WO2020151696A1 - 一种增强跨网络访问安全的方法、设备及系统 - Google Patents

一种增强跨网络访问安全的方法、设备及系统 Download PDF

Info

Publication number
WO2020151696A1
WO2020151696A1 PCT/CN2020/073436 CN2020073436W WO2020151696A1 WO 2020151696 A1 WO2020151696 A1 WO 2020151696A1 CN 2020073436 W CN2020073436 W CN 2020073436W WO 2020151696 A1 WO2020151696 A1 WO 2020151696A1
Authority
WO
WIPO (PCT)
Prior art keywords
network
terminal
accessing
access
information
Prior art date
Application number
PCT/CN2020/073436
Other languages
English (en)
French (fr)
Inventor
郭龙华
李�赫
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP20745507.2A priority Critical patent/EP3893536A4/en
Publication of WO2020151696A1 publication Critical patent/WO2020151696A1/zh
Priority to US17/374,405 priority patent/US20210344680A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/14—Session management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/71—Hardware identity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
    • H04L2463/142—Denial of service attacks against network infrastructure
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/102—Entity profiles

Definitions

  • This application relates to the field of communication technology, and in particular to methods, devices and systems for enhancing cross-network access security.
  • 5G communication technology supports Non-Public Networks (NPN). Only authorized users can access non-public networks, and authorized users can access either the NPN network or the public land mobile network (PLMN) network.
  • NPN Non-Public Networks
  • PLMN public land mobile network
  • the 5G communication technology supports the roaming, mobility, and business continuity characteristics of the UE between the NPN and PLMN networks. For example, the UE can access the non-public network through the PLMN network, or access the PLMN network through the non-public network.
  • the NPN network is deployed based on the 5G system architecture.
  • the NPN network/NPN network For the scenario where authorized users can access both the NPN network and the PLMN network, there are credentials of the NPN network and the PLMN network on the UE configuration.
  • the UE After the UE has registered in the first network (PLMN network/NPN network), it discovers and selects the non-3GPP interworking function (N3IWF) network element of the second network (NPN network/PLMN network), and passes the The N3IWF network element of the second network performs identity authentication and registration procedures and accesses the second network, so that the UE can access the second network through the first network.
  • N3IWF non-3GPP interworking function
  • the malicious UE cannot pass the authentication of the second network, if it continues to initiate an authentication request to the second network through the first network, it will cause a great burden on the networks of the first network and the second network. If a large number of UEs are captured and at the same time frequently initiate authentication requests to the second network, it is easy to cause distributed denial of service (DDoS) attacks.
  • DDoS distributed denial of service
  • the embodiments of the application provide methods, devices, and systems for enhancing cross-network access security.
  • the embodiments of the application pass security events (such as authentication conditions) to the UE on the second network. ) Record and determine the result of the decision for the subsequent behavior of the UE, and notify the first network of the result of the decision, so that the first network can safely process the subsequent behavior of the UE on the second network to realize the first network and the second network Security linkage.
  • Security events such as authentication conditions
  • a method for enhancing cross-network access security is provided.
  • the method is used for a terminal to access a second network through a packet data unit PDU session established in a first network.
  • the method includes:
  • the session management network element receives a first request message for the PDU session, where the first request message includes address information of the terminal, an identifier of the second network, and indication information for prohibiting the terminal from accessing the second network
  • the first request message stores information for prohibiting the terminal from accessing the second network; block the terminal from accessing the second network.
  • the session function network element in the first network can store information that prohibits the terminal from accessing the second network according to the instructions of the second network, and block the terminal’s access to the second network, so that the second network can control The terminal accesses itself through the first network, avoiding possible DDOS attacks on the second network.
  • the information for prohibiting the terminal from accessing the second network includes the identification of the terminal in the first network and the identification of the second network; the session management network element is based on the terminal The address information of, the identifier of the second network, and the instruction information for prohibiting the terminal from accessing the second network, storing the information for prohibiting the terminal from accessing the second network, specifically:
  • the session management network element in the first network can store the information that prohibits the terminal from accessing the second network locally, so that when it subsequently receives a PDU session establishment request initiated by the terminal to access the second network, it can Directly according to locally stored information prohibiting the terminal from accessing the second network, it is determined that it is necessary to block the terminal from accessing the second network through the PDU session.
  • the information for prohibiting the terminal from accessing the second network includes the identification of the terminal in the first network and the identification of the second network; the session management network element is based on the terminal The address information of, the identifier of the second network, and the instruction information for prohibiting the terminal from accessing the second network, storing the information for prohibiting the terminal from accessing the second network, specifically:
  • the information prohibiting the terminal from accessing the second network is stored in the subscription data of the terminal in the UDM network element in the first network or stored in the security gateway in the first network.
  • the session management network element in the first network may store the information prohibiting the terminal from accessing the second network on other network elements in the first network, for example, a UDM network element or a security gateway in the first network on.
  • the security gateway in the first network may be, for example, a security edge protection proxy (SEPP).
  • SEPP security edge protection proxy
  • the blocking the terminal's access to the second network includes: the session management network element sends the user plane function network that serves the PDU session in the first network The element sends a second request message for blocking the terminal from accessing the second network; the user plane function network element blocks the terminal from accessing the second network according to the second request message.
  • a PDU session can carry a lot of data/information.
  • the first network only needs to block the data/messages that access the second network in the terminal PDU session, instead of releasing the entire PDU session. The flexibility of PDU session management.
  • the blocking the terminal's access to the second network includes: releasing the PDU session.
  • the PDU session created by the terminal is specifically used to access the second network.
  • releasing the PDU session in time can release related network elements in the first network (such as AMF network elements or SMF Network element). .
  • the session management network element in the first network may prohibit the terminal from accessing the second network according to the To block the terminal’s access to the second network. If the session management network element stores the information prohibiting the terminal from accessing the second network locally, the session management network element directly determines that the terminal needs to be blocked from passing the PDU based on the locally stored information prohibiting the terminal from accessing the second network. The session accesses the second network; if the session management network element stores the information that prohibits the terminal from accessing the second network in other network elements in the first network, it needs to obtain from other network elements that the terminal is prohibited from accessing the second network. Network information.
  • the information prohibiting the terminal from accessing the second network further includes a valid period for prohibiting the terminal from accessing the second network.
  • the session management network element in the first network blocks the terminal from accessing the second network through the first network.
  • the PDU session establishment request of the terminal may be rejected, where the PDU session establishment requested by the terminal is a PDU session for accessing the second network. Or blocking the data/message used to access the second network in the PDU session established by the terminal.
  • a method for enhancing cross-network access security is provided.
  • the method is used for a terminal to access a second network through a packet data unit PDU session established in a first network.
  • the method includes: When the UE authentication fails, the network element records the result of the authentication failure; according to the result of the authentication failure, determines to prevent the terminal from accessing the second network; and reports to the network in the first network.
  • the element sends an authentication response, and the authentication response includes the address information of the terminal and instruction information that prohibits the terminal from accessing the second network.
  • the network element in the second network can notify the first network to block the terminal's access to the second network, avoiding possible DDOS attacks on the second network.
  • the authentication response further includes a valid period for prohibiting the terminal from accessing the second network.
  • the terminal is blocked from accessing the second network through the first network to prevent malicious attackers from hijacking the terminal and deliberately causing the terminal authentication to fail, resulting in the terminal permanently unable to access the second network through the first network.
  • the network element in the second network is a non-3GPP interworking function N3IWF network element. .
  • a device for enhancing cross-network access security has the function of implementing the method described in the first aspect.
  • This function can be realized by hardware, or by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the above-mentioned functions.
  • a device for enhancing cross-network access security including: a processor and a memory; the memory is used to store computer execution instructions, and when the device is running, the processor executes the computer execution instructions stored in the memory , So that the device executes the method for enhancing cross-network access security as described in any one of the above-mentioned first aspects.
  • a computer-readable storage medium stores instructions that, when run on a computer, enable the computer to execute the enhanced cross-talk described in any one of the above-mentioned first aspects.
  • a computer program product containing instructions which when running on a computer, enables the computer to execute the method for enhancing cross-network access security described in any one of the above-mentioned first aspects.
  • a device for example, the device may be a chip system
  • the device includes a processor for supporting the device to implement the functions involved in the first aspect.
  • the device further includes a memory, which is used to store the necessary program instructions and data of the device.
  • the device is a chip system, it can be composed of chips, or include chips and other discrete devices.
  • a device for enhancing cross-network access security has the function of implementing the method described in the second aspect.
  • This function can be realized by hardware, or by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the above-mentioned functions.
  • a device for enhancing cross-network access security including: a processor and a memory; the memory is used to store computer execution instructions, and when the device is running, the processor executes the computer execution instructions stored in the memory , So that the device executes the method for enhancing cross-network access security as described in any one of the above second aspects.
  • a computer-readable storage medium stores instructions that, when run on a computer, enable the computer to execute the enhanced cross-talk described in any one of the above-mentioned second aspects.
  • a safe method for network access is provided, and the computer-readable storage medium stores instructions that, when run on a computer, enable the computer to execute the enhanced cross-talk described in any one of the above-mentioned second aspects.
  • a computer program product containing instructions which when running on a computer, enables the computer to execute the method for enhancing cross-network access security described in any one of the above second aspects.
  • an apparatus for example, the apparatus may be a chip system
  • the apparatus includes a processor for supporting a second session management network element to implement the functions involved in the above second aspect.
  • the device further includes a memory, which is used to store the necessary program instructions and data of the device.
  • the device is a chip system, it can be composed of chips, or include chips and other discrete devices.
  • a system for enhancing cross-network access security is provided.
  • the system is used by a terminal to access a second network through a packet data unit PDU session established in the first network.
  • the second network is used for In the case of the UE authentication failure, record the result of the authentication failure; according to the result of the authentication failure, determine to prevent the terminal from accessing the second network; send an authentication response to the first network,
  • the authentication response includes address information of the terminal and instruction information for prohibiting the terminal from accessing the second network; the first network is used to receive the authentication response sent in the second network; storage prohibition Information about the terminal's access to the second network; blocking the terminal's access to the second network.
  • the second network is further configured to determine that the number of times the terminal authentication fails is greater than a preset threshold.
  • the first network is also used to release the PDU session.
  • the first network is also used to block data/messages used to access the second network in the PDU session.
  • the first network is further configured to, when the terminal re-initiates a PDU session establishment request for accessing the second network, according to the prohibition of the terminal from accessing the second network Information, blocking access of the terminal to the second network.
  • the authentication response further includes a validity period for prohibiting the terminal from accessing the second network; the information prohibiting the terminal from accessing the second network further includes the validity period.
  • the first network element is configured to block the terminal's access to the second network through the first network during the validity period.
  • FIG. 1 is a schematic diagram of a flow of a terminal accessing an NPN through a PLMN in the prior art
  • FIG. 2 is a schematic diagram of a flow of a terminal accessing a PLMN through an NPN in the prior art
  • FIG. 3 is a schematic diagram of a system for enhancing cross-network access security provided by an embodiment of the application
  • FIG. 4 is a schematic diagram of another system for enhancing cross-network access security provided by an embodiment of the application.
  • FIG. 5 is a schematic diagram of another system for enhancing cross-network access security provided by an application embodiment
  • FIG. 6 is a schematic flowchart of a method for enhancing cross-network access security provided by an embodiment of this application;
  • FIG. 7 is a schematic flowchart of another method for enhancing cross-network access security provided by an embodiment of this application.
  • FIG. 8 is a schematic flowchart of another method for enhancing cross-network access security provided by an embodiment of this application.
  • FIG. 9 is a schematic structural diagram of an apparatus for enhancing cross-network access security provided by an embodiment of this application.
  • FIG. 10 is a schematic structural diagram of another device for enhancing cross-network access security provided by an embodiment of the application.
  • FIG. 11 is a schematic structural diagram of another device for enhancing cross-network access security provided by an embodiment of this application.
  • At least one item (a) refers to any combination of these items, including any combination of a single item (a) or a plurality of items (a).
  • at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple .
  • words such as “first” and “second” are used to distinguish the same items or similar items with substantially the same function and effect. Those skilled in the art can understand that the words “first”, “second” and the like do not limit the quantity and execution order, and the words “first” and “second” do not limit the difference.
  • the first network and the second network are two different networks.
  • the first network may be the network of the first operator, and the second network may be the network of the second operator; or,
  • the first network is a PLMN network, and the second network is an NPN network; the embodiment of the present application does not limit the types of the first network and the second network.
  • FIG. 1 is a flowchart of a UE accessing an NPN network through a PLMN network.
  • PLMN public land mobile networks
  • NPN non-public networks
  • Figure 1 is a flowchart of a UE accessing an NPN network through a PLMN network.
  • the data network accessed by the PDU session established by the UE in the PLMN network establishes an IP connection with the N3IWF corresponding to the NPN network.
  • the UE obtains the IP address by registering to the PLMN network and discovers the N3IWF of the NPN network, and then establishes a connection with the NPN network through the N3IWF.
  • the specific process is shown in Figure 1:
  • Step 101 The UE connects to the PLMN network
  • a security credential (credential) for accessing the PLMN network is configured on the UE.
  • the UE uses the security credentials of the PLMN network to discover, select and connect to the PLMN network; the UE obtains an IP address through the PLMN network.
  • the UE may request the establishment of a PDU session to the data network in the PLMN network, and during the establishment of the PDU session, the network element (for example, UPF or SMF) in the PLMN network allocates an IP address.
  • the network element for example, UPF or SMF
  • Step 202 The UE determines the N3IWF in the NPN network
  • the IP address or full domain name of the N3IWF corresponding to the NPN network is pre-configured on the UE.
  • Step 203 The UE registers with the NPN network through N3IWF;
  • a security credential for accessing the NPN network is pre-configured on the UE.
  • the UE uses the security credentials of the NPN network to access the NPN network, and completes the process of registering to the NPN network through the N3IWF;
  • Step 204 The UE and the NPN network establish a PDU session connection.
  • the NPN network will authenticate the UE during the process of the UE registering to the NPN network through the N3IWF. Only when the authentication is successful, the UE can establish a PDU session to the NPN network through the PLMN network.
  • Figure 2 is a flowchart of the UE accessing the PLMN network through the NPN network.
  • the UE obtains an IP address by registering to the NPN network and discovers the N3IWF of the PLMN network, and then establishes a connection with the PLMN network through the N3IWF.
  • the specific process is shown in Figure 2:
  • Step 201 The UE connects to the NPN network
  • a security credential (credential) for accessing the NPN network is configured on the UE.
  • the UE uses the security credentials of the NPN network to discover, select, and connect to the NPN network; the UE obtains an IP address through the NPN network.
  • the UE may request the establishment of a PDU session to the data network in the NPN network, and during the establishment of the PDU session, the network element (for example, UPF or SMF) in the NPN network allocates an IP address.
  • the network element for example, UPF or SMF
  • Step 202 The UE determines the N3IWF in the PLMN network
  • the UE determines the N3IWF in the PLMN network according to the strategy of selecting the N3IWF in the PLMN network.
  • the IP address or full domain name of the N3IWF corresponding to the PLMN network is pre-configured on the UE.
  • Step 203 The UE registers with the PLMN network through N3IWF;
  • a security credential for accessing the PLMN network is pre-configured on the UE.
  • the UE uses the security credentials of the PLMN network to access the PLMN network, and completes the process of registering to the PLMN network through N3IWF;
  • Step 204 The UE and the PLMN network establish a PDU session connection.
  • step 203 when the UE is registered to the PLMN network through the N3IWF, the PLMN network will authenticate the UE, and only if the authentication is successful, the UE can establish a PDU session to the PLMN network through the NPN network.
  • the second network needs to first The UE is authenticated, and only when the authentication passes, the UE can establish a PDU session to the second network through the first network. If a malicious UE continues to initiate an authentication/authentication request to the second network through the first network without passing the authentication/authentication, then this continuous authentication/authentication process will affect the network of the second network. Yuan makes an impact. For example, a large number of UEs are captured while frequently initiating authentication/authentication requests to the second network, which is likely to cause DDoS attacks.
  • Fig. 3 is a schematic diagram of a system according to an embodiment of the present application, which includes a network element of a first network and a network element of a second network, and the UE is connected to the second network through the first network.
  • the network element in the second network records the authentication failure when the terminal authentication fails. Result; According to the result of the authentication failure, it is determined that the terminal is prevented from accessing the second network; an authentication response is sent to the first network, the authentication response includes the address information of the terminal and prohibiting the Instruction information for the terminal to access the second network.
  • the network element in the first network is configured to receive the authentication response sent in the second network; store information prohibiting the terminal from accessing the second network; block the terminal from accessing the second network .
  • the network elements in the first network can block the UE's access to the second network, which can prevent the UE from launching a malicious attack on the second network through the first network.
  • the first network and the second network may be based on the current 5G network or other network architecture layouts in the future. In a possible implementation manner, the first network and the second network may both be based on the mechanism layout of the 5G system. As shown in Figures 4 and 5, the UE accesses the NPN network through the PLMN network and the NPN network accesses respectively. PLMN network architecture diagram.
  • the terminal involved in FIG. 4 or FIG. 5 in the embodiment of the present application may include various handheld devices with wireless communication functions, vehicle-mounted devices, wearable devices, computing devices, or devices connected to wireless modems.
  • Other processing equipment can also include subscriber units, cellular phones, smart phones, wireless data cards, personal digital assistants (PDA) computers, tablet computers, and wireless modems (modem), handheld device, laptop computer, cordless phone or wireless local loop (WLL) station, machine type communication (MTC) terminal , User equipment (user equipment, UE), mobile station (mobile station, MS), terminal device (terminal device) or relay user equipment, etc.
  • the relay user equipment may be, for example, a 5G residential gateway (RG).
  • RG 5G residential gateway
  • the access equipment (wireless/wired access network) involved in Figure 4 or Figure 5 refers to equipment that accesses the core network, such as a base station, a broadband network gateway (BNG), and an aggregation switch.
  • BNG broadband network gateway
  • the base station may include various forms of base stations, such as macro base stations, micro base stations (also called small stations), relay stations, access points, and so on.
  • the User Plan Function (UPF) network element involved in Figure 4 or Figure 5 is a functional network element of the user plane, which is mainly responsible for connecting to external networks, including the long term evolution (LTE) service gateway (serving gateway, SGW) and packet data network gateway (packet data network gateway, PDN-GW) related functions.
  • LTE long term evolution
  • SGW serving gateway
  • PDN-GW packet data network gateway
  • UPF can perform user data packet forwarding according to SMF routing rules, such as sending uplink data to DN or other UPFs; forwarding downlink data to other UPFs or RANs; it can also control specific data flows, such as blocking certain Characteristic (for example, using IP quintuple characterization) data packet.
  • the UPF may receive a packet filter (Packet Filter) issued by the SMF to block the UE from accessing the second network.
  • Packet Filter Packet Filter
  • the Access and Mobility Management Function network element is responsible for the access management and mobility management of the UE, such as the maintenance of the UE status, the reachability management of the UE, and the non-access layer. (non-access-stratum, NAS) message forwarding, session management (session management, SM) N2 message forwarding.
  • NAS non-access-stratum
  • SM session management
  • AMF network elements can implement the mobility management function in the MME in the LTE network framework. Realize access management functions.
  • the Session Management Function (SMF) network element in Figure 4 or Figure 5 is responsible for session management, allocating and releasing resources for UE sessions; the resources include session quality of service (QoS), session path, and forwarding Rules etc.
  • the SMF or UPF network element is also used to allocate an Internet Protocol (IP) address for the UE.
  • IP Internet Protocol
  • the AUSF network element in Figure 4 or Figure 5 is used to perform UE safety authentication, such as authentication/authentication.
  • the AF network element in FIG. 4 or FIG. 5 may be a third-party application control platform, or an operator's own equipment, and the AF network element may provide services for multiple application servers.
  • the UDM network element in FIG. 4 or FIG. 5 can store the subscription information of the UE.
  • the PCF network element in Figure 4 or Figure 5 is used for user policy management, similar to the policy and charging rules function (PCRF) network element in LTE, which is mainly responsible for policy authorization, service quality and charging rules
  • PCF policy and charging rules function
  • the corresponding rules are issued to the UPF network elements through the SMF network element to complete the installation of the corresponding policies and rules.
  • a network element may also be called an instance or a network functional entity.
  • UDM network elements may also be called UDM instances or UDM network function entities;
  • AMF network elements may also be called AMF instances or AMF network function entities.
  • the UDM network elements described in the embodiments of this application can realize their functions by interacting with the same data repository (UDR) network element, and the UDR network element is used to store UDM network elements for execution UDM network element is used to interact with other network elements for the data required for its operation.
  • UDR network element and the UDM network element may be two independent physical entities, and the UDR network element may also be integrated in the UDM network element, which is not specifically limited in comparison with the embodiments of this application.
  • the above-mentioned functional network element may be a network element in a hardware device, a software function running on dedicated hardware, or a virtualization function instantiated on a platform (for example, a cloud platform).
  • the first network and the second network are both based on the mechanism layout of the 5G system for description.
  • a method for enhancing cross-network access security includes the following steps:
  • Step 601 The UE connects to the first network.
  • the UE needs to register in the first network to obtain the right to obtain related services through the first network.
  • the first network will authenticate/authenticate the UE.
  • a security credential for accessing the first network is configured on the UE. The UE uses the security credentials of the first network to discover, select, and connect to the first network.
  • Step 602 The UE establishes a PDU session in the first network.
  • the UE may request the establishment of a PDU session to a Data Network (DN) in the first network, and during the establishment of the PDU session, a network element (for example, UPF or SMF) in the first network allocates an IP address to the UE.
  • DN Data Network
  • a network element for example, UPF or SMF
  • Step 603 The UE determines the N3IWF of the second network.
  • the IP address or the fully qualified domain name (FQDN) of the N3IWF corresponding to the second network is pre-configured on the UE.
  • Step 604 The UE requests to register with the second network through the N3IWF of the second network, and triggers the authentication process;
  • the UE sends a registration request to the network element in the second network through the N3IWF of the second network, and triggers mutual authentication between the UE and the first network during the registration process.
  • a registration request to the network element in the second network through the N3IWF of the second network, and triggers mutual authentication between the UE and the first network during the registration process.
  • the prior art such as TS 23.502 V15.2.0 section 4.2.2.2.2 General Registration related descriptions and TS 33.501 V15.2.0 Section 6.1.3 Authentication procedures related descriptions, which will not be repeated here.
  • Step 605 The network element in the second network determines that the authentication to the UE fails, records the authentication result, and makes a corresponding decision.
  • a possible implementation is that the AUSF network element, AMF network element, or N3IWF in the second network judges that the authentication of the UE fails, and the AUSF network element, AMF network element, or N3IWF network element in the second network in the prior art An error indication will be returned to the UE to notify the UE that authentication has failed.
  • the N3IWF network element or other network elements in the second network (for example, the AUSF network element or the AMF network element in the second network, etc.) record the UE authentication failure
  • the N3IWF network element or other network elements in the second network decide whether to prohibit the UE from accessing the second network.
  • it can be set for the UE to prohibit access to the second network A validity period.
  • the second network determines whether the authentication of the UE fails.
  • the second network Other network elements in the network notify the N3IWF network element, so that the N3IWF network element determines that the authentication of the UE by the second network has failed.
  • the N3IWF network element or another network element in the second network records a log of any UE authentication/authentication failure, and the recorded log content may include the IP address of the UE and the identifier of the UE in the second network. If the number of authentication/authentication failures of the UE with the same IP address reaches the preset threshold within the preset time period, the N3IWF network element or other network elements in the second network can prohibit the UE corresponding to the IP address from checking the second The network makes access decisions.
  • Step 606 The network element in the second network sends an authentication/authentication response to the UPF network element in the first network.
  • the N3IWF in the second network sends an authentication response to the UPF in the first network; in another possible implementation manner, the N3IWF in the second network passes through the SMF network in the second network. The element sends an authentication response to the UPF network element in the first network.
  • the authentication response includes the IP address and the cause value cause.
  • the cause is used to indicate that the IP address is prohibited from accessing the second network, and optionally, it is also used to indicate the reason for prohibiting the IP address from accessing the second network, such as authentication/authentication failure.
  • the authentication response further includes a validity period, which is used to indicate time information when the IP address is prohibited from accessing the second network, for example, the IP address is prohibited from accessing the second network within a certain period of time or before a certain time. .
  • Step 607 The UPF network element in the first network sends an authentication/authentication response to the UE.
  • the authentication/authentication response sent by the UPF network element in the first network to the UE includes indication information that the authentication of the UE has failed.
  • Step 608 The UPF network element in the first network sends a PDU session control request to the SMF network element serving the PDU session of the UE in the first network.
  • the PDU session control request includes information such as the IP address, cause, and identification (SN_ID) of the second network; optionally, the PDU session control request further includes the validity period.
  • the IP address and cause value may not be carried in step 606, but only used to indicate that the second network fails to authenticate/authenticate the UE.
  • the PDU session control request in step 608 may be sent by the SMF network element in the second network to the SMF network element in the first network.
  • the N3IWF network element in the second network or other network elements in the second network decides that the UE needs to be prohibited from accessing the second network according to the UE’s previous authentication result, the UE is prohibited from accessing the second network.
  • the network access decision result is sent to the SMF network element in the second network.
  • the SMF network element in the second network sends a PDU session control request to the SMF network element in the first network according to the decision result of prohibiting the UE from accessing the second network.
  • Step 609 The SMF network element serving the PDU session of the UE in the first network receives the PDU session control request sent by the UPF network element in the first network; and saves information that prohibits the UE from accessing the second network.
  • the information for prohibiting the UE from accessing the second network includes an identifier of the UE and an identifier of the second network; optionally, it also includes the aforementioned validity period.
  • the SMF network element serving the PDU session of the UE in the first network determines that the second network prohibits the UE from accessing the second network according to the cause in the PDU session control request; according to the IP address in the PDU session control request , Determine the PDU session identifier (optional) of the UE and the identifier of the UE in the first network; and store the identifier of the UE in the first network and the identifier of the second network in association.
  • the identity of the UE in the first network may specifically be a user permanent identity (subscription permanent identifier, SUPI).
  • each entry in the blacklist is used to record which UE is prohibited from accessing which network.
  • each entry in the blacklist also includes the validity period of the entry.
  • the SMF network element serving the PDU session of the UE in the first network also determines the type of the PDU session of the UE.
  • the PDU session of the UE is specifically used to access the second network, for example, the Data Network Name (DNN) corresponding to the PDU session of the UE carries the information of the second network
  • DNN Data Network Name
  • the PDU session when the UE’s PDU session is not specifically used to access the second network, it means that in addition to being used by the UE to access the second network, the PDU session can also be used by the UE to obtain corresponding information. Business/service data in a data network. At this time, if the PDU session is directly released, other services/services of the UE will be affected. Therefore, the PDU session needs to be reserved, but the data/messages that access the second network in the PDU session need to be blocked. In a possible implementation manner, the UE skips step 610 and performs steps 611-614 instead, regardless of whether the PDU session is dedicated to accessing the second network.
  • Step 610 Release the PDU session of the UE.
  • Step 611 The SMF network element initiates a PDU session management policy modification process.
  • the SMF network element determines that it is necessary to prevent the UE from accessing the second network, it decides to modify the PDU session of the UE.
  • the SMF network element sends a session management policy update request (for example, Npcf_SMPolicyControl_Update request) to the PCF network element in the first network, and the session management policy update request is used to request the PCF network element to generate a session that prevents the UE from accessing the second network Management strategy.
  • a session management policy update request for example, Npcf_SMPolicyControl_Update request
  • the PCF network element generates a new session management policy according to the received session management policy update request, and sends the generated session management policy to the SMF network element; optionally, the new session management policy includes a packet filter.
  • the filter is used to block the data/request of the UE to access the second network.
  • the packet filter includes the IP address and destination address of the UE.
  • it also includes destination port, transport layer protocol and other information.
  • the destination address may be the address of the network element in the second network, for example, it may be the IP address of the N3IWF in the second network.
  • Step 612 The SMF network element initiates the N4 session update process of the UPF network element.
  • the SMF network element sends the N4 Session Modification Request message to the UPF network element, and the N4 Session Modification Request message includes the packet filter, and the UPF network element receives the N4 Session Modification Request message sent by the SMF network element, and installs the packet filter.
  • the SMF network element sends the N4 Session Modification Request message to the UPF network element, and the N4 Session Modification Request message includes the packet filter
  • the UPF network element receives the N4 Session Modification Request message sent by the SMF network element, and installs the packet filter.
  • the SMF network element sends the N4 Session Modification Request message to the UPF network element, and the N4 Session Modification Request message includes the packet filter
  • the UPF network element receives the N4 Session Modification Request message sent by the SMF network element, and installs the packet filter.
  • the SMF network element sends the N4 Session Modification Request message to the UPF network element, and the N4 Se
  • Step 613 The SMF network element sends a PDU session control response to the UPF network element.
  • the PDU session control response may specifically be a confirmation message, which is used to indicate that the SMF network element has successfully received the PDU session control request in step 608.
  • it can also be used to indicate the success of the PDU session modification.
  • Step 614 The UPF network element blocks the UE's access to the second network according to the packet filter.
  • the UPF network element can filter the data packet according to the packet filter, for example, can block the data packet according to the source address and the destination address of the data packet, thereby preventing the UE from accessing the second network.
  • Step 615 The UE subsequently initiates a PDU session establishment request again.
  • Step 616 The network element in the first network refuses the UE to access the second network.
  • the SMF network element rejects the PDU session in step 615 Establish; if the PDU session requested by the UE is not specifically used to access the second network, perform steps 611-614 to limit the data/messages from the UE to the second network on the UPF network element.
  • Step 617 The subsequent process of establishing a PDU session.
  • the SMF network element rejects the establishment of the PDU session in step 616, the SMF network element sends a PDU session rejection message to the UE.
  • it may include a reason value for rejecting the establishment of the PDU session.
  • the SMF network element notifies the UE to reject the establishment of the PDU session through NAS SM signaling, and the NAS SM signaling may include a reason value for rejection, for example, access to the second network is denied.
  • the subsequent process of PDU session establishment may include sending PDU session establishment to the UE Successful response message.
  • the network element of the second network records the authentication result of the UE after the UE authentication fails, and when it is determined that the UE requests authentication/authentication multiple times, it sends a block to the network element in the first network. The UE continues to visit the second network.
  • the release of the PDU session or the modification of the PDU session by the network element in the first network can effectively prevent malicious UEs from occupying the resources of the first network and the second network, improve network efficiency, and prevent the second network from DDoS attacks.
  • the SMF network element in the first network stores information that prohibits the UE from accessing the second network (ie, blacklist), and SMF also determines whether a UE is allowed to access the second network according to the blacklist.
  • the UDM in the first network can save the information that prohibits the UE from accessing the second network (ie blacklist), and then The SMF network element determines whether a UE is allowed to access the second network according to the blacklist.
  • the method includes the following steps:
  • Steps 701 to 708 are respectively the same as steps 601 to 608 in the embodiment of FIG.
  • Step 709 The SMF network element serving the PDU session of the UE in the first network receives the PDU session control request sent by the UPF network element in the first network.
  • the SMF network element serving the PDU session of the UE in the first network determines that the second network prohibits the UE from accessing the second network according to the cause in the PDU session control request; according to the IP address in the PDU session control request , Determine the PDU session identifier of the UE and the identifier of the UE in the first network;
  • the SMF network element also sends the validity period to the UDM network element.
  • the SMF network element serving the PDU session of the UE in the first network also determines the type of the PDU session of the UE.
  • the Data Network Name (DNN) corresponding to the PDU session of the UE carries the information of the second network
  • DNN Data Network Name
  • the PDU session when the UE’s PDU session is not specifically used to access the second network, it means that in addition to being used by the UE to access the second network, the PDU session can also be used by the UE to obtain corresponding information. Business/service data in a data network. At this time, if the PDU session is directly released, other services/services of the UE will be affected. Therefore, the PDU session needs to be reserved, but the data/messages that access the second network in the PDU session need to be blocked. In a possible implementation manner, the UE skips step 711 and performs steps 712-715 instead, regardless of whether the PDU session is dedicated to accessing the second network.
  • Step 710 The SMF network element serving the PDU session of the UE in the first network stores information that prohibits the UE from accessing the second network in the UDM network element.
  • the SMF network element stores information that prohibits the UE from accessing the second network in the subscription data of the UE in the UDM network element.
  • the UDM network element stores a blacklist in the subscription data of each UE, and each entry in the blacklist is used to record which network the UE is prohibited from accessing.
  • each entry in the blacklist also includes the validity period of the entry.
  • Steps 711 to 716 are respectively the same as steps 610 to 615 in the embodiment of FIG.
  • Step 717 The SMF network element obtains information preventing the UE from accessing the second network from the UDM network element.
  • the SMF network element may obtain the subscription data of the UE from the UDM network element during the establishment of the PDU session, and obtain the information that prevents the UE from accessing the second network from the subscription data of the UE.
  • Steps 718 to 719 are respectively the same as steps 616 to 617 in the embodiment of FIG.
  • the SMF network element in the first network stores information that prohibits the UE from accessing the second network (ie, blacklist), and SMF also determines whether a UE is allowed to access the second network according to the blacklist.
  • the UDM in the first network can store information that prohibits the UE from accessing the second network (ie, blacklist), and then the SMF network element determines whether a UE is allowed to access the second network according to the blacklist.
  • a security gateway is respectively deployed in the first network and the second network.
  • it may be a security edge protection proxy (SEPP).
  • SEPP security edge protection proxy
  • the security gateway can be a separate network element, and its function can also be integrated into an existing network element. The method includes the following steps:
  • Step 801 to step 805 are the same as steps 701 to 705 in the embodiment of FIG. 7 respectively.
  • Steps 806 to 809 are respectively the same as steps 706 to 709 in the embodiment of FIG. 7.
  • the difference is that the execution subject of step 806 is replaced by the N3IWF in the second network of step 706 in FIG. 7 with the second security gateway in FIG. 8.
  • the execution subject of 807 and step 808 is replaced by the UPF of the relevant steps in FIG. 7 with the relevant content of the first security gateway in FIG. 8.
  • Step 810 The SMF network element serving the PDU session of the UE in the first network stores information that prohibits the UE from accessing the second network to the first security gateway.
  • step 710 in the embodiment of FIG. 7, as long as the UDM in step 710 is replaced with the first security gateway, the steps are repeated here.
  • Step 811 is the same as step 711 in the embodiment of FIG. 7.
  • Step 812 The SMF network element sends to the first security gateway information preventing the UE from accessing the second network.
  • the SMF network element sends a PDU session control response to the first security gateway, and the PDU session control response carries information that prevents the UE from accessing the second network.
  • the information that prevents the UE from accessing the second network may include, for example, the identification of the UE in the first network/the IP address of the UE, the destination IP address, and other information.
  • it also includes destination port, transport layer protocol and other information.
  • the destination address may be the address of the network element in the second network, for example, it may be the IP address of the N3IWF in the second network or the address of the second security gateway.
  • Step 813 The first security gateway blocks the UE's access to the second network.
  • Step 815 is the same as step 716 in the embodiment of FIG. 7.
  • Step 816 The SMF network element obtains information preventing the UE from accessing the second network from the first security gateway.
  • Steps 817 to 818 are respectively the same as steps 718 to 719 in the embodiment of FIG.
  • FIG. 9 is a schematic diagram of the logical structure of an apparatus for enhancing cross-network access security provided by an embodiment of the present application.
  • the apparatus 90 is used for a terminal to access a second network through a packet data unit PDU session established in the first network.
  • the device 90 may include a receiving module 901 and a processing module 902.
  • the receiving module 901 is configured to receive a first request message for the PDU session, where the first request message includes the address information of the terminal, the identifier of the second network, and the information prohibiting the terminal from accessing the second network Instruction information
  • the processing module 902 is configured to store information for prohibiting the terminal from accessing the second network according to the first request message
  • the processing module 901 is also used to block the terminal's access to the second network.
  • the information prohibiting the terminal from accessing the second network includes the identification of the terminal in the first network and the identification of the second network; the processing unit 902 is configured to store information prohibiting the terminal from accessing the second network Information, specifically:
  • the processing unit 902 is configured to store information for prohibiting the terminal from accessing the second network, specifically:
  • the information prohibiting the terminal from accessing the second network is stored in the subscription data of the terminal in the UDM network element in the first network or stored in the security gateway in the first network.
  • the processing module 902 is configured to block the terminal's access to the second network, including: reporting to a user plane function network serving the PDU session in the first network The element sends a second request message for blocking the terminal from accessing the second network, the second request message instructing the user plane function network element to block the terminal from accessing the second network.
  • the processing module 902 is configured to block the terminal's access to the second network, including: releasing the PDU session.
  • the processing module 902 is further configured to block the terminal pairing according to the information prohibiting the terminal from accessing the second network when the terminal again initiates a PDU session establishment request for accessing the second network Access to the second network.
  • the first request message further includes an effective period for prohibiting the terminal from accessing the second network; the information prohibiting the terminal from accessing the second network further includes the effective period.
  • the device 90 can realize the functions of the SMF network element in the embodiment shown in Figs. 6-8.
  • FIG. 10 is a schematic diagram of the logical structure of an apparatus for enhancing cross-network access security provided by an embodiment of the present application.
  • the apparatus 100 is used for a terminal to access a second network through a packet data unit PDU session established in the first network.
  • the apparatus 100 may include a processing module 1001 and a sending module 1002.
  • the processing module 1001 is configured to record the result of the authentication failure when the UE authentication fails;
  • the processing module 1001 is further configured to determine to prevent the terminal from accessing the second network according to the result of the authentication failure;
  • the sending module 1002 is configured to send an authentication response to the network element in the first network, where the authentication response includes address information of the terminal and instruction information for prohibiting the terminal from accessing the second network.
  • the authentication response further includes a valid period for prohibiting the terminal from accessing the second network.
  • the processing module 1001 is configured to determine that the terminal is prevented from accessing the second network, specifically: determining that the number of authentication failures of the terminal is greater than a preset threshold.
  • the device is a non-3GPP interworking function N3IWF network element.
  • the device 100 can implement the functions of the N3IWF network element in the embodiment shown in FIGS. 6-8.
  • Any of the functional network elements described in Figures 4-5 in the embodiments of the present application can be either a network element in a hardware device, a software function running on dedicated hardware, or an instantiation on a platform (for example, a cloud platform) Virtualization capabilities.
  • FIG. 11 is a schematic diagram of the hardware structure of a communication device provided by an embodiment of the application.
  • the communication device 1100 includes a processor 1101, a communication line 1102, a memory 1103, and at least one communication interface (in FIG. 11, it is only an example, taking the communication interface 1104 as an example for illustration).
  • the processor 1101 may be a general-purpose central processing unit (central processing unit, CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more programs for controlling the execution of the program of this application. integrated circuit.
  • CPU central processing unit
  • ASIC application-specific integrated circuit
  • the communication line 1102 may include a path to transmit information between the aforementioned components.
  • Communication interface 1104 using any device such as a transceiver to communicate with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area networks (WLAN), etc. .
  • RAN radio access network
  • WLAN wireless local area networks
  • the memory 1103 may be read-only memory (ROM) or other types of static storage devices that can store static information and instructions, random access memory (RAM), or other types that can store information and instructions
  • the dynamic storage device can also be electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disk storage, optical disc storage (Including compact discs, laser discs, optical discs, digital universal discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or can be used to carry or store desired program codes in the form of instructions or data structures and can be used by a computer Any other media accessed, but not limited to this.
  • the memory may exist independently and is connected to the processor through a communication line 1102. The memory can also be integrated with the processor.
  • the memory 1103 is used to store computer-executable instructions for executing the solution of the present application, and the processor 1101 controls the execution.
  • the processor 1101 is configured to execute computer-executable instructions stored in the memory 1103, so as to implement the method for enhancing cross-network access security provided in the foregoing Embodiments 6-8 of the present application.
  • the computer-executed instructions in the embodiments of the present application may also be referred to as application program codes, which are not specifically limited in the embodiments of the present application.
  • the processor 1101 may include one or more CPUs, such as CPU0 and CPU1 in FIG. 11.
  • the communication device 1100 may include multiple processors, such as the processor 1101 and the processor 1108 in FIG. 11. Each of these processors may be a single-CPU (single-CPU) processor or a multi-core (multi-CPU) processor.
  • the processor here may refer to one or more devices, circuits, and/or processing cores for processing data (for example, computer program instructions).
  • the communication device 1100 may further include an output device 1105 and an input device 1106.
  • the output device 1105 communicates with the processor 1101 and can display information in a variety of ways.
  • the output device 405 may be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector (projector) Wait.
  • the input device 1106 communicates with the processor 1101 and can receive user input in a variety of ways.
  • the input device 1106 may be a mouse, a keyboard, a touch screen device, or a sensor device.
  • the aforementioned communication device 1100 may be a general-purpose device or a special-purpose device.
  • the communication device 1100 may be a desktop computer, a portable computer, a network server, a palmtop computer (personal digital assistant, PDA), a mobile phone, a tablet computer, a wireless terminal device, an embedded device, or a similar structure in FIG. 11 equipment.
  • PDA personal digital assistant
  • the embodiment of the present application does not limit the type of the communication device 1100.
  • an embodiment of the present application further provides a device (for example, the device may be a chip system), the device includes a processor, and is configured to support the method for enhancing cross-network access security described in FIGS. 6-8.
  • the device also includes a memory.
  • the memory is used to store program instructions and data necessary for the first session management network element.
  • the memory may not be in the device.
  • the device is a chip system, it may be composed of a chip, or may include a chip and other discrete devices, which is not specifically limited in the embodiment of the present application.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website, computer, server, or data center.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or include one or more data storage devices such as servers, data centers, etc. that can be integrated with the medium.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, and a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk (SSD)).

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请实施例提供增强跨网络访问安全的方法、设备及系统，在UE通过第一网络接入第二网络的场景下，本申请实施例通过在第二网络对UE的安全事件(例如认证情况)进行记录并为UE的后续行为确定决策结果，并将所述决策结果通知第一网络，以便于第一网络对UE针对第二网络的后续行为进行安全处理，实现第一网络和第二网络的安全联动。在第一网络近源管理恶意UE，降低第一网络和第二网络的通信负载，也保障了第二网络的网络安全。

Description

一种增强跨网络访问安全的方法、设备及系统
本申请要求于2019年1月21日提交中国专利局、申请号为201910055371.2、申请名称为“一种增强跨网络访问安全的方法、设备及系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及增强跨网络访问安全的方法、设备及系统。
背景技术
为满足垂直行业通信需求，5G通信技术支持非公共网络(Non-Public Networks,NPN)。非公共网络只有授权用户可以接入，经授权的用户既可以接入NPN网络，也可以接入公用陆地移动网(public land mobile network,PLMN)网络。5G通信技术支持UE在NPN和PLMN网络之间的漫游、移动性和业务连续性等特性，例如，UE可以通过PLMN网络接入非公共网络，或者通过非公共网络接入PLMN网络。
在现有机制中，NPN网络基于5G系统架构进行部署。针对授权用户既可以接入NPN网络，也可以接入PLMN网络的场景，在UE配置上有NPN网络和PLMN网络的凭证(credential)。UE在第一网络(PLMN网络/NPN网络)中注册完成后，发现并选择第二网络(NPN网络/PLMN网络)的非3GPP互通功能(non-3GPP interworking function，N3IWF)网元，并通过第二网络的N3IWF网元进行身份认证和注册流程并接入第二网络，实现UE通过第一网络对第二网络的访问。恶意UE在无法通过第二网络认证的情况下，如果依然持续通过第一网络向第二网络发起认证请求，将会对第一网络和第二网络的网络造成很大的负担。如果大量UE被俘获，且同时向第二网络频繁发起认证请求，容易造成分布式拒绝服务(distributed denial of service，DDoS)攻击。
发明内容
本申请实施例提供增强跨网络访问安全的方法、设备及系统，在UE通过第一网络接入第二网络的场景下，本申请实施例通过在第二网络对UE的安全事件(例如认证情况)进行记录并为UE的后续行为确定决策结果，并将所述决策结果通知第一网络，以便于第一网络对UE针对第二网络的后续行为进行安全处理，实现第一网络和第二网络的安全联动。在第一网络近源管理恶意UE，降低第一网络和第二网络的通信负载，也保障了第二网络的网络安全。
为达到上述目的，本申请的实施例采用如下技术方案：
第一方面，提供了一种增强跨网络访问安全的方法，所述方法用于终端通过在第一网络中建立的分组数据单元PDU会话访问第二网络，所述方法包括：第一网络中的会话管理网元接收针对所述PDU会话第一请求消息，所述第一请求消息包括所述终端的地址信息、所述第二网络的标识以及禁止所述终端访问所述第二网络的指示信息；根据所述第一请求消息，存储禁止所述终端访问第二网络的信息；阻断所述终端对所述第二网络的访问。基于该方案，第一网络中的会话功能网元可以根据第二网络的指示，存储禁止所述终端访问第二网络的信息，并且阻断终端对第二网络的访问，使得第二网络可以控制终端通过第一网络对自身的访问，避免了对第二网络可能的DDOS攻击。
在一种可能的设计中，所述禁止所述终端访问第二网络的信息包括所述终端在第一网络中的标识和所述第二网络的标识；所述会话管理网元根据所述终端的地址信息、所述第二网络的标识以及禁止所述终端访问第二网络的指示信息，存储禁止所述终端访问第二网络的信息，具体为：
根据所述终端的地址信息，确定所述终端在所述第一网络中的标识；
关联存储所述终端在所述第一网络中的标识和所述第二网络的标识。
基于该方案，第一网络中的会话管理网元可以将禁止所述终端访问第二网络的信息存储在本地，这样后续再次收到终端发起的访问第二网络的PDU会话建立请求时，就可以直接根据本地存储的禁止所述终端访问第二网络的信息，确定需要阻断所述终端通过PDU会话访问第二网络。
在一种可能的设计中，所述禁止所述终端访问第二网络的信息包括所述终端在第一网络中的标识和所述第二网络的标识；所述会话管理网元根据所述终端的地址信息、所述第二网络的标识以及禁止所述终端访问第二网络的指示信息，存储禁止所述终端访问第二网络的信息，具体为：
根据所述终端的地址信息，确定所述终端在所述第一网络中的标识；
将所述禁止所述终端访问第二网络的信息存储到所述第一网络中UDM网元中所述终端的签约数据里或者存储到第一网络中安全网关中。
也就是说，第一网络中的会话管理网元可以将禁止所述终端访问第二网络的信息存储到第一网络中的其他网元上，例如，UDM网元或者第一网络中的安全网关上。所述第一网络中的安全网关例如可以是安全边界保护代理(security edge protection proxy，SEPP)。将禁止所述终端访问第二网络的信息存储到第一网络中的其他网元上，特别是一些全局性的网元上(该网元同时为第一网络中的多个会话管理网元服务)，可以使得当终端的位置发生变化时，第一网络依然能够准确的获知所述禁止所述终端访问第二网络的信息，进而准确的阻断所述终端对第二网络的访问。
在一种可能的设计中，所述阻断所述终端对所述第二网络的访问，包括：所述会话管理网元向所述第一网络中为所述PDU会话服务的用户面功能网元发送阻断所述终端访问所述第二网络的第二请求消息；所述用户面功能网元根据第二请求消息，阻断所述终端对所述第二网络的访问。一个PDU会话中可以承载很多的数据/信息，在这种情况下，第一网络只需要阻断终端PDU会话中访问第二网络的数据/消息即可，而不需要释放整个PDU会话，保持了PDU会话管理的灵活性。
在一种可能的设计中，所述阻断所述终端对所述第二网络的访问，包括：释放所述PDU会话。在一些情况下，终端创建的PDU会话为专门用于访问第二网络的，这种情况下，及时的释放所述PDU会话，可以及时释放第一网络中相关网元(例如AMF网元或者SMF网元)上的资源。。
在一种可能的设计中，在所述终端再次发起用于访问第二网络的PDU会话建立请求的情况下，第一网络中的会话管理网元可以根据所述禁止所述终端访问第二网络的信息，阻断所述终端对所述第二网络的访问。如果会话管理网元将禁止所述终端访问第二网络的信息存储在本地，则会话管理网元直接根据本地存储的禁止所述终端访问第二网络的信息，确定需要阻断所述终端通过PDU会话访问第二网络；如果会话管理网元将禁止所述终端访问第二网络的信息存储在第一网络中的其他网元中，则需要先从其他网元中获取禁止所述终端访问第二网络的信息。
在一种可能的设计中，所述禁止所述终端访问第二网络的信息还包括禁止所述终端访问所述第二网络的有效期。所述第一网络中的会话管理网元在所述有效期内，阻断所述终端通过所述第一网络对所述第二网络的访问。具体可以是拒绝所述终端的PDU会话建立请求，其中，终端请求建立的PDU会话为用于访问所述第二网络的PDU会话。或者是阻断终端建立的PDU会话中用于访问所述第二网络的数据/消息。
第二方面，提供了一种增强跨网络访问安全的方法，所述方法用于终端通过在第一网络中建立的分组数据单元PDU会话访问第二网络，所述方法包括：第二网络中的网元在所述UE鉴权失败的情况下，记录所述鉴权失败的结果；根据所述鉴权失败的结果，确定阻止所述终端访问所述第二网络；向第一网络中的网元发送鉴权响应，所述鉴权响应包括所述终端的地址信息以及禁止所述终端访问所述第二网络的指示信息。
基于该方案，第二网络中的网元在终端鉴权失败的情况下，可以通知第一网络阻断所述终端对第二网络的访问，避免了对第二网络可能的DDOS攻击。
在一种可能的设计中，所述鉴权响应还包括禁止所述终端访问所述第二网络的有效期。在有效期内阻断终端通过第一网络对第二网络的访问，防止恶意攻击者挟持终端通过故意使得终端鉴权失败，从而导致终端永久无法通过第一网络访问第二网络。
在一种可能的设计中，所述第二网络中的网元为非3GPP互通功能N3IWF网元。。
第三方面，提供了增强跨网络访问安全的装置，该装置具有实现上述第一方面所述的方法的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块。
第四方面，提供了一种增强跨网络访问安全的装置，包括：处理器和存储器；该存储器用于存储计算机执行指令，当该装置运行时，该处理器执行该存储器存储的该计算机执行指令，以使该装置执行如上述第一方面中任一项所述的增强跨网络访问安全的方法。
第五方面，提供了一种计算机可读存储介质，该计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机可以执行上述第一方面中任一项所述的增强跨网络访问安全的方法。
第六方面，提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机可以执行上述第一方面中任一项所述的增强跨网络访问安全的方法。
第七方面，提供了一种装置(例如，该装置可以是芯片系统)，该装置包括处理器，用于支持装置实现上述第一方面中所涉及的功能。在一种可能的设计中，该装置还包括存储器，该存储器，用于保存所述装置必要的程序指令和数据。该装置是芯片系统时，可以由芯片构成，也可以包含芯片和其他分立器件。
其中，第三方面至第七方面中任一种设计方式所带来的技术效果可参见第一方面中不同设计方式所带来的技术效果，此处不再赘述。
第八方面，提供了一种增强跨网络访问安全的装置，该装置具有实现上述第二方面所述的方法的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块。
第九方面，提供了一种增强跨网络访问安全的装置，包括：处理器和存储器；该存储器用于存储计算机执行指令，当该装置运行时，该处理器执行该存储器存储的该计算机执行指令，以使该装置执行如上述第二方面中任一项所述的增强跨网络访问安全的方法。
第十方面，提供了一种计算机可读存储介质，该计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机可以执行上述第二方面中任一项所述的增强跨网络访问安 全的方法。
第十一方面，提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机可以执行上述第二方面中任一项所述的增强跨网络访问安全的方法。
第十二方面，提供了一种装置(例如，该装置可以是芯片系统)，该装置包括处理器，用于支持第二会话管理网元实现上述第二方面中所涉及的功能。在一种可能的设计中，该装置还包括存储器，该存储器，用于保存所述装置必要的程序指令和数据。该装置是芯片系统时，可以由芯片构成，也可以包含芯片和其他分立器件。
其中，第八方面至第十二方面中任一种设计方式所带来的技术效果可参见第二方面中不同设计方式所带来的技术效果，此处不再赘述。
第十三方面，提供了增强跨网络访问安全的系统，该系统用于终端通过在第一网络中建立的分组数据单元PDU会话访问第二网络，其中，所述第二网络，用于在所述UE鉴权失败的情况下，记录所述鉴权失败的结果；根据所述鉴权失败的结果，确定阻止所述终端访问所述第二网络；向所述第一网络发送鉴权响应，所述鉴权响应包括所述终端的地址信息以及禁止所述终端访问所述第二网络的指示信息；所述第一网络，用于接收所述第二网络中发送的鉴权响应；存储禁止所述终端访问第二网络的信息；阻断所述终端对所述第二网络的访问。
在一种可能的设计中，所述第二网络，还用于确定所述终端鉴权失败的次数大于预设的阈值。
在一种可能的设计中，所述第一网络，还用于释放所述PDU会话。
在一种可能的设计中，所述第一网络，还用于阻断所述PDU会话中用于访问所述第二网络的数据/消息。
在一种可能的设计中，所述第一网络，还用于在所述终端再次发起用于访问第二网络的PDU会话建立请求的情况下，根据所述禁止所述终端访问第二网络的信息，阻断所述终端对所述第二网络的访问。
在一种可能的设计中，所述鉴权响应还包括禁止所述终端访问所述第二网络的有效期；所述禁止所述终端访问所述第二网络的信息还包括所述有效期。所述第一网元，用于在所述有效期内，阻断所述终端通过所述第一网络对第二网络的访问。
其中，第十三方面中任一种设计方式所带来的技术效果可参见上述第一方面或第二方面中不同设计方式所带来的技术效果，此处不再赘述。
本申请的这些方面或其他方面在以下实施例的描述中会更加简明易懂。
附图说明
图1为现有技术中终端通过PLMN访问NPN的流程示意图；
图2为现有技术中终端通过NPN访问PLMN的流程示意图；
图3为本申请实施例提供的一种增强跨网络访问安全的系统示意图；
图4为本申请实施例提供的又一种增强跨网络访问安全的系统示意图；
图5为申请实施例提供的又一种增强跨网络访问安全的系统示意图；
图6为本申请实施例提供的一种增强跨网络访问安全的方法流程示意图；
图7为本申请实施例提供的又一种增强跨网络访问安全的方法流程示意图；
图8为本申请实施例提供的又一种增强跨网络访问安全的方法流程示意图；
图9为本申请实施例提供的一种增强跨网络访问安全的装置的结构示意图；
图10为本申请实施例提供的又一种增强跨网络访问安全的装置的结构示意图；
图11为本申请实施例提供的又一种增强跨网络访问安全的装置的结构示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行描述。其中，在本申请的描述中，除非另有说明，“/”表示前后关联的对象是一种“或”的关系，例如，A/B可以表示A或B；本申请中的“和/或”仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况，其中A,B可以是单数或者复数。并且，在本申请的描述中，除非另有说明，“多个”是指两个或多于两个。“以下至少一项(个)”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a，b，或c中的至少一项(个)，可以表示：a，b，c，a-b，a-c，b-c，或a-b-c，其中a，b，c可以是单个，也可以是多个。另外，为了便于清楚描述本申请实施例的技术方案，在本申请的实施例中，采用了“第一”、“第二”等字样对功能和作用基本相同的相同项或相似项进行区分。本领域技术人员可以理解“第一”、“第二”等字样并不对数量和执行次序进行限定，并且“第一”、“第二”等字样也并不限定一定不同。
此外，本申请实施例描述的网络架构以及业务场景是为了更加清楚的说明本申请实施例的技术方案，并不构成对于本申请实施例提供的技术方案的限定，本领域普通技术人员可知，随着网络架构的演变和新业务场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
在本申请实施例中第一网络和第二网络为不同的两个网络，例如，第一网络可以是第一运营商的网络，第二网络可以是第二运营商的网络；也可以是，第一网络为PLMN网络，第二网络为一个NPN网络；本申请实施例对第一网络和第二网络的类型不做限定。
在3GPP TR23.734中，提出标准需要支持公共陆地移动网络(PLMN)和非公共网络(NPN)之间通过类似非3GPP互通功能(N3IWF)网元的网关进行业务连接。图1为UE通过PLMN网络接入NPN网络的流程图。在该场景下，可选的，UE在PLMN网络中建立的PDU会话接入的数据网络与NPN网络对应的N3IWF建立有IP连接。
UE通过注册到PLMN网络获得IP地址并发现NPN网络的N3IWF，然后通过N3IWF建立和NPN网络的连接，具体流程如图1所示：
步骤101、UE连接到PLMN网络；
可选的，在UE上配置有接入到PLMN网络的安全凭证(credential)。UE使用PLMN网络的安全凭证发现、选择并连接到PLMN网络中；UE通过PLMN网络获取IP地址。例如UE可以在PLMN网络中请求建立到数据网络的PDU会话，并且在PDU会话建立过程中，由PLMN网络中的网元(例如UPF或者SMF)分配IP地址。
步骤202、UE确定NPN网络中的N3IWF；
可选的，在UE上预先配置有NPN网络对应的N3IWF的IP地址或者全量域名。
步骤203、UE通过N3IWF注册到NPN网络；
可选的，在UE上预先配置有接入到NPN网络的安全凭证。UE使用NPN网络的安全凭证接入到NPN网络，并通过N3IWF完成注册到NPN网络的流程；
步骤204、UE和NPN网络建立PDU会话连接。
在步骤203中，UE通过N3IWF注册到NPN网络的过程中，NPN网络会对UE进行鉴权，只有鉴权成功的情况下，UE才可以通过PLMN网络建立到NPN网络的PDU会话。
图2为UE通过NPN网络接入PLMN网络的流程图。UE通过注册到NPN网络获得IP地址 并发现PLMN网络的N3IWF，然后通过N3IWF建立和PLMN网络的连接，具体流程如图2所示：
步骤201、UE连接到NPN网络；
可选的，在UE上配置有接入到NPN网络的安全凭证(credential)。UE使用NPN网络的安全凭证发现、选择并连接到NPN网络中；UE通过NPN网络获取IP地址。例如UE可以在NPN网络中请求建立到数据网络的PDU会话，并且在PDU会话建立过程中，由NPN网络中的网元(例如UPF或者SMF)分配IP地址。
步骤202、UE确定PLMN网络中的N3IWF；
可选的，UE根据PLMN网络中选择N3IWF的策略，确定PLMN网络中的N3IWF。或者，在UE上预先配置有PLMN网络对应的N3IWF的IP地址或者全量域名。
步骤203、UE通过N3IWF注册到PLMN网络；
可选的，在UE上预先配置有接入到PLMN网络的安全凭证。UE使用PLMN网络的安全凭证接入到PLMN网络，并通过N3IWF完成注册到PLMN网络的流程；
步骤204、UE和PLMN网络建立PDU会话连接。
在步骤203中，UE通过N3IWF注册到PLMN网络的过程中，PLMN网络会对UE进行鉴权，只有鉴权成功的情况下，UE才可以通过NPN网络建立到PLMN网络的PDU会话。
结合图1和图2的实施例可知，第一网络中(PLMN网络或者NPN网络)的UE通过第一网络接入到第二网络(NPN网络或者PLMN网络)的过程中，第二网络需要先对UE进行鉴权，只有鉴权通过的情况下，UE才可以通过第一网络建立到第二网络的PDU会话。如果恶意UE在未通过鉴权/认证的情况下，依然持续通过第一网络向第二网络发起鉴权/认证请求，那么这种持续的鉴权/认证过程，将会对第二网络的网元造成影响。例如，大量UE被俘获同时向第二网络频繁发起认证/鉴权请求，容易造成DDoS攻击。
图3是本申请实施例的一种系统示意图，包括第一网络的网元和第二网络的网元，UE通过第一网络连接到第二网络。在本申请实施例中，为了降低第一网络中的UE对第二网络潜在的攻击，本申请实施例中，第二网络中的网元在终端鉴权失败的情况下，记录鉴权失败的结果；根据所述鉴权失败的结果，确定阻止所述终端访问所述第二网络；向所述第一网络发送鉴权响应，所述鉴权响应包括所述终端的地址信息以及禁止所述终端访问所述第二网络的指示信息。所述第一网络中的网元，用于接收所述第二网络中发送的鉴权响应；存储禁止所述终端访问第二网络的信息；阻断所述终端对所述第二网络的访问。
后续UE再通过第一网络接入第二网络时，第一网络中的网元可以阻挡UE对第二网络的访问，这样就可以避免而已UE通过第一网络发起对第二网络的恶意攻击。
第一网络和第二网络可以基于目前的5G网络或者未来的其他网络架构布局。一种可能的实施方式中，第一网络和第二网络可以都是基于5G系统的机制布局，如图4和图5所述，分别是UE通过PLMN网络接入NPN网络以及通过NPN网络接入PLMN网络的架构图。
可选的，本申请实施例中图4或图5中所涉及到的终端(terminal)可以包括各种具有无线通信功能的手持设备、车载设备、可穿戴设备、计算设备或连接到无线调制解调器的其它处理设备；还可以包括用户单元(subscriber unit)、蜂窝电话(cellular phone)、智能电话(smart phone)、无线数据卡、个人数字助理(personal digital assistant，PDA)电脑、平板型电脑、无线调制解调器(modem)、手持设备(handheld)、膝上型电脑(laptop computer)、无绳电话(cordless phone)或者无线本地环路(wireless local loop，WLL)台、机器类型通信(machine type communication，MTC)终端、用户设备(user equipment，UE)，移动台(mobile station，MS)，终端设备(terminal device)或者中继用户设备等。 其中，中继用户设备例如可以是5G家庭网关(residential gateway，RG)。为方便描述，本申请中，上面提到的设备统称为终端。
图4或图5中所涉及的接入设备(无线/有线接入网络)指的是接入核心网的设备，例如可以是基站，宽带网络业务网关(broadband network gateway，BNG)，汇聚交换机，非第三代合作伙伴计划(3rd generation partnership project，3GPP)接入设备等。基站可以包括各种形式的基站，例如：宏基站，微基站(也称为小站)，中继站，接入点等。
图4或图5中所涉及的用户面功能(User Plan Function，UPF)网元是用户面的功能网元，主要负责连接外部网络，其包括了长期演进(long term evolution，LTE)的服务网关(serving gateway，SGW)和分组数据网网关(packet data network gateway，PDN-GW)的相关功能。具体地，UPF可以根据SMF的路由规则执行用户数据包转发，如上行数据发送到DN或其他UPF；下行数据转发到其他UPF或者RAN；也可以实现对特定数据流的控制，例如阻断某些特征(例如，使用IP五元组表征)的数据包。在本申请实施例中，UPF可以接收SMF下发的包过滤器(Packet Filter)，用于阻断UE访问第二网络。
图4或图5中接入与移动性管理功能(Access and Mobility Management Function网元负责UE的接入管理和移动性管理，例如负责UE的状态维护、UE的可达性管理、非接入层(non-access-stratum，NAS)消息的转发、会话管理(session management，SM)N2消息的转发。在实际应用中，AMF网元可实现LTE网络框架中MME里的移动性管理功能，还可实现接入管理功能。
图4或图5中会话管理功能(Session Management Function，SMF)网元负责会话管理，为UE的会话分配资源、释放资源；其中资源包括会话服务质量(quality of service，QoS)、会话路径、转发规则等。SMF或者UPF网元还用于为UE分配互联网协议(Internet Protocol，IP)地址。
图4或图5中AUSF网元用于执行UE的安全认证，如鉴权/认证。
图4或图5中AF网元可以是第三方的应用控制平台，也可以是运营商自己的设备，AF网元可以为多个应用服务器提供服务。
图4或图5中UDM网元可存储UE的签约信息。
图4或图5中PCF网元用于进行用户策略管理，类似于LTE中的策略与计费规则功能(policy and charging rules function，PCRF)网元，主要负责策略授权、服务质量以及计费规则的生成，并将相应规则通过SMF网元下发至UPF网元，完成相应策略及规则的安装。
需要说明的是，本申请实施例将AMF、SMF和UDM等称为网元仅为一种示意。实际中，网元也可以称为实例或者网络功能实体。例如，UDM网元也可以称为UDM实例、UDM网络功能实体；AMF网元也可以称为AMF实例、AMF网络功能实体。
同样需要说明的是，本申请实施例中所述的UDM网元在实现其功能时可以通过和同一数据仓储(unified data repository，UDR)网元交互实现，UDR网元用于存储UDM网元执行其操作时所需的数据，UDM网元用于与其他网元进行交互。实际实现时，UDR网元和UDM网元可以是两个独立的物理实体，UDR网元也可集成在UDM网元中，本申请实施例对比不做具体限定。
可以理解的是，上述功能网元既可以是硬件设备中的网络元件，也可以是在专用硬件上运行的软件功能，或者是平台(例如，云平台)上实例化的虚拟化功能。
示例性的，为了便于描述，后续实施例中，以第一网络和第二网络都是基于5G系统的机制布局为例进行描述。
下面将结合附图对本申请实施例提供的增强跨网络访问安全的方法进行具体阐述。
需要说明的是，本申请下述实施例中各个网元之间的消息名字或消息中各参数的名字等只是一个示例，具体实现中也可以是其他的名字，本申请实施例对此不作具体限定。
如图6所示，为本申请实施例提供的一种增强跨网络访问安全的方法，该方法包括如下步骤：
步骤601、UE连接到第一网络；
可选的，UE需要注册到第一网络中以获得通过第一网络获取相关服务的权限。在UE注册流程中，第一网络会对UE进行认证/鉴权。可选的，在UE上配置有接入到第一网络的安全凭证。UE使用第一网络的安全凭证发现、选择并连接到第一网络。
步骤602、UE在第一网络中建立PDU会话。
UE可以在第一网络中请求建立到数据网络(Data Network，DN)的PDU会话，并且在PDU会话建立过程中，由第一网络中的网元(例如UPF或者SMF)为UE分配IP地址。
步骤603、UE确定第二网络的N3IWF；
可选的，在UE上预先配置有第二网络对应的N3IWF的IP地址或者全量域名(fully qualified domain name，FQDN)。
步骤604、UE通过第二网络的N3IWF，请求注册到第二网络，并触发鉴权流程；
一种可能的实现方式中，UE通过第二网络的N3IWF，向第二网络中的网元发送注册请求，并且在注册过程中触发UE和第一网络之间的互相鉴权。具体实现可以参考现有技术，如TS 23.502 V15.2.0第4.2.2.2.2节General Registration相关描述以及TS 33.501 V15.2.0第6.1.3节Authentication procedures相关描述，这里不再赘述。
步骤605、第二网络中的网元确定对UE的鉴权失败，记录鉴权结果并做出相应的决策。
一种可能的实现方式是，第二网络中的AUSF网元、AMF网元或者N3IWF判断对UE的鉴权失败，现有技术中第二网络中的AUSF网元、AMF网元或者N3IWF网元会向UE返回一个错误指示，用于通知UE鉴权失败。本申请实施例中，在确定对UE的鉴权失败之后，N3IWF网元或者第二网络中的其他网元(例如，第二网络中的AUSF网元或者AMF网元等)记录UE鉴权失败的结果，并由N3IWF网元或者第二网络中的其他网元根据UE之前的鉴权结果，决策是否需要禁止UE对第二网络的访问，可选的，可以为UE禁止访问第二网络设置一个有效期。
一种可能的实现方式中，在由第二网络中的其他网元(例如，第二网络中的AUSF网元或者AMF网元等)来判断UE的鉴权是否失败的情况下，第二网络中的其他网元通知N3IWF网元，从而使得N3IWF网元确定第二网络对UE的鉴权失败。
可选的，N3IWF网元或者第二网络中的其他网元记录任一UE认证/鉴权失败的日志，记录的日志内容可以包括UE的IP地址和UE在第二网络中的标识等。如果同一个IP地址的UE在预设时长内认证/鉴权失败的次数达到预设阈值，则N3IWF网元或者第二网络中的其他网元可以做出禁止该IP地址对应的UE对第二网络进行访问的决策。
步骤606、第二网络中的网元向第一网络中的UPF网元发送认证/鉴权响应；
在一种可能的实现方式中，第二网络中的N3IWF向第一网络中的UPF发送鉴权响应；另一种可能的实现方式中，第二网络中的N3IWF通过第二网络中的SMF网元向第一网络中的UPF网元发送鉴权响应。
所述鉴权响应包括所述IP地址以及原因值cause。所述cause用于指示禁止该IP地址访问第二网络，可选的，还用于指示禁止该IP地址访问第二网络的原因，例如认证/鉴权失败。可选的，该鉴权响应中还包括有效期，该有效期用于指示禁止该IP地址访问第二网络的 时间信息，例如，某一时间段内或者某一时刻之前禁止该IP地址访问第二网络。
步骤607、第一网络中的UPF网元向UE发送认证/鉴权响应；
可选的，第一网络中的UPF网元向UE发送的认证/鉴权响应中包括UE鉴权失败的指示信息。
步骤608、第一网络中的UPF网元向第一网络中为UE的PDU会话服务的SMF网元发送PDU会话控制请求；
具体的，该PDU会话控制请求包括所述IP地址、cause和所述第二网络的标识(SN_ID)等信息；可选的，该PDU会话控制请求还包括所述有效期。
需要说明书的是，步骤606中可能并不携带所述IP地址以及原因值cause，而只是用于指示第二网络对所述UE认证/鉴权失败。这种情况下，步骤608中的PDU会话控制请求可以是由第二网络中的SMF网元发送所给所述第一网络中的SMF网元。进一步的，步骤605中，第二网络中的N3IWF网元或者第二网络中的其他网元根据UE之前的鉴权结果，决策需要禁止UE对第二网络的访问之后，将禁止UE对第二网络进行访问的决策结果发送给所述第二网络中的SMF网元。所述第二网络中的SMF网元根据禁止UE访问第二网络的决策结果，向所述第一网络中的SMF网元发送PDU会话控制请求。
步骤609、第一网络中为UE的PDU会话服务的SMF网元接收第一网络中UPF网元发送的PDU会话控制请求；保存禁止所述UE访问第二网络的信息。
可选的，所述禁止所述UE访问第二网络的信息包括所述UE的标识和所述第二网络的标识；可选的，还包括上述有效期。
具体的，第一网络中为UE的PDU会话服务的SMF网元根据所述PDU会话控制请求中的cause，确定第二网络禁止所述UE访问第二网络；根据PDU会话控制请求中的IP地址，确定所述UE的PDU会话标识(可选的)以及UE在第一网络中的标识；关联存储所述UE在第一网络中的标识和所述第二网络的标识。UE在第一网络中的标识具体可以是用户永久标识(subscription permanent identifier，SUPI)。
一种可能的实现方式是，SMF网元维护一个黑名单，黑名单中每一个条目用于记录哪个UE禁止访问哪个网络。可选的，黑名单中每一个条目还包括该条目的有效期。
可选的，第一网络中为UE的PDU会话服务的SMF网元还判断所述UE的PDU会话的类型。当所述UE的PDU会话为专门用于访问所述第二网络的，例如所述UE的PDU会话对应的数据网络名称(Data Network Name，DNN)携带有所述第二网络的信息，则执行步骤610，释放所述UE的PDU会话，并且跳过步骤611-614；当所述UE的PDU会话不是为专门用于访问所述第二网络的，例如所述UE的PDU会话对应的数据网络名称(Data Network Name，DNN)为公共的数据网络(如因特网)，则跳过步骤610，转而执行步骤611-614。需要说明的是，当所述UE的PDU会话不是为专门用于访问所述第二网络的时候，说明该PDU会话除了被UE用于访问第二网络之外，还可以用于被UE获取对应的数据网络中的业务/服务数据。此时，如果直接释放该PDU会话，将会导致UE的其他业务/服务受到影响。因此，需要保留该PDU会话，但是需要阻断该PDU会话中访问第二网络的数据/消息。一种可能的实现方式中，UE不管该PDU会话是否专门用于访问所述第二网络，均跳过步骤610，转而执行步骤611-614。
步骤610、释放所述UE的PDU会话。
PDU会话的释放流程可以参考现有技术，这里不再赘述。例如，可以参考TS 23.502 V15.2.0第4.3.4节PDU Session Release相关描述。
步骤611、SMF网元发起PDU会话管理策略修改流程。
具体的，SMF网元确定需要阻止UE访问第二网络之后，决定修改UE的PDU会话。可选的，SMF网元向第一网络中的PCF网元发送会话管理策略更新请求(例如，Npcf_SMPolicyControl_Update request)，该会话管理策略更新请求用于请求PCF网元生成阻止UE访问第二网络的会话管理策略。
PCF网元根据接收到的会话管理策略更新请求，生成新的会话管理策略，并将生成的会话管理策略发送给SMF网元；可选的，新的会话管理策略包括一个包过滤器，该包过滤器用于阻断UE访问第二网络的数据/请求。例如，该包过滤器包括UE的IP地址和目的地址。可选的，还包括目的端口、传输层协议等信息。其中目的地址可以是第二网络中网元的地址，例如可以是第二网络中N3IWF的IP地址。
步骤612、SMF网元发起UPF网元的N4会话更新流程。
具体的，SMF网元向UPF网元发送N4 Session Modification Request message，该N4Session Modification Request message包括所述包过滤器，UPF网元接收SMF网元发送的N4 Session Modification Request message，并安装所述包过滤器。
步骤613、SMF网元向UPF网元发送PDU会话控制响应。
具体的，PDU会话控制响应具体可以是一个确认消息，用于指示SMF网元已经成功接收到步骤608中的PDU会话控制请求。可选的，还可以用于指示PDU会话修改成功。
步骤614、UPF网元根据所述包过滤器阻断UE对第二网络的访问。
具体的，UPF网元可以根据包过滤器过滤数据包，例如，可以根据数据包的源地址和目的地址，进行阻断，从而阻止UE到所述第二网络的访问。
步骤615、UE后续再次发起PDU会话建立请求。
步骤616、第一网络中的网元拒绝UE访问第二网络。
具体的，SMF网元根据所述黑名单确定所述UE不允许访问第二网络，且UE请求建立的PDU会话专门用于访问第二网络，则所述SMF网元拒绝步骤615中PDU会话的建立；如果UE请求建立的PDU会话不是专门用于访问第二网络，则执行步骤611-614，在UPF网元上限值UE到第二网络的数据/消息。
步骤617、PDU会话建立的后续流程。
可选的，如果步骤616中，SMF网元拒绝PDU会话的建立，则SMF网元向UE发送PDU会话拒绝消息，可选的，可以包括拒绝PDU会话建立的原因值。具体的，SMF网元通过NAS SM信令通知UE拒绝PDU会话建立，该NAS SM信令可以包括拒绝的原因值，例如拒绝访问第二网络。
可选的，如果步骤616中，SMF网元确定UE请求建立的PDU会话不是专门用于访问第二网络，且执行步骤611-614，则PDU会话建立的后续流程可以包括向UE发送PDU会话建立成功的响应消息。
本申请实施例中第二网络的网元在UE鉴权失败之后，记录UE的鉴权结果，并且在确定UE多次请求认证/鉴权的情况下，向第一网络中的网元发送阻止UE继续访问第二网络的指示。第一网络中的网元释放PDU会话或者PDU会话修改，能够有效防止恶意UE对第一网络和第二网络的资源占用，提高网络效率，防止第二网络遭受DDoS攻击。
在图6所述的实施例中，第一网络中的SMF网元保存禁止UE访问第二网络的信息(即黑名单)，并且也是由SMF根据黑名单，确定一个UE是否允许访问第二网络。如图7所示，在本申请实施例提供的另一种增强跨网络访问安全的方法中，可以由第一网络中的UDM保存禁止UE访问第二网络的信息(即黑名单)，然后由SMF网元根据黑名单，确定一个UE是否允 许访问第二网络，该方法包括如下步骤：
步骤701-步骤708分别同图6实施例中的步骤601-608，相关内容可以参考上述实施例，这里不再赘述。
步骤709、第一网络中为UE的PDU会话服务的SMF网元接收第一网络中UPF网元发送的PDU会话控制请求。
具体的，第一网络中为UE的PDU会话服务的SMF网元根据所述PDU会话控制请求中的cause，确定第二网络禁止所述UE访问第二网络；根据PDU会话控制请求中的IP地址，确定所述UE的PDU会话标识以及UE在第一网络中的标识；
将所述UE在第一网络中的标识和所述第二网络的标识发送给UDM网元。可选的，SMF网元还将所述有效期发送给UDM网元。
可选的，第一网络中为UE的PDU会话服务的SMF网元还判断所述UE的PDU会话的类型。当所述UE的PDU会话为专门用于访问所述第二网络的，例如所述UE的PDU会话对应的数据网络名称(Data Network Name，DNN)携带有所述第二网络的信息，则执行步骤711，释放所述UE的PDU会话，并且跳过步骤712-715；当所述UE的PDU会话不是为专门用于访问所述第二网络的，例如所述UE的PDU会话对应的数据网络名称(Data Network Name，DNN)为公共的数据网络(如因特网)，则跳过步骤711，转而执行步骤712-715。需要说明的是，当所述UE的PDU会话不是为专门用于访问所述第二网络的时候，说明该PDU会话除了被UE用于访问第二网络之外，还可以用于被UE获取对应的数据网络中的业务/服务数据。此时，如果直接释放该PDU会话，将会导致UE的其他业务/服务受到影响。因此，需要保留该PDU会话，但是需要阻断该PDU会话中访问第二网络的数据/消息。一种可能的实现方式中，UE不管该PDU会话是否专门用于访问所述第二网络，均跳过步骤711，转而执行步骤712-715。
步骤710、第一网络中为UE的PDU会话服务的SMF网元将禁止所述UE访问第二网络的信息存储到UDM网元。
可选的，SMF网元将禁止所述UE访问第二网络的信息存储到UDM网元中所述UE的签约数据中。具体的，所述UDM网元在每个UE的签约数据中保存一个黑名单，黑名单中每一个条目用于记录UE禁止访问哪个网络。可选的，黑名单中每一个条目还包括该条目的有效期。
步骤711-步骤716分别同图6实施例中的步骤610-615，相关内容可以参考上述实施例，这里不再赘述。
步骤717、SMF网元从UDM网元获取阻止UE访问第二网络的信息。
具体的，SMF网元可以在PDU会话建立过程中从UDM网元获取UE的签约数据，并从所述UE的签约数据中获取阻止UE访问第二网络的信息。
步骤718-步骤719分别同图6实施例中的步骤616-617，相关内容可以参考上述实施例，这里不再赘述。
在图6所述的实施例中，第一网络中的SMF网元保存禁止UE访问第二网络的信息(即黑名单)，并且也是由SMF根据黑名单，确定一个UE是否允许访问第二网络。如图7所示，可以由第一网络中的UDM保存禁止UE访问第二网络的信息(即黑名单)，然后由SMF网元根据黑名单，确定一个UE是否允许访问第二网络。在图8所述的另有一种增强跨网络访问安全的方法中，第一网络和第二网络中分别部署了一个安全网关，例如可以是安全边界保护代理(security edge protection proxy，SEPP)，该安全网关可以是单独的网元，其功能也可以集成到已有的网元中。该方法包括如下步骤：
步骤801-步骤805分别同图7实施例中的步骤701-705，相关内容可以参考上述实施例， 这里不再赘述。
步骤806-步骤809分别同图7实施例中的步骤706-709，不同的是，步骤806的执行主体由图7中步骤706第二网络中的N3IWF替换为图8中第二安全网关，步骤807和步骤808的执行主体由图7中相关步骤的UPF替换为图8中第一安全网关相关内容可以参考上述实施例，这里不再赘述。
步骤810、第一网络中为UE的PDU会话服务的SMF网元将禁止所述UE访问第二网络的信息存储到第一安全网关。
具体描述参考图7实施例中步骤710，只要将步骤710中的UDM替换为第一安全网关即可，这里步骤赘述。
步骤811同图7实施例中的步骤711.
步骤812、SMF网元向第一安全网关发送阻止UE访问第二网络的信息。
可选的，SMF网元向第一安全网关发送PDU会话控制响应，PDU会话控制响应中携带阻止UE访问第二网络的信息。所述阻止UE访问第二网络的信息例如可以包括UE在第一网络中的标识/UE的IP地址、目的IP地址等信息。可选的，还包括目的端口、传输层协议等信息。其中目的地址可以是第二网络中网元的地址，例如可以是第二网络中N3IWF的IP地址或者第二安全网关的地址。
步骤813、第一安全网关阻断UE对第二网络的访问。
步骤815同图7实施例中的步骤716.
步骤816、SMF网元从第一安全网关获取阻止UE访问第二网络的信息。
步骤817-步骤818分别同图7实施例中的步骤718-719，相关内容可以参考上述实施例，这里不再赘述。
上述详细阐述了本申请实施例的方法，下面提供了本申请实施例的装置。
请参见图9，是本申请实施例提供的增强跨网络访问安全的装置的逻辑结构示意图，所述装置90用于终端通过在第一网络中建立的分组数据单元PDU会话访问第二网络，该装置90可以包括接收模块901和处理模块902。
接收模块901，用于接收针对所述PDU会话第一请求消息，所述第一请求消息包括所述终端的地址信息、所述第二网络的标识以及禁止所述终端访问所述第二网络的指示信息；
处理模块902，用于根据所述第一请求消息，存储禁止所述终端访问第二网络的信息；
所述处理模块901，还用于阻断所述终端对所述第二网络的访问。
所述禁止所述终端访问第二网络的信息包括所述终端在第一网络中的标识和所述第二网络的标识；所述处理单元902，用于存储禁止所述终端访问第二网络的信息，具体为：
根据所述终端的地址信息，确定所述终端在所述第一网络中的标识；
关联存储所述终端在所述第一网络中的标识和所述第二网络的标识。
或者，所述处理单元902，用于存储禁止所述终端访问第二网络的信息，具体为：
根据所述终端的地址信息，确定所述终端在所述第一网络中的标识；
将所述禁止所述终端访问第二网络的信息存储到所述第一网络中UDM网元中所述终端的签约数据里或者存储到第一网络中安全网关中。
一种可能的实现方式中，所述处理模块902，用于阻断所述终端对所述第二网络的访问，包括：向所述第一网络中为所述PDU会话服务的用户面功能网元发送阻断所述终端访问所述第二网络的第二请求消息，所述第二请求消息指示所述用户面功能网元阻断所述终端对所述第二网络的访问。
另一种可能的实现方式中，所述处理模块902，用于阻断所述终端对所述第二网络的访问，包括：释放所述PDU会话。
所述处理模块902，还用于在所述终端再次发起用于访问第二网络的PDU会话建立请求的情况下，根据所述禁止所述终端访问第二网络的信息，阻断所述终端对所述第二网络的访问。
可选的，第一请求消息还包括禁止所述终端访问所述第二网络的有效期；所述禁止所述终端访问所述第二网络的信息还包括所述有效期。
该装置90可以实现图6-8所示实施例中SMF网元的功能，该装置90中各个模块执行详细过程可以参见图6-8所示实施例SMF网元的执行步骤，此处不再赘述。
请参见图10，是本申请实施例提供的增强跨网络访问安全的装置的逻辑结构示意图，所述装置100用于终端通过在第一网络中建立的分组数据单元PDU会话访问第二网络，该装置100可以包括处理模块1001和发送模块1002。
处理模块1001，用于在所述UE鉴权失败的情况下，记录所述鉴权失败的结果；
所述处理模块1001，还用于根据所述鉴权失败的结果，确定阻止所述终端访问所述第二网络；
发送模块1002，用于向第一网络中的网元发送鉴权响应，所述鉴权响应包括所述终端的地址信息以及禁止所述终端访问所述第二网络的指示信息。
可选的，所述鉴权响应还包括禁止所述终端访问所述第二网络的有效期。
所述处理模块1001，用于确定阻止所述终端访问所述第二网络，具体为：确定所述终端鉴权失败的次数大于预设的阈值。
可选的，所述装置为非3GPP互通功能N3IWF网元。
该装置100可以实现图6-8所示实施例中N3IWF网元的功能，该装置100中各个模块执行详细过程可以参见图6-8所示实施例N3IWF网元的执行步骤，此处不再赘述。
本申请实施例图4-5所述的任一功能网元既可以是硬件设备中的网络元件，也可以是在专用硬件上运行的软件功能，或者是平台(例如，云平台)上实例化的虚拟化功能。
例如，本申请实施4-5所述的任一功能网元可以通过图11中的通信设备来实现。图11所示为本申请实施例提供的通信设备的硬件结构示意图。该通信设备1100包括处理器1101，通信线路1102，存储器1103以及至少一个通信接口(图11中仅是示例性的以包括通信接口1104为例进行说明)。
处理器1101可以是一个通用中央处理器(central processing unit，CPU)，微处理器，特定应用集成电路(application-specific integrated circuit，ASIC)，或一个或多个用于控制本申请方案程序执行的集成电路。
通信线路1102可包括一通路，在上述组件之间传送信息。
通信接口1104，使用任何收发器一类的装置，用于与其他设备或通信网络通信，如以太网，无线接入网(radio access network，RAN)，无线局域网(wireless local area networks，WLAN)等。
存储器1103可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其他类型的动态存储设备，也可以是电可擦可编程只读存储器(electrically erasable programmable read-only memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光 碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器可以是独立存在，通过通信线路1102与处理器相连接。存储器也可以和处理器集成在一起。
其中，存储器1103用于存储执行本申请方案的计算机执行指令，并由处理器1101来控制执行。处理器1101用于执行存储器1103中存储的计算机执行指令，从而实现本申请上述实施例6-8提供的增强跨网络访问安全的方法。
可选的，本申请实施例中的计算机执行指令也可以称之为应用程序代码，本申请实施例对此不作具体限定。
在具体实现中，作为一种实施例，处理器1101可以包括一个或多个CPU，例如图11中的CPU0和CPU1。
在具体实现中，作为一种实施例，通信设备1100可以包括多个处理器，例如图11中的处理器1101和处理器1108。这些处理器中的每一个可以是一个单核(single-CPU)处理器，也可以是一个多核(multi-CPU)处理器。这里的处理器可以指一个或多个设备、电路、和/或用于处理数据(例如计算机程序指令)的处理核。
在具体实现中，作为一种实施例，通信设备1100还可以包括输出设备1105和输入设备1106。输出设备1105和处理器1101通信，可以以多种方式来显示信息。例如，输出设备405可以是液晶显示器(liquid crystal display，LCD)，发光二级管(light emitting diode，LED)显示设备，阴极射线管(cathode ray tube，CRT)显示设备，或投影仪(projector)等。输入设备1106和处理器1101通信，可以以多种方式接收用户的输入。例如，输入设备1106可以是鼠标、键盘、触摸屏设备或传感设备等。
上述的通信设备1100可以是一个通用设备或者是一个专用设备。在具体实现中，通信设备1100可以是台式机、便携式电脑、网络服务器、掌上电脑(personal digital assistant，PDA)、移动手机、平板电脑、无线终端设备、嵌入式设备或有图11中类似结构的设备。本申请实施例不限定通信设备1100的类型。
可选的，本申请实施例还提供了一种装置(例如，该装置可以是芯片系统)，该装置包括处理器，用于支持上述图6-8所述的增强跨网络访问安全的方法。在一种可能的设计中，该装置还包括存储器。该存储器，用于保存第一会话管理网元必要的程序指令和数据。当然，存储器也可以不在该装置中。该装置是芯片系统时，可以由芯片构成，也可以包含芯片和其他分立器件，本申请实施例对此不作具体限定。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件程序实现时，可以全部或部分地以计算机程序产品的形式来实现。该计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或者数据中心通过有线(例如同轴电缆、光纤、数字用户线(digital subscriber line，DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可以用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)，光介质(例如，DVD)、或者半导体介质(例如固态硬盘(solid state disk，SSD))等。
尽管在此结合各实施例对本申请进行了描述，然而，在实施所要求保护的本申请过程中，本领域技术人员通过查看所述附图、公开内容、以及所附权利要求书，可理解并实现所述公开实施例的其他变化。在权利要求中，“包括”(comprising)一词不排除其他组成部分或步骤，“一”或“一个”不排除多个的情况。单个处理器或其他单元可以实现权利要求中列举的若干项功能。相互不同的从属权利要求中记载了某些措施，但这并不表示这些措施不能组合起来产生良好的效果。
尽管结合具体特征及其实施例对本申请进行了描述，显而易见的，在不脱离本申请的精神和范围的情况下，可对其进行各种修改和组合。相应地，本说明书和附图仅仅是所附权利要求所界定的本申请的示例性说明，且视为已覆盖本申请范围内的任意和所有修改、变化、组合或等同物。显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的精神和范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (30)

  1. 一种增强跨网络访问安全的方法，其特征在于，所述方法用于终端通过在第一网络中建立的分组数据单元PDU会话访问第二网络，所述方法包括：
    第一网络中的会话管理网元接收针对所述PDU会话第一请求消息，所述第一请求消息包括所述终端的地址信息、所述第二网络的标识以及禁止所述终端访问所述第二网络的指示信息；
    所述会话管理网元根据所述第一请求消息，存储禁止所述终端访问第二网络的信息；
    所述会话管理网元阻断所述终端对所述第二网络的访问。
  2. 根据权利要求1所述的方法，其特征在于，所述禁止所述终端访问第二网络的信息包括所述终端在第一网络中的标识和所述第二网络的标识；所述会话管理网元根据所述终端的地址信息、所述第二网络的标识以及禁止所述终端访问第二网络的指示信息，存储禁止所述终端访问第二网络的信息，具体为：
    根据所述终端的地址信息，确定所述终端在所述第一网络中的标识；
    关联存储所述终端在所述第一网络中的标识和所述第二网络的标识。
  3. 根据权利要求1所述的方法，其特征在于，所述禁止所述终端访问第二网络的信息包括所述终端在第一网络中的标识和所述第二网络的标识；所述会话管理网元根据所述终端的地址信息、所述第二网络的标识以及禁止所述终端访问第二网络的指示信息，存储禁止所述终端访问第二网络的信息，具体为：
    根据所述终端的地址信息，确定所述终端在所述第一网络中的标识；
    将所述终端在所述第一网络中的标识和所述第二网络的标识关联存储到所述第一网络中UDM网元中所述终端的签约数据里或者存储到第一网络中安全网关中。
  4. 根据权利要求1-3任一所述的方法，其特征在于，所述阻断所述终端对所述第二网络的访问，包括：
    所述会话管理网元向所述第一网络中为所述PDU会话服务的用户面功能网元发送阻断所述终端访问所述第二网络的第二请求消息；
    所述用户面功能网元根据第二请求消息，阻断所述终端对所述第二网络的访问。
  5. 根据权利要求1-3任一所述的方法，其特征在于，所述阻断所述终端对所述第二网络的访问，包括：
    所述会话管理网元释放所述PDU会话。
  6. 根据权利要求1-5任一所述的方法，其特征在于，所述方法还包括：
    在所述终端再次发起用于访问第二网络的PDU会话建立请求的情况下，根据所述禁止所述终端访问第二网络的信息，阻断所述终端对所述第二网络的访问。
  7. 根据权利要求1-6任一所述的方法，其特征在于，第一请求消息还包括禁止所述终端访问所述第二网络的有效期；所述禁止所述终端访问所述第二网络的信息还包括所述有效期。
  8. 一种增强跨网络访问安全的方法，其特征在于，所述方法用于终端通过在第一网络中建立的分组数据单元PDU会话访问第二网络，所述方法包括：
    第二网络中的网元在所述UE鉴权失败的情况下，记录所述鉴权失败的结果；
    所述第二网络中的网元根据所述鉴权失败的结果，确定阻止所述终端访问所述第二网络；
    所述第二网络中的网元向第一网络中的网元发送鉴权响应，所述鉴权响应包括所述终端的地址信息以及禁止所述终端访问所述第二网络的指示信息。
  9. 根据权利要求8所述的方法，其特征在于，所述鉴权响应还包括禁止所述终端访问所述第二网络的有效期。
  10. 根据权利要求8或9所述的方法，其特征在于，所述确定阻止所述终端访问所述第二网络，具体为：
    所述第二网络中的网元确定所述终端鉴权失败的次数大于预设的阈值。
  11. 根据权利要求8-10任一所述的方法，其特征在于，所述第二网络中的网元为非3GPP互通功能N3IWF网元。
  12. 一种增强跨网络访问安全的装置，其特征在于，所述装置用于终端通过在第一网络中建立的分组数据单元PDU会话访问第二网络，所述装置包括：
    接收模块，用于接收针对所述PDU会话第一请求消息，所述第一请求消息包括所述终端的地址信息、所述第二网络的标识以及禁止所述终端访问所述第二网络的指示信息；
    处理模块，用于根据所述第一请求消息，存储禁止所述终端访问第二网络的信息；
    所述处理模块，还用于阻断所述终端对所述第二网络的访问。
  13. 根据权利要求12所述的装置，其特征在于，所述禁止所述终端访问第二网络的信息包括所述终端在第一网络中的标识和所述第二网络的标识；所述处理单元，用于存储禁止所述终端访问第二网络的信息，具体为：
    根据所述终端的地址信息，确定所述终端在所述第一网络中的标识；
    关联存储所述终端在所述第一网络中的标识和所述第二网络的标识。
  14. 根据权利要求12所述的装置，其特征在于，所述禁止所述终端访问第二网络的信息包括所述终端在第一网络中的标识和所述第二网络的标识；所述处理单元，用于存储禁止所述终端访问第二网络的信息，具体为：
    根据所述终端的地址信息，确定所述终端在所述第一网络中的标识；
    将所述终端在所述第一网络中的标识和所述第二网络的标识关联存储到所述第一网络中UDM网元中所述终端的签约数据里或者存储到第一网络中安全网关中。
  15. 根据权利要求12-14任一所述的装置，其特征在于，所述处理模块，用于阻断所述终端对所述第二网络的访问，包括：
    向所述第一网络中为所述PDU会话服务的用户面功能网元发送阻断所述终端访问所述第二网络的第二请求消息，所述第二请求消息指示所述用户面功能网元阻断所述终端对所述第二网络的访问。
  16. 根据权利要求12-14任一所述的装置，其特征在于，所述处理模块，用于阻断所述终端对所述第二网络的访问，包括：
    释放所述PDU会话。
  17. 根据权利要求12-16任一所述的装置，其特征在于，所述处理模块，还用于在所述终端再次发起用于访问第二网络的PDU会话建立请求的情况下，根据所述禁止所述终端访问第二网络的信息，阻断所述终端对所述第二网络的访问。
  18. 根据权利要求12-17任一所述的装置，其特征在于，第一请求消息还包括禁止所述终端访问所述第二网络的有效期；所述禁止所述终端访问所述第二网络的信息还包括所述有效期。
  19. 一种增强跨网络访问安全的装置，其特征在于，所述装置用于终端通过在第一网络中建立的分组数据单元PDU会话访问第二网络，所述装置包括：
    处理模块，用于在所述UE鉴权失败的情况下，记录所述鉴权失败的结果；
    所述处理模块，还用于根据所述鉴权失败的结果，确定阻止所述终端访问所述第二网络；
    发送模块，用于向第一网络中的网元发送鉴权响应，所述鉴权响应包括所述终端的地址信息以及禁止所述终端访问所述第二网络的指示信息。
  20. 根据权利要求19所述的装置，其特征在于，所述鉴权响应还包括禁止所述终端访问所述第二网络的有效期。
  21. 根据权利要求19或20所述的装置，其特征在于，所述处理模块，用于确定阻止所述终端访问所述第二网络，具体为：
    确定所述终端鉴权失败的次数大于预设的阈值。
  22. 根据权利要求19-21任一所述的装置，其特征在于，所述装置为非3GPP互通功能N3IWF网元。
  23. 一种增强跨网络访问安全的装置，其特征在于，所述装置包括处理器和存储器；
    所述存储器用于存储计算机执行指令，当所述装置运行时，所述处理器执行所述存储器存储的所述计算机执行指令，以使所述装置执行如权利要求1-11任一所述的方法。
  24. 一种计算机存储介质，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行所述权利要求1-11任一所述的方法。
  25. 一种增强跨网络访问安全的系统，所述系统用于终端通过在第一网络中建立的分组数据单元PDU会话访问第二网络，其特征在于，
    所述第二网络，用于在所述UE鉴权失败的情况下，记录所述鉴权失败的结果；根据所述鉴权失败的结果，确定阻止所述终端访问所述第二网络；向所述第一网络发送鉴权响应，所述鉴权响应包括所述终端的地址信息以及禁止所述终端访问所述第二网络的指示信息；
    所述第一网络，用于接收所述第二网络中发送的鉴权响应；存储禁止所述终端访问第二网络的信息；阻断所述终端对所述第二网络的访问。
  26. 根据权利要求25所述的系统，其特征在于，所述第二网络，还用于确定所述终端鉴权失败的次数大于预设的阈值。
  27. 根据权利要求25或26所述的系统，其特征在于，所述第一网络，还用于释放所述PDU会话。
  28. 根据权利要求25或26所述的系统，其特征在于，所述第一网络，还用于阻断所述PDU会话中用于访问所述第二网络的数据/消息。
  29. 根据权利要求25-28任一所述的方法，其特征在于，所述第一网络，还用于在所述终端再次发起用于访问第二网络的PDU会话建立请求的情况下，根据所述禁止所述终端访问第二网络的信息，阻断所述终端对所述第二网络的访问。
  30. 根据权利要求25-29任一所述的系统，其特征在于，所述鉴权响应还包括禁止所述终端访问所述第二网络的有效期；所述禁止所述终端访问所述第二网络的信息还包括所述有效期。
PCT/CN2020/073436 2019-01-21 2020-01-21 一种增强跨网络访问安全的方法、设备及系统 WO2020151696A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP20745507.2A EP3893536A4 (en) 2019-01-21 2020-01-21 METHOD, DEVICE AND SYSTEM FOR IMPROVING INTER-NETWORK ACCESS SECURITY
US17/374,405 US20210344680A1 (en) 2019-01-21 2021-07-13 Method, Device, And System For Enhancing Cross-Network Access Security

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910055371.2A CN111465018B (zh) 2019-01-21 2019-01-21 一种增强跨网络访问安全的方法、设备及系统
CN201910055371.2 2019-01-21

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/374,405 Continuation US20210344680A1 (en) 2019-01-21 2021-07-13 Method, Device, And System For Enhancing Cross-Network Access Security

Publications (1)

Publication Number Publication Date
WO2020151696A1 true WO2020151696A1 (zh) 2020-07-30

Family

ID=71682158

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/073436 WO2020151696A1 (zh) 2019-01-21 2020-01-21 一种增强跨网络访问安全的方法、设备及系统

Country Status (4)

Country Link
US (1) US20210344680A1 (zh)
EP (1) EP3893536A4 (zh)
CN (1) CN111465018B (zh)
WO (1) WO2020151696A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114390523A (zh) * 2020-10-15 2022-04-22 联发科技股份有限公司 增强ue对禁止的snpn列表的处理的方法及用户设备

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2022033526A1 (zh) * 2020-08-12 2022-02-17 华为技术有限公司 一种通信方法及装置
CN112437456B (zh) * 2020-12-07 2023-05-26 中国联合网络通信集团有限公司 一种非公共网络中的通信方法及设备
CN113114650B (zh) * 2021-04-02 2024-04-23 腾讯科技（深圳）有限公司 网络攻击的解决方法、装置、设备及介质
CN113489747B (zh) * 2021-08-17 2023-03-24 中国联合网络通信集团有限公司 会话连接方法、装置及终端
CN117439819B (zh) * 2023-12-20 2024-03-22 深圳市胜威南方科技有限公司 一种pdu机柜安全监控方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103516739A (zh) * 2012-06-21 2014-01-15 中兴通讯股份有限公司 Sta的剔除方法及装置
CN105991515A (zh) * 2015-01-28 2016-10-05 普天信息技术有限公司 一种通信系统业务隔离的实现方法、终端及基站
CN108377493A (zh) * 2016-11-21 2018-08-07 华为技术有限公司 连接建立方法、设备及系统
US20180352483A1 (en) * 2017-04-19 2018-12-06 Lg Electronics Inc. Method for pdu session establishment procedure and amf node

Family Cites Families (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10116691B2 (en) * 2004-11-23 2018-10-30 Kodiak Networks, Inc. VoIP denial-of-service protection mechanisms from attack
CN101052044B (zh) * 2007-05-18 2010-04-21 华为技术有限公司 一种ims中iptv流媒体业务实现方法、网络设备及终端设备
KR101585936B1 (ko) * 2011-11-22 2016-01-18 한국전자통신연구원 가상 사설 망 관리 시스템 및 그 방법
US20160021530A1 (en) * 2014-07-18 2016-01-21 Google Technology Holdings LLC Method and Apparatus for Selectively Granting or Denying Mobile Applications Access to Cellular Networks
JP6564022B2 (ja) * 2014-08-28 2019-08-21 ノキア ソリューションズ アンド ネットワークス オサケ ユキチュアＮｏｋｉａ Ｓｏｌｕｔｉｏｎｓ ａｎｄ Ｎｅｔｗｏｒｋｓ Ｏｙ 異種ネットワークに対して有効なユーザ機器識別情報
CN106304056A (zh) * 2015-05-19 2017-01-04 中兴通讯股份有限公司 一种设备标识的检查方法及系统、设备
EP3151599A1 (en) * 2015-09-30 2017-04-05 Apple Inc. Authentication failure handling for cellular network access through wlan
CN112702180B (zh) * 2016-10-31 2022-05-17 华为技术有限公司 一种策略控制方法、装置及系统
US10321503B2 (en) * 2016-12-11 2019-06-11 Motorola Mobility Llc Method and apparatus for attaching a remote unit to a mobile core network via a standalone untrusted non-3GPP access network
US20190007500A1 (en) * 2017-07-03 2019-01-03 Electronics And Telecommunications Research Institute Method for protocol data unit (pdu) session anchor relocation and 5g network registration
WO2019032968A1 (en) * 2017-08-11 2019-02-14 Convida Wireless, Llc ANALYSIS OF NETWORK DATA IN A COMMUNICATION NETWORK
EP3721674B1 (en) * 2017-12-04 2022-07-13 Telefonaktiebolaget LM Ericsson (publ) Method, computer program, carrier containing the computer program and wireless device for supporting multiple access networks
WO2019135560A1 (ko) * 2018-01-04 2019-07-11 엘지전자 주식회사 Pdu 세션 수립 절차를 수행하는 방법, 사용자 장치 및 네트워크 노드
KR20200077259A (ko) * 2018-12-20 2020-06-30 삼성전자주식회사 네트워크 연결 방법 및 장치

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103516739A (zh) * 2012-06-21 2014-01-15 中兴通讯股份有限公司 Sta的剔除方法及装置
CN105991515A (zh) * 2015-01-28 2016-10-05 普天信息技术有限公司 一种通信系统业务隔离的实现方法、终端及基站
CN108377493A (zh) * 2016-11-21 2018-08-07 华为技术有限公司 连接建立方法、设备及系统
US20180352483A1 (en) * 2017-04-19 2018-12-06 Lg Electronics Inc. Method for pdu session establishment procedure and amf node

Non-Patent Citations (3)

* Cited by examiner, † Cited by third party
Title
3GPP TR23.734
3GPP: "Study on Security for 5GS Enhanced Support of Vertical and LAN Services (Release 16)", 3GPP TR 33.819 V0.3.0, 1 April 2019 (2019-04-01), XP051723259 *
See also references of EP3893536A4

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114390523A (zh) * 2020-10-15 2022-04-22 联发科技股份有限公司 增强ue对禁止的snpn列表的处理的方法及用户设备

Also Published As

Publication number Publication date
CN111465018B (zh) 2021-12-31
CN111465018A (zh) 2020-07-28
EP3893536A4 (en) 2022-02-23
EP3893536A1 (en) 2021-10-13
US20210344680A1 (en) 2021-11-04

Similar Documents

Publication Publication Date Title
WO2020151696A1 (zh) 一种增强跨网络访问安全的方法、设备及系统
US11026080B2 (en) Policy control function determining method, apparatus, and system
KR102224248B1 (ko) 통신 시스템에서 PDU(Protocol Data Unit) 세션을 설립하는 방법
US11483878B2 (en) Session establishment method and system, and device
RU2727184C1 (ru) Способ обработки процедуры установления сеанса связи pdu и узел amf
WO2017200264A1 (en) Roaming support for next generation slice architecture
US11457334B2 (en) Context management method and apparatus
US20200296142A1 (en) User Group Establishment Method and Apparatus
CN107615732B (zh) 将会话接纳至虚拟网络中的方法和移动性管理功能实体
US20230072956A1 (en) Slice access method, apparatus, and system
WO2020224622A1 (zh) 一种信息配置方法及装置
CN112584486B (zh) 一种通信方法及装置
WO2020177523A1 (zh) 终端设备的注册方法及装置
WO2021012736A1 (zh) 一种会话管理网元的选择方法、装置及系统
JP7043631B2 (ja) Ｓｓｃモードを決定するための方法および装置
US20230164523A1 (en) Communication Method, Device, and System
WO2019024744A1 (zh) 获取终端设备的身份标识的方法及装置
US20230269794A1 (en) Local network accessing method and apparatus
CN111757312A (zh) 一种会话的处理方法及装置
CN115244991B (zh) 通信方法、装置及系统
KR102318746B1 (ko) 가상 id를 이용하여 복수의 pdu 세션들을 처리하는 방법 및 상기 방법을 수행하는 smf
US20240073745A1 (en) Systems and methods for network-based slice access authorization
WO2023220998A1 (zh) 无线通信的方法、用户设备及网络设备
WO2022237516A1 (zh) 一种无线通信方法及通信装置
WO2023213181A1 (zh) 一种通信方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20745507

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2020745507

Country of ref document: EP

Effective date: 20210705

NENP Non-entry into the national phase

Ref country code: DE