WO2018064824A1 - 网络访问控制方法、装置及设备 - Google Patents

网络访问控制方法、装置及设备 Download PDF

Info

Publication number
WO2018064824A1
WO2018064824A1 PCT/CN2016/101529 CN2016101529W WO2018064824A1 WO 2018064824 A1 WO2018064824 A1 WO 2018064824A1 CN 2016101529 W CN2016101529 W CN 2016101529W WO 2018064824 A1 WO2018064824 A1 WO 2018064824A1
Authority
WO
WIPO (PCT)
Prior art keywords
instance
type
network slice
accessed
network
Prior art date
Application number
PCT/CN2016/101529
Other languages
English (en)
French (fr)
Inventor
马景旺
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority to BR112019006929-1A priority Critical patent/BR112019006929B1/pt
Priority to RU2019113932A priority patent/RU2709286C1/ru
Priority to KR1020197013371A priority patent/KR102181956B1/ko
Priority to PCT/CN2016/101529 priority patent/WO2018064824A1/zh
Priority to CN201680089757.XA priority patent/CN109845190B/zh
Priority to JP2019518956A priority patent/JP6768942B2/ja
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP16918158.3A priority patent/EP3525522B1/en
Priority to CN202110027483.4A priority patent/CN112887962B/zh
Priority to EP20188920.1A priority patent/EP3799480B1/en
Publication of WO2018064824A1 publication Critical patent/WO2018064824A1/zh
Priority to US16/379,394 priority patent/US10743247B2/en
Priority to US16/942,025 priority patent/US11997489B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/02—Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
    • H04W8/08—Mobility data transfer
    • H04W8/14—Mobility data transfer between corresponding nodes
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0893—Assignment of logical groups to network elements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0894—Policy-based network configuration management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/08—Access restriction or access information delivery, e.g. discovery data delivery
    • H04W48/14—Access restriction or access information delivery, e.g. discovery data delivery using user query or user detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/16—Discovering, processing access restriction or access information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/17—Selecting a data network PoA [Point of Attachment]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/18—Selecting a network or a communication service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W60/00—Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H04W76/11—Allocation or use of connection identifiers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/18—Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
    • H04W84/04—Large scale networks; Deep hierarchical networks
    • H04W84/042—Public Land Mobile systems, e.g. cellular systems

Definitions

  • the present invention relates to the field of communications technologies, and in particular, to a network access control method, apparatus, and device.
  • the Public Land Mobile Network is a network established and operated for the purpose of providing land mobile communication services to the public.
  • PLMN can be divided into multiple networks. Slices are provided by respective network slices for respective network services.
  • a network segment may be included in a single PLMN.
  • Each network segment may be deployed with multiple Network Function (NF) instances.
  • NF Network Function
  • Each NF instance may provide one type of network service to the user.
  • a cross-PLMN roaming service for example, a terminal device provided by a Chinese operator is located abroad
  • an NF instance in one PLMN may need to access an instance of the NF to be accessed in another PLMN, in the prior art, one The NF instance in the PLMN can access the NF instance in the other PLMN according to the NF type of the NF instance to be accessed.
  • the to-be-accessed The NF instance may not include the network function or data required by the NF instance, and the NF instance cannot access the correct NF instance to be accessed, which results in poor reliability of access of the NF instance between different PLMNs.
  • the embodiment of the invention provides a network access control method, device and device for improving the reliability of access of an NF instance between different PLMNs.
  • the embodiment of the present invention provides a network access control method, where the method includes: when the first NF instance needs to access the NF instance of the NF type of the NF instance to be accessed in the second PLMN, the first NF instance is The first NFRF sends a discovery request, where the discovery request includes an identifier of the second PLMN and an NF type of the NF instance to be accessed; the first NFRF acquires the to-be-accessed network slice identifier, And requesting, by the second NFRF in the second PLMN, the NF type of the NF instance to be accessed and the instance information of the second NF instance corresponding to the to-be-accessed network slice identifier, and sending instance information to the first NF instance, so that the first NF instance is sent.
  • the second NF instance is accessed according to the instance information.
  • a first NFRF is set for the first PLMN, and the NF instance in the first PLMN is managed by the first NFRF; the second NFRF is set for the second PLMN, and the second NFRF is used by the second NFRF The NF instance is managed.
  • the first NF instance may obtain instance information of the second NF instance according to the first NFRF and the second NFRF, and according to the first The instance information of the two NF instances accesses the second NF instance, so that the NF instance in one PLMN can accurately access the NF instance in other PLMNs, thereby improving the reliability of accessing the NF instance in different PLMNs.
  • the first NFRF may obtain the to-be-accessed network slice identifier corresponding to the NF instance to be accessed, and send the identifier to the second NFRF. Sending a request for obtaining the NF type of the NF instance to be accessed and the network slice identifier to be accessed, and receiving the NF type of the NF instance to be accessed and the second NF instance corresponding to the to-be-accessed network slice identifier sent by the second NFRF Instance information.
  • the network slice identifier to be accessed is the type of the network slice to be accessed, or the network slice identifier to be accessed is a combination of the type of the network slice to be accessed and the tenant identifier.
  • the first NFRF can obtain the to-be-accessed network slice identifier corresponding to the NF instance to be accessed by using the following two possible implementation manners:
  • the discovery request includes the to-be-accessed network slice identifier; correspondingly, the first NFRF may obtain the to-be-accessed network slice identifier in the discovery request.
  • the first NF instance determines the to-be-accessed network slice identifier corresponding to the NF instance to be accessed, and carries the to-be-accessed network slice identifier in the discovery request, so that the first NFRF can quickly acquire the to-be-accessed network. Slice identification.
  • the first NFRF obtains a function type corresponding to the first NF instance, and determines a network slice identifier to be accessed according to the function type corresponding to the first NF instance.
  • the first NFRF may acquire the first network slice type of the first network slice to which the first NF instance belongs; determine the first according to the function type corresponding to the first NF instance. a second network slice type corresponding to the network slice type in the second PLMN; determining the second network slice type as the to-be-accessed network slice identifier.
  • the function type corresponding to the first NF instance is the first function type
  • the method may be configured to send a slice type acquisition request to the policy management unit, where the network slice acquisition request includes the first network slice type and an identifier of the second PLMN, and received by the policy management unit, The first network slice type corresponds to a second network slice type in the second PLMN.
  • the first NFRF can accurately obtain the to-be-accessed network slice identifier corresponding to the NF instance to be accessed according to the function type corresponding to the first NF instance, and further improve the access of the NF instance in different PLMNs. reliability.
  • the instance information includes an address of the second NF instance; and correspondingly, sending the instance information to the first NF instance, including: sending the instance information to the first NF instance, so that The first NF instance accesses the second NF instance according to an address of a second NF instance in the instance information.
  • sending the instance information to the first NF instance includes: sending the first NF instance to the first NF instance Sending instance information of each of the second NF instances, so that the first NF instance determines a target second NF instance in the second NF instance, and accesses the target according to an address of the target second NF instance The second NF instance.
  • the instance information includes load information of each of the second NF instances, so that the first NF instance determines a target among multiple second NF instances according to load information of each of the second NF instances. a second NF instance, and accessing the target second NF instance according to the address of the target second NF instance.
  • the obtaining request may further include an NF type of the first NF instance, so that the second NFRF sends the NF class of the first NF instance before sending the instance information of the second NF instance to the first NFRF.
  • the type is verified to ensure the security of access to the NF instance in different PLMNs.
  • the added NF instance may be registered in the NFRF, specifically: receiving The NF registration request includes the instance information of the NF instance to be registered and the slice information of the network slice to which the NF instance to be registered belongs; the instance information of the NF instance to be registered, and the slice information of the network slice to which the NF instance to be registered belongs Generate instance information of the NF instance to be registered.
  • the instance information of the NF instance to be registered includes at least one of an identifier of the to-be-registered instance, an NF type of the instance to be registered, and an address of the instance to be registered;
  • the slice information of the target network slice includes the identifier and target of the target network slice. At least one of the types of network slices.
  • an embodiment of the present invention provides a network access control method, where an execution entity of the method is a second NFRF in a second PLMN, and the method may include: receiving, by the second NFRF, an acquisition request sent by the first NFRF, and acquiring the request The NF instance type to be accessed and the network slice identifier to be accessed are obtained, and the NF type of the NF instance to be accessed and the instance information of the second NF instance corresponding to the to-be-accessed network slice identifier are obtained according to the acquisition request, and sent to the first NFRF. Instance information of the second NF instance.
  • the second NFRF may manage the NF instance in the second PLMN, so that after the second NFRF receives the acquisition request sent by the first NFRF, the second NFRF may acquire the NF type of the NF instance to be accessed and The instance information of the second NF instance corresponding to the network slice identifier is to be accessed, and the instance information of the second NF instance is sent to the first NFRF, so that the first NF instance in the first PLMN can access the second NF instance, which improves the difference.
  • the reliability of NF instance access in PLMN is mapped to the second NFRF.
  • the second NFRF obtains the NF type of the NF instance to be accessed and the instance information of the second NF instance corresponding to the to-be-accessed network slice identifier according to the obtaining request: Obtaining an NF type of the to-be-accessed NF instance and an address and load information of a second NF instance corresponding to the to-be-accessed network slice identifier.
  • the method before acquiring the NF type of the NF instance to be accessed and the address and load information of the second NF instance corresponding to the to-be-accessed network slice identifier, the method further includes:
  • the step of acquiring the NF type of the NF instance to be accessed and the address and load information of the second NF instance corresponding to the to-be-accessed network slice identifier is performed, so that The first NF instance is configured to select one target second NF instance among the plurality of second NF instances according to load information of each second NF instance.
  • the acquiring the request further includes the NF type of the first NF instance; correspondingly, acquiring the NF type of the NF instance to be accessed and the to-be-accessed network according to the obtaining request before the slice identifier identifies the instance information of the second NF instance, the method further includes:
  • each NF type in the first NF type set is an NF type of an NF instance that allows access to the to-be-accessed NF instance;
  • the first NF type set includes the NF type of the first NF instance, performing instance information of acquiring the NF type of the NF instance to be accessed and the second NF instance corresponding to the to-be-accessed network slice identifier; Or if the determining that the first NF type set does not include the NF type of the first NF instance, sending access restricted prompt information to the first NFRF, so that the first NFRF is The first NF instance sends the access restricted prompt information. In turn, the security of accessing NF instances across PLMNs is improved.
  • the embodiment of the present invention provides a network control method, where the method may include: when the first NF instance needs to access the NF instance of the NF type of the NF instance to be accessed in the second PLMN, the first NF instance is to be acquired.
  • the network slice identifier to be accessed is obtained, and the network slice identifier to be accessed is carried in the discovery request sent to the first NFRF instance, so that the second NFRF can be determined according to Accessing the NF type of the NF instance and the to-be-accessed network slice identifier obtains instance information of the second NF instance, so that the first NF instance can access the second NF instance in the second PLMN.
  • the first NF instance may obtain the to-be-accessed network slice identifier of the network slice to which the to-be-accessed NF instance belongs by using the following possible implementation manners:
  • the function type corresponding to the first NF instance is the first function type
  • the function type corresponding to the first NF instance is the second function type
  • the type of slice in the is different.
  • the first NF instance may send a slice type acquisition request to the policy management unit, where the network slice acquisition request includes the first network slice type and an identifier of the second PLMN; and the policy management is received.
  • the second network slice type corresponding to the first network slice type sent by the unit in the second PLMN.
  • an embodiment of the present invention provides a network access control apparatus, where the network access control apparatus is applied to a first NFRF in a first PLMN, where the apparatus includes a receiving module, a processing module, and a sending module, where
  • the receiving module is configured to receive a discovery request sent by the first network function NF instance, where the discovery request includes an identifier of the second PLMN and an NF type of the NF instance to be accessed;
  • the processing module is configured to obtain a network slice identifier to be accessed
  • the sending module is configured to send an acquisition request to the second NFRF corresponding to the identifier of the second PLMN, where the obtaining request includes an NF type of the NF instance to be accessed and the to-be-accessed network slice identifier;
  • the receiving module is configured to receive, by the second NFR, the NF type of the NF instance to be accessed and the instance information of the second NF instance corresponding to the to-be-accessed network slice identifier;
  • the sending module is configured to send the instance information to the first NF instance.
  • the network access control apparatus shown in the embodiment of the present invention may perform the method shown in the foregoing method embodiment.
  • the technical solution, its implementation principle and beneficial effects are similar, and will not be described again here.
  • the to-be-accessed network slice identifier is a type of the to-be-accessed network slice
  • the to-be-accessed network slice identifier is a combination of the type of the to-be-accessed network slice and the tenant identification.
  • the discovery request includes the to-be-accessed network slice identifier; correspondingly, the processing module is specifically configured to:
  • processing module is specifically configured to:
  • processing module is specifically configured to:
  • processing module is specifically configured to:
  • the first network type Determining, by the first network type, the first network slice type of the first network slice to which the first NF instance belongs as the second network slice type, where the function type of the first NF instance is the first function type;
  • the network function corresponding to the first function type has the same slice type in all PLMNs;
  • the function type corresponding to the first NF instance is the second function type, requesting, by the policy management unit, the second network slice type, where the network function corresponding to the second function type is a slice type in different PLMNs different.
  • the sending module is further configured to send a slice type acquisition request to the policy management unit, where the network slice acquisition request includes the first network slice type and the second The identity of the PLMN;
  • the receiving module is further configured to receive, by the policy management unit, the first network cut The slice type corresponds to a second network slice type in the second PLMN.
  • the instance information includes an address of the second NF instance; correspondingly, the sending module is specifically configured to:
  • the number of the second NF instances corresponding to the NF type of the NF instance to be accessed is greater than 1;
  • the sending module is specifically configured to:
  • the instance information includes load information of each of the second NF instances, so that the first NF instance is in multiple according to load information of each of the second NF instances.
  • the target second NF instance is determined in the two NF instance, and the target second NF instance is accessed according to the address of the target second NF instance.
  • the method further includes:
  • the receiving module is further configured to receive an NF registration request, where the NF registration request includes instance information of the NF instance to be registered, and slice information of the network slice to which the NF instance to be registered belongs;
  • the processing module is further configured to generate instance information of the NF instance to be registered according to the instance information of the NF instance to be registered and the slice information of the network slice to which the NF instance to be registered belongs.
  • the instance information of the NF instance to be registered includes at least one of an identifier of an instance to be registered, an NF type of an instance to be registered, and an address of an instance to be registered;
  • the slice information of the target network slice includes at least one of an identifier of the target network slice and a type of the target network slice.
  • the network access control device shown in the embodiment of the present invention may perform the technical solutions shown in the foregoing method embodiments, and the implementation principles and beneficial effects thereof are similar, and details are not described herein.
  • an embodiment of the present invention provides another network access control apparatus, where the network control apparatus is applied to a second NFRF in a second PLMN, where the apparatus includes a receiving module, a processing module, and a sending module, where
  • the receiving module is configured to receive an acquisition request sent by the first NFRF, where the obtaining request is Including the to-be-accessed network function NF instance type and the to-be-accessed network slice identifier;
  • the processing module is configured to obtain, according to the obtaining request, instance information of an NF type of the NF instance to be accessed and a second NF instance corresponding to the to-be-accessed network slice identifier;
  • the sending module is configured to send instance information of the second NF instance to the first NFRF.
  • the network access control device shown in the embodiment of the present invention may perform the technical solutions shown in the foregoing method embodiments, and the implementation principles and beneficial effects thereof are similar, and details are not described herein.
  • the processing module is specifically configured to:
  • processing module is further configured to:
  • the step of acquiring the NF type of the NF instance to be accessed and the address and load information of the second NF instance corresponding to the to-be-accessed network slice identifier is performed.
  • the acquiring request further includes an NF type of the first NF instance; correspondingly, the processing module is further configured to:
  • each NF type in the first NF type set is an NF type of an NF instance that allows access to the to-be-accessed NF instance;
  • the instance information of the NF type of the NF instance to be accessed and the second NF instance corresponding to the to-be-accessed network slice identifier is performed.
  • the sending module is further configured to send, to the first NFRF, if the NF type of the first NF instance is not included in the first NF type set. Accessing the restricted prompt information, so that the first NFRF sends the access restricted prompt information to the first NF instance.
  • the network access control device shown in the embodiment of the present invention may perform the technical solutions shown in the foregoing method embodiments, and the implementation principles and beneficial effects thereof are similar, and details are not described herein.
  • the embodiment of the present invention provides a network control device, where the network control device is applied to a first NF instance, the device processing module, a sending module, and a receiving module, where
  • the processing module is configured to obtain an NF type of the NF instance to be accessed, and a to-be-accessed network slice identifier of the network slice to which the NF instance to be accessed belongs;
  • the sending module is configured to send a discovery request to the first network function management module NFRF, where the sending request includes an identifier of the second PLMN, an NF type of the NF instance to be accessed, and the to-be-accessed network slice identifier, so that the sending request includes:
  • the first NFRF requests the second NFRF request in the second PLMN to obtain instance information of the NF type of the NF instance to be accessed and the second NF instance corresponding to the to-be-accessed network slice identifier;
  • the receiving module is configured to receive instance information of the second NF instance sent by the first NFRF.
  • the network access control device shown in the embodiment of the present invention may perform the technical solutions shown in the foregoing method embodiments, and the implementation principles and beneficial effects thereof are similar, and details are not described herein.
  • the processing module is specifically configured to:
  • processing module is specifically configured to:
  • the first network type Determining, by the first network type, the first network slice type of the first network slice to which the first NF instance belongs as the second network slice type, where the function type of the first NF instance is the first function type;
  • the network function corresponding to the first function type has the same slice type in all PLMNs;
  • the function type corresponding to the first NF instance is the second function type, requesting, by the policy management unit, the second network slice type, where the network function corresponding to the second function type is a slice type in different PLMNs different.
  • the sending module is further configured to: Transmitting a slice type acquisition request, where the network slice acquisition request includes the first network slice type and an identifier of the second PLMN;
  • the receiving module is further configured to receive, by the policy management unit, a second network slice type corresponding to the first network slice type in the second PLMN.
  • the network access control device shown in the embodiment of the present invention may perform the technical solutions shown in the foregoing method embodiments, and the implementation principles and beneficial effects thereof are similar, and details are not described herein.
  • an embodiment of the present invention provides a network access control device, where the network access control device is applied to a first NFRF in a first PLMN, where the device includes a receiver, a processor, a transmitter, a memory, and a communication bus.
  • the memory is used to store the program
  • the communication bus is used to implement the communication connection between the components
  • the processor can read the program in the memory and perform corresponding operations, wherein
  • the receiver is configured to receive a discovery request sent by the first network function NF instance, where the discovery request includes an identifier of the second PLMN and an NF type of the NF instance to be accessed;
  • the processor is configured to obtain a network slice identifier to be accessed
  • the transmitter is configured to send an acquisition request to the second NFRF corresponding to the identifier of the second PLMN, where the acquisition request includes an NF type of the NF instance to be accessed and the to-be-accessed network slice identifier;
  • the receiver is configured to receive, by the second NFR, the NF type of the NF instance to be accessed and the instance information of the second NF instance corresponding to the to-be-accessed network slice identifier;
  • the transmitter is configured to send the instance information to the first NF instance.
  • the network access control device shown in the embodiment of the present invention may perform the technical solutions shown in the foregoing method embodiments, and the implementation principles and beneficial effects thereof are similar, and details are not described herein.
  • the to-be-accessed network slice identifier is a type of the to-be-accessed network slice
  • the to-be-accessed network slice identifier is a combination of the type of the to-be-accessed network slice and the tenant identification.
  • the discovery request includes the to-be-accessed network slice identifier; correspondingly, the processor is specifically configured to:
  • the processor is specifically configured to:
  • the processor is specifically configured to:
  • the processor is specifically configured to:
  • the first network type Determining, by the first network type, the first network slice type of the first network slice to which the first NF instance belongs as the second network slice type, where the function type of the first NF instance is the first function type;
  • the network function corresponding to the first function type has the same slice type in all PLMNs;
  • the function type corresponding to the first NF instance is the second function type, requesting, by the policy management unit, the second network slice type, where the network function corresponding to the second function type is a slice type in different PLMNs different.
  • the transmitter is further configured to send a slice type acquisition request to the policy management unit, where the network slice acquisition request includes the first network slice type and the second The identity of the PLMN;
  • the receiver is further configured to receive, by the policy management unit, a second network slice type corresponding to the first network slice type in the second PLMN.
  • the instance information includes an address of the second NF instance; correspondingly, the sender is specifically configured to:
  • the number of the second NF instances corresponding to the NF type of the NF instance to be accessed is greater than 1;
  • the transmitter is specifically configured to:
  • the NF instance determines a target second NF instance in the second NF instance and accesses the target second NF instance according to the address of the target second NF instance.
  • the instance information includes load information of each of the second NF instances, so that the first NF instance is in multiple according to load information of each of the second NF instances.
  • the target second NF instance is determined in the two NF instance, and the target second NF instance is accessed according to the address of the target second NF instance.
  • the method further includes:
  • the receiver is further configured to receive an NF registration request, where the NF registration request includes instance information of an NF instance to be registered, and slice information of a network slice to which the NF instance to be registered belongs;
  • the processor is further configured to generate instance information of the NF instance to be registered according to the instance information of the NF instance to be registered and the slice information of the network slice to which the NF instance to be registered belongs.
  • the instance information of the NF instance to be registered includes at least one of an identifier of an instance to be registered, an NF type of an instance to be registered, and an address of an instance to be registered;
  • the slice information of the target network slice includes at least one of an identifier of the target network slice and a type of the target network slice.
  • the network access control device shown in the embodiment of the present invention may perform the technical solutions shown in the foregoing method embodiments, and the implementation principles and beneficial effects thereof are similar, and details are not described herein.
  • the embodiment of the present invention provides a network access control device, which is applied to a second network function manager NFRF in a second public land mobile network PLMN, where the device includes a receiver, a processor, and a transmitter, where
  • the receiver is configured to receive an acquisition request sent by the first NFRF, where the acquisition request includes the to-be-accessed network function NF instance type and the to-be-accessed network slice identifier;
  • the processor is configured to obtain, according to the obtaining request, instance information of an NF type of the NF instance to be accessed and a second NF instance corresponding to the to-be-accessed network slice identifier;
  • the transmitter is configured to send instance information of the second NF instance to the first NFRF.
  • the network access control device shown in the embodiment of the present invention may perform the technical solutions shown in the foregoing method embodiments, and the implementation principles and beneficial effects thereof are similar, and details are not described herein.
  • the processor is specifically configured to:
  • the processor is further configured to:
  • the processor acquires the NF type of the NF instance to be accessed and the address and load information of the second NF instance corresponding to the to-be-accessed network slice identifier Accessing the number of the second NF instance corresponding to the network slice identifier;
  • the step of acquiring the NF type of the NF instance to be accessed and the address and load information of the second NF instance corresponding to the to-be-accessed network slice identifier is performed.
  • the acquiring request further includes an NF type of the first NF instance; correspondingly, the processor is further configured to:
  • each NF type in the first NF type set is an NF type of an NF instance that allows access to the to-be-accessed NF instance;
  • the instance information of the NF type of the NF instance to be accessed and the second NF instance corresponding to the to-be-accessed network slice identifier is performed.
  • the transmitter is further configured to send, to the first NFRF, if the NF type of the first NF instance is not included in the first NF type set. Accessing the restricted prompt information, so that the first NFRF sends the access restricted prompt information to the first NF instance.
  • the network access control device shown in the embodiment of the present invention may perform the technical solutions shown in the foregoing method embodiments, and the implementation principles and beneficial effects thereof are similar, and details are not described herein.
  • an embodiment of the present invention provides a network control device, which is applied to an instance of a first network function NF, the device processor, a transmitter, and a receiver, where
  • the processor is configured to obtain an NF type of the NF instance to be accessed, and a to-be-accessed network slice identifier of the network slice to which the NF instance to be accessed belongs;
  • the sender is configured to send a discovery request to the first network function manager NFRF, where the sending request includes an identifier of the second PLMN, an NF type of the NF instance to be accessed, and the to-be-accessed network slice identifier, so that the sender
  • the first NFRF requests the second NFRF request in the second PLMN to obtain the NF type of the NF instance to be accessed and the second NF instance corresponding to the to-be-accessed network slice identifier.
  • Instance information
  • the receiver is configured to receive instance information of the second NF instance sent by the first NFRF.
  • the network access control device shown in the embodiment of the present invention may perform the technical solutions shown in the foregoing method embodiments, and the implementation principles and beneficial effects thereof are similar, and details are not described herein.
  • the processor is specifically configured to:
  • the processor is specifically configured to:
  • the first network type Determining, by the first network type, the first network slice type of the first network slice to which the first NF instance belongs as the second network slice type, where the function type of the first NF instance is the first function type;
  • the network function corresponding to the first function type has the same slice type in all PLMNs;
  • the function type corresponding to the first NF instance is the second function type, requesting, by the policy management unit, the second network slice type, where the network function corresponding to the second function type is a slice type in different PLMNs different.
  • the transmitter is further configured to send a slice type acquisition request to the policy management unit, where the network slice acquisition request includes the first network slice type and the second The identity of the PLMN;
  • the receiver is further configured to receive, by the policy management unit, a second network slice type corresponding to the first network slice type in the second PLMN.
  • the network access control device shown in the embodiment of the present invention may perform the technical solutions shown in the foregoing method embodiments, and the implementation principles and beneficial effects thereof are similar, and details are not described herein.
  • an embodiment of the present invention provides a network control system, where the network control system includes the network control device according to the seventh to ninth aspects.
  • the network access control method, device and device provided by the embodiment of the present invention, by setting a first NFRF in the first PLMN, and setting a second NFRF in the second PLMN, the first NFRF is used for storing Instance information of each NF instance in the first PLMN, and the second NFRF is used to store instance information of each NF instance in the second PLMN.
  • the first NF instance may obtain instance information of the second NF instance by using the first NFRF and the second NFRF, and according to the second NF The instance information of the instance accesses the second NF instance, so that the first NF instance in the first PLMN can be accessed to access the NF instance in the second PLMN, thereby improving the reliability of the NF instance access in different PLMNs.
  • FIG. 1 is a schematic diagram of an application scenario of a network access control method according to an embodiment of the present disclosure
  • FIG. 2 is a schematic flowchart 1 of a network access control method according to an embodiment of the present invention
  • FIG. 3 is a schematic flowchart of a method for registering an NF instance in an NFRF according to an embodiment of the present invention
  • FIG. 4 is a schematic flowchart of a method for obtaining a slice identifier of a network to be accessed according to an embodiment of the present disclosure
  • FIG. 5 is a schematic flowchart of a method for verifying a slice identifier of a network to be accessed according to an embodiment of the present disclosure
  • FIG. 6 is a second schematic flowchart of a network access control method according to an embodiment of the present disclosure.
  • FIG. 7 is a schematic flowchart 3 of a network access control method according to an embodiment of the present disclosure.
  • FIG. 8 is a schematic flowchart 4 of a network access control method according to an embodiment of the present disclosure.
  • FIG. 9 is a schematic structural diagram of a network access control apparatus according to an embodiment of the present invention.
  • FIG. 10 is a schematic structural diagram of another network access control apparatus according to an embodiment of the present disclosure.
  • FIG. 11 is a schematic structural diagram of still another network control apparatus according to an embodiment of the present disclosure.
  • FIG. 12 is a schematic structural diagram of a network access control device according to an embodiment of the present disclosure.
  • FIG. 13 is a schematic structural diagram of another network access control device according to an embodiment of the present disclosure.
  • FIG. 14 is a schematic structural diagram of still another network access control device according to an embodiment of the present invention.
  • FIG. 1 is a schematic diagram of an application scenario of a network access control method according to an embodiment of the present invention.
  • a first PLMN 101 and a second PLMN 102 are included.
  • a plurality of network slices 1011 and a first NFRF 1012 are included in the first PLMN 101; a plurality of network slices 1021 and a second NFRF 1022 are included in the second PLMN 102, and a plurality of NF instances are disposed in each network slice.
  • the first NFRF 1012 may manage the NF instances in each network slice 1011 in the first PLMN 101, and the second NFRF 1022 may manage the NF instances in each network slice 1021 in the second PLMN 102.
  • the NF instance in the first PLMN 101 may acquire the second PLMN 102 through the first NFRF 1012 and the second NFRF 1022.
  • the information of the NF instance that needs to be accessed (for example, the network slice type to which the NF instance belongs), and accesses the NF instance that needs to be accessed according to the information of the NF instance that needs to be accessed.
  • the scenario that the NF instance in the first PLMN 101 needs to access the NF instance in the second PLMN may be: the SIM card used by the terminal device is provided by the operator corresponding to the second PLMN, if the terminal device is located in the first PLMN.
  • the NF instance in the first PLMN 101 needs to access the NF instance in the second PLMN
  • the NF instance in the first PLMN 101 interacts with the NF instance in the second PLMN to Implementing services to terminal devices.
  • the scenario in which the NF instance in the first PLMN 101 needs to access the NF instance in the second PLMN may also include other scenarios, which are not specifically limited by the present invention.
  • the NF instance in the network slice in the PLMN can be managed by the NFRF, so that the NF instance in one PLMN can access the NF instance in other PLMN through the NFRF. .
  • the reliability of NF instance access in different PLMNs is improved.
  • first PLMN and the second PLMN are substantially the same in the embodiment of the present application.
  • first PLMN the corresponding PLMN after the terminal device roams
  • second PLMN the PLMN
  • the first PLMN may also be a PLMN corresponding to other terminal devices before roaming
  • the second PLMN may also be a corresponding PLMN after the other terminal devices roam.
  • the NFRF corresponding to the first PLMN is referred to as a first NFRF
  • the NFRF corresponding to the second PLMN is referred to as a second NFRF
  • the first PLMN is to be referred to
  • the NF in the middle is called the first NF
  • the NF in the second PLMN is called the second NF.
  • FIG. 2 is a schematic flowchart 1 of a network access control method according to an embodiment of the present invention.
  • the method may include:
  • the first NFRF acquires a to-be-accessed network slice identifier.
  • the first NFRF sends an acquisition request to the second NFRF corresponding to the identifier of the second PLMN, where the request includes the NF type of the NF instance to be accessed and the network slice identifier to be accessed.
  • the second NFRF obtains, according to the obtaining request, instance information of the NF type of the NF instance to be accessed and the second NF instance corresponding to the to-be-accessed network slice identifier.
  • the second NFRF sends instance information of the second NF instance to the first NFRF.
  • the first NFRF sends instance information of the second NF instance to the first NF instance.
  • the first NFRF is the first PLMN corresponding to the NFRF
  • the first NF instance is any one of the network slices in the first PLMN
  • the second NFRF is the second PLMN corresponding to the NFRF.
  • the first PLMN and the second PLMN are different PLMNs.
  • the terminal device corresponds to the second PLMN (the second PLMN provides the terminal device), and if the terminal device roams in the first PLMN, the first NF instance in the first PLMN is to the terminal device.
  • a process of providing a service when the first NF instance needs to access the NF instance in the second PLMN, the first NF instance sends a discovery request to the first NFRF, where the discovery request includes the identifier of the second PLMN and the NF of the NF instance to be accessed.
  • Type the discovery request is used to request access to an NF instance in the second PLMN.
  • the NF type of the NF instance refers to the type of network function that the NF instance has, such as a mobility management function, a packet data session connection management function, a user authentication function, and a policy management function.
  • the first NFRF After the first NFRF receives the discovery request sent by the first NF, the first NFRF obtains the identifier of the second PLMN and the NF type of the NF instance to be accessed in the discovery request, and determines the second NFRF corresponding to the identifier of the second PLMN, and The identifier of the network slice to which the NF instance corresponding to the NF instance belongs (the network slice identifier to be accessed).
  • the first NFRF sends an acquisition request to the second NFRF, The acquisition request includes the NF type of the NF instance to be accessed and the network slice identifier to be accessed.
  • the to-be-accessed network slice identifier may be a type of the network slice to be accessed, or the network slice identifier to be accessed may be a combination of the type of the network slice to be accessed and the tenant identifier; specifically, if the network slice to be accessed is a certain If the network slice is leased by the tenant, the network slice identifier to be accessed may be a combination of the type of the network slice to be accessed and the tenant identifier. If the network slice to be accessed is a general network slice of the operator (non-lease network slice), the network slice to be accessed is to be accessed. The identity can be the type of network slice to be accessed.
  • the second NFRF After the second NFRF receives the acquisition request of the first NFRF transmission, the second NFRF obtains the instance information of the NF type of the NF instance to be accessed and the second NF instance corresponding to the to-be-accessed network slice identifier according to the acquisition request.
  • the second NFRF stores instance information of all NF instances in all network slices in the second PLMN, and the second NFRF may be in the stored instance according to the NF type of the NF instance to be accessed and the network slice identifier to be accessed. The information of the NF type of the NF instance to be accessed and the instance information of the second NF instance corresponding to the to-be-accessed network slice identifier are obtained.
  • the instance information may include address information, load information, and the like of the NF instance.
  • the content included in the instance information may be set according to actual needs, which is not specifically limited in the present invention.
  • the number of the second NF instances obtained by the second NFRF may be one or multiple.
  • the second NFRF After the second NFRF obtains the instance information of the second NF instance, the second NFRF sends the instance information of the second NF instance to the first NFRF, so that the first NFRF sends the instance information to the first NF instance, where the first NF instance is The second instance of the NF is accessed in the received instance information.
  • the instance information of the second NF instance includes an address of the second NF instance, and correspondingly, the first NF instance may access the second NF instance according to the address of the second NF instance in the instance information.
  • the first NF instance may directly access the second NF instance according to the instance information of the second NF instance.
  • the second NFRF may select a target second NF instance among the plurality of second NF instances, and obtain instance information of the second NF instance according to the target. Accessing the target second NF instance.
  • the load information of each second NF instance may be included in the instance information, so that the first NF instance may select the target second NF instance according to the load information of each second NF instance, for example, the first NF instance may be The second NF instance with the smallest load is determined as the target second NF instance.
  • the instance information may further include a priority of each second NF instance, so that the first NF instance can be The target second NF instance is selected according to the priority of each second NF instance.
  • the first NF instance may determine the second NF instance with the highest priority as the target second NF instance.
  • the first NF instance may also determine any second NF instance in the second NF instance as the target second NF instance, if the information about the load and the priority of the second NF instance is not included in the instance information.
  • the network access control method provided by the embodiment of the present invention provides a second NFRF in the second PLMN by setting a first NFRF in the first PLMN, where the first NFRF is used to store instance information of each NF instance in the first PLMN.
  • the two NFRFs are used to store instance information of each NF instance in the second PLMN.
  • the first NF instance may obtain instance information of the second NF instance by using the first NFRF and the second NFRF, and according to the second NF The instance information of the instance accesses the second NF instance, so that the first NF instance in the first PLMN can be accessed to access the NF instance in the second PLMN, thereby improving the reliability of the NF instance access in different PLMNs.
  • the added NF instance may be registered in the NFRF, where the NFRF may be NFRF corresponding to any PLMN.
  • FIG. 3 is a schematic flowchart of a method for registering an NF instance in an NFRF according to an embodiment of the present invention.
  • the method may include:
  • S301 Receive an NF registration request, where the NF registration request includes instance information of the NF instance to be registered, and slice information of the network slice to which the NF instance to be registered belongs.
  • each network slice in the PLMN may correspond to a slice management unit.
  • the user may input an NF registration request through the slice management unit to enable slice management.
  • the unit sends the NF registration request to the NFRF, where the NF registration request includes instance information of the NF instance to be registered, and slice information of the network slice to which the NF instance to be registered belongs.
  • the instance information of the NF instance to be registered includes at least one of an identifier of the to-be-registered instance, an NF type of the instance to be registered, and an address of the instance to be registered;
  • the slice information of the target network slice includes the identifier and target of the target network slice. At least one of the types of network slices.
  • the NFRF After the NFRF receives the NF registration request, the NFRF generates instance information of the NF instance to be registered according to the instance information of the NF instance to be registered in the registration request and the slice information of the network slice to which the NF instance to be registered belongs.
  • the NFRF may feed back the generated instance information of the NF instance to be registered to the slice management unit.
  • the NFRF may store the instance information of the registered NF instance in the form of a table or the like.
  • NFRF can store instance information of the NF instance in the corresponding PLMN through Table 1:
  • Table 1 is only a storage form for storing instance information of the NF instance in the PLMN by the example instance NFRF, and content included in each instance information, and is not limited to the storage form and the content included in the instance information. In the actual application process, the storage form and the content included in each instance information may be set according to actual needs.
  • the NF instance when an NF instance is added to the PLMN, the NF instance is registered in the NFRF to enable the NFRF to generate instance information of the added NF instance, so that the NF instance can be saved.
  • the NFRF may store instance information of each NF instance in the PLMN.
  • the first NFRF may obtain the to-be-accessed network slice identifier corresponding to the NF instance to be accessed by using the following two possible implementation manners:
  • a feasible implementation manner is: when the first NF instance sends a discovery request to the first NFRF, the first NF instance obtains the to-be-accessed network slice identifier, and carries the to-be-accessed network slice identifier in the discovery request, so that the first NFRF can be Obtain the network slice identifier to be accessed in the discovery request.
  • the first NFRF determines the network slice identifier to be accessed according to the function type corresponding to the first NF instance.
  • the first NF instance or the first NFRF may obtain the to-be-accessed network slice identifier by using the following feasible implementation manners. For details, refer to the embodiment shown in FIG. 4 .
  • FIG. 4 is a schematic flowchart of a method for obtaining a network slice identifier to be accessed according to an embodiment of the present invention.
  • the method may include:
  • S402. Determine whether the function type corresponding to the first NF instance is the first function type.
  • the execution body shown in the embodiment of FIG. 4 may be the first NF instance, or may be the first NFRF.
  • the first NF instance may obtain the to-be-accessed network slice identifier by using the method shown in the embodiment of FIG.
  • the network segment identifier to be accessed is not included in the discovery request received by the first NFRF, the first NFRF may obtain the to-be-accessed network slice identifier by using the method shown in the embodiment of FIG.
  • the function type corresponding to the first NF instance is obtained, and the function type may include the first function type and the second function type.
  • the network function corresponding to the first function type has the same slice type in all PLMNs, and the network function corresponding to the second function type has different slice types in different PLMNs.
  • the function type is an attribute information of the NF instance, and the function type of the second NF instance is obtained in the attribute information of the first NF instance.
  • the function type corresponding to the first NF instance is the first function type, acquiring a first network slice type of the first network slice to which the first NF instance belongs, and determining, by the first network slice type, that the first network slice type is in the second Corresponding second network slice type in the PLMN, and determining the second network slice type as the to-be-accessed network slice identifier.
  • the function type corresponding to the first NF instance is the second function type
  • requesting, by the policy management unit, the second network slice type corresponding to the first network slice type in the second PLMN optionally, sending the policy to the policy management unit a slice type acquisition request includes a first network slice type and an identifier of the second PLMN, and receives a second network slice type corresponding to the first network slice type in the second PLMN sent by the policy management unit.
  • the corresponding relationship between the network slices of different PLMNs is stored in the policy management unit.
  • the corresponding relationship may be as shown in Table 2:
  • Table 2 only illustrates the correspondence between each network slice between different PLMNs in the form of an example, and the storage form of the corresponding relationship by the policy management unit, not the corresponding relationship, and the storage of the corresponding relationship.
  • the definition of the form, in the actual application process, the relationship should be set according to actual needs, and the storage form of the corresponding relationship.
  • the to-be-accessed network slice identifier corresponding to the NF instance to be accessed can be accurately obtained, and the reliability of the NF instance access in different PLMNs is further improved.
  • FIG. 5 is a schematic flowchart of a method for verifying access rights of a first NF instance according to an embodiment of the present invention. Referring to FIG. 5, the method may include:
  • Each NF type in the first NF type set is an NF type of an NF instance that allows access to the NF instance.
  • the acquiring request sent by the first NFRF to the second NFRF further includes the NF type of the first NF instance, so that after the second NFRF receives the obtaining request, the NF instance to be accessed is obtained first.
  • each NF type in the first NF type set is an NF type of an NF instance that allows access to the NF instance, and determines whether the first NF instance includes the first NF instance. NF type.
  • the second NFRF instance continues to obtain the NF type of the NF instance to be accessed and the network slice identifier to be accessed. Instance information of the corresponding second NF instance.
  • the second NFRF sends the access restricted prompt information to the first NFRF, so that the first An NFRF sends access restricted prompt information to the first NF instance.
  • the network access control method shown in the above embodiment will be described in detail through the embodiments shown in FIGS. 6 to 8, respectively.
  • the network slice identifier to be accessed is included in the discovery request sent by the first NF instance to the first NFRF.
  • the to-be-accessed network slice identifier is not included in the discovery request sent by the first NF instance to the first NFRF, and the to-be-accessed network slice identifier is obtained by the first NFRF.
  • FIG. 6 is a schematic flowchart 2 of a network access control method according to an embodiment of the present invention. Referring to FIG. 6, the method may include:
  • the first NF instance acquires a function type corresponding to the first NF instance.
  • the first NF instance determines whether the function type corresponding to the first NF instance is the first function type.
  • the first NF instance determines the first network slice type as a second network slice type corresponding to the first network slice type in the second PLMN.
  • the first NF instance sends a network slice identifier acquisition request to the policy management unit, where the network slice acquisition request includes the first network slice type and the identifier of the second PLMN.
  • the policy management unit sends, to the first NF instance, a second network slice type corresponding to the first network slice type in the second PLMN.
  • the first NF instance determines the second network slice type as the to-be-accessed network slice identifier.
  • the first NFRF obtains the NF type of the to-be-accessed NF instance and the to-be-accessed network slice identifier in the discovery request, and generates an acquisition request.
  • the obtaining request includes the NF type of the NF instance to be accessed and the to-be-accessed network slice identifier.
  • the first NFRF sends an acquisition request to the second NFRF corresponding to the identifier of the second PLMN.
  • the second NFRF obtains the NF type of the NF instance to be accessed and the candidate to be accessed according to the acquisition request.
  • the instance information of the second NF instance corresponding to the network slice identifier is requested.
  • the second NFRF sends instance information of the second NF instance to the first NFRF.
  • the first NFRF sends instance information of the second NF instance to the first NF instance.
  • the first NF instance determines whether the number of the second NF instance is greater than 1.
  • the first NF instance selects a target second NF instance among the plurality of second NF instances.
  • the first NF instance determines the target second NF instance by the second NF instance.
  • the first NF instance sends an access request to the target second NF instance.
  • the second NF instance sends an access response to the first NF instance.
  • the first NF instance when the first NF instance needs to access the NF instance in the second PLMN, the first NF instance sends a discovery request to the first NFRF, so that the first NFRF can quickly obtain the NF instance,
  • the first NF instance first determines the identifier of the network slice corresponding to the NF instance to be accessed (the network slice identifier to be accessed). Specifically, the first NF instance is determined by S601-S606. Access the network slice ID. It should be noted that the specific description of S601-S606 can refer to S401-S407, and details are not described herein again.
  • the first NFRF After the first NFRF receives the discovery request, the first NFRF obtains the NF type of the NF instance to be accessed and the network slice identifier to be accessed in the discovery request, and generates an NF type including the to-be-accessed NF instance and a network slice identifier acquisition request to be accessed. And sending an acquisition request to the second NFRF corresponding to the identifier of the second PLMN.
  • the second NFRF obtains instance information of the NF type of the NF instance to be accessed and the second NF instance corresponding to the to-be-accessed network slice identifier according to the acquisition request, and sends instance information of the second NF instance to the first NFRF.
  • the second PLMN may determine, according to the obtaining request, the NF type of the NF instance to be accessed and the number of the second NF instance corresponding to the to-be-accessed network slice identifier; if the number of the second NF instance is 1, determining The instance information of the second NF instance includes the address of the second NF instance. If the number of the second NF instance is greater than 1, determining that the instance information of the second NF instance includes the address of each second NF instance and the load of each second NF instance. information.
  • the first NFRF After receiving the instance information of the second NF instance, the first NFRF sends the instance information of the second NF instance to the first NF instance.
  • the instance information may include the address, information load information, and priority of the second NF instance. Level and so on.
  • the specific content included in the instance information can be set according to actual needs.
  • the first NF instance determines whether the number of the second NF instance is greater than 1. If yes, the first NF instance selects the target second NF instance in the multiple second NF instances. Optionally, the first NF instance may minimize the load.
  • the instance is determined to be the target second NF instance; if not, the second NF instance is directly determined as the target second NF instance, and the access request is sent to the target second NF instance, and the access to the second NF instance is received. After the response, the first NF instance can access the second NF instance.
  • FIG. 7 is a schematic flowchart 3 of a network access control method according to an embodiment of the present invention. Referring to FIG. 7, the method may include:
  • the first NFRF acquires a function type corresponding to the first NF instance.
  • the first NFRF determines whether the function type corresponding to the first NF instance is the first function type.
  • the first NFRF determines the first network slice type as a second network slice type corresponding to the first network slice type in the second PLMN.
  • the first NFRF sends a network slice identifier acquisition request to the policy management unit, where the network slice acquisition request includes the first network slice type to be accessed and the identifier of the second PLMN.
  • the policy management unit sends, to the first NFRF, a second network slice type corresponding to the first network slice type in the second PLMN.
  • the first NFRF determines the second network slice type as the to-be-accessed network slice identifier.
  • the first NFRF generates an acquisition request according to the NF type of the NF instance to be accessed and the network slice identifier to be accessed, where the acquisition request includes the NF type of the NF instance to be accessed and the network slice identifier to be accessed.
  • the first NFRF sends an acquisition request to the second NFRF corresponding to the identifier of the second PLMN.
  • the second NFRF obtains, according to the obtaining request, instance information of the NF type of the NF instance to be accessed and the second NF instance corresponding to the to-be-accessed network slice identifier.
  • the second NFRF sends instance information of the second NF instance to the first NFRF.
  • the first NFRF sends instance information of the second NF instance to the first NF instance.
  • the first NF instance determines whether the number of the second NF instance is greater than 1.
  • the first NF instance selects a target second NF instance among the plurality of second NF instances.
  • the first NF instance determines the target second NF instance by the second NF instance.
  • the first NF instance sends an access request to the target second NF instance.
  • S717 The second NF instance sends an access response to the first NF instance.
  • the first NF instance when the first NF instance needs to access the NF instance in the second PLMN, the first NF instance sends a discovery request to the first NFRF, where the discovery request includes the identifier and the to-be of the second PLMN. Access the NF type of the NF instance.
  • the first NFRF After the first NFRF receives the discovery request, the first NFRF needs to determine the identifier of the network slice corresponding to the NF instance to be accessed (the network slice identifier to be accessed) in order to obtain the NF instance corresponding to the NF type of the NF instance to be accessed. Specifically, the first NFRF determines the network slice identifier to be accessed through S702-S707. It should be noted that the specific description of S702-S707 can be referred to the same as S401-S407, and the specific description of S709-S717 can refer to S609-S617, and details are not described herein.
  • the first NFRF determines the network slice identifier to be accessed, and the function and structure of the first NF need not be improved, thereby saving costs.
  • the acquisition request may further include an NF type of the first NF instance, so that the second NFRF provides the instance information of the second NF instance to the first NF before the first The NF type of an NF instance is verified.
  • the implementation manner will be described in detail through the embodiment shown in FIG.
  • FIG. 8 is a schematic flowchart diagram of a network access control method according to an embodiment of the present invention. Referring to FIG. 8, the method may include:
  • the first NFRF obtains a function type corresponding to the first NF instance.
  • the first NFRF determines whether the function type corresponding to the first NF instance is the first function type.
  • the first NFRF determines the first network slice type as a second network slice type corresponding to the first network slice type in the second PLMN.
  • the first NFRF sends a network slice identifier acquisition request to the policy management unit, where the network slice acquisition request includes the first network slice type to be accessed and the identifier of the second PLMN.
  • the first NFRF determines the second network slice type as the to-be-accessed network slice identifier.
  • the first NFRF generates an acquisition request according to the NF type of the NF instance to be accessed, the network slice identifier to be accessed, and the NF type of the first NF instance, where the request includes the NF type of the NF instance to be accessed, the network slice identifier to be accessed, And the NF type of the first NF instance.
  • the first NFRF sends an acquisition request to the second NFRF corresponding to the identifier of the second PLMN.
  • the second NFRF obtains a first NF type set corresponding to the NF instance to be accessed, and each NF type in the first NF type set is an NF type of an NF instance that allows access to the NF instance.
  • the second NFRF determines whether the NF type of the first NF instance is included in the first NF type set.
  • the second NFRF sends the access restricted prompt information to the first NFRF.
  • the first NFRF sends the access restricted prompt information to the first NF instance.
  • the second NFRF obtains, according to the obtaining request, instance information of the NF type of the NF instance to be accessed and the second NF instance corresponding to the to-be-accessed network slice identifier.
  • the second NFRF sends instance information of the second NF instance to the first NFRF.
  • the first NFRF sends instance information of the second NF instance to the first NF instance.
  • S817 The first NF instance determines whether the number of the second NF instance is greater than 1.
  • the first NF instance selects a target second NF instance in the multiple second NF instances.
  • the first NF instance determines the target second NF instance by the second NF instance.
  • the first NF instance sends an access request to the target second NF instance.
  • the second NF instance sends an access response to the first NF instance.
  • S801-S807 can refer to S701-S707, and details are not described herein.
  • the first NFRF generates an acquisition request according to the NF type of the NF instance to be accessed, the network slice identifier to be accessed, and the NF type of the first NF instance, where the request includes the NF type of the NF instance to be accessed, and the network slice to be accessed. Identifying, and the NF type of the first NF instance, and sending an acquisition request to the second NFRF.
  • the second acquiring the corresponding first NF type set of the NF instance to be accessed, and determining whether the NF type of the first NF instance is included in the first NF type set.
  • S814-S821 is performed.
  • S814-S821 refers to S710-S716, and details are not described herein.
  • the second NFRF sends the access restricted prompt information to the first NFRF, and the first NFRF sends the access restricted prompt information to the first NF instance.
  • the first NF does not have access to the NF instance of the NF instance of the NF instance to be accessed.
  • the second NFRF before the second NFRF provides the first NF instance with the instance information of the NF instance in the second PLMN, it is first verified whether the first NF instance has access rights, and the first NF instance is determined to have When accessing the right, the first NF instance is provided with instance information of the NF instance in the second PLMN, which improves the security of the NF instance access across the PLMN.
  • the NF type of the first NF instance and the NF type of the NF instance to be accessed may be carried in the acquisition request. (excluding the network slice identifier to be accessed), so that the second NFRF acquires the first network slice type of the first network slice to which the first NF instance belongs, and requests the policy management unit to acquire the first network slice type in the second PLMN.
  • the second NFRF acquires the first network slice type of the first network slice to which the first NF instance belongs, and requests the policy management unit to acquire the first network slice type in the second PLMN.
  • Corresponding second network slice type, and determining the second network slice type as the to-be-accessed network slice identifier Corresponding second network slice type, and determining the second network slice type as the to-be-accessed network slice identifier.
  • the process of requesting the second NFRF to obtain the second network slice type from the policy management unit is the same as the process of the first NFRF requesting the second network slice type from the policy management unit, and details are not described
  • FIG. 9 is a schematic structural diagram of a network access control apparatus according to an embodiment of the present disclosure.
  • the network access control apparatus is applied to a first NFRF in a first PLMN.
  • the apparatus includes a receiving module 11 and a processing module. 12 and a sending module 13, wherein
  • the receiving module 11 is configured to receive a discovery request sent by the first network function NF instance, where the discovery request includes an identifier of the second PLMN and an NF type of the NF instance to be accessed;
  • the processing module 12 is configured to obtain a network slice identifier to be accessed
  • the sending module 13 is configured to send an acquisition request to the second NFRF corresponding to the identifier of the second PLMN, where the obtaining request includes an NF type of the NF instance to be accessed and the to-be-accessed network slice identifier;
  • the receiving module 11 is configured to receive, by the second NFR, the NF type of the NF instance to be accessed and the instance information of the second NF instance corresponding to the to-be-accessed network slice identifier;
  • the sending module 13 is configured to send the instance information to the first NF instance.
  • the network access control device shown in the embodiment of the present invention may perform the technical solutions shown in the foregoing method embodiments, and the implementation principles and beneficial effects thereof are similar, and details are not described herein.
  • the to-be-accessed network slice identifier is a type of the to-be-accessed network slice
  • the to-be-accessed network slice identifier is a combination of the type of the to-be-accessed network slice and the tenant identification.
  • the discovery request includes the to-be-accessed network slice identifier; correspondingly, the processing module 12 is specifically configured to:
  • processing module 12 is specifically configured to:
  • processing module 12 is specifically configured to:
  • processing module 12 is specifically configured to:
  • the first network type Determining, by the first network type, the first network slice type of the first network slice to which the first NF instance belongs as the second network slice type, where the function type of the first NF instance is the first function type;
  • the network function corresponding to the first function type has the same slice type in all PLMNs;
  • the function type corresponding to the first NF instance is the second function type, requesting, by the policy management unit, the second network slice type, where the network function corresponding to the second function type is a slice type in different PLMNs different.
  • the sending module 13 is further configured to send a slice type obtaining request to the policy management unit, where the network slice obtaining request includes the first network slice type and the first The identity of the second PLMN;
  • the receiving module 11 is further configured to receive, by the policy management unit, a second network slice type corresponding to the first network slice type in the second PLMN.
  • the instance information includes an address of the second NF instance; correspondingly, the sending module 13 is specifically configured to:
  • the number of the second NF instances corresponding to the NF type of the NF instance to be accessed is greater than 1;
  • the sending module 13 is specifically configured to:
  • the NF instance determines a target second NF instance in the second NF instance and accesses the target second NF instance according to the address of the target second NF instance.
  • the instance information includes load information of each of the second NF instances, so that the first NF instance is in multiple according to load information of each of the second NF instances.
  • the target second NF instance is determined in the two NF instance, and the target second NF instance is accessed according to the address of the target second NF instance.
  • the method further includes:
  • the receiving module 11 is further configured to receive an NF registration request, where the NF registration request includes instance information of the NF instance to be registered, and slice information of the network slice to which the NF instance to be registered belongs;
  • the processing module 12 is further configured to generate instance information of the NF instance to be registered according to the instance information of the NF instance to be registered and the slice information of the network slice to which the NF instance to be registered belongs.
  • the instance information of the NF instance to be registered includes at least one of an identifier of an instance to be registered, an NF type of an instance to be registered, and an address of an instance to be registered;
  • the slice information of the target network slice includes at least one of an identifier of the target network slice and a type of the target network slice.
  • the network access control device shown in the embodiment of the present invention may perform the technical solutions shown in the foregoing method embodiments, and the implementation principles and beneficial effects thereof are similar, and details are not described herein.
  • FIG. 10 is a schematic structural diagram of another network access control apparatus according to an embodiment of the present invention.
  • the network control apparatus is applied to a second NFRF in a second PLMN.
  • the apparatus includes a receiving module 21 and a processing module. 22 and a sending module 23, wherein
  • the receiving module 21 is configured to receive an acquisition request sent by the first NFRF, where the obtaining request includes the to-be-accessed network function NF instance type and the to-be-accessed network slice identifier;
  • the processing module 22 is configured to obtain, according to the obtaining request, instance information of the NF type of the NF instance to be accessed and the second NF instance corresponding to the to-be-accessed network slice identifier;
  • the sending module 23 is configured to send instance information of the second NF instance to the first NFRF.
  • the network access control device shown in the embodiment of the present invention may perform the technical solutions shown in the foregoing method embodiments, and the implementation principles and beneficial effects thereof are similar, and details are not described herein.
  • processing module 22 is specifically configured to:
  • processing module 22 is further configured to:
  • the processing module 22 acquires the NF type of the NF instance to be accessed and the address and load information of the second NF instance corresponding to the to-be-accessed network slice identifier Number of the second NF instance corresponding to the network slice identifier to be accessed;
  • the step of acquiring the NF type of the NF instance to be accessed and the address and load information of the second NF instance corresponding to the to-be-accessed network slice identifier is performed.
  • the acquiring request further includes an NF type of the first NF instance; correspondingly, the processing module 22 is further configured to:
  • the processing module 22 Before the processing module 22 obtains the NF type of the NF instance to be accessed and the instance information of the second NF instance corresponding to the to-be-accessed network slice identifier, the processing module 22 obtains the instance corresponding to the NF instance to be accessed.
  • a first NF type set where each NF type in the first NF type set is an NF type of an NF instance that allows access to the to-be-accessed NF instance;
  • the instance information of the NF type of the NF instance to be accessed and the second NF instance corresponding to the to-be-accessed network slice identifier is performed.
  • the sending module 23 is further configured to: if the determining that the first NF type set does not include the NF type of the first NF instance, then to the first NFRF Sending the access restricted prompt information, so that the first NFRF sends the access restricted prompt information to the first NF instance.
  • the network access control device shown in the embodiment of the present invention may perform the technical solutions shown in the foregoing method embodiments, and the implementation principles and beneficial effects thereof are similar, and details are not described herein.
  • FIG. 11 is a schematic structural diagram of still another network control apparatus according to an embodiment of the present invention.
  • the network control apparatus is applied to a first NF instance.
  • the processing module 31 is configured to obtain an NF type of the NF instance to be accessed, and a to-be-accessed network slice identifier of the network slice to which the NF instance to be accessed belongs.
  • the sending module 32 is configured to send a discovery request to the first network function management module NFRF,
  • the sending request includes an identifier of the second PLMN, an NF type of the NF instance to be accessed, and the to-be-accessed network slice identifier, so that the first NFRF obtains a second NFRF request from the second PLMN. Accessing the NF type of the NF instance and the instance information of the second NF instance corresponding to the network slice identifier to be accessed;
  • the receiving module 33 is configured to receive instance information of the second NF instance sent by the first NFRF.
  • the network access control device shown in the embodiment of the present invention may perform the technical solutions shown in the foregoing method embodiments, and the implementation principles and beneficial effects thereof are similar, and details are not described herein.
  • processing module 31 is specifically configured to:
  • processing module 31 is specifically configured to:
  • the first network type Determining, by the first network type, the first network slice type of the first network slice to which the first NF instance belongs as the second network slice type, where the function type of the first NF instance is the first function type;
  • the network function corresponding to the first function type has the same slice type in all PLMNs;
  • the function type corresponding to the first NF instance is the second function type, requesting, by the policy management unit, the second network slice type, where the network function corresponding to the second function type is a slice type in different PLMNs different.
  • the sending module 32 is further configured to send a slice type acquisition request to the policy management unit, where the network slice acquisition request includes the first network slice type and the first The identity of the second PLMN;
  • the receiving module 33 is further configured to receive, by the policy management unit, a second network slice type corresponding to the first network slice type in the second PLMN.
  • the network access control device shown in the embodiment of the present invention may perform the technical solutions shown in the foregoing method embodiments, and the implementation principles and beneficial effects thereof are similar, and details are not described herein.
  • FIG. 12 is a schematic structural diagram of a network access control device according to an embodiment of the present invention.
  • the network access control device is applied to the first NFRF in the first PLMN.
  • the device includes a receiver 41, a processor 42, a transmitter 43, a memory 44, and a communication bus 45 for storing a program.
  • the communication bus 45 is used to implement a communication connection between the components, and the processor 42 can read the program in the memory 44 and perform corresponding operations, wherein
  • the receiver 41 is configured to receive a discovery request sent by the first network function NF instance, where the discovery request includes an identifier of the second PLMN and an NF type of the NF instance to be accessed;
  • the processor 42 is configured to obtain a network slice identifier to be accessed
  • the transmitter 43 is configured to send an acquisition request to the second NFRF corresponding to the identifier of the second PLMN, where the acquisition request includes an NF type of the NF instance to be accessed and the to-be-accessed network slice identifier;
  • the receiver 41 is configured to receive, by the second NFR, the NF type of the NF instance to be accessed and the instance information of the second NF instance corresponding to the network slice identifier to be accessed;
  • the transmitter 43 is configured to send the instance information to the first NF instance.
  • the network access control device shown in the embodiment of the present invention may perform the technical solutions shown in the foregoing method embodiments, and the implementation principles and beneficial effects thereof are similar, and details are not described herein.
  • the to-be-accessed network slice identifier is a type of the to-be-accessed network slice
  • the to-be-accessed network slice identifier is a combination of the type of the to-be-accessed network slice and the tenant identification.
  • the discovery request includes the to-be-accessed network slice identifier; correspondingly, the processor 42 is specifically configured to:
  • the processor 42 is specifically configured to:
  • the processor 42 is specifically configured to:
  • the processor 42 is specifically configured to:
  • the first network type Determining, by the first network type, the first network slice type of the first network slice to which the first NF instance belongs as the second network slice type, where the function type of the first NF instance is the first function type;
  • the network function corresponding to the first function type has the same slice type in all PLMNs;
  • the function type corresponding to the first NF instance is the second function type, requesting, by the policy management unit, the second network slice type, where the network function corresponding to the second function type is a slice type in different PLMNs different.
  • the transmitter 43 is further configured to send a slice type acquisition request to the policy management unit, where the network slice acquisition request includes the first network slice type and the first The identity of the second PLMN;
  • the receiver 41 is further configured to receive, by the policy management unit, a second network slice type corresponding to the first network slice type in the second PLMN.
  • the instance information includes an address of the second NF instance; correspondingly, the transmitter 43 is specifically configured to:
  • the number of the second NF instances corresponding to the NF type of the NF instance to be accessed is greater than 1;
  • the transmitter 43 is specifically configured to:
  • the instance information includes load information of each of the second NF instances, so that the first NF instance is in multiple according to load information of each of the second NF instances.
  • the target second NF instance is determined in the two NF instance, and the target second NF instance is accessed according to the address of the target second NF instance.
  • the method further includes:
  • the receiver 41 is further configured to receive an NF registration request, where the NF registration request includes instance information of the NF instance to be registered, and slice information of the network slice to which the NF instance to be registered belongs;
  • the processor 42 is further configured to generate instance information of the NF instance to be registered according to the instance information of the NF instance to be registered and the slice information of the network slice to which the NF instance to be registered belongs.
  • the instance information of the NF instance to be registered includes at least one of an identifier of an instance to be registered, an NF type of an instance to be registered, and an address of an instance to be registered;
  • the slice information of the target network slice includes at least one of an identifier of the target network slice and a type of the target network slice.
  • the network access control device shown in the embodiment of the present invention may perform the technical solutions shown in the foregoing method embodiments, and the implementation principles and beneficial effects thereof are similar, and details are not described herein.
  • FIG. 13 is a schematic structural diagram of another network access control device according to an embodiment of the present disclosure.
  • the network access control device is applied to a second NFRF in a second PLMN.
  • the device includes a receiver 51 and a processor. 52.
  • the communication bus 55 is for implementing a communication connection between the components, and the processor 52 can read the program in the memory 54 and execute the corresponding Operation, where
  • the receiver 51 is configured to receive an acquisition request sent by the first NFRF, where the acquisition request includes the to-be-accessed network function NF instance type and the to-be-accessed network slice identifier;
  • the processor 52 is configured to obtain, according to the obtaining request, instance information of the NF type of the NF instance to be accessed and the second NF instance corresponding to the to-be-accessed network slice identifier;
  • the transmitter 53 is configured to send instance information of the second NF instance to the first NFRF.
  • the network access control device shown in the embodiment of the present invention may perform the technical solutions shown in the foregoing method embodiments, and the implementation principles and beneficial effects thereof are similar, and details are not described herein.
  • the processor 52 is specifically configured to:
  • processor 52 is further configured to:
  • the processor 52 acquires the NF type of the NF instance to be accessed and the address and load information of the second NF instance corresponding to the to-be-accessed network slice identifier Number of the second NF instance corresponding to the network slice identifier to be accessed;
  • the step of acquiring the NF type of the NF instance to be accessed and the address and load information of the second NF instance corresponding to the to-be-accessed network slice identifier is performed.
  • the acquiring request further includes an NF type of the first NF instance; correspondingly, the processor 52 is further configured to:
  • the instance information of the NF type of the NF instance to be accessed and the second NF instance corresponding to the to-be-accessed network slice identifier is performed.
  • the transmitter 53 is further configured to: if the determining that the first NF type set does not include the NF type of the first NF instance, then to the first NFRF Sending the access restricted prompt information, so that the first NFRF sends the access restricted prompt information to the first NF instance.
  • the network access control device shown in the embodiment of the present invention may perform the technical solutions shown in the foregoing method embodiments, and the implementation principles and beneficial effects thereof are similar, and details are not described herein.
  • FIG. 14 is a schematic structural diagram of another network access control device according to an embodiment of the present disclosure.
  • the network access control device is applied to a first NF instance.
  • the device includes a processor 61, a transmitter 62, and a receiver. 63, a memory 64 for storing a program, a communication bus 65 for implementing a communication connection between components, and a processor 61 for reading a program in the memory 64 and performing a corresponding operation, wherein
  • the processor 61 is configured to obtain an NF type of the NF instance to be accessed, and a to-be-accessed network slice identifier of the network slice to which the NF instance to be accessed belongs;
  • the transmitter 62 is configured to send a discovery request to the first network function manager NFRF, where the sending request includes an identifier of the second PLMN, an NF type of the NF instance to be accessed, and the to-be-accessed network slice identifier, And causing, by the first NFRF, a second NFRF request in the second PLMN to obtain instance information of an NF type of the NF instance to be accessed and a second NF instance corresponding to the to-be-accessed network slice identifier;
  • the receiver 63 is configured to receive instance information of the second NF instance sent by the first NFRF.
  • the network access control device shown in the embodiment of the present invention may perform the technical solutions shown in the foregoing method embodiments, and the implementation principles and beneficial effects thereof are similar, and details are not described herein.
  • the processor 61 is specifically configured to:
  • the processor 61 is specifically configured to:
  • the first network type Determining, by the first network type, the first network slice type of the first network slice to which the first NF instance belongs as the second network slice type, where the function type of the first NF instance is the first function type;
  • the network function corresponding to the first function type has the same slice type in all PLMNs;
  • the function type corresponding to the first NF instance is the second function type, requesting, by the policy management unit, the second network slice type, where the network function corresponding to the second function type is a slice type in different PLMNs different.
  • the transmitter 62 is further configured to send a slice type acquisition request to the policy management unit, where the network slice acquisition request includes the first network slice type and the first The identity of the second PLMN;
  • the receiver 63 is configured to receive, by the policy management unit, a second network slice type corresponding to the first network slice type in the second PLMN.
  • the network access control device shown in the embodiment of the present invention may perform the technical solutions shown in the foregoing method embodiments, and the implementation principles and beneficial effects thereof are similar, and details are not described herein.
  • the embodiment of the invention provides a network control system, which includes the network control device shown in the embodiment of FIG. 12-14.
  • the storage medium includes: a medium that can store program codes, such as a ROM, a RAM, a magnetic disk, or an optical disk.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Databases & Information Systems (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Abstract

本发明提供一种网络访问控制方法、装置及设备，该方法包括：接收第一网络功能NF实例发送的发现请求，所述发现请求中包括第二PLMN的标识和待访问NF实例的NF类型；获取待访问网络切片标识，并向所述第二PLMN的标识对应的第二NFRF请求所述待访问NF实例的NF类型和待访问网络切片标识对应的第二NF实例的实例信息；向所述第一NF实例发送所述实例信息。用于提高不同PLMN之间的NF实例访问的可靠性。

Description

网络访问控制方法、装置及设备 技术领域
本发明涉及通信技术领域，尤其涉及一种网络访问控制方法、装置及设备。
背景技术
公共陆地移动网络(Public Land Mobile Network，简称PLMN)是为公众提供陆地移动通信业务目的而建立和经营的网络，为了提高网络通信效率和满足不同的通信业务需求，可以将PLMN划分为多个网络切片，分别由各个网络切片提供相应的网络服务。
一个PLMN中可以包括多个网络切片，每一个网络切片中可以部署多个网络功能(Network Function，简称NF)实例，每一个NF实例可以向用户提供一种类型的网络服务。在为用户提供跨PLMN漫游服务(例如由中国运营商提供服务器的终端设备位于国外)时，一个PLMN中的NF实例可能需要访问另一个PLMN中的待访问NF实例，在现有技术中，一个PLMN中的NF实例只能根据待访问NF实例的NF类型访问另一个PLMN中的NF实例，然而，当待访问NF实例所属的网络切片类型与该NF实例所属的网络切片类型不同时，待访问NF实例可能不包括该NF实例所需要的网络功能或数据等，导致该NF实例无法对正确的待访问NF实例进行访问，进而导致不同PLMN之间的NF实例的访问的可靠性较差。
发明内容
本发明实施例提供一种网络访问控制方法、装置及设备，用于提高不同PLMN之间的NF实例的访问的可靠性。
第一方面，本发明实施例提供一种网络访问控制方法，该方法可以包括：当第一NF实例需要访问第二PLMN中的待访问NF实例的NF类型的NF实例时，第一NF实例向第一NFRF发送发现请求，该发现请求中包括第二PLMN的标识和待访问NF实例的NF类型；第一NFRF获取待访问网络切片标识， 并向第二PLMN中的第二NFRF请求待访问NF实例的NF类型和待访问网络切片标识对应的第二NF实例的实例信息，并向第一NF实例发送实例信息，以使第一NF实例根据实例信息访问第二NF实例。
在本申请中，为第一PLMN设置第一NFRF，并由第一NFRF对第一PLMN中的NF实例进行管理；为第二PLMN设置第二NFRF，并由第二NFRF对第二PLMN中的NF实例进行管理。这样，当第一PLMN中的第一NF实例需要访问第二PLMN中的第二NF实例时，第一NF实例可以根据第一NFRF和第二NFRF获取第二NF实例的实例信息，并根据第二NF实例的实例信息，对第二NF实例进行访问，进而实现一个PLMN中的NF实例可以对其它PLMN中的NF实例进行准确的访问，进而提高不同PLMN中NF实例访问的可靠性。
在一种可能的实施方式中，可选的，当第一NFRF需要获取第二NF实例的实例信息时，第一NFRF可以获取待访问NF实例对应的待访问网络切片标识，并向第二NFRF发送获取请求，获取请求中包括待访问NF实例的NF类型和待访问网络切片标识，并接收第二NFRF发送的、待访问NF实例的NF类型和待访问网络切片标识对应的第二NF实例的实例信息。
在该种可行的实现方式中，可选的，待访问网络切片标识为待访问网络切片的类型；或者，待访问网络切片标识为待访问网络切片的类型和租户标识的组合。
可选的，第一NFRF可以通过如下两种可行的实现方式获取待访问NF实例对应的待访问网络切片标识：
一种可行的实现方式：发现请求中包括待访问网络切片标识；相应的，第一NFRF可以在发现请求中获取待访问网络切片标识。
在该种可行的实现方式中，由第一NF实例确定待访问NF实例对应的待访问网络切片标识，并在发现请求中携带待访问网络切片标识，以使第一NFRF可以快速获取待访问网络切片标识。
另一种可行的实现方式：第一NFRF获取第一NF实例对应的功能类型，并根据第一NF实例对应的功能类型，确定待访问网络切片标识。
可选的，第一NFRF可以获取所述第一NF实例所属的第一网络切片的第一网络切片类型；根据所述第一NF实例对应的功能类型，确定所述第一 网络切片类型在所述第二PLMN中对应的第二网络切片类型；将所述第二网络切片类型确定为所述待访问网络切片标识。
可选的，若所述第一NF实例对应的功能类型为第一功能类型，则将所述第一NF实例所属的第一网络切片的第一网络切片类型确定为所述第二网络切片类型；其中，所述第一功能类型对应的网络功能在所有PLMN中的切片类型相同；
可选的，若所述第一NF实例对应的功能类型为第二功能类型，则向策略管理单元请求获取所述第二网络切片类型；其中，第二功能类型对应的网络功能在不同的PLMN中的切片类型不同。可选的，可以向所述策略管理单元发送切片类型获取请求，所述网络切片获取请求中包括所述第一网络切片类型和所述第二PLMN的标识；接收所述策略管理单元发送的、所述第一网络切片类型在所述第二PLMN中对应的第二网络切片类型。
在该种可行的实现方式中，第一NFRF根据第一NF实例对应的功能类型，可以准确的获取得到待访问NF实例对应的待访问网络切片标识，进一步的提高了不同PLMN中NF实例访问的可靠性。
可选的，所述实例信息中包括第二NF实例的地址；相应的，向所述第一NF实例发送所述实例信息，包括：向所述第一NF实例发送所述实例信息，以使所述第一NF实例根据所述实例信息中的第二NF实例的地址访问所述第二NF实例。
可选的，若所述待访问NF实例的NF类型对应的第二NF实例的个数大于1；相应的，向所述第一NF实例发送所述实例信息包括：向所述第一NF实例发送各所述第二NF实例的实例信息，以使所述第一NF实例在所述第二NF实例中确定目标第二NF实例，并根据所述目标第二NF实例的地址访问所述目标第二NF实例。
可选的，所述实例信息中包括各所述第二NF实例的负载信息，以使所述第一NF实例根据各所述第二NF实例的负载信息在多个第二NF实例中确定目标第二NF实例，并根据所述目标第二NF实例的地址访问所述目标第二NF实例。
可选的，获取请求中还可以包括第一NF实例的NF类型，以使第二NFRF在向第一NFRF发送第二NF实例的实例信息之前，对第一NF实例的NF类 型进行验证，进而保证不同PLMN中的NF实例访问的安全性。
在另一种可能的实施方式中，为了保证NFRF可以存储有PLMN中各NF实例的实例信息，当在PLMN中增设NF实例时，可以在NFRF中对增设的NF实例进行注册，具体的：接收NF注册请求，NF注册请求中包括待注册NF实例的实例信息、及待注册NF实例所属的网络切片的切片信息；根据待注册NF实例的实例信息、及待注册NF实例所属网络切片的切片信息，生成待注册NF实例的实例信息。
可选的，待注册NF实例的实例信息包括待注册实例的标识、待注册实例的NF类型、待注册实例的地址中的至少一种；目标网络切片的切片信息包括目标网络切片的标识、目标网络切片的类型中的至少一种。
第二方面，本发明实施例提供种网络访问控制方法，该方法的执行主体为第二PLMN中的第二块NFRF，该方法可以包括：第二NFRF接收第一NFRF发送的获取请求，获取请求中包括待访问网络功能NF实例类型和待访问网络切片标识，根据获取请求，获取待访问NF实例的NF类型和待访问网络切片标识对应的第二NF实例的实例信息，并向第一NFRF发送第二NF实例的实例信息。
在上述过程中，第二NFRF可以对第二PLMN中的NF实例进行管理，这样，当第二NFRF接收到第一NFRF发送的获取请求之后，第二NFRF可以获取待访问NF实例的NF类型和待访问网络切片标识对应的第二NF实例的实例信息，并向第一NFRF发送第二NF实例的实例信息，以使第一PLMN中的第一NF实例可以访问第二NF实例，提高了不同PLMN中NF实例访问的可靠性。
在一种可能的实施方式中，第二NFRF通过如下实现方式根据所述获取请求，获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的实例信息：获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的地址和负载信息。
可选的，在获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的地址和负载信息之前，还包括：
获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的个数；
若所述第二NF实例的个数大于1，则执行获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的地址和负载信息的步骤，这样，可以使得第一NF实例可以根据各个第二NF实例的负载信息在多个第二NF实例中选择一个目标第二NF实例。
在另一种可能的实施方式中，所述获取请求中还包括第一NF实例的NF类型；相应的，根据所述获取请求，获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的实例信息之前，还包括：
获取所述待访问NF实例对应的第一NF类型集合，所述第一NF类型集合中的各NF类型为允许对所述待访问NF实例进行访问的NF实例的NF类型；
若所述第一NF类型集合中包括所述第一NF实例的NF类型，则执行获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的实例信息；或者，若所述确定所述第一NF类型集合中不包括所述第一NF实例的NF类型，则向所述第一NFRF发送访问受限提示信息，以使所述第一NFRF向所述第一NF实例发送所述访问受限提示信息。进而提高跨PLMN进行NF实例访问的安全性。
第三方面，本发明实施例提供一种网络控制方法，该方法可以包括：当第一NF实例需要访问第二PLMN中的待访问NF实例的NF类型的NF实例时，第一NF实例获取待访问NF实例的NF类型、及所述待访问NF实例所属的网络切片的待访问网络切片标识，并向第一网络功能管理模块NFRF发送发现请求，所述发送请求中包括第二PLMN的标识、待访问NF实例的NF类型、及所述待访问网络切片标识，以使所述第一NFRF向所述第二PLMN中的第二NFRF请求获取待访问NF实例的NF类型和待访问网络切片标识对应的第二NF实例的实例信息，第一NF实例接收所述第一NFRF发送的所述第二NF实例的实例信息。
在上述过程中，在第一NF实例发送发现请求之前，先获取待访问网络切片标识，并在向第一NFRF实例发送的发现请求中携带待访问网络切片标识，以使第二NFRF可以根据待访问NF实例的NF类型和待访问网络切片标识获取第二NF实例的实例信息，使得第一NF实例可以对第二PLMN中的第二NF实例进行访问。
在一种可能的实施方式中，可选的，第一NF实例可以通过如下可行的实现方式获取所述待访问NF实例所属的网络切片的待访问网络切片标识：
获取所述第一NF实例所属的第一网络切片的第一网络切片类型；
根据所述第一NF实例对应的功能类型，确定所述第一网络切片类型在所述第二PLMN中对应的第二网络切片类型；
将所述第二网络切片类型确定为所述待访问网络切片标识。
可选的，若所述第一NF实例对应的功能类型为第一功能类型，则将所述第一NF实例所属的第一网络切片的第一网络切片类型确定为所述第二网络切片类型；其中，所述第一功能类型对应的网络功能在所有PLMN中的切片类型相同；
可选的，若所述第一NF实例对应的功能类型为第二功能类型，则向策略管理单元请求获取所述第二网络切片类型；其中，第二功能类型对应的网络功能在不同的PLMN中的切片类型不同。
可选的，第一NF实例可以向所述策略管理单元发送切片类型获取请求，所述网络切片获取请求中包括所述第一网络切片类型和所述第二PLMN的标识；接收所述策略管理单元发送的、所述第一网络切片类型在所述第二PLMN中对应的第二网络切片类型。
第四方面，本发明实施例提供一种网络访问控制装置，该网络访问控制装置应用于第一PLMN中的第一NFRF，所述装置包括接收模块、处理模块和发送模块，其中，
所述接收模块用于，接收第一网络功能NF实例发送的发现请求，所述发现请求中包括第二PLMN的标识和待访问NF实例的NF类型；
所述处理模块用于，获取待访问网络切片标识；
所述发送模块用于，向所述第二PLMN的标识对应的第二NFRF发送获取请求，所述获取请求包括待访问NF实例的NF类型和所述待访问网络切片标识；
所述接收模块用于，接收第二NFR发送的所述待访问NF实例的NF类型和待访问网络切片标识对应的第二NF实例的实例信息；
所述发送模块用于，向所述第一NF实例发送所述实例信息。
本发明实施例所示的网络访问控制装置可以执行上述方法实施例所示的 技术方案，其实现原理以及有益效果类似，此处不再进行赘述。
在一种可能的实施方式中，所述待访问网络切片标识为所述待访问网络切片的类型；
或者，
所述待访问网络切片标识为所述待访问网络切片的类型和租户标识的组合。
在另一种可能的实施方式中，所述发现请求中包括所述待访问网络切片标识；相应的，所述处理模块具体用于：
在所述发现请求中获取所述待访问网络切片标识。
在另一种可能的实施方式中，所述处理模块具体用于：
获取所述第一NF实例对应的功能类型；
根据所述第一NF实例对应的功能类型，确定所述待访问网络切片标识。
在另一种可能的实施方式中，所述处理模块具体用于：
获取所述第一NF实例所属的第一网络切片的第一网络切片类型；
根据所述第一NF实例对应的功能类型，确定所述第一网络切片类型在所述第二PLMN中对应的第二网络切片类型；
将所述第二网络切片类型确定为所述待访问网络切片标识。
在另一种可能的实施方式中，所述处理模块具体用于：
若所述第一NF实例对应的功能类型为第一功能类型，则将所述第一NF实例所属的第一网络切片的第一网络切片类型确定为所述第二网络切片类型；其中，所述第一功能类型对应的网络功能在所有PLMN中的切片类型相同；
或者，
若所述第一NF实例对应的功能类型为第二功能类型，则向策略管理单元请求获取所述第二网络切片类型；其中，第二功能类型对应的网络功能在不同的PLMN中的切片类型不同。
在另一种可能的实施方式中，所述发送模块还用于，向所述策略管理单元发送切片类型获取请求，所述网络切片获取请求中包括所述第一网络切片类型和所述第二PLMN的标识；
所述接收模块还用于，接收所述策略管理单元发送的、所述第一网络切 片类型在所述第二PLMN中对应的第二网络切片类型。
在另一种可能的实施方式中，所述实例信息中包括第二NF实例的地址；相应的，所述发送模块具体用于：
向所述第一NF实例发送所述实例信息，以使所述第一NF实例根据所述实例信息中的第二NF实例的地址访问所述第二NF实例。
在另一种可能的实施方式中，所述待访问NF实例的NF类型对应的第二NF实例的个数大于1；
相应的，所述发送模块具体用于：
向所述第一NF实例发送各所述第二NF实例的实例信息，以使所述第一NF实例在所述第二NF实例中确定目标第二NF实例，并根据所述目标第二NF实例的地址访问所述目标第二NF实例。
在另一种可能的实施方式中，所述实例信息中包括各所述第二NF实例的负载信息，以使所述第一NF实例根据各所述第二NF实例的负载信息在多个第二NF实例中确定目标第二NF实例，并根据所述目标第二NF实例的地址访问所述目标第二NF实例。
在另一种可能的实施方式中，所述方法还包括：
所述接收模块还用于，接收NF注册请求，所述NF注册请求中包括待注册NF实例的实例信息、及待注册NF实例所属的网络切片的切片信息；
所述处理模块还用于，根据所述待注册NF实例的实例信息、及所述待注册NF实例所属网络切片的切片信息，生成所述待注册NF实例的实例信息。
在另一种可能的实施方式中，所述待注册NF实例的实例信息包括待注册实例的标识、待注册实例的NF类型、待注册实例的地址中的至少一种；
所述目标网络切片的切片信息包括所述目标网络切片的标识、所述目标网络切片的类型中的至少一种。
本发明实施例所示的网络访问控制装置可以执行上述方法实施例所示的技术方案，其实现原理以及有益效果类似，此处不再进行赘述。
第五方面，本发明实施例提供另一种网络访问控制装置，该网络控制装置应用于第二PLMN中的第二NFRF，所述装置包括接收模块、处理模块和发送模块，其中，
所述接收模块用于，接收第一NFRF发送的获取请求，所述获取请求中 包括所述待访问网络功能NF实例类型和所述待访问网络切片标识；
所述处理模块用于，根据所述获取请求，获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的实例信息；
所述发送模块用于，向所述第一NFRF发送所述第二NF实例的实例信息。
本发明实施例所示的网络访问控制装置可以执行上述方法实施例所示的技术方案，其实现原理以及有益效果类似，此处不再进行赘述。
在一种可能的实施方式中，所述处理模块具体用于：
获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的地址和负载信息。
在另一种可能的实施方式中，所述处理模块还用于：
在所述处理模块获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的地址和负载信息之前，获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的个数；
若所述第二NF实例的个数大于1，则执行获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的地址和负载信息的步骤。
在另一种可能的实施方式中，所述获取请求中还包括第一NF实例的NF类型；相应的，所述处理模块还用于：
在所述处理模块根据所述获取请求，获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的实例信息之前，获取所述待访问NF实例对应的第一NF类型集合，所述第一NF类型集合中的各NF类型为允许对所述待访问NF实例进行访问的NF实例的NF类型；
若所述第一NF类型集合中包括所述第一NF实例的NF类型，则执行获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的实例信息。
在另一种可能的实施方式中，所述发送模块还用于，若所述确定所述第一NF类型集合中不包括所述第一NF实例的NF类型，则向所述第一NFRF发送访问受限提示信息，以使所述第一NFRF向所述第一NF实例发送所述访问受限提示信息。
本发明实施例所示的网络访问控制装置可以执行上述方法实施例所示的技术方案，其实现原理以及有益效果类似，此处不再进行赘述。
第六方面，本发明实施例提供又一种网络控制装置，该网络控制装置应用于第一NF实例，所述装置处理模块、发送模块和接收模块，其中，
所述处理模块用于，获取待访问NF实例的NF类型、及所述待访问NF实例所属的网络切片的待访问网络切片标识；
所述发送模块用于，向第一网络功能管理模块NFRF发送发现请求，所述发送请求中包括第二PLMN的标识、待访问NF实例的NF类型、及所述待访问网络切片标识，以使所述第一NFRF向所述第二PLMN中的第二NFRF请求获取待访问NF实例的NF类型和待访问网络切片标识对应的第二NF实例的实例信息；
所述接收模块用于，接收所述第一NFRF发送的所述第二NF实例的实例信息。
本发明实施例所示的网络访问控制装置可以执行上述方法实施例所示的技术方案，其实现原理以及有益效果类似，此处不再进行赘述。
在一种可能的实施方式中，所述处理模块具体用于：
获取所述第一NF实例所属的第一网络切片的第一网络切片类型；
根据所述第一NF实例对应的功能类型，确定所述第一网络切片类型在所述第二PLMN中对应的第二网络切片类型；
将所述第二网络切片类型确定为所述待访问网络切片标识。
在另一种可能的实施方式中，所述处理模块具体用于：
若所述第一NF实例对应的功能类型为第一功能类型，则将所述第一NF实例所属的第一网络切片的第一网络切片类型确定为所述第二网络切片类型；其中，所述第一功能类型对应的网络功能在所有PLMN中的切片类型相同；
或者，
若所述第一NF实例对应的功能类型为第二功能类型，则向策略管理单元请求获取所述第二网络切片类型；其中，第二功能类型对应的网络功能在不同的PLMN中的切片类型不同。
在另一种可能的实施方式中，所述发送模块还用于，向所述策略管理单 元发送切片类型获取请求，所述网络切片获取请求中包括所述第一网络切片类型和所述第二PLMN的标识；
所述接收模块还用于，接收所述策略管理单元发送的、所述第一网络切片类型在所述第二PLMN中对应的第二网络切片类型。
本发明实施例所示的网络访问控制装置可以执行上述方法实施例所示的技术方案，其实现原理以及有益效果类似，此处不再进行赘述。
第七方面，本发明实施例提供一种网络访问控制设备，该网络访问控制设备应用于第一PLMN中的第一NFRF，该设备包括接收器、处理器和、发送器、存储器、以及通信总线，存储器用于存储程序，通信总线用于实现元件之间的通信连接，处理器可以读取存储器中的程序，并执行相应的操作，其中，
所述接收器用于，接收第一网络功能NF实例发送的发现请求，所述发现请求中包括第二PLMN的标识和待访问NF实例的NF类型；
所述处理器用于，获取待访问网络切片标识；
所述发送器用于，向所述第二PLMN的标识对应的第二NFRF发送获取请求，所述获取请求包括待访问NF实例的NF类型和所述待访问网络切片标识；
所述接收器用于，接收第二NFR发送的所述待访问NF实例的NF类型和待访问网络切片标识对应的第二NF实例的实例信息；
所述发送器用于，向所述第一NF实例发送所述实例信息。
本发明实施例所示的网络访问控制设备可以执行上述方法实施例所示的技术方案，其实现原理以及有益效果类似，此处不再进行赘述。
在一种可能的实施方式中，所述待访问网络切片标识为所述待访问网络切片的类型；
或者，
所述待访问网络切片标识为所述待访问网络切片的类型和租户标识的组合。
在另一种可能的实施方式中，所述发现请求中包括所述待访问网络切片标识；相应的，所述处理器具体用于：
在所述发现请求中获取所述待访问网络切片标识。
在另一种可能的实施方式中，所述处理器具体用于：
获取所述第一NF实例对应的功能类型；
根据所述第一NF实例对应的功能类型，确定所述待访问网络切片标识。
在另一种可能的实施方式中，所述处理器具体用于：
获取所述第一NF实例所属的第一网络切片的第一网络切片类型；
根据所述第一NF实例对应的功能类型，确定所述第一网络切片类型在所述第二PLMN中对应的第二网络切片类型；
将所述第二网络切片类型确定为所述待访问网络切片标识。
在另一种可能的实施方式中，所述处理器具体用于：
若所述第一NF实例对应的功能类型为第一功能类型，则将所述第一NF实例所属的第一网络切片的第一网络切片类型确定为所述第二网络切片类型；其中，所述第一功能类型对应的网络功能在所有PLMN中的切片类型相同；
或者，
若所述第一NF实例对应的功能类型为第二功能类型，则向策略管理单元请求获取所述第二网络切片类型；其中，第二功能类型对应的网络功能在不同的PLMN中的切片类型不同。
在另一种可能的实施方式中，所述发送器还用于，向所述策略管理单元发送切片类型获取请求，所述网络切片获取请求中包括所述第一网络切片类型和所述第二PLMN的标识；
所述接收器还用于，接收所述策略管理单元发送的、所述第一网络切片类型在所述第二PLMN中对应的第二网络切片类型。
在另一种可能的实施方式中，所述实例信息中包括第二NF实例的地址；相应的，所述发送器具体用于：
向所述第一NF实例发送所述实例信息，以使所述第一NF实例根据所述实例信息中的第二NF实例的地址访问所述第二NF实例。
在另一种可能的实施方式中，所述待访问NF实例的NF类型对应的第二NF实例的个数大于1；
相应的，所述发送器具体用于：
向所述第一NF实例发送各所述第二NF实例的实例信息，以使所述第一 NF实例在所述第二NF实例中确定目标第二NF实例，并根据所述目标第二NF实例的地址访问所述目标第二NF实例。
在另一种可能的实施方式中，所述实例信息中包括各所述第二NF实例的负载信息，以使所述第一NF实例根据各所述第二NF实例的负载信息在多个第二NF实例中确定目标第二NF实例，并根据所述目标第二NF实例的地址访问所述目标第二NF实例。
在另一种可能的实施方式中，所述方法还包括：
所述接收器还用于，接收NF注册请求，所述NF注册请求中包括待注册NF实例的实例信息、及待注册NF实例所属的网络切片的切片信息；
所述处理器还用于，根据所述待注册NF实例的实例信息、及所述待注册NF实例所属网络切片的切片信息，生成所述待注册NF实例的实例信息。
在另一种可能的实施方式中，所述待注册NF实例的实例信息包括待注册实例的标识、待注册实例的NF类型、待注册实例的地址中的至少一种；
所述目标网络切片的切片信息包括所述目标网络切片的标识、所述目标网络切片的类型中的至少一种。
本发明实施例所示的网络访问控制设备可以执行上述方法实施例所示的技术方案，其实现原理以及有益效果类似，此处不再进行赘述。
第八方面，本发明实施例提供一种网络访问控制设备，应用于第二公共陆地移动网络PLMN中的第二网络功能管理器NFRF，所述装置包括接收器、处理器和发送器，其中，
所述接收器用于，接收第一NFRF发送的获取请求，所述获取请求中包括所述待访问网络功能NF实例类型和所述待访问网络切片标识；
所述处理器用于，根据所述获取请求，获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的实例信息；
所述发送器用于，向所述第一NFRF发送所述第二NF实例的实例信息。
本发明实施例所示的网络访问控制设备可以执行上述方法实施例所示的技术方案，其实现原理以及有益效果类似，此处不再进行赘述。
在一种可能的实施方式中，所述处理器具体用于：
获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的地址和负载信息。
在另一种可能的实施方式中，所述处理器还用于：
在所述处理器获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的地址和负载信息之前，获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的个数；
若所述第二NF实例的个数大于1，则执行获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的地址和负载信息的步骤。
在另一种可能的实施方式中，所述获取请求中还包括第一NF实例的NF类型；相应的，所述处理器还用于：
在所述处理器根据所述获取请求，获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的实例信息之前，获取所述待访问NF实例对应的第一NF类型集合，所述第一NF类型集合中的各NF类型为允许对所述待访问NF实例进行访问的NF实例的NF类型；
若所述第一NF类型集合中包括所述第一NF实例的NF类型，则执行获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的实例信息。
在另一种可能的实施方式中，所述发送器还用于，若所述确定所述第一NF类型集合中不包括所述第一NF实例的NF类型，则向所述第一NFRF发送访问受限提示信息，以使所述第一NFRF向所述第一NF实例发送所述访问受限提示信息。
本发明实施例所示的网络访问控制设备可以执行上述方法实施例所示的技术方案，其实现原理以及有益效果类似，此处不再进行赘述。
第九方面，本发明实施例提供一种网络控制设备，应用于第一网络功能NF实例，所述装置处理器、发送器和接收器，其中，
所述处理器用于，获取待访问NF实例的NF类型、及所述待访问NF实例所属的网络切片的待访问网络切片标识；
所述发送器用于，向第一网络功能管理器NFRF发送发现请求，所述发送请求中包括第二PLMN的标识、待访问NF实例的NF类型、及所述待访问网络切片标识，以使所述第一NFRF向所述第二PLMN中的第二NFRF请求获取待访问NF实例的NF类型和待访问网络切片标识对应的第二NF实例 的实例信息；
所述接收器用于，接收所述第一NFRF发送的所述第二NF实例的实例信息。
本发明实施例所示的网络访问控制设备可以执行上述方法实施例所示的技术方案，其实现原理以及有益效果类似，此处不再进行赘述。
在一种可能的实施方式中，所述处理器具体用于：
获取所述第一NF实例所属的第一网络切片的第一网络切片类型；
根据所述第一NF实例对应的功能类型，确定所述第一网络切片类型在所述第二PLMN中对应的第二网络切片类型；
将所述第二网络切片类型确定为所述待访问网络切片标识。
在另一种可能的实施方式中，所述处理器具体用于：
若所述第一NF实例对应的功能类型为第一功能类型，则将所述第一NF实例所属的第一网络切片的第一网络切片类型确定为所述第二网络切片类型；其中，所述第一功能类型对应的网络功能在所有PLMN中的切片类型相同；
或者，
若所述第一NF实例对应的功能类型为第二功能类型，则向策略管理单元请求获取所述第二网络切片类型；其中，第二功能类型对应的网络功能在不同的PLMN中的切片类型不同。
在另一种可能的实施方式中，所述发送器还用于，向所述策略管理单元发送切片类型获取请求，所述网络切片获取请求中包括所述第一网络切片类型和所述第二PLMN的标识；
所述接收器还用于，接收所述策略管理单元发送的、所述第一网络切片类型在所述第二PLMN中对应的第二网络切片类型。
本发明实施例所示的网络访问控制设备可以执行上述方法实施例所示的技术方案，其实现原理以及有益效果类似，此处不再进行赘述。
第十方面，本发明实施例提供一种网络控制系统，所述网络控制系统包括上述第七方面至第九方面所述的网络控制设备。
本发明实施例提供的网络访问控制方法、装置及设备，通过在第一PLMN中设置第一NFRF，在第二PLMN中设置第二NFRF，第一NFRF用于存储 第一PLMN中各NF实例的实例信息，第二NFRF用于存储第二PLMN中各NF实例的实例信息。当第一PLMN中的第一NF实例需要访问第二PLMN中的第二NF实例时，第一NF实例可以通过第一NFRF和第二NFRF获取第二NF实例的实例信息，并根据第二NF实例的实例信息对第二NF实例进行访问，这样，可以保证第一PLMN中的第一NF实例可以对第二PLMN中的NF实例进行访问，进而提高不同PLMN中NF实例访问的可靠性。
附图说明
图1为本发明实施例提供的网络访问控制方法的应用场景示意图；
图2为本发明实施例提供的网络访问控制方法的流程示意图一；
图3为本发明实施例提供的在NFRF中注册NF实例方法的流程示意图；
图4为本发明实施例提供的获取待访问网络切片标识方法的流程示意图；
图5为本发明实施例提供的对待访问网络切片标识验证方法的流程示意图；
图6为本发明实施例提供的网络访问控制方法的流程示意图二；
图7为本发明实施例提供的网络访问控制方法的流程示意图三；
图8为本发明实施例提供的网络访问控制方法的流程示意图四；
图9为本发明实施例提供的一种网络访问控制装置的结构示意图；
图10为本发明实施例提供的另一种网络访问控制装置的结构示意图；
图11为本发明实施例提供的又一种网络控制装置的结构示意图；
图12为本发明实施例提供的一种网络访问控制设备的结构示意图；
图13为本发明实施例提供的另一种网络访问控制设备的结构示意图；
图14为本发明实施例提供的又一种网络访问控制设备的结构示意图。
具体实施方式
为使本发明实施例的目的、技术方案和优点更加清楚，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获 得的所有其他实施例，都属于本发明保护的范围。
图1为本发明实施例提供的网络访问控制方法的应用场景示意图，请参见图1，包括第一PLMN 101和第二PLMN 102。在第一PLMN 101中包括多个网络切片1011和第一NFRF 1012；在第二PLMN 102中包括多个网络切片1021和第二NFRF 1022，每一个网络切片中设置有多个NF实例。其中，第一NFRF 1012可以对第一PLMN 101中的各网络切片1011中的NF实例进行管理，第二NFRF 1022可以对第二PLMN 102中的各网络切片1021中的NF实例进行管理。
在本申请中，当第一PLMN 101中的NF实例需要访问第二PLMN中的NF实例时，第一PLMN 101中的NF实例可以通过第一NFRF 1012和第二NFRF 1022，获取第二PLMN 102中的需要访问的NF实例的信息(例如，NF实例所属的网络切片类型等)，并根据需要访问的NF实例的信息，对需要访问的NF实例进行访问。
可选的，第一PLMN 101中的NF实例需要访问第二PLMN中的NF实例的场景可以为：终端设备使用的SIM卡由第二PLMN对应的运营商提供，若终端设备位于第一PLMN中，当需要向终端设备提供服务时，则第一PLMN 101中的NF实例需要访问第二PLMN中的NF实例，第一PLMN 101中的NF实例通过和第二PLMN中的NF实例进行交互，以实现向终端设备提供服务。当然，第一PLMN 101中的NF实例需要访问第二PLMN中的NF实例的场景还可以包括其它场景，本发明对此不作具体限定。
在本申请中，通过为各个PLMN设置对应的NFRF，由NFRF可以对PLMN中的网络切片中的NF实例进行管理，以使一个PLMN中的NF实例可以通过NFRF对其它PLMN中的NF实例进行访问。进而提高不同PLMN中NF实例访问的可靠性。
需要说明的是，本申请实施例中所述的第一PLMN和第二PLMN的实质相同，为了便于描述，将终端设备漫游后对应的PLMN称之为第一PLMN，将终端设备漫游前对应的PLMN称之为第二PLMN；当然，第一PLMN也可以为其它终端设备漫游前对应的PLMN，第二PLMN也可以为其它终端设备漫游后对应的PLMN。同理，为了便于描述，将第一PLMN对应的NFRF称之为第一NFRF，将第二PLMN对应的NFRF称之为第二NFRF；将第一PLMN 中的NF称之为第一NF，将第二PLMN中的NF称之为第二NF。
下面，通过具体实施例对本申请所示的技术方案进行详细说明。需要说明的是，下面这几个具体的实施例可以相互结合，对于相同或相似的概念或过程可能在某些实施例中不再赘述。
图2为本发明实施例提供的网络访问控制方法的流程示意图一，请参见图2，该方法可以包括：
S201、第一NF实例向第一NFRF发送的发现请求，发现请求中包括第二PLMN的标识和待访问NF实例的NF类型。
S202、第一NFRF获取待访问网络切片标识。
S203、第一NFRF向第二PLMN的标识对应的第二NFRF发送获取请求，获取请求中包括待访问NF实例的NF类型和待访问网络切片标识。
S204、第二NFRF根据获取请求，获取待访问NF实例的NF类型和待访问网络切片标识对应的第二NF实例的实例信息。
S205、第二NFRF向第一NFRF发送第二NF实例的实例信息。
S206、第一NFRF向第一NF实例发送第二NF实例的实例信息。
在图2所示的实施例中，第一NFRF为第一PLMN对应NFRF，第一NF实例为第一PLMN中的任意一个网络切片中的任意一个NF实例；第二NFRF为第二PLMN对应NFRF，第一PLMN和第二PLMN为不同的PLMN。
在实际应用过程中，假设终端设备与第二PLMN对应(由第二PLMN为终端设备提供服务)，若终端设备漫游在第一PLMN中，在第一PLMN中的第一NF实例向该终端设备提供服务的过程，当第一NF实例需要访问第二PLMN中的NF实例时，第一NF实例向第一NFRF发送发现请求，该发现请求中包括第二PLMN的标识和待访问NF实例的NF类型；该发现请求用于请求访问第二PLMN中的NF实例。具体的，NF实例的NF类型指的是该NF实例所具备的网络功能的类型，例如移动管理功能、分组数据会话连接管理功能、用户鉴权功能和策略管理功能等。
在第一NFRF接收到第一NF发送的发现请求之后，第一NFRF在发现请求中获取第二PLMN的标识和待访问NF实例的NF类型，确定第二PLMN的标识对应的第二NFRF、及待访问NF实例对应的NF实例所属的网络切片的标识(待访问网络切片标识)。第一NFRF向第二NFRF发送获取请求， 该获取请求中包括待访问NF实例的NF类型和待访问网络切片标识。可选的，待访问网络切片标识可以为待访问网络切片的类型，或者，待访问网络切片标识可以为待访问网络切片的类型和租户标识的组合；具体的，若待访问网络切片为向某租户出租的网络切片，则待访问网络切片标识可以为待访问网络切片的类型和租户标识的组合，若待访问网络切片为运营商的通用网络切片(非出租网络切片)，则待访问网络切片标识可以为待访问网络切片的类型。
在第二NFRF接收到第一NFRF发送的获取请求之后，第二NFRF根据获取请求，获取待访问NF实例的NF类型和待访问网络切片标识对应的第二NF实例的实例信息。可选的，在第二NFRF中存储有第二PLMN中所有网络切片中所有NF实例的实例信息，第二NFRF可以根据待访问NF实例的NF类型和待访问网络切片标识，在已存储的实例信息中获取待访问NF实例的NF类型和待访问网络切片标识对应的第二NF实例的实例信息。可选的，实例信息中可以包括NF实例的地址信息、负载信息等。可以根据实际需要设置实例信息中包括的内容，本发明对此不作具体限定。可选的，第二NFRF获取得到的第二NF实例的个数可以为1个，也可以为多个。
在第二NFRF获取得到第二NF实例的实例信息之后，第二NFRF向第一NFRF发送第二NF实例的实例信息，以使第一NFRF向第一NF实例发送实例信息，第一NF实例根据接收到的实例信息中访问第二NF实例。可选的，第二NF实例的实例信息中包括第二NF实例的地址，相应的，第一NF实例可以根据实例信息中的第二NF实例的地址访问第二NF实例。
可选的，当第二NFRF获取得到的第二NF实例的个数为1个时，第一NF实例可以直接根据该一个第二NF实例的实例信息，对该第二NF实例进行访问。当第二NFRF获取得到的第二NF实例的个数大于1时，第二NFRF可以在该多个第二NF实例中选择一个目标第二NF实例，并根据该目标第二NF实例的实例信息，对该目标第二NF实例进行访问。
可选的，在实例信息中还可以包括各第二NF实例的负载信息，以使第一NF实例可以根据各第二NF实例的负载信息选择目标第二NF实例，例如，第一NF实例可以将负载最小的第二NF实例确定为目标第二NF实例。可选的，实例信息中还可以包括各第二NF实例的优先级，以使第一NF实例可以 根据各第二NF实例的优先级选择目标第二NF实例，例如，第一NF实例可以将优先级最高的第二NF实例确定为目标第二NF实例。当然，若实例信息中未包括各第二NF实例的负载信息、优先级等信息，第一NF实例也可以将第二NF实例中任意一个第二NF实例确定为目标第二NF实例。
本发明实施例提供的网络访问控制方法，通过在第一PLMN中设置第一NFRF，在第二PLMN中设置第二NFRF，第一NFRF用于存储第一PLMN中各NF实例的实例信息，第二NFRF用于存储第二PLMN中各NF实例的实例信息。当第一PLMN中的第一NF实例需要访问第二PLMN中的第二NF实例时，第一NF实例可以通过第一NFRF和第二NFRF获取第二NF实例的实例信息，并根据第二NF实例的实例信息对第二NF实例进行访问，这样，可以保证第一PLMN中的第一NF实例可以对第二PLMN中的NF实例进行访问，进而提高不同PLMN中NF实例访问的可靠性。
在图2所示实施例中，为了保证NFRF可以存储有PLMN中各NF实例的实例信息，当在PLMN中增设NF实例时，可以在NFRF中对增设的NF实例进行注册，其中，该NFRF可以为任意一个PLMN对应的NFRF。下面，通过图3所示的实施例，对在NFRF中注册NF实例的过程进行详细说明。
图3为本发明实施例提供的在NFRF中注册NF实例方法的流程示意图，请参见图3，该方法可以包括：
S301、接收NF注册请求，NF注册请求中包括待注册NF实例的实例信息、及待注册NF实例所属的网络切片的切片信息。
S302、根据待注册NF实例的实例信息、及待注册NF实例所属网络切片的切片信息，生成待注册NF实例的实例信息。
在图3所示的实施例中，PLMN中每一个网络切片可以对应一个切片管理单元，当用户需要在网络切片中增设NF实例时，用户可以通过切片管理单元输入NF注册请求，以使切片管理单元向NFRF发送该NF注册请求，其中，该NF注册请求中包括待注册NF实例的实例信息、及待注册NF实例所属的网络切片的切片信息。可选的，待注册NF实例的实例信息包括待注册实例的标识、待注册实例的NF类型、待注册实例的地址中的至少一种；目标网络切片的切片信息包括目标网络切片的标识、目标网络切片的类型中的至少一种。
在NFRF接收到NF注册请求之后，NFRF根据注册请求中的待注册NF实例的实例信息、及待注册NF实例所属网络切片的切片信息，生成待注册NF实例的实例信息。可选的，NFRF在生成待注册NF实例的实例信息之后，NFRF可以向切片管理单元反馈生成的、待注册NF实例的实例信息。可选的，NFRF可以以表格等形式对待注册NF实例的实例信息进行存储。
例如，NFRF可以通过表1对对应的PLMN中的NF实例的实例信息进行存储：
表1
Figure PCTCN2016101529-appb-000001
需要说明的是，表1只是以示例形式实例NFRF对PLMN中的NF实例的实例信息进行存储的存储形式、及各实例信息中包括的内容，并非对存储形式及实例信息中包括的内容的限定，在实际应用过程中，可以根据实际需要设置该存储形式、及各实例信息中包括的内容。
在上述过程中，PLMN中增设NF实例时，通过在NFRF中对增设的NF实例进行注册，以使NFRF生成增设的NF实例的实例信息，这样，可以保 证NFRF可以存储有PLMN中各NF实例的实例信息。
在上述任意一个实施例的基础上，第一NFRF可以通过如下两种可行的实现方式获取待访问NF实例对应的待访问网络切片标识：
一种可行的实现方式：第一NF实例向第一NFRF发送的发现请求时，第一NF实例获取待访问网络切片标识，并在发现请求中携带待访问网络切片标识，以使第一NFRF可以在发现请求中获取待访问网络切片标识。
另一种可行的实现方式：第一NFRF根据第一NF实例对应的功能类型，确定待访问网络切片标识。
在上述两种可行的实现方式中，第一NF实例或者第一NFRF可以通过如下可行的实现方式获取待访问网络切片标识，具体的，请参见图4所示的实施例。
图4为本发明实施例提供的获取待访问网络切片标识方法的流程示意图，请参见图4，该方法可以包括：
S401、获取第一NF实例对应的功能类型、及第一NF实例所属的第一网络切片的第一网络切片类型。
S402、判断第一NF实例对应的功能类型是否为第一功能类型。
若是，则执行S403和S406。
若否，则执行S404-S406。
S403、将第一网络切片类型确定为第一网络切片类型在第二PLMN中对应的第二网络切片类型。
S404、向策略管理单元发送切片类型获取请求，网络切片获取请求中包括第一网络切片类型和第二PLMN的标识；
S405、接收策略管理单元发送的、第一网络切片类型在第二PLMN中对应的第二网络切片类型。
S406、将第二网络切片类型确定为待访问网络切片标识。
图4实施例所示的执行主体可以为第一NF实例，也可以为第一NFRF。当第一NF实例需要在发现请求中携带待访问网络切片标识时，第一NF实例可以通过图4实施例所示的方法获取待访问网络切片标识。当第一NFRF接收到的发现请求中未包括待访问网络切片标识时，第一NFRF可以通过图4实施例所示的方法获取待访问网络切片标识。
在实际应用过程中，当需要获取待访问网络切片标识时，先获取第一NF实例对应的功能类型，该功能类型可以包括第一功能类型和第二功能类型。其中，第一功能类型对应的网络功能在所有PLMN中的切片类型相同，第二功能类型对应的网络功能在不同的PLMN中的切片类型不同。可选的，功能类型为NF实例的一种属性信息，可以在第一NF实例的属性信息中获取第二NF实例的功能类型。
在获取得到第一NF实例对应的功能类型之后，判断第一NF实例对应的功能类型是否为第一功能类型。
若第一NF实例对应的功能类型是第一功能类型，则获取第一NF实例所属的第一网络切片的第一网络切片类型，并将第一网络切片类型确定第一网络切片类型在第二PLMN中对应的第二网络切片类型，并将第二网络切片类型确定为待访问网络切片标识。
或者，
若第一NF实例对应的功能类型是第二功能类型，则向策略管理单元请求获取第一网络切片类型在第二PLMN中对应的第二网络切片类型，可选的，可以向策略管理单元发送切片类型获取请求，网络切片获取请求中包括第一网络切片类型和第二PLMN的标识，并接收策略管理单元发送的、第一网络切片类型在第二PLMN中对应的第二网络切片类型。可选的，在策略管理单元中存储有不同PLMN之间的各网络切片的对应关系，可选的，该对应关系可以如表2所示：
表2
Figure PCTCN2016101529-appb-000002
需要说明的是，表2只是以示例的形式示意不同PLMN之间的各网络切片的对应关系、以及策略管理单元对该对应关系的存储形式，并非对该对应关系、及对该对应关系的存储形式的限定，在实际应用过程中，可以根据实际需要设置该应关系、及对该对应关系的存储形式。
在上述过程中，根据第一NF实例对应的功能类型，可以准确的获取得到待访问NF实例对应的待访问网络切片标识，进一步的提高了不同PLMN中NF实例访问的可靠性。
在上述任意一个实施例的基础上，为了保证NF实例访问的安全性，在第一NFRF获取待访问NF实例的NF类型和待访问网络切片标识对应的第二NF实例的实例信息之前，还可以验证第一NF实例是否具有对待访问NF实例(第二NF实例)的访问权限，具体的，请参见图5所示的实施例。
图5为本发明实施例提供的对第一NF实例的访问权限进行验证方法的流程示意图，请参见图5，该方法可以包括：
S501、获取待访问NF实例对应的第一NF类型集合，第一NF类型集合中的各NF类型为允许对待访问NF实例进行访问的NF实例的NF类型。
S501、判断所述第一NF类型集合中是否包括第一NF实例的NF类型。
若是，则执行S503。
若否，则执行S504。
S503、获取待访问NF实例的NF类型和待访问网络切片标识对应的第二NF实例的实例信息。
S504、向第一NFRF发送访问受限提示信息，以使第一NFRF向第一NF实例发送访问受限提示信息。
在图5所示的实施例中，第一NFRF向第二NFRF发送的获取请求中还包括第一NF实例的NF类型，这样，在第二NFRF接收到获取请求之后，先获取待访问NF实例对应的第一NF类型集合，该第一NF类型集合中的各NF类型为允许对待访问NF实例进行访问的NF实例的NF类型，并判断所述第一NF类型集合中是否包括第一NF实例的NF类型。
若第一NF类型集合中包括第一NF实例的NF类型，说明第一NF实例具有对待访问NF实例的访问权限，则第二NFRF实例继续获取待访问NF实例的NF类型和待访问网络切片标识对应的第二NF实例的实例信息。
若第一NF类型集合中不包括第一NF实例的NF类型，说明第一NF实例不具有对待访问NF实例的访问权限，则第二NFRF向第一NFRF发送访问受限提示信息，以使第一NFRF向第一NF实例发送访问受限提示信息。
下面，分别通过图6-图8所示的实施例，对上述实施例所示的网络访问控制方法进行详细说明。其中，在图6所示的实施例中，在第一NF实例向第一NFRF发送的发现请求中包括待访问网络切片标识。在图7所示的实施例中，在第一NF实例向第一NFRF发送的发现请求中不包括待访问网络切片标识，由第一NFRF获取待访问网络切片标识。
图6为本发明实施例提供的网络访问控制方法的流程示意图二，请参见图6，该方法可以包括：
S601、第一NF实例获取第一NF实例对应的功能类型。
S602、第一NF实例判断第一NF实例对应的功能类型是否为第一功能类型。
若是，则执行S603。
若否，则执行S604。
S603、第一NF实例将第一网络切片类型确定为第一网络切片类型在第二PLMN中对应的第二网络切片类型。
在S603之后，执行S606。
S604、第一NF实例向策略管理单元发送网络切片标识获取请求，网络切片获取请求中包括第一网络切片类型和第二PLMN的标识。
S605、策略管理单元向第一NF实例发送第一网络切片类型在第二PLMN中对应的第二网络切片类型。
S606、第一NF实例将第二网络切片类型确定为待访问网络切片标识。
S607、第一NF实例向第一NFRF发送的发现请求，发现请求中包括第二PLMN的标识、待访问NF实例的NF类型和待访问网络切片标识。
S608、第一NFRF在发现请求中获取待访问NF实例的NF类型和待访问网络切片标识，并生成获取请求；其中，获取请求中包括待访问NF实例的NF类型和待访问网络切片标识。
S609、第一NFRF向第二PLMN的标识对应的第二NFRF发送获取请求。
S610、第二NFRF根据获取请求，获取待访问NF实例的NF类型和待访 问网络切片标识对应的第二NF实例的实例信息。
S611、第二NFRF向第一NFRF发送第二NF实例的实例信息。
S612、第一NFRF向第一NF实例发送第二NF实例的实例信息。
S613、第一NF实例判断第二NF实例的个数是否大于1。
若是，则执行S614。
若否，则执行S615。
S614、第一NF实例在多个第二NF实例中选择目标第二NF实例。
S615、第一NF实例将第二NF实例确定目标第二NF实例。
S616、第一NF实例向目标第二NF实例发送访问请求。
S617、第二NF实例向第一NF实例发送访问响应。
在图6所示的实施例中，在第一NF实例需要访问第二PLMN中的NF实例时，第一NF实例向第一NFRF发送发现请求，为了使得第一NFRF可以快速获取NF实例，第一NF实例在向第一NFRF发送发现请求时，第一NF实例先确定待访问NF实例对应的网络切片的标识(待访问网络切片标识)，具体的，第一NF实例通过S601-S606确定待访问网络切片标识。需要说明的是，S601-S606具体的描述可以参考S401-S407，此处不再进行赘述。
在第一NFRF接收到发现请求之后，第一NFRF在发现请求中获取待访问NF实例的NF类型和待访问网络切片标识，生成包括待访问NF实例的NF类型和待访问网络切片标识获取请求，并向第二PLMN的标识对应的第二NFRF发送获取请求。
第二NFRF根据获取请求，获取待访问NF实例的NF类型和待访问网络切片标识对应的第二NF实例的实例信息，并向第一NFRF发送第二NF实例的实例信息。可选的，第二PLMN可以根据获取请求，确定待访问NF实例的NF类型和待访问网络切片标识对应的第二NF实例的个数；若第二NF实例的个数为1，则确定第二NF实例的实例信息包括第二NF实例的地址；若第二NF实例的个数大于1，则确定第二NF实例的实例信息包括各第二NF实例的地址和各第二NF实例的负载信息。
第一NFRF接收到第二NF实例的实例信息之后，向第一NF实例发送第二NF实例的实例信息，可选的，该实例信息中可以包括第二NF实例的地址、信息负载信息、优先级等。可以根据实际需要设实例信息中包括的具体内容。 第一NF实例判断第二NF实例的个数是否大于1，若是，则第一NF实例在多个第二NF实例中选择目标第二NF实例，可选的，第一NF实例可以将负载最小的实例确定为目标第二NF实例；若否，则直接将该一个第二NF实例确定为目标第二NF实例，并向目标第二NF实例发送访问请求，在接收到第二NF实例的访问响应之后，第一NF实例可以访问第二NF实例。
需要说明的是，在图6实施例所示的网络控制方法中，部分步骤可以通过具有相似功能的步骤替换，本发明对此不作具体限定。
在上述过程中，由第一NF确定待访问网络切片标识，减轻第一NFRF的负担，进而提高第一NFRF获取第二NF实例的实例信息的效率。
图7为本发明实施例提供的网络访问控制方法的流程示意图三，请参见图7，该方法可以包括：
S701、第一NF实例向第一NFRF发送的发现请求，发现请求中包括第二PLMN的标识、待访问NF实例的NF类型。
S702、第一NFRF获取第一NF实例对应的功能类型。
S703、第一NFRF判断第一NF实例对应的功能类型是否为第一功能类型。
若是，则执行S704。
若否，则执行S705。
S704、第一NFRF将第一网络切片类型确定为第一网络切片类型在第二PLMN中对应的第二网络切片类型。
在S704之后，执行S707。
S705、第一NFRF向策略管理单元发送网络切片标识获取请求，网络切片获取请求中包括待访问第一网络切片类型和第二PLMN的标识。
S706、策略管理单元向第一NFRF发送第一网络切片类型在第二PLMN中对应的第二网络切片类型。
S707、第一NFRF将第二网络切片类型确定为待访问网络切片标识。
S708、第一NFRF根据待访问NF实例的NF类型和待访问网络切片标识生成获取请求，获取请求包括待访问NF实例的NF类型和待访问网络切片标识。
S709、第一NFRF向第二PLMN的标识对应的第二NFRF发送获取请求。
S710、第二NFRF根据获取请求，获取待访问NF实例的NF类型和待访问网络切片标识对应的第二NF实例的实例信息。
S711、第二NFRF向第一NFRF发送第二NF实例的实例信息。
S712、第一NFRF向第一NF实例发送第二NF实例的实例信息。
S713、第一NF实例判断第二NF实例的个数是否大于1。
若是，则执行S614。
若否，则执行S615。
S714、第一NF实例在多个第二NF实例中选择目标第二NF实例。
S715、第一NF实例将第二NF实例确定目标第二NF实例。
S716、第一NF实例向目标第二NF实例发送访问请求。
S717、第二NF实例向第一NF实例发送访问响应。
在图7所示的实施例中，在第一NF实例需要访问第二PLMN中的NF实例时，第一NF实例向第一NFRF发送发现请求，该发现请求中包括第二PLMN的标识和待访问NF实例的NF类型。
在第一NFRF接收到发现请求之后，第一NFRF为了获取到待访问NF实例的NF类型对应的NF实例，第一NFRF需要确定待访问NF实例对应的网络切片的标识(待访问网络切片标识)，具体的，第一NFRF通过S702-S707确定待访问网络切片标识。需要说明的是，S702-S707具体的描述可以参考S401-S407相同，S709-S717的具体描述可以参考S609-S617，此处不再进行赘述。
需要说明的是，在图7实施例所示的网络控制方法中，部分步骤可以通过具有相似功能的步骤替换，本发明对此不作具体限定。
在上述过程中，由第一NFRF确定待访问网络切片标识，无需对第一NF的功能及结构进行较多改进，进而节省了成本。
在图6或图7所示实施例的基础上，获取请求中还可以包括第一NF实例的NF类型，以使第二NFRF向第一NF提供第二NF实例的实例信息之前，先对第一NF实例的NF类型进行验证。为了便于描述，在图7所示实施例的基础上，通过图8所示的实施例对该种实现方式进行详细说明。
图8为本发明实施例提供的网络访问控制方法的流程示意图四，请参见图8，该方法可以包括：
S801、第一NF实例向第一NFRF发送的发现请求，发现请求中包括第二PLMN的标识、待访问NF实例的NF类型。
S802、第一NFRF实获取第一NF实例对应的功能类型。
S803、第一NFRF判断第一NF实例对应的功能类型是否为第一功能类型。
若是，则执行S804。
若否，则执行S805。
S804、第一NFRF将第一网络切片类型确定为第一网络切片类型在第二PLMN中对应的第二网络切片类型。
在S804之后，执行S807。
S805、第一NFRF向策略管理单元发送网络切片标识获取请求，网络切片获取请求中包括待访问第一网络切片类型和第二PLMN的标识。
S806、第一NFRF接收策略管理单元发送的、第一网络切片类型在第二PLMN中对应的第二网络切片类型。
S807、第一NFRF将第二网络切片类型确定为待访问网络切片标识。
S808、第一NFRF根据待访问NF实例的NF类型、待访问网络切片标识、及第一NF实例的NF类型生成获取请求，获取请求中包括待访问NF实例的NF类型、待访问网络切片标识、及第一NF实例的NF类型。
S809、第一NFRF向第二PLMN的标识对应的第二NFRF发送获取请求。
S810、第二NFRF获取待访问NF实例对应的第一NF类型集合，第一NF类型集合中的各NF类型为允许对待访问NF实例进行访问的NF实例的NF类型。
S811、第二NFRF判断第一NF类型集合中是否包括第一NF实例的NF类型。
若是，则执行S814-S821。
若否，则执行S812-S813。
S812、第二NFRF向第一NFRF发送访问受限提示信息；
S813、第一NFRF向第一NF实例发送访问受限提示信息。
S814、第二NFRF根据获取请求，获取待访问NF实例的NF类型和待访问网络切片标识对应的第二NF实例的实例信息。
S815、第二NFRF向第一NFRF发送第二NF实例的实例信息。
S816、第一NFRF向第一NF实例发送第二NF实例的实例信息。
S817、第一NF实例判断第二NF实例的个数是否大于1。
若是，则执行S818。
若否，则执行S819。
S818、第一NF实例在多个第二NF实例中选择目标第二NF实例。
S819、第一NF实例将第二NF实例确定目标第二NF实例。
S820、第一NF实例向目标第二NF实例发送访问请求。
S821、第二NF实例向第一NF实例发送访问响应。
在图8所示的实施例中，S801-S807具体的描述可以参考S701-S707，此处不再进行赘述。
在S808中，第一NFRF根据待访问NF实例的NF类型、待访问网络切片标识、及第一NF实例的NF类型生成获取请求，获取请求中包括待访问NF实例的NF类型、待访问网络切片标识、及第一NF实例的NF类型，并向第二NFRF发送获取请求。
第二获取待访问NF实例的对应的第一NF类型集合，并判断第一NF类型集合中是否包括第一NF实例的NF类型。
若是，则说明第一NF实例具有访问待访问NF实例的权限，则执行S814-S821。其中，S814-S821的具体描述可以参考S710-S716，此处不再进行赘述。
若否，则说明第一NF实例不具有访问待访问NF实例的权限，则第二NFRF向第一NFRF发送访问受限提示信息，并由第一NFRF向第一NF实例发送访问受限提示信息，以提示第一NF没有访问待访问NF实例的NF类型的NF实例的权限。
需要说明的是，在图8实施例所示的网络控制方法中，部分步骤可以通过具有相似功能的步骤替换，本发明对此不作具体限定。
在图8所示的实施例中，在第二NFRF向第一NF实例提供第二PLMN中的NF实例的实例信息之前，先验证第一NF实例是否具有访问权限，在确定第一NF实例具有访问权限时，再向第一NF实例提供第二PLMN中的NF实例的实例信息，提高了跨PLMN的NF实例访问的安全性。
需要说明的是，在上述任意一个实施例的基础上，在第一NFRF向第二NFRF发送获取请求时，也可以在获取请求中携带第一NF实例的NF类型和待访问NF实例的NF类型(不包括待访问网络切片标识)，以使第二NFRF获取第一NF实例所属的第一网络切片的第一网络切片类型，并向策略管理单元请求获取第一网络切片类型在第二PLMN中对应的第二网络切片类型，并将第二网络切片类型确定为待访问网络切片标识。其中，第二NFRF向策略管理单元请求获取第二网络切片类型的过程，与第一NFRF向策略管理单元请求获取第二网络切片类型的过程相同，此处不再进行赘述。
图9为本发明实施例提供的一种网络访问控制装置的结构示意图，该网络访问控制装置应用于第一PLMN中的第一NFRF，请参见图9，所述装置包括接收模块11、处理模块12和发送模块13，其中，
所述接收模块11用于，接收第一网络功能NF实例发送的发现请求，所述发现请求中包括第二PLMN的标识和待访问NF实例的NF类型；
所述处理模块12用于，获取待访问网络切片标识；
所述发送模块13用于，向所述第二PLMN的标识对应的第二NFRF发送获取请求，所述获取请求包括待访问NF实例的NF类型和所述待访问网络切片标识；
所述接收模块11用于，接收第二NFR发送的所述待访问NF实例的NF类型和待访问网络切片标识对应的第二NF实例的实例信息；
所述发送模块13用于，向所述第一NF实例发送所述实例信息。
本发明实施例所示的网络访问控制装置可以执行上述方法实施例所示的技术方案，其实现原理以及有益效果类似，此处不再进行赘述。
在一种可能的实施方式中，所述待访问网络切片标识为所述待访问网络切片的类型；
或者，
所述待访问网络切片标识为所述待访问网络切片的类型和租户标识的组合。
在另一种可能的实施方式中，所述发现请求中包括所述待访问网络切片标识；相应的，所述处理模块12具体用于：
在所述发现请求中获取所述待访问网络切片标识。
在另一种可能的实施方式中，所述处理模块12具体用于：
获取所述第一NF实例对应的功能类型；
根据所述第一NF实例对应的功能类型，确定所述待访问网络切片标识。
在另一种可能的实施方式中，所述处理模块12具体用于：
获取所述第一NF实例所属的第一网络切片的第一网络切片类型；
根据所述第一NF实例对应的功能类型，确定所述第一网络切片类型在所述第二PLMN中对应的第二网络切片类型；
将所述第二网络切片类型确定为所述待访问网络切片标识。
在另一种可能的实施方式中，所述处理模块12具体用于：
若所述第一NF实例对应的功能类型为第一功能类型，则将所述第一NF实例所属的第一网络切片的第一网络切片类型确定为所述第二网络切片类型；其中，所述第一功能类型对应的网络功能在所有PLMN中的切片类型相同；
或者，
若所述第一NF实例对应的功能类型为第二功能类型，则向策略管理单元请求获取所述第二网络切片类型；其中，第二功能类型对应的网络功能在不同的PLMN中的切片类型不同。
在另一种可能的实施方式中，所述发送模块13还用于，向所述策略管理单元发送切片类型获取请求，所述网络切片获取请求中包括所述第一网络切片类型和所述第二PLMN的标识；
所述接收模块11还用于，接收所述策略管理单元发送的、所述第一网络切片类型在所述第二PLMN中对应的第二网络切片类型。
在另一种可能的实施方式中，所述实例信息中包括第二NF实例的地址；相应的，所述发送模块13具体用于：
向所述第一NF实例发送所述实例信息，以使所述第一NF实例根据所述实例信息中的第二NF实例的地址访问所述第二NF实例。
在另一种可能的实施方式中，所述待访问NF实例的NF类型对应的第二NF实例的个数大于1；
相应的，所述发送模块13具体用于：
向所述第一NF实例发送各所述第二NF实例的实例信息，以使所述第一 NF实例在所述第二NF实例中确定目标第二NF实例，并根据所述目标第二NF实例的地址访问所述目标第二NF实例。
在另一种可能的实施方式中，所述实例信息中包括各所述第二NF实例的负载信息，以使所述第一NF实例根据各所述第二NF实例的负载信息在多个第二NF实例中确定目标第二NF实例，并根据所述目标第二NF实例的地址访问所述目标第二NF实例。
在另一种可能的实施方式中，所述方法还包括：
所述接收模块11还用于，接收NF注册请求，所述NF注册请求中包括待注册NF实例的实例信息、及待注册NF实例所属的网络切片的切片信息；
所述处理模块12还用于，根据所述待注册NF实例的实例信息、及所述待注册NF实例所属网络切片的切片信息，生成所述待注册NF实例的实例信息。
在另一种可能的实施方式中，所述待注册NF实例的实例信息包括待注册实例的标识、待注册实例的NF类型、待注册实例的地址中的至少一种；
所述目标网络切片的切片信息包括所述目标网络切片的标识、所述目标网络切片的类型中的至少一种。
本发明实施例所示的网络访问控制装置可以执行上述方法实施例所示的技术方案，其实现原理以及有益效果类似，此处不再进行赘述。
图10为本发明实施例提供的另一种网络访问控制装置的结构示意图，该网络控制装置应用于第二PLMN中的第二NFRF，请参见图10，所述装置包括接收模块21、处理模块22和发送模块23，其中，
所述接收模块21用于，接收第一NFRF发送的获取请求，所述获取请求中包括所述待访问网络功能NF实例类型和所述待访问网络切片标识；
所述处理模块22用于，根据所述获取请求，获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的实例信息；
所述发送模块23用于，向所述第一NFRF发送所述第二NF实例的实例信息。
本发明实施例所示的网络访问控制装置可以执行上述方法实施例所示的技术方案，其实现原理以及有益效果类似，此处不再进行赘述。
在一种可能的实施方式中，所述处理模块22具体用于：
获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的地址和负载信息。
在另一种可能的实施方式中，所述处理模块22还用于：
在所述处理模块22获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的地址和负载信息之前，获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的个数；
若所述第二NF实例的个数大于1，则执行获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的地址和负载信息的步骤。
在另一种可能的实施方式中，所述获取请求中还包括第一NF实例的NF类型；相应的，所述处理模块22还用于：
在所述处理模块22根据所述获取请求，获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的实例信息之前，获取所述待访问NF实例对应的第一NF类型集合，所述第一NF类型集合中的各NF类型为允许对所述待访问NF实例进行访问的NF实例的NF类型；
若所述第一NF类型集合中包括所述第一NF实例的NF类型，则执行获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的实例信息。
在另一种可能的实施方式中，所述发送模块23还用于，若所述确定所述第一NF类型集合中不包括所述第一NF实例的NF类型，则向所述第一NFRF发送访问受限提示信息，以使所述第一NFRF向所述第一NF实例发送所述访问受限提示信息。
本发明实施例所示的网络访问控制装置可以执行上述方法实施例所示的技术方案，其实现原理以及有益效果类似，此处不再进行赘述。
图11为本发明实施例提供的又一种网络控制装置的结构示意图，该网络控制装置应用于第一NF实例，请参见图11，所述装置处理模块31、发送模块32和接收模块33，其中，
所述处理模块31用于，获取待访问NF实例的NF类型、及所述待访问NF实例所属的网络切片的待访问网络切片标识；
所述发送模块32用于，向第一网络功能管理模块NFRF发送发现请求， 所述发送请求中包括第二PLMN的标识、待访问NF实例的NF类型、及所述待访问网络切片标识，以使所述第一NFRF向所述第二PLMN中的第二NFRF请求获取待访问NF实例的NF类型和待访问网络切片标识对应的第二NF实例的实例信息；
所述接收模块33用于，接收所述第一NFRF发送的所述第二NF实例的实例信息。
本发明实施例所示的网络访问控制装置可以执行上述方法实施例所示的技术方案，其实现原理以及有益效果类似，此处不再进行赘述。
在一种可能的实施方式中，所述处理模块31具体用于：
获取所述第一NF实例所属的第一网络切片的第一网络切片类型；
根据所述第一NF实例对应的功能类型，确定所述第一网络切片类型在所述第二PLMN中对应的第二网络切片类型；
将所述第二网络切片类型确定为所述待访问网络切片标识。
在另一种可能的实施方式中，所述处理模块31具体用于：
若所述第一NF实例对应的功能类型为第一功能类型，则将所述第一NF实例所属的第一网络切片的第一网络切片类型确定为所述第二网络切片类型；其中，所述第一功能类型对应的网络功能在所有PLMN中的切片类型相同；
或者，
若所述第一NF实例对应的功能类型为第二功能类型，则向策略管理单元请求获取所述第二网络切片类型；其中，第二功能类型对应的网络功能在不同的PLMN中的切片类型不同。
在另一种可能的实施方式中，所述发送模块32还用于，向所述策略管理单元发送切片类型获取请求，所述网络切片获取请求中包括所述第一网络切片类型和所述第二PLMN的标识；
所述接收模块33还用于，接收所述策略管理单元发送的、所述第一网络切片类型在所述第二PLMN中对应的第二网络切片类型。
本发明实施例所示的网络访问控制装置可以执行上述方法实施例所示的技术方案，其实现原理以及有益效果类似，此处不再进行赘述。
图12为本发明实施例提供的一种网络访问控制设备的结构示意图，该网 络访问控制设备应用于第一PLMN中的第一NFRF，请参见图12，该设备包括接收器41、处理器42、发送器43、存储器44、以及通信总线45，存储器44用于存储程序，通信总线45用于实现元件之间的通信连接，处理器42可以读取存储器44中的程序，并执行相应的操作，其中，
所述接收器41用于，接收第一网络功能NF实例发送的发现请求，所述发现请求中包括第二PLMN的标识和待访问NF实例的NF类型；
所述处理器42用于，获取待访问网络切片标识；
所述发送器43用于，向所述第二PLMN的标识对应的第二NFRF发送获取请求，所述获取请求包括待访问NF实例的NF类型和所述待访问网络切片标识；
所述接收器41用于，接收第二NFR发送的所述待访问NF实例的NF类型和待访问网络切片标识对应的第二NF实例的实例信息；
所述发送器43用于，向所述第一NF实例发送所述实例信息。
本发明实施例所示的网络访问控制设备可以执行上述方法实施例所示的技术方案，其实现原理以及有益效果类似，此处不再进行赘述。
在一种可能的实施方式中，所述待访问网络切片标识为所述待访问网络切片的类型；
或者，
所述待访问网络切片标识为所述待访问网络切片的类型和租户标识的组合。
在另一种可能的实施方式中，所述发现请求中包括所述待访问网络切片标识；相应的，所述处理器42具体用于：
在所述发现请求中获取所述待访问网络切片标识。
在另一种可能的实施方式中，所述处理器42具体用于：
获取所述第一NF实例对应的功能类型；
根据所述第一NF实例对应的功能类型，确定所述待访问网络切片标识。
在另一种可能的实施方式中，所述处理器42具体用于：
获取所述第一NF实例所属的第一网络切片的第一网络切片类型；
根据所述第一NF实例对应的功能类型，确定所述第一网络切片类型在所述第二PLMN中对应的第二网络切片类型；
将所述第二网络切片类型确定为所述待访问网络切片标识。
在另一种可能的实施方式中，所述处理器42具体用于：
若所述第一NF实例对应的功能类型为第一功能类型，则将所述第一NF实例所属的第一网络切片的第一网络切片类型确定为所述第二网络切片类型；其中，所述第一功能类型对应的网络功能在所有PLMN中的切片类型相同；
或者，
若所述第一NF实例对应的功能类型为第二功能类型，则向策略管理单元请求获取所述第二网络切片类型；其中，第二功能类型对应的网络功能在不同的PLMN中的切片类型不同。
在另一种可能的实施方式中，所述发送器43还用于，向所述策略管理单元发送切片类型获取请求，所述网络切片获取请求中包括所述第一网络切片类型和所述第二PLMN的标识；
所述接收器41还用于，接收所述策略管理单元发送的、所述第一网络切片类型在所述第二PLMN中对应的第二网络切片类型。
在另一种可能的实施方式中，所述实例信息中包括第二NF实例的地址；相应的，所述发送器43具体用于：
向所述第一NF实例发送所述实例信息，以使所述第一NF实例根据所述实例信息中的第二NF实例的地址访问所述第二NF实例。
在另一种可能的实施方式中，所述待访问NF实例的NF类型对应的第二NF实例的个数大于1；
相应的，所述发送器43具体用于：
向所述第一NF实例发送各所述第二NF实例的实例信息，以使所述第一NF实例在所述第二NF实例中确定目标第二NF实例，并根据所述目标第二NF实例的地址访问所述目标第二NF实例。
在另一种可能的实施方式中，所述实例信息中包括各所述第二NF实例的负载信息，以使所述第一NF实例根据各所述第二NF实例的负载信息在多个第二NF实例中确定目标第二NF实例，并根据所述目标第二NF实例的地址访问所述目标第二NF实例。
在另一种可能的实施方式中，所述方法还包括：
所述接收器41还用于，接收NF注册请求，所述NF注册请求中包括待注册NF实例的实例信息、及待注册NF实例所属的网络切片的切片信息；
所述处理器42还用于，根据所述待注册NF实例的实例信息、及所述待注册NF实例所属网络切片的切片信息，生成所述待注册NF实例的实例信息。
在另一种可能的实施方式中，所述待注册NF实例的实例信息包括待注册实例的标识、待注册实例的NF类型、待注册实例的地址中的至少一种；
所述目标网络切片的切片信息包括所述目标网络切片的标识、所述目标网络切片的类型中的至少一种。
本发明实施例所示的网络访问控制设备可以执行上述方法实施例所示的技术方案，其实现原理以及有益效果类似，此处不再进行赘述。
图13为本发明实施例提供的另一种网络访问控制设备的结构示意图，该网络访问控制设备应用于第二PLMN中的第二NFRF，请参见图13，该设备包括接收器51、处理器52、发送器53、存储器54、以及通信总线55，存储器54用于存储程序，通信总线55用于实现元件之间的通信连接，处理器52可以读取存储器54中的程序，并执行相应的操作，其中，
所述接收器51用于，接收第一NFRF发送的获取请求，所述获取请求中包括所述待访问网络功能NF实例类型和所述待访问网络切片标识；
所述处理器52用于，根据所述获取请求，获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的实例信息；
所述发送器53用于，向所述第一NFRF发送所述第二NF实例的实例信息。
本发明实施例所示的网络访问控制设备可以执行上述方法实施例所示的技术方案，其实现原理以及有益效果类似，此处不再进行赘述。
在一种可能的实施方式中，所述处理器52具体用于：
获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的地址和负载信息。
在另一种可能的实施方式中，所述处理器52还用于：
在所述处理器52获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的地址和负载信息之前，获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的个数；
若所述第二NF实例的个数大于1，则执行获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的地址和负载信息的步骤。
在另一种可能的实施方式中，所述获取请求中还包括第一NF实例的NF类型；相应的，所述处理器52还用于：
在所述处理器52根据所述获取请求，获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的实例信息之前，获取所述待访问NF实例对应的第一NF类型集合，所述第一NF类型集合中的各NF类型为允许对所述待访问NF实例进行访问的NF实例的NF类型；
若所述第一NF类型集合中包括所述第一NF实例的NF类型，则执行获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的实例信息。
在另一种可能的实施方式中，所述发送器53还用于，若所述确定所述第一NF类型集合中不包括所述第一NF实例的NF类型，则向所述第一NFRF发送访问受限提示信息，以使所述第一NFRF向所述第一NF实例发送所述访问受限提示信息。
本发明实施例所示的网络访问控制设备可以执行上述方法实施例所示的技术方案，其实现原理以及有益效果类似，此处不再进行赘述。
图14为本发明实施例提供的又一种网络访问控制设备的结构示意图，该网络访问控制设备应用于第一NF实例，请参见图14，该设备包括处理器61、发送器62、接收器63、存储器64、以及通信总线65，存储器64用于存储程序，通信总线65用于实现元件之间的通信连接，处理器61可以读取存储器64中的程序，并执行相应的操作，其中，
所述处理器61用于，获取待访问NF实例的NF类型、及所述待访问NF实例所属的网络切片的待访问网络切片标识；
所述发送器62用于，向第一网络功能管理器NFRF发送发现请求，所述发送请求中包括第二PLMN的标识、待访问NF实例的NF类型、及所述待访问网络切片标识，以使所述第一NFRF向所述第二PLMN中的第二NFRF请求获取待访问NF实例的NF类型和待访问网络切片标识对应的第二NF实例的实例信息；
所述接收器63用于，接收所述第一NFRF发送的所述第二NF实例的实例信息。
本发明实施例所示的网络访问控制设备可以执行上述方法实施例所示的技术方案，其实现原理以及有益效果类似，此处不再进行赘述。
在一种可能的实施方式中，所述处理器61具体用于：
获取所述第一NF实例所属的第一网络切片的第一网络切片类型；
根据所述第一NF实例对应的功能类型，确定所述第一网络切片类型在所述第二PLMN中对应的第二网络切片类型；
将所述第二网络切片类型确定为所述待访问网络切片标识。
在另一种可能的实施方式中，所述处理器61具体用于：
若所述第一NF实例对应的功能类型为第一功能类型，则将所述第一NF实例所属的第一网络切片的第一网络切片类型确定为所述第二网络切片类型；其中，所述第一功能类型对应的网络功能在所有PLMN中的切片类型相同；
或者，
若所述第一NF实例对应的功能类型为第二功能类型，则向策略管理单元请求获取所述第二网络切片类型；其中，第二功能类型对应的网络功能在不同的PLMN中的切片类型不同。
在另一种可能的实施方式中，所述发送器62还用于，向所述策略管理单元发送切片类型获取请求，所述网络切片获取请求中包括所述第一网络切片类型和所述第二PLMN的标识；
所述接收器63用于，接收所述策略管理单元发送的、所述第一网络切片类型在所述第二PLMN中对应的第二网络切片类型。
本发明实施例所示的网络访问控制设备可以执行上述方法实施例所示的技术方案，其实现原理以及有益效果类似，此处不再进行赘述。
本发明实施例提供一种网络控制系统，所述网络控制系统包括图12-图14实施例所示的网络控制设备。
本领域普通技术人员可以理解：实现上述方法实施例的全部或部分步骤可以通过程序指令相关的硬件来完成，前述的程序可以存储于一计算机可读取存储介质中，该程序在执行时，执行包括上述方法实施例的步骤；而前述 的存储介质包括：ROM、RAM、磁碟或者光盘等各种可以存储程序代码的介质。
最后应说明的是：以上各实施例仅用以说明本发明的技术方案，而非对其限制；尽管参照前述各实施例对本发明进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分或者全部技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本发明各实施例技术方案的范围。

Claims (30)

  1. 一种网络访问控制方法，其特征在于，应用于第一公共陆地移动网络PLMN中的第一网络功能管理模块NFRF，所述方法包括：
    接收第一网络功能NF实例发送的发现请求，所述发现请求中包括第二PLMN的标识和待访问NF实例的NF类型；
    获取待访问网络切片标识；
    向所述第二PLMN的标识对应的第二NFRF发送获取请求，所述获取请求包括待访问NF实例的NF类型和所述待访问网络切片标识；
    接收第二NFR发送的所述待访问NF实例的NF类型和待访问网络切片标识对应的第二NF实例的实例信息；
    向所述第一NF实例发送所述实例信息。
  2. 根据权利要求1所述的方法，其特征在于，
    所述待访问网络切片标识为所述待访问网络切片的类型；
    或者，
    所述待访问网络切片标识为所述待访问网络切片的类型和租户标识的组合。
  3. 根据权利要求1或2所述的方法，其特征在于，所述发现请求中包括所述待访问网络切片标识；相应的，所述获取所述待访问NF实例的NF类型对应的待访问网络切片标识，包括：
    在所述发现请求中获取所述待访问网络切片标识。
  4. 根据权利要求1或2所述的方法，其特征在于，所述获取所述待访问NF实例对应的待访问网络切片标识，包括：
    获取所述第一NF实例对应的功能类型；
    根据所述第一NF实例对应的功能类型，确定所述待访问网络切片标识。
  5. 根据权利要求4所述的方法，其特征在于，所述根据所述第一NF实例对应的功能类型，确定所述待访问网络切片标识，包括：
    获取所述第一NF实例所属的第一网络切片的第一网络切片类型；
    根据所述第一NF实例对应的功能类型，确定所述第一网络切片类型在所述第二PLMN中对应的第二网络切片类型；
    将所述第二网络切片类型确定为所述待访问网络切片标识。
  6. 根据权利要求5所述的方法，其特征在于，所述根据所述第一NF实例对应的功能类型，确定所述第一网络切片类型在所述第二PLMN中对应的第二网络切片类型，包括：
    若所述第一NF实例对应的功能类型为第一功能类型，则将所述第一NF实例所属的第一网络切片的第一网络切片类型确定为所述第二网络切片类型；其中，所述第一功能类型对应的网络功能在所有PLMN中的切片类型相同；
    或者，
    若所述第一NF实例对应的功能类型为第二功能类型，则向策略管理单元请求获取所述第二网络切片类型；其中，第二功能类型对应的网络功能在不同的PLMN中的切片类型不同。
  7. 根据权利要求6所述的方法，其特征在于，所述向策略管理单元请求获取所述第二网络切片类型，包括：
    向所述策略管理单元发送切片类型获取请求，所述网络切片获取请求中包括所述第一网络切片类型和所述第二PLMN的标识；
    接收所述策略管理单元发送的、所述第一网络切片类型在所述第二PLMN中对应的第二网络切片类型。
  8. 根据权利要求1-7任一项所述的方法，其特征在于，所述实例信息中包括第二NF实例的地址；相应的，向所述第一NF实例发送所述实例信息，包括：
    向所述第一NF实例发送所述实例信息，以使所述第一NF实例根据所述实例信息中的第二NF实例的地址访问所述第二NF实例。
  9. 根据权利要求1-8任一项所述的方法，其特征在于，所述待访问NF实例的NF类型对应的第二NF实例的个数大于1；
    相应的，向所述第一NF实例发送所述实例信息包括：
    向所述第一NF实例发送各所述第二NF实例的实例信息，以使所述第一NF实例在所述第二NF实例中确定目标第二NF实例，并根据所述目标第二NF实例的地址访问所述目标第二NF实例。
  10. 根据权利要求9所述的方法，其特征在于，所述实例信息中包括各所述第二NF实例的负载信息，以使所述第一NF实例根据各所述第二NF实 例的负载信息在多个第二NF实例中确定目标第二NF实例，并根据所述目标第二NF实例的地址访问所述目标第二NF实例。
  11. 根据权利要求1-10任一项所述的方法，其特征在于，所述方法还包括：
    接收NF注册请求，所述NF注册请求中包括待注册NF实例的实例信息、及待注册NF实例所属的网络切片的切片信息；
    根据所述待注册NF实例的实例信息、及所述待注册NF实例所属网络切片的切片信息，生成所述待注册NF实例的实例信息。
  12. 根据权利要求11所述的方法，其特征在于，
    所述待注册NF实例的实例信息包括待注册实例的标识、待注册实例的NF类型、待注册实例的地址中的至少一种；
    所述目标网络切片的切片信息包括所述目标网络切片的标识、所述目标网络切片的类型中的至少一种。
  13. 一种网络访问控制方法，其特征在于，应用于第二公共陆地移动网络PLMN中的第二网络功能管理模块NFRF，所述方法包括：
    接收第一NFRF发送的获取请求，所述获取请求中包括所述待访问网络功能NF实例类型和所述待访问网络切片标识；
    根据所述获取请求，获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的实例信息；
    向所述第一NFRF发送所述第二NF实例的实例信息。
  14. 根据权利要求13所述的方法，其特征在于，根据所述获取请求，获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的实例信息，包括：
    获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的地址和负载信息。
  15. 根据权利要求14所述的方法，其特征在于，获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的地址和负载信息之前，还包括：
    获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的个数；
    若所述第二NF实例的个数大于1，则执行获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的地址和负载信息的步骤。
  16. 根据权利要求13-15任一项所述的方法，其特征在于，所述获取请求中还包括第一NF实例的NF类型；
    相应的，根据所述获取请求，获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的实例信息之前，还包括：
    获取所述待访问NF实例对应的第一NF类型集合，所述第一NF类型集合中的各NF类型为允许对所述待访问NF实例进行访问的NF实例的NF类型；
    若所述第一NF类型集合中包括所述第一NF实例的NF类型，则执行获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的实例信息。
  17. 根据权利要求16所述的方法，其特征在于，所述方法还包括：若所述确定所述第一NF类型集合中不包括所述第一NF实例的NF类型，则向所述第一NFRF发送访问受限提示信息，以使所述第一NFRF向所述第一NF实例发送所述访问受限提示信息。
  18. 一种网络控制方法，其特征在于，应用于位于第一公共陆地移动网络PLMN中的第一网络功能NF实例，所述方法包括：
    获取待访问NF实例的NF类型、及所述待访问NF实例所属的网络切片的待访问网络切片标识；
    向所述第一NFRF发送发现请求，所述发送请求中包括第二PLMN的标识、待访问NF实例的NF类型、及所述待访问网络切片标识，以使所述第一NFRF向所述第二PLMN中的第二NFRF请求获取待访问NF实例的NF类型和待访问网络切片标识对应的第二NF实例的实例信息；
    接收所述第一NFRF发送的所述第二NF实例的实例信息。
  19. 根据权利要求18所述的方法，其特征在于，所述获取所述待访问NF实例所属的网络切片的待访问网络切片标识，包括：
    获取所述第一NF实例所属的第一网络切片的第一网络切片类型；
    根据所述第一NF实例对应的功能类型，确定所述第一网络切片类型在 所述第二PLMN中对应的第二网络切片类型；
    将所述第二网络切片类型确定为所述待访问网络切片标识。
  20. 根据权利要求19所述的方法，其特征在于，所述根据所述第一NF实例对应的功能类型，确定所述第一网络切片类型在所述第二PLMN中对应的第二网络切片类型，包括：
    若所述第一NF实例对应的功能类型为第一功能类型，则将所述第一NF实例所属的第一网络切片的第一网络切片类型确定为所述第二网络切片类型；其中，所述第一功能类型对应的网络功能在所有PLMN中的切片类型相同；
    或者，
    若所述第一NF实例对应的功能类型为第二功能类型，则向策略管理单元请求获取所述第二网络切片类型；其中，第二功能类型对应的网络功能在不同的PLMN中的切片类型不同。
  21. 根据权利要求20所述的方法，其特征在于，所述向策略管理单元请求获取所述第二网络切片类型，包括：
    向所述策略管理单元发送切片类型获取请求，所述网络切片获取请求中包括所述第一网络切片类型和所述第二PLMN的标识；
    接收所述策略管理单元发送的、所述第一网络切片类型在所述第二PLMN中对应的第二网络切片类型。
  22. 一种网络访问控制装置，其特征在于，应用于第一公共陆地移动网络PLMN中的第一网络功能管理模块NFRF，所述装置包括接收模块、处理模块和发送模块，其中，
    所述接收模块用于，接收第一网络功能NF实例发送的发现请求，所述发现请求中包括第二PLMN的标识和待访问NF实例的NF类型；
    所述处理模块用于，获取待访问网络切片标识；
    所述发送模块用于，向所述第二PLMN的标识对应的第二NFRF发送获取请求，所述获取请求包括待访问NF实例的NF类型和所述待访问网络切片标识；
    所述接收模块用于，接收第二NFR发送的所述待访问NF实例的NF类型和待访问网络切片标识对应的第二NF实例的实例信息；
    所述发送模块用于，向所述第一NF实例发送所述实例信息。
  23. 根据权利要求22所述的装置，其特征在于，所述发现请求中包括所述待访问网络切片标识；相应的，所述处理模块具体用于：
    在所述发现请求中获取所述待访问网络切片标识。
  24. 根据权利要求22所述的装置，其特征在于，所述处理模块具体用于：
    获取所述第一NF实例所属的第一网络切片的第一网络切片类型；
    根据所述第一NF实例对应的功能类型，确定所述第一网络切片类型在所述第二PLMN中对应的第二网络切片类型；
    将所述第二网络切片类型确定为所述待访问网络切片标识。
  25. 根据权利要求24所述的装置，其特征在于，所述处理模块具体用于：
    若所述第一NF实例对应的功能类型为第一功能类型，则将所述第一NF实例所属的第一网络切片的第一网络切片类型确定为所述第二网络切片类型；其中，所述第一功能类型对应的网络功能在所有PLMN中的切片类型相同；
    或者，
    若所述第一NF实例对应的功能类型为第二功能类型，则向策略管理单元请求获取所述第二网络切片类型；其中，第二功能类型对应的网络功能在不同的PLMN中的切片类型不同。
  26. 一种网络访问控制装置，其特征在于，应用于第二公共陆地移动网络PLMN中的第二网络功能管理模块NFRF，所述装置包括接收模块、处理模块和发送模块，其中，
    所述接收模块用于，接收第一NFRF发送的获取请求，所述获取请求中包括所述待访问网络功能NF实例类型和所述待访问网络切片标识；
    所述处理模块用于，根据所述获取请求，获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的实例信息；
    所述发送模块用于，向所述第一NFRF发送所述第二NF实例的实例信息。
  27. 根据权利要求26所述的装置，其特征在于，所述获取请求中还包括第一NF实例的NF类型；相应的，所述处理模块还用于：
    在所述处理模块根据所述获取请求，获取所述待访问NF实例的NF类型 和所述待访问网络切片标识对应的第二NF实例的实例信息之前，获取所述待访问NF实例对应的第一NF类型集合，所述第一NF类型集合中的各NF类型为允许对所述待访问NF实例进行访问的NF实例的NF类型；
    若所述第一NF类型集合中包括所述第一NF实例的NF类型，则执行获取所述待访问NF实例的NF类型和所述待访问网络切片标识对应的第二NF实例的实例信息；或者，若所述确定所述第一NF类型集合中不包括所述第一NF实例的NF类型，则向所述第一NFRF发送访问受限提示信息，以使所述第一NFRF向所述第一NF实例发送所述访问受限提示信息。
  28. 一种网络控制装置，其特征在于，应用于第一网络功能NF实例，所述装置处理模块、发送模块和接收模块，其中，
    所述处理模块用于，获取待访问NF实例的NF类型、及所述待访问NF实例所属的网络切片的待访问网络切片标识；
    所述发送模块用于，向第一网络功能管理模块NFRF发送发现请求，所述发送请求中包括第二PLMN的标识、待访问NF实例的NF类型、及所述待访问网络切片标识，以使所述第一NFRF向所述第二PLMN中的第二NFRF请求获取待访问NF实例的NF类型和待访问网络切片标识对应的第二NF实例的实例信息；
    所述接收模块用于，接收所述第一NFRF发送的所述第二NF实例的实例信息。
  29. 根据权利要求28所述的装置，其特征在于，所述处理模块具体用于：
    获取所述第一NF实例所属的第一网络切片的第一网络切片类型；
    根据所述第一NF实例对应的功能类型，确定所述第一网络切片类型在所述第二PLMN中对应的第二网络切片类型；
    将所述第二网络切片类型确定为所述待访问网络切片标识。
  30. 根据权利要求29所述的装置，其特征在于，所述处理模块具体用于：
    若所述第一NF实例对应的功能类型为第一功能类型，则将所述第一NF实例所属的第一网络切片的第一网络切片类型确定为所述第二网络切片类型；其中，所述第一功能类型对应的网络功能在所有PLMN中的切片类型相同；
    或者，
    若所述第一NF实例对应的功能类型为第二功能类型，则向策略管理单元请求获取所述第二网络切片类型；其中，第二功能类型对应的网络功能在不同的PLMN中的切片类型不同。
PCT/CN2016/101529 2016-10-09 2016-10-09 网络访问控制方法、装置及设备 WO2018064824A1 (zh)

Priority Applications (11)

Application Number Priority Date Filing Date Title
RU2019113932A RU2709286C1 (ru) 2016-10-09 2016-10-09 Способ, аппаратура и устройство для управления доступом в сеть связи
KR1020197013371A KR102181956B1 (ko) 2016-10-09 2016-10-09 네트워크 액세스 제어 방법, 장치 및 기기
PCT/CN2016/101529 WO2018064824A1 (zh) 2016-10-09 2016-10-09 网络访问控制方法、装置及设备
CN201680089757.XA CN109845190B (zh) 2016-10-09 2016-10-09 网络访问控制方法、装置及设备
JP2019518956A JP6768942B2 (ja) 2016-10-09 2016-10-09 ネットワークアクセス制御方法、装置、およびデバイス
BR112019006929-1A BR112019006929B1 (pt) 2016-10-09 Método de controle de acesso à rede, aparelho, e dispositivo
EP16918158.3A EP3525522B1 (en) 2016-10-09 2016-10-09 Network access control method
CN202110027483.4A CN112887962B (zh) 2016-10-09 2016-10-09 网络访问控制方法、装置及设备
EP20188920.1A EP3799480B1 (en) 2016-10-09 2016-10-09 Network access control method, apparatus, and device
US16/379,394 US10743247B2 (en) 2016-10-09 2019-04-09 Network access control method, apparatus, and device
US16/942,025 US11997489B2 (en) 2016-10-09 2020-07-29 Network access control method, apparatus, and device

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2016/101529 WO2018064824A1 (zh) 2016-10-09 2016-10-09 网络访问控制方法、装置及设备

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/379,394 Continuation US10743247B2 (en) 2016-10-09 2019-04-09 Network access control method, apparatus, and device

Publications (1)

Publication Number Publication Date
WO2018064824A1 true WO2018064824A1 (zh) 2018-04-12

Family

ID=61830796

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/101529 WO2018064824A1 (zh) 2016-10-09 2016-10-09 网络访问控制方法、装置及设备

Country Status (7)

Country Link
US (2) US10743247B2 (zh)
EP (2) EP3799480B1 (zh)
JP (1) JP6768942B2 (zh)
KR (1) KR102181956B1 (zh)
CN (2) CN109845190B (zh)
RU (1) RU2709286C1 (zh)
WO (1) WO2018064824A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3525522A4 (en) * 2016-10-09 2019-08-14 Huawei Technologies Co., Ltd. NETWORK ACCESS CONTROL METHOD, DEVICE AND DEVICE

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108243106B (zh) * 2016-12-23 2020-09-04 华为技术有限公司 控制网络切片的方法、转发设备、控制设备和通信系统
CN112788585B (zh) * 2020-12-28 2021-11-02 广州爱浦路网络技术有限公司 一种5g核心网中nf切换方法、装置及存储介质

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110149968A1 (en) * 2009-12-21 2011-06-23 Electronics And Telecommunications Research Institute Method for controlling internet network
CN103269282A (zh) * 2013-04-25 2013-08-28 杭州华三通信技术有限公司 网络配置自动部署方法和装置
CN105813195A (zh) * 2016-05-13 2016-07-27 电信科学技术研究院 一种按需为终端选择移动性管理机制的方法及装置

Family Cites Families (22)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB0108041D0 (en) 2001-03-30 2001-05-23 Nokia Networks Oy Presence service in IP multimedia
US7873357B2 (en) * 2004-11-04 2011-01-18 Telefonaktiebolaget L M Ericsson (Publ) Selective disablement of mobile communication equipment capabilities
WO2008051021A1 (en) * 2006-10-26 2008-05-02 Ktfreetel Co., Ltd. Private mobile network integration service system using public land mobile network and call processing method therefof
EP2700260B1 (en) * 2011-04-21 2016-03-23 Nokia Solutions and Networks Oy Coordination in self-organizing networks
WO2014117339A1 (zh) * 2013-01-30 2014-08-07 华为技术有限公司 网络功能的通知处理方法、装置和系统
CN103650437B (zh) * 2013-06-28 2016-11-16 华为技术有限公司 任播服务注册、实现方法及装置、交换设备和系统
CN104811328B (zh) * 2014-01-27 2018-08-10 新华三技术有限公司 虚拟网络资源管理方法及装置
WO2015174989A1 (en) * 2014-05-15 2015-11-19 Hewlett-Packard Development Company, L.P. Network traffic tuning
CN104253866B (zh) * 2014-09-20 2018-03-27 华为技术有限公司 虚拟网络功能网元的软件部署方法、系统及相关设备
CN105830394B (zh) * 2014-11-27 2019-05-21 华为技术有限公司 虚拟网络策略的配置方法、系统及其虚拟网元和网管系统
KR20170105582A (ko) * 2015-01-20 2017-09-19 후아웨이 테크놀러지 컴퍼니 리미티드 Nfv 및 sdn과 연동하기 위한 sdt를 위한 시스템들 및 방법들
US9392471B1 (en) * 2015-07-24 2016-07-12 Viavi Solutions Uk Limited Self-optimizing network (SON) system for mobile networks
US10425830B2 (en) * 2015-09-07 2019-09-24 Electronics And Telecommunications Research Institute Mobile communication network system and method for composing network component configurations
US10129108B2 (en) * 2015-11-13 2018-11-13 Huawei Technologies Co., Ltd. System and methods for network management and orchestration for network slicing
US11070967B2 (en) * 2015-12-29 2021-07-20 Telefonaktiebolaget Lm Ericsson (Publ) Network nodes and methods performed therein for enabling communication in a communication network
WO2017113109A1 (en) * 2015-12-29 2017-07-06 Telefonaktiebolaget Lm Ericsson (Publ) Method and apparatus for virtualized network service provision
WO2017197273A1 (en) * 2016-05-12 2017-11-16 Convida Wireless, Llc Connecting to virtualized mobile core networks
CN106210042B (zh) * 2016-07-11 2019-06-18 清华大学 一种基于端到端网络切片的用户服务请求选择方法
EP3523923A1 (en) * 2016-10-05 2019-08-14 Convida Wireless, LLC Capability exposure for service instantiation
US11297660B2 (en) * 2016-10-06 2022-04-05 Convida Wireless, Llc Session management with relaying and charging for indirect connection for internet of things applications in 3GPP network
KR102559755B1 (ko) 2016-10-06 2023-07-26 삼성전자 주식회사 네크워크 슬라이스를 지원하는 로밍 환경에서 단말의 attach 및 home routed PDU session 생성 방법
EP3799480B1 (en) 2016-10-09 2024-08-21 Huawei Technologies Co., Ltd. Network access control method, apparatus, and device

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110149968A1 (en) * 2009-12-21 2011-06-23 Electronics And Telecommunications Research Institute Method for controlling internet network
CN103269282A (zh) * 2013-04-25 2013-08-28 杭州华三通信技术有限公司 网络配置自动部署方法和装置
CN105813195A (zh) * 2016-05-13 2016-07-27 电信科学技术研究院 一种按需为终端选择移动性管理机制的方法及装置

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
HUAWEI: "Progress Overview on Network Slicing in SA1, SA2, NGMN and Analysis of Potential Management Related Aspects", 3GPP TSG SA WG5 (TELECOM MANAGEMENT) MEETING #109, S5-165210, 2 September 2016 (2016-09-02), XP051172120 *
See also references of EP3525522A4 *

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3525522A4 (en) * 2016-10-09 2019-08-14 Huawei Technologies Co., Ltd. NETWORK ACCESS CONTROL METHOD, DEVICE AND DEVICE
US10743247B2 (en) 2016-10-09 2020-08-11 Huawei Technologies Co., Ltd. Network access control method, apparatus, and device
EP3799480A1 (en) * 2016-10-09 2021-03-31 Huawei Technologies Co., Ltd. Network access control method, apparatus, and device
US11997489B2 (en) 2016-10-09 2024-05-28 Huawei Technologies Co., Ltd. Network access control method, apparatus, and device

Also Published As

Publication number Publication date
CN112887962B (zh) 2022-04-29
US20190239150A1 (en) 2019-08-01
US10743247B2 (en) 2020-08-11
EP3799480A1 (en) 2021-03-31
JP6768942B2 (ja) 2020-10-14
KR102181956B1 (ko) 2020-11-23
CN112887962A (zh) 2021-06-01
BR112019006929A2 (pt) 2019-07-02
US11997489B2 (en) 2024-05-28
EP3525522A1 (en) 2019-08-14
JP2019530374A (ja) 2019-10-17
RU2709286C1 (ru) 2019-12-17
CN109845190A (zh) 2019-06-04
EP3525522B1 (en) 2020-12-09
US20200359220A1 (en) 2020-11-12
CN109845190B (zh) 2021-01-15
EP3525522A4 (en) 2019-08-14
EP3799480B1 (en) 2024-08-21
KR20190064631A (ko) 2019-06-10

Similar Documents

Publication Publication Date Title
US11737045B2 (en) Connection processing method and apparatus in multi-access scenario
CN109922472B (zh) 用户策略的获取
EP3557913A1 (en) Network slice selection policy updating method and apparatus
WO2018161796A1 (zh) 多接入场景中的连接处理方法和装置
CN113541925B (zh) 通信系统、方法及装置
US11503496B2 (en) Data processing method and apparatus
CN109803029B (zh) 数据处理方法、装置及设备
CN110324246A (zh) 一种通信方法及装置
US11864149B2 (en) Systems and methods for user equipment (UE) registration
CN109246769A (zh) 一种pdu会话建立方法及装置
WO2018064824A1 (zh) 网络访问控制方法、装置及设备
US20230199502A1 (en) Apparatus and Method for Remotely Managing Devices, and Program Therefor
EP4075722A1 (en) Security enhancement on inter-network communication
CN112492592A (zh) 一种多个nrf场景下的授权方法
CN116391373A (zh) 管理装置到网络的连接性
BR112019006929B1 (pt) Método de controle de acesso à rede, aparelho, e dispositivo

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16918158

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2019518956

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

REG Reference to national code

Ref country code: BR

Ref legal event code: B01A

Ref document number: 112019006929

Country of ref document: BR

ENP Entry into the national phase

Ref document number: 20197013371

Country of ref document: KR

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 2016918158

Country of ref document: EP

Effective date: 20190508

ENP Entry into the national phase

Ref document number: 112019006929

Country of ref document: BR

Kind code of ref document: A2

Effective date: 20190404