WO2018045983A1

WO2018045983A1 - Information processing method and device, and network system

Info

Publication number: WO2018045983A1
Application number: PCT/CN2017/100915
Authority: WO
Inventors: 游世林; 蔡继燕; 林兆骥; 彭锦; 梁爽; 李志军; 赵孝武
Original assignee: 中兴通讯股份有限公司
Priority date: 2016-09-09
Filing date: 2017-09-07
Publication date: 2018-03-15
Also published as: CN107809776B; CN107809776A

Abstract

The present invention provides an information processing method and device, and a network system. The method comprises: receiving a first attachment request message for making a user equipment be attached to a network, wherein the first attachment request message carries a slice selection entity identifier used for identifying a slice selection entity; obtaining user security context corresponding to the user equipment from the slice selection entity corresponding to the slice selection entity identifier; and performing authentication on the user equipment according to the obtained user security context. The present invention resolves the problem in the related art of the increased processing load of a user data center caused by the requirement of frequent interaction with the user data center during a user registration process, and achieves the effects of reducing the signaling load and lowering the processing load of the user data center.

Description

Information processing method, device and network system

Technical field

The present disclosure relates to the field of communications, and in particular to an information processing method, apparatus, and network system.

Background technique

Mobile communication has developed rapidly in more than 20 years, which has brought huge impacts on people's lifestyle, working methods, social and political, and economic aspects. Human society has entered an era of efficient informationization, and the demand for business applications in all aspects has exploded. It will bring huge challenges to the future wireless mobile bandwidth system in terms of frequency, technology and operation.

In addition to providing services for everyone's communication, the future mobile network will provide access services for more and more IoT terminals. Internet of Things access brings new challenges and opportunities to mobile networks. Different types of Internet of Things have different needs for the network. Some require the network to provide high real-time and high-reliability services, such as telemedicine, while others require regular small data transmission services, such as remote meter reading systems. For different business needs, mobile networks may need to be properly optimized to meet business needs. More and more Internet of Things puts more and more different optimization requirements on mobile networks. Some of the optimization requirements may be contradictory. Therefore, a converged core network is increasingly unable to meet various Internet of Things. demand.

With the advent of Network Function Virtualization (NFV), core network functions can be built on common hardware without the need for a dedicated hardware platform. The emergence of NFV makes it possible for operators to build different virtual core networks for different network business needs. The virtual core network built for different network business needs is called a network slice. Each network function in the virtual core network can be optimized and customized according to network service requirements. Network slices based on NFV technology can be rapidly deployed according to requirements to quickly meet the needs of different scenarios.

1 is a schematic diagram of a network slice in the related art. As shown in Figure 1, three network slices (network slices A, B, C) are illustrated. Each of the slices includes a wireless access network and a universal network. Network function entity, slice control plane function entity and slice user plane function entity. The general functional entities include a mobility management entity, a session management entity, and an authentication authentication entity (slices A and B). If the slice has no common network function entity, the slice common function entity is included in the slice control plane function entity (slice C), and the network further includes a user data center, which stores user subscription data and security data (root key) of the user equipment. The user equipment (User Equipment, UE for short) accesses the network through the radio access network, and selects a suitable slice to perform services through the slice selection function entity.

2 is a schematic flowchart of initial registration and re-registration of a user-accessed network to select a suitable slice in the related art. As shown in FIG. 2, the process includes the following steps:

Step S202: The user equipment sends an initial attach request message to the radio access network, and the radio access network forwards the attach request message to the slice selection function entity, where the message carries the user identifier.

Step S204: The slice selection function entity acquires the user subscription information and the security context from the user data center according to the user identifier, and performs mutual authentication on the user and the network.

The foregoing authentication process includes: the slice selection function entity sends an authentication authentication request message to the user data center, and the user data center sends an authentication authentication request response message to the slice selection function entity, where the message carries the user security context, that is, the security vector group, and the slice The function entity sends a user authentication request message to the user equipment, where the message carries the authentication token, and the user equipment verifies the validity of the network by using the authentication token, and calculates a desired response value, and sends a user profile to the slice selection function entity. The right authentication request response message, the carrying the desired response value, the slice selection function entity compares the expected response value in the security context with the received expected response value, and if equal, authenticates the user device to the user data center The user subscription data is obtained, and the slice selection function entity saves the security context and the user subscription data.

Step S206, the slice selection function entity selects an appropriate slice according to the information in the user subscription data, that is, the slice selection function entity selects an appropriate slice identifier.

Step S208, the slice selection function entity sends a slice selection message to the wireless access network, where the message carries a slice identifier.

Step S210: The radio access network selects a corresponding slice according to the corresponding slice identifier.

Step S212a, the radio access network sends an attach request message to the slice mobility management entity of the selected slice, and the slice mobility management entity selects an appropriate slice authentication authentication entity and forwards the attach request message to the slice authentication authentication entity.

Step S212b: The slice authentication authentication entity acquires user subscription data from the user data center, and authenticates whether the user can legally access the slice.

The authentication and authentication process includes: the slice authentication authentication entity sends an authentication authentication request message to the user data center, and the user data center sends an authentication authentication request response message to the slice authentication authentication entity, where the message carries the user security context, that is, the security vector. The group authentication authentication entity sends a user authentication authentication request message to the user equipment, where the message carries the authentication token, and the user equipment verifies the validity of the network by using the authentication token, and calculates the expected response value to authenticate the slice authentication. The entity sends back a user authentication request response message, where the expected response value is carried, and the slice authentication authentication entity compares the expected response value in the security context with the received expected response value. If they are equal, the authentication user equipment is legal. The user subscription data is obtained from the user data center, and the slice authentication authentication entity saves the security context and the user subscription data.

Step S212c, establishing a user plane connection with the user plane gateway (optional step).

Step S212d: After the authentication of the slice authentication authentication entity is successful, the connection response message is sent back to the slice mobility management entity, and the slice mobility management entity sends an attach response message to the wireless network management entity.

Step S214: The radio access network sends an attach response message to the user equipment message, where the message carries a slice identifier.

Steps S202-S214 complete the initial registration of the user equipment.

Step S216: The user equipment initiates a re-registration request message to the radio access network, where the message carries a slice identifier.

Step S218, the radio access network directly forwards the re-registration request message to the slice management entity.

In step S220, the re-registration process is completed according to steps 206-207.

It can be seen from the above process that in the initial registration process of the user, the user security context and the user subscription data are acquired twice to the user data center, and in the user re-registration process, the user security context needs to be obtained from the user data center. The user subscribes to the data, and the user data center is located in the user's home domain. Such a process requires multiple times to obtain the user security context and user subscription data in the home domain, which will increase the signaling load, and generally the user data center manages more users. This will increase the processing load of the user data center.

Therefore, the registration process of the user in the related art needs to interact with the user data center multiple times, thereby increasing the processing load of the user data center.

Summary of the invention

The embodiments of the present disclosure provide an information processing method, apparatus, and network system, so as to at least solve the problem that the registration process of the user in the related art needs to interact with the user data center multiple times to increase the processing load of the user data center.

According to an embodiment of the present disclosure, an information processing method is provided, including: receiving a first attach request message for a user equipment to attach to a network, where the first attach request message carries an identifier for selecting a slice selection entity The slice selection entity identifier is obtained; the slice selection entity corresponding to the slice selection entity identifier acquires a user security context corresponding to the user equipment; and the user equipment is authenticated and authenticated according to the obtained user security context.

Optionally, after the authentication authentication result is that the user equipment is legal, after the user equipment is authenticated and authenticated according to the obtained user security context, the method further includes: allocating the user equipment The first identifier information of the user equipment is sent; the attach response message is sent to the user equipment, where the attach response message carries the first identifier information.

Optionally, after the sending the attach response message to the user equipment, the method further includes: receiving a second attach request message sent by the user equipment, where the second attach request message carries the first The identification information is obtained, and the security context corresponding to the user equipment that is locally saved is obtained according to the first identifier information; and the user equipment is authenticated and authenticated according to the obtained security context.

Optionally, after the sending the attach response message to the user equipment, the method further includes: Receiving, by the preset network element, a preset message for acquiring a security context of the user equipment, where the preset message carries the first identifier information; according to the first identifier information, obtaining a local save The security context corresponding to the user equipment is sent to the preset network element.

Optionally, in the process of authenticating the user equipment according to the obtained user security context, the method further includes: acquiring, by the slice selection entity, user subscription data of the user equipment.

According to another embodiment of the present disclosure, an information processing method is provided, including: receiving a first attach request message for a user equipment attached to a network, where the first attach request message carries a identifier for identifying a slice The slice of the entity selects the entity identifier; the slice selection entity corresponding to the slice selection entity identifier acquires the user security context corresponding to the user equipment; and sends the obtained security context to the authentication authentication entity, where the security context The authentication and authentication entity is configured to perform authentication and authentication on the user equipment.

Optionally, after the obtained security context is sent to the authentication and authenticating entity, the method further includes: receiving a first attach response message sent by the authentication and authenticating entity; The second identifier information of the user equipment is sent to the user equipment, where the second attach response message carries the second identifier information.

Optionally, after the sending the second attach response message to the user equipment, the method further includes: receiving a second attach request message sent by the user equipment, where the second attach request message carries the The second identifier information is obtained, and the security context corresponding to the user equipment that is locally saved is obtained according to the second identifier information; and the obtained security context is sent to the authentication and authenticating entity.

Optionally, after the sending the second attach response message to the user equipment, the method further includes: receiving, by using a preset network element, a preset message for acquiring a security context of the user equipment, where the The message carries the second identifier information, and the security context corresponding to the user equipment saved locally is obtained according to the second identifier information, and the obtained security context is sent to the preset network element. .

Optionally, after the obtained security context is sent to the authentication and authenticating entity, the method further includes: acquiring, by the slice selection entity, user subscription data of the user equipment.

According to still another embodiment of the present disclosure, there is provided an information processing apparatus comprising: a first receiving module configured to receive a first attach request message for a user equipment attached to a network, wherein the first attach request message And the acquiring module is configured to obtain a user security context corresponding to the user equipment by selecting a slice selection entity corresponding to the slice selection entity identifier, and the authentication module is set to obtain according to the The user security context is used to authenticate the user equipment.

Optionally, the device further includes: an allocating module, configured to allocate, to the user equipment, a first identifier for identifying the user equipment, if the authentication and authentication result of the authentication module is legal for the user equipment And the sending module is configured to send an attach response message to the user equipment, where the attach response message carries the first identifier information.

Optionally, the first receiving module is further configured to receive a second attach request message sent by the user equipment, where the second attach request message carries the first identifier information; And the method further includes: acquiring, according to the first identifier information, the locally saved security context corresponding to the user equipment; the authentication module is further configured to perform, according to the obtained security context, the user equipment Authentication certification.

Optionally, the receiving module is further configured to receive a preset message that is sent by the preset network element to obtain the security context of the user equipment, where the preset message carries the first identifier information. The obtaining module is further configured to: obtain the security context corresponding to the locally saved user equipment according to the first identifier information; and the sending module is further configured to send the obtained security context to the Preset network elements.

Optionally, the acquiring module is further configured to acquire user subscription data of the user equipment from the slice selection entity.

According to still another embodiment of the present disclosure, there is provided an authentication authentication entity, comprising: the apparatus of any of the above.

According to still another embodiment of the present disclosure, an information processing apparatus is provided, including: receiving a module, configured to receive a first attach request message for the user equipment to attach to the network, where the first attach request message carries a slice selection entity identifier for identifying a slice selection entity, and an acquiring module is configured to The slice selection entity corresponding to the slice selection entity identifier acquires the user security context corresponding to the user equipment, and the sending module is configured to send the obtained security context to the authentication authentication entity, where the security context is used for the authentication The right authentication entity performs authentication and authentication on the user equipment.

Optionally, the device further includes: an allocating module, wherein the receiving module is further configured to receive a first attach response message sent by the authentication and authenticating entity; the allocating module is configured to be the user device Allocating the second identifier information for identifying the user equipment; the sending module is further configured to send a second attach response message to the user equipment, where the second attach response message carries the second identifier information.

Optionally, the receiving module is further configured to receive a second attach request message sent by the user equipment, where the second attach request message carries the second identifier information; And the sending module is further configured to send the obtained security context to the authentication and authenticating entity according to the second identifier information, where the security context corresponding to the user equipment is locally saved.

Optionally, the receiving module is further configured to receive a preset message that is sent by the preset network element to obtain a security context of the user equipment, where the preset message carries the second identifier information. The obtaining module is further configured to: obtain the security context corresponding to the locally saved user equipment according to the second identifier information; and the sending module is configured to send the obtained security context to the Preset network element.

According to still another embodiment of the present disclosure, there is provided a mobility management entity, comprising: the apparatus of any of the above.

According to still another embodiment of the present disclosure, there is provided a network system including a slice selection function entity, an authentication authentication entity, and a mobility management entity, the slice selection function An entity interacts with the authentication authentication entity via an interface, the authentication authentication entity comprising the apparatus of any one of the preceding claims, and/or the slice selection function entity and the mobility management entity Interacting through an interface, the mobility management entity comprising the apparatus of any of the above.

According to still another embodiment of the present disclosure, a storage medium is also provided. The storage medium is configured to store program code for performing the step of: receiving a first attach request message for the user equipment to attach to the network, wherein the first attach request message carries a slice selection for identifying a slice selection entity Entity identification; the slice selection entity corresponding to the slice selection entity identifier acquires a user security context corresponding to the user equipment; and performs authentication authentication on the user equipment according to the obtained user security context.

Optionally, the storage medium is further configured to store program code for performing the following steps: in case the authentication authentication result is that the user equipment is legal, the user equipment is performed according to the acquired user security context After the authentication, the method further includes: allocating, to the user equipment, first identifier information for identifying the user equipment; and sending an attach response message to the user equipment, where the attach response message carries the first Identification information.

Optionally, the storage medium is further configured to store program code for performing the following steps: after sending the attach response message to the user equipment, the method further includes: receiving a second attach request message sent by the user equipment, where The second attachment request message carries the first identifier information, and the security context corresponding to the user equipment saved locally is obtained according to the first identifier information; and according to the obtained security context, The user equipment performs authentication and authentication.

Optionally, the storage medium is further configured to store program code for performing the following steps: after sending the attach response message to the user equipment, the method further includes: receiving, by the preset network element, the acquiring the user equipment The preset message of the security context, wherein the preset message carries the first identifier information; and according to the first identifier information, the locally saved security context corresponding to the user equipment is acquired; The security context is sent to the preset network element.

Optionally, the storage medium is further configured to: store the program code for performing the following steps: in the process of performing authentication and authentication on the user equipment according to the acquired user security context, the method further includes: selecting the slice The entity acquires user subscription data of the user equipment.

According to still another embodiment of the present disclosure, a storage medium is also provided. The storage medium is configured to store program code for performing the step of: receiving a first attach request message for the user equipment to attach to the network, wherein the first attach request message carries a slice selection for identifying a slice selection entity Entity identifier; the slice selection entity corresponding to the slice selection entity identifier acquires a user security context corresponding to the user equipment; and sends the obtained security context to an authentication authentication entity, where the security context is used for the The authentication and authenticating entity performs authentication and authentication on the user equipment.

Optionally, the storage medium is further configured to store program code for performing the following steps: after sending the obtained security context to the authentication and authenticating entity, further comprising: receiving, by the authentication and authenticating entity, An attach response message, the user equipment is allocated second identification information for identifying the user equipment, and the second attach response message is sent to the user equipment, where the second attach response message carries the Two identification information.

Optionally, the storage medium is further configured to store program code for performing the following steps: after sending the second attach response message to the user equipment, the method further includes: receiving a second attach request message sent by the user equipment And the second attachment request message carries the second identifier information, and the security context corresponding to the locally saved user equipment is obtained according to the second identifier information; the obtained security context is to be obtained. Send to the authentication and authentication entity.

Optionally, the storage medium is further configured to store the program code for performing the following steps: after sending the second attach response message to the user equipment, the method further includes: receiving, by the preset network element, the acquiring a preset message of the security context of the user equipment, where the preset message carries the second identifier information; and according to the second identifier information, the security context corresponding to the locally saved user equipment is obtained; And sending the obtained security context to the preset network element.

Optionally, the storage medium is further configured to store program code for performing the following steps: after transmitting the obtained security context to the authentication and authentication entity, further comprising: acquiring the user to the slice selection entity User subscription data for the device.

According to still another embodiment of the present disclosure, there is also provided a processor for running a program, wherein the program is executed to perform the method of any of the above.

Through the disclosure, the user security context is obtained from the slice selection function entity by the slice selection function entity identifier, and the user equipment is authenticated and authenticated, and the slice selection function entity and the slice general network function entity or the slice control plane function entity interface are added, thereby reducing The processing load of the user data center can solve the problem that the registration process of the user in the related technology needs to interact with the user data center multiple times, and the processing load of the user data center is increased, thereby reducing the signaling load and reducing the processing load of the user data center. effect.

DRAWINGS

The drawings described herein are intended to provide an understanding of the present disclosure, and are intended to be a part of the present disclosure. In the drawing:

1 is a schematic diagram of a network slice in the related art;

2 is a schematic flowchart of initial registration and re-registration of a user-accessed network to select a suitable slice in the related art;

3 is a hardware structural block diagram of an authentication and authentication entity of an information processing method according to an embodiment of the present disclosure;

4 is a flowchart 1 of an information processing method according to an embodiment of the present disclosure;

FIG. 5 is a second flowchart of an information processing method according to an embodiment of the present disclosure; FIG.

6 is a schematic architectural diagram of a network slice in accordance with a preferred embodiment of the present disclosure;

7 is a flow diagram showing initial registration and re-registration of a user equipment access network to select a suitable slice according to a preferred embodiment of the present disclosure;

8 is a block diagram 1 of a structure of a signal processing apparatus according to an embodiment of the present disclosure;

9 is a structural block diagram 2 of a signal processing apparatus according to an embodiment of the present disclosure;

FIG. 10 is a structural block diagram of an authentication authentication entity according to an embodiment of the present disclosure; FIG.

11 is a block diagram 3 of a structure of a signal processing apparatus according to an embodiment of the present disclosure;

FIG. 12 is a structural block diagram 4 of a signal processing apparatus according to an embodiment of the present disclosure; FIG.

FIG. 13 is a structural block diagram of a mobility management entity according to an embodiment of the present disclosure; FIG.

FIG. 14 is a structural block diagram of a network system according to an embodiment of the present disclosure.

detailed description

The present disclosure will be described in detail below with reference to the drawings in conjunction with the embodiments. It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict.

It is to be understood that the terms "first", "second", and the like in the specification and claims of the present disclosure are used to distinguish similar objects, and are not necessarily used to describe a particular order or order.

Example 1

The method embodiment provided by Embodiment 1 of the present application may be executed in an authentication authentication entity, a mobility management entity, a computer terminal, or the like. Taking the operation on the authentication and authentication entity as an example, FIG. 3 is a hardware structural block diagram of an authentication and authentication entity of an information processing method according to an embodiment of the present disclosure. As shown in FIG. 3, authentication authentication entity 30 may include one or more (only one shown) processor 32 (processor 32 may include, but is not limited to, processing of a microprocessor MCU or a programmable logic device FPGA, etc. A device 34, a memory 34 for storing data, and a transmission device 36 for communication functions. It will be understood by those skilled in the art that the structure shown in FIG. 3 is merely illustrative and does not limit the structure of the above electronic device. For example, authentication authentication entity 30 may also include more or fewer components than shown in FIG. 3, or have a different configuration than that shown in FIG.

The memory 34 can be used to store software programs and modules of application software, such as program instructions/modules corresponding to the information processing method in the embodiment of the present disclosure, and the processor 32 executes various kinds by executing software programs and modules stored in the memory 34. Functional applications and data processing, That is, the above method is implemented. Memory 34 may include high speed random access memory and may also include non-volatile memory such as one or more magnetic storage devices, flash memory, or other non-volatile solid state memory. In some examples, memory 34 may also include memory remotely located relative to processor 32, which may be connected to authentication authentication entity 30 over a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

Transmission device 36 is for receiving or transmitting data via a network. An example of such a network may include a wireless network provided by a communication provider of the authentication authority 30. In one example, the transmission device 36 includes a Network Interface Controller (NIC) that can be connected to other network devices through a base station to communicate with the Internet. In one example, the transmission device 36 can be a Radio Frequency (RF) module for communicating with the Internet wirelessly.

In this embodiment, an information processing method running on the above-mentioned authentication and authentication entity is provided. FIG. 4 is a flowchart 1 of an information processing method according to an embodiment of the present disclosure. As shown in FIG. 4, the process includes the following steps:

Step S402, receiving a first attach request message for the user equipment to attach to the network, where the first attach request message carries a slice selection function entity identifier for identifying the slice selection function entity;

Step S404, acquiring, by the slice selection function entity corresponding to the slice selection function entity identifier, a user security context corresponding to the user equipment;

Step S406: Perform authentication authentication on the user equipment according to the obtained user security context.

Through the above steps, the user security context is obtained from the slice selection function entity through the slice selection function entity identifier, and the user equipment is authenticated and authenticated, and the registration process of the user in the related technology needs to interact with the user data center multiple times to increase user data. The central processing load problem reduces the signaling load and reduces the processing load of the user data center.

Optionally, the method may further include: assigning, to the user equipment, first identifier information for identifying the user equipment; and sending an attach response message to the user equipment, where the authentication response is that the user equipment is legal. The message carries the first identification information. By dividing the user The first identification information of the user equipment of the user identifier can be used to replace the user code used in the original message, and the user code can be protected.

Optionally, after the attach response message is sent to the user equipment, the re-registration process may be performed by using the first identifier information that is allocated in the process of the user performing the re-registration. For example, the second attach request message sent by the user equipment may be received, where the second attach request message carries the first identifier information, and the user security context corresponding to the locally saved user equipment is obtained according to the first identifier information; The user security context is used to authenticate the user equipment.

Optionally, after the attaching the response message to the user equipment, the user security context corresponding to the locally saved user equipment may be sent to the other preset network element according to the first identifier information. For example, the preset message sent by the preset network element for acquiring the user security context of the user equipment may be received, where the preset message carries the first identifier information, and according to the first identifier information, the locally saved user equipment corresponding is obtained. The user security context sends the obtained security context to the preset network element. In the foregoing manner, the user security context corresponding to the user equipment may be provided to the preset network element in the preset scenario (for example, the scenario in which the preset network needs the security context). Generally, the interaction cost between the common network function entities is much smaller than the interaction cost between the common network function entity and the user data center. By providing a user security context for the preset network element, the required network resource overhead can be reduced.

Optionally, the user subscription data of the user equipment can be obtained in multiple manners, for example, the user subscription data can be obtained from the user data center, and, for example, the user equipment can be authenticated and authenticated according to the obtained user security context. In the process, the user subscription data of the user equipment is obtained from the slice selection function entity. For example, after the user equipment is authenticated and the user equipment is determined to be legal, the user subscription data of the user equipment is obtained from the slice selection function entity.

In the embodiment, an information processing method running on the mobility management entity is further provided, and the structure of the mobility management entity is as shown in FIG. 3. FIG. 5 is a second flowchart of an information processing method according to an embodiment of the present disclosure. As shown in FIG. 5, the flow includes the following steps:

Step S502, receiving a first attach request message for the user equipment to attach to the network, where The first attach request message carries a slice selection function entity identifier for identifying a slice selection function entity;

Step S504, acquiring, by the slice selection function entity corresponding to the slice selection function entity identifier, a user security context corresponding to the user equipment;

Step S506: The obtained security context is sent to the authentication and authentication entity, where the security context is used by the authentication and authentication entity to perform authentication and authentication on the user equipment.

The user security context is obtained from the slice selection function entity by using the slice selection function entity identifier, and the obtained user security context is sent to the authentication authentication entity, and the authentication and authentication entity performs authentication and authentication on the user equipment. The problem that the registration process of the user in the related art needs to interact with the user data center multiple times, increases the processing load of the user data center, reduces the signaling load, and reduces the processing load of the user data center.

Optionally, after the obtained security context is sent to the authentication and authenticating entity, the method may further include: receiving a first attach response message sent by the authentication and authenticating entity; and allocating, to the user equipment, second identifier information for identifying the user equipment; Sending a second attach response message to the user equipment, where the second attach response message carries the second identifier information.

Optionally, after the sending the second attach response message to the user equipment, the method further includes: receiving the second attach request message sent by the user equipment, where the second attach request message carries the second identifier information; The information is obtained by acquiring a security context corresponding to the locally saved user equipment, and sending the obtained security context to the authentication and authenticating entity.

Optionally, after the sending the second attach response message to the user equipment, the method further includes: receiving, by the preset network element, a preset message for acquiring a security context of the user equipment, where the preset message carries the second And the security information corresponding to the locally saved user equipment is obtained according to the second identifier information; and the obtained security context is sent to the preset network element.

Optionally, after the obtained security context is sent to the authentication and authenticating entity, the method further includes: acquiring the user subscription data of the user equipment to the slice selection function entity.

Based on the foregoing embodiment and the preferred embodiment, in order to explain the entire process interaction of the solution, in the preferred embodiment, a user security context delivery method is provided, and the method includes: slicing After the function entity obtains the user security context from the user data center, the two-way authentication of the user equipment is implemented, and the appropriate slice is selected for the user equipment; the slice obtains the user security context from the slice selection function entity through the slice selection function entity identifier, and completes the slice pair. User device authentication.

The slice obtains the user security context from the slice selection function entity through the slice selection function entity identifier, and may be a slice authentication authentication entity (similar to the function of the foregoing authentication authentication entity) and/or a slice mobility management entity (acting with the foregoing mobility management) The function of the entity is similar) the user security context is obtained from the slice selection function entity by the slice selection function entity identifier.

Optionally, the slice authentication authentication entity may further acquire the user security context and the user subscription data from the slice selection function entity according to the slice selection function entity identifier.

Optionally, the slice mobility management entity may further acquire user subscription data from the slice selection function entity according to the slice selection function entity identifier.

Optionally, the slice authentication authentication entity may send the user subscription data to the slice mobility management entity.

Alternatively, the slice selection function entity may send a slice selection function entity identifier to the slice mobility management entity, or the slice authentication authentication entity.

Optionally, the radio access network sends back a slice selection function entity identifier, or a slice identifier, or a slice mobility management identifier, or a slice authentication management identifier to the user equipment.

Optionally, the slice selection function entity identifier, or the slice identifier, or the slice mobility management identifier, or the slice authentication management identifier may allocate a temporary identifier to the user equipment for each entity.

Optionally, the temporary identification may include public identification information of the entity.

The preferred embodiment further provides a user security context delivery system, which is configured to add a slice selection function entity to a slice general network function entity or a slice control plane function entity interface for initial registration or re-registration of the user equipment. The slice selection function entity sends a user security context or user subscription data to the slice general network function entity or the slice control plane function entity.

The method of the preferred embodiment of the present disclosure will be described in detail below with reference to the accompanying drawings.

FIG. 6 is a schematic structural diagram of a network slice according to a preferred embodiment of the present disclosure. As shown in FIG. 6 , an interface between a slice selection function entity and a slice general network function entity or a slice control plane function entity is added with respect to an existing architecture. The user equipment initial registration or re-registration slice selection function entity sends a user security context or user subscription data to the slice general network function entity or the slice control plane function entity.

7 is a flow diagram of initial registration and re-registration of a user equipment access network to select a suitable slice in accordance with a preferred embodiment of the present disclosure. In the process, the slice selection function entity obtains the user security context from the user data center, implements bidirectional authentication for the user equipment, and selects an appropriate slice for the user equipment, and the slice obtains the user from the slice selection function entity through the slice selection function entity identifier. Security context, completes the authentication of the user device by the slice. As shown in FIG. 7, the process includes the following steps:

Step S702: The user equipment sends an initial attach request message to the radio access network, and the radio access network forwards the attach request message to the slice selection function entity, where the message carries the user identifier.

Step S704, the slice selection function entity acquires the user subscription information and the security context from the user data center according to the user identifier, and performs mutual authentication on the user and the network. The authentication process includes: the slice selection function entity sends an authentication authentication request message to the user data center. The user data center sends an authentication authentication request response message to the slice selection function entity, where the message carries the user security context, that is, the security vector group, and the slice selection function entity sends a user authentication authentication request message to the user equipment, where the message carries the authentication token. The user equipment verifies the validity of the network by using the authentication token, and calculates a desired response value, and sends a user authentication authentication request response message to the slice selection function entity, where the expected response value is carried, and the slice selection function entity is in the security context. The expected response value is compared with the received expected response value. If they are equal, the authenticated user equipment is legal, and the user subscription data is obtained from the user data center, and the slice selection function entity saves the security context and the user subscription data.

Step S706, the slice selection function entity selects an appropriate one according to the information in the user subscription data. The slice, ie the slice selection function entity, selects the appropriate slice identifier.

In step S708, the slice selection function entity sends a slice selection message to the radio access network, where the message carries a slice identifier, and the message may carry a slice selection function entity identifier, where the slice selection function entity identifier may include a slice selection function entity identifier, and may also include The slice selection function entity assigns a temporary identifier 1 to the user equipment.

Step S710, the radio access network selects a corresponding slice according to the corresponding slice identifier.

Step S712a, the radio access network sends an attach request message to the slice mobility management entity of the selected slice, and the slice mobility management entity selects an appropriate slice authentication authentication entity and forwards an attach request message to the slice authentication authentication entity, the attach request The message carries a slice selection function entity identifier.

Step S712b: Acquire user subscription data information from the slice selection function entity, and slice the authentication user.

The slice mobility management entity may obtain the user subscription data information from the slice selection function entity, or the slice authentication authentication entity may obtain the user subscription data information from the slice selection function entity. For the first case, the slice mobility management entity acquires the user subscription data and the user security context from the slice selection function entity according to the slice selection function entity identifier, saves the user subscription data, and sends the user security context to the slice authentication authentication entity. For the second case, the slice authentication authority acquires the user security context and/or the user subscription data from the slice selection function entity according to the slice selection function entity identity.

The authentication authentication process includes: the slice authentication authentication entity sends a user authentication authentication request message to the user equipment according to the user security context or the subscription data to authenticate the user, and the message carries the authentication command. The card, the user equipment verifies the validity of the network by using the authentication token, and calculates a desired response value, and sends a user authentication authentication request response message to the slice authentication and authenticating entity, where the expected response value is carried, and the slice authentication authentication entity The expected response value in the user security context is compared to the expected response value received, and if equal, the authenticated user device is legal. After the authentication user equipment is legal, if the slice authentication authentication entity does not acquire the user subscription data in the foregoing process, the slice authentication authentication entity may provide the user with the user. The data center obtains user subscription data. The slice authentication authentication entity and the slice mobility management entity save the security context and/or the user subscription data (the saved content is determined according to the content acquired as described above).

The slice mobility management entity may allocate a slice mobility management entity identifier to the user equipment, where the identifier is a user temporary identifier 2, and the temporary identifier 2 may include identifier information for identifying the mobility management entity, and may further include a slice mobility management entity. The identification information assigned to the user equipment (acting the same as the foregoing second identification information). The slice authentication authentication entity may allocate a slice authentication authentication entity identifier to the user equipment, where the identifier is a user temporary identifier 3, and the temporary identifier 3 may include identifier information for identifying a slice authentication authentication entity, and may also include slice authentication authentication. The identifier information assigned by the entity to the user equipment (acting the same as the foregoing first identifier information).

After the foregoing authentication and authentication is completed, the mobility management entity further needs to initiate a location update request to the user data center, the user data center saves the mobility management entity identifier, and sends a location update request response to the mobility management entity.

Step S712c, establishing a user plane connection with the user plane gateway (optional step).

Step S712d: After the authentication of the slice authentication authentication entity is successful, the connection response message is sent back to the slice mobility management entity, where the message may carry the user temporary identifier 3, and the slice mobility management entity sends an attach response message to the wireless network management entity, and the message may be Carry the user temporary identifier 3 and/or the user temporary identifier 2.

Step S714, the radio access network sends an attach response message to the user equipment message, where the message carries a slice identifier, and/or a user temporary identifier 1 (or a slice selection function entity identifier), and/or a user temporary identifier 2, and/or a user. Temporary identification 3.

Steps S702 to S714 complete the initial registration of the user equipment.

Step S716: The user equipment initiates a re-registration request message to the radio access network, where the message may carry at least one of the following identifier information: a slice identifier, a user temporary identifier 1 (or a slice selection function entity identifier), and a user temporary identifier 2 , user temporary identification 3.

Step S718: The radio access network directly forwards the re-registration request message to the slice management entity according to the slice identifier, where the message may carry at least one of the following identifier information: Identification 1, user temporary identification 2, user temporary identification 3.

Step S720, the re-registration process is completed according to step S712-step S714, wherein if the slice mobility management entity or the slice authentication capability entity can be able to find the user subscription according to the user temporary identifier 2 and/or the user temporary identifier 3 in step S712b The data or the user security context may directly authenticate whether the user equipment can access the slice. Otherwise, the user entity may subscribe to the data or the user security context according to the user temporary identifier 1 (or the slice selection function entity identifier).

The user data center is located in the user's home domain, and is generally not in the same place as the network slice. In the process of initial registration or re-registration, it is necessary to obtain the user security context and user subscription data multiple times in the home domain, which will increase the signaling load, and generally In the case of user data centers, there are more users, which will increase the processing load of the user data center. Through the above technical solution of the preferred embodiment of the present disclosure, by adding the slice selection function entity to the slice general network function entity or the slice control plane function entity interface, the user security is obtained from the user data center multiple times in the initial registration or re-registration. Context or user subscription data issues.

Through the description of the above embodiments, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware, but in many cases, the former is A better implementation. Based on such understanding, portions of the technical solutions of the present disclosure that contribute substantially or to the prior art may be embodied in the form of a software product stored in a storage medium (eg, ROM/RAM, disk, The optical disc includes a number of instructions for causing a terminal device (which may be a cell phone, a computer, a server, or a network device, etc.) to perform the methods described in various embodiments of the present disclosure.

Example 2

In the embodiment, a signal processing device is provided, which is used to implement the above-mentioned embodiments and preferred embodiments, and has not been described again. As used below, the term "module" may implement a combination of software and/or hardware of a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also implemented. Possible and conceived.

FIG. 8 is a structural block diagram 1 of a signal processing apparatus according to an embodiment of the present disclosure. As shown in FIG. 8, the apparatus includes:

The receiving module 82 is configured to receive a first attach request message for the user equipment to attach to the network, where the first attach request message carries a slice selection function entity identifier for identifying the slice selection function entity;

The obtaining module 84 is connected to the receiving module 82, and configured to acquire a user security context corresponding to the user equipment by using a slice selection function entity corresponding to the slice selection function entity identifier;

The authentication module 86 is connected to the obtaining module 84, and is configured to perform authentication and authentication on the user equipment according to the obtained user security context.

9 is a structural block diagram 2 of a signal processing apparatus according to an embodiment of the present disclosure. As shown in FIG. 9, the apparatus includes: in addition to all the modules shown in FIG. 8, the apparatus further includes:

The allocating module 92 is configured to allocate, to the user equipment, first identification information for identifying the user equipment, in a case that the authentication result of the authentication module is that the user equipment is legal;

The sending module 94 is connected to the foregoing allocating module 92, and is configured to send an attach response message to the user equipment, where the attach response message carries the first identifier information.

Optionally, the receiving module 82 is further configured to receive a second attach request message sent by the user equipment, where the second attach request message carries the first identifier information, and the obtaining module 84 is further configured to be configured according to the first identifier. The information is obtained by acquiring the security context corresponding to the locally saved user equipment. The authentication module 86 is further configured to perform authentication and authentication on the user equipment according to the obtained security context.

Optionally, the receiving module 82 is further configured to receive a preset message that is used by the preset network element to obtain the security context of the user equipment, where the preset message carries the first identifier information, and the acquiring module 84 further The method is configured to obtain the security context corresponding to the locally saved user equipment according to the first identifier information, and the sending module 94 is further configured to send the obtained security context to the preset network element.

Optionally, the obtaining module 84 is further configured to acquire user subscription data of the user equipment to the slice selection function entity.

An authentication authentication entity is also provided in this embodiment. FIG. 10 is a structural block diagram of an authentication authentication entity according to an embodiment of the present disclosure. As shown in FIG. 10, the authentication authentication entity includes the following in FIG. 8 or 9. Data processing device 102.

A data processing method is also provided in this embodiment. FIG. 11 is a structural block diagram 3 of a signal processing apparatus according to an embodiment of the present disclosure. As shown in FIG. 11, the apparatus includes:

The receiving module 112 is configured to receive a first attach request message for the user equipment to attach to the network, where the first attach request message carries a slice selection function entity identifier for identifying the slice selection function entity;

The obtaining module 114 is connected to the receiving module 112, and configured to acquire a user security context corresponding to the user equipment by using a slice selection function entity corresponding to the slice selection function entity identifier;

The sending module 116 is connected to the obtaining module 114, and is configured to send the obtained security context to the authentication and authenticating entity, where the security context is used by the authentication and authenticating entity to perform authentication and authentication on the user equipment.

FIG. 12 is a structural block diagram of a signal processing apparatus according to an embodiment of the present disclosure. As shown in FIG. 12, the apparatus includes: an allocating module 122, in addition to all the modules shown in FIG.

The receiving module 112 is further configured to receive a first attach response message sent by the authentication and authenticating entity;

The allocating module 122 is configured to allocate, to the user equipment, second identifier information for identifying the user equipment;

The sending module 116 is further configured to send a second attach response message to the user equipment, where the second attach response message carries the second identifier information.

Optionally, the receiving module 112 is further configured to receive a preset message that is sent by the preset network element to obtain the security context of the user equipment, where the preset message carries the second identifier information, and the acquiring module 114 further The method may be configured to obtain a security context corresponding to the locally saved user equipment according to the second identifier information, and the sending module 116 may also be configured to secure the obtained The following is sent to the default network element.

Optionally, the obtaining module 114 is further configured to acquire user subscription data of the user equipment to the slice selection function entity.

A mobility management entity is also provided in this embodiment. FIG. 13 is a structural block diagram of a mobility management entity according to an embodiment of the present disclosure. As shown in FIG. 13, the mobility management entity includes the same in FIG. 11 or 12. Data processing device 132 is shown.

It should be noted that each of the above modules may be implemented by software or hardware. For the latter, the foregoing may be implemented by, but not limited to, the foregoing modules are all located in the same processor; or, the above modules are in any combination. The forms are located in different processors.

Example 3

A network system is provided in this embodiment. FIG. 14 is a structural block diagram of a network system according to an embodiment of the present disclosure. As shown in FIG. 14, the network system includes: a slice selection function entity 142, an authentication authentication entity 144, and Mobility management entity 146, wherein the slice selection function entity 142 and the authentication authentication entity 144 interact through an interface, the authentication authentication entity 144 includes the first data processing device 1442 shown in FIG. 8 or FIG. 9, and/or The slice selection function entity 142 interacts with the mobility management entity 146 via an interface, and the second data processing device 1462 shown in FIG. 11 or FIG. 12 is mobility managed.

Example 4

Embodiments of the present disclosure also provide a storage medium. The storage medium includes a stored program, wherein the program described above executes the method of any of the above

Optionally, in the embodiment, the foregoing storage medium may be configured to store program code for performing the following steps:

S1, receiving a first attach request message for the user equipment to attach to the network, where the first attach request message carries a slice selection function entity identifier for identifying a slice selection function entity;

S2. Acquire a user equipment corresponding to the slice selection function entity corresponding to the slice selection function entity identifier. Corresponding user security context;

S3: Perform authentication and authentication on the user equipment according to the obtained user security context.

Optionally, the storage medium is further arranged to store program code for performing the following steps:

After the authentication and authentication result is that the user equipment is legal, after the user equipment is authenticated and authenticated according to the obtained user security context, the method further includes:

S1. The user equipment is allocated first identifier information for identifying the user equipment.

S2. The attach response message is sent to the user equipment, where the attach response message carries the first identifier information.

After sending the attach response message to the user equipment, the method further includes:

S1. The second attach request message sent by the user equipment is received, where the second attach request message carries the first identifier information.

S2. Acquire, according to the first identifier information, a security context corresponding to the locally saved user equipment.

S3: Perform authentication and authentication on the user equipment according to the obtained security context.

S1. The preset message sent by the preset network element to obtain the security context of the user equipment is received, where the preset message carries the first identifier information.

S3: Send the obtained security context to the preset network element.

In the process of authenticating the user equipment according to the obtained user security context, the method further includes:

The user subscription data of the user equipment is obtained from the slice selection function entity.

Optionally, in this embodiment, the foregoing storage medium may include, but is not limited to: a USB flash drive, only A medium that can store program code, such as a read-only memory (ROM), a random access memory (RAM), a removable hard disk, a magnetic disk, or an optical disk.

In this embodiment, the processor performs, according to the stored program code in the storage medium, the first attach request message for the user equipment to be attached to the network, where the first attach request message carries the identifier for selecting the slice selection entity. The slice selection entity identifier is obtained by the slice selection entity corresponding to the slice selection entity identifier, and the user security context corresponding to the user equipment is obtained; and the user equipment is authenticated and authenticated according to the obtained user security context.

Optionally, in this embodiment, the processor performs, according to the stored program code in the storage medium, the user equipment is authenticated according to the acquired user security context, if the authentication authentication result is that the user equipment is legal. After the authentication, the method further includes: allocating the first identifier information for identifying the user equipment to the user equipment; and sending the attach response message to the user equipment, where the attach response message carries the first identifier information.

Optionally, in this embodiment, the processor performs, according to the stored program code in the storage medium, after the sending the attach response message to the user equipment, the method further includes: receiving the second attach request message sent by the user equipment, where The second attach request message carries the first identifier information, and obtains a security context corresponding to the locally saved user equipment according to the first identifier information, and performs authentication authentication on the user equipment according to the obtained security context.

Optionally, in this embodiment, the processor performs, according to the stored program code in the storage medium, after the sending the attach response message to the user equipment, the method further includes: receiving the security sent by the preset network element for acquiring the user equipment. The preset message of the context, wherein the preset message carries the first identifier information; the security context corresponding to the locally saved user equipment is obtained according to the first identifier information; and the obtained security context is sent to the preset network element.

Optionally, in this embodiment, the processor is configured to: according to the stored program code in the storage medium, in the process of performing authentication and authentication on the user equipment according to the acquired user security context, the method further includes: acquiring, by the slice selection entity User subscription data for the user device.

Optionally, the optional examples in this embodiment may refer to the foregoing embodiment and the optional implementation manner. The examples described in this embodiment are not described herein again.

Example 5

This embodiment provides a storage medium. Optionally, in the embodiment, the foregoing storage medium may be configured to store program code for performing the following steps:

S2. The slice selection function entity corresponding to the slice selection function entity identifier acquires a user security context corresponding to the user equipment.

S3. The obtained security context is sent to the authentication and authenticating entity, where the security context is used by the authentication and authenticating entity to perform authentication and authentication on the user equipment.

After the obtained security context is sent to the authentication and authentication entity, the method further includes:

S1. Receive a first attach response message sent by the authentication and authenticating entity.

S2. The user equipment is allocated second identification information for identifying the user equipment.

S3. The second attach response message is sent to the user equipment, where the second attach response message carries the second identifier information.

After the second attach response message is sent to the user equipment, the method further includes:

S1. The second attach request message sent by the user equipment is received, where the second attach request message carries the second identifier information.

S2. Acquire a security context corresponding to the locally saved user equipment according to the second identifier information.

S3: Send the obtained security context to the authentication and authenticating entity.

S1. The preset message sent by the preset network element to obtain the security context of the user equipment is received, where the preset message carries the second identifier information.

S3: Send the obtained security context to the preset network element.

Optionally, the storage medium is further configured to store program code for performing the following steps: after sending the acquired security context to the authentication authentication entity, the method further includes: acquiring user subscription data of the user equipment to the slice selection function entity.

Optionally, in this embodiment, the foregoing storage medium may include, but not limited to, a USB flash drive, a Read-Only Memory (ROM), a Random Access Memory (RAM), a mobile hard disk, and a magnetic memory. A variety of media that can store program code, such as a disc or a disc.

In this embodiment, the processor performs, according to the stored program code in the storage medium, a first attach request message for the user equipment to be attached to the network, where the first attach request message carries the identifier for identifying the slice. The slice of the entity selects the entity identifier; the slice selection entity corresponding to the slice selection entity identifier acquires the user security context corresponding to the user equipment; and sends the obtained security context to the authentication authentication entity, where the security context The authentication and authentication entity is configured to perform authentication and authentication on the user equipment.

Optionally, in this embodiment, the processor performs, according to the stored program code in the storage medium, after the obtained security context is sent to the authentication and authenticating entity, the method further includes: receiving the authentication authentication. a first attach response message sent by the entity; a second identifier information for identifying the user equipment is allocated to the user equipment; and a second attach response message is sent to the user equipment, where the second attach response message carries There is the second identification information.

Optionally, in this embodiment, the processor performs, according to the stored program code in the storage medium, after sending the second attach response message to the user equipment, the method further includes: receiving, by the user equipment, a second attach request message, wherein the second attach request message carries the second identifier information; and the locally saved security context corresponding to the user equipment is obtained according to the second identifier information; The security context is sent to the authentication Certified entity.

Optionally, in this embodiment, the processor performs, according to the stored program code in the storage medium, after the sending the second attach response message to the user equipment, the method further includes: receiving, by using the preset network element, Obtaining a preset message of the security context of the user equipment, where the preset message carries the second identifier information, and according to the second identifier information, acquiring a local device corresponding to the user equipment The security context is sent; the obtained security context is sent to the preset network element.

Optionally, in this embodiment, the processor performs, according to the stored program code in the storage medium, after the obtained security context is sent to the authentication and authenticating entity, the method further includes: selecting an entity to the slice Obtaining user subscription data of the user equipment.

Embodiments of the present disclosure also provide a processor for running a program, wherein the program executes the steps of any of the above methods when executed.

For an alternative example in this embodiment, reference may be made to the examples described in the foregoing embodiments and the optional embodiments, and details are not described herein again.

It will be apparent to those skilled in the art that the various modules or steps of the present disclosure described above can be implemented by a general-purpose computing device that can be centralized on a single computing device or distributed across a network of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein. The steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated as a single integrated circuit module. As such, the disclosure is not limited to any specific combination of hardware and software.

The above description is only a preferred embodiment of the present disclosure, and is not intended to limit the disclosure, and various changes and modifications may be made to the present disclosure. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and scope of the present disclosure are intended to be included within the scope of the present disclosure.

Industrial applicability

In an embodiment of the present disclosure, the user security context is obtained from the slice selection function entity by using the slice selection function entity identifier, and the user equipment is authenticated, and the slice selection function entity and the slice general network function entity or the slice control plane function entity interface are added. The processing load of the user data center is reduced, so that the registration process of the user in the related technology needs to interact with the user data center multiple times, and the processing load of the user data center is increased, thereby reducing signaling load and reducing user data center processing. The effect of the load.

Claims

An information processing method includes:

Receiving a first attach request message for the user equipment to be attached to the network, where the first attach request message carries a slice selection function entity identifier for identifying a slice selection function entity;

And selecting, by the slice selection function entity corresponding to the slice function entity identifier, a user security context corresponding to the user equipment;

And authenticating the user equipment according to the obtained user security context.
The method according to claim 1, wherein, after the authentication authentication result is that the user equipment is legal, after the user equipment is authenticated and authenticated according to the obtained user security context, the method further includes:

Allocating first identifier information for identifying the user equipment to the user equipment;

Sending an attach response message to the user equipment, where the attach response message carries the first identifier information.
The method of claim 2, after the sending the attach response message to the user equipment, further comprising:

Receiving a second attach request message sent by the user equipment, where the second attach request message carries the first identifier information;

Obtaining, according to the first identifier information, the security context corresponding to the locally saved user equipment;

And authenticating the user equipment according to the obtained security context.
The method of claim 2, after the sending the attach response message to the user equipment, further comprising:

Receiving, by the preset network element, a preset message for acquiring a security context of the user equipment, where the preset message carries the first identifier information;

Obtaining, according to the first identifier information, the security context corresponding to the locally saved user equipment;

And sending the obtained security context to the preset network element.
The method according to any one of claims 1 to 4, wherein, in the process of performing authentication and authentication on the user equipment according to the acquired user security context, the method further includes:

And acquiring, by the slice selection function entity, user subscription data of the user equipment.
An information processing method includes:

Receiving a first attach request message for the user equipment to be attached to the network, where the first attach request message carries a slice selection function entity identifier for identifying a slice selection function entity;

And selecting, by the slice selection function entity corresponding to the slice function entity identifier, a user security context corresponding to the user equipment;

Sending the obtained security context to the authentication and authentication entity, where the security context is used by the authentication and authentication entity to perform authentication and authentication on the user equipment.
The method according to claim 6, wherein after the obtained security context is sent to the authentication and authentication entity, the method further includes:

Receiving a first attach response message sent by the authentication and authenticating entity;

Allocating, to the user equipment, second identifier information for identifying the user equipment;

Sending a second attach response message to the user equipment, where the second attach response message carries the second identifier information.
The method of claim 7, further comprising: after transmitting the second attach response message to the user equipment,

Receiving a second attach request message sent by the user equipment, where the second attach The request information carries the second identification information;

Acquiring, according to the second identifier information, the security context corresponding to the locally saved user equipment;

Sending the obtained security context to the authentication authentication entity.
The method of claim 7, further comprising: after transmitting the second attach response message to the user equipment,

Receiving, by the preset network element, a preset message for acquiring a security context of the user equipment, where the preset message carries the second identifier information;

Acquiring, according to the second identifier information, the security context corresponding to the locally saved user equipment;

And sending the obtained security context to the preset network element.
The method according to any one of claims 6 to 9, wherein after the obtained security context is sent to the authentication and authentication entity, the method further includes:

And acquiring, by the slice selection function entity, user subscription data of the user equipment.
An information processing apparatus comprising:

a receiving module, configured to receive a first attach request message for the user equipment to attach to the network, where the first attach request message carries a slice selection function entity identifier for identifying a slice selection function entity;

An acquiring module, configured to acquire a user security context corresponding to the user equipment by selecting a slice selection function entity corresponding to the slice function entity identifier;

The authentication module is configured to perform authentication and authentication on the user equipment according to the obtained user security context.
The device according to claim 11, further comprising:

An allocation module, configured to perform authentication authentication on the authentication module as the user equipment In the case of the method, the user equipment is allocated first identification information for identifying the user equipment;

The sending module is configured to send an attach response message to the user equipment, where the attach response message carries the first identifier information.
The device according to claim 12, wherein

The receiving module is further configured to receive a second attach request message sent by the user equipment, where the second attach request message carries the first identifier information;

The obtaining module is further configured to: obtain the security context corresponding to the locally saved user equipment according to the first identifier information;

The authentication module is further configured to perform authentication and authentication on the user equipment according to the obtained security context.
The device according to claim 12, wherein

The receiving module is further configured to receive a preset message that is sent by the preset network element to obtain the security context of the user equipment, where the preset message carries the first identifier information;

The obtaining module is further configured to: obtain the security context corresponding to the locally saved user equipment according to the first identifier information;

The sending module is further configured to send the obtained security context to the preset network element.
The apparatus according to any one of claims 11 to 14, wherein

The acquiring module is further configured to acquire user subscription data of the user equipment to the slice selection function entity.
An authentication authentication entity comprising: the apparatus of any one of claims 11 to 15.
An information processing apparatus comprising:

a receiving module, configured to receive a first attach request message for the user equipment to attach to the network, where the first attach request message carries a slice selection function entity identifier for identifying a slice selection function entity;

An acquiring module, configured to acquire a user security context corresponding to the user equipment by selecting a slice selection function entity corresponding to the slice function entity identifier;

The sending module is configured to send the obtained security context to the authentication and authentication entity, where the security context is used by the authentication and authentication entity to perform authentication and authentication on the user equipment.
The apparatus according to claim 17, further comprising: an allocation module, wherein

The receiving module is further configured to receive a first attach response message sent by the authentication and authenticating entity;

The allocating module is configured to allocate, to the user equipment, second identifier information for identifying the user equipment;

The sending module is further configured to send a second attach response message to the user equipment, where the second attach response message carries the second identifier information.
The device according to claim 18, wherein

The receiving module is further configured to receive a second attach request message sent by the user equipment, where the second attach request message carries the second identifier information;

The obtaining module is further configured to acquire, according to the second identifier information, the security context corresponding to the locally saved user equipment;

The sending module is further configured to send the obtained security context to the authentication and authenticating entity.
The device according to claim 18, wherein

The receiving module is further configured to receive a preset message that is sent by the preset network element to obtain the security context of the user equipment, where the preset message carries the second identifier information;

The obtaining module is further configured to acquire, according to the second identifier information, the security context corresponding to the locally saved user equipment;

The sending module is further configured to send the obtained security context to the preset network element.
The apparatus according to any one of claims 17 to 20, wherein

The acquiring module is further configured to acquire user subscription data of the user equipment to the slice selection function entity.
A mobility management entity comprising: the apparatus of any one of claims 17 to 21.
A network system includes a slice selection function entity, an authentication authentication entity, and a mobility management entity, wherein the slice selection function entity interacts with the authentication authentication entity through an interface, and the authentication authentication entity includes a claim The apparatus of any one of 11 to 15, and/or the slice selection function entity interacts with the mobility management entity via an interface, the mobility management entity comprising any one of claims 17 to 21 A device as described.
A storage medium, the storage medium comprising a stored program, wherein the program is executed to perform the method of any one of claims 1 to 10.
A processor for running a program, wherein the program is executed to perform the method of any one of claims 1 to 10.