WO2021004444A1 - 一种通信方法以及网元 - Google Patents

一种通信方法以及网元 Download PDF

Info

Publication number
WO2021004444A1
WO2021004444A1 PCT/CN2020/100555 CN2020100555W WO2021004444A1 WO 2021004444 A1 WO2021004444 A1 WO 2021004444A1 CN 2020100555 W CN2020100555 W CN 2020100555W WO 2021004444 A1 WO2021004444 A1 WO 2021004444A1
Authority
WO
WIPO (PCT)
Prior art keywords
network element
authentication
network slice
slice
target
Prior art date
Application number
PCT/CN2020/100555
Other languages
English (en)
French (fr)
Inventor
朱方园
李岩
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to JP2022500876A priority Critical patent/JP2022540445A/ja
Priority to EP20836463.8A priority patent/EP3989621A4/en
Publication of WO2021004444A1 publication Critical patent/WO2021004444A1/zh
Priority to US17/571,527 priority patent/US20220132311A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W24/00—Supervisory, monitoring or testing arrangements
    • H04W24/02—Arrangements for optimising operational condition
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
    • H04W84/04—Large scale networks; Deep hierarchical networks
    • H04W84/042—Public Land Mobile systems, e.g. cellular systems

Definitions

  • This application relates to the field of communication technology, and specifically to a communication method.
  • the 5th Generation mobile communication technology (5G) system architecture not only supports the wireless technology defined by the 3GPP standard group to access the core network side, but also supports non-3GPP access technology through the non-3GPP interworking function (non-3GPP interworking). function, N3IWF) or next generation packet data gateway (ngPDG) or fixed network access gateway or trusted non-3GPP access gateway to access the core network side.
  • non-3GPP interworking function, N3IWF
  • ngPDG next generation packet data gateway
  • ngPDG fixed network access gateway or trusted non-3GPP access gateway
  • 5G network slicing technology provides isolated network environments for different application scenarios by virtual independent logical networks on the same network infrastructure, so that different application scenarios can customize network functions and features according to their own needs, and can effectively guarantee different services. QoS requirements.
  • the terminal device may need to perform authentication at the granularity of the network slice in addition to the permanent identification of the main authentication process And authorization process.
  • PLMN public land mobile networks
  • the core network element must repeat the authentication and authorization process at the network slice granularity for the network slice. Rights and authorization procedures, leading to waste of signaling between the terminal equipment and the core network side.
  • the embodiment of the present application provides a method to avoid repeated initiation of the network slice authentication process for the same S-NSSAI, which leads to waste of signaling between the terminal device and the core network side.
  • the first aspect of this application provides a communication method, which can be applied to enhanced mobile broadband (eMBB) scenarios, massive machine type communication (mMTC) scenarios, and low-latency, ultra-reliable communications ( Ultra reliable and low latency communication (uRLLC) scenario. It may include: the first network element obtains the first authentication status of the target network slice of the first terminal device from the data management network element, the first authentication status indicates the first authentication result of the target network slice, or the first authentication status Indicates that the target network slice has not performed the authentication process. The first network element determines whether to perform the first authentication process on the target network slice according to the first authentication status.
  • eMBB enhanced mobile broadband
  • mMTC massive machine type communication
  • uRLLC Ultra reliable and low latency communication
  • the first network element determines whether to perform the first authentication process on the target network slice according to the first authentication status, avoiding repeated initiation of the network slice authentication process for the same S-NSSAI, which will cause the terminal device to follow the core The signaling on the network side is wasted.
  • the first network element determines whether to perform the first authentication process on the target network slice according to the first authentication state, which may include: the first network element When the first authentication result of the target network slice is determined according to the first authentication status, the first network element does not perform an authentication process on the target network slice. Or when the first network element determines that the target network slice has not performed the authentication process according to the first authentication status, the first network element performs the first authentication process on the target network slice.
  • the first network element determines that the first authentication result of the target network slice can be determined according to the first authentication status
  • the first authentication process is no longer executed to avoid targeting the same S -NSSAI repeatedly initiates the network slicing authentication process, resulting in waste of signaling between the terminal equipment and the core network side.
  • the method may further include: the first network element performs a first operation on the target network slice according to the first authentication state. After the authentication process, the method may further include: the first network element notifies the data management network element of the second authentication status of the target network slice, and the second authentication status indicates the second authentication result corresponding to the first authentication process.
  • the first network element if the first network element performs the first authentication process on the target network slice, the first network element notifies the data management network element of the authentication result corresponding to the first authentication process
  • the data management network element that is, the second authentication result mentioned above, to avoid repeated initiation of the network for the same S-NSSAI Slice authentication process.
  • the method may further include: the first network element performs a first operation on the target network slice according to the first authentication state. After the authentication process, the method may further include: the first network element notifies the data management network element of the effective time of the second authentication state of the target network slice.
  • the authentication state can correspond to the effective time, so that the validity of the authentication state can be flexibly controlled, and the diversity of the scheme is increased.
  • the method may further include: the first network element learns that the first terminal device requests to access the target network slice.
  • the first network element determines not to perform the first authentication process on the target network slice according to the first authentication state, and Including: if the first network element determines that the first authentication result of the target network slice is successful according to the first authentication status, the first network element does not perform the first authentication process on the target network slice and determines that the first terminal device is allowed to access Into the target network slice. Or if the first network element determines that the first authentication result of the target network slice is a failure according to the first authentication status, the first network element does not perform the first authentication process on the target network slice and determines that the first terminal device is not allowed to access Into the target network slice.
  • the first network element obtains the target network slice of the first terminal device from the data management network element.
  • the first authentication state may include: the first network element requests subscription data from the data management network element.
  • the first network element receives the subscription data sent by the data management network element and the first authentication state of the target network slice.
  • the first network element is a mobility management network element, a specific method for the first network element to obtain the first authentication status from the data management network element is given .
  • the first network element obtains the target network slice of the first terminal device from the data management network element.
  • the first authentication status may include: the first network element sends a request message to the data management network element, and the request message is used to query the first authentication status of the target network slice.
  • the first network element receives a response message sent by the data management network element, and the response message indicates the first authentication status of the target network slice.
  • a specific method for the first network element to obtain the first authentication status from the data management network element is given .
  • the method may further include: the authentication server network element receives a first message sent by the first mobility management network element, where the first message is used for Request to perform the first authentication process.
  • the first network element determining not to perform the first authentication process on the target network slice according to the first authentication state may include : If the first network element determines that the first authentication result of the target network slice is successful or failed according to the first authentication status, the first network element determines not to perform the first authentication process on the target network slice and to the first mobility management The network element sends the first authentication result of the target network slice.
  • the first network element obtains the target network slice of the first terminal device from the data management network element
  • the first authentication status may include: the first network element sends a request message to the data management network element, and the request message is used to query the first authentication status of the target network slice.
  • the first network element receives a response message sent by the data management network element, and the response message indicates the first authentication status of the target network slice.
  • the first network element is an authentication server network element, a specific way for the first network element to obtain the first authentication status from the data management network element is given.
  • the authentication server network element when the first network element performs the first authentication procedure on the target network slice, the authentication server network element receives A second message sent by the second mobility management network element, where the second message is used to request the target network slice of the first terminal device to perform the second authentication process.
  • the authentication server network element sends instruction information to the second mobility management network element, where the instruction information is used to indicate that the second authentication process is suspended.
  • the method may include: the authentication server network element sends the second authentication result of the target network slice to the second mobility management network element.
  • the authentication server network element determines whether the second authentication process is for the same S-NSSAI, and if it is, one of the network slice authentication processes is suspended.
  • the up state that is, the suspension of the second authentication process, can prevent different mobility management network elements from repeatedly initiating the network slice authentication process for the same S-NSSAI, resulting in waste of signaling between the terminal equipment and the core network side.
  • a second aspect of the present application provides a communication method, which may include: a data management network element learning a first authentication status of a target network slice of a first terminal device, the first authentication status indicating a first authentication result of the target network slice, Or the first authentication status indicates that the target network slice has not performed the authentication process.
  • the data management network element sends the first authentication status to the first network element. It can be seen from the first aspect that the data management network element can send the authentication status of the target network slice to the first network element, and the first network element can determine whether to perform the first authentication process on the target network slice according to the first authentication status. , To avoid repeated initiation of the network slice authentication process for the same S-NSSAI, resulting in waste of signaling between the terminal equipment and the core network side.
  • the data management network element learns the target network slice of the first terminal device
  • the first authentication state may include: the data management network element receives the first authentication state sent by the second network element, and the second network element is when the first terminal device accesses the target network slice through the first public land mobile network PLMN,
  • the first authentication state is the first authentication result corresponding to the third authentication process performed by the second network element on the target network slice.
  • the data management network element learns the target network slice of the first terminal device
  • the first authentication status may include: the data management network element receives the first authentication status sent by the third network element, and the first authentication status is the first authentication process corresponding to the third authentication process performed by the third network element on the target network slice.
  • the first network element and the third network element are authentication server network elements located in the home public land mobile network HPLMN.
  • the first network element is the first terminal device through the second
  • the method may further include: data management network The element receives the request message sent by the first network element, and the request message is used to query the first authentication status of the target network slice.
  • the data management network element sending the first authentication status to the first network element may include: the data management network element sending a response message to the first network element, the response message indicating the first authentication status of the target network slice.
  • the first network element is the first terminal device through the second
  • the method may further include: the data management network element receives a request message sent by the first network element, the request message Used to request contract data.
  • the data management network element sending the first authentication status to the first network element may include: the data management network element sending the subscription data and the first authentication status of the target network slice to the first network element.
  • the fifth possible implementation manner may further include: the data management network element receiving the first to the target network slice The valid time of the authentication status.
  • a third aspect of the present application provides a communication method, which may include: a fourth network element receives a first authentication request message sent by a first network element, and the first authentication request message is used to request the fourth network element to contact the first terminal device
  • the accessed first network slice executes the first authentication process.
  • the fourth network element receives a second authentication request message sent by the second network element, and the second authentication request message is used to request the fourth network element to access the first terminal device.
  • the network slicing executes the second authentication process.
  • the fourth network element sends instruction information to the second network element, where the instruction information is used to indicate that the second authentication process is suspended.
  • the fourth network element obtains the first authentication result of the first authentication process, and sends the first authentication result of the first authentication process to the second network element. Use the fourth network element to determine whether the second authentication process is for the same S-NSSAI. If so, put one of the network slice authentication processes in a suspended state, that is, the second authentication process is suspended. Avoid repeated initiation of the network slice authentication process for the same S-NSSAI, resulting in waste of signaling between the terminal device and the core network side.
  • the fourth network element is an authentication server network element
  • the first network element is a first mobility management network element located in the first PLMN
  • the first The second network element is a second mobility management network element located in the second PLMN.
  • the fourth network element is an authentication, authorization, and accounting server
  • the first network element and the second network element are authentication server networks located in HPLMN yuan.
  • a fourth aspect of the present application provides a first network element, which may include: a transceiving unit, configured to obtain a first authentication status of a target network slice of a first terminal device from a data management network element, the first authentication status indicating the target network The first authentication result of the slice or the first authentication status indicates that the target network slice has not performed the authentication process.
  • the processing unit which is coupled with the transceiver unit, is configured to determine whether to perform the first authentication process on the target network slice according to the first authentication state obtained by the transceiver unit.
  • the processing unit is specifically configured to: when determining the first authentication result of the target network slice according to the first authentication state obtained by the transceiver unit, Network slicing does not perform the authentication process. Or when it is determined according to the first authentication state obtained by the transceiver unit that the target network slice has not performed the authentication process, the first network element performs the first authentication process on the target network slice.
  • the transceiver unit is further configured to notify the data management network element of the second authentication status of the target network slice, and the second The authentication status indicates the second authentication result corresponding to the first authentication process.
  • the transceiver unit is also used to notify the data management network element of the effective time of the second authentication state of the target network slice .
  • the transceiver unit when the first network element is a mobility management network element, the transceiver unit: Before obtaining the first authentication state of the target network slice of the first terminal device from the data management network element, it is also used to learn that the first terminal device requests to access the target network slice.
  • the processing unit is specifically configured to: if the target network slice is determined according to the first authentication status obtained by the transceiver unit When the first authentication result is successful, the first authentication procedure is not performed on the target network slice and it is determined that the first terminal device is allowed to access the target network slice. Or if it is determined that the first authentication result of the target network slice is failed according to the first authentication status obtained by the transceiver unit, the first authentication process is not performed on the target network slice and it is determined that the first terminal device is not allowed to access the target network slice .
  • the transceiver unit is specifically configured to learn the registration request of the first terminal device. According to the registration request, the data management network element is requested to send subscription data. Receive the subscription data sent by the data management network element and the first authentication state of the target network slice.
  • the transceiver unit is specifically configured to: request subscription data from the data management network element, and receive data management A response message sent by the network element, the response message indicating the first authentication status of the target network slice.
  • the transceiver unit Before the data management network element obtains the first authentication status of the target network slice of the first terminal device, it is also used to receive a first message sent by the first mobility management network element, where the first message is used to request execution of the first authentication process .
  • the processing unit is specifically configured to determine the first authentication result of the target network slice according to the first authentication state When it is a success or a failure, it is determined not to perform the first authentication process on the target network slice, and the first authentication result of the target network slice is sent to the first mobility management network element.
  • the transceiver unit is specifically configured to: send a request message to the data management network element, and the request message is used To query the first authentication status of the target network slice. Receive a response message sent by the data management network element, where the response message indicates the first authentication status of the target network slice.
  • the transceiver unit is further configured to receive when the processing unit performs the first authentication procedure on the target network slice A second message sent by the second mobility management network element, where the second message is used to request the target network slice of the first terminal device to perform the second authentication process.
  • the transceiver unit is further configured to send instruction information to the second mobility management network element, where the instruction information is used to indicate that the second authentication process is suspended.
  • the transceiver unit is further configured to, after obtaining the second authentication result of the target network slice, send the second authentication result of the target network slice to the second mobility management network element.
  • a fifth aspect of the present application provides a data management network element, which may include: a transceiver unit, configured to learn a first authentication status of a target network slice of a first terminal device, and the first authentication status indicates a first authentication status of the target network slice. The authentication result, or the first authentication status indicates that the target network slice has not performed the authentication process.
  • the transceiver unit is also used to send the first authentication status to the first network element.
  • the transceiver unit is specifically configured to receive the first authentication status sent by the second network element, and the second network element is the first terminal device passing the first authentication status.
  • the third mobility management network element that provides services for the first terminal device, the first authentication state is the third authentication process performed by the third network element on the target network slice The corresponding first authentication result.
  • the transceiver unit is specifically configured to receive the first authentication status sent by the third network element, and the third network element is the first terminal device passing the first authentication status.
  • the authentication server network element that provides services for the first terminal device the first authentication state is the first authentication process corresponding to the third authentication process performed by the third network element on the target network slice
  • the first network element and the third network element are authentication server network elements located in the home public land mobile network HPLMN.
  • the first network element is the first terminal device through the second
  • the transceiver unit is further configured to: receive The request message sent by the first network element is used to query the first authentication status of the target network slice.
  • the transceiver unit is specifically configured to send a response message to the first network element, where the response message indicates the first authentication status of the target network slice.
  • the first network element is the first terminal device passing through the second
  • the transceiver unit is also used to receive a request message sent by the first network element, and the request message is used to request Contract data.
  • the transceiver unit is specifically configured to send the subscription data and the first authentication state of the target network slice to the first network element.
  • the transceiver unit is further configured to receive the first authentication of the target network slice The effective time of the state.
  • a sixth aspect of the present application provides a fourth network element, which may include: a transceiver unit, configured to receive a first authentication request message sent by a first network element, and the first authentication request message is used to request a third network element to The first network slice accessed by a terminal device executes the first authentication process. Before the end of the first authentication process, the transceiver unit is also used to receive a second authentication request message sent by the second network element, and the second authentication request message is used to request the third network element to access the first terminal device. The first network slice executes the second authentication process. The transceiver unit is also used to send instruction information to the second network element, where the instruction information is used to indicate that the second authentication process is suspended. The transceiver unit is also used to obtain the first authentication result of the first authentication process, and send the first authentication result of the first authentication process to the second network element.
  • a transceiver unit configured to receive a first authentication request message sent by a first network element, and the first authentication request message is used to request a third
  • the fourth network element is an authentication server network element
  • the first network element is a first mobility management network element located in the first PLMN
  • the first The second network element is a second mobility management network element located in the second PLMN.
  • the fourth network element is an authentication, authorization, and accounting server
  • the first network element and the second network element are authentication server networks located in HPLMN yuan.
  • the seventh aspect of the present application provides a computer-readable storage medium that stores instructions in the computer-readable storage medium, and when it runs on a computer, the computer can execute the first aspect or any possible implementation of the first aspect. Communication method.
  • the eighth aspect of the present application provides a computer-readable storage medium that stores instructions in the computer-readable storage medium, and when it runs on a computer, the computer can execute the second aspect or any possible implementation of the second aspect. Communication method.
  • a ninth aspect of the present application provides a computer-readable storage medium that stores instructions in the computer-readable storage medium, and when it runs on a computer, the computer can execute the third aspect or any possible implementation of the third aspect. Communication method.
  • the tenth aspect of the present application provides a computer program product containing instructions, which when running on a computer, enables the computer to execute the communication method of the first aspect or any one of the possible implementation manners of the first aspect.
  • the eleventh aspect of the present application provides a computer program product containing instructions, which when run on a computer, enables the computer to execute the communication method of the second aspect or any one of the possible implementation manners of the second aspect.
  • the twelfth aspect of the present application provides a computer program product containing instructions, which when running on a computer, enables the computer to execute the communication method of the third aspect or any one of the possible implementation manners of the third aspect.
  • the technical effects brought by any one of the fifth aspect, eighth aspect, eleventh aspect, and tenth aspect can refer to the technical effects brought about by different implementation manners in the second aspect, which will not be here Repeat.
  • a thirteenth aspect of the present application provides a system, which may include: a first network element and a data management network element, where the first network element is the first aspect described in the first aspect or any one of the possible implementations of the first aspect.
  • the network element, the data management network element is the data management network element described in the second aspect or any one of the possible implementation manners of the second aspect.
  • a fourteenth aspect of the present application provides a system, which may include: a fourth network element, a first network element, and a data management network element, where the first network element is the foregoing first aspect or any possible implementation manner of the first aspect
  • the first network element described in, the data management network element is the data management network element described in the second aspect or any one of the possible implementations of the second aspect
  • the fourth network element is any of the third aspect or the third aspect.
  • a fifteenth aspect of the present application provides a system, which may include: a first network element and a fourth network element, where the first network element is the first aspect described in the first aspect or any one of the possible implementations of the first aspect.
  • Network element, the fourth network element is the fourth network element described in the foregoing third aspect or any one of the possible implementation manners of the third aspect.
  • the first network element determines whether to perform the first authentication process on the target network slice according to the first authentication state, avoiding repeated initiation of the network slice authentication process for the same S-NSSAI, which will cause the terminal device to follow the core The signaling on the network side is wasted.
  • FIG. 1 is a schematic diagram of a system architecture provided by an embodiment of the application
  • Figure 2 is a schematic diagram of repeated authentication of the same S-NSSAI in different PLMN scenarios
  • FIG. 3 is a schematic flowchart of a communication method 300 provided by this application.
  • FIG. 4 is a schematic flowchart of a communication method 400 provided by this application.
  • FIG. 5 is a schematic flowchart of a communication method 500 provided by this application.
  • Figure 6 is a schematic diagram of a scenario provided by this application.
  • FIG. 7 is a schematic flowchart of a communication method 700 provided by this application.
  • FIG. 8 is a schematic flowchart of a communication method 800 provided by this application.
  • Figure 9 is a schematic diagram of another scenario provided by this application.
  • FIG. 10 is a schematic diagram of the hardware structure of a communication device provided by an embodiment of the application.
  • FIG. 11 is a schematic diagram of the structure of a first network element provided by an embodiment of this application.
  • FIG. 12 is a schematic diagram of the structure of an AMF network element provided by an embodiment of the application.
  • FIG. 13 is a schematic diagram of the structure of a UDM network element provided by an embodiment of the application.
  • FIG. 14 is a schematic diagram of the structure of an AUSF network element provided by an embodiment of this application.
  • FIG. 15 is a schematic diagram of the structure of AAA-S provided by an embodiment of the application.
  • the embodiments of the application provide a communication method, network element, and storage medium.
  • a first terminal device accesses a target network slice through a first public land mobile network (PLMN)
  • the first network element manages according to user data
  • the authentication status sent by the function User Data Management, UDM
  • UDM User Data Management
  • UDM can determine the authentication result of the target network slice, the authentication result of the target network slice is no longer repeated, and the authentication result is that the first terminal device is connected through the second PLMN.
  • UDM User Data Management
  • the first network element determines that the target network slice has not performed the authentication process according to the authentication status sent by the UDM network element, the first network element pairs After the target network slice is authenticated, the UDM network element is notified of the authentication status of the target network slice, so as to prevent different core network elements from repeatedly initiating the network slice authentication process for the same target network slice, which will cause the terminal device to follow the core network side Signaling waste. Detailed descriptions are given below.
  • the naming or numbering of steps appearing in this application does not mean that the steps in the method flow must be executed in the time/logical order indicated by the naming or numbering.
  • the named or numbered process steps can be implemented according to the The technical purpose changes the execution order, as long as the same or similar technical effects can be achieved.
  • the division of modules presented in this application is a logical division. In actual applications, there may be other divisions. For example, multiple modules can be combined or integrated in another system, or some features can be ignored , Or not to execute, in addition, the displayed or discussed mutual coupling or direct coupling or communication connection may be through some ports, and the indirect coupling or communication connection between modules may be electrical or other similar forms. There are no restrictions in the application.
  • the modules or sub-modules described as separate components may or may not be physically separate, may or may not be physical modules, or may be distributed to multiple circuit modules, and some or all of them may be selected according to actual needs Module to achieve the purpose of this application program.
  • FIG. 1 is a schematic diagram of a system architecture provided by an embodiment of this application.
  • Fig. 1 exemplarily shows a schematic diagram of a system architecture provided by the present application.
  • the system architecture includes mobility management network elements, session management network elements, policy control network elements, authentication service network elements, data management network elements, and user plane network elements.
  • the communication system architecture also includes access network equipment, terminal equipment (user equipment, UE), and data network element (data network, DN).
  • the terminal device can be connected to the mobility management network element, the access network device can also be connected to the mobility management network element, the access network device can also be connected to the user plane network element, and the user plane network element can be connected to the session management network element, Data network connection, mobility management network element can be connected to session management network element, data management network element, policy control network element and authentication service network element respectively, session management network element is connected to policy control network element and data management network element respectively. Both the mobility management network element and the session management network element can obtain data from the data management network element, such as user subscription data, and both the mobility management network element and the session management network element can obtain policy data from the policy control network element.
  • the policy control network element obtains the user subscription data from the data management network element and sends it to the mobility management network element and the session management network element, and then the mobility management network element and the session management network element deliver it to the access network equipment and terminal Equipment and user plane network elements, etc.
  • the mobility management network element is mainly used for the registration, mobility management, and tracking area update procedures of terminal devices in the mobile network.
  • the mobility management network element terminates non-access stratum (NAS) messages, completes registration management, connection management, and reachability management, assigns track area list (TA list), and mobility management, etc., And transparently route session management (SM) messages to the session management network element.
  • the mobility management network element may be a (Mobility Management Entity, MME) mobility management entity.
  • MME Mobility Management Entity
  • mobility management network elements can be core network access and mobility management function access and mobility management function, AMF network elements.
  • communication will be like the 6th generation (6th generation).
  • 6G) communications the mobility management network element can still be an AMF network element, or a network element with other names that supports the mobility management function, which is not limited in this application.
  • the session management network element is mainly used for session management in the mobile network, such as session creation, modification, and release. Specific functions include, for example, allocating internet protocol (IP) addresses for users, selecting user plane network elements that provide message forwarding functions, and so on.
  • the session management network element may be the control plane function (control plane of PGW) of the (Packet Data Network GateWay, PGW) packet data network gateway.
  • the session management network element can be a session management function (session management function, SMF) network element.
  • SMF session management function
  • the session management network element can still be an SMF network element or other supporting session management function
  • the name of the network element is not limited in this application.
  • the policy control network element includes user subscription data management functions, policy control functions, charging policy control functions, quality of service (QoS) control, etc.
  • the policy control network element may be (policy and charging rules function, PCRF) policy and charging rules function.
  • the policy control network element can be a policy control function (PCF) network element.
  • PCF policy control function
  • future communications such as 6G, the policy control network element can still be a PCF network element, or other names that support the policy control function
  • the network element of this application is not limited.
  • the authentication server network element is mainly used to verify service functions and store keys using an extensible authentication protocol (EAP) to realize user authentication and authentication.
  • the authentication server may be (authentication, authorization, accounting server, AAA Server) authentication, authorization and accounting server.
  • the authentication server network element can be an authentication server function (authentication server function, AUSF) network element.
  • the authentication server network element can still be an AUSF network element or another name that supports the authentication function Network element, this application is not limited.
  • the data management network element is mainly used to store user data, such as contract information, authentication/authorization information.
  • the data management network element can be the (Home Subscriber Server, HSS) home user server.
  • the data management network element can be a unified data management (UDM) network element.
  • UDM unified data management
  • the data management network element can still be a UDM network element, or a network element of another name that supports the data management function, which is not limited in this application.
  • User plane network elements are mainly used for user plane service processing, such as service routing, packet forwarding, anchoring functions, quality of service (QoS) mapping and execution, uplink identification and routing to the data network, Downlink packet buffer and downlink data arrival notification trigger, connection with external data network, etc.
  • the user plane network element may be the user plane function (user plane of PGW) of the (Packet Data Network GateWay, PGW) packet data network gateway.
  • the user plane network element can be a user plane function (UPF) network element.
  • UPF user plane function
  • future communications such as 6G
  • the user plane network element can still be a UPF network element, or other names that support user plane functions
  • the network element of this application is not limited.
  • Access network equipment which may also be referred to as radio access network (RAN) equipment, is a type of equipment that provides wireless communication functions for terminal equipment.
  • Access network equipment includes, but is not limited to: next-generation base stations (gnodeB, gNB) in 5G, evolved node B (evolved node B, eNB), radio network controller (RNC), node B (node B) B, NB), base station controller (BSC), base transceiver station (base transceiver station, BTS), home base station (for example, home evolved nodeB, or home node B, HNB), baseband unit (baseBand unit, BBU), transmission point (transmitting and receiving point, TRP), transmission point (transmitting point, TP), mobile switching center, etc.
  • next-generation base stations evolved node B, eNB
  • RNC radio network controller
  • node B node B
  • BSC base station controller
  • BTS base transceiver station
  • home base station for example, home evolved node
  • UE User equipment
  • UE is a device with wireless transceiver function. It can be deployed on land, including indoor or outdoor, handheld or vehicle-mounted; it can also be deployed on the water (such as ships); it can also be deployed on In the air (such as airplanes, balloons, satellites, etc.).
  • the terminal device can be a mobile phone (mobile phone), a tablet computer (pad), a computer with wireless transceiver function, a virtual reality (VR) terminal, an augmented reality (AR) terminal, and an industrial control (industrial control)
  • DN Network Data Network
  • operators services such as operator services, Internet access services, and third-party services.
  • third-party services such as operator services, Internet access services, and third-party services.
  • the core network serves as a bearer network to provide an interface to the DN, providing terminal equipment with communication connections, authentication, management, communication, and carrying data services.
  • core network functions are divided into user plane functions and control plane functions.
  • the user plane function is mainly responsible for packet data packet forwarding and QoS control.
  • the control plane function is mainly responsible for user registration and authentication, mobility management, and issuing data packet forwarding strategies or QoS control strategies to the user plane function (UPF).
  • the control plane function mainly includes access and mobility management function (core access and mobility management function, AMF) network elements and session management function (session management function, SMF) network elements, etc.
  • AMF access and mobility management function
  • SMF session management function
  • the AMF network element is responsible for the registration process during user access, location management during user movement, and paging of terminal equipment.
  • the SMF network element is responsible for establishing a corresponding session connection on the core network side when a user initiates a service, and providing specific services for the user.
  • network elements or functions may be network elements in hardware devices, software functions running on dedicated hardware, or virtualization functions instantiated on a platform (for example, a cloud platform).
  • the above-mentioned network elements or functions can be divided into one or more services, and further, there may be services independent of the network functions.
  • an instance of the above-mentioned function, or an instance of a service included in the above-mentioned function, or an instance of a service that exists independently of the network function may be referred to as a service instance.
  • the interfaces and connections in the system architecture may include: N1, N2, N3, N4, N5, N6, N7, N8, N10, N11, N12, N15, N22.
  • N1 is the control plane connection between the terminal equipment and the AMF network element, which is used to transmit control signaling between the user equipment and the core network control plane.
  • the messages in the specific N1 connection can be transferred between the terminal equipment and the RAN.
  • Connection N2 connection between RAN and AMF network elements for transmission.
  • N2 is the control plane connection between the RAN and AMF network elements.
  • N3 is the connection between the RAN and the user plane function.
  • N4 is the connection between the SMF network element and the user plane function, and is used to transfer control signaling between the SMF network element and the user plane function.
  • N5 is the connection between PCF and AF
  • N6 is the connection between user plane function and DN
  • N7 is the connection between SMF network element and PCF
  • N8 is the connection between AMF network element and UDM network element
  • N10 is The connection between UDM network element and SMF network element
  • N11 is the connection between AMF network element and SMF network element
  • N12 is the connection between AUSF network element and AMF network element
  • the current 5G application scenarios include enhanced mobile broadband (eMBB), massive machine type communication (mMTC), and low-latency, ultra-reliable communication (Ultra reliable and low latency communication, uRLLC).
  • eMBB enhanced mobile broadband
  • mMTC massive machine type communication
  • uRLLC ultra-reliable communication
  • the eMBB scene is mainly for 4K/8K ultra-high-definition video, holographic technology, augmented reality/virtual reality and other applications.
  • the main demand for mobile broadband is higher data capacity.
  • the peak Internet speed of smart terminal users must reach 10Gbit/s or even 20Gbit/s, which enables large-bandwidth applications such as virtual reality, ubiquitous live video streaming and sharing, and cloud access anytime, anywhere.
  • mMTC scenarios are applied to massive sensors deployed in measurement, construction, agriculture, logistics, smart cities, homes and other fields. These sensor devices are very dense and most of them are static. 5G networks are required to support large-scale connections and connections between people and things. The number reaches 1 million per square kilometer.
  • uRLLC scenarios are mainly used in fields such as unmanned driving, automatic factories, and smart grids.
  • the main requirements are ultra-low latency and high reliability.
  • the 5G network is required to have a latency of 1 millisecond to enable applications in vertical industries, such as low latency services such as smart manufacturing, remote mechanical control, assisted driving, and autonomous driving.
  • Network slicing is to cut a physical network into multiple virtual end-to-end networks.
  • Each virtual network including the equipment, access, transmission and core network in the network, is logically independent, and any virtual network fails. Will not affect other virtual networks.
  • Each virtual network has different functions and characteristics, and faces different needs and services.
  • the terminal device can provide the requested network slice selection assistance information (requested network slice selection assistance information, requested NSSAI) to the core network for the core network to select AMF network elements for the terminal device And network slicing examples.
  • the single network slice selection assistance information (S-NSSAI) is used to identify a network slice.
  • the network comprehensively judges based on the terminal device’s contract data, roaming agreement, local configuration and other information, and returns the network slice selection assistance information (Allowed network slice selection assistance information, Allowed NSSAI) allowed by the current network. This value is sent to the terminal device together with the registration acceptance message, and is used to carry it to the core network when the terminal device initiates a service request.
  • the allowed NSSAI delivery process can update the Allowed NSSAI stored locally on the terminal device through the configuration update process triggered by the network.
  • a terminal device When a terminal device is registered in the network, in addition to performing the main authentication process of the permanent identification of the terminal device, it may also determine whether it is necessary to check a certain S in the Requested NSSAI according to the Requested NSSAI requested by the terminal device and the subscription data of the terminal device.
  • -NSSAI executes a network slice specific authentication and authorization process (network slice specific authentication and authorization), which can also be simply referred to as the second authentication process of network slicing, or the second authentication process for short.
  • the terminal device when the terminal device carries the first Requested NSSAI and registers with the first PLMN through the first access technology (for example, 3GPP access type), the first AMF network element in the first PLMN serves the terminal device , And send Allowed NSSAI (Allowed NSSAI for 3GPP access type) suitable for 3GPP access technology to the terminal device.
  • Allowed NSSAI for 3GPP access type means that each S-NSSAI in the Allowed NSSAI of the terminal device is only allowed to be used under 3GPP access type.
  • the terminal device finds that there is another PLMN at its current location, in order to distinguish it from the first PLMN, the other PLMN is called the second PLMN here.
  • the terminal device carries the second Requested NSSAI and passes the second access technology (for example, non-3GPP access). type)
  • the registration process is initiated.
  • the second AMF network element in the second PLMN serves the terminal device and sends to the terminal device Allowed NSSAI (Allowed NSSAI for non-3GPP access type), Allowed for non-3GPP access technology NSSAI for non-3GPP access type indicates that each S-NSSAI in the Allowed NSSAI of the terminal device is only allowed to be used under non-3GPP access type.
  • Allowed NSSAI for 3GPP access type and Allowed NSSAI for non-3GPP access type contain the same S-NSSAI, this means that the S-NSSAI can be used under 3GPP access type and also under non-3GPP access type. .
  • FIG. 2 it is a schematic diagram of repeated authentication of the same S-NSSAI requesting access to the same terminal device in different PLMN scenarios.
  • the terminal device is connected through different access technologies.
  • the core network of different PLMNs for example, one can access the core network side of the first PLMN through the wireless technology defined by the 3GPP standard group, and the other is access to the second PLMN through N3IWF through non-3GPP access technology Core network side.
  • the Requested NSSAI carried in the registration request contains the same S-NSSAI that requires authentication, such as the network shown in Figure 2 Slice 1, when the S-NSSAI used to identify network slice 1 has already executed network slice specific authentication and authorization procedures in the first PLMN, if the S-NSSAI repeats authentication in the second PLMN, due to the authentication of the network slice The process has nothing to do with the access technology, resulting in repeated authentication for the same S-NSSAI. In the scenario shown in Figure 2, that is, repeated authentication for network slice 1, resulting in signaling waste.
  • this application provides a communication method to solve the problem of repeated authentication for the same S-NSSAI, which causes a waste of signaling.
  • FIG. 3 is a schematic flowchart of a communication method 300 provided by this application.
  • a communication method 300 provided by the present application may include the following steps:
  • the first network element obtains the first authentication state of the target network slice of the first terminal device from the UDM network element.
  • the first network element obtains the first authentication state of the target network slice of the first terminal device from the UDM network element.
  • the first authentication status indicates the first authentication result of the target network slice, or the first authentication status indicates that the target network slice has not performed an authentication process.
  • the first authentication result may include that the target network slice has already executed the authentication process and the authentication result is successful, or the target network slice has already executed the authentication process and the authentication result is failed.
  • the first network element determines whether to perform the first authentication process on the target network slice according to the first authentication state.
  • the first network element determines the first authentication result of the target network slice according to the first authentication status
  • the first network element does not perform the first authentication process on the target network slice, such as the first network
  • the first network element does not perform the first authentication process on the target network slice in the first PLMN.
  • the first authentication result is the authentication result of the second network element on the target network slice when the first terminal device accesses the target network slice through the second PLMN.
  • the first network element when the first network element determines that the target network slice has not performed the authentication process according to the first authentication status, the first network element performs the first authentication process on the target network slice.
  • the first network element after the first network element performs the first authentication process on the target network slice according to the first authentication status, it notifies the UDM network element of the second authentication status of the target network slice, and the second authentication status Indicates the second authentication result corresponding to the first authentication process.
  • the target network slice includes the first target network slice and the second target network slice, and the first network element obtains the information of the first terminal device from the UDM network element.
  • the first authentication state of the target network slice determines that the authentication result of the first target network slice is successful or failed, and it is determined that the authentication process of the second target network slice has not been executed, then the first network element does not perform the authentication on the first target network slice.
  • the authentication process is performed, where the authentication result of the first target network slice is the authentication result of the second network element on the target network slice when the first terminal device accesses the target network slice through the second PLMN.
  • the UDM network element After the first network element performs the authentication procedure on the second target network slice in the first PLMN, the UDM network element notifies the UDM network element of the second authentication status of the second target network slice.
  • the second network element may obtain the second authentication status of the second target network slice of the first terminal device from the UDM network element, and the second network element The second authentication status indicates the authentication result of the second target network slice, and the authentication result is the authentication result of the first network element on the second target network slice, then the second network element may determine not to perform authentication on the second network slice Rights process.
  • the first network element determines whether to perform the first authentication process on the target network slice according to the first authentication state, avoiding repeated initiation of the network slice authentication process for the same S-NSSAI, which may cause the terminal device to follow the core network The signaling on the side is wasted.
  • the first network element may be different network elements in different solutions, for example, the first network element may be an AMF network element or an AUSF network element.
  • the first network element can obtain the first authentication status of the target network slice of the first terminal device from the UDM network element in a variety of ways. For example, it can include that the UDM network element can use the request message sent by the first network element through The response message sends the authentication status of the target network slice to the first network element, or when the first network element is an AMF network element, the UDM network element may carry the target in the contracted S-NSSAI message sent to the AMF network element for the terminal device The authentication status of the network slice.
  • the first network element when it performs the authentication process on multiple target network slices, it can send the authentication results of all target network slices to the UDM network element at one time, or it can send the authentication results of the target network slices to the UDM network element multiple times. UDM network element.
  • FIG. 4 is a schematic flowchart of a communication method 400 provided by this application.
  • a communication method 400 provided by the present application may include the following steps:
  • the terminal device initiates a registration process of the first PLMN through the first access technology.
  • the terminal device carries the Requested NSSAI when initiating the registration process, and the access device selects the appropriate AMF network element corresponding to the network slice for the terminal according to the NSSAI, and then forwards the registration request to the AMF network element, and the AMF entity receives and processes the registration request.
  • the access device corresponding to the first access technology is omitted in FIG. 4.
  • the first AMF network element provides services for terminal equipment.
  • the UDM network element sends the authentication status of the target network slice to the first AMF network element.
  • the first AMF network element may request the UDM network element to send the contracted S-NSSAI of the terminal device, and the UDM network element sends the terminal device's information to the first AMF network element according to the request of the first AMF network element. Sign the S-NSSAI and send the authentication status of the target network slice to the AMF network element at the same time.
  • the first AMF network element may call the servicing operation Nudm_SDM_Get of UDM to obtain the contracted S-NSSAI of the terminal device.
  • the UDM network element sends to the first AMF network element the contracted S-NSSAI of the terminal device through Nudm_SDM_Get response, and the indication information of whether each contracted S-NSSAI needs to perform authentication.
  • UDM can also send to the first AMF network element whether the S-NSSAI that needs to perform authentication has performed Network Slice Specific Authentication and Authorization through Nudm_SDM_Get response, that is, send the S-NSSAI that needs to perform authentication to the first AMF network element. NSSAI authentication status.
  • the S-NSSAI that needs to perform authentication includes the target network slice. Exemplarily, Table 1 shows a possible way for UDM network elements to store S-NSSAI information.
  • Table 1 S-NSSAI information stored in UDM network elements
  • the UDM network element may also send the signed S-NSSAI to the first AMF network element, and then according to the request of the first AMF network element, send the authentication of the target network slice to the first AMF network element.
  • the first AMF network element calls the servicing operation Nudm_SDM_Get of the UDM network element to obtain the subscribed S-NSSAI of the UE, where the subscribed S-NSSAI includes indication information for indicating whether the S-NSSAI needs to perform Network Slice Specific Authentication and Authorization.
  • the UDM network element sends to the first AMF network element the contracted S-NSSAI of the terminal device through Nudm_SDM_Get response, and the indication information of whether each contracted S-NSSAI needs to perform authentication.
  • the first AMF network element then calls the servicing operation Nudm_UECM_Get request of the UDM network element, and carries the S-NSSAI that needs to perform the authentication process, and queries the UDM network element for the authentication status of the S-NSSAI.
  • the UDM network element returns the authentication status corresponding to the S-NSSAI to the first AMF network element through Nudm_UECM_Get response.
  • the first AMF network element determines whether to perform an authentication process on the target network slice according to the received authentication status of the target network slice.
  • the first scenario If the Requested NSSAI carried by the terminal device when initiating the first PLMN registration process contains the S-NSSAI that needs to perform Network Slice Specific Authentication and Authorization, and the authentication status indication sent by the first AMF network element through UDM The S-NSSAI has already performed the authentication process, the first AMF network element will no longer perform the authentication process for the S-NSSAI. It should be noted that the authentication process here and below refers to the second authentication process , Namely network Slice Specific Authentication and Authorization. The first AMF network element determines the Allowed NSSAI according to the authentication status. The following is an example with Table 1.
  • the Requested NSSAI carried includes the first S-NSSAI and the fourth S-NSSAI, and the authentication status sent by the first AMF network element through the UDM network element It is obtained that the first S-NSSAI has already performed authentication, and the fourth S-NSSAI does not need to perform authentication, the first AMF network element determines that it is not necessary to perform authentication on the first S-NSSAI and the fourth S-NSSAI, because If the authentication result of the first S-NSSAI is successful, the first AMF network element determines that the Allowed NSSAI includes the first S-NSSAI and the fourth S-NSSAI, that is, the first AMF network element determines that the terminal device is allowed to access the first S-NSSAI.
  • the first AMF network element determines that the Allowed NSSAI only includes the fourth S-NSSAI, that is, the first AMF network element determines that the terminal device is allowed to access Enter the fourth S-NSSAI, and the terminal device is not allowed to access the first S-NSSAI.
  • the first S-NSSAI is equivalent to the target network slice of this application.
  • the second scenario If the Requested NSSAI contains an S-NSSAI that needs to perform Network Slice Specific Authentication and Authorization, and the first AMF network element determines through the authentication status sent by UDM that the S-NSSAI has not performed the authentication process, then The first AMF network element initiates a Network Slice Specific Authentication and Authorization process for each S-NSSAI that needs to perform authentication and does not perform the authentication process. After the process ends, step 404 is executed. With reference to Table 1, it is assumed that the Requested NSSAI carried by the terminal device includes the second S-NSSAI and the third S-NSSAI.
  • the first AMF network element obtains the authentication status of the second S-NSSAI and the third S-NSSAI from the information sent by the UDM network element, that is, both the second S-NSSAI and the third S-NSSAI need to perform Network Slice Specific Authentication and Authorization, and neither the second S-NSSAI nor the third S-NSSAI has performed the authentication process. Then the first AMF network element initiates a Network Slice Specific Authentication and Authorization process to the second S-NSSAI and the third S-NSSAI. After the Network Slice Specific Authentication and Authorization process ends, the AMF network element continues to perform step 404. In the above example in the first scenario, the second S-NSSAI and the third S-NSSAI are equivalent to the target network slices of this application.
  • the first AMF network element After the Network Slice Specific Authentication and Authorization process, the first AMF network element notifies the UDM network element of the authentication status of the target network slice.
  • the first AMF network element After the first AMF network element performs the Network Slice Specific Authentication and Authorization process on the second S-NSSAI and the third S-NSSAI, it notifies the UDM network element of the authentication status of the second S-NSSAI and the third S-NSSAI, The authentication status indicates the authentication result of the second S-NSSAI and the third S-NSSA.
  • the first AMF network element stores the authentication result of the S-NSSAI in the UDM network element by invoking the servicing operation Nudm_UECM_Update of the UDM network element.
  • the first AMF network element may receive S from the AUSF network element or the authentication, authorization and accounting server (authentication, authorization, accounting server, AAA Server). -The timer corresponding to the NSSAI, or the first AMF network element determines the timer corresponding to the S-NSSAI according to local configuration information.
  • the first AMF network element may also store the authentication result of the S-NSSAI and a timer in the UDM network element, and the timer is used to indicate the validity period of the authentication result of the S-NSSAI.
  • the first AMF network element may store the authentication result of the S-NSSAI and the timer in the UDM network element by invoking the servicing operation Nudm_UECM_Update of the UDM network element.
  • the UDM network element may delete the S-NSSAI authentication result after the timer expires.
  • the UDM network element only stores the authentication result of the S-NSSAI without a corresponding timer, it means that the validity of the authentication result of the S-NSSAI has no time limit.
  • the first AMF network element can divide the authentication result. Sending to the UDM network element multiple times can also be sent to the UDM network element once.
  • the first AMF network element can store the authentication result of the S-NSSAI and the timer in the UDM network element by calling Nudm_UECM_Update, a servicing operation of multiple UDMs.
  • the first AMF network element can call the UDM service operation Nudm_UECM_Update and store the authentication result of the second S-NSSAI and the timer timer in UDM network element.
  • the first AMF network element again calls the service operation Nudm_UECM_Update of the UDM network element and stores the authentication result of the third S-NSSAI and the timer timer in UDM network element. It should be noted that the embodiment of the application does not limit the number of times the authentication result is sent.
  • the target network slice includes N network slices, and N is an integer greater than 0, and the UDM network element can receive M messages sent by the AMF network element. , M messages are used to update the authentication status of the target network slice in the UDM network element, and M is not greater than N.
  • the first AMF network element can call a servicing operation Nudm_UECM_Update to store the authentication results of the 4 network slices in the UDM network element, or the first AMF network element can call Two servicing operations Nudm_UECM_Update, where the first time is used to store the authentication results corresponding to network slice 1 and network slice 2 in the UDM network element, and the second time is used to authenticate network slice 3 and network slice 4 The result is stored in the UDM network element.
  • the first AMF network element can call Nudm_UECM_Update three times as a service operation, the first time it is used to store the authentication results corresponding to network slice 1 and network slice 2 in the UDM network element, and the second time it is used to store the authentication results corresponding to network slice 3
  • the authentication result is stored in the UDM network element, and the third time is used to store the authentication result corresponding to the network slice 4 in the UDM network element.
  • the UDM network element learns the authentication status of the corresponding target network slice.
  • UDM updates The stored information for example, corresponds to Table 1.
  • Table 2 shows a possible way of updating the S-NSSAI information of the UDM network element.
  • the terminal device initiates a registration process of the second PLMN through the second access technology.
  • the terminal device carries the Requested NSSAI when initiating the registration process, and the access device selects the appropriate AMF network element corresponding to the network slice for the terminal according to the NSSAI, and then forwards the registration request to the AMF network element, and the AMF entity receives and processes the registration request.
  • the access device corresponding to the second access technology is omitted.
  • the second AMF network element provides services for the terminal device.
  • the UDM network element sends the authentication status of the S-NSSAI to the second AMF network element.
  • the second AMF network element may request the UDM network element to send the signed S-NSSAI of the terminal device, and the UDM network element sends the terminal device's information to the second AMF network element according to the request of the second AMF network element. Sign the S-NSSAI and send the authentication status of the target network slice to the AMF network element at the same time. Specifically, you can refer to step 402 about the first AMF network element to request the UDM network element to send the contracted S-NSSAI of the terminal device. The UDM network element sends the terminal device to the first AMF network element according to the request of the first AMF network element. Signed S-NSSAI, and sends a description of the authentication status of the target network slice to the AMF network element for understanding, which will not be repeated here.
  • the UDM network element may also send the signed S-NSSAI to the second AMF network element, and then according to the request of the second AMF network element, send the authentication of the target network slice to the second AMF network element.
  • Right status Specifically, you can refer to the UDM network element in step 402. After sending the contracted S-NSSAI to the first AMF network element, according to the request of the first AMF network element, send the target network slice to the first AMF network element.
  • the description of the authentication status is to be understood, and will not be repeated here.
  • the second AMF network element determines whether to perform an authentication process on the target network slice according to the received authentication status of the target network slice.
  • the example in step 403 is continued to explain. It is assumed that when the terminal device initiates the registration process of the second PLMN, the Requested NSSAI carried includes the second S-NSSAI and the third S-NSSAI.
  • the second AMF network element obtains through the authentication status sent by UDM that the second S-NSSAI has performed authentication and the authentication result is successful, and the second AMF network element obtains the third through the authentication status sent by the UDM network element.
  • the S-NSSAI has already performed authentication and the authentication result is failure.
  • the authentication result of the second S-NSSAI and the third S-NSSAI is that the first AMF network element pairs the second S-NSSAI and the second S-NSSAI in the first PLMN.
  • the corresponding result after the third S-NSSAI performs the authentication process can be understood with reference to steps 404 and 405 for details.
  • the second AMF network element determines that the second S-NSSAI and the third S-NSSAI will no longer be authenticated in the second PLMN.
  • the second AMF network element directly determines the Allowed NSSAI according to the obtained authentication results of the second S-NSSAI and the third S-NSSAI, and the Allowed NSSAI includes only the second S-NSSAI. That is, the second AMF network element determines that the terminal device is allowed to access the second S-NSSAI, and the terminal device is not allowed to access the third S-NSSAI.
  • the second AMF network element obtains through the authentication status sent by the UDM network element that the second S-NSSAI has performed authentication, And the authentication result is successful, and at the same time, the second AMF network element obtains the timer-1 corresponding to the authentication state of the second S-NSSAI from the UDM, and the authentication result is still in the valid period, that is, the timer-1 has not timed out.
  • the second AMF network element obtains from the authentication status sent by the UDM network element that the third S-NSSAI has performed authentication and the authentication result is a failure. At the same time, the second AMF network element obtains the third S-NSSAI from the UDM network element.
  • the S-NSSAI authentication status corresponds to timer-2, and the authentication result is still within the validity period, that is, timer-2 has not expired.
  • the authentication results of the second S-NSSAI and the third S-NSSAI are the corresponding results of the first AMF network element after the first PLMN performs the authentication process on the second S-NSSAI and the third S-NSSAI, which can be specifically Refer to steps 404 and 405 for understanding.
  • the second AMF network element determines that the second S-NSSAI and the third S-NSSAI will no longer be authenticated in the second PLMN.
  • the second AMF network element directly determines the Allowed NSSAI according to the obtained authentication results of the second S-NSSAI and the third S-NSSAI.
  • the Allowed NSSAI includes the second S-NSSAI and the third S-NSSAI, that is, the second AMF network element It is determined that the terminal device is allowed to access the second S-NSSAI and the third S-NSSAI.
  • the S-NSSAI contracted by the terminal equipment is not limited to the four S-NSSAIs mentioned in Table 1 and Table 2.
  • the first S-NSSAI, the second S-NSSAI, the third S-NSSAI and the fourth S-NSSAI It does not represent a restriction on the quantity, but for the convenience of explanation.
  • the S-NSSAI contracted by the terminal device also includes the fifth S-NSSAI
  • the Requested NSSAI carried also includes the fifth S-NSSAI.
  • the second AMF network element performs the authentication process on the fifth S-NSSAI and sends the authentication status of the fifth S-NSSAI to the UDM, and the UDM network element learns the fifth S-NSSAI.
  • the authentication status of NSSAI can be understood by referring to steps 404 and 405.
  • the first AMF network element notifies the UDM network element of the authentication status of the target network slice and the UDM network element learns the authentication status of the corresponding target network slice. Here Do not repeat it again.
  • the authentication result of the network slicing is stored in the UDM network element.
  • the AMF network element stores the authentication result of the network slicing in the UDM network element, which can prevent the AMF network element under different PLMNs and different access technologies from targeting The same S-NSSAI repeatedly initiates the network slice authentication process, which leads to waste of signaling between the terminal equipment and the core network side.
  • Method 400 mentions that if the Requested NSSAI contains an S-NSSAI that needs to perform Network Slice Specific Authentication and Authorization, and the S-NSSAI has not performed an authentication process, the first AMF network element will perform authentication for each S-NSSAI initiates the Network Slice Specific Authentication and Authorization process. Specifically, after the first AMF network element decides to trigger the Network Slice Specific Authentication and Authorization process, the first AMF network element will interact with the authentication, authorization and accounting server (authentication, authorization, accounting server, AAA Server) through the AUSF network element The authentication information of the terminal device is transmitted.
  • the authentication, authorization and accounting server authentication, authorization, accounting server, AAA Server
  • the embodiment of this application also provides another method 500.
  • the AUSF network element After the first AMF network element decides to trigger the Network Slice Specific Authentication and Authorization process, the AUSF network element sends a query request message to the UDM network element, requesting the UDM network element to send the target network The authentication status of the slice, this method will be specifically introduced below.
  • FIG. 5 is a schematic flowchart of a communication method 500 provided by this application.
  • a communication method 500 provided by the present application may include the following steps:
  • a terminal device initiates a registration process of a first PLMN through a first access technology.
  • the terminal device carries the Requested NSSAI when initiating the registration process, and the access device selects the appropriate AMF network element corresponding to the network slice for the terminal according to the NSSAI, and then forwards the registration request to the AMF network element, and the AMF entity receives and processes the registration request.
  • the access device corresponding to the first access technology is omitted in FIG. 5.
  • the first AMF network element provides services for terminal equipment.
  • the first AMF network element receives the signed S-NSSAI of the terminal device sent by the UDM network element.
  • the first AMF network element may call the servicing operation Nudm_SDM_Get of UDM to obtain the contracted S-NSSAI of the terminal device.
  • the UDM network element sends the contracted S-NSSAI of the terminal device to the first AMF network element through Nudm_SDM_Get response, and the indication information of whether each S-NSSAI needs to perform authentication.
  • the first AMF network element initiates a Network Slice Specific Authentication and Authorization process for each S-NSSAI that needs to perform authentication.
  • the first AMF network element performs a secondary authentication process on the S-NSSAI.
  • the first AMF requests the terminal device to obtain an extensible authentication protocol identifier (extensible authentication protocol, EAP ID) and carries the S-NSSAI, and the terminal device sends the EAP ID to the first AMF network element.
  • EAP ID extensible authentication protocol
  • the first AMF network element invokes the service operation of the AUSF network element.
  • the first AMF network element invokes the service operation of the AUSF network element, and requests the AUSF network element to perform an authentication process.
  • the first AMF network element can call Nausf_Communication_EAP MessageTransfer to request the AUSF network element to perform the authentication process.
  • the service operation can carry an EAP ID response message (EAP ID response), the address of the AAA-S server, and the general public user Identifier (generic public subscription identifier, GPSI), the first AMF network element identifier and S-NSSAI.
  • GPSI may be an external identification of the terminal device. For example, when the terminal device is a mobile phone, the GPSI may be a mobile phone number or an email address.
  • the address of the AAA-S server may be pre-configured on the first AMF network element or stored in the subscription data of the UE, and the first AMF network element obtains the address of the AAA-S server from the UDM.
  • S-NSSAI is the network slice identifier executed by the network slice specific authentication and authorization process in step 503.
  • the UDM network element sends the authentication status of the target network slice to the AUSF network element according to the request of the AUSF.
  • the AUSF network element When the AUSF network element is triggered to perform the authentication process, it can first send a request message to the UDM network element to request the UDM network element to send the authentication status of the target network slice, and the UDM network element can send the authentication status of the target network slice to the AUSF network element .
  • the AUSF network element calls the servicing operation Nudm_UECM_Get request of the UDM network element, and carries the S-NSSAI that needs to perform the authentication process, and queries the UDM network element for the authentication status of the S-NSSAI.
  • the UDM network element returns the authentication status corresponding to the S-NSSAI to the AUSF network element through Nudm_UECM_Get response.
  • the authentication status may include that the S-NSSAI has not performed the authentication process, or the S-NSSAI has performed the authentication.
  • the authentication process and the authentication result are successful, or the S-NSSAI has already executed the authentication process and the authentication result is failure.
  • the AUSF network element determines whether to perform an authentication process on the target network slice according to the received authentication status of the target network slice.
  • step 507 is executed.
  • the second scenario If the AUSF network element determines that the S-NSSAI has not performed the authentication process according to the authentication status of the target S-NSSAI, the AUSF continues to perform the authentication process on the S-NSSAI, that is, the AUSF network element performs steps 508 to Step 509.
  • the AUSF network element sends the S-NSSAI authentication result obtained from the UDM network element to the first AMF network element.
  • the AUSF network element learns from the UDM network element that the S-NSSAI has performed the authentication process and the corresponding authentication result, it means that the S-NSSAI has performed the Network Slice Specific Authentication and Authorization process, and there is no need to repeat the network slice specific authentication process. and authorization procedure, the AUSF network element directly returns the S-NSSAI authentication result obtained from the UDM network element to the first AMF network element. The first AMF network element determines Allowed NSSAI according to the authentication result.
  • the AUSF network element sends a request message to the AAA-S.
  • the request message is used to request the AAA-S to perform Network Slice Specific Authentication and Authorization on the S-NSSAI.
  • the AUSF network element After the Network Slice Specific Authentication and Authorization process, the AUSF network element sends the authentication status of the target network slice to the UDM network element.
  • the AUSF network element can store the authentication result of the S-NSSAI in the UDM network element by calling the UDM service operation Nudm_UECM_Update.
  • the AUSF network element may receive the timer corresponding to the S-NSSAI from AAA-S, or the AUSF network element may determine the S-NSSAI according to the local configuration information. The corresponding timer timer.
  • the AUSF network element may also send the authentication result of the S-NSSAI and a timer to the UDM network element, and the timer is used to indicate the validity period of the authentication result of the S-NSSAI.
  • the AUSF network element can store the authentication result of the S-NSSAI and the timer in the UDM network element by invoking the service operation Nudm_UECM_Update of the UDM network element.
  • the UDM network element may delete the S-NSSAI authentication result after the timer expires.
  • the UDM network element only stores the authentication result of the S-NSSAI without a corresponding timer, it means that the validity of the authentication result of the S-NSSAI has no time limit.
  • the AUSF network element can divide the authentication result into multiple times Sending to the UDM network element can also be sent to the UDM network element at one time.
  • the first AMF network element can send the authentication result to the UDM network element multiple times or send it to the UDM network element once for understanding, and will not be repeated here.
  • the UDM network element learns the authentication status of the corresponding network slice.
  • the UDM network element After the UDM network element receives the authentication status sent by the AUSF network element, the UDM network element updates the authentication status of the corresponding network slice.
  • the terminal device initiates the registration process of the second PLMN through the second access technology.
  • the terminal device carries the Requested NSSAI when initiating the registration process, and the access device selects the appropriate AMF network element corresponding to the network slice for the terminal according to the NSSAI, and then forwards the registration request to the AMF network element, and the AMF entity receives and processes the registration request.
  • the access device corresponding to the second access technology is omitted in FIG. 5.
  • the second AMF network element provides services for the terminal device.
  • the second AMF network element receives the signed S-NSSAI of the terminal device sent by the UDM network element.
  • the second AMF network element initiates a Network Slice Specific Authentication and Authorization process for each S-NSSAI that needs to perform authentication.
  • the second AMF network element invokes the service operation of the AUSF network element.
  • Steps 512 to 514 can refer to steps 502 to 504 where the first AMF network element receives the contracted S-NSSAI of the terminal device sent by the UDM network element.
  • the first AMF network element initiates a Network for each S-NSSAI that needs to perform authentication.
  • the Slice Specific Authentication and Authorization process and the service operation of the AUSF network element called by the first AMF network element for understanding are not repeated here.
  • the UDM network element sends the authentication status of the target network slice to the AUSF network element according to the request of the AUSF.
  • the AUSF network element determines whether to perform an authentication process on the target network slice according to the received authentication status of the target network slice.
  • step 517 is executed.
  • the second scenario if the AUSF network element determines that the S-NSSAI has not performed the authentication process according to the authentication status of the target S-NSSAI, the AUSF continues to perform the authentication process on the S-NSSAI, that is, AUSF performs step 518 to step 519 .
  • the AUSF network element sends the S-NSSAI authentication result obtained from the UDM network element to the second AMF network element.
  • the AUSF network element sends a request message to AAA-S.
  • the AUSF network element After the Network Slice Specific Authentication and Authorization process, the AUSF network element sends the authentication status of the target network slice to the UDM network element.
  • the UDM network element learns the authentication status of the corresponding network slice.
  • Steps 515 to 520 can be understood with reference to steps 505 to 510, and will not be repeated here.
  • Method 500 stores the authentication result of the network slicing in the UDM network element.
  • the AUSF network element stores the authentication result of the network slicing in the UDM network element, which can prevent the AMF network element under different PLMN and different access technologies from targeting The same S-NSSAI repeatedly initiates the network slice authentication process, which leads to waste of signaling between the terminal equipment and the core network side.
  • an AUSF network element that simultaneously receives an authentication request sent by two AMF network elements.
  • the AUSF network element receives the first message sent by the first AMF network element of the first PLMN.
  • the first message is used to request to perform the first authentication process on the target network slice.
  • the AUSF network element When the AUSF network element performs the first authentication process on the target network slice, The UE registers with the second PLMN through the second access technology, the AUSF network element receives the second message sent by the second AMF network element of the second PLMN, and the second message is used to request the execution of the second authentication process on the target network slice, then The AUSF network element may send indication information to the second AMF network element, where the indication information is used to indicate that the second authentication process is suspended. After the AUSF network element learns the authentication result of the target network slice, the AUSF network element sends the authentication result of the target network slice to the second AMF network element.
  • the Requested NSSAI contains the same S-NSSAI that requires authentication.
  • the S-NSSAI has been authenticated in the first PLMN
  • Method 400 and Method 500 respectively give two methods, as shown in Figure 6, taking the first AMF as an example for illustration, Method 400, in the registration process, if The first AMF network element determines that the Requested NSSAI includes a certain S-NSSAI, and the S-NSSAI needs to perform authentication, then the first AMF network element first obtains the authentication status of the S-NSSAI from the UDM network element.
  • -NSSAI has performed the authentication process before, and the AMF network element directly determines the Allowed NSSAI of the terminal device according to the authentication result.
  • the AUSF network element obtains the S-NSSAI from the UDM network element. -NSSAI authentication status. If the S-NSSAI has performed an authentication process before, the AUSF network element directly returns the authentication result to the AMF network element, which triggers the AMF network element to determine the Allowed NSSAI of the terminal device according to the authentication result.
  • FIG. 7 is a schematic flowchart of a communication method 700 provided by this application.
  • a communication method 700 provided by the present application may include the following steps:
  • the UDM network element sends the contract data of the terminal device to the first AMF network element.
  • the UDM network element sends the subscription data of the terminal device to the second AMF network element.
  • the UDM network element when the terminal device initiates the registration process, sends the terminal device subscription data to the AMF network element. Specifically, the terminal device can be sent to the first AMF network element and the second AMF network element respectively. S-NSSAI and the authentication status of S-NSSAI, assuming that at a certain moment, the subscription information of the terminal device has changed. Since the UDM network element stores the identifiers of two different AMF network elements, the UDM network element The subscription data of the terminal device needs to be sent to the first AMF network element and the second AMF network element respectively. In order to distinguish, the contract data sent for the first time is called the old contract data, and the contract information changed later is called the new contract data.
  • the UDM network element may send the subscription data of the terminal device to the first AMF network element and the second AMF network element respectively by calling Nudm_SDM_Notification.
  • the contract data of the terminal device includes the S-NSSAI subscribed by the terminal device and the indication information of whether the S-NSSAI needs to perform Network Slice Specific Authentication and Authorization.
  • the first AMF network element performs a secondary authentication process on the target network slice.
  • the first AMF network element initiates a secondary authentication process for the S-NSSAI, and requests the terminal device to obtain the EAP ID. For example, suppose that the terminal device carries the Requested NSSAI when initiating the first PLMN registration process. It is assumed that the Requested NSSAI includes the first S-NSSAI, the second S-NSSAI, the third S-NSSAI, and the fourth S-NSSAI.
  • the access device According to the NSSAI, an AMF network element corresponding to a suitable network slice is selected for the terminal, and it is assumed that the first AMF network element provides services for the terminal device.
  • the first AMF network element obtains the first S-NSSAI from the UDM network element, the second S-NSSAI needs to perform the second authentication process, and the third S-NSSAI and the fourth S-NSSAI do not need to perform the second authentication process .
  • the first AMF network element also obtains from the UDM network element that the first S-NSSAI has performed the authentication process, and the authentication result is successful, and the second S-NSSAI has not performed the authentication process, then the first AMF The network element no longer re-authenticates the first S-NSSAI.
  • the first AMF network element determines that the Allowed NSSAI includes the first S-NSSAI, the third S-NSSAI and the fourth S-NSSA and sends it to the terminal device. If the first AMF After the network element performs the authentication process on the second S-NSSAI, and the authentication result is successful, the first AMF network element updates Allowed NSSAI including the first S-NSSAI, the second S-NSSAI, the third S-NSSAI and the fourth S-NSSA, if the first AMF network element performs the authentication process on the second S-NSSAI, and the authentication result is a failure, the first AMF network element does not need to update the Allowed NSSAI.
  • the first AMF network element receives the new subscription data of the terminal device sent by the UDM network element, indicating that the terminal device’s subscription S-NSSAI includes the second S-NSSAI, the third S-NSSAI, and the fourth S-NSSAI.
  • NSSAI where the second S-NSSAI and the third S-NSSAI need to perform the second authentication process, and the fourth S-NSSAI does not need to perform the authentication process.
  • the second S-NSSAI never needs to perform network slice specific
  • the authentication and authorization procedure is changed to a network slice specific authentication and authorization procedure, and the current Allowed NSSAI includes the second S-NSSAI, the first AMF network element needs to perform the second authentication procedure on the second S-NSSAI. Specifically, jump to step 704.
  • the first AMF network element invokes the service operation of the AUSF network element.
  • the first AMF network element invokes the service operation of the AUSF network element, and requests the AUSF network element to perform an authentication process.
  • the first AMF network element can call Nausf_Communication_EAP MessageTransfer to request the AUSF network element to perform the authentication process.
  • the service operation can carry an EAP ID response message (EAP ID response), the address of the AAA-S server, and the general public user Identifier (generic public subscription identifier, GPSI), the first AMF network element identifier and S-NSSAI.
  • GPSI may be an external identification of the terminal device. For example, when the terminal device is a mobile phone, the GPSI may be a mobile phone number or an email address.
  • the address of the AAA-S server can be pre-configured on the AMF network element.
  • S-NSSAI is the network slice identifier executed by the network slice specific authentication and authorization process in step 703.
  • the AUSF network element sends a request message to the AAA-S, requesting the AAA-S to perform a secondary authentication process on the target network slice.
  • step 703 to step 705 the flow of the second authentication performed by the first AMF network element can refer to the steps in the above method 400 or method 500, and details are not repeated here.
  • the second AMF network element performs a secondary authentication procedure on the target network slice.
  • the second AMF network element performing the secondary authentication process on the target network slice can be understood by referring to the second AMF network element performing the second authentication process on the target network slice in step 703, which will not be repeated here. It should be noted that it should be noted that it should be noted that it should be noted that the S-NSSAI that needs to perform authentication is included in the Allowed NSSAI corresponding to two different access technologies. Therefore, the first AMF and the second AMF will respectively initiate the Network Slice Specific Authentication and Authorization process of the same S-NSSAI.
  • the second AMF network element invokes the service operation of the AUSF network element.
  • the second AMF network element invokes the service operation of the AUSF network element and requests the AUSF network element to perform an authentication process.
  • the second AMF network element can call Nausf_Communication_EAP MessageTransfer to request the AUSF network element to perform the authentication process.
  • the service operation can carry an EAP ID response message (EAP ID response), the address of the AAA-S server, and the general public user Identifier (generic public subscription identifier, GPSI), the second AMF network element identifier, and S-NSSAI.
  • GPSI may be an external identification of the terminal device. For example, when the terminal device is a mobile phone, the GPSI may be a mobile phone number or an email address.
  • the address of the AAA-S server can be pre-configured on the AMF network element.
  • S-NSSAI is the network slice identifier executed by the network slice specific authentication and authorization process in step 706.
  • the AUSF network element in step 704 and the AUSF network element in step 707 are AUSF network elements located in a home public land mobile network (HPLMN).
  • HPLMN home public land mobile network
  • the AUSF network element suspends the authentication process of the target network slice initiated by the second AMF network element.
  • the AUSF network element judges that before the authentication process initiated by the first AMF network element ends, the AUSF network element learns that the second AMF network element initiated the same terminal based on the GPSI and S-NSSAI sent by the second AMF network element in step 707. For the same S-NSSAI authentication process of the device, the AUSF network element triggers the second AMF network element to suspend the authentication process of the target network slice.
  • it may also include:
  • the AUSF network element sends indication information to the second AMF network element.
  • the indication information is used to indicate that the S-NSSAI secondary authentication process initiated by the second AMF network element in step 706 of the second AMF network element is temporarily in a suspended state.
  • the AUSF network element After the authentication process initiated by the first AMF network element ends, the AUSF network element sends the authentication result to the second AMF network element.
  • the first AMF or AUSF network element may also send the authentication result to the UDM network element.
  • the AUSF network element learns the authentication result, it can also send the authentication result to the second AMF network element.
  • the second AMF network element determines Allowed NSSAI according to the authentication result.
  • the first AMF network element needs to perform the second authentication process on the second S-NSSAI.
  • the second AMF network element also performs the second authentication process on the second S-NSSAI.
  • the first AMF network element first invokes the servicing operation of the AUSF network element
  • AUSF determines that the second AMF network element initiated the same
  • the authentication process of the same S-NSSAI of the terminal equipment that is, the authentication process of the second S-NSSAI of the same terminal equipment, then the AUSF network element will authenticate the second AMF network element to the second S-NSSAI
  • the authorization process is suspended.
  • the AUSF network element When the authentication process of the second S-NSSAI initiated by the first AMF network element ends, the AUSF network element directly sends the result corresponding to the authentication process of the second S-NSSAI to the second AMF network
  • the second AMF network element determines the Allowed NSSAI of the terminal device in the second PLMN according to the authentication result. For example, when the authentication result corresponding to the authentication process of the second S-NSSAI initiated by the first AMF network element is successful, Then the second AMF network element determines that the Allowed NSSAI of the terminal device in the second PLMN includes the second S-NSSAI according to the authentication result.
  • the second AMF network element determines that the Allowed NSSAI of the terminal device in the second PLMN does not include the second S-NSSAI according to the authentication result.
  • Method 700 judges whether the second authentication process is for the same S-NSSAI through the AUSF network element, and if so, puts the network slice authentication process under one of the access technologies in a suspended state, that is, the second authentication process
  • the suspension of the authorization process can prevent the AMF network elements under different access technologies from repeatedly initiating the network slice authentication process for the same S-NSSAI, resulting in waste of signaling between the terminal equipment and the core network side.
  • AAA-S may also determine whether the authentication process is for the same S-NSSAI. For this scenario, the following specific introduction will be given.
  • FIG. 8 is a schematic flowchart of a communication method 800 provided by this application.
  • a communication method 800 provided by this application may include the following steps:
  • the UDM network element sends the contract data of the terminal device to the first AMF network element.
  • the UDM network element sends the subscription data of the terminal device to the second AMF network element.
  • the first AMF network element performs a secondary authentication process on the target network slice.
  • the first AMF network element invokes the service operation of the AUSF network element.
  • the AUSF network element sends a request message to the AAA-S, requesting the AAA-S to perform a secondary authentication process on the target network slice.
  • the second AMF network element performs a secondary authentication procedure on the target network slice.
  • the second AMF network element invokes the service operation of the AUSF network element.
  • Step 801 to step 807 can be understood with reference to step 701 to step 707 in the method 700, and details are not repeated here.
  • the AUSF network element sends a request message to the AAA-S, requesting the AAA-S to perform a secondary authentication process on the target network slice.
  • the AAA-S triggers the AUSF network element to suspend the authentication process of the target network slice initiated by the second AMF network element.
  • AAA-S judges that before the end of the authentication process initiated by the AUSF network element, the AUSF network element initiated the same S-NSSAI authentication process for the same terminal device, then AAA-S triggers the AUSF network element to slice the target network The authentication process is suspended.
  • it may also include:
  • the AUSF network element sends indication information to the second AMF network element.
  • the indication information is used to indicate that the S-NSSAI secondary authentication process initiated by the second AMF network element in step 806 of the second AMF network element is temporarily in a suspended state.
  • the AUSF network element After the authentication process initiated by the first AMF network element ends, the AUSF network element sends the authentication result to the second AMF network element.
  • the second AMF network element determines Allowed NSSAI according to the authentication result.
  • Step 811 and step 812 can be understood with reference to step 710 and step 711 in the method 700, which will not be repeated here.
  • Method 800 uses AAA-S to determine whether the second authentication process is for the same S-NSSAI. If so, it triggers the AUSF network element to put the network slice authentication process under one of the access technologies in a suspended state, that is The suspension of the second authentication process can prevent AMF network elements under different access technologies from repeatedly initiating the network slice authentication process for the same S-NSSAI, resulting in waste of signaling between the terminal equipment and the core network side.
  • Method 700 and method 800 respectively provide two methods. As shown in FIG. 9, it is assumed that the path from the terminal device through the first AMF network element and the AUSF network element to the AAA-S shown in FIG.
  • the authentication process performed by the network element is hereinafter referred to as the first authentication process.
  • the AUSF network element or AAA-S receives from the second AMF network element for the same terminal device
  • the same S-NSSAI authentication request hereinafter referred to as the second authentication process
  • the AUSF network element suspends the second authentication process, or AAA-S triggers the AUSF network element to suspend the second process.
  • the AUSF network element directly returns the S-NSSAI authentication result to the second AMF according to the result of the first authentication process, reducing signaling interaction.
  • the foregoing mainly introduces the solution provided by the embodiment of the present application from the perspective of interaction among the first network element, AMF network element, AUSF network element, AAA-S, and UDM network element.
  • the first network element, AMF network element, AUSF network element, AAA-S, and UDM network element include hardware structures and/or software modules corresponding to each function in order to realize the above functions.
  • the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed by hardware or computer software-driven hardware depends on the specific application and design constraint conditions of the technical solution. Professionals and technicians can use different methods for each specific application to implement the described functions, but such implementation should not be considered beyond the scope of this application.
  • the first network element, AMF network element, AUSF network element, AAA-S and UDM network element in Figures 3 to 9 can be implemented by one physical device, or can be implemented by multiple physical devices. It may also be a logical function module in a physical device, which is not specifically limited in the embodiment of the present application.
  • FIG. 10 shows a schematic diagram of the hardware structure of a communication device provided by an embodiment of the application. It includes a communication interface 1001 and a processor 1002, and may also include a memory 1003.
  • the communication interface 1001 may use any device such as a transceiver for communicating with other devices or communication networks.
  • the processor 1002 includes, but is not limited to, a central processing unit (CPU), a network processor (NP), an application-specific integrated circuit (ASIC) or a programmable logic device (programmable logic device, PLD) one or more.
  • the above-mentioned PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof.
  • the processor 1002 is responsible for the communication line 1004 and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions.
  • the memory 1003 may be used to store data used by the processor 1002 when performing operations.
  • the memory 1003 can be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, random access memory (RAM), or other types that can store information and instructions
  • the dynamic storage device can also be electrically erasable programmable read-only memory (electrically programmable read-only memory, EEPROM), compact disc read-only memory (CD-ROM) or other optical disk storage, Optical disc storage (including compact disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), magnetic disk storage media or other magnetic storage devices, or can be used to carry or store desired program codes in the form of instructions or data structures and can Any other medium accessed by the computer, but not limited to this.
  • the memory can exist independently and is connected to the processor 1002 through a communication line 1004.
  • the memory 1003 may also be integrated with the processor 1002. If the memory 1003 and the processor 1002 are independent devices, the memory 1003 and the processor 1002 are connected, for example, the memory 1003 and the processor 1002 can communicate through a communication line.
  • the communication interface 1001 and the processor 1002 may communicate through a communication line, and the communication interface 1001 may also be directly connected to the processor 1002.
  • the communication line 1004 may include any number of interconnected buses and bridges.
  • the communication line 1004 links various circuits including one or more processors 1002 represented by the processor 1002 and a memory represented by the memory 1003 together.
  • the communication line 1004 can also link various other circuits such as peripheral devices, voltage regulators, power management circuits, etc., which are all known in the art, and therefore, this application will not further describe them.
  • the communication device when the communication device is the first network element, it may include:
  • the memory is used to store computer-readable instructions.
  • the communication interface coupled with the memory, the communication interface is used to perform the following operations:
  • the first authentication status indicates the first authentication result of the target network slice, or the first authentication status indicates that the target network slice is not executed Go through the authentication process;
  • the processor which is coupled with the communication interface, is configured to determine whether to execute the first authentication process for the target network slice according to the first authentication state obtained by the communication interface.
  • the processor is specifically configured to: when determining the first authentication result of the target network slice according to the first authentication status obtained by the communication interface, not perform the authentication process on the target network slice; or according to the communication interface When the obtained first authentication status determines that the target network slice has not performed the authentication process, the first network element performs the first authentication process on the target network slice.
  • the communication interface is also used to notify the UDM network element of the second authentication status of the target network slice, where the second authentication status indicates the second authentication result corresponding to the first authentication process.
  • the communication interface is also used to notify the UDM network element of the effective time of the second authentication state of the target network slice.
  • the communication interface is also used to learn that the terminal device requests to access the target network slice.
  • the processor is specifically configured to: if it is determined that the first authentication result of the target network slice is successful according to the first authentication status obtained by the communication interface, the first authentication process is not executed for the target network slice and the first authentication process is determined to be allowed The terminal device accesses the target network slice; or if the first authentication result of the target network slice is determined to be a failure according to the first authentication status obtained by the communication interface, the first authentication process is not performed on the target network slice and the terminal is determined not to be allowed The device accesses the target network slice.
  • the communication interface is specifically configured to: request the UDM network element to send subscription data; receive the subscription data sent by the UDM network element and the first authentication status of the target network slice.
  • the communication interface is specifically used for: sending a request message to the UDM network element, the request message is used to query the first authentication status of the target network slice; receiving a response message sent by the UDM network element, the response message indicating the target network slice The first authentication status.
  • the communication interface uses the user data management function UDM network element before obtaining the first authentication status of the target network slice of the terminal device. After receiving the first message sent by the first mobility management function AMF network element, the first message is used to request the execution of the first authentication process.
  • the processor is specifically configured to: if the first authentication result of the target network slice is determined to be success or failure according to the first authentication status, determine not to perform the first authentication process on the target network slice and send it to the first AMF network.
  • the meta sends the first authentication result of the target network slice.
  • the communication interface is specifically used for: sending a request message to the UDM network element, the request message is used to query the first authentication status of the target network slice; receiving a response message sent by the UDM network element, the response message indicating the target network slice The first authentication status.
  • the communication interface is further configured to receive a second message sent by the second mobility management function AMF network element when the processor executes the first authentication procedure on the target network slice, and the second message is used to request the first authentication process.
  • the target network slice of the terminal device executes the second authentication process; the communication interface is also used to send indication information to the second AMF network element, the indication information is used to indicate that the second authentication process is suspended; the communication interface is also used to learn After the second authentication result of the target network slice, the second authentication result of the target network slice is sent to the second AMF network element.
  • the communication device when it is a UDM network element, it may include:
  • the memory is used to store computer-readable instructions.
  • the communication interface coupled with the memory, the communication interface is used to perform the following operations:
  • the first authentication state of the target network slice of the terminal device is learned, the first authentication state indicates the first authentication result of the target network slice, or the first authentication state indicates that the target network slice has not performed an authentication process;
  • the communication interface is specifically used to receive the first authentication status sent by the second network element, and the second network element is to provide services for the terminal device when the terminal device accesses the target network slice through the first public land mobile network PLMN
  • the first authentication status is the first authentication result corresponding to the third authentication process performed by the second network element on the target network slice.
  • the communication interface is specifically used to receive the first authentication status sent by a third network element, and the third network element is to provide services for the terminal device when the terminal device accesses the target network slice through the first public land mobile network PLMN
  • the authentication server functions as an AUSF network element, and the first authentication status is the first authentication result corresponding to the third authentication process performed by the fourth network element on the target network slice.
  • the first network element is the first mobility management function AMF network element that provides services for the terminal device when the terminal device accesses the target network slice through the second public land mobile network PLMN or the authentication for providing services for the terminal device
  • the communication interface is also used to: receive a request message sent by the first network element, and the request message is used to query the first authentication status of the target network slice; the communication interface is specifically used to communicate to the first network element Send a response message, the response message indicating the first authentication status of the target network slice.
  • the first network element is the first mobility management function AMF network element that provides services for the terminal device when the terminal device accesses the target network slice through the second public land mobile network PLMN
  • the communication interface is also used for receiving
  • the request message sent by the first network element is used to request subscription data; the communication interface is specifically used to send the subscription data and the first authentication status of the target network slice to the first network element.
  • the communication interface is also used to receive the valid time of the first authentication state of the target network slice.
  • the communication device when it is an AUSF network element, it may further include:
  • a communication interface configured to receive a first authentication request message sent by a first network element, where the first authentication request message is used to request a third network element to perform a first authentication process on the first network slice accessed by the terminal device;
  • the communication interface is also used to receive a second authentication request message sent by the second network element, and the second authentication request message is used to request the first network element to access the terminal device by the third network element.
  • Network slicing executes the second authentication process
  • the communication interface is also used to send instruction information to the second network element, where the instruction information is used to indicate that the second authentication process is suspended;
  • the communication interface is also used to obtain the first authentication result of the first authentication process, and send the first authentication result of the first authentication process to the second network element.
  • the first network element is a first mobility management function AMF network element located in the first PLMN
  • the second network element is a second mobility management function AMF network element located in the second PLMN.
  • the communication device when it is AAA-S, it may further include:
  • a communication interface configured to receive a first authentication request message sent by a first network element, where the first authentication request message is used to request a third network element to perform a first authentication process on the first network slice accessed by the terminal device;
  • the communication interface is also used to receive a second authentication request message sent by the second network element, and the second authentication request message is used to request the first network element to access the terminal device by the third network element.
  • Network slicing executes the second authentication process
  • the communication interface is also used to send instruction information to the second network element, where the instruction information is used to indicate that the second authentication process is suspended;
  • the communication interface is also used to obtain the first authentication result of the first authentication process, and send the first authentication result of the first authentication process to the second network element.
  • the first network element and the second network element are the authentication server function AUSF network elements located in the home public land mobile network HPLMN.
  • the communication interfaces of the first network element, AMF network element, AUSF network element, AAA-S, and UDM network element may be regarded as the transceiver unit, and the first network element, AMF network element, and AUSF network element
  • the processors with processing functions of AAA-S and UDM network elements are regarded as processing units, and the memories of the first network element, AMF network elements, AUSF network elements, AAA-S and UDM network elements are regarded as storage units.
  • the first network element may include a transceiver unit 1110 and a processing unit 1120.
  • the transceiver unit may also be referred to as a transceiver, a transceiver, a transceiver, and so on.
  • the processing unit may also be called a processor, a processing board, a processing module, a processing device, and so on.
  • the device for implementing the receiving function in the transceiver unit 1110 can be regarded as the receiving unit, and the device for implementing the sending function in the transceiver unit 1110 as the sending unit, that is, the transceiver unit 1110 includes a receiving unit and a sending unit.
  • the transceiver unit may sometimes be called a transceiver, a transceiver, or a transceiver circuit.
  • the receiving unit may sometimes be called a receiver, receiver, or receiving circuit.
  • the transmitting unit may sometimes be called a transmitter, a transmitter, or a transmitting circuit.
  • the transceiver unit 1110 is configured to perform the transceiver operation on the first network element side in step 301 in FIG. 3, and/or the transceiver unit 1110 is also configured to perform the first network element in the embodiment corresponding to FIG. 3 Other sending and receiving steps on the yuan side.
  • the processing unit 1120 is configured to perform processing operations on the first network element side in step 302 in FIG. 3, and/or the processing unit 1120 is further configured to perform other processing steps on the first network element side in the embodiment corresponding to FIG. 3.
  • the AMF network element may include a transceiver unit 1210 and a processing unit 1220.
  • the transceiver unit may also be referred to as a transceiver, a transceiver, a transceiver, and so on.
  • the processing unit may also be called a processor, a processing board, a processing module, a processing device, and so on.
  • the device for implementing the receiving function in the transceiver unit 1210 can be regarded as the receiving unit, and the device for implementing the sending function in the transceiver unit 1210 as the sending unit, that is, the transceiver unit 1210 includes a receiving unit and a sending unit.
  • the transceiver unit may sometimes be called a transceiver, a transceiver, or a transceiver circuit.
  • the receiving unit may sometimes be called a receiver, receiver, or receiving circuit.
  • the transmitting unit may sometimes be called a transmitter, a transmitter, or a transmitting circuit.
  • the transceiver unit 1210 may be used to perform the transceiver operations on the first AMF network element or the second AMF network element side in steps 401, 402, 404, 406, and 407 in FIG. 4, and/or The unit 1210 is also used to perform other transceiving steps on the side of the first AMF network element or the second AMF network element in the embodiment corresponding to FIG. 4, and the processing unit 1220 is used to perform steps 403 and 408 of the first AMF network element in FIG. Or the processing operation on the side of the second AMF network element, and/or the processing unit 1220 is further configured to perform other processing steps on the side of the first AMF network element or the second AMF network element in the embodiment corresponding to FIG. 4.
  • the transceiving unit 1210 may be used to perform the transceiving on the first AMF network element or the second AMF network element side in steps 501, 502, 504, 507, 511, 512, 514, and 517 in FIG. 5 Operation, and/or the transceiving unit 1210 is also used to perform other transceiving steps on the first AMF network element or the second AMF network element side in the embodiment corresponding to FIG. 5, and the processing unit 1220 is used to perform steps 503 and 513 in FIG. 5 In the first AMF network element or the second AMF network element side processing operations, and/or the processing unit 1220 is further configured to perform other processing steps on the first AMF network element or the second AMF network element side in the embodiment corresponding to FIG. 5 .
  • the transceiver unit 1210 may be used to perform the transceiver operations on the first AMF network element or the second AMF network element side in steps 701, 702, 704, 707, 709, and 710 in FIG. 7, and /Or the transceiving unit 1210 is further configured to perform other transceiving steps on the side of the first AMF network element or the second AMF network element in the embodiment corresponding to FIG. 7, and the processing unit 1220 is configured to perform the first steps in steps 703 and 711 in FIG. The processing operation on the side of the AMF network element or the second AMF network element, and/or the processing unit 1220 is further configured to perform other processing steps on the side of the first AMF network element or the second AMF network element in the embodiment corresponding to FIG. 7.
  • the transceiver unit 1210 may be used to perform the transceiver operations on the first AMF network element or the second AMF network element side in steps 801, 802, 804, 807, 808, 810, and 811 in FIG. 8. And/or the transceiving unit 1210 is further configured to perform other transceiving steps on the side of the first AMF network element or the second AMF network element in the embodiment corresponding to FIG. 8, and the processing unit 1220 is configured to perform steps 803 and 812 in FIG. The processing operation on the side of an AMF network element or the second AMF network element, and/or the processing unit 1220 is further configured to perform other processing steps on the side of the first AMF network element or the second AMF network element in the embodiment corresponding to FIG. 8.
  • the UDM network element may include a transceiver unit 1310 and a processing unit 1320.
  • the transceiver unit may also be referred to as a transceiver, a transceiver, a transceiver, and so on.
  • the processing unit may also be called a processor, a processing board, a processing module, a processing device, and so on.
  • the device for implementing the receiving function in the transceiver unit 1310 can be regarded as the receiving unit, and the device for implementing the sending function in the transceiver unit 1310 as the sending unit, that is, the transceiver unit 1310 includes a receiving unit and a sending unit.
  • the transceiver unit may sometimes be called a transceiver, a transceiver, or a transceiver circuit.
  • the receiving unit may sometimes be called a receiver, receiver, or receiving circuit.
  • the transmitting unit may sometimes be called a transmitter, a transmitter, or a transmitting circuit.
  • the transceiving unit 1310 is used to perform the transceiving operation on the UDM network element side in step 301 in FIG. 3, and/or the transceiving unit 1310 is also used to perform the UDM network element side in the embodiment corresponding to FIG. 3 The other sending and receiving steps.
  • the transceiving unit 1310 is used to perform the transceiving operations on the UDM network element side in steps 401 and 405 in FIG. 4, and/or the transceiving unit 1310 is also used to perform the UDM network element in the embodiment corresponding to FIG. 4 Other sending and receiving steps on the yuan side.
  • the processing unit 1320 is configured to perform processing operations on the UDM network element side in step 405 in FIG. 4, and/or the processing unit 1320 is further configured to perform other processing steps on the UDM network element side in the embodiment corresponding to FIG. 4.
  • the storage unit 1330 is configured to perform the storage/update operation on the UDM network element side in step 405 in FIG. 4. And/or the storage unit 1330 is further configured to perform other storage steps on the UDM network element side in the embodiment corresponding to FIG. 4.
  • the transceiver unit 1310 is configured to perform the transceiver operations on the UDM network element side in steps 502, 505, 509, 510, 512, and 519, 520 in FIG. 5, and/or the transceiver unit 1310 is also configured to Perform other transceiving steps on the UDM network element side in the embodiment corresponding to FIG. 5.
  • the processing unit 1320 is configured to perform processing operations on the UDM network element side in steps 510 and 520 in FIG. 5, and/or the processing unit 1320 is further configured to perform other processing steps on the UDM network element side in the embodiment corresponding to FIG. 5.
  • the storage unit 1330 is configured to perform storage/update operations on the UDM network element side in steps 510 and 520 in FIG. 5. And/or the storage unit 1330 is further configured to perform other storage steps on the UDM network element side in the embodiment corresponding to FIG. 5.
  • the transceiving unit 1310 is used to perform the transceiving operations on the UDM network element side in steps 701 and 702 in FIG. 7, and/or the transceiving unit 1310 is also used to perform the UDM network element in the embodiment corresponding to FIG. Other sending and receiving steps on the yuan side.
  • the transceiving unit 1310 is used to perform the transceiving operations on the UDM network element side in steps 801 and 802 in FIG. 8, and/or the transceiving unit 1310 is also used to perform the UDM network element in the embodiment corresponding to FIG. Other sending and receiving steps on the yuan side.
  • the AUSF network element may include a transceiver unit 1410 and a processing unit 1420.
  • the transceiver unit may also be referred to as a transceiver, a transceiver, a transceiver, and so on.
  • the processing unit may also be called a processor, a processing board, a processing module, a processing device, and so on.
  • the device for implementing the receiving function in the transceiver unit 1410 can be regarded as the receiving unit, and the device for implementing the sending function in the transceiver unit 1410 as the sending unit, that is, the transceiver unit 1410 includes a receiving unit and a sending unit.
  • the transceiver unit may sometimes be called a transceiver, a transceiver, or a transceiver circuit.
  • the receiving unit may sometimes be called a receiver, receiver, or receiving circuit.
  • the transmitting unit may sometimes be called a transmitter, a transmitter, or a transmitting circuit.
  • the transceiver unit 1410 is configured to perform the transceiver operations on the AUSF network element side in steps 504, 505, 507, 508, 509, 514, 515, 517, 518, and 519 in FIG. 5, and/or
  • the transceiving unit 1410 is also configured to perform other transceiving steps on the AUSF network element side in the embodiment corresponding to FIG. 5.
  • the processing unit 1420 is configured to perform processing operations on the AUSF network element side in steps 506 and 516 in FIG. 5, and/or the processing unit 1420 is also configured to perform other processing steps on the AUSF network element side in the embodiment corresponding to FIG. 5.
  • the transceiving unit 1410 is used to perform the transceiving operations on the AUSF network element side in steps 704, 705, 707, 709, and 710 in FIG. 7, and/or the transceiving unit 1410 is also used to perform corresponding operations in FIG. 7 Other receiving and sending steps on the AUSF network element side in the embodiment.
  • the processing unit 1420 is configured to perform processing operations on the AUSF network element side in step 708 in FIG. 7, and/or the processing unit 1420 is further configured to perform other processing steps on the AUSF network element side in the embodiment corresponding to FIG. 7.
  • the transceiving unit 1410 is used to perform the transceiving operations on the AUSF network element side in steps 804, 805, 807, 809, 810, and 811 in Figure 8, and/or the transceiving unit 1410 is also used to perform Figure 8. 8. Other transceiving steps on the AUSF network element side in the corresponding embodiment.
  • the AAA-S may include a transceiver unit 1510 and a processing unit 1520.
  • the transceiver unit may also be referred to as a transceiver, a transceiver, a transceiver, and so on.
  • the processing unit may also be called a processor, a processing board, a processing module, a processing device, and so on.
  • the device for implementing the receiving function in the transceiver unit 1510 can be regarded as the receiving unit, and the device for implementing the sending function in the transceiver unit 1510 as the sending unit, that is, the transceiver unit 1510 includes a receiving unit and a sending unit.
  • the transceiver unit may sometimes be called a transceiver, a transceiver, or a transceiver circuit.
  • the receiving unit may sometimes be called a receiver, receiver, or receiving circuit.
  • the transmitting unit may sometimes be called a transmitter, a transmitter, or a transmitting circuit.
  • the transceiving unit 1510 is used to perform the transceiving operations on the AAA-S side in steps 508 and 518 in FIG. 5, and/or the transceiving unit 1510 is also used to perform AAA-S in the embodiment corresponding to FIG. 5 Other sending and receiving steps on the S side.
  • the transceiving unit 1510 is used to perform the transceiving operation on the AAA-S side in step 705 in FIG. 7, and/or the transceiving unit 1510 is also used to perform the AAA-S side in the embodiment corresponding to FIG. The other sending and receiving steps.
  • the transceiving unit 1510 is used to perform the transceiving operations on the AAA-S side in steps 805, 808, and 809 in FIG. 8, and/or the transceiving unit 1510 is also used to perform the corresponding embodiment in FIG. 8 Other receiving and sending steps on AAA-S side.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • the computer instructions may be transmitted from a website, computer, server, or data center. Transmission to another website site, computer, server or data center via wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.).
  • wired such as coaxial cable, optical fiber, digital subscriber line (DSL)
  • wireless such as infrared, wireless, microwave, etc.
  • the computer-readable storage medium may be any available medium that can be stored by a computer or a data storage device such as a server or data center integrated with one or more available media.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk (SSD)).
  • the program can be stored in a computer-readable storage medium, and the storage medium can include: ROM, RAM, magnetic disk or CD, etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请实施例公开了一种通信方法，包括：第一网元从数据管理功能网元获得第一终端设备的目标网络切片的第一鉴权状态，第一鉴权状态指示目标网络切片的第一鉴权结果，或者第一鉴权状态指示目标网络切片未执行过鉴权流程。第一网元根据第一鉴权状态确定是否对目标网络切片执行第一鉴权流程。本申请实施例还提供相应的网元，通过本申请提供的技术方案第一网元根据第一鉴权状态确定是否对目标网络切片执行第一鉴权流程，避免针对同一个S-NSSAI重复发起网络切片鉴权流程，而导致终端设备跟核心网侧的信令浪费。

Description

一种通信方法以及网元
本申请要求于2019年7月9日提交中国专利局，申请号为201910615962.0、发明名称为“一种通信方法以及网元”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，具体涉及一种通信方法。
背景技术
第五代移动通信(the 5th Generationmobile communication technology，5G)系统架构不但支持3GPP标准组定义的无线技术接入核心网络侧，而且支持non-3GPP接入技术通过non-3GPP转换功能(non-3GPP interworking function，N3IWF)或下一代接入网关(next generation packet data gateway，ngPDG)或固网接入网关或可信non-3GPP接入网关接入核心网络侧。此外，5G时代将有数以千亿计的物联网设备接入网络，不同类型应用场景对网络的需求是差异化的，有的甚至是相互冲突的。通过单一网络同时为不同类型应用场景提供服务，会导致网络架构异常复杂、网络管理效率和资源利用效率低下。5G网络切片技术通过在同一网络基础设施上虚拟独立逻辑网络的方式为不同的应用场景提供相互隔离的网络环境，使得不同应用场景可以按照各自的需求定制网络功能和特性，能够切实保障不同业务的QoS需求。
当终端设备通过不同的公用陆地移动网(public land mobile network，PLMN)接入相同的网络切片时，终端设备除了执行永久标识的主鉴权流程之外，可能还需要执行网络切片粒度的鉴权和授权流程。目前，在不同的PLMN中，若都需要对终端设备请求接入的同一个网络切片执行网络切片粒度的鉴权和授权流程时，核心网网元要对该网络切片重复执行网络切片粒度的鉴权和授权流程，导致终端设备跟核心网侧的信令浪费。
发明内容
本申请实施例提供一种，避免针对同一个S-NSSAI重复发起网络切片鉴权流程，而导致终端设备跟核心网侧的信令浪费。
为达到上述目的，本申请实施例提供如下技术方案：
本申请第一方面提供一种通信方法，可以适用于增强型的移动宽带(enhanced mobile broadband，eMBB)场景、大连接物联网(massive machine type communication，mMTC)场景以及低时延、超可靠通信(Ultra reliable and low latency communication，uRLLC)场景。可以包括：第一网元从数据管理网元获得第一终端设备的目标网络切片的第一鉴权状态，第一鉴权状态指示目标网络切片的第一鉴权结果，或者第一鉴权状态指示目标网络切片未执行过鉴权流程。第一网元根据第一鉴权状态确定是否对目标网络切片执行第一鉴权流程。由第一方面可知，第一网元根据第一鉴权状态确定是否对目标网络切片执行第一鉴权流程，避免针对同一个S-NSSAI重复发起网络切片鉴权流程，而导致终端设备跟核心网侧的信令浪费。
可选地，结合上述第一方面，在第一种可能的实现方式中，第一网元根据第一鉴权状 态确定是否对目标网络切片执行第一鉴权流程，可以包括：第一网元根据第一鉴权状态确定目标网络切片的第一鉴权结果时，第一网元对目标网络切片不执行鉴权流程。或者第一网元根据第一鉴权状态确定目标网络切片未执行过鉴权流程时，第一网元对目标网络切片执行第一鉴权流程。由第一方面第一种可能的方式可知，第一网元根据第一鉴权状态确定能够确定目标网络切片的第一鉴权结果时，不再执行第一鉴权流程，避免针对同一个S-NSSAI重复发起网络切片鉴权流程，而导致终端设备跟核心网侧的信令浪费。
可选地，结合上述第一方面第一种可能的实现方式，在第二种可能的实现方式中，该方法还可以包括：第一网元根据第一鉴权状态对目标网络切片执行第一鉴权流程后，该方法还可以包括：第一网元通知数据管理网元目标网络切片的第二鉴权状态，第二鉴权状态指示第一鉴权流程对应的第二鉴权结果。由第一方面第二种可能的方式可知，若第一网元对目标网络切片执行了第一鉴权流程，第一网元将该第一鉴权流程对应的鉴权结果通知数据管理网元，当其他网元需要对该目标网络切片进行鉴权时，可以直接从数据管理网元处获取该鉴权结果，即上述提到的第二鉴权结果，避免针对同一个S-NSSAI重复发起网络切片鉴权流程。
可选地，结合上述第一方面第二种可能的实现方式，在第三种可能的实现方式中，该方法还可以包括：第一网元根据第一鉴权状态对目标网络切片执行第一鉴权流程后，方法还可以包括:第一网元通知数据管理网元目标网络切片的第二鉴权状态的有效时间。有第一方面第三种可能的实现方式可知，鉴权状态可以对应有效时间，使得该鉴权状态的有效性可以灵活控制，增加方案的多样性。
可选地，结合上述第一方面或第一方面第一种至第三种可能的实现方式，在第四种可能的实现方式中，第一网元为移动性管理网元时，第一网元从数据管理网元获得第一终端设备的目标网络切片的第一鉴权状态之前，方法还可以包括：第一网元获知第一终端设备请求接入目标网络切片。
可选地，结合上述第一方面第四种可能的实现方式，在第五种可能的实现方式中，第一网元根据第一鉴权状态确定不对目标网络切片执行第一鉴权流程，可以包括：若第一网元根据第一鉴权状态确定目标网络切片的第一鉴权结果为成功时，第一网元对目标网络切片不执行第一鉴权流程且确定允许第一终端设备接入目标网络切片。或者若第一网元根据第一鉴权状态确定目标网络切片的第一鉴权结果为失败时，第一网元对目标网络切片不执行第一鉴权流程且确定不允许第一终端设备接入目标网络切片。
可选地，结合上述第一方面第四种或第五种可能的实现方式，在第六种可能的实现方式中，第一网元从数据管理网元获得第一终端设备的目标网络切片的第一鉴权状态，可以包括：第一网元向数据管理网元请求签约数据。第一网元接收数据管理网元发送的签约数据和目标网络切片的第一鉴权状态。由第一方面第六种可能的实现方式可知，当第一网元是移动性管理网元时，给出了一种具体的第一网元从数据管理网元获取第一鉴权状态的方式。
可选地，结合上述第一方面第四种或第五种可能的实现方式，在第七种可能的实现方式中，第一网元从数据管理网元获得第一终端设备的目标网络切片的第一鉴权状态，可以 包括：第一网元向数据管理网元发送请求消息，请求消息用于查询目标网络切片的第一鉴权状态。第一网元接收数据管理网元发送的响应消息，响应消息指示目标网络切片的第一鉴权状态。由第一方面第七种可能的实现方式可知，当第一网元是移动性管理网元时，给出了一种具体的第一网元从数据管理网元获取第一鉴权状态的方式。
可选地，结合上述第一方面或第一方面第一种至第三种可能的实现方式，在第八种可能的实现方式中，第一网元为认证服务器网元时，认证服务器网元从数据管理网元获得第一终端设备的目标网络切片的第一鉴权状态之前，方法还可以包括：认证服务器网元接收第一移动性管理网元发送的第一消息，第一消息用于请求执行第一鉴权流程。
可选地，结合上述第一方面第八种可能的实现方式，在第九种可能的实现方式中，第一网元根据第一鉴权状态确定不对目标网络切片执行第一鉴权流程可以包括：若第一网元根据第一鉴权状态确定目标网络切片的第一鉴权结果为成功或失败时，第一网元确定不对目标网络切片执行第一鉴权流程且向第一移动性管理网元发送目标网络切片的第一鉴权结果。
可选地，结合上述第一方面第八种或第九种可能的实现方式，在第十种可能的实现方式中，第一网元从数据管理网元获得第一终端设备的目标网络切片的第一鉴权状态，可以包括：第一网元向数据管理网元发送请求消息，请求消息用于查询目标网络切片的第一鉴权状态。第一网元接收数据管理网元发送的响应消息，响应消息指示目标网络切片的第一鉴权状态。当第一网元是认证服务器网元时，给出了一种具体的第一网元从数据管理网元获取第一鉴权状态的方式。
可选地，结合上述第一方面第八种可能的实现方式，在第十一种可能的实现方式中，当第一网元对目标网络切片执行第一鉴权流程中，认证服务器网元接收第二移动性管理网元发送的第二消息，第二消息用于请求第一终端设备的目标网络切片执行第二鉴权流程。认证服务器网元向第二移动性管理网元发送指示信息，指示信息用于指示第二鉴权流程被挂起。在认证服务器网元获知目标网络切片的第二鉴权结果之后，方法可以包括：认证服务器网元向第二移动性管理网元发送目标网络切片的第二鉴权结果。由第一方面第十一种可能的实现方式可知，通过认证服务器网元判断第二个鉴权流程是否针对的是同一个S-NSSAI，如果是，则将其中一个网络切片鉴权流程处于挂起状态，即第二个鉴权流程挂起，可以避免不同移动性管理网元针对同一个S-NSSAI重复发起网络切片鉴权流程，而导致终端设备跟核心网侧的信令浪费。
本申请第二方面提供一种通信方法，可以包括：数据管理网元获知第一终端设备的目标网络切片的第一鉴权状态，第一鉴权状态指示目标网络切片的第一鉴权结果，或者第一鉴权状态指示目标网络切片未执行过鉴权流程。数据管理网元向第一网元发送第一鉴权状态。由第一方面可知，数据管理网元可以将已经目标网络切片的鉴权状态向第一网元发送，第一网元可以根据第一鉴权状态确定是否对目标网络切片执行第一鉴权流程，避免针对同一个S-NSSAI重复发起网络切片鉴权流程，而导致终端设备跟核心网侧的信令浪费。
可选地，结合上述第二方面，在第一种可能的实现方式中，当第一鉴权状态指示目标网络切片的第一鉴权结果，数据管理网元获知第一终端设备的目标网络切片的第一鉴权状 态可以包括：数据管理网元接收第二网元发送的第一鉴权状态，第二网元是第一终端设备通过第一公用陆地移动网PLMN接入目标网络切片时，为第一终端设备提供服务的第三移动性管理网元，第一鉴权状态为第二网元对目标网络切片执行的第三鉴权流程对应的第一鉴权结果。
可选地，结合上述第二方面，在第二种可能的实现方式中，当第一鉴权状态指示目标网络切片的第一鉴权结果，数据管理网元获知第一终端设备的目标网络切片的第一鉴权状态可以包括：数据管理网元接收第三网元发送的第一鉴权状态，第一鉴权状态是第三网元对目标网络切片执行的第三鉴权流程对应的第一鉴权结果，第一网元和第三网元为位于归属公共陆地移动网络HPLMN中的认证服务器网元。
可选地，结合上述第二方面或第二方面第一种或第二方面第二种可能的实现方式，在第三种可能的实现方式中，第一网元是第一终端设备通过第二公用陆地移动网PLMN接入目标网络切片时，为第一终端设备提供服务的第一移动性管理网元或为第一终端设备提供服务的认证服务器网元时，方法还可以包括：数据管理网元接收第一网元发送的请求消息，请求消息用于查询目标网络切片的第一鉴权状态。数据管理网元向第一网元发送第一鉴权状态，可以包括：数据管理网元向第一网元发送响应消息，响应消息指示目标网络切片的第一鉴权状态。
可选地，结合上述第二方面或第二方面第一种或第二方面第二种可能的实现方式，在第四种可能的实现方式中，第一网元是第一终端设备通过第二公用陆地移动网PLMN接入目标网络切片时，为第一终端设备提供服务的第一移动性管理网元时，方法还可以包括：数据管理网元接收第一网元发送的请求消息，请求消息用于请求签约数据。数据管理网元向第一网元发送第一鉴权状态，可以包括：数据管理网元向第一网元发送签约数据和目标网络切片的第一鉴权状态。
可选地，结合上述第二方面或第二方面第一种至第四种可能的实现方式，在第五种可能的实现方式中，还可以包括：数据管理网元接收目标网络切片的第一鉴权状态的有效时间。
本申请第三方面提供一种通信方法，可以包括：第四网元接收第一网元发送的第一鉴权请求消息，第一鉴权请求消息用于请求第四网元对第一终端设备接入的第一网络切片执行第一鉴权流程。在第一鉴权流程结束之前，第四网元接收第二网元发送的第二鉴权请求消息，第二鉴权请求消息用于请求第四网元对第一终端设备接入的第一网络切片执行第二鉴权流程。第四网元向第二网元发送指示信息，指示信息用于指示第二鉴权流程被挂起。第四网元获取第一鉴权流程的第一鉴权结果，并向第二网元发送第一鉴权流程的第一鉴权结果。通过第四网元判断第二个鉴权流程是否针对的是同一个S-NSSAI，如果是，则将其中一个网络切片鉴权流程处于挂起状态，即第二个鉴权流程挂起，可以避免针对同一个S-NSSAI重复发起网络切片鉴权流程，而导致终端设备跟核心网侧的信令浪费。
可选地，结合上述第三方面，在第一种可能的实现方式中，第四网元为认证服务器网元，第一网元为位于第一PLMN中的第一移动性管理网元，第二网元为位于第二PLMN中的第二移动性管理网元。
可选地，结合上述第三方面，在第二种可能的实现方式中，第四网元为认证、授权和计费服务器，第一网元和第二网元为位于HPLMN中的认证服务器网元。
本申请第四方面提供一种第一网元，可以包括：收发单元，用于从数据管理网元获得第一终端设备的目标网络切片的第一鉴权状态，第一鉴权状态指示目标网络切片的第一鉴权结果，或者第一鉴权状态指示目标网络切片未执行过鉴权流程。处理单元，处理单元与收发单元耦合，用于根据收发单元获得的第一鉴权状态确定是否对目标网络切片执行第一鉴权流程。
可选地，结合上述第四方面，在第一种可能的实现方式中，处理单元具体用于：根据收发单元获得的第一鉴权状态确定目标网络切片的第一鉴权结果时，对目标网络切片不执行鉴权流程。或者根据收发单元获得的第一鉴权状态确定目标网络切片未执行过鉴权流程时，第一网元对目标网络切片执行第一鉴权流程。
可选地，结合上述第四方面第一种可能的实现方式，在第二种可能的实现方式中，收发单元，还用于通知数据管理网元目标网络切片的第二鉴权状态，第二鉴权状态指示第一鉴权流程对应的第二鉴权结果。
可选地，结合上述第四方面第二种可能的实现方式，在第三种可能的实现方式中，收发单元，还用于通知数据管理网元目标网络切片的第二鉴权状态的有效时间。
可选地，结合上述第四方面或第四方面第一种至第三种可能的实现方式，在第四种可能的实现方式中，第一网元为移动性管理网元时，收发单元，从数据管理网元获得第一终端设备的目标网络切片的第一鉴权状态之前，还用于获知第一终端设备请求接入目标网络切片。
可选地，结合上述第四方面第四种可能的实现方式，在第五种可能的实现方式中，处理单元，具体用于：若根据收发单元获得的第一鉴权状态确定目标网络切片的第一鉴权结果为成功时，对目标网络切片不执行第一鉴权流程且确定允许第一终端设备接入目标网络切片。或者若根据收发单元获得的第一鉴权状态确定目标网络切片的第一鉴权结果为失败时，对目标网络切片不执行第一鉴权流程且确定不允许第一终端设备接入目标网络切片。
可选地，结合上述第四方面第四种或第五种可能的实现方式，在第六种可能的实现方式中，收发单元，具体用于：获知第一终端设备的注册请求。根据注册请求，请求数据管理网元发送签约数据。接收数据管理网元发送的签约数据和目标网络切片的第一鉴权状态。
可选地，结合上述第四方面第四种或第五种可能的实现方式，在第七种可能的实现方式中，收发单元，具体用于：向数据管理网元请求签约数据，接收数据管理网元发送的响应消息，响应消息指示目标网络切片的第一鉴权状态。
可选地，结合上述第四方面或第四方面第一种至第三种可能的实现方式，在第八种可能的实现方式中，第一网元为认证服务器网元时，收发单元，从数据管理网元获得第一终端设备的目标网络切片的第一鉴权状态之前，还用于接收第一移动性管理网元发送的第一消息，第一消息用于请求执行第一鉴权流程。
可选地，结合上述第四方面第八种可能的实现方式，在第九种可能的实现方式中，处理单元，具体用于若根据第一鉴权状态确定目标网络切片的第一鉴权结果为成功或失败时， 确定不对目标网络切片执行第一鉴权流程且向第一移动性管理网元发送目标网络切片的第一鉴权结果。
可选地，结合上述第四方面第八种或第九种可能的实现方式，在第十种可能的实现方式中，收发单元，具体用于：向数据管理网元发送请求消息，请求消息用于查询目标网络切片的第一鉴权状态。接收数据管理网元发送的响应消息，响应消息指示目标网络切片的第一鉴权状态。
可选地，结合上述第四方面第八种可能的实现方式，在第十一种可能的实现方式中，收发单元，还用于在处理单元对目标网络切片执行第一鉴权流程中，接收第二移动性管理网元发送的第二消息，第二消息用于请求第一终端设备的目标网络切片执行第二鉴权流程。收发单元，还用于向第二移动性管理网元发送指示信息，指示信息用于指示第二鉴权流程被挂起。收发单元，还用于获知目标网络切片的第二鉴权结果之后，向第二移动性管理网元发送目标网络切片的第二鉴权结果。
本申请第五方面提供一种数据管理网元，可以包括：收发单元，用于获知第一终端设备的目标网络切片的第一鉴权状态，第一鉴权状态指示目标网络切片的第一鉴权结果，或者第一鉴权状态指示目标网络切片未执行过鉴权流程。收发单元，还用于向第一网元发送第一鉴权状态。
可选地，结合上述第五方面，在第一种可能的实现方式中，收发单元，具体用于接收第二网元发送的第一鉴权状态，第二网元是第一终端设备通过第一公用陆地移动网PLMN接入目标网络切片时，为第一终端设备提供服务的第三移动性管理网元，第一鉴权状态为第三网元对目标网络切片执行的第三鉴权流程对应的第一鉴权结果。
可选地，结合上述第五方面，在第二种可能的实现方式中，收发单元，具体用于接收第三网元发送的第一鉴权状态，第三网元是第一终端设备通过第一公用陆地移动网PLMN接入目标网络切片时，为第一终端设备提供服务的认证服务器网元，第一鉴权状态为第三网元对目标网络切片执行的第三鉴权流程对应的第一鉴权结果，第一网元和第三网元为位于归属公共陆地移动网络HPLMN中的认证服务器网元。
可选地，结合上述第五方面或第五方面第一种或第五方面第二种可能的实现方式，在第三种可能的实现方式中，第一网元是第一终端设备通过第二公用陆地移动网PLMN接入目标网络切片时，为第一终端设备提供服务的第一移动性管理网元或为第一终端设备提供服务的认证服务器网元时，收发单元，还用于：接收第一网元发送的请求消息，请求消息用于查询目标网络切片的第一鉴权状态。收发单元，具体用于向第一网元发送响应消息，响应消息指示目标网络切片的第一鉴权状态。
可选地，结合上述第五方面或第五方面第一种或第五方面第二种可能的实现方式，在第四种可能的实现方式中，第一网元是第一终端设备通过第二公用陆地移动网PLMN接入目标网络切片时，为第一终端设备提供服务的第一移动性管理网元时，收发单元，还用于接收第一网元发送的请求消息，请求消息用于请求签约数据。收发单元，具体用于向第一网元发送签约数据和目标网络切片的第一鉴权状态。
可选地，结合上述第五方面或第五方面第一种至第四种可能的实现方式，在第五种可 能的实现方式中，收发单元，还用于接收目标网络切片的第一鉴权状态的有效时间。
本申请第六方面提供一种第四网元，可以包括：收发单元，用于接收第一网元发送的第一鉴权请求消息，第一鉴权请求消息用于请求第三网元对第一终端设备接入的第一网络切片执行第一鉴权流程。在第一鉴权流程结束之前，收发单元，还用于接收第二网元发送的第二鉴权请求消息，第二鉴权请求消息用于请求第三网元对第一终端设备接入的第一网络切片执行第二鉴权流程。收发单元，还用于向第二网元发送指示信息，指示信息用于指示第二鉴权流程被挂起。收发单元，还用于获取第一鉴权流程的第一鉴权结果，并向第二网元发送第一鉴权流程的第一鉴权结果。
可选地，结合上述第六方面，在第一种可能的实现方式中，第四网元为认证服务器网元，第一网元为位于第一PLMN中的第一移动性管理网元，第二网元为位于第二PLMN中的第二移动性管理网元。
可选地，结合上述第六方面，在第二种可能的实现方式中，第四网元为认证、授权和计费服务器，第一网元和第二网元为位于HPLMN中的认证服务器网元。
本申请第七方面提供一种计算机可读存储介质，该计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机可以执行上述第一方面或第一方面任意一种可能实现方式的通信方法。
本申请第八方面提供一种计算机可读存储介质，该计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机可以执行上述第二方面或第二方面任意一种可能实现方式的通信方法。
本申请第九方面提供一种计算机可读存储介质，该计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机可以执行上述第三方面或第三方面任意一种可能实现方式的通信方法。
本申请第十方面提供一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机可以执行上述第一方面或第一方面任意一种可能实现方式的通信方法。
本申请第十一方面提供一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机可以执行上述第二方面或第二方面任意一种可能实现方式的通信方法。
本申请第十二方面提供一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机可以执行上述第三方面或第三方面任意一种可能实现方式的通信方法。
其中，第四方面、第七方面、第十方面、第九方面中任一种实现方式所带来的技术效果可参见第一方面中不同实现方式所带来的技术效果，此处不再赘述。
其中，第五方面、第八方面、第十一方面、第十方面中任一种实现方式所带来的技术效果可参见第二方面中不同实现方式所带来的技术效果，此处不再赘述。
其中，第六方面、第九方面、第十二方面中任一种实现方式所带来的技术效果可参见第三方面中不同实现方式所带来的技术效果，此处不再赘述。
本申请第十三方面提供一种系统，可以包括：第一网元和数据管理网元，其中该第一网元为上述第一方面或第一方面任意一种可能实现方式中描述的第一网元，数据管理网元为上述第二方面或第二方面任意一种可能实现方式中描述的数据管理网元。
本申请第十四方面提供一种系统，可以包括：第四网元、第一网元以及数据管理网元，其中该第一网元为上述第一方面或第一方面任意一种可能实现方式中描述的第一网元，数据管理网元为上述第二方面或第二方面任意一种可能实现方式中描述的数据管理网元，该第四网元为上述第三方面或第三方面任意一种可能实现方式中描述的第四网元。
本申请第十五方面提供一种系统，可以包括：第一网元以及第四网元，其中该第一网元为上述第一方面或第一方面任意一种可能实现方式中描述的第一网元，该第四网元为上述第三方面或第三方面任意一种可能实现方式中描述的第四网元。
本申请提供的技术方案第一网元根据第一鉴权状态确定是否对目标网络切片执行第一鉴权流程，避免针对同一个S-NSSAI重复发起网络切片鉴权流程，而导致终端设备跟核心网侧的信令浪费。
附图说明
图1为本申请实施例提供的一种系统架构示意图；
图2为不同的PLMN场景下对同一个S-NSSAI重复鉴权的示意图；
图3为本申请提供的一种通信方法300的流程示意图；
图4为本申请提供的一种通信方法400的流程示意图；
图5为本申请提供的一种通信方法500的流程示意图；
图6为本申请提供的一个场景示意图；
图7为本申请提供的一种通信方法700的流程示意图；
图8为本申请提供的一种通信方法800的流程示意图；
图9为本申请提供的另一个场景示意图；
图10为本申请实施例提供的通信设备的硬件结构的一个示意图；
图11为本申请实施例提供的第一网元的结构的示意图；
图12为本申请实施例提供的AMF网元的结构的示意图；
图13为本申请实施例提供的UDM网元的结构的示意图；
图14为本申请实施例提供的AUSF网元的结构的示意图；
图15为本申请实施例提供的AAA-S的结构的示意图。
具体实施方式
下面结合附图，对本申请的实施例进行描述，显然，所描述的实施例仅仅是本申请一部分的实施例，而不是全部的实施例。本领域普通技术人员可知，随着技术的发展和新场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
本申请实施例提供一种通信方法、网元及存储介质，第一终端设备通过第一公用陆地移动网(public land mobile network，PLMN)接入目标网络切片时，第一网元根据用户数据管理功能(User Data Management，UDM)发送的鉴权状态可以确定该目标网络切片的鉴权结果时，则不再对该目标网络切片重复鉴权，鉴权结果为第一终端设备通过第二PLMN接入目标网络切片时第二网元对目标网络切片的鉴权结果，该第一网元根据UDM网元发送的鉴权状态确定该目标网络切片未执行过鉴权流程时，第一网元对该目标网络切片鉴权后，通知UDM网元该目标网络切片的鉴权状态，避免不同核心网网元针对同一个目标网络切片重 复发起网络切片鉴权流程，而导致终端设备跟核心网侧的信令浪费。以下分别进行详细说明。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的实施例能够以除了在这里图示或描述的内容以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或模块的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或模块，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或模块。在本申请中出现的对步骤进行的命名或者编号，并不意味着必须按照命名或者编号所指示的时间/逻辑先后顺序执行方法流程中的步骤，已经命名或者编号的流程步骤可以根据要实现的技术目的变更执行次序，只要能达到相同或者相类似的技术效果即可。本申请中所出现的模块的划分，是一种逻辑上的划分，实际应用中实现时可以有另外的划分方式，例如多个模块可以结合成或集成在另一个系统中，或一些特征可以忽略，或不执行，另外，所显示的或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些端口，模块之间的间接耦合或通信连接可以是电性或其他类似的形式，本申请中均不作限定。并且，作为分离部件说明的模块或子模块可以是也可以不是物理上的分离，可以是也可以不是物理模块，或者可以分布到多个电路模块中，可以根据实际的需要选择其中的部分或全部模块来实现本申请方案的目的。
需要说明的是，本申请实施例中，名词“网络”和“系统”经常交替使用，但本领域的技术人员可以理解其含义。信息(information)，信号(signal)，消息(message)有时可以混用，应当指出的是，在不强调其区别时，其所要表达的含义是一致的。
还需要说明的是，在本申请实施例中，“上报”和“反馈”以及“响应”经常交替使用，但本领域的技术人员可以理解其含义。因此，在本申请实施例中，在不强调其区别时，其所要表达的含义是一致的。
为了方便理解本申请，在描述本申请的方法之前，首先对本申请实施例适用的网络架构、网络切片以及鉴权进行介绍。
图1为本申请实施例提供的一种系统架构示意图。
图1示例性示出了本申请提供的一种系统架构示意图。如图1所示，该系统架构包括移动性管理网元、会话管理网元、策略控制网元、认证服务网元、数据管理网元和用户面网元。进一步，该通信系统架构还包括接入网设备、终端设备(user equipment，UE)和数据网络网元(data network，DN)。终端设备可与移动性管理网元连接，接入网设备也可与移动性管理网元连接，接入网设备还可与用户面网元连接，用户面网元可分别与会话管理网元、数据网络连接，移动性管理网元可分别与会话管理网元、数据管理网元、策略控制网元和认证服务网元连接，会话管理网元分别与策略控制网元和数据管理网元连接。移动性管理网元和会话管理网元均可从数据管理网元获取数，例如用户签约数据，移动性管理网元和会话管理网元均可从策略控制网元获取策略数据。例如，策略控制网元从数据管理网元获得用户签约数据并发送到移动性管理网元和会话管理网元，再由移动性管理网 元和会话管理网元下发到接入网设备、终端设备和用户面网元等。
移动性管理网元，主要用于移动网络中的终端设备的注册、移动性管理、跟踪区更新流程。移动性管理网元终结了非接入层(non access stratum，NAS)消息、完成注册管理、连接管理以及可达性管理、分配跟踪区域列表(track area list，TA list)以及移动性管理等，并且透明路由会话管理(session management，SM)消息到会话管理网元。在第4代(4th generation，4G)通信中，移动性管理网元可以是(Mobility Management Entity,MME)移动性管理实体。在第5代(5th generation，5G)通信中，移动性管理网元可以是核心网接入和移动性管理功能access and mobility management function，AMF)网元，在未来通信如第6代(6th generation，6G)通信中，移动性管理网元仍可以是AMF网元，或者是支持移动性管理功能的其它名称的网元，本申请对此不作限定。
会话管理网元，主要用于移动网络中的会话管理，如会话创建、修改、释放。具体功能比如包括为用户分配互联网协议(internet protocol，IP)地址、选择提供报文转发功能的用户面网元等。在第4G中，会话管理网元可以是(Packet Data Network GateWay,PGW)分组数据网网关的控制面功能(control plane of PGW)。在5G中，会话管理网元可以是会话管理功能(session management function，SMF)网元，在未来通信如6G中，会话管理网元仍可以是SMF网元，或是支持会话管理功能的其它的名称的网元，本申请不做限定。
策略控制网元，其包含用户签约数据管理功能，策略控制功能，计费策略控制功能，服务质量(quality of service，QoS)控制等。在第4G中，策略控制网元可以是(policy and charging rules function,PCRF)策略和计费规则功能。在5G中，策略控制网元可以是策略控制功能(policy control function，PCF)网元，在未来通信如6G中，策略控制网元仍可以是PCF网元，或是支持策略控制功能的其它名称的网元，本申请不做限定。
认证服务器网元，主要用于使用可扩展的身份验证协议(extensible authentication protocol，EAP)验证服务功能、存储密钥，以实现对用户的鉴权和认证。在第4G中，认证服务器可以是(authentication、authorization、accounting server，AAA Server)认证、授权和计费服务器。在5G中，认证服务器网元可以是认证服务器功能(authentication server function，AUSF)网元，在未来通信如6G中，认证服务器网元仍可以是AUSF网元，或是支持认证功能的其它名称的网元，本申请不做限定。
数据管理网元，主要用于存储用户数据，如签约信息、鉴权/授权信息。在4G中，数据管理网元可以是(Home subscriber Server，HSS)归属用户服务器，在5G中，数据管理网元可以是统一数据管理(unified data management，UDM)网元，在未来通信如6G中，数据管理网元仍可以是UDM网元，或是支持数据管理功能的其它名称的网元，本申请不做限定。
用户面网元，主要用于用户平面的业务处理，例如业务路由、包转发、锚定功能、业务质量(quality of service，QoS)映射和执行、上行链路的标识识别并路由到数据网络、下行包缓存和下行链路数据到达的通知触发、与外部数据网络连接等。在4G中，用户面网元可以是(Packet Data Network GateWay,PGW)分组数据网网关的用户面功能(user plane of PGW)。在5G中，用户面网元可以是用户面功能(user plane function，UPF)网元， 在未来通信如6G中，用户面网元仍可以是UPF网元，或是支持用户面功能的其它名称的网元，本申请不做限定。
接入网设备，也可以称为无线接入网(radio access network，RAN)设备，是一种为终端设备提供无线通信功能的设备。接入网设备包括但不限于：5G中的下一代基站(g nodeB，gNB)、演进型节点B(evolved node B，eNB)、无线网络控制器(radio network controller，RNC)、节点B(node B，NB)、基站控制器(base station controller，BSC)、基站收发台(base transceiver station，BTS)、家庭基站(例如，home evolved nodeB，或home node B，HNB)、基带单元(baseBand unit，BBU)、传输点(transmitting and receiving point，TRP)、发射点(transmitting point，TP)、移动交换中心等。
终端设备(user equipment，UE)，是一种具有无线收发功能的设备，可以部署在陆地上，包括室内或室外、手持或车载；也可以部署在水面上(如轮船等)；还可以部署在空中(例如飞机、气球和卫星上等)。终端设备可以是手机(mobile phone)、平板电脑(pad)、带无线收发功能的电脑、虚拟现实(virtual reality，VR)终端、增强现实(augmented reality，AR)终端、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端等。
数据网络(Data Network，DN)，主要用于为用户提供业务，比如运营商的业务、互联网接入业务和第三方业务。
核心网络(core network，CN)作为承载网络提供到DN的接口，为终端设备提供通信连接、认证、管理、通信以及对数据业务完成承载等。在图1所示的网络架构中，核心网功能分为用户面功能与控制面功能。用户面功能主要负责分组数据包的转发、QoS控制等。控制面功能主要负责用户注册认证、移动性管理、向用户面功能(user plane function，UPF)下发数据包转发策略、或QoS控制策略等。其中，控制面功能主要包括接入与移动性管理功能(core access and mobility management function，AMF)网元与会话管理功能(session management function，SMF)网元等。具体的，AMF网元负责用户接入时的注册流程及用户移动过程中的位置管理，对终端设备的寻呼等。SMF网元负责用户发起业务时核心网络侧建立相应的会话连接，为用户提供具体服务等。
可以理解的是，上述网元或者功能既可以是硬件设备中的网络元件，也可以是在专用硬件上运行软件功能，或者是平台(例如，云平台)上实例化的虚拟化功能。上述网元或者功能可划分出一个或多个服务，进一步，还可能会出现独立于网络功能存在的服务。在本申请中，上述功能的实例、或上述功能中包括的服务的实例、或独立于网络功能存在的服务实例均可称为服务实例。
本申请以5G通信系统架构为例进行说明，如图1所示，系统架构中的接口和连接可以包括：N1、N2、N3、N4、N5、N6、N7、N8、N10、N11、N12、N15、N22。其中，N1为终端设备和AMF网元之间的控制面连接，用于传输用户设备和核心网控制面之间的控制信令，具体的N1连接中的消息可以由终端设备和RAN之间的连接、RAN和AMF网元之间的N2连接进行传 输。N2为RAN和AMF网元之间的控制面连接。N3为RAN和用户面功能之间的连接。N4为SMF网元和用户面功能之间的连接，用于传递SMF网元和用户面功能之间的控制信令。N5为PCF与AF之间的连接，N6为用户面功能和DN之间的连接，N7为SMF网元与PCF之间的连接，N8为AMF网元和UDM网元之间的连接，N10为UDM网元和SMF网元之间的连接，N11为AMF网元和SMF网元之间的连接，N12为AUSF网元和AMF网元之间的连接，N15为AMF网元和PCF网元之间的连接，N22为NSSF网元和AMF网元之间的连接。
进入5G时代，将有大量的设备接入网络，这些设备分属不同的领域，它们具有不同的特点和需求。不同设备对于网络的移动性、安全性、时延、可靠性，甚至是计费方式的需求是不同的。目前5G的应用场景包括增强型的移动宽带(enhanced mobile broadband，eMBB)、大连接物联网(massive machine type communication，mMTC)以及低时延、超可靠通信(Ultra reliable and low latency communication，uRLLC)。
其中，eMBB场景主要面向4K/8K超高清视频、全息技术、增强现实/虚拟现实等应用，移动宽带的主要需求是更高的数据容量。智能终端用户上网峰值速率要达到10Gbit/s甚至20Gbit/s，从而使能虚拟现实、无处不在的视频直播和分享、随时随地的云接入等大带宽应用。
mMTC场景应用于部署在测量、建筑、农业、物流、智慧城市、家庭等领域的海量传感器，这些传感器设备是非常密集的，大部分是静止的，要求5G网络支撑大规模连接，人和物联接数量达到100万个/平方公里。
uRLLC场景主要应用于无人驾驶、自动工厂、智能电网等领域，主要需求是超低时延和高可靠性。要求5G网络的时延达到1毫秒，从而使能垂直行业的应用，如智能制造、远程机械控制、辅助驾驶和自动驾驶等低时延业务。
不同设备对于网络的需求是不同，因此，在5G网络架构中引入了网络切片的概念。网络切片是将一个物理网络切割成多个虚拟的端到端的网络，每个虚拟网络之间，包括网络内的设备、接入、传输和核心网，是逻辑独立的，任何一个虚拟网络发生故障都不会影响到其它虚拟网络。每个虚拟网络具备不同的功能特点，面向不同的需求和服务。
当终端设备需要接入到某个网络切片时，终端设备可以提供请求的网络切片选择辅助信息(requested network slice selection assistance information，requested NSSAI)给核心网，用于核心网为终端设备选择AMF网元以及网络切片实例。单一网络切片辅助信息(single network slice selection assistance information，S-NSSAI)用于标识一个网络切片。在终端设备附着到网络之后，网络根据终端设备的签约数据，以及漫游协议，本地配置等信息综合判断，并返回当前网络允许的网络切片选择辅助信息(Allowed network slice selection assistance information，Allowed NSSAI)，该值同注册接受消息一起发送至终端设备，用于后续终端设备发起业务请求时，携带至核心网。当终端设备附着之后，如果核心网决定需要更新终端设备的Allowed NSSAI，则Allowed NSSAI的下发流程可以通过网络触发的配置更新流程来更新终端设备本地存储的Allowed NSSAI。
当终端设备注册到网络中时，除了执行终端设备永久标识的主鉴权流程之外，可能还会根据终端设备请求的Requested NSSAI以及终端设备的签约数据判断是否需要对 Requested NSSAI中的某一个S-NSSAI执行网络切片粒度的鉴权和授权流程(network slice specific authentication and authorization),该流程也可以简单称为网络切片的二次鉴权流程，或者简称为第二次鉴权流程。
根据现有的3GPP协议，当终端设备携带第一Requested NSSAI通过第一个接入技术(例如3GPP access type)注册到第一PLMN的时候，第一PLMN中的第一AMF网元为终端设备服务，并向终端设备发送适用于3GPP接入技术的Allowed NSSAI(Allowed NSSAI for3GPP access type)。Allowed NSSAI for 3GPP access type表示该终端设备的Allowed NSSAI中的每一个S-NSSAI只允许在3GPP access type下使用。
如果终端设备发现当前位置存在另一个PLMN，为了和第一PLMN进行区分，这里称另一个PLMN为第二PLMN，终端设备携带第二Requested NSSAI并通过第二个接入技术(例如non-3GPP access type)发起了注册流程，第二PLMN中的第二AMF网元为终端设备服务，并向终端设备发送适用于non-3GPP接入技术的Allowed NSSAI(Allowed NSSAI for non-3GPP access type)，Allowed NSSAI for non-3GPP access type表示该终端设备的Allowed NSSAI中的每一个S-NSSAI只允许在non-3GPP access type下使用。
如果Allowed NSSAI for 3GPP access type跟Allowed NSSAI for non-3GPP access type中包含了相同的S-NSSAI，这表示该S-NSSAI即可以在3GPP access type下使用，又可以在non-3GPP access type下使用。
如图2所示，为不同的PLMN场景下对同一个终端设备请求接入的同一个S-NSSAI重复鉴权的示意图，在图2所示的场景下，终端设备通过不同的接入技术接入不同的PLMN的核心网，比如，一种可以是通过3GPP标准组定义的无线技术接入第一PLMN的核心网络侧，另一种是non-3GPP接入技术通过N3IWF接入第二PLMN的核心网络侧。当终端设备先后分别通过不同的接入技术在第一PLMN和第二PLMN注册，且注册请求中携带的Requested NSSAI包含相同的、且需要鉴权的S-NSSAI，比如图2中所示的网络切片1，当该用于标识网络切片1的S-NSSAI已经在第一PLMN执行过network slice specific authentication and authorization流程，如果该S-NSSAI在第二PLMN重复鉴权的话，由于网络切片的鉴权流程与接入技术无关，导致针对同一个S-NSSAI重复鉴权，在图2所示的场景下，即对网络切片1重复鉴权，造成信令浪费。
为了解决这一问题，本申请提供了一种通信方法，解决针对同一个S-NSSAI重复鉴权，造成信令浪费的问题。
图3为本申请提供的一种通信方法300的流程示意图。
如图3所示，本申请提供的一种通信方法300，可以包括如下步骤：
301、第一网元从UDM网元获得第一终端设备的目标网络切片的第一鉴权状态。
第一终端设备通过第一PLMN接入目标网络切片时，第一网元从UDM网元获得第一终端设备的目标网络切片的第一鉴权状态。具体的，第一鉴权状态指示目标网络切片的第一鉴权结果，或者第一鉴权状态指示目标网络切片未执行过鉴权流程。其中，第一鉴权结果可以包括目标网络切片已经执行过鉴权流程且鉴权结果为成功，或者目标网络切片已经执行过鉴权流程且鉴权结果为失败。
302、第一网元根据第一鉴权状态确定是否对目标网络切片执行第一鉴权流程。
在一个具体的实施方式中，第一网元根据第一鉴权状态确定目标网络切片的第一鉴权结果时，第一网元对目标网络切片不执行第一鉴权流程，比如第一网元根据第一鉴权状态确定目标网络切片的第一鉴权结果为成功或失败时，第一网元对目标网络切片在第一PLMN不执行第一鉴权流程。其中，第一鉴权结果为第一终端设备通过第二PLMN接入目标网络切片时第二网元对目标网络切片的鉴权结果。
在一个具体的实施方式中，第一网元根据第一鉴权状态确定目标网络切片未执行过鉴权流程时，第一网元对目标网络切片执行第一鉴权流程。
在一个具体的实施方式中，第一网元根据第一鉴权状态对目标网络切片执行第一鉴权流程后，通知UDM网元该目标网络切片的第二鉴权状态，第二鉴权状态指示第一鉴权流程对应的第二鉴权结果。举例说明，第一终端设备通过第一PLMN接入目标网络切片时，假设目标网络切片包括第一目标网络切片和第二目标网络切片，第一网元根据从UDM网元获得第一终端设备的目标网络切片的第一鉴权状态，确定第一目标网络切片的鉴权结果为成功或者失败，确定第二目标网络切片未执行过鉴权流程，则第一网元对第一目标网络切片不执行鉴权流程，其中第一目标网络切片的鉴权结果为第一终端设备通过第二PLMN接入目标网络切片时第二网元对目标网络切片的鉴权结果。第一网元对第二目标网络切片在第一PLMN执行鉴权流程后通知UDM网元该第二目标网络切片的第二鉴权状态，当第一终端设备通过第二PLMN接入第二目标网络切片，第二网元需要对第二目标网络切片执行鉴权流程时，第二网元可以根据从UDM网元获得第一终端设备的第二目标网络切片的第二鉴权状态，该第二鉴权状态指示第二目标网络切片的鉴权结果，该鉴权结果为第一网元对第二目标网络切片的鉴权结果，则第二网元可以确定对第二网络切片不执行鉴权流程。
由方法300可知，第一网元根据第一鉴权状态确定是否对目标网络切片执行第一鉴权流程，避免针对同一个S-NSSAI重复发起网络切片鉴权流程，而导致终端设备跟核心网侧的信令浪费。
第一网元在不同的方案中可以是不同的网元，比如第一网元可以是AMF网元或者AUSF网元。其次，第一网元可以通过多种方式从UDM网元获得第一终端设备的目标网络切片的第一鉴权状态，比如可以包括，UDM网元可以根据第一网元发送的请求消息，通过响应消息向第一网元发送目标网络切片的鉴权状态，或者当第一网元为AMF网元时，UDM网元可以在向AMF网元发送终端设备的签约S-NSSAI消息中，携带目标网络切片的鉴权状态。此外，当第一网元对多个目标网络切片执行鉴权流程后可以一次将所有目标网络切片的鉴权结果发送给UDM网元，也可以分多次将目标网络切片的鉴权结果发送给UDM网元。以下将分别针对以上方案进行详细的说明。
图4为本申请提供的一种通信方法400的流程示意图。
如图4所示，本申请提供的一种通信方法400，可以包括如下步骤：
401、终端设备通过第一接入技术发起第一PLMN的注册流程。
终端设备在发起注册流程时携带Requested NSSAI，接入设备根据该NSSAI为终端选择合适的网络切片对应的AMF网元，进而转发注册请求给该AMF网元，由该AMF实体接收 注册请求并处理，图4中省略了第一接入技术对应的接入设备。第一AMF网元为终端设备提供服务。
402、UDM网元向第一AMF网元发送目标网络切片的鉴权状态。
在一种具体的实施方式中，第一AMF网元可以请求UDM网元发送终端设备的签约S-NSSAI，UDM网元根据第一AMF网元的请求，向第一AMF网元发送终端设备的签约S-NSSAI，同时向AMF网元发送目标网络切片的鉴权状态。示例性的，第一AMF网元可以调用UDM的服务化操作Nudm_SDM_Get获取终端设备的签约S-NSSAI。UDM网元通过Nudm_SDM_Get response向第一AMF网元发送终端设备的签约S-NSSAI，以及每一个签约的S-NSSAI是否需要执行鉴权的指示信息。UDM还可以通过Nudm_SDM_Get response向第一AMF网元发送需要执行鉴权的S-NSSAI是否已经执行Network Slice Specific Authentication and Authorization的指示信息，即向第一AMF网元发送需要执行鉴权的该S-NSSAI的鉴权状态。需要执行鉴权的S-NSSAI包含目标网络切片。示例性的，表1给出了一种UDM网元存储S-NSSAI信息可能方式。
表1：UDM网元存储的S-NSSAI信息
Figure PCTCN2020100555-appb-000001
在一种具体的实施方式中，UDM网元也可以在向第一AMF网元发送签约S-NSSAI之后，再根据第一AMF网元的请求，向第一AMF网元发送目标网络切片的鉴权状态。举例说明，第一AMF网元调用UDM网元的服务化操作Nudm_SDM_Get获取UE的签约S-NSSAI，其中，签约S-NSSAI包含指示信息，用于指示该S-NSSAI是否需要执行Network Slice Specific Authentication and Authorization。UDM网元通过Nudm_SDM_Get response向第一AMF网元发送终端设备的签约S-NSSAI，以及每一个签约的S-NSSAI是否需要执行鉴权的指示信息。第一AMF网元再调用UDM网元的服务化操作Nudm_UECM_Get request，并携带需要执行鉴权流程的S-NSSAI，向UDM网元查询该S-NSSAI的鉴权状态。UDM网元通过Nudm_UECM_Get response向第一AMF网元返回该S-NSSAI对应的鉴权状态。
403、第一AMF网元根据接收到的目标网络切片的鉴权状态确定是否对目标网络切片执行鉴权流程。
第一种情形：如果终端设备在发起第一PLMN注册流程时携带的Requested NSSAI中包含了需要执行Network Slice Specific Authentication and Authorization的S-NSSAI，且第一AMF网元通过UDM发送的鉴权状态指示该S-NSSAI已经执行过鉴权流程，则第一AMF网元不再对该S-NSSAI执行鉴权流程，需要说明的是，此处及以下的鉴权流程都是指二次鉴权流程，即network Slice Specific Authentication and Authorization。第一AMF网元根据该鉴权状态确定Allowed NSSAI。下面结合表1举例说明，假设终端设备发起第 一PLMN的注册流程时，携带的Requested NSSAI包括第一S-NSSAI和第四S-NSSAI，第一AMF网元通过UDM网元发送的鉴权状态获取到第一S-NSSAI已经执行过鉴权，第四S-NSSAI不需要执行鉴权，则第一AMF网元确定不需要对第一S-NSSAI和第四S-NSSAI执行鉴权，因为第一S-NSSAI的鉴权结果为成功，则第一AMF网元确定Allowed NSSAI包括第一S-NSSAI和第四S-NSSAI，即第一AMF网元确定允许终端设备接入第一S-NSSAI和第四S-NSSAI，或者若第一S-NSSAI的鉴权结果为失败，则第一AMF网元确定Allowed NSSAI只包括第四S-NSSAI，即第一AMF网元确定允许终端设备接入第四S-NSSAI，不允许终端设备接入第一S-NSSAI，在上述第一种情形中的例子中，第一S-NSSAI相当于是本申请的目标网络切片。
第二种情形：如果Requested NSSAI中包含了需要执行Network Slice Specific Authentication and Authorization的S-NSSAI，且第一AMF网元通过UDM发送的鉴权状态确定该S-NSSAI未执行过鉴权流程，则第一AMF网元针对每一个需要执行鉴权的S-NSSAI且未执行鉴权流程的S-NSSAI发起Network Slice Specific Authentication and Authorization流程。流程结束后，执行步骤404。结合表1举例说明，假设终端设备携带的Requested NSSAI包括第二S-NSSAI和第三S-NSSAI。第一AMF网元通过UDM网元发送的信息中获取到第二S-NSSAI和第三S-NSSAI的鉴权状态，即第二S-NSSAI和第三S-NSSAI均需要执行Network Slice Specific Authentication and Authorization，且第二S-NSSAI和第三S-NSSAI均未执行过鉴权流程。则第一AMF网元对第二S-NSSAI和第三S-NSSAI发起Network Slice Specific Authentication and Authorization流程，该Network Slice Specific Authentication and Authorization流程结束后，AMF网元继续执行步骤404。在上述第一种情形中的例子中，第二S-NSSAI和第三S-NSSAI相当于是本申请的目标网络切片。
404、Network Slice Specific Authentication and Authorization流程之后，第一AMF网元通知UDM网元该目标网络切片的鉴权状态。
举例说明，第一AMF网元对第二S-NSSAI和第三S-NSSAI执行Network Slice Specific Authentication and Authorization流程后，通知UDM网元第二S-NSSAI和第三S-NSSAI的鉴权状态，该鉴权状态指示第二S-NSSAI和第三S-NSSA鉴权结果。示例性的，一种可能的实现方式可以为第一AMF网元通过调用UDM网元的服务化操作Nudm_UECM_Update将S-NSSAI的鉴权结果存储在UDM网元中。
在一个具体的实施方式中，在执行Network Slice Specific Authentication and Authorization流程中，第一AMF网元可以从AUSF网元或者认证、授权和计费服务器(authentication、authorization、accounting server，AAA Server)接收S-NSSAI对应的定时器timer，或者第一AMF网元根据本地配置信息，确定S-NSSAI对应的定时器timer。第一AMF网元还可以将S-NSSAI的鉴权结果以及定时器timer存储在UDM网元中，定时器timer用于表示S-NSSAI的鉴权结果的有效期时长。示例性的，第一AMF网元可以通过调用UDM网元的服务化操作Nudm_UECM_Update将S-NSSAI的鉴权结果以及定时器timer存储在UDM网元中。当timer超时之后，该S-NSSAI的鉴权结果失效。可选地，UDM网元可以删除timer超时后的S-NSSAI的鉴权结果。示例性的，如果UDM网元只存储了 S-NSSAI的鉴权结果，没有对应的定时器timer，则说明该S-NSSAI的鉴权结果的有效性没有时间限制。在一个具体的实施方式中，当需要执行鉴权的S-NSSAI是多个时，当每个S-NSSAI的Network Slice Specific Authentication and Authorization流程结束之后，第一AMF网元可以将鉴权结果分多次发送给UDM网元也可以一次发送给UDM网元。比如第一AMF网元可以通过调用多次UDM的服务化操作Nudm_UECM_Update将该S-NSSAI的鉴权结果以及定时器timer存储在UDM网元中。例如，当第二S-NSSAI的Network Slice Specific Authentication and Authorization流程结束之后，第一AMF网元可以通过调用UDM的服务化操作Nudm_UECM_Update将该第二S-NSSAI的鉴权结果以及定时器timer存储在UDM网元。当第三S-NSSAI的Network Slice Specific Authentication and Authorization流程结束之后，第一AMF网元再次通过调用UDM网元的服务化操作Nudm_UECM_Update将该第三S-NSSAI的鉴权结果以及定时器timer存储在UDM网元中。需要说明的，本申请实施例并不对发送鉴权结果的次数进行限制，比如，目标网络切片包括N个网络切片，N为大于0的整数，UDM网元可以接收AMF网元发送的M次消息，M次消息用于更新UDM网元中目标网络切片的鉴权状态，M不大于N。举例说明，当需要执行鉴权的网络切片包括4个，第一AMF网元可以调用一次服务化操作Nudm_UECM_Update将4个网络切片的鉴权结果存储在UDM网元，或者第一AMF网元可以调用两次服务化操作Nudm_UECM_Update，其中，第一次用于将网络切片1和网络切片2对应的鉴权结果存储在UDM网元，第二次用于将网络切片3和网络切片4对应的鉴权结果存储在UDM网元。或者第一AMF网元可以调用3次服务化操作Nudm_UECM_Update，第一次用于将网络切片1和网络切片2对应的鉴权结果存储在UDM网元，第二次用于将网络切片3对应的鉴权结果存储在UDM网元，第三次用于将网络切片4对应的鉴权结果存储在UDM网元。
405、UDM网元获知相应的目标网络切片的鉴权状态。
举例说明，假设UDM网元通过第一AMF网元发送的目标网络切片的鉴权状态获知第二S-NSSAI的鉴权结果为成功，第三S-NSSAI的鉴权结果为失败，则UDM更新存储的信息，示例性的，对应于表1，表2给出了一种UDM网元更新后的S-NSSAI信息的可能方式。
表2：UDM网元更新后的S-NSSAI信息
Figure PCTCN2020100555-appb-000002
406、终端设备通过第二接入技术发起第二PLMN的注册流程。
终端设备在发起注册流程时携带Requested NSSAI，接入设备根据该NSSAI为终端选择合适的网络切片对应的AMF网元，进而转发注册请求给该AMF网元，由该AMF实体接收注册请求并处理，图4中省略了第二接入技术对应的接入设备。第二AMF网元为终端设备提供服务。
407、UDM网元向第二AMF网元发送S-NSSAI的鉴权状态。
在一种具体的实施方式中，第二AMF网元可以请求UDM网元发送终端设备的签约S-NSSAI，UDM网元根据第二AMF网元的请求，向第二AMF网元发送终端设备的签约S-NSSAI，同时向AMF网元发送目标网络切片的鉴权状态。具体的，可以参考步骤402中的关于第一AMF网元可以请求UDM网元发送终端设备的签约S-NSSAI，UDM网元根据第一AMF网元的请求，向第一AMF网元发送终端设备的签约S-NSSAI，同时向AMF网元发送目标网络切片的鉴权状态的描述进行理解，此处不再重复赘述。
在一种具体的实施方式中，UDM网元也可以在向第二AMF网元发送签约S-NSSAI之后，再根据第二AMF网元的请求，向第二AMF网元发送目标网络切片的鉴权状态。具体的，可以参考步骤402中的关于UDM网元也可以在向第一AMF网元发送签约S-NSSAI之后，再根据第一AMF网元的请求，向第一AMF网元发送目标网络切片的鉴权状态的描述进行理解，此处不再重复赘述。
408、第二AMF网元根据接收到的目标网络切片的鉴权状态确定是否对目标网络切片执行鉴权流程。
具体可以参考步骤403中第一AMF网元根据接收到的目标网络切片的鉴权状态确定是否对目标网络切片执行鉴权流程进行理解。这里为了说清楚不需要对已经执行过鉴权流程的网络切片重复鉴权，延续步骤403中的例子继续解释说明。假设终端设备发起第二PLMN的注册流程时，携带的Requested NSSAI包括第二S-NSSAI和第三S-NSSAI。第二AMF网元通过UDM发送的鉴权状态获取到第二S-NSSAI已经执行过鉴权，且鉴权结果为成功，第二AMF网元通过UDM网元发送的鉴权状态获取到第三S-NSSAI已经执行过鉴权，且鉴权结果为失败，其中，第二S-NSSAI和第三S-NSSAI的鉴权结果为第一AMF网元在第一PLMN对第二S-NSSAI和第三S-NSSAI执行鉴权流程后对应的结果，具体可以参考步骤404和405进行理解。则第二AMF网元确定在第二PLMN不再对第二S-NSSAI和第三S-NSSAI执行鉴权流程。第二AMF网元直接根据获取到的第二S-NSSAI和第三S-NSSAI的鉴权结果确定Allowed NSSAI，Allowed NSSAI只包括第二S-NSSAI。即第二AMF网元确定允许终端设备接入第二S-NSSAI，不允许终端设备接入第三S-NSSAI。
在一个具体的实施例中，如果该鉴权结果还对应有效时间，即定时器timer，第二AMF网元通过UDM网元发送的鉴权状态获取到第二S-NSSAI已经执行过鉴权，且鉴权结果为成功，同时，第二AMF网元从UDM中获取了第二S-NSSAI的鉴权状态对应的timer-1，且该鉴权结果依然在有效期，即timer-1未超时。第二AMF网元通过UDM网元发送的鉴权状态获取到第三S-NSSAI已经执行过鉴权，且鉴权结果为失败，同时，第二AMF网元从UDM网元中获取了第三S-NSSAI的鉴权状态对应的timer-2，且该鉴权结果依然在有效期，即timer-2未超时。其中，第二S-NSSAI和第三S-NSSAI的鉴权结果为第一AMF网元在第一PLMN对第二S-NSSAI和第三S-NSSAI执行鉴权流程后对应的结果，具体可以参考步骤404和405进行理解。则第二AMF网元确定在第二PLMN不再对第二S-NSSAI和第三S-NSSAI执行鉴权流程。第二AMF网元直接根据获取到的第二S-NSSAI和第三S-NSSAI的鉴权结果确定Allowed NSSAI，Allowed NSSAI包括第二S-NSSAI和第三S-NSSAI，即第二AMF网元确 定允许终端设备接入第二S-NSSAI和第三S-NSSAI。
当然，终端设备签约的S-NSSAI并不限于表1和表2中提到的4个S-NSSAI，第一S-NSSAI、第二S-NSSAI、第三S-NSSAI以及第四S-NSSAI并不代表对数量的限制，只是为了说明的方便。假设终端设备签约的S-NSSAI还包括第五S-NSSAI，终端设备发起第二PLMN的注册流程时，携带的Requested NSSAI还包括第五S-NSSAI，若该第五S-NSSAI需要执行二次鉴权流程且没有被执行过鉴权流程，则第二AMF网元对第五S-NSSAI执行鉴权流程后向UDM发送第五S-NSSAI的鉴权状态，UDM网元获知第五S-NSSAI的鉴权状态，具体的可以参考步骤404和405第一AMF网元通知UDM网元该目标网络切片的鉴权状态以及UDM网元获知相应的目标网络切片的鉴权状态进行理解，此处不再重复赘述。
方法400通过将网络切片的鉴权结果存在UDM网元中，具体的，由AMF网元将网络切片的鉴权结果存在UDM网元中，可以避免不同PLMN不同接入技术下的AMF网元针对同一个S-NSSAI重复发起网络切片鉴权流程，而导致终端设备跟核心网侧的信令浪费。
方法400中提到如果Requested NSSAI中包含了需要执行Network Slice Specific Authentication and Authorization的S-NSSAI，且该S-NSSAI未执行过鉴权流程，则第一AMF网元针对每一个需要执行鉴权的S-NSSAI发起Network Slice Specific Authentication and Authorization流程。具体的，当第一AMF网元决定触发Network Slice Specific Authentication and Authorization流程之后，第一AMF网元会通过AUSF网元与认证、授权和计费服务器(authentication、authorization、accounting server，AAA Server)交互传递终端设备的鉴权信息，如果AAA Server位于第三方，导致AUSF网元无法直接跟AAA Server交互的话，那么AUSF网元可以间接通过认证、授权和计费代理(authentication、authorization、accounting proxy，AAA proxy)与AAA Server交互。所以本申请实施例还提供另一种方法500，当第一AMF网元决定触发Network Slice Specific Authentication and Authorization流程之后，由AUSF网元向UDM网元发送查询请求消息，请求UDM网元发送目标网络切片的鉴权状态，以下将对这一方法进行具体的介绍。
图5为本申请提供的一种通信方法500的流程示意图。
如图5所示，本申请提供的一种通信方法500，可以包括如下步骤：
501、终端设备通过第一接入技术发起第一PLMN的注册流程。
终端设备在发起注册流程时携带Requested NSSAI，接入设备根据该NSSAI为终端选择合适的网络切片对应的AMF网元，进而转发注册请求给该AMF网元，由该AMF实体接收注册请求并处理，图5中省略了第一接入技术对应的接入设备。第一AMF网元为终端设备提供服务。
502、第一AMF网元接收UDM网元发送的终端设备的签约S-NSSAI。
示例性的，第一AMF网元可以调用UDM的服务化操作Nudm_SDM_Get获取终端设备的签约S-NSSAI。UDM网元通过Nudm_SDM_Get response向第一AMF网元发送终端设备的签约S-NSSAI，以及每一个S-NSSAI是否需要执行鉴权的指示信息。
503、第一AMF网元针对每一个需要执行鉴权的S-NSSAI发起Network Slice Specific  Authentication and Authorization流程。
如果终端设备在发起第一PLMN注册流程时携带的Requested NSSAI中包含了需要执行Network Slice Specific Authentication and Authorization的S-NSSAI，则第一AMF网元对该S-NSSAI执行二次鉴权流程。第一AMF向终端设备请求获取可扩展的鉴权协议标识(extensible authentication protocol，EAP ID)，并携带S-NSSAI，终端设备向第一AMF网元发送EAP ID。
504、第一AMF网元调用AUSF网元的服务化操作。
第一AMF网元调用AUSF网元的服务化操作，请求AUSF网元进行鉴权流程。示例性的，第一AMF网元可以调用Nausf_Communication_EAP MessageTransfer，请求AUSF网元进行鉴权流程，该服务化操作中可以携带EAP ID响应消息(EAP ID response)，AAA-S服务器的地址，通用公共用户标识(generic public subscription identifier，GPSI),第一AMF网元标识以及S-NSSAI。其中，GPSI可以是终端设备的外部标识，示例性的，该终端设备为手机时，该GPSI可以是手机号码或者电子邮箱。AAA-S服务器的地址可以预先配置在第一AMF网元上或者存储在UE的签约数据中，则第一AMF网元从UDM获取AAA-S服务器的地址。S-NSSAI是步骤503中的network slice specific authentication and authorization流程执行的网络切片标识。
505、UDM网元根据AUSF的请求，向AUSF网元发送目标网络切片的鉴权状态。
AUSF网元被触发进行鉴权流程时，可以先向UDM网元发送请求消息，请求UDM网元发送目标网络切片的鉴权状态，UDM网元可以向AUSF网元发送目标网络切片的鉴权状态。举例说明，AUSF网元调用UDM网元的服务化操作Nudm_UECM_Get request，并携带需要执行鉴权流程的S-NSSAI，向UDM网元查询该S-NSSAI的鉴权状态。UDM网元通过Nudm_UECM_Get response向AUSF网元返回该S-NSSAI对应的鉴权状态，具体的，该鉴权状态可以包括该S-NSSAI未执行过鉴权流程，或者该S-NSSAI已经执行过鉴权流程且鉴权结果为成功，或者该S-NSSAI已经执行过鉴权流程且鉴权结果为失败。
506、AUSF网元根据接收到的目标网络切片的鉴权状态确定是否对目标网络切片执行鉴权流程。
第一种情形：若AUSF网元根据目标S-NSSAI的鉴权状态获取到S-NSSAI的鉴权结果，则执行步骤507。
第二种情形：若AUSF网元根据目标S-NSSAI的鉴权状态确定S-NSSAI未执行过鉴权流程，则AUSF继续对该S-NSSAI执行鉴权流程，即AUSF网元执行步骤508至步骤509。
507、AUSF网元将从UDM网元获取到的S-NSSAI的鉴权结果向第一AMF网元发送。
如果AUSF网元从UDM网元获知S-NSSAI已经执行过鉴权流程以及对应的鉴权结果，那么说明该S-NSSAI已经执行过Network Slice Specific Authentication and Authorization流程，则无需重复执行network slice specific authentication and authorization procedure，AUSF网元将从UDM网元获取的该S-NSSAI的鉴权结果直接返回给第一AMF网元。第一AMF网元根据该鉴权结果确定Allowed NSSAI。
508、AUSF网元向AAA-S发送请求消息。
该请求消息用于请求AAA-S对该S-NSSAI执行Network Slice Specific Authentication and Authorization。
509、Network Slice Specific Authentication and Authorization流程之后，AUSF网元向UDM网元发送目标网络切片的鉴权状态。
比如，待Network Slice Specific Authentication and Authorization结束之后，AUSF网元可以通过调用UDM的服务化操作Nudm_UECM_Update将S-NSSAI的鉴权结果存储在UDM网元中。
在一个具体的实施方式中，在执行Network Slice Specific Authentication and Authorization流程中，AUSF网元可以从AAA-S接收S-NSSAI对应的定时器timer，或者AUSF网元根据本地配置信息，确定S-NSSAI对应的定时器timer。AUSF网元还可以将S-NSSAI的鉴权结果以及定时器timer向UDM网元发送，定时器timer用于表示S-NSSAI的鉴权结果的有效期时长。示例性的，AUSF网元可以通过调用UDM网元的服务化操作Nudm_UECM_Update将S-NSSAI的鉴权结果以及定时器timer存储在UDM网元中。当timer超时之后，该鉴权结果失效。可选地，UDM网元可以删除timer超时后的S-NSSAI的鉴权结果。示例性的，如果UDM网元只存储了S-NSSAI的鉴权结果，没有对应的定时器timer，则说明该S-NSSAI的鉴权结果的有效性没有时间限制。
在一个具体的实施方式中，当需要执行鉴权的S-NSSAI是多个时，当每个S-NSSAI的Network Slice Specific Authentication and Authorization流程结束之后，AUSF网元可以将鉴权结果分多次发送给UDM网元也可以一次发送给UDM网元。具体的可以参考方法400中步骤404中第一AMF网元可以将鉴权结果分多次发送给UDM网元也可以一次发送给UDM网元进行理解，此处不再重复赘述。
510、UDM网元获知相应的网络切片的鉴权状态。
UDM网元接收到AUSF网元发送的鉴权状态后，UDM网元更新相应的网络切片的鉴权状态。
511、终端设备通过第二接入技术发起第二PLMN的注册流程。
终端设备在发起注册流程时携带Requested NSSAI，接入设备根据该NSSAI为终端选择合适的网络切片对应的AMF网元，进而转发注册请求给该AMF网元，由该AMF实体接收注册请求并处理，图5中省略了第二接入技术对应的接入设备。第二AMF网元为终端设备提供服务。
512、第二AMF网元接收UDM网元发送的终端设备的签约S-NSSAI。
513、第二AMF网元针对每一个需要执行鉴权的S-NSSAI发起Network Slice Specific Authentication and Authorization流程。
514、第二AMF网元调用AUSF网元的服务化操作。
步骤512至步骤514可以参考步骤502至步骤504中第一AMF网元接收UDM网元发送的终端设备的签约S-NSSAI、第一AMF网元针对每一个需要执行鉴权的S-NSSAI发起Network Slice Specific Authentication and Authorization流程以及第一AMF网元调用AUSF网元的服务化操作进行理解，此处不再重复赘述。
515、UDM网元根据AUSF的请求，向AUSF网元发送目标网络切片的鉴权状态。
具体描述，参考步骤505。
516、AUSF网元根据接收到的目标网络切片的鉴权状态确定是否对目标网络切片执行鉴权流程。
第一种情形：若AUSF网元根据目标S-NSSAI的鉴权状态获取到S-NSSAI的鉴权结果，则执行步骤517。
第二种情形：若AUSF网元根据目标S-NSSAI的鉴权状态确定S-NSSAI未执行过鉴权流程，则AUSF继续对该S-NSSAI执行鉴权流程，即AUSF执行步骤518至步骤519。
517、AUSF网元将从UDM网元获取到的S-NSSAI的鉴权结果向第二AMF网元发送。
518、AUSF网元向AAA-S发送请求消息。
519、Network Slice Specific Authentication and Authorization流程之后，AUSF网元向UDM网元发送目标网络切片的鉴权状态。
520、UDM网元获知相应的网络切片的鉴权状态。
步骤515至步骤520可以参考步骤505至510进行理解，此处不再重复赘述。
方法500通过将网络切片的鉴权结果存在UDM网元中，具体的，由AUSF网元将网络切片的鉴权结果存在UDM网元中，可以避免不同PLMN不同接入技术下的AMF网元针对同一个S-NSSAI重复发起网络切片鉴权流程，而导致终端设备跟核心网侧的信令浪费。
需要说明的是，可能存在AUSF网元同时接收到两个AMF网元发送的鉴权请求，比如在一个具体的实施方式中，当UE通过第一接入技术注册到第一PLMN时，AUSF网元接收第一PLMN的第一AMF网元发送的第一消息，第一消息用于请求对目标网络切片执行第一鉴权流程，当AUSF网元对目标网络切片执行第一鉴权流程中，UE通过第二接入技术注册到第二PLMN，AUSF网元接收第二PLMN的第二AMF网元发送的第二消息，第二消息用于请求对目标网络切片执行第二鉴权流程，则AUSF网元可以向第二AMF网元发送指示信息，指示信息用于指示第二鉴权流程被挂起。在AUSF网元获知目标网络切片的鉴权结果之后，AUSF网元向第二AMF网元发送目标网络切片的鉴权结果。
针对当终端设备先后通过不同的接入技术分别在第一PLMN和第二PLMN注册，Requested NSSAI包含相同的且需要鉴权的S-NSSAI，当该S-NSSAI已经在第一PLMN鉴权过，如何优化该S-NSSAI在第二PLMN鉴权流程，方法400和方法500分别给出了两种方法，如图6所示，以第一AMF为例进行说明，方法400，注册流程中，如果第一AMF网元判断Requested NSSAI包括某个S-NSSAI，且该S-NSSAI需要执行鉴权，则该第一AMF网元首先从UDM网元获取该S-NSSAI的鉴权状态，如果该S-NSSAI之前执行过鉴权流程，则AMF网元直接根据鉴权结果确定终端设备的Allowed NSSAI。方法500在注册流程中，如果第一AMF网元判断Requested NSSAI包括某个S-NSSAI，且该S-NSSAI需要执行鉴权，在鉴权流程中，则AUSF网元从UDM网元获取该S-NSSAI的鉴权状态，如果该S-NSSAI之前执行过鉴权流程，AUSF网元直接将鉴权结果返回给AMF网元，触发AMF网元根据鉴权结果确定终端设备的Allowed NSSAI。
方法400和方法500在具体的实现过程中，可能存在S-NSSAI的签约信息改变的场景， 比如，当第一PLMN和第二PLMN的Allowed NSSAI均包含了某个相同的S-NSSAI，如果该S-NSSAI从不需要network slice specific authentication and authorization procedure改为需要执行network slice specific authentication and authorization procedure，那么UDM网元向两个AMF网元下发新的签约信息之后，两个AMF网元会针对同一个S-NSSAI分别执行network slice specific authentication and authorization procedure，导致核心网传递鉴权所需的信令十分冗余，下面针对这一问题进行详细的说明。
图7为本申请提供的一种通信方法700的流程示意图。
如图7所示，本申请提供的一种通信方法700，可以包括如下步骤：
701、UDM网元向第一AMF网元发送终端设备的签约数据。
702、UDM网元向第二AMF网元发送终端设备的签约数据。
在方法400和方法500中，当终端设备发起注册流程时，UDM网元向AMF网元发送终端设备的签约数据，具体的，可以分别向第一AMF网元和第二AMF网元发送终端设备的签约S-NSSAI以及S-NSSAI的鉴权状态，假设在某个时刻，终端设备的签约信息发生了改变，由于UDM网元中存储了两个不同的AMF网元的标识，所以UDM网元需要分别向第一AMF网元和第二AMF网元发送终端设备的签约数据。为了区分，将第一次发送的签约数据称为旧签约数据，将后来更改的签约信息称为新签约数据。示例性的，UDM网元可以通过调用Nudm_SDM_Notification分别向第一AMF网元和第二AMF网元发送终端设备的签约数据。终端设备的签约数据包含了终端设备签约的S-NSSAI，以及该S-NSSAI是否需要执行Network Slice Specific Authentication and Authorization的指示信息。
703、第一AMF网元对目标网络切片执行二次鉴权流程。
第一AMF网元判断获取的新签约里面，某个S-NSSAI从不需要network slice specific authentication and authorization procedure改为需要执行network slice specific authentication and authorization procedure，且需要执行Network Slice Specific Authentication and Authorization的S-NSSAI在当前Allowed NSSAI里面。则第一AMF网元针对该S-NSSAI发起二次鉴权流程，并向终端设备请求获取EAP ID。举例说明，假设终端设备在发起第一PLMN注册流程时携带Requested NSSAI，其中假设Requested NSSAI包括第一S-NSSAI，第二S-NSSAI，第三S-NSSAI和第四S-NSSAI，接入设备根据该NSSAI为终端选择合适的网络切片对应的AMF网元，假设第一AMF网元为终端设备提供服务。第一AMF网元从UDM网元处获取到第一S-NSSAI，第二S-NSSAI需要执行二次鉴权流程，第三S-NSSAI和第四S-NSSAI不需要执行二次鉴权流程。此外，第一AMF网元还从UDM网元处获取到第一S-NSSAI已经执行过鉴权流程，且鉴权结果为成功，第二S-NSSAI未执行过鉴权流程，则第一AMF网元不再对第一S-NSSAI重新鉴权，第一AMF网元确定Allowed NSSAI包括第一S-NSSAI，第三S-NSSAI和第四S-NSSA并发送至终端设备，若第一AMF网元对第二S-NSSAI执行鉴权流程后，鉴权结果为成功，则第一AMF网元更新Allowed NSSAI包括第一S-NSSAI，第二S-NSSAI，第三S-NSSAI和第四S-NSSA，若第一AMF网元对第二S-NSSAI执行鉴权流程后，鉴权结果为失败，则第一AMF网元无需更新Allowed NSSAI。假设在某个时刻，第一AMF网元接收到UDM网元发送的终端设备的新签约数据，指示终端设备的签 约S-NSSAI包括第二S-NSSAI，第三S-NSSAI以及第四S-NSSAI，其中，第二S-NSSAI和第三S-NSSAI需要执行二次鉴权流程，第四S-NSSAI不需要执行鉴权流程，可以看出第二S-NSSAI从不需要执行network slice specific authentication and authorization procedure改为需要执行network slice specific authentication and authorization procedure，并且当前的Allowed NSSAI包括第二S-NSSAI，则第一AMF网元需要对第二S-NSSAI执行二次鉴权流程。具体的，跳转到执行步骤704。
704、第一AMF网元调用AUSF网元的服务化操作。
第一AMF网元调用AUSF网元的服务化操作，请求AUSF网元进行鉴权流程。示例性的，第一AMF网元可以调用Nausf_Communication_EAP MessageTransfer，请求AUSF网元进行鉴权流程，该服务化操作中可以携带EAP ID响应消息(EAP ID response)，AAA-S服务器的地址，通用公共用户标识(generic public subscription identifier，GPSI),第一AMF网元标识以及S-NSSAI。其中，GPSI可以是终端设备的外部标识，示例性的，该终端设备为手机时，该GPSI可以是手机号码或者电子邮箱。AAA-S服务器的地址可以预先配置在AMF网元上。S-NSSAI是步骤703中的network slice specific authentication and authorization流程执行的网络切片标识。
705、AUSF网元向AAA-S发送请求消息，请求AAA-S对目标网络切片执行二次鉴权流程。
步骤703至步骤705中，第一AMF网元执行二次鉴权的流程可以参考上述方法400或方法500中的步骤，此处不再重复赘述。
706、在第一AMF网元发起的鉴权流程结束之前，第二AMF网元对目标网络切片执行二次鉴权流程。
第二AMF网元对目标网络切片执行二次鉴权流程可以参考步骤703中第一AMF网元对目标网络切片执行二次鉴权流程进行理解，此处不再重复赘述。需要说明的是，需要说明的是，需要执行鉴权的S-NSSAI同时包含在两个不同接入技术对应的Allowed NSSAI里面。因此第一AMF跟第二AMF会分别发起同一个S-NSSAI的Network Slice Specific Authentication and Authorization流程。
707、第二AMF网元调用AUSF网元的服务化操作。
第二AMF网元调用AUSF网元的服务化操作，请求AUSF网元进行鉴权流程。示例性的，第二AMF网元可以调用Nausf_Communication_EAP MessageTransfer，请求AUSF网元进行鉴权流程，该服务化操作中可以携带EAP ID响应消息(EAP ID response)，AAA-S服务器的地址，通用公共用户标识(generic public subscription identifier，GPSI),第二AMF网元标识以及S-NSSAI。其中，GPSI可以是终端设备的外部标识，示例性的，该终端设备为手机时，该GPSI可以是手机号码或者电子邮箱。AAA-S服务器的地址可以预先配置在AMF网元上。S-NSSAI是步骤706中的network slice specific authentication and authorization流程执行的网络切片标识。步骤704中的AUSF网元与步骤707中的AUSF网元为位于归属公共陆地移动网(home public land mobile network，HPLMN)中的AUSF网元。
708、AUSF网元将第二AMF网元发起的目标网络切片的鉴权流程挂起。
AUSF网元判断在第一AMF网元发起的鉴权流程结束之前，AUSF网元根据707步骤中第二AMF网元发送的GPSI和S-NSSAI获知第二AMF网元发起的是对同一个终端设备的同一个S-NSSAI的鉴权流程，则AUSF网元触发第二AMF网元将目标网络切片的鉴权流程挂起。
在一个具体的实施方式中，还可以包括：
709、AUSF网元向第二AMF网元发送指示信息。
该指示信息用于指示第二AMF网元步骤706中第二AMF网元发起的该S-NSSAI的二次鉴权流程暂时处于挂起状态。
710、第一AMF网元发起的鉴权流程结束后，AUSF网元将鉴权结果向第二AMF网元发送。
在一个具体的实施方式中，根据方法400和方法500可知，第一AMF网元发起的鉴权流程结束后，第一AMF或者AUSF网元还可以将该鉴权结果发送到UDM网元中。
在方法700中，AUSF网元获知鉴权结果后，还可以向第二AMF网元发送该鉴权结果。
711、第二AMF网元根据该鉴权结果确定Allowed NSSAI。
举例说明，在步骤703的例子中，第一AMF网元需要对第二S-NSSAI执行二次鉴权流程，假设步骤706中，第二AMF网元也对第二S-NSSAI执行二次鉴权流程，则假设第一AMF网元先调用AUSF网元的服务化操作，则当第二AMF网元调用AUSF网元的服务化操作时，AUSF确定第二AMF网元发起的是对同一个终端设备的同一个S-NSSAI的鉴权流程，即都是对同一个终端设备的第二S-NSSAI的鉴权流程，则AUSF网元将第二AMF网元对第二S-NSSAI的鉴权流程挂起，当第一AMF网元发起的对第二S-NSSAI的鉴权流程结束后，AUSF网元直接将该第二S-NSSAI的鉴权流程对应的结果发送给第二AMF网元，第二AMF网元根据该鉴权结果确定终端设备在第二PLMN的Allowed NSSAI，比如当第一AMF网元发起的对第二S-NSSAI的鉴权流程对应的鉴权结果为成功，则第二AMF网元根据该鉴权结果确定终端设备在第二PLMN的Allowed NSSAI包括第二S-NSSAI，当第一AMF网元发起的对第二S-NSSAI的鉴权流程对应的鉴权结果为失败，则第二AMF网元根据该鉴权结果确定终端设备在第二PLMN的Allowed NSSAI不包括第二S-NSSAI。
方法700通过AUSF网元判断第二个鉴权流程是否针对的是同一个S-NSSAI，如果是，则将其中一个接入技术下的网络切片鉴权流程处于挂起状态，即第二个鉴权流程挂起，可以避免不同接入技术下的AMF网元针对同一个S-NSSAI重复发起网络切片鉴权流程，而导致终端设备跟核心网侧的信令浪费。需要说明的是，在一些具体的应用场景中，也可以由AAA-S判断鉴权流程是否针对的是同一个S-NSSAI，针对这一场景，下面进行具体的介绍。
图8为本申请提供的一种通信方法800的流程示意图。
如图8所示，本申请提供的一种通信方法800，可以包括如下步骤：
801、UDM网元向第一AMF网元发送终端设备的签约数据。
802、UDM网元向第二AMF网元发送终端设备的签约数据。
803、第一AMF网元对目标网络切片执行二次鉴权流程。
804、第一AMF网元调用AUSF网元的服务化操作。
805、AUSF网元向AAA-S发送请求消息，请求AAA-S对目标网络切片执行二次鉴权流程。
806、在第一AMF网元发起的鉴权流程结束之前，第二AMF网元对目标网络切片执行二次鉴权流程。
807、第二AMF网元调用AUSF网元的服务化操作。
步骤801至步骤807可以参考方法700中步骤701至步骤707进行理解，此处不再重复赘述。
808、AUSF网元向AAA-S发送请求消息，请求AAA-S对目标网络切片执行二次鉴权流程。
809、AAA-S触发AUSF网元将第二AMF网元发起的目标网络切片的鉴权流程挂起。
AAA-S判断在AUSF网元发起的鉴权流程结束之前，AUSF网元发起的是对同一个终端设备的同一个S-NSSAI的鉴权流程，则AAA-S触发AUSF网元将目标网络切片的鉴权流程挂起。
在一个具体的实施方式中，还可以包括：
810、AUSF网元向第二AMF网元发送指示信息。
该指示信息用于指示第二AMF网元步骤806中第二AMF网元发起的该S-NSSAI的二次鉴权流程暂时处于挂起状态。
811、第一AMF网元发起的鉴权流程结束后，AUSF网元向第二AMF网元发送该鉴权结果。
812、第二AMF网元根据该鉴权结果确定Allowed NSSAI。
步骤811和步骤812可以参考方法700中的步骤710和步骤711进行理解，此处不再重复赘述。
方法800通过AAA-S判断第二个鉴权流程是否针对的是同一个S-NSSAI，如果是，则触发AUSF网元将其中一个接入技术下的网络切片鉴权流程处于挂起状态，即第二个鉴权流程挂起，可以避免不同接入技术下的AMF网元针对同一个S-NSSAI重复发起网络切片鉴权流程，而导致终端设备跟核心网侧的信令浪费。
当第一PLMN和第二PLMN-2的Allowed NSSAI均包含了某个相同的S-NSSAI，如果S-NSSAI的签约信息改变，比如该S-NSSAI从不需要network slice specific authentication and authorization procedure改为需要执行network slice specific authentication and authorization procedure，那么UDM网元向两个AMF网元下发新的签约信息之后，两个AMF网元会针对同一个S-NSAI分别执行network slice specific authentication and authorization procedure，导致核心网传递鉴权所需的信令十分冗余。方法700和方法800分别给出了两种方法，如图9所示，假设图9中所示的从终端设备经过第一AMF网元、AUSF网元到AAA-S的路径表示经过第一AMF网元执行的鉴权流程，以下简称为第一个鉴权流程，在第一个鉴权流程结束之前，如果AUSF网元或AAA-S又从第二AMF网元收到了针对同一个终端设备同一个S-NSSAI的鉴权请求，以下简称为第二个鉴权流程，则AUSF网元将第二个鉴权流程挂起，或者AAA-S触发AUSF网元将第二个流程挂起，直至第一个鉴权流程结束后，AUSF网元根据第一个鉴权流程的结果，直接向第二AMF 返回该S-NSSAI鉴权结果，减少信令交互。
上述主要从第一网元、AMF网元、AUSF网元、AAA-S以及UDM网元之间交互的角度对本申请实施例提供的方案进行了介绍。可以理解的是，上述第一网元、AMF网元、AUSF网元、AAA-S以及UDM网元为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本文中所公开的实施例描述的各示例的模块及算法步骤，本申请能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
从硬件结构上来描述，图3至图9中的第一网元、AMF网元、AUSF网元、AAA-S以及UDM网元可以由一个实体设备实现，也可以由多个实体设备共同实现，还可以是一个实体设备内的一个逻辑功能模块，本申请实施例对此不作具体限定。
例如，第一网元、AMF网元、AUSF网元、AAA-S以及UDM网元可以通过图10中的通信设备来实现。图10所示为本申请实施例提供的通信设备的硬件结构示意图。包括：通信接口1001和处理器1002，还可以包括存储器1003。
通信接口1001可以使用任何收发器一类的装置，用于与其他设备或通信网络通信。
处理器1002包括但不限于中央处理器(central processing unit，CPU)，网络处理器(network processor，NP)，专用集成电路(application-specific integrated circuit，ASIC)或者可编程逻辑器件(programmable logic device，PLD)中的一个或多个。上述PLD可以是复杂可编程逻辑器件(complex programmable logic device，CPLD)，现场可编程逻辑门阵列(field-programmable gate array，FPGA)，通用阵列逻辑(generic array logic,GAL)或其任意组合。处理器1002负责通信线路1004和通常的处理，还可以提供各种功能，包括定时，外围接口，电压调节，电源管理以及其他控制功能。存储器1003可以用于存储处理器1002在执行操作时所使用的数据。
存储器1003可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其他类型的动态存储设备，也可以是电可擦可编程只读存储器(electrically er服务器able programmable read-only memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器可以是独立存在，通过通信线路1004与处理器1002相连接。存储器1003也可以和处理器1002集成在一起。如果存储器1003和处理器1002是相互独立的器件，存储器1003和处理器1002相连，例如存储器1003和处理器1002可以通过通信线路通信。通信接口1001和处理器1002可以通过通信线路通信，通信接口1001也可以与处理器1002直连。
通信线路1004可以包括任意数量的互联的总线和桥，通信线路1004将包括由处理器 1002代表的一个或多个处理器1002和存储器1003代表的存储器的各种电路链接在一起。通信线路1004还可以将诸如外围设备、稳压器和功率管理电路等之类的各种其他电路链接在一起，这些都是本领域所公知的，因此，本申请不再对其进行进一步描述。
在一个具体的实施方式中，当该通信设备为第一网元时，可以包括：
存储器，用于存储计算机可读指令。
和与存储器耦合的通信接口，通信接口用于执行以下操作：
从用户数据管理功能UDM网元获得终端设备的目标网络切片的第一鉴权状态，第一鉴权状态指示目标网络切片的第一鉴权结果，或者第一鉴权状态指示目标网络切片未执行过鉴权流程；
处理器，处理器与通信接口耦合，用于根据通信接口获得的第一鉴权状态确定是否对目标网络切片执行第一鉴权流程。
在一个具体的实施方式中，处理器具体用于：根据通信接口获得的第一鉴权状态确定目标网络切片的第一鉴权结果时，对目标网络切片不执行鉴权流程；或者根据通信接口获得的第一鉴权状态确定目标网络切片未执行过鉴权流程时，第一网元对目标网络切片执行第一鉴权流程。
可选地，通信接口，还用于通知UDM网元目标网络切片的第二鉴权状态，第二鉴权状态指示第一鉴权流程对应的第二鉴权结果。
可选地，通信接口，还用于通知UDM网元目标网络切片的第二鉴权状态的有效时间。
在一个具体的实施方式中，第一网元为移动性管理功能AMF网元时，通信接口，还用于获知终端设备请求接入目标网络切片。
可选地，处理器，具体用于：若根据通信接口获得的第一鉴权状态确定目标网络切片的第一鉴权结果为成功时，对目标网络切片不执行第一鉴权流程且确定允许终端设备接入目标网络切片；或者若根据通信接口获得的第一鉴权状态确定目标网络切片的第一鉴权结果为失败时，对目标网络切片不执行第一鉴权流程且确定不允许终端设备接入目标网络切片。
可选地，通信接口，具体用于：请求UDM网元发送签约数据；接收UDM网元发送的签约数据和目标网络切片的第一鉴权状态。
可选地，通信接口，具体用于：向UDM网元发送请求消息，请求消息用于查询目标网络切片的第一鉴权状态；接收UDM网元发送的响应消息，响应消息指示目标网络切片的第一鉴权状态。
在一个具体的实施方式中，第一网元为鉴权服务器功能AUSF网元时，通信接口，从用户数据管理功能UDM网元获得终端设备的目标网络切片的第一鉴权状态之前，还用于接收第一移动性管理功能AMF网元发送的第一消息，第一消息用于请求执行第一鉴权流程。
可选地，处理器，具体用于若根据第一鉴权状态确定目标网络切片的第一鉴权结果为成功或失败时，确定不对目标网络切片执行第一鉴权流程且向第一AMF网元发送目标网络切片的第一鉴权结果。
可选地，通信接口，具体用于：向UDM网元发送请求消息，请求消息用于查询目标网 络切片的第一鉴权状态；接收UDM网元发送的响应消息，响应消息指示目标网络切片的第一鉴权状态。
可选地，通信接口，还用于在处理器对目标网络切片执行第一鉴权流程中，接收第二移动性管理功能AMF网元发送的第二消息，第二消息用于请求对第一终端设备的目标网络切片执行第二鉴权流程；通信接口，还用于向第二AMF网元发送指示信息，指示信息用于指示第二鉴权流程被挂起；通信接口，还用于获知目标网络切片的第二鉴权结果之后，向第二AMF网元发送目标网络切片的第二鉴权结果。
在一个具体的实施方式中，该通信设备为UDM网元时，可以包括：
存储器，用于存储计算机可读指令。
和与存储器耦合的通信接口，通信接口用于执行以下操作：
获知终端设备的目标网络切片的第一鉴权状态，第一鉴权状态指示目标网络切片的第一鉴权结果，或者第一鉴权状态指示目标网络切片未执行过鉴权流程；
向第一网元发送第一鉴权状态。
可选地，通信接口，具体用于接收第二网元发送的第一鉴权状态，第二网元是终端设备通过第一公用陆地移动网PLMN接入目标网络切片时，为终端设备提供服务的第三移动性管理功能AMF网元，第一鉴权状态为第二网元对目标网络切片执行的第三鉴权流程对应的第一鉴权结果。
可选地，通信接口，具体用于接收第三网元发送的第一鉴权状态，第三网元是终端设备通过第一公用陆地移动网PLMN接入目标网络切片时，为终端设备提供服务的鉴权服务器功能AUSF网元，第一鉴权状态为第四网元对目标网络切片执行的第三鉴权流程对应的第一鉴权结果。
可选地，第一网元是终端设备通过第二公用陆地移动网PLMN接入目标网络切片时，为终端设备提供服务的第一移动性管理功能AMF网元或为终端设备提供服务的鉴权服务器功能AUSF网元时，通信接口，还用于：接收第一网元发送的请求消息，请求消息用于查询目标网络切片的第一鉴权状态；通信接口，具体用于向第一网元发送响应消息，响应消息指示目标网络切片的第一鉴权状态。
可选地，第一网元是终端设备通过第二公用陆地移动网PLMN接入目标网络切片时，为终端设备提供服务的第一移动性管理功能AMF网元时，通信接口，还用于接收第一网元发送的请求消息，请求消息用于请求签约数据；通信接口，具体用于向第一网元发送签约数据和目标网络切片的第一鉴权状态。
可选地，通信接口，还用于接收目标网络切片的第一鉴权状态的有效时间。
在一种具体的实施方式中，该通信设备为AUSF网元时，还可以包括：
通信接口，用于接收第一网元发送的第一鉴权请求消息，第一鉴权请求消息用于请求第三网元对终端设备接入的第一网络切片执行第一鉴权流程；
在第一鉴权流程结束之前，通信接口，还用于接收第二网元发送的第二鉴权请求消息，第二鉴权请求消息用于请求第三网元对终端设备接入的第一网络切片执行第二鉴权流程；
通信接口，还用于向第二网元发送指示信息，指示信息用于指示第二鉴权流程被挂起；
通信接口，还用于获取第一鉴权流程的第一鉴权结果，并向第二网元发送第一鉴权流程的第一鉴权结果。第一网元为位于第一PLMN中的第一移动性管理功能AMF网元，第二网元为位于第二PLMN中的第二移动性管理功能AMF网元。
在一种具体的实施方式中，该通信设备为AAA-S时，还可以包括：
通信接口，用于接收第一网元发送的第一鉴权请求消息，第一鉴权请求消息用于请求第三网元对终端设备接入的第一网络切片执行第一鉴权流程；
在第一鉴权流程结束之前，通信接口，还用于接收第二网元发送的第二鉴权请求消息，第二鉴权请求消息用于请求第三网元对终端设备接入的第一网络切片执行第二鉴权流程；
通信接口，还用于向第二网元发送指示信息，指示信息用于指示第二鉴权流程被挂起；
通信接口，还用于获取第一鉴权流程的第一鉴权结果，并向第二网元发送第一鉴权流程的第一鉴权结果。第一网元和第二网元为位于归属公共陆地移动网络HPLMN中的鉴权服务器功能AUSF网元。
在本申请实施例中，可以将第一网元、AMF网元、AUSF网元、AAA-S以及UDM网元的通信接口视为收发单元，将第一网元、AMF网元、AUSF网元、AAA-S以及UDM网元的具有处理功能的处理器视为处理单元，将第一网元、AMF网元、AUSF网元、AAA-S以及UDM网元的存储器视为存储单元。
如图11所示，第一网元可以包括收发单元1110和处理单元1120。收发单元也可以称为收发器、收发机、收发装置等。处理单元也可以称为处理器，处理单板，处理模块、处理装置等。可选的，可以将收发单元1110中用于实现接收功能的器件视为接收单元，将收发单元1110中用于实现发送功能的器件视为发送单元，即收发单元1110包括接收单元和发送单元。收发单元有时也可以称为收发机、收发器、或收发电路等。接收单元有时也可以称为接收机、接收器、或接收电路等。发送单元有时也可以称为发射机、发射器或者发射电路等。
在一个具体的实施方式中，收发单元1110用于执行图3中的步骤301中第一网元侧的收发操作，和/或收发单元1110还用于执行图3对应的实施例中第一网元侧的其他收发步骤。处理单元1120用于执行图3中的步骤302中第一网元侧的处理操作，和/或处理单元1120还用于执行图3对应的实施例中第一网元侧的其他处理步骤。
如图12所示，AMF网元可以包括收发单元1210和处理单元1220。收发单元也可以称为收发器、收发机、收发装置等。处理单元也可以称为处理器，处理单板，处理模块、处理装置等。可选的，可以将收发单元1210中用于实现接收功能的器件视为接收单元，将收发单元1210中用于实现发送功能的器件视为发送单元，即收发单元1210包括接收单元和发送单元。收发单元有时也可以称为收发机、收发器、或收发电路等。接收单元有时也可以称为接收机、接收器、或接收电路等。发送单元有时也可以称为发射机、发射器或者发射电路等。
在一个具体的实施方式中，收发单元1210可以用于执行图4中的步骤401、402、404、406和407中第一AMF网元或第二AMF网元侧的收发操作，和/或收发单元1210还用于执行图4对应的实施例中第一AMF网元或第二AMF网元侧的其他收发步骤，处理单元1220用 于执行图4中的步骤403和408中第一AMF网元或第二AMF网元侧的处理操作，和/或处理单元1220还用于执行图4对应的实施例中第一AMF网元或第二AMF网元侧的其他处理步骤。
在一个具体的实施方式中，收发单元1210可以用于执行图5中的步骤501、502、504、507、511、512、514以及517中第一AMF网元或第二AMF网元侧的收发操作，和/或收发单元1210还用于执行图5对应的实施例中第一AMF网元或第二AMF网元侧的其他收发步骤，处理单元1220用于执行图5中的步骤503和513中第一AMF网元或第二AMF网元侧的处理操作，和/或处理单元1220还用于执行图5对应的实施例中第一AMF网元或第二AMF网元侧的其他处理步骤。
在一个具体的实施方式中，收发单元1210可以用于执行图7中的步骤701、702、704、707、709、以及710中第一AMF网元或第二AMF网元侧的收发操作，和/或收发单元1210还用于执行图7对应的实施例中第一AMF网元或第二AMF网元侧的其他收发步骤，处理单元1220用于执行图7中的步骤703和711中第一AMF网元或第二AMF网元侧的处理操作，和/或处理单元1220还用于执行图7对应的实施例中第一AMF网元或第二AMF网元侧的其他处理步骤。
在一个具体的实施方式中，收发单元1210可以用于执行图8中的步骤801、802、804、807、808、810以及811中第一AMF网元或第二AMF网元侧的收发操作，和/或收发单元1210还用于执行图8对应的实施例中第一AMF网元或第二AMF网元侧的其他收发步骤，处理单元1220用于执行图8中的步骤803和812中第一AMF网元或第二AMF网元侧的处理操作，和/或处理单元1220还用于执行图8对应的实施例中第一AMF网元或第二AMF网元侧的其他处理步骤。
如图13所示，UDM网元可以包括收发单元1310和处理单元1320。收发单元也可以称为收发器、收发机、收发装置等。处理单元也可以称为处理器，处理单板，处理模块、处理装置等。可选的，可以将收发单元1310中用于实现接收功能的器件视为接收单元，将收发单元1310中用于实现发送功能的器件视为发送单元，即收发单元1310包括接收单元和发送单元。收发单元有时也可以称为收发机、收发器、或收发电路等。接收单元有时也可以称为接收机、接收器、或接收电路等。发送单元有时也可以称为发射机、发射器或者发射电路等。
在一个具体的实施方式中，收发单元1310用于执行图3中的步骤301中UDM网元侧的收发操作，和/或收发单元1310还用于执行图3对应的实施例中UDM网元侧的其他收发步骤。
在一个具体的实施方式中，收发单元1310用于执行图4中的步骤401、405中UDM网元侧的收发操作，和/或收发单元1310还用于执行图4对应的实施例中UDM网元侧的其他收发步骤。处理单元1320用于执行图4中的步骤405中UDM网元侧的处理操作，和/或处理单元1320还用于执行图4对应的实施例中UDM网元侧的其他处理步骤。存储单元1330用于执行图4中的步骤405中UDM网元侧的存储/更新操作。和/或存储单元1330还用于执行图4对应的实施例中UDM网元侧的其他存储步骤。
在一个具体的实施方式中，收发单元1310用于执行图5中的步骤502、505、509、510、 512以及519、520中UDM网元侧的收发操作，和/或收发单元1310还用于执行图5对应的实施例中UDM网元侧的其他收发步骤。处理单元1320用于执行图5中的步骤510、520中UDM网元侧的处理操作，和/或处理单元1320还用于执行图5对应的实施例中UDM网元侧的其他处理步骤。存储单元1330用于执行图5中的步骤510、520中UDM网元侧的存储/更新操作。和/或存储单元1330还用于执行图5对应的实施例中UDM网元侧的其他存储步骤。
在一个具体的实施方式中，收发单元1310用于执行图7中的步骤701、702中UDM网元侧的收发操作，和/或收发单元1310还用于执行图7对应的实施例中UDM网元侧的其他收发步骤。
在一个具体的实施方式中，收发单元1310用于执行图8中的步骤801、802中UDM网元侧的收发操作，和/或收发单元1310还用于执行图8对应的实施例中UDM网元侧的其他收发步骤。
如图14所示，AUSF网元可以包括收发单元1410和处理单元1420。收发单元也可以称为收发器、收发机、收发装置等。处理单元也可以称为处理器，处理单板，处理模块、处理装置等。可选的，可以将收发单元1410中用于实现接收功能的器件视为接收单元，将收发单元1410中用于实现发送功能的器件视为发送单元，即收发单元1410包括接收单元和发送单元。收发单元有时也可以称为收发机、收发器、或收发电路等。接收单元有时也可以称为接收机、接收器、或接收电路等。发送单元有时也可以称为发射机、发射器或者发射电路等。
在一个具体的实施方式中，收发单元1410用于执行图5中的步骤504、505、507、508、509、514、515、517、518以及519中AUSF网元侧的收发操作，和/或收发单元1410还用于执行图5对应的实施例中AUSF网元侧的其他收发步骤。处理单元1420用于执行图5中的步骤506和516中AUSF网元侧的处理操作，和/或处理单元1420还用于执行图5对应的实施例中AUSF网元侧的其他处理步骤。
在一个具体的实施方式中，收发单元1410用于执行图7中的步骤704、705、707、709以及710中AUSF网元侧的收发操作，和/或收发单元1410还用于执行图7对应的实施例中AUSF网元侧的其他收发步骤。处理单元1420用于执行图7中的步骤708中AUSF网元侧的处理操作，和/或处理单元1420还用于执行图7对应的实施例中AUSF网元侧的其他处理步骤。
在一个具体的实施方式中，收发单元1410用于执行图8中的步骤804、805、807、809、810以及811中AUSF网元侧的收发操作，和/或收发单元1410还用于执行图8对应的实施例中AUSF网元侧的其他收发步骤。
如图15所示，AAA-S可以包括收发单元1510和处理单元1520。收发单元也可以称为收发器、收发机、收发装置等。处理单元也可以称为处理器，处理单板，处理模块、处理装置等。可选的，可以将收发单元1510中用于实现接收功能的器件视为接收单元，将收发单元1510中用于实现发送功能的器件视为发送单元，即收发单元1510包括接收单元和发送单元。收发单元有时也可以称为收发机、收发器、或收发电路等。接收单元有时也可以 称为接收机、接收器、或接收电路等。发送单元有时也可以称为发射机、发射器或者发射电路等。
在一个具体的实施方式中，收发单元1510用于执行图5中的步骤508以及518中AAA-S侧的收发操作，和/或收发单元1510还用于执行图5对应的实施例中AAA-S侧的其他收发步骤。
在一个具体的实施方式中，收发单元1510用于执行图7中的步骤705中AAA-S侧的收发操作，和/或收发单元1510还用于执行图7对应的实施例中AAA-S侧的其他收发步骤。
在一个具体的实施方式中，收发单元1510用于执行图8中的步骤805、808以及809中AAA-S侧的收发操作，和/或收发单元1510还用于执行图8对应的实施例中AAA-S侧的其他收发步骤。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。
所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存储的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘Solid State Disk(SSD))等。
本领域普通技术人员可以理解上述实施例的各种方法中的全部或部分步骤是可以通过程序来指令相关的硬件来完成，该程序可以存储于一计算机可读存储介质中，存储介质可以包括：ROM、RAM、磁盘或光盘等。
以上对本申请实施例所提供的通信方法、网元、系统以及存储介质进行了详细介绍，本文中应用了具体个例对本申请的原理及实施方式进行了阐述，以上实施例的说明只是用于帮助理解本申请的方法及其核心思想；同时，对于本领域的一般技术人员，依据本申请的思想，在具体实施方式及应用范围上均会有改变之处，综上所述，本说明书内容不应理解为对本申请的限制。

Claims (50)

  1. 一种通信方法，其特征在于，包括：
    第一网元从数据管理网元获得第一终端设备的目标网络切片的第一鉴权状态，所述第一鉴权状态指示所述目标网络切片的第一鉴权结果，或者所述第一鉴权状态指示所述目标网络切片未执行过鉴权流程；
    所述第一网元根据所述第一鉴权状态确定是否对所述目标网络切片执行第一鉴权流程。
  2. 根据权利要求1所述的通信方法，其特征在于，所述第一网元根据所述第一鉴权状态确定是否对所述目标网络切片执行第一鉴权流程，包括：
    所述第一网元根据所述第一鉴权状态确定所述目标网络切片的第一鉴权结果时，所述第一网元对所述目标网络切片不执行鉴权流程；或者
    所述第一网元根据所述第一鉴权状态确定所述目标网络切片未执行过鉴权流程时，所述第一网元对所述目标网络切片执行所述第一鉴权流程。
  3. 根据权利要求2所述的通信方法，其特征在于，所述第一网元根据所述第一鉴权状态对所述目标网络切片执行所述第一鉴权流程后，所述方法还包括：
    所述第一网元通知所述数据管理网元所述目标网络切片的第二鉴权状态，所述第二鉴权状态指示所述第一鉴权流程对应的第二鉴权结果。
  4. 根据权利要求3所述的通信方法，其特征在于，所述方法还包括:
    所述第一网元通知所述数据管理网元所述目标网络切片的所述第二鉴权状态的有效时间。
  5. 根据权利要求1至4任一项所述的通信方法，其特征在于，所述第一网元为移动性管理网元时，所述第一网元从数据管理网元获得第一终端设备的目标网络切片的第一鉴权状态之前，所述方法还包括：
    所述第一网元获知所述第一终端设备请求接入所述目标网络切片。
  6. 根据权利要求5所述的通信方法，其特征在于，所述第一网元根据所述第一鉴权状态确定不对所述目标网络切片执行第一鉴权流程，包括：
    若所述第一网元根据所述第一鉴权状态确定所述目标网络切片的第一鉴权结果为成功时，所述第一网元对所述目标网络切片不执行第一鉴权流程且确定允许所述第一终端设备接入所述目标网络切片；或者
    若所述第一网元根据所述第一鉴权状态确定所述目标网络切片的第一鉴权结果为失败时，所述第一网元对所述目标网络切片不执行第一鉴权流程且确定不允许所述第一终端设备接入所述目标网络切片。
  7. 根据权利要求5或6所述的通信方法，其特征在于，所述第一网元从数据管理网元获得第一终端设备的目标网络切片的第一鉴权状态，包括：
    所述第一网元向所述数据管理网元请求签约数据；
    所述第一网元接收所述数据管理网元发送的签约数据和所述目标网络切片的第一鉴权 状态。
  8. 根据权利要求5或6所述的通信方法，其特征在于，所述第一网元从数据管理网元获得第一终端设备的目标网络切片的第一鉴权状态，包括：
    所述第一网元向所述数据管理网元发送请求消息，所述请求消息用于查询所述目标网络切片的第一鉴权状态；
    所述第一网元接收所述数据管理网元发送的响应消息，所述响应消息指示所述目标网络切片的第一鉴权状态。
  9. 根据权利要求1至4任一项所述的通信方法，其特征在于，所述第一网元为认证服务器网元时，所述认证服务器网元从数据管理网元获得第一终端设备的目标网络切片的第一鉴权状态之前，所述方法还包括：
    所述认证服务器网元接收第一移动性管理网元发送的第一消息，所述第一消息用于请求执行第一鉴权流程。
  10. 根据权利要求9所述的通信方法，其特征在于，所述第一网元根据所述第一鉴权状态确定不对所述目标网络切片执行第一鉴权流程包括：
    若所述第一网元根据所述第一鉴权状态确定所述目标网络切片的第一鉴权结果为成功或失败时，所述第一网元确定不对所述目标网络切片执行第一鉴权流程且向所述第一移动性管理网元发送所述目标网络切片的第一鉴权结果。
  11. 根据权利要求9或10所述的通信方法，其特征在于，所述第一网元从数据管理网元获得第一终端设备的目标网络切片的第一鉴权状态，包括：
    所述第一网元向所述数据管理网元发送请求消息，所述请求消息用于查询所述目标网络切片的第一鉴权状态；
    所述第一网元接收所述数据管理网元发送的响应消息，所述响应消息指示所述目标网络切片的第一鉴权状态。
  12. 根据权利要求9所述的通信方法，其特征在于，当第一网元对所述目标网络切片执行第一鉴权流程中，所述认证服务器网元接收第二移动性管理网元发送的第二消息，所述第二消息用于请求对第一终端设备的所述目标网络切片执行第二鉴权流程；
    所述认证服务器网元向所述第二移动性管理网元发送指示信息，所述指示信息用于指示第二鉴权流程被挂起；
    在所述认证服务器网元获知所述目标网络切片的第二鉴权结果之后，所述方法包括：所述认证服务器网元向所述第二移动性管理网元发送所述目标网络切片的第二鉴权结果。
  13. 一种通信方法，其特征在于，包括：
    数据管理网元获知第一终端设备的目标网络切片的第一鉴权状态，所述第一鉴权状态指示所述第一终端设备的目标网络切片的第一鉴权结果，或者所述第一鉴权状态指示所述第一终端设备的目标网络切片未执行过鉴权流程；
    所述数据管理网元向所述第一网元发送所述第一鉴权状态。
  14. 根据权利要求13所述的通信方法，其特征在于，当所述第一鉴权状态指示所述目标网络切片的第一鉴权结果，所述第一网元为所述第一终端设备通过第二公用陆地移动网 PLMN接入目标网络切片时，为所述第一终端设备提供服务的第一移动性管理网元，则所述数据管理网元获知第一终端设备的目标网络切片的第一鉴权状态包括：
    所述数据管理网元接收第二网元发送的第一鉴权状态，所述第二网元是所述第一终端设备通过第一公用陆地移动网PLMN接入目标网络切片时，为所述第一终端设备提供服务的第三移动性管理网元，所述第一鉴权状态为所述第二网元对第一终端设备的所述目标网络切片执行的第三鉴权流程对应的第一鉴权结果。
  15. 根据权利要求13所述的通信方法，其特征在于，当所述第一鉴权状态指示所述目标网络切片的第一鉴权结果，所述数据管理网元获知第一终端设备的目标网络切片的第一鉴权状态包括：
    所述数据管理网元接收第三网元发送的第一鉴权状态，所述第一鉴权状态是所述第三网元对所述目标网络切片执行的第三鉴权流程对应的第一鉴权结果，所述第一网元和所述第三网元为认证服务器网元。
  16. 根据权利要求13至15任一项所述的通信方法，其特征在于，所述方法还包括：
    所述数据管理网元接收所述第一网元发送的请求消息，所述请求消息用于查询所述目标网络切片的第一鉴权状态；
    所述数据管理网元向所述第一网元发送所述第一鉴权状态，包括：
    所述数据管理网元向所述第一网元发送响应消息，所述响应消息指示所述目标网络切片的第一鉴权状态。
  17. 根据权利要求14所述的通信方法，其特征在于，所述方法还包括：
    所述数据管理网元接收所述第一网元发送的请求消息，所述请求消息用于请求签约数据；
    所述数据管理网元向所述第一网元发送所述第一鉴权状态，包括：
    所述数据管理网元向所述第一网元发送所述签约数据和所述目标网络切片的第一鉴权状态。
  18. 根据权利要求13至17任一项所述的通信方法，其特征在于，还包括：
    所述数据管理网元接收所述目标网络切片的第一鉴权状态的有效时间。
  19. 一种通信方法，其特征在于，包括：
    第四网元接收第一网元发送的第一鉴权请求消息，所述第一鉴权请求消息用于请求所述第四网元对第一终端设备接入的第一网络切片执行第一鉴权流程；
    在所述第一鉴权流程结束之前，所述第四网元接收第二网元发送的第二鉴权请求消息，所述第二鉴权请求消息用于请求所述第四网元对所述第一终端设备接入的所述第一网络切片执行第二鉴权流程；
    所述第四网元向所述第二网元发送指示信息，所述指示信息用于指示所述第二鉴权流程被挂起；
    所述第四网元获取所述第一鉴权流程的第一鉴权结果，并向所述第二网元发送所述第一鉴权流程的第一鉴权结果。
  20. 根据权利要求19所述的通信方法，其特征在于，所述第四网元为认证服务器网元， 所述第一网元为位于第一公用陆地移动网PLMN中的第一移动性管理网元，所述第二网元为位于第二PLMN中的第二移动性管理网元。
  21. 根据权利要求19所述的通信方法，其特征在于，所述第四网元为认证、授权和计费服务器，所述第一网元和第二网元为认证服务器网元。
  22. 一种第一网元，其特征在于，包括：
    通信接口，用于从数据管理网元获得第一终端设备的目标网络切片的第一鉴权状态，所述第一鉴权状态指示所述目标网络切片的第一鉴权结果，或者所述第一鉴权状态指示所述目标网络切片未执行过鉴权流程；
    处理器，所述处理器与所述通信接口耦合，用于根据所述通信接口获得的所述第一鉴权状态确定是否对所述目标网络切片执行第一鉴权流程。
  23. 根据权利要求22所述的第一网元，其特征在于，所述处理器具体用于：
    根据所述通信接口获得的所述第一鉴权状态确定所述目标网络切片的第一鉴权结果时，对所述目标网络切片不执行鉴权流程；或者
    根据所述通信接口获得的所述第一鉴权状态确定所述目标网络切片未执行过鉴权流程时，所述第一网元对所述目标网络切片执行所述第一鉴权流程。
  24. 根据权利要求23所述的第一网元，其特征在于，
    所述通信接口，还用于通知所述数据管理网元所述目标网络切片的第二鉴权状态，所述第二鉴权状态指示所述第一鉴权流程对应的第二鉴权结果。
  25. 根据权利要求24所述的第一网元，其特征在于，
    所述通信接口，还用于通知所述数据管理网元所述目标网络切片的所述第二鉴权状态的有效时间。
  26. 根据权利要求22至25所述的第一网元，其特征在于，所述第一网元为移动性管理网元时，
    所述通信接口，从数据管理网元获得第一终端设备的目标网络切片的第一鉴权状态之前，还用于获知所述第一终端设备请求接入所述目标网络切片。
  27. 根据权利要求26所述的第一网元，其特征在于，所述通信接口，具体用于：
    获知所述第一终端设备的注册请求；
    根据所述注册请求，请求所述数据管理网元发送签约数据；
    接收所述数据管理网元发送的签约数据和所述目标网络切片的第一鉴权状态。
  28. 根据权利要求26所述的第一网元，其特征在于，所述通信接口，具体用于：
    向所述数据管理网元发送请求消息，所述请求消息用于查询所述目标网络切片的第一鉴权状态；
    接收所述数据管理网元发送的响应消息，所述响应消息指示所述目标网络切片的第一鉴权状态。
  29. 一种数据管理网元，其特征在于，包括：
    通信接口，用于获知第一终端设备的目标网络切片的第一鉴权状态，所述第一鉴权状态指示所述目标网络切片的第一鉴权结果，或者所述第一鉴权状态指示所述目标网络切片 未执行过鉴权流程；
    所述通信接口，还用于向所述第一网元发送所述第一鉴权状态。
  30. 一种第三网元，其特征在于，包括：
    通信接口，用于接收第一网元发送的第一鉴权请求消息，所述第一鉴权请求消息用于请求所述第三网元对第一终端设备接入的第一网络切片执行第一鉴权流程；
    在所述第一鉴权流程结束之前，所述通信接口，还用于接收第二网元发送的第二鉴权请求消息，所述第二鉴权请求消息用于请求所述第三网元对所述第一终端设备接入的所述第一网络切片执行第二鉴权流程；
    所述通信接口，还用于向所述第二网元发送指示信息，所述指示信息用于指示所述第二鉴权流程被挂起；
    所述通信接口，还用于获取所述第一鉴权流程的第一鉴权结果，并向所述第二网元发送所述第一鉴权流程的第一鉴权结果。
  31. 一种第一网元，其特征在于，包括：
    收发单元，用于从数据管理网元获得第一终端设备的目标网络切片的第一鉴权状态，所述第一鉴权状态指示所述目标网络切片的第一鉴权结果，或者所述第一鉴权状态指示所述目标网络切片未执行过鉴权流程；
    处理单元，所述处理单元与所述收发单元耦合，用于根据所述收发单元获得的所述第一鉴权结果确定是否对所述目标网络切片执行第一鉴权流程。
  32. 一种数据管理网络，其特征在于，包括：
    收发单元，用于获知第一终端设备的目标网络切片的第一鉴权状态，所述第一鉴权状态指示所述目标网络切片的第一鉴权结果，或者所述第一鉴权状态指示所述目标网络切片未执行过鉴权流程；
    所述收发单元，还用于向第一网元发送所述第一鉴权状态。
  33. 一种第三网元，其特征在于，包括：
    收发单元，用于接收第一网元发送的第一鉴权请求消息，所述第一鉴权请求消息用于请求第三网元对第一终端设备接入的第一网络切片执行第一鉴权流程；
    在所述第一鉴权流程结束之前，所述收发单元，还用于接收第二网元发送的第二鉴权请求消息，所述第二鉴权请求消息用于请求所述第三网元对所述第一终端设备接入的第一所述网络切片执行第二鉴权流程；
    所述收发单元，还用于向所述第二网元发送指示信息，所述指示信息用于指示所述第二鉴权流程被挂起；
    所述收发单元，还用于获取所述第一鉴权流程的第一鉴权结果，并向所述第二网元发送所述第一鉴权流程的所述第一鉴权结果。
  34. 一种芯片系统，其特征在于，包括：所述芯片系统包括至少一个处理器，和接口电路，所述接口电路和所述至少一个处理器通过线路互联，所述处理器通过运行指令，以执行权利要求1到12任一项所述的方法。
  35. 一种芯片系统，其特征在于，包括：所述芯片系统包括至少一个处理器，和接口 电路，所述接口电路和所述至少一个处理器通过线路互联，所述处理器通过运行指令，以执行权利要求13到18任一项所述的方法。
  36. 一种芯片系统，其特征在于，包括：所述芯片系统包括至少一个处理器，和接口电路，所述接口电路和所述至少一个处理器通过线路互联，所述处理器通过运行指令，以执行权利要求19到21任一项所述的方法。
  37. 一种处理器，其特征在于，用于执行如权利要求1-12任一项所述的方法。
  38. 一种处理器，其特征在于，用于执行如权利要求13-18任一项所述的方法。
  39. 一种处理器，其特征在于，用于执行如权利要求19-21任一项所述的方法。
  40. 一种传输信息的装置，用于执行1到12任一项所述方法。
  41. 一种传输信息的装置，用于执行13到18项任一项所述方法。
  42. 一种传输信息的装置，用于执行19到21项任一项所述方法。
  43. 一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述1到12任一项所述的方法。
  44. 一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述13到18任一项所述的方法。
  45. 一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述19到21任一项所述的方法。
  46. 一种计算机可读存储介质，包括指令，当其在计算机上运行时，使得计算机执行如权利要求1到12项任一项所述的方法。
  47. 一种计算机可读存储介质，包括指令，当其在计算机上运行时，使得计算机执行上述13到18任一项所述的方法。
  48. 一种计算机可读存储介质，包括指令，当其在计算机上运行时，使得计算机执行上述19到21任一项所述的方法。
  49. 一种通信系统，其特征在于，包括如权利要求22至28中任一项所述的第一网元，和如权利要求29所述的数据管理网元，以及权利要求30所述的第三网元。
  50. 一种通信系统，其特征在于，包括如权利要求22至28中任一项所述的第一网元以及权利要求30所述的第三网元。
PCT/CN2020/100555 2019-07-09 2020-07-07 一种通信方法以及网元 WO2021004444A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
JP2022500876A JP2022540445A (ja) 2019-07-09 2020-07-07 通信方法及びネットワーク要素
EP20836463.8A EP3989621A4 (en) 2019-07-09 2020-07-07 COMMUNICATION METHOD AND NETWORK ELEMENT
US17/571,527 US20220132311A1 (en) 2019-07-09 2022-01-09 Communication method and network element

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910615962.0 2019-07-09
CN201910615962.0A CN112291784B (zh) 2019-07-09 2019-07-09 一种通信方法以及网元

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/571,527 Continuation US20220132311A1 (en) 2019-07-09 2022-01-09 Communication method and network element

Publications (1)

Publication Number Publication Date
WO2021004444A1 true WO2021004444A1 (zh) 2021-01-14

Family

ID=74114360

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/100555 WO2021004444A1 (zh) 2019-07-09 2020-07-07 一种通信方法以及网元

Country Status (5)

Country Link
US (1) US20220132311A1 (zh)
EP (1) EP3989621A4 (zh)
JP (1) JP2022540445A (zh)
CN (1) CN112291784B (zh)
WO (1) WO2021004444A1 (zh)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113573297B (zh) * 2020-04-10 2023-04-07 华为技术有限公司 一种通信方法及装置
WO2023216060A1 (en) * 2022-05-09 2023-11-16 Apple Inc. Home network-triggered authentication procedure
CN115022877A (zh) * 2022-07-14 2022-09-06 中国联合网络通信集团有限公司 终端鉴权方法、装置、电子设备及计算机可读存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170359768A1 (en) * 2016-06-10 2017-12-14 Lg Electronics Inc. Method and apparatus for receiving authorization information on network slice
WO2018013925A1 (en) * 2016-07-15 2018-01-18 Idac Holdings, Inc. Adaptive authorization framework for communication networks
CN108347729A (zh) * 2017-01-24 2018-07-31 电信科学技术研究院 网络切片内鉴权方法、切片鉴权代理实体及会话管理实体
CN109104726A (zh) * 2017-06-20 2018-12-28 上海中兴软件有限责任公司 网络切片的认证方法及相应装置、系统和介质
CN109842880A (zh) * 2018-08-23 2019-06-04 华为技术有限公司 路由方法、装置及系统

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106550410B (zh) * 2015-09-17 2020-07-07 华为技术有限公司 一种通信控制方法和控制器、用户设备、相关装置
US10142994B2 (en) * 2016-04-18 2018-11-27 Electronics And Telecommunications Research Institute Communication method and apparatus using network slicing
CN107249192B (zh) * 2017-06-30 2020-06-09 广东工业大学 一种共享网络切片的状态监控方法及装置
CN109699072B (zh) * 2018-04-09 2020-03-10 华为技术有限公司 通信方法、装置和系统
US11032710B2 (en) * 2019-02-15 2021-06-08 Qualcomm Incorporated Systems and methods of supporting device triggered re-authentication of slice-specific secondary authentication and authorization

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170359768A1 (en) * 2016-06-10 2017-12-14 Lg Electronics Inc. Method and apparatus for receiving authorization information on network slice
WO2018013925A1 (en) * 2016-07-15 2018-01-18 Idac Holdings, Inc. Adaptive authorization framework for communication networks
CN108347729A (zh) * 2017-01-24 2018-07-31 电信科学技术研究院 网络切片内鉴权方法、切片鉴权代理实体及会话管理实体
CN109104726A (zh) * 2017-06-20 2018-12-28 上海中兴软件有限责任公司 网络切片的认证方法及相应装置、系统和介质
CN109842880A (zh) * 2018-08-23 2019-06-04 华为技术有限公司 路由方法、装置及系统

Non-Patent Citations (11)

* Cited by examiner, † Cited by third party
Title
ANONYMOUS: "3 Generation Partnership Project; Technical Specification Group Services and System Aspects; Security architecture and procedures for 5G system (Release 15)", 3GPP STANDARD; TECHNICAL SPECIFICATION; 3GPP TS 33.501, vol. SA WG3, no. V15.5.0, 13 June 2019 (2019-06-13), pages 1 - 190, XP051754085 *
ANONYMOUS: "3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Security Aspects; Study on Security Aspects of Enhanced Network Slicing (Release 16)", 3GPP STANDARD; TECHNICAL REPORT; 3GPP TR 33.813, no. V0.4.0, 31 May 2019 (2019-05-31), pages 1 - 27, XP051753830 *
HUAWEI; HISILICON: "A solution to EAP method negotiation", 3GPP TSG-SA WG3 MEETING #95-BIS S3-192199, vol. SA WG3, 17 June 2019 (2019-06-17), Sapporo (Japan), pages 1 - 2, XP051753139 *
HUAWEI; HISILICON: "Conclusions to KI #1 on Slice Authentication", 3GPP DRAFT; S3-191929-CONCLUSION FOR KEY ISSUE 1-SLICE, vol. SA WG3, 17 June 2019 (2019-06-17), Sapporo (Japan), pages 1 - 1, XP051752877 *
HUAWEI; HISILICON: "Conclusions to KI #1 on Slice Authentication", 3GPP DRAFT; S3-192366 CONCLUSIONS TO KI #1 ON SLICE AUTHENTICATION, vol. SA WG3, 28 June 2019 (2019-06-28), Sapporo (Japan), pages 1 - 1, XP051749874 *
HUAWEI; HISILICON: "Content in Slicing Clause X.X.2", 3GPP DRAFT; S3-194045, vol. SA WG3, 11 November 2019 (2019-11-11), Reno, US, pages 1 - 2, XP051824361 *
HUAWEI; HISILICON: "EAP based slice-specific authentication procedure", 3GPP DRAFT; S3-193403-SLICE-SPECIFIC AUTHENTICATION, vol. SA WG3, 18 October 2019 (2019-10-18), Chongqing, China, pages 1 - 3, XP051796152 *
HUAWEI; HISILICON: "EAP based slice-specific authentication", 3GPP DRAFT; S3-192726-SLICE-SPECIFIC AUTHENTICATION, vol. SA WG3, 19 August 2019 (2019-08-19), Wroclaw (Poland), pages 1 - 3, XP051776562 *
HUAWEI; HISILICON; NOKIA; ERICSSON; INTERDIGITAL: "Content in Slicing Clause X.X.2", 3GPP DRAFT; S3-194536, vol. SA WG3, 22 November 2019 (2019-11-22), Reno, US, pages 1 - 3, XP051828680 *
NOKIA; NOKIA SHANGHAI BELL; ERICSSON; HUAWEI; HISILICON; INTERDIGITAL: "Draft for network slice specific authentication procedures", 3GPP DRAFT; S3-194541, vol. SA WG3, 3 December 2019 (2019-12-03), Reno, US, pages 1 - 9, XP051835558 *
See also references of EP3989621A4

Also Published As

Publication number Publication date
CN112291784A (zh) 2021-01-29
US20220132311A1 (en) 2022-04-28
JP2022540445A (ja) 2022-09-15
EP3989621A1 (en) 2022-04-27
EP3989621A4 (en) 2022-08-03
CN112291784B (zh) 2022-04-05

Similar Documents

Publication Publication Date Title
US11381956B2 (en) Obtaining of UE policy
CN110169098B (zh) 在移动通信系统中选择接入和移动性管理功能的方法和装置
KR102224248B1 (ko) 통신 시스템에서 PDU(Protocol Data Unit) 세션을 설립하는 방법
US11612013B2 (en) Data transmission method, device, and system
KR102412288B1 (ko) 제 3자 응용 서버에서 단말의 무선 연결 타입 변경을 확인하는 방법
WO2021004444A1 (zh) 一种通信方法以及网元
KR20240036599A (ko) 통신 방법 및 장치
KR20190077510A (ko) 부하 마이그레이션 방법, 장치 및 시스템
WO2019196811A1 (zh) 通信方法和相关装置
WO2020034965A1 (zh) 一种消息传输方法、装置及存储介质
WO2021051420A1 (zh) 一种dns缓存记录的确定方法及装置
US20230275872A1 (en) Communication method and apparatus, and computer-readable storage medium
AU2020246484B2 (en) Terminal management and control method, apparatus, and system
KR20210055537A (ko) 무선 통신 시스템에서 로컬 프로세싱을 위한 트래픽 스티어링을 위한 방법 및 장치
WO2021159415A1 (zh) 通信方法、装置及系统
WO2023143212A1 (zh) 一种通信方法及装置
CN115766343A (zh) 一种通信方法及装置
KR20230050048A (ko) 무선 통신 시스템에서 Home Routed 세션의 Visited 사업자 망에서 세션 분기 방법 및 장치
TW202345625A (zh) 一種漫遊場景下的通信方法及裝置
JP2024505266A (ja) 第１のコアネットワーク装置の方法、第２のコアネットワーク装置の方法、および無線アクセスネットワークの方法
KR20230073580A (ko) 무선 통신 시스템에서 서비스 기능 체인을 제공하는 방법 및 장치
CN116647832A (zh) 一种通信方法及装置
CN118042558A (zh) 通信方法、通信装置及通信系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20836463

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2022500876

Country of ref document: JP

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 2020836463

Country of ref document: EP

Effective date: 20220124