WO2019196963A1

WO2019196963A1 - Method and device for accessing network slice, storage medium, electronic device

Info

Publication number: WO2019196963A1
Application number: PCT/CN2019/089942
Authority: WO
Inventors: 余万涛
Original assignee: 中兴通讯股份有限公司
Priority date: 2018-04-08
Filing date: 2019-06-04
Publication date: 2019-10-17
Also published as: CN110351721A

Abstract

Disclosed are a method and a device for accessing a network slice, a storage medium, and an electronic device, the method comprising: determining first network slice subscriber identity information (IMSIs) currently being used on user equipment, the first IMSIs being temporarily configured information; sending the first IMSIs to a network-side device, in order to instruct the network-side device to send the first IMSIs to an authentication server function entity (AUSF), so that the AUSF will generate a first authentication vector on the basis of the first IMSIs, the first authentication vector being used to instruct a security management entity (SEAF) of the network slice to perform, with the UE, and by means of the first authentication vector, authentication used for the network slice.

Description

Method and device for accessing network slice, storage medium, electronic device

The present application claims the priority of the Chinese Patent Application, the entire disclosure of which is hereby incorporated by reference.

Technical field

The present application relates to the field of communications, for example, to a method and apparatus for accessing a network slice, a storage medium, and an electronic device.

Background technique

The 5th-generation (5G) network architecture will introduce new Information Technology (IT) technologies such as Network Function Virtualization (NFV). In the 3rd-generation (3G) or 4th-generation (4G) networks, the protection of functional network elements is largely dependent on the security isolation of physical devices. . In the 5G network, due to the deployment of the NFV technology, some functional network elements are deployed on the clouded infrastructure in the form of virtual function network elements. A virtual core network constructed based on network service requirements is called a network slice, and a network slice forms a virtual core network to provide a mobile network access service for a group of specific user equipment UEs. In the related 3G/4G mobile communication system, the user equipment (User Equipment, UE) is directly provided by the core network after accessing the network by means of authentication and key agreement (AKA) AKA authentication. Business. In the 5G system, the concept of network slicing is introduced, so that after the UE attaches to the network, the network slice needs to be further accessed. When accessing the network slice, the UE directly sends the identifier information of the network slice in the plaintext mode when accessing the network slice, and the attacker may collect the UE information of the access network slice, and based on the collected access network. The sliced UE information is used to perform a denial of service attack on the group of UEs. Therefore, in the related art, there is a problem that the identification information of the network slice is easily leaked when the UE accesses the network slice.

In view of the above technical problems, an effective solution has not been proposed in the related art.

Summary of the invention

The embodiments of the present invention provide a method and a device for accessing a network slice, a storage medium, and an electronic device, so as to at least solve the problem that the identification information of the network slice is easily leaked when the UE accesses the network slice in the related art.

According to an embodiment of the present application, a method for accessing a network slice is provided, including: determining first network slice user subscription identity information IMSIs currently used on a user equipment, wherein the first IMSIs are temporarily configured information. Sending the first IMSIs to the network side device to instruct the network side device to send the first IMSIs to the authentication service function entity AUSF, so that the AUSF generates a first authentication vector based on the first IMSIs; The first authentication vector is used to indicate that the security management entity SEAF of the network slice performs authentication for the network slice with the user equipment by using the first authentication vector; and the authentication of the network slice is passed. After that, the network slice is accessed.

According to still another embodiment of the present application, a method for network slice authentication is provided, including: receiving first network slice user subscription identity information IMSIs sent by a network side device, where the first IMSIs are temporarily configured. Generating a first authentication vector based on the first IMSIs; transmitting the first authentication vector to a security management entity SEAF of a network slice to indicate that the SEAF is performed with the user equipment by using the first authentication vector Authenticating for the network slice; after the authentication of the network slice is passed, instructing the user equipment to access the network slice.

According to still another embodiment of the present application, a method for accessing a network slice includes: determining a first network slice user subscription identity information IMSIs, wherein the first IMSIs are information temporarily configured to a user equipment; Configuring the first IMSIs to the user equipment, to instruct the user equipment to send the first IMSIs to the network side device, so that the network side device sends the first IMSIs to the authentication service function entity AUSF Receiving a first authentication vector generated by the AUSF based on the first IMSI; performing authentication for the network slice with the user equipment by using the first authentication vector; after authenticating the network slice Instructing the user equipment to access the network slice.

According to still another embodiment of the present application, an authentication apparatus for network slicing is further provided, including: a first determining module, configured to determine first network slice subscriber subscription identity information IMSIs currently used on a user equipment, where The first IMSIs are temporarily configured information; the first sending module is configured to send the first IMSIs to the network side device, to instruct the network side device to send the first IMSIs to the authentication service function entity AUSF, And causing the AUSF to generate a first authentication vector based on the first IMSIs, where the first authentication vector is used to indicate that the security management entity SEAF of the network slice is used by the user equipment by using the first authentication vector. The first access module is configured to access the network slice after the authentication of the network slice is passed.

According to still another embodiment of the present application, an apparatus for network slice authentication is provided, including: a first receiving module, configured to receive first network slice subscriber subscription identity information IMSIs sent by a network side device, where The first IMSIs are temporarily configured information; the first generating module is configured to generate a first authentication vector based on the first IMSIs; and the second sending module is configured to send the first authentication vector to a security management of the network slice An entity SEAF, to indicate that the SEAF performs authentication for the network slice with the user equipment by using the first authentication vector; and the first processing module is configured to: after the authentication of the network slice is passed, indicate The user equipment accesses the network slice.

According to still another embodiment of the present application, a method for accessing a network slice is further provided, including: a second determining module, configured to determine a first network slice user subscription identity information IMSIs, wherein the first IMSIs are temporary And the configuration module is configured to configure the first IMSI to be configured to the user equipment, to indicate that the user equipment sends the first IMSI to the network side device, so that the network side device The first IMSIs are sent to the authentication service function entity AUSF; the second receiving module is configured to receive the first authentication vector generated by the AUSF based on the first IMSIs; and the authentication module is configured to pass the first authentication vector and The user equipment performs authentication for the network slice; the second processing module is configured to instruct the user equipment to access the network slice after the authentication of the network slice is passed.

According to still another embodiment of the present application, there is also provided a storage medium having stored therein a computer program, wherein the computer program is configured to execute the steps of any one of the method embodiments described above.

According to still another embodiment of the present application, there is also provided an electronic device comprising a memory and a processor, wherein the memory stores a computer program, the processor being configured to run the computer program to perform any of the above The steps in the method embodiments.

Through the present application, the user equipment needs to determine the first IMSIs currently used on the user equipment, where the first IMSIs are temporarily configured information; the user equipment sends the first IMSIs to the network side device, and the network side device sends the first IMSIs. The authentication service function entity AUSF is caused to cause the AUSF to generate a first authentication vector based on the first IMSIs; wherein the first authentication vector is used to indicate that the SEAF of the network slice performs authentication for the network slice with the user equipment by using the first authentication vector. It is not necessary to perform clear text transmission on the network slice identification information to implement network slice authentication of the user equipment, but to implement network slice authentication of the user equipment through the temporarily configured information IMSIs, and the IMSIs are different in each authentication process. . Therefore, the problem that the identification information of the network slice is easily leaked when the UE accesses the network slice in the related art can be solved, and the identification information of the network slice and the privacy of the user are achieved.

BRIEF abstract

The drawings described herein are intended to provide a further understanding of the present application, and are intended to be a part of this application. In the drawing:

1 is a block diagram showing the hardware structure of a mobile terminal for accessing a network slice according to an embodiment of the present invention;

2 is a flowchart (1) of a method for accessing a network slice according to an embodiment of the present invention;

3 is a flowchart (2) of a method for accessing a network slice according to an embodiment of the present invention;

4 is a flowchart (3) of a method for accessing a network slice according to an embodiment of the present invention;

FIG. 5 is a structural block diagram (1) of an apparatus for accessing a network slice according to an embodiment of the present invention;

6 is a structural block diagram (2) of an apparatus for accessing a network slice according to an embodiment of the present invention;

7 is a structural block diagram (3) of an apparatus for accessing a network slice according to an embodiment of the present invention.

detailed description

The present application will be described in detail below with reference to the drawings in conjunction with the embodiments. It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict.

It should be noted that the terms "first", "second" and the like in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or order.

Example 1

The method embodiment provided in Embodiment 1 of the present application can be executed in a mobile terminal, a computer terminal or the like. Taking a mobile terminal as an example, FIG. 1 is a hardware structural block diagram of a mobile terminal for accessing a network slice according to an embodiment of the present invention. As shown in FIG. 1, mobile terminal 10 may include one or more (only one shown in FIG. 1) processor 102 (processor 102 may include, but is not limited to, a processing device such as a microprocessor MCU or a programmable logic device FPGA. And a memory 104 for storing data, optionally, the above mobile terminal may further include a transmission device 106 for communication functions and an input and output device 108. It will be understood by those skilled in the art that the structure shown in FIG. 1 is merely illustrative, and does not limit the structure of the above mobile terminal. For example, the mobile terminal 10 may also include more or fewer components than those shown in FIG. 1, or have a different configuration than that shown in FIG.

The memory 104 can be used to store a computer program, such as a software program of a application software and a module, such as a computer program corresponding to a method of accessing a network slice in an embodiment of the present invention, the processor 102 running a computer program stored in the memory 104, Thereby performing various functional applications and data processing, that is, implementing the above method. Memory 104 may include high speed random access memory, and may also include non-volatile memory such as one or more magnetic storage devices, flash memory, or other non-volatile solid state memory. In some examples, memory 104 may further include memory remotely located relative to processor 102, which may be connected to mobile terminal 10 over a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

Transmission device 106 is for receiving or transmitting data via a network. The above-described network specific example may include a wireless network provided by a communication provider of the mobile terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC) that can be connected to other network devices through a base station to communicate with the Internet. In one example, the transmission device 106 can be a Radio Frequency (RF) module for communicating with the Internet wirelessly.

In this embodiment, a method for accessing a network slice is provided. FIG. 2 is a flowchart (1) of a method for accessing a network slice according to an embodiment of the present invention. As shown in FIG. 2, the process includes the following steps:

Step S202, determining first network slice user subscription identity information IMSIs currently used on the user equipment, where the first IMSIs are temporarily configured information.

Step S204, the first IMSIs are sent to the network side device to instruct the network side device to send the first IMSIs to the authentication service function entity AUSF, so that the AUSF generates a first authentication vector based on the first IMSIs. The authentication vector is used to indicate that the security management entity SEAF of the network slice performs authentication for the network slice described above with the user equipment by using the first authentication vector.

Step S206, after the authentication of the network slice is passed, accessing the network slice.

Through the above steps, the user equipment needs to determine the first IMSIs currently used on the user equipment, where the first IMSIs are temporarily configured information; the user equipment sends the first IMSIs to the network side device, and the network side device sends the first IMSIs. The authentication service function entity AUSF is caused to cause the AUSF to generate a first authentication vector based on the first IMSIs; wherein the first authentication vector is used to indicate that the SEAF of the network slice performs authentication for the network slice with the user equipment by using the first authentication vector. It is not necessary to perform clear text transmission on the network slice identification information to implement network slice authentication of the user equipment, but to implement network slice authentication of the user equipment through the temporarily configured information IMSIs, and the IMSIs are different in each authentication process. . Therefore, the problem that the identification information of the network slice is easily leaked when the UE accesses the network slice in the related art can be solved, and the identification information of the protection network slice and the effect of user privacy are achieved.

Optionally, the execution body of the foregoing steps may be a user equipment or the like, but is not limited thereto.

In an optional embodiment, after the SEAF successfully performs the authentication for the network slice by using the first authentication vector and the user equipment, the method further includes: using the first IMSI to negotiate with the SEAF, Determining the second IMSIs; updating the first IMSIs currently used on the user equipment to the second IMSIs. In this embodiment, the second IMSIs may be determined according to the MSIN temporarily allocated for the user included in the first IMSIs, or may be determined by the network side device in the same manner as determining the first IMSIs. The determined second IMSIs are different from the first IMSIs, that is, when the network slice authentication is required again, the second IMSIs are used for authentication, so that the IMSIs are temporarily set, and the identification information of the network slice can be protected. .

In an optional embodiment, updating the first IMSIs currently used on the user equipment to the second IMSIs includes: updating the first correspondence saved on the user equipment to a second correspondence, where A correspondence relationship between the subscriber identity information IMSI, the first IMSIs, and the identifier information of the network slice, where the second correspondence is the user subscription identity information IMSI, the second IMSIs, and the network slice of the user equipment. Identify the correspondence between the information. In this embodiment, after receiving the identifier information, the IMSI, and the first IMSIs of the network slice sent by the network slice, the user equipment generates a first correspondence relationship list according to the correspondence between the three information, and updates the first IMSIs to the first After an IMSI, the corresponding first relationship list is also updated to the second relationship list. Prepare for the authentication of the network slice again.

In an optional embodiment, determining that the first IMSIs include one of the following: receiving the first IMSIs configured by using the network slice according to the identifier information of the network slice, and determining, according to the first correspondence stored on the user equipment, And the first IMSIs corresponding to the identifier information of the network slice sent by the network slice, where the first correspondence is the correspondence between the user subscription identity information IMSI, the first IMSIs, and the identifier information of the network slice of the user equipment. relationship. In this embodiment, when initially performing network slice authentication, the network slice configures the first IMSIs for the user equipment; if the user equipment is not initially authenticated, the user subscription information of the user equipment has been established in the user equipment. The correspondence between the IMSI, the first IMSIs, and the identifier information of the network slice may directly determine the first IMSIs in the corresponding relationship according to the identifier information of the network slice sent by the network slice.

In an optional embodiment, after updating the first IMSIs currently used on the user equipment to the second IMSIs, the method further includes: updating the first IMSIs currently used on the user equipment to the foregoing After the two IMSIs fail, the first IMSIs are used to negotiate with the SEAF to generate third IMSIs; and the first IMSIs currently used on the user equipment are updated to the third IMSIs. In this embodiment, there are various reasons for the failure to update the first IMSIs to the second IMSIs, for example, a network failure occurs, or information included in the first IMSIs is unavailable. The generated third IMSIs may be the same as the second IMSIs, or may be different from the second IMSIs, as long as the updated third IMSIs are different from the first IMSIs.

In an optional embodiment, after determining the foregoing second IMSIs, the method further includes: if it is determined that the user equipment and the SEAF need to perform the authentication for the network slice again, the second IMSIs are Sending to the network side device; instructing the network side device to send the second IMSIs to the AUSF, so that the AUSF generates a second authentication vector based on the second IMSIs; wherein the second authentication vector is used to indicate that the SEAF passes The second authentication vector performs authentication for the network slice described above with the user equipment. In this embodiment, since the conditions for the AUSF to generate the authentication vector are different, that is, the generated first authentication vector and the second authentication vector are different each time.

In an optional embodiment, the sending, by the network side device, the first IMSI includes: sending the network attach request information that carries the first IMSIs to the network side device, where the network attach request information is used to request access to the foregoing Network side device. In this embodiment, the user equipment needs to send network attachment request information to the network side device to access the network, and then the AUSF performs the step of generating an authentication vector.

In an optional embodiment, the first IMSIs include: a mobile country code MCC, a mobile network code MNC, and a mobile subscriber identity number MSIN; wherein the MCC and the MNC in the first IMSI are subscribed to the identity information IMSI in the user. The MCC is the same as the MNC, and the MSIN is a number temporarily configured by the network slice for the user equipment. In this embodiment, since the MSIN is temporarily configured, that is, the first IMSIs are also temporarily configured, the configured IMSIs are different each time, and the security of the identification information of the network slice is ensured.

In an optional embodiment, the method includes: determining, by the user equipment, the first network slice user subscription identity information IMSIs currently used on the user equipment, where the first IMSIs are temporarily configured information; and the user equipment is to the network The side device sends the first IMSIs; the network side device sends the first IMSIs to the authentication service function entity AUSF; the AUSF generates a first authentication vector based on the first IMSIs; and the security management entity SEAF of the network slice passes the first authentication. The vector is authenticated for the network slice described above with the user equipment described above.

In this embodiment, a method for accessing a network slice is provided. FIG. 3 is a flowchart (2) of a method for accessing a network slice according to an embodiment of the present invention. As shown in FIG. 3, the process includes the following steps:

Step S302: Receive first network slice user subscription identity information IMSIs sent by the network side device, where the first IMSIs are temporarily configured information.

Step S304, generating a first authentication vector based on the first IMSIs.

Step S306: The first authentication vector is sent to the security management entity (SEAF) of the network slice to instruct the SEAF to perform authentication for the network slice with the user equipment by using the first authentication vector.

Step S308, after the authentication of the network slice is passed, instructing the user equipment to access the network slice.

Through the above steps, the AUSF on the network side receives the first IMSIs sent by the network side device, where the first IMSIs are temporarily configured information; the first authentication vector is generated based on the first IMSIs; and the first authentication vector is sent to the network slice. The SEAF is used to instruct the SEAF to perform authentication for the network slice with the user equipment through the first authentication vector. It is not necessary to perform clear text transmission on the network slice identification information to implement network slice authentication of the user equipment, but to implement network slice authentication of the user equipment through the temporarily configured information IMSIs, and the IMSIs are different in each authentication process. . Therefore, the problem that the identification information of the network slice is easily leaked when the UE accesses the network slice in the related art can be solved, and the identification information of the protection network slice and the effect of user privacy are achieved.

Optionally, the execution body of the foregoing step may be an authentication service function entity on the network side, but is not limited thereto.

In an optional embodiment, generating the foregoing first authentication vector based on the foregoing first IMSIs includes: searching for the user subscription identity information IMSI corresponding to the first IMSIs in the first correspondence saved on the authentication service function entity AUSF And generating, according to the foregoing IMSI, a first authentication vector corresponding to the first IMSIs, where the first correspondence is a correspondence between the user subscription identity information IMSI, the first IMSIs, and the identifier information of the network slice. In this embodiment, the AUSF and the user equipment generate a correspondence relationship list according to the correspondence between the user subscription identity information IMSI, the first IMSIs, and the identifier information of the network slice, and the correspondence lists on both sides are updated synchronously. . That is, the corresponding relationships included are the same.

In an optional embodiment, after the foregoing SEAF successfully performs the authentication for the network slice by using the first authentication vector and the user equipment, the method further includes: receiving the second IMSIs sent by the SEAF, where the foregoing The second IMSIs are determined by the foregoing user equipment and the foregoing SEAF through negotiation; and the first IMSIs currently used on the authentication service function entity AUSF are updated to the second IMSIs. In this embodiment, when updating the first correspondence, the AUSF receives the first IMSIs updated by the SEAF, and is not the IMSIs received from the network side.

In an optional embodiment, updating the first IMSIs currently used on the AUSF to the second IMSIs includes: updating a first correspondence saved on the AUSF to a second correspondence, where the first Corresponding relationship is a correspondence between the user subscription identity information IMSI, the first IMSIs, and the identifier information of the network slice, where the second correspondence is between the user subscription identity information IMSI, the second IMSIs, and the identifier information of the network slice. Correspondence relationship.

In an optional embodiment, after updating the first IMSIs currently used on the AUSF to the second IMSIs, the method further includes: updating the first IMSIs currently used on the AUSF to the second After the failure of the IMSIs, the third IMSIs sent by the SEAF are received, wherein the third IMSIs are determined by the user equipment and the SEAF through negotiation; and the first IMSIs currently used on the AUSF are updated to the third IMSIs.

In an optional embodiment, after determining the foregoing second IMSIs, the method further includes: receiving, after determining that the user equipment and the SEAF need to perform the authentication for the network slice again, receiving the network side device. Transmitting the second IMSIs, wherein the second IMSIs are temporarily configured information; generating a second authentication vector based on the second IMSIs; and sending the second authentication vector to the SEAF to indicate that the SEAF passes the second authentication vector and The user equipment performs authentication for the network slice described above.

In an optional embodiment, the receiving, by the network side device, the first IMSI includes: receiving the network attach request information that is sent by the network side and carrying the first IMSI, where the network attach request information is used for requesting Enter the above network side device.

In an optional embodiment, the first IMSIs include: a mobile country code MCC, a mobile network code MNC, and a mobile subscriber identity number MSIN; wherein the MCC and the MNC in the first IMSI are subscribed to the identity information IMSI in the user. The MCC is the same as the MNC, and the MSIN is a number temporarily configured by the network slice for the user equipment.

In an optional embodiment, the authentication service function entity AUSF receives the first network slice subscriber subscription identity information IMSIs sent by the network side device, where the first IMSIs are temporarily configured information; the foregoing AUSF is based on the first IMSIs. Generating a first authentication vector; the AUSF sends the first authentication vector to the security management entity SEAF of the network slice; and the SEAF performs authentication for the network slice with the user equipment by using the first authentication vector.

In this embodiment, a method for accessing a network slice is provided. FIG. 4 is a flowchart (3) of a method for accessing a network slice according to an embodiment of the present invention. As shown in FIG. 4, the process includes the following steps:

Step S402, the first network slice user subscription identity information IMSIs is determined, where the first IMSIs are information temporarily configured to the user equipment.

Step S404, the first IMSIs are configured to be sent to the user equipment, so that the user equipment sends the first IMSIs to the network side device, so that the network side device sends the first IMSIs to the authentication service function entity AUSF.

Step S406: Receive a first authentication vector generated by the AUSF based on the first IMSIs.

Step S408, performing authentication for the network slice by using the first authentication vector and the user equipment.

Step S410, after the authentication of the network slice is passed, instructing the user equipment to access the network slice.

Through the above steps, the first IMSIs are determined by the security management entity SEAF of the network slice, wherein the first IMSIs are information temporarily configured for the user equipment; and the first IMSIs are configured to the user equipment to indicate that the user equipment will use the first IMSIs. Sending to the network side device, so that the network side device sends the first IMSIs to the AUSF; then receives the first authentication vector generated by the AUSF based on the foregoing first IMSIs; and performs authentication for the network slice with the user equipment by using the first authentication vector. It is not necessary to perform clear text transmission on the network slice identification information to implement network slice authentication of the user equipment, but to implement network slice authentication of the user equipment through the temporarily configured information IMSIs, and the IMSIs are different in each authentication process. . Therefore, the problem that the identification information of the network slice is easily leaked when the UE accesses the network slice in the related art can be solved, and the identification information of the protection network slice and the effect of user privacy are achieved.

Optionally, the execution body of the foregoing step may be a security management entity SEAF of the network slice, but is not limited thereto.

In an optional embodiment, determining the foregoing IMSIs includes: configuring the first IMSIs based on the identifier information of the network slice.

In an optional embodiment, after successfully performing the foregoing authentication for the network slice by using the foregoing first authentication vector and the foregoing user equipment, the method further includes: negotiating with the user equipment by using the first IMSI to determine Sending, by the second IMSIs, the foregoing second IMSIs to the AUSF, to instruct the AUSF to update the first IMSIs currently used by the AUSF to the second IMSIs.

In an optional embodiment, after the sending the second IMSIs to the AUSF, the method further includes: after determining that the first IMSIs currently used on the AUSF is updated to the second IMSIs, using the foregoing An IMSIs negotiates with the user equipment to generate a third IMSIs, and sends the third IMSIs to the AUSF to instruct the AUSF to update the first IMSIs currently used by the AUSF to the third IMSIs.

In an optional embodiment, after determining the foregoing second IMSIs, the method further includes: configuring, after determining that the user equipment and the SEAF need to perform the authentication for the network slice again, configuring the second IMSIs And the user equipment is sent to the user equipment to send the second IMSIs to the network side device, so that the network side device sends the second IMSIs to the authentication service function entity AUSF; and the receiving the AUSF is generated based on the second IMSIs. a second authentication vector; performing authentication for the network slice by using the second authentication vector and the user equipment.

In an optional embodiment, the security management entity SEAF determines the first network slice user subscription identity information IMSIs, wherein the first IMSIs are information temporarily configured to the user equipment; and the SEAF configures the first IMSIs to The user equipment sends the first IMSIs to the network side device; the network side device sends the first IMSIs to the authentication service function entity AUSF; and the SEAF receives the first authentication generated by the AUSF based on the first IMSIs. a vector; the SEAF performs authentication for the network slice by using the first authentication vector and the user equipment.

Through the description of the above embodiments, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware, but in many cases, the former is A better implementation. Based on such understanding, the technical solution of the present application, which is essential or contributes to the related art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk, CD-ROM). The instructions include a plurality of instructions for causing a terminal device (which may be a cell phone, a computer, a server, or a network device, etc.) to perform the above-described methods of various embodiments of the present application.

Example 2

An authentication device for network slicing is also provided in this embodiment, and the device is used to implement the foregoing embodiments and preferred embodiments, and details are not described herein. As used below, the term "module" may implement a combination of software and/or hardware of a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.

FIG. 5 is a structural block diagram (1) of an authentication apparatus for network slice according to an embodiment of the present invention. As shown in FIG. 5, the apparatus includes: a first determining module 52, a first sending module 54, and a first access module. 56, the device is described in detail below:

The first determining module 52 is configured to determine first network slice user subscription identity information IMSIs currently used on the user equipment, where the first IMSIs are temporarily configured information, and the first sending module 54 is connected to the first determining module. The first IMSIs are sent to the network side device to instruct the network side device to send the first IMSIs to the authentication service function entity AUSF, so that the AUSF generates a first authentication vector based on the first IMSIs. The first authentication vector is used to indicate that the security management entity SEAF of the network slice performs authentication for the network slice with the user equipment by using the first authentication vector, and the first access module 56 is connected to the first sending module. 54 is configured to access the network slice after the authentication of the network slice is passed.

In an optional embodiment, after the SEAF successfully performs the authentication for the network slice by using the first authentication vector and the user equipment, the device further includes: a third determining module, configured to use the foregoing first IMSIs and the foregoing SEAF Negotiating to determine the second IMSIs; the first update module is connected to the third determining module in the foregoing, for updating the first IMSIs currently used on the user equipment to the second IMSIs.

In an optional embodiment, the first update module updates the first IMSIs currently used on the user equipment to the second IMSIs by updating the first correspondence saved on the user equipment to the second correspondence. The first correspondence is a correspondence between the user subscription identity information IMSI, the first IMSIs, and the identifier information of the network slice, where the second correspondence is the user subscription identity information IMSI of the user equipment, and the foregoing The correspondence between the two IMSIs and the identification information of the above network slice.

In an optional embodiment, the foregoing apparatus determines, by one of the following manners, the first IMSIs: receiving the foregoing first IMSIs configured by the network slice based on the identifier information of the network slice; and according to the first correspondence saved on the user equipment Determining the first IMSIs corresponding to the identifier information of the network slice sent by the network slice, where the first correspondence is the user subscription identity information IMSI of the user equipment, the first IMSI, and the identifier information of the network slice. Correspondence between the two.

In an optional embodiment, after updating the first IMSIs currently used on the user equipment to the second IMSIs, the apparatus further includes a second generating module, configured to use the foregoing information currently used on the user equipment. After the first IMSIs are updated to fail the foregoing second IMSIs, the foregoing first IMSIs are used to negotiate with the SEAF to generate a third IMSIs; and the second update module is connected to the second generation module in the foregoing, for using the user equipment. The above first IMSIs currently used on the above are updated to the above third IMSIs.

In an optional embodiment, after determining the foregoing second IMSIs, the apparatus further includes: a third sending module, configured to determine, in the case that the user equipment and the SEAF need to perform the authentication for the network slice again And sending the second IMSIs to the network side device, where the first indication module is connected to the third sending module, configured to instruct the network side device to send the second IMSIs to the AUSF, so that the AUSF is based on the second The IMSIs generate a second authentication vector, where the second authentication vector is used to indicate that the SEAF performs authentication for the network slice with the user equipment by using the second authentication vector.

In an optional embodiment, the first sending module 54 sends the first IMSIs to the network side device by sending, to the network side device, the network attach request information that carries the first IMSIs, where the network attach request is sent. The information is used to request access to the network side device.

In an optional embodiment, the user equipment determines the first network slice subscriber subscription identity information IMSIs currently used on the user equipment, where the first IMSIs are temporarily configured information; the user equipment sends the foregoing to the network side device. a first IMSI; the network side device sends the first IMSIs to the authentication service function entity AUSF; the AUSF generates a first authentication vector based on the first IMSIs; and the security management entity SEAF of the network slice passes the first authentication vector and the foregoing The user equipment performs authentication for the above network slice.

FIG. 6 is a structural block diagram (2) of an authentication apparatus for network slicing according to an embodiment of the present invention. As shown in FIG. 6, the apparatus includes: a first receiving module 62, a first generating module 64, and a second sending module 66. And the first processing module 68, the device is described in detail below:

The first receiving module 62 is configured to receive the first network slice user subscription identity information IMSIs sent by the network side device, where the first IMSIs are temporarily configured information, and the first generation module 64 is connected to the first receiving in the foregoing. The module 62 is configured to generate a first authentication vector based on the foregoing first IMSIs, and the second sending module 66 is connected to the first generating module in the foregoing, and is configured to send the first authentication vector to the security management entity SEAF of the network slice. Instructing the SEAF to perform authentication for the network slice with the user equipment by using the first authentication vector, and the first processing module 68 is connected to the second sending module 66 for authenticating the network slice. After passing, the user equipment is instructed to access the network slice.

In an optional embodiment, the first generating module 64 generates the foregoing first authentication vector based on the foregoing first IMSIs by: searching for the first correspondence in the first correspondence saved on the authentication service function entity AUSF The user-signed identity information IMSI corresponding to the IMSI; generating the first authentication vector corresponding to the first IMSIs based on the IMSI; wherein the first correspondence is the user subscription identity information IMSI, the first IMSI, and the identifier of the network slice The correspondence between the information.

In an optional embodiment, after the foregoing SEAF successfully performs the authentication for the network slice by using the foregoing first authentication vector and the user equipment, the apparatus is further configured to: receive the second IMSIs sent by the SEAF, where The second IMSIs are determined by the user equipment and the SEAF in a negotiated manner; and the first IMSIs currently used on the authentication service function entity AUSF are updated to the second IMSIs.

In an optional embodiment, the foregoing device updates the first IMSIs currently used on the AUSF to the second IMSIs by updating the first correspondence saved on the AUSF to a second correspondence, where The first correspondence is a correspondence between the user subscription identity information IMSI, the first IMSIs, and the identifier information of the network slice, where the second correspondence is the user subscription identity information IMSI, the second IMSIs, and the foregoing network. Correspondence between the identification information of the slice.

In an optional embodiment, after updating the first IMSIs currently used on the AUSF to the second IMSIs, the apparatus is further configured to: update the first IMSIs currently used on the AUSF to the foregoing After the second IMSIs fail, the third IMSIs sent by the SEAF are received, wherein the third IMSIs are determined by the user equipment and the SEAF through negotiation; and the first IMSIs currently used on the AUSF are updated to the third IMSIs.

In an optional embodiment, after determining the second IMSIs, the foregoing apparatus is further configured to: when determining that the user equipment and the SEAF need to perform the authentication for the network slice again, receive the network side. The second IMSIs sent by the device, where the second IMSIs are temporarily configured information; generating a second authentication vector based on the second IMSIs; and sending the second authentication vector to the SEAF to indicate that the SEAF passes the second The authentication vector is authenticated with the user equipment described above for the network slice described above.

In an optional embodiment, the first receiving module 62 receives the first IMSIs sent by the network side device by receiving the network attach request information that is sent by the network side and carries the first IMSIs, where The network attachment request information is used to request access to the network side device.

In an optional embodiment, the authentication service function entity AUSF receives the first network slice subscriber subscription identity information IMSIs sent by the network side device, where the first IMSIs are temporarily configured information; the foregoing AUSF is generated based on the first IMSIs. a first authentication vector; the AUSF sends the first authentication vector to the security management entity SEAF of the network slice; and the SEAF performs authentication for the network slice with the user equipment by using the first authentication vector.

7 is a structural block diagram (3) of an authentication apparatus for network slicing according to an embodiment of the present invention. As shown in FIG. 7, the apparatus includes: a second determining module 72, a configuration module 74, a second receiving module 76, and authentication. Module 78 and second processing module 710, the device is described in detail below:

The second determining module 72 is configured to determine the first network slice user subscription identity information IMSIs, where the first IMSIs are information temporarily configured to the user equipment, and the configuration module 74 is connected to the second determining module in the foregoing, The first IMSIs are configured to the user equipment, to indicate that the user equipment sends the first IMSIs to the network side device, so that the network side device sends the first IMSIs to the authentication service function entity AUSF; and the second receiving module 76 The configuration module 74 is connected to the first authentication vector generated by the AUSF based on the first IMSIs, and the authentication module 78 is connected to the second receiving module 76 for using the first authentication vector. The user equipment performs authentication for the network slice, and the second processing module 710 is connected to the authentication module 78 for indicating that the user equipment accesses the network slice after the authentication of the network slice is passed.

In an optional embodiment, the determining, by the second determining module 72, the IMSIs by: configuring the first IMSIs based on the identifier information of the network slice.

In an optional embodiment, the device is further configured to negotiate with the user equipment by using the first IMSIs after the user equipment is successfully authenticated by using the foregoing first authentication vector and the user equipment. Determining the second IMSIs; transmitting the second IMSIs to the AUSF, to instruct the AUSF to update the first IMSIs currently used by the AUSF to the second IMSIs.

In an optional embodiment, after the sending the foregoing second IMSIs to the AUSF, the foregoing apparatus is further configured to: after determining that the first IMSIs currently used on the AUSF is updated to the second IMSIs, The first IMSIs negotiate with the user equipment to generate a third IMSIs, and send the third IMSIs to the AUSF to instruct the AUSF to update the first IMSIs currently used by the AUSF to the third IMSIs.

In an optional embodiment, after determining the second IMSIs, the foregoing apparatus is further configured to: when determining that the user equipment and the SEAF need to perform the authentication for the network slice again, The IMSIs are configured to be sent to the user equipment to indicate that the user equipment sends the second IMSIs to the network side device, so that the network side device sends the second IMSIs to the authentication service function entity AUSF; and the receiving the AUSF is based on the second IMSIs. Generating a second authentication vector; performing authentication for the network slice by using the second authentication vector and the user equipment.

In an optional embodiment, the security management entity SEAF determines the first network slice user subscription identity information IMSIs, wherein the first IMSIs are information temporarily configured to the user equipment; the SEAF configures the first IMSIs to the user The user equipment sends the first IMSIs to the network side device; the network side device sends the first IMSIs to the authentication service function entity AUSF; and the SEAF receives the first authentication vector generated by the AUSF based on the first IMSIs; The SEAF performs authentication for the network slice by using the first authentication vector and the user equipment.

It should be noted that each of the above modules may be implemented by software or hardware. For the latter, the foregoing may be implemented by, but not limited to, the foregoing modules are all located in the same processor; or, the above modules are in any combination. The forms are located in different processors.

The present application is described in detail below in conjunction with specific embodiments:

Specific embodiment 1:

In the 5G network architecture, a virtual core network constructed based on network service requirements is called a network slice, and a network slice forms a virtual core network to provide a mobile network access service for a group of specific user terminals. A typical network slice includes a set of virtualized core network functions, such as a slice control plane unit, which is mainly responsible for slice mobility, session management, and authentication authentication related functions. The slice user plane unit mainly provides users with sliced user resources. The slice policy control unit is responsible for the function of the user policy, and the slice charging unit is responsible for the charging function of the user. The function of network slicing is determined by the operator according to the requirements and the operator's policy. For example, some network slices may include a dedicated forwarding plane in addition to the control plane function; and some network slices may only include some basic control plane functions. Other core network related functions are shared with other network slices. Network slices may be created, modified, or deleted based on requirements. A UE may also receive services from different network slices simultaneously.

In the related 3G/4G mobile communication system, since there is no network slice, the authentication and key agreement (AKA) AKA authentication is adopted, and the UE directly accesses the service provided by the core network after accessing the network. In the 5G system, after the network slice concept is introduced, the UE needs to access the network slice after attaching to the network. When accessing the network slice, the UE needs to send the slice identification information to the network, and the network determines the network slice accessed by the UE according to the slice identification information. If the UE sends the network slice identification information in the plaintext mode when accessing the network slice, the attacker may collect the UE information of the access network slice, and based on the collected UE information of a certain network slice that is accessed to the group of UEs. Conduct a denial of service attack. Therefore, how to protect the privacy of the network slice identification information is a technical problem that the 5G system needs to solve in the case of ensuring that the UE accesses the network slice.

In order to solve the privacy security problem of the identification information of the network slice when the UE accesses the network slice in the 5G communication system in the related art. This embodiment provides the following technical solutions:

The network slice configures one network slice subscriber subscription identity information IMSIs for each user allowed to access the network slice. That is, before the user equipment determines the currently used first network slice subscriber subscription identity information IMSIs, the user equipment already knows the network slice that it is allowed to access, and the first IMSIs determined by the device is a temporary subscriber subscription identity information. That is, it is determined for the network slice that access is allowed for one access. The IMSIs used to re-access the network slice are different each time. The first IMSIs include an international mobile subscriber identity (IMSI), corresponding to the user subscription identity information, the Mobile Country Code (MCC), and the Mobile Network Code (MNC). , Mobile Subscriber Identification Number (MSIN). The MCC and the MNC are the same as the MCC and the MNC of the corresponding part of the user's permanent subscription identity information IMSI, and the MSIN part is a number temporarily assigned by the network slice to the slice user (corresponding to the user equipment in the above).

In this embodiment, the IMSIs are valid temporary user subscription identity information generated by the network slice. The first IMSIs and the second IMSIs in the above are the same as the IMSIs concept in the specific embodiment.

In this embodiment, the user subscription data information is information for the user equipment to perform network slice access, and includes at least user subscription identity information IMSI, network slice user subscription identity information IMSIs, and network slice information SliceID.

In this embodiment, a user subscription identity information IMSI may correspond to a plurality of different network slice subscriber subscription identity information IMSIs, and each IMSIs corresponds to a network slice, that is, the first correspondence relationship and the second correspondence relationship in the foregoing are indicated. The content of the corresponding relationship.

On the network side (which may be for the network side of the network side device in the above), the user of the home network subscribes to a data management entity, such as an Authentication Service Function (AUSF), to manage and maintain the user subscription data. Of course, it can also be other data management entities. The AUSF saves, manages, and maintains a correspondence list of IMSI, IMSIs, and SliceID (the same as the first correspondence in the above, the concept of the second correspondence), where one IMSI can be associated with multiple IMSIs and their corresponding SliceIDs. correspond.

On the network side, the slice can contain a security management entity, Security Anchor Function (SEAF), which is a security anchor in the network slice. The SEAF of the network slice can allocate one IMSIs for one IMSI. The SEAF of the network slice may generate a new IMSIs-new (corresponding to the second IMSIs in the above) based on the IMSIs.

The slice may also include an Access and Mobility Management Function (AMF) for mobility management of the UE.

On the terminal side (which may be for the terminal side of the user equipment in the above), the UE maintains and manages the user subscription data. The UE saves, manages, and maintains a list of correspondences of IMSI, IMSIs, and SliceID. An IMSI can correspond to a plurality of different IMSIs and their corresponding SliceIDs. The UE may generate a new IMSIs-new based on the IMSIs.

In this embodiment, the SEAF of the UE and the network slice may generate the same new IMSIs-new based on the IMSIs (corresponding to the first IMSIs in the foregoing) in the same manner by negotiation (corresponding to the second in the foregoing). IMSIs).

When the UE attaches to the network, the UE sends the attach request information to the 5G base station gNB, where the attach request information includes the IMSIs.

After receiving the attach request information sent by the UE, the gNB (corresponding to the network side device in the above) further sends the attach request information to the authentication service function entity AUSF. After receiving the attach request information, the AUSF searches for the corresponding IMSI and the network slice identifier SliceID based on the IMSIs. Then, a corresponding authentication vector (corresponding to the first authentication vector in the above) is generated based on the IMSI, and then the IMSI, the IMSIs, and the authentication vector information are sent to the SEAF of the network slice corresponding to the network slice identifier SliceID.

After receiving the IMSI, IMSIs, and authentication vector information, the SEAF performs AKA authentication with the UE through the authentication vector.

After the authentication succeeds, the SEAF and the UE can synchronously generate an identical new network slice subscriber subscription identity information IMSIs-new based on the IMSIs in the same generation manner.

The UE deletes the old IMSIs in the correspondence list of the IMSI, the IMSIs, and the SliceID, and saves the new IMSIs-new, that is, updates the first correspondence in the user equipment to the second correspondence.

The SEAF further sends the IMSI and the new network slice subscriber subscription identity information IMSIs-new to the AUSF.

The AUSF deletes the old IMSIs in the correspondence list of IMSI, IMSIs and SliceID, and saves the new IMSIs-new. That is, the first correspondence in the AUSF is updated to the second correspondence.

After updating the correspondence list of IMSI, IMSIs and SliceID, AUSF can feed back confirmation information to SEAF.

The SEAF may further feed back the acknowledgment information to the UE. If the UE completes updating the correspondence list of the IMSI, the IMSIs, and the SliceID, after receiving the acknowledgment information, the UE returns a confirmation response message to the SEAF. The SEAF may further send a feedback confirmation response message to the AUSF. If the UE does not complete the update relationship list of the IMSI, the IMSIs, and the SliceID (that is, if the update fails), after receiving the confirmation information, the UE returns a confirmation failure response message to the SEAF, and then restarts between the UE and the SEAF. Negotiating the process of generating a new IMSIs-new, and further completing the correspondence list of the updated IMSI, IMSIs, and SliceID between the UE and the AUSF, and completing the correspondence list update confirmation process of the IMSI, IMSIs, and SliceID.

In this embodiment, by using the network slice user subscription identity information IMSIs, the process of sending the network slice identification information to the network when the UE attaches to the network is avoided, thereby ensuring the privacy security of the network slice identity information.

Specific embodiment 2:

This embodiment provides a UE, including:

The first sending module is configured to send the attach request information to the network. The attach request information includes a network slice user subscription identity information IMSIs of the user;

The first authentication module (corresponding to the authentication module in the foregoing) is used for access authentication between the UE and the network slice.

a first update module (corresponding to updating the first correspondence stored on the UE to the second correspondence), for the UE to sign the identity information based on the old network slice user (on the basis of the negotiation with the network slice) The first IMSIs in the above) generate new network slice subscriber subscription identity information (corresponding to the second IMSIs in the above).

The first management module is configured to save, update, and maintain a correspondence list of the IMSI, the IMSIs, and the SliceID. (corresponding to updating the first correspondence stored on the UE to the second correspondence in the above)

Preferably, the embodiment provides a network security anchor function entity SEAF, including:

a second receiving module, configured to receive IMSI, IMSIs, and authentication vector information from the AUSF, for receiving update confirmation information;

a second authentication module (corresponding to the authentication module in the foregoing), configured to perform access authentication with the UE;

a second update module (corresponding to updating the first correspondence stored on the AUSF to the second correspondence in the foregoing), and the SEAF is based on the old network slice user subscription identity information (corresponding to the negotiation with the UE) The first IMSIs in the above) generate new network slice user subscription identity information (corresponding to the second IMSIs in the above).

The second sending module is configured to send the network slice user subscription identity information and the update confirmation response information.

Preferably, the embodiment provides an authentication service function entity AUSF, including:

The third receiving module (corresponding to the first receiving module in the foregoing) is configured to receive the network slice user subscription identity information sent by the gNB from the UE, and simultaneously receive the new network slice user subscription identity information sent by the SEAF.

An authentication vector generation module (corresponding to the authentication module in the above) is used to generate an authentication vector.

The second management module (corresponding to updating the first correspondence stored on the AUSF to the second correspondence) to save, update, and maintain the correspondence list of the IMSI, the IMSIs, and the SliceID.

The third sending module is configured to send the authentication information and the update confirmation information.

Preferably, the embodiment provides a slice identification information protection system, including:

The UE is configured to send the attach request information including the network slice user subscription identity information IMSIs, generate a new network slice user subscription identity information, and save, update, and maintain a correspondence list of the IMSI, the IMSIs, and the SliceID.

The security anchor function entity SEAF is used for performing access authentication with the UE, and generating new network slice user subscription identity information;

The authentication service function entity AUSF is used to generate an authentication vector, and save, update, and maintain a correspondence list of IMSI, IMSIs, and SliceID.

Specific Example 3:

In this embodiment, the scheme described in the specific embodiments 1 and 2 is combined to further describe the authentication of the network slice:

In this embodiment, the SEAF of the UE and the network slice may generate an identical new IMSIs-new based on the IMSIs in the same manner by negotiation.

The attachment scheme of the UE based on the network slice user subscription identity information provided in this embodiment may specifically include the following content:

When the UE attaches to the network, the UE sends the attach request information to the 5G base station gNB. The attachment request information includes IMSIs;

After receiving the attach request information sent by the UE, the gNB further sends the attach request information to the authentication service function entity AUSF;

After receiving the access request information, the authentication service function entity AUSF searches for the corresponding IMSI and the network slice identifier SliceID based on the IMSIs. Then generating a corresponding authentication vector based on the IMSI, and then transmitting the IMSI, the IMSIs, and the authentication vector information to the SEAF of the network slice corresponding to the network slice identifier SliceID;

After the authentication succeeds, the SEAF and the UE may synchronously generate an identical new network slice subscriber subscription identity information IMSIs-new based on the IMSIs in the same generation manner through negotiation;

The UE deletes the old IMSIs in the correspondence list of the IMSI, the IMSIs, and the SliceID, and saves the new IMSIs-new;

The SEAF further sends the IMSI and the new network slice subscriber subscription identity information IMSIs-new to the AUSF;

AUSF deletes the old IMSIs in the correspondence list of IMSI, IMSIs and SliceID, and saves the new IMSIs-new;

After updating the correspondence list of the IMSI, the IMSIs, and the SliceID, the AUSF may feed back the confirmation information to the SEAF;

The SEAF may further feed back confirmation information to the UE;

If the UE completes updating the correspondence list of the IMSI, the IMSIs, and the SliceID, after receiving the confirmation information, the UE sends a confirmation response message to the SEAF;

The SEAF forwards the feedback confirmation response message to the AUSF.

The UE device provided in this embodiment includes: a first sending module, a first authentication module (corresponding to the first access module in the foregoing), a first update module, and a first management module.

The first sending module is configured to send the attach request information and the confirmation response information to the network. The attach request information includes a network slice user subscription identity information IMSIs of the user;

a first authentication module, configured to perform access authentication between the UE and the network slice;

a first update module, configured to generate a new network slice user subscription identity information based on the old network slice user subscription identity information on the basis of the negotiation with the network slice;

a first management module, configured to save, update, and maintain a correspondence list of IMSI, IMSIs, and SliceID;

The network security anchor function entity provided in this embodiment includes:

a second update module, configured to generate, by the SEAF, a new network slice user subscription identity information based on the old network slice user subscription identity information;

a second sending module, configured to send network slice user subscription identity information and update confirmation response information;

The network authentication service function entity AUSF includes:

An authentication vector generation module, configured to generate an authentication vector;

a second management module, configured to save, update, and maintain a correspondence list of the IMSI, the IMSIs, and the SliceID;

a third sending module, configured to send the authentication information and the update confirmation information;

The network slice identification information protection system provided in this embodiment includes: the UE device, the network security anchor function entity SEAF, and the network authentication service function entity described in the foregoing embodiments.

Embodiments of the present application also provide a storage medium having stored therein a computer program, wherein the computer program is configured to execute the steps of any one of the method embodiments described above.

Alternatively, in the present embodiment, the above storage medium may be arranged to store a computer program for performing the above steps.

Optionally, in this embodiment, the foregoing storage medium may include, but not limited to, a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, and a magnetic A variety of media that can store computer programs, such as a disc or an optical disc.

Embodiments of the present application also provide an electronic device including a memory and a processor having a computer program stored therein, the processor being configured to execute a computer program to perform the steps of any of the above method embodiments.

Optionally, the electronic device may further include a transmission device and an input and output device, wherein the transmission device is connected to the processor, and the input and output device is connected to the processor.

For example, the specific examples in this embodiment may refer to the examples described in the foregoing embodiments and the optional embodiments, and details are not described herein again.

Obviously, those skilled in the art should understand that the above modules or steps of the present application can be implemented by a general computing device, which can be concentrated on a single computing device or distributed in a network composed of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein. The steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated as a single integrated circuit module. Thus, the application is not limited to any particular combination of hardware and software.

The above description is only the preferred embodiment of the present application, and is not intended to limit the present application, and various changes and modifications may be made to the present application. Any modifications, equivalent substitutions, improvements, etc. made within the principles of this application are intended to be included within the scope of the present application.

Claims

A method for accessing a network slice includes:

Determining first network slice user subscription identity information IMSIs currently used on the user equipment, where the first IMSIs are temporarily configured information;

Sending, by the network side device, the first IMSIs, to instruct the network side device to send the first IMSIs to an authentication service function entity AUSF, so that the AUSF generates a first authentication vector based on the first IMSIs;

The first authentication vector is used to indicate that the security management entity SEAF of the network slice performs authentication for the network slice with the user equipment by using the first authentication vector.

After the authentication of the network slice is passed, the network slice is accessed.
The method according to claim 1, after the SEAF successfully performs authentication for the network slice with the user equipment by using the first authentication vector, the method further includes:

Negotiating with the SEAF using the first IMSIs to determine second IMSIs;

Updating the first IMSIs currently used on the user equipment to the second IMSIs.
The method of claim 2, wherein updating the first IMSIs currently used on the user equipment to the second IMSIs comprises:

Updating the first correspondence that is saved on the user equipment to a second correspondence, where the first correspondence is between the user subscription identity information IMSI, the first IMSI, and the identifier information of the network slice. Corresponding relationship, the second correspondence is a correspondence between user subscription identity information IMSI, the second IMSIs, and identifier information of the network slice of the user equipment.
The method of claim 1 wherein said determining that the first IMSI currently in use on the user equipment comprises one of:

Receiving, by the network slice, the first IMSIs configured based on the identifier information of the network slice;

Determining, according to the first correspondence that is saved on the user equipment, the first IMSIs corresponding to the identifier information of the network slice sent by the network slice, where the first correspondence is a user of the user equipment Correspondence between the identity information IMSI, the first IMSIs, and the identification information of the network slice.
The method according to claim 2, after updating the first IMSIs currently used on the user equipment to the second IMSIs, the method further includes:

After updating the first IMSIs currently used on the user equipment to the second IMSIs, using the first IMSIs to negotiate with the SEAF to generate third IMSIs;

Updating the first IMSIs currently used on the user equipment to the third IMSIs.
The method of claim 2, after determining the second IMSIs, the method further comprising:

And determining, in the case that the user equipment and the SEAF need to perform the authentication for the network slice again, sending the second IMSIs to the network side device;

Instructing the network side device to send the second IMSIs to the AUSF, so that the AUSF generates a second authentication vector based on the second IMSIs;

The second authentication vector is used to instruct the SEAF to perform authentication for the network slice with the user equipment by using the second authentication vector.
The method of claim 1, wherein the transmitting the first IMSIs to the network side device comprises:

Sending network attach request information carrying the first IMSIs to the network side device, where the network attach request information is used to request access to the network side device.
The method of claim 1 wherein said first IMSIs comprise:

Mobile country code MCC, mobile network code MNC and mobile subscriber identification number MSIN;

The MCC and the MNC in the first IMSI are the same as the MCC and the MNC in the user subscription identity information IMSI, where the MSIN is a number temporarily configured by the network slice for the user equipment.
The method of claim 1 comprising:

Determining, by the user equipment, the first network slice user subscription identity information IMSIs currently used on the user equipment, where the first IMSIs are temporarily configured information;

Transmitting, by the user equipment, the first IMSIs to a network side device;

Sending, by the network side device, the first IMSIs to an authentication service function entity AUSF;

Generating, by the AUSF, a first authentication vector based on the first IMSIs;

The security management entity SEAF of the network slice performs authentication for the network slice with the user equipment by using the first authentication vector.
A method for accessing a network slice includes:

Receiving, by the network side device, the first network slice user subscription identity information IMSIs, where the first IMSIs are temporarily configured information;

Generating a first authentication vector based on the first IMSIs;

Sending the first authentication vector to the security management entity SEAF of the network slice to instruct the SEAF to perform authentication for the network slice with the user equipment by using the first authentication vector;

After the authentication of the network slice is passed, the user equipment is instructed to access the network slice.
The method of claim 10, wherein generating the first authentication vector based on the first IMSIs comprises:

Searching for the user subscription identity information IMSI corresponding to the first IMSIs in the first correspondence stored on the authentication service function entity AUSF;

Generating the first authentication vector corresponding to the first IMSIs based on the IMSI;

The first correspondence relationship is a correspondence between the user subscription identity information IMSI, the first IMSIs, and the identifier information of the network slice.
The method according to claim 10, after the SEAF successfully performs authentication for the network slice with the user equipment by using the first authentication vector, the method further includes:

Receiving, by the SEIF, the second IMSIs, where the second IMSIs are determined by the user equipment and the SEAF through negotiation;

The first IMSIs currently used on the authentication service function entity AUSF are updated to the second IMSIs.
The method of claim 12, wherein updating the first IMSIs currently used on the AUSF to the second IMSIs comprises:

Updating the first correspondence stored on the AUSF to a second correspondence, where the first correspondence is a correspondence between user subscription identity information IMSI, the first IMSI, and identifier information of the network slice The second corresponding relationship is a correspondence between the user subscription identity information IMSI, the second IMSIs, and identifier information of the network slice.
The method of claim 12, after updating the first IMSIs currently used on the AUSF to the second IMSIs, the method further comprising:

After updating the first IMSIs currently used on the AUSF to the second IMSIs, receiving the third IMSIs sent by the SEAF, where the third IMSIs are the user equipment and the SEAF passing Determined by negotiation;

Updating the first IMSIs currently used on the AUSF to the third IMSIs.
The method of claim 12, after determining the second IMSIs, the method further comprising:

Receiving, in the case that the user equipment and the SEAF need to perform the authentication for the network slice again, receiving the second IMSIs sent by the network side device, where the second IMSIs are temporarily configured. Information;

Generating a second authentication vector based on the second IMSIs;

Sending the second authentication vector to the SEAF to instruct the SEAF to perform authentication for the network slice with the user equipment by using the second authentication vector.
The method of claim 10, wherein receiving the first IMSIs sent by the network side device comprises:

Receiving, by the network side device, network attach request information that carries the first IMSI, where the network attach request information is used to request access to the network side device.
The method of claim 10 wherein said first IMSIs comprise:

Mobile country code MCC, mobile network code MNC and mobile subscriber identification number MSIN;

The MCC and the MNC in the first IMSI are the same as the MCC and the MNC in the user subscription identity information IMSI, where the MSIN is a number temporarily configured by the network slice for the user equipment.
The method of claim 10 comprising:

The authentication service function entity AUSF receives the first network slice user subscription identity information IMSIs sent by the network side device, where the first IMSIs is temporarily configured information;

Generating, by the AUSF, a first authentication vector based on the first IMSIs;

Transmitting, by the AUSF, the first authentication vector to a security management entity SEAF of a network slice;

The SEAF performs authentication for the network slice with the user equipment by using the first authentication vector.
A method for accessing a network slice includes:

Determining the first network slice user subscription identity information IMSIs, wherein the first IMSIs are information temporarily configured to the user equipment;

Configuring the first IMSIs to the user equipment, to instruct the user equipment to send the first IMSIs to the network side device, so that the network side device sends the first IMSIs to the authentication service function entity AUSF ;

Receiving, by the AUSF, a first authentication vector generated based on the first IMSIs;

Performing authentication for the network slice with the user equipment by using the first authentication vector;

After the authentication of the network slice is passed, the user equipment is instructed to access the network slice.
The method of claim 19, wherein said determining the first IMSI currently used on the user equipment comprises:

The first IMSIs are configured based on the identification information of the network slice.
The method according to claim 19, after successfully performing authentication for the network slice with the user equipment by using the first authentication vector, the method further includes:

Negotiating with the user equipment using the first IMSIs to determine second IMSIs;

Transmitting the second IMSIs to the AUSF to instruct the AUSF to update the first IMSIs currently used by the AUSF to the second IMSIs.
The method of claim 21, after the sending the second IMSIs to the AUSF, the method further comprises:

After determining that the first IMSIs currently used on the AUSF fails to be updated to the second IMSIs, using the first IMSIs to negotiate with the user equipment to generate third IMSIs;

Transmitting the third IMSIs to the AUSF to instruct the AUSF to update the first IMSIs currently used by the AUSF to the third IMSIs.
The method of claim 21, after determining the second IMSIs, the method further comprising:

And determining, in the case that the user equipment and the security management entity SEAF need to perform the authentication for the network slice again, configuring the second IMSIs to the user equipment, to indicate that the user equipment Sending, by the network side device, the second IMSIs to the authentication service function entity AUSF;

Receiving, by the AUSF, a second authentication vector generated based on the second IMSIs;

Authentication for the network slice is performed with the user equipment by the second authentication vector.
The method of claim 19 wherein said first IMSIs comprise:

Mobile country code MCC, mobile network code MNC and mobile subscriber identification number MSIN;

The MCC and the MNC in the first IMSI are the same as the MCC and the MNC in the user subscription identity information IMSI, where the MSIN is a number temporarily configured by the network slice for the user equipment.
The method of claim 19 comprising:

The security management entity SEAF determines the first network slice user subscription identity information IMSIs, wherein the first IMSIs are information temporarily configured to the user equipment;

The SEAF configures the first IMSIs to the user equipment;

Transmitting, by the user equipment, the first IMSIs to a network side device;

Sending, by the network side device, the first IMSIs to an authentication service function entity AUSF;

The SEAF receives a first authentication vector generated by the AUSF based on the first IMSIs;

The SEAF performs authentication for the network slice with the user equipment by using the first authentication vector.
A device for accessing a network slice includes:

a first determining module, configured to determine first network slice user subscription identity information IMSIs currently used on the user equipment, where the first IMSIs are temporarily configured information;

The first sending module is configured to send the first IMSIs to the network side device, to instruct the network side device to send the first IMSIs to the authentication service function entity AUSF, so that the AUSF is generated based on the first IMSIs First authentication vector;

The first authentication vector is used to indicate that the security management entity SEAF of the network slice performs authentication for the network slice with the user equipment by using the first authentication vector.

The first access module is configured to access the network slice after the authentication of the network slice is passed.
A device for accessing a network slice includes:

The first receiving module is configured to receive the first network slice user subscription identity information IMSIs sent by the network side device, where the first IMSIs are temporarily configured information;

a first generation module, configured to generate a first authentication vector based on the first IMSIs;

a second sending module, configured to send the first authentication vector to a security management entity (SEAF) of the network slice, to instruct the SEAF to perform authentication for the network slice with the user equipment by using the first authentication vector;

The first processing module is configured to instruct the user equipment to access the network slice after the authentication of the network slice is passed.
A device for accessing a network slice includes:

a second determining module, configured to determine a first network slice user subscription identity information IMSIs, where the first IMSIs are information temporarily configured to the user equipment;

a configuration module, configured to configure the first IMSIs to the user equipment, to instruct the user equipment to send the first IMSIs to a network side device, so that the network side device sends the first IMSIs to Authentication service function entity AUSF;

a second receiving module, configured to receive a first authentication vector generated by the AUSF based on the first IMSIs;

An authentication module, configured to perform authentication for the network slice with the user equipment by using the first authentication vector;

The second processing module is configured to instruct the user equipment to access the network slice after the authentication of the network slice is passed.
A storage medium having stored therein a computer program, wherein the computer program is configured to execute claims 1 to 9, or claims 10 to 18, or any one of claims 19 to 25 The method described in the item.
An electronic device comprising a memory and a processor, wherein the memory stores a computer program, the processor being arranged to execute the computer program to perform claims 1 to 9, or claims 10 to 18, Or the method of any one of claims 19 to 25.