reply message comprises all APNs accessible by the second user equipment, and/or all APNs that the first user equipment can access.
An authentication device for a user equipment, characterized in that it is applied to a device to device D2D network, and the device comprises a transceiver:

The transceiver is configured to receive a request message sent by the second user equipment, where the request message includes an access point name APN, and configured to send a response to the second user equipment in response to the request message And a message, to indicate whether the second user equipment can establish a connection to the APN.
The apparatus of claim 13 further comprising a processor:

The processor is configured to determine whether access authorization information of the APN is stored in the first user equipment;

The transceiver is further configured to: when determining that the access authorization information of the APN is not stored in the first user equipment, send an authentication request to the network device, where the authentication request is sent, in response to the request message The identifier information of the APN or the authenticated user equipment is carried in the network device, so that the network device returns an authentication reply message to the first user equipment after the authentication succeeds.
The device according to claim 14, wherein the transceiver is specifically configured to: after receiving the authentication reply message returned by the network device, according to the authentication reply message, to the second user equipment And sending the response message to indicate whether the second user equipment is able to connect to the APN carried in the request message.
The device according to claim 15, wherein the transceiver is configured to use the access authorization information according to the APN when determining that the access authorization information of the APN is stored in the first user equipment. Sending the response message to the second user equipment to indicate whether the second user equipment can connect to the APN carried in the request message.
The device according to claim 16, wherein the transceiver is further configured to send, when the APN is carried in the authentication request, to a network device corresponding to the second user equipment, Whether the second user equipment is able to connect to the authentication request of the APN, the authentication reply message is used to indicate whether the second user equipment can access the APN; when the authentication request is carried When the identifier information of the first user equipment is sent, an authentication request for authenticating the first user equipment is sent to the network device corresponding to the first user equipment, where the authentication reply message is used. Instructing the APN that the first user equipment can access; when the authentication request carries the identification information of the second user equipment, to the second The network device corresponding to the user equipment sends an authentication request for authenticating the second user equipment, and the authentication reply message is used to indicate the APN that the second user equipment can access.
The device according to claim 15, wherein the authentication reply message includes all APNs that the second user equipment can access, and/or all APNs that the first user equipment can access.