WO2018170703A1 - 一种连接建立方法及装置 - Google Patents

一种连接建立方法及装置 Download PDF

Info

Publication number
WO2018170703A1
WO2018170703A1 PCT/CN2017/077383 CN2017077383W WO2018170703A1 WO 2018170703 A1 WO2018170703 A1 WO 2018170703A1 CN 2017077383 W CN2017077383 W CN 2017077383W WO 2018170703 A1 WO2018170703 A1 WO 2018170703A1
Authority
WO
WIPO (PCT)
Prior art keywords
access
terminal
connection
network element
mobility management
Prior art date
Application number
PCT/CN2017/077383
Other languages
English (en)
French (fr)
Inventor
于游洋
李欢
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2017/077383 priority Critical patent/WO2018170703A1/zh
Publication of WO2018170703A1 publication Critical patent/WO2018170703A1/zh

Links

Images

Definitions

  • the present application relates to the field of communications, and in particular, to a connection establishment method and apparatus.
  • next-generation mobile communication network architecture Next Generation System
  • 5G network architecture Next Generation Mobile communication network architecture
  • the architecture supports not only the wireless technologies defined by the 3GPP standard group (such as the Long Term Evolution (LTE) or the 5G Radio Access Network (RAN)) but also the core network (such as the 5G core network (Core). Network), and supports the non-3GPP access technology to access the core network through a non-3GPP Interworking Function (N3IWF) or a Next Generation Packet Data Gateway (NGPDG).
  • N3IWF non-3GPP Interworking Function
  • NPDG Next Generation Packet Data Gateway
  • the mobile core network allows the terminal to access from the 3GPP access network or from the non-3GPP access network, and also allows the terminal to access from both the 3GPP access network and the non-3GPP access network.
  • the terminal accesses the core network from the 3GPP network
  • IDLE idle state
  • CONNECTED connected state
  • the terminal releases the air interface connection and the Non Access Stratum (NAS) connection, and enters an idle state, thereby achieving the purpose of saving network resources and saving terminal power consumption.
  • NAS Non Access Stratum
  • the terminal accesses the core network from a non-3GPP network, there is also a state transition between the idle state and the connected state.
  • the embodiment of the present application discloses a connection establishment method and device.
  • a connection establishment method comprising: an idle state terminal transmitting an indication to an access and mobility management network element when it is required to use a non-3GPP network for uplink transmission or establishing a connection with a non-3GPP access network Information, the indication information is used to indicate that the access and mobility management network element maintains the signaling connection after the signaling connection between the terminal and the access and mobility management network element is established;
  • the terminal sends an authentication request message to the gateway device, where the gateway device generates a non-access stratum message based on the authentication request message, where the non-access stratum message is used to request the access and mobility management.
  • the network element establishes the signaling connection.
  • the authentication request message includes a periodic registration type parameter, where the periodic registration type parameter is used to indicate that the access and mobility management network element establishes a periodic registration process with the terminal. Signaling connection between.
  • the indication information is included in the authentication request message.
  • the non-access stratum message is a registration request message.
  • the indication information includes at least one of a service request indication, an activation identifier, a keep-alive indication, or a connection recovery indication.
  • the method further includes: the terminal sending a service request message to the access and mobility management network element by using a secure connection with the gateway device; wherein the secure connection is according to the terminal to the gateway Device sent by the device The right request message is created.
  • the authentication request message includes an authentication parameter, where the authentication parameter is used to instruct the gateway device to establish a secure connection between the gateway device and the terminal by using the authentication parameter.
  • connection establishment method comprising:
  • the access and mobility management network element receives the indication information sent by the terminal in the idle state, where the indication information is used to indicate the access and mobility management network element in the terminal and the access and mobility management network element
  • the signaling connection is maintained after the establishment of the signaling connection; the access and mobility management network element establishes a signaling connection with the terminal according to the non-access stratum message.
  • the non-access stratum message includes a periodic registration type parameter; the establishing a signaling connection with the terminal, including: the access and mobility management network element according to the periodicity
  • the registration type parameter establishes a signaling connection with the terminal by using a periodic registration procedure.
  • the indication information is included in the non-access stratum message.
  • the indication information includes at least one of a service request indication, an activation identifier, a keep-alive indication, or a connection recovery indication.
  • a terminal including:
  • an indication module configured to send indication information to the access and mobility management network element when the terminal is in an idle state and needs to use the non-3GPP network for uplink transmission or establish a connection with the non-3GPP access network, where the indication information is used by And indicating that the access and mobility management network element maintains the signaling connection after establishing a signaling connection between the terminal and the access and mobility management network element;
  • connection establishment requesting module configured to send an authentication request message to the gateway device, to enable the gateway device to generate a non-access stratum message based on the authentication request message, where the non-access stratum message is used to request the connection
  • the incoming and mobility management network elements establish the signaling connection.
  • the authentication request message includes a periodic registration type parameter, where the periodic registration type parameter is used to indicate that the access and mobility management network element establishes a periodic registration process with the terminal. Signaling connection between.
  • the non-access stratum message is a registration request message.
  • the indication information is included in the authentication request message.
  • the indication information includes at least one of a service request indication, an activation identifier, a keep-alive indication, or a connection recovery indication.
  • connection establishment requesting module is further configured to: send a service request message to the access and mobility management network element by using a secure connection with the gateway device; wherein the secure connection is according to the terminal Established by the authentication request message sent to the gateway device.
  • the authentication request message includes an authentication parameter, where the authentication parameter is used to instruct the gateway device to establish a secure connection between the gateway device and the terminal by using the authentication parameter.
  • the fourth aspect provides an access and mobility management network element, including:
  • connection processing module configured to receive indication information sent by the terminal in an idle state, and keep the signaling connection after the signaling connection between the terminal and the access and mobility management network element is established according to the indication information ;
  • connection establishing module configured to establish a signaling connection with the terminal according to the non-access stratum message.
  • the non-access stratum message includes a periodic registration type parameter; the connection establishing module is specifically configured to: establish, according to the periodic registration type parameter, a process of periodically registering with the terminal Signaling connection.
  • the indication information is included in the non-access stratum message.
  • the indication information includes at least one of a service request indication, an activation identifier, a keep-alive indication, or a connection recovery indication.
  • connection establishment method comprising:
  • the terminal When the terminal in the idle state needs to use the non-3GPP network for uplink transmission or establish a connection with the non-3GPP access network, the terminal sends an authentication request message to the gateway device, where the authentication request includes the authentication parameter or the indication information. At least one, the authentication parameter is used to instruct the gateway device to establish a secure connection with the terminal according to the authentication parameter and the certificate configured by the terminal; and the terminal receives the returned by the gateway device The authentication response message establishes a secure connection with the gateway device.
  • the method further includes: the terminal sending, by using the secure connection, a non-access stratum message to the access and mobility management network element, where the non-access stratum message is used for the access and mobility
  • the management network element establishes a signaling connection between the terminal and the access and mobility management network element.
  • the authentication parameter is further used to indicate that the gateway device does not perform a registration process before sending the non-access stratum message.
  • the authentication parameter is further used to indicate that the gateway device generates a service request message, and sends the service request message to the access and mobility management network element; the service request message is used by The access and mobility management network element establishes a signaling connection between the terminal and the access and mobility management network element.
  • the indication information included in the authentication request message is used to indicate that the gateway device does not perform a registration process before sending the non-access stratum message.
  • the indication information is further used to indicate that the gateway device maintains a secure connection with the terminal.
  • the indication information in the authentication request message is further used to instruct the gateway device to generate a service request message, and send the service request message to the access and mobility management network element;
  • a service request message is used by the access and mobility management network element to establish a signaling connection between the terminal and the access and mobility management network element.
  • the indication information is a service request indication or a connection recovery indication.
  • the non-access stratum message is a service request message.
  • connection establishment method including:
  • the gateway device receives the authentication request message sent by the terminal in the idle state, where the authentication request includes at least one of an authentication parameter or the indication information, where the indication information is used to indicate that the gateway device keeps the established Secure connection
  • the gateway device establishes a secure connection with the terminal according to the authentication parameter and the certificate configured by the terminal.
  • the method further includes: the gateway device receiving a non-access stratum message sent by the terminal by using a secure connection with the terminal, and sending the non-access stratum message to access and mobility management The network element, the non-access stratum message is used by the access and mobility management network element to establish a signaling connection between the terminal and the access and mobility management network element.
  • the method further includes: the gateway device does not perform a registration process before sending the non-access stratum message according to the authentication parameter.
  • the method further includes: the gateway device generates a service request message according to the authentication parameter, and sends the service request message to the access and mobility management network element;
  • the access and mobility management network element establishes a signaling connection between the terminal and the access and mobility management network element.
  • the authentication request further includes indication information.
  • the method further includes: the gateway device does not perform a registration process before sending the non-access stratum message according to the indication information.
  • the gateway device may further maintain a secure connection with the terminal according to the indication information.
  • the method further includes: the gateway device generating a service request message according to the indication information, and sending the service request message to the access and the mobile a service management message; the service request message is used by the access and mobility management network element to establish a signaling connection between the terminal and the access and mobility management network element.
  • the indication information is a service request indication or a connection recovery indication.
  • the non-access stratum message is a service request message.
  • a terminal including:
  • An authentication requesting module configured to send an authentication request message to the gateway device when the terminal is in an idle state and needs to use the non-3GPP network for uplink transmission or establish a connection with the non-3GPP access network, where the authentication request message is sent Include at least one of an authentication parameter or an indication information; and receiving an authentication response message returned by the gateway device; and a secure connection establishing module, configured to establish, according to the authentication parameter and the certificate configured by the terminal A secure connection between the gateway devices.
  • the method further includes: a signaling connection requesting module, configured to send, by using the secure connection, a non-access stratum message to the access and mobility management network element, where the non-access stratum message is used for the access and
  • the mobility management network element establishes a signaling connection between the terminal and the access and mobility management network element.
  • the authentication parameter is further used to indicate that the gateway device does not perform a registration process before sending the non-access stratum message.
  • the authentication parameter is further used to indicate that the gateway device generates a service request message, and sends the service request message to the access and mobility management network element; the service request message is used by The access and mobility management network element establishes a signaling connection between the terminal and the access and mobility management network element.
  • the indication information included in the authentication request is used to indicate that the gateway device does not perform a registration process before sending the non-access stratum message.
  • the indication information in the authentication request message is further used to instruct the gateway device to generate a service request message, and send the service request message to the access and mobility management network element;
  • a service request message is used by the access and mobility management network element to establish a signaling connection between the terminal and the access and mobility management network element.
  • the indication information is a service request indication or a connection recovery indication.
  • the non-access stratum message is a service request message.
  • a gateway device including:
  • An authentication module configured to receive an authentication request message sent by a terminal in an idle state, where the authentication request includes at least one of an authentication parameter or an indication information, where the indication information is used to indicate that the gateway device keeps Established said secure connection;
  • a secure connection establishing module configured to establish a secure connection with the terminal according to the authentication parameter and the certificate configured by the terminal.
  • the method further includes: a signaling connection requesting module, configured to receive a non-access stratum message sent by the terminal by using a secure connection with the terminal, and send the non-access stratum message to the access And a mobility management network element, wherein the non-access stratum message is used by the access and mobility management network element to establish the terminal and the access and mobility management network element Signaling connection between.
  • a signaling connection requesting module configured to receive a non-access stratum message sent by the terminal by using a secure connection with the terminal, and send the non-access stratum message to the access
  • a mobility management network element wherein the non-access stratum message is used by the access and mobility management network element to establish the terminal and the access and mobility management network element Signaling connection between.
  • the signaling connection requesting module is further configured to: according to the authentication parameter, do not perform a registration process before sending the non-access stratum message.
  • the signaling connection requesting module is further configured to: generate a service request message according to the authentication parameter, and send the service request message to the access and mobility management network element; the service request The message is used by the access and mobility management network element to establish a signaling connection between the terminal and the access and mobility management network element.
  • the authentication request further includes indication information, where the signaling connection requesting module is further configured to: according to the indication information, do not perform a registration process before sending the non-access stratum message.
  • the indication information in the authentication request message is further used to instruct the gateway device to generate a service request message, and send the service request message to the access and mobility management network element;
  • a service request message is used by the access and mobility management network element to establish a signaling connection between the terminal and the access and mobility management network element.
  • the indication information is a service request indication or a connection recovery indication.
  • the non-access stratum message is a service request message.
  • a terminal comprising: a communication interface, a memory, and a processor, the memory for storing program code to be executed by the processor.
  • the communication interface is used to receive user tasks sent by the client.
  • the processor is configured to execute the program code stored in the memory, specifically for performing the method of the first aspect or the fifth aspect.
  • a gateway device comprising: a memory and a processor, the memory for storing program code to be executed by the processor.
  • the communication interface is used to receive user tasks sent by the client.
  • the processor is configured to execute program code stored in the memory, and is specifically configured to perform any of the methods of the sixth aspect.
  • an access and mobility management network element comprising: a memory and a processor, the memory for storing program code to be executed by the processor.
  • the communication interface is used to receive user tasks sent by the client.
  • the processor is configured to execute program code stored in the memory, and is specifically configured to perform any of the methods of the second aspect.
  • a twelfth aspect a computer readable storage medium for storing computer software instructions for performing the functions of any one of the first aspect and the fifth aspect described above, comprising A program designed by any of the methods of designing the fifth aspect.
  • a thirteenth aspect a computer readable storage medium for storing computer software instructions for performing the functions of any of the above sixth aspects, comprising any one of the above sixth aspects
  • a fourteenth aspect a computer readable storage medium for storing computer software instructions for performing the functions of any of the above-described second aspects, comprising any one of the above second aspects
  • the idle state terminal accesses the mobility and mobility management network element when it is required to use the non-3GPP network for uplink transmission or establish a connection with the non-3GPP access network.
  • Sending indication information the indication information is used to indicate that the access and mobility management network element maintains the signaling connection after establishing a signaling connection between the terminal and the access and mobility management network element
  • the terminal sends an authentication request message to the gateway device, where the gateway device generates a non-access stratum message based on the authentication request message, where the non-access stratum message is used to request the access and move
  • the mobility management network element establishes the signaling connection.
  • the idle state terminal sends an authentication request message to the gateway device when it is required to use the non-3GPP network for uplink transmission or establish a connection with the non-3GPP access network, where
  • the authentication request includes at least one of an authentication parameter or an indication information, where the authentication parameter is used to indicate that the gateway device establishes with the terminal according to the authentication parameter and a certificate configured by the terminal.
  • a secure connection between the terminal; the terminal receives an authentication response message returned by the gateway device, and establishes a secure connection with the gateway device.
  • FIG. 1 is a schematic diagram showing a network architecture applicable to an embodiment of the present application
  • FIG. 2 exemplarily shows a block diagram of a connection establishment process provided by an embodiment of the present application
  • FIG. 3A exemplarily shows a block diagram of an implementation flow of S210 in FIG. 2;
  • FIG. 3B exemplarily shows a block diagram of an implementation flow of S220 in FIG. 2;
  • Figure 4 exemplarily shows one of the signaling interaction diagrams for connection establishment
  • FIG. 5 exemplarily shows a second signaling connection diagram of connection establishment
  • Figure 6 exemplarily shows the third of the signaling interaction diagram of the connection establishment
  • FIG. 7 exemplarily shows the fourth of the signaling interaction diagram of the connection establishment
  • Figure 8 exemplarily shows the fifth of the signaling interaction diagram of the connection establishment
  • FIG. 9 is a schematic structural diagram of a terminal provided by an embodiment of the present application.
  • FIG. 10 is a schematic structural diagram of an access and mobility management network element provided by an embodiment of the present application.
  • FIG. 11 is a schematic structural diagram of a terminal provided by another embodiment of the present application.
  • FIG. 12 is a schematic structural diagram of a gateway device provided by an embodiment of the present application.
  • FIG. 13 is a schematic structural diagram of a terminal provided by another embodiment of the present application.
  • FIG. 14 is a schematic structural diagram of a gateway device provided by another embodiment of the present application.
  • FIG. 15 exemplarily shows a schematic structural diagram of an access and mobility management network element provided by another embodiment of the present application.
  • the embodiment of the present application provides a method and an apparatus for establishing a connection between a terminal and an idle state to establish a connection with a 3GPP network.
  • the embodiments of the present application are described in detail below with reference to the accompanying drawings.
  • FIG. 1 exemplarily shows a schematic diagram of a network architecture to which the embodiment of the present application is applied.
  • This network architecture shows the network architecture for non-3GPP access in a 5G network architecture.
  • the 3GPP network side mainly includes a 3GPP access network, a core network, and a gateway device.
  • the non-3GPP network side mainly includes a non-3GPP access network, and the access network may be an untrusted network, such as a Wireless Local Area Networks (WLAN).
  • the terminal can access the core network through the 3GPP access network, or access the core network through the non-3GPP access network.
  • the gateway device may be a component of the core network or a network device independent of the core network.
  • the gateway device may be an N3IWF, an ngPDG, or other non-3GPP access network devices.
  • the embodiment of the present application does not limit the name of the gateway device. Take the gateway device as the N3IWF as an example. As shown in Figure 1, N3IWF and non-3GPP Access network and core network connection.
  • the core network includes a control plane network element and a user plane network element.
  • the control plane network element is used to implement the control plane function (CPF). It can mainly include user registration authentication, mobility management, and sending packet forwarding policies to the user plane network element. Quality of Service (referred to as Quality of Service). QoS) control strategy, etc.
  • the user plane network element is used to implement the User Plane Function (UPF), and may mainly include packet data packet forwarding, QoS control, and accounting information statistics.
  • UPF User Plane Function
  • the control plane network element may further include the following network elements: Access and Mobility Management Function (AMF) and Session Management Function (SMF).
  • AMF Access and Mobility Management Function
  • SMF Session Management Function
  • the AMF is responsible for the registration process when the terminal is connected and the location management during the terminal movement.
  • SMF Session Management Function
  • the network side establishes a corresponding session connection, and provides a specific service for the user.
  • the N4 interface between the SMF and the UPF sends a packet forwarding policy and a QoS policy to the UPF.
  • the gateway device is the N3IWF.
  • the interface between the N3IWF and the AMF is called the N2 interface.
  • the interface between the N3IWF and the UPF is called the N3 interface.
  • the interface between the AMF and the SMF is called the N11 interface.
  • a terminal in the network architecture may also be referred to as a user equipment (User Equipment, UE for short).
  • the terminal can access the network via a non-3GPP access network and/or a 3GPP access network to communicate with the core network.
  • the terminal may be a mobile phone (or "cellular" phone), a computer with a mobile terminal, etc., for example, the terminal may also be a portable, pocket, handheld, computer built-in or in-vehicle mobile device that is connected to the wireless device. Incoming voice and/or data.
  • the terminal in the above network architecture may also be a Device to Device (D2D) terminal or a Machine to Machine (M2M) terminal or a Machine Type Communication (MTC) terminal.
  • D2D Device to Device
  • M2M Machine to Machine
  • MTC Machine Type Communication
  • the state of the terminal When the connection between the terminal and the gateway device (such as the N3IWF) is released, on the terminal side, the state of the terminal enters an idle state. In this case, the connection between the gateway device and the core network is released, and on the network side, the state of the terminal also enters an idle state.
  • the terminal in the idle state uses the non-3GPP network for uplink transmission (such as sending uplink signaling or transmitting uplink user data) or establishing a connection with the non-3GPP access network, establishing a connection with the network side device, and changing from the idle state to the connected state .
  • FIG. 2 exemplarily shows a schematic overall flow chart of connection establishment provided by an embodiment of the present application.
  • the process can be implemented based on the network architecture shown in FIG.
  • the connection establishment process may be performed, and the connection state is changed from the idle state to the connected state.
  • the connection establishment process can also be performed. For example, when the terminal in the idle state detects the WLAN, establish a connection with the WLAN and initiate a connection establishment procedure with the 3GPP network.
  • connection establishment process provided by the embodiment of the present application may include:
  • S210 Establish a secure connection between the terminal and the gateway device.
  • the gateway device is an N3IWF.
  • the secure connection may have different types of secure connections depending on the security protocol employed. Take the Internet Protocol Security (IPSec) protocol as an example.
  • IPSec Internet Protocol Security
  • the secure connection is an IPSec connection.
  • the terminal sends a non-access stratum message to the core network device by using a secure connection with the gateway device, to trigger establishment of a signaling connection between the core network device and the terminal.
  • the core network device refers to a control plane network element. More specifically, the network architecture shown in FIG. 1 is used as an example.
  • the control plane network element may be an AMF.
  • the non-access stratum message may be a service request message or a registration request message.
  • the terminal is switched from the idle state to the connected state, and may further send uplink signaling through the established connection, or receive downlink signaling sent by the network side.
  • a data connection may be established between the terminal and the core network device.
  • the core network device is a user plane network element. More specifically, the network architecture shown in FIG. 1 is used as an example.
  • the user plane network element may be an UPF.
  • FIG. 3A exemplarily shows an implementation process of S210 in the flow shown in FIG. 2.
  • the flow may include:
  • the terminal in the idle state sends an authentication request message to the gateway device.
  • the authentication request message may be an Internet Key Exchange Authentication (IKE_AUTH) message.
  • IKE_AUTH Internet Key Exchange Authentication
  • the authentication request message is used to enable the gateway device to generate a non-access stratum message based on the authentication request message, where the non-access stratum message is used to request the access and mobility management network element to establish the Signaling connection.
  • the gateway device returns an authentication response message to the terminal according to the authentication request message.
  • S303 The terminal receives an authentication response message returned by the gateway device, and establishes a secure connection with the gateway device.
  • the authentication request message sent by the terminal includes an authentication parameter, where the authentication parameter is used to instruct the gateway device to establish a relationship with the terminal according to the authentication parameter and the certificate configured by the terminal.
  • the gateway device may perform authentication authentication on the terminal according to the authentication parameter in the authentication request message and the certificate configured by the terminal, and return an authentication response message to the terminal; in S303, the terminal receives the authentication. After the response message, a secure connection is established with the gateway device.
  • the gateway device may send the authentication parameter generated by the gateway device to the terminal by using an authentication response message.
  • the terminal may perform authentication authentication on the gateway device according to the authentication parameter carried in the terminal and the certificate configured by the terminal, and establish security with the gateway device after the authentication and authentication is passed. connection.
  • the authentication parameter in the authentication request message sent by the terminal is further used to indicate that the gateway device does not perform the registration process before sending the service request message or other type of request message.
  • the gateway device may not initiate a registration process according to the authentication parameter.
  • the authentication parameter included in the authentication request message sent by the terminal may be used to instruct the gateway device to generate a service request message or other type of request message, and send the service request message to the access and mobility management network.
  • the service request message is used by the access and mobility management network element to establish a signaling connection between the terminal and the access and mobility management network element.
  • the gateway device may generate a service request message according to the authentication parameter, and send the service request message to the access and mobility management network element.
  • the authentication request message sent by the terminal may include an authentication parameter and indication information (for the sake of clarity, the indication information is referred to herein as “first indication information”), where the first indication information is used to indicate the gateway device.
  • the registration process is not performed. Specifically, the gateway device is instructed not to perform the registration process before sending a service request message or other type of request message to the access and mobility management network element. After receiving the authentication request message, the gateway device may not initiate the registration process before sending the service request or other type of request message according to the first indication information carried therein. Further, the gateway device may further maintain a secure connection with the terminal according to the first indication information.
  • the first indication information may be a service request indication or a connection recovery indication.
  • the first indication information in the authentication request message sent by the terminal is further used to instruct the gateway device to generate a service request message, and send the service request message to the access and mobility management network element; Said service request message is used by said access and mobility management network element to establish between said terminal and said access and mobility management network element Signaling connection.
  • the gateway device may generate a service request message according to the first indication information, and send the service request message to the access and mobility management network element.
  • the authentication request message sent by the terminal does not include an authentication parameter; in S302, the authentication response message returned by the gateway device to the terminal may include EAP-REQ/Identity (EAP- The REQ/Identity indicates an EAP-Request message, and the EAP-Request message carries the UE identification request information.
  • the UE may initiate EAP authentication to the gateway device.
  • the authentication request message sent by the terminal may include second indication information, where the access and mobility management network element is between the terminal and the access and mobility management network element.
  • the signaling connection is maintained after the signaling connection is established.
  • the second indication information may include at least one of a service request indication, an activation identifier, a keep connection indication, or a connection recovery indication.
  • the foregoing second indication information may also be sent by the terminal to the access and mobility management network element by using another message before the non-access stratum message is sent.
  • FIG. 3B exemplarily shows an implementation process of S220 in the process shown in FIG. 2. As shown, the process may include:
  • the terminal sends an access layer message to the access and mobility management network element by using a secure connection with the gateway device.
  • the access layer message may be a service request message (or other type of request message) or a registration request message.
  • the access and mobility management network element establishes a signaling connection with the terminal according to the non-access stratum message, and maintains the signaling connection according to the second indication information.
  • the second indication information may be carried in the non-access stratum message.
  • the terminal may carry a periodic registration type parameter in the authentication request message, where the periodic registration type parameter is used to indicate that the access and mobility management network element uses a periodic registration process to establish a relationship with the terminal. Let the connection. In S402, the access and mobility management network element performs periodic type registration on the terminal according to the periodic registration type parameter.
  • FIG. 4 exemplarily shows a signaling interaction diagram of the first method in the method for performing connection recovery based on the first indication information.
  • a user equipment also referred to as a user equipment
  • IDL idle
  • the UE When the UE needs to use the non-3GPP network for uplink transmission or establish a non-3GPP access network.
  • connecting perform the following process:
  • Steps 1a to 1b The UE establishes a connection with the non-3GPP access network, acquires the local IP address of the UE, and obtains the IP address of the N3IWF.
  • Step 2a The UE initiates an IKE_SA_INIT initial request message to the N3IWF.
  • the N3IWF replies to the IKE_SA_INIT initial request message.
  • Step 2b The UE sends an IKE_AUTH request message to the N3IWF, where the message carries the user identifier and the AUTH parameter.
  • Step 2c After receiving the IKE_AUTH request message, the N3IWF performs authentication authentication on the UE according to the AUTH parameter included in the message. After the authentication is authenticated, the N3IWF's own AUTH parameter is generated, and an IKE_AUTH reply message is sent to the UE. The reply message contains the AUTH parameter generated by the N3IWF. After receiving the IKE_AUTH reply message, the UE authenticates the N3IWF according to the AUTH parameter included in the reply message. After the authentication is passed, the UE and the N3IWF perform mutual authentication, and the IPSec connection between the UE and the N3IWF is established. carry out.
  • Step 3 The UE sends a NAS message through an IPSec connection, and the NAS message may be a Service Request message.
  • Step 4 After receiving the NAS message on the IPSec connection, the N3IWF sends the registration request message of the UE to the AMF according to the AUTH parameter in the IKE_AUTH request message sent by the terminal, but sends the NAS message to the AMF.
  • the message is sent to the AMF via an N2 interface message.
  • the N3IWF sends an Initial UE message to the AMF, where the initial UE message includes a service request message sent by the UE.
  • Step 5 After receiving the NAS message (such as the service request message) sent by the UE, the AMF initiates an authentication process with the UE based on the local policy.
  • the foregoing local policy may include: when the UE accesses from the non-3GPP network, the AMF notifies the Authentication Server Function (AUSF) to initiate an authentication authentication process.
  • AUSF Authentication Server Function
  • the authentication and authentication process is an optional process, and whether the authentication and authentication process is performed according to the content of the local policy.
  • Step 6a to Step 7 The AMF and the SMF exchange an N11 interface message, and the AMF sends an N2 interface message to the N3IWF, where the message is a reply message of the N2 interface message sent in the step 4, and the reply message includes a service accept message.
  • the network side establishes a Packet Data Unit (PDU) connection for the UE. Specifically, the N11 interface connection establishment for the UE is completed. Optionally, if the UE needs to send user data, the N3 interface connection for the UE is also established.
  • PDU Packet Data Unit
  • Step 8 The N3IWF sends a NAS message to the UE through the established IPSec connection, and the NAS message is a reply message of the NAS message sent in step 3.
  • the NAS message can be a Service Accept message.
  • Step 9 to Step 11 the UE initiates a process of establishing a sub-IPSec connection.
  • the certificate may be configured and carried in the IKE_AUTH request message.
  • the N3IWF may perform authentication authentication on the UE according to the AUTH parameter included in the IKE_AUTH request message and the certificate.
  • the N3IWF may configure the certificate and carry the certificate in the IKE_AUTH reply message.
  • the UE may perform authentication and authentication on the N3IWF according to the AUTH parameter and the certificate included in the IKE_AUTH reply message.
  • FIG. 5 exemplarily shows a signaling interaction diagram of the second method in the method for performing connection recovery based on the first indication information.
  • the UE has already registered to the 3GPP network but is in the idle (IDLE) state.
  • the UE needs to use the non-3GPP network for uplink transmission or establish a connection with the non-3GPP access network, the following process is performed:
  • Steps 1a to 1b The UE establishes a connection with the non-3GPP access network, acquires the local IP address of the UE, and obtains the IP address of the N3IWF.
  • Step 2a The UE initiates an IKE_SA_INIT initial request message to the N3IWF.
  • the N3IWF replies to the IKE_SA_INIT initial request message.
  • Step 2b The UE sends an IKE_AUTH request message to the N3IWF, where the message carries the user identifier, the AUTH parameter, and the first indication information.
  • the first indication information is at least one of a service request indication or a connection recovery indication.
  • Step 2c After receiving the IKE_AUTH request message, the N3IWF performs authentication authentication on the UE according to the AUTH parameter included in the message. After the authentication is authenticated, the N3IWF's own AUTH parameter is generated, and an IKE_AUTH reply message is sent to the UE. The reply message contains the AUTH parameter generated by the N3IWF. After receiving the IKE_AUTH reply message, the UE authenticates the N3IWF according to the AUTH parameter included in the reply message. After the authentication is passed, the UE and the N3IWF perform mutual authentication, and the IPSec connection between the UE and the N3IWF is established. carry out.
  • the N3IWF maintains an IPSec connection with the UE according to the first indication information. Specifically, the N3IWF keeps the IPSec with the UE after performing periodic location update on the UE according to the first indication information. connection. For example, after receiving the connection disconnection request message sent by the AMF for the UE, the N3IWF refuses to respond to the request message according to the service request indication or the connection recovery indication sent by the UE, so as to maintain an IPSec connection with the UE.
  • Step 3 The UE sends a NAS message through an IPSec connection, and the NAS message may be a Service Request message.
  • Step 4 After receiving the NAS message on the IPSec connection, the N3IWF does not generate a registration request (Registration Request) message of the UE and sends it to the AMF according to the AUTH parameter or the first indication information included in the IKE_AUTH request message sent by the terminal. Instead, the NAS message is sent to the AMF via an N2 interface message. Specifically, the N3IWF sends an Initial UE message to the AMF, where the initial UE message includes a service request message sent by the UE.
  • Registration Request Registration Request
  • Step 5 After receiving the NAS message (such as the service request message) sent by the UE, the AMF initiates an authentication process with the UE based on the local policy.
  • the foregoing local policy may include: when the UE accesses from the non-3GPP network, the AMF notifies the AUSF to initiate an authentication authentication process.
  • the authentication and authentication process is an optional process, and whether the authentication and authentication process is performed according to the content of the local policy.
  • Step 6a to Step 7 The AMF and the SMF exchange an N11 interface message, and the AMF sends an N2 interface message to the N3IWF, where the message is a reply message of the N2 interface message sent in the step 4, and the reply message includes a service accept message.
  • the network side establishment completion of the PDU for the UE is completed.
  • the N11 interface connection establishment for the UE is completed.
  • the N3 interface connection for the UE is also established.
  • Step 8 The N3IWF sends a NAS message to the UE through the established IPSec connection, and the NAS message is a reply message of the NAS message sent in step 3.
  • the NAS message can be a Service Accept message.
  • Step 9 to Step 11 the UE initiates a process of establishing a sub-IPSec connection.
  • the certificate may be configured and carried in the IKE_AUTH request message.
  • the N3IWF may perform authentication authentication on the UE according to the AUTH parameter included in the IKE_AUTH request message and the certificate.
  • the N3IWF may configure the certificate and carry the certificate in the IKE_AUTH reply message.
  • the UE may perform authentication and authentication on the N3IWF according to the AUTH parameter and the certificate included in the IKE_AUTH reply message.
  • FIG. 6 exemplarily shows a signaling interaction diagram of the third method in the method for performing connection recovery based on the first indication information.
  • the UE has already registered to the 3GPP network but is in the idle (IDLE) state.
  • the UE needs to use the non-3GPP network for uplink transmission or establish a connection with the non-3GPP access network, the following process is performed:
  • Steps 1a to 1b The UE establishes a connection with the non-3GPP access network, acquires the local IP address of the UE, and obtains the IP address of the N3IWF.
  • Step 2a The UE initiates an IKE_SA_INIT initial request message to the N3IWF.
  • the N3IWF replies to the IKE_SA_INIT initial request message.
  • Step 2b The UE sends an IKE_AUTH request message to the N3IWF, where the message carries the user identifier and the first indication information.
  • the first indication information is at least one of a service request indication or a connection recovery indication.
  • Step 2c After receiving the IKE_AUTH request message, the N3IWF does not perform the EAP authentication process with the UE, but sends an IKE_AUTH reply message to the UE, and the IPSec connection establishment between the UE and the N3IWF is completed.
  • the N3IWF maintains an IPSec connection with the UE according to the first indication information. Specifically, the N3IWF maintains an IPSec connection with the UE after performing periodic location update on the UE according to the first indication information. For example, after receiving the connection disconnection request message sent by the AMF for the UE, the N3IWF refuses to respond to the request message according to the service request indication or the connection recovery indication sent by the UE, so as to maintain an IPSec connection with the UE.
  • Step 3 The UE sends a NAS message through an IPSec connection, and the NAS message may be a Service Request message.
  • Step 4 After receiving the NAS message on the IPSec connection, the N3IWF sends a registration request (Notification Request) message to the AMF according to the first indication information, and sends the NAS message to the AMF through the N2 interface message. . Specifically, the N3IWF sends an Initial UE message to the AMF, where the initial UE message includes a service request message sent by the UE.
  • a registration request Notification Request
  • Step 5 After receiving the NAS message (such as the service request message) sent by the UE, the AMF initiates an authentication process with the UE based on the local policy.
  • the foregoing local policy may include: when the UE accesses from the non-3GPP network, the AMF notifies the AUSF to initiate an authentication authentication process.
  • the authentication and authentication process is an optional process, and whether the authentication and authentication process is performed according to the content of the local policy.
  • Step 6a to Step 7 The AMF and the SMF exchange an N11 interface message, and the AMF sends an N2 interface message to the N3IWF, where the message is a reply message of the N2 interface message sent in the step 4, and the reply message includes a service accept message.
  • the network side establishment completion of the PDU for the UE is completed.
  • the N11 interface connection establishment for the UE is completed.
  • the N3 interface connection for the UE is also established.
  • Step 8 The N3IWF sends a NAS message to the UE through the established IPSec connection, and the NAS message is a reply message of the NAS message sent in step 3.
  • the NAS message can be a Service Accept message.
  • Step 9 to Step 11 the UE initiates a process of establishing a sub-IPSec connection.
  • the N3IWF establishes an IPSec connection with the UE based on the AUTH parameter, and generates an initial UE message to send the NAS message transmitted in the IPSec connection to the AMF, thereby establishing an N2 interface between the N3IWF and the AMF.
  • the connection in turn, establishes a signaling connection between the UE and the AMF.
  • FIG. 7 exemplarily shows a signaling interaction diagram of the first method in the method of performing connection recovery based on the second indication information.
  • the UE has already registered to the 3GPP network but is in the idle (IDLE) state.
  • the UE needs to use the non-3GPP network for uplink transmission or establish a connection with the non-3GPP access network, the following process is performed:
  • Steps 1a to 1b The UE establishes a connection with the non-3GPP access network, acquires the local IP address of the UE, and obtains the IP address of the N3IWF.
  • Step 2a The UE initiates an IKE_SA_INIT initial request message to the N3IWF.
  • the N3IWF replies to the IKE_SA_INIT initial request message.
  • Step 2b The UE sends an IKE_AUTH request message to the N3IWF, where the message carries the user identifier but does not include the AUTH parameter, indicating that the UE needs to be authenticated based on the EAP.
  • the IKE_AUTH request message further includes a periodic registration type parameter and a second indication information.
  • the second indication information may include at least one of a service request indication, an activation identifier, a keep connection indication, and a connection recovery indication.
  • Step 2c to step 2d the N3IWF sends an IKE_AUTH reply message to the UE, where the reply message includes EAP-REQ/Identity (EAP-REQ/Identity indicates: An EAP-Request message, where the EAP-Request message carries UE identification request information.
  • the UE After receiving the IKE_AUTH request message containing the EAP-REQ/Identity, the UE sends an IKE_AUTH request message to the N3IWF, where the request message includes the user identifier and EAP-REQ/Identity.
  • Step 3 After receiving the IKE_AUTH request message, the N3IWF generates a registration request message, and sends an N2 interface message to the AMF.
  • the N2 interface message includes a registration request message, where the registration request message includes a user identifier, a periodic registration type parameter, and a second Instructions.
  • the periodic registration type parameter and the second indication information are the same as the corresponding information content carried in the IKE_AUTH request message received by the N3IWF.
  • the N3IWF stores the second indication information carried in the N3IWF.
  • the N3IWF can maintain an IPSec connection with the UE based on the stored second indication information.
  • the AMF sends a connection disconnection request message to the UE to the N3IWF, and the N3IWF may refuse to respond to the request message according to the second indication information sent by the UE. Maintain an IPSec connection with the UE.
  • Step 4 The AMF notifies the AUSF to complete the EAP authentication of the UE based on the local policy.
  • the establishment of the IPSec connection between the N3IWF and the UE is completed.
  • the foregoing local policy may include: when the UE accesses from the non-3GPP network, the AMF notifies the AUSF to initiate an authentication authentication process.
  • the authentication and authentication process is an optional process, and whether the authentication and authentication process is performed according to the content of the local policy.
  • the AMF stores the second indication information sent by the UE, and may maintain the N2 interface connection of the UE based on the second indication information. Specifically, after the periodic location update is performed on the UE, the AMF may maintain the N2 interface connection between the AMF and the N3 IWF according to the stored second indication information of the UE.
  • Step 5 to Step 6 The AMF sends an N2 interface message to the N3 IWF, and the message may be a registration accept message.
  • the N3IWF forwards the message to the UE through the established IPSec connection.
  • Step 7 The UE sends a NAS message through an IPSec connection, where the NAS message may be a Service Request message.
  • Step 8 After receiving the NAS message on the IPSec connection, the N3IWF sends the NAS message to the AMF through the N2 interface message according to the second indication information.
  • Step 9a to Step 10 After receiving the NAS message (such as the service request message) sent by the UE, the AMF exchanges the N11 interface message with the SMF, and the AMF sends an N2 interface message to the N3IWF, where the message is the reply of the N2 interface message sent in the step 8.
  • a message containing a service acceptance message Through the above process, the PDU connection of the UE to the UE can be established. Specifically, the N11 interface connection establishment for the UE is completed. Optionally, if the UE needs to send user data, the N3 interface connection for the UE is also established.
  • Step 11 The N3IWF sends a NAS message to the UE through the established IPSec connection, and the NAS message is a reply message of the NAS message sent in step 7.
  • the NAS message can be a Service Accept message.
  • Step 11 to Step 14 the UE initiates a procedure for establishing a sub-IPSec connection.
  • the UE may send the second indication information and the registration type parameter to other N3IWFs, such as the IKE_AUTH request message carried in step 2d.
  • step 7 may be omitted in the foregoing process shown in FIG. 7, that is, the N3IWF may generate a service request message according to the second indication information, and send the service request message to the AMF, so that The AMF establishes a signaling connection between the UE and the AMF.
  • FIG. 8 exemplarily shows a signaling interaction diagram of the second method in the method for performing connection recovery based on the second indication information.
  • the UE has registered to the 3GPP network but is idle. (IDLE) state, when the UE needs to use the non-3GPP network for uplink transmission or establish a connection with the non-3GPP access network, the following process is performed:
  • Steps 1a to 1b The UE establishes a connection with the non-3GPP access network, acquires the local IP address of the UE, and obtains the IP address of the N3IWF.
  • Step 2a The UE initiates an IKE_SA_INIT initial request message to the N3IWF.
  • the N3IWF replies to the IKE_SA_INIT initial request message.
  • Step 2b The UE sends an IKE_AUTH request message to the N3IWF, where the message carries the user identifier, the AUTH parameter, the periodic registration type parameter, and the second indication information.
  • the second indication information may include at least one of a service request indication, an activation identifier, a keep connection indication, or a connection recovery indication.
  • Step 2c After receiving the IKE_AUTH request message, the N3IWF authenticates the UE according to the AUTH parameter carried in the message, and generates an AUTH parameter of the N3IWF after the authentication is passed, and sends an IKE_AUTH reply message to the UE, where the reply message is sent. Contains the AUTH parameter generated by the N3IWF, excluding EAP-REQ/Identity.
  • the UE After receiving the IKE_AUTH reply message, the UE authenticates the N3IWF according to the AUTH parameter included in the reply message. After the authentication is passed, the UE and the N3IWF perform mutual authentication, and the IPSec connection between the UE and the N3IWF is established. carry out.
  • Step 3 The N3IWF generates a registration request message, and sends an N2 interface message to the AMF.
  • the N2 interface message includes a registration request message, where the registration request message includes a user identifier, a periodic registration type parameter, and second indication information.
  • the periodic registration type parameter and the second indication information are the same as the corresponding information content carried in the IKE_AUTH request message received by the N3IWF.
  • the N3IWF stores the second indication information carried in the N3IWF.
  • the N3IWF can maintain an IPSec connection with the UE based on the stored second indication information.
  • the AMF sends a connection disconnection request message to the UE to the N3IWF, and the N3IWF may refuse to respond to the request message according to the second indication information sent by the UE. Maintain an IPSec connection with the UE.
  • Step 4 The AMF notifies the AUSF to complete the EAP authentication of the UE based on the local policy.
  • the establishment of the IPSec connection between the N3IWF and the UE is completed.
  • the foregoing local policy may include: when the UE accesses from the non-3GPP network, the AMF notifies the AUSF to initiate an authentication authentication process.
  • the authentication and authentication process is an optional process, and whether the authentication and authentication process is performed according to the content of the local policy.
  • the AMF stores the second indication information sent by the UE, and may maintain the N2 interface connection of the UE based on the second indication information. Specifically, after the periodic location update is performed on the UE, the AMF may maintain the N2 interface connection between the AMF and the N3 IWF according to the stored second indication information of the UE.
  • Step 5 to Step 6 The AMF sends an N2 interface message to the N3 IWF, and the message may be a registration accept message.
  • the N3IWF forwards the message to the UE through the established IPSec connection.
  • Step 7 The UE sends a NAS message through an IPSec connection, where the NAS message may be a Service Request message.
  • Step 8 After receiving the NAS message on the IPSec connection, the N3IWF sends the NAS message to the AMF through the N2 interface message according to the second indication information.
  • Step 9a to Step 10 After receiving the NAS message (such as the service request message) sent by the UE, the AMF exchanges the N11 interface message with the SMF, and the AMF sends an N2 interface message to the N3IWF, where the message is the N2 interface sent in step 8.
  • the reply message of the message which contains the service accept message.
  • the PDU connection of the UE to the UE can be established. Specifically, the N11 interface connection establishment for the UE is completed. Optionally, if the UE needs to send user data, the N3 interface connection for the UE is also established.
  • Step 11 The N3IWF sends a NAS message to the UE through the established IPSec connection, and the NAS message is a reply message of the NAS message sent in step 7.
  • the NAS message can be a Service Accept message.
  • Step 11 to Step 14 the UE initiates a procedure for establishing a sub-IPSec connection.
  • the N3IWF may perform authentication and authentication on the UE according to the certificate of the UE and the AUTH parameter included in the message.
  • the N3IWF may obtain the certificate of the UE from the AMF during the periodic location update process of the UE.
  • step 7 may be omitted in the foregoing process shown in FIG. 8, that is, the N3IWF may generate a service request message according to the second indication information, and send the service request message to the AMF, so that The AMF establishes a signaling connection between the UE and the AMF.
  • the connection between the UE and the network side is established based on the periodic registration procedure, and the connection is maintained based on the second indication information.
  • the UE sends a service request message to the network side in the connected state, and establishes a related PDU connection, so that the UE transitions from the idle state to the connected state, and provides a connection channel for the subsequent UE to initiate a service request.
  • FIG. 9 exemplarily shows a schematic structural diagram of a terminal provided by an embodiment of the present application, where the terminal can implement the connection establishment process described in the foregoing embodiment.
  • the terminal may include: an indication module 901, and a connection establishment request module 902.
  • the indication module 901 is configured to send indication information to the access and mobility management network element when the terminal is in an idle state and needs to use the non-3GPP network for uplink transmission or establish a connection with the non-3GPP access network, where the indication information is used. And indicating that the access and mobility management network element maintains the signaling connection after the establishment of the signaling connection between the terminal and the access and mobility management network element; the connection establishment request module 902 is configured to The gateway device sends an authentication request message, where the gateway device generates a non-access stratum message based on the authentication request message, where the non-access stratum message is used to request the access and mobility management NE to establish The signaling connection.
  • the authentication request message includes a periodic registration type parameter, where the periodic registration type parameter is used to indicate that the access and mobility management network element establishes a periodic registration process with the terminal. Signaling connection between.
  • the indication information is included in the authentication request message.
  • the indication information includes at least one of a service request indication, an activation identifier, a keep-alive indication, or a connection recovery indication.
  • connection establishment requesting module 902 is further configured to: send a non-access stratum message to the access and mobility management network element by using a secure connection with the gateway device; wherein the secure connection is according to the The authentication request message is sent by the terminal to the gateway device, where the authentication request message includes an authentication parameter, where the authentication parameter is used to instruct the gateway device to establish the gateway device by using the authentication parameter.
  • a secure connection with the terminal is further configured to: send a non-access stratum message to the access and mobility management network element by using a secure connection with the gateway device; wherein the secure connection is according to the The authentication request message is sent by the terminal to the gateway device, where the authentication request message includes an authentication parameter, where the authentication parameter is used to instruct the gateway device to establish the gateway device by using the authentication parameter.
  • a secure connection with the terminal is further configured to: send a non-access stratum message to the access and mobility management network element by using a secure connection with the gateway device; wherein the secure connection is according to the The authentication request message is sent by the terminal to the gateway device
  • FIG. 10 is a schematic structural diagram of an access and mobility management network element provided by an embodiment of the present application.
  • the access and mobility management network element can implement the connection establishment process described in the foregoing embodiments.
  • the access and mobility management network element may include: a connection processing module 1001, and a connection establishment module 1002.
  • the connection processing module 1001 is configured to receive indication information sent by the terminal in an idle state, and keep the signaling connection after the signaling connection between the terminal and the access and mobility management network element is established according to the indication information.
  • Connection construction The vertical module 1002 is configured to establish a signaling connection with the terminal according to the non-access stratum message.
  • the non-access stratum message includes a periodic registration type parameter; the connection establishing module 1002 is specifically configured to: establish, according to the periodic registration type parameter, a periodic registration process with the terminal Signaling connection.
  • the indication information is included in the non-access stratum message.
  • the indication information includes at least one of a service request indication, an activation identifier, a keep-alive indication, or a connection recovery indication.
  • FIG. 11 is a schematic structural diagram of a terminal provided by an embodiment of the present application.
  • the terminal can implement the connection establishment process described in the foregoing embodiment.
  • the terminal provided by the embodiment of the present application may include: an authentication request module 1101 and a secure connection establishing module 1102.
  • the authentication requesting module 1101 is configured to send an authentication request message to the gateway device when the terminal is in an idle state and needs to use the non-3GPP network for uplink transmission or establish a connection with the non-3GPP access network, where the authentication request is sent.
  • the secure connection establishing module 1102 is configured to establish and cooperate according to the authentication parameter and the certificate configured by the terminal A secure connection between the gateway devices.
  • the terminal may further include: a signaling connection requesting module 1103, configured to send, by using the secure connection, a non-access stratum message to the access and mobility management network element, where the non-access stratum message is used for The access and mobility management network element establishes a signaling connection between the terminal and the access and mobility management network element.
  • the terminal may further include a signaling connection establishing module 1104, configured to establish a signaling connection with the access and mobility management network element.
  • the authentication parameter is further used to indicate that the gateway device does not perform a registration process before sending the non-access stratum message.
  • the authentication request further includes indication information, where the indication information is used to indicate that the gateway device does not perform a registration process before sending the non-access stratum message.
  • the authentication parameter is further used to indicate that the gateway device generates a service request message, and sends the service request message to the access and mobility management network element; the service request message is used by The access and mobility management network element establishes a signaling connection between the terminal and the access and mobility management network element.
  • the indication information is a service request indication or a connection recovery indication.
  • the indication information in the authentication request message is further used to instruct the gateway device to generate a service request message, and send the service request message to the access and mobility management network element;
  • a service request message is used by the access and mobility management network element to establish a signaling connection between the terminal and the access and mobility management network element.
  • the non-access stratum message is a service request message.
  • FIG. 12 is a schematic structural diagram of a gateway device according to an embodiment of the present disclosure.
  • the gateway device can implement the connection establishment process implemented on the terminal side described in the foregoing embodiment.
  • the gateway device may include: an authentication module 1201 and a secure connection establishing module 1202.
  • the authentication module 1201 is configured to receive an authentication request message sent by the terminal in an idle state, where the authentication request includes at least one of an authentication parameter or an indication information, where the indication information is used to indicate that the gateway device keeps
  • the secure connection established by the secure connection establishing module 1202 is configured to establish a secure connection with the terminal according to the authentication parameter and the certificate configured by the terminal.
  • the gateway device further includes a signaling connection requesting module 1203, configured to receive a non-access stratum message sent by the terminal by using a secure connection with the terminal, and send the non-access stratum message Transmitted to the access and mobility management network element, the non-access stratum message is used by the access and mobility management network element to establish signaling between the terminal and the access and mobility management network element connection.
  • a signaling connection requesting module 1203 configured to receive a non-access stratum message sent by the terminal by using a secure connection with the terminal, and send the non-access stratum message Transmitted to the access and mobility management network element, the non-access stratum message is used by the access and mobility management network element to establish signaling between the terminal and the access and mobility management network element connection.
  • the signaling connection requesting module is further configured to: generate a service request message according to the authentication parameter, and send the service request message to the access and mobility management network element; the service request The message is used by the access and mobility management network element to establish a signaling connection between the terminal and the access and mobility management network element.
  • the signaling connection requesting module 1203 is further configured to: according to the authentication parameter, do not perform a registration process before sending the non-access stratum message.
  • the signaling connection requesting module 1203 is further configured to: according to the indication information, do not perform a registration process before sending the non-access stratum message.
  • the signaling connection requesting module is further configured to: generate a service request message according to the indication information, and send the service request message to the access and a mobility management network element; the service request message is used by the access and mobility management network element to establish a signaling connection between the terminal and the access and mobility management network element.
  • the indication information is a service request indication or a connection recovery indication.
  • the non-access stratum message is a service request message.
  • FIG. 13 is a schematic structural diagram of a terminal provided by an embodiment of the present application.
  • the terminal includes a communication interface 1301, a processor 1302, and a memory 1303 for storing program code to be executed by the processor 1302.
  • the communication interface 1301 is used for message interaction.
  • the processor 1302 is configured to execute the program code stored in the memory, specifically for performing the method performed by the terminal side in the foregoing embodiment.
  • the processor 1302 may be a central processing unit (CPU), or a digital processing module or the like.
  • the memory 1303 may be a non-volatile memory, such as a hard disk drive (HDD) or a solid-state drive (SSD), or a volatile memory such as a random access memory. (random-access memory, referred to as RAM).
  • Memory 1303 is any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer, but is not limited thereto.
  • connection medium between the communication interface 1301, the processor 1302, and the memory 1303 is not limited in the embodiment of the present application.
  • the memory 1303, the processor 1302, and the communication interface 1301 are connected by a bus 1304 in FIG. 13, and the bus is indicated by a thick line in FIG. 13, and the connection manner between other components is only schematically illustrated. , not limited to.
  • the bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in FIG. 13, but it does not mean that there is only one bus or one type of bus.
  • the embodiment of the present invention further provides a computer readable storage medium for storing computer software instructions required to execute the processor 1301, which includes a program for executing the above-mentioned processor.
  • FIG. 14 exemplarily shows a schematic structural diagram of a gateway provided by an embodiment of the present application.
  • the gateway device includes a communication interface 1401, a processor 1402, and a memory 1403 for storing program code to be executed by the processor 1402.
  • Communication interface 1401 is used for message interaction.
  • the processor 1402 is configured to execute program code stored in the memory, specifically for performing the method performed by the gateway device side in the foregoing embodiment.
  • the processor 1402 can be a central processing unit (CPU), or a digital processing module or the like.
  • the memory 1403 may be a non-volatile memory, such as a hard disk drive (HDD) or a solid-state drive (SSD), or a volatile memory such as a random access memory. (random-access memory, referred to as RAM).
  • Memory 1403 is any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer, but is not limited thereto.
  • connection medium between the above communication interface 1401, the processor 1402, and the memory 1403 is not limited in the embodiment of the present application.
  • the memory 1403, the processor 1402, and the communication interface 1401 are connected by a bus 1404 in FIG. 14.
  • the bus is indicated by a thick line in FIG. 14, and the connection manner between other components is only schematically illustrated. , not limited to.
  • the bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 14, but it does not mean that there is only one bus or one type of bus.
  • the embodiment of the present invention further provides a computer readable storage medium for storing computer software instructions required to execute the processor 1401 described above, which includes a program for executing the above-mentioned processor.
  • FIG. 15 is a schematic structural diagram of an access and mobility management network element provided by an embodiment of the present application.
  • the network element includes a communication interface 1501, a processor 1502, and a memory 1503 for storing program code to be executed by the processor 1502.
  • Communication interface 1501 is used for message interaction.
  • the processor 1502 is configured to execute the program code stored in the memory, specifically for performing the method performed by the access and mobility management network element side in the foregoing embodiment.
  • the processor 1502 can be a central processing unit (CPU), or a digital processing module or the like.
  • the memory 1503 may be a non-volatile memory, such as a hard disk drive (HDD) or a solid-state drive (SSD), or a volatile memory such as a random access memory. (random-access memory, referred to as RAM).
  • Memory 1503 is any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer, but is not limited thereto.
  • connection medium between the communication interface 1501, the processor 1502, and the memory 1503 is not limited in the embodiment of the present application.
  • the memory 1503, the processor 1502, and the communication interface 1501 are connected by a bus 1504 in FIG. 15, and the bus is indicated by a thick line in FIG. 15, and the connection manner between other components is only schematically illustrated. , not limited to.
  • the bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 15, but it does not mean that there is only one bus or one type of bus.
  • the embodiment of the present invention further provides a computer readable storage medium for storing computer software instructions required to execute the processor 1501 described above, which includes a program for executing the above-mentioned processor.
  • embodiments of the present application can be provided as a method, system, or computer program product.
  • the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment in combination of software and hardware.
  • the application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.
  • This application is a flowchart and/or reference to a method, apparatus (system), and computer program product according to the present application. Block diagram to describe. It will be understood that each flow and/or block of the flowchart illustrations and/or FIG.
  • These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine for the execution of instructions for execution by a processor of a computer or other programmable data processing device.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Landscapes

  • Mobile Radio Communication Systems (AREA)

Abstract

一种连接建立方法及装置。空闲态的终端在需要利用非3GPP网络进行上行传输或建立与非3GPP接入网连接时，一方面，向接入和移动性管理网元发送指示信息，用于指示所述接入和移动性管理网元在所述终端和所述接入和移动性管理网元之间的信令连接建立后保持所述信令连接；另一方面，向网关设备发送鉴权请求消息，所述鉴权请求中包括鉴权参数或指示信息中的至少一个，建立与所述终端之间的安全连接。采用本申请可针对空闲态的终端建立与网络侧的连接。

Description

一种连接建立方法及装置 技术领域
本申请涉及通信领域，尤其涉及一种连接建立方法及装置。
背景技术
为了应对无线宽带技术的挑战，保持3GPP网络的领先优势，3GPP标准组制定了下一代移动通信网络架构(Next Generation System)，称为5G网络架构。该架构不但支持3GPP标准组定义的无线技术(如长期演进(Long Term Evolution，简称LTE)或5G无线接入网(Radio Access Network，简称RAN)等)接入核心网(如5G核心网(Core network)，而且支持非3GPP接入技术通过非3GPP转换功能(non-3GPP Interworking Function，简称N3IWF)或下一代分组数据网关(next Generation packet data Gateway，简称ngPDG)接入核心网。
移动核心网允许终端从3GPP的接入网接入，或者从非3GPP的接入网接入，还允许终端同时从3GPP接入网以及从非3GPP接入网接入。终端从3GPP网络接入核心网的情况下，存在空闲态(IDLE)和连接态(CONNECTED)之间的状态转换。比如，若终端在一段时间内没有数据传输，则该终端释放空口连接和非接入层(Non Access Stratum，简称NAS)连接，进入空闲态，以达到节省网络资源以及节省终端电量消耗的目的。终端从非3GPP网络接入核心网的情况下，也会存在空闲态和连接态之间的状态转换。
现有技术中已经能够实现在终端初始注册流程中建立终端与网络侧的连接，使终端处于连接态。但是，目前尚无法实现当终端已经注册到3GPP网络且进入空闲态后，如何建立与3GPP网络侧的连接，转换到连接态。
发明内容
本申请实施例公开了一种连接建立方法及装置。
第一方面，提供一种连接建立方法，该方法包括：空闲态的终端在需要利用非3GPP网络进行上行传输或建立与非3GPP接入网连接时，向接入和移动性管理网元发送指示信息，所述指示信息用于指示所述接入和移动性管理网元在所述终端和所述接入和移动性管理网元之间的信令连接建立后保持所述信令连接；所述终端向网关设备发送鉴权请求消息，用于使所述网关设备基于所述鉴权请求消息生成非接入层消息，所述非接入层消息用于请求所述接入和移动性管理网元建立所述信令连接。
可选地，所述鉴权请求消息中包括周期性注册类型参数，所述周期性注册类型参数用于指示所述接入和移动性管理网元采用周期性注册的流程建立与所述终端之间的信令连接。
可选地，所述指示信息包括于所述鉴权请求消息中。
可选地，所述非接入层消息为注册请求消息。
可选地，所述指示信息包括：服务请求指示、激活标识、保持连接指示、或连接恢复指示中的至少一个。
可选地，还包括：所述终端通过与网关设备之间的安全连接向所述接入和移动性管理网元发送服务请求消息；其中，所述安全连接是根据所述终端向所述网关设备发送的鉴 权请求消息建立的。
可选地，所述鉴权请求消息中包括鉴权参数，所述鉴权参数用于指示所述网关设备采用所述鉴权参数建立所述网关设备和所述终端之间的安全连接。
第二方面，提供一种连接建立方法，该方法包括：
接入和移动性管理网元接收空闲态的终端发送的指示信息，所述指示信息用于指示所述接入和移动性管理网元在所述终端和所述接入和移动性管理网元之间的信令连接建立后保持所述信令连接；所述接入和移动性管理网元根据非接入层消息，建立与所述终端之间的信令连接。
可选地，所述非接入层消息中包括周期性注册类型参数；所述建立与所述终端之间的信令连接，包括：所述接入和移动性管理网元根据所述周期性注册类型参数，采用周期性注册的流程建立与所述终端之间的信令连接。
可选地，所述指示信息包括于所述非接入层消息中。
可选地，所述指示信息包括：服务请求指示、激活标识、保持连接指示、或连接恢复指示中的至少一个。
第三方面，提供一种终端，包括：
指示模块，用于在所述终端处于空闲态且需要利用非3GPP网络进行上行传输或建立与非3GPP接入网连接时，向接入和移动性管理网元发送指示信息，所述指示信息用于指示所述接入和移动性管理网元在所述终端和所述接入和移动性管理网元之间的信令连接建立后保持所述信令连接；
连接建立请求模块，用于向网关设备发送鉴权请求消息，用于使所述网关设备基于所述鉴权请求消息生成非接入层消息，所述非接入层消息用于请求所述接入和移动性管理网元建立所述信令连接。
可选地，所述鉴权请求消息中包括周期性注册类型参数，所述周期性注册类型参数用于指示所述接入和移动性管理网元采用周期性注册的流程建立与所述终端之间的信令连接。
可选地，所述非接入层消息为注册请求消息。
可选地，所述指示信息包括于所述鉴权请求消息中。
可选地，所述指示信息包括：服务请求指示、激活标识、保持连接指示、或连接恢复指示中的至少一个。
可选地，所述连接建立请求模块还用于：通过与网关设备之间的安全连接向所述接入和移动性管理网元发送服务请求消息；其中，所述安全连接是根据所述终端向所述网关设备发送的鉴权请求消息建立的。
可选地，所述鉴权请求消息中包括鉴权参数，所述鉴权参数用于指示所述网关设备采用所述鉴权参数建立所述网关设备和所述终端之间的安全连接。
第四方面，提供一种接入和移动性管理网元，包括：
连接处理模块，用于接收空闲态的终端发送的指示信息，根据所述指示信息在所述终端和所述接入和移动性管理网元之间的信令连接建立后保持所述信令连接；
连接建立模块，用于根据非接入层消息，建立与所述终端之间的信令连接。
可选地，所述非接入层消息中包括周期性注册类型参数；所述连接建立模块具体用于：根据所述周期性注册类型参数，采用周期性注册的流程建立与所述终端之间的信令连接。
可选地，所述指示信息包括于所述非接入层消息中。
可选地，所述指示信息包括：服务请求指示、激活标识、保持连接指示、或连接恢复指示中的至少一个。
第五方面，提供一种连接建立方法，该方法包括：
空闲态的终端在需要利用非3GPP网络进行上行传输或建立与非3GPP接入网连接时，向网关设备发送鉴权请求消息，其中，所述鉴权请求中包括鉴权参数或指示信息中的至少一个，所述鉴权参数用于指示所述网关设备根据所述鉴权参数和所述终端配置的证书，建立与所述终端之间的安全连接；所述终端接收所述网关设备返回的鉴权响应消息，建立与所述网关设备之间的安全连接。
可选地，所述方法还包括：所述终端通过所述安全连接向接入和移动性管理网元发送非接入层消息，所述非接入层消息用于所述接入和移动性管理网元建立所述终端和所述接入和移动性管理网元之间的信令连接。
可选地，所述鉴权参数还用于指示所述网关设备在发送所述非接入层消息之前，不进行注册流程。
可选地，所述鉴权参数还用于指示所述网关设备生成服务请求消息，并将所述服务请求消息发送给所述接入和移动性管理网元；所述服务请求消息用于所述接入和移动性管理网元建立所述终端和所述接入和移动性管理网元之间的信令连接。
可选地，所述鉴权请求消息中包括的指示信息，用于指示所述网关设备在发送所述非接入层消息之前，不进行注册流程。
可选地，所述指示信息还用于指示所述网关设备保持与所述终端之间的安全连接。
可选地，所述鉴权请求消息中的指示信息，还用于指示所述网关设备生成服务请求消息，并将所述服务请求消息发送给所述接入和移动性管理网元；所述服务请求消息用于所述接入和移动性管理网元建立所述终端和所述接入和移动性管理网元之间的信令连接。
可选地，所述指示信息为服务请求指示或连接恢复指示。
可选地，所述非接入层消息为服务请求消息。
第六方面，提供一种连接建立方法，包括：
网关设备接收空闲态的终端发送的鉴权请求消息，其中，所述鉴权请求中包括鉴权参数或指示信息中的至少一个，所述指示信息用于指示所述网关设备保持建立的所述安全连接；
所述网关设备根据所述鉴权参数和所述终端配置的证书，建立与所述终端之间的安全连接。
可选地，还包括：所述网关设备通过与所述终端之间的安全连接接收所述终端发送的非接入层消息，并将所述非接入层消息发送给接入和移动性管理网元，所述非接入层消息用于所述接入和移动性管理网元建立所述终端和所述接入和移动性管理网元之间的信令连接。
可选地，还包括：所述网关设备根据所述鉴权参数，在发送所述非接入层消息之前不进行注册流程。
可选地，还包括：所述网关设备根据所述鉴权参数生成服务请求消息，并将所述服务请求消息发送给所述接入和移动性管理网元；所述服务请求消息用于所述接入和移动性管理网元建立所述终端和所述接入和移动性管理网元之间的信令连接。
可选地，所述鉴权请求中还包括指示信息；所述方法还包括：所述网关设备根据所述指示信息，在发送所述非接入层消息之前不进行注册流程。
可选地，所述网关设备还可以根据该指示信息，保持与所述终端之间的安全连接。
可选地，所述鉴权请求中包括指示信息时，所述方法还包括：所述网关设备根据所述指示信息生成服务请求消息，并将所述服务请求消息发送给所述接入和移动性管理网元；所述服务请求消息用于所述接入和移动性管理网元建立所述终端和所述接入和移动性管理网元之间的信令连接。
可选地，所述指示信息为服务请求指示或连接恢复指示。
可选地，所述非接入层消息为服务请求消息。
第七方面，提供一种终端，包括：
鉴权请求模块，用于在所述终端处于空闲态且需要利用非3GPP网络进行上行传输或建立与非3GPP接入网连接时，向网关设备发送鉴权请求消息，其中，所述鉴权请求中包括鉴权参数或指示信息中的至少一个；以及，接收所述网关设备返回的鉴权响应消息；安全连接建立模块，用于根据所述鉴权参数和所述终端配置的证书，建立与所述网关设备之间的安全连接。
可选地，还包括：信令连接请求模块，用于通过所述安全连接向接入和移动性管理网元发送非接入层消息，所述非接入层消息用于所述接入和移动性管理网元建立所述终端和所述接入和移动性管理网元之间的信令连接。
可选地，所述鉴权参数还用于指示所述网关设备在发送所述非接入层消息之前，不进行注册流程。
可选地，所述鉴权参数还用于指示所述网关设备生成服务请求消息，并将所述服务请求消息发送给所述接入和移动性管理网元；所述服务请求消息用于所述接入和移动性管理网元建立所述终端和所述接入和移动性管理网元之间的信令连接。
可选地，所述鉴权请求中包括的指示信息，用于指示所述网关设备在发送所述非接入层消息之前，不进行注册流程。
可选地，所述鉴权请求消息中的指示信息，还用于指示所述网关设备生成服务请求消息，并将所述服务请求消息发送给所述接入和移动性管理网元；所述服务请求消息用于所述接入和移动性管理网元建立所述终端和所述接入和移动性管理网元之间的信令连接。
可选地，所述指示信息为服务请求指示或连接恢复指示。
可选地，其特征在于，所述非接入层消息为服务请求消息。
第八方面，提供一种网关设备，包括：
鉴权模块，用于接收空闲态的终端发送的鉴权请求消息，其中，所述鉴权请求中包括鉴权参数或指示信息中的至少一个，所述指示信息用于指示所述网关设备保持建立的所述安全连接；
安全连接建立模块，用于根据所述鉴权参数和所述终端配置的证书，建立与所述终端之间的安全连接。
可选地，还包括：信令连接请求模块，用于通过与所述终端之间的安全连接接收所述终端发送的非接入层消息，并将所述非接入层消息发送给接入和移动性管理网元，所述非接入层消息用于所述接入和移动性管理网元建立所述终端和所述接入和移动性管理网元 之间的信令连接。
可选地，所述信令连接请求模块还用于：根据所述鉴权参数，在发送所述非接入层消息之前不进行注册流程。
可选地，所述信令连接请求模块还用于：根据所述鉴权参数生成服务请求消息，并将所述服务请求消息发送给所述接入和移动性管理网元；所述服务请求消息用于所述接入和移动性管理网元建立所述终端和所述接入和移动性管理网元之间的信令连接。
可选地，所述鉴权请求中还包括指示信息；所述信令连接请求模块还用于：根据所述指示信息，在发送所述非接入层消息之前不进行注册流程。
可选地，所述鉴权请求消息中的指示信息，还用于指示所述网关设备生成服务请求消息，并将所述服务请求消息发送给所述接入和移动性管理网元；所述服务请求消息用于所述接入和移动性管理网元建立所述终端和所述接入和移动性管理网元之间的信令连接。
可选地，所述指示信息为服务请求指示或连接恢复指示。
可选地，所述非接入层消息为服务请求消息。
第九方面，提供了一种终端，该终端包括：通信接口、存储器以及处理器，存储器用于存储处理器所需执行的程序代码。通信接口用于接收客户端发送的用户任务。处理器用于执行存储器所存储的程序代码，具体用于执行第一方面或第五方面的任一种方法。
第十方面，提供了一种网关设备，该网关设备包括：存储器以及处理器，存储器用于存储处理器所需执行的程序代码。通信接口用于接收客户端发送的用户任务。处理器用于执行存储器所存储的程序代码，具体用于执行第六方面的任一种方法。
第十一方面，提供了一种接入和移动性管理网元，该网元包括：存储器以及处理器，存储器用于存储处理器所需执行的程序代码。通信接口用于接收客户端发送的用户任务。处理器用于执行存储器所存储的程序代码，具体用于执行第二方面的任一种方法。
第十二方面，提供了一种计算机可读存储介质，用于存储为执行上述第一方面、第五方面的任意一种设计的功能所用的计算机软件指令，其包含用于执行上述第一方面、第五方面的任意一种设计的方法所设计的程序。
第十三方面，提供了一种计算机可读存储介质，用于存储为执行上述第六方面的任意一种设计的功能所用的计算机软件指令，其包含用于执行上述第六方面的任意一种设计的方法所设计的程序。
第十四方面，提供了一种计算机可读存储介质，用于存储为执行上述第二方面的任意一种设计的功能所用的计算机软件指令，其包含用于执行上述第二方面的任意一种设计的方法所设计的程序。
本申请的上述第一方面至第四方面提供的实施例中，空闲态的终端在需要利用非3GPP网络进行上行传输或建立与非3GPP接入网连接时，向接入和移动性管理网元发送指示信息，所述指示信息用于指示所述接入和移动性管理网元在所述终端和所述接入和移动性管理网元之间的信令连接建立后保持所述信令连接；所述终端向网关设备发送鉴权请求消息，用于使所述网关设备基于所述鉴权请求消息生成非接入层消息，所述非接入层消息用于请求所述接入和移动性管理网元建立所述信令连接。从而实现了空闲态的终端在需要利用非3GPP网络进行上行传输或建立与非3GPP接入网连接时，建立与接入和移动性管理网元之间的信令连接的过程。
本申请的上述第五至第八方面提供的实施例中，空闲态的终端在需要利用非3GPP网络进行上行传输或建立与非3GPP接入网连接时，向网关设备发送鉴权请求消息，其中，所述鉴权请求中包括鉴权参数或指示信息中的至少一个，所述鉴权参数用于指示所述网关设备根据所述鉴权参数和所述终端配置的证书，建立与所述终端之间的安全连接；所述终端接收所述网关设备返回的鉴权响应消息，建立与所述网关设备之间的安全连接。从而实现了空闲态的终端在需要利用非3GPP网络进行上行传输或建立与非3GPP接入网连接时，建立与网关设备之间的安全连接的过程。
附图说明
图1示例性地示出了本申请实施例适用的网络架构示意图；
图2示例性地示出了本申请实施例提供的连接建立流程的框图；
图3A示例性地示出了图2中S210的实现流程框图；
图3B示例性地示出了图2中S220的实现流程框图；
图4示例性地示出了连接建立的信令交互图之一；
图5示例性地示出了连接建立的信令交互图之二；
图6示例性地示出了连接建立的信令交互图之三；
图7示例性地示出了连接建立的信令交互图之四；
图8示例性地示出了连接建立的信令交互图之五；
图9示例性地示出了本申请实施例提供的终端的结构示意图；
图10示例性地示出了本申请实施例提供的接入和移动性管理网元的结构示意图；
图11示例性地示出了本申请另外的实施例提供的终端的结构示意图；
图12示例性地示出了本申请的实施例提供的网关设备的结构示意图；
图13示例性地示出了本申请另外的实施例提供的终端的结构示意图；
图14示例性地示出了本申请另外的实施例提供的网关设备的结构示意图；
图15示例性地示出了本申请另外的实施例提供的接入和移动性管理网元的结构示意图。
具体实施方式
本申请实施例提供了一种终端从空闲态转换到连接态，建立与3GPP网络的连接的方法及装置。下面结合附图对本申请实施例进行详细描述。
图1示例性地示出了本申请实施例适用的网络架构示意图。该网络架构示出了5G网络架构中非3GPP接入的网络架构。
3GPP网络侧主要包括3GPP接入网络、核心网以及网关设备。非3GPP网络侧主要包括非3GPP接入网络，该接入网络可能是非可信网络，比如无线局域网(Wireless Local Area Networks，简称WLAN)。终端可通过3GPP接入网络接入核心网，也可通过非3GPP接入网络接入核心网。
网关设备可以是核心网的组成部分，也可以是独立于核心网的网络设备。该网关设备可以是N3IWF，也可以是ngPDG，或者是其他非3GPP接入网设备。本申请实施例对该网关设备的名称不做限制。以网关设备为N3IWF为例，如图1所示，N3IWF与非3GPP 接入网络和核心网连接。
核心网中包括控制面网元和用户面网元。控制面网元用于实现控制面功能(Control Plane function，简称CPF)，主要可包括用户注册认证、移动性管理及向用户面网元下发数据包转发策略、服务质量(Quality of Service，简称QoS)控制策略等。用户面网元用于实现用户面功能(User Plane Function，简称UPF)，主要可包括分组数据包的转发、QoS控制、计费信息统计等。
控制面网元可进一步包括以下网元：接入和移动性管理功能(Access and Mobility Management Function，简称AMF)与会话管理功能(Session Management Function，简称SMF)。AMF负责终端接入时的注册流程及终端移动过程中的位置管理。SMF负责终端发起业务时网络侧建立相应的会话连接，为用户提供具体服务，尤其是基于SMF与UPF之间的N4接口向UPF下发数据包转发策略、QoS策略等。
上述网络架构中，以网关设备为N3IWF为例，N3IWF与AMF之间的接口称为N2接口，N3IWF与UPF之间的接口称为N3接口，AMF与SMF之间的接口称为N11接口。
上述网络架构中的终端，也可称为用户设备(User Equipment，简称为UE)。该终端可以经非3GPP接入网络和/或3GPP接入网接入网络，与核心网进行通信。该终端可以是移动电话(或称为“蜂窝”电话)、具有移动终端的计算机等，例如，终端还可以是便携式、袖珍式、手持式、计算机内置的或者车载的移动装置，它们与无线接入网交换语音和/或数据。上述网络架构中的终端还可以是设备与设备(Device to Device，简称D2D)终端或者机器与机器(Machine to Machine，简称M2M)终端或者机器类型通信(Machine Type Communication，简称MTC)终端。
当终端与网关设备(如N3IWF)之间的连接释放时，在终端侧，终端的状态进入空闲态。此种情况下，网关设备与核心网之间的连接被释放，在网络侧，该终端的状态也会进入空闲态。当空闲态的终端利用非3GPP网络进行上行传输(比如发送上行信令或发送上行用户数据)或建立与非3GPP接入网连接时时，建立与网络侧设备的连接，从空闲态转换为连接态。
图2示例性地示出了本申请实施例提供的连接建立的总体流程示意图。该流程可基于图1所示的网络架构实现。当空闲态的终端需要利用非3GPP网络进行上行传输时，可执行连接建立流程，从空闲态转换为连接态。比如，当空闲态的终端需要利用WLAN发送上行信令和/或用户数据时，发起与3GPP网络的连接建立流程。空闲态的终端需要建立与非3GPP接入网连接时，也可执行连接建立流程。比如，当空闲态的终端探测到WLAN时，建立与该WLAN的连接，并发起与3GPP网络的连接建立流程。
总体来说，本申请实施例提供的连接建立流程可包括：
S210：终端与网关设备之间建立安全连接。
其中，以图1所示的网络架构为例，所述网关设备为N3IWF。所述安全连接，根据所采用的安全协议的不同可以有不同类型的安全连接。以采用Internet协议安全性(Internet Protocol Security，简称IPSec)协议为例，该安全连接为IPSec连接。
S220：终端通过与网关设备之间的安全连接向核心网设备发送非接入层消息，以触发建立该核心网设备与该终端之间的信令连接。其中，所述核心网设备是指控制面网元，更具体地，以图1所示的网络架构为例，所述控制面网元可以是AMF。所述非接入层消息可以是服务请求消息，也可以是注册请求消息。
上述连接建立后，该终端从空闲态转换为连接态，并可进一步通过建立的连接发送上行信令，或者接收网络侧发送的下行信令。
可选地，在需要发送用户数据的情况下，还可建立终端与核心网设备之间建立数据连接。其中，所述核心网设备是指用户面网元，更具体地，以图1所示的网络架构为例，所述用户面网元可以是UPF。
图3A示例性地示出了图2所示的流程中的S210的一种实现过程，如图所示，该流程可包括：
S301：空闲态的终端向网关设备发送鉴权请求消息。所述鉴权请求消息可以是因特网密钥交换鉴权(Internet Key Exchange Authentication，简称IKE_AUTH)消息。所述鉴权请求消息用于使所述网关设备基于所述鉴权请求消息生成非接入层消息，所述非接入层消息用于请求所述接入和移动性管理网元建立所述信令连接。
S302：网关设备根据该鉴权请求消息，向终端返回鉴权响应消息。
S303：终端接收网关设备返回的鉴权响应消息，建立与该网关设备之间的安全连接。
在一些实施例中，在S301中，终端发送的鉴权请求消息中包括鉴权参数，该鉴权参数用于指示网关设备根据该鉴权参数和终端配置的证书，建立与该终端之间的安全连接；在S302中，网关设备可根据鉴权请求消息中的鉴权参数以及该终端配置的证书对该终端进行鉴权认证，向终端返回鉴权响应消息；在S303中，终端接收到鉴权响应消息后，建立与该网关设备之间的安全连接。
可选地，上述流程中，网关设备在对终端鉴权认证通过后，可将网关设备生成的鉴权参数携带于鉴权响应消息发送给终端。终端接收到鉴权响应消息后，可根据其中携带的鉴权参数以及该终端配置的证书，对该网关设备进行鉴权认证，并在鉴权认证通过后，建立与该网关设备之间的安全连接。
可选地，终端发送的鉴权请求消息中的鉴权参数，还用于指示网关设备在发送服务请求消息或其他类型的请求消息之前，不进行注册流程。网关设备在接收到该鉴权请求消息后，可根据该鉴权参数不发起注册流程。
可选地，终端发送的鉴权请求消息中包含的鉴权参数，还可用于指示网关设备生成服务请求消息或其他类型的请求消息，并将该服务请求消息发送给接入和移动性管理网元。该服务请求消息用于所述接入和移动性管理网元建立该终端和该接入和移动性管理网元之间的信令连接。网关设备可根据该鉴权参数生成服务请求消息，并将该服务请求消息发送给接入和移动性管理网元。
可选地，终端发送的鉴权请求消息中可包括鉴权参数以及指示信息(为清楚起见，这里将该指示信息称为“第一指示信息”)，该第一指示信息用于指示网关设备不进行注册流程，具体地，指示网关设备在向接入和移动性管理网元发送服务请求消息或其他类型的请求消息之前，不进行注册流程。网关设备在接收到该鉴权请求消息后，可根据其中携带的第一指示信息，在发送服务请求或其他类型的请求消息前，不发起注册流程。进一步地，网关设备还可以根据该第一指示信息，保持与所述终端之间的安全连接。所述第一指示信息可以是服务请求指示或连接恢复指示。
可选地，终端发送的鉴权请求消息中的第一指示信息，还可用于指示网关设备生成服务请求消息，并将所述服务请求消息发送给所述接入和移动性管理网元；所述服务请求消息用于所述接入和移动性管理网元建立所述终端和所述接入和移动性管理网元之间的 信令连接。网关设备可根据该第一指示信息，生成服务请求消息，并将所述服务请求消息发送给所述接入和移动性管理网元。
在另一些实施例中，在S301中，终端发送的鉴权请求消息中不包含鉴权参数；在S302中，网关设备向终端返回的鉴权响应消息中可包括EAP-REQ/Identity(EAP-REQ/Identity表示：EAP-请求消息，该EAP-请求消息中携带UE标识请求信息)。UE收到包含有EAP-REQ/Identity的鉴权请求消息后，可向网关设备发起EAP鉴权。
在一些实施例中，终端发送的鉴权请求消息中可包括第二指示信息，用于指示接入和移动性管理网元在所述终端和所述接入和移动性管理网元之间的信令连接建立后保持所述信令连接。所述第二指示信息可包括：服务请求指示、激活标识、保持连接指示、或连接恢复指示中的至少一个。
可选地，上述第二指示信息也可在该非接入层消息发送之前，由终端通过另外的消息发送给接入和移动性管理网元。
图3B示例性地示出了图2所示的流程中的S220的一种实现过程，如图所示，该流程可包括：
S401：终端通过与网关设备之间的安全连接，向接入和移动性管理网元发送接入层消息。该接入层消息可以是服务请求消息(或者其他类型的请求消息)，也可以是注册请求消息。
S402：接入和移动性管理网元根据该非接入层消息，建立与该终端之间的信令连接，并根据该第二指示信息保持该信令连接。该第二指示信息可携带于该非接入层消息中。
可选地，终端在鉴权请求消息中可携带周期性注册类型参数，所述周期性注册类型参数用于指示接入和移动性管理网元采用周期性注册的流程建立与终端之间的信令连接。在S402中，接入和移动性管理网元根据该周期性注册类型参数，对该终端进行周期性类型注册。
以图1所示的网络架构为例，图4示例性地示出了基于第一指示信息进行连接恢复的方法中，第一种方法的信令交互图。如图所示，终端(User Equipment，简称UE，也称用户设备)已经注册到3GPP网络但处于空闲(IDLE)态，当该UE需要利用非3GPP网络进行上行传输或建立与非3GPP接入网连接时，执行如下流程：
步骤1a～1b：UE与非3GPP接入网建立连接，获取该UE的本地IP地址，并获取N3IWF的IP地址。
步骤2a：UE发起IKE_SA_INIT初始请求消息给N3IWF。N3IWF回复该IKE_SA_INIT初始请求消息。
步骤2b:UE发送IKE_AUTH请求消息给N3IWF，该消息中携带用户标识以及AUTH参数。
步骤2c：N3IWF收到IKE_AUTH请求消息后，根据该消息中包含的AUTH参数，对该UE进行鉴权认证，鉴权认证通过后生成N3IWF自己的AUTH参数，并向该UE发送IKE_AUTH回复消息，该回复消息中包含N3IWF生成的AUTH参数。UE收到IKE_AUTH回复消息后，根据该回复消息中包含的AUTH参数对N3IWF进行鉴权认证，鉴权认证通过后，该UE与N3IWF之间完成双向认证，该UE与N3IWF之间的IPSec连接建立完成。
步骤3：UE通过IPSec连接发送NAS消息，所述NAS消息可以是服务请求(Service Request)消息。
步骤4：N3IWF在该IPSec连接上收到NAS消息后，根据终端发送的所述IKE_AUTH请求消息中的AUTH参数，不生成该UE的注册请求(Registration Request)消息发送给AMF，而是将该NAS消息通过N2接口消息发送给AMF。具体地，N3IWF发送初始UE消息(Initial UE message)给AMF，该初始UE消息中包含UE发送的服务请求消息。
步骤5：AMF收到UE发送的NAS消息(如服务请求消息)后，基于本地策略发起与UE之间的鉴权认证流程。上述本地策略可包括：当UE从非3GPP网络接入时，AMF通知鉴权服务器功能(Authentication Server Function，简称AUSF)发起鉴权认证流程。该鉴权认证流程为可选流程，是否执行该鉴权认证流程依据本地策略的内容。
步骤6a～步骤7：AMF与SMF交互N11接口消息，AMF向N3IWF发送N2接口消息，该消息为步骤4中发送的N2接口消息的回复消息，该回复消息中包含服务接受消息。通过上述过程，网络侧针对该UE的分组数据单元(Packet Data Unit，简称PDU)连接建立完成。具体地，针对该UE的N11接口连接建立完成。可选地，如果该UE需要发送用户数据，则针对该UE的N3接口连接也建立完成。
步骤8：N3IWF通过已建立的IPSec连接向UE发送NAS消息，该NAS消息是步骤3中发送的NAS消息的回复消息。该NAS消息可以是服务接受(Service Accept)消息。
步骤9～步骤11：可选地，UE发起子IPSec连接的建立流程。
可选地，在步骤2b中，UE向N3IWF发送IKE_AUTH请求消息之前，可配置证书，并将该证书携带于IKE_AUTH请求消息。N3IWF可根据IKE_AUTH请求消息中包含的AUTH参数和该证书对该UE进行鉴权认证。
可选地，在步骤2c中，N3IWF收到UE发送的IKE_AUTH请求消息后，可配置证书，并将该证书携带于IKE_AUTH回复消息。该UE可根据IKE_AUTH回复消息中包含的AUTH参数和证书对该N3IWF进行鉴权认证。
以图1所示的网络架构为例，图5示例性地示出了基于第一指示信息进行连接恢复的方法中，第二种方法的信令交互图。如图所示，UE已经注册到3GPP网络但处于空闲(IDLE)态，当该UE需要利用非3GPP网络进行上行传输或建立与非3GPP接入网连接时，执行如下流程：
步骤1a～1b：UE与非3GPP接入网建立连接，获取该UE的本地IP地址，并获取N3IWF的IP地址。
步骤2a：UE发起IKE_SA_INIT初始请求消息给N3IWF。N3IWF回复该IKE_SA_INIT初始请求消息。
步骤2b:UE发送IKE_AUTH请求消息给N3IWF，该消息中携带用户标识、AUTH参数以及第一指示信息。本流程中，该第一指示信息为服务请求指示或连接恢复指示中的至少一种。
步骤2c：N3IWF收到IKE_AUTH请求消息后，根据该消息中包含的AUTH参数，对该UE进行鉴权认证，鉴权认证通过后生成N3IWF自己的AUTH参数，并向该UE发送IKE_AUTH回复消息，该回复消息中包含N3IWF生成的AUTH参数。UE收到IKE_AUTH回复消息后，根据该回复消息中包含的AUTH参数对N3IWF进行鉴权认证，鉴权认证通过后，该UE与N3IWF之间完成双向认证，该UE与N3IWF之间的IPSec连接建立完成。
进一步地，N3IWF根据第一指示信息，保持与该UE之间的IPSec连接。具体地，N3IWF根据第一指示信息，在对该UE进行周期性位置更新后，保持与该UE之间的IPSec 连接。例如，N3IWF在接收到AMF发送的针对该UE的连接断开请求消息后，根据该UE发送的服务请求指示或连接恢复指示，拒绝响应该请求消息，以保持与UE之间的IPSec连接。
步骤3：UE通过IPSec连接发送NAS消息，所述NAS消息可以是服务请求(Service Request)消息。
步骤4：N3IWF在该IPSec连接上收到NAS消息后，根据终端发送的所述IKE_AUTH请求消息中包括的AUTH参数或第一指示信息，不生成该UE的注册请求(Registration Request)消息发送给AMF，而是将该NAS消息通过N2接口消息发送给AMF。具体地，N3IWF发送初始UE消息(Initial UE message)给AMF，该初始UE消息中包含UE发送的服务请求消息。
步骤5：AMF收到UE发送的NAS消息(如服务请求消息)后，基于本地策略发起与UE之间的鉴权认证流程。上述本地策略可包括：当UE从非3GPP网络接入时，AMF通知AUSF发起鉴权认证流程。该鉴权认证流程为可选流程，是否执行该鉴权认证流程依据本地策略的内容。
步骤6a～步骤7：AMF与SMF交互N11接口消息，AMF向N3IWF发送N2接口消息，该消息为步骤4中发送的N2接口消息的回复消息，该回复消息中包含服务接受消息。通过上述过程，网络侧针对该UE的PDU连接建立完成。具体地，针对该UE的N11接口连接建立完成。可选地，如果该UE需要发送用户数据，则针对该UE的N3接口连接也建立完成。
步骤8：N3IWF通过已建立的IPSec连接向UE发送NAS消息，该NAS消息是步骤3中发送的NAS消息的回复消息。该NAS消息可以是服务接受(Service Accept)消息。
步骤9～步骤11：可选地，UE发起子IPSec连接的建立流程。
可选地，在步骤2b中，UE向N3IWF发送IKE_AUTH请求消息之前，可配置证书，并将该证书携带于IKE_AUTH请求消息。N3IWF可根据IKE_AUTH请求消息中包含的AUTH参数和该证书对该UE进行鉴权认证。
可选地，在步骤2c中，N3IWF收到UE发送的IKE_AUTH请求消息后，可配置证书，并将该证书携带于IKE_AUTH回复消息。该UE可根据IKE_AUTH回复消息中包含的AUTH参数和证书对该N3IWF进行鉴权认证。
以图1所示的网络架构为例，图6示例性地示出了基于第一指示信息进行连接恢复的方法中，第三种方法的信令交互图。如图所示，UE已经注册到3GPP网络但处于空闲(IDLE)态，当该UE需要利用非3GPP网络进行上行传输或建立与非3GPP接入网连接时，执行如下流程：
步骤1a～1b：UE与非3GPP接入网建立连接，获取该UE的本地IP地址，并获取N3IWF的IP地址。
步骤2a：UE发起IKE_SA_INIT初始请求消息给N3IWF。N3IWF回复该IKE_SA_INIT初始请求消息。
步骤2b:UE发送IKE_AUTH请求消息给N3IWF，该消息中携带用户标识以及第一指示信息。本流程中，该第一指示信息为服务请求指示或连接恢复指示中的至少一种。
步骤2c：N3IWF收到IKE_AUTH请求消息后，不执行与UE间的EAP鉴权流程，而是向该UE发送IKE_AUTH回复消息，该UE与N3IWF之间的IPSec连接建立完成。
进一步地，N3IWF根据所述第一指示信息，保持与该UE之间的IPSec连接。具体地，N3IWF根据第一指示信息，在对该UE进行周期性位置更新后，保持与该UE之间的IPSec连接。例如，N3IWF在接收到AMF发送的针对该UE的连接断开请求消息后，根据该UE发送的服务请求指示或连接恢复指示，拒绝响应该请求消息，以保持与UE之间的IPSec连接。
步骤3：UE通过IPSec连接发送NAS消息，所述NAS消息可以是服务请求(Service Request)消息。
步骤4：N3IWF在该IPSec连接上收到NAS消息后，根据第一指示信息，不生成该UE的注册请求(Registration Request)消息发送给AMF，而是将该NAS消息通过N2接口消息发送给AMF。具体地，N3IWF发送初始UE消息(Initial UE message)给AMF，该初始UE消息中包含UE发送的服务请求消息。
步骤5：AMF收到UE发送的NAS消息(如服务请求消息)后，基于本地策略发起与UE之间的鉴权认证流程。上述本地策略可包括：当UE从非3GPP网络接入时，AMF通知AUSF发起鉴权认证流程。该鉴权认证流程为可选流程，是否执行该鉴权认证流程依据本地策略的内容。
步骤6a～步骤7：AMF与SMF交互N11接口消息，AMF向N3IWF发送N2接口消息，该消息为步骤4中发送的N2接口消息的回复消息，该回复消息中包含服务接受消息。通过上述过程，网络侧针对该UE的PDU连接建立完成。具体地，针对该UE的N11接口连接建立完成。可选地，如果该UE需要发送用户数据，则针对该UE的N3接口连接也建立完成。
步骤8：N3IWF通过已建立的IPSec连接向UE发送NAS消息，该NAS消息是步骤3中发送的NAS消息的回复消息。该NAS消息可以是服务接受(Service Accept)消息。
步骤9～步骤11：可选地，UE发起子IPSec连接的建立流程。
图4至图6所描述的流程中，N3IWF基于AUTH参数建立与UE之间的IPSec连接，并生成初始UE消息将上述IPSec连接中传递的NAS消息发送给AMF，从而建立N3IWF与AMF的N2接口连接，进而建立完成UE与AMF之间的信令连接。
以图1所示的网络架构为例，图7示例性地示出了基于第二指示信息进行连接恢复的方法中第一种方法的信令交互图。如图所示，UE已经注册到3GPP网络但处于空闲(IDLE)态，当该UE需要利用非3GPP网络进行上行传输或建立与非3GPP接入网连接时，执行如下流程：
步骤1a～1b：UE与非3GPP接入网建立连接，获取该UE的本地IP地址，并获取N3IWF的IP地址。
步骤2a：UE发起IKE_SA_INIT初始请求消息给N3IWF。N3IWF回复该IKE_SA_INIT初始请求消息。
步骤2b:UE发送IKE_AUTH请求消息给N3IWF，该消息中携带用户标识但不包含AUTH参数，表明需要基于EAP进行鉴权。该IKE_AUTH请求消息中还包括周期性注册类型(Registration type)参数以及第二指示信息。其中，第二指示信息可包括服务请求指示、激活标识、保持连接指示、连接恢复指示中的至少一个。
步骤2c～步骤2d：可选地，N3IWF收到IKE_AUTH请求消息后，向该UE发送IKE_AUTH回复消息，该回复消息中包含EAP-REQ/Identity(EAP-REQ/Identity表示： EAP-请求消息，该EAP-请求消息中携带UE标识请求信息)。UE收到包含有EAP-REQ/Identity的IKE_AUTH请求消息后，向N3IWF发送IKE_AUTH请求消息，该请求消息中包含有用户标识以及EAP-REQ/Identity。
步骤3：N3IWF接收到IKE_AUTH请求消息后，生成注册请求消息，向AMF发送N2接口消息，该N2接口消息中包括注册请求消息，该注册请求消息中包含用户标识、周期性注册类型参数、第二指示信息。其中，周期性注册类型参数和第二指示信息，与N3IWF接收到的IKE_AUTH请求消息中携带的相应信息内容相同。
可选地，N3IWF接收到IKE_AUTH请求消息后，存储其中携带的第二指示信息。这样，当N3IWF与AMF之间的N2接口连接释放时，N3IWF可基于存储的第二指示信息保持与UE之间的IPSec连接。例如，AMF与N3IWF之间针对该UE的N2接口连接释放后，AMF向N3IWF发送针对该UE的连接断开请求消息，N3IWF可根据该UE发送的第二指示信息，拒绝响应该请求消息，以保持与UE之间的IPSec连接。
步骤4：AMF基于本地策略通知AUSF完成UE的EAP鉴权认证，此过程中，N3IWF与该UE之间的IPSec连接建立完成。上述本地策略可包括：当UE从非3GPP网络接入时，AMF通知AUSF发起鉴权认证流程。该鉴权认证流程为可选流程，是否执行该鉴权认证流程依据本地策略的内容。
可选地，AMF存储该UE发送的第二指示信息，并可基于该第二指示信息，保持该UE的N2接口连接。具体地，当对该UE进行周期性位置更新后，AMF可根据存储的该UE的第二指示信息保持该UE在AMF与N3IWF之间的N2接口连接。
步骤5～步骤6：AMF发送N2接口消息给N3IWF，该消息可以是注册接受消息。N3IWF通过已建立的IPSec连接将该消息转发给UE。
步骤7：UE通过IPSec连接发送NAS消息，所述NAS消息可以是服务请求(Service Request)消息。
步骤8：N3IWF在该IPSec连接上收到NAS消息后，根据第二指示信息，将该NAS消息通过N2接口消息发送给AMF。
步骤9a～步骤10：AMF收到UE发送的NAS消息(如服务请求消息)后，与SMF交互N11接口消息，AMF向N3IWF发送N2接口消息，该消息为步骤8中发送的N2接口消息的回复消息，该回复消息中包含服务接受消息。通过上述过程，网络侧针对该UE的PDU连接可以建立完成。具体地，针对该UE的N11接口连接建立完成。可选地，如果该UE需要发送用户数据，则针对该UE的N3接口连接也建立完成。
步骤11：N3IWF通过已建立的IPSec连接向UE发送NAS消息，该NAS消息是步骤7中发送的NAS消息的回复消息。该NAS消息可以是服务接受(Service Accept)消息。
步骤11～步骤14：可选地，UE发起子IPSec连接的建立流程。
在其他的例子中，UE可将第二指示信息和注册类型参数携带与其他消息，比如携带于步骤2d中的IKE_AUTH请求消息中发送给N3IWF。
可选地，在一些实施例中，上述图7所示的流程中可省略步骤7，即，N3IWF可根据第二指示信息生成服务请求消息，并将所述服务请求消息发送给AMF，以使AMF建立该UE和该AMF之间的信令连接。
以图1所示的网络架构为例，图8示例性地示出了基于第二指示信息进行连接恢复的方法中第二种方法的信令交互图。如图所示，UE已经注册到3GPP网络但处于空闲 (IDLE)态，当该UE需要利用非3GPP网络进行上行传输或建立与非3GPP接入网连接时，执行如下流程：
步骤1a～1b：UE与非3GPP接入网建立连接，获取该UE的本地IP地址，并获取N3IWF的IP地址。
步骤2a：UE发起IKE_SA_INIT初始请求消息给N3IWF。N3IWF回复该IKE_SA_INIT初始请求消息。
步骤2b:UE发送IKE_AUTH请求消息给N3IWF，该消息中携带用户标识、AUTH参数、周期性注册类型参数以及第二指示信息。其中，第二指示信息可包括服务请求指示、激活标识、保持连接指示、或连接恢复指示中的至少一个。
步骤2c：N3IWF收到IKE_AUTH请求消息后，根据该消息中携带的AUTH参数对UE进行鉴权认证，鉴权认证通过后生成N3IWF自己的AUTH参数，向该UE发送IKE_AUTH回复消息，该回复消息中包含N3IWF生成的AUTH参数，不包含EAP-REQ/Identity。
UE收到IKE_AUTH回复消息后，根据该回复消息中包含的AUTH参数对N3IWF进行鉴权认证，鉴权认证通过后，该UE与N3IWF之间完成双向认证，该UE与N3IWF之间的IPSec连接建立完成。
步骤3：N3IWF生成注册请求消息，向AMF发送N2接口消息，该N2接口消息中包括注册请求消息，该注册请求消息中包含用户标识、周期性注册类型参数、第二指示信息。其中，周期性注册类型参数和第二指示信息，与N3IWF接收到的IKE_AUTH请求消息中携带的相应信息内容相同。
可选地，N3IWF接收到IKE_AUTH请求消息后，存储其中携带的第二指示信息。这样，当N3IWF与AMF之间的N2接口连接释放时，N3IWF可基于存储的第二指示信息保持与UE之间的IPSec连接。例如，AMF与N3IWF之间针对该UE的N2接口连接释放后，AMF向N3IWF发送针对该UE的连接断开请求消息，N3IWF可根据该UE发送的第二指示信息，拒绝响应该请求消息，以保持与UE之间的IPSec连接。
步骤4：AMF基于本地策略通知AUSF完成UE的EAP鉴权认证，此过程中，N3IWF与该UE之间的IPSec连接建立完成。上述本地策略可包括：当UE从非3GPP网络接入时，AMF通知AUSF发起鉴权认证流程。该鉴权认证流程为可选流程，是否执行该鉴权认证流程依据本地策略的内容。
可选地，AMF存储该UE发送的第二指示信息，并可基于该第二指示信息，保持该UE的N2接口连接。具体地，当对该UE进行周期性位置更新后，AMF可根据存储的该UE的第二指示信息保持该UE在AMF与N3IWF之间的N2接口连接。
步骤5～步骤6：AMF发送N2接口消息给N3IWF，该消息可以是注册接受消息。N3IWF通过已建立的IPSec连接将该消息转发给UE。
步骤7：UE通过IPSec连接发送NAS消息，所述NAS消息可以是服务请求(Service Request)消息。
步骤8：N3IWF在该IPSec连接上收到NAS消息后，根据第二指示信息，将该NAS消息通过N2接口消息发送给AMF。
步骤9a～步骤10：AMF收到UE发送的NAS消息(如服务请求消息)后，与SMF交互N11接口消息，AMF向N3IWF发送N2接口消息，该消息为步骤8中发送的N2接口 消息的回复消息，该回复消息中包含服务接受消息。通过上述过程，网络侧针对该UE的PDU连接可以建立完成。具体地，针对该UE的N11接口连接建立完成。可选地，如果该UE需要发送用户数据，则针对该UE的N3接口连接也建立完成。
步骤11：N3IWF通过已建立的IPSec连接向UE发送NAS消息，该NAS消息是步骤7中发送的NAS消息的回复消息。该NAS消息可以是服务接受(Service Accept)消息。
步骤11～步骤14：可选地，UE发起子IPSec连接的建立流程。
可选地，N3IWF接收到UE发送的IKE_AUTH请求消息后，可根据该UE的证书以及该消息中包含的AUTH参数，对该UE进行鉴权认证。其中，N3IWF可在UE的周期性位置更新过程中从AMF获得该UE的证书。
可选地，在一些实施例中，上述图8所示的流程中可省略步骤7，即，N3IWF可根据第二指示信息生成服务请求消息，并将所述服务请求消息发送给AMF，以使AMF建立该UE和该AMF之间的信令连接。
图7和图8所示的流程中，基于周期性注册流程建立UE与网络侧的连接，并基于第二指示信息保持上述连接。UE在连接状态下发送服务请求消息给网络侧，建立相关PDU连接，从而实现UE从空闲态转为连接态，为后续UE发起服务请求提供连接通道。
基于相同的技术构思，本申请实施例还提供了一种终端。图9示例性地示出了本申请实施例提供的终端的结构示意图，该终端可实现前述实施例描述的连接建立流程。
如图9所示，该终端可包括：指示模块901、连接建立请求模块902。指示模块901用于在所述终端处于空闲态且需要利用非3GPP网络进行上行传输或建立与非3GPP接入网连接时，向接入和移动性管理网元发送指示信息，所述指示信息用于指示所述接入和移动性管理网元在所述终端和所述接入和移动性管理网元之间的信令连接建立后保持所述信令连接；连接建立请求模块902用于向网关设备发送鉴权请求消息，用于使所述网关设备基于所述鉴权请求消息生成非接入层消息，所述非接入层消息用于请求所述接入和移动性管理网元建立所述信令连接。
可选地，所述鉴权请求消息中包括周期性注册类型参数，所述周期性注册类型参数用于指示所述接入和移动性管理网元采用周期性注册的流程建立与所述终端之间的信令连接。
可选地，所述指示信息包括于所述鉴权请求消息中。
可选地，所述指示信息包括：服务请求指示、激活标识、保持连接指示、或连接恢复指示中的至少一个。
可选地，连接建立请求模块902还用于：通过与网关设备之间的安全连接向所述接入和移动性管理网元发送非接入层消息；其中，所述安全连接是根据所述终端向所述网关设备发送的鉴权请求消息建立的，所述鉴权请求消息中包括鉴权参数，所述鉴权参数用于指示所述网关设备采用所述鉴权参数建立所述网关设备和所述终端之间的安全连接。
基于相同的技术构思，本申请实施例还提供了一种接入和移动性管理网元。图10示例性地示出了本申请实施例提供的接入和移动性管理网元的结构示意图。该接入和移动性管理网元可实现前述实施例描述的连接建立流程。
如图10所示，该接入和移动性管理网元可包括：连接处理模块1001、连接建立模块1002。连接处理模块1001用于接收空闲态的终端发送的指示信息，根据所述指示信息在所述终端和所述接入和移动性管理网元之间的信令连接建立后保持所述信令连接；连接建 立模块1002用于根据非接入层消息，建立与所述终端之间的信令连接。
可选地，所述非接入层消息中包括周期性注册类型参数；连接建立模块1002具体用于：根据所述周期性注册类型参数，采用周期性注册的流程建立与所述终端之间的信令连接。
可选地，所述指示信息包括于所述非接入层消息中。
可选地，所述指示信息包括：服务请求指示、激活标识、保持连接指示、或连接恢复指示中的至少一个。
基于相同的技术构思，本申请实施例还提供了一种终端。图11示例性地示出了本申请实施例提供的终端的结构示意图。该终端可实现前述实施例描述的连接建立流程。
如图11所示，本申请实施例提供的终端可包括：鉴权请求模块1101、安全连接建立模块可1102。鉴权请求模块1101用于在所述终端处于空闲态且需要利用非3GPP网络进行上行传输或建立与非3GPP接入网连接时，向网关设备发送鉴权请求消息，其中，所述鉴权请求中包括鉴权参数或指示信息中的至少一个；以及，接收所述网关设备返回的鉴权响应消息；安全连接建立模块1102用于根据所述鉴权参数和所述终端配置的证书，建立与所述网关设备之间的安全连接。
可选地，该终端还可包括：信令连接请求模块1103，用于通过所述安全连接向接入和移动性管理网元发送非接入层消息，所述非接入层消息用于所述接入和移动性管理网元建立所述终端和所述接入和移动性管理网元之间的信令连接。可选地，该终端还可包括信令连接建立模块1104，用于与接入和移动性管理网元建立信令连接。
可选地，所述鉴权参数还用于指示所述网关设备在发送所述非接入层消息之前，不进行注册流程。
可选地，所述鉴权请求中还包括指示信息，所述指示信息用于指示所述网关设备在发送所述非接入层消息之前，不进行注册流程。
可选地，所述鉴权参数还用于指示所述网关设备生成服务请求消息，并将所述服务请求消息发送给所述接入和移动性管理网元；所述服务请求消息用于所述接入和移动性管理网元建立所述终端和所述接入和移动性管理网元之间的信令连接。
可选地，所述指示信息为服务请求指示或连接恢复指示。
可选地，所述鉴权请求消息中的指示信息，还用于指示所述网关设备生成服务请求消息，并将所述服务请求消息发送给所述接入和移动性管理网元；所述服务请求消息用于所述接入和移动性管理网元建立所述终端和所述接入和移动性管理网元之间的信令连接。
可选地，所述非接入层消息为服务请求消息。
基于相同的技术构思，本申请实施例还提供了一种网关设备。图12示例性地示出了本申请实施例提的网关设备的结构示意图，该网关设备可实现前述实施例描述的在终端侧实现的连接建立流程。
如图12所示，该网关设备可包括：鉴权模块1201、安全连接建立模块1202。鉴权模块1201用于接收空闲态的终端发送的鉴权请求消息，其中，所述鉴权请求中包括鉴权参数或指示信息中的至少一个，所述指示信息用于指示所述网关设备保持建立的所述安全连接；安全连接建立模块1202用于根据所述鉴权参数和所述终端配置的证书，建立与所述终端之间的安全连接。
可选地，该网关设备中还包括信令连接请求模块1203，用于通过与所述终端之间的安全连接接收所述终端发送的非接入层消息，并将所述非接入层消息发送给接入和移动性管理网元，所述非接入层消息用于所述接入和移动性管理网元建立所述终端和所述接入和移动性管理网元之间的信令连接。
可选地，所述信令连接请求模块还用于：根据所述鉴权参数生成服务请求消息，并将所述服务请求消息发送给所述接入和移动性管理网元；所述服务请求消息用于所述接入和移动性管理网元建立所述终端和所述接入和移动性管理网元之间的信令连接。
可选地，信令连接请求模块1203还用于：根据所述鉴权参数，在发送所述非接入层消息之前不进行注册流程。
可选地，鉴权请求中包括指示信息时，信令连接请求模块1203还用于：根据所述指示信息，在发送所述非接入层消息之前不进行注册流程。
可选地，所述鉴权请求中包括指示信息时，所述信令连接请求模块还用于：根据所述指示信息生成服务请求消息，并将所述服务请求消息发送给所述接入和移动性管理网元；所述服务请求消息用于所述接入和移动性管理网元建立所述终端和所述接入和移动性管理网元之间的信令连接。
可选地，所述指示信息为服务请求指示或连接恢复指示。
可选地，所述非接入层消息为服务请求消息。
基于相同的技术构思，本申请实施例还提供了一种终端。图13示例性地示出了本申请实施例提供的终端的结构示意图。
如图13所示，该终端包括：通信接口1301、处理器1302以及存储器1303，存储器1303用于存储处理器1302所需执行的程序代码。通信接口1301用于进行消息交互。处理器1302用于执行存储器所存储的程序代码，具体用于执行前述实施例中终端侧执行的方法。
处理器1302可以是一个中央处理模块(central processing unit，简称CPU)，或者为数字处理模块等等。存储器1303可以是非易失性存储器，比如硬盘(hard disk drive，简称HDD)或固态硬盘(solid-state drive，简称SSD)等，还可以是易失性存储器(volatile memory)，例如随机存取存储器(random-access memory，简称RAM)。存储器1303是能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。
本申请实施例中不限定上述通信接口1301、处理器1302以及存储器1303之间的具体连接介质。本申请实施例在图13中以存储器1303、处理器1302以及通信接口1301之间通过总线1304连接，总线在图13中以粗线表示，其它部件之间的连接方式，仅是进行示意性说明，并不引以为限。所述总线可以分为地址总线、数据总线、控制总线等。为便于表示，图13中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
本发明实施例还提供了一种计算机可读存储介质，用于存储为执行上述处理器1301所需执行的计算机软件指令，其包含用于执行上述处理器所需执行的程序。
基于相同的技术构思，本申请实施例还提供了一种网关设备。图14示例性地示出了本申请实施例提供的网关的结构示意图。
如图14所示，该网关设备包括：通信接口1401、处理器1402以及存储器1403，存储器1403用于存储处理器1402所需执行的程序代码。通信接口1401用于进行消息交互。 处理器1402用于执行存储器所存储的程序代码，具体用于执行前述实施例中网关设备侧执行的方法。
处理器1402可以是一个中央处理模块(central processing unit，简称CPU)，或者为数字处理模块等等。存储器1403可以是非易失性存储器，比如硬盘(hard disk drive，简称HDD)或固态硬盘(solid-state drive，简称SSD)等，还可以是易失性存储器(volatile memory)，例如随机存取存储器(random-access memory，简称RAM)。存储器1403是能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。
本申请实施例中不限定上述通信接口1401、处理器1402以及存储器1403之间的具体连接介质。本申请实施例在图14中以存储器1403、处理器1402以及通信接口1401之间通过总线1404连接，总线在图14中以粗线表示，其它部件之间的连接方式，仅是进行示意性说明，并不引以为限。所述总线可以分为地址总线、数据总线、控制总线等。为便于表示，图14中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
本发明实施例还提供了一种计算机可读存储介质，用于存储为执行上述处理器1401所需执行的计算机软件指令，其包含用于执行上述处理器所需执行的程序。
基于相同的技术构思，本申请实施例还提供了一种网关设备。图15示例性地示出了本申请实施例提供的接入和移动性管理网元的结构示意图。
如图15所示，该网元包括：通信接口1501、处理器1502以及存储器1503，存储器1503用于存储处理器1502所需执行的程序代码。通信接口1501用于进行消息交互。处理器1502用于执行存储器所存储的程序代码，具体用于执行前述实施例中接入和移动性管理网元侧执行的方法。
处理器1502可以是一个中央处理模块(central processing unit，简称CPU)，或者为数字处理模块等等。存储器1503可以是非易失性存储器，比如硬盘(hard disk drive，简称HDD)或固态硬盘(solid-state drive，简称SSD)等，还可以是易失性存储器(volatile memory)，例如随机存取存储器(random-access memory，简称RAM)。存储器1503是能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。
本申请实施例中不限定上述通信接口1501、处理器1502以及存储器1503之间的具体连接介质。本申请实施例在图15中以存储器1503、处理器1502以及通信接口1501之间通过总线1504连接，总线在图15中以粗线表示，其它部件之间的连接方式，仅是进行示意性说明，并不引以为限。所述总线可以分为地址总线、数据总线、控制总线等。为便于表示，图15中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
本发明实施例还提供了一种计算机可读存储介质，用于存储为执行上述处理器1501所需执行的计算机软件指令，其包含用于执行上述处理器所需执行的程序。
本领域内的技术人员应明白，本申请的实施例可提供为方法、系统、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请的方法、设备(系统)、和计算机程序产品的流程图和/或 方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的精神和范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (53)

  1. 一种连接建立方法，其特征在于，包括：
    空闲态的终端在需要利用非3GPP网络进行上行传输或建立与非3GPP接入网连接时，向接入和移动性管理网元发送指示信息，所述指示信息用于指示所述接入和移动性管理网元在所述终端和所述接入和移动性管理网元之间的信令连接建立后保持所述信令连接；
    所述终端向网关设备发送鉴权请求消息，用于使所述网关设备基于所述鉴权请求消息生成非接入层消息，所述非接入层消息用于请求所述接入和移动性管理网元建立所述信令连接。
  2. 如权利要求1所述的方法，其特征在于，所述鉴权请求消息中包括周期性注册类型参数，所述周期性注册类型参数用于指示所述接入和移动性管理网元采用周期性注册的流程建立与所述终端之间的信令连接。
  3. 如权利要求1所述的方法，其特征在于，所述非接入层消息为注册请求消息。
  4. 如权利要求1所述的方法，其特征在于，所述指示信息包括于所述鉴权请求消息中。
  5. 如权利要求1-4中任一项所述的方法，其特征在于，所述指示信息包括：服务请求指示、激活标识、保持连接指示、或连接恢复指示中的至少一个。
  6. 如权利要求1-5中任一项所述的方法，其特征在于，还包括：
    所述终端通过与网关设备之间的安全连接向所述接入和移动性管理网元发送服务请求消息；其中，所述安全连接是根据所述终端向所述网关设备发送的鉴权请求消息建立的。
  7. 如权利要求6所述方法，其特征在于，所述鉴权请求消息中包括鉴权参数，所述鉴权参数用于指示所述网关设备采用所述鉴权参数建立所述网关设备和所述终端之间的安全连接。
  8. 一种连接建立方法，其特征在于，包括：
    接入和移动性管理网元接收空闲态的终端发送的指示信息，所述指示信息用于指示所述接入和移动性管理网元在所述终端和所述接入和移动性管理网元之间的信令连接建立后保持所述信令连接；
    所述接入和移动性管理网元根据非接入层消息，建立与所述终端之间的信令连接。
  9. 如权利要求8所述的方法，其特征在于，所述非接入层消息中包括周期性注册类型参数；
    所述建立与所述终端之间的信令连接，包括：
    所述接入和移动性管理网元根据所述周期性注册类型参数，采用周期性注册的流程建立与所述终端之间的信令连接。
  10. 如权利要求8所述的方法，其特征在于，所述指示信息包括于所述非接入层消息中。
  11. 如权利要求8-10中任一项所述的方法，其特征在于，所述指示信息包括：服务请求指示、激活标识、保持连接指示、或连接恢复指示中的至少一个。
  12. 一种连接建立方法，其特征在于，包括：
    空闲态的终端在需要利用非3GPP网络进行上行传输或建立与非3GPP接入网连接时，向网关设备发送鉴权请求消息，其中，所述鉴权请求中包括鉴权参数或指示信息中 的至少一个，所述鉴权参数用于指示所述网关设备根据所述鉴权参数和所述终端配置的证书，建立与所述终端之间的安全连接；
    所述终端接收所述网关设备返回的鉴权响应消息，建立与所述网关设备之间的安全连接。
  13. 如权利要求12所述的方法，其特征在于，所述方法还包括：
    所述终端通过所述安全连接向接入和移动性管理网元发送非接入层消息，所述非接入层消息用于所述接入和移动性管理网元建立所述终端和所述接入和移动性管理网元之间的信令连接。
  14. 如权利要求13所述的方法，其特征在于，所述鉴权参数还用于指示所述网关设备在发送所述非接入层消息之前，不进行注册流程。
  15. 如权利要求12所述的方法，其特征在于，所述鉴权参数还用于指示所述网关设备生成服务请求消息，并将所述服务请求消息发送给所述接入和移动性管理网元；所述服务请求消息用于所述接入和移动性管理网元建立所述终端和所述接入和移动性管理网元之间的信令连接。
  16. 如权利要求12所述的方法，其特征在于，所述鉴权请求消息中的指示信息，还用于指示所述网关设备在发送所述非接入层消息之前，不进行注册流程。
  17. 如权利要求12所述的方法，其特征在于，所述鉴权请求消息中的指示信息，还用于指示所述网关设备生成服务请求消息，并将所述服务请求消息发送给所述接入和移动性管理网元；所述服务请求消息用于所述接入和移动性管理网元建立所述终端和所述接入和移动性管理网元之间的信令连接。
  18. 如权利要求12-17中任一项所述的方法，其特征在于，所述指示信息为服务请求指示或连接恢复指示。
  19. 如权利要求13、14、16中任一项所述的方法，其特征在于，所述非接入层消息为服务请求消息。
  20. 一种连接建立方法，其特征在于，包括：
    网关设备接收空闲态的终端发送的鉴权请求消息，其中，所述鉴权请求中包括鉴权参数或指示信息中的至少一个，所述指示信息用于指示所述网关设备保持建立的所述安全连接；
    所述网关设备根据所述鉴权参数和所述终端配置的证书，建立与所述终端之间的安全连接。
  21. 如权利要求20所述的方法，其特征在于，还包括：
    所述网关设备通过与所述终端之间的安全连接接收所述终端发送的非接入层消息，并将所述非接入层消息发送给接入和移动性管理网元，所述非接入层消息用于所述接入和移动性管理网元建立所述终端和所述接入和移动性管理网元之间的信令连接。
  22. 如权利要求21所述的方法，其特征在于，还包括：
    所述网关设备根据所述鉴权参数，在发送所述非接入层消息之前不进行注册流程。
  23. 如权利要求20所述的方法，其特征在于，还包括：
    所述网关设备根据所述鉴权参数生成服务请求消息，并将所述服务请求消息发送给所述接入和移动性管理网元；所述服务请求消息用于所述接入和移动性管理网元建立所述终端和所述接入和移动性管理网元之间的信令连接。
  24. 如权利要求20所述的方法，其特征在于，所述鉴权请求中包括指示信息时，所述方法还包括：
    所述网关设备根据所述指示信息，在发送所述非接入层消息之前不进行注册流程。
  25. 如权利要求20所述的方法，其特征在于，所述鉴权请求中包括指示信息时，所述方法还包括：
    所述网关设备根据所述指示信息生成服务请求消息，并将所述服务请求消息发送给所述接入和移动性管理网元；所述服务请求消息用于所述接入和移动性管理网元建立所述终端和所述接入和移动性管理网元之间的信令连接。
  26. 如权利要求20-25中任一项所述的方法，其特征在于，所述指示信息为服务请求指示或连接恢复指示。
  27. 如权利要求21、22、24中任一项所述的方法，其特征在于，所述非接入层消息为服务请求消息。
  28. 一种终端，其特征在于，包括：
    指示模块，用于在所述终端处于空闲态且需要利用非3GPP网络进行上行传输或建立与非3GPP接入网连接时，向接入和移动性管理网元发送指示信息，所述指示信息用于指示所述接入和移动性管理网元在所述终端和所述接入和移动性管理网元之间的信令连接建立后保持所述信令连接；
    连接建立请求模块，用于向网关设备发送鉴权请求消息，用于使所述网关设备基于所述鉴权请求消息生成非接入层消息，所述非接入层消息用于请求所述接入和移动性管理网元建立所述信令连接。
  29. 如权利要求28所述的终端，其特征在于，所述鉴权请求消息中包括周期性注册类型参数，所述周期性注册类型参数用于指示所述接入和移动性管理网元采用周期性注册的流程建立与所述终端之间的信令连接。
  30. 如权利要求31所述的终端，其特征在于，所述指示信息包括于所述鉴权请求消息中。
  31. 如权利要求28-29中任一项所述的终端，其特征在于，所述指示信息包括：服务请求指示、激活标识、保持连接指示、或连接恢复指示中的至少一个。
  32. 如权利要求28-30中任一项所述的终端，其特征在于，所述连接建立请求模块还用于：通过与网关设备之间的安全连接向所述接入和移动性管理网元发送服务请求消息；其中，所述安全连接是根据所述终端向所述网关设备发送的鉴权请求消息建立的。
  33. 如权利要求32所述的终端，其特征在于，所述鉴权请求消息中包括鉴权参数，所述鉴权参数用于指示所述网关设备采用所述鉴权参数建立所述网关设备和所述终端之间的安全连接。
  34. 一种接入和移动性管理网元，其特征在于，包括：
    连接处理模块，用于接收空闲态的终端发送的指示信息，根据所述指示信息在所述终端和所述接入和移动性管理网元之间的信令连接建立后保持所述信令连接；
    连接建立模块，用于根据非接入层消息，建立与所述终端之间的信令连接。
  35. 如权利要求34所述的网元，其特征在于，所述非接入层消息中包括周期性注册类型参数；
    所述连接建立模块具体用于：根据所述周期性注册类型参数，采用周期性注册的流程 建立与所述终端之间的信令连接。
  36. 如权利要求34所述的网元，其特征在于，所述指示信息包括于所述非接入层消息中。
  37. 如权利要求34-36中任一项所述的网元，其特征在于，所述指示信息包括：服务请求指示、激活标识、保持连接指示、或连接恢复指示中的至少一个。
  38. 一种终端，其特征在于，包括：
    鉴权请求模块，用于在所述终端处于空闲态且需要利用非3GPP网络进行上行传输或建立与非3GPP接入网连接时，向网关设备发送鉴权请求消息，其中，所述鉴权请求中包括鉴权参数或指示信息中的至少一个；以及，接收所述网关设备返回的鉴权响应消息；
    安全连接建立模块，用于根据所述鉴权参数和所述终端配置的证书，建立与所述网关设备之间的安全连接。
  39. 如权利要求38所述的终端，其特征在于，还包括：
    信令连接请求模块，用于通过所述安全连接向接入和移动性管理网元发送非接入层消息，所述非接入层消息用于所述接入和移动性管理网元建立所述终端和所述接入和移动性管理网元之间的信令连接。
  40. 如权利要求39所述的终端，其特征在于，所述鉴权参数还用于指示所述网关设备在发送所述非接入层消息之前，不进行注册流程。
  41. 如权利要求38所述的终端，其特征在于，所述鉴权参数还用于指示所述网关设备生成服务请求消息，并将所述服务请求消息发送给所述接入和移动性管理网元；所述服务请求消息用于所述接入和移动性管理网元建立所述终端和所述接入和移动性管理网元之间的信令连接。
  42. 如权利要求38所述的终端，其特征在于，所述鉴权请求中的指示信息用于指示所述网关设备在发送所述非接入层消息之前，不进行注册流程。
  43. 如权利要求38所述的终端，其特征在于，所述鉴权请求消息中的指示信息，还用于指示所述网关设备生成服务请求消息，并将所述服务请求消息发送给所述接入和移动性管理网元；所述服务请求消息用于所述接入和移动性管理网元建立所述终端和所述接入和移动性管理网元之间的信令连接。
  44. 如权利要求38-43中任一项所述的终端，其特征在于，所述指示信息为服务请求指示或连接恢复指示。
  45. 如权利要求39、40、43-44中任一项所述的终端，其特征在于，所述非接入层消息为服务请求消息。
  46. 一种网关设备，其特征在于，包括：
    鉴权模块，用于接收空闲态的终端发送的鉴权请求消息，其中，所述鉴权请求中包括鉴权参数或指示信息中的至少一个，所述指示信息用于指示所述网关设备保持建立的所述安全连接；
    安全连接建立模块，用于根据所述鉴权参数和所述终端配置的证书，建立与所述终端之间的安全连接。
  47. 如权利要求46所述的设备，其特征在于，还包括：
    信令连接请求模块，用于通过与所述终端之间的安全连接接收所述终端发送的非接入层消息，并将所述非接入层消息发送给接入和移动性管理网元，所述非接入层消息用于所 述接入和移动性管理网元建立所述终端和所述接入和移动性管理网元之间的信令连接。
  48. 如权利要求47所述的设备，其特征在于，所述信令连接请求模块还用于：根据所述鉴权参数，在发送所述非接入层消息之前不进行注册流程。
  49. 如权利要求46所述的设备，其特征在于，所述信令连接请求模块还用于：
    根据所述鉴权参数生成服务请求消息，并将所述服务请求消息发送给所述接入和移动性管理网元；所述服务请求消息用于所述接入和移动性管理网元建立所述终端和所述接入和移动性管理网元之间的信令连接。
  50. 如权利要求47-49中任一项所述的设备，其特征在于，所述鉴权请求中包括指示信息时，所述信令连接请求模块还用于：根据所述指示信息，在发送所述非接入层消息之前不进行注册流程。
  51. 如权利要求46所述的设备，其特征在于，所述鉴权请求中包括指示信息时，所述信令连接请求模块还用于：
    根据所述指示信息生成服务请求消息，并将所述服务请求消息发送给所述接入和移动性管理网元；所述服务请求消息用于所述接入和移动性管理网元建立所述终端和所述接入和移动性管理网元之间的信令连接。
  52. 如权利要求46所述的设备，其特征在于，所述指示信息为服务请求指示或连接恢复指示。
  53. 如权利要求47-52中任一项所述的设备，其特征在于，所述非接入层消息为服务请求消息。
PCT/CN2017/077383 2017-03-20 2017-03-20 一种连接建立方法及装置 WO2018170703A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/CN2017/077383 WO2018170703A1 (zh) 2017-03-20 2017-03-20 一种连接建立方法及装置

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2017/077383 WO2018170703A1 (zh) 2017-03-20 2017-03-20 一种连接建立方法及装置

Publications (1)

Publication Number Publication Date
WO2018170703A1 true WO2018170703A1 (zh) 2018-09-27

Family

ID=63584023

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/077383 WO2018170703A1 (zh) 2017-03-20 2017-03-20 一种连接建立方法及装置

Country Status (1)

Country Link
WO (1) WO2018170703A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112312489A (zh) * 2019-07-31 2021-02-02 华为技术有限公司 传输数据的方法、通信装置和通信系统
WO2021104405A1 (zh) * 2019-11-29 2021-06-03 华为技术有限公司 一种通信方法及设备
TWI730644B (zh) * 2019-02-26 2021-06-11 聯發科技股份有限公司 通訊設備和連接恢復方法
US20220132602A1 (en) * 2019-01-15 2022-04-28 Datang Mobile Communications Equipment Co.,Ltd. Pdu session activation method and apparatus, and paging method and apparatus

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101312561A (zh) * 2007-05-24 2008-11-26 华为技术有限公司 无线通信系统及无线通信方法
CN102017709A (zh) * 2008-05-09 2011-04-13 爱立信电话股份有限公司 在3gpp网络与非3gpp网络之间的无缝切换
CN103748926A (zh) * 2011-06-22 2014-04-23 阿尔卡特朗讯 在受信任的非3gpp接入上的ip连接支持
CN104904263A (zh) * 2013-07-08 2015-09-09 三星电子株式会社 用于控制wlan系统中的过载的装置和方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101312561A (zh) * 2007-05-24 2008-11-26 华为技术有限公司 无线通信系统及无线通信方法
CN102017709A (zh) * 2008-05-09 2011-04-13 爱立信电话股份有限公司 在3gpp网络与非3gpp网络之间的无缝切换
CN103748926A (zh) * 2011-06-22 2014-04-23 阿尔卡特朗讯 在受信任的非3gpp接入上的ip连接支持
CN104904263A (zh) * 2013-07-08 2015-09-09 三星电子株式会社 用于控制wlan系统中的过载的装置和方法

Cited By (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20220132602A1 (en) * 2019-01-15 2022-04-28 Datang Mobile Communications Equipment Co.,Ltd. Pdu session activation method and apparatus, and paging method and apparatus
US11997729B2 (en) * 2019-01-15 2024-05-28 Datang Mobile Communications Equipment Co., Ltd. PDU session activation method and apparatus, and paging method and apparatus
TWI730644B (zh) * 2019-02-26 2021-06-11 聯發科技股份有限公司 通訊設備和連接恢復方法
US11419174B2 (en) 2019-02-26 2022-08-16 Mediatek Inc. Connection recovery method for recovering a connection between a communications apparatus and a data network and the associated communications apparatus
CN112312489A (zh) * 2019-07-31 2021-02-02 华为技术有限公司 传输数据的方法、通信装置和通信系统
CN112312489B (zh) * 2019-07-31 2021-12-24 华为技术有限公司 传输数据的方法、通信装置和通信系统
US11968575B2 (en) 2019-07-31 2024-04-23 Huawei Technologies Co., Ltd. Data transmission method, communication apparatus, and communication system
WO2021104405A1 (zh) * 2019-11-29 2021-06-03 华为技术有限公司 一种通信方法及设备

Similar Documents

Publication Publication Date Title
US11895157B2 (en) Network security management method, and apparatus
CN108574969B (zh) 多接入场景中的连接处理方法和装置
US8665819B2 (en) System and method for providing mobility between heterogenous networks in a communication environment
WO2018161796A1 (zh) 多接入场景中的连接处理方法和装置
WO2020029938A1 (zh) 安全会话方法和装置
WO2018145654A1 (zh) 实现多接入管理的方法、装置及计算机存储介质
EP3771242A1 (en) Key generation method and relevant apparatus
EP3737032B1 (en) Key updating method and apparatus
US8661510B2 (en) Topology based fast secured access
US20200344245A1 (en) Message sending method and apparatus
EP2317694B1 (en) Method and system and user equipment for protocol configuration option transmission
WO2015096138A1 (zh) 分流方法、用户设备、基站和接入点
WO2018170703A1 (zh) 一种连接建立方法及装置
WO2023279776A1 (zh) 多模终端接入控制方法、装置、电子设备及存储介质
US20220053332A1 (en) Secondary authentication for wwan vpn
WO2019096279A1 (zh) 一种安全通信方法和装置
WO2022253083A1 (zh) 一种公私网业务的隔离方法、装置及系统
WO2022134089A1 (zh) 一种安全上下文生成方法、装置及计算机可读存储介质
CN116368833A (zh) 针对边缘计算服务的安全连接的建立和认证的方法和系统
WO2013166909A1 (zh) Eap认证触发方法及系统、接入网设备、终端设备
WO2023246457A1 (zh) 安全决策协商方法及网元
WO2024001889A1 (zh) V2x策略请求方法及装置
WO2023213184A1 (zh) 一种通信方法及通信装置
WO2023213208A1 (zh) 一种通信方法及通信装置
WO2023137760A1 (zh) 无线通信方法、远端ue、ausf以及amf

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17901723

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17901723

Country of ref document: EP

Kind code of ref document: A1