WO2019096287A1 - 鉴权的方法和装置 - Google Patents

鉴权的方法和装置 Download PDF

Info

Publication number
WO2019096287A1
WO2019096287A1 PCT/CN2018/116066 CN2018116066W WO2019096287A1 WO 2019096287 A1 WO2019096287 A1 WO 2019096287A1 CN 2018116066 W CN2018116066 W CN 2018116066W WO 2019096287 A1 WO2019096287 A1 WO 2019096287A1
Authority
WO
WIPO (PCT)
Prior art keywords
information
access
authentication
network element
terminal device
Prior art date
Application number
PCT/CN2018/116066
Other languages
English (en)
French (fr)
Inventor
诸华林
李欢
靳维生
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP18878836.8A priority Critical patent/EP3697119A4/en
Priority to AU2018366777A priority patent/AU2018366777A1/en
Publication of WO2019096287A1 publication Critical patent/WO2019096287A1/zh
Priority to US16/874,025 priority patent/US20200275275A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H04W12/086—Access security using security domains
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/029—Firewall traversal, e.g. tunnelling or, creating pinholes
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0478—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload applying multiple layers of encryption, e.g. nested tunnels or encrypting the content with a first key and then with at least a second key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0892—Network architectures or network communication protocols for network security for authentication of entities by using authentication-authorization-accounting [AAA] servers or protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3271—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/102—Route integrity, e.g. using trusted paths
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/20—Selecting an access point
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H04W76/12—Setup of transport tunnels

Definitions

  • the embodiments of the present application relate to the field of communications, and in particular, to a method and apparatus for authentication.
  • the terminal device In a 5rd generation (5G) communication network, the terminal device is allowed to access the core network through a non-3rd generation partnership project (3GPP) access network.
  • 3GPP non-3rd generation partnership project
  • the embodiment of the present application provides a method and an apparatus for authentication, which can be applied to a new generation communication network.
  • a first aspect of the present application provides a method for authenticating, comprising: an access network element receiving access authentication information from a terminal device; the access network element generating a first according to the access authentication information a message, the first message includes the access authentication information; the access network element sends the first message to an access management network element; and the access network element receives the access management network element to send The first response message of the first message, the first response message includes response information of the access authentication information; the access network element sends the location information to the terminal device according to the first response message The response information of the access authentication information.
  • the method in the embodiment of the present application can solve the problem that the transmission protocol of different network element authentication information is not adapted.
  • the first message is a non-access stratum NAS message or an N2 interface message, where the N2 interface is the access network element and the access management Interface between network elements.
  • the first response message includes indication information, where the indication information is used to indicate that the first response message is used for access authentication; And sending, by the first response message, the response information of the access authentication information to the terminal device, where the access network element extracts the access in the first response message according to the indication information The response information of the authentication information; the access network element sends the response information of the access authentication information to the terminal device.
  • the indication information is an access authentication indication or a message type.
  • the method further includes the access network element transmitting the address information of the access network element to the terminal device.
  • a second aspect of the present application provides a method for authenticating, comprising: acquiring, by a terminal device, address information of an access network element used for access authentication; and selecting, by the terminal device, an access network corresponding to the address information The process of initiating tunnel authentication by the element.
  • the terminal device selects a process for the access network element to initiate tunnel authentication in the access authentication process, which can simplify the process of access authentication and tunnel authentication.
  • the terminal device acquires address information of an access network element used for access authentication, including: in the access authentication process, the terminal device receives the Address information of the access network element sent by the access network element.
  • the terminal device acquires address information of the access network element used for access authentication, where the terminal device sends the public device where the terminal device is located to the domain name system DNS.
  • the identification information of the land mobile network PLMN; the terminal device receives the address information of the access network element that is sent by the domain name system according to the identity information of the PLMN.
  • the method before the terminal device selects a process for the access network element corresponding to the address information to initiate tunnel authentication, the method further includes: the terminal device to the address The access network element corresponding to the information initiates an access authentication process.
  • a third aspect of the present application provides a method for authenticating, comprising: an access node receiving connection establishment information from a terminal device, where the connection establishment information is used to establish a connection between the terminal device and the access node
  • the access node assigns address information to the terminal device, the address information is used to perform an authentication process; the access node receives result information of the authentication process sent by the access gateway, the authentication
  • the result information of the process includes the result information of the access authentication; the access node determines the validity of the address information of the terminal device according to the result information of the access authentication.
  • access authentication and tunnel authentication are performed synchronously, thereby simplifying the authentication process.
  • a fourth aspect of the present application provides a method for authenticating, comprising: acquiring, by a terminal device, address information of the terminal device; the terminal device sending tunnel authentication information to the access gateway, where the tunnel authentication information includes Address information of the terminal device; the terminal device receives response information of the tunnel authentication information sent by the access gateway, and the response information of the tunnel authentication information includes result information of access authentication; the terminal device Determining validity of the address information of the terminal device according to the result information of the access authentication.
  • the result information of the access authentication is information that the access authentication succeeds, and the terminal device determines the terminal according to the result information of the access authentication.
  • the address information of the device is valid, and the terminal device determines that the address information of the terminal device is valid according to the information about the success of the access authentication.
  • the result information of the access authentication is information that the access authentication fails, and the terminal device determines the terminal according to the result information of the access authentication.
  • the address information of the device is valid, and the terminal device determines that the address information of the terminal device is invalid according to the information about the access authentication failure.
  • a fifth aspect of the present application provides a method for authenticating, comprising: an access gateway receiving tunnel authentication information from a terminal device, where the tunnel authentication information includes address information allocated by the access node for the terminal device
  • the access gateway sends the tunnel authentication information to the access management network element; the access gateway receives the response information of the tunnel authentication information sent by the access management network element, and the tunnel authentication
  • the response information of the information includes result information of the access authentication; the access gateway sends the response information of the tunnel authentication information to the terminal device.
  • the seventh aspect of the present application provides an authentication apparatus, including: a processing unit and a transceiver unit, where the transceiver unit is configured to acquire address information of an access network element used for access authentication; The process of initiating tunnel authentication is performed by selecting an access network element corresponding to the address information.
  • An eighth aspect of the present application provides an authentication apparatus, including: a processing unit and a transceiver unit, the transceiver unit configured to receive connection establishment information from a terminal device, where the connection establishment information is used to establish the terminal device a connection with the access node; the processing unit is configured to allocate address information to the terminal device, where the address information is used to perform an authentication process; the transceiver unit is further configured to receive the The result information of the authentication process, the result information of the authentication process includes result information of the access authentication; the processing unit is further configured to determine, according to the result information of the access authentication, that the address information of the terminal device is valid Sex.
  • a ninth aspect of the present application provides an authentication apparatus, a processing unit, and a transceiver unit, where the transceiver unit is configured to acquire address information of the authenticated device, and the transceiver unit is further configured to send to the access gateway.
  • the tunnel authentication information includes address information of the device that is authenticated, and the transceiver unit is further configured to receive response information of the tunnel authentication information sent by the access gateway, where the tunnel authentication information is The response information includes result information of the access authentication; the processing unit is configured to determine validity of the address information of the authenticated device according to the result information of the access authentication.
  • a computer storage medium stores instructions that, when run on a computer, cause the computer to perform the first to fifth aspects and various Any of the possible implementations.
  • FIG. 1b is a schematic diagram of another communication system implementing an embodiment of the present application.
  • FIG. 5 is a schematic flowchart of a fourth embodiment of an authentication method of the present application.
  • FIG. 6 is a schematic flowchart of a fifth embodiment of an authentication method of the present application.
  • FIG. 9 is a schematic flowchart of an eighth embodiment of an authentication method of the present application.
  • the terminal device includes, but is not limited to, a user equipment (UE), a subscriber unit, a subscriber station, a mobile station, a mobile station, a remote station, a remote terminal device, a mobile terminal device, and a user terminal device.
  • UE user equipment
  • subscriber unit a subscriber station
  • mobile station a mobile station
  • remote station a remote terminal device
  • mobile terminal device a mobile terminal device
  • user terminal device includes, but is not limited to, a user equipment (UE), a subscriber unit, a subscriber station, a mobile station, a mobile station, a remote station, a remote terminal device, a mobile terminal device, and a user terminal device.
  • UE user equipment
  • terminal equipment wireless communication equipment, user agent, user equipment, cellular telephone, cordless telephone, session initiation protocol (SIP) telephone, wireless local loop (WLL) station, personal digital processing (personal Digital assistant, PDA), handheld device with wireless communication function, computing device, processing device connected to wireless modem, in-vehicle device, wearable device, terminal device in Internet of Things, home appliance, virtual reality device, future 5G network
  • PLMN public land mobile network
  • the terminal device is used as an example for the UE.
  • FIG. 1a is a schematic diagram of a communication system capable of implementing an embodiment of the present application.
  • the UE accesses a core network (Core Network, CN) through an untrusted non-3GPP access network (AN).
  • Core Network Core Network
  • AN untrusted non-3GPP access network
  • AMF network elements are used for mobility management, lawful interception, or access authorization and authentication.
  • the SMF network element is used to implement session and bearer management, address allocation, and the like.
  • the AUSF network element is used to implement authentication and authentication for the UE.
  • each network element can be communicatively coupled through the interface shown in FIG. 1a.
  • the functions and interfaces of the network elements are merely exemplary. When each network element is applied to the embodiment of the present application, not all functions are required. All or part of the network element of the core network element may be a physical entity network element or a virtualized network element, which is not limited herein.
  • FIG. 1b is a schematic diagram of another communication system capable of implementing an embodiment of the present application.
  • the UE accesses a Mobile Network Operator (MNO) network through a 5G MulteFire (MF) network.
  • MNO Mobile Network Operator
  • MF 5G MulteFire
  • the UE accesses the MulteFire core network through the MulteFire Access Network (MF AN).
  • the MulteFire core network can also be called the Neutral Host (NH) core network.
  • the MulteFire core network element includes: NH-UPF network element, NH-AMF network element, NH-SMF network element, and Neutral Host Authentication (Authorization, Accounting, NH-AAA) network element.
  • the NH-UPF network element, the NH-AMF network element, the NH-SMF network element, and the NH-AAA network element are similar to the corresponding network elements in the carrier network, and will not be described in detail herein.
  • the MNO network includes: an N3IWF network element and an AMF network element.
  • the access authentication refers to whether the UE can access the access network for authentication, for example, whether the UE can access the WIFI network for authentication and authentication.
  • Tunnel authentication refers to whether the UE can access the core network for authentication and authentication through tunnel technology.
  • a network element obtains information from another network element (for example, a B network element), and may refer to that the A network element directly receives information from the B network element, or may The A network element receives information from the B network element through other network elements (for example, the C network element).
  • the C network element can transparently transmit information, and can also process the information, for example, carrying the information in different messages for transmission or extracting information. Only the extracted information is sent to the A network element.
  • the A network element sends information to the B network element, which may be that the A network element directly sends information to the B network element, and may also refer to the A network element passing through other network elements (for example, the C network. Meta) sends information to the B network element.
  • the B network element may be that the A network element directly sends information to the B network element, and may also refer to the A network element passing through other network elements (for example, the C network. Meta) sends information to the B network element.
  • FIG. 2 is a schematic flow chart of a first embodiment of an authentication method of the present application.
  • the method in this embodiment can be applied to the system shown in FIG. 1a and FIG. 1b, and can also be applied to other communication systems, for example, the UE accesses the carrier network through a wired transmission network (fixed network) or a trusted non-3GPP access network.
  • the communication system is not limited here.
  • the authentication method includes:
  • Step 201 The terminal device sends the access authentication information to the access network element.
  • the terminal device may be the UE in Figures 1a and 1b.
  • the access network element may be the N3IWF network element in FIG. 1a and FIG. 1b.
  • the access network element may be a Broadband Network Gateway (BNG) or a Fixed Mobile Interworking Function network. Element or Access Gateway Function network element or Wireline Access Node.
  • BNG Broadband Network Gateway
  • Fixed Mobile Interworking Function Element or Access Gateway Function network element or Wireline Access Node.
  • the access network element may be an access node, for example, a base station device or a trusted WLAN connection.
  • Incoming node not limited here.
  • the access authentication information may be an extensible authentication protocol (EAP) information or a point-to-point protocol (PPP) information, for example, an Ethernet-based point-to-point protocol (Pointto Point Protocol over Ethernet). , PPPoE) information.
  • EAP extensible authentication protocol
  • PPP point-to-point protocol
  • the access authentication information may also be an 802.1X authentication message or a webpage authentication message.
  • Step 202 The access network element generates a first message according to the received access authentication information.
  • the header information of the NAS message includes a message type.
  • the message type may be Acess Authentication, which is used to indicate that the NAS message is used for access authentication.
  • the NAS message can use the header information shown in Table 1.
  • the header information of the NAS message includes an Acess Authentication Indication.
  • an access authentication indication is added to the header information of the attach request message, as shown in Table 2.
  • the header information of the N2 message includes an Acess Authentication Indication, as shown in Table 4.
  • Step 203 The access network element sends the generated first message to the access management network element.
  • the access management network element can learn that the message is used for access authentication according to the indication information in the first message.
  • the access management network element may perform authentication on the AUSF network element according to the access authentication information in the received first message, and receive response information of the access authentication information sent by the AUSF network element.
  • the process of authenticating the access management network element to the AUSF network element is described in the prior art and will not be described in detail herein.
  • the access network element After receiving the first response message, the access network element extracts response information of the access authentication information from the first response message.
  • the access network element extracts response information of the access authentication information according to the indication information carried in the first response message. For example, if the type of the first response message is Acess Authentication or the first response message carries the Acess Authentication Indication, the access network element deletes the header information of the first response message, thereby obtaining response information of the access authentication information.
  • Step 206 The access network element sends response information of the access authentication information to the terminal device.
  • the response information of the access authentication information sent by the access network element to the terminal device may include the address information of the access network element.
  • the address information may be an Internet Protocol (IP) address of the access network element.
  • IP Internet Protocol
  • the terminal device selects an access network element corresponding to the address information to initiate a tunnel authentication process.
  • the access network element may also carry the address information of the access network element in a single message or in other messages, which is not limited herein.
  • FIG. 3 is a schematic flowchart of a second embodiment of an authentication method of the present application.
  • the method of the present embodiment can be applied to the system shown in FIG. 1a and FIG. 1b, and can also be applied to other communication systems, for example, the communication system in which the UE accesses the carrier network through the fixed network, which is not limited herein.
  • the authentication method includes:
  • Step 301 The terminal device acquires address information of an access network element used for access authentication.
  • the non-trusted non-3GPP access network selects the N3IWF network element for access authentication, the address of the N3IWF network element to be selected by the non-trusted non-3GPP access network
  • the information is sent to the terminal device; or, in the system shown in FIG. 1b, after the NH-AAA network element selects the N3IWF network element for access authentication, the address information of the N3IWF network element to be selected by the NH-AAA network element Send to the terminal device.
  • Step 401 The terminal device sends connection establishment information to the access node.
  • the connection establishment information is used to establish a connection between the terminal device and the access node.
  • the connection setup message when the method is applied to a trusted or non-trusted non-3GPP network, the connection setup message may be a Wireless Local Area Network (WLAN) connection setup message; when the method is applied to the Multefire network.
  • the connection setup message may be an attach request message; when applied to a fixed network, the connection setup message may be a PPP connection message.
  • WLAN Wireless Local Area Network
  • Step 402 The access node allocates address information to the terminal device.
  • the access node After receiving the connection establishment information sent by the terminal device, the access node allocates address information to the terminal device.
  • the address information may be a temporary address information.
  • the address information can be an IP address. This address information is used to perform an authentication process.
  • the terminal device can access the access network and the core network through the address information.
  • Step 403 The access node sends the allocated address information to the terminal device.
  • the terminal device obtains the address information of the terminal device by using the steps 401, 402, and 403.
  • the steps 401, 402, and 403. For the specific method, refer to the prior art.
  • Step 404 The terminal device sends tunnel authentication information to the access gateway.
  • the tunnel authentication information includes address information allocated by the access node for the terminal device.
  • the tunnel authentication information may further include identification information of the terminal device.
  • the access gateway when the method in this embodiment is applied to a non-trusted non-3GPP network, the access gateway may be the N3IWF network element in FIG. 1a, and the access node may be the non-trusted non-trust in FIG. 1a.
  • the 3GPP access network when the method of the embodiment is applied to a trusted non-3GPP network or a fixed network, the access gateway may be set in the access node, that is, the access network element may also be an access node, where not Make a limit.
  • Step 405 The access gateway sends tunnel authentication information to the access management network element.
  • the access gateway After the access gateway receives the tunnel authentication information sent by the terminal device, the access gateway sends the tunnel authentication information to the access management network element.
  • the access gateway extracts the tunnel authentication information from the message sent by the terminal device, and then sends the extracted tunnel authentication information to the access management network element.
  • Step 406 The access management network element sends response information of the tunnel authentication information to the access gateway.
  • the access management network element may send the information about the tunnel authentication to the AUSF network element.
  • the AUSF network element completes the authentication and authentication of the terminal device. Specifically, the AUSF network element may perform tunnel and access authentication authentication on the terminal device according to the user identification information in the tunnel authentication information.
  • the AUSF network element sends response information of the tunnel authentication information to the access management network element.
  • the response information of the tunnel authentication information includes result information of the access authentication.
  • the response information of the tunnel authentication information may further include result information of the tunnel authentication.
  • the response information of the tunnel authentication information may also be referred to as result information of the authentication process.
  • the response information of the tunnel authentication information sent by the AUSF network element to the access management network element may be carried in the AAA message.
  • the access management network element receives the result information of the authentication process sent by the AUSF network element.
  • the result information of the authentication process includes result information of the access authentication.
  • Step 407 The access gateway sends response information of the tunnel authentication information to the access node.
  • the access gateway may send the response information of the tunnel authentication information to the access node.
  • the access gateway may extract the response information of the tunnel authentication information from the message sent by the access management network element, and then send the response information of the extracted tunnel authentication information to the access gateway.
  • the access gateway may also carry the response information of the tunnel authentication information in other messages to send the access gateway, which is not limited herein.
  • Step 408 The access node determines validity of the address information of the terminal device according to the result information of the access authentication.
  • the access node determines the validity of the address information of the terminal device according to the result information of the access authentication carried in the response information of the tunnel authentication information.
  • the result information of the access authentication may be information for successful access authentication or information for failure of access authentication.
  • the access node determines that the address information allocated for the terminal device is valid, and the access node allows the terminal device to continue to use the address information to access the network.
  • the result of the access authentication is the information of the access authentication failure, the access node determines that the address information allocated for the terminal device is invalid, and the access node prohibits the terminal device from continuing to use the address information to access the network.
  • Step 410 The terminal device determines validity of the address information of the terminal device according to the result information of the access authentication.
  • the terminal device determines that the address information allocated by the access node is valid, and the terminal device continues to use the address information to access the network.
  • the terminal device determines that the address information allocated by the access node is invalid, and the terminal device stops using the address information to access the network.
  • the terminal device after the terminal device acquires the address information allocated by the access node, the terminal device carries the address information in the data packet of the authentication message as the source address of the data.
  • the flow of steps 404, 405, 406, 407, and 409 of the tunnel authentication may be detailed in the flow of the existing tunnel authentication.
  • the access node allocates address information to the terminal device in advance, and uses the address information to perform an authentication process. Since the tunnel authentication and access authentication are synchronized, the authentication process is simplified.
  • FIG. 5 is a schematic flowchart of a fourth embodiment of the authentication method of the present application, and the method of the embodiment is described in detail based on the architecture of FIG. 1b.
  • Step 501 The UE sends an attach request to the NH-AMF network element.
  • the UE may also send a registration request to the NH-AMF network element.
  • Step 502 The NH-AMF network element sends the EAP-RQ/Identity information to the UE by using the NAS message.
  • the message is an EAP request message, which is used to initiate an EAP access authentication process.
  • the message is also used to request a UE ID from the UE.
  • Step 503 The UE sends EAP-RSP/Identity information to the NH-AMF network element by using the NAS message.
  • Step 504 and step 505 The NH-AMF network element sends the EAP-RSP/Identity information to the N3IWF network element through the NH-AAA network element.
  • the NH-AMF network element may extract EAP-RSP/Identity information from the NAS message, and then send the information to the NH-AAA network element through the AAA message.
  • the NH-AAA network element sends the AAA message to the N3IWF network element, so that the UE ID is sent to the N3IWF network element.
  • the NAS message includes indication information for indicating that the NAS message is used for access authentication.
  • the N3IWF network element generates an N2 message for transmitting EAP information, and carries the AAA message received in step 505 in the N2 message and sends the message to the AMF network element.
  • the NAS message or the N2 message may be the first message in step 202.
  • the NAS message or the N2 message may be the first message in step 202.
  • the description of step 202 refer to the description of step 202.
  • Step 507 The N3IWF network element sends the generated NAS message to the AMF network element.
  • Step 508 The AMF network element requests an authentication vector from the AUSF network element according to the received NAS message.
  • the AMF network element can learn that the NAS message is used for access authentication according to the indication information in the NAS message.
  • the AMF network element requests an authentication vector from the AUSF network element according to the access authentication information (EAP-RSP/Identity) in the NAS message.
  • the process of requesting an authentication vector from the AMF network element to the AUSF network element according to the access authentication information can be referred to the prior art, and is not described here.
  • Step 509 to step 511 The AUSF generates an authentication vector, and sends the authentication vector to the AMF network element.
  • Step 512 The AMF network element obtains a master security key (MSK) according to the received authentication vector.
  • MSK master security key
  • the method for obtaining the MSK by the AMF network element according to the authentication vector can be referred to the prior art and will not be described here.
  • Step 513 The AMF generates a NAS message for transmitting EAP information, and sends the NAS message to the N3IWF network element.
  • the NAS message includes indication information for indicating that the NAS message is used for access authentication.
  • the NAS message includes an AAA message including challenge request information (EAP-RQ/AKA'-Challenge) information.
  • EAP-RQ/AKA'-Challenge challenge request information
  • the AMF generates an N2 message for transmitting EAP information, and sends challenge request information to the N3IWF network element in the N2 message.
  • the NAS message or the N2 message may be the first response message in step 204.
  • the NAS message or the N2 message may be the first response message in step 204.
  • step 204 refers to the description of step 204, which is not described in detail herein.
  • Step 514 The N3IWF network element extracts the AAA message in the NAS message.
  • the N3IWF network element may identify, according to the indication information in the NAS message, that the received NAS message is used for access authentication.
  • the N3IWF network element may delete the header information of the NAS message, thereby obtaining challenge request information in the NAS message.
  • the challenge request information may be considered as response information of the authentication information in step 205.
  • step 205 refers to the description of step 205 in this step, which is not described in detail herein.
  • the N3IWF network element may also extract an AAA message from the N2 message.
  • Step 515 to step 516 The N3IWF network element sends the challenge request information to the NH-AMF network element through the NH-AAA network element.
  • the N3IWF network element may also send the IP address of the N3IWF network element to the NH-AMF network element.
  • the N3IWF network element includes the challenge request information and the IP address of the N3IWF network element in the sent AAA message.
  • Step 517 The N3IWF network element sends challenge request information to the UE.
  • the N3IWF network element may extract challenge request information from the received AAA message, and then carry the challenge request information in the NAS message and send it to the UE.
  • the N3IWF network element may extract the IP address of the N3IWF network element from the received AAA message, and then carry the IP address of the N3IWF network element in the NAS message and send it to the UE.
  • Step 518 The UE acquires the RES value according to the received challenge request information.
  • Step 519 to step 521 The UE sends challenge response information to the N3IWF network element.
  • Step 522 The N3IWF network element generates a NAS message for transmitting EAP information, and the AAA message received in step 521 is carried in the NAS message and sent to the AMF network element.
  • the NAS message includes indication information for indicating that the NAS message is used for access authentication.
  • the N3IWF network element generates an N2 message for transmitting EAP information, and the AAA message received in step 521 is carried in the N2 message and sent to the AMF network element.
  • the AAA message carries the challenge response information.
  • the method for generating the NAS message or the N2 message in this step is similar to the method for generating the NAS message or the N2 message in step 506. For details, refer to the description of step 506, which is not described in detail herein.
  • Step 523 The N3IWF network element sends the generated NAS message to the AMF network element.
  • Step 524 The AMF network element determines whether the UE is legal.
  • the AMF network element After receiving the NAS message sent by the N3IWF network element, the AMF network element learns that the NAS message is used for access authentication according to the indication information in the NAS message. The AMF network element determines whether the UE is legal according to the challenge response information in the NAS message. For a method for determining whether a UE is legal, the AMF network element is specifically referred to the prior art, and is not described in detail herein.
  • Step 525 The AMF generates a NAS message for transmitting EAP information, and sends the NAS message to the N3IWF network element.
  • the NAS message includes indication information for indicating that the NAS message is used for access authentication.
  • the NAS message also includes result information of the access authentication.
  • the NAS message includes an AAA message
  • the AAA message includes result information (EAP-Success/MSK) of the access authentication.
  • the result information of the access authentication may be regarded as the response information of the access authentication information in step 205.
  • the AMF generates an N2 message for transmitting EAP information, and sends the result information of the access authentication to the N3IWF network element in the N2 message.
  • the method for generating the NAS message or the N2 message in this step is similar to the method for generating the NAS message or the N2 message in step 513. For details, refer to the description of step 513, which is not described in detail herein.
  • Step 526 The N3IWF network element extracts the AAA message in the NAS message.
  • the N3IWF network element may identify, according to the indication information in the NAS message, that the received NAS message is used for access authentication.
  • the N3IWF network element may delete the header information of the NAS message, thereby obtaining result information of the access authentication in the NAS message.
  • the result information of the access authentication may be considered as the response information of the authentication information in step 205.
  • step 205 refer to the description of step 205 in this step, which is not described in detail herein.
  • the N3IWF network element may also extract an AAA message from the N2 message.
  • Step 527 to step 528 The N3IWF network element sends the result information of the access authentication to the NH-AMF network element through the NH-AAA network element.
  • the N3IWF network element may also send the IP address of the N3IWF network element to the NH-AMF network element.
  • the N3IWF network element includes the result information of the access authentication and the IP address of the N3IWF network element in the sent AAA message.
  • Step 529 The NH-AMF network element sends the result information of the access authentication to the UE.
  • the N3IWF network element may extract the result information of the access authentication from the received AAA message, and then carry the result information of the access authentication in the NAS message and send the result to the UE.
  • the N3IWF network element may extract the IP address of the N3IWF network element from the received AAA message, and then carry the IP address of the N3IWF network element in the NAS message and send it to the UE.
  • the IP address of the N3IWF network element when the IP address of the N3IWF network element is included in the step 515 to the step 517, the IP address of the N3IWF network element may not be included in the step 527 to the step 529; otherwise, the steps 515 to 517 are not included.
  • the IP address of the N3IWF network element when the IP address of the N3IWF network element is included, the IP address of the N3IWF network element may be included in steps 527 to 529.
  • the IP addresses of the N3IWF network element may also be included in steps 515 to 517 and steps 527 to 529.
  • Step 530 to step 533 The UE and the NH-AMF network element complete the subsequent access authentication process according to the result of the access authentication, for example, generating an encryption key.
  • Step 534 The UE selects a flow of the tunnel authentication by the N3IWF network element in the access authentication process.
  • the UE selects a corresponding N3IWF network element according to the received IP address of the N3IWF network element. Then, a process of tunnel authentication is initiated to the selected N3IWF network element.
  • FIG. 6 is a schematic flowchart of a fifth embodiment of the authentication method of the present application, and the method of the embodiment is described in detail based on the architecture of FIG. 1a.
  • the functions of the non-trusted non-3GPP access network are similar to those of the NH-AMF network element and the NH-AAA network element in the embodiment shown in FIG. 5.
  • the non-trusted non-3GPP access network may be an access node.
  • the authentication method of the implementation includes:
  • Step 601 The UE sends a connection establishment message to the non-trusted non-3GPP access network.
  • Step 602 The non-trusted non-3GPP access network sends EAP-RQ/Identity information to the UE to the UE.
  • the EAP-RQ/Identity information is used to initiate an EAP access authentication process. This information is also used to request the UE ID from the UE.
  • Step 603 The UE sends EAP-RSP/Identity information to the non-trusted non-3GPP access network.
  • the EAP-RSP/Identity information is a response message of the EAP-RQ/Identity information. This information carries the UE ID.
  • Step 604 The non-trusted non-3GPP access network sends an AAA message to the N3IWF network element.
  • the AAA message includes EAP-RSP/Identity information.
  • Steps 605 to 614 are specifically described in the description of steps 506 to 515, and are not described in detail herein.
  • Step 615 The non-trusted non-3GPP access network sends challenge request information to the UE.
  • the non-trusted non-3GPP access network may extract challenge request information from the received AAA message, and then send the challenge request information to the UE.
  • the non-trusted non-3GPP access network may extract the IP address information of the N3IWF network element from the received AAA message, and then send the IP address information of the N3IWF network element to the UE.
  • Step 616 The UE acquires the RES value according to the received challenge request information.
  • Step 617 to step 618 The UE sends challenge response information to the non-N3IWF network element.
  • Steps 619 to 623 are specifically described in the description of steps 522 to 526, and are not described in detail herein.
  • Step 624 The N3IWF sends the result information of the access authentication to the non-trusted non-3GPP access network.
  • the N3IWF sends an AAA message to the non-trusted non-3GPP access network, where the AAA message includes result information of the access authentication.
  • Step 625 The non-trusted non-3GPP access network sends the result information of the access authentication to the UE.
  • Steps 626 to 630 are specifically described in the description of steps 530 to 534, and are not described in detail herein.
  • FIG. 7 is a schematic flowchart of a sixth embodiment of an authentication method of the present application.
  • the method of this embodiment is described in detail based on the architecture of FIG. 1b.
  • the method in this embodiment and the method in the fourth embodiment are as follows: the UE first selects an N3IWF network element, and then initiates a process of access authentication and tunnel authentication to the selected N3IWF network element.
  • the method in this embodiment includes:
  • Step 701 The UE selects an N3IWF network element.
  • the UE sends the ID of the PLMN where the UE is located to the DNS.
  • the UE receives the IP address of the N3IWF network element that the DNS sends according to the PLMN ID.
  • the UE may select an N3IWF network element corresponding to the IP address from the IP addresses of the plurality of N3IWF network elements.
  • steps 702 to 705 For details of steps 702 to 705, refer to the description of steps 502 to 504.
  • Steps 702 to 705 are different from steps 502 to 504 in that the message sent in each step carries the IP address of the N3IWF network element selected in step 701.
  • Step 706 The NH-AAA network element selects a corresponding N3IWF network element according to the IP address of the N3IWF network element carried in the received AAA message.
  • Step 707 The NH-AAA network element sends an AAA message to the selected N3IWF network element.
  • steps 708 to 736 For details of steps 708 to 736, refer to the description of steps 506 to 534.
  • Steps 708 to 736 are different from steps 506 to 534 in that the messages in steps 717 to 719 may not carry the IP address of the N3IWF network element and/or the messages in steps 729 to 731 may not carry the N3IWF network element. IP address.
  • FIG. 8 is a schematic flowchart of a seventh embodiment of the authentication method of the present application, and the method of the embodiment is described in detail based on the architecture of FIG. 1a.
  • the method in this embodiment and the method in the fifth embodiment are as follows: the UE first selects an N3IWF network element, and then initiates a process of access authentication and tunnel authentication to the selected N3IWF network element.
  • the non-trusted non-3GPP access network may be an access node.
  • the method in this embodiment includes:
  • Step 801 The UE selects an N3IWF network element.
  • steps 802 to 804 For details of steps 802 to 804, refer to the description of steps 701 to 703.
  • Steps 802 to 804 are different from steps 701 to 703 in that the message sent in each step carries the IP address of the N3IWF network element selected in step 801.
  • Step 805 The non-trusted non-3GPP access network selects the corresponding N3IWF network element according to the IP address of the N3IWF network element carried in the received AAA message.
  • Step 806 The non-trusted non-3GPP access network sends an AAA message to the selected N3IWF network element.
  • Steps 807 to 832 refer to the description of steps 605 to 630.
  • Steps 807 to 832 are different from steps 605 to 630 in that the message in step 816 to step 817 may not carry the IP address of the N3IWF network element and/or the message in steps 726 to 727 may not carry the N3IWF network element. IP address.
  • FIG. 9 is a schematic flowchart of an eighth embodiment of an authentication method of the present application. The method of this embodiment is described in detail on the basis of the architecture of Fig. 1a. In this embodiment, access authentication and tunnel authentication are performed synchronously.
  • the non-trusted non-3GPP access network may be an access node. Specifically, the method in this embodiment includes:
  • steps 901 to 903 For details of steps 901 to 903, refer to the description of steps 401 to 403.
  • steps 904 to 907 can participate in the prior art.
  • Steps 904 to 907 are different from the prior art in that the interaction information between the UE and the N3IWF network element includes the IP address allocated by the non-trusted non-3GPP access network in step 903 to the UE.
  • the UE carries the IP address in the data packet of the interactive authentication message. Use this IP address for the tunnel authentication process.
  • Step 908 The N3IWF network element selects an AMF network element used for tunnel authentication.
  • the method for selecting an AMF network element by the N3IWF network element is specifically referred to the prior art.
  • Step 909 The N3IWF network element sends a registration request (Registration Request) message to the AMF network element.
  • Step 910a to step 910i The AMF network element interacts with the AUSF network element and performs EAP authentication on the UE.
  • the AUSF network element performs access authentication and tunnel authentication by authenticating the UE ID.
  • the interaction information between the network elements includes the IP address allocated by the non-trusted non-3GPP access network in the step 903.
  • the UE carries the IP address in the data packet of the interactive authentication message.
  • Step 911 The AUSF network element sends an AAA message to the AMF network element.
  • the AAA message includes result information (EAP-Success) of tunnel authentication.
  • the AAA message also includes access authentication result information.
  • the result information of the tunnel authentication includes result information of the access authentication.
  • the result information of the tunnel authentication and the result information of the access authentication may be referred to as response information of the tunnel authentication information.
  • Step 912 The AMF network element sends response information of the tunnel authentication information to the N3IWF network element.
  • the AMF network element extracts the response information of the tunnel authentication information from the AAA message, and then sends the response information of the tunnel authentication information to the N3IWF network element.
  • the response information of the tunnel authentication information includes result information of the tunnel authentication and result information of the access authentication.
  • Step 913 The N3IWF network element sends the result information of the access authentication to the non-trusted non-3GPP access network.
  • the N3IWF network element After receiving the response information of the tunnel authentication information, the N3IWF network element obtains the result information of the access authentication from the response message of the tunnel authentication information. The N3IWF network element sends the result information of the access authentication to the non-trusted non-3GPP access network.
  • Step 914 The non-trusted non-3GPP access network sends response information of the result information of the access authentication to the N3IWF network element.
  • Step 915 The non-trusted non-3GPP access network determines the validity of the IP address of the UE according to the result information of the access authentication.
  • the result information of the access authentication may be information for successful access authentication or information for failure of access authentication.
  • the non-trusted non-3GPP access network determines that the IP address allocated for the UE in step 903 is valid, and the non-trusted non-3GPP access network allows the UE to continue to use.
  • the IP address is connected to the network.
  • the non-trusted non-3GPP access network determines that the IP address allocated to the UE in step 903 is invalid, and the non-trusted non-3GPP access network prohibits the UE from using the The IP address is connected to the network.
  • Step 916 to step 919 The N3IWF network element and the UE complete the tunnel authentication process.
  • the N3IWF network element sends the result information of the tunnel authentication and the result information of the access authentication to the UE.
  • Step 920 The UE determines the validity of the IP address according to the result information of the access authentication.
  • the UE determines that the IP address allocated in step 903 is valid, and the UE continues to use the IP address to access the network.
  • the result of the access authentication is the information of the access authentication failure, the UE determines that the IP address allocated in step 903 is invalid, and the UE stops using the IP address to access the network.
  • FIG. 10 is a schematic diagram of an authentication apparatus according to an embodiment of the present application.
  • the authentication device includes a transceiver unit 1001, a processing unit 1002, and a storage unit 1003.
  • the transceiver unit 1001, the processing unit 1002, and the storage unit 1003 may be physically separate units, or may be integrated into one or more physical units, which is not limited herein.
  • the transceiver unit 1001 is configured to implement content interaction between the processing unit 1002 and other units or network elements.
  • the transceiver unit 1001 may be a communication interface of the authentication device, a transceiver circuit or a transceiver, or a transceiver.
  • the transceiver unit 1001 can also be a communication interface or a transceiver circuit of the processing unit 1002.
  • the transceiver unit 1001 can be a transceiver chip.
  • the authentication device may also include a plurality of transceiver units 1001, or the transceiver unit 1001 includes a plurality of sub-transceiver units.
  • the transceiver unit 1001 may further include a transmitting unit and a receiving unit for performing corresponding transmitting and receiving operations.
  • the processing unit 1002 is configured to implement processing of data by the authentication device.
  • Processing unit 1002 may be a processing circuit or a processor.
  • the processor may be a central processing unit (CPU), a network processor (NP) or a combination of a CPU and an NP.
  • the processor may further include a hardware chip.
  • the hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof.
  • the PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a Generic Array Logic (GAL), or any combination thereof.
  • CPLD complex programmable logic device
  • FPGA field-programmable gate array
  • GAL Generic Array Logic
  • the authentication device may also include a plurality of processing units or the processing unit 1002 includes a plurality of sub-data processing units.
  • the processor may be a single-CPU processor or a multi-core processor.
  • the storage unit 1003 is configured to store computer instructions executed by the processing unit 1002.
  • the storage unit 1003 may be a storage circuit or a memory.
  • the memory can be either volatile memory or non-volatile memory, or can include both volatile and nonvolatile memory.
  • the non-volatile memory may be a read-only memory (ROM), a programmable read only memory (ROMM), an erasable programmable read only memory (erasable PROM, EPROM), or an electrical Erase programmable EPROM (EEPROM) or flash memory.
  • the volatile memory can be a random access memory (RAM) that acts as an external cache.
  • the storage unit 1003 may be a unit that is independent of the processing unit 1002, or may be a storage unit in the processing unit 1002, which is not limited herein. Although only one storage unit 1003 is shown in FIG. 10, the authentication device may also include a plurality of storage units 1003 or the storage unit 1003 includes a plurality of sub storage units.
  • the processing unit 1002 can perform content interaction with other network elements through the transceiver unit 1001. For example, the processing unit 1002 acquires or receives content from other network elements. If the processing unit 1002 and the transceiver unit 1001 are physically separated components, the processing unit 1002 may perform content interaction with other units inside the authentication device without going through the transceiver unit 1001.
  • the transceiver unit 1001, the processing unit 1002, and the storage unit 603 can be connected to each other through a bus.
  • the bus can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus.
  • PCI peripheral component interconnect
  • EISA extended industry standard architecture
  • the bus can be divided into an address bus, a data bus, a control bus, and the like.
  • the processing unit 1002 causes the authentication device to implement the methods in the first to eighth embodiments of the present application according to computer instructions stored in the storage unit 1003.
  • the authentication device may be a data processing chip or a data processing chip module, such as a System on Chip (SoC).
  • SoC System on Chip
  • the authentication device may be an access network element, for example, an N3IWF network element or an access node.
  • the authentication device can also be a terminal device.
  • the transceiver unit 1001 is configured to receive access authentication information from the terminal device, and the processing unit 1002 is configured to perform access according to the access
  • the first information is generated by the authentication information
  • the first message includes the access authentication information
  • the transceiver unit 1001 is further configured to send the first message to the access management network element, and receive the access management network.
  • a first response message of the first message sent by the element the first response message includes response information of the access authentication information
  • the transceiver unit 1001 is further configured to: according to the first response message
  • the terminal device sends the response information of the access authentication information.
  • the first message is a non-access stratum NAS message or an N2 interface message, where the N2 interface is an interface between the authentication device and the access management network element.
  • the first response message includes indication information, where the indication information is used to indicate that the first response message is used for access authentication, and the processing unit is further configured to: according to the indication The information extracts response information of the access authentication information in the first response message.
  • the indication information is an access authentication indication or a message type.
  • the transceiver unit is further configured to send address information of the access network element to the terminal device.
  • the transceiver unit 1001 is configured to implement the content transceiving operation of the access network element and the external network element in the first embodiment of the present application.
  • the transceiver unit 1001 is further configured to implement content transceiving operations of the N3IWF network element and the external network element in the fourth embodiment to the seventh embodiment of the present application.
  • the processing unit 1002 is configured to implement the processing operation of the internal data or signaling of the access network element in the first embodiment of the present application.
  • the processing unit 1002 is configured to implement the operations of step 202 or step 205 in the first embodiment.
  • the processing unit 1002 is further configured to implement processing operations of internal data or signaling of the N3IWF network element in the fourth embodiment to the seventh embodiment of the present application.
  • the processing unit 1002 causes the authentication device to implement the access network element in the first embodiment of the present application or the N3IWF network element in the fourth embodiment to the seventh embodiment according to the computer instruction stored in the storage unit 1003.
  • the action performed for example:
  • the first response message includes indication information, where the indication information is used to indicate that the first response message is used for access authentication, and the processing unit 1002 is further configured to The computer instructions stored in the storage unit 1003 perform an operation of extracting response information of the access authentication information in the first response message according to the indication information.
  • the processing unit 1002 is further configured to: according to the computer instruction stored in the storage unit 1003, use the transceiver unit 1003 to send the access network element to the terminal device Address information.
  • the transceiver unit 1001 can be a communication interface of the authentication device
  • the processing unit 1002 can be a processor of the authentication device
  • the storage unit 1003 can be a memory of the authentication device.
  • the transceiver unit 1001 is configured to acquire address information of an access network element used for access authentication; and the processing unit 1002 is configured to select The process of the tunnel authentication initiated by the access network element corresponding to the address information.
  • the transceiver unit 1001 is configured to receive address information of the access network element sent by the access network element in an access authentication process.
  • the transceiver unit 1001 is configured to send identifier information of a public land mobile network PLMN where the authentication device is sent to the domain name system DNS; the transceiver unit 1001 is further configured to receive the domain name system according to the The address information of the access network element sent by the identifier information of the PLMN.
  • the processing unit 1002 is further configured to initiate an access authentication process to the access network element corresponding to the address information.
  • the transceiver unit 1001 is further configured to implement content transceiving operations of the UE and the external network element in the fourth to seventh embodiments of the present application.
  • the processing unit 1002 is further configured to implement processing operations of the internal data or signaling of the UE in the fourth to seventh embodiments of the present application.
  • the processing unit 1002 causes the authentication device to implement the operations performed by the UE in the fourth embodiment to the seventh embodiment of the present application, according to the computer instructions stored in the storage unit 1003, for example:
  • transceiver unit 1001 obtains, by the transceiver unit 1001, address information of an access network element used for access authentication, and selecting an access network element corresponding to the address information to initiate a tunnel authentication process.
  • the receiving, by the transceiver unit 1001, the address information of the access network element used for access authentication includes: receiving, by using the transceiver unit 1001, the Accessing the address information of the access network element sent by the network element.
  • the receiving, by the transceiver unit 1001, the address information of the access network element used for access authentication includes: the device that sends the authentication to the domain name system DNS by using the transceiver unit 1001. Identification information of the public land mobile network PLMN; receiving, by the transceiver unit 1001, address information of the access network element that is sent by the domain name system according to the identity information of the PLMN.
  • the processing unit 1002 is further configured to: according to the computer instruction stored in the storage unit 1003, use the transceiver unit 1001 to initiate an access network element corresponding to the address information. Access authentication process.
  • the transceiver unit 1001 can be the transceiver of the authentication device
  • the processing unit 1002 can be the processor of the authentication device
  • the storage unit 1003 can be the memory of the authentication device.
  • the transceiver unit 1001 is configured to receive connection establishment information from a terminal device, where the connection establishment information is used to establish the terminal device and the a connection of the access node; the processing unit 1002 is configured to allocate address information to the terminal device, where the address information is used to perform an authentication process; the transceiver unit 1001 is further configured to receive the template sent by the access gateway The result information of the weighting process, the result information of the authentication process includes result information of the access authentication; the processing unit 1002 is further configured to determine, according to the result information of the access authentication, that the address information of the terminal device is valid. Sex.
  • the result information of the access authentication is information that the access authentication succeeds
  • the processing unit 1002 is configured to determine, according to the information about the successful access authentication, the terminal device.
  • the address information is valid.
  • the result information of the access authentication is information that the access authentication fails, and the processing unit 1002 is configured to determine, according to the information about the access authentication failure, the terminal device.
  • the address information is invalid.
  • the transceiver unit 1001 is configured to implement the content transceiving operation of the access node and the external network element in the third embodiment of the present application.
  • the transceiver unit 1001 is further configured to implement the content transceiving operation of the non-trusted non-3GPP access network and the external network element in the eighth embodiment of the present application.
  • the processing unit 1002 is configured to implement the processing operation of the internal data or signaling of the access node in the third embodiment of the present application.
  • the processing unit 1002 is further configured to implement processing operations of internal data or signaling of the non-trusted non-3GPP access network in the eighth embodiment of the present application.
  • the processing unit 1002 causes the authentication device to implement the access node in the third embodiment of the present application and the non-trusted non-3GPP access network in the eighth embodiment. Operation, for example:
  • connection establishment information from the terminal device by using the transceiver unit 1001
  • the connection establishment information is used to establish a connection between the terminal device and the access node, and the address information is allocated to the terminal device by using the transceiver unit 1001.
  • the address information is used to perform an authentication process; the result of the authentication process sent by the access gateway is received by the transceiver unit 1001, and the result information of the authentication process includes result information of the access authentication;
  • the result information of the authentication device determines the validity of the address information of the terminal device.
  • the result information of the access authentication is information that the access authentication succeeds, and the determining, according to the result information of the access authentication, the validity of the address information of the terminal device,
  • the method includes: determining, according to the information about the success of the access authentication, that the address information of the terminal device is valid.
  • the result information of the access authentication is information that the access authentication fails
  • the determining, according to the result information of the access authentication, the validity of the address information of the terminal device includes: determining, according to the information that the access authentication fails, that the address information of the terminal device is invalid.
  • the transceiver unit 1001 can be a communication interface of the authentication device
  • the processing unit 1002 can be a processor of the authentication device
  • the storage unit 1003 can be a memory of the authentication device.
  • the transceiver unit 1001 is configured to acquire address information of the authenticated device; the transceiver unit 1001 is further configured to access the gateway. Sending tunnel authentication information, where the tunnel authentication information includes address information of the authenticated device; the transceiver unit 1001 is further configured to receive response information of the tunnel authentication information sent by the access gateway, where the tunnel authentication is performed.
  • the response information of the information includes the result information of the access authentication; the processing unit 1002 is configured to determine the validity of the address information of the authenticated device according to the result information of the access authentication.
  • the result information of the access authentication is information that the access authentication succeeds
  • the processing unit 1002 is configured to determine, according to the information about the successful access authentication, the authentication.
  • the address information of the device is valid.
  • the result information of the access authentication is information that the access authentication fails, and the processing unit 1002 is configured to determine, according to the information about the access authentication failure, the authentication.
  • the device's address information is invalid.
  • the transceiver unit 1001 is further configured to receive address information of the device that is sent by the access node.
  • the transceiver unit 1001 is further configured to implement the content transceiving operation of the UE and the external network element in the third embodiment and the eighth embodiment of the present application.
  • the processing unit 1002 is further configured to implement processing operations of internal UE data or signaling in the third embodiment and the eighth embodiment of the present application.
  • the processing unit 1002 causes the authentication device to implement the operations performed by the UE in the third embodiment and the eighth embodiment of the present application, according to the computer instructions stored in the storage unit 1003, for example:
  • the transceiver unit 1001 Acquiring the address information of the terminal device by using the transceiver unit 1001; transmitting, by the transceiver unit 1001, tunnel authentication information to the access gateway, where the tunnel authentication information includes address information of the authentication device;
  • the transceiver unit 1001 receives the response information of the tunnel authentication information sent by the access gateway, where the response information of the tunnel authentication information includes result information of the access authentication, and determines the information according to the result information of the access authentication.
  • the address information of the authentication device is valid.
  • the result information of the access authentication is information that the access authentication succeeds
  • the determining, according to the result information of the access authentication, the validity of the address information of the authentication device includes: determining, according to the information about the success of the access authentication, that the address information of the authentication device is valid.
  • the result information of the access authentication is information that the access authentication fails
  • the determining, according to the result information of the access authentication, the validity of the address information of the authentication device includes: determining, according to the information that the access authentication fails, that the address information of the authentication device is invalid.
  • the obtaining, by the transceiver unit 1001, the address information of the authentication device includes: receiving, by the transceiver unit 1001, address information of the authentication device sent by the access node.
  • the transceiver unit 1001 can be the transceiver of the authentication device
  • the processing unit 1002 can be the processor of the authentication device
  • the storage unit 1003 can be the memory of the authentication device.
  • the processing unit 1002 is configured to receive tunnel authentication information from the terminal device by using the transceiver unit 1001, where the tunnel authentication information includes The address information allocated by the ingress node to the terminal device; the processing unit 1002 is further configured to send the tunnel authentication information to the access management network element by using the transceiver unit 1001; the processing unit 1002 is configured to pass the The transceiver unit 1001 receives the response information of the tunnel authentication information sent by the access management network element, and the response information of the tunnel authentication information includes result information of the access authentication; the processing unit 1002 is configured to pass the The transceiver unit 1001 sends the response information of the tunnel authentication information to the terminal device.
  • the transceiver unit 1001 is further configured to implement the content transceiving operation of the N3IWF network element and the external network element in the third embodiment and the eighth embodiment of the present application.
  • the processing unit 1002 is further configured to implement processing operations of internal data or signaling of the N3IWF network element in the third embodiment and the eighth embodiment of the present application.
  • the processing unit 1002 causes the authentication device to implement the operations performed by the N3IWF network element in the third embodiment and the eighth embodiment of the present application, according to the computer instructions stored in the storage unit 1003.
  • the transceiver unit 1001 can be a communication interface of the authentication device
  • the processing unit 1002 can be a processor of the authentication device
  • the storage unit 1003 can be a memory of the authentication device.
  • the embodiment of the present application further provides a computer storage medium having instructions stored therein, when executed on a computer, causing the computer to execute any one of the foregoing embodiments 1 to 8.
  • the operation of the network element is not limited to.
  • the embodiment of the present application further provides a computer program product comprising instructions, which, when run on a computer, cause the computer to perform the operations of the network element in any one of the above-described Embodiments 1 to 8.
  • the names of request messages, response messages, and other various messages are employed for convenience of description. However, these messages are merely illustrative of the content to be carried or the functions to be carried.
  • the specific name of the message is not limited to the present application, for example, it may be a first message, a second message, a third message, or the like. These messages can be specific messages and can be some of the fields in the message. These messages can also represent various service operations.
  • the computer program product can include one or more computer instructions.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable device.
  • the computer instructions can be stored in a computer readable storage medium or transferred from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions can be from a website site, computer, server or data center Transfer to another website site, computer, server, or data center by wire (eg, coaxial cable, fiber optic, digital subscriber (DSL), or wireless (eg, infrared, wireless, microwave, etc.).
  • the computer readable storage medium can be any available media that can be accessed by a computer or a data storage device such as a server, data center, or the like that includes one or more available media.
  • the usable medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic disk), an optical medium (eg, a DVD), or a semiconductor medium (eg, a solid state disk (SSD)) or the like.
  • a magnetic medium eg, a floppy disk, a hard disk, a magnetic disk
  • an optical medium eg, a DVD
  • a semiconductor medium eg, a solid state disk (SSD)
  • the disclosed systems, devices, and methods may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the functions may be stored in a computer readable storage medium if implemented in the form of a software functional unit and sold or used as a standalone product.
  • the technical solution of the present application which is essential or contributes to the prior art, or a part of the technical solution, may be embodied in the form of a software product, which is stored in a storage medium, including
  • the instructions are used to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present application.
  • the foregoing storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read only memory, a random access memory, a magnetic disk, or an optical disk.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请实施例提供一种鉴权的方法和装置。该方法，包括：接入网元接收来自终端设备的接入鉴权信息；所述接入网元根据所述接入鉴权信息生成第一消息，所述第一消息包括所述接入鉴权信息；所述接入网元向接入管理网元发送所述第一消息；所述接入网元接收所述接入管理网元发送的所述第一消息的第一响应消息，所述第一响应消息包括所述接入鉴权信息的响应信息；所述接入网元根据所述第一响应消息向所述终端设备发送所述接入鉴权信息的响应信息。本申请实施例的方法可以解决不同网元鉴权信息的传输协议不适配的问题。

Description

鉴权的方法和装置
本申请要求在2017年11月20日提交中国国家知识产权局、申请号为201711158711.1、发明名称为“鉴权的方法和装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请实施例涉及通信领域，更具体地，涉及一种鉴权的方法和装置。
背景技术
在第五代(5rd generation，5G)通信网络中，允许终端设备通过非第三代合作伙伴计划(3rd generation partnership project,3GPP)接入网接入核心网。然而，由于5G通信网络和4G通信网络的架构不同，现有的终端设备的接入鉴权的方法并不适用于5G通信网络。
发明内容
本申请实施例提供一种鉴权的方法和装置，能够应用于新一代的通信网络。
本申请的第一方面，提供了一种鉴权的方法，包括：接入网元接收来自终端设备的接入鉴权信息；所述接入网元根据所述接入鉴权信息生成第一消息，所述第一消息包括所述接入鉴权信息；所述接入网元向接入管理网元发送所述第一消息；所述接入网元接收所述接入管理网元发送的所述第一消息的第一响应消息，所述第一响应消息包括所述接入鉴权信息的响应信息；所述接入网元根据所述第一响应消息向所述终端设备发送所述接入鉴权信息的响应信息。本申请实施例中的方法可以解决不同网元鉴权信息的传输协议不适配的问题。
在第一方面的第一种可能的实现方式中，所述第一消息为非接入层NAS消息或者N2接口消息，其中，所述N2接口为所述接入网元和所述接入管理网元之间的接口。
在第一方面的第二种可能的实现方式中，所述第一响应消息包括指示信息，所述指示信息用于指示所述第一响应消息用于接入鉴权；所述接入网元根据所述第一响应消息向所述终端设备发送所述接入鉴权信息的响应信息，包括：所述接入网元根据所述指示信息提取所述第一响应消息中的所述接入鉴权信息的响应信息；所述接入网元向所述终端设备发送所述接入鉴权信息的响应信息。
结合第一方面的第二种可能的实现方式，在第一方面的第三种可能的实现方式中所述指示信息为接入鉴权指示或者消息类型。
在第一方面任意一种可能的实现方式中，所述方法还包括所述接入网元向所述终端设备发送所述接入网元的地址信息。
本申请的第二方面，提供了一种鉴权的方法，包括：终端设备获取用于接入鉴权的接入网元的地址信息；所述终端设备选择所述地址信息对应的接入网元发起隧道鉴权的流程。在本实施例中，终端设备选择接入鉴权过程中的接入网元发起隧道鉴权的流程，可以简化接入鉴权和隧道鉴权的流程。
在第二方面的第一种可能的实现方式中，所述终端设备获取用于接入鉴权的接入网元的地址信息，包括：在接入鉴权过程中，所述终端设备接收所述接入网元发送的所述接入网元的地址信息。
在第二方面的第二种可能的实现方式中，终端设备获取用于接入鉴权的接入网元的地址信息，包括：所述终端设备向域名系统DNS发送所述终端设备所在的公共陆地移动网 络PLMN的标识信息；所述终端设备接收所述域名系统根据PLMN的标识信息发送的所述接入网元的地址信息。
在第二方面任意一种可能的实现方式中，所述终端设备选择所述地址信息对应的接入网元发起隧道鉴权的流程之前，所述方法还包括：所述终端设备向所述地址信息对应的接入网元发起接入鉴权流程。
本申请的第三方面，提供了一种鉴权的方法，包括：接入节点接收来自终端设备的连接建立信息，所述连接建立信息用于建立所述终端设备与所述接入节点的连接；所述接入节点向所述终端设备分配地址信息，所述地址信息用于执行鉴权过程；所述接入节点接收接入网关发送的所述鉴权过程的结果信息，所述鉴权过程的结果信息包括接入鉴权的结果信息；所述接入节点根据所述接入鉴权的结果信息确定所述终端设备的地址信息有效性。在本申请的实施例中，接入鉴权和隧道鉴权同步进行，从而简化了鉴权流程。
在第三方面的第一种可能的实现方式中，所述接入鉴权的结果信息为接入鉴权成功的信息，所述接入节点根据所述接入鉴权的结果信息确定所述终端设备的地址信息有效性，包括：所述接入节点根据所述接入鉴权成功的信息确定所述终端设备的地址信息有效。
在第三方面的第二种可能的实现方式中，所述接入鉴权的结果信息为接入鉴权失败的信息，所述接入节点根据所述接入鉴权的结果信息确定所述终端设备的地址信息有效性，包括：所述接入节点根据所述接入鉴权失败的信息确定所述终端设备的地址信息无效。
本申请的第四方面，提供了一种鉴权的方法，包括：终端设备获取所述终端设备的地址信息；所述终端设备向接入网关发送隧道鉴权信息，所述隧道鉴权信息包括所述终端设备的地址信息；所述终端设备接收所述接入网关发送的隧道鉴权信息的响应信息，所述隧道鉴权信息的响应信息包括接入鉴权的结果信息；所述终端设备根据所述接入鉴权的结果信息确定所述终端设备的地址信息有效性。
在第四方面的第一种可能的实现方式中，所述接入鉴权的结果信息为接入鉴权成功的信息，所述终端设备根据所述接入鉴权的结果信息确定所述终端设备的地址信息有效性，包括：所述终端设备根据所述接入鉴权成功的信息确定所述终端设备的地址信息有效。
在第四方面的第二种可能的实现方式中，所述接入鉴权的结果信息为接入鉴权失败的信息，所述终端设备根据所述接入鉴权的结果信息确定所述终端设备的地址信息有效性，包括：所述终端设备根据所述接入鉴权失败的信息确定所述终端设备的地址信息无效。
在第四方面的任意一种可能的实现方式中，所述终端设备获取所述终端设备的地址信息，包括：所述终端设备接收接入节点发送的所述终端设备的地址信息。
本申请的第五方面，提供了一种鉴权的方法，包括：接入网关接收来自终端设备的隧道鉴权信息，所述隧道鉴权信息包括接入节点为所述终端设备分配的地址信息；所述接入网关向接入管理网元发送所述隧道鉴权信息；所述接入网关接收所述接入管理网元发送的所述隧道鉴权信息的响应信息，所述隧道鉴权信息的响应信息包括接入鉴权的结果信息；所述接入网关向所述终端设备发送所述隧道鉴权信息的响应信息。
本申请的第六方面，提供了一种鉴权装置，包括：处理单元和收发单元；所述收发单元用于接收来自终端设备的接入鉴权信息；所述处理单元用于根据所述接入鉴权信息生成第一消息，所述第一消息包括所述接入鉴权信息；所述收发单元还用于向接入管理网元发送所述第一消息，接收所述接入管理网元发送的所述第一消息的第一响应消息，所述第一响应消息包括所述接入鉴权信息的响应信息；所述收发单元还用于根据所述第一响应消息向所述终端设备发送所述接入鉴权信息的响应信息。
本申请的第七方面，提供了一种鉴权装置，包括：处理单元和收发单元，所述收发单元用于获取用于接入鉴权的接入网元的地址信息；所述处理单元用于选择所述地址信息对应的接入网元发起隧道鉴权的流程。
本申请的第八方面，提供了一种鉴权装置，包括：处理单元和收发单元，所述收发单元用于接收来自终端设备的连接建立信息，所述连接建立信息用于建立所述终端设备与所 述接入节点的连接；所述处理单元用于向所述终端设备分配地址信息，所述地址信息用于执行鉴权过程；所述收发单元还用于接收接入网关发送的所述鉴权过程的结果信息，所述鉴权过程的结果信息包括接入鉴权的结果信息；所述处理单元还用于根据所述接入鉴权的结果信息确定所述终端设备的地址信息有效性。
本申请的第九方面，提供了一种鉴权装置，处理单元和收发单元，所述收发单元用于获取所述鉴权的装置的地址信息；所述收发单元还用于向接入网关发送隧道鉴权信息，所述隧道鉴权信息包括鉴权的装置的地址信息；所述收发单元还用于接收所述接入网关发送的隧道鉴权信息的响应信息，所述隧道鉴权信息的响应信息包括接入鉴权的结果信息；所述处理单元用于根据所述接入鉴权的结果信息确定所述鉴权的装置的地址信息有效性。
本申请的第十方面，提供了一种鉴权装置，包括：处理单元和收发单元，所述处理单元用于通过所述收发单元接收来自终端设备的隧道鉴权信息，所述隧道鉴权信息包括接入节点为所述终端设备分配的地址信息；所述处理单元还用于通过所述收发单元向接入管理网元发送所述隧道鉴权信息；所述处理单元用于通过所述收发单元接收所述接入管理网元发送的所述隧道鉴权信息的响应信息，所述隧道鉴权信息的响应信息包括接入鉴权的结果信息；所述处理单元用于通过所述收发单元向所述终端设备发送所述隧道鉴权信息的响应信息。
本申请的第十一方面，提供了一种计算机存储介质，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行上述第一方面到第五方面以及各种可能的实现方式中的任何一种方法。
本申请的第十二方面，提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述第一方面到第五方面以及各种可能的实现方式中的任何一种方法。
附图说明
图1a是实现本申请实施例的一种通信系统的示意图。
图1b是实现本申请实施例的另一种通信系统的示意图。
图2是本申请的鉴权方法的第一实施例的示意性流程图。
图3是本申请的鉴权方法的第二实施例的示意性流程图。
图4是本申请的鉴权方法的第三实施例的示意性流程图。
图5是本申请的鉴权方法的第四实施例的示意性流程图。
图6是本申请的鉴权方法的第五实施例的示意性流程图。
图7是本申请的鉴权方法的第六实施例的示意性流程图。
图8是本申请的鉴权方法的第七实施例的示意性流程图。
图9是本申请的鉴权方法的第八实施例的示意性流程图。
图10是本申请实施例的鉴权装置的示意图。
具体实施方式
本申请实施例可以用于5G或者下一代网络、固定网络，家庭基站网络，企业网络，MulteFire网络，非3GPP(如wifi)接入的移动网络等。
在本申请的实施例中，终端设备包括但不限于：用户设备(user equipment,UE)、用户单元、用户站、移动站、移动台、远方站、远程终端设备、移动终端设备、用户终端设备、终端设备、无线通信设备、用户代理、用户装置、蜂窝电话、无绳电话、会话启动协议(session  initiation protocol,SIP)电话、无线本地环路(wireless local loop,WLL)站、个人数字处理(personal digital assistant，PDA)、具有无线通信功能的手持设备、计算设备、连接到无线调制解调器的处理设备、车载设备、可穿戴设备、物联网中的终端设备设备、家用电器、虚拟现实设备、未来5G网络中的终端设备设备或者未来演进的公共陆地移动网络(public land mobile network，PLMN)中的终端设备等。本申请的各实施例中，以终端设备为UE进行举例说明。
图1a是能够实现本申请实施例的一种通信系统的示意图。在该通信系统中，UE通过非可信(Untrusted)非3GPP接入网(acess network,AN)接入核心网(Core Network,CN)。
核心网网元可以包括：用户面功能(user plane function，UPF)网元、接入和移动性管理功能(access and mobility management function，AMF)网元、会话管理功能(session management function，SMF)网元和鉴权服务功能(authentication server function,AUSF)网元。通过非可信非3GPP接入网，非3GPP互通功能(non-3GPP Interworking Function，N3IWF)网元和用户面功能网元，可以实现UE和数据网络(Data Network,DN)之间用户面数据的传输。其中，N3IWF网元可以是非可信非3GPP接入网接入核心网的网关。N3IWF网元可以是一个单独的网元，N3IWF网元也可以设置在接入网设备或者核心网网元中，在此不做限定。AMF网元用于移动性管理、合法监听、或者接入授权以及鉴权等。SMF网元用于实现会话和承载管理、地址分配等。AUSF网元用于实现对UE的鉴权和认证。在本实施例中，各网元可以通过图1a所示的接口通信连接。
可以理解的是，在图1a所示的通信系统中，各网元的功能以及接口仅为示例性的，各个网元在应用于本申请的实施例中时，并非全部功能都是必需的。核心网网元的全部或者部分网元可以是物理上的实体网元，也可以是虚拟化的网元，在此不做限定。
图1b是能够实现本申请实施例的另一种通信系统的示意图。在该通信系统中，UE通过5G MulteFire(MF)网络接入移动网络运营商(Mobile Network Operator,MNO)网络。
其中，UE通过MulteFire接入网(MF AN)接入MulteFire核心网。MulteFire核心网也可以称为中立主机(Neutral Host,NH)核心网。MulteFire核心网网元包括：NH-UPF网元,NH-AMF网元,NH-SMF网元和中立主机鉴权，授权，计费(Neutral Host Authentication,Authorization,Accounting,NH-AAA)网元。NH-UPF网元,NH-AMF网元,NH-SMF网元和NH-AAA网元与运营商网络中对应的网元功能类似，在此不再详述。MNO网络包括：N3IWF网元和AMF网元。在本实施例中，各网元可以通过图1b所示的接口通信连接。可以理解的是，在图1b所示的通信系统中，各网元的功能以及接口仅为示例性的，各个网元在应用于本申请的实施例中时，并非全部功能都是必需的。核心网网元的全部或者部分网元可以是物理上的实体网元，也可以是虚拟化的网元，在此不做限定。
在本申请的实施例中，接入鉴权是指对UE能否接入接入网进行鉴权认证，例如：对UE能否接入WIFI网络进行鉴权认证。隧道鉴权是指对UE能否通过隧道技术接入到核心网进行鉴权认证。
在本申请的实施例中，“和/或”仅仅是一种描述关联对象的关联关系，表示可以存在三种关系。例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，在本申请的描述中，“多个”是指两个或多于两个。
在本申请的实施例中，某一网元(例如：A网元)获取来自另一网元(例如：B网元)的信息，可以指A网元直接从B网元接收信息，也可以指A网元经其他网元(例如：C网元)从B网元接收信息。当A网元经C网元从B网元接收信息时，C网元可以对信息进行透传，也可以将信息进行处理，例如：将信息携带在不同的消息中进行传输或者对信息进行提取，只发送提取后的信息给A网元。类似的，在本申请的各实施例中，A网元向B网元发送信息，可以指A网元直接向B网元发送信息，也可以指A网元经其他网元(例如：C网元)向B网元发送信息。
图2是本申请的鉴权方法的第一实施例的示意性流程图。本实施例的方法可以应用于 图1a和图1b所示的系统，也可以应用于其他通信系统，例如：UE通过有线传输网络(固定网络)或者可信非3GPP接入网接入运营商网络的通信系统，在此不做限定。具体的，该鉴权方法包括：
步骤201：终端设备向接入网元发送接入鉴权信息。
终端设备可以是图1a和图1b中的UE。当本实施例的方法应用于非可信非3GPP接入网或者MulteFire网络时，接入网元可以是图1a和图1b中的N3IWF网元。在一种可能的实现方式中，当本实施例的方法应用于有线传输网络时，接入网元可以是宽带网络网关(Broadband Network Gateway,BNG)或者固定移动互通功能(Fixed Mobile Interworking Function)网元或者接入网关功能(Access Gateway Function)网元或者有线接入节点(Wireline Access Node)。在另一种可能的实现方式中，当本实施例的方法应用于可信非3GPP接入网或者有线传输网络时，接入网元可以是接入节点，例如：基站设备或者可信WLAN接入节点，在此不做限定。
对应的，接入鉴权信息可以是扩展认证协议(extensible authentication protocol,EAP)信息，也可以是点对点协议(Pointto Point Protocol,PPP)信息，例如：基于以太网的点对点协议(Pointto Point Protocol over Ethernet,PPPoE)信息。接入鉴权信息还可以是802.1X认证消息，或者网页认证消息。
步骤202：接入网元根据接收到的接入鉴权信息生成第一消息。
在现有的5G通信网络中，由于接入管理网元(例如：AMF网元)只能接收非接入层(non-access stratum,NAS)传输的鉴权信息，与传统的鉴权信息的传输协议不适配，因此，本步骤中，接入网元根据接收到的接入鉴权信息生成第一消息。第一消息包括步骤201中接收到的接入鉴权信息。
第一消息可以是NAS消息。该NAS消息可以是一个专门用于传输接入鉴权信息的NAS消息，也可以是现有的NAS消息，在此不做限定。NAS消息中可以包括指示信息。该指示信息用于指示该第一消息用于接入鉴权。指示信息可以是接入鉴权指示或者消息类型。
具体的，当第一消息是一个专门用于传输接入鉴权信息的NAS消息时，该NAS消息的头信息中包括消息类型(message type)。该消息类型可以是Acess Authentication，用于指示该NAS消息用于接入鉴权。例如：该NAS消息可以采用表1所示的头信息。
表1
Figure PCTCN2018116066-appb-000001
当第一消息为现有的NAS消息(例如：附着请求消息)时，该NAS消息的头信息中包括接入鉴权指示(Acess Authentication Indication)。例如：在附着请求(attach request)消息的头信息中增加接入鉴权指示，如表2。
表2
Figure PCTCN2018116066-appb-000002
第一消息可以是N2接口消息，在本申请的各实施例中，简称为N2消息。具体的,在3GPP协议中，N2接口可以为N2-AP。该N2消息可以是一个专门用于传输接入鉴权信息的N2消息，也可以是现有的N2消息，在此不做限定。N2消息中可以包括指示信息。该指示信息用于指示该第一消息用于接入鉴权。指示信息可以是接入鉴权指示或者消息类型。
具体的，当第一消息是一个专门用于传输接入鉴权信息的N2消息时，该N2消息的头信息中包括消息类型(message type)。该消息类型可以是Acess Authentication，用于指示该N2消息用于接入鉴权。例如：该N2消息可以采用表3所示的头信息。
表3
Figure PCTCN2018116066-appb-000003
当第一消息为现有的N2消息时，该N2消息的头信息中包括接入鉴权指示(Acess Authentication Indication)，如表4所示。
表4
IE/Group Name Presence
Message Type M
AMF UE NGAP ID M
gNB UE NGAP ID M
Access Authentication Indication  
EAP payload M
在一种可能的实现方式中，接入网元可以将接收到的接入鉴权信息携带在第一消息的载(payload)中。接入鉴权信息可以是EAP-RSP/Identity或者EAP-RSP/AKA’-Challenge，详见现有技术，在此不再详述。
步骤203：接入网元向接入管理网元发送生成的第一消息。
接入管理网元可以是图1a和图1b中的AMF网元。第一消息用于接入鉴权。
接入管理网元可以根据第一消息中的指示信息获知该消息用于接入鉴权。接入管理网元可以根据接收到的第一消息中的接入鉴权信息向AUSF网元进行鉴权，并接收AUSF网元发送的接入鉴权信息的响应信息。接入管理网元向AUSF网元进行鉴权的流程详见现有技术的描述，在此不做详述。
步骤204：接入管理网元向接入网元发送第一消息的第一响应消息。
第一响应消息包括接入鉴权信息的响应信息。接入鉴权信息的响应信息可以是EAP-RQ/AKA’-Challenge，也可以是EAP-Success/MSK，详见现有技术，在此不再详述。
接入管理网元可以根据接收到的接入鉴权信息的响应信息生成第一响应消息。第一响应消息可以是NAS消息。该NAS消息可以是一个专门用于传输接入鉴权信息的NAS消息，也可以是现有的NAS消息。NAS消息中可以包括指示信息。该指示信息用于指示该第一消息用于接入鉴权。该指示信息可以是接入鉴权指示或者消息类型，具体参见步骤202的描述。第一响应消息还可以是N2消息。该N2消息可以是一个专门用于传输接入鉴权信息的N2消息，也可以是现有的N2消息，在此不做限定。N2消息中可以包括指示信息。该指示信息用于指示该第一响应消息用于接入鉴权。该指示信息可以是接入鉴权指示或者消息类型，具体参见步骤202的描述。
第一响应消息携带接入鉴权信息的响应信息。
步骤205：接入网元从第一响应消息中提取接入鉴权信息的响应信息。
接入网元接收到第一响应消息后，从第一响应消息中提取接入鉴权信息的响应信息。
具体的，接入网元根据第一响应消息中携带的指示信息提取接入鉴权信息的响应信息。例如：若第一响应消息的类型为Acess Authentication或者第一响应消息中携带Acess Authentication Indication，则接入网元删除该第一响应消息的头信息，从而获得接入鉴权信 息的响应信息。
步骤206：接入网元向终端设备发送接入鉴权信息的响应信息。
接入网元将提取的接入鉴权信息的响应信息发送给终端设备。
在本申请的实施例中，接入网元在接入鉴权的过程中，接收来自终端设备的接入鉴权信息，根据所述接入鉴权信息生成用于接入鉴权的第一消息，从而可以解决现有技术中不同网元鉴权信息的传输协议不适配的问题。
在一种可能的实现方式中，接入网元向终端设备发送的接入鉴权信息的响应信息中，可以包括接入网元的地址信息。该地址信息可以是接入网元的因特网协议(Internet Protocol,IP)地址。在隧道鉴权的过程中，终端设备选择该地址信息对应的接入网元发起隧道鉴权的流程。当然，接入网元也可以通过单独的一条消息或者在其他消息中携带该接入网元的地址信息，在此不做限定。
在图1a的通信系统中，在接入鉴权的过程中，非可信非3GPP接入网选择对应的N3IWF网元进行接入鉴权。在图1b的通信系统中，在接入鉴权的过程中，NH-AAA网元选择对应的N3IWF网元进行接入鉴权。然而，在接入鉴权结束后，UE选择N3IWF网元进行隧道鉴权。在两次鉴权过程中，由于不同的网元选择的N3IWF网元可能不同，增加了系统的复杂性，例如：AMF网元需要记录两个不同的N3IWF网元。
图3是本申请的鉴权方法的第二实施例的示意性流程图。本实施例的方法可以应用于图1a和图1b所示的系统，也可以应用于其他通信系统，例如：UE通过固定网络接入运营商网络的通信系统，在此不做限定。具体的，该鉴权方法包括：
步骤301：终端设备获取用于接入鉴权的接入网元的地址信息。
在一种可能的实现方式中，终端设备可以在接入鉴权前，获取接入网元的地址信息。例如：终端设备向域名系统(Domain Name System,DNS)发送终端设备所在的公共陆地移动网络(Public Land Mobile Network,PLMN)的标识信息。终端设备接收域名系统根据PLMN的标识信息发送的接入网元的地址信息。当终端设备接收到域名系统发送的多个接入网元对应的地址信息时，终端设备可以从多个接入网元中选择一个接入网元。终端设备选择接入网元的流程可以参见详见现有技术。终端设备获得接入网元的地址信息后，在发起接入鉴权的过程中，可以携带该接入网元的地址信息，从而可以选择该地址信息对应的接入网元进行接入鉴权。
在另一种可能的实现方式中，终端设备可以在接入鉴权过程中，获取接入网元的地址信息。具体的，在接入鉴权过程中，当用于接入鉴权的接入网元确定后，接入网元将该接入网元的地址信息发送给终端设备。例如：接入网元向终端设备发送的接入鉴权信息的响应信息中，可以包括接入网元的地址信息，具体参见图2实施例的描述。又例如：在图1a所示的系统中，当非可信非3GPP接入网选择用于接入鉴权的N3IWF网元后，非可信非3GPP接入网将选择的N3IWF网元的地址信息发送给终端设备；或者，在图1b所示的系统中，当NH-AAA网元选择用于接入鉴权的N3IWF网元后，NH-AAA网元将选择的N3IWF网元的地址信息发送给终端设备。
步骤302：终端设备选择接收到的地址信息对应的接入网元发起隧道鉴权的流程。
终端设备发起隧道鉴权的流程具体参见现有技术，在此不再详述。
在本申请的实施例中，接入网元向终端设备发送接入网元的地址信息。在隧道鉴权的过程中，终端设备选择该地址信息对应的接入网元发起隧道鉴权的流程，从而可以避免在两次鉴权过程中，选择的接入网元不同的问题，进而可以简化系统复杂性。
图4是本申请的鉴权方法的第三实施例的示意性流程图。本实施例的方法可以应用于图1a和图1b所示的系统，也可以应用于其他通信系统，例如：UE通过固定网络接入运营商网络的通信系统，在此不做限定。具体的，该鉴权方法包括：
步骤401：终端设备向接入节点发送连接建立信息。该连接建立信息用于建立所述终端设备与所述接入节点的连接。
在本申请的实施例中，接入节点可以是接入网设备。接入节点可以为特定的地理区域提供通信覆盖，并且可以与位于该覆盖区域(小区)内的终端设备进行通信。接入节点可以与任意数目终端设备通信。接入节点与终端设备之间可以有多个空口连接，例如，接入节点与终端设备之间存在两个空口连接，分别用于传输数据流A和数据流B。接入节点可以支持不同制式的通信协议，或者可以支持不同的通信模式。例如，该接节点可以是演进型基站(evolved node B，eNodeB)，或者是无线保真接入点(wireless fidelity access point，WiFi AP)、或者是全球微波接入互操作性基站(worldwide interoperability for microwave access base station，WiMAX BS)，或者是云无线接入网络(cloud radio access network，CRAN)中的无线控制器，固定接入网络中的接入设备，或者为未来5G网络中的接入设备或者未来演进PLMN中的接入设备等。
在本实施例中，当该方法应用于可信或者非可信非3GPP网络时，该连接建立消息可以是无线局域网(Wireless Local Area Network,WLAN)连接建立消息；当该方法应用于Multefire网络时，该连接建立消息可以是附着请求消息；当应用于固定网络时，该连接建立消息可以为PPP连接消息。
步骤402：接入节点向终端设备分配地址信息。
接入节点在接收到终端设备发送的连接建立信息后，为终端设备分配地址信息。可选的，该地址信息可以是一个临时的地址信息。该地址信息可以是IP地址。该地址信息用于执行鉴权过程。
终端设备可以通过该地址信息接入接入网和核心网。
步骤403：接入节点向终端设备发送分配的地址信息。
在本申请的实施例中，终端设备通过步骤401、步骤402和步骤403获取所述终端设备的地址信息具体的方法可以参见现有技术。
步骤404：终端设备向接入网关发送隧道鉴权信息。
该隧道鉴权信息包括接入节点为终端设备分配的地址信息。该隧道鉴权信息还可以包括终端设备的标识信息。
在本申请的实施例中，当本实施例的方法应用于非可信非3GPP网络时，接入网关可以是图1a中的N3IWF网元，接入节点可以是图1a中的非可信非3GPP接入网；当本实施例的方法应用于可信非3GPP网络或者固定网络时，接入网关可以设置于接入节点中，即该接入网元也可以是接入节点，在此不做限定。
步骤405：接入网关向接入管理网元发送隧道鉴权信息。
接入网关接收到终端设备发送的隧道鉴权信息后，接入网关向接入管理网元发送隧道鉴权信息。
在一种可能的实现方式中，接入网关从终端设备发送的消息中提取隧道鉴权信息，然后将提取的隧道鉴权信息发送给接入管理网元。
步骤406：接入管理网元向接入网关发送隧道鉴权信息的响应信息。
接入管理网元接收到接入网关发送的隧道鉴权信息后，可以将隧道鉴权相关的信息发送给AUSF网元。AUSF网元完成对该终端设备的鉴权认证。具体的，AUSF网元可以根据隧道鉴权信息中的用户标识信息对该终端设备进行隧道和接入鉴权鉴权认证。AUSF网元向接入管理网元发送隧道鉴权信息的响应信息。隧道鉴权信息的响应信息包括接入鉴权的结果信息。隧道鉴权信息的响应信息还可以包括隧道鉴权的结果信息。在本申请的实施例中，隧道鉴权信息的响应信息也可以称为鉴权过程的结果信息。AUSF网元向接入管理网元发送的隧道鉴权信息的响应信息可以携带在AAA消息中。
接入管理网元接收AUSF网元发送的鉴权过程的结果信息。该鉴权过程的结果信息包括接入鉴权的结果信息。
在一种可能的实现方式中，隧道鉴权信息的响应信息也可以是隧道鉴权的结果信息，该隧道鉴权的结果信息包括接入鉴权的结果信息。接入管理网元将该隧道鉴权信息的响应 信息发送给接入网关。
具体的，接入管理网元可以从AUSF网元发送的消息中提取隧道鉴权信息的响应信息，然后将提取的隧道鉴权信息的响应信息发送给接入网关。
在一种可能的实现方式中，接入鉴权的结果信息也可以不携带在隧道鉴权信息的响应信息中，而是通过其他消息发送给接入网关，在此不做限定。
步骤407：接入网关向接入节点发送隧道鉴权信息的响应信息。
接入网关接收到接入管理网元发送的隧道鉴权信息的响应信息后，可以将该隧道鉴权信息的响应信息发送给接入节点。
具体的，接入网关可以从接入管理网元发送的消息中提取隧道鉴权信息的响应信息，然后将提取的隧道鉴权信息的响应信息发送给接入网关。接入网关也可以将隧道鉴权信息的响应信息携带在其他消息中发送接入网关，在此不做限定。
步骤408：接入节点根据接入鉴权的结果信息确定终端设备的地址信息有效性。
具体的，接入节点根据隧道鉴权信息的响应信息中携带的接入鉴权的结果信息确定终端设备的地址信息有效性。
接入鉴权的结果信息可以为接入鉴权成功的信息或者接入鉴权失败的信息。
当接入鉴权的结果信息为接入鉴权成功的信息时，接入节点确定为终端设备分配的地址信息有效，接入节点允许终端设备继续使用该地址信息接入网络。当接入鉴权的结果信息为接入鉴权失败的信息时，接入节点确定为终端设备分配的地址信息无效，接入节点禁止终端设备继续使用该地址信息接入网络。
步骤409：接入节点向终端设备发送隧道鉴权信息的响应信息。
在本实施例中，步骤408和步骤409的执行先后顺序不做限定，也可以先执行步骤409再执行步骤408。
步骤410：终端设备根据接入鉴权的结果信息确定终端设备的地址信息有效性。
具体的，终端设备根据隧道鉴权信息的响应信息中携带的接入鉴权的结果信息确定终端设备的地址信息有效性。
接入鉴权的结果信息可以为接入鉴权成功的信息或者接入鉴权失败的信息。
当接入鉴权的结果信息为接入鉴权成功的信息时，终端设备确定接入节点分配的地址信息有效，终端设备继续使用该地址信息接入网络。当接入鉴权的结果信息为接入鉴权失败的信息时，终端设备确定接入节点分配的地址信息无效，终端设备停止使用该地址信息接入网络。
在本实施例一种可能的实现方式中，终端设备获取接入节点分配的地址信息后，终端设备在鉴权消息的数据包中携带该地址信息作为数据的源地址。
本实施例中，关于隧道鉴权的步骤404、步骤405、步骤406、步骤407以及步骤409的流程可以详见现有的隧道鉴权的流程。
在本实施例中，接入节点预先为终端设备分配地址信息，利用该地址信息执行鉴权过程。由于隧道鉴权和接入鉴权同步进行，简化了鉴权流程。
图5是本申请的鉴权方法的第四实施例的示意性流程图，本实施例的方法在图1b的架构的基础上详细说明。
步骤501：UE向NH-AMF网元发送附着请求。
在该步骤中，UE也可以向NH-AMF网元发送注册请求。
步骤502：NH-AMF网元通过NAS消息发送EAP-RQ/Identity信息给UE。
该消息为EAP请求消息，用于发起EAP接入鉴权流程。该消息还用于向UE请求UE ID。
步骤503：UE通过NAS消息向NH-AMF网元发送EAP-RSP/Identity信息。
该消息为EAP响应消息。该消息中携带UE ID。
步骤504和步骤505：NH-AMF网元通过NH-AAA网元向N3IWF网元发送 EAP-RSP/Identity信息。
具体的，NH-AMF网元可以从NAS消息中提取EAP-RSP/Identity信息，然后将该信息通过AAA消息发送给NH-AAA网元。NH-AAA网元将该AAA消息发送给N3IWF网元，从而将UE ID发送给N3IWF网元。
步骤506：N3IWF网元生成用于传输EAP信息的NAS消息，将步骤505中接收的AAA消息携带在该NAS消息中发送给AMF网元。
该NAS消息中包括指示信息，用于指示该NAS消息用于接入鉴权。
在另一种可能的实现方式中，N3IWF网元生成用于传输EAP信息的N2消息，将步骤505中接收的AAA消息携带在该N2消息中发送给AMF网元。
该NAS消息或N2消息可以是步骤202中的第一消息，具体参见步骤202的描述。
步骤507：N3IWF网元将生成的NAS消息发送给AMF网元。
步骤508：AMF网元根据接收到的NAS消息向AUSF网元请求鉴权向量。
AMF网元可以根据NAS消息中的指示信息，获知该NAS消息用于接入鉴权。AMF网元根据NAS消息中的接入鉴权信息(EAP-RSP/Identity)向AUSF网元请求鉴权向量。
AMF网元根据接入鉴权信息向AUSF网元请求鉴权向量的过程可以参见现有技术，在此不做描述。
步骤509～步骤511：AUSF生成鉴权向量，并将鉴权向量发送给AMF网元。
AUSF生成鉴权的过程可以参见现有技术，在此不做描述。
步骤512：AMF网元根据接收到的鉴权向量，获取主安全密钥(master security key,MSK)。
AMF网元根据鉴权向量获取MSK的方法可以参见现有技术，在此不做描述。
步骤513：AMF生成用于传输EAP信息的NAS消息，并将该NAS消息发送给N3IWF网元。
该NAS消息中包括指示信息，用于指示该NAS消息用于接入鉴权。
具体的，NAS消息中包括AAA消息，该AAA消息包括挑战请求信息(EAP-RQ/AKA’-Challenge)信息。
在另一种可能的实现方式中，AMF生成用于传输EAP信息的N2消息，并在该N2消息中将挑战请求信息发送给N3IWF网元。
该NAS消息或N2消息可以是步骤204中的第一响应消息，具体参见步骤204的描述，在此不再详述。
步骤514：N3IWF网元提取NAS消息中的AAA消息。
具体的，N3IWF网元可以根据NAS消息中的指示信息识别出接收到的NAS消息是用于接入鉴权的。N3IWF网元可以将该NAS消息的头信息删除，从而获得该NAS消息中的挑战请求信息。挑战请求信息可以认为是步骤205中的鉴权信息的响应信息。本步骤具体参见步骤205的描述，在此不做详述。
在另一种可能的实现方式中，N3IWF网元也可以从N2消息中提取AAA消息。
步骤515～步骤516：N3IWF网元通过NH-AAA网元向NH-AMF网元发送挑战请求信息。
N3IWF网元向NH-AMF网元发送挑战请求信息的步骤详见现有技术，在此不再详述。
在一种可能的实现方式中，N3IWF网元还可以向NH-AMF网元发送该N3IWF网元的IP地址。具体的，N3IWF网元在发送的AAA消息中包括挑战请求的信息和N3IWF网元的IP地址。
步骤517：N3IWF网元向UE发送挑战请求信息。
N3IWF网元可以从接收到的AAA消息中提取挑战请求信息，然后将该挑战请求信息携带在NAS消息中发送给UE。
在一种可能的实现方式中，N3IWF网元可以从接收到的AAA消息中提取N3IWF网 元的IP地址，然后将该N3IWF网元的IP地址携带在NAS消息中发送给UE。
步骤518：UE根据接收到的挑战请求信息获取RES值。
该步骤具体参见现有技术，在此不再详述。
步骤519～步骤521：UE向N3IWF网元发送挑战响应信息。
UE向N3IWF网元发送挑战响应信息(EAP-RSP/AKA’-Challenge)的流程，具体参见现有技术，在此不再详述。
步骤522：N3IWF网元生成用于传输EAP信息的NAS消息，将步骤521中接收的AAA消息携带在该NAS消息中发送给AMF网元。
该NAS消息中包括指示信息，用于指示该NAS消息用于接入鉴权。
在另一种可能的实现方式中，N3IWF网元生成用于传输EAP信息的N2消息，将步骤521中接收的AAA消息携带在该N2消息中发送给AMF网元。
AAA消息中携带挑战响应信息。
本步骤中生成NAS消息或者N2消息的方法与步骤506中生成NAS消息或者N2消息的方法类似，具体参见步骤506的描述，在此不再详述。
步骤523：N3IWF网元向AMF网元发送生成的NAS消息。
步骤524：AMF网元判断UE是否合法。
AMF网元接收到N3IWF网元发送的NAS消息后，根据该NAS消息中的指示信息获知该NAS消息用于接入鉴权。AMF网元根据该NAS消息中的挑战响应信息判断UE是否合法。AMF网元判断UE是否合法的方法具体参见现有技术，在此不再详述。
步骤525：AMF生成用于传输EAP信息的NAS消息，并将该NAS消息发送给N3IWF网元。
该NAS消息中包括指示信息，用于指示该NAS消息用于接入鉴权。
该NAS消息还包括接入鉴权的结果信息。
具体的，NAS消息中包括AAA消息，该AAA消息包括接入鉴权的结果信息(EAP--Success/MSK)。
该接入鉴权的结果信息可以认为是步骤205中的接入鉴权信息的响应信息。
在另一种可能的实现方式中，AMF生成用于传输EAP信息的N2消息，并在该N2消息中将接入鉴权的结果信息发送给N3IWF网元。
本步骤中生成NAS消息或者N2消息的方法与步骤513中生成NAS消息或者N2消息的方法类似，具体参见步骤513的描述，在此不再详述。
步骤526：N3IWF网元提取NAS消息中的AAA消息。
具体的，N3IWF网元可以根据NAS消息中的指示信息识别出接收到的NAS消息是用于接入鉴权。N3IWF网元可以将该NAS消息的头信息删除，从而获得该NAS消息中的接入鉴权的结果信息。接入鉴权的结果信息可以认为是步骤205中的鉴权信息的响应信息。本步骤具体参见步骤205的描述，在此不做详述。
在另一种可能的实现方式中，N3IWF网元也可以从N2消息中提取AAA消息。
步骤527～步骤528：N3IWF网元通过NH-AAA网元向NH-AMF网元发送接入鉴权的结果信息。
N3IWF网元向NH-AMF网元发送接入鉴权的结果信息的步骤详见现有技术，在此不再详述。
在一种可能的实现方式中，N3IWF网元还可以向NH-AMF网元发送该N3IWF网元的IP地址。具体的，N3IWF网元在发送的AAA消息中包括接入鉴权的结果信息和N3IWF网元的IP地址。
步骤529：NH-AMF网元向UE发送接入鉴权的结果信息。
N3IWF网元可以从接收到的AAA消息中提取接入鉴权的结果信息，然后将该接入鉴权的结果信息携带在NAS消息中发送给UE。
在一种可能的实现方式中，N3IWF网元可以从接收到的AAA消息中提取N3IWF网元的IP地址，然后将该N3IWF网元的IP地址携带在NAS消息中发送给UE。
在本申请的实施例中，当步骤515～步骤517中包括N3IWF网元的IP地址时，步骤527～步骤529中可以不包括N3IWF网元的IP地址；反之，当步骤515～步骤517中不包括N3IWF网元的IP地址时，步骤527～步骤529中可以包括N3IWF网元的IP地址。当然，步骤515～步骤517和步骤527～步骤529中也可以都包括N3IWF网元的IP地址。
步骤530～步骤533：UE和NH-AMF网元根据接入鉴权的结果信息完成后续的接入鉴权流程，例如：生成加密密钥。
该步骤具体可以参见现有技术，在此不再详述。
步骤534：UE选择接入鉴权过程中的N3IWF网元发起隧道鉴权的流程。
UE根据接收到的N3IWF网元的IP地址选择对应的N3IWF网元。然后向选择的N3IWF网元发起隧道鉴权的流程。
具体隧道鉴权的流程参见现有技术，在此不再详述。
图6是本申请的鉴权方法的第五实施例的示意性流程图，本实施例的方法在图1a的架构的基础上详细说明。在本实施例中，非可信非3GPP接入网与图5所示的实施例中的NH-AMF网元和NH-AAA网元的功能类似。在本实施例中，非可信非3GPP接入网可以是接入节点。具体的，本实施的鉴权方法包括：
步骤601：UE向非可信非3GPP接入网发送连接建立消息。
步骤602：非可信非3GPP接入网向UE发送EAP-RQ/Identity信息给UE。
该EAP-RQ/Identity信息用于发起EAP接入鉴权流程。该信息还用于向UE请求UE ID。
步骤603：UE向非可信非3GPP接入网发送EAP-RSP/Identity信息。
EAP-RSP/Identity信息为EAP-RQ/Identity信息的响应消息。该信息中携带UE ID。
步骤604：非可信非3GPP接入网向N3IWF网元发送AAA消息。
该AAA消息中包括EAP-RSP/Identity信息。
步骤605～步骤614具体参见步骤506～步骤515的描述，在此不再详述。
步骤615：非可信非3GPP接入网向UE发送挑战请求信息。
具体的，非可信非3GPP接入网可以从接收到的AAA消息中提取挑战请求信息，然后将该挑战请求信息发送给UE。
在一种可能的实现方式中，非可信非3GPP接入网可以从接收到的AAA消息中提取N3IWF网元的IP地址信息，然后将该N3IWF网元的IP地址信息发送给UE。
步骤616：UE根据接收到的挑战请求信息获取RES值。
该步骤具体参见现有技术，在此不再详述。
步骤617～步骤618：UE向非N3IWF网元发送挑战响应信息。
UE向N3IWF网元发送挑战响应信息的流程，具体参见现有技术，在此不再详述。
步骤619～步骤623具体参见步骤522～步骤526的描述，在此不再详述。
步骤624：N3IWF向非可信非3GPP接入网发送接入鉴权的结果信息。
具体的，N3IWF向非可信非3GPP接入网发送AAA消息，该AAA消息包括接入鉴权的结果信息。
步骤625：非可信非3GPP接入网向UE发送接入鉴权的结果信息。
步骤626～步骤630具体参见步骤530～步骤534的描述，在此不再详述。
图7是本申请的鉴权方法的第六实施例的示意性流程图，本实施例的方法在图1b的架构的基础上详细说明。本实施例中的方法与第四实施例中的方法区域在于：UE先选择N3IWF网元，然后向选择的N3IWF网元发起接入鉴权和隧道鉴权的流程。具体的，本实施例的方法包括：
步骤701：UE选择N3IWF网元。
具体的，UE在接入鉴权前，向DNS发送UE所在的PLMN的ID。UE接收DNS根 据PLMN ID发送的N3IWF网元的IP地址。当UE接收到DNS发送的多个N3IWF网元的IP地址时，UE可以从多个N3IWF网元的IP地址中选择一个IP地址对应的N3IWF网元。
步骤702～步骤705具体参见步骤502～步骤504的描述。
步骤702～步骤705与步骤502～步骤504的区别在于，在各步骤发送的消息中携带步骤701中选择的N3IWF网元的IP地址。
步骤706：NH-AAA网元根据接收到的AAA消息中携带的N3IWF网元的IP地址，选择对应的N3IWF网元。
步骤707：NH-AAA网元向选择的N3IWF网元发送AAA消息。
步骤708～步骤736具体参见步骤506～步骤534的描述。
步骤708～步骤736与步骤506～步骤534的区别在于：步骤717～步骤719中的消息可以不携带N3IWF网元的IP地址和/或者步骤729～步骤731中的消息可以不携带N3IWF网元的IP地址。
图8是本申请的鉴权方法的第七实施例的示意性流程图，本实施例的方法在图1a的架构的基础上详细说明。本实施例中的方法与第五实施例中的方法区域在于：UE先选择N3IWF网元，然后向选择的N3IWF网元发起接入鉴权和隧道鉴权的流程。在本实施例中，非可信非3GPP接入网可以是接入节点。具体的，本实施例的方法包括：
步骤801：UE选择N3IWF网元。
该步骤具体参见步骤701的描述。
步骤802～步骤804具体参见步骤701～步骤703的描述。
步骤802～步骤804与步骤701～步骤703的区别在于，在各步骤发送的消息中携带步骤801中选择的N3IWF网元的IP地址。
步骤805：非可信非3GPP接入网根据接收到的AAA消息中携带的N3IWF网元的IP地址，选择对应的N3IWF网元。
步骤806：非可信非3GPP接入网向选择的N3IWF网元发送AAA消息。
步骤807～步骤832具体参见步骤605～步骤630的描述。
步骤807～步骤832与步骤605～步骤630的区别在于：步骤816～步骤817中的消息可以不携带N3IWF网元的IP地址和/或者步骤726～步骤727中的消息可以不携带N3IWF网元的IP地址。
图9是本申请的鉴权方法的第八实施例的示意性流程图。本实施例的方法在图1a的架构的基础上详细说明。在本实施例中，接入鉴权和隧道鉴权同步进行。在本实施例中，非可信非3GPP接入网可以是接入节点。具体的，本实施例的方法包括：
步骤901～步骤903具体参见步骤401～步骤403的描述。
步骤904：UE与N3IWF网元之间建立网络密钥交换安全接入(internet key exchange security access,IKE SA)通道。
步骤905～步骤907：UE发起IKE鉴权请求的流程。
步骤904～步骤907具体流程可以参加现有技术。步骤904～步骤907与现有技术的区别在于：UE与N3IWF网元之间的交互信息中包括步骤903中非可信非3GPP接入网为UE分配的IP地址。具体的，UE在交互的鉴权消息的数据包中携带该IP地址。使用该IP地址进行隧道鉴权流程。
步骤908：N3IWF网元选择用于隧道鉴权的AMF网元。
N3IWF网元选择AMF网元的方法具体参见现有技术。
步骤909：N3IWF网元把注册请求(Registration Request)消息发送给AMF网元。
步骤910a～步骤910i：AMF网元与AUSF网元进行交互并对UE进行EAP鉴权。
具体的，AUSF网元通过对UE ID进行认证，从而完成接入鉴权和隧道鉴权。步骤910a～步骤910i具体流程参见现有技术，区别在于，各网元之间的交互信息中包括步骤903中非可信非3GPP接入网为UE分配的IP地址。具体的，UE在交互的鉴权消息的数据包中携 带该IP地址。
步骤911：AUSF网元向AMF网元发送AAA消息。
该AAA消息包括隧道鉴权的结果信息(EAP-Success)。该AAA消息还包括接入鉴权的结果(access authentication result)信息。在一种可能的实现方式中，隧道鉴权的结果信息包括接入鉴权的结果信息。在本实施例中，隧道鉴权的结果信息和接入鉴权的结果信息可以称为隧道鉴权信息的响应信息。
步骤912：AMF网元向N3IWF网元发送隧道鉴权信息的响应信息。
AMF网元从AAA消息中提取隧道鉴权信息的响应信息，然后将提权的隧道鉴权信息的响应信息发送给N3IWF网元。
隧道鉴权信息的响应信息包括隧道鉴权的结果信息和接入鉴权的结果信息。
步骤913：N3IWF网元向非可信非3GPP接入网发送接入鉴权的结果信息。
N3IWF网元接收隧道鉴权信息的响应信息后，从该隧道鉴权信息的响应消息中获取接入鉴权的结果信息。N3IWF网元将接入鉴权的结果信息发送非可信非3GPP接入网。
步骤914：非可信非3GPP接入网向N3IWF网元发送接入鉴权的结果信息的响应信息。
步骤915：非可信非3GPP接入网根据接入鉴权的结果信息确定UE的IP地址的有效性。
具体的，接入鉴权的结果信息可以为接入鉴权成功的信息或者接入鉴权失败的信息。
当接入鉴权的结果信息为接入鉴权成功的信息时，非可信非3GPP接入网确定步骤903中为UE分配的IP地址有效，非可信非3GPP接入网允许UE继续使用该IP地址接入网络。当接入鉴权的结果信息为接入鉴权失败的信息时，非可信非3GPP接入网确定步骤903中为UE分配的IP地址无效，非可信非3GPP接入网禁止UE使用该IP地址接入网络。
步骤916～步骤919：N3IWF网元与UE完成隧道鉴权流程。
步骤916～步骤919具体流程参见现有技术，区别在于，在N3IWF网元与UE的交互消息中，N3IWF网元将隧道鉴权的结果信息和接入鉴权的结果信息发送给UE。
步骤920：UE根据接入鉴权的结果信息确定IP地址的有效性。
当接入鉴权的结果信息为接入鉴权成功的信息时，UE确定步骤903中分配的IP地址有效，UE继续使用该IP地址接入网络。当接入鉴权的结果信息为接入鉴权失败的信息时，UE确定步骤903中分配的IP地址无效，UE停止使用该IP地址接入网络。
图10是本申请实施例提供的一种鉴权装置的示意图。该鉴权装置包括收发单元1001、处理单元1002以及存储单元1003。收发单元1001、处理单元1002以及存储单元1003可以是在物理上相互分离的单元，也可以集成到一个或者多个物理单元中，在此不做限定。
收发单元1001用于实现处理单元1002与其他单元或者网元的内容交互。具体的，收发单元1001可以是该鉴权装置的通信接口，也可以是收发电路或者收发器，还可以是收发信机。收发单元1001还可以是处理单元1002的通信接口或者收发电路。可选的，收发单元1001可以是一个收发芯片。
虽然图10中仅仅示出了一个收发单元1001，鉴权装置也可以包括多个收发单元1001，或者收发单元1001包括多个子收发单元。收发单元1001还可以包括发送单元和接收单元，用于执行对应的发送和接收操作。
处理单元1002用于实现鉴权装置对数据的处理。处理单元1002可以是处理电路，也可以是处理器。其中，处理器可以是中央处理器(central processing unit，CPU)，网络处理器(network processor，NP)或者CPU和NP的组合。处理器还可以进一步包括硬件芯片。上述硬件芯片可以是专用集成电路(application-specific integrated circuit，ASIC)，可编程逻辑器件(programmable logic device，PLD)或其组合。上述PLD可以是复杂可编程逻辑器件(complex programmable logic device,CPLD)，现场可编程逻辑门阵列(field-programmable gate array，FPGA)，通用阵列逻辑(Generic Array Logic，GAL)或其任意组合。
虽然图10中仅仅示出了一个处理单元1002，鉴权装置也可以包括多个处理单元或者 处理单元1002包括多个子数据处理单元。具体的，处理器可以是一个单核(single-CPU)处理器，也可以是一个多核(multi-CPU)处理器。
存储单元1003用于存储处理单元1002执行的计算机指令。存储单元1003可以是存储电路也可以是存储器。存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)，其用作外部高速缓存。
存储单元1003可以是独立于处理单元1002的单元，也可以是处理单元1002中的存储单元，在此不做限定。虽然图10中仅仅示出了一个存储单元1003，鉴权装置也可以包括多个存储单元1003或者存储单元1003包括多个子存储单元。
在本申请的各实施例中，处理单元1002可以通过收发单元1001与其他网元进行内容交互，例如：处理单元1002获取或者接收来自其他网元的内容。若处理单元1002与收发单元1001是物理上分离的两个部件，处理单元1002可以不经过收发单元1001与鉴权装置内部的其他单元进行内容交互。
一种可能的实现方式中，收发单元1001、处理单元1002以及存储单元603可以通过总线相互连接。总线可以是外设部件互连标准(peripheral component interconnect，PCI)总线或扩展工业标准结构(extended industry standard architecture，EISA)总线等。所述总线可以分为地址总线、数据总线、控制总线等。
在本申请的实施例中，处理单元1002根据存储单元1003中存储的计算机指令，使得鉴权装置实现本申请第一实施例到第八实施例中的方法。
在本申请的实施例中，鉴权装置可以是数据处理芯片或者数据处理芯片模块，例如片上系统(System on Chip,SoC)。
具体的，鉴权装置可以是接入网元，例如：N3IWF网元或者接入节点。鉴权装置也可以是终端设备。
当鉴权装置为接入网元时，在一种可能的实现方式中，所述收发单元1001用于接收来自终端设备的接入鉴权信息；所述处理单元1002用于根据所述接入鉴权信息生成第一消息，所述第一消息包括所述接入鉴权信息；所述收发单元1001还用于向接入管理网元发送所述第一消息，接收所述接入管理网元发送的所述第一消息的第一响应消息，所述第一响应消息包括所述接入鉴权信息的响应信息；所述收发单元1001还用于根据所述第一响应消息向所述终端设备发送所述接入鉴权信息的响应信息。
在一种可能的实现方式中，所述第一消息为非接入层NAS消息或者N2接口消息，其中，所述N2接口为所述鉴权装置和所述接入管理网元之间的接口。
在一种可能的实现方式中，所述第一响应消息包括指示信息，所述指示信息用于指示所述第一响应消息用于接入鉴权，所述处理单元还用于根据所述指示信息提取所述第一响应消息中的所述接入鉴权信息的响应信息。
在一种可能的实现方式中，所述指示信息为接入鉴权指示或者消息类型。
在一种可能的实现方式中，所述收发单元还用于向所述终端设备发送所述接入网元的地址信息。
在本实施例中，收发单元1001用于实现本申请第一实施例中接入网元与外部网元的内容收发操作。收发单元1001还用于实现本申请第四实施例到第七实施例中N3IWF网元与外部网元的内容收发操作。处理单元1002用于实现本申请第一实施例中接入网元内部数据或者信令的处理操作,例如，处理单元1002用于实现第一实施例中步骤202或者步骤205的操作。处理单元1002还用于实现本申请第四实施例到第七实施例中N3IWF网元内部数据或者信令的处理操作。
在本实施例中，处理单元1002根据存储单元1003中存储的计算机指令，使得鉴权装置实现本申请第一实施例中的接入网元或第四实施例到第七实施例中N3IWF网元执行的操作，例如：
利用所述收发单元1001接收来自终端设备的接入鉴权信息；根据所述接入鉴权信息生成第一消息，所述第一消息包括所述接入鉴权信息；利用所述收发单元1001向接入管理网元发送所述第一消息；利用所述收发单元1001接收所述接入管理网元发送的所述第一消息的第一响应消息，所述第一响应消息包括所述接入鉴权信息的响应信息；根据所述第一响应消息利用所述收发单元1001向所述终端设备发送所述接入鉴权信息的响应信息。
在一种可能的实现方式中，所述第一响应消息包括指示信息，所述指示信息用于指示所述第一响应消息用于接入鉴权，所述处理单元1002还用于根据所述存储单元1003中存储的计算机指令执行如下操作：根据所述指示信息提取所述第一响应消息中的所述接入鉴权信息的响应信息。
在一种可能的实现方式中，所述处理单元1002还用于根据所述存储单元1003中存储的计算机指令执行如下操作：利用所述收发单元1003向所述终端设备发送所述接入网元的地址信息。
在一种可能的实现方式中，收发单元1001可以为该鉴权装置的通信接口，处理单元1002可以为该鉴权装置的处理器，存储单元1003可以为该鉴权装置的存储器。
当鉴权装置为终端设备时，在一种可能的实现方式中，所述收发单元1001用于获取用于接入鉴权的接入网元的地址信息；所述处理单元1002用于选择所述地址信息对应的接入网元发起隧道鉴权的流程。
在一种可能的实现方式中，所述收发单元1001用于在接入鉴权过程中接收所述接入网元发送的所述接入网元的地址信息。
在一种可能的实现方式中，所述收发单元1001用于向域名系统DNS发送鉴权的装置所在的公共陆地移动网络PLMN的标识信息；所述收发单元1001还用于接收所述域名系统根据PLMN的标识信息发送的所述接入网元的地址信息。
在一种可能的实现方式中，所述处理单元1002还用于向所述地址信息对应的接入网元发起接入鉴权流程。
在本实施例中，收发单元1001还用于实现本申请第四实施例到第七实施例中UE与外部网元的内容收发操作。处理单元1002还用于实现本申请第四实施例到第七实施例中UE内部数据或者信令的处理操作。
在本实施例中，处理单元1002根据存储单元1003中存储的计算机指令，使得鉴权装置实现本申请第四实施例到第七实施例中UE执行的操作，例如：
利用所述收发单元1001获取用于接入鉴权的接入网元的地址信息；选择所述地址信息对应的接入网元发起隧道鉴权的流程。
在一种可能的实现方式中，利用所述收发单元1001获取用于接入鉴权的接入网元的地址信息，包括：在接入鉴权过程中，利用所述收发单元1001接收所述接入网元发送的所述接入网元的地址信息。
在一种可能的实现方式中，利用所述收发单元1001获取用于接入鉴权的接入网元的地址信息，包括：利用所述收发单元1001向域名系统DNS发送鉴权的装置所在的公共陆地移动网络PLMN的标识信息；利用所述收发单元1001接收所述域名系统根据PLMN的标识信息发送的所述接入网元的地址信息。
在一种可能的实现方式中，所述处理单元1002还用于根据所述存储单元1003中存储的计算机指令执行如下操作：利用所述收发单元1001向所述地址信息对应的接入网元发起接入鉴权流程。
在一种可能的实现方式中，收发单元1001可以为该鉴权装置的收发器，处理单元1002可以为该鉴权装置的处理器，存储单元1003可以为该鉴权装置的存储器。
当鉴权装置为接入节点时，在一种可能的实现方式中，所述收发单元1001用于接收来自终端设备的连接建立信息，所述连接建立信息用于建立所述终端设备与所述接入节点的连接；所述处理单元1002用于向所述终端设备分配地址信息，所述地址信息用于执行鉴权过程；所述收发单元1001还用于接收接入网关发送的所述鉴权过程的结果信息，所述鉴权过程的结果信息包括接入鉴权的结果信息；所述处理单元1002还用于根据所述接入鉴权的结果信息确定所述终端设备的地址信息有效性。
在一种可能的实现方式中，所述接入鉴权的结果信息为接入鉴权成功的信息，所述处理单元1002用于根据所述接入鉴权成功的信息确定所述终端设备的地址信息有效。
在一种可能的实现方式中，所述接入鉴权的结果信息为接入鉴权失败的信息，所述处理单元1002用于根据所述接入鉴权失败的信息确定所述终端设备的地址信息无效。
在本实施例中，收发单元1001用于实现本申请第三实施例中接入节点与外部网元的内容收发操作。收发单元1001还用于实现本申请第八实施例中非可信非3GPP接入网与外部网元的内容收发操作。处理单元1002用于实现本申请第三实施例中接入节点内部数据或者信令的处理操作。处理单元1002还用于实现本申请第八实施例中非可信非3GPP接入网内部数据或者信令的处理操作。
在本实施例中，处理单元1002根据存储单元1003中存储的计算机指令，使得鉴权装置实现本申请第三实施例中接入节点和第八实施例中非可信非3GPP接入网执行的操作，例如：
利用所述收发单元1001接收来自终端设备的连接建立信息，所述连接建立信息用于建立所述终端设备与所述接入节点的连接；利用收发单元1001向所述终端设备分配地址信息，所述地址信息用于执行鉴权过程；利用收发单元1001接收接入网关发送的所述鉴权过程的结果信息，所述鉴权过程的结果信息包括接入鉴权的结果信息；根据所述接入鉴权的结果信息确定所述终端设备的地址信息有效性。
在一种可能的实现方式中，所述接入鉴权的结果信息为接入鉴权成功的信息，所述根据所述接入鉴权的结果信息确定所述终端设备的地址信息有效性，包括：根据所述接入鉴权成功的信息确定所述终端设备的地址信息有效。
在一种可能的实现方式中，所述接入鉴权的结果信息为接入鉴权失败的信息，所述根据所述接入鉴权的结果信息确定所述终端设备的地址信息有效性，包括：根据所述接入鉴权失败的信息确定所述终端设备的地址信息无效。
在一种可能的实现方式中，收发单元1001可以为该鉴权装置的通信接口，处理单元1002可以为该鉴权装置的处理器，存储单元1003可以为该鉴权装置的存储器。
当鉴权装置为另一终端设备时，在一种可能的实现方式中，所述收发单元1001用于获取所述鉴权的装置的地址信息；所述收发单元1001还用于向接入网关发送隧道鉴权信息，所述隧道鉴权信息包括鉴权的装置的地址信息；所述收发单元1001还用于接收所述接入网关发送的隧道鉴权信息的响应信息，所述隧道鉴权信息的响应信息包括接入鉴权的结果信息；所述处理单元1002用于根据所述接入鉴权的结果信息确定所述鉴权的装置的地址信息有效性。
在一种可能的实现方式中，所述接入鉴权的结果信息为接入鉴权成功的信息，所述处理单元1002用于根据所述接入鉴权成功的信息确定所述鉴权的装置的地址信息有效。
在一种可能的实现方式中，所述接入鉴权的结果信息为接入鉴权失败的信息，所述处理单元1002用于根据所述接入鉴权失败的信息确定所述鉴权的装置的地址信息无效。
在一种可能的实现方式中，所述收发单元1001还用于接收接入节点发送的所述鉴权的装置的地址信息。
在本实施例中，收发单元1001还用于实现本申请第三实施例和第八实施例中UE与外部网元的内容收发操作。处理单元1002还用于实现本申请第三实施例和第八实施例中UE内部数据或者信令的处理操作。
在本实施例中，处理单元1002根据存储单元1003中存储的计算机指令，使得鉴权装置实现本申请第三实施例和第八实施例中UE执行的操作，例如：
利用所述收发单元1001获取所述终端设备的地址信息；利用所述收发单元1001向接入网关发送隧道鉴权信息，所述隧道鉴权信息包括所述鉴权装置的地址信息；利用所述收发单元1001接收所述接入网关发送的隧道鉴权信息的响应信息，所述隧道鉴权信息的响应信息包括接入鉴权的结果信息；根据所述接入鉴权的结果信息确定所述鉴权装置的地址信息有效性。
在一种可能的实现方式中，所述接入鉴权的结果信息为接入鉴权成功的信息，所述根据所述接入鉴权的结果信息确定所述鉴权装置的地址信息有效性，包括：根据所述接入鉴权成功的信息确定所述鉴权装置的地址信息有效。
在一种可能的实现方式中，所述接入鉴权的结果信息为接入鉴权失败的信息，所述根据所述接入鉴权的结果信息确定所述鉴权装置的地址信息有效性，包括：根据所述接入鉴权失败的信息确定所述鉴权装置的地址信息无效。
在一种可能的实现方式中，利用所述收发单元1001获取所述鉴权装置的地址信息，包括：利用所述收发单元1001接收接入节点发送的所述鉴权装置的地址信息。
在一种可能的实现方式中，收发单元1001可以为该鉴权装置的收发器，处理单元1002可以为该鉴权装置的处理器，存储单元1003可以为该鉴权装置的存储器。
当鉴权装置为接入网关时，在一种可能的实现方式中，所述处理单元1002用于通过所述收发单元1001接收来自终端设备的隧道鉴权信息，所述隧道鉴权信息包括接入节点为所述终端设备分配的地址信息；所述处理单元1002还用于通过所述收发单元1001向接入管理网元发送所述隧道鉴权信息；所述处理单元1002用于通过所述收发单元1001接收所述接入管理网元发送的所述隧道鉴权信息的响应信息，所述隧道鉴权信息的响应信息包括接入鉴权的结果信息；所述处理单元1002用于通过所述收发单元1001向所述终端设备发送所述隧道鉴权信息的响应信息。
在本实施例中，收发单元1001还用于实现本申请第三实施例和第八实施例中N3IWF网元与外部网元的内容收发操作。处理单元1002还用于实现本申请第三实施例和第八实施例中N3IWF网元内部数据或者信令的处理操作。
在本实施例中，处理单元1002根据存储单元1003中存储的计算机指令，使得鉴权装置实现本申请第三实施例和第八实施例中N3IWF网元执行的操作。
在一种可能的实现方式中，收发单元1001可以为该鉴权装置的通信接口，处理单元1002可以为该鉴权装置的处理器，存储单元1003可以为该鉴权装置的存储器。
本申请的实施例还提供一种计算机存储介质，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行上述实施例一到实施例八中任意一个实施例中网元的操作。
本申请的实施例还提供一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述实施例一到实施例八中任意一个实施例中网元的操作。
在本申请的各实施例中，为了方面理解，进行了多种举例说明。然而，这些例子仅仅是一些举例，并不意味着是实现本申请的最佳实现方式。
在本申请的各实施例中，为了方便的描述，采用了请求消息，响应消息以及其他各种消息的名称。然而，这些消息仅仅是以举例方式说明需要携带的内容或者实现的功能，消息的具体名称并不对本申请的做出限定，例如：还可以是第一消息，第二消息，第三消息等。这些消息可以是具体的一些消息，可以是消息中的某些字段。这些消息还可以代表各种服务化操作。
上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品可以包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或 部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁盘)、光介质(例如，DVD)、或者半导体介质(例如，固态硬盘(solid state disk，SSD))等。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不做限定。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器、随机存取存储器、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应所述以权利要求的保护范围为准。

Claims (30)

  1. 一种鉴权的方法，其特征在于，包括：
    接入网元接收来自终端设备的接入鉴权信息；
    所述接入网元根据所述接入鉴权信息生成第一消息，所述第一消息包括所述接入鉴权信息；
    所述接入网元向接入管理网元发送所述第一消息；
    所述接入网元接收所述接入管理网元发送的所述第一消息的第一响应消息，所述第一响应消息包括所述接入鉴权信息的响应信息；
    所述接入网元根据所述第一响应消息向所述终端设备发送所述接入鉴权信息的响应信息。
  2. 根据权利要求1所述的方法，其特征在于，
    所述第一消息为非接入层NAS消息或者N2接口消息，其中，所述N2接口为所述接入网元和所述接入管理网元之间的接口。
  3. 根据权利要求1或2所述的方法，其特征在于，所述第一响应消息包括指示信息，所述指示信息用于指示所述第一响应消息用于接入鉴权，
    所述接入网元根据所述第一响应消息向所述终端设备发送所述接入鉴权信息的响应信息，包括：
    所述接入网元根据所述指示信息提取所述第一响应消息中的所述接入鉴权信息的响应信息；
    所述接入网元向所述终端设备发送所述接入鉴权信息的响应信息。
  4. 根据权利要求3所述的方法，其特征在于，所述指示信息为接入鉴权指示或者消息类型。
  5. 根据权利要求1-4中任意一项所述的方法，其特征在于，所述方法还包括所述接入网元向所述终端设备发送所述接入网元的地址信息。
  6. 一种鉴权的方法，其特征在于，包括：
    终端设备获取用于接入鉴权的接入网元的地址信息；
    所述终端设备选择所述地址信息对应的接入网元发起隧道鉴权的流程。
  7. 根据权利要求6所述的方法，其特征在于，所述终端设备获取用于接入鉴权的接入网元的地址信息，包括：
    在接入鉴权过程中，所述终端设备接收所述接入网元发送的所述接入网元的地址信息。
  8. 根据权利要求6所述的方法，其特征在于，终端设备获取用于接入鉴权的接入网元的地址信息，包括：
    所述终端设备向域名系统DNS发送所述终端设备所在的公共陆地移动网络PLMN的标识信息；
    所述终端设备接收所述域名系统根据PLMN的标识信息发送的所述接入网元的地址信息。
  9. 根据权利要求6-8中任意一项所述的方法，其特征在于，所述终端设备选择所述地 址信息对应的接入网元发起隧道鉴权的流程之前，所述方法还包括：
    所述终端设备向所述地址信息对应的接入网元发起接入鉴权流程。
  10. 一种鉴权的方法，其特征在于，包括：
    终端设备获取所述终端设备的地址信息；
    所述终端设备向接入网关发送隧道鉴权信息，所述隧道鉴权信息包括所述终端设备的地址信息；
    所述终端设备接收所述接入网关发送的隧道鉴权信息的响应信息，所述隧道鉴权信息的响应信息包括接入鉴权的结果信息；
    所述终端设备根据所述接入鉴权的结果信息确定所述终端设备的地址信息有效性。
  11. 根据权利要求10所述的方法，其特征在于，所述接入鉴权的结果信息为接入鉴权成功的信息，
    所述终端设备根据所述接入鉴权的结果信息确定所述终端设备的地址信息有效性，包括：
    所述终端设备根据所述接入鉴权成功的信息确定所述终端设备的地址信息有效。
  12. 根据权利要求10所述的方法，其特征在于，所述接入鉴权的结果信息为接入鉴权失败的信息，
    所述终端设备根据所述接入鉴权的结果信息确定所述终端设备的地址信息有效性，包括：
    所述终端设备根据所述接入鉴权失败的信息确定所述终端设备的地址信息无效。
  13. 根据权利要求10-12中任意一项所述的方法，其特征在于，所述终端设备获取所述终端设备的地址信息，包括：
    所述终端设备接收接入节点发送的所述终端设备的地址信息。
  14. 一种鉴权装置，其特征在于，包括：
    收发单元，用于接收来自终端设备的接入鉴权信息；
    处理单元，用于根据所述接入鉴权信息生成第一消息，所述第一消息包括所述接入鉴权信息；
    所述收发单元还用于向接入管理网元发送所述第一消息，接收所述接入管理网元发送的所述第一消息的第一响应消息，所述第一响应消息包括所述接入鉴权信息的响应信息；
    所述收发单元还用于根据所述第一响应消息向所述终端设备发送所述接入鉴权信息的响应信息。
  15. 根据权利要求14所述的装置，其特征在于，
    所述第一消息为非接入层NAS消息或者N2接口消息，其中，所述N2接口为所述鉴权装置和所述接入管理网元之间的接口。
  16. 根据权利要求14或15所述的装置，其特征在于，所述第一响应消息包括指示信息，所述指示信息用于指示所述第一响应消息用于接入鉴权，
    所述处理单元还用于根据所述指示信息提取所述第一响应消息中的所述接入鉴权信息的响应信息。
  17. 根据权利要求16所述的装置，其特征在于，所述指示信息为接入鉴权指示或者消息类型。
  18. 根据权利要求14-17中任意一项所述的装置，其特征在于，所述收发单元还用于 向所述终端设备发送所述接入网元的地址信息。
  19. 一种鉴权的装置，其特征在于，包括：
    收发单元，用于获取用于接入鉴权的接入网元的地址信息；
    处理单元，用于选择所述地址信息对应的接入网元发起隧道鉴权的流程。
  20. 根据权利要求19所述的装置，其特征在于，所述收发单元用于在接入鉴权过程中接收所述接入网元发送的所述接入网元的地址信息。
  21. 根据权利要求19所述的装置，其特征在于，所述收发单元用于向域名系统DNS发送鉴权的装置所在的公共陆地移动网络PLMN的标识信息；
    所述收发单元还用于接收所述域名系统根据PLMN的标识信息发送的所述接入网元的地址信息。
  22. 根据权利要求19-21中任意一项所述的装置，其特征在于，所述处理单元还用于向所述地址信息对应的接入网元发起接入鉴权流程。
  23. 一种鉴权的装置，其特征在于，包括：处理单元和收发单元，
    所述收发单元用于获取所述鉴权的装置的地址信息；
    所述收发单元还用于向接入网关发送隧道鉴权信息，所述隧道鉴权信息包括鉴权的装置的地址信息；
    所述收发单元还用于接收所述接入网关发送的隧道鉴权信息的响应信息，所述隧道鉴权信息的响应信息包括接入鉴权的结果信息；
    所述处理单元用于根据所述接入鉴权的结果信息确定所述鉴权的装置的地址信息有效性。
  24. 根据权利要求23所述的装置，其特征在于，所述接入鉴权的结果信息为接入鉴权成功的信息，所述处理单元用于根据所述接入鉴权成功的信息确定所述鉴权的装置的地址信息有效。
  25. 根据权利要求23所述的装置，其特征在于，所述接入鉴权的结果信息为接入鉴权失败的信息，所述处理单元用于根据所述接入鉴权失败的信息确定所述鉴权的装置的地址信息无效。
  26. 根据权利要求23-25中任意一项所述的装置，其特征在于，所述收发单元还用于接收接入节点发送的所述鉴权的装置的地址信息。
  27. 一种鉴权装置，其特征在于，包括处理器、存储器和通信接口：
    所述存储器用于存储计算机指令；
    所述处理器用于根据所述存储器中存储的计算机指令执行如下操作：
    利用所述通信接口接收来自终端设备的接入鉴权信息；
    根据所述接入鉴权信息生成第一消息，所述第一消息包括所述接入鉴权信息；
    利用所述通信接口向接入管理网元发送所述第一消息；
    利用所述通信接口接收所述接入管理网元发送的所述第一消息的第一响应消息，所述第一响应消息包括所述接入鉴权信息的响应信息；
    根据所述第一响应消息利用所述通信接口向所述终端设备发送所述接入鉴权信息的响应信息。
  28. 一种鉴权装置，其特征在于，包括处理器、存储器和收发器：
    所述存储器用于存储计算机指令；
    所述处理器用于根据所述存储器中存储的计算机指令执行如下操作：
    利用所述收发器获取用于接入鉴权的接入网元的地址信息；
    选择所述地址信息对应的接入网元发起隧道鉴权的流程。
  29. 一种计算机存储介质，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行所述权利要求1-13中任意一项所述的方法。
  30. 一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行所述权利要求1-13中任意一项所述的方法。
PCT/CN2018/116066 2017-11-20 2018-11-17 鉴权的方法和装置 WO2019096287A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
EP18878836.8A EP3697119A4 (en) 2017-11-20 2018-11-17 AUTHENTICATION METHOD AND DEVICE
AU2018366777A AU2018366777A1 (en) 2017-11-20 2018-11-17 Authentication method and apparatus
US16/874,025 US20200275275A1 (en) 2017-11-20 2020-05-14 Authentication method and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201711158711.1 2017-11-20
CN201711158711.1A CN109819440B (zh) 2017-11-20 2017-11-20 鉴权的方法和装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/874,025 Continuation US20200275275A1 (en) 2017-11-20 2020-05-14 Authentication method and apparatus

Publications (1)

Publication Number Publication Date
WO2019096287A1 true WO2019096287A1 (zh) 2019-05-23

Family

ID=66540054

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/116066 WO2019096287A1 (zh) 2017-11-20 2018-11-17 鉴权的方法和装置

Country Status (5)

Country Link
US (1) US20200275275A1 (zh)
EP (1) EP3697119A4 (zh)
CN (2) CN109819440B (zh)
AU (1) AU2018366777A1 (zh)
WO (1) WO2019096287A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2021160272A1 (en) * 2020-02-13 2021-08-19 Lenovo (Singapore) Pte. Ltd. Determining an access network radio access type

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2023552928A (ja) * 2020-12-14 2023-12-20 オッポ広東移動通信有限公司 無線通信方法、端末デバイス及びネットワーク要素
CN116567626A (zh) * 2022-01-27 2023-08-08 维沃移动通信有限公司 设备鉴权方法、装置及通信设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2007049936A1 (en) * 2005-10-27 2007-05-03 Samsung Electronics Co., Ltd. System and method for handover between interworking wlan and eutran access systems
CN101237699A (zh) * 2008-02-29 2008-08-06 中兴通讯股份有限公司 无线网络节点与接入服务器之间建立多隧道的控制方法
WO2010034483A1 (en) * 2008-09-23 2010-04-01 Panasonic Corporation Optimization of handovers to untrusted non-3gpp networks
CN103428798A (zh) * 2012-05-22 2013-12-04 华为终端有限公司 网关选择方法、服务器、用户设备、网关及分组数据系统

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100499536C (zh) * 2003-10-22 2009-06-10 华为技术有限公司 无线局域网中选定业务的解析接入处理方法
US7613155B2 (en) * 2005-04-30 2009-11-03 Lg Electronics Inc. Terminal, system and method for providing location information service by interworking between WLAN and mobile communication network
CN101466083B (zh) * 2007-12-18 2010-12-08 华为技术有限公司 一种紧急呼叫方法和装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2007049936A1 (en) * 2005-10-27 2007-05-03 Samsung Electronics Co., Ltd. System and method for handover between interworking wlan and eutran access systems
CN101237699A (zh) * 2008-02-29 2008-08-06 中兴通讯股份有限公司 无线网络节点与接入服务器之间建立多隧道的控制方法
WO2010034483A1 (en) * 2008-09-23 2010-04-01 Panasonic Corporation Optimization of handovers to untrusted non-3gpp networks
CN103428798A (zh) * 2012-05-22 2013-12-04 华为终端有限公司 网关选择方法、服务器、用户设备、网关及分组数据系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3697119A4

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2021160272A1 (en) * 2020-02-13 2021-08-19 Lenovo (Singapore) Pte. Ltd. Determining an access network radio access type

Also Published As

Publication number Publication date
US20200275275A1 (en) 2020-08-27
EP3697119A4 (en) 2020-08-26
CN115567935A (zh) 2023-01-03
AU2018366777A1 (en) 2020-05-28
CN109819440B (zh) 2022-08-26
EP3697119A1 (en) 2020-08-19
CN109819440A (zh) 2019-05-28

Similar Documents

Publication Publication Date Title
US11212676B2 (en) User identity privacy protection in public wireless local access network, WLAN, access
CN107852407B (zh) 用于集成小型小区和Wi-Fi网络的统一认证
US20220360634A1 (en) User plane model for non-3gpp access to fifth generation core network
CN112997454B (zh) 经由移动通信网络连接到家庭局域网
US9549317B2 (en) Methods and apparatuses to provide secure communication between an untrusted wireless access network and a trusted controlled network
WO2019024866A1 (zh) 一种接入网络的方法、设备及系统
CN108738013B (zh) 网络接入方法、装置和网络设备
WO2015101125A1 (zh) 网络接入控制方法和设备
TW201644236A (zh) 使用用於服務ｃ平面方法的網路符記的高效策略實施
US20130114463A1 (en) System and Method for Domain Name Resolution for Fast Link Setup
US8588742B2 (en) Method and apparatus for providing wireless services to mobile subscribers using existing broadband infrastructure
US20200275275A1 (en) Authentication method and apparatus
CN114667499A (zh) 基于口令和策略的设备无关认证
WO2017167249A1 (zh) 一种专网接入方法、装置及系统
WO2018196587A1 (zh) 融合网络中的用户认证方法及装置
WO2012149783A1 (zh) 用于接入移动网络的方法和装置以及用户设备
RU2727160C1 (ru) Аутентификация для систем следующего поколения
WO2011116713A2 (zh) Mtc终端通过网关与网络通信的方法、设备及系统
WO2014048373A1 (zh) 无线信息传输方法和设备
KR20230124621A (ko) 비-3gpp 서비스 액세스를 위한 ue 인증 방법 및 시스템
JP2020505845A (ja) 緊急アクセス中のパラメータ交換のための方法およびデバイス
WO2013067911A1 (zh) 一种接入认证方法、系统及设备
KR101272576B1 (ko) Ｉ－ｗｌａｎ에 접속할 수 있는 안드로이드 단말，및 안드로이드 단말의 ｉ－ｗｌａｎ 접속 방법
WO2019024612A1 (zh) 一种接入鉴权的方法及装置
WO2014032542A9 (zh) 多连接建立的方法及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18878836

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2018878836

Country of ref document: EP

Effective date: 20200512

ENP Entry into the national phase

Ref document number: 2018366777

Country of ref document: AU

Date of ref document: 20181117

Kind code of ref document: A