WO2019024866A1 - 一种接入网络的方法、设备及系统 - Google Patents

一种接入网络的方法、设备及系统 Download PDF

Info

Publication number
WO2019024866A1
WO2019024866A1 PCT/CN2018/097989 CN2018097989W WO2019024866A1 WO 2019024866 A1 WO2019024866 A1 WO 2019024866A1 CN 2018097989 W CN2018097989 W CN 2018097989W WO 2019024866 A1 WO2019024866 A1 WO 2019024866A1
Authority
WO
WIPO (PCT)
Prior art keywords
authentication
message
network
information
terminal device
Prior art date
Application number
PCT/CN2018/097989
Other languages
English (en)
French (fr)
Inventor
朱元萍
黄亚达
庞伶俐
张毅
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP18841051.8A priority Critical patent/EP3657834B1/en
Publication of WO2019024866A1 publication Critical patent/WO2019024866A1/zh
Priority to US16/751,801 priority patent/US11197238B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/18—Selecting a network or a communication service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/16—Discovering, processing access restriction or access information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W88/00—Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
    • H04W88/16—Gateway arrangements

Definitions

  • the present application relates to the field of communications technologies, and in particular, to a method, device, and system for accessing a network.
  • the home user deploys the customer premise equipment (CPE).
  • CPE customer premise equipment
  • the CPE connects to the radio access network deployed by the operator through the wireless air interface.
  • the :RAN radio accesses the network
  • the terminal device may be a set-top box (STB) of a mobile phone, a computer or a television.
  • STB set-top box
  • the network needs to provide authentication and address allocation services, and these devices can smoothly carry out corresponding services.
  • a set-top box if it is required to receive an internet protocol television (IPTV) service, after being authenticated in the IPTV network, it is assigned a legal internet protocol (IP) address. Can only request various programs of IPTV.
  • IPTV internet protocol television
  • IP internet protocol television
  • the authentication mode of the mobile terminal is to send the mobile terminal information to the core network node through a non-access stratum (NAS) message of the control plane, generally a mobile management entity (mobile)
  • the management entity queries the home subscriber server (HSS) for the terminal equipment information, and then authenticates the packet data network gateway (PGW). After the terminal device allocates an IP address, it sends it to the mobile terminal through the NAS message.
  • the typical access modes commonly used by the terminal are as follows: an access method based on the X-network point-to-point protocol over X (PPPoX), based on the X network.
  • the access mode of the IP protocol (internet protocol over X, IPoX) and the access mode based on the IEEE802.1x standard.
  • Each access method corresponds to a different authentication method, for example:
  • the PPPoX access mode provides point-to-point connections on different types of networks, and accesses and remotely connects broadband networks through PPP dialing.
  • the terminal establishes a tunnel between the broadband remote access router (BRAS) and the PPP session.
  • BRAS broadband remote access router
  • PPP session negotiation including the link control protocol (LCP) negotiation, authentication, and network control protocol (NCP) negotiation).
  • the terminal sends the authentication packet to the BRAS based on the LCP negotiation authentication mode, and then the BRAS passes the Remote Authentication Dial In User Service (RADIUS) protocol to the authentication server (AAA server). Send an authentication request.
  • the BRAS assigns an IP address to the fixed network terminal and returns it to the terminal that requested the address.
  • RADIUS Remote Authentication Dial In User Service
  • the common authentication mode is dynamic host configuration protocol (DHCP):
  • DHCP dynamic host configuration protocol
  • the terminal obtains an IP address in static configuration or DHCP mode. Or authenticate the user by means of quick authentication.
  • the terminal broadcasts a DHCP request.
  • the terminal forwards the DHCP request of the terminal to the DHCP server.
  • the DHCP server sends an authentication request to the authentication server (AAA server).
  • AAA server authentication server
  • the DHCP server requests the DHCP server.
  • the fixed network terminal of the address assigns a legal IP address, returns it to the gateway, and then forwards it to the requesting terminal.
  • the IEEE 802.1x-based access method introduces the extensible authentication protocol (EAP) of the PPP protocol. More authentication mechanisms can be used, such as the Message-Digest Algorithm-5. MD5), one-time passwords (OTP), smart cards, security pre-shared keys, and other extended authentication methods.
  • EAP extensible authentication protocol
  • More authentication mechanisms can be used, such as the Message-Digest Algorithm-5. MD5), one-time passwords (OTP), smart cards, security pre-shared keys, and other extended authentication methods.
  • the network access method based on NAS messages in the mobile network is currently only applicable to mobile terminals.
  • the CPE as a mobile terminal can use this method for authentication and address allocation, but other terminal devices such as computers and TV set-top boxes belong to
  • the control plane protocol in the mobile network is not supported, and it is currently impossible to perform authentication and address request through NAS messages. They will still initiate requests in accordance with traditional fixed network authentication protocols (PPPoX or IPoX, etc.), which need to be forwarded via the CPE and the base station's radio access network, as well as backhaul networks to the mobile gateway, such as PGW.
  • PPPoX or IPoX, etc. traditional fixed network authentication protocols
  • Nodes that perform authentication and address assignment to the external network such as the gateway device BNG/BRAS/SR (referred to as BNG in the text for convenience of description), DHCP server, etc., are not supported in the existing mobile network, so the network needs to be After the node is changed, the access authentication requirement of the terminal device connected to the CPE is adapted.
  • the embodiment of the present application provides a method for accessing the network, which can fully utilize the existing network to complete the process of the terminal device accessing the network, especially
  • the mobile network is used to complete the terminal device access process under the resident node, thereby avoiding laying a dedicated network channel and improving the utilization rate of the mobile network.
  • the embodiments of the present application also provide corresponding devices and systems.
  • the first aspect of the present application provides a method for accessing a network, including: receiving, by a resident node, a first message from a terminal device, where the first message includes an authentication request; the resident node may be a customer premise equipment (English) Abbreviation: CPE), the resident node sends a second message, the second message is processed by the network node as a third message, the network node includes a RAN device or a management device (such as an MME), and the third message is used by the gateway device to identify the authentication request and And the authentication mode of the terminal device accessing the network, the second message may be sent by the resident node, and the RAN device may process the second message, and after processing, obtain a third message, the authentication request and/or the terminal device
  • the authentication mode of the access network is used by the network to authenticate the terminal device; the resident node receives the information from the authentication result returned by the network, and transmits the information of the authentication result to the terminal device.
  • the information of the authentication result may be carried in the signaling message, for example, carried in the authentication return message, and may be carried in other messages.
  • the information of the authentication result in the embodiment of the present application may be a network device.
  • the authentication result sent, in the process of returning the information of the authentication result to the resident node by the gateway device and other devices, may also add other information, for example, routing configuration information, and the authentication, for example, in the authentication return message.
  • the resulting information is returned together. It can be seen from the above first aspect that the solution can fully utilize the existing network to complete the process of the terminal device accessing the network, for example, using the mobile network to complete the access process of the terminal device connected to the CPE, thereby avoiding laying a dedicated network channel. , improve the utilization of mobile networks.
  • the embodiments of the present application also provide corresponding devices and systems.
  • the authentication request and/or the authentication mode of the terminal device accessing the network is used by the network to authenticate the terminal device, including: the authentication mode is used to indicate
  • the gateway device sends an authentication request to the network device, where the authentication request is used to instruct the network device to authenticate the terminal device; the resident node receives the information from the network returned the authentication result, including: the resident node receives the gateway from the network device Information about the authentication result returned by the device.
  • the second message includes an authentication request and indication information, where the indication information includes, to indicate, that the terminal device accesses the network The way of authentication.
  • the indication information may be an authentication type indication information, where the authentication type indication information may include an identifier indication of the authentication mode and/or an indication of the authentication protocol identifier, and is used to indicate the authentication mode of the terminal device accessing the network.
  • This implementation is a type of authentication method that ensures the diversity of authentication.
  • the second message is transmitted to the gateway device by using an authentication channel corresponding to the authentication mode, where the authentication channel is used.
  • Determine the corresponding authentication method For example, the identifier of the authentication channel may be mapped to the authentication mode, and the corresponding authentication mode may be determined according to the authentication channel, and may not be limited to the mapping relationship between the identifier of the authentication channel and the authentication mode, or may be Other correspondences may be as long as the correspondence between the authentication channel and the authentication mode can be achieved.
  • the authentication channel may be a channel for transmitting data and/or signaling, and is not limited to transmitting only authentication messages.
  • the authentication channel is established between the resident node and the gateway device, and the authentication channel may be a bearer or a transmission tunnel, or may be an APN/DNN or PDN connection or a PDU session or a network slice, etc., when the channel is established. Then determine the authentication method or authentication protocol used. In this way, when the authentication request of the terminal device or the resident node is transmitted, the authentication type indication information may be transmitted without transmitting the authentication request on the corresponding channel. This implementation is another way of authentication, ensuring the diversity of authentication.
  • the method further includes: the information carried by the resident node in the data packet between the terminal device and the resident node according to the first message
  • the authentication mode of the terminal device accessing the network is identified; the resident node processes the indication information and the authentication request for indicating the authentication mode to obtain the second message.
  • the method of obtaining the second message may be: adding the indication information to the first message to obtain the second message, or regenerating a second message according to the authentication request and the indication information.
  • the second message includes indication information, where the indication information may be a protocol layer of the resident node above the access layer of the communication protocol hollow port or The second node sends the second message to the RAN device, where the resident node sends the second message to the RAN device, where the resident node sends the second message to the RAN device by using the EPS packet of the evolved packet system;
  • the second message includes the indication information
  • the indication information and the authentication request are included in the third message, and the third message is transmitted through the transmission channel between the RAN device and the gateway device.
  • This implementation provides a user plane authentication method to ensure the diversity of authentication methods.
  • the second message is a first non-access stratum NAS message, where the first NAS message includes an authentication request and indication information; the resident node Sending the second message, including: the first node message is sent by the resident node to the RAN device, and the first NAS message is sent to the management device by using the RAN device, where the authentication request message and the indication information in the first NAS message are obtained by the management device, and Sent by the management device to the gateway device.
  • an authentication method of the control plane is provided, which ensures the diversity of the authentication methods.
  • the method further includes: the resident node sends another message for accessing the network by using the RAN device, where the other A message is used by the gateway device to identify the authentication request of the resident node accessing the network and/or the authentication mode of the resident node accessing the network, and the authentication request and the authentication mode of the resident node accessing the network are used for the network to authenticate the resident node;
  • the node receives information from the authentication results returned by the network.
  • This implementation provides an authentication method for the resident node to access the network.
  • the authentication request and the authentication mode of the resident node accessing the network are used by the network to perform authentication on the resident node, including: the authentication mode is used to indicate
  • the gateway device sends an authentication request to the network device, where the authentication request is used to instruct the network device to authenticate the resident node; the resident node receives the information from the authentication result returned by the network, including: the resident node receives the authentication returned by the network device through the gateway device. The resulting information.
  • another message includes an authentication request and another indication information, where another indication information includes, used to indicate that the resident node accesses the network Information on the authentication method.
  • the third message is transmitted to the gateway device by using an authentication channel corresponding to the authentication mode, and the authentication channel is used to determine the corresponding authentication mode.
  • another message is a second NAS message.
  • the first NAS message and/or the second NAS message is a first type NAS message, and the first type NAS message is used for a message that the terminal device and/or the resident node accesses the network; or, the first NAS message and/or the second NAS message is a second type of NAS message, and the second type of NAS message includes a cell, where the cell is included in the terminal Information about the device and/or the resident node accessing the network; the cell included in the second type of NAS message may be a currently existing cell in which a field dedicated to placing information of the access network is set, or
  • the first NAS message and/or the second NAS message is a third type of NAS message, and the third type of NAS message includes a cell, where the cell is used to carry information of the terminal device and/or the resident node accessing the network, and the cell includes A cell or a message container for accessing, the cell for accessing may be
  • the information of the authentication result in the thirteenth possible implementation manner includes the information of the authentication pass, and the return message of the information corresponding to the authentication result is further Including address allocation information and/or routing configuration information, the return message of the information corresponding to the authentication result may be a return message containing information of the authentication result, or may be after the return message of the information including the authentication result.
  • the routing configuration information includes reference information allocated by the network device for the routing configuration of the resident node, or configuration information for the routing configuration of the resident node determined by the gateway device according to the reference information of the routing configuration, where the address allocation information is included as a terminal.
  • the reference information of the route configuration may be reference information for the uplink route configuration of the resident node, and the configuration information of the route configuration may be configuration information for the uplink route configuration of the resident node.
  • the resident node saves configuration information for the routing configuration of the resident node, and the configuration information is used by the resident node to determine the service corresponding to the service of the terminal device. Routing configuration.
  • the second message further includes authentication additional information, where the authentication additional information includes an identity indicating the resident node At least one of information indicating a location of the terminal device and/or a location of the resident node and channel information for transmitting the authentication request; the channel information for transmitting the authentication request includes at least one of the following information: a tunnel identifier, a bearer identifier, And the session ID.
  • the second aspect of the present application provides a method for accessing a network, where the gateway device receives an authentication request, where the authentication request is sent by the terminal device to the resident node by using the first message, where the resident node may be a user premises equipment, and the first The message is processed by the resident node as a second message, the second message is processed by the network node as a third message, the third message includes an authentication request and/or an authentication mode of the terminal device accessing the network; and the gateway device identifies the third message according to the third message The right request and/or the authentication mode of the terminal device accessing the network.
  • the gateway device sends the corresponding message to the corresponding network device in the network according to the authentication mode.
  • the authentication request is used to instruct the network device to authenticate the terminal device; the gateway device sends the information of the authentication result to the RAN device or the management device of the radio access network, where the information of the authentication result includes the network
  • the authentication result returned by the device to the terminal device.
  • the method further includes: the gateway device receiving the indication information, where the indication information is included in the second message and the third message, where the indication information is used to indicate the terminal device access
  • the authentication method of the network may be an authentication type indication information, where the authentication type indication information may include an identifier indication of the authentication mode and/or an indication of the authentication protocol identifier, and is used to indicate the authentication mode of the terminal device accessing the network.
  • This implementation is a type of authentication method that ensures the diversity of authentication.
  • the gateway device receives the authentication request, where the gateway device receives the authentication request by using an authentication channel corresponding to the authentication mode, where the authentication channel is used to determine the corresponding Authentication method.
  • the authentication channel is a channel for data and/or signaling transmission, and is not limited to only transmitting an authentication message.
  • the authentication channel may be established between the CPE and the gateway device, and the authentication channel may be a bearer or a transmission tunnel, or may be an APN/DNN or PDN connection or a PDU session or a network slice, etc., when the channel is established, Determine the authentication method or authentication protocol to be adopted.
  • the authentication type indication information may not be transmitted, and the authentication request or the authentication request may be transmitted on the corresponding channel.
  • This implementation is another way of authentication, ensuring the diversity of authentication.
  • the gateway device receives the authentication request and the indication information, including: the transmission between the RAN device and the gateway device by the gateway device through the radio access network
  • the channel receives the third message sent by the RAN device, where the third message includes an authentication request and indication information included in the second message.
  • the gateway device receives the authentication request and the indication information, where the gateway device receives the authentication request and the indication information sent by the management device, and the authentication The request and the first indication information are obtained by the management device from the first non-access stratum NAS message and sent by the management device, and the first NAS message is sent by the resident node to the management device by using the radio access network RAN device.
  • the gateway device adds the authentication additional information to the fourth message that is sent to the network device, where the authentication additional information includes
  • the second message further includes at least one of an identifier indicating the location of the resident node, information indicating the location of the terminal device and/or the location of the resident node, channel information for transmitting the authentication request, and channel information for transmitting the authentication request. It includes at least one of the following information: a tunnel identifier, a bearer identifier, and a session identifier.
  • the method further includes: the gateway device records a mapping relationship between the identifier information of the resident node and the identifier of the terminal device, where the mapping relationship is used for sending the The information requesting the corresponding authentication result.
  • the method further includes: the gateway device receiving an authentication request that the resident node uses to access the network, where the authentication request is included in In another message sent by the resident node, the gateway device identifies the authentication request of the resident node accessing the network and/or the authentication mode of the resident node accessing the network according to another message; the gateway device sends an authentication request to the network device according to the authentication mode, and the authentication request is sent.
  • the network device is used to authenticate the resident node; the gateway device forwards the information of the authentication result returned by the network device to the resident node.
  • the another message includes an authentication request and another indication information, where another indication information includes, used to indicate that the resident node accesses the network Information on the authentication method.
  • the third message is transmitted to the gateway device by using an authentication channel corresponding to the authentication mode, and the authentication channel is used to identify the corresponding authentication mode.
  • the method further includes: determining, by the gateway device, the configuration of the routing configuration according to the reference information of the routing configuration allocated by the network device Information, the reference information of the routing configuration is that the information of the authentication result is allocated by the network device when the information passed through the authentication, the gateway device sends the information to the resident node via the RAN device, or via the management device and the wireless network access RAN device Configuration information of the route configuration.
  • another indication information and an authentication request received by the gateway device are obtained by the management device from the second NAS message sent by the resident node.
  • the third aspect of the present application provides a method for accessing a network, where the management device receives an authentication request sent by a resident node, where the authentication request is sent by the terminal device to the resident node by using the first message, and the management device sends the request to the gateway device.
  • a third message the third message includes an authentication request and/or an authentication mode of the terminal device accessing the network, and the third message is used by the gateway device to identify the authentication request and/or the authentication mode of the terminal device accessing the network.
  • the weight mode is used to instruct the gateway device to send the information of the authentication result returned by the gateway device to the resident node, where the information of the authentication result includes an authentication result returned by the network device to the terminal device.
  • the solution can fully utilize the existing network to complete the process of the terminal device accessing the network, for example, using the mobile network to complete the access process of the terminal device connected to the CPE, thereby avoiding laying a dedicated network channel. , improve the utilization of mobile networks.
  • the embodiments of the present application also provide corresponding devices and systems.
  • the first message is processed by the resident node as the second message
  • the management device processes the second message into the third message
  • the second message and the third message include the authentication request And indication information, wherein the indication information includes an authentication manner for indicating that the terminal device accesses the network.
  • the first message is processed by the resident node as the second message
  • the management device processes the second message into the third message
  • the second message is the first non-access stratum NAS.
  • the method further includes: the management device acquiring the authentication request and the indication information from the first NAS message, and sending the indication information when sending the authentication request.
  • the method further includes: the management device receives another message for the resident node to access the network, and The message is used by the gateway device to identify the authentication request of the resident node to access the network and/or the authentication mode of the resident node accessing the network.
  • the authentication mode is used to instruct the gateway device to send an authentication request to the network device; the management device sends an authentication request to the gateway device.
  • the authentication request is used to instruct the network device to authenticate the resident node.
  • another message includes an authentication request and another indication information, where another indication information includes a location information indicating that the resident node accesses the network Information on the authentication method.
  • the method further includes: the management device acquires another indication information and an authentication request from the second NAS message; the management device sends the information to the gateway device
  • the authentication request includes: the management device sends the authentication protocol type information and the authentication request by using a transmission channel established with the gateway device.
  • a fourth aspect of the present application provides a method for accessing a network, including: a resident node sending a first message to a radio access network RAN device, where the first message includes an authentication request, and the first message is processed by the network node as a second message, where the second message is used by the gateway device to identify an authentication request of the resident node to access the network and/or an authentication mode of the resident node accessing the network, the authentication request And/or an authentication mode in which the resident node accesses the network is used by the network to authenticate the resident node; the resident node receives information from an authentication result of the network.
  • the solution can fully utilize the existing network to complete the process of the terminal device accessing the network, for example, using the mobile network to complete the access process of the terminal device connected to the CPE, thereby avoiding laying a dedicated network channel. , improve the utilization of mobile networks.
  • the embodiments of the present application also provide corresponding devices and systems.
  • the authentication request and/or the authentication mode of the resident node accessing the network is used by a network to authenticate the resident node, including
  • the authentication mode is used to instruct the gateway device to send the authentication request to the network device, where the authentication request is used to instruct the network device to perform authentication on the resident node;
  • Receiving information from the authentication result returned by the network comprising: the resident node receiving information from an authentication result returned by the network device through the gateway device.
  • the first message includes the authentication request and indication information, where the indication information is included Information indicating an authentication mode of the resident node accessing the network.
  • the first message is transmitted to the gateway device by using an authentication channel corresponding to the authentication mode,
  • the authentication channel is used to determine the corresponding authentication mode.
  • the authentication channel is a channel for transmitting data and/or signaling, and is not limited to only transmitting an authentication message.
  • the first message is a non-access stratum NAS message.
  • the NAS message is a first type of NAS message, and the first type of NAS message is used by the resident node accessing The message of the network; or,
  • the NAS message is a second type of NAS message, where the second type of NAS message includes a cell, where the cell includes information for the resident node to access the network; or
  • the NAS message is a third type of NAS message, and the third type of NAS message includes a cell, where the cell is used to carry information that the resident node accesses the network, where the cell includes The incoming cell or message container.
  • the information of the authentication result includes information that is passed through authentication, and information corresponding to the authentication result
  • the return message further includes address allocation information and/or routing configuration information, where the routing configuration information includes reference information of a routing configuration allocated by the network device, or a route determined by the gateway device according to the reference information of the routing configuration.
  • the configured configuration information, the address allocation information including a network address pre-allocated or allocated to the terminal device.
  • the first message further includes authentication additional information, where the authentication additional information includes indicating the station At least one of an identity of the node, information indicating the location of the resident node, and channel information for transmitting the authentication request; the channel information for transmitting the authentication request includes at least one of the following information: a tunnel identifier , the bearer ID, and the session ID.
  • a fifth aspect of the present disclosure provides a method for accessing a network, where the gateway device receives an authentication request that is used by a resident node to access a network, where the authentication request is included in a first message sent by the resident node.
  • the first message is processed by the network node as a second message; the gateway device identifies, according to the second message, an authentication request of the resident node to access the network and/or the resident node accesses the network
  • the authentication device sends the authentication request to the network device according to the authentication mode, where the authentication request is used by the network device to authenticate the resident node; the gateway device is wireless
  • the access network RAN device or the management device sends the information of the authentication result, where the information of the authentication result includes the authentication result returned by the network device to the terminal device.
  • the solution can fully utilize the existing network to complete the process of the terminal device accessing the network, for example, using the mobile network to complete the access process of the terminal device connected to the CPE, thereby avoiding laying a dedicated network channel. , improve the utilization of mobile networks.
  • the embodiments of the present application also provide corresponding devices and systems.
  • the first message includes the authentication request and indication information, where the indication information includes, used to indicate that the resident node accesses the network Information on the method of authentication.
  • the first message is transmitted to the gateway device by using an authentication channel corresponding to the authentication mode, where the authentication channel is used to determine a corresponding The authentication method.
  • the authentication channel may be a channel for transmitting data and/or signaling, and is not limited to transmitting only authentication messages.
  • the first message is a non-access stratum NAS message
  • the method further includes: the gateway device receiving the indication information And the indication information and the authentication request are obtained by the management device from the NAS message sent by the resident node.
  • the method further includes: referring, by the gateway device, reference information of a route configuration allocated by the network device, Determining configuration information of the routing configuration of the resident node, where the configuration information is a routing configuration corresponding to the service of the terminal device, where the reference information of the routing configuration is that the information of the authentication result includes the information that the authentication passes Network device assigned.
  • the gateway device adds the authentication additional information to a third message that is sent to the network device
  • the authentication additional information includes at least one of information indicating an identity of the resident node, information indicating a location of the resident node, and channel information for transmitting the authentication request; the transmitting request for transmission
  • the channel information includes at least one of the following information: a tunnel identifier, a bearer identifier, and a session identifier.
  • a sixth aspect of the present application provides a method for accessing a network, including: a management device receiving an authentication request used by a resident node to access a network, where the authentication request is included in a first message sent by the resident node; The management device processes the first message as a second message; the second message is used by the gateway device to identify an authentication request of the resident node to access the network and/or the resident node access.
  • the authentication mode of the network the authentication mode is used to instruct the gateway device to send the authentication request to the network device, and the management device sends the authentication request to the gateway device, where
  • the authentication request is used to instruct the network device to authenticate the resident node; the management device sends information about the authentication result returned by the gateway device to the resident node, where the information of the authentication result includes The authentication result returned by the network device to the terminal device.
  • the solution can fully utilize the existing network to complete the process of the terminal device accessing the network, for example, using the mobile network to complete the access process of the terminal device connected to the CPE, thereby avoiding laying a dedicated network channel. , improve the utilization of mobile networks.
  • the embodiments of the present application also provide corresponding devices and systems.
  • the first message includes the authentication request and indication information, where the indication information includes, used to indicate that the resident node accesses the network Information on the method of authentication.
  • the first message is a non-access stratum NAS message
  • the management device sends the authentication request to the gateway device Previously, the method further includes:
  • the management device acquires the indication information and the authentication request from the NAS message
  • the management device sends the indication information and the authentication request by using a transmission channel established between the gateway device and the gateway device.
  • the method further includes: the management device receiving the authentication authorization information sent by the gateway device, and saving the authentication Authorization information.
  • a seventh aspect of the present application provides a method for accessing a network, including: receiving, by a resident node, a first message from a terminal device, where the first message includes a first authentication request;
  • the resident node transmits a first non-access stratum NAS message to the management device by using the access network AN device, where the first NAS message includes the first authentication request, and the authentication request is received by the management device
  • the first NAS message is sent to the authentication device, so that the authentication device authenticates the terminal device according to the authentication request.
  • the resident node receives the information of the first authentication result returned by the management device, and sends the information of the first authentication result to the terminal device, where the information of the first authentication result includes the authentication device The result of the authentication of the terminal device.
  • the first message and the first NAS message further include first indication information, where the first indication information is used to indicate that the terminal device is connected And the first indication information is used to instruct the authentication device to perform authentication on the terminal device according to the authentication manner indicated by the first indication information.
  • the resident node receives the authentication device by using the The information of the first authentication result returned by the management device, including:
  • the resident node receives the second NAS message, where the second NAS message includes the first authentication result information and/or address information of the terminal device.
  • the first NAS message further includes an identifier indicating the resident node, indicating the location of the terminal device and/or the At least one of information of a location of a resident node, channel information for transmitting the first authentication request;
  • the channel information for transmitting the first authentication request includes at least one of the following information: a tunnel identifier, a bearer identifier, and a session identifier.
  • the method further includes:
  • the resident node sends a third NAS message to the management device, where the third NAS message includes a second authentication request, and the second authentication request is obtained by the management device from the third NAS message. And sending to the authentication device, so that the authentication device authenticates the resident node according to the second authentication request;
  • the resident node receives the information of the second authentication result returned by the management device, where the information of the second authentication result includes an authentication result returned by the authentication device to the resident node.
  • the third NAS message further includes second indication information, where the second indication information is used to indicate an authentication mode of the resident node to access the network, and the second indication information is used to indicate that the authentication device is in accordance with the The authentication mode indicated by the second indication information authenticates the resident node.
  • the first NAS message and/or the second NAS message and/or the third NAS message are first type NAS messages, and the first type NAS message is used for the terminal device or the resident node a message accessing the network; or,
  • the first NAS message and/or the second NAS message and/or the third NAS message are a second type of NAS message, where the second type of NAS message includes a cell, and the cell includes Information that the terminal device or the resident node accesses the network; or
  • the first NAS message and/or the second NAS message and/or the third NAS message are third type NAS messages, where the third type NAS message includes a cell, and the cell is used to carry The terminal device or the resident node accesses information of the network, and the cell includes a cell or a message container for accessing the network.
  • the third NAS message further includes authentication additional information, where the authentication additional information includes indicating the station At least one of an identity of the node, information indicating a location of the resident node, and channel information for transmitting the second authentication request, where the channel information for transmitting the second authentication request includes: a tunnel identifier and / or bearer identity and / or session ID.
  • the eighth aspect of the present application provides a method for accessing a network, where the gateway device receives a first authentication request sent by the management device, where the first authentication request is sent by the terminal device to the resident node by using the first message.
  • the first message is that the first non-access stratum NAS message or the first message is processed by the resident node as a first non-access stratum NAS message, and the first NAS message includes the first authentication request,
  • the first authentication request is learned by the management device from the first NAS message;
  • the gateway device Sending, by the gateway device, the information of the first authentication result to the management device, where the information of the first authentication result is sent by the management device to the resident node by using a second NAS message, the first authentication
  • the result information includes an authentication result returned by the authentication device for the terminal device.
  • the first message and the first NAS message further include first indication information, where the first indication information is used to indicate that the terminal device is connected And the first indication information is used to instruct the authentication device to perform authentication on the terminal device according to the authentication manner indicated by the first indication information.
  • the method further includes:
  • the gateway device adds the authentication additional information to the second message sent to the authentication device, where the authentication additional information includes an identifier indicating the resident node, indicating the location and/or location of the terminal device. At least one of information of a location of the resident node and channel information for transmitting the first authentication request;
  • the channel information for transmitting the first authentication request includes at least one of the following information: a tunnel identifier, a bearer identifier, and a session identifier.
  • the method further includes:
  • the gateway device receives a second authentication request sent by the management device, where the second authentication request is included in a third NAS message sent by the resident node, and the second authentication request is received by the management device from the Known in the three NAS messages;
  • the gateway device sends the information of the second authentication result to the management device, where the information of the second authentication result includes an authentication result returned by the authentication device to the resident node.
  • the third NAS message further includes second indication information, where the second indication information is used to indicate that the resident node is connected. And the second indication information is used to indicate that the authentication device performs authentication on the resident node according to the authentication manner indicated by the second indication information.
  • the method further includes:
  • the gateway device adds the authentication additional information to a third message sent to the authentication device, where the authentication additional information includes an identifier indicating the resident node, information indicating the location of the resident node, and At least one of channel information for transmitting the second authentication request;
  • the channel information for transmitting the second authentication request includes at least one of the following information: a tunnel identifier, a bearer identifier, and a session identifier.
  • a ninth aspect of the present application provides a method for accessing a network, including: a management device receiving a first NAS message sent by a resident node, where the first NAS message includes a first authentication request, where the first authentication request includes In the first message sent by the terminal device, the first authentication request is used to indicate that the authentication device performs authentication on the terminal device; and the management device obtains the first authentication from the first NAS message.
  • the solution can fully utilize the existing network to complete the process of the terminal device accessing the network, for example, using the mobile network to complete the access process of the terminal device connected to the CPE, thereby avoiding laying a dedicated network channel. , improve the utilization of mobile networks.
  • the embodiments of the present application also provide corresponding devices and systems.
  • the first message further includes first indication information, where the first indication information is used to indicate that the terminal device accesses the network And the first indication information is used by the authentication device to authenticate the terminal device according to the authentication manner indicated by the first indication information.
  • the method further includes:
  • the management device receives address information returned from the gateway device
  • the management device carries the information of the first authentication result and/or the address information in a second NAS message
  • the management device sends the second NAS message to the resident node.
  • the method further includes:
  • the management device receives a third NAS message from the resident node, where the third NAS message includes a second authentication request;
  • the management device extracts the second authentication request from the third NAS message
  • the management device sends an authentication request to the authentication device, so that the authentication device performs authentication on the terminal device according to the authentication request, where the authentication request is the second authentication request or the management device Generated according to the second authentication request;
  • the management device sends information of the second authentication result to the resident node, where the information of the second authentication result includes an authentication result returned by the authentication device to the resident node.
  • the third NAS message further includes second indication information, where the second indication information is used to indicate that the resident node is connected In the authentication mode of the network, the second indication information is used to instruct the authentication device to perform authentication on the resident node according to the authentication manner indicated by the second indication information.
  • a tenth aspect of the present application provides a method for accessing a network, where the terminal device sends a first message to a resident node, where the first message is a non-access stratum NAS message, and the first message includes a first authentication.
  • the authentication request is used to indicate that the authentication device authenticates the terminal device, and the protocol stack of the terminal device includes an Ethernet protocol layer, or a local area network protocol layer or a personal area network under the non-access NAS layer.
  • a protocol layer the terminal device receives information of a first authentication result returned by the resident node.
  • the solution can fully utilize the existing network to complete the process of the terminal device accessing the network, for example, using the mobile network to complete the access process of the terminal device connected to the CPE, thereby avoiding laying a dedicated network channel. , improve the utilization of mobile networks.
  • the embodiments of the present application also provide corresponding devices and systems.
  • the first message further includes first indication information, where the first indication information is used to indicate an authentication mode of the terminal device accessing the network
  • the first indication information is used by the authentication device to authenticate the terminal device according to the authentication manner indicated by the first indication information.
  • the tenth aspect of the present application provides a resident node, where the terminal device connected to the resident node accesses the network, the resident node includes: a memory, a transceiver, and at least one processor, where the memory stores instructions.
  • the memory, the transceiver, and the at least one processor are interconnected by a line, and the transceiver is configured to perform the operation of transmitting and receiving at the resident node side in the optional aspect of the first aspect or the first aspect; at least one processor call instruction
  • the message processing or control operation performed on the resident node side in the first aspect or any of the alternative implementations of the first aspect is performed.
  • the twelfth aspect of the present application provides a gateway device, where the terminal device connected to the resident node accesses the network, the gateway device includes: a memory, a transceiver, and at least one processor, where the memory stores instructions The memory, the transceiver, and the at least one processor are interconnected by a line, and the transceiver is configured to perform the operation of transmitting and receiving on the gateway device side in any optional implementation manner of the second aspect or the second aspect; at least one processor invokes the instruction, Performing message processing or control operations performed on the gateway device side in the second aspect or any of the alternative implementations of the second aspect.
  • the thirteenth aspect of the present application provides a management device, which is applied to a process in which a terminal device connected to the resident node accesses a network, where the management device includes: a memory, a transceiver, and at least one processor, where the memory stores instructions.
  • the memory, the transceiver, and the at least one processor are interconnected by a line, and the transceiver is configured to perform the operation of transmitting and receiving on the management device side in any optional implementation manner of the third aspect or the third aspect; at least one processor invokes the instruction, Performing a message processing or control operation on the management device side in any of the optional implementations of the third aspect or the third aspect.
  • a possible implementation manner is that the gateway device provided in the twelfth aspect of the present application and the management device provided in the thirteenth aspect of the present application may also be combined as a whole, and serve as a core network node in the foregoing method flow. Interact with other network elements.
  • the process interaction between the original gateway device and the original management device can be implemented as an internal implementation of the core network node, and the process interaction between the original gateway device and the original management device and other network elements can continue to be the core. Process interaction between network network nodes and other network elements.
  • the fourteenth aspect of the present application provides a resident node, in the process of the resident node accessing the network, the resident node includes: a memory, a transceiver, and at least one processor, where the memory stores instructions; the memory, The transceiver and the at least one processor are interconnected by a line, and the transceiver is configured to perform the operation of transmitting and receiving on the side of the resident node in any of the optional implementations of the fourth aspect or the fourth aspect; at least one processor invokes the instruction, and performs The message processing or control operation performed on the resident node side in any of the alternative implementations of the four aspects or the fourth aspect.
  • a fifteenth aspect of the present application provides a gateway device, where the gateway device includes: a memory, a transceiver, and at least one processor, where the memory stores instructions, a memory, and a transceiver. And the at least one processor is interconnected by a line, where the transceiver is configured to perform the operation of transmitting and receiving on the gateway device side in any optional implementation manner of the fifth aspect or the fifth aspect; at least one processor invokes the instruction to perform the fifth aspect or The message processing or control operation performed on the gateway device side in any of the alternative implementations of the fifth aspect.
  • the sixteenth aspect of the present application provides a management device, in the process of the resident node accessing a network, the management device includes: a memory, a transceiver, and at least one processor, where the memory stores instructions, a memory, and a transceiver.
  • the at least one processor is interconnected by a line, and the transceiver is configured to perform the operation of transmitting and receiving on the management device side in any optional implementation manner of the sixth aspect or the sixth aspect; the at least one processor invokes the instruction to perform the sixth aspect or The message processing or control operation performed on the management device side in any of the alternative implementations of the sixth aspect.
  • a possible implementation manner is that the gateway device provided by the fifteenth aspect of the present application and the management device provided by the sixteenth aspect of the present application may also be combined as a whole, and serve as a core network in the method flow involved.
  • Network nodes interact with other network elements.
  • the process interaction between the original gateway device and the original management device can be implemented as an internal implementation of the core network node, and the process interaction between the original gateway device and the original management device and other network elements can continue to be the core. Process interaction between network network nodes and other network elements.
  • the seventeenth aspect of the present application provides a resident node, where the resident node and the terminal device connected to the resident node access the network, the resident node includes: a memory, a transceiver, and at least one processing An instruction is stored in the memory; the memory, the transceiver, and the at least one processor are interconnected by a line, and the transceiver is configured to perform the operation of transmitting and receiving at the resident node side in any of the optional implementations of the seventh aspect or the seventh aspect At least one processor invokes an instruction to perform a message processing or control operation on the resident node side in any of the optional implementations of the seventh aspect or the seventh aspect.
  • the eighteenth aspect of the present application provides a gateway device, where the gateway device and the terminal device connected to the resident node access the network, the gateway device includes: a memory, a transceiver, and at least one processor, The memory is stored with instructions, and the memory, the transceiver, and the at least one processor are interconnected by a line, and the transceiver is configured to perform the operation of transmitting and receiving the message on the gateway device side in any optional implementation manner of the eighth aspect or the eighth aspect; at least one The processor invokes an instruction to perform a message processing or control operation performed on the gateway device side in any of the optional implementations of the fifth aspect or the fifth aspect.
  • a nineteenth aspect of the present application provides a management device, which is applied to a process in which the resident node and the terminal device connected to the resident node access the network, where the management device includes: a memory, a transceiver, and at least one processor.
  • the memory is stored with instructions, and the memory, the transceiver, and the at least one processor are interconnected by a line, and the transceiver is configured to perform the operation of transmitting and receiving the message on the management device side in any optional implementation manner of the ninth aspect or the ninth aspect; at least one The processor invokes an instruction to perform a message processing or control operation on the management device side in any of the optional implementations of the eighth aspect or the eighth aspect.
  • a possible implementation manner is that the gateway device provided in the eighteenth aspect of the present application and the management device provided in the nineteenth aspect of the present application may also be combined as a whole, and serve as a core network in the method flow involved.
  • the node interacts with other network elements.
  • the process interaction between the original gateway device and the original management device can be implemented as an internal implementation of the core network node, and the process interaction between the original gateway device and the original management device and other network elements can continue to be the core. Process interaction between network network nodes and other network elements.
  • the twentieth aspect of the present application provides a terminal device, which is applied to a process in which the terminal device accesses a network, including: a memory, a transceiver, and at least one processor, where the memory stores instructions, a memory, a transceiver, and at least one processing.
  • the device is interconnected by a line, and the transceiver is configured to perform the operation of transmitting and receiving a message on the terminal device side in the tenth aspect.
  • a twenty-first aspect of the present application provides a chip system, which is applicable to a resident node, the chip system comprising: at least one processor, a memory and an interface circuit, and the memory, the transceiver, and the at least one processor are interconnected by a line, at least one Instructions are stored in the memory; the instructions are executed by the processor to perform the operations of the resident node in the first aspect or any of the alternative implementations of the first aspect.
  • a twenty-second aspect of the present application provides a chip system, which is applicable to a gateway device, where the chip system includes: at least one processor, a memory and an interface circuit, and the memory, the transceiver, and the at least one processor are interconnected by a line, at least one The instructions are stored in the memory; the instructions are executed by the processor to perform the operations of the gateway device in any of the alternative implementations of the second aspect or the second aspect.
  • a twenty-third aspect of the present application provides a chip system, which is applicable to a management device, the chip system comprising: at least one processor, a memory and an interface circuit, and the memory, the transceiver, and the at least one processor are interconnected by a line, at least Instructions are stored in a memory; instructions are executed by the processor to perform the operations of the management device in any of the alternative implementations of the third aspect or the third aspect.
  • a twenty-fourth aspect of the present application provides a chip system applicable to a resident node, the chip system comprising: at least one processor, a memory and an interface circuit, the memory, the transceiver, and the at least one processor being interconnected by a line, at least one Instructions are stored in the memory; the instructions are executed by the processor to perform the operations of the resident node in any of the alternative implementations of the fourth aspect or the fourth aspect.
  • a twenty-fifth aspect of the present application provides a chip system, which is applicable to a gateway device, where the chip system includes: at least one processor, a memory and an interface circuit, and the memory, the transceiver, and the at least one processor are interconnected by a line, at least one An instruction is stored in the memory; the instruction is executed by the processor to perform the operation of the gateway device in any of the alternative implementations of the fifth aspect or the fifth aspect.
  • a twenty-sixth aspect of the present application provides a chip system, an application and management device, the chip system comprising: at least one processor, a memory and an interface circuit, the memory, the transceiver, and the at least one processor being interconnected by a line, at least one
  • the instructions are stored in the memory; the instructions are executed by the processor to perform the operations of the management device in any of the alternative implementations of the sixth or sixth aspect.
  • a twenty-seventh aspect of the present application provides a chip system, comprising: applicable to a resident node, the chip system at least one processor, a memory and an interface circuit, the memory, the transceiver, and the at least one processor being interconnected by a line, at least one Instructions are stored in the memory; the instructions are executed by the processor to perform the operations of the resident node in any of the alternative implementations of the seventh aspect or the seventh aspect.
  • a twenty-eighth aspect of the present application provides a chip system, comprising: at least one processor, a memory and an interface circuit of the chip system, the memory, the transceiver, and the at least one processor are interconnected by a line, at least one An instruction is stored in the memory; the instruction is executed by the processor to perform the operation of the gateway device in any of the alternative implementations of the eighth aspect or the eighth aspect.
  • a twenty-ninth aspect of the present application provides a chip system, which is applicable to a management device, the chip system comprising: at least one processor, a memory and an interface circuit, and the memory, the transceiver, and the at least one processor are interconnected by a line, at least one
  • the instructions are stored in the memory; the instructions are executed by the processor to perform the operations of the management device in any of the alternative implementations of the ninth or ninth aspect.
  • a thirtieth aspect of the present application provides a chip system, which is applicable to a terminal device, the chip system comprising: at least one processor, a memory and an interface circuit, the memory, the transceiver, and the at least one processor being interconnected by a line, the at least one memory An instruction is stored therein; the instruction is executed by the processor to perform the operation of the terminal device in the tenth aspect.
  • Yet another aspect of the present application provides a computer readable storage medium, applicable to a resident node, wherein the computer readable storage medium stores instructions for performing the first aspect or the first when the instructions are run on the computing device The operation of the resident node in any of the alternative implementations.
  • Yet another aspect of the present application provides a computer readable storage medium, applicable to a gateway device, wherein the computer readable storage medium stores instructions for performing the second aspect or the second when the instructions are run on the computing device The operation of the gateway device in any of the alternative implementations.
  • Yet another aspect of the present application provides a computer readable storage medium, applicable to a management device, having stored therein instructions for performing a third aspect or a third when the instructions are run on a computing device The operation of the device is managed in any of the alternative implementations.
  • Yet another aspect of the present application provides a computer readable storage medium, applicable to a resident node, wherein the computer readable storage medium stores instructions that, when executed on a computing device, perform a fourth aspect or fourth The operation of the resident node in any of the alternative implementations.
  • Yet another aspect of the present application provides a computer readable storage medium, applicable to a gateway device, wherein the computer readable storage medium stores instructions for executing the fifth aspect or the fifth when the instruction is run on the computing device The operation of the gateway device in any of the alternative implementations.
  • Yet another aspect of the present application provides a computer readable storage medium, applicable to a management device, having stored therein instructions for performing a sixth aspect or sixth when the instructions are run on a computing device The operation of the device is managed in any of the alternative implementations.
  • Yet another aspect of the present application provides a computer readable storage medium, applicable to a resident node, the computer readable storage medium storing instructions for executing the seventh aspect or the seventh when the instruction is run on the computing device The operation of the resident node in any of the alternative implementations.
  • Yet another aspect of the present application provides a computer readable storage medium, applicable to a gateway device, wherein the computer readable storage medium stores instructions for performing an eighth aspect or eighth when the instructions are run on the computing device The operation of the gateway device in any of the alternative implementations.
  • Yet another aspect of the present application provides a computer readable storage medium, applicable to a management device, having stored therein instructions for performing a ninth aspect or a ninth when the instructions are run on a computing device The operation of the device is managed in any of the alternative implementations.
  • Yet another aspect of the present application provides a computer readable storage medium, applicable to a terminal device, wherein the computer readable storage medium stores instructions for performing the tenth aspect or the tenth when the instruction is run on the computing device The operation of the terminal device in any of the alternative implementations.
  • a further aspect of the present application provides a computer program product, applicable to a resident node, when the program is run on a computing device, performing the first aspect or any of the optional implementations of the first aspect of the resident node operating.
  • a further aspect of the present application provides a computer program product, applicable to a gateway device, when the program is run on a computing device, performing the gateway device in any of the alternative implementations of the second aspect or the second aspect operating.
  • a further aspect of the present application provides a computer program product, applicable to a management device, for performing management of a device in any of the optional implementations of the third aspect or the third aspect when the program is run on the computing device operating.
  • a further aspect of the present application provides a computer program product, applicable to a resident node, for performing a resident node in any of the alternative implementations of the fourth aspect or the fourth aspect when the program is run on the computing device operating.
  • a further aspect of the present application provides a computer program product, applicable to a gateway device, when the program is run on a computing device, performing the gateway device in any of the alternative implementations of the fifth aspect or the fifth aspect operating.
  • a further aspect of the present application provides a computer program product applicable to a management device, wherein when the program is run on a computing device, performing the management device in any of the optional implementations of the sixth aspect or the sixth aspect operating.
  • a further aspect of the present application provides a computer program product, applicable to a resident node, performing the resident node of any of the optional implementations of the seventh aspect or the seventh aspect when the program is run on the computing device operating.
  • a further aspect of the present application provides a computer program product, applicable to a gateway device, when the program is run on a computing device, performing the gateway device in any of the optional implementations of the eighth aspect or the eighth aspect operating.
  • a further aspect of the present application provides a computer program product, applicable to a management device, for performing management of the device in any of the optional implementations of the ninth or ninth aspect when the program is run on the computing device operating.
  • a further aspect of the present application provides a computer program product, applicable to a terminal device, when the program is run on a computing device, performing the terminal device in any of the optional implementations of the tenth or tenth aspect operating.
  • the solution provided by the embodiment of the present application can fully utilize the existing network to complete the process of the terminal device accessing the network, for example, using the mobile network to complete the access process of the terminal device connected to the CPE, thereby avoiding laying a dedicated network channel. , improve the utilization of mobile networks.
  • the embodiments of the present application also provide corresponding devices and systems.
  • 1 is a schematic diagram of a scene of WTTx
  • FIG. 2A is a schematic diagram of a network architecture in an embodiment of the present application.
  • 2B is a schematic diagram of a network access line of the terminal device
  • 2C is a schematic diagram of another network access line of the terminal device
  • 2D is a schematic diagram of another network access line of the terminal device in the embodiment of the present application.
  • 2E is a schematic diagram of another network access line of the terminal device in the embodiment of the present application.
  • FIG. 3 is a schematic diagram of an embodiment of a method for a device to access a network according to an embodiment of the present application
  • FIG. 4 is a schematic diagram of another embodiment of a method for a device to access a network according to an embodiment of the present disclosure
  • FIG. 5 is a schematic diagram of another embodiment of a method for a device to access a network according to an embodiment of the present disclosure
  • FIG. 6 is a schematic diagram of another embodiment of a method for a device to access a network according to an embodiment of the present disclosure
  • FIG. 7 is a schematic diagram of another embodiment of a method for a device to access a network according to an embodiment of the present disclosure
  • FIG. 8 is a schematic diagram of another embodiment of a method for a device to access a network according to an embodiment of the present disclosure
  • FIG. 9A is a schematic diagram showing an example of an interaction system between devices according to an embodiment of the present application.
  • 9B is a schematic diagram of an example of a device protocol stack provided by an embodiment of the present application.
  • 9C is another schematic diagram of a device protocol stack provided by an embodiment of the present application.
  • 9D is another schematic diagram of a device protocol stack provided by an embodiment of the present application.
  • 9E is another schematic diagram of a device protocol stack provided by an embodiment of the present application.
  • FIG. 10 is a schematic diagram of another embodiment of a method for a device to access a network according to an embodiment of the present disclosure
  • FIG. 11 is a schematic diagram of another embodiment of a method for a device to access a network according to an embodiment of the present disclosure
  • FIG. 12 is a schematic structural diagram of a converged network provided by an embodiment of the present application.
  • FIG. 13 is a schematic diagram of another embodiment of a method for a device to access a network according to an embodiment of the present disclosure
  • FIG. 14 is a schematic diagram of another embodiment of a method for a device to access a network according to an embodiment of the present disclosure
  • FIG. 15 is a schematic diagram of another embodiment of a method for a device to access a network according to an embodiment of the present disclosure
  • FIG. 16 is a schematic diagram of another embodiment of a method for a device to access a network according to an embodiment of the present disclosure
  • FIG. 17 is a schematic diagram of a functional node of an apparatus for a device to access a network according to an embodiment of the present disclosure
  • FIG. 18 is a schematic diagram of an embodiment of a user premises equipment provided by an embodiment of the present application.
  • FIG. 19 is a schematic diagram of an embodiment of a chip system according to an embodiment of the present application.
  • the embodiment of the present invention provides a method for accessing a network, which can fully utilize the existing network to complete the process of the terminal device accessing the network, for example, using the mobile network to complete the access process of the terminal device connected to the CPE, thereby avoiding laying A dedicated network channel improves the utilization of the mobile network.
  • the embodiments of the present application also provide corresponding devices and systems. The details are described below separately.
  • upstream and downstream appearing in this application are used in some scenarios to describe the direction of data/information transmission.
  • upstream direction is the direction in which the data/information is transmitted from the terminal device to the network side
  • the downlink direction is the direction in which the data/information is transmitted from the network side device to the terminal device
  • upstream and downstream are only used to describe the direction, and specific devices for starting and ending the data/information are not limited.
  • the naming or numbering of the steps appearing in this application does not mean that the steps in the method flow must be performed in the time/logical order indicated by the naming or numbering.
  • the process steps that have been named or numbered can be implemented according to the The technical purpose changes the execution order as long as the same or similar technical effects can be achieved.
  • the division of modules appearing in this application is a logical division. In actual applications, there may be another division manner. For example, multiple modules may be combined or integrated into another system, or some features may be ignored. Alternatively, or not, in addition, the coupling or direct coupling or communication connection between the displays or the discussions may be through some interfaces, and the indirect coupling or communication connection between the modules may be electrical or the like. There are no restrictions on the application.
  • modules or sub-modules described as separate components may or may not be physically separated, may not be physical modules, or may be distributed to multiple circuit modules, and some or all of them may be selected according to actual needs. Modules are used to achieve the objectives of the present application.
  • authentication In the embodiment of the present application, the term “authentication” is used, and the meaning thereof includes: identification and identification of identity, and/or authorization of related operations.
  • the resident node may be a CPE in this embodiment of the present application.
  • the external network may be relative to the mobile network, and the external network is a network composed of other network elements or network devices except the network element/network device of the mobile network (including the access network and the core network).
  • the external network in the embodiment of the present application may be a fixed network.
  • the terminal device connected to the CPE is connected to the CPE and accesses the terminal device of the network through the CPE.
  • the terminal device connected to the CPE completes the network access scheme on the external network through the mobile network; includes the scheme 1 and the scheme 2, and the scheme 1 includes the scheme 1-1 and the scheme 1-2, and the scheme 2 includes Includes scenario 2-1 and scenario 2-2.
  • Solution 1 The terminal device connected to the CPE completes the network access solution on the external network through the 4G mobile network.
  • Solution 1-1 The terminal device connected to the CPE completes the network access solution on the external network through the user plane of the 4G mobile network.
  • Solution 1-2 The terminal device connected to the CPE completes the network access scheme on the external network through the control plane of the 4G mobile network.
  • Solution 2 The terminal device connected to the CPE completes the network access solution on the external network through the 5G mobile network.
  • Solution 2-1 The terminal device connected to the CPE completes the network access scheme on the external network through the user plane of the 5G mobile network.
  • Solution 2-2 The terminal device connected to the CPE completes the network access scheme of the external network through the control plane of the 5G mobile network.
  • Part 2 The CPE or its connected terminal equipment completes the network access scheme on the external network through the mobile network; among them, the scheme 1 and the scheme 2 are included.
  • Solution 1 the CPE or the terminal device connected thereto completes the network access of the external network through the 4G mobile network;
  • Solution 2 the CPE or the terminal device connected thereto completes the network access of the external network through the 5G mobile network.
  • Part III In a converged network of fixed networks and mobile networks, a terminal device connected to the CPE and a network access scheme of the CPE in the converged network.
  • the fixed network may also be referred to as a wired network
  • the mobile network may also be referred to as a wireless network.
  • the differences between 4G and 5G include: some functions of UPF and SMF in 5G and mobile gateways (for example: PGW) in 4G overlap.
  • the AMF in the 5G overlaps with some functions of the MME in the 4G. Therefore, in order to clearly express the devices in the 4G and 5G scenarios, SMF and UPF, and S/P-GW (SGW or PGW), LGW, etc. can be collectively referred to.
  • SMF and UPF, and S/P-GW (SGW or PGW), LGW, etc. can be collectively referred to.
  • a gateway device an S/P-GW or an LGW may be referred to as a mobile gateway, and the MME and the AMF are collectively referred to as a management device.
  • the corresponding specific network element may be used.
  • the gateway device is represented by PGW, SMF or UPF
  • the management device is represented by MME or AMF.
  • the terminal device in the embodiment of the present application includes a fixed terminal device such as an STB, a personal computer (PC), an IP phone, a fax machine, and the like, and a mobile terminal device such as a mobile phone and a tablet computer.
  • the connected terminal devices may be terminal devices that access the network or perform services through the CPE, that is, the network connections of the terminal devices are all responsible by the CPE.
  • 2A is a schematic diagram of a network architecture including a mobile network and an external network.
  • the network architecture shown in FIG. 2A is an example of an architecture in which the mobile network is a 4G network.
  • the network architecture includes four network access lines shown in FIG. 2B to FIG. 2E for the terminal device.
  • the line 1 shown in FIG. 2B is a network access route of the terminal through the IPoX method.
  • the terminal sends a DHCP request message (for example, DHCP discover or DHCP request) to the DHCP server through the DHCP relay, and the DHCP relay can add the authentication additional information in the DHCP message extension field, and the DHCP server will be the terminal.
  • the authentication request is forwarded to the authentication server (AAA Server), and the terminal device that sends the DHCP request is authenticated.
  • the binding authentication mode of the DHCP access network is taken as an example for description. In fact, there are various ways for the network to authenticate the terminal, and the details are not described herein.
  • the line 2 shown in FIG. 2C is a network access route of the mobile terminal in the mobile network.
  • the mobile terminal cooperates with the MME and the HSS to complete the authentication process.
  • the line 3 shown in FIG. 2D is a terminal device connected to the CPE, and the network access process in the external network is completed through the user plane of the mobile network.
  • the line 4 shown in FIG. 2E is a terminal device connected to the CPE, and the network access process in the external network is completed through the control plane of the mobile network.
  • the line 3 shown in FIG. 2D and the line 4 shown in FIG. 2E illustrate that the terminal device connected to the CPE completes the network access process in the external network through the mobile network. In fact, the CPE completes the network connection in the external network through the mobile network.
  • the process of the present invention can also be understood by referring to FIG. 2D and FIG. 2E.
  • the terminal device connected to the CPE is not considered, and is not shown in the embodiment of the present application.
  • an embodiment of a method for a device to access a network includes:
  • the CPE receives a first message sent by the terminal device, where the first message includes an authentication request.
  • the terminal device can be understood as a terminal device connected to the CPE, and the terminal device connected to the CPE is connected to the terminal device of the CPE, and the terminal device accesses the network through the CPE.
  • the CPE receives the first message sent by the connected terminal device, that is, receives the first message sent by the terminal device connected to the CPE.
  • the authentication request may be an access request or a connection request or an authentication request or an address allocation request or other type of information indicating the intent of the access network sent by the connected terminal device to the network when performing network access. To simplify the presentation, they are collectively referred to as an authentication request.
  • the CPE can receive an authentication request, and does not need to be carried by other messages, for example, the first message is not required to be carried.
  • the CPE processes the first message to obtain a second message.
  • the second message is used by the gateway device to identify the authentication request and/or the authentication mode of the terminal device accessing the network, where the authentication mode is used to instruct the gateway device to send the authentication to the network device.
  • the authentication request is used to instruct the network device to perform authentication on the terminal device;
  • the second message may include the authentication request and the first indication information, where the first indication information may be an authentication type indication information, where the authentication type indication information is used to indicate that the terminal device is connected.
  • the authentication type indication information may include an identifier indication of the authentication mode and/or an indication of the authentication protocol identifier.
  • the first indication information, the second indication information, and the indication information in the embodiment of the present application are actually information having an indication function, and the first and second are only serial number identifiers that appear twice in a scene, and should not be It is understood to be a limitation with special meaning.
  • the authentication message may be transmitted to the gateway device by using an authentication channel corresponding to the authentication mode, where the authentication channel is used to identify a corresponding authentication mode.
  • the authentication channel may be a channel for transmitting data and/or signaling, and is not limited to transmitting only authentication messages.
  • the authentication channel may be a specific channel established between the CPE and the gateway device, and the specific channel may be a bearer or a transmission tunnel, or may be an APN/DNN or PDN connection or a PDU session or a network slice, etc., as long as The specific channel is configured to correspond to the authentication mode.
  • the specific channel format is not limited in the embodiment of the present application.
  • the information of the authentication result may also be returned to the terminal device through the specific channel, and the information of the authentication result may be carried in the authentication return message and returned to the terminal device through the specific channel.
  • the information of the authentication result may be returned by other means.
  • the following describes the process of the terminal device accessing the network in the embodiment of the present application by taking the case where the authentication request and the authentication type indication information are included in the second message.
  • the authentication request and the authentication type indication information are included in the second message.
  • the authentication type indication information in the form of a specific channel, in addition to using a specific channel to transmit data between the CPE and the gateway device, there is no need to include the authentication type indication information in the second message, and other steps and processes and the indication information including the authentication type are included.
  • the method is basically the same, and the network access process using a specific channel can be understood by referring to this manner.
  • the process of step 102 may include stripping the L1/L2 packet header of the communication protocol between the CPE and the terminal device, and identifying the authentication mode and/or the authentication protocol type adopted by the terminal device.
  • the authentication mode may include, but is not limited to, PPP, PPPoX, IPoX, EAP, etc.
  • the authentication protocol type may include, but is not limited to, protocols such as LCP, PAP, CHAP, etc. involved in PPPoX authentication, or IPOX.
  • the DHCP protocol (DHCPv4, or DHCPv6) involved, or EAP-AKA, EAP-AKA', EAP-SIM, EAP-TLS, etc. in EAP authentication.
  • the CPE After identifying the authentication mode and/or the authentication protocol type corresponding to the terminal device authentication request, the CPE will process the content of the authentication request message in the first message (excluding the L1/L2 packet header or the complete unpeeled processing)
  • the information such as the request message or the plurality of key parameters included in the authentication message is encapsulated together with the authentication type indication information to obtain the second message.
  • the authentication type indication information may be carried in the authentication request, and an authentication request including the authentication type indication information may be obtained, where the authentication type may be included.
  • the authentication request indicating the information is regarded as the second message.
  • the authentication type indication information When the authentication type indication information is added to the first message or the authentication request, it may be added on the air interface access layer, for example, an IP layer data packet (or a packet header), or may be in an air interface access layer such as SDAP/
  • the data packet (or the packet header) of the PDCP/RLC/MAC/PHY layer is added, or is added to the data packet (or the packet header) of a new (sub)layer, and the specific added location is the embodiment of the present application. There is no limit in the middle.
  • the CPE sends a second message to the radio access network RAN device.
  • the RAN device sends a data packet including an authentication request and an authentication type indication information to the mobile gateway.
  • the RAN device may cancel the air interface access layer encapsulation, and then perform protocol encapsulation of the S1 interface (for example, GTP tunnel encapsulation) to obtain a third message, and then move to the mobile device through a GTP (GTP-U) tunnel.
  • the gateway sends a third message including an authentication request and an authentication type indication information, and the third message may be a data packet.
  • the RAN device may be in the S1.
  • the authentication type indication information is added to the packet header (such as the GTP/UDP/IP packet header) involved in the interface protocol encapsulation.
  • the mobile gateway reads the authentication request and the authentication type indication information.
  • the mobile gateway may read the authentication type indication information from the packet header involved in the protocol encapsulation of the S1 interface, and release the protocol encapsulation of the S1 interface.
  • the authentication request is obtained in the subsequent data packet; or the mobile gateway may obtain the authentication type indication information from the data packet (or the packet header) of the IP layer, for example, after the protocol encapsulation of the S1 interface is removed.
  • the authentication request; or the mobile gateway may determine the corresponding authentication mode and/or the authentication protocol according to the transmission channel of the data packet (for example, a specific bearer), and obtain the authentication in the data packet after the protocol encapsulation of the S1 interface is released. request.
  • the mobile gateway sends an authentication request to the network device.
  • the mobile gateway sends the authentication request to the corresponding network device related to the authentication and address allocation in the network in the manner required by the authentication mode or the authentication protocol.
  • the corresponding network devices include, but are not limited to, BNG, DHCP server, AAA server, and the like.
  • the authentication mode is PPP or PPPoX
  • the BNG is used as the PPP endpoint
  • the mobile gateway can establish a PPP connection to the BNG on the L2TP tunnel and allocate a PPP session ID.
  • the mobile gateway can send a DHCP message including the authentication request to the BNG and/or the DHCP server as a DHCP relay or a DHCP proxy.
  • the mobile gateway may add authentication additional information in the extended option field of the authentication request, for example, indicating the identity of the CPE (such as IMSI), information indicating the location of the terminal device, and/or the location of the resident node (
  • At least one of the channel information for transmitting the authentication request, such as ECGI and/or eNB ID and/or TAI, etc., the channel information for transmitting the authentication request includes at least one of the following information: The tunnel identifier of the right request, the bearer identifier of the transmission authentication request, and the session identifier (for example, PDU session ID) for transmitting the authentication request.
  • the CCE may also add the foregoing authentication additional information to the second message before sending the second message to the RAN device.
  • the network device performs authentication and authentication on the terminal device according to an authentication mode used by the terminal device.
  • the network device that terminates the PPP session such as the BNG, passes the password authentication protocol (PAP) or the challenge handshake authentication protocol (challenge handshake authentication protocol).
  • PAP password authentication protocol
  • CHAP challenge handshake authentication protocol
  • the BNG sends an authentication request to the authentication server, ie, the AAA server, through the RADUIS or diameter protocol for authentication.
  • the network device such as the BNG
  • the DHCP server adds the authentication related extension field (such as device information, user name, and password) added by the terminal in the request message.
  • the authentication related extension field such as device information, user name, and password
  • the authentication packet is constructed and sent to the AAA server for authentication through the RADIUS or diameter protocol.
  • the EAP client ie, the terminal device that requests authentication and authentication
  • the EAP device EAP authenticator
  • BNG EAP authenticator
  • the EAP authentication packet is exchanged between the EAP device and the EAP client.
  • the EAP device end transmits the authentication related packet through the RADIUS or Diameter protocol between the EAP relay mode or the EAP termination mode and the authentication server, such as the AAA server.
  • the network device receives information about an authentication result returned by the authentication server.
  • the information of the authentication result may include indication information of whether or not to pass the authentication.
  • the information of the authentication result may be carried in the authentication return message.
  • the authentication return message in the embodiment of the present application is not specifically a message, and the authentication return message may be multiple types of information capable of carrying the authentication result.
  • the message, as long as it can carry the information of the authentication result, can function as an authentication return message.
  • the AAA server sends a reject message to the DHCP server, and the DHCP server returns a DHCP NAK message to the BNG. If the authentication succeeds, the AAA server sends the authentication pass message to the DHCP server. Then, the DHCP server returns a DHCP offer (offer) message to the BNG.
  • the network device may carry the IP address and/or the reference information of the route configuration allocated by the terminal device in the authentication return message.
  • the reference information of the route configuration may be reference information used for CPE uplink route configuration.
  • the network device in this step 109 includes, but is not limited to, a gateway/router node such as a BNG, or a node having an address assignment function such as a DHCP server.
  • the network device sends the authentication return message to the terminal device via the wireless gateway according to the authentication mode adopted by the terminal device.
  • the authentication return message sent by the network device to the mobile gateway may include an authentication result and/or an address allocation result, and may further include reference information used for CPE route configuration.
  • the reference information for CPE route configuration may include part or all of the following information: common server IP address/segment address/address prefix of service related (eg IPTV service), corresponding network mask information (eg mask or mask) Length), the multicast address of the content (if it contains multicast services), and the corresponding next hop node.
  • IPTV service is used as an example.
  • the common server includes, but is not limited to, a content server, a fast server, a DHCP server, a DNS server, etc.
  • the multicast address of the provided content may include a multicast address of each channel, and the corresponding next hop node may be The IP address of a gateway or router.
  • the DHCP server can carry the IP address pre-allocated or assigned to the terminal device in the DHCP offer message and/or the DHCP Ack message, and can also be added to the CPE route configuration in the extended option field (for example, option 121). Reference information.
  • the mobile gateway receives an authentication return message sent by the network device.
  • the information of the authentication result is carried in the authentication return message.
  • the mobile gateway may directly encapsulate the authentication return message by using a user plane;
  • the mobile gateway may generate routing configuration information according to the reference information for the CPE routing configuration, where the routing configuration information may be configuration information for CPE uplink routing configuration, and the routing configuration information may include some or all of the following items: Common server IP address/segment address/address prefix related to service, network mask information (such as mask or mask length), multicast address providing content (if multicast service is included), next hop node address, The corresponding access point identifier (such as APN/DNN) or network slice identifier or connection channel identifier (such as PDN connection identifier or PDU session identifier or bearer identifier) or the identifier of the gateway device or CPE device port information that the CPE should select.
  • the routing configuration information may be configuration information for CPE uplink routing configuration
  • the routing configuration information may include some or all of the following items: Common server IP address/segment address/address prefix related to service, network mask information (such as mask or mask length), multicast address providing content (if multicast service is included), next
  • the mobile gateway may send routing configuration information to the CPE in the following manner: the mobile gateway adds the routing configuration information to the authentication return message; or the mobile gateway replaces the reference information used for the CPE routing configuration in the authentication return message with Routing configuration information; or, the mobile gateway sends the routing configuration information to the MME, which is carried by the MME in the NAS message and sent to the CPE.
  • the mobile gateway performs user plane encapsulation on the authentication return message.
  • the mobile gateway may also determine the routing configuration information according to the reference information of the routing configuration, but continue to send the reference information of the routing configuration, and the CPE may determine the routing configuration information according to the reference information configured by the routing.
  • the reference information and the routing configuration information of the routing configuration may be collectively referred to as routing configuration information, that is, the routing configuration information includes reference information allocated by the network device for routing configuration of the resident node. Or the configuration information determined by the gateway device according to the reference configuration of the routing configuration for the routing configuration of the resident node.
  • the mobile gateway sends a user plane data packet encapsulating the authentication return message to the CPE by using a user plane bearer with the CPE.
  • the CPE receives the user plane data packet encapsulating the authentication return message, decapsulates the same, and extracts an authentication return message.
  • the CPE may identify the authentication return message to confirm which terminal device the authentication return message is sent to.
  • the CPE may perform route configuration according to the reference information or route configuration information of the route configuration included in the authentication return message, or according to the route configuration information carried in the NAS message received from the MME.
  • the CPE sends an authentication return message to the terminal device that sends the authentication request.
  • the subsequent terminal device continues to exchange other messages with the network device according to the requirements of the authentication mode.
  • the DHCP request message and the corresponding DHCP Ack message involved in the IPoX authentication mode will also be transmitted by the user plane bearer between the CPE and the mobile gateway, and routed between the mobile gateway and the BNG and the selected DHCP server until the terminal is completed. The process of the device accessing the network.
  • the user plane of the existing 4G network is fully utilized in the embodiment of the present application to complete the access of the terminal device to the network, thereby avoiding laying a dedicated network channel and improving the utilization of the mobile network. rate.
  • the above is a general description of the possible authentication methods of the terminal device.
  • the following is an example in which the terminal device is an STB and the authentication mode is IPoX (DHCP+ authentication).
  • IPoX DHCP+ authentication
  • the process of completing the network access by the STB through the user plane of the 4G mobile network is introduced. .
  • another embodiment of a method for a device to access a network includes:
  • the CPE receives the DHCP discover message sent by the STB.
  • the DHCP discover message is equivalent to the first message in the foregoing embodiment corresponding to FIG. 3, and the DHCP discover message may include device type information of the STB.
  • the CPE identifies a DHCP discover message.
  • the CPE can identify the IP quintuple information (the source IP address is 0.0.0.0, the destination IP address is 255.255.255.255, the source port number 68, the destination port number 67, and the protocol type UDP) of the packet sent by the STB.
  • the received packet is a DHCP discover message, so that the corresponding authentication mode is IPoX (DHCP+Authentication), and then the user plane encapsulation is performed.
  • the first indication information may be added to the encapsulated packet, for example, the authentication type. Instructions.
  • the CPE forwards the encapsulated DHCP discover message to the PGW by using the evolved base station eNB.
  • the PGW receives and processes the DHCP discover message.
  • the PGW extracts the DHCP discover message in the uplink user plane message according to the authentication mode indication in the received message.
  • the PGW When receiving the DHCP discover message from the STB forwarded by the CPE, the PGW records the mapping relationship between the ID identifying the CPE identity (for example, EPS bearer/TEID, etc.) and the MAC address of the STB requesting the IP address.
  • the ID identifying the CPE identity for example, EPS bearer/TEID, etc.
  • the PGW can function as a DHCP relay or DHCP proxy to modify certain related fields in a DHCP packet. For example, when acting as a DHCP relay, the PGW modifies the Giaddr in the DHCP discover message to its own IP address, and +1 in the hops field. It can also be used as an intermediate node to add authentication additional information in an extension field (for example, option 82), such as: indicating CPE.
  • an extension field for example, option 82
  • At least one of an identity eg, IMSI
  • information indicating a location of the terminal device and/or a location of the resident node eg, ECGI and/or eNB ID and/or TAI
  • channel information for transmitting the authentication request includes at least one of the following: a tunnel identifier for transmitting the authentication request, a bearer identifier for transmitting the authentication request, and a session identifier (for example, a PDU session ID) for transmitting the authentication request.
  • the PGW sends a DHCP discover message to the DHCP server.
  • the DHCP server generates an authentication request packet according to the authentication related information included in the DHCP discover message, and sends an authentication request to the authentication server.
  • the authentication server authenticates the STB.
  • the DHCP server receives the authentication result returned by the authentication server.
  • the DHCP server sends a DHCP offer to the PGW, where the DHCP server pre-allocates the IP address to the STB.
  • the PGW determines, according to the mapping relationship recorded in step 204, that a DHCP offer needs to be sent to the CPE.
  • the PGW sends a data packet including a DHCP offer message to the CPE.
  • the CPE receives the data packet that includes the DHCP offer message, and identifies that the terminal device is the STB.
  • the STB can be identified according to the client MAC address in the DHCP offer message.
  • the CPE sends a DHCP offer message to the STB.
  • the CPE receives a DHCP request (request) message sent by the STB.
  • the CPE identifies the DHCP request message, performs user plane encapsulation, and adds an authentication type indication information.
  • the CPE sends a data packet including a DHCP request to the PGW via the eNB.
  • the PGW sends a DHCP request message to the DHCP server.
  • the PGW Before being sent, the PGW can act as a DHCP relay or DHCP proxy to modify the contents of certain related fields in the DHCP request message.
  • the PGW receives a DHCP response (Ack) packet returned by the DHCP server.
  • Ack DHCP response
  • the DHCP Ack may also include an extension field (such as option 121) for the CPE route configuration reference.
  • the PGW sends, by using the eNB, a data packet that includes a DHCP Ack packet to the CPE.
  • the PGW may add routing configuration information to the DHCP Ack, or the PGW sends a message containing the routing configuration information to the MME, and the MME sends the message to the CPE through the NAS message.
  • the CPE receives the data packet that includes the DHCP Ack packet, and identifies the terminal device as the STB. For example, the STB can be identified according to the client MAC address in the DHCP offer message.
  • the CPE performs routing configuration based on routing configuration information or reference information in a DHCP Ack or NAS message.
  • the CPE sends a DHCP Ack packet to the STB.
  • the STB After receiving the DHCP Ack packet, the STB can obtain a valid IP address, and the access network process is completed. The subsequent STB can communicate with the devices in the network by using the obtained legal IP address within a valid time range, and accept the service provided by the network.
  • the above is a description of the scheme 1-1 in Part 1.
  • the scheme 1-2 in the embodiment of the present application is described below with reference to FIG. 5, that is, a scheme in which a terminal device connected to a CPE completes network access in an external network through a control plane of a 4G mobile network.
  • another embodiment of a method for a device to access a network includes:
  • the CPE receives a first message sent by the terminal device, where the first message includes an authentication request.
  • the terminal device can be understood as a terminal device connected to the CPE, and the connected terminal device is a terminal device connected to the CPE, and the terminal device accesses the network through the CPE.
  • the CPE receives the first message sent by the connected terminal device, that is, receives the first message sent by the terminal device connected to the CPE.
  • the authentication request is an access request or a connection request or an authentication request or an address allocation request or other type of information indicating the intent of the access network sent by the connected terminal device to the network when performing network access. To simplify the presentation, they are collectively referred to as an authentication request.
  • the CPE receives an authentication request, and does not need to pass other messages, such as the first message.
  • the CPE processes the first message to obtain a second message.
  • the second message is a NAS message, and the NAS message includes the authentication request and/or the authentication type indication information.
  • the process of step 302 may include stripping the L1/L2 packet header of the communication protocol between the CPE and the terminal device, and identifying the authentication mode and/or the authentication protocol type adopted by the terminal device.
  • the authentication mode may include, but is not limited to, PPP, PPPoX, IPoX, EAP, etc.
  • the authentication protocol type may include, but is not limited to, protocols such as LCP, PAP, CHAP, etc. involved in PPPoX authentication, or IPOX.
  • the related DHCP protocol (DHCPv4, or DHCPv6), or EAP-AKA, EAP-AKA', EAP-SIM, EAP-TLS, etc. in EAP authentication.
  • the CPE After identifying the authentication mode and/or the authentication protocol type corresponding to the terminal device authentication request, the CPE will identify the content of the authentication request message (excluding the L1/L2 packet header or the complete request packet without the stripping process) Or information such as multiple key parameters included in the authentication message is carried in the NAS message, and indicates the authentication type indication information corresponding to the authentication message.
  • the authentication type indication information may include an identification indication of an authentication mode and/or an authentication protocol identifier indication.
  • the CPE needs to carry the authentication related information in the NAS message.
  • the first type of NAS message is a message dedicated to the terminal device or the CPE access network, that is, the first type of NAS message is a new type of NAS message defined for carrying a specific type of authentication protocol.
  • the NAS message type is defined as an EAP authentication message, and the content of the interactive message related to the EAP authentication or the key parameters included in the interaction message involved in the EAP authentication is encapsulated in the NAS message.
  • the second type of NAS message includes an information element (IE), where the cell may be a protocol configuration option cell, where the protocol configuration option cell includes the terminal device or the CPE access network.
  • the information that is, the second type of NAS message is in the cell of the existing NAS message, for example, the protocol supported in the protocol configuration option PCO cell, the protocol corresponding to the authentication mode is added, and the corresponding protocol is set.
  • the ID, and then the authentication type and/or the authentication protocol related interactive message content, or key parameters, may be added to the corresponding PCO content.
  • the terminal device and the network side when the terminal device and the network side generate the NAS message carrying the EAP message, set a protocol identity in the PCO cell of the NAS to the identity corresponding to the EAP-AKA, and in the corresponding “Protocol ID # In the "contents", the content of the interactive message involved in the authentication corresponding to the EAP-AKA protocol, or the information of various key parameters included in the interaction message involved in the authentication is added.
  • the third type of NAS message includes a cell, and the cell may be an access dedicated cell or a message container, where the access dedicated cell or message container is used to carry the terminal device or the CPE
  • the information of the incoming network that is to say the third type of NAS message, is configured to configure a new cell or message container in the existing NAS message for carrying the interactive message corresponding to the authentication protocol.
  • the information may include part or all of the following information: the authentication type indication information, the content of the interaction message involved in the authentication, or information about various key parameters included in the interaction message involved in the authentication.
  • the NAS message involved in the embodiment of the present application may be any one of the foregoing three types, whether in the uplink direction or the downlink direction.
  • the CPE sends the NAS message to the MME by using the RAN device.
  • the MME After receiving the NAS message, the MME extracts, from the NAS message, the key parameters included in the authentication request or the authentication message, and/or the authentication type indication information.
  • the MME sends a message (eg, request/transport message) to the mobile gateway.
  • a message eg, request/transport message
  • the method includes at least one of a key parameter and an authentication type indication information included in the authentication request or the authentication message.
  • the mobile gateway needs to refer to the authentication type indication information after receiving the information, and generate an authentication request message according to the key parameters.
  • Steps 306 to 309 are the same as steps 106 to 109 in the embodiment corresponding to FIG. 3, and are not repeatedly described in this embodiment. For details, refer to steps 106 to 109.
  • the mobile gateway receives an authentication return message sent by the network device.
  • the authentication return message carries information of the authentication result.
  • the mobile gateway may generate route configuration information according to the reference information of the route configuration.
  • the mobile gateway sends a message to the MME.
  • the message (eg, request/response/transport message) includes at least one of a key parameter and routing configuration information in an authentication return message or an authentication return message.
  • the MME encapsulates the content in the message sent by the mobile gateway in the NAS message.
  • the content of the NAS message includes at least one of an authentication return message, a key parameter in the authentication return message, and routing configuration information.
  • the type of the NAS message can also be understood by referring to the three types described above.
  • the MME sends the NAS message to the CPE by using the RAN device.
  • the CPE extracts or generates an authentication return message from the received NAS message.
  • the CPE may identify the authentication return message to confirm which terminal device the authentication return message is sent to.
  • the CPE can perform routing configuration according to the reference information or routing configuration information used for the CPE route configuration included in the authentication return message. For the reference information and routing configuration information content of the routing configuration, refer to the descriptions in steps 109 and 110.
  • the CPE sends an authentication return message to the terminal device that sends the authentication request.
  • the subsequent terminal device continues to interact with the network device according to the requirements of the authentication mode, such as the DHCP request message and the corresponding DHCP Ack message involved in the IPoX authentication mode, and the control plane channel between the CPE and the MME. And the transmission between the MME and the mobile gateway, and routing between the mobile gateway and the BNG and the related DHCP server until the terminal device accesses the network.
  • the authentication mode such as the DHCP request message and the corresponding DHCP Ack message involved in the IPoX authentication mode
  • the control plane channel between the CPE and the MME.
  • control plane of the existing 4G network is fully utilized in the embodiment of the present application to complete the access of the terminal device to the network, thereby avoiding laying a dedicated network channel and improving the utilization of the mobile network. rate.
  • scheme 2-1 in the embodiment of the present application is described below with reference to FIG. 6, that is, scheme 2-1, the scheme in which the terminal device connected to the CPE completes network access through the user plane of the 5G mobile network.
  • FIG. 6 another embodiment of a method for a device to access a network according to an embodiment of the present application includes:
  • the CPE receives a first message sent by the terminal device, where the first message includes an authentication request.
  • the terminal device can be understood as a terminal device connected to the CPE, and the terminal device connected to the CPE is connected to the terminal device of the CPE, and the terminal device accesses the network through the CPE.
  • the CPE receives the first message sent by the connected terminal device, that is, receives the first message sent by the terminal device connected to the CPE.
  • the authentication request is an access request or a connection request or an authentication request or an address allocation request or other type of information indicating the intent of the access network sent by the connected terminal device to the network when performing network access. To simplify the presentation, they are collectively referred to as an authentication request.
  • the CPE receives an authentication request, and does not need to be carried by other messages, for example, the first message is carried.
  • the CPE processes the first message to obtain a second message.
  • step 402 The related message and the processing in the step 402 can be understood by referring to step 102, and details are not repeatedly described herein.
  • the CPE sends a second message to the RAN device.
  • the RAN device at this location may be the base station gNB in 5G.
  • the RAN device sends a data packet to the UPF, where the authentication request and/or the authentication type indication information carried in the second message is included.
  • the data packet can be a third message.
  • the CPE transmits the data packet through the established PDU session (PDU session) to the UPF via the RAN device.
  • the RAN device cancels the air interface access layer encapsulation, performs encapsulation according to the N3 interface protocol requirement (for example, tunnel encapsulation), and then transmits the channel corresponding to the PDU session of the CPE and the UPF (for example, In the N3 tunnel, a data packet including an authentication request and/or an authentication type indication information is sent to the UPF.
  • the N3 interface protocol requirement for example, tunnel encapsulation
  • the RAN device may be in the N3.
  • the authentication type indication information is added to the packet header (such as the GTP/UDP/IP packet header) involved in the interface protocol encapsulation.
  • the UPF decapsulates the received data packet, and reads an authentication request and/or an authentication type indication information therein.
  • the UPF may read the authentication type indication information from the packet header involved in the protocol encapsulation of the N3 interface, and release the protocol of the N3 interface.
  • the authentication request is obtained in the encapsulated data packet.
  • the UPF may obtain the authentication type indication information from the air interface access layer, for example, the IP layer data packet (or the packet header) after the protocol encapsulation of the N3 interface is released.
  • the UPF may determine the corresponding authentication mode and/or the authentication protocol according to the transmission channel of the data packet (for example, the N3 tunnel corresponding to a specific PDU session), and remove the data packet encapsulated by the protocol of the N3 interface. Get an authentication request.
  • the UPF requests authentication configuration information and/or authentication additional information from the SMF.
  • the interface between the UPF and the SMF is an N4 interface.
  • the UPF sends a message (for example, a request/response/transport message) to the SMF through the N4 interface, which may include key parameters and/or authentication type indication information in the authentication request message or the authentication request message of the terminal device.
  • the SMF sends a message (eg, request/response/transport message) to the UPF over the N4 interface, which may include authentication configuration information and/or authentication additional information, which is additional information for authentication.
  • the authentication configuration information is used to guide the UPF to establish a connection with the network device in the DN according to the authentication requirement.
  • the authentication additional information may include, for example, an identity indicating the CPE (such as IMSI), information indicating the location of the terminal device and/or the location of the resident node (such as ECGI and/or gNB ID and/or TAI, etc.), for transmission.
  • At least one of the channel information of the authentication request, the channel information for transmitting the authentication request includes at least one of the following information: a tunnel identifier for transmitting the authentication request, a bearer identifier for transmitting the authentication request, and a transport packet The session identifier (such as the PDU session ID) of the right request.
  • This step 406 is an optional step and may or may not be performed.
  • the UPF establishes a connection with the network device in the data network according to the authentication requirement.
  • Network devices in a data network may include various devices in the network for authentication and/or forwarding and/or address allocation, such as BNG, DHCP Server, AAA Server, and the like.
  • the UPF can establish a PPP connection session with a network device such as a BNG in the DN on top of the L2TP tunnel.
  • the UPF acts as a DHCP relay to forward the DHCP message containing the authentication request to a network device such as a DHCP server in the DN.
  • the SMF can send a packet containing the authentication message to the network device in the DN, such as the BNG or AAA server, through the RADIUS protocol or the Diameter protocol, and the UPF is responsible for forwarding between the SMF and the network device in the DN.
  • the authentication-related packet is exchanged.
  • the SMF can be used as the EAP device.
  • the UPF can send the packet containing the authentication message to the network device in the DN, such as the BNG or the AAA server, by using the RADIUS protocol or the Diameter protocol.
  • the UPF can be used as the EAP device.
  • the role of the EAP device can be understood by referring to the introduction in step 107.
  • the authentication additional information may be sent by the SMF to the UPF in step 406, or may be obtained by the UPF according to the context information of the CPE or PDU session.
  • the SMF may add the authentication additional information to the authentication request message, and then send the message to the UPF.
  • the UPF sends an authentication request packet to the network device in the DN.
  • the network device includes, but is not limited to, a gateway/router node such as a BNG, or a node having an address allocation function, such as a DHCP server, or a node having an authentication function, such as an AAA server.
  • a gateway/router node such as a BNG
  • a node having an address allocation function such as a DHCP server
  • a node having an authentication function such as an AAA server.
  • the network device in the DN performs authentication and authentication on the terminal device according to the authentication mode adopted by the terminal device.
  • step process may refer to step 107.
  • the network device in the DN receives the information of the authentication result returned by the authentication server.
  • the network device in this step may include, but is not limited to, a gateway/router node such as a BNG, or a node having an address allocation function such as a DHCP server. If the "network device in the DN" in this step corresponds to the "network device" in step 108, the process of this step can be understood by referring to step 108.
  • the network device in the DN may carry an IP address allocated to the terminal device and/or reference information used for CPE route configuration in the authentication return message.
  • the network device in this step may include, but is not limited to, a gateway/router node such as a BNG, or a node having an address allocation function such as a DHCP server. If the "network device in the DN" in this step corresponds to the "network device" in step 109, this step process can be understood by referring to step 109.
  • the UPF receives an authentication return message sent by the network device in the DN.
  • the UPF may directly encapsulate the authentication return message for the user plane encapsulation; or the UPF may generate the route configuration information according to the reference information used for the CPE route configuration. Carrying in the authentication return message, and then performing user plane encapsulation on the authentication return message; or, on the one hand, the UPF returns the authentication return message for user plane encapsulation; on the other hand, the UPF passes the reference information for CPE route configuration.
  • the N4 interface sends a message (for example, a request/response/transport message) to the SMF.
  • the AMF sends the routing configuration information to the CPE in the NAS message; or the UPF sends the authentication return message to the SMF through the message of the N4 interface (for example, request/response/transport message), and the route configuration information is generated by the SMF.
  • the request message is sent to the UPF through the request/response/transmission message of the N4 interface, and the UPF adds an authentication return message to the route configuration information.
  • the UPF sends a data packet encapsulating the authentication return message to the CPE via the RAN device.
  • the CPE receives the data packet encapsulating the authentication return message, decapsulates the packet, and extracts an authentication return message.
  • the CPE may identify the authentication return message to confirm which terminal device the authentication return message is sent to.
  • the CPE can perform route configuration according to the route configuration reference information or route configuration information included in the authentication return message or the route configuration information carried in the NAS message received from the AMF.
  • the CPE sends an authentication return message to the terminal device that sends the authentication request.
  • the subsequent terminal device continues to interact with the network device according to the requirements of the authentication mode, such as the DHCP request message and the corresponding DHCP Ack message involved in the IPoX authentication mode, until the terminal device accesses the network.
  • the authentication mode such as the DHCP request message and the corresponding DHCP Ack message involved in the IPoX authentication mode
  • the user plane of the existing 5G network is fully utilized in the embodiment of the present application to complete the access of the terminal device to the network, thereby avoiding laying a dedicated network channel and improving the utilization of the mobile network. rate.
  • the above is a description of the scheme 2-1 in Part 1.
  • the scheme 2-2 in the embodiment of the present application is described below with reference to FIG. 7, that is, a scheme in which a terminal device connected to a CPE completes network access through a control plane of a 5G mobile network.
  • the CPE receives a first message sent by the terminal device, where the first message includes an authentication request.
  • the terminal device can be understood as a terminal device connected to the CPE, and the terminal device connected to the CPE is connected to the terminal device of the CPE, and the terminal device accesses the network through the CPE.
  • the CPE receives the first message sent by the connected terminal device, that is, receives the first message sent by the terminal device connected to the CPE.
  • the authentication request is an access request or a connection request or an authentication request or an address allocation request or other type of information indicating the intent of the access network sent by the connected terminal device to the network when performing network access. To simplify the presentation, they are collectively referred to as an authentication request.
  • the CPE receives an authentication request, and does not need to pass other messages, such as the first message.
  • the CPE processes the first message to the second message.
  • step 502 can be understood by referring to the description in step 302, and details are not repeated herein.
  • the CPE sends the NAS message to the AMF by using the RAN device.
  • the AMF After receiving the NAS message, the AMF extracts, from the NAS message, a key parameter included in the authentication request or the authentication request message, and/or an authentication type indication information.
  • the AMF sends a message (for example, a request/response/transport message) to the SMF, where the at least one of the key parameters included in the authentication request or the authentication request message, and the authentication type indication information is included.
  • a message for example, a request/response/transport message
  • the communication interface between the AMF and the SMF is an N11 interface.
  • the SMF generates authentication configuration information and/or authentication additional information.
  • the authentication configuration information is used to guide the UPF to establish a connection with the network device in the DN according to the authentication requirement.
  • the UPF can establish a PPP connection session with a network device such as a BNG in the DN on top of the L2TP tunnel.
  • the UPF acts as a DHCP relay to send a DHCP message containing the authentication related information to a network device such as a DHCP server in the DN.
  • the SMF can send a packet containing the authentication message to the network device in the DN, such as the BNG or AAA server, through the RADIUS protocol or the Diameter protocol, and the UPF is responsible for forwarding between the SMF and the network device in the DN.
  • the SMF can be used as the EAP device.
  • the UPF can send the packet containing the authentication message to the network device in the DN, such as the BNG or AAA server, through the RADIUS protocol or the Diameter protocol.
  • the UPF can be used as an EAP device end.
  • the role of the EAP device can be understood by referring to the introduction in step 107.
  • the authentication additional information may include, for example, an identity indicating the CPE (such as an IMSI), information indicating a location of the resident node (such as ECGI and/or gNB ID and/or TAI, etc.), for transmitting the authentication request.
  • an identity indicating the CPE such as an IMSI
  • information indicating a location of the resident node such as ECGI and/or gNB ID and/or TAI, etc.
  • the channel information for transmitting the authentication request includes at least one of the following: a tunnel identifier for transmitting the authentication request, a bearer identifier for transmitting the authentication request, and a session identifier for transmitting the authentication request (eg PDU session ID) and so on.
  • the SMF sends a message to the UPF.
  • the message (eg, request/response/transport message) includes at least one of a key parameter, authentication configuration information, authentication additional information, and authentication type indication information included in the authentication request or the authentication request message.
  • the UPF receives the message sent by the SMF, and generates an authentication request message.
  • the UPF may refer to the authentication type indication information in the message sent by the SMF (for example, the request/response/transport message), according to the key parameter included in the authentication request or the authentication request message carried in the message, and/ Or authentication additional information to generate an authentication request message.
  • the authentication request message may include authentication additional information.
  • Steps 509 to 512 are the same as steps 409 to 412 corresponding to FIG. 6, and are not repeatedly described in this embodiment. For details, refer to steps 409 to 412.
  • the UPF receives an authentication return message sent by the network device in the DN.
  • the UPF can obtain the key parameters in the authentication return message for generating the message sent to the SMF.
  • the UPF may extract reference information for CPE route configuration; or generate route configuration information according to the reference information; or, the UPF Referring to the reference information, routing configuration information is added to the authentication return message.
  • the UPF sends a message to the SMF.
  • the message (eg, request/response/transport message) includes at least one of the following: an authentication return message or a key parameter in the authentication return message, routing configuration information, reference information for CPE route configuration.
  • the SMF may generate route configuration information according to the reference information.
  • the SMF sends a message to the AMF.
  • the message (eg, request/response/transport message) includes at least one of the following: key parameters in the authentication return message or authentication return message, routing configuration information, reference information for CPE routing configuration.
  • the AMF encapsulates the content of the message sent by the SMF in the NAS message.
  • the NAS message includes at least one of the following information: a key parameter in the authentication return message or the authentication return message, routing configuration information, and reference information used for CPE route configuration.
  • the type of the NAS message can also be understood by referring to the three types introduced in step 302.
  • the AMF sends a NAS message to the CPE through the RAN device.
  • the CPE decapsulates the received NAS message, and extracts or generates an authentication return message.
  • the CPE may identify the authentication return message to confirm which terminal device the authentication return message is sent to.
  • the CPE can perform routing configuration according to the routing configuration information or the reference information used for the CPE route configuration included in the authentication return message.
  • the CPE sends an authentication return message to the terminal device that sends the authentication request.
  • the subsequent terminal device continues to interact with the network device according to the requirements of the authentication mode, such as the DHCP request message and the corresponding DHCP Ack message involved in the IPoX authentication mode, until the terminal device accesses the network.
  • the authentication mode such as the DHCP request message and the corresponding DHCP Ack message involved in the IPoX authentication mode
  • control plane of the existing 5G network is fully utilized in the embodiment of the present application to complete the access of the terminal device to the network, thereby avoiding laying a dedicated network channel and improving the utilization of the mobile network. rate.
  • the above is a general description of the possible authentication methods for the terminal device.
  • the following is an example in which the terminal device is an STB and the authentication mode is IPoX (DHCP+ authentication).
  • IPoX DHCP+ authentication
  • the process of completing the network access by the STB through the control plane of the 5G mobile network is introduced. .
  • another embodiment of a method for a device to access a network includes:
  • the CPE receives an authentication request packet sent by the STB.
  • the CPE After receiving the authentication request packet, the CPE encapsulates the parameter used for authentication in the authentication request or the authentication request in the NAS message.
  • the NAS message may further include an authentication type indication information. .
  • Encapsulating the authentication request as a NAS message can be understood by referring to the three types of NAS messages introduced in step 302.
  • the CPE carries the authentication type indication information as IPoX (DHCP+Authentication), DHCP extension field content (such as option 60), and STB device information in a message container (for example, a Session Management container) of the NAS message PDU session establishment request.
  • IPoX DHCP+Authentication
  • DHCP extension field content such as option 60
  • STB device information in a message container (for example, a Session Management container) of the NAS message PDU session establishment request.
  • a message container for example, a Session Management container
  • the CPE sends a NAS message to the AMF by using the RAN device.
  • the AMF decapsulates the received NAS message.
  • the AMF sends a message to the SMF that carries a DHCP discover message or a key parameter related to authentication in the DHCP discover.
  • the content that the CPE includes in the Session Management container may be carried in the SM request message sent by the AMF to the SMF through the N11 interface.
  • the SMF generates authentication configuration information and/or authentication additional information.
  • the generation of the authentication configuration information and/or the authentication additional information related content can be understood by referring to the description in step 506.
  • the SMF may add the generated authentication additional information to the DHCP discover message, and may also perform the role of the SMF in authenticating the device (for example, DHCP).
  • Relay or DHCP Proxy Modify some of the fields in the DHCP discover message. For example, as a DHCP relay, the SMF can modify the IP address of the first relay node—Raiaddr, hop count, hops, and so on.
  • the SMF may generate a DHCP discover message according to the key parameters related to the authentication included in the message sent by the AMF, where the authentication additional information may be added (for example, the content corresponding to the extension field option 82), and the device may also be in accordance with the SMF.
  • the role of the authentication modifies/fills part of the field in the DHCP discover message.
  • the SMF can modify/fill the IP address of the first relay node—Raiaddr, experienced hop. Number - hops and other fields.
  • the SMF sends a message to the UPF through the N4 interface, where the DHCP Discover message and/or the authentication configuration information may be carried.
  • the authentication related key parameters may be carried, and the authentication configuration information and/or the authentication additional information (for example, the content corresponding to the extension field option 82) generated in step 606 and the like may be carried.
  • the message may be a request/response/transport message or the like, such as a session establishment/modification request.
  • the UPF receives the message sent by the SMF.
  • the UPF may serve as a DHCP relay or a DHCP proxy node according to the authentication configuration information or the authentication type indication information contained therein, for example, with the network device in the DN.
  • the DHCP server interacts.
  • the UPF extracts the DHCP discover message from the N4 session establishment/modification message according to the authentication type indication information or the authentication configuration information, and uses the DHCP relay to modify a part of the DHCP discover message field, and adds the CPE in the extension field option 82.
  • the DHCP relay is used to modify the part of the DHCP message, and the IMSI information of the CPE is added in the extension field option 82.
  • the SMF acts as a DHCP relay or a DHCP proxy node, and interacts with a network device such as a DHCP server in the DN through the UPF.
  • the UPF can be used as an intermediate node to forward the SMF and the DN according to the authentication configuration information or the authentication type indication information. Interaction messages between network devices. For example, the UPF obtains a DHCP discover message generated/modified by the SMF from a message sent by the SMF (for example, a request/response/transport message) for forwarding to the DHCP server.
  • the UPF sends an authentication request packet to the network device in the DN.
  • the UPF sends a DHCP discover message to the DHCP server in the DN through the N6 interface.
  • the network device in the DN performs authentication and authentication on the terminal device according to the authentication mode used by the terminal device. For example, the DHCP server sends an authentication packet to the AAA server based on the authentication parameter in the DHCP discover message, and the AAA server authenticates the STB.
  • the authentication server sends the information of the authentication result to the network device in the DN.
  • the AAA server After the authentication of the STB is passed, the AAA server returns an authentication notification to the DHCP server.
  • the network device in the DN generates an authentication return message, for example, the DHCP server generates a DHCP offer message, carries an IP address pre-allocated for the STB, and adds a reference for CPE route configuration in an extension field (for example, option 121). information.
  • the reference information for CPE routing configuration may include, for example, all or part of the following: a common server (content server, fast change server, etc.) of the IPTV service, IP address/segment address/address prefix, and/or network mask
  • the code information (such as the mask or mask length) and the corresponding next hop node provide the multicast address of the content and the corresponding next hop node. It is worth noting that the DHCP server can also add reference information for CPE route configuration in an extension field (for example, option 121) in subsequent DHCP Ack messages.
  • the UPF receives the DHCP offer message sent by the DHCP server.
  • the UPF may modify/fill part of the field content in the DHCP offer message.
  • the UPF sends a message to the SMF.
  • the message may include multiple key parameters in the DHCP offer message or contain a DHCP offer message.
  • the message may be a request/response/transport message, such as an N4 session setup/modification response message.
  • the SMF may modify/fill part of the field content in the DHCP offer message.
  • the SMF may generate routing configuration information according to reference information contained therein for CPE routing configuration.
  • the routing configuration information may be added in an extension field of the DHCP offer message, or the reference information for the CPE route configuration in the DHCP offer message extension field may be replaced with the routing configuration information.
  • the SMF sends a message to the AMF.
  • the message may be a request/response/transmission message, such as an SM response message.
  • the message container (for example, the session management container) in the message carries multiple key parameters in the DHCP offer message or the DHCP offer message, and may include routing configuration information and/or reference information used for CPE route configuration. .
  • the AMF generates a NAS message.
  • the NAS message may carry a message to the CPE/terminal device through a message container in the response/transport message sent by the SMF.
  • a message container in the response/transport message sent by the SMF For example, in the NAS message PDU session response, the content contained in the session management container in the SM response message sent by the SMF (such as multiple key parameters in the DHCP offer message, routing configuration information, etc.) is carried.
  • the AMF sends the generated NAS message to the CPE through the RAN device.
  • the CPE decapsulates the received NAS message, obtains a DHCP offer message, or extracts key parameters in the DHCP offer message to generate a DHCP offer message.
  • the CPE may perform routing configuration according to routing configuration information in the NAS message and/or reference information used for CPE routing configuration.
  • the CPE can confirm that the DHCP offer message needs to be sent to the STB according to the information in the NAS message or the DHCP offer message.
  • the CPE sends a DHCP offer message to the STB that is the terminal device that sends the authentication request.
  • the STB and the DHCP server will continue to follow the transmission path segments (including STB-CPE, CPE-AMF, AMF-SMF, SMF-UPF, UPF-DHCP server) described in the above steps (601-619).
  • the interaction of messages including DHCP request and DHCP Ack) until the IPoX authentication process is completed.
  • the DHCP server will also return a DHCP Ack message to the STB.
  • the DHCP Ack message returned by the DHCP server may carry the IP address assigned to the STB, and/or be used for CPE routing. Configuration reference information.
  • the various nodes involved including the CPE, RAN device, AMF, SMF, UPF, network device in the DN, etc., will also forward or process subsequent messages in the device access process as described in steps 601-619.
  • the process of implementing network access by a CPE or a terminal device connected thereto through a 4G or 5G mobile network in the embodiment of the present application is described below.
  • the network access process of the CPE can be integrated into the foregoing part one.
  • the CPE performs the network access process first, or can be used as an independent network access solution, whether it is combined.
  • the process of accessing the CPE network is basically the same.
  • the process of accessing the network by the CPE and the process of accessing the network by the terminal device are basically the same. Only the CPE that initiates the authentication request is directly encapsulated by the user plane or the control plane and transmitted to the corresponding device, without considering The steps involved in the transfer between the terminal device and the CPE.
  • the network access process of the CPE or the terminal device connected to it is as described in part II above:
  • Solution 1 the CPE or the terminal device connected thereto completes the network access through the 4G mobile network;
  • Solution 2 the CPE or the terminal device connected thereto completes the network access through the 5G mobile network.
  • both the solution 1 and the solution 2 in the solution may include a network access process of the user plane and a network access process of the control plane.
  • the foregoing description has been made on the network access process of the terminal device, and the network access process of the CPE can be understood by referring to the network access process of the terminal device. Therefore, in the embodiment of the present application, the CPE or The network access process of the terminal device connected to it is described by taking the control plane in the 4G scenario and the control plane in the 5G scenario as an example. The process of the user plane can be understood by referring to the corresponding process in Part 1.
  • the terminal acts as an EAP client, and the authentication request can be forwarded to the EAP device.
  • the EAP device can initiate EAP authentication to the EAP client, and the EAP authentication message is exchanged between the EAP device and the EAP client. Text.
  • the EAP device end transmits the authentication-related packets in the EAP relay mode or the EAP termination mode and the authentication node.
  • the EAP device and the authentication node can transmit the authentication-related packets through the RADIUS or Diameter protocol.
  • the CPE or its attached terminal device can be regarded as a terminal, that is, an EAP client.
  • the CPE or the terminal device connected thereto can be accessed through other types of protocols.
  • the EAP is used as an example to introduce the CPE or the following.
  • the network access authentication process of the connected terminal device but it should not be understood as only the EAP protocol can perform network access authentication of the CPE or its connected terminal device.
  • the NAS protocol bearer is used in the embodiment of the present application.
  • the EAP authentication protocol related message may be included in the mobile core network, and the transmission process between the mobile core network and the network device having the authentication function may include:
  • a node in the mobile core network such as an MME or a mobile gateway in a 4G network, or an AMF or SMF in a 5G network, as a node having an EAP proxy function (which may be simply referred to as an EAP authenticator, that is, an EAP authenticator), can support RADIUS.
  • the /Diameter protocol and the EAP protocol the EAP message is exchanged with the terminal, and the authentication related message is transmitted between the network device having the authentication function, for example, the AAA server; or a node in the mobile core network is used as the middle
  • the RADIUS/Diameter protocol can be used to transmit the EAP message between the terminal and the EAP device.
  • the EAP device and the network device with the authentication function can send authentication-related packets through the RADIUS/Diameter protocol.
  • FIG. 9B shows a protocol stack of a device involved in the authentication process of the EAP device end in the 4G/5G network.
  • FIG. 9C shows a possible example of a protocol stack of a device involved in the authentication process of the EAP device end in the 4G network.
  • FIG. 9D shows a possible example of a protocol stack of a device involved in the authentication process of the EAP device end in the SMF in the 5G network.
  • Figure 9E shows a possible example of a protocol stack for a device involved in the authentication process of the BNG as an EAP device interface to the 4G/5G network.
  • the protocol layer included in the protocol stack of each device of FIG. 9B includes: the protocol stack of the terminal includes multiple protocol layers of the 4G/5G radio access layer, the NAS protocol layer, and optionally, the EAP protocol layer; the 4G network
  • the protocol stack of the medium RAN device includes multiple protocol layers of the radio access layer (such as PDCP, RLC, MAC, PHY, etc.) and multiple protocol layers of the S1 control plane interface;
  • the protocol stack of the RAN device in the 5G network includes wireless access Multiple protocol layers of the layer (such as SDAP, PDCP, RLC, MAC, PHY, etc.) and multiple protocol layers of the N2 interface;
  • the protocol stack of the MME in the 4G network includes multiple protocol layers of the S1 control plane interface, the NAS protocol layer, The multiple protocol layers of the S11 interface and the Diameter/RADIUS protocol layer, optionally including the EAP protocol layer;
  • the protocol stack of the AMF in the 5G network includes multiple protocol layers of the N2 interface, the NAS protocol
  • Layer and Diameter/RADIUS protocol layer optionally, also includes EAP protocol layer;
  • SGW protocol stack in 4G network includes multiple protocol layers of S11 interface and multiple protocol layers of S5/S8 interface;
  • SMF protocol in 5G network The stack includes multiple protocol layers of the N11 interface and multiple protocol layers of the N4 interface
  • the protocol stack of the PGW in the 4G network includes multiple protocol layers of the S5/S8 interface and the lower layer (eg layer 1 to layer 4) protocol layer of the SGi interface;
  • the protocol stack of the UPF in the 5G network includes multiple protocol layers of the N4 interface and N6
  • the AAA server protocol stack includes the Diameter/RADIUS protocol layer, and optionally the EAP protocol layer; when interfacing with the 4G network, the AAA server protocol stack also includes the lower layer protocol layer of the SGi interface;
  • the AAA server protocol stack also includes the lower layer protocol layer of the N6 interface.
  • the protocol stack included in the protocol stack of each device of FIG. 9C includes: the protocol stack of the terminal includes multiple protocol layers of the radio access layer, the NAS protocol layer, and optionally, an EAP protocol layer; the protocol stack of the RAN device includes Multiple protocol layers of the radio access layer and multiple protocol layers of the S1 control plane interface; the protocol stack of the MME includes multiple protocol layers of the S1 control plane interface, multiple protocol layers of the S11 interface, and the NAS protocol layer; the protocol of the SGW The stack includes multiple protocol layers of the S11 interface and multiple protocol layers of the S5/S8 interface; the protocol stack of the PGW includes multiple protocol layers of the S5/S8 interface, the lower layer protocol layer of the SGi interface, and the Diameter/RADIUS protocol layer.
  • the AAA server protocol stack includes a lower layer protocol layer of the SGi interface, a Diameter/RADIUS protocol, and optionally an EAP protocol layer.
  • the protocol stack included in the protocol stack of each device of FIG. 9D includes: the protocol stack of the terminal includes multiple protocol layers of the radio access layer, the NAS protocol layer, and optionally, the EAP protocol layer; the protocol stack of the RAN device includes Multiple protocol layers of the radio access layer and multiple protocol layers of the N2 interface; the protocol stack of the AMF includes multiple protocol layers of the N2 interface and multiple protocol layers of the N11 interface; the protocol stack of the SMF includes multiple protocols of the N11 interface The layer, the multiple protocol layers of the N4 interface, the Diameter/RADIUS protocol layer, and optionally the EAP protocol layer; the protocol stack of the UPF includes multiple protocol layers of the N4 interface and the lower protocol layer of the N6 interface; the AAA server protocol stack The lower layer protocol layer including the N6 interface, the Diameter/RADIUS protocol layer, and optionally the EAP protocol layer.
  • the protocol stack included in the protocol stack of each device of FIG. 9E includes: the protocol stack of the terminal includes multiple protocol layers of the 4G/5G radio access layer, the NAS protocol layer, and optionally, the EAP protocol layer; in the 4G network
  • the protocol stack of the RAN device includes multiple protocol layers (such as PDCP, RLC, MAC, PHY, etc.) of the radio access layer and multiple protocol layers of the S1 control plane interface;
  • the protocol stack of the RAN device in the 5G network includes the radio access layer Multiple protocol layers (such as SDAP, PDCP, RLC, MAC, PHY, etc.) and multiple protocol layers of the N2 interface;
  • the protocol stack of the MME in the 4G network includes multiple protocol layers of the S1 control plane interface, the NAS protocol layer, and the S11 Multiple protocol layers of the interface;
  • the protocol stack of the AMF in the 5G network includes multiple protocol layers of the N2 interface, the NAS protocol layer, and multiple protocol layers of the N11 interface;
  • the protocol stack of the SMF in the 5G network includes multiple protocol layers of the N11 interface, multiple protocol layers of the N4 interface, and the Diameter/RADIUS protocol layer;
  • the protocol stack of the PGW in the 4G network includes the S5 Multiple protocol layers of the /S8 interface, the lower layer protocol layer of the SGi interface, and Diamet The er/RADIUS protocol layer;
  • the protocol stack of the UPF in the 5G network includes multiple protocol layers of the N4 interface and the lower protocol layer of the N6 interface;
  • the protocol stack of the BNG includes the SGi/N6 interface lower layer protocol, the DN network lower layer protocol layer, and the Diameter/RADIUS
  • the protocol layer optionally, also includes an EAP protocol layer;
  • the AAA server protocol stack includes a DN network lower layer protocol layer, a Diameter/RADIUS protocol layer, and optionally an EAP protocol layer.
  • the protocol stacks of the devices involved in each figure are different, on the one hand, related to the 4G or 5G network, and on the other hand, which device is related to the EAP device end.
  • the authentication process of Figures 9B to 9E may include:
  • a terminal in a 4G network, carries an EAP message through a NAS message, and the MME functions as an EAP device end.
  • the MME decapsulates the uplink NAS message sent by the terminal, and then uses the EAP relay mode to encapsulate the EAP message in the RADIUS protocol message or the Diameter protocol message, and sends the message to the network device with the authentication function.
  • the EAP termination mode the authentication related information in the EAP message is extracted and directly written in the RADIUS protocol message or the Diameter protocol message, and sent to the network device with the authentication function.
  • the EAP message when transmitted between the MME and the network device with the authentication function, it may need to be forwarded by some nodes such as the mobile gateway, the BNG, and other routing nodes.
  • the reverse downlink EAP message is also transmitted between segments in a similar manner.
  • the terminal carries the EAP message through the NAS message, and the mobile gateway functions as the EAP device end.
  • the MME establishes a GTP tunnel with the mobile gateway, and can carry various types of EAP messages.
  • the GTP tunnel can be a GTP-U tunnel of the user plane or a GTP of the control plane. C tunnel.
  • the MME decapsulates the uplink NAS message sent from the terminal, and then sends the EAP message to the mobile gateway. Similarly, the mobile gateway sends the downlink EAP message to the MME.
  • a new tunnel may be established between the MME and the mobile gateway, and the type of the tunnel is determined to be used for sending the EAP authentication message.
  • EAP relay can be directly encapsulated in the RADIUS protocol message or the Diameter protocol message between the mobile gateway and the network device with authentication authentication function.
  • the mobile gateway can extract the authentication related information in the EAP message and directly write it in the RADIUS protocol message or the Diameter protocol message.
  • the reverse downlink EAP message is also transmitted between segments in a similar manner.
  • the terminal carries the EAP message through the NAS message, and the AMF sends the EAP message related content to the SMF after decapsulating the uplink NAS message sent by the terminal.
  • the SMF encapsulates the EAP message in a RADIUS protocol message or a Diameter protocol message and sends it to the network device with the authentication function in the DN.
  • the SMF uses the EAP termination mode to set the EAP.
  • the authentication related information in the message is extracted and directly written in the RADIUS protocol message or the Diameter protocol message, and sent to the network device with the authentication function.
  • the EAP message when the EAP message is transmitted between the SMF and the DN with the authentication and authentication function, it may need to be forwarded by some nodes such as UPF, BNG and other routing nodes.
  • the reverse downlink EAP message is also transmitted between segments in a similar manner.
  • the terminal carries the EAP message through the NAS message, and the AMF functions as the EAP device end.
  • the AMF After decapsulating the uplink NAS message sent by the terminal, the AMF encapsulates the EAP message in a RADIUS protocol message or a Diameter protocol message, and sends the EAP message to the network device with the authentication function in the DN.
  • the AMF uses the EAP termination mode to extract the authentication related information in the EAP message, and directly writes it in the RADIUS protocol message or the Diameter protocol message, and sends the information to the network device with the authentication function.
  • the EAP message when transmitted between the AMF and the DN with the authentication and authentication function, it may need to be forwarded by some nodes such as SMF, UPF, BNG and other routing nodes.
  • the reverse downlink EAP message is also transmitted between segments in a similar manner.
  • the terminal carries the EAP message through the NAS message, and the network device other than the mobile network, for example, the BNG, acts as the EAP device end.
  • the EAP message related content is sent to the mobile gateway/SMF, and the mobile gateway/SMF communicates with the EAP device end (for example, BNG) through the RADIUS/Diameter protocol, and the received
  • the content of the EAP message is encapsulated in a RADIUS protocol message or a Diameter protocol message, and is sent to the EAP device (for example, BNG), and then the EAP device uses the EAP relay mode or the EAP termination mode to send the network device with the authentication function.
  • the mobile gateway/SMF sends a message to the EAP device end, such as the BNG, and may need to be forwarded by the UPF and/or other routing nodes.
  • the reverse downlink EAP message is also transmitted between segments in a similar manner.
  • the description of the transmission mode of the EAP authentication message between the segments in the above paragraph is applicable to multiple terminals using the EAP authentication mode for authentication. It is not limited to the scenario of CPE authentication described above.
  • the terminal may be a typical terminal of the WTTx, such as a CPE, and may be a typical mobile terminal such as a mobile phone, and may be a terminal that accesses the network through the mobile terminal, for example, various types of wearable.
  • the device may also be various types of terminals that access the network through the CPE, such as an STB, a PC, and the like.
  • the EAP authentication message that is transmitted between the terminal and the mobile core network device (such as the MME/AMF) by using the NAS message may be related information for authenticating the terminal, or may be used for the terminal.
  • Related messages for other terminal device authentication may be related information for authenticating the terminal, or may be used for the terminal.
  • the scheme 1 of the authentication protocol shown in FIG. 9A and FIG. 9E (mainly FIG. 9E) and the network access flowchart shown in FIG. 10 are used to introduce the scheme 1 in part 2 of the embodiment of the present application:
  • another embodiment of a method for a device to access a network includes:
  • the CPE sends, by using the RAN device, an NAS message including an authentication request and/or an authentication type indication information to the MME.
  • the authentication request is an access request or a connection request or an authentication request or an address allocation request sent by the CPE or a terminal device connected thereto to the network, or other types of information indicating the intent of the access network. To simplify the presentation, they are collectively referred to as authentication requests.
  • the authentication type indication information may include an identification indication of an authentication mode and/or an authentication protocol identifier indication.
  • the MME identifies, according to the authentication authentication type indication information in the NAS message, an authentication mode (such as EAP) required.
  • the MME establishes a channel for transmitting an authentication-related message (for example, an EAP message) with a suitable mobile gateway, for example, establishing a GTP-U/C tunnel.
  • an authentication-related message for example, an EAP message
  • the mobile gateway establishes a connection with a network device in the external network (such as the EAP device BNG in FIG. 9E). This step can be skipped if the channel and/or connection is pre-existing.
  • the MME sends a message, such as a connection request message, to a network device (such as a broadband gateway BNG) in the external network by using the mobile gateway.
  • a network device such as a broadband gateway BNG
  • connection request message includes an identifier of the CPE and/or the connected terminal, where the identifier may be allocated by a mobile core network node, such as an MME, or may be generated by a CPE and/or an attached terminal, or may be a CPE and/or Or the preset identifier in the connected terminal device.
  • a mobile core network node such as an MME
  • a mobile core network node having an EAP proxy capability such as an MME
  • an EAP device is used as an EAP device to generate a message for triggering authentication (such as an EAP-request/Identity message), which is carried in a NAS message and sent to or under the CPE.
  • the hanged terminal device triggers the authentication process; or the mobile gateway, such as the PGW, serves as the EAP device.
  • the mobile gateway such as the PGW, serves as the EAP device.
  • After receiving the connection request it can send a message triggering authentication (such as EAP-request/Identity message), which is carried by the MME.
  • the NAS message is sent to the CPE or its connected terminal device to trigger the authentication process.
  • the mobile core network node may also send a message (for example, “device connection establishment request message”) to an EAP device end (such as BNG) in the external network. It is used to notify the EAP device (such as BNG) to trigger the authentication process for the CPE or its connected terminal device. After receiving the message, the EAP device (such as the BNG) sends a trigger to the CPE or its connected terminal device.
  • the authenticated message (such as EAP-request/Identity message) triggers the authentication process.
  • the EAP-start message is used as an authentication request by the CPE or the terminal device connected thereto, and is carried in the NAS message.
  • the EAP device such as the management function entity or the gateway device or the BNG
  • the EAP authentication process and sends a message to the CPE or its connected terminal device (such as EAP-request/). Identity message), the authentication process is performed.
  • the CPE sends, by using the RAN device, an NAS message that includes an EAP authentication response to the MME.
  • the EAP authentication response such as an EAP-Response/Identity message, is generated by the CPE or a terminal device connected thereto.
  • information such as a Network Access Identifier (NAI), a CPE, or an identifier of a terminal device connected thereto may be added.
  • NAI Network Access Identifier
  • the EAP authentication response message will be delivered to the EAP device side (such as BNG) via the mobile core network node.
  • the EAP device end (such as the BNG) sends an access authentication request to the authentication server.
  • the BNG sends an access authentication request, such as a RADIUS Access-request message, to the AAA server, where the EAP-Response/Identity message can be carried.
  • the BNG may encapsulate the EAP-Response/Identity message in the EAPoR packet in the EAP relay mode, or encapsulate the authentication related information included in the EAP-Response/Identity message in the standard RADIUS packet in the EAP termination mode.
  • the authentication server selects or confirms the applicable authentication protocol, for example, it can interact with the device that stores the user information, such as the HSS, to find the user matching information and confirm the adopted.
  • EAP authentication protocol which may include, but is not limited to, EAP-AKA, EAP-AKA', EAP-SIM, EAP-TLS, EAP-MD5, EAP-TTLS, EAP-OTP defined in the RFC of the IETF. Wait. Then, the authentication process is completed before the authentication server and the EAP device end, and between the EAP device and the CPE or the terminal device connected to it. The messages involved in the authentication process are described in the same way as the previous steps.
  • the EAP-AKA mode is taken as an example to briefly introduce the authentication process for the CPE.
  • the authentication process of the CPE connected terminal can also be understood by referring to the description of the authentication process in the step 707. The difference is that the CPE needs to send the authentication related message included in the received NAS message to the downlink terminal. And the uplink NAS message including the authentication related message generated by the downlink terminal needs to be sent to the MME.
  • the authentication process of the authentication server AAA server to the CPE is as follows:
  • the AAA server responds to an authentication request packet on the EAP device, and sends a Challenge to the CPE, which contains an EAP-Request/AKA-identity packet.
  • the EAP device (such as the BNG) forwards the EAP-request/AKA-identity message to the mobile core network node, such as the mobile gateway, and then sends the message to the CPE via the MME.
  • the mobile core network node such as the mobile gateway
  • the CPE After receiving the CPE, the CPE replies to the EAP-response/AKA-identity response message and sends it to the EAP device (such as BNG) via the mobile core network node (such as the MME and/or the mobile gateway);
  • the EAP device such as BNG
  • the mobile core network node such as the MME and/or the mobile gateway
  • the EAP device (such as the BNG) encapsulates the EAP-response/AKA-identity response packet in the RADIUS Access-request request packet to the AAA server.
  • the AAA server requests the HSS for the authentication vector corresponding to the device according to the CPE device ID included in the EAP-response/AKA-identity message, for example, the IMSI; after the HSS generates the corresponding authentication vector ⁇ RAND, XRES, CK, IK, AUTN ⁇ , sent to the AAA server;
  • the AAA server sends the authentication parameters required by the CPE to the CPE through the EAP device, such as the BNG and the mobile core network node (such as the MME and/or the mobile gateway) through the EAP-Request/AKA-challenge message;
  • the EAP device such as the BNG and the mobile core network node (such as the MME and/or the mobile gateway) through the EAP-Request/AKA-challenge message;
  • the CPE runs the AKA algorithm to verify the authentication parameters to verify the validity of the network, and calculates new authentication parameters, including RES and MAC (Message Authentication Code) values, and feeds back EAP-response/AKA-Challenge response messages to the EAP device.
  • the end (such as BNG) is sent to the AAA server by the EAP device (such as BNG);
  • the AAA server verifies the new MAC received and compares XRES with RES.
  • the EAP-request/AKA-Notification message is sent to the CPE via the EAP device end (such as BNG) and the mobile core network node (such as the mobile gateway and/or the MME);
  • the EAP device end such as BNG
  • the mobile core network node such as the mobile gateway and/or the MME
  • the CPE sends an EAP-response/AKA-Notification message to the AAA server via the mobile core network node (such as the MME and/or the mobile gateway) and the EAP device end such as the BNG;
  • the mobile core network node such as the MME and/or the mobile gateway
  • the EAP device end such as the BNG
  • the AAA server saves the information related to the access session, sends a Subscriber Profile retrieval (optional) to the HSS, generates an EAP-success message, and notifies the EAP device end (such as BNG) and the mobile core network node (such as the MME and/or the mobile gateway). CPE.
  • the EAP device (such as BNG) saves the CPE authentication and authorization information. If the authentication fails, the EAP device end (such as BNG) will notify the CPE or its connected terminal device to fail authentication via the mobile core network node (such as the mobile gateway and/or MME) and the RAN device, and the process ends.
  • the mobile core network node such as the mobile gateway and/or MME
  • the EAP device end (such as BNG) sends an authentication authorization information notification to the mobile core network node (such as the MME and/or the mobile gateway).
  • the mobile core network node such as the MME and/or the mobile gateway.
  • the mobile core network node (such as the MME and/or the mobile gateway) saves the authentication and authorization information of the CPE or the terminal device connected thereto.
  • the possible implementations are as follows:
  • the mobile core network node (such as the MME and/or the mobile gateway) has the EAP proxy capability, it can be used as the EAP device end to save the authentication and authorization information when receiving the EAP-success information.
  • the "Authentication Authorization Information" notification may be sent by the BNG to the mobile core network node (such as the MME and/or the mobile gateway) through the RADIUS/Diameter protocol message and saved.
  • the mobile core network node such as the MME and/or the mobile gateway
  • the EPS bearer of the CPE to the mobile gateway may be established for the subsequent communication.
  • the specific establishment process may refer to the prior art.
  • the CPE or the terminal device connected thereto may initiate a request for assigning an IP address, which is carried in the NAS message and transmitted to the MME, and then sent by the MME to the mobile gateway.
  • the address allocation request is included in the authentication request in step 701, the CPE or the terminal device connected thereto does not need to send the address request again.
  • the mobile gateway may assign an IP address to the CPE or its attached terminal device, or the mobile gateway may initiate a DHCP address allocation request to the network device, such as the BNG.
  • the BNG can assign an IP address to the CPE or its attached terminal device, or request an IP address from the DHCP server, and then the BNG returns the assigned IP address to the mobile gateway.
  • the packets returned by the network device (such as DHCP offer and/or DHCP Ack) may carry reference information for CPE route configuration (for example, carrying route configuration reference information in the extension field option 121).
  • the mobile gateway may return the result of the address assignment to the CPE that initiated the request or the terminal device under it via the MME. If the packet returned by the network device includes reference information for CPE routing configuration, the mobile gateway may generate routing configuration information according to the reference message, and is included in the notification message sent by the mobile gateway to the CPE via the MME.
  • the reference information for the CPE route configuration and the routing configuration information can be understood by referring to the descriptions in steps 109 and 110.
  • the BNG records the online status of the CPE or the terminal device connected thereto.
  • the BNG can periodically query the online status of the CPE or the terminal device connected by using the handshake request (EAP-request/identity) handshake message, and the online CPE or the terminal device connected thereto can pass the handshake response (EAP-response/identity). Respond.
  • EAP-request/identity handshake request
  • EAP-response/identity handshake response
  • the CPE or the terminal device connected thereto completes the network access process through the 4G mobile network.
  • FIG. 9A to FIG. 9E mainly FIG. 9E
  • FIG. 11 the scheme 2 in part two is described, that is, the CPE or the terminal device connected thereto completes the network access process through the 5G mobile network.
  • another embodiment of a device access network provided by an embodiment of the present application includes:
  • the CPE sends, by using the RAN device, an NAS message that includes an authentication request and/or an authentication authentication type indication information to the AMF.
  • the authentication request is an access request or a connection request or an authentication request or an address allocation request sent by the CPE or a terminal device connected thereto to the network, or other types of information indicating the intent of the access network. To simplify the presentation, they are collectively referred to as authentication requests.
  • the authentication type indication information may include an identification indication of an authentication mode and/or an authentication protocol identifier indication.
  • the AMF identifies the required authentication mode (such as EAP) according to the authentication type indication information in the NAS message.
  • the AMF selects an appropriate SMF and establishes a channel for carrying the EAP message with the SMF.
  • the SMF selects an appropriate UPF and connects the network device in the external network through the UPF (as shown in the EAP device in FIG. 9E).
  • BNG Establish a connection. This step can be omitted if the channel/connection is pre-built.
  • the AMF sends a message (for example, a request/response/transport message) to the SMF, where the key parameter in the authentication request or the authentication request message of the CPE or the terminal device connected thereto may be included.
  • a message for example, a request/response/transport message
  • the SMF sends a message to a network device such as a BNG in the DN via the UPF.
  • the message (which may be, for example, a "connection request message”) may contain key parameters in an authentication request or an authentication request message of the CPE or the terminal device under it.
  • the message includes an identifier of the CPE or a terminal device connected thereto, and the identifier may be allocated by a mobile core network node, such as an AMF or an SMF, or may be generated by the CPE or a terminal device connected thereto, or may be The identifier preset in the CPE or its connected terminal device.
  • Trigger authentication authentication there are three possible ways:
  • a mobile core network node having an EAP proxy capability such as AMF
  • AMF EAP proxy capability
  • AMF EAP-request/Identity message
  • the message of the right (such as the EAP-request/Identity message) is carried in the NAS message and sent to the CPE to trigger the authentication process.
  • the mobile core network node such as the SMF, may also send a message (for example, a “device connection establishment request” message) to the EAP device end in the external network via the UPF.
  • a message for example, a “device connection establishment request” message
  • the BNG is used to notify the BNG to trigger the authentication process for the CPE or the terminal device connected to it.
  • the BNG sends a message triggering the authentication to the CPE or the terminal device connected to it (such as EAP-request). /Identity message), triggers the authentication process.
  • the EAP-start message may be used as an authentication request by the CPE or the terminal device connected thereto, and may be carried in the NAS message.
  • the EAP device end (such as the mobile core network node AMF or SMF or UPF, or an external network device such as BNG) is triggered by the EAP authentication process after receiving the EAP-start message, and sends a message to the CPE (for example, EAP-request/ Identity message), the authentication process is performed.
  • the CPE sends, by using the RAN device, a NAS message that includes an EAP authentication response.
  • the EAP authentication response such as an EAP-Response/Identity message, in which information such as the network access identifier information NAI, the CPE or the identifier of the terminal device connected thereto, may be added, and the EAP authentication response message is sent through the mobile core network node (such as AMF and / or SMF and / or UPF) is passed to the EAP device side (such as BNG).
  • the mobile core network node such as AMF and / or SMF and / or UPF
  • the EAP device end (such as the BNG) sends an access authentication request to the authentication server.
  • the BNG sends an access authentication request, such as a RADIUS Access-request message, to the AAA server, where the EAP-Response/Identity message can be carried.
  • the BNG may encapsulate the EAP-Response/Identity message in the EAPoR packet in the EAP relay mode, or encapsulate the authentication related information included in the EAP-Response/Identity message in the standard RADIUS packet in the EAP termination mode.
  • the EAP device may need to forward some nodes in the SMF, UPF, BNG, and other routing nodes.
  • the authentication process can refer to the process in step 707 above, in which the mobile core network node involved, the role of the mobile gateway is replaced by SMF and UPF, and the role of the MME is replaced by AMF.
  • the EAP device (such as BNG) saves the CPE authentication and authorization information. If the authentication fails, the EAP device (such as BNG) will notify the CPE or its connected terminal device to fail authentication via the mobile core network node (such as UPF and/or SMF and/or AMF) and the RAN device, and the process ends.
  • the mobile core network node such as UPF and/or SMF and/or AMF
  • the EAP device end (such as BNG) sends an authentication authorization information notification to the mobile core network node (such as UPF and/or SMF and/or AMF).
  • the mobile core network node such as UPF and/or SMF and/or AMF.
  • the mobile core network node (such as UPF and/or SMF and/or AMF) saves the authentication and authorization information of the CPE or the terminal device connected thereto.
  • the mobile core network node (such as UPF and/or SMF and/or AMF) has the EAP proxy capability, it can be used as the EAP device end to save the authentication and authorization information when receiving the EAP-success information.
  • the "Authentication Authorization Information" notification may be sent by the BNG to the mobile core network node (such as UPF and/or SMF and/or AMF) through the RADIUS/Diameter protocol message and saved.
  • the mobile core network node such as UPF and/or SMF and/or AMF
  • the PDU session between the CPE and the UPF (including the air interface bearer of the RAN device to the CPE, the N3 tunnel), the N4 session, and the like may be established.
  • the specific establishment process refer to the prior art, for example, 3GPP TS23.502 V0. The corresponding part of .4.0 is understood.
  • the CPE or its connected terminal device can initiate a request for assigning an IP address, carry it in the NAS message and transmit it to the AMF, and then send it to the SMF by the AMF.
  • the address allocation request is included in the authentication request in step 701, the CPE or the terminal device connected thereto does not need to send the address request again.
  • the SMF may assign an IP address to the CPE or its attached terminal device, or the SMF may initiate a DHCP address allocation request to the network device, such as the BNG, via the UPF.
  • the BNG may assign an IP address to the CPE or its attached terminal device, or request an IP address from the DHCP server, and then return the assigned IP address to the SMF via the UPF.
  • the packets returned by the network device (such as DHCP offer and/or DHCP Ack) may carry reference information for CPE route configuration (for example, carrying route configuration reference information in the extension field option 121).
  • the SMF returns the result of the address assignment via the AMF to the CPE that initiated the request or the terminal device it is attached to. If the message returned by the network device includes reference information for CPE route configuration, the SMF may generate route configuration information according to the reference message, and is included in the notification message sent by the SMF to the CPE via the AMF.
  • the reference information for the CPE route configuration and the routing configuration information can be understood by referring to the descriptions in steps 109 and 110.
  • the BNG records the online status of the CPE or the terminal device connected thereto.
  • the BNG can periodically query the online status of the CPE or the terminal device connected by using the handshake request (EAP-request/identity) handshake message, and the online CPE or the terminal device connected thereto can pass the handshake response (EAP-response/identity). Respond.
  • EAP-request/identity handshake request
  • EAP-response/identity handshake response
  • the CPE or the terminal device connected thereto completes the network access process through the 5G mobile network.
  • the network access mode described above indicates the authentication mode or the authentication protocol type information to indicate the authentication mode by using the authentication type indication information.
  • a specific channel may be established between the CPE and the gateway device for sending the authentication.
  • the channel may be a bearer or a transmission tunnel, or may be an APN/DNN or PDN connection or a PDU session or a network slice, as long as the channel can be associated with the authentication mode. There is no limit in the middle.
  • the CPE negotiates with the gateway device the authentication mode or authentication protocol used by the data in the channel.
  • the authentication type indication information does not need to be transmitted when the authentication request of the terminal device is transmitted, or the authentication protocol type information does not need to be transmitted when the CPE authentication request is transmitted, and only needs to be corresponding according to the corresponding authentication method.
  • the transmission authentication request or the authentication request may be carried on the bearer.
  • the authentication result can also be returned through the channel, or the authentication result can be returned by other system-defined information.
  • other authentication steps in a manner of using a specific channel can be understood by referring to the corresponding processes in the foregoing embodiments, and details are not repeatedly described in the embodiments of the present application.
  • the above is the process of the device accessing the network via the mobile network.
  • the following describes the process of accessing the network by the device under the converged network architecture in the embodiment of the present application.
  • the convergence network in the 5G scenario provided by the embodiment of the present application includes:
  • the protocol stack of the terminal device may include an Ethernet protocol layer, a LAN (including LAN, WLAN, etc.) protocol layer, and a personal area network (PAN, such as Bluetooth, Zigbee, etc.) under the NAS layer.
  • Low-level protocols for interconnection technologies D2D, microwave, infrared, etc.
  • the STB is a conventional fixed terminal (also referred to as a fixed network terminal or a wired network terminal), and the traditional fixed terminal transmits a NAS message between the AMF and the AMF, for example, in the embodiment of the present application.
  • the name of the interface can be used for NAS message transmission between each terminal device and AMF.
  • the NG-STB is a 5G fixed terminal, and the 5G fixed terminal transmits a NAS message through the N1b interface and the AMF;
  • the NG-UE is a mobile terminal in the 5G network, and the 5G mobile terminal transmits the NAS message through the N1 interface in the 5G network and the AMF.
  • NG-RG is a home gateway in a 5G network.
  • the NG-RG can have a wireless terminal module (that is, WTTx CPE, which accesses the network through the radio access network RAN), and can also have a fixed terminal module (ie, a fixed CPE, which is wired.
  • NG-RG can be connected by wireless (such as terminal direct connection D2D in 3GPP, or WiFi/Bluetooth/Zigbee/microwave/infrared connection) or wired connection (such as Ethernet) ), with other terminal devices in the home (such as STB, NG-UE, NG-STB, etc.) to form a WLAN/LAN/PAN (WLAN is a wireless local area network, LAN is a local area network, PAN is a personal area network), and these terminal devices are provided.
  • Network access service; NG-NAS is the NAS message processing module in the CPE. The NAS message is transmitted between the N1a interface and the AMF.
  • the WTTx RAN module in the RAN transmits control plane messages through the interface N2b and the AMF, and the Fixed AN module passes the interface N2a. Transfer control key messages to and from AMF.
  • Figure 12 is an authentication scheme of a CPE in a converged network and a terminal device connected to the CPE.
  • the CPE and the terminal device connected to the CPE carry the authentication corresponding to various possible authentication protocols through the NAS message.
  • the message is sent to the network for authentication and authentication.
  • the various types of possible authentication technologies include, but are not limited to, the EPS-AKA or EPS-AKA mechanism commonly used in wireless networks, or the EAP-TLS, EAP-SIM, EAP-AKA of the EAP series commonly used in wireless local area networks.
  • EAP-AKA', or the authentication mechanism corresponding to the access methods such as PPP, PPPoX, and IPoX commonly used in fixed networks.
  • the NAS protocol bears on the mobile network side.
  • the three types of the NAS message can be understood by referring to the description in the foregoing section. The details are not repeated here.
  • (R)AN indicates that the access network may be a radio access network or a fixed (wired) access network, ie, the (R) AN device represents a radio access network device such as a base station, or a fixed (wired) access network device such as DSLAM.
  • another embodiment of a device access network provided by an embodiment of the present application includes:
  • the terminal device sends an authentication request.
  • the terminal device can be understood as a terminal device connected to the CPE, and the terminal device connected to the CPE is connected to the terminal device of the CPE, and the terminal device accesses the network through the CPE.
  • the authentication request may be included in the NAS message.
  • the NAS message may further carry the authentication type indication information.
  • the authentication request is an access request or a connection request or an authentication request or an address allocation request sent by the terminal device to the network when the network access is performed, or other types of information indicating the intention of the access network, for the simplified expression, collectively Request for authentication.
  • the authentication type indication information may include an identification indication of an authentication mode and/or an authentication protocol identifier indication.
  • the CPE acts as a relay role, and forwards the NAS message to the (R) AN device, and the (R) AN device sends the NAS message of the terminal device connected to the CPE to the AMF.
  • the CPE may generate an uplink NAS message and send the message to the AMF via the (R) AN device, where the terminal device authentication is carried. Key parameters in the request or authentication request message, and/or authentication type indication information.
  • the AMF parses the received NAS message.
  • the AMF sends an authentication request to a node having an authentication function, such as an AUSF.
  • the AUSF can support various types of authentication protocols. After the authentication request message sent by the AMF and the authentication of the terminal device are completed, the AUSF returns the authentication result to the AMF.
  • the AMF sends a message to the SMF.
  • the message (eg, request/response/transport message) can be used to request the establishment of a PDU session, which can also include an address request of the terminal device.
  • the SMF selects an appropriate UPF according to the requirements of the terminal device, establishes a PDU session, and allocates an IP address to the terminal device.
  • the SMF may assign an IP address to the terminal device, or the SMF may initiate a DHCP address allocation request to the external network device (DN node) such as the BNG via the UPF.
  • the BNG may assign an IP address to the terminal device, or request an IP address from the DHCP server, and then carry the assigned IP address in the return message (eg, DHCP offer and/or DHCP Ack, etc.) and return it to the SMF via the UPF.
  • the packets returned by the network device (such as DHCP offer and/or DHCP Ack) may carry reference information for CPE route configuration (for example, carrying route configuration reference information in the extension field option 121).
  • the reference information content for the CPE routing configuration can be understood by referring to the corresponding description in step 109.
  • the SMF receives a message returned by an external network device having an address allocation function, where the IP address assigned to the terminal device may be included, and/or used for CPE routing configuration reference information.
  • the SMF may generate route configuration information according to the reference message and include the notification message sent by the SMF to the CPE via the AMF.
  • the reference information for the CPE routing configuration and the routing configuration information content can be understood by referring to the descriptions in steps 109 and 110.
  • the SMF sends a message to the AMF.
  • the message may be a request/response/transport message, such as a “session establishment response message”, where the message includes a notification message sent by the SMF to the terminal device connected to the CPE, and the notification message may include a terminal that is connected to the CPE.
  • the message may include a notification message sent by the SMF to the CPE, where the notification message may include routing configuration information.
  • the AMF generates an authentication return message by using the result of the authentication and/or the IP address allocation result and/or the routing configuration information, and may be encapsulated in the NAS message sent to the terminal device connected to the CPE.
  • the AMF may also carry the notification message in the NAS message sent to the CPE.
  • AMF to (R) AN device, (R) AN device to CPE, CPE to the connected terminal device transmits the authentication return message step by step.
  • the CPE receives the NAS message forwarded by the (R) AN device. If the NAS message includes an authentication return message sent to the terminal device connected to the CPE, which includes routing configuration information, the CPE is included. You can read the routing configuration information (such as CPE configuration NAS snooping function) for routing configuration. Alternatively, the AMF includes routing configuration information in the NAS message sent to the CPE, and the CPE performs routing configuration after receiving the corresponding NAS message.
  • the routing configuration information such as CPE configuration NAS snooping function
  • the network access process of the terminal device can be implemented under the 5G scene fusion network architecture in the embodiment of the present application, thereby avoiding laying a dedicated network channel and improving the utilization of the mobile network. rate.
  • the above is the authentication process for the terminal device connected to the CPE.
  • the authentication process of the CPE in this scenario is actually the same as the process corresponding to Figure 13, except that the CPE acts as a relay when the terminal device is authenticated.
  • the CPE acts as a relay when the terminal device is authenticated.
  • the authentication request is directly sent by the CPE carrying the NAS message on the CPE.
  • another embodiment of a device access network provided by an embodiment of the present application includes:
  • the CPE sends an authentication request to the AMF via the (R) AN device.
  • the authentication request may be included in the NAS message.
  • the NAS message may further carry the authentication type indication information.
  • the authentication request is an access request or a connection request or an authentication request or an address allocation request sent by the CPE to the network when the network access is performed, or other types of information indicating the intention of the access network, which are collectively referred to as a simplified expression.
  • Authentication request The authentication type indication information may include an identification indication of an authentication mode and/or an authentication protocol identifier indication.
  • the process of 1002 to 1011 is similar to the steps 903 to 912 of the embodiment corresponding to FIG. 13 described above, and can be understood with reference to steps 903 to 912. It should be noted that the difference between this embodiment and the previous embodiment corresponding to FIG. 13 is that, in this embodiment, the authentication and address allocation are for the CPE, so in steps 903 to 912, the core network is used.
  • the message that the device returns to the terminal device connected to the CPE can be replaced with the message returned by the core network device to the CPE in this embodiment.
  • the CPE can read the content. For example, the CPE can obtain routing configuration information from the NAS message received by itself, without performing NAS snooping.
  • the network access process of the CPE in the 5G scene fusion network architecture can be implemented in the embodiment of the present application, thereby avoiding laying a dedicated network channel and improving the utilization rate of the mobile network.
  • part 4 of the embodiment of the present application is introduced, that is, a terminal device that is connected to the CPE and another network access plan of the CPE in the converged network in the converged network architecture of the 5G scenario.
  • another embodiment of a method for a device to access a network includes:
  • the terminal device sends an authentication request.
  • the terminal device can be understood as a terminal device connected to the CPE, and the terminal device connected to the CPE is connected to the terminal device of the CPE, and the terminal device accesses the network through the CPE.
  • the authentication request may be included in the NAS message.
  • the NAS message may further carry the authentication type indication information.
  • the authentication request is an access request or a connection request or an authentication request or an address allocation request sent by the terminal device to the network when the network access is performed, or other types of information indicating the intention of the access network, for the simplified expression, collectively Request for authentication.
  • the authentication type indication information may include an identification indication of an authentication mode and/or an authentication protocol identifier indication.
  • the CPE acts as a relay role, and forwards the NAS message including the terminal authentication request to the (R) AN device, and then forwards to the AMF via the (R) AN device.
  • the CPE may generate an uplink NAS message and send the message to the AMF via the (R) AN device, where the terminal device authentication is carried. Key parameters in the request or authentication request message, and/or authentication type indication information.
  • Steps 1103 to 1116 can be understood by referring to steps 504 to 517.
  • the CPE receives the NAS message forwarded by the (R) AN device. If the NAS message includes an authentication return message sent to the terminal device connected to the CPE, where the routing configuration information is included, the CPE is included. You can read the routing configuration information (such as CPE configuration NAS snooping function) for routing configuration. Alternatively, the AMF includes routing configuration information in the NAS message sent to the CPE, and the CPE performs routing configuration after receiving the corresponding NAS message.
  • the routing configuration information such as CPE configuration NAS snooping function
  • the NAS snooping function in the embodiment of the present application means that the device can read the NAS message for the NAS message transmitted through the device, and learn all or part of the content of the NAS message, but does not change the content of the NAS message.
  • the CPE transmits, to the terminal device connected thereto, the NAS message sent by the AMF to the terminal device.
  • the network access process of the terminal device can be implemented under the 5G scene fusion network architecture, thereby avoiding laying a dedicated network channel and improving the utilization of the mobile network. rate.
  • the above is the authentication process for the terminal device connected to the CPE.
  • the authentication process of the CPE in this scenario is basically the same as the process corresponding to Figure 15. The difference includes: when the terminal device is authenticated, the CPE acts as a relay. Role: When the CPE is authenticated, the authentication request is sent directly by the CPE carrying the NAS message on the CPE.
  • another embodiment of a device access network provided by an embodiment of the present application includes:
  • the CPE sends an authentication request to the AMF via the (R) AN device.
  • the authentication request may be included in the NAS message.
  • the NAS message may further carry the authentication type indication information.
  • the authentication request is an access request or a connection request or an authentication request or an address allocation request sent by the CPE to the network when the network access is performed, or other types of information indicating the intention of the access network, which are collectively referred to as a simplified expression.
  • Authentication request The authentication type indication information may include an identification indication of an authentication mode and/or an authentication protocol identifier indication.
  • the process of 1202 to 1215 is similar to step 1103 to step 1116 in the embodiment corresponding to FIG. 15 described above, and can be understood with reference to steps 1103 to 1116.
  • the difference between the embodiment and the embodiment corresponding to FIG. 15 is that, in this embodiment, both the authentication and the address allocation are for the CPE, so in step 1103 to step 1116, the core network device returns.
  • the message to the terminal device connected to the CPE should be replaced with the message returned by the core network device to the CPE in this embodiment.
  • the CPE can read the content.
  • the CPE can obtain routing configuration information from the NAS message received by itself, without performing NAS snooping.
  • the NAS snooping function in the embodiment of the present application means that the device can read the NAS message for the NAS message transmitted through the device, and learn all or part of the content of the NAS message, but does not change the content of the NAS message.
  • the CPE can be accessed in the converged network, thereby avoiding laying a dedicated network channel and improving The utilization of mobile networks.
  • the foregoing is a description of the method for accessing the network in the embodiment of the present application.
  • the device for accessing the network is described below with reference to the accompanying drawings.
  • the device can be regarded as an abstract summary of various devices used for accessing the network in the embodiment of the present application. .
  • the device accessing the network may be a CPE, a gateway device, a management function entity or a terminal device.
  • the apparatus 130 for accessing the network may include the following modules divided by functions: a receiving module 1301, a processing module 1302, and a transmitting module 1303.
  • the receiving module 1301 can perform the receiving function when the device accessing the network in the embodiment shown in FIG. 3 to FIG. 16 is a corresponding CPE, a gateway device, a management function entity or a terminal device.
  • the sending module 1303 can perform the sending function when the device accessing the network in the embodiment shown in FIG. 3 to FIG. 16 is a corresponding CPE, a gateway device, a management function entity or a terminal device.
  • the processing module 1302 can perform the processing functions when the device accessing the network in the embodiment shown in FIG. 3 to FIG. 16 is a corresponding CPE, a gateway device, a management function entity, or a terminal device.
  • FIG. 18 is a schematic structural diagram of a CPE 140 according to an embodiment of the present invention.
  • the CPE 140 includes at least one processor 1410, a memory 1450, and a transceiver 1430.
  • the memory 1450 can include read only memory and random access memory and provides operational instructions and data to the processor 1410.
  • a portion of memory 1450 may also include non-volatile random access memory (NVRAM).
  • NVRAM non-volatile random access memory
  • the memory 1450 stores the following elements, executable modules or data structures, or a subset thereof, or their extended set:
  • the corresponding operation is performed by calling an operation instruction stored in the memory 1450 (which can be stored in the operating system).
  • the processor 1410 controls the operation of the CPE 140, which may also be referred to as a CPU (Central Processing Unit).
  • Memory 1450 can include read only memory and random access memory and provides instructions and data to processor 1410.
  • a portion of memory 1450 may also include non-volatile random access memory (NVRAM).
  • the specific components of the CPE 140 are coupled together by a bus system 1420 in a specific application.
  • the bus system 1420 may include a power bus, a control bus, a status signal bus, and the like in addition to the data bus. However, for clarity of description, various buses are labeled as bus system 1420 in the figure.
  • Processor 1410 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method may be completed by an integrated logic circuit of hardware in the processor 1410 or an instruction in a form of software.
  • the processor 1410 described above may be a general purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, or discrete hardware. Component.
  • DSP digital signal processor
  • ASIC application specific integrated circuit
  • FPGA off-the-shelf programmable gate array
  • the methods, steps, and logical block diagrams disclosed in the embodiments of the present invention may be implemented or carried out.
  • the general purpose processor may be a microprocessor or the processor or any conventional processor or the like.
  • the steps of the method disclosed in the embodiments of the present invention may be directly implemented by the hardware decoding processor, or may be performed by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in a conventional storage medium such as random access memory, flash memory, read only memory, programmable read only memory or electrically erasable programmable memory, registers, and the like.
  • the storage medium is located in the memory 1450, and the processor 1410 reads the information in the memory 1450 and, in conjunction with its hardware, performs the steps of the above method.
  • the transceiver 1430 is configured to perform the steps of receiving and transmitting the CPE in the embodiment shown in Figures 3-16.
  • the processor 1410 is configured to perform the steps of the processing of the CPE in the embodiment shown in Figures 3-16.
  • gateway devices management function entities, and terminal devices
  • terminal devices can also be understood by referring to FIG. 18, in which the functions of the corresponding transceivers and processors in the gateway device, the management function entity, and the terminal device can perform the devices in FIG. 3 to FIG. The corresponding steps of receiving, sending and processing.
  • FIG. 19 is a schematic structural diagram of a chip system 150 according to an embodiment of the present invention.
  • the chip system 150 includes at least one processor 1510, a memory 1550, and an interface circuit 1530 that can include read only memory and random access memory and provides operational instructions and data to the processor 1510.
  • a portion of memory 1550 may also include non-volatile random access memory (NVRAM).
  • NVRAM non-volatile random access memory
  • the memory 1550 stores elements, executable modules or data structures, or a subset thereof, or their extended set:
  • the corresponding operation is performed by calling an operation instruction stored in the memory 1550 (which can be stored in the operating system).
  • One possible implementation manner is that the structure of the chip system used by the customer premises equipment, the gateway equipment, the management function entity or the terminal equipment is similar, but different devices use different chip systems to implement their respective functions.
  • the processor 1510 controls operations of a user premises equipment, a gateway device, a management function entity, or a terminal device.
  • the processor 1510 may also be referred to as a CPU (Central Processing Unit).
  • Memory 1550 can include read only memory and random access memory and provides instructions and data to processor 1510.
  • a portion of memory 1550 may also include non-volatile random access memory (NVRAM).
  • NVRAM non-volatile random access memory
  • the components of the CPE 140 are coupled together by a bus system 1520.
  • the bus system 1520 may include a power bus, a control bus, a status signal bus, and the like in addition to the data bus. However, for clarity of description, various buses are labeled as bus system 1520 in the figure.
  • the method disclosed in the foregoing embodiments of the present invention may be applied to the processor 1510 or implemented by the processor 1510.
  • the processor 1510 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the foregoing method may be completed by an integrated logic circuit of hardware in the processor 1510 or an instruction in a form of software.
  • the processor 1510 described above may be a general purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, or discrete hardware. Component.
  • DSP digital signal processor
  • ASIC application specific integrated circuit
  • FPGA off-the-shelf programmable gate array
  • the methods, steps, and logical block diagrams disclosed in the embodiments of the present invention may be implemented or carried out.
  • the general purpose processor may be a microprocessor or the processor or any conventional processor or the like.
  • the steps of the method disclosed in the embodiments of the present invention may be directly implemented by the hardware decoding processor, or may be performed by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in a conventional storage medium such as random access memory, flash memory, read only memory, programmable read only memory or electrically erasable programmable memory, registers, and the like.
  • the storage medium is located in the memory 1550, and the processor 1510 reads the information in the memory 1550 and performs the steps of the above method in combination with its hardware.
  • the interface circuit 1530 is configured to perform the steps of receiving and transmitting the resident equipment, the gateway device, the management function entity, or the terminal device in the embodiment shown in FIG. 3-16.
  • the processor 1510 is configured to perform the processing of the resident equipment, the gateway device, the management function entity, or the terminal device in the embodiment shown in FIG. 3-16.
  • the instructions stored by the memory for execution by the processor may be implemented in the form of a computer program product.
  • the computer program product may be written in the memory in advance, or may be downloaded in software and installed in the memory.
  • the computer program product includes one or more computer instructions.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable device.
  • the computer instructions can be stored in a computer readable storage medium or transferred from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions can be from a website site, computer, server or data center Transfer to another website site, computer, server, or data center by wire (eg, coaxial cable, fiber optic, digital subscriber line (DSL), or wireless (eg, infrared, wireless, microwave, etc.).
  • wire eg, coaxial cable, fiber optic, digital subscriber line (DSL), or wireless (eg, infrared, wireless, microwave, etc.).
  • the computer readable storage medium can be any available media that can be stored by a computer or a data storage device such as a server, data center, or the like that includes one or more available media.
  • the usable medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (such as a solid state disk (SSD)).

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请公开了一种在通信技术领域内终端设备通过无线手段接入网络的方法，包括：通信网络中的驻地节点接收来自于终端设备的第一消息，第一消息包含鉴权请求；驻地节点发送第二消息，第二消息被网络节点处理为第三消息，第三消息被用于网关设备识别鉴权请求和/或终端设备接入网络的鉴权方式，鉴权请求和/或终端设备接入网络的鉴权方式被用于网络对终端设备进行鉴权；驻地节点接收来自于网络的鉴权结果的信息，并向终端设备发送鉴权结果的信息。本申请技术方案可以利用移动网络完成驻地节点下的终端设备接入网络，避免了铺设专用的网络通道，提高了移动网络的利用率。本申请实施例还提供了相应的设备及系统。

Description

一种接入网络的方法、设备及系统
本申请要求于2017年8月2日提交中国专利局、申请号为201710652059.2、发明名称为“一种接入网络的方法、设备及系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，具体涉及一种接入网络的方法、设备及系统。
背景技术
近年来，随着网络建设的大力发展，全球宽带普及率逐步增长。而大量新兴业务的涌现，对网络不断提出着更快速率的要求。一些古老而传统的有线连接方式，比如非对称数字用户环路(asymmetric digital subscriber line，英文简称：ADSL)无法满足宽带业务的提速需求，需要通过大量部署光纤(fiber to the x，英文简称：FTTx)来改造升级接入网络。然而，在一些老城区或一些地广人稀的偏远地区，光纤的铺设代价非常大，施工成本高，网络运营商无法接受，因此，为满足这种场景的宽带接入需求，无线接入(wireless to the x，英文简称：WTTx)成了一种可能的选项。
在WTTx场景中，如图1所示，家庭用户部署安装用户驻地设备(customer premise equipment，英文简称：CPE)，CPE通过无线空口连接到运营商部署的无线接入网络(radio access network，英文简称：RAN)设备，继而接入网络，而CPE可以为更多的终端设备提供网络连接。终端设备可以是手机、电脑、电视的机顶盒(set-top box，英文简称：STB)等。对于CPE下的各种终端设备，需要网络提供鉴权和地址分配服务，这些设备才可以顺利开展相应的业务。例如机顶盒，若要其能接收互联网电视(internet protocol television，英文简称：IPTV)业务，需在IPTV网络内鉴权通过后，被分配合法的互联网协议(internet protocol，英文简称：IP)地址后，方能请求IPTV的各类节目。
现在的无线网络中，移动终端的认证方式为通过控制面的非接入层(non-access stratum，英文简称：NAS)消息，将移动终端信息发送至核心网节点，一般为移动管理实体(mobile management entity，英文简称：MME)向归属签约用户服务器(home subscriber server，英文简称：HSS)查询终端设备信息后进行鉴权，然后由分组数据网关(packet data network gateway，英文简称：PGW)为移动终端设备分配IP地址后，再通过NAS消息发送给移动终端。
在固定网络接入的方式中，终端常用的典型接入方式有以下三种，基于X网络的点到点协议(point to point protocol over X，英文简称：PPPoX)的接入方式、基于X网络上承载IP协议(internet protocol over X，英文简称：IPoX)的接入方式和基于IEEE802.1x标准的接入方式。每种接入方式都对应于不同的鉴权方式，例如：
PPPoX的接入方式在不同类型的网络上提供点到点的连接，通过PPP拨号的方式实现宽带网络的接入和远程连接。终端通过与宽带远程接入路由器(broadband remote access router，英文简称：BRAS)之间建立隧道，承载PPP会话。例如，最常见的以太网承载PPP协议(point to point protocol over ethernet，英文简称：PPPoE)就是一种将PPP封装在以太网框架中的隧道协议，终端与BRAS进行PPPoE协商即发现阶段交互后，进行PPP 会话协商(包含链路控制协议(link control protocol，英文简称：LCP)协商、认证和网络控制协议(network control protocol，英文简称：NCP)协商三个阶段)。认证期间，终端基于LCP协商的认证方式将认证报文发给BRAS，然后由BRAS通过远端用户接入验证服务(Remote Authentication Dial In User Service，英文简称：RADIUS)协议向认证服务器(AAA server)发送认证请求。认证通过后，在NCP阶段，BRAS为固网终端分配IP地址并返回给请求地址的终端。
对于IPoX接入方式，常用的鉴权方式为“动态主机配置协议(dynamic host configuration protocol，英文简称：DHCP)+认证”，终端以静态配置或DHCP方式获取IP地址，以Web认证、绑定认证或快速认证等方式验证用户身份。例如，在绑定认证方式中，终端广播DHCP请求，网关收到后将终端的DHCP请求转发至DHCP服务器，由DHCP服务器向认证服务器(AAA server)发认证请求，认证通过后，DHCP server为请求地址的固网终端分配合法的IP地址，返回给网关，然后再转发至请求的终端。
基于IEEE 802.1x的接入方式引入了PPP协议的扩展认证协议(extensible authentication protocol，英文简称：EAP)，可以采用更多的认证机制，比如消息摘要算法第5版(Message-Digest Algorithm-5，MD5)，一次性口令(one time passwords，英文简称：OTP)，智能卡、预共享秘钥(security Pre-shared Key)等多种扩展认证方法。
移动网络中基于NAS消息的网络接入方式，目前仅适用于移动终端，CPE作为移动终端可以采用此方法进行鉴权和地址分配，但其下所属的其他诸如电脑、电视机顶盒等终端设备，由于不支持移动网络中的控制面协议，目前暂时无法通过NAS消息进行鉴权和地址请求。它们仍然会按照传统的固网鉴权协议(PPPoX或IPoX等)发起请求，这些请求需要经由CPE和基站的无线接入网，以及回传(backhaul)网络传至移动网关，例如PGW后，转发至外部网络中进行鉴权和地址分配的节点，如网关设备BNG/BRAS/SR(为便于表述，本文中统称为BNG)、DHCP server等，现有移动网络中并不支持，故需要对网络中的节点改动后适配CPE下挂的终端设备的接入鉴权需求。
由以上描述可见，现有的CPE下挂的终端设备在光纤铺设不足的地区无法较好的接入网络。
发明内容
为解决现有技术中终端设备无法较好的接入网络的问题，本申请实施例提供一种接入网络的方法，可以充分利用已有的网络，完成终端设备接入网络的过程，尤其是，利用移动网络完成驻地节点下的终端设备接入过程，从而避免了铺设专用的网络通道，提高了移动网络的利用率。本申请实施例还提供了相应的设备及系统。
本申请第一方面提供一种接入网络的方法，包括：驻地节点接收来自于终端设备的第一消息，第一消息包含鉴权请求；该驻地节点可以是用户驻地设备(customer premise equipment，英文简称：CPE)，驻地节点发送第二消息，第二消息被网络节点处理为第三消息，网络节点包括RAN设备或者管理设备(如MME)，第三消息被用于网关设备识别鉴权请求和/或终端设备接入网络的鉴权方式，该第二消息可以是由驻地节点发出的，RAN设备可以对第二消息进行处理，处理后得到第三消息，该鉴权请求和/或终端设备接入网络的鉴权方 式被用于网络对终端设备进行鉴权；驻地节点接收来自于网络返回的鉴权结果的信息，并向终端设备发送鉴权结果的信息。该鉴权结果的信息可以携带在信令消息中，例如：携带在鉴权返回消息中，当然也可以携带在其他消息中，另外，本申请实施例中鉴权结果的信息可以是网络设备所发送的鉴权结果，在该鉴权结果的信息经网关设备以及其他设备返回到驻地节点的过程中，还可以在例如鉴权返回消息中加入其他信息，例如：路由配置信息，与该鉴权结果的信息一并返回。由以上第一方面可见，该方案可以充分利用已有的网络，完成终端设备接入网络的过程，比如，利用移动网络完成CPE下挂的终端设备接入过程，从而避免了铺设专用的网络通道，提高了移动网络的利用率。本申请实施例还提供了相应的设备及系统。
结合第一方面，在第一种可能的实现方式中，该鉴权请求和/或终端设备接入网络的鉴权方式被用于网络对终端设备进行鉴权，包括：鉴权方式用于指示网关设备向网络设备发送鉴权请求，鉴权请求用于指示网络设备对终端设备进行鉴权；驻地节点接收来自于网络返回的鉴权结果的信息，包括：驻地节点接收来自于网络设备通过网关设备返回的鉴权结果的信息。
结合第一方面或第一方面第一种可能的实现方式，在第二种可能的实现方式中，第二消息包含鉴权请求和指示信息，其中，指示信息包含用于指示终端设备接入网络的鉴权方式。该指示信息可以是鉴权类型指示信息，其中，鉴权类型指示信息可以包括鉴权方式的标识指示和/或鉴权协议标识指示，用于指示终端设备接入网络的鉴权方式。该实现方式是鉴权方式的一种，确保了鉴权的多样性。
结合第一方面或第一方面第一种可能的实现方式，在第三种可能的实现方式中，第二消息通过与鉴权方式对应的鉴权通道传输给网关设备，鉴权通道被用于确定对应的鉴权方式。比如，可以是鉴权通道的标识与鉴权方式有映射关系，从而根据鉴权通道确定对应的鉴权方式，也可以不限于是鉴权通道的标识与鉴权方式的映射关系，还可以是其他的对应关系，只要能实现鉴权通道与鉴权方式的对应即可。该鉴权通道可以是一种用于传输数据和/或信令的通道，不限于只传输鉴权消息。该鉴权通道是在驻地节点和网关设备之间建立的，该鉴权通道可以是承载或传输隧道，也可以是APN/DNN或PDN连接或PDU session或网络切片(slice)等，通道建立时，就确定采用的鉴权方式或者鉴权协议。这样，在传输终端设备或驻地节点的鉴权请求时可无需传输鉴权类型指示信息，在相应的通道上传输鉴权请求即可。该实现方式是鉴权方式的另一种，确保了鉴权的多样性。
结合第一方面第二种可能的实现方式，在第四种可能的实现方式中，该方法还包括：驻地节点根据第一消息，从终端设备与驻地节点之间的数据报文中携带的信息中识别终端设备接入网络的鉴权方式；驻地节点对用于指示鉴权方式的指示信息和鉴权请求进行处理，以得到第二消息。得到第二消息的方式可以是在第一消息中添加指示信息得到第二消息，还也可以是根据鉴权请求和指示信息重新生成一个第二消息。
结合第一方面第四种可能的实现方式，在第五种可能的实现方式中，第二消息中包括指示信息，指示信息可以是驻地节点在通信协议中空口接入层之上的协议层或在空口接入层的处理过程中添加的；驻地节点发送第二消息，包括：驻地节点向RAN设备发送第二消息， 可以是驻地节点通过演进分组系统EPS承载向RAN设备发送第二消息；当第二消息包含指示信息时，指示信息和鉴权请求被包含于第三消息中，并通过RAN设备与网关设备之间的传输通道传输第三消息。该实现方式中提供了一种用户面的鉴权方式，确保了鉴权方式的多样性。
结合第一方面第四种可能的实现方式，在第六种可能的实现方式中，第二消息为第一非接入层NAS消息，第一NAS消息中包含鉴权请求和指示信息；驻地节点发送第二消息，包括：驻地节点向RAN设备发送第一NAS消息，并通过RAN设备向管理设备发送第一NAS消息，第一NAS消息中的鉴权请求消息和指示信息被管理设备获得，并由管理设备向网关设备发送。该实现方式中提供了一种控制面的鉴权方式，确保了鉴权方式的多样性。
结合第一方面或上述第一方面任一可选的实现方式，在第七种可能的实现方式中，该方法还包括：驻地节点通过RAN设备发送用于接入网络的另一消息，该另一消息被用于网关设备识别驻地节点接入网络的认证请求和/或驻地节点接入网络的认证方式，认证请求和驻地节点接入网络的认证方式被用于网络对驻地节点进行认证；驻地节点接收来自于网络返回的认证结果的信息。该实现方式提供了驻地节点接入网络的认证方式。
结合第一方面第七种可能的实现方式，在第八种可能的实现方式中，认证请求和驻地节点接入网络的认证方式被用于网络对驻地节点进行认证，包括：认证方式用于指示网关设备向网络设备发送认证请求，认证请求用于指示网络设备对驻地节点进行认证；驻地节点接收来自于网络返回的认证结果的信息，包括：驻地节点接收来自于网络设备通过网关设备返回的认证结果的信息。
结合第一方面第七种可能的实现方式，在第九种可能的实现方式中，另一消息包含认证请求和另一指示信息，其中，另一指示信息包含用于指示驻地节点接入网络的认证方式的信息。
结合第一方面第八种可能的实现方式，在第十种可能的实现方式中，第三消息通过与认证方式对应的认证通道传输给网关设备，认证通道用于确定对应的认证方式。
结合第一方面第九种可能的实现方式，在第十一种可能的实现方式中，另一消息为第二NAS消息。
结合第一方面第十一种可能的实现方式，在第十二种可能的实现方式中，第一NAS消息和/或第二NAS消息为第一类型NAS消息，第一类型NAS消息为用于终端设备和/或驻地节点接入网络的消息；或者，第一NAS消息和/或第二NAS消息为第二类型NAS消息，第二类型NAS消息中包含信元，信元中包含用于终端设备和/或驻地节点接入网络的信息；该第二类型NAS消息中包含的信元可以是当前已存在的信元，在该信元中设置专用于放置接入网络的信息的字段，或者，第一NAS消息和/或第二NAS消息为第三类型NAS消息，第三类型NAS消息中包含信元，信元用于携带终端设备和/或驻地节点接入网络的信息，信元包括用于接入的信元或者消息容器，该用于接入的信元可以是专门设置的信元，该信元只用于接入网络。
结合第一方面或上述第一方面任一可选的实现方式，在第十三种可能的实现方式中鉴权结果的信息包括鉴权通过的信息，对应鉴权结果的信息的返回消息中还包括地址分配信息和/或路由配置信息，该对应鉴权结果的信息的返回消息可以是包含该鉴权结果的信息的 返回消息，还可以是在包含该鉴权结果的信息的返回消息之后的其他返回消息，路由配置信息包括网络设备分配的用于驻地节点路由配置的参考信息，或者，网关设备根据路由配置的参考信息确定的用于驻地节点路由配置的配置信息，地址分配信息包括为终端设备预分配或分配的网络地址。该路由配置的参考信息可以是用于驻地节点上行路由配置的参考信息，路由配置的配置信息可以是用于驻地节点上行路由配置的配置信息。
结合第一方面第十三中可能的实现方式，在第十四种可能的实现方式中，驻地节点保存用于驻地节点路由配置的配置信息，配置信息用于驻地节点为终端设备的业务确定对应的路由配置。
结合第一方面或上述第一方面任一可选的实现方式，在第十五种可能的实现方式中，第二消息还包括鉴权附加信息，该鉴权附加信息包括表明驻地节点的身份标识、表明终端设备位置和/或驻地节点位置的信息和用于传输鉴权请求的通道信息中的至少一个；用于传输鉴权请求的通道信息包括如下信息的至少一个：隧道标识，承载标识，以及会话标识。
本申请第二方面提供一种接入网络的方法，包括：网关设备接收鉴权请求，鉴权请求为终端设备通过第一消息向驻地节点发送的，该驻地节点可以是用户驻地设备，第一消息被驻地节点处理为第二消息，第二消息被网络节点处理为第三消息，第三消息包含鉴权请求和/或终端设备接入网络的鉴权方式；网关设备根据第三消息识别鉴权请求和/或终端设备接入网络的鉴权方式，在本申请中，即使第二消息在RAN设备处被修改，得到第三消息；网关设备根据鉴权方式向网络中的相应网络设备发送鉴权请求，鉴权请求用于指示网络设备对终端设备进行鉴权；网关设备向无线接入网络RAN设备或者管理设备发送鉴权结果的信息，所述鉴权结果的信息中包含所述网络设备返回的对所述终端设备的鉴权结果。由以上第二方面可见，该方案可以充分利用已有的网络，完成终端设备接入网络的过程，比如，利用移动网络完成CPE下挂的终端设备接入过程，从而避免了铺设专用的网络通道，提高了移动网络的利用率。本申请实施例还提供了相应的设备及系统。
结合第二方面，在第一种可能的实现方式中，该方法还包括：网关设备接收指示信息，指示信息包含于第二消息和第三消息中，其中，指示信息用于指示终端设备接入网络的鉴权方式。该指示信息可以是鉴权类型指示信息，其中，鉴权类型指示信息可以包括鉴权方式的标识指示和/或鉴权协议标识指示，用于指示终端设备接入网络的鉴权方式。该实现方式是鉴权方式的一种，确保了鉴权的多样性。
结合第二方面，在第二种可能的实现方式中，网关设备接收鉴权请求，包括：网关设备通过与鉴权方式对应的鉴权通道接收鉴权请求，鉴权通道被用于确定对应的鉴权方式。可选的，该鉴权通道是一种用于数据和/或信令传输的通道，不限于只传输鉴权消息。该鉴权通道可以在CPE和网关设备之间建立的，该鉴权通道可以是承载或传输隧道，也可以是APN/DNN或PDN连接或PDU session或网络切片(slice)等，通道建立时，就确定采用的鉴权方式或者鉴权协议。这样，在传输终端设备或CPE的鉴权请求时可无需传输鉴权类型指示信息，在相应的通道上传输鉴权请求或者认证请求即可。该实现方式是鉴权方式的另一种，确保了鉴权的多样性。
结合第二方面第一种可能的实现方式，在第三种可能的实现方式中，网关设备接收鉴 权请求和指示信息，包括：网关设备通过无线接入网RAN设备与网关设备之间的传输通道接收RAN设备发送的第三消息，第三消息中包含第二消息中包含的鉴权请求和指示信息。
结合第二方面第一种可能的实现方式，在第四种可能的实现方式中，网关设备接收鉴权请求和指示信息，包括：网关设备接收管理设备发送的鉴权请求和指示信息，鉴权请求和第一指示信息为管理设备从第一非接入层NAS消息中获取，并由管理设备发送来的，第一NAS消息为驻地节点通过无线接入网络RAN设备向管理设备发送的。
结合第二方面或上述第二方面任一可选的实现方式，在第五种可能的实现方式中，网关设备在向网络设备发送的第四消息中添加鉴权附加信息，鉴权附加信息包括第二消息还包括表明驻地节点的身份标识，表明终端设备位置和/或所述驻地节点位置的信息、用于传输鉴权请求的通道信息中的至少一个；用于传输鉴权请求的通道信息包括如下信息中的至少一个：隧道标识，承载标识，以及会话标识。
结合第二方面第五种可能的实现方式，在第六种可能的实现方式中，该方法还包括：网关设备记录驻地节点的标识信息与终端设备的标识的映射关系，映射关系用于发送鉴权请求对应的鉴权结果的信息。
结合第二方面或上述第二方面任一可选的实现方式，在第七种可能的实现方式中，该方法还包括：网关设备接收驻地节点用于接入网络的认证请求，认证请求包含于驻地节点发送的另一消息中；网关设备根据另一消息识别驻地节点接入网络的认证请求和/或驻地节点接入网络的认证方式；网关设备根据认证方式向网络设备发送认证请求，认证请求用于网络设备对驻地节点进行认证；网关设备转发网络设备返回的对驻地节点的认证结果的信息。
结合第二方面第七种可能的实现方式，在第八种可能的实现方式中，另一消息包含认证请求和另一指示信息，其中，另一指示信息包含用于指示驻地节点接入网络的认证方式的信息。
结合第二方面第七种可能的实现方式，在第九种可能的实现方式中，第三消息通过与认证方式对应的认证通道传输给网关设备，认证通道用于识别对应的认证方式。
结合第二方面或上述第二方面任一可选的实现方式，在第十种可能的实现方式中，该方法还包括：网关设备根据网络设备分配的路由配置的参考信息，确定路由配置的配置信息，路由配置的参考信息为鉴权结果的信息包括鉴权通过的信息时网络设备分配的，网关设备经RAN设备，或者经管理设备和无线网络接入RAN设备向所述驻地节点发送所述路由配置的配置信息。
结合第二方面第八种可能的实现方式，在第十一种可能的实现方式中，网关设备接收的另一指示信息和认证请求为管理设备从驻地节点发送的第二NAS消息中获取的。
本申请第三方面提供一种接入网络的方法，包括：管理设备接收驻地节点发送的鉴权请求，该鉴权请求为终端设备通过第一消息向驻地节点发送的，管理设备向网关设备发送第三消息，第三消息包含鉴权请求和/或终端设备接入网络的鉴权方式，第三消息被用于网关设备识别鉴权请求和/或终端设备接入网络的鉴权方式，鉴权方式用于指示网关设备向所述驻地节点发送所述网关设备返回的鉴权结果的信息，所述鉴权结果的信息中包含所述网 络设备返回的对所述终端设备的鉴权结果。由以上第三方面可见，该方案可以充分利用已有的网络，完成终端设备接入网络的过程，比如，利用移动网络完成CPE下挂的终端设备接入过程，从而避免了铺设专用的网络通道，提高了移动网络的利用率。本申请实施例还提供了相应的设备及系统。
结合第三方面，在第一种可能的实现方式中，第一消息被驻地节点处理为第二消息，管理设备将第二消息处理为第三消息，第二消息和第三消息包含鉴权请求和指示信息，其中，指示信息包含用于指示终端设备接入网络的鉴权方式。
结合第三方面，在第二种可能的实现方式中，第一消息被驻地节点处理为第二消息，管理设备将第二消息处理为第三消息，第二消息为第一非接入层NAS消息；方法还包括：管理设备从第一NAS消息中获取鉴权请求和指示信息，并在发送鉴权请求时发送指示信息。
结合第三方面、第三面第一种或第二种可能的实现方式，在第三种可能的实现方式中，方法还包括：管理设备接收用于驻地节点接入网络的另一消息，另一消息被用于网关设备识别驻地节点接入网络的认证请求和/或驻地节点接入网络的认证方式，认证方式用于指示网关设备向网络设备发送认证请求；管理设备向网关设备发送认证请求，认证请求用于指示网络设备对驻地节点进行认证。
结合第三方面第三种可能的实现方式，在第四种可能的实现方式中，另一消息包含认证请求和另一指示信息，其中，另一指示信息包含用于指示驻地节点接入网络的认证方式的信息。
结合第三方面第四种可能的实现方式，在第五种可能的实现方式中，该方法还包括：管理设备从第二NAS消息中获取另一指示信息和认证请求；管理设备向网关设备发送认证请求，包括：管理设备通过与网关设备之间建立的传输通道发送认证协议类型信息和认证请求。
本申请第四方面提供一种接入网络的方法，包括：驻地节点向无线接入网RAN设备发送第一消息，所述第一消息包含鉴权请求，所述第一消息被网络节点处理为第二消息，所述第二消息被用于网关设备识别所述驻地节点接入所述网络的鉴权请求和/或所述驻地节点接入所述网络的鉴权方式，所述鉴权请求和/或所述驻地节点接入所述网络的鉴权方式被用于网络对所述驻地节点进行鉴权；所述驻地节点接收来自于所述网络的鉴权结果的信息。由以上第四方面可见，该方案可以充分利用已有的网络，完成终端设备接入网络的过程，例如，利用移动网络完成CPE下挂的终端设备接入过程，从而避免了铺设专用的网络通道，提高了移动网络的利用率。本申请实施例还提供了相应的设备及系统。
结合第四方面，在第一种可能的实现方式中，所述鉴权请求和/或所述驻地节点接入所述网络的鉴权方式被用于网络对所述驻地节点进行鉴权，包括：所述鉴权方式用于指示所述网关设备向所述网络设备发送所述鉴权请求，所述鉴权请求用于指示所述网络设备对所述驻地节点进行鉴权；所述驻地节点接收来自于所述网络返回的鉴权结果的信息，包括：所述驻地节点接收来自于所述网络设备通过所述网关设备返回的鉴权结果的信息。
结合第四方面或第四方面第一种可能的实现方式，在第二种可能的实现方式中，所述第一消息包含所述鉴权请求和指示信息，其中，所述指示信息包含用于指示所述驻地节点 接入所述网络的鉴权方式的信息。
结合第四方面或第四方面第一种可能的实现方式，在第三种可能的实现方式中，所述第一消息通过与所述鉴权方式对应的鉴权通道传输给所述网关设备，所述鉴权通道被用于确定对应的所述鉴权方式。可选的，该鉴权通道是一种用于传输数据和/或信令的通道，不限于只传输鉴权消息。
结合第四方面第二种可能的实现方式，在第四种可能的实现方式中，所述第一消息为非接入层NAS消息。
结合第四方面第四种可能的实现方式，在第五种可能的实现方式中，所述NAS消息为第一类型NAS消息，所述第一类型NAS消息为用于所述驻地节点接入所述网络的消息；或者，
所述NAS消息为第二类型NAS消息，所述第二类型NAS消息中包含信元，所述信元中包含用于所述驻地节点接入所述网络的信息；或者，
所述NAS消息为第三类型NAS消息，所述第三类型NAS消息中包含信元，所述信元用于携带所述驻地节点接入所述网络的信息，所述信元包括用于接入的信元或者消息容器。
结合第四方面或上述第四方面任一可选的实现方式，在第六种可能的实现方式中，所述鉴权结果的信息包括鉴权通过的信息，对应所述鉴权结果的信息的返回消息中还包括地址分配信息和/或路由配置信息，所述路由配置信息包括所述网络设备分配的路由配置的参考信息，或者，所述网关设备根据所述路由配置的参考信息确定的路由配置的配置信息，所述地址分配信息包括为所述终端设备预分配或分配的网络地址。
结合第四方面或上述第四方面任一可选的实现方式，在第七种可能的实现方式中，所述第一消息还包括鉴权附加信息，所述鉴权附加信息包括表明所述驻地节点的身份标识、表明所述驻地节点位置的信息和用于传输所述鉴权请求的通道信息中的至少一个；所述用于传输鉴权请求的通道信息包括如下信息的至少一个：隧道标识，承载标识，以及会话标识。
本申请第五方面提供一种接入网络的方法，包括：网关设备接收驻地节点用于接入网络的鉴权请求，所述鉴权请求包含于所述驻地节点发送的第一消息中，所述第一消息被网络节点处理为第二消息；所述网关设备根据所述第二消息识别所述驻地节点接入所述网络的鉴权请求和/或所述驻地节点接入所述网络的鉴权方式；所述网关设备根据所述鉴权方式向网络设备发送所述鉴权请求，所述鉴权请求用于所述网络设备对所述驻地节点进行鉴权；所述网关设备向无线接入网络RAN设备或管理设备发送鉴权结果的信息，所述鉴权结果的信息中包含所述网络设备返回的对所述终端设备的鉴权结果。由以上第五方面可见，该方案可以充分利用已有的网络，完成终端设备接入网络的过程，例如，利用移动网络完成CPE下挂的终端设备接入过程，从而避免了铺设专用的网络通道，提高了移动网络的利用率。本申请实施例还提供了相应的设备及系统。
结合第五方面，在第一种可能的实现方式中，所述第一消息包含所述鉴权请求和指示信息，其中，所述指示信息包含用于指示所述驻地节点接入所述网络的鉴权方式的信息。
结合第五方面，在第二种可能的实现方式中，所述第一消息通过与所述鉴权方式对应的鉴权通道传输给所述网关设备，所述鉴权通道被用于确定对应的所述鉴权方式。该鉴权 通道可以是一种用于传输数据和/或信令的通道，不限于只传输鉴权消息。
结合第五方面第一种可能的实现方式，在第三种可能的实现方式中，所述第一消息为非接入层NAS消息；所述方法还包括：所述网关设备接收所述指示信息，所述指示信息和所述鉴权请求为所述管理设备从所述驻地节点发送的NAS消息中获取的。
结合第五方面或上述第五方面任一可选的实现方式，在第四种可能的实现方式中，所述方法还包括：所述网关设备根据所述网络设备分配的路由配置的参考信息，确定所述驻地节点路由配置的配置信息，所述配置信息为终端设备的业务确定对应的路由配置，所述路由配置的参考信息为所述鉴权结果的信息包括鉴权通过的信息时所述网络设备分配的。
结合第五方面或上述第五方面任一可选的实现方式，在第五种可能的实现方式中，所述网关设备在向所述网络设备发送的第三消息中添加所述鉴权附加信息，所述鉴权附加信息包括表明所述驻地节点的身份标识、表明所述驻地节点位置的信息和用于传输所述鉴权请求的通道信息中的至少一个；所述用于传输鉴权请求的通道信息包括如下信息的至少一个：隧道标识，承载标识，以及会话标识。
本申请第六方面提供一种接入网络的方法，包括：管理设备接收驻地节点用于接入网络的鉴权请求，所述鉴权请求包含于所述驻地节点发送的第一消息中；所述管理设备将所述第一消息处理为第二消息；所述第二消息被用于所述网关设备识别所述驻地节点接入所述网络的鉴权请求和/或所述驻地节点接入所述网络的鉴权方式，所述鉴权方式用于指示所述网关设备向所述网络设备发送所述鉴权请求；所述管理设备向所述网关设备发送所述鉴权请求，所述鉴权请求用于指示所述网络设备对所述驻地节点进行鉴权；所述管理设备向所述驻地节点发送所述网关设备返回的鉴权结果的信息，所述鉴权结果的信息中包含所述网络设备返回的对所述终端设备的鉴权结果。由以上第六方面可见，该方案可以充分利用已有的网络，完成终端设备接入网络的过程，例如，利用移动网络完成CPE下挂的终端设备接入过程，从而避免了铺设专用的网络通道，提高了移动网络的利用率。本申请实施例还提供了相应的设备及系统。
结合第六方面，在第一种可能的实现方式中，所述第一消息包含所述鉴权请求和指示信息，其中，所述指示信息包含用于指示所述驻地节点接入所述网络的鉴权方式的信息。
结合第六方面第一种可能的实现方式，在第二种可能的实现方式中，所述第一消息为非接入层NAS消息，所述管理设备向所述网关设备发送所述鉴权请求之前，所述方法还包括：
所述管理设备从所述NAS消息中获取所述指示信息和所述鉴权请求；
所述管理设备向所述网关设备发送所述鉴权请求，包括：
所述管理设备通过与所述网关设备之间建立的传输通道发送所述指示信息和所述鉴权请求。
结合第六方面第二种可能的实现方式，在第三种可能的实现方式中，所述方法还包括：所述管理设备接收所述网关设备发送的鉴权授权信息，并保存所述鉴权授权信息。
本申请第七方面提供一种接入网络的方法，包括：驻地节点接收来自于终端设备的第一消息，所述第一消息中包含第一鉴权请求；
所述驻地节点通过接入网络AN设备向管理设备传输第一非接入层NAS消息，所述第一 NAS消息包含所述第一鉴权请求，所述鉴权请求被所述管理设备从所述第一NAS消息中获知后向认证设备发送，以使所述认证设备根据所述鉴权请求对所述终端设备进行鉴权；
所述驻地节点接收所述管理设备返回的第一鉴权结果的信息，并向所述终端设备发送所述第一鉴权结果的信息，所述第一鉴权结果的信息包括所述认证设备对所述终端设备的认证结果。由以上第七方面可见，该方案可以充分利用已有的网络，完成终端设备接入网络的过程，例如，利用移动网络完成CPE下挂的终端设备接入过程，从而避免了铺设专用的网络通道，提高了移动网络的利用率。本申请实施例还提供了相应的设备及系统。
结合第七方面，在第一种可能的实现方式中，所述第一消息和所述第一NAS消息中还包括第一指示信息，所述第一指示信息包含用于指示所述终端设备接入网络的鉴权方式的信息，所述第一指示信息用于指示所述认证设备按照所述第一指示信息所指示的鉴权方式对所述终端设备进行鉴权。
结合第七方面或第七方面第一种可能的实现方式，在第二种可能的实现方式中，当所述认证设备为认证服务功能实体时，所述驻地节点接收所述认证设备通过所述管理设备返回的第一鉴权结果的信息，包括：
所述驻地节点接收第二NAS消息，所述第二NAS消息中包含所述第一鉴权结果信息和/或所述终端设备的地址信息。
结合第七方面第二种可能的实现方式，在第三种可能的实现方式中，所述第一NAS消息还包括表明所述驻地节点的身份标识，表明所述终端设备位置和/或所述驻地节点位置的信息、用于传输所述第一鉴权请求的通道信息中的至少一个；
所述用于传输第一鉴权请求的通道信息包括如下信息的至少一个：隧道标识，承载标识，以及会话标识。
结合第七方面、第七方面第一种或第二种可能的实现方式，在第三种可能的实现方式中，所述方法还包括：
所述驻地节点向所述管理设备发送第三NAS消息，所述第三NAS消息中包含第二鉴权请求，所述第二鉴权请求被所述管理设备从所述第三NAS消息中获取后发送给所述认证设备，以使所述认证设备根据所述第二鉴权请求对所述驻地节点进行鉴权；
所述驻地节点接收所述管理设备返回的第二鉴权结果的信息，所述第二鉴权结果的信息中包含所述认证设备返回的对所述驻地节点的鉴权结果。
结合第七方面第三种可能的实现方式，在第四种可能的实现方式中，
所述第三NAS消息还包括第二指示信息，所述第二指示信息用于指示所述驻地节点接入所述网络的鉴权方式，所述第二指示信息用于指示所述认证设备按照所述第二指示信息所指示的鉴权方式对所述驻地节点进行鉴权。
结合第七方面第三种或第四种可能的实现方式，在第五种可能的实现方式中，
所述第一NAS消息和/或所述第二NAS消息和/或所述第三NAS消息为第一类型NAS消息，所述第一类型NAS消息为用于所述终端设备或所述驻地节点接入所述网络的消息；或者，
所述第一NAS消息和/或所述第二NAS消息和/或所述第三NAS消息为第二类型NAS消息，所述第二类型NAS消息中包含信元，所述信元中包含用于所述终端设备或所述驻地节点接入 所述网络的信息；或者，
所述第一NAS消息和/或所述第二NAS消息和/或所述第三NAS消息为第三类型NAS消息，所述第三类型NAS消息中包含信元，所述信元用于携带所述终端设备或所述驻地节点接入所述网络的信息，所述信元包括用于接入网络的信元或者消息容器。
结合第七方面第三种或第四种可能的实现方式，在第六种可能的实现方式中，所述第三NAS消息还包括鉴权附加信息，所述鉴权附加信息包括表明所述驻地节点的身份标识、表明所述驻地节点位置的信息和用于传输所述第二鉴权请求的通道信息中的至少一个，所述用于传输第二鉴权请求的通道信息包括：隧道标识和/或承载标识和/或会话标识。
本申请第八方面提供一种接入网络的方法，包括：网关设备接收管理设备发送的第一鉴权请求，所述第一鉴权请求为终端设备通过第一消息向驻地节点发送的，所述第一消息为第一非接入层NAS消息或所述第一消息被所述驻地节点处理为第一非接入层NAS消息，所述第一NAS消息包含所述第一鉴权请求，所述第一鉴权请求被所述管理设备从所述第一NAS消息中获知；
所述网关设备向认证设备发送所述第一鉴权请求，以使所述认证设备根据所述第一鉴权请求对所述终端设备进行鉴权；
所述网关设备向所述管理设备发送第一鉴权结果的信息，所述第一鉴权结果的信息被所述管理设备通过第二NAS消息向所述驻地节点发送，所述第一鉴权结果的信息中包含所述认证设备返回的对所述终端设备的鉴权结果。
结合第八方面，在第一种可能的实现方式中，所述第一消息和所述第一NAS消息中还包括第一指示信息，所述第一指示信息包含用于指示所述终端设备接入网络的鉴权方式的信息，所述第一指示信息用于指示所述认证设备按照所述第一指示信息所指示的鉴权方式对所述终端设备进行鉴权。
结合第八方面或第八方面第一种可能的实现方式中，在第二种可能的实现方式中，所述方法还包括：
所述网关设备在向所述认证设备发送的第二消息中添加所述鉴权附加信息，所述鉴权附加信息包括表明所述驻地节点的身份标识、表明所述终端设备位置和/或所述驻地节点位置的信息和用于传输所述第一鉴权请求的通道信息中的至少一个；
所述用于传输第一鉴权请求的通道信息包括如下信息的至少一个：隧道标识，承载标识，以及会话标识。
结合第八方面、第八方面第一种或第二种可能的实现方式中，在第三种可能的实现方式中，所述方法还包括：
网关设备接收管理设备发送的第二鉴权请求，所述第二鉴权请求包含于所述驻地节点发送的第三NAS消息中，所述第二鉴权请求被所述管理设备从所述第三NAS消息中获知；
所述网关设备向认证设备发送所述第二鉴权请求，以使所述认证设备根据所述第二鉴权请求对所述驻地节点进行鉴权；
所述网关设备向所述管理设备发送第二鉴权结果的信息，所述第二鉴权结果的信息中包含所述认证设备返回的对所述驻地节点的鉴权结果。
结合第八方面第三种可能的实现方式，在第四种可能的实现方式中，所述第三NAS消息还包括第二指示信息，所述第二指示信息用于指示所述驻地节点接入所述网络的鉴权方式，所述第二指示信息用于指示所述认证设备按照所述第二指示信息所指示的鉴权方式对所述驻地节点进行鉴权。
结合第八方面第三种或第四种可能的实现方式，在第五种可能的实现方式中，所述方法还包括：
所述网关设备在向所述认证设备发送的第三消息中添加所述鉴权附加信息，所述鉴权附加信息包括表明所述驻地节点的身份标识、表明所述驻地节点位置的信息和用于传输所述第二鉴权请求的通道信息中的至少一个；
所述用于传输第二鉴权请求的通道信息包括如下信息的至少一个：隧道标识，承载标识，以及会话标识。
本申请第九方面提供一种接入网络的方法，包括：管理设备接收驻地节点发送的第一NAS消息，所述第一NAS消息中包含第一鉴权请求，所述第一鉴权请求包含于终端设备发送的第一消息中，所述第一鉴权请求用于指示认证设备对所述终端设备进行鉴权；所述管理设备从所述第一NAS消息中获取所述第一鉴权请求；所述管理设备向认证设备发送所述第一鉴权请求，以使所述认证设备根据所述第一鉴权请求对所述终端设备进行鉴权；所述管理设备向所述驻地节点发送第一鉴权结果的信息，所述第一鉴权结果的信息中包含所述认证设备返回的对所述终端设备的鉴权结果。由以上第九方面可见，该方案可以充分利用已有的网络，完成终端设备接入网络的过程，例如，利用移动网络完成CPE下挂的终端设备接入过程，从而避免了铺设专用的网络通道，提高了移动网络的利用率。本申请实施例还提供了相应的设备及系统。
结合第九方面，在第一种可能的实现方式中，所述第一消息中还包括第一指示信息，其中，所述第一指示信息用于指示所述终端设备接入所述网络的鉴权方式，所述第一指示信息用于所述认证设备按照所述第一指示信息所指示的鉴权方式对所述终端设备进行鉴权。
结合第九方面或第九方面第一种可能的实现方式，在第二种可能的实现方式中，所述方法还包括：
所述管理设备接收来自于所述网关设备返回的地址信息；
所述管理设备将所述第一鉴权结果的信息和/或所述地址信息携带在第二NAS消息中；
所述管理设备向所述驻地节点发送所述第二NAS消息。
结合第九方面、第九方面第一种或第二种可能的实现方式，在第三种可能的实现方式中，所述方法还包括：
所述管理设备接收来自所述驻地节点的第三NAS消息，所述第三NAS消息中包含第二鉴权请求；
所述管理设备从所述第三NAS消息中提取所述第二鉴权请求；
所述管理设备发送认证请求给所述认证设备，以使所述认证设备根据所述认证请求，对所述终端设备进行认证，所述认证请求为所述第二鉴权请求或所述管理设备根据所述第 二鉴权请求生成的；
所述管理设备向所述驻地节点发送第二鉴权结果的信息，所述第二鉴权结果的信息中包含所述认证设备返回的对所述驻地节点的鉴权结果。
结合第九方面第第三种可能的实现方式，在第四种可能的实现方式中，所述第三NAS消息还包括第二指示信息，所述第二指示信息用于指示所述驻地节点接入所述网络的鉴权方式，所述第二指示信息用于指示所述认证设备按照所述第二指示信息所指示的鉴权方式对所述驻地节点进行鉴权。
本申请第十方面提供一种接入网络的方法，包括：终端设备向驻地节点发送第一消息，所述第一消息为非接入层NAS消息，所述第一消息中包含第一鉴权请求，所述鉴权请求用于指示认证设备对所述终端设备进行鉴权，所述终端设备的协议栈中在非接入NAS层下包括以太网协议层、或局域网协议层或个域网协议层；所述终端设备接收所述驻地节点返回的第一鉴权结果的信息。由以上第十方面可见，该方案可以充分利用已有的网络，完成终端设备接入网络的过程，例如，利用移动网络完成CPE下挂的终端设备接入过程，从而避免了铺设专用的网络通道，提高了移动网络的利用率。本申请实施例还提供了相应的设备及系统。
结合第十方面，在第一种可能的实现方式中，所述第一消息中还包括第一指示信息，其中，所述第一指示信息用于指示所述终端设备接入网络的鉴权方式，所述第一指示信息用于所述认证设备按照所述第一指示信息所指示的鉴权方式对所述终端设备进行鉴权。
本申请第十一方面提供一种驻地节点，应用于该驻地节点下挂的终端设备接入网络的过程中，所述驻地节点包括：存储器、收发器和至少一个处理器，存储器中存储有指令；存储器、收发器和至少一个处理器通过线路互联，收发器用于进行第一方面或第一方面任一可选实现方式中，在驻地节点侧进行的消息收发的操作；至少一个处理器调用指令，执行第一方面或第一方面任一可选实现方式中的在驻地节点侧进行的消息处理或控制操作。
本申请第十二方面提供一种网关设备，应用于该驻地节点下挂的终端设备接入网络的过程中，所述网关设备包括：存储器、收发器和至少一个处理器，存储器中存储有指令，存储器、收发器和至少一个处理器通过线路互联，收发器用于执行第二方面或第二方面任一可选实现方式中，在网关设备侧进行消息收发的操作；至少一个处理器调用指令，执行第二方面或第二方面任一可选实现方式中的在网关设备侧进行的消息处理或控制操作。
本申请第十三方面提供一种管理设备，应用于该驻地节点下挂的终端设备接入网络的过程中，所述管理设备包括：存储器、收发器和至少一个处理器，存储器中存储有指令，存储器、收发器和至少一个处理器通过线路互联，收发器用于执行第三方面或第三方面任一可选实现方式中，在管理设备侧进行消息收发的操作；至少一个处理器调用指令，执行第三方面或第三方面任一可选实现方式中的在管理设备侧进行的消息处理或控制操作。
一种可能的实现方式为，本申请第十二方面提供的网关设备和本申请第十三方面提供的管理设备的功能，也可以结合作为一个整体，在前述方法流程中作为一个核心网网络节点与其他网元交互。这样，原网关设备和原管理设备之间的流程交互，可以作为该核心网网络节点内部的实现，而原网关设备和或原管理设备与其他网元之间的流程交互，可以继续作为该核心网网络节点与其他网元之间的流程交互。
本申请第十四方面提供一种驻地节点，应用于该驻地节点接入网络的过程中，所述驻地节点包括：包括：存储器、收发器和至少一个处理器，存储器中存储有指令；存储器、收发器和至少一个处理器通过线路互联，收发器用于执行第四方面或第四方面任一可选实现方式中，在驻地节点侧进行的消息收发的操作；至少一个处理器调用指令，执行第四方面或第四方面任一可选实现方式中的在驻地节点侧进行的消息处理或控制操作。
本申请第十五方面提供一种网关设备，应用于该驻地节点接入网络的过程中，所述网关设备包括：存储器、收发器和至少一个处理器，存储器中存储有指令，存储器、收发器和至少一个处理器通过线路互联，收发器用于执行第五方面或第五方面任一可选实现方式中，在网关设备侧进行消息收发的操作；至少一个处理器调用指令，执行第五方面或第五方面任一可选实现方式中的在网关设备侧进行的消息处理或控制操作。
本申请第十六方面提供一种管理设备，应用于该驻地节点接入网络的过程中，所述管理设备包括：存储器、收发器和至少一个处理器，存储器中存储有指令，存储器、收发器和至少一个处理器通过线路互联，收发器用于执行第六方面或第六方面任一可选实现方式中，在管理设备侧进行消息收发的操作；至少一个处理器调用指令，执行第六方面或第六方面任一可选实现方式中的在管理设备侧进行的消息处理或控制操作。
一种可能的实现方式为，本申请第十五方面提供的网关设备和本申请第十六方面提供的管理设备的功能，也可以结合作为一个整体，在涉及到的方法流程中作为一个核心网网络节点与其他网元交互。这样，原网关设备和原管理设备之间的流程交互，可以作为该核心网网络节点内部的实现，而原网关设备和或原管理设备与其他网元之间的流程交互，可以继续作为该核心网网络节点与其他网元之间的流程交互。
本申请第十七方面提供一种驻地节点，应用于该驻地节点和所述驻地节点下挂的终端设备接入网络的过程中，所述驻地节点包括：包括：存储器、收发器和至少一个处理器，存储器中存储有指令；存储器、收发器和至少一个处理器通过线路互联，收发器用于执行第七方面或第七方面任一可选实现方式中，在驻地节点侧进行的消息收发的操作；至少一个处理器调用指令，执行第七方面或第七方面任一可选实现方式中的在驻地节点侧进行的消息处理或控制操作。
本申请第十八方面提供一种网关设备，应用于该驻地节点和所述驻地节点下挂的终端设备接入网络的过程中，所述网关设备包括：存储器、收发器和至少一个处理器，存储器中存储有指令，存储器、收发器和至少一个处理器通过线路互联，收发器用于执行第八方面或第八方面任一可选实现方式中，在网关设备侧进行消息收发的操作；至少一个处理器调用指令，执行第五方面或第五方面任一可选实现方式中的在网关设备侧进行的消息处理或控制操作。
本申请第十九方面提供一种管理设备，应用于该驻地节点和所述驻地节点下挂的终端设备接入网络的过程中，所述管理设备包括：存储器、收发器和至少一个处理器，存储器中存储有指令，存储器、收发器和至少一个处理器通过线路互联，收发器用于执行第九方面或第九方面任一可选实现方式中，在管理设备侧进行消息收发的操作；至少一个处理器调用指令，执行第八方面或第八方面任一可选实现方式中的在管理设备侧进行的消息处理 或控制操作。
一种可能的实现方式为，本申请第十八方面提供的网关设备和本申请第十九方面提供的管理设备的功能，也可以结合作为一个整体，在涉及的方法流程中作为一个核心网网络节点与其他网元交互。这样，原网关设备和原管理设备之间的流程交互，可以作为该核心网网络节点内部的实现，而原网关设备和或原管理设备与其他网元之间的流程交互，可以继续作为该核心网网络节点与其他网元之间的流程交互。
本申请第二十方面提供一种终端设备，应用于该终端设备接入网络的过程中，包括：存储器、收发器和至少一个处理器，存储器中存储有指令，存储器、收发器和至少一个处理器通过线路互联，收发器用于执行第十方面在终端设备侧进行消息收发的操作。
本申请第二十一方面提供一种芯片系统，可应用于驻地节点中，该芯片系统包括：至少一个处理器，存储器和接口电路，存储器、收发器和至少一个处理器通过线路互联，至少一个存储器中存储有指令；指令被处理器执行，以执行第一方面或第一方面任一可选的实现方式中驻地节点的操作。
本申请第二十二方面提供一种芯片系统，可应用于网关设备中，该芯片系统包括：至少一个处理器，存储器和接口电路，存储器、收发器和至少一个处理器通过线路互联，至少一个存储器中存储有指令；指令被处理器执行，以执行第二方面或第二方面任一可选的实现方式中网关设备的操作。
本申请第二十三方面提供一种芯片系统，可应用于管理设备中，该该芯片系统包括：至少一个处理器，存储器和接口电路，存储器、收发器和至少一个处理器通过线路互联，至少一个存储器中存储有指令；指令被处理器执行，以执行第三方面或第三方面任一可选的实现方式中管理设备的操作。
本申请第二十四方面提供一种芯片系统，可应用与驻地节点中，该芯片系统包括：至少一个处理器，存储器和接口电路，存储器、收发器和至少一个处理器通过线路互联，至少一个存储器中存储有指令；指令被处理器执行，以执行第四方面或第四方面任一可选的实现方式中驻地节点的操作。
本申请第二十五方面提供一种芯片系统，可应用于网关设备中，该芯片系统包括：至少一个处理器，存储器和接口电路，存储器、收发器和至少一个处理器通过线路互联，至少一个存储器中存储有指令；指令被处理器执行，以执行第五方面或第五方面任一可选的实现方式中网关设备的操作。
本申请第二十六方面提供一种芯片系统，可应用与管理设备中，该芯片系统包括：至少一个处理器，存储器和接口电路，存储器、收发器和至少一个处理器通过线路互联，至少一个存储器中存储有指令；指令被处理器执行，以执行第六方面或第六方面任一可选的实现方式中管理设备的操作。
本申请第二十七方面提供一种芯片系统，包括：可应用于驻地节点中，该芯片系统至少一个处理器，存储器和接口电路，存储器、收发器和至少一个处理器通过线路互联，至少一个存储器中存储有指令；指令被处理器执行，以执行第七方面或第七方面任一可选的实现方式中驻地节点的操作。
本申请第二十八方面提供一种芯片系统，包括：可应用与网关设备中，该芯片系统至少一个处理器，存储器和接口电路，存储器、收发器和至少一个处理器通过线路互联，至少一个存储器中存储有指令；指令被处理器执行，以执行第八方面或第八方面任一可选的实现方式中网关设备的操作。
本申请第二十九方面提供一种芯片系统，可应用于管理设备中，该芯片系统包括：至少一个处理器，存储器和接口电路，存储器、收发器和至少一个处理器通过线路互联，至少一个存储器中存储有指令；指令被处理器执行，以执行第九方面或第九方面任一可选的实现方式中管理设备的操作。
本申请第三十方面提供一种芯片系统，可应用于终端设备中，该芯片系统包括：至少一个处理器，存储器和接口电路，存储器、收发器和至少一个处理器通过线路互联，至少一个存储器中存储有指令；指令被处理器执行，以执行第十方面中终端设备的操作。
本申请的又一方面提供了一种计算机可读存储介质，可应用于驻地节点中，该计算机可读存储介质中存储有指令，当指令在计算设备上运行时，执行第一方面或第一方面任一可选的实现方式中驻地节点的操作。
本申请的又一方面提供了一种计算机可读存储介质，可应用于网关设备中，该计算机可读存储介质中存储有指令，当指令在计算设备上运行时，执行第二方面或第二方面任一可选的实现方式中网关设备的操作。
本申请的又一方面提供了一种计算机可读存储介质，可应用于管理设备中，该计算机可读存储介质中存储有指令，当指令在计算设备上运行时，执行第三方面或第三方面任一可选的实现方式中管理设备的操作。
本申请的又一方面提供了一种计算机可读存储介质，可应用于驻地节点中，该计算机可读存储介质中存储有指令，当指令在计算设备上运行时，执行第四方面或第四方面任一可选的实现方式中驻地节点的操作。
本申请的又一方面提供了一种计算机可读存储介质，可应用于网关设备中，该计算机可读存储介质中存储有指令，当指令在计算设备上运行时，执行第五方面或第五方面任一可选的实现方式中网关设备的操作。
本申请的又一方面提供了一种计算机可读存储介质，可应用于管理设备中，该计算机可读存储介质中存储有指令，当指令在计算设备上运行时，执行第六方面或第六方面任一可选的实现方式中管理设备的操作。
本申请的又一方面提供了一种计算机可读存储介质，可应用于驻地节点中，该计算机可读存储介质中存储有指令，当指令在计算设备上运行时，执行第七方面或第七方面任一可选的实现方式中驻地节点的操作。
本申请的又一方面提供了一种计算机可读存储介质，可应用于网关设备中，该计算机可读存储介质中存储有指令，当指令在计算设备上运行时，执行第八方面或第八方面任一可选的实现方式中网关设备的操作。
本申请的又一方面提供了一种计算机可读存储介质，可应用于管理设备中，该计算机可读存储介质中存储有指令，当指令在计算设备上运行时，执行第九方面或第九方面任一 可选的实现方式中管理设备的操作。
本申请的又一方面提供了一种计算机可读存储介质，可应用于终端设备中，该计算机可读存储介质中存储有指令，当指令在计算设备上运行时，执行第十方面或第十方面任一可选的实现方式中终端设备的操作。
本申请的又一方面提供了一种计算机程序产品，可应用于驻地节点中，当该程序在计算设备上运行时，执行第一方面或第一方面任一可选的实现方式中驻地节点的操作。
本申请的又一方面提供了一种计算机程序产品，可应用于网关设备中，当该程序在计算设备上运行时，执行第二方面或第二方面任一可选的实现方式中网关设备的操作。
本申请的又一方面提供了一种计算机程序产品，可应用于管理设备中，当该程序在计算设备上运行时，执行第三方面或第三方面任一可选的实现方式中管理设备的操作。
本申请的又一方面提供了一种计算机程序产品，可应用于驻地节点中，当该程序在计算设备上运行时，执行第四方面或第四方面任一可选的实现方式中驻地节点的操作。
本申请的又一方面提供了一种计算机程序产品，可应用于网关设备中，当该程序在计算设备上运行时，执行第五方面或第五方面任一可选的实现方式中网关设备的操作。
本申请的又一方面提供了一种计算机程序产品，可应用于管理设备中，当该程序在计算设备上运行时，执行第六方面或第六方面任一可选的实现方式中管理设备的操作。
本申请的又一方面提供了一种计算机程序产品，可应用于驻地节点中，当该程序在计算设备上运行时，执行第七方面或第七方面任一可选的实现方式中驻地节点的操作。
本申请的又一方面提供了一种计算机程序产品，可应用于网关设备中，当该程序在计算设备上运行时，执行第八方面或第八方面任一可选的实现方式中网关设备的操作。
本申请的又一方面提供了一种计算机程序产品，可应用于管理设备中，当该程序在计算设备上运行时，执行第九方面或第九方面任一可选的实现方式中管理设备的操作。
本申请的又一方面提供了一种计算机程序产品，可应用于终端设备中，当该程序在计算设备上运行时，执行第十方面或第十方面任一可选的实现方式中终端设备的操作。
本申请实施例所提供的方案，可以充分利用已有的网络，完成终端设备接入网络的过程，例如，利用移动网络完成CPE下挂的终端设备接入过程，从而避免了铺设专用的网络通道，提高了移动网络的利用率。本申请实施例还提供了相应的设备及系统。
附图说明
图1是WTTx的一场景示意图；
图2A是本申请实施例中一网络架构示意图；
图2B是终端设备的一网络接入线路示意图；
图2C是终端设备的另一网络接入线路示意图；
图2D是本申请实施例中终端设备的另一网络接入线路示意图；
图2E是本申请实施例中终端设备的另一网络接入线路示意图；
图3是本申请实施例提供的设备接入网络的方法的一实施例示意图；
图4是本申请实施例提供的设备接入网络的方法的另一实施例示意图；
图5是本申请实施例提供的设备接入网络的方法的另一实施例示意图；
图6是本申请实施例提供的设备接入网络的方法的另一实施例示意图；
图7是本申请实施例提供的设备接入网络的方法的另一实施例示意图；
图8是本申请实施例提供的设备接入网络的方法的另一实施例示意图；
图9A是本申请实施例提供的设备之间交互系统的一示例示意图；
图9B是本申请实施例提供的设备协议栈的一示例示意图；
图9C是本申请实施例提供的设备协议栈的另一示例示意图；
图9D是本申请实施例提供的设备协议栈的另一示例示意图；
图9E是本申请实施例提供的设备协议栈的另一示例示意图；
图10是本申请实施例提供的设备接入网络的方法的另一实施例示意图；
图11是本申请实施例提供的设备接入网络的方法的另一实施例示意图；
图12是本申请实施例提供的融合网络的一架构示意图；
图13是本申请实施例提供的用于设备接入网络的方法的另一实施例示意图；
图14是本申请实施例提供的用于设备接入网络的方法的另一实施例示意图；
图15是本申请实施例提供的用于设备接入网络的方法的另一实施例示意图；
图16是本申请实施例提供的用于设备接入网络的方法的另一实施例示意图；
图17为本申请实施例提供的用于设备接入网络的装置的功能性结示意图；
图18为本申请实施例提供的用户驻地设备的一实施例示意图；
图19是本申请实施例提供的芯片系统的一实施例示意图。
具体实施方式
下面结合附图，对本申请的实施例进行描述，显然，所描述的实施例仅仅是本申请一部分的实施例，而不是全部的实施例。本领域普通技术人员可知，随着新技术的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
本申请实施例提供一种接入网络的方法，可以充分利用已有的网络，完成终端设备接入网络的过程，例如，利用移动网络完成CPE下挂的终端设备接入过程，从而避免了铺设专用的网络通道，提高了移动网络的利用率。本申请实施例还提供了相应的设备及系统。以下分别进行详细说明。
本申请中出现的术语“上行”和“下行”，在某些场景用于描述数据/信息传输的方向，比如，“上行”方向为该数据/信息从终端设备向网络侧传输的方向，“下行”方向为该数据/信息从网络侧设备向终端设备传输的方向，“上行”和“下行”仅用于描述方向，该数据/信息传输起止的具体设备都不作限定。
本申请中出现的术语“和/或”，可以是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本申请中字符“/”，一般表示前后关联对象是一种“或”的关系。
本申请中可能出现的对各种消息/信息/设备/网元/系统/装置/动作/操作/流程/概念等各类客体进行了赋名，但这些具体的名称并不构成对相关客体的限定，所赋名称可随着场景，语境或者使用习惯等因素而变更，对相关客体的技术含义的理解，应主要从其在技术方案中所体现/执行的功能和技术效果来确定。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的实施例能够以除了在这里图示或描述的内容以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或模块的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或模块，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或模块。在本申请中出现的对步骤进行的命名或者编号，并不意味着必须按照命名或者编号所指示的时间/逻辑先后顺序执行方法流程中的步骤，已经命名或者编号的流程步骤可以根据要实现的技术目的变更执行次序，只要能达到相同或者相类似的技术效果即可。本申请中所出现的模块的划分，是一种逻辑上的划分，实际应用中实现时可以有另外的划分方式，例如多个模块可以结合成或集成在另一个系统中，或一些特征可以忽略，或不执行，另外，所显示的或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，模块之间的间接耦合或通信连接可以是电性或其他类似的形式，本申请中均不作限定。并且，作为分离部件说明的模块或子模块可以是也可以不是物理上的分离，可以是也可以不是物理模块，或者可以分布到多个电路模块中，可以根据实际的需要选择其中的部分或全部模块来实现本申请方案的目的。
本申请实施例中，涉及的术语“鉴权”，其含义包括：身份的识别鉴定，和/或，相关操作的授权。
因本申请实施例中涉及到多个英文缩写，因此先对本申请实施例所涉及到的英文缩写所对应的中文全称以及英文全称通过如下表格做出预先介绍。
Figure PCTCN2018097989-appb-000001
Figure PCTCN2018097989-appb-000002
Figure PCTCN2018097989-appb-000003
驻地节点在本申请实施例中可以为CPE。本申请实施例中外部网络可以是相对于移动网络而言的，外部网络是由移动网(包括接入网和核心网)的网元/网络设备之外的其他网元或网络设备组成的网络。本申请实施例中的外部网络可以为固定网络。本申请中，CPE下挂的终端设备：即连接到CPE，并通过CPE接入网络的终端设备。
为了便于阅读理解，在描述本申请各实施例之前，下面对本申请实施例的结构做如下整体介绍：
部分一、CPE下挂的终端设备通过移动网络完成在外部网络的网络接入的方案；其中包括方案1和方案2，方案1中又包括方案1-1和方案1-2，方案2中又包括方案2-1和方案2-2。
方案1、CPE下挂的终端设备通过4G移动网络完成在外部网络的网络接入的方案。
方案1-1、CPE下挂的终端设备通过4G移动网络的用户面完成在外部网络的网络接入的方案。
方案1-2、CPE下挂的终端设备通过4G移动网络的控制面完成在外部网络的网络接入的方案。
方案2、CPE下挂的终端设备通过5G移动网络完成在外部网络的网络接入的方案。
方案2-1、CPE下挂的终端设备通过5G移动网络的用户面完成在外部网络的网络接入的方案。
方案2-2、CPE下挂的终端设备通过5G移动网络的控制面完成在外部网络的网络接入的方案。
部分二、CPE或其下挂的终端设备通过移动网络完成在外部网络的网络接入的方案；其中，包括方案1和方案2。
方案1、CPE或其下挂的终端设备通过4G移动网络完成在外部网络的网络接入的方案；
方案2、CPE或其下挂的终端设备通过5G移动网络完成在外部网络的网络接入的方案。
部分三、在固定网络和移动网络的融合网络中，CPE下挂的终端设备以及CPE在融合网络中的一种网络接入的方案。
部分四、在固定网络和移动网络的融合网络中，CPE下挂的终端设备以及CPE在融合网络中的另一种网络接入的方案。
其中，固定网络也可以称为有线网络，移动网络也可以称为无线网络。
在部分一和部分二的方案中，4G和5G的差别点包括：5G中的UPF和SMF与4G中的移动网关(例如：PGW)的一些功能重合。5G中的AMF与4G中的MME的一些功能重合，因此，为了将4G和5G场景中的设备都表达清楚，可以将SMF和UPF，以及S/P–GW(SGW或PGW)、LGW等统称为网关设备，S/P-GW或LGW可以称为移动网关，将MME和AMF统称为管理设备。但在具体的 4G或5G场景实施例中，可以用相应的具体网元来表示，例如网关设备用PGW、SMF或者UPF来表示，管理设备用MME或者AMF来表示。
需要说明的是，上述部分一至部分四的方案以移动网络和固定网络(外部网络)为例进行的说明，实际上，可以理解的是，只要是两个或多个网络的互联或对接实现终端设备或者CPE的网络接入，或者两个或多个网络的融合实现终端设备或者CPE的网络接入，都属于本申请实施例所包含的范围。
本申请实施例中的终端设备包括，如STB、个人计算机(personal computer，PC)、IP电话、传真机等固定终端设备，以及手机和平板电脑等移动终端设备。下挂的终端设备可以是通过该CPE接入网络或进行业务的终端设备，也就是这些终端设备的网络连接都由该CPE负责。
下面，针对上面所描述的各个部分中所涉及到的方案分别进行描述。
图2A为包含了移动网络和外部网络的网络架构示意图。
如图2A所示的网络架构是以移动网络是4G网络的架构为例进行的说明，该网络架构中针对终端设备包含了图2B至图2E所示的四条网络接入线路。
其中，图2B所示的线路1为终端通过IPoX方式的网络接入路线。在该线路1中，终端通过DHCP中继向DHCP server发送DHCP请求报文(例如DHCP discover或DHCP request)，DHCP中继可以在DHCP报文扩展字段添加鉴权附加信息，该DHCP server将对终端的鉴权请求转发给认证服务器(AAA Server)，对该发送DHCP请求的终端设备进行鉴权。图2B中以DHCP接入网络的绑定鉴权方式为例进行说明，实际上，网络对终端的鉴权方式有多种，本处不一一赘述。
其中，图2C所示的线路2为移动终端在移动网络中的网络接入路线。在该线路2中，移动终端与MME和HSS协同完成鉴权过程。
其中，图2D所示的线路3为CPE下挂的终端设备，通过移动网络的用户面完成在外部网络的网络接入过程。
其中，图2E所示的线路4为CPE下挂的终端设备，通过移动网络的控制面完成在外部网络的网络接入过程。
图2D所示的线路3和图2E所示的线路4示意的是CPE下挂的终端设备通过移动网络完成在外部网络的网络接入过程，实际上CPE通过移动网络完成在外部网络的网络接入过程也可以参阅图2D和图2E进行理解，不考虑CPE下挂的终端设备即可，本申请实施例中不一一示出了。
下面结合图2D所示的线路3以及图3介绍本申请实施例中部分一中的方案1-1，即：CPE下挂的终端设备通过4G移动网络的用户面完成在外部网络的网络接入的方案。
如图3所示，本申请实施例提供的设备接入网络的方法的一实施例包括：
101、CPE接收终端设备发送的第一消息，该第一消息中包含鉴权请求。
该终端设备可以理解为是CPE下挂的终端设备，下挂的终端设备即连接到该CPE的终端设备，该终端设备通过该CPE接入网络。CPE接收下挂的终端设备发送的第一消息，即接收来自于连接到该CPE的终端设备发送的第一消息。
所述鉴权请求可以是该下挂的终端设备在进行网络接入时，向网络发送的接入请求或连接请求或鉴权请求或地址分配请求或其他类型的表明接入网络意图的信息。为简化表述，统称为鉴权请求。
可选地，CPE接收的可以就是一个鉴权请求，不需要通过其他消息携带，例如不需要该第一消息携带。
102、CPE对第一消息进行处理，以得到第二消息。
该第二消息被用于网关设备识别所述鉴权请求和/或所述终端设备接入网络的鉴权方式，所述鉴权方式用于指示所述网关设备向网络设备发送所述鉴权请求，所述鉴权请求用于指示所述网络设备对所述终端设备进行鉴权；
可以是：第二消息中包含所述鉴权请求和第一指示信息，该第一指示信息可以是鉴权类型指示信息，其中，所述鉴权类型指示信息用于指示所述终端设备接入网络的鉴权方式，鉴权类型指示信息可以包括鉴权方式的标识指示和/或鉴权协议标识指示。
本申请实施例中的第一指示信息、第二指示信息、指示信息实际上都是具有指示功能的信息，第一、第二只是在一个场景中出现两次的序号标识，并不应将其理解为是有特殊含义的限定。
还可以是：第二消息中包含所述鉴权请求，通过与所述鉴权方式对应的鉴权通道传输给所述网关设备，所述鉴权通道用于识别对应的鉴权方式。该鉴权通道可以是一种用于传输数据和/或信令的通道，不限于只传输鉴权消息。
该鉴权通道可以是在CPE和网关设备之间建立的特定通道，该特定通道可以是承载或者传输隧道，也可以是APN/DNN或PDN连接或PDU session或网络切片(slice)等，只要能实现特定通道与鉴权方式对应即可，具体特定通道的形式本申请实施例中不做限定。特定通道建立时，就确定采用的鉴权方式或者鉴权协议。这样，在传输终端设备或CPE的鉴权请求时可无需传输鉴权类型指示信息，在相应的特定通道上传输鉴权请求或者认证请求即可。网关设备可以根据该鉴权请求的特定通道确定对应的鉴权方式。鉴权结果的信息也可以通过该特定通道返回至终端设备，该鉴权结果的信息可以携带在鉴权返回消息中通过该特定通道返回至终端设备。当然，不限于通过特定通道返回鉴权结果的信息，也可以通过其他方式返回该鉴权结果的信息。
下面以第二消息中包含所述鉴权请求和鉴权类型指示信息的情况为例，介绍本申请实施例中终端设备接入网络的过程。实际上，采用特定通道的形式除了使用特定通道传输CPE和网关设备之间的数据，无需在第二消息中包含鉴权类型指示信息之外，其他的步骤和过程与包含鉴权类型指示信息的方式基本相同，可以参照这种方式理解采用特定通道的网络接入过程。
步骤102的过程可以包括剥离CPE与终端设备间通信协议的L1/L2报文头，识别终端设备所采用的鉴权方式和/或鉴权协议类型。所述鉴权方式可以包括但不限于例如PPP、PPPoX、IPoX和EAP等，所述鉴权协议类型可以包括但不限于如PPPoX鉴权中涉及到的LCP、PAP、CHAP等协议，或者IPOX中涉及到的DHCP协议(DHCPv4，或DHCPv6)，或者EAP鉴权中的EAP-AKA，EAP-AKA’，EAP-SIM，EAP-TLS等。识别下挂的终端设备鉴权请求对应的鉴权方式和/或鉴 权协议类型后，CPE将第一消息中鉴权请求消息内容(剥离了L1/L2报文头或者未经剥离处理的完整请求报文)或鉴权消息中所包含的多种关键参数等信息，和鉴权类型指示信息一并封装，以得到第二消息。
可选地，若第一消息是鉴权请求，则可以将鉴权类型指示信息携带在该鉴权请求中，得到包含了鉴权类型指示信息的鉴权请求，可以将该包含了鉴权类型指示信息的鉴权请求看作第二消息。
在向第一消息或者鉴权请求中添加鉴权类型指示信息时，可以在空口接入层之上例如IP层的数据包(或报文头)添加，亦可在空口接入层如SDAP/PDCP/RLC/MAC/PHY层的数据包(或报文头)中添加，或者是在某新增的(子)层的数据包(或报文头)添加，具体添加的位置本申请实施例中不做限定。
103、CPE向无线接入网络RAN设备发送第二消息。
104、RAN设备向移动网关发送包含鉴权请求和鉴权类型指示信息的数据包。
RAN设备接收到该第二消息后，可以解除空口接入层封装，再进行S1接口的协议封装(例如GTP隧道封装)，得到第三消息，然后通过用户面GTP(GTP-U)隧道向移动网关发送包含鉴权请求和鉴权类型指示信息的第三消息，该第三消息可以是数据包。
若CPE在空口接入层如SDAP/PDCP/RLC/MAC/PHY层或某新增的(子)层的数据包(或报文头)中包含鉴权类型指示信息，则RAN设备可在S1接口协议封装所涉及的报文头(如GTP/UDP/IP报文头)中添加鉴权类型指示信息。
105、移动网关读取鉴权请求和鉴权类型指示信息。
对于RAN设备发送的包含鉴权请求和鉴权类型指示信息的数据包，移动网关可以从S1接口的协议封装所涉及的报文头中读取鉴权类型指示信息，在解除S1接口的协议封装后的数据包中得到鉴权请求；或者，移动网关可以在解除S1接口的协议封装后，从空口接入层之上例如IP层的数据包(或报文头)中得到鉴权类型指示信息和鉴权请求；或者，移动网关可以根据数据包的传输通道(例如某特定承载)确定对应的鉴权方式和/或鉴权协议，在解除S1接口的协议封装后的数据包中得到鉴权请求。
106、移动网关向网络设备发送鉴权请求。
参考鉴权类型指示信息，移动网关将鉴权请求以鉴权方式或鉴权协议所需的方式，发送给网络中与鉴权认证和地址分配相关的相应网络设备。相应网络设备包括但不限于BNG、DHCP server、AAA server等。
例如：若鉴权方式是PPP或PPPoX，则将BNG作为PPP终结点，移动网关可在L2TP隧道之上建立到BNG的PPP连接，分配PPP会话(session)ID。
若鉴权方式是IPoX，则移动网关可作为DHCP relay或DHCP Proxy将包含鉴权请求的DHCP消息发送至BNG和/或DHCP server。
在鉴权请求转发前，移动网关可以在鉴权请求的扩展option字段中添加鉴权附加信息，例如：表明CPE的身份标识(如IMSI)、表明终端设备位置和/或驻地节点位置的信息(如ECGI和/或eNB ID和/或TAI等)、用于传输所述鉴权请求的通道信息中的至少一个，所述用于传输鉴权请求的通道信息包括如下信息的至少一个：传输鉴权请求的隧道标识，传输鉴 权请求的承载标识，以及传输鉴权请求的会话标识(例如PDU session ID)等。
可选地，也可以是由CPE在向RAN设备发送第二消息前在第二消息中添加上述鉴权附加信息。
107、网络设备根据终端设备所采用的鉴权方式，对该终端设备进行鉴权认证。
例如：若采用PPP鉴权方式，则在LCP阶段协商认证协议之后，终结PPP会话的网络设备如BNG通过密码验证协议(password authentication protocol，英文简称为：PAP)或挑战握手认证协议(challenge handshake authentication protocol，英文简称为：CHAP)对终端设备进行鉴权，BNG通过RADUIS或diameter协议发送鉴权请求至认证服务器即AAA server进行鉴权。
若采用IPoX的鉴权方式，则网络设备如BNG将DHCP发现(discover)请求消息路由至DHCP server，由DHCP server将请求报文中终端添加的鉴权相关扩展字段(例如设备信息、用户名和密码等)以及中间节点添加的鉴权相关扩展option字段信息提取出来，构造认证报文并通过RADIUS或diameter协议发送至AAA server进行鉴权。
若采用EAP的鉴权方式，则EAP客户端(即请求鉴权认证的终端设备)的鉴权请求被转发至EAP设备端(EAP authenticator)例如BNG，EAP设备端可发起对客户端的EAP认证，在EAP设备端和EAP客户端之间交互EAP认证报文。此外，EAP设备端将以EAP中继方式或EAP终结方式，和认证服务器例如AAA server之间通过RADIUS或Diameter协议传送鉴权相关报文。
108、网络设备接收认证服务器返回的鉴权结果的信息。
该鉴权结果的信息中可以包括是否通过鉴权的指示信息。
该鉴权结果的信息可以携带在鉴权返回消息中，本申请实施例中的鉴权返回消息不是特指的一个消息，该鉴权返回消息可以是能够携带鉴权结果的信息的多种类型的消息，只要能够携带鉴权结果的信息的消息，都可以作为鉴权返回消息来起作用。
例如若是IPoX的鉴权方式，倘若认证不通过，则AAA server向DHCP server发送拒绝报文，DHCP server将向BNG返回DHCP NAK报文；若认证通过，AAA server将向DHCP server发送认证通过信息，再由DHCP server向BNG返回DHCP提供(offer)报文。
109、网络设备在鉴权返回消息中可携带为终端设备分配的IP地址和/或路由配置的参考信息。
该路由配置的参考信息可以是用于CPE上行路由配置的参考信息。
该步骤109中的网络设备包括但不限于网关/路由器节点如BNG，或具有地址分配功能的节点如DHCP server。所述网络设备将根据终端设备所采用的鉴权方式，将鉴权返回消息经由无线网关发送至终端设备。其中，所述网络设备发送至移动网关的鉴权返回消息中，可包含鉴权结果和/或地址分配结果，还可包含用于CPE路由配置的参考信息。
用于CPE路由配置的参考信息可以包括以下信息的部分或全部：业务相关(例如IPTV业务)的常用服务器IP地址/网段地址/地址前缀，对应的网络掩码信息(例如掩码或掩码长度)，提供内容的组播地址(若包含组播类业务)，以及对应的下一跳节点。以IPTV业务为例，常用服务器包括但不限于内容服务器、快速换台服务器、DHCP server、DNS server 等，提供内容的组播地址可包括各个频道的组播地址，对应的下一跳节点可以是某个网关或路由器的IP地址。
例如，DHCP server可以在DHCP offer报文和/或DHCP Ack报文中，携带为终端设备预分配或分配的IP地址，还可在扩展option字段中(例如option 121)，添加用于CPE路由配置的参考信息。
110、移动网关接收网络设备发送的鉴权返回消息。
鉴权返回消息中携带鉴权结果的信息。
若鉴权返回消息中包含用于CPE路由配置的参考信息，则移动网关可以直接对鉴权返回消息进行用户面封装；
或者，移动网关可以根据用于CPE路由配置的参考信息，生成路由配置信息，该路由配置信息可以是用于CPE上行路由配置的配置信息，该路由配置信息可以包括以下项中的部分或全部：业务相关的常用服务器IP地址/网段地址/地址前缀，网络掩码信息(例如掩码或掩码长度)，提供内容的组播地址(若包含组播类业务)，下一跳节点地址，CPE应选择的对应接入点标识(如APN/DNN)或网络切片标识或连接通道标识(例如PDN连接标识或PDU会话标识或承载标识)或网关设备的标识或CPE设备端口信息等。
移动网关向CPE发送路由配置信息的方式可以有以下几种：移动网关将路由配置信息添加在鉴权返回消息中；或者，移动网关将鉴权返回消息中用于CPE路由配置的参考信息替换为路由配置信息；或者，移动网关将路由配置信息发送给MME，由MME携带在NAS消息中发送给CPE。
移动网关对鉴权返回消息进行用户面封装。
移动网关也可以不根据路由配置的参考信息确定路由配置信息，而是继续发送该路由配置的参考信息，CPE可以根据该路由配置的参考信息自行确定路由配置信息。
一种可选的设计中，可以将路由配置的参考信息和路由配置信息统称为路由配置信息，也就是所述路由配置信息包括所述网络设备分配的用于所述驻地节点路由配置的参考信息，或者，所述网关设备根据所述路由配置的参考信息确定的用于所述驻地节点路由配置的配置信息。
111、移动网关通过与CPE的用户面承载向CPE发送封装了鉴权返回消息的用户面数据包。
112、CPE接收封装了鉴权返回消息的用户面数据包，对其解封装，提取出鉴权返回消息。
CPE可以对鉴权返回消息进行识别以确认该鉴权返回消息该发送给哪个终端设备。
CPE可根据鉴权返回消息中包含的路由配置的参考信息或路由配置信息，或根据从MME处收到的NAS消息中携带的路由配置信息，进行路由配置。
113、CPE向发送鉴权请求的终端设备发送鉴权返回消息。
类似地，后续终端设备根据鉴权方式的需求，与网络设备继续交互其他的消息。例如IPoX鉴权方式涉及的DHCP request消息和相应的DHCP Ack消息，也将由CPE和移动网关之间的用户面承载传送，并在移动网关和BNG以及选定的DHCP server之间路由，直至完成终端 设备接入网络的过程。
从该图3对应的实施例的内容可知，本申请实施例中充分利用已有的4G网络的用户面，完成终端设备接入网络，从而避免了铺设专用的网络通道，提高了移动网络的利用率。
以上是针对终端设备可能的鉴权方式的概括性描述，下面以终端设备是STB，鉴权方式是IPoX(DHCP+认证)为例，介绍该STB通过4G移动网络的用户面完成网络接入的过程。
如图4所示，本申请实施例提供的设备接入网络的方法的另一实施例包括：
201、CPE接收STB发送的DHCP discover消息。
该DHCP discover消息相当于上述图3对应的实施例中的第一消息，该DHCP discover消息中可以包含该STB的设备类型信息。
202、CPE识别DHCP discover消息。
例如CPE可基于接收到STB发送报文的IP五元组信息(源IP地址为0.0.0.0，目的IP地址为255.255.255.255，源端口号68，目的端口号67，协议类型UDP)，识别出接收到的报文为DHCP discover消息，故获知对应的鉴权方式为IPoX(DHCP+认证)，然后对其进行用户面封装，可在封装的报文中添加第一指示信息，例如：鉴权类型指示信息。
203、CPE通过演进基站eNB向PGW转发被封装的DHCP discover消息。
204、PGW接收和处理DHCP discover消息。
PGW根据接收报文中的鉴权方式指示，提取上行用户面报文中的DHCP discover消息。
PGW在收到来自CPE转发的STB的DHCP discover报文时，记录标识CPE身份的ID(例如EPS bearer/TEID等)和请求IP地址的STB的MAC地址之间的映射关系。
PGW可以作为DHCP relay或DHCP Proxy的角色，修改DHCP报文中的某些相关字段内容。例如作为DHCP relay时，PGW修改DHCP discover报文中的Giaddr为自己的IP地址，在hops字段+1；还可以作为中间节点在扩展字段(例如option 82)中添加鉴权附加信息如：表明CPE的身份标识(如IMSI)、表明终端设备位置和/或驻地节点位置的信息(如ECGI和/或eNB ID和/或TAI)、用于传输所述鉴权请求的通道信息中的至少一个，所述用于传输鉴权请求的通道信息包括如下信息的至少一个：传输鉴权请求的隧道标识，传输鉴权请求的承载标识，以及传输鉴权请求的会话标识(例如PDU session ID)等。
205、PGW向DHCP Server发送DHCP discover消息。
206、DHCP Server根据DHCP discover消息中包含的鉴权相关信息，生成认证请求报文，向认证服务器发送认证请求。
207、认证服务器对该STB进行鉴权。
208、DHCP Server接收认证服务器返回的认证结果。
209、若认证通过，DHCP Server向PGW发送DHCP offer，其中包含DHCP server为STB预分配的IP地址。
210、PGW根据步骤204记录的映射关系，确定需发送DHCP offer给CPE。
211、PGW向CPE发送包含DHCP offer报文的数据包。
212、CPE接收包含DHCP offer报文的数据包，从中识别出终端设备为STB。
例如可根据DHCP offer报文中的客户端MAC地址识别出STB。
213、CPE将DHCP offer报文发送给STB。
214、CPE接收STB发送的DHCP请求(request)消息。
215、CPE识别DHCP request消息，进行用户面封装，添加鉴权类型指示信息。
216、CPE经由eNB向PGW发送包含DHCP request的数据包。
217、PGW向DHCP Server发送DHCP request消息。
在发送前，PGW可以作为DHCP relay或DHCP Proxy的角色，修改DHCP request报文中的某些相关字段内容。
218、PGW接收DHCP Server返回的DHCP应答(Ack)报文。
其中包含DHCP server分配给STB的IP地址，该DHCP Ack中还可包含用于CPE路由配置参考的扩展字段(如option 121)。
219、PGW经由eNB向CPE发送发包含DHCP Ack报文的数据包。
可选地，PGW可在DHCP Ack中添加路由配置信息，或者PGW向MME发送包含路由配置信息的消息，由MME通过NAS消息发送给CPE。
220、CPE接收包含DHCP Ack报文的数据包，从中识别出终端设备为STB，例如可根据DHCP offer报文中的客户端MAC地址识别出STB。
CPE基于DHCP Ack或NAS消息中的路由配置信息或参考信息，进行路由配置。
221、CPE将DHCP Ack报文发送给STB。
STB收到DHCP Ack报文后，可获得合法的IP地址，接入网络过程完成，后续STB可在有效的时间范围内利用获得的合法IP地址与网络中的设备通信，接受网络提供的服务。
以上是对部分一中方案1-1的描述。下面结合图5描述本申请实施例中的方案1-2，即：CPE下挂的终端设备通过4G移动网络的控制面完成在外部网络的网络接入的方案。
如图5所示，本申请实施例提供的设备接入网络的方法的另一实施例包括：
301、CPE接收终端设备发送的第一消息，该第一消息中包含鉴权请求。
该终端设备可以理解为是该CPE下挂的终端设备，下挂的终端设备即连接到该CPE的终端设备，该终端设备通过该CPE接入网络。CPE接收下挂的终端设备发送的第一消息，即接收来自于连接到该CPE的终端设备发送的第一消息。
所述鉴权请求是该下挂的终端设备在进行网络接入时，向网络发送的接入请求或连接请求或鉴权请求或地址分配请求或其他类型的表明接入网络意图的信息。为简化表述，统称为鉴权请求。
可选地，CPE接收的可以就是一个鉴权请求，不需要通过其他消息，例如第一消息携带。
302、CPE对第一消息进行处理，以得到第二消息。
该第二消息为NAS消息，该NAS消息中包含所述鉴权请求和/或鉴权类型指示信息。
步骤302的过程可以包括剥离CPE与终端设备间通信协议的L1/L2报文头，识别终端设备所采用的鉴权方式和/或鉴权协议类型。所述鉴权方式可以包括但不限于例如PPP、PPPoX、IPoX和EAP等，所述鉴权协议类型可以包括但不限于如PPPoX鉴权中涉及到的LCP、PAP、CHAP等协议，或者IPOX中涉及到的DHCP协议(DHCPv4，或DHCPv6)，或者EAP鉴权中的EAP-AKA， EAP-AKA’，EAP-SIM，EAP-TLS等。识别下挂的终端设备鉴权请求对应的鉴权方式和/或鉴权协议类型后，CPE将鉴权请求消息内容(剥离了L1/L2报文头或者未经剥离处理的完整请求报文)或鉴权消息中所包含的多种关键参数等信息携带在NAS消息中，并指明携带鉴权消息对应的鉴权类型指示信息。所述鉴权类型指示信息可以包括鉴权方式的标识指示和/或鉴权协议标识指示。
也就是说，CPE要将鉴权相关信息携带在NAS消息中。
需要说明的是，本申请实施例中的NAS消息可以包括三种类型：
第一类型NAS消息为专用于所述终端设备或所述CPE接入网络的消息，也就是说第一类型NAS消息为定义的一种新的NAS消息类型，用于承载特定类型的鉴权协议相关的交互消息。例如定义NAS消息类型为EAP鉴权消息，并在此NAS消息中封装EAP鉴权涉及的交互消息内容，或EAP鉴权涉及的交互消息中所包含的多种关键参数等信息。
第二类型NAS消息中包含信元(information element，IE)，该信元可以是协议配置选项信元，所述协议配置选项信元中包含用于所述终端设备或所述CPE接入网络的信息，也就是说第二类型NAS消息为在现有的NAS消息的信元中，例如：协议配置选项PCO信元中支持的协议中，添加鉴权方式对应的协议，并设定对应的协议ID，然后可在对应的PCO内容中添加鉴权类型和/或鉴权协议相关的交互消息内容，或关键参数。例如，终端设备和网络侧在产生携带EAP消息的NAS消息时，将NAS的PCO信元中某个协议标识(Protocol identity)设定为EAP-AKA对应的identity，并在对应的“Protocol ID #n contents”中添加EAP-AKA协议对应的鉴权所涉及的交互消息内容，或鉴权所涉及的交互消息中包含的多种关键参数等信息。
第三类型NAS消息中包含信元，该信元可以是接入专用信元或消息容器(message container)，所述接入专用信元或消息容器用于携带所述终端设备或所述CPE接入网络的信息，也就是说第三类型的NAS消息为在现有的NAS消息中配置一种新的信元或消息容器，用于携带鉴权协议对应涉及的交互消息。其中可包含以下信息中的部分或全部：所述鉴权类型指示信息，鉴权所涉及的交互消息内容或鉴权所涉及的交互消息中所包含的多种关键参数等信息。
需要说明的是，本申请实施例中所涉及到的NAS消息，无论是上行方向还是下行方向都可以是上述三种类型中的任意一种。
303、CPE通过RAN设备向MME发送该NAS消息。
304、MME接收到该NAS消息后，从NAS消息中提取出鉴权请求或鉴权消息中包含的关键参数，和/或鉴权类型指示信息。
305、MME向移动网关发送消息(例如请求/传输消息)。
其中包含鉴权请求或鉴权消息中包含的关键参数和鉴权类型指示信息中的至少一项。
需指出，若MME发送的是鉴权消息中包含的关键参数，则移动网关收到后需要参照鉴权类型指示信息，根据这些关键参数生成鉴权请求报文。
步骤306至步骤309与图3对应的实施例中的步骤106至步骤109相同，本实施例中不再做重复赘述，可以参阅步骤106至步骤109进行理解。
310、移动网关接收网络设备发送的鉴权返回消息。
该鉴权返回消息中携带鉴权结果的信息。
若鉴权返回消息中若包含用于CPE路由配置的参考信息，移动网关可以根据路由配置的参考信息，生成路由配置信息。
所述路由配置的参考信息和路由配置信息内容参见步骤109和步骤110中的描述。
311、移动网关向MME发送消息。
所述消息(例如请求/应答/传输消息)包含鉴权返回消息或鉴权返回消息中的关键参数和路由配置信息中的至少一项。
312、MME将移动网关发来的消息中的内容封装在NAS消息中。
所述NAS消息的内容包含鉴权返回消息、鉴权返回消息中的关键参数和路由配置信息中的至少一项。
该NAS消息的类型也可以参阅前述介绍的三种类型进行理解。
313、MME通过RAN设备向CPE发送该NAS消息。
314、CPE从收到的NAS消息中提取或生成鉴权返回消息。
CPE可以对鉴权返回消息进行识别，以确认该鉴权返回消息该发送给哪个终端设备。CPE可根据鉴权返回消息中包含的用于CPE路由配置的参考信息或路由配置信息进行路由配置。所述路由配置的参考信息和路由配置信息内容参见步骤109和步骤110中的描述。
315、CPE向发送鉴权请求的终端设备发送鉴权返回消息。
类似地，后续终端设备根据鉴权方式的需求，与网络设备继续交互其他的消息，例如IPoX鉴权方式涉及的DHCP request消息和相应的DHCP Ack消息，也将由CPE和MME之间的控制面通道以及MME和移动网关之间传送，并在移动网关和BNG以及相关的DHCP server之间路由，直至完成终端设备接入网络的过程。
从该图5对应的实施例的内容可知，本申请实施例中充分利用已有的4G网络的控制面，完成终端设备接入网络，从而避免了铺设专用的网络通道，提高了移动网络的利用率。
以上是对部分一中方案1-2的描述。下面结合图6描述本申请实施例中的方案2-1，即：方案2-1、CPE下挂的终端设备通过5G移动网络的用户面完成网络接入的方案。
如图6所示，本申请实施例提供的设备接入网络的方法的另一实施例包括：
401、CPE接收终端设备发送的第一消息，该第一消息中包含鉴权请求。
该终端设备可以理解为是CPE下挂的终端设备，下挂的终端设备即连接到该CPE的终端设备，该终端设备通过该CPE接入网络。CPE接收下挂的终端设备发送的第一消息，即接收来自于连接到该CPE的终端设备发送的第一消息。
所述鉴权请求是该下挂的终端设备在进行网络接入时，向网络发送的接入请求或连接请求或鉴权请求或地址分配请求或其他类型的表明接入网络意图的信息。为简化表述，统称为鉴权请求。
可选地，CPE接收的可以就是一个鉴权请求，不需要通过其他消息携带，例如第一消息携带。
402、CPE对第一消息进行处理，以得到第二消息。
该步骤402中的相关消息以及处理过程可以参阅步骤102进行理解，本处不再重复赘述。
403、CPE向RAN设备发送第二消息。
该处的RAN设备可以是5G中的基站gNB。
404、RAN设备向UPF发送数据包，其中包含第二消息中携带的鉴权请求和/或鉴权类型指示信息。
该数据包可以是第三消息。
CPE经由RAN设备，与UPF之间通过建立的PDU会话(PDU session)传输数据包。RAN设备接收到CPE发来的第二消息后，解除空口接入层封装，再根据N3接口协议要求进行封装(例如进行隧道封装)，然后在与CPE和UPF的PDU session对应的传输通道(例如N3 tunnel)中向UPF发送包含鉴权请求和/或鉴权类型指示信息的数据包。
若CPE在空口接入层如SDAP/PDCP/RLC/MAC/PHY层或某新增的(子)层的数据包(或报文头)中包含鉴权类型指示信息，则RAN设备可在N3接口协议封装所涉及的报文头(如GTP/UDP/IP报文头)中添加鉴权类型指示信息。
405、UPF解封装收到的数据包，读取其中的鉴权请求和/或鉴权类型指示信息。
对于RAN设备发送的包含鉴权请求和/或鉴权类型指示信息的数据包，UPF可以从N3接口的协议封装所涉及的报文头中读取鉴权类型指示信息，在解除N3接口的协议封装后的数据包中得到鉴权请求；或者，UPF可以在解除N3接口的协议封装后，从空口接入层之上例如IP层的数据包(或报文头)中得到鉴权类型指示信息和鉴权请求；或者，UPF可以根据数据包的传输通道(例如某特定PDU session对应的N3 tunnel)确定对应的鉴权方式和/或鉴权协议，在解除N3接口的协议封装后的数据包中得到鉴权请求。
406、UPF向SMF请求鉴权配置信息和/或鉴权附加信息。
UPF与SMF之间的接口为N4接口。UPF通过N4接口向SMF发送消息(例如请求/应答/传输消息)，其中可以包含终端设备的鉴权请求报文或鉴权请求报文中的关键参数和/或鉴权类型指示信息。SMF通过N4接口向UPF发送消息(例如请求/应答/传输消息)，其中可包含鉴权配置信息和/或鉴权附加信息，鉴权附加信息为用于鉴权的附加信息。
所述鉴权配置信息，用于指导UPF根据鉴权需求与DN中的网络设备建立连接。
所述鉴权附加信息可以包括如：表明CPE的身份标识(如IMSI)、表明终端设备位置和/或驻地节点位置的信息(如ECGI和/或gNB ID和/或TAI等)、用于传输所述鉴权请求的通道信息中的至少一个，所述用于传输鉴权请求的通道信息包括如下信息的至少一个：传输鉴权请求的隧道标识，传输鉴权请求的承载标识，以及传输鉴权请求的会话标识(例如PDU session ID)等。
该步骤406为可选步骤，可以执行也可以不执行。
407、UPF根据鉴权需求与数据网络中的网络设备建立连接。
数据网络(DN)中的网络设备可以包括网络中的各种用于鉴权和/或转发和/或地址分配的设备，例如：BNG，DHCP Server，AAA Server等。
例如，若鉴权方式是PPP或PPPoX，则UPF可以在L2TP隧道之上与DN中的网络设备例如 BNG建立PPP连接会话。
若鉴权方式是IPoX，则UPF作为DHCP relay将包含鉴权请求的DHCP消息路由转发至DN中的网络设备例如DHCP server。
若鉴权方式是EAP，方式一，SMF可以通过RADIUS协议或者Diameter协议向DN中的网络设备例如BNG或AAA server发送包含鉴权消息的报文，UPF负责转发SMF和DN中的网络设备之间交互的鉴权相关报文，可选地，SMF可作为EAP设备端。方式二，UPF可以通过RADIUS协议或者Diameter协议向DN中的网络设备例如BNG或AAA server发送包含鉴权消息的报文，可选地，UPF可作为EAP设备端。EAP设备端的作用可参考步骤107中的介绍进行理解。
408、在鉴权请求报文中添加鉴权附加信息。
若由UPF添加鉴权附加信息，所述鉴权附加信息可以是在步骤406中由SMF发给UPF的，也可以是UPF根据CPE或PDU session的上下文信息获得的。
若在步骤406中，UPF向SMF发送的消息中包含鉴权请求报文，则SMF可以在鉴权请求报文中添加鉴权附加信息后，再将报文发送给UPF。
409、UPF向DN中的网络设备发送鉴权请求报文。
该步骤中，所述网络设备包括但不限于网关/路由器节点如BNG，或具有地址分配功能的节点如DHCP server，或具有鉴权认证功能的节点如AAA server。
410、DN中的网络设备根据终端设备所采用的鉴权方式，对该终端设备进行鉴权认证。
若将此步骤中的“DN中的网络设备”与步骤107中的“网络设备”对应，则此步骤过程可参考步骤107。
411、DN中的网络设备接收认证服务器返回的鉴权结果的信息。
该步骤中的网络设备，可包括但不限于网关/路由器节点如BNG，或具有地址分配功能的节点如DHCP server。若将此步骤中的“DN中的网络设备”与步骤108中的“网络设备”对应，则此步骤过程可参考步骤108进行理解。
412、DN中的网络设备在鉴权返回消息中可携带为终端设备分配的IP地址和/或用于CPE路由配置的参考信息。
该步骤中的网络设备，可包括但不限于网关/路由器节点如BNG，或具有地址分配功能的节点如DHCP server。若将此步骤中的“DN中的网络设备”与步骤109中的“网络设备”对应，此步骤过程可参考步骤109进行理解。
413、UPF接收DN中的网络设备发送的鉴权返回消息。
若鉴权返回消息中包含用于CPE路由配置的参考信息，则UPF可以直接将此鉴权返回消息进行用户面封装；或者，UPF可以根据用于CPE路由配置的参考信息，生成路由配置信息，携带在鉴权返回消息中，然后对鉴权返回消息进行用户面封装；或者，一方面，UPF将鉴权返回消息进行用户面封装，另一方面，UPF将用于CPE路由配置的参考信息通过N4接口的消息(例如请求/应答/传输消息)发送给SMF，SMF根据所述参考信息生成发送给CPE的路由配置信息，携带在N11接口的消息(例如请求/应答/传输消息)发送给AMF，再由AMF将路由配置信息携带在NAS消息中发送给CPE；或者，UPF将鉴权返回消息通过N4接口的消息(例如请求/应答/传输消息)发送给SMF，由SMF生成路由配置信息，携带在鉴权返回消息，再通过 N4接口的请求/应答/传输消息发给UPF，UPF对添加了路由配置信息的鉴权返回消息进行用户面封装。
关于路由配置的参考信息和路由配置信息的内容可以参阅步骤109和步骤110中的描述，本处不再重复赘述。
414、UPF经由RAN设备向CPE发送封装了鉴权返回消息的数据包。
415、CPE接收封装了鉴权返回消息的数据包，对其解封装，提取出鉴权返回消息。
CPE可以对鉴权返回消息进行识别以确认该鉴权返回消息该发送给哪个终端设备。
CPE可根据鉴权返回消息中包含的路由配置参考信息或路由配置信息，或根据从AMF处收到的NAS消息中携带的路由配置信息，进行路由配置。
416、CPE向发送鉴权请求的终端设备发送鉴权返回消息。
类似地，后续终端设备根据鉴权方式的需求，与网络设备继续交互其他的消息，例如IPoX鉴权方式涉及的DHCP request消息和相应的DHCP Ack消息，直至完成终端设备接入网络的过程。
从该图6对应的实施例的内容可知，本申请实施例中充分利用已有的5G网络的用户面，完成终端设备接入网络，从而避免了铺设专用的网络通道，提高了移动网络的利用率。
以上是对部分一中方案2-1的描述。下面结合图7描述本申请实施例中的方案2-2，即：CPE下挂的终端设备通过5G移动网络的控制面完成网络接入的方案。
501、CPE接收终端设备发送的第一消息，该第一消息中包含鉴权请求。
该终端设备可以理解为是CPE下挂的终端设备，下挂的终端设备即连接到该CPE的终端设备，该终端设备通过该CPE接入网络。CPE接收下挂的终端设备发送的第一消息，即接收来自于连接到该CPE的终端设备发送的第一消息。
所述鉴权请求是该下挂的终端设备在进行网络接入时，向网络发送的接入请求或连接请求或鉴权请求或地址分配请求或其他类型的表明接入网络意图的信息。为简化表述，统称为鉴权请求。
可选地，CPE接收的可以就是一个鉴权请求，不需要通过其他消息，例如第一消息携带。
502、CPE对第一消息进行处理，以到第二消息。
该步骤502可以参阅步骤302中的描述进行理解，本处不再重复赘述。
503、CPE通过RAN设备向AMF发送该NAS消息。
504、AMF接收到该NAS消息后，从NAS消息中提取出鉴权请求或鉴权请求消息中包含的关键参数，和/或鉴权类型指示信息。
505、AMF向SMF发送消息(例如请求/应答/传输消息)，其中包括鉴权请求或鉴权请求消息中包含的关键参数，和鉴权类型指示信息中的至少一项。
AMF与SMF之间的通信接口为N11接口。
506、SMF生成鉴权配置信息和/或鉴权附加信息。
所述鉴权配置信息，用于指导UPF根据鉴权需求与DN中的网络设备建立连接。
例如，若鉴权方式是PPP或PPPoX，则UPF可以在L2TP隧道之上与DN中的网络设备例如 BNG建立PPP连接会话。
若鉴权方式是IPoX，则UPF作为DHCP relay将包含鉴权相关信息的DHCP消息发送至DN中的网络设备例如DHCP server。
若鉴权方式是EAP，方式一，SMF可以通过RADIUS协议或者Diameter协议向DN中的网络设备例如BNG或AAA server发送包含鉴权消息的报文，UPF负责转发SMF和DN中的网络设备之间交互的鉴权相关报文，可选地，SMF可作为EAP设备端；方式二，UPF可以通过RADIUS协议或者Diameter协议向DN中的网络设备例如BNG或AAA server发送包含鉴权消息的报文，可选地，UPF可作为EAP设备端。EAP设备端的作用可参考步骤107中的介绍进行理解。
所述鉴权附加信息可以包括如：表明CPE的身份标识(如IMSI)、表明驻地节点位置的信息(如ECGI和/或gNB ID和/或TAI等)、用于传输所述鉴权请求的通道信息中的至少一个，所述用于传输鉴权请求的通道信息包括如下信息中的至少一个：传输鉴权请求的隧道标识，传输鉴权请求的承载标识，以及传输鉴权请求的会话标识(例如PDU session ID)等。
507、SMF向UPF发送消息。
该消息(例如请求/应答/传输消息)包括鉴权请求或鉴权请求消息中包含的关键参数、鉴权配置信息、鉴权附加信息和鉴权类型指示信息中的至少一个。
508、UPF收到SMF发送的消息，生成鉴权请求报文。
UPF可参考所述SMF发来的消息(例如请求/应答/传输消息)中的鉴权类型指示信息，根据所述消息中携带的鉴权请求或者鉴权请求消息中包含的关键参数，和/或鉴权附加信息，生成鉴权请求报文。所述鉴权请求报文中可以包含鉴权附加信息。
步骤509-步骤512与图6对应的步骤409-步骤412相同，本实施例中不再做重复赘述，可以参阅步骤409至步骤412进行理解。
513、UPF接收DN中的网络设备发送的鉴权返回消息。
根据接收的鉴权返回消息，UPF可以得到鉴权返回消息中的关键参数，用于生成发送给SMF的消息。
若所述鉴权返回消息中包含用于CPE路由配置的参考信息，则UPF可以提取出用于CPE路由配置的参考信息；或者，根据所述参考信息，生成路由配置信息；或者，UPF根据所述参考信息，在所述鉴权返回消息中添加路由配置信息。
关于路由配置的参考信息和路由配置信息的内容可以参阅步骤109和步骤110中的描述，本处不再重复赘述。
514、UPF向SMF发送消息。
所述消息(例如请求/应答/传输消息)包含以下信息中的至少一项：鉴权返回消息或鉴权返回消息中的关键参数，路由配置信息，用于CPE路由配置的参考信息。
若SMF收到UPF发送的消息中包含用于CPE路由配置的参考信息，SMF可以根据所述参考信息生成路由配置信息。
515、SMF向AMF发送消息。
所述消息(例如请求/应答/传输消息)包含以下信息中的至少一项：鉴权返回消息或鉴权返回消息中的关键参数、路由配置信息、用于CPE路由配置的参考信息。
516、AMF将SMF发来的消息的内容封装在NAS消息中。
所述NAS消息中包含以下信息中的至少一项：鉴权返回消息或鉴权返回消息中的关键参数，路由配置信息，用于CPE路由配置的参考信息。
所述NAS消息的类型也可以参阅步骤302介绍的三种类型进行理解。
517、AMF通过RAN设备向CPE发送NAS消息。
518、CPE解封装收到的NAS消息，从中提取或生成鉴权返回消息。
CPE可以对鉴权返回消息进行识别以确认该鉴权返回消息该发送给哪个终端设备。
CPE可根据路由配置信息或鉴权返回消息中包含的用于CPE路由配置的参考信息进行路由配置。
519、CPE向发送鉴权请求的终端设备发送鉴权返回消息。
类似地，后续终端设备根据鉴权方式的需求，与网络设备继续交互其他的消息，例如IPoX鉴权方式涉及的DHCP request消息和相应的DHCP Ack消息，直至完成终端设备接入网络的过程。
从该图7对应的实施例的内容可知，本申请实施例中充分利用已有的5G网络的控制面，完成终端设备接入网络，从而避免了铺设专用的网络通道，提高了移动网络的利用率。
以上是针对终端设备可能的鉴权方式的概括性描述，下面以终端设备是STB，鉴权方式是IPoX(DHCP+认证)为例，介绍该STB通过5G移动网络的控制面完成网络接入的过程。
如图8所示，本申请实施例提供的设备接入网络的方法的另一实施例包括：
601、CPE接收STB发送的鉴权请求报文。
例如DHCP discover报文；
602、CPE接收到鉴权请求报文后，将鉴权请求或鉴权请求中用于鉴权的参数封装在NAS消息中，可选地，所述NAS消息中还可包含鉴权类型指示信息。
将鉴权请求封装为NAS消息可以参阅步骤302中介绍的NAS消息的三种类型进行理解。
例如，CPE在NAS消息PDU session建立请求的某个消息容器(例如Session Management container)中，携带鉴权类型指示信息为IPoX(DHCP+认证)、DHCP扩展字段内容(如option 60)、STB的设备信息如MAC地址、设备类型等信息。
603、CPE通过RAN设备向AMF发送NAS消息。
604、AMF解封装收到的NAS消息。
605、AMF向SMF发送携带DHCP discover报文或DHCP discover中鉴权相关关键参数的消息。
例如可以在AMF通过N11接口发往SMF的SM request消息中携带CPE在Session Management container中包含的内容。
606、SMF生成鉴权配置信息和/或鉴权附加信息。
生成鉴权配置信息和/或鉴权附加信息相关内容可参考步骤506中的描述进行理解。
可选地，若AMF发来的消息中包含DHCP discover报文，则SMF可以将生成的鉴权附加信息添加在DHCP discover报文中，还可根据SMF在对设备鉴权中的角色(例如DHCP relay或DHCP Proxy)修改DHCP discover报文中的部分字段内容，例如作为DHCP relay，SMF可 以修改首个relay节点的IP地址——Raiaddr、经历的跳数——hops等字段。
或者，SMF可以根据AMF发来的消息中包含的鉴权相关关键参数，生成DHCP discover报文，其中可添加鉴权附加信息(例如扩展字段option 82对应的内容)，还可根据SMF在对设备鉴权中的角色(例如DHCP relay或DHCP Proxy)修改/填充DHCP discover报文中的部分字段内容，例如作为DHCP relay，SMF可以修改/填充首个relay节点的IP地址——Raiaddr、经历的跳数——hops等字段。
607、SMF通过N4接口向UPF发送消息，其中可携带DHCP Discover报文和/或鉴权配置信息；
或者，其中可携带鉴权相关关键参数，以及步骤606中生成的鉴权配置信息和/或鉴权附加信息(例如扩展字段option 82对应的内容)等。
所述消息可以是请求/应答/传输消息等，例如会话建立/修改请求。
608、UPF接收SMF发送的消息。
UPF接收到SMF的消息(例如N4会话建立/修改请求消息)后，根据其中包含的鉴权配置信息或鉴权类型指示信息，UPF可以作为DHCP relay或DHCP Proxy节点，与DN中的网络设备例如DHCP server进行交互。例如，UPF根据鉴权类型指示信息或鉴权配置信息，从N4会话建立/修改消息中提取出DHCP discover报文，作为DHCP relay修改DHCP discover报文的部分字段，并在扩展字段option 82添加CPE的IMSI信息；或根据其中的关键参数生成DHCP discover报文后，作为DHCP relay修改DHCP报文的部分字段，在扩展字段option 82添加CPE的IMSI信息。
或者，SMF作为DHCP relay或DHCP Proxy节点，通过UPF，与DN中的网络设备例如DHCP server进行交互，UPF根据鉴权配置信息或鉴权类型指示信息，可以作为中间节点，负责转发SMF和DN中网络设备之间的交互报文。例如，UPF从SMF发来的消息(例如请求/应答/传输消息)中，得到经SMF生成/修改的DHCP discover报文，用于向DHCP server转发。
609、UPF向DN中的网络设备发送鉴权请求报文。例如，UPF通过N6接口，向DN中的DHCP server发送DHCP discover报文。
610、DN中的网络设备根据终端设备所采用的鉴权方式，对该终端设备进行鉴权认证。例如，DHCP server基于DHCP discover报文中的鉴权参数，向AAA server发送认证报文，由AAA server对STB进行鉴权。
611、认证服务器向DN中的网络设备发送鉴权结果的信息。
例如，对STB的鉴权通过后，AAA server向DHCP server返回认证通过通知。
612、DN中的网络设备生成鉴权返回消息，例如：DHCP server生成DHCP offer报文，在其中携带为STB预分配的IP地址，在扩展字段(例如option121)中添加用于CPE路由配置的参考信息。所述用于CPE路由配置的参考信息可以包括例如以下内容中的全部或部分：IPTV业务的常用服务器(内容服务器、快速换台服务器等)IP地址/网段地址/地址前缀和/或网络掩码信息(例如掩码或掩码长度)以及对应的下一跳节点，提供内容的组播地址以及对应的下一跳节点等。值得注意的是，DHCP server也可以在后续的DHCP Ack报文中，在扩展字段(例如option 121)中添加用于CPE路由配置的参考信息。
613、UPF接收DHCP server发送的DHCP offer报文。
可选地，根据UPF在对设备鉴权中的角色(例如DHCP relay或DHCP Proxy)，UPF可修改/填充DHCP offer报文中的部分字段内容。
614、UPF向SMF发送消息。
所述消息中可包含DHCP offer报文中的多个关键参数，或者包含DHCP offer报文。该消息可以是请求/应答/传输消息，例如N4会话建立/修改应答消息。
可选地，根据SMF在对设备鉴权中的角色(例如DHCP relay或DHCP Proxy)，SMF可修改/填充DHCP offer报文中的部分字段内容。
可选地，SMF可根据其中包含的用于CPE路由配置的参考信息生成路由配置信息。所述路由配置信息可以添加在DHCP offer报文的扩展字段中，或者将DHCP offer报文扩展字段中的用于CPE路由配置的参考信息替换为路由配置信息。
615、SMF向AMF发送消息。
所述消息可以是请求/应答/传输消息，例如SM response消息。在所述消息中的某消息容器(例如session management container)中，携带DHCP offer报文或DHCP offer报文中的多个关键参数，可包括路由配置信息和/或用于CPE路由配置的参考信息。
616、AMF生成NAS消息。
所述NAS消息中，可以携带在SMF发来的应答/传输消息中，通过某消息容器给CPE/终端设备的消息。例如在NAS消息PDU session response中，携带SMF发送的SM response消息中session management container中的包含的内容(如DHCP offer报文中的多个关键参数、路由配置信息等)。
617、AMF通过RAN设备向CPE发送生成的NAS消息。
618、CPE解封装收到的NAS消息，得到DHCP offer报文，或者提取DHCP offer报文中的关键参数，生成DHCP offer报文。
可选地，CPE可根据NAS消息中的路由配置信息和/或用于CPE路由配置的参考信息进行路由配置。
CPE可以根据NAS消息或者DHCP offer报文中的信息，确认需将DHCP offer报文发送给STB。
619、CPE向发送鉴权请求的终端设备即STB发送DHCP offer报文。
后续，STB和DHCP server之间将通过上述步骤(601-619)中介绍的传输途径各段(包括STB-CPE，CPE-AMF，AMF-SMF，SMF-UPF，UPF-DHCP server)，继续后续消息(包括DHCP request及DHCP Ack)的交互，直至完成IPoX方式的鉴权过程。包括从STB发送DHCP request消息到选定的DHCP server，DHCP server也将返回DHCP Ack消息给STB，DHCP server返回的DHCP Ack报文中可携带为STB分配的IP地址，和/或用于CPE路由配置的参考信息。所涉及的各个节点，包括CPE、RAN设备、AMF、SMF、UPF、DN中的网络设备等也将如步骤601-619中介绍的方式，对设备接入过程中的后续消息转发或处理。
以上所描述的是CPE下挂的终端设备通过4G或5G移动网络实现网络接入的过程。
下面介绍本申请实施例中CPE或其下挂的终端设备通过4G或5G移动网络实现网络接入 的过程。而且，CPE的网络接入过程可以结合到前述部分一的方案中，例如：在下挂的终端设备接入网络之前，CPE先执行网络接入过程，也可以作为独立网络接入方案，无论是结合到前述部分一的方案中，还是作为独立的方案，CPE网络接入的过程都是基本相同的。
CPE接入网络的过程和终端设备接入网络的过程基本相同，只是发起鉴权请求的是CPE，CPE可直接对鉴权请求进行用户面或控制面的封装后传输至相应设备，不需要考虑终端设备和CPE之间传输所涉及到的步骤。
CPE或其下挂的终端设备的网络接入过程如前述部分二所描述的：
方案1、CPE或其下挂的终端设备通过4G移动网络完成网络接入的方案；
方案2、CPE或其下挂的终端设备通过5G移动网络完成网络接入的方案。
而且，该处的方案1中和方案2中都可以包括用户面的网络接入过程和控制面的网络接入过程。
鉴于前述已经对终端设备的网络接入过程做了多个实施例的描述，而且CPE的网络接入过程可以参阅终端设备的网络接入过程进行理解，因此，本申请实施例中，对CPE或其下挂的终端设备的网络接入过程以4G场景中的控制面和5G场景中的控制面为例进行介绍，用户面的过程可以参阅部分一的相应过程进行理解。
在介绍CPE或其下挂的终端设备的网络接入之前，结合图9A介绍下本申请实施例中终端、EAP设备端和认证节点之间依靠EAP协议的信息交互过程。如图9A所示，终端作为EAP客户端，其鉴权请求可被转发至EAP设备端，EAP设备端可发起对EAP客户端的EAP认证，在EAP设备端和EAP客户端之间交互EAP认证报文。此外，EAP设备端将以EAP中继方式或EAP终结方式和认证节点传送认证相关报文，EAP设备端与认证节点之间可以通过RADIUS或Diameter协议传送认证相关报文。
在此实施例中，可以将CPE或其下挂的终端设备视为终端，即EAP客户端。当然，除图9A中所示出的EAP鉴权协议，也可以通过其他类型的协议对CPE或其下挂的终端设备进行网络接入，下面的实施例中以EAP为例介绍CPE或其下挂的终端设备的网络接入鉴权过程，但不应将其理解为只有EAP这一种协议才能执行CPE或其下挂的终端设备的网络接入鉴权。
为支持鉴权协议在移动网络侧通过NAS协议承载，本申请实施例中，有三种利用NAS消息携带鉴权协议相关消息的方法，具体可参参阅前述实施例中的三种类型的NAS消息进行理解。
EAP鉴权协议相关的消息在移动核心网内，以及移动核心网和具有鉴权认证功能的网络设备间的传输过程可以包括：
移动核心网内的节点，如4G网络中的MME或移动网关，又如5G网络中的AMF或SMF，作为具有EAP代理功能的节点(可简称为EAP设备端，即EAP authenticator)，可支持RADIUS/Diameter协议以及EAP协议，与终端之间交互EAP消息，并与具有鉴权认证功能的网络设备例如AAA server之间传递认证相关报文；或者，所述移动核心网内的某节点，作为中继的角色，可支持RADIUS/Diameter协议，将EAP消息在终端和EAP设备端之间传输，EAP设备端与具有鉴权认证功能的网络设备之间通过RADIUS/Diameter协议传送认证相关报文。
在4G网络中和5G网络中，各设备的协议栈中的协议层会有不同。示例性的，图9B给出 了4G/5G网络中，MME/AMF作为EAP设备端的鉴权过程所涉及设备的协议栈。图9C给出了4G网络中移动网关作为EAP设备端的鉴权过程所涉及设备的协议栈的一种可能的示例。图9D给出了5G网络中SMF作为EAP设备端的鉴权过程所涉及设备的协议栈的一种可能的示例。图9E给出了BNG作为EAP设备端与4G/5G网络对接的鉴权过程所涉及设备的协议栈的一种可能的示例。
图9B的各设备的协议栈所包含的协议层情况包括：终端的协议栈包括4G/5G无线接入层的多个协议层、NAS协议层，可选地，还包括EAP协议层；4G网络中RAN设备的协议栈包括无线接入层的多个协议层(例如PDCP、RLC、MAC、PHY等)和S1控制面接口的多个协议层；5G网络中RAN设备的协议栈包括无线接入层的多个协议层(例如SDAP、PDCP、RLC、MAC、PHY等)和N2接口的多个协议层；4G网络中MME的协议栈包括S1控制面接口的多个协议层、NAS协议层、S11接口的多个协议层和Diameter/RADIUS协议层，可选地，还包括EAP协议层；5G网络中AMF的协议栈包括N2接口的多个协议层、NAS协议层、N11接口的多个协议层和Diameter/RADIUS协议层，可选地，还包括EAP协议层；4G网络中SGW的协议栈包括S11接口的多个协议层和S5/S8接口的多个协议层；5G网络中SMF的协议栈包括N11接口的多个协议层和N4接口的多个协议层；4G网络中PGW的协议栈包括S5/S8接口的多个协议层和SGi接口的低层(例如层1到层4)协议层；5G网络中UPF的协议栈包括N4接口的多个协议层和N6接口的低层协议层；AAA server协议栈包括Diameter/RADIUS协议层，可选地，还包括EAP协议层；与4G网络对接时，AAA server协议栈还包括SGi接口的低层协议层；与5G网络对接时，AAA server协议栈还包括N6接口的低层协议层。
图9C的各设备的协议栈所包含的协议情况包括：终端的协议栈包括无线接入层的多个协议层、NAS协议层，可选地，还包括EAP协议层；RAN设备的协议栈包括无线接入层的多个协议层和S1控制面接口的多个协议层；MME的协议栈包括S1控制面接口的多个协议层、S11接口的多个协议层和NAS协议层；SGW的协议栈包括S11接口的多个协议层和S5/S8接口的多个协议层；PGW的协议栈包括S5/S8接口的多个协议层、SGi接口的低层协议层和Diameter/RADIUS协议层，可选地，还包括EAP协议层；AAA server协议栈包括SGi接口的低层协议层、Diameter/RADIUS协议，可选地，还包括EAP协议层。
图9D的各设备的协议栈所包含的协议情况包括：终端的协议栈包括无线接入层的多个协议层、NAS协议层，可选地，还包括EAP协议层；RAN设备的协议栈包括无线接入层的多个协议层和N2接口的多个协议层；AMF的协议栈包括N2接口的多个协议层、N11接口的多个协议层；SMF的协议栈包括N11接口的多个协议层、N4接口的多个协议层、Diameter/RADIUS协议层，可选地，还包括EAP协议层；UPF的协议栈包括N4接口的多个协议层和N6接口的低层协议层；AAA server协议栈包括N6接口的低层协议层、Diameter/RADIUS协议层，可选地，还包括EAP协议层。
图9E的各设备的协议栈所包含的协议情况包括：终端的协议栈包括4G/5G无线接入层的多个协议层、NAS协议层，可选地，还包括EAP协议层；4G网络中RAN设备的协议栈包括无线接入层的多个协议层(例如PDCP、RLC、MAC、PHY等)和S1控制面接口的多个协议层；5G网络中RAN设备的协议栈包括无线接入层的多个协议层(例如SDAP、PDCP、RLC、MAC、PHY 等)和N2接口的多个协议层；4G网络中MME的协议栈包括S1控制面接口的多个协议层、NAS协议层、S11接口的多个协议层；5G网络中AMF的协议栈包括N2接口的多个协议层、NAS协议层、N11接口的多个协议层；4G网络中SGW的协议栈包括S11接口的多个协议层、S5/S8接口的多个协议层；5G网络中SMF的协议栈包括N11接口的多个协议层、N4接口的多个协议层和Diameter/RADIUS协议层；4G网络中PGW的协议栈包括S5/S8接口的多个协议层、SGi接口的低层协议层和Diameter/RADIUS协议层；5G网络中UPF的协议栈包括N4接口的多个协议层和N6接口的低层协议层；BNG的协议栈包括SGi/N6接口低层协议、DN网络低层协议层、Diameter/RADIUS协议层，可选地，还包括EAP协议层；AAA server协议栈包括DN网络低层协议层、Diameter/RADIUS协议层，可选地，还包括EAP协议层。
以上图9B至图9E中，每幅图中所涉及的设备的协议栈不同，一方面与4G或者5G网络有关，一方面与哪个设备作为EAP设备端有关。
图9B至图9E的认证过程可以包括：
例如，参考图9B，在4G网络中，终端通过NAS消息携带EAP消息，MME作为EAP设备端。MME会对终端发来的上行NAS消息进行解封装，然后采用EAP中继方式，将EAP消息封装在RADIUS协议消息或者Diameter协议消息中，发送给具有鉴权认证功能的网络设备；或者，MME采用EAP终结方式，将EAP消息中的鉴权相关信息提取出来，直接写在RADIUS协议消息或者Diameter协议消息中，发送给具有鉴权认证功能的网络设备。需要说明的是，EAP消息在MME和具有鉴权认证功能的网络设备之间传输时，可能需要经过如移动网关、BNG和其他路由节点中的部分节点的转发。反向的下行的EAP消息也采用类似的方式在各段之间传输。
又如，在4G网络中，参考图9C，终端通过NAS消息携带EAP消息，移动网关作为EAP设备端。则这种情况下，移动网内：MME会与移动网关之间建立GTP隧道，可承载各类EAP消息，所述GTP隧道可以是用户平面的GTP-U隧道，也可以是控制平面的GTP-C隧道。MME对从终端发来的上行NAS消息进行解封装，然后将EAP消息发给移动网关；类似地，移动网关也会将下行EAP消息发给MME。值得注意的是，为了MME和移动网关之间接口上的GTP隧道支持EAP鉴权消息的传输，可以在MME和移动网关之间建立一条新隧道，确定隧道的类型为用于发送EAP鉴权消息；也可以沿用已经建好的隧道，在数据包隧道的头部(例如GTP/UDP/IP报文头)加上特殊标识，表明隧道内传输的内容为EAP鉴权消息。移动网关和具有鉴权认证功能的网络设备间：采用EAP中继的方式，EAP消息可直接被封装在RADIUS协议消息或者Diameter协议消息中，在移动网关与具有鉴权认证功能的网络设备之间传输；或者，采用EAP终结方式，移动网关可以将EAP消息中的鉴权相关信息提取出来，直接写在RADIUS协议消息或者Diameter协议消息中传输。反向的下行的EAP消息也采用类似的方式在各段之间传输。
又如，在5G网络中，参考图9D，终端通过NAS消息携带EAP消息，AMF会对对终端发来的上行NAS消息进行解封装后，将其中的EAP消息相关内容发送至SMF。SMF作为EAP设备端，采用EAP中继的方式，将EAP消息封装在RADIUS协议消息或者Diameter协议消息中，发送给DN中具有鉴权认证功能的网络设备；或者，SMF采用EAP终结方式，将EAP消息中的鉴权相关信息提取出来，直接写在RADIUS协议消息或者Diameter协议消息中，发送给具有鉴权认证功能的网络设备。需要说明的是，EAP消息在SMF和DN中具有鉴权认证功能的网络设备之间 传输时，可能需要经过如UPF、BNG和其他路由节点中的部分节点的转发。反向的下行的EAP消息也采用类似的方式在各段之间传输。
又如，在5G网络中，参考图9D，终端通过NAS消息携带EAP消息，AMF作为EAP设备端。AMF会对从终端发来的上行NAS消息进行解封装后，采用EAP中继的方式，将EAP消息封装在RADIUS协议消息或者Diameter协议消息中，发送给DN中具有鉴权认证功能的网络设备；或者，AMF采用EAP终结方式，将EAP消息中的鉴权相关信息提取出来，直接写在RADIUS协议消息或者Diameter协议消息中，发送给具有鉴权认证功能的网络设备。需要说明的是，EAP消息在AMF和DN中具有鉴权认证功能的网络设备之间传输时，可能需要经过如SMF、UPF、BNG和其他路由节点中的部分节点的转发。反向的下行的EAP消息也采用类似的方式在各段之间传输。
再如，在4G或5G网络中，参考图9E，终端通过NAS消息携带EAP消息，移动网络之外的网络设备例如BNG做为EAP设备端。核心网节点MME/AMF对NAS消息解封装后，将其中的EAP消息相关内容发送至移动网关/SMF，移动网关/SMF通过RADIUS/Diameter协议与EAP设备端(例如BNG)通信，将收到的EAP消息相关内容封装在RADIUS协议消息或者Diameter协议消息中，发送给EAP设备端(例如BNG)，再由EAP设备端采用EAP中继方式或EAP终结方式，向具有鉴权认证功能的网络设备发送EAP鉴权消息。需要说明的是，移动网关/SMF向EAP设备端例如BNG发送消息，可能需要经过UPF和/或其他路由节点转发。反向的下行EAP消息也采用类似的方式在各段之间传输。
结合图9A-图9E，上述段落中对EAP鉴权消息在各段之间的传输方式的描述，适用于多种终端利用EAP鉴权方式进行鉴权。不限于上述所描述的CPE鉴权的场景，例如，所述终端可以是WTTx的典型终端例如CPE，可以是典型的移动终端例如手机，可以是通过移动终端接入网络的终端例如各类可穿戴设备，也可以是通过CPE接入网络的各类终端例如STB、PC机等。可选的，终端与移动核心网设备(如MME/AMF)之间通过NAS消息传输的EAP鉴权消息，可以是用于对该终端鉴权的相关消息，也可以是用于对该终端下挂的其他终端设备鉴权的相关消息。
下面结合图9A-图9E(以图9E为主)所示的鉴权协议框架示意图，和图10所示的网络接入流程图，介绍本申请实施例中的部分二中的方案1：
如图10所示，本申请实施例提供的设备接入网络的方法的另一实施例包括：
701、CPE通过RAN设备向MME发送包含鉴权请求和/或鉴权类型指示信息的NAS消息。
所述鉴权请求是CPE或其下挂的终端设备在进行网络接入时，向网络发送的接入请求或连接请求或鉴权请求或地址分配请求或其他类型的表明接入网络意图的信息，为简化表述，统称为鉴权请求。所述鉴权类型指示信息可以包括鉴权方式的标识指示和/或鉴权协议标识指示。
702、MME根据NAS消息中的鉴权鉴权类型指示信息识别所需的鉴权方式(如EAP)。
MME与合适的移动网关建立传输携带鉴权相关消息(例如EAP消息)的通道，例如建立GTP-U/C隧道。可选地，根据鉴权需求，移动网关与外部网络中的网络设备(如图9E中的EAP设备端BNG)建立连接。如果所述通道和/或连接已预先存在，则此步骤可略过。
703、MME通过移动网关向外部网络中的网络设备(如宽带网关BNG)发送消息，例如连接请求消息。
其中可包含CPE或其下挂的终端设备的鉴权请求或鉴权请求消息中的关键参数。可选地，该连接请求消息中包含CPE和/或下挂终端的标识，该标识可以由移动核心网节点例如MME分配，也可以由CPE和/或下挂终端生成，还可以是CPE和/或下挂的终端设备中预置的标识。
704、触发鉴权认证。
有以下三种可能的方式：
方式一，具有EAP代理能力的移动核心网节点，例如MME，作为EAP设备端，生成触发鉴权的消息(如EAP-request/Identity消息)，将其携带在NAS消息中发送给CPE或其下挂的终端设备，触发鉴权认证过程；或者，移动网关如PGW，作为EAP设备端，在接收到连接请求后，可以发送触发鉴权的消息(如EAP-request/Identity消息)，经由MME携带在NAS消息中发送给CPE或其下挂的终端设备，触发鉴权认证过程。
方式二，如图10所示，若EAP设备端不在移动网内，也可以由移动核心网节点发送消息(例如“设备连接建立请求消息”)至外部网络中的EAP设备端(如BNG)，用于通知EAP设备端(如BNG)触发对CPE或其下挂的终端设备的鉴权认证过程，EAP设备端(如BNG)收到此消息后，向CPE或其下挂的终端设备发送触发鉴权的消息(如EAP-request/Identity消息)，触发鉴权认证过程。
方式三，此外，还可以由CPE或其下挂的终端设备以EAP-start消息作为鉴权请求，携带在NAS消息中发送。EAP设备端(如管理功能实体或网关设备或者BNG等)，在收到此EAP-start消息后被触发EAP鉴权认证过程，向CPE或其下挂的终端设备发送消息(如EAP-request/Identity消息)，进行鉴权认证过程。
705、CPE通过RAN设备向MME发送包含EAP认证响应的NAS消息。
所述EAP认证响应，如EAP-Response/Identity消息，由CPE或其下挂的终端设备生成。可选地，其中可添加网络接入标识(Network Access Identifier，英文简称为：NAI)，CPE或其下挂的终端设备的标识等信息。EAP认证响应消息将经由移动核心网节点传递至EAP设备端(如BNG)。
706、EAP设备端(如BNG)向认证服务器发送接入认证请求。
例如，BNG向AAA server发送接入认证请求，例如RADIUS Access-request消息，其中可携带EAP-Response/Identity消息。可选地，BNG可以EAP中继模式在EAPoR报文中封装EAP-Response/Identity消息，或以EAP终结模式在标准RADIUS报文中封装EAP-Response/Identity消息中包含的认证相关信息。
707、对CPE或其下挂的终端设备进行认证。
根据接入认证请求中包含的信息(如用户/设备/终端相关)，认证服务器选择或确认适用的鉴权协议，例如可与保存有用户信息的设备如HSS交互查找用户匹配信息后确认所采用EAP鉴权协议，所述EAP鉴权协议可包含但不限于IETF的RFC中定义的EAP-AKA，EAP-AKA’,EAP-SIM，EAP-TLS，EAP-MD5，EAP-TTLS，EAP-OTP等。然后在认证服务器与EAP设备端之 前、EAP设备端与CPE或其下挂的终端设备之间，交互认证相关的报文，完成认证过程。鉴权过程中涉及的消息在各段的承载方式同前面步骤中所述。本实施例中将以EAP-AKA方式为例简要介绍对CPE的认证过程。值得注意的是，对CPE下挂终端的认证过程也可以参考此步骤707中对认证过程的描述进行理解，区别在于CPE需将收到的NAS消息中包含的鉴权相关消息发送至下挂终端，且需要将包含下挂终端生成的鉴权相关消息的上行NAS消息发送至MME。
若采用EAP-AKA协议，认证服务器AAA server对CPE的认证过程如下：
AAA server回应EAP设备端一个认证请求报文，向CPE发起Challenge，里面含有EAP-Request/AKA-identity报文；
EAP设备端(如BNG)将EAP-request/AKA-identity报文转发至移动核心网节点如移动网关，再经由MME携带在NAS消息中发给CPE；
CPE收到后，回复EAP-response/AKA-identity响应消息，经由移动核心网节点(如MME和/或移动网关)发送至EAP设备端(如BNG)；
EAP设备端(如BNG)将EAP-response/AKA-identity响应报文封装在RADIUS Access-request请求报文中传给AAA server；
AAA server根据EAP-response/AKA-identity消息中包含的CPE设备ID，例如IMSI，向HSS请求设备对应的鉴权向量；HSS产生相应的鉴权向量{RAND,XRES，CK,IK,AUTN}后，发给AAA server；
AAA server将CPE所需的鉴权参数通过EAP-Request/AKA-challenge消息，经由EAP设备端如BNG和移动核心网节点(如MME和/或移动网关)发送给CPE；
CPE运行AKA算法验证其中的鉴权参数，以验证网络的合法性，并计算新的鉴权参数，包含RES和MAC(Message Authentication Code)值，反馈EAP-response/AKA-Challenge响应消息至EAP设备端(如BNG)，再由EAP设备端(如BNG)发送至AAA server；
AAA server验证收到的新MAC，并比较XRES与RES是否一致；
AAA server验证通过后，发送EAP-request/AKA-Notification消息，经由EAP设备端(如BNG)及移动核心网节点(如移动网关和/或MME)发送给CPE；
CPE发送EAP-response/AKA-Notification消息，经由移动核心网节点(如MME和/或移动网关)和EAP设备端如BNG回应至AAA server；
AAA server保存接入会话相关的信息，向HSS发送subscriber Profile retrieval(可选)，产生EAP-success消息，经由EAP设备端(如BNG)和移动核心网节点(如MME和/或移动网关)通知CPE。
708、EAP认证鉴权通过后，EAP设备端(如BNG)保存CPE的认证和授权信息。若认证不通过，则EAP设备端(如BNG)将经由移动核心网节点(如移动网关和/或MME)以及RAN设备通知CPE或其下挂的终端设备认证失败，流程结束。
709、EAP设备端(如BNG)向移动核心网节点(如MME和/或移动网关)发送认证授权信息通知。
710、移动核心网节点(如MME和/或移动网关)保存CPE或其下挂的终端设备的认证和授权信息。可能的实现方式有以下几种：
若移动核心网节点(如MME和/或移动网关)具有EAP代理能力，则可作为EAP设备端，在收到EAP-success信息时，保存其中的认证和授权信息。
或者，参考步骤709，可由BNG通过RADIUS/Diameter协议消息发送“认证授权信息”通知至移动核心网节点(如MME和/或移动网关)后保存。
可选地，可以继续为后续通信建立CPE至移动网关的EPS承载(包括RAN设备至CPE的空口承载、S1承载、S5/S8承载)，具体的建立过程可以参考现有技术。
711、为CPE或其下挂的终端设备分配IP地址。
CPE或其下挂的终端设备可发起分配IP地址的请求，携带在NAS消息中传输至MME，再由MME发送至移动网关。可选地，若在步骤701中的鉴权请求中已包含地址分配请求，则CPE或其下挂的终端设备无需再次发送地址请求。
移动网关可以为CPE或其下挂的终端设备分配IP地址，或者移动网关可以向网络设备例如BNG发起DHCP地址分配请求。BNG可以为CPE或其下挂的终端设备分配IP地址，或者向DHCP server请求分配IP地址，然后BNG将分配的IP地址返回给移动网关。网络设备返回的报文(如DHCP offer和/或DHCP Ack)中，可以携带用于CPE路由配置的参考信息(例如在扩展字段option 121中携带路由配置参考信息)。
移动网关可将地址分配的结果经由MME返回至发起请求的CPE或其下挂的终端设备。若网络设备返回的报文中包含用于CPE路由配置的参考信息，则移动网关可根据所述参考消息生成路由配置信息，并包含在移动网关经由MME发送给CPE的通知消息中。所述用于CPE路由配置的参考信息和所述路由配置信息可参考步骤109和步骤110中的描述进行理解。
712、BNG记录CPE或其下挂的终端设备的上线状态。
713、BNG可以通过handshake request(EAP-request/identity)握手消息定期查询CPE或其下挂的终端设备的在线状态，在线CPE或其下挂的终端设备可通过handshake response(EAP-response/identity)予以响应。
以上图10中所描述的是CPE或其下挂的终端设备通过4G移动网络完成网络接入过程。下面结合图9A至图9E(以图9E为主)以及图11，描述部分二中的方案2，即：CPE或其下挂的终端设备通过5G移动网络完成网络接入过程。
如图11所示，本申请实施例提供的设备接入网络的另一实施例包括：
801、CPE通过RAN设备向AMF发送包含鉴权请求和/或鉴权鉴权类型指示信息的NAS消息。
所述鉴权请求是CPE或其下挂的终端设备在进行网络接入时，向网络发送的接入请求或连接请求或鉴权请求或地址分配请求或其他类型的表明接入网络意图的信息，为简化表述，统称为鉴权请求。所述鉴权类型指示信息可以包括鉴权方式的标识指示和/或鉴权协议标识指示。
802、AMF根据NAS消息中的鉴权类型指示信息识别所需的鉴权方式(如EAP)。
AMF选择合适的SMF，与SMF之间建立承载EAP消息的通道，可选地，根据鉴权需求，SMF选择合适的UPF，通过UPF与外部网络中的网络设备(如图9E中的EAP设备端BNG)建立连接。如果所述通道/连接已预先建好，则此步骤可省略。
803、AMF向SMF发送消息(例如请求/应答/传输消息)，其中可包含CPE或其下挂的终端设备的鉴权请求或鉴权请求消息中的关键参数。
进而，SMF经由UPF向DN中的网络设备例如BNG发送消息。所述消息(可以是例如“连接请求消息”)中可包含CPE或其下挂的终端设备的鉴权请求或鉴权请求消息中的关键参数。可选地，所述消息中包含CPE或其下挂的终端设备的标识，该标识可以由移动核心网节点例如AMF或SMF分配，也可以由CPE或其下挂的终端设备生成，还可以是CPE或其下挂的终端设备中预置的标识。
804、触发鉴权认证，有以下三种可能的方式：
方式一，具有EAP代理能力的移动核心网节点，例如AMF，作为EAP设备端，生成触发鉴权的消息(如EAP-request/Identity消息)，将其携带在NAS消息中发送给CPE或其下挂的终端设备，触发鉴权认证过程；或者，SMF作为EAP设备端，在接收到连接请求后，可以发送包含触发鉴权的消息(如EAP-request/Identity消息)给AMF，AMF将触发鉴权的消息(如EAP-request/Identity消息)携带在NAS消息中发送给CPE，触发鉴权认证过程。
方式二，如图11所示，若移动EAP设备端不在移动网内，也可以由移动核心网节点例如SMF经由UPF发送消息(例如“设备连接建立请求”消息)至外部网络中的EAP设备端如BNG，用于通知BNG触发对CPE或其下挂的终端设备的鉴权认证过程，BNG收到此消息后，向CPE或其下挂的终端设备发送触发鉴权的消息(如EAP-request/Identity消息)，触发鉴权认证过程。
方式三，此外，还可由CPE或其下挂的终端设备以EAP-start消息作为鉴权请求，携带在NAS消息中发送。EAP设备端(如移动核心网节点AMF或SMF或UPF，或外部网络设备如BNG)，在收到此EAP-start消息后被触发EAP鉴权认证过程，向CPE发送消息(例如EAP-request/Identity消息)，进行鉴权认证过程。
805、CPE通过RAN设备发送包含EAP认证响应的NAS消息。
所述EAP认证响应，如EAP-Response/Identity消息，其中可添加网络接入标识信息NAI，CPE或其下挂的终端设备的标识等信息，EAP认证响应消息经由移动核心网节点(如AMF和/或SMF和/或UPF)传递至EAP设备端(如BNG)。
若EAP认证响应需经由SMF和UPF传输，SMF和UPF之间需要建立连接。
806、EAP设备端(如BNG)向认证服务器发送接入认证请求。
例如，BNG向AAA server发送接入认证请求，如RADIUS Access-request消息，其中可携带EAP-Response/Identity消息。可选地，BNG可以EAP中继模式在EAPoR报文中封装EAP-Response/Identity消息，或以EAP终结模式在标准RADIUS报文中封装EAP-Response/Identity消息中包含的认证相关信息。
需说明的是，EAP设备端(如AMF或SMF或BNG)向AAA server发送接入认证请求的过程中，可能需要经过如SMF、UPF、BNG和其他路由节点中的部分节点的转发。
807、对CPE或其下挂的终端设备进行认证。
认证过程可以参阅上述步骤707中的过程，其中涉及的移动核心网节点，移动网关的角色由SMF和UPF来代替，MME的角色由AMF来代替。
808、EAP认证鉴权通过后，EAP设备端(如BNG)保存CPE的认证和授权信息。若认证不通过，则EAP设备端(如BNG)将经由移动核心网节点(如UPF和/或SMF和/或AMF)以及RAN设备通知CPE或其下挂的终端设备认证失败，流程结束。
809、EAP设备端(如BNG)向移动核心网节点(如UPF和/或SMF和/或AMF)发送认证授权信息通知。
810、移动核心网节点(如UPF和/或SMF和/或AMF)保存CPE或其下挂的终端设备的认证和授权信息。
实现方式有以下几种：
若移动核心网节点(如UPF和/或SMF和/或AMF)具有EAP代理能力，则可作为EAP设备端，在收到EAP-success信息时，保存其中的认证和授权信息。
或者，参考步骤809，可由BNG通过RADIUS/Diameter协议消息发送“认证授权信息“通知至移动核心网节点(如UPF和/或SMF和/或AMF)后保存。
可选地，可以继续建立CPE至UPF之间的PDU session(包括RAN设备至CPE的空口承载、N3 tunnel)、N4 session等，具体的建立过程可以参考现有技术，例如：3GPP TS23.502 V0.4.0中的相应部分进行理解。
811、为CPE或其下挂的终端设备分配IP地址。
CPE或其下挂的终端设备可发起分配IP地址的请求，携带在NAS消息中传输至AMF，再由AMF发送至SMF。可选地，若在步骤701中的鉴权请求中已包含地址分配请求，则CPE或其下挂的终端设备无需再次发送地址请求。
SMF可以为CPE或其下挂的终端设备分配IP地址，或者SMF可以经由UPF向网络设备例如BNG发起DHCP地址分配请求。BNG可以为CPE或其下挂的终端设备分配IP地址，或者向DHCP server请求分配IP地址，然后将分配的IP地址经由UPF返回给SMF。网络设备返回的报文(如DHCP offer和/或DHCP Ack)中，可以携带用于CPE路由配置的参考信息(例如在扩展字段option 121中携带路由配置参考信息)。
SMF将地址分配的结果经由AMF返回至发起请求的CPE或其下挂的终端设备。若网络设备返回的报文中包含用于CPE路由配置的参考信息，则SMF可根据所述参考消息生成路由配置信息，并包含在SMF经由AMF发送给CPE的通知消息中。所述用于CPE路由配置的参考信息和所述路由配置信息可参考步骤109和步骤110中的描述进行理解。
812、BNG记录CPE或其下挂的终端设备的上线状态。
813、BNG可以通过handshake request(EAP-request/identity)握手消息定期查询CPE或其下挂的终端设备的在线状态，在线CPE或其下挂的终端设备可通过handshake response(EAP-response/identity)予以响应。
以上图11中所描述的是CPE或其下挂的终端设备通过5G移动网络完成网络接入过程。
以上所描述的网络接入方式通过鉴权类型指示信息来指示鉴权方式或者认证协议类型信息来指示认证方式，可选的，还可以在CPE和网关设备之间建立特定通道用于发送鉴权相关的消息，该通道可以是承载或传输隧道，也可以是APN/DNN或PDN连接或PDU session或网络切片等，只要能实现通道与鉴权方式对应即可，具体通道的形式本申请实施例中不 做限定。通道建立时，CPE与网关设备协商通道中的数据采用的鉴权方式或者鉴权协议。这样，在传输终端设备的鉴权请求时就不需要传输鉴权类型指示信息，或者在传输CPE的认证请求时就不需要传输认证协议类型信息，只需要在根据相应的鉴权方式在相应的承载上传输鉴权请求或者认证请求即可。鉴权结果也可以通过该通道返回，也可以通过其他系统定义的信息来返回该鉴权结果。除此之外，使用特定通道的方式的其他鉴权步骤都可以参阅上述实施例中的相应过程进行理解，本申请实施例中不再重复赘述。
以上是设备经由移动网络接入网络的过程，下面介绍本申请实施例中融合网络架构下的设备接入网络的过程。
下面结合图12介绍本申请实施例中5G场景下的融合网络的架构。
如图12所示，本申请实施例提供的5G场景下的融合网络包括：
各类支持NAS协议的终端设备，所述终端设备的协议栈中在NAS层下可以包括以太协议层、局域网(包括LAN、WLAN等)协议层、个域网(PAN，如Bluetooth，Zigbee等)、其他设备间互联技术(D2D、微波、红外等)的低层协议。例如图12中，STB为传统的固定终端(或称为固网终端或有线网络终端)，该传统固定终端通过例如N1c接口与AMF间传输NAS消息；本申请实施例中不限定各设备之间的接口名称，只要能用于各终端设备与AMF之间的NAS消息传输即可。NG-STB为5G固定终端，该5G固定终端通过N1b接口与AMF间传输NAS消息；NG-UE为5G网络中的移动终端，该5G移动终端通过5G网络中的N1接口与AMF间传输NAS消息；NG-RG为5G网络中的家庭网关，NG-RG中可以有无线终端模块(即WTTx CPE，通过无线接入网RAN接入网络)，还可以有固定终端模块(即Fixed CPE，通过有线接入网fixed AN接入网络)；NG-RG可以通过无线连接方式(例如3GPP中的终端直连D2D，或WiFi/Bluetooth/Zigbee/微波/红外等连接方式)或有线连接方式(例如以太网)，与家庭中的其他终端设备(如STB、NG-UE、NG-STB等)组成WLAN/LAN/PAN(WLAN为无线局域网，LAN为局域网，PAN为个域网)，为这些终端设备提供网络接入服务；NG-NAS为CPE中的NAS消息处理模块，通过N1a接口与AMF间传输NAS消息，RAN中的WTTx RAN模块通过接口N2b与AMF间传输控制面消息，Fixed AN模块通过接口N2a与AMF间传输控制键消息。
图12所示的是一种融合网络中的CPE和该CPE下挂的终端设备的鉴权方案，CPE和其下挂的终端设备，都通过NAS消息承载各类可能鉴权协议对应的鉴权消息，到网络中进行鉴权认证过程。所述的各类可能鉴权技术，包括但不限于无线网络中常用的EPS-AKA或EPS-AKA’机制，或者无线局域网中常用的EAP系列的EAP-TLS、EAP-SIM、EAP-AKA、EAP-AKA’等，或者固网常用的PPP、PPPoX、IPoX等接入方式对应的鉴权机制。
为支持多样化的鉴权协议在移动网络侧通过NAS协议承载，本申请中，有三种利用NAS消息携带鉴权相关消息的方法，关于NAS消息的三种类型可以参阅前述部分的描述进行理解，本处不再重复赘述。
下面结合图13介绍本申请实施例中的部分三，即：在5G场景的融合网络架构下，CPE下挂的终端设备的一种网络接入的方案。其中(R)AN表示，接入网可能是无线接入网或固定(有线)接入网，即(R)AN设备表示无线接入网设备例如基站，或固定(有线)接入网 设备例如DSLAM。
如图13所示，本申请实施例提供的设备接入网络的另一实施例包括：
901、终端设备发送鉴权请求。
该终端设备可以理解为是CPE下挂的终端设备，下挂的终端设备即连接到该CPE的终端设备，该终端设备通过该CPE接入网络。
所述鉴权请求可以包含在NAS消息中，可选地，该NAS消息中还可携带鉴权类型指示信息。所述鉴权请求是终端设备在进行网络接入时，向网络发送的接入请求或连接请求或鉴权请求或地址分配请求或其他类型的表明接入网络意图的信息，为简化表述，统称为鉴权请求。所述鉴权类型指示信息可以包括鉴权方式的标识指示和/或鉴权协议标识指示。
902、CPE作为中继角色，转发包含其下挂终端NAS消息至(R)AN设备，(R)AN设备收到后，将CPE下挂的终端设备的NAS消息发送至AMF。
可选地，若CPE下挂的终端设备发送的鉴权请求并未包含在NAS消息中，则CPE可以生成上行NAS消息经(R)AN设备发送给AMF，其中携带下挂的终端设备鉴权请求或鉴权请求消息中的关键参数，和/或鉴权类型指示信息。
903、AMF解析收到的NAS消息。
提取鉴权请求相关的信息，确认所需的鉴权方式或鉴权协议。
904、AMF向具有认证功能的节点例如AUSF发送鉴权请求。
905、对终端设备鉴权。
AUSF可支持各类不同的鉴权协议，根据AMF的发送的鉴权请求消息与完成对终端设备的鉴权认证后，返回鉴权结果至AMF。
906、若鉴权通过，AMF向SMF发送消息。
所述消息(例如请求/应答/传输消息)可用于请求建立PDU session，其中还可以包含终端设备的地址请求。
907、SMF根据终端设备的需求，选择合适的UPF，建立PDU session并为终端设备分配IP地址。
可选地，SMF可以为终端设备分配IP地址，或者SMF可以经由UPF向外部网络设备(DN node)例如BNG发起DHCP地址分配请求。BNG可以为终端设备分配IP地址，或者向DHCP server请求分配IP地址，然后将分配的IP地址携带在返回报文(例如DHCP offer和/或DHCP Ack等)经由UPF返回给SMF。网络设备返回的报文(如DHCP offer和/或DHCP Ack)中，可以携带用于CPE路由配置的参考信息(例如在扩展字段option 121中携带路由配置参考信息)。所述用于CPE路由配置的参考信息内容可参考步骤109中的相应描述进行理解。
908、SMF接收具有地址分配功能的外部网络设备返回的消息，其中可以包含分配给终端设备的IP地址，和/或用于CPE路由配置参考信息。
若外部网络设备返回的DHCP报文中包含用于CPE路由配置的参考信息，则SMF可根据所述参考消息生成路由配置信息，并包含在SMF经由AMF发送给CPE的通知消息中。所述用于CPE路由配置的参考信息和所述路由配置信息内容可参考步骤109和步骤110中的描述进行理解。
909、SMF向AMF发送消息。
所述消息可以是请求/应答/传输消息，例如“会话建立响应消息”，所述消息中包含SMF发给CPE下挂的终端设备的通知消息，所述通知消息可包含为CPE下挂的终端设备分配的IP地址，和/或路由配置信息。或者，所述消息中可包含SMF发送给CPE的通知消息，所述通知消息中可包含路由配置信息。
910、AMF将鉴权结果和/或IP地址分配结果和/或路由配置信息，生成鉴权返回消息，可以封装在发送给CPE下挂的终端设备的NAS消息中。此外，若AMF收到SMF发送给CPE的通知消息，则AMF也可以将该通知消息携带在发送给CPE的NAS消息中。
911-913，AMF至(R)AN设备，(R)AN设备至CPE，CPE至下挂的终端设备逐级传输鉴权返回消息。
在步骤912中，CPE接收到(R)AN设备转发的NAS消息，若所述NAS消息中包含的是发送给CPE下挂的终端设备的鉴权返回消息，其中包含有路由配置信息，则CPE可以读取其中(例如CPE配置NAS snooping功能)的路由配置信息，进行路由配置。或者，AMF在发送给CPE的NAS消息中包含路由配置信息，CPE收到相应NAS消息后进行路由配置。
鉴权结束后，后续与协议相关的网络接入相应步骤可以参阅前述实施例中的过程进行理解，本处不再重复赘述。
从该图13对应的实施例的内容可知，本申请实施例中在5G场景融合网络架构下，可以实现终端设备的网络接入过程，从而避免了铺设专用的网络通道，提高了移动网络的利用率。
以上是针对CPE下挂的终端设备的鉴权过程，该场景下的CPE的鉴权过程实际上与图13所对应的过程基本相同，只是在下挂的终端设备鉴权时，CPE充当中继的角色，当CPE鉴权时，鉴权请求直接由CPE携带在CPE的NAS消息发出。
如图14所示，本申请实施例提供的设备接入网络的另一实施例包括：
1001、CPE经由(R)AN设备，向AMF发送鉴权请求。
该鉴权请求可以包含在NAS消息中，可选地，该NAS消息中还可携带鉴权类型指示信息。
所述鉴权请求是CPE在进行网络接入时，向网络发送的接入请求或连接请求或鉴权请求或地址分配请求或其他类型的表明接入网络意图的信息，为简化表述，统称为鉴权请求。所述鉴权类型指示信息可以包括鉴权方式的标识指示和/或鉴权协议标识指示。
1002至1011的过程与上述图13对应的实施例中的步骤903至步骤912相似，可以参考步骤903至912进行理解。需指出的是，本实施例与图13所对应的上一实施例的差异之处在于，本实施例中，鉴权和地址分配是针对CPE的，故步骤903至步骤912中，由核心网设备返回至CPE下挂的终端设备的消息，在本实施例中可以替换为由核心网设备返回至CPE的消息，CPE收到后可读取其中的内容。例如CPE可以从自己收到的NAS消息中获取路由配置信息，无需进行NAS snooping。
从该图14对应的实施例的内容可知，本申请实施例中可以实现CPE在5G场景融合网络架构的网络接入过程，从而避免了铺设专用的网络通道，提高了移动网络的利用率。
下面结合图15，介绍本申请实施例中的部分四，即：在5G场景的融合网络架构下，CPE 下挂的终端设备以及CPE在融合网络中的另一种网络接入的方案。
如图15所示，本申请实施例提供的设备接入网络的方法的另一实施例包括：
1101、终端设备发送鉴权请求。
该终端设备可以理解为是CPE下挂的终端设备，下挂的终端设备即连接到该CPE的终端设备，该终端设备通过该CPE接入网络。
该鉴权请求可以包含在NAS消息中，可选地，该NAS消息中还可携带鉴权类型指示信息。
所述鉴权请求是终端设备在进行网络接入时，向网络发送的接入请求或连接请求或鉴权请求或地址分配请求或其他类型的表明接入网络意图的信息，为简化表述，统称为鉴权请求。所述鉴权类型指示信息可以包括鉴权方式的标识指示和/或鉴权协议标识指示。
1102、CPE作为中继角色，转发包含其下挂终端鉴权请求的NAS消息至(R)AN设备，然后经由(R)AN设备转发至AMF。
可选地，若CPE下挂的终端设备发送的鉴权请求并未包含在NAS消息中，则CPE可以生成上行NAS消息经(R)AN设备发送给AMF，其中携带下挂的终端设备鉴权请求或鉴权请求消息中的关键参数，和/或鉴权类型指示信息。
步骤1103至步骤1116可参考步骤504-步骤517进行理解。
在步骤1116中，CPE接收到(R)AN设备转发的NAS消息，若所述NAS消息中包含的是发送给CPE下挂的终端设备的鉴权返回消息，其中包含有路由配置信息，则CPE可以读取其中(例如CPE配置NAS snooping功能)的路由配置信息，进行路由配置。或者，AMF在发送给CPE的NAS消息中包含路由配置信息，CPE收到相应NAS消息后进行路由配置。
本申请实施例中所称的NAS snooping功能，是指设备对于经过其传输的NAS消息，能够读取NAS消息，获知NAS消息的全部或者部分内容，但不改动NAS消息的内容。
1117、CPE向其下挂的终端设备传输AMF发送至此终端设备的NAS消息。
从该图15对应的实施例的内容可知，本申请实施例中在5G场景融合网络架构下，可以实现终端设备的网络接入过程，从而避免了铺设专用的网络通道，提高了移动网络的利用率。
以上是针对CPE下挂的终端设备的鉴权过程，该场景下的CPE的鉴权过程实际上与图15所对应的过程基本相同，区别点包括：在终端设备鉴权时，CPE充当中继的角色，当CPE鉴权时，鉴权请求直接由CPE携带在CPE的NAS消息发出。
如图16所示，本申请实施例提供的设备接入网络的另一实施例包括：
1201、CPE经由(R)AN设备，向AMF发送鉴权请求。
该鉴权请求可以包含在NAS消息中，可选地，该NAS消息中还可携带鉴权类型指示信息。
所述鉴权请求是CPE在进行网络接入时，向网络发送的接入请求或连接请求或鉴权请求或地址分配请求或其他类型的表明接入网络意图的信息，为简化表述，统称为鉴权请求。所述鉴权类型指示信息可以包括鉴权方式的标识指示和/或鉴权协议标识指示。
1202至1215的过程与上述图15对应的实施例中的步骤1103至步骤1116相似，可以参考步骤1103至步骤1116进行理解。需指出的是，本实施例与图15所对应实施例的差异之处在于，本实施例中，鉴权和地址分配都是针对CPE的，故步骤1103至步骤1116中，由核心网设 备返回至CPE下挂的终端设备的消息，在本实施例中应替换为由核心网设备返回至CPE的消息，CPE收到后可读取其中的内容。例如CPE可以从自己收到的NAS消息中获取路由配置信息，无需进行NAS snooping。本申请实施例中所称的NAS snooping功能，是指设备对于经过其传输的NAS消息，能够读取NAS消息，获知NAS消息的全部或者部分内容，但不改动NAS消息的内容。
从该图16对应的实施例的内容可知，本申请实施例中在移动网络和固定网络融合为融合网络后，可以实现CPE在融合网络的接入过程，从而避免了铺设专用的网络通道，提高了移动网络的利用率。
以上是对本申请实施例中接入网络的方法的描述，下面结合附图介绍接入网络的装置，该装置可以被看作是本申请实施例中各类用于接入网络的装置的抽象概括。
该接入网络的装置可以是CPE、网关设备、管理功能实体或者终端设备。
如图17所示，广义的理解，该接入网络的装置130可以包括如下按功能划分的模块：接收模块1301、处理模块1302和发送模块1303。该接收模块1301可以执行上述图3至图16所示实施例中当该接入网络的装置为相应的CPE、网关设备、管理功能实体或者终端设备时的接收功能。发送模块1303可以执行上述图3至图16所示实施例中当该接入网络的装置为相应的CPE、网关设备、管理功能实体或者终端设备时的发送功能。处理模块1302可以执行上述图3至图16所示实施例中当该接入网络的装置为相应的CPE、网关设备、管理功能实体或者终端设备时的处理功能。
图18是本发明实施例提供的CPE140的结构示意图。所述CPE140包括至少一个处理器1410、存储器1450和收发器1430。该存储器1450可以包括只读存储器和随机存取存储器，并向处理器1410提供操作指令和数据。存储器1450的一部分还可以包括非易失性随机存取存储器(NVRAM)。
在一些实施方式中，存储器1450存储了如下的元素，可执行模块或者数据结构，或者他们的子集，或者他们的扩展集:
在本发明实施例中，通过调用存储器1450存储的操作指令(该操作指令可存储在操作系统中)，执行相应的操作。处理器1410控制CPE140的操作，处理器1410还可以称为CPU(Central Processing Unit，中央处理单元)。存储器1450可以包括只读存储器和随机存取存储器，并向处理器1410提供指令和数据。存储器1450的一部分还可以包括非易失性随机存取存储器(NVRAM)。具体的应用中CPE140的各个组件通过总线系统1420耦合在一起，其中总线系统1420除包括数据总线之外，还可以包括电源总线、控制总线和状态信号总线等。但是为了清楚说明起见，在图中将各种总线都标为总线系统1420。
上述本发明实施例揭示的方法可以应用于处理器1410中，或者由处理器1410实现。处理器1410可能是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法的各步骤可以通过处理器1410中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器1410可以是通用处理器、数字信号处理器(DSP)、专用集成电路(ASIC)、现成可编程门阵列(FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本发明实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微 处理器或者该处理器也可以是任何常规的处理器等。结合本发明实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器1450，处理器1410读取存储器1450中的信息，结合其硬件完成上述方法的步骤。
可选地，收发器1430用于执行图3-图16所示的实施例中的CPE的接收和发送的步骤。
处理器1410用于执行图3-图16所示的实施例中的CPE的处理的步骤。
其他网关设备、管理功能实体和终端设备的结构也可以参阅图18进行理解，其中网关设备、管理功能实体和终端设备中相应收发器和处理器的功能都可以执行图3至图16中各设备相应的接收、发送和处理的步骤。
图19是本发明实施例提供的芯片系统150的结构示意图。芯片系统150包括至少一个处理器1510、存储器1550和接口电路1530，存储器1550可以包括只读存储器和随机存取存储器，并向处理器1510提供操作指令和数据。存储器1550的一部分还可以包括非易失性随机存取存储器(NVRAM)。
在一些实施方式中，存储器1550存储了如下的元素，可执行模块或者数据结构，或者他们的子集，或者他们的扩展集:
在本发明实施例中，通过调用存储器1550存储的操作指令(该操作指令可存储在操作系统中)，执行相应的操作。
一种可能的实现方式为：用户驻地设备、网关设备、管理功能实体或者终端设备所用的芯片系统的结构类似，但不同的装置使用不同的芯片系统以实现各自的功能。
处理器1510控制用户驻地设备、网关设备、管理功能实体或者终端设备的操作，处理器1510还可以称为CPU(Central Processing Unit，中央处理单元)。存储器1550可以包括只读存储器和随机存取存储器，并向处理器1510提供指令和数据。存储器1550的一部分还可以包括非易失性随机存取存储器(NVRAM)。具体的应用中CPE140的各个组件通过总线系统1520耦合在一起，其中总线系统1520除包括数据总线之外，还可以包括电源总线、控制总线和状态信号总线等。但是为了清楚说明起见，在图中将各种总线都标为总线系统1520。
上述本发明实施例揭示的方法可以应用于处理器1510中，或者由处理器1510实现。处理器1510可能是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法的各步骤可以通过处理器1510中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器1510可以是通用处理器、数字信号处理器(DSP)、专用集成电路(ASIC)、现成可编程门阵列(FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本发明实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本发明实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器1550，处理器1510读取存储器1550中的信息，结合其硬件完成上述方法的步骤。
可选地，接口电路1530用于执行图3-图16所示的实施例中的户驻地设备、网关设备、管理功能实体或者终端设备的接收和发送的步骤。
处理器1510用于执行图3-图16所示的实施例中的户驻地设备、网关设备、管理功能实体或者终端设备的处理的步骤。
在上述实施例中，存储器存储的供处理器执行的指令可以以计算机程序产品的形式实现。所述计算机程序产品可以是事先写入在存储器中，也可以是以软件形式下载并安装在存储器中。
所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存储的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘Solid State Disk(SSD))等。
以上对本申请实施例所提供的接入网络的方法、装置、设备、计算机可读存储介质以及系统进行了详细介绍，本文中应用了具体个例对本申请的原理及实施方式进行了阐述，以上实施例的说明只是用于帮助理解本申请的方法及其核心思想；同时，对于本领域的一般技术人员，依据本申请的思想，在具体实施方式及应用范围上均会有改变之处，综上所述，本说明书内容不应理解为对本申请的限制。

Claims (32)

  1. 一种接入网络的方法，其特征在于，包括：
    驻地节点接收来自于终端设备的第一消息，所述第一消息包含鉴权请求；
    所述驻地节点发送第二消息，所述第二消息被网络节点处理为第三消息，所述第三消息被用于网关设备识别所述鉴权请求和/或所述终端设备接入网络的鉴权方式，所述鉴权请求和/或所述终端设备接入网络的鉴权方式被用于网络对所述终端设备进行鉴权；
    所述驻地节点接收来自于所述网络的鉴权结果的信息，并向所述终端设备发送所述鉴权结果的信息。
  2. 根据权利要求1所述的方法，其特征在于，所述鉴权请求和/或所述终端设备接入网络的鉴权方式被用于网络对所述终端设备进行鉴权，包括：
    所述鉴权方式用于指示所述网关设备向网络设备发送所述鉴权请求，所述鉴权请求用于指示所述网络设备对所述终端设备进行鉴权；
    所述驻地节点接收来自于所述网络返回的鉴权结果的信息，包括：
    所述驻地节点接收来自于所述网络设备通过所述网关设备返回的鉴权结果的信息。
  3. 根据权利要求1或2所述的方法，其特征在于，所述第二消息包含所述鉴权请求和指示信息，其中，所述指示信息包含用于指示所述终端设备接入网络的鉴权方式。
  4. 根据权利要求1或2所述的方法，其特征在于，所述第二消息通过与所述鉴权方式对应的鉴权通道传输，所述鉴权通道被用于确定对应的所述鉴权方式。
  5. 根据权利要求3所述的方法，其特征在于，所述方法还包括：
    所述驻地节点根据所述第一消息，从所述终端设备与所述驻地节点之间的数据报文携带的信息中识别所述终端设备接入所述网络的鉴权方式；
    所述驻地节点对所述用于指示所述鉴权方式的所述指示信息和所述鉴权请求进行处理，以得到所述第二消息。
  6. 根据权利要求5所述的方法，其特征在于，所述第二消息中包括指示信息，所述指示信息是所述驻地节点在通信协议中空口接入层之上的协议层或在所述空口接入层的处理过程中添加的；
    所述驻地节点发送第二消息，包括：
    所述驻地节点向无线接入网络RAN设备发送所述第二消息；
    当所述第二消息包含所述指示信息时，所述指示信息和所述鉴权请求被包含于所述第三消息中，并通过所述RAN设备与所述网关设备之间的传输通道传输所述第三消息。
  7. 根据权利要求5所述的方法，其特征在于，所述第二消息为第一非接入层NAS消息，所述第一NAS消息中包含所述鉴权请求和所述指示信息；
    所述驻地节点发送第二消息，包括：
    所述驻地节点向无线接入网络RAN设备发送所述第一NAS消息，并通过所述RAN设备向管理设备发送所述第一NAS消息，所述第一NAS消息中的所述鉴权请求消息和所述指示信息被所述管理设备获得，并由所述管理设备向所述网关设备发送。
  8. 根据权利要求1-7任一所述的方法，其特征在于，所述鉴权结果的信息包括鉴权通 过的信息，对应所述鉴权结果的信息的返回消息中还包括地址分配信息和/或路由配置信息，所述路由配置信息包括所述网络设备分配的路由配置的参考信息，或者，所述网关设备根据所述路由配置的参考信息确定的路由配置的配置信息，所述地址分配信息包括为所述终端设备预分配或分配的网络地址。
  9. 根据权利要求8所述的方法，其特征在于，所述方法还包括：
    所述驻地节点保存所述路由配置信息，所述路由配置信息用于所述驻地节点为所述终端设备的业务确定对应的路由配置。
  10. 根据权利要求7所述的方法，其特征在于，所述第一NAS消息为第一类型NAS消息，所述第一类型NAS消息为用于所述终端设备接入所述网络的消息；或者，
    所述第一NAS消息为第二类型NAS消息，所述第二类型NAS消息中包含信元，所述信元中包含用于所述终端设备接入所述网络的信息；或者，
    所述第一NAS消息为第三类型NAS消息，所述第三类型NAS消息中包含信元，所述信元用于携带所述终端设备接入所述网络的信息，所述信元包括用于接入的信元或者消息容器。
  11. 根据权利要求1-7任一所述的方法，其特征在于，所述第二消息还包括鉴权附加信息，所述鉴权附加信息包括表明所述驻地节点的身份标识、表明所述终端设备位置和/或所述驻地节点位置的信息和用于传输所述鉴权请求的通道信息中的至少一个；
    所述用于传输鉴权请求的通道信息包括如下信息的至少一个：隧道标识，承载标识，以及会话标识。
  12. 一种接入网络的方法，其特征在于，包括：
    网关设备接收鉴权请求，所述鉴权请求为终端设备通过第一消息向驻地节点发送的，所述第一消息被所述驻地节点处理为第二消息，所述第二消息被网络节点处理为第三消息，所述第三消息包含所述鉴权请求和/或所述终端设备接入网络的鉴权方式；
    所述网关设备根据所述第三消息识别所述鉴权请求和/或所述终端设备接入网络的鉴权方式；
    所述网关设备根据所述鉴权方式向所述网络中的网络设备发送所述鉴权请求，所述鉴权请求用于指示所述网络设备对所述终端设备进行鉴权；
    所述网关设备向无线接入网络RAN设备或者管理设备发送鉴权结果的信息，所述鉴权结果的信息中包含所述网络设备返回的对所述终端设备的鉴权结果。
  13. 根据权利要求12所述的方法，其特征在于，所述方法还包括：
    所述网关设备接收指示信息，所述指示信息包含于所述第二消息和/或所述第三消息中，其中，所述指示信息用于指示所述终端设备接入网络的鉴权方式。
  14. 根据权利要求12所述的方法，其特征在于，所述网关设备接收鉴权请求，包括：
    所述网关设备通过与所述鉴权方式对应的鉴权通道接收所述鉴权请求，所述鉴权通道被用于确定对应的所述鉴权方式。
  15. 根据权利要求13所述的方法，其特征在于，所述网关设备接收鉴权请求和指示信息，包括：
    所述网关设备通过所述无线接入网RAN设备与所述网关设备之间的传输通道接收来自 于所述RAN设备的所述第三消息，所述第三消息中包含所述第二消息中包含的所述鉴权请求和所述指示信息。
  16. 根据权利要求13所述的方法，其特征在于，所述网关设备接收鉴权请求和指示信息，包括：
    所述网关设备接收管理设备发送的所述鉴权请求和所述指示信息，所述鉴权请求和所述指示信息为所述管理设备从第一非接入层NAS消息中获取，并由所述管理设备发送来的，所述第一NAS消息为所述驻地节点通过无线接入网络RAN设备向所述管理设备发送的。
  17. 根据权利要求12-16任一所述的方法，其特征在于，所述方法还包括：
    所述网关设备在向所述网络设备发送的第四消息中添加所述鉴权附加信息，所述鉴权附加信息包括表明所述驻地节点的身份标识、表明所述终端设备位置和/或所述驻地节点位置的信息和用于传输所述鉴权请求的通道信息中的至少一个；
    所述用于传输鉴权请求的通道信息包括如下信息中的至少一个：隧道标识，承载标识，以及会话标识。
  18. 根据权利要求17所述的方法，其特征在于，所述方法还包括：
    所述网关设备记录所述驻地节点的标识信息与所述终端设备的标识的映射关系，所述映射关系用于发送所述鉴权请求对应的鉴权结果的信息。
  19. 根据权利要求12-18任一所述的方法，其特征在于，所述方法还包括：
    所述网关设备根据所述网络设备分配的路由配置的参考信息，确定路由配置的配置信息，所述路由配置的参考信息为所述鉴权结果的信息包括鉴权通过的信息时所述网络设备分配的；
    所述移动网关经无线网络接入RAN设备，或者经管理设备和无线网络接入RAN设备向所述驻地节点发送所述路由配置的配置信息。
  20. 一种接入网络的方法，其特征在于，包括：
    管理设备接收驻地节点发送的鉴权请求，所述鉴权请求为终端设备通过第一消息向所述驻地节点发送的；
    所述管理设备向网关设备发送第三消息，所述第三消息包含所述鉴权请求和/或所述终端设备接入网络的鉴权方式，所述第三消息被用于所述网关设备识别所述鉴权请求和/或所述终端设备接入网络的鉴权方式，所述鉴权方式用于指示所述网关设备向网络设备发送所述鉴权请求，所述鉴权请求用于指示所述网络设备对所述终端设备进行鉴权；
    所述管理设备向所述驻地节点发送所述网关设备返回的鉴权结果的信息，所述鉴权结果的信息中包含所述网络设备返回的对所述终端设备的鉴权结果。
  21. 根据权利要求20所述的方法，其特征在于，所述第一消息被所述驻地节点处理为第二消息，所述第二消息和/或所述第三消息包含所述鉴权请求和指示信息，其中，所述指示信息包含用于指示所述终端设备接入网络的鉴权方式。
  22. 根据权利要求20所述的方法，其特征在于，所述第一消息被所述驻地节点处理为第二消息，所述第二消息为第一非接入层NAS消息；所述方法还包括：
    所述管理设备从所述第一NAS消息中获取所述鉴权请求和指示信息，并在发送所述鉴 权请求时发送所述指示信息。
  23. 一种驻地节点，其特征在于，包括：存储器、收发器和至少一个处理器，所述存储器中存储有指令；所述存储器、所述收发器和所述至少一个处理器通过线路互联，所述收发器用于进行权利要求1-11任一所述的方法中，在所述驻地节点侧进行的消息收发的操作；
    所述至少一个处理器调用所述指令，执行权利要求1-11任一所述的方法中的在所述驻地节点侧进行的消息处理或控制操作。
  24. 一种网关设备，其特征在于，包括：存储器、收发器和至少一个处理器，所述存储器中存储有指令，所述存储器、所述收发器和所述至少一个处理器通过线路互联，所述收发器用于执行权利要求12-19任一所述的方法中，在所述网关设备侧进行消息收发的操作；
    所述至少一个处理器调用所述指令，执行权利要求12-19任一所述的方法中的在所述网关设备侧进行的消息处理或控制操作。
  25. 一种管理设备，其特征在于，存储器、收发器和至少一个处理器，所述存储器中存储有指令，所述存储器、所述收发器和所述至少一个处理器通过线路互联，所述收发器用于执行权利要求20-22任一所述的方法中，在所述管理设备侧进行消息收发的操作；
    所述至少一个处理器调用所述指令，执行权利要求20-22任一所述的方法中的在所述管理设备侧进行的消息处理或控制操作。
  26. 一种芯片系统，其特征在于，包括：应用于驻地节点中，所述芯片系统包括至少一个处理器，存储器和接口电路，所述存储器、所述收发器和所述至少一个处理器通过线路互联，所述至少一个存储器中存储有指令；所述指令被所述处理器执行，以执行权利要求1-11任一所述的方法中所述驻地节点的操作。
  27. 一种芯片系统，其特征在于，包括：应用于网关设备中，所述芯片系统包括至少一个处理器，存储器和接口电路，所述存储器、所述收发器和所述至少一个处理器通过线路互联，所述至少一个存储器中存储有指令；所述指令被所述处理器执行，以执行权利要求12-19任一所述的方法中所述网关设备的操作。
  28. 一种芯片系统，其特征在于，包括：应用于管理设备中，所述芯片系统包括至少一个处理器，存储器和接口电路，所述存储器、所述收发器和所述至少一个处理器通过线路互联，所述至少一个存储器中存储有指令；所述指令被所述处理器执行，以执行权利要求20-22任一所述的方法中所述管理设备的操作。
  29. 一种计算机可读存储介质，其特征在于，应用于驻地节点中，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行上述权利要求1-11任一所述的方法。
  30. 一种计算机可读存储介质，其特征在于，应用于网关设备中，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行上述权利要求12-19任一所述的方法。
  31. 一种计算机可读存储介质，其特征在于，应用于管理设备中，所述计算机可读存 储介质中存储有指令，当其在计算机上运行时，使得计算机执行上述权利要求20-22任一所述的方法。
  32. 一种网络接入系统，其特征在于，包括：终端设备、驻地节点、管理设备、网关设备、网络设备和认证设备；
    其中，所述驻地节点为权利要求23所述的驻地节点；
    所述网关设备为权利要求24所述的网关设备；
    所述管理设备为权利要求25所述的管理设备。
PCT/CN2018/097989 2017-08-02 2018-08-01 一种接入网络的方法、设备及系统 WO2019024866A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP18841051.8A EP3657834B1 (en) 2017-08-02 2018-08-01 Method, device and system for accessing network
US16/751,801 US11197238B2 (en) 2017-08-02 2020-01-24 Network access method, device, and system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710652059.2 2017-08-02
CN201710652059.2A CN109391940B (zh) 2017-08-02 2017-08-02 一种接入网络的方法、设备及系统

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/751,801 Continuation US11197238B2 (en) 2017-08-02 2020-01-24 Network access method, device, and system

Publications (1)

Publication Number Publication Date
WO2019024866A1 true WO2019024866A1 (zh) 2019-02-07

Family

ID=65233306

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/097989 WO2019024866A1 (zh) 2017-08-02 2018-08-01 一种接入网络的方法、设备及系统

Country Status (4)

Country Link
US (1) US11197238B2 (zh)
EP (1) EP3657834B1 (zh)
CN (1) CN109391940B (zh)
WO (1) WO2019024866A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111093262A (zh) * 2019-07-31 2020-05-01 中兴通讯股份有限公司 一种实现5g用户注册的方法、网元设备及存储介质
CN113973076A (zh) * 2020-07-24 2022-01-25 华为技术有限公司 一种多播切换方法及装置
EP3982656A4 (en) * 2019-06-24 2022-07-20 Huawei Technologies Co., Ltd. METHOD OF ACCESSING A MOBILE CORE NETWORK USING A FIXED ACCESS DEVICE

Families Citing this family (35)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10797894B2 (en) * 2017-12-28 2020-10-06 Ofinno, Llc Service type and device type-based policy and charging control
CN110602724B (zh) * 2018-06-12 2021-05-14 华为技术有限公司 网络配置的方法和通信装置
EP3598843B1 (en) * 2018-07-16 2021-06-23 Nokia Solutions and Networks Oy Apparatus, method and computer program
US10708857B2 (en) * 2018-12-06 2020-07-07 Charter Communications Operating, Llc Tiered re-allocation of wireless channels
WO2020124230A1 (en) * 2018-12-19 2020-06-25 Conversant Intellectual Property Management Inc. System and method for a network access service
US11197343B2 (en) * 2019-06-18 2021-12-07 Nokia Technologies Oy Method and apparatus for adding notifications related with user equipment multicast group and leave
EP4021047A4 (en) * 2019-08-19 2023-09-06 LG Electronics Inc. AUTHENTICATION FOR RELAY
CN112584464B (zh) * 2019-09-30 2022-07-19 华为技术有限公司 通信方法、通信装置及存储介质
US20210143985A1 (en) * 2019-11-11 2021-05-13 Karlsgate, LLC Method and protocol for triple-blind identity mapping.
CN113573297B (zh) * 2020-04-10 2023-04-07 华为技术有限公司 一种通信方法及装置
WO2021208857A1 (zh) * 2020-04-17 2021-10-21 维沃移动通信有限公司 接入控制方法及通信设备
CN113556709B (zh) * 2020-04-23 2024-07-05 华为技术有限公司 一种通信方法及装置
CN113746649B (zh) * 2020-05-14 2022-12-06 华为技术有限公司 一种网络切片控制方法及通信装置
CN111867153B (zh) * 2020-06-12 2023-02-03 青岛海信智慧生活科技股份有限公司 一种终端、网关设备和数据处理方法
CN111669766A (zh) * 2020-06-15 2020-09-15 深圳畅想云物联科技有限公司 智慧园区无线智能专网实现方法、系统以及存储介质
US11589264B2 (en) * 2020-07-31 2023-02-21 Charter Communications Operating, Llc System and method for leveraging access customer premise equipment (CPE) gateway resources to provide 5G edge computing services
CN114079974A (zh) * 2020-08-12 2022-02-22 中国移动通信有限公司研究院 网络能力开放方法、装置、upf实体及cpe网元
CN114158028A (zh) * 2020-09-07 2022-03-08 中国移动通信有限公司研究院 数据网络鉴权方式适配方法、装置及可读存储介质
CN114189497A (zh) * 2020-09-14 2022-03-15 中兴通讯股份有限公司 地址获取方法和装置、计算机可读存储介质
US11425044B2 (en) * 2020-10-15 2022-08-23 Cisco Technology, Inc. DHCP layer 2 relay in VXLAN overlay fabric
CN114449619B (zh) * 2020-10-20 2024-06-25 大唐移动通信设备有限公司 固定上网设备接入无线网络系统的方法及室分系统
CN114726902B (zh) * 2021-01-05 2024-06-25 中国移动通信有限公司研究院 数据传输方法、装置、通信设备及计算机可读存储介质
CN112969177B (zh) * 2021-01-29 2023-03-14 展讯半导体(南京)有限公司 终端接入方法及装置、存储介质、接入点、核心网、终端
WO2022179525A1 (en) * 2021-02-23 2022-09-01 Telefonaktiebolaget Lm Ericsson (Publ) Method and apparatus for authentication
CN113015265B (zh) * 2021-02-24 2023-07-18 西安广和通无线软件有限公司 网络会话自愈方法、装置、系统、计算机设备和存储介质
CN113438131B (zh) * 2021-06-24 2022-11-25 深圳市吉祥腾达科技有限公司 一种路由器l2tp多客户端接入数及稳定性测试方法
CN115567934A (zh) * 2021-06-30 2023-01-03 华为技术有限公司 一种认证方法及通信装置
CN115604053A (zh) * 2021-07-09 2023-01-13 华为技术有限公司（Cn） 基于介质冗余协议进行组网的方法和装置
CN114362989B (zh) * 2021-09-30 2023-11-10 成都长虹网络科技有限责任公司 终端访问iptv业务的方法、网关、计算机设备和存储介质
CN114268938A (zh) * 2021-12-20 2022-04-01 中国电信股份有限公司 用户前置设备的纳管方法、装置、设备以及存储介质
CN116567625A (zh) * 2022-01-27 2023-08-08 维沃移动通信有限公司 设备鉴权方法、装置、终端及网络功能
CN115086276B (zh) * 2022-07-14 2023-04-25 中国联合网络通信集团有限公司 一种地址管理方法、装置、设备及系统
US11811728B1 (en) * 2022-08-08 2023-11-07 Juniper Networks, Inc. Broadband network gateway (BNG) as dynamic host configuration protocol (DHCP) server
US20240063909A1 (en) * 2022-08-18 2024-02-22 At&T Mobility Ii Llc Mobile telecommunications network access point configuration and fiber routing configuration for customer premises equipment
CN117041969B (zh) * 2023-09-28 2024-01-02 新华三技术有限公司 5g双域专网的接入方法、系统及装置、电子设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102045684A (zh) * 2009-10-26 2011-05-04 中国移动通信集团江苏有限公司 一种实现无线局域网分区计费的方法和系统
WO2013170576A1 (zh) * 2012-05-15 2013-11-21 华为技术有限公司 一种网络融合的方法、设备及通信系统
CN103841558A (zh) * 2012-11-26 2014-06-04 中国移动通信集团北京有限公司 一种终端鉴权方法、系统及移动通信终端
CN106131832A (zh) * 2015-11-25 2016-11-16 北京邮电大学 一种面向wlan与蜂窝网融合的核心网架构

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7669229B2 (en) * 2002-11-13 2010-02-23 Intel Corporation Network protecting authentication proxy
US20080028445A1 (en) * 2006-07-31 2008-01-31 Fortinet, Inc. Use of authentication information to make routing decisions
US8966584B2 (en) * 2007-12-18 2015-02-24 Verizon Patent And Licensing Inc. Dynamic authentication gateway
US8189567B2 (en) * 2009-01-29 2012-05-29 Telefonaktiebolaget L M Ericsson (Publ) Method and nodes for registering a terminal
CN103229534B (zh) * 2011-07-11 2016-01-27 华为技术有限公司 策略控制方法和设备
CN102572830B (zh) * 2012-01-19 2015-07-08 华为技术有限公司 终端接入认证的方法及用户端设备
US20150350912A1 (en) * 2014-05-28 2015-12-03 Telefonaktiebolaget L M Ericsson (Publ) Residential service delivery based on unique residential apn
WO2015200273A1 (en) * 2014-06-27 2015-12-30 Arris Enterprises, Inc. Set-to box or similar device with wifi protected setup button and visual indicators for displaying each stage of a protected setup process
WO2017099864A1 (en) * 2015-12-09 2017-06-15 Intel IP Corporation Standardized access to core networks
US10136318B1 (en) * 2017-06-21 2018-11-20 At&T Intellectual Property I, L.P. Authentication device selection to facilitate authentication via an updateable subscriber identifier

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102045684A (zh) * 2009-10-26 2011-05-04 中国移动通信集团江苏有限公司 一种实现无线局域网分区计费的方法和系统
WO2013170576A1 (zh) * 2012-05-15 2013-11-21 华为技术有限公司 一种网络融合的方法、设备及通信系统
CN103841558A (zh) * 2012-11-26 2014-06-04 中国移动通信集团北京有限公司 一种终端鉴权方法、系统及移动通信终端
CN106131832A (zh) * 2015-11-25 2016-11-16 北京邮电大学 一种面向wlan与蜂窝网融合的核心网架构

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3657834A4

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3982656A4 (en) * 2019-06-24 2022-07-20 Huawei Technologies Co., Ltd. METHOD OF ACCESSING A MOBILE CORE NETWORK USING A FIXED ACCESS DEVICE
US12010520B2 (en) 2019-06-24 2024-06-11 Huawei Technologies Co., Ltd. Method for accessing mobile core network by using fixed access device
CN111093262A (zh) * 2019-07-31 2020-05-01 中兴通讯股份有限公司 一种实现5g用户注册的方法、网元设备及存储介质
CN113973076A (zh) * 2020-07-24 2022-01-25 华为技术有限公司 一种多播切换方法及装置

Also Published As

Publication number Publication date
EP3657834B1 (en) 2024-03-27
US20200163012A1 (en) 2020-05-21
EP3657834A4 (en) 2020-08-12
CN109391940B (zh) 2021-02-12
EP3657834A1 (en) 2020-05-27
US11197238B2 (en) 2021-12-07
CN109391940A (zh) 2019-02-26

Similar Documents

Publication Publication Date Title
CN109391940B (zh) 一种接入网络的方法、设备及系统
US10021566B2 (en) Non-mobile authentication for mobile network gateway connectivity
US9549317B2 (en) Methods and apparatuses to provide secure communication between an untrusted wireless access network and a trusted controlled network
EP2676463B1 (en) Mobile router and method in an eps
WO2016196958A1 (en) Unified authentication for integrated small cell and wi-fi networks
US9622143B1 (en) Access point name mappings for a layer two wireless access network
KR20140022455A (ko) 이용자 엔티티에 네트워크 액세스를 제공하기 위한 방법 및 장치
CN112019578B (zh) 一种用户面连接的建立方法、装置及系统
US20160380962A1 (en) Wireless access gateway
US20200275275A1 (en) Authentication method and apparatus
WO2020187261A1 (zh) 一种通信方法、装置及系统
CN106171041B (zh) 控制无线接入网关的方法、存储介质、设备及无线网络
US10367658B2 (en) Wireless network session establishment method and apparatus utilizing a virtual local area network label
JP6369179B2 (ja) トンネルエンドポイント装置、ｄｈｃｐサーバ、インタフェースの自動設定方法及びプログラム
US20240155705A1 (en) Communication method and apparatus
WO2023001015A1 (zh) 一种传输数据的方法和装置
EP2897417A1 (en) Pdn service realizing method, system and network element
JP2015041970A (ja) 通信システム、通信方法、および、通信プログラム
US20150215780A1 (en) Method and device for transmitting data

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18841051

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2018841051

Country of ref document: EP

Effective date: 20200219