WO2021063057A1 - 漫游信令消息发送的方法、相关设备和通信系统 - Google Patents

漫游信令消息发送的方法、相关设备和通信系统 Download PDF

Info

Publication number
WO2021063057A1
WO2021063057A1 PCT/CN2020/100219 CN2020100219W WO2021063057A1 WO 2021063057 A1 WO2021063057 A1 WO 2021063057A1 CN 2020100219 W CN2020100219 W CN 2020100219W WO 2021063057 A1 WO2021063057 A1 WO 2021063057A1
Authority
WO
WIPO (PCT)
Prior art keywords
visited
sepp
core network
identity
network device
Prior art date
Application number
PCT/CN2020/100219
Other languages
English (en)
French (fr)
Inventor
邵国强
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to JP2022519772A priority Critical patent/JP2022550165A/ja
Priority to EP20872621.6A priority patent/EP4040820A4/en
Publication of WO2021063057A1 publication Critical patent/WO2021063057A1/zh
Priority to US17/708,830 priority patent/US20220225075A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/02—Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
    • H04W8/08—Mobility data transfer
    • H04W8/12—Mobility data transfer between location registers or mobility servers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/02—Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
    • H04W8/08—Mobility data transfer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/14—Session management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/14—Session management
    • H04L67/148—Migration or transfer of sessions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/51—Discovery or management thereof, e.g. service location protocol [SLP] or web services
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/02—Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
    • H04W8/06—Registration at serving network Location Register, VLR or user mobility server
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/02—Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
    • H04W8/04—Registration at HLR or HSS [Home Subscriber Server]
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
    • Y02D30/00—Reducing energy consumption in communication networks
    • Y02D30/70—Reducing energy consumption in communication networks in wireless communication networks

Definitions

  • This application relates to the field of communication technology, and in particular to a method, related equipment and communication system for sending roaming signaling messages.
  • the fifth generation (5G) mobile communication technology is the latest generation of cellular mobile communication technology.
  • the performance goals of 5G networks are high data rate, low latency, energy saving, cost reduction, increase of system capacity and large-scale device connection.
  • the Security Edge Protection Proxy (SEPP) device acts as the border security gateway of the 5GC, which can realize the interconnection of 5G networks of different operators.
  • SEPP Security Edge Protection Proxy
  • the network repository function (NRF) device of the visited place receives the roaming signaling message sent by the network element, and sends the address carrying the home NRF identifier to the SEPP of the visited place
  • the visited place SEPP returns the virtual visited place SEPP identifier to the NRF, and saves the correspondence between the home place NRF identifier and the virtual visited place SEPP identifier.
  • the NRF sends a roaming signaling message to the visited SEPP, which carries the aforementioned virtual visited SEPP identifier.
  • the SEPP receives the roaming signaling message sent by the NRF, it replaces the virtual visited SEPP identifier carried in it with the home NRF identifier, and sends the replaced roaming signaling message to the home SEPP, and the home SEPP
  • the received roaming signaling message is forwarded to the home NRF for subsequent processing.
  • the visited SEPP needs to conduct multiple signaling interactions with the visited NRF, and the visited SEPP also needs to save the correspondence between the home NRF ID and the virtual visited SEPP ID. As a result, the efficiency of roaming signaling message forwarding is low, and the equipment cost is also increased.
  • This application provides a method, related equipment and communication system for sending roaming signaling messages to solve the problem of low message forwarding efficiency due to multiple signaling interactions between the visited SEPP and NRF in the prior art.
  • an embodiment of the present application provides a method for forwarding roaming signaling messages.
  • the method mainly includes the following steps:
  • the visited core network device receives the roaming signaling message, adds the identity of the home core network device and the identity of the visited SEPP device to the roaming signaling message, and then the visited core network device sends a message containing the home to the visited SEPP device Roaming signaling message for the identity of the local core network device and the identity of the visited SEPP device.
  • the visited core network device does not need to obtain the virtual visited SEPP device identifier from the visited SEPP device, but sends the visited SEPP the identity of the home core network device and the visited SEPP device.
  • the roaming signaling message with the identity of the visited SEPP device can forward the above-mentioned roaming signaling message to the home network according to the identity of the home core network device.
  • this solution reduces the signaling interaction between the visited SEPP device and the visited core network device, improves the efficiency of message forwarding, and also improves the stability of the communication system.
  • the visited core network device can also start to establish a secure link (or secure connection) with the visited SEPP device, and then receive the security certificate sent by the visited SEPP device; and then the visited core network device may start to establish a secure link (or secure connection) with the visited SEPP device;
  • the identity of the visited SEPP device in the roaming signaling message is used to verify (also can be referred to as verifying) the security certificate.
  • the visited core network device sends the roaming signaling message including the identity of the home core network device and the identity of the visited SEPP device to the visited SEPP device.
  • this embodiment Before sending the roaming signaling message to the SEPP device in the visited place, this embodiment adds a step to verify the security of the SEPP device in the visited place, which enhances the security of the communication system.
  • the roaming signaling message received by the visited core network device carries the identity of the home network.
  • the visited core network device generates the identity of the home core network device according to the identity of the home network. logo. Subsequently, the visited core network device may add the generated identification of the home core network device to the received roaming signaling message.
  • the visited core network device may add the identity of the visited SEPP device to the header of the roaming signaling message, so that the visited SEPP device can recognize that the roaming signaling message is sent to itself.
  • this application provides a method for sending roaming signaling messages, which is mainly implemented by a visited SEPP device, and the method includes:
  • the visited SEPP device receives the roaming signaling message sent by the visited core network device.
  • the roaming signaling message contains the identity of the home core network device and the identity of the visited SEPP device, and then the visited SEPP device will The identity of the visited SEPP device in the roaming signaling message is replaced with the identity of the home core network device. After the replacement is completed, the visited SEPP device sends the replaced roaming signaling message to the home SEPP device.
  • the visited SEPP device can use the identity of the home core network device in the received roaming signaling message to replace the identity of the visited SEPP device in the roaming signaling message, and the visited SEPP device may not It is necessary to save the correspondence between the virtual visitor SEPP device identifier and the home NRF identifier in advance, thereby saving storage resources. After the SEPP equipment in the visited area recovers from a failure, the corresponding relationship does not need to be restored, thereby improving the working stability of the SEPP equipment in the visited area and simplifying the implementation and deployment costs of the SEPP equipment.
  • the visited SEPP device also starts to establish a secure link with the visited core network device, and the visited SEPP device sends a security certificate to the visited core network device, thereby guaranteeing the visited core network device and the visitor. Security of communication between local SEPP devices.
  • the visited SEPP device replaces the identity of the visited SEPP device in the header of the roaming signaling message with the identity of the home core network device, so that after sending the roaming signaling message to the home SEPP device , The home SEPP device can learn that the message is sent to the home core network device according to the header of the roaming signaling message.
  • this application provides a core network device, which mainly includes:
  • the method of sending the message For the beneficial effects of the core network equipment provided in this aspect, reference may be made to the description of the first aspect.
  • the above-mentioned core network equipment may be deployed in the visited network of the user equipment and used as the visited core network equipment.
  • the aforementioned core network device further includes a transceiver for communicating with other devices.
  • this application provides a security edge protection proxy device, which mainly includes:
  • the method of sending signaling messages For the beneficial effects of the SEPP device provided in this aspect, please refer to the description of the second aspect.
  • the above-mentioned security edge protection proxy device may be deployed in the visited location network of the user equipment, and used as the visited location security edge protection proxy device.
  • the above-mentioned SEPP device further includes a transceiver for communicating with other devices.
  • this application provides a communication system, which mainly includes:
  • a visited core network device and a visited security edge protection agent SEPP device where the visited core network device is configured to implement the method for sending roaming signaling messages as described in the first aspect
  • the visited SEPP device is configured to implement the method for sending roaming signaling messages as described in the second aspect.
  • the visited core network device and the visited security edge protection agent device can be implemented by using a general computer architecture, including a memory and a processor.
  • the visited core network equipment may be the equipment described in the third aspect
  • the SEPP equipment may be the equipment described in the fourth aspect.
  • the communication system provided in this aspect has the beneficial effects of the roaming signaling message sending methods provided in the above two aspects.
  • this application also provides a visited core network device, which mainly includes: a first receiving unit, a message processing unit, and a first sending unit.
  • the first receiving unit is used to receive a roaming signaling message
  • the message processing unit is used to add the identity of the home core network device and the identity of the visited SEPP device to the roaming signaling message
  • the first sending unit is used to Send a roaming signaling message containing the identity of the home core network device and the identity of the visited SEPP device to the visited SEPP.
  • the visited core network equipment further includes:
  • the link establishment unit is configured to start establishing a secure link with the visited SEPP device, and the first receiving unit is also configured to receive the security certificate sent by the visited SEPP device;
  • a verification unit configured to verify the security certificate according to the identity of the visited SEPP device in the roaming signaling message
  • the first sending unit is further configured to send the roaming signaling message including the identity of the home core network device and the identity of the visited SEPP device to the visited SEPP device after the verification is successful.
  • the roaming signaling message received by the first receiving unit in the visited core network device carries the identity of the home network
  • the visited core network device further includes: a generating unit configured to generate information based on the home location.
  • the identity of the network generates the identity of the home core network device.
  • the identity of the visited SEPP device is located in the header of the roaming signaling message, that is, the message processing unit adds the identity of the visited SEPP device to the header of the roaming signaling message, and the identity of the visited SEPP device is added to the header of the roaming signaling message.
  • the identification of the home core network device is added to the extension field.
  • the beneficial effects of the visited core network equipment provided by the sixth aspect can be referred to the description of the first aspect.
  • this application also provides a SEPP device at a visit site, which mainly includes:
  • the second receiving unit, the message replacement unit and the second sending unit are the same.
  • the second receiving unit is configured to receive a roaming signaling message sent by a visited core network device, where the roaming signaling message includes the identity of the home core network device and the identity of the visited SEPP device;
  • a message replacement unit configured to replace the identity of the visited SEPP device in the roaming signaling message with the identity of the home core network device
  • the second sending unit is used to send the replaced roaming signaling message to the home SEPP device.
  • the SEPP equipment of the visited place further includes:
  • a link establishment unit for establishing a secure link with the visited core network device
  • the second sending unit is also used to send a security certificate to the visited core network device.
  • the message replacement unit in the visited SEPP device replaces the identity of the visited SEPP in the header of the roaming signaling message with the identity of the home core network device.
  • the beneficial effects of the visited SEPP equipment provided by the seventh aspect can be referred to the description of the second aspect.
  • the present application also provides a computer-readable storage medium that stores instructions in the computer-readable storage medium, which when run on a computer, causes the computer to execute the methods described in the foregoing aspects.
  • this application also provides a computer program product containing instructions, which when run on a computer, causes the computer to execute the methods described in the above aspects.
  • the present application also provides a computer chip connected to a memory, and the chip is configured to read and execute a software program stored in the memory, and execute the methods described in the foregoing aspects.
  • the visited core network equipment may be the visited NRF equipment, or may also be the visited NSSF equipment.
  • the roaming signaling message may be a service discovery request or a network slicing request.
  • the roaming signaling message is a Hypertext Transfer Protocol Secure (HTTPS) message.
  • HTTPS Hypertext Transfer Protocol Secure
  • the identity of the visited SEPP device is the Fully Qualified Domain Name (FQDN) of the visited SEPP device
  • the identity of the visited core network device is the FQDN of the visited core network device.
  • the identifier of the home core network device is the FQDN of the home core network device.
  • FIG. 1 is a schematic diagram of a network architecture of a 5G roaming scenario according to an embodiment of the present application
  • FIG. 2 is a schematic diagram of interfaces between devices of a 5G network according to an embodiment of the present application
  • FIG. 3 is a flowchart of a method for sending roaming signaling messages according to an embodiment of the application
  • FIG. 5 is a schematic structural diagram of a core network device provided by an embodiment of this application.
  • FIG. 6 is a schematic structural diagram of an SEPP device provided by an embodiment of this application.
  • Fig. 7 is a hardware schematic diagram of a core network device and an SEPP device provided by an embodiment of the present application.
  • Figure 1 is a schematic diagram of a network architecture of a 5G roaming scenario according to an embodiment of the present application.
  • Figure 2 is a schematic diagram of the interfaces between the devices of the 5G network.
  • the user equipment roams from the home public land mobile network (Home Public Land Mobile Network, HPLMN) to the visited public land mobile network (Visited Public Land Mobile Network, VPLMN), using the visit Local public land mobile network for data services.
  • the home public land mobile network is referred to as the home network (also can be referred to as the local network)
  • the visited public land mobile network is referred to as the visited network.
  • a firewall is used for security isolation between the visited network and the home network.
  • the signaling between the visited network and the home network is transferred through the N32 interface between the visited SEPP (vSEPP) and the home SEPP (hSEPP).
  • SEPP can also realize the concealment of the PLMN network topology and the routing of signaling messages.
  • SEPP can also be called a border security gateway.
  • the visiting SEPP and the home SEPP can be directly connected through the N32 interface, or can be connected through an IP packet exchange (Internet Protocol Packet eXchange, IPX) device, that is, messages between SEPP are forwarded through IPX.
  • IPX Internet Protocol Packet eXchange
  • both the home network and the visited network adopt a 5G architecture.
  • the following describes the functions and interfaces of related devices in the 5G network with reference to FIG. 2.
  • Access and Mobility Management Function (AMF) equipment is a kind of control plane network element in the 3rd Generation Partnership Project (3GPP) network, which is mainly responsible for the access control and mobility of UE access to the operator’s network Sexual management.
  • the security anchor function (SEAF) can be deployed in the AMF device (AMF for short), or the SEAF can also be deployed in another device different from the AMF.
  • the SEAF is deployed in the AMF. Take for example.
  • SEAF and AMF can be collectively referred to as AMF.
  • a Session Management Function (SMF) device is a control plane network element in a 3GPP network.
  • SMF Session Management Function
  • an SMF device (SMF for short) is mainly used to manage a packet data unit (Packet Data Unit, PDU) session of the UE.
  • PDU Packet Data Unit
  • the UE can send data packets to each other through the PDU session and the data network.
  • SMF is responsible for management work such as the establishment, maintenance and deletion of PDU sessions.
  • DN Packet Data Network
  • PDN Packet Data Network
  • the 3GPP network can access multiple DNs, and multiple services provided by operators or third parties can be deployed on the DNs.
  • a certain DN is a private network of a smart factory, sensors installed on the smart factory workshop play the role of UE, and a control server for the sensors is deployed in the DN.
  • the UE communicates with the control server, and after obtaining the instruction of the control server, the UE can transmit the collected data to the control server according to the instruction.
  • Unified Data Management (UDM) equipment is also a control plane network element in the 3GPP network.
  • UDM equipment (UDM) is mainly responsible for storing the subscription data, credential and persistent identity of subscribers in the 3GPP network. (Subscriber Permanent Identifier, SUPI) etc. These data can be used for authentication and authorization of the UE to access the operator's 3GPP network.
  • SUPI Subscriber Permanent Identifier
  • the authentication server function (Authentication Server Function, AUSF) device is also a control plane network element in the 3GPP network, and the AUSF device is mainly used for first-level authentication (that is, the 3GPP network authenticates its subscribers).
  • NEF equipment is also a control plane network element in the 3GPP network.
  • NEF equipment (NEF for short) is mainly responsible for opening the external interface of the 3GPP network to third parties in a safe manner.
  • NEF can be used as a communication relay.
  • the NEF can translate the SUPI into its corresponding external identity (Identity, ID).
  • ID an external identity
  • NEF can translate the external identity ID into the corresponding SUPI when it is sent to the 3GPP network.
  • CMF Charging Function
  • 5G network such as online or offline charging for the traffic generated by the UE using the 5G network.
  • the user's charging control can be performed on the home network.
  • the Network Repository Function (NRF) device is also a control plane network element in the 3GPP network. It is mainly responsible for storing the configuration and service profile of the accessible network function (NF) and providing the network for other network elements. Function discovery service, through network discovery, can realize the selection and communication between network elements.
  • NF accessible network function
  • Application Function (AF) devices are used to provide application-related functions, such as providing voice call functions, conference functions, and so on.
  • the User Plane Function (UPF) device is a gateway for the communication between the 3GPP network and the DN, and can be used for data message forwarding, policy control, usage reporting, etc.
  • the Policy Control Function (PCF) device is a control plane function in the 3GPP network, which is used to provide the SMF with the policy of the PDU session.
  • Policies may include charging, Quality of Service (QoS), authorization-related policies, and so on.
  • the aforementioned NEF, NRF, PCF, UDM, AF, CHF, AUSF, AMF, SMF, and UPF belong to the equipment in the 5G core network.
  • the access network (Access Network, AN) is a sub-network of the 3GPP network. To access the 3GPP network, the UE first passes through the AN. In the wireless access scenario, AN is also called a radio access network (Radio Access Network, RAN), so the two terms RAN and AN are often mixed without distinction.
  • RAN Radio Access Network
  • 3GPP network refers to a network that complies with 3GPP standards.
  • the part except UE and DN in Figure 2 can be regarded as a 3GPP network.
  • 3GPP networks are not limited to 5G networks defined by 3GPP, but can also include 2G, 3G, and 4G networks.
  • 3GPP networks are operated by operators.
  • N1, N2, N3, N4, N6, etc. in the architecture shown in FIG. 2 respectively represent reference points between related network elements/network functions.
  • the 5G network also adopts a service-oriented architecture. Nausf, Namf... etc. respectively represent service-oriented interfaces of related network functions.
  • 3GPP networks and non-3GPP networks may coexist, and some network elements in the 5G network may also be used in some non-5G networks.
  • part or all of the core network functions in the 5G architecture shown in Figure 2 can be virtualized.
  • Part or all of the core network functions in 3G or 4G or other network architectures can also be virtualized, and no examples are given here.
  • the prior art provides a method for sending roaming signaling messages.
  • the visited NRF receives the roaming signaling message sent by the network element, and sends an address request message carrying the home NRF identifier to the visited SEPP.
  • the visited place SEPP returns the virtual visited place SEPP identifier to the NRF, and saves the correspondence between the home place NRF identifier and the virtual visited place SEPP identifier.
  • the inventor found that the visited place NRF will receive the security certificate sent by the visited place SEPP after obtaining the virtual visited place SEPP identity, and the visited place NRF needs to use the virtual visited place SEPP identity to verify the security certificate. After the verification is successful, the visited NRF can send roaming signaling messages to the visited SEPP.
  • the visited place NRF after receiving the roaming signaling message, the visited place NRF does not need to obtain the virtual visited place SEPP identity from the visited place SEPP, but adds the visited place SEPP identity to the roaming signaling message, so as to
  • the security certificate sent by the visited SEPP is subsequently received, the security certificate is verified by using the identity of the visited SEPP added in the roaming signaling message, so that the security verification can be passed, and the roaming signaling message can be sent to the visited SEPP.
  • the technical solution provided by this application can not only meet the requirements of security verification, but also avoid multiple signaling interactions between the visited NRF and the visited SEPP, which saves resources and improves roaming signaling messages. The efficiency of sending.
  • the following describes a roaming signaling message sending method provided by an embodiment of the present application based on the network system shown in FIG. 1-2. As shown in FIG. 3, the method includes:
  • Step 301 The visited core network device receives the roaming signaling message of the user equipment.
  • the user equipment roams from the home location to the visited location and initiates a service request.
  • the visited core network device receives the roaming signaling message of the user equipment.
  • the roaming signaling message may be a service discovery request to obtain the address of the UDM or PCF that provides services for the user equipment.
  • the roaming signaling message may also be a charging request, which is used to request the charging system of the home area to charge the user equipment.
  • the visited core network device may be a visited NRF or a visited network slice selection function (Network Slice Selection Function, NSSF) device.
  • the visited NRF or NSSF device receives other network elements in the core network (such as AMF/ SMF) roaming signaling message sent by the user equipment.
  • the visited NRF can support the service discovery function, which can realize the selection and communication between network elements.
  • the visited NSSF device selects an AMF that can serve the UE or a network slice instance that can serve the UE based on the received information and local configuration.
  • Step 302 The visited core network device generates the identity of the home core network device according to the identity of the home network carried in the roaming signaling message.
  • the roaming signaling message carries the identity of the home network of the user equipment, such as HPLMN ID.
  • the visited core network device may generate the identity of the home core network device according to the identity of the home network.
  • the identifier of the home core network device may be a fully qualified domain name (FQDN), physical address, IP address, etc. of the home core network device.
  • the home core network equipment may be the home AMF, the home UDM, or the home billing system.
  • Step 303 The visited core network device adds the identity of the home core network device and the identity of the visited SEPP to the roaming signaling message.
  • the visited core network device may add the identity of the home core network device and the identity of the visited SEPP to different fields of the roaming signaling message.
  • the identity of the visited SEPP is added to the header (also referred to as the header) of the roaming signaling message, and the identity of the home core network device is added to the extended field (or extended header field).
  • the identity of the SEPP of the visited place may be the FQDN, physical address, IP address, etc. of the SEPP of the visited place.
  • Step 304 The visitor's core network equipment and the visitor's SEPP start to establish a secure link.
  • a transport layer security (Transport Layer Security, TLS) link is established by sending a handshake hello message between the visited core network device and the SEPP.
  • TLS Transport Layer Security
  • the visited SEPP sends a security certificate to the visited core network device.
  • the visitor's SEPP logo can be configured in the visitor's core network equipment to facilitate sending hello messages to the visitor's SEPP.
  • Step 305 The core network device of the visited place receives the security certificate sent by the SEPP of the visited place.
  • Step 306 The visited core network device verifies the security certificate according to the identity of the visited SEPP in the roaming signaling message.
  • the visitor's core network equipment can verify the visitor's SEPP. Therefore, the visited core network device verifies the security certificate according to the identity of the visited SEPP in the roaming signaling message.
  • the visited core network device uses the visited SEPP identifier in the header of the roaming signaling message to verify the received security certificate. Since the security certificate carries the identity of the visited SEPP, and the header of the roaming signaling message is also the identity of the visited SEPP, the security check passes.
  • Step 307 The process of establishing a secure link is completed between the visited core network device and the visited SEPP.
  • the visited core network device continues the process of establishing a secure link, for example, sending a finished message to each other.
  • Step 308 The visited core network device sends a roaming signaling message containing the identity of the home core network device and the identity of the visited SEPP to the visited SEPP.
  • the visited core network device sends the modified roaming signaling message in step 303 (that is, the roaming signaling message with the identity of the home core network device and the identity of the visited SEPP added) to the visited SEPP.
  • the visited SEPP receives the roaming signaling message sent by the visited core network device, and the roaming signaling message includes the identity of the home core network device and the identity of the visited SEPP.
  • Step 309 The visited SEPP replaces the identity of the visited SEPP in the roaming signaling message with the identity of the home core network device.
  • the visited SEPP determines that the header of the roaming signaling message carries its own identity, that is, the identity of the visited SEPP, and the identity of the visited SEPP in the roaming signaling message is replaced with that of the home core network device.
  • logo After replacement, the header of the roaming signaling message carries the identity of the home core network device.
  • the roaming signaling message carries two identifications of the home core network equipment.
  • the visited core network device can delete the identity of the home core network device carried in the extended header field of the roaming signaling message, that is, keep the identity of the home core network device carried in the header of the roaming signaling message, thereby reducing roaming
  • the number of bytes of signaling messages saves network traffic.
  • Step 310 The visited SEPP sends the replaced roaming signaling message to the home SEPP.
  • the home SEPP identifier is configured in the visited SEPP, and the visited SEPP sends the replaced roaming signaling message to the home SEPP through the N32 interface.
  • the header of the replaced roaming signaling message carries the home core network equipment. logo.
  • the visited SEPP After the visited SEPP receives the roaming signaling message, it forwards it to the corresponding home core network device according to the identity of the home core network device carried in the header of the roaming signaling message.
  • the technical solution provided in this application actively generates roaming signaling messages that carry the identity of the visited SEPP and the identity of the home core network device by the visited core network equipment, so that the security certificate sent by the visited SEPP can be realized after receiving the security certificate sent by the visited SEPP. Security verification of SEPP in the visited place.
  • the visitor core network device can send to the visited SEPP a roaming signaling message carrying the identity of the visited SEPP and the identity of the home core network device, so that the visited SEPP can send the visited SEPP of the roaming signaling message header.
  • the identity of is replaced with the identity of the home core network device, and the roaming signaling message after replacement is forwarded to the home SEPP.
  • the visited core network equipment does not need to perform signaling interaction with the visited SEPP to obtain the identity of the visited SEPP that satisfies the security check, which reduces the communication between the visited core network equipment and the visited SEPP. Make interaction, thereby saving network resources.
  • the visited SEPP does not need to save the correspondence between the virtual visited SEPP identifier and the home NRF in advance, thereby saving storage resources.
  • the roaming signaling message can be forwarded quickly according to the parameters (the identification of the home core network device and the identification of the visited SEPP) carried in the received roaming signaling message, without the need to restore the correspondence This improves the working stability of SEPP in the visited place and simplifies the implementation and deployment cost of SEPP.
  • the message sending method provided in the embodiment of the present application further includes:
  • Step 401 The visited NRF receives the service discovery request sent by the visited AMF, which carries the identity of the home network.
  • the UE roams from the home location to the visited location and initiates a data service in the visited location.
  • the AMF of the visited location After receiving the service request of the UE, the AMF of the visited location performs network discovery to the core network equipment of the visited area to obtain services for the user equipment.
  • UDM or PCF such as home UDM, PCF
  • the visited core network device is specifically the visited NRF
  • the visited AMF sends a service discovery request to the visited NRF
  • the service discovery request carries the identity of the home network, for example, the PLMN ID is 0x64f021.
  • the service discovery request is sent using Hypertext Transfer Protocol (HTTP) messages.
  • HTTP Hypertext Transfer Protocol
  • the NRF includes a multi-level structure. If the underlying (first layer) NRF cannot process the service discovery request, it is uploaded level by level until an NRF that can process the service discovery request is found. In this embodiment, these NRFs are treated as a whole.
  • Step 402 The visited NRF determines that it needs to perform service discovery in the home network according to the service discovery request.
  • the NRF determines that the core network device of the home network needs to perform service discovery according to the identity of the home network in the service discovery request.
  • the home core network device is specifically the home NRF.
  • Step 403 The visited NRF generates the identification of the home NRF.
  • the identity of the home NRF generated by the visited NRF according to the PLMN ID is specifically the FQDN of the home NRF, for example: nrf.5gc.mnc ⁇ MNC>.mcc ⁇ MCC>.3gppnetwork.org.
  • the mobile network code Mobile Network Code, MNC
  • the mobile country code Mobile Country Code, MCC
  • the identity of the visited place SEPP is configured in the visited place NRF, and the identity of the visited place SEPP is specifically the FQDN of the visited place SEPP, for example: sepp.visited-operator.com.
  • Step 404 The visited NRF adds the FQDN of the home NRF and the FQDN of the visited SEPP to the service discovery request.
  • the visited NRF may pack the FQDN of the visited SEPP into the header of the service discovery request, and pack the FQDN of the home NRF into the extension field (or extension header field) of the service discovery request.
  • the visited NRF packs nrf.5gc.mnc ⁇ MNC>.mcc ⁇ MCC>.3gppnetwork.org into the extension field 3gpp-sbi-target-FQDN of the htpps message.
  • Step 405 The visited place NRF and the visited place SEPP start to establish a secure link.
  • the visited NRF and SEPP establish a TLS link by sending hello messages to each other.
  • the visited NRF receives the security certificate sent by the visited SEPP.
  • Step 406 The visited SEPP sends the security certificate to the visited NRF.
  • the security certificate of the SEPP of the visited place can be sent to the NRF of the visited place through a certificate message.
  • Step 407 The visited NRF verifies the security of the visited SEPP.
  • the visited NRF verifies the security of the visited SEPP.
  • the visited NRF uses the FQDN of the service discovery request header to verify the FQDN carried in the received security certificate. Since the FQDN in the header of the service discovery request and the FQDN carried in the security certificate are both the FQDN of the visited SEPP, the verification passes, that is, the visited NRF considers the visited SEPP to be safe.
  • Step 408 The procedure of establishing a secure link between the visited place NRF and the visited place SEPP is completed.
  • the visited NRF continues the process of establishing a secure link after the verification is successful, for example, sending a finished message to each other.
  • Step 409 The visited NRF sends to the visited SEPP a service discovery request with the FQDN of the home NRF and the FQDN of the visited SEPP added.
  • the service discovery request can be sent to the visited SEPP via an https message.
  • the visited SEPP receives the service discovery request sent by the visited NRF.
  • the service discovery request has been modified by the visited NRF, that is, the service discovery request of the FQDN of the home NRF and the FQDN of the visited SEPP are added.
  • Step 410 The visited SEPP replaces the FQDN of the visited SEPP in the service discovery request with the FQDN of the home NRF.
  • the visited SEPP after the visited SEPP receives the service discovery request, it finds that the header carries its own FQDN and carries the 3gpp-sbi-target-FQDN extension header field, so use 3gpp-sbi-target-FQDN The carried FQDN replaces the FQDN in the header.
  • the visited SEPP can also delete the 3gpp-sbi-target-FQDN header field of the service discovery request.
  • Step 411 The visited SEPP sends the replaced service discovery request to the home SEPP.
  • the SEPP of the visited place can be configured with the identifier of the home SEPP, and the SEPP of the visited place can send a replaced service discovery request to the home SEPP through the N32 interface.
  • the FQDN carried in the header of the service discovery request is nrf.5gc.mnc ⁇ MNC>.mcc ⁇ MCC>.3gppnetwork.org.
  • the visited SEPP can send the replaced service discovery request to the home SEPP.
  • the visited SEPP can package (or encapsulate) the replaced service discovery request into the https message body and generate the N32-f message header.
  • N32-f The header of the message header is the FQDN of the home SEPP, and the visited SEPP sends an https message encapsulating the service discovery request to the home SEPP.
  • the home SEPP obtains the service discovery request from the https message body and sends the service discovery request to the home NRF.
  • the home SEPP forwards the service discovery request to the home NRF according to the FQDN carried in the header of the service discovery request, and the home NRF can further forward the service discovery request to the home UDM or the home PCF for corresponding service processing .
  • This embodiment uses NRF to perform service discovery as an example to describe in detail the roaming signaling message sending method provided in this application.
  • the roaming signaling message provided in this application can also be applied to the scenario where the NSSF enters the slice discovery.
  • the equipment for signaling interaction is the visited NSSF and the visited SEPP.
  • the roaming signaling message is specifically a slicing request.
  • the visited NSSF will also execute the procedures of steps 401-409 in the foregoing embodiment.
  • the visited SEPP executes the above steps 410-411, and sends the slicing request to the home SEPP.
  • the home SEPP can also forward the slicing request to the corresponding home core network equipment, such as home NSSF, home UDM, home PCF, and so on.
  • the embodiment of the application also provides a core network device, which is specifically used to implement the method executed by the visited core network device in the method embodiment shown in FIG. 3-4.
  • the structure of the core network device is shown in FIG. 5, and mainly includes: a first receiving unit 501, a message processing unit 502, and a first sending unit 503;
  • the first receiving unit 501 is used to receive a roaming signaling message
  • the message processing unit 502 is used to add the identity of the home core network device and the identity of the visited SEPP to the roaming signaling message
  • the first sending unit 503 is used to Send a roaming signaling message containing the identity of the home core network device and the identity of the visited SEPP to the visited SEPP.
  • the visitor core network device does not need to obtain the virtual visitor SEPP identifier from the visitor SEPP, but sends the information to the visited SEPP.
  • the core network device provided in this embodiment does not need to perform multiple signaling interactions with the visited SEPP, which saves system resources and improves the efficiency of message forwarding.
  • the visited core network equipment provided in this embodiment may further include:
  • the link establishment unit 504 is configured to start establishing a secure link with the visited SEPP.
  • the first receiving unit 501 is also configured to receive the security certificate sent by the visited SEPP;
  • the verification unit 505 is configured to verify the security certificate received by the first receiving unit 501 according to the identity of the visited SEPP in the roaming signaling message;
  • the first sending unit 503 is further configured to send the roaming signaling message including the identity of the home core network device and the identity of the visited SEPP to the visited SEPP after the verification is successful.
  • the visited core network device can enhance the security of communication with the visited SEPP, and also enhance the security of the entire mobile communication network.
  • the roaming signaling message received by the first receiving unit 501 in the visited core network device carries the identity of the home network
  • the visited core network device further includes: a generating unit 506, configured to The identity of the home network generates the identity of the home core network device.
  • the identity of the visited SEPP is located in the header of the roaming signaling message, that is, the message processing unit 502 in the core network device of the visited adds the identity of the visited SEPP to the header of the roaming signaling message, Add the identity of the home core network device to the extended field of the roaming signaling message, so that the visited SEPP can determine that the message is sent to itself after receiving the roaming signaling message, and perform replacement processing on the message.
  • module can refer to specific hardware or application integrated circuits, processors and memories that execute one or more software or firmware programs, and integrate Logic circuits, and/or other devices that can provide the above-mentioned functions.
  • the embodiment of the present application also provides an SEPP device, which is specifically used to implement the SEPP execution method of the visited place described in the method embodiment shown in FIG. 3-4.
  • the structure of the SEPP is shown in FIG. 6 and mainly includes: The second receiving unit 601, the message replacing unit 602, and the second sending unit 603.
  • the second receiving unit 601 is configured to receive a roaming signaling message sent by a visited core network device, where the roaming signaling message includes the identity of the home core network device and the identity of the visited SEPP;
  • the message replacement unit 602 is configured to replace the identity of the visited SEPP in the roaming signaling message with the identity of the home core network device;
  • the second sending unit 603 is configured to send the replaced roaming signaling message to the home SEPP.
  • the SEPP in the visited place can replace the identity of the home core network device in the received roaming signaling message in the roaming signaling message.
  • the identity of the visited place SEPP, the visited place SEPP does not need to save the correspondence between the virtual visited place SEPP identity and the home place NRF in advance, thereby saving storage resources. Even if the SEPP fails to recover in the visited place, there is no need to restore the corresponding relationship, which improves the working stability of the visited SEPP and simplifies the implementation and deployment costs of the SEPP.
  • the visited SEPP provided in this embodiment also includes:
  • the link establishment unit 604 is configured to start establishing a secure link with the visited core network device
  • the second sending unit 603 is further configured to send a security certificate to the visited core network device.
  • the message replacement unit 602 in the visited SEPP replaces the identity of the visited SEPP in the header of the roaming signaling message with the identity of the home core network device.
  • the message replacement unit 602 may also delete the identity of the home core network device carried in the extension field of the roaming signaling message. By replacing and deleting related fields, the home SEPP can recognize the received roaming signaling message, and send the roaming signaling message to the corresponding home core network device for processing.
  • the SEPP in the above embodiments is presented in the form of functional modules.
  • the “module” here can refer to specific hardware or application integrated circuits, processors and memories that execute one or more software or firmware programs, and integrated logic circuits. , And/or other devices that can provide the above-mentioned functions.
  • FIG. 7 is a hardware schematic diagram of a core network device and an SEPP device provided by an embodiment of the present application.
  • Both the core network device and the SEPP device provided in this embodiment adopt general computer hardware, including a processor 701, a memory 702, a bus 703, an input device 704, and an output device 705.
  • the memory 702 may include a computer storage medium in the form of a volatile and/or nonvolatile memory, such as a read-only memory and/or a random access memory.
  • the memory 702 can store an operating system, application programs, other program modules, executable code, program data, user account opening data, user subscription data, and the like.
  • the input device 704 can be used to input commands and information to the core network device/SEPP.
  • the input device 704 is a keyboard or pointing device, such as a mouse, trackball, touchpad, microphone, joystick, game pad, satellite TV antenna, scanner or Similar equipment. These input devices may be connected to the processor 701 through the bus 703.
  • the output device 705 can be used to output information from the core network device/SEPP. In addition to the monitor, the output device 705 can also provide other peripheral output devices, such as speakers and/or printing devices. These output devices can also be connected via the bus 703 Processor 701.
  • the core network device/SEPP device may be connected to the network through the network interface 706, for example, connected to a local area network (LAN).
  • LAN local area network
  • the computer execution instructions stored in the core network device/SEPP can be stored in a remote storage device, not limited to local storage.
  • the core network device can execute the method steps on the visited core network device side in the above embodiment, for example, perform steps 301-303 , 306-307, 401-404, 407-409, etc.
  • the SEPP can execute the method steps on the SEPP side of the visited place in the above embodiment, for example, execute steps 304-305, 309-310, 405-406, 410-411, etc.
  • the aforementioned memory 702 stores computer-executable instructions for realizing the functions of the first sending unit 503, the first receiving unit 501, and the message processing unit 502 in FIG. 5.
  • the functions/implementation processes of the first sending unit 503, the first receiving unit 501, and the message processing unit 502 in FIG. 5 can all be implemented by the processor 701 in FIG. 7 calling the computer execution instructions stored in the memory 702, and the specific implementation process And functions refer to the above-mentioned related embodiments.
  • the memory 702 stores computer-executable instructions for implementing the functions of the second receiving unit 601, the message replacement unit 602, and the second sending unit 603 in FIG. 6.
  • the functions/implementation processes of the second receiving unit 601, the message replacement unit 602, and the second sending unit 603 in FIG. 6 can be implemented by the processor 701 in FIG. Refer to the above related embodiment.
  • the "visited place” is relative to the "home place".
  • the core network equipment of the current network is the visited core network equipment
  • the SEPP of the current network is the visited SEPP .
  • the above-mentioned visited core network equipment can serve not only user equipment roaming to the current network, but also local user equipment of the current network.
  • the visited core network equipment in the foregoing embodiment may include a visited NRF device, a visited NSSF device, and the like.
  • this application can be provided as methods, systems, or computer program products. Therefore, this application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, this application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.
  • computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing equipment to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction device.
  • the device implements the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.
  • These computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operation steps are executed on the computer or other programmable equipment to produce computer-implemented processing, so as to execute on the computer or other programmable equipment.
  • the instructions provide steps for implementing the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Databases & Information Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请提供一种漫游信令消息发送的方法，用以解决现有技术中拜访地核心网设备、拜访地SEPP设备之间需要多次信令交互来获得虚拟拜访地SEPP设备的标识，从而导致漫游信令消息发送效率低的问题。在本申请中，拜访地核心网设备接收到漫游信令消息后，在漫游信令消息中增加归属地核心网设备的标识和拜访地SEPP的标识，随后向拜访地SEPP发送包含归属地核心网设备的标识和拜访地SEPP的标识的漫游信令消息，从而拜访地SEPP可以根据归属地核心网设备的标识向归属地网络转发上述漫游信令消息，减少了拜访地SEPP和拜访地核心网设备之间的信令交互，提高了消息转发的效率。

Description

漫游信令消息发送的方法、相关设备和通信系统
本申请要求于2019年9月30日提交中国国家知识产权局、申请号为201910944236.3、发明名称为“漫游信令消息发送的方法、相关设备和通信系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种漫游信令消息发送的方法、相关设备和通信系统。
背景技术
第五代(5th generation，5G)移动通信技术是最新一代蜂窝移动通信技术。5G网络的性能目标是高数据速率、低时延、节省能源、降低成本、提高系统容量和大规模设备连接。
在5G核心网(5G core，5GC)中，安全边缘保护代理(Security Edge Protection Proxy，SEPP)设备作为5GC的边界安全网关，可以实现不同运营商的5G网络对接。当5G用户漫游时，5GC内部网络设备(网元)的漫游信令消息通过SEPP设备(后续简称SEPP)转发给归属地5G网络。
在现有的漫游信令消息发送方法中，拜访地的网络存储功能(network repository function，NRF)设备接收到网元发送的漫游信令消息，向拜访地的SEPP发送携带归属地NRF标识的地址请求消息，拜访地SEPP向NRF返回虚拟的拜访地SEPP标识，并保存所述归属地NRF标识和虚拟的拜访地SEPP标识之间的对应关系。
随后，NRF向拜访地SEPP发送漫游信令消息，其中携带上述虚拟的拜访地SEPP标识。SEPP接收到NRF发送的漫游信令消息后，将其中携带的虚拟的拜访地SEPP标识替换为归属地NRF的标识，并将替换后的漫游信令消息发给归属地的SEPP，归属地的SEPP将接收到的漫游信令消息转发给归属地的NRF进行后续处理。
在现有的漫游信令消息发送流程中，拜访地SEPP需要与拜访地NRF多次进行信令交互，拜访地SEPP还需要保存归属地NRF标识和虚拟的拜访地SEPP标识之间的对应关系，导致漫游信令消息转发的效率较低，也增加了设备成本。
发明内容
本申请提供一种漫游信令消息发送的方法、相关设备和通信系统，用以解决现有技术中拜访地SEPP需要与NRF进行多次信令交互，消息转发效率低的问题。
第一方面，本申请实施例提供了一种漫游信令消息转发方法，该方法主要包括如下步骤：
拜访地核心网设备接收漫游信令消息，在该漫游信令消息中增加归属地核心网设备的 标识和拜访地SEPP设备的标识，随后拜访地核心网设备向拜访地SEPP设备发送包含所述归属地核心网设备的标识和拜访地SEPP设备的标识的漫游信令消息。
通过第一方面提供的方案，拜访地核心网设备不需要向拜访地SEPP设备获取虚拟的拜访地SEPP设备的标识，而是向拜访地SEPP发送包含归属地核心网设备的标识和拜访地SEPP设备的标识的漫游信令消息，从而拜访地SEPP设备可以根据归属地核心网设备的标识向归属地网络转发上述漫游信令消息。与现有技术相比，本方案减少了拜访地SEPP设备和拜访地核心网设备之间的信令交互，提高了消息转发的效率，也提升了通信系统的稳定性。
在一个实施方案中，拜访地核心网设备还可以和拜访地SEPP设备开始建立安全链路(或安全连接)，然后接收所述拜访地SEPP设备发送的安全证书；然后拜访地核心网设备根据所述漫游信令消息中的所述拜访地SEPP设备的标识来校验(也可以称为验证)安全证书。拜访地核心网设备在校验成功后，向所述拜访地SEPP设备发送包含所述归属地核心网设备的标识和拜访地SEPP设备的标识的所述漫游信令消息。
本实施方案在向拜访地SEPP设备发送漫游信令消息之前，增加了对拜访地SEPP设备安全校验的步骤，增强了通信系统的安全。
在一个实施方案中，拜访地核心网设备接收到的漫游信令消息中携带归属地网络的标识，此时拜访地核心网设备根据所述归属地网络的标识生成所述归属地核心网设备的标识。随后，拜访地核心网设备可以将生成的归属地核心网设备的标识增加到接收到的漫游信令消息中。
在一个实施方案中，拜访地核心网设备可以将拜访地SEPP设备的标识增加到漫游信令消息的首部，以便于拜访地SEPP设备识别该漫游信令消息是发送给自己的。
第二方面，本申请提供一种漫游信令消息发送的方法，其主要由拜访地SEPP设备来实现，所述方法包括：
拜访地SEPP设备接收拜访地核心网设备发送的漫游信令消息，所述漫游信令消息中包含所述归属地核心网设备的标识和所述拜访地SEPP设备的标识，然后拜访地SEPP设备将所述漫游信令消息中的所述拜访地SEPP设备的标识替换为所述归属地核心网设备的标识。在替换完成后，所述拜访地SEPP设备向归属地SEPP设备发送替换后的漫游信令消息。
在本方面提供的实施方案中，拜访地SEPP设备可以使用接收到的漫游信令消息中的归属地核心网设备的标识替换漫游信令消息中的拜访地SEPP设备的标识，拜访地SEPP设备不需要提前保存虚拟的拜访地SEPP设备标识与归属地NRF之间的标识的对应关系，从而节约了存储资源。在拜访地SEPP设备发生故障恢复后，不需要恢复该对应关系，从而提高了拜访地SEPP设备的工作稳定性，简化了SEPP设备的实现和部署成本。
在一个实施方案中，拜访地SEPP设备还和所述拜访地核心网设备开始建立安全链路，拜访地SEPP设备向所述拜访地核心网设备发送安全证书，从而保障拜访地核心网设备和拜访地SEPP设备之间通信的安全。
在一个实施方案中，拜访地SEPP设备将漫游信令消息首部的拜访地SEPP设备的标识替换为所述归属地核心网设备的标识，从而在将该漫游信令消息发给归属地SEPP设备之后，归属地SEPP设备可以根据漫游信令消息的首部获知该消息是发往归属地核心网设备的。
第三方面，本申请提供一种核心网设备，其主要包括：
相互耦合的存储器和处理器，所述存储器中存储了程序代码，所述处理器调用并执行 所述存储器中存储的程序代码，使得所述核心网设备执行如第一方面所述的漫游信令消息发送的方法。本方面提供的核心网设备的有益效果可以参见第一方面的描述。
在一个实施方案中，上述核心网设备可以部署在用户设备的拜访地网络中，作为拜访地核心网设备来使用。
在一个实施方案中，上述核心网设备还包括收发器，用于和其他设备进行通信。
第四方面，本申请提供一种安全边缘保护代理设备，其主要包括：
相互耦合的存储器和处理器，所述存储器中存储了程序代码，所述处理器调用并执行所述存储器中存储的程序代码，使得所述安全边缘保护代理设备执行如第二方面所述的漫游信令消息发送的方法。本方面提供的SEPP设备的有益效果可以参见第二方面的描述。
在一个实施方案中，上述安全边缘保护代理设备可以部署在用户设备的拜访地网络中，作为拜访地安全边缘保护代理设备来使用。
在一个实施方案中，上述SEPP设备还包括收发器，用于和其他设备进行通信。
第五方面，本申请提供一种通信系统，其主要包括：
拜访地核心网设备和拜访地安全边缘保护代理SEPP设备，所述拜访地核心网设备配置于实现如第一方面所述的漫游信令消息发送的方法；
所述拜访地SEPP设备配置于实现如第二方面所述的漫游信令消息发送的方法。
在一个实施方案中，拜访地核心网设备和拜访地安全边缘保护代理设备可以采用通用的计算机架构来实现，包括存储器和处理器。拜访地核心网设备可以为第三方面所描述的设备，SEPP设备可以为第四方面所描述的设备。
本方面提供的通信系统兼有上述两方面提供的漫游信令消息发送的方法的有益效果。
第六方面，本申请还提供一种拜访地核心网设备，该设备主要包括：第一接收单元、消息处理单元和第一发送单元。
其中，第一接收单元用于接收到漫游信令消息，消息处理单元用于在所述漫游信令消息中增加归属地核心网设备的标识和拜访地SEPP设备的标识，第一发送单元用于向拜访地SEPP发送包含所述归属地核心网设备的标识和拜访地SEPP设备的标识的漫游信令消息。
在一个实施方案中，拜访地核心网设备还包括：
链路建立单元，用于和所述拜访地SEPP设备开始建立安全链路，第一接收单元还用于接收所述拜访地SEPP设备发送的安全证书；
校验单元，用于根据所述漫游信令消息中的所述拜访地SEPP设备的标识校验所述安全证书；
第一发送单元还用于在校验成功后，向拜访地SEPP设备发送包含所述归属地核心网设备的标识和拜访地SEPP设备的标识的所述漫游信令消息。
在一个实施方案中，拜访地核心网设备中的第一接收单元接收到的漫游信令消息中携带归属地网络的标识，拜访地核心网设备还包括：生成单元，用于根据所述归属地网络的标识生成所述归属地核心网设备的标识。
在一个实施方案中，拜访地SEPP设备的标识位于所述漫游信令消息的首部，即消息处理单元在所述漫游信令消息的首部中增加拜访地SEPP设备的标识，在漫游信令消息的扩展字段中增加归属地核心网设备的标识。
其中，第六方面提供的拜访地核心网设备的有益效果可以参见第一方面的描述。
第七方面，本申请还提供一种拜访地SEPP设备，其主要包括：
第二接收单元，消息替换单元和第二发送单元。
其中，第二接收单元用于接收拜访地核心网设备发送的漫游信令消息，所述漫游信令消息中包含所述归属地核心网设备的标识和所述拜访地SEPP设备的标识；
消息替换单元，用于将所述漫游信令消息中的所述拜访地SEPP设备的标识替换为所述归属地核心网设备的标识；
第二发送单元，用于向归属地SEPP设备发送替换后的漫游信令消息。
在一个实施方案中，拜访地SEPP设备还包括：
链路建立单元，用于和所述拜访地核心网设备开始建立安全链路；
第二发送单元还用于向所述拜访地核心网设备发送安全证书。
在一个实施方案中，拜访地SEPP设备中的消息替换单元将所述漫游信令消息首部的拜访地SEPP的标识替换为所述归属地核心网设备的标识。
其中，第七方面提供的拜访地SEPP设备的有益效果可以参见第二方面的描述。
第八方面，本申请还提供一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行上述各方面所述的方法。
第九方面，本申请还提供一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述各方面所述的方法。
第十方面，本申请还提供一种计算机芯片，所述芯片与存储器相连，所述芯片用于读取并执行所述存储器中存储的软件程序，执行上述各方面所述的方法。
在以上任一方面的技术方案中，拜访地核心网设备可以为拜访地NRF设备，还可以为拜访地NSSF设备。
在以上任一方面的技术方案中，漫游信令消息可以为服务发现请求或网络切片请求。
在以上任一方面的技术方案中，漫游信令消息为超文本安全传输协议(Hypertext Transfer Protocol Secure，HTTPS)消息。
在以上任一方面的技术方案中，拜访地SEPP设备的标识为拜访地SEPP设备的全合格域名(Fully Qualified Domain Name，FQDN)，拜访地核心网设备的标识为拜访地核心网设备的FQDN，归属地核心网设备的标识为归属地核心网设备的FQDN。
附图说明
图1是本申请实施例的5G漫游场景的网络架构示意图；
图2是本申请实施例5G网络的设备之间的接口示意图；
图3为本申请实施例提供的一种漫游信令消息发送方法的流程图；
图4为本申请实施例提供的另一种漫游信令消息发送方法的流程图；
图5为本申请实施例提供的一种核心网设备的结构示意图；
图6为本申请实施例提供的一种SEPP设备的结构示意图；
图7是本申请实施例提供的核心网设备和SEPP设备的硬件示意图。
具体实施方式
为了使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请作进一步 地详细描述。方法实施例中的具体操作方法也可以应用于装置实施例或系统实施例中。
参见图1-2，图1是本申请实施例的5G漫游场景的网络架构示意图。图2是5G网络的设备之间的接口示意图。
如图1所示，用户设备(User Equipment，UE)从归属地公共陆地移动网(Home Public Land Mobile Network，HPLMN)漫游到拜访地公共陆地移动网(Visited Public Land Mobile Network，VPLMN)，使用拜访地公共陆地移动网进行数据业务。其中，归属地公共陆地移动网简称归属网络(也可以称为本地网络)，拜访地公共陆地移动网简称拜访网络。
拜访网络和归属网络之间使用防火墙进行安全隔离。拜访网络和归属网络之间的信令通过拜访地SEPP(vSEPP)和归属地SEPP(hSEPP)之间的N32接口进行传递。此外，SEPP还可以实现PLMN网络的拓扑对外隐藏以及信令消息的路由寻址。SEPP也可以称为边界安全网关。拜访SEPP和归属SEPP之间可以通过N32接口直连，也可以通过IP包交换(Internet Protocol Packet eXchange，IPX)设备进行连接，即SEPP之间的消息通过IPX进行转发。
在本实施例中，归属网络和拜访网络均采用了5G架构，下面结合图2来介绍5G网络中相关设备的功能和接口。
接入与移动性管理功能(AMF)设备是第三代合作伙伴计划(3rd Generation Partnership Project，3GPP)网络中的一种控制面网元，主要负责UE接入运营商网络的接入控制和移动性管理。其中，安全锚点功能(Security Anchor Function，SEAF)可以部署于AMF设备(简称AMF)之中，或SEAF也可能部署于不同于AMF的另一设备中，图2中以SEAF被部署于AMF中为例。当SEAF被部署于AMF中时，SEAF和AMF可合称AMF。
会话管理功能(Session Management Function，SMF)设备是3GPP网络中的一种控制面网元，其中，SMF设备(简称SMF)主要用于负责管理UE的分组数据单元(Packet Data Unit，PDU)会话。UE可以通过PDU会话与数据网络互相发送数据包。SMF负责PDU会话的建立、维护和删除等管理工作。
数据网络(Data Network，DN)也称为分组数据网络(Packet Data Network，PDN)，是位于3GPP网络之外的网络。其中，3GPP网络可接入多个DN，DN上可部署运营商或第三方提供的多种业务。例如，某个DN是一个智能工厂的私有网络，安装在智能工厂车间的传感器扮演UE的角色，DN中部署了传感器的控制服务器。UE与控制服务器通信，UE在获取控制服务器的指令之后，可根据这个指令将采集的数据传递给控制服务器。
统一数据管理(Unified Data Management，UDM)设备也是3GPP网络中的一种控制面网元，UDM设备(简称UDM)主要负责存储3GPP网络中签约用户的签约数据、信任状(credential)和持久身份标识(Subscriber Permanent Identifier，SUPI)等。这些数据可以被用于UE接入运营商3GPP网络的认证和授权。
认证服务器功能(Authentication Server Function，AUSF)设备也是3GPP网络中的一种控制面网元，AUSF设备主要用于第一级认证(即3GPP网络对其签约用户的认证)。
网络开放功能(Network Exposure Function，NEF)设备也是3GPP网络之中的一种控制面网元。NEF设备(简称NEF)主要负责以安全的方式对第三方开放3GPP网络的对外接口。其中，在SMF等网元需要与第三方网元通信时，可以以NEF为通信的中继。比如，将UE的SUPI从3GPP网络发送到第三方时，NEF可以将SUPI翻译成其对应的外部身份标识(Identity，ID)。反之，NEF可以将外部身份ID在发送到3GPP网络时，将其翻译成对应 的SUPI。
计费功能(Charging Function，CHF)设备用于对用户设备使用5G网络进行计费，例如对UE使用5G网络产生的流量进行在线计费或离线计费。当用户处于漫游场景下，用户的计费控制可以在归属地网络进行。
网络存储功能(Network Repository Function，NRF)设备也是3GPP网络中的一种控制面网元，主要负责存储可被访问的网络功能(NF)的配置与服务资料(profile)，为其他网元提供网络功能的发现服务，通过网络发现可以实现网元间的选择与通信。
应用功能(Application Function，AF)设备用于提供应用相关的功能，例如提供语音通话功能、会议功能等。
用户面功能(User Plane Function，UPF)设备是3GPP网络与DN通信的网关，可以用于数据报文的转发、策略控制、使用量报告等。
策略控制功能(Policy Control Function，PCF)设备是3GPP网络中的一种控制面功能，用于向SMF提供PDU会话的策略。策略可包括计费、服务质量(Quality of Service，QoS)、授权相关策略等。
其中，上述NEF、NRF、PCF、UDM、AF、CHF、AUSF、AMF、SMF、UPF属于5G核心网中的设备。
接入网(Access Network，AN)是3GPP网络的一个子网络，UE要接入3GPP网络，首先经过AN。在无线接入场景下AN也称无线接入网(Radio Access Network，RAN)，因此RAN和AN这两个术语经常不做区分的混用。
其中，3GPP网络是指符合3GPP标准的网络。其中，图2中除了UE和DN以外的部分可看作是3GPP网络。3GPP网络不只局限于3GPP定义的5G网络，还可包括2G、3G、4G网络。通常3GPP网络由运营商来运营。此外，在图2所示架构中的N1、N2、N3、N4、N6等分别代表相关网元/网络功能之间的参照点(Reference Point)。其中，5G网络还采用了服务化的架构。Nausf、Namf...等分别代表相关网络功能的服务化接口。当然，3GPP网络和非3GPP网络可能共存，5G网络的中的一些网元也可能被运用到一些非5G网络中。
例如图2所示5G架构中的部分或全部核心网功能均可被虚拟化。3G或4G或其他网络架构中部分或全部核心网功能也可被虚拟化，此处不再一一举例。
现有技术给出了一种漫游信令消息发送的方法，在该方法中，拜访地NRF接收到网元发送的漫游信令消息，向拜访地SEPP发送携带归属地NRF标识的地址请求消息，拜访地SEPP向NRF返回虚拟的拜访地SEPP标识，并保存所述归属地NRF标识和虚拟的拜访地SEPP标识之间的对应关系。发明人发现，拜访地NRF在获得虚拟的拜访地SEPP标识之后，会接收到拜访地SEPP发送的安全证书，拜访地NRF需要使用虚拟的拜访地SEPP标识来校验该安全证书。校验成功后，拜访地NRF才可以向拜访地SEPP发送漫游信令消息。
在本申请中，拜访地NRF在接收到漫游信令消息后，不需要向拜访地SEPP获取虚拟的拜访地SEPP的标识，而是在该漫游信令消息中增加拜访地SEPP的标识，从而在后续接收到拜访地SEPP发送的安全证书时，使用漫游信令消息中增加的拜访地SEPP的标识来校验安全证书，可以使得安全校验通过，进而可以向拜访地SEPP发送漫游信令消息。与现有技术相比，本申请提供的技术方案不仅可以满足安全校验的需求，还可以避免拜访地NRF与拜访地SEPP多次进行信令交互，节省了资源，也提高了漫游信令消息发送的效率。
下面基于如图1-2所示的网络系统，对本申请实施例提供的一种漫游信令消息发送方法进行介绍，如图3所示，所述方法包括：
步骤301：拜访地核心网设备接收用户设备的漫游信令消息。
其中，用户设备从归属地漫游到拜访地，并发起业务请求。拜访地核心网设备接收到该用户设备的漫游信令消息。例如，漫游信令消息可以为业务发现请求，以获取为该用户设备提供服务的UDM或PCF的地址。此外，漫游信令消息也可以为计费请求，用于请求归属地的计费系统对该用户设备进行计费。
在本实施例中，拜访地核心网设备可以为拜访地NRF或拜访地网络切片选择功能(Network Slice Selection Function，NSSF)设备，拜访地NRF或NSSF设备接收核心网中其他网元(例如AMF/SMF)发送的用户设备的漫游信令消息。拜访地NRF可以支持服务发现功能，从而可以实现网元间的选择与通信。拜访地NSSF设备根据接收到的信息及本地配置，选出可以为UE服务的AMF或为UE服务的网络切片实例等。
步骤302：拜访地核心网设备根据漫游信令消息中携带的归属地网络的标识生成归属地核心网设备的标识。
其中，漫游信令消息中携带用户设备归属地网络的标识，例如HPLMN ID。拜访地核心网设备可以根据该归属地网络的标识生成归属地核心网设备的标识。归属地核心网设备的标识可以为归属地核心网设备的全合格域名(Fully Qualified Domain Name，FQDN)、物理地址、IP地址等。归属地核心网设备可以为归属地AMF、归属地UDM或归属地计费系统等。
步骤303：拜访地核心网设备在漫游信令消息中增加归属地核心网设备的标识和拜访地SEPP的标识。
在本实施例中，拜访地核心网设备可以在漫游信令消息的不同字段中增加归属地核心网设备的标识和拜访地SEPP的标识。例如，将拜访地SEPP的标识增加到漫游信令消息的首部(也可以称为头部)，将归属地核心网设备的标识增加到扩展字段(或扩展头域)中。
其中，拜访地SEPP的标识可以为拜访地SEPP的FQDN、物理地址、IP地址等。
步骤304：拜访地核心网设备和拜访地SEPP开始建立安全链路。
在本实施例中，拜访地核心网设备和SEPP之间通过发送握手hello消息来建立传输层安全(Transport Layer Security，TLS)链路。在安全链路(或安全连接)建立的过程中，拜访地SEPP向拜访地核心网设备发送安全证书。拜访地核心网设备中可以配置拜访地SEPP的标识，便于向拜访地SEPP发送hello消息。
步骤305、拜访地核心网设备接收拜访地SEPP发送的安全证书。
步骤306、拜访地核心网设备根据所述漫游信令消息中的拜访地SEPP的标识校验所述安全证书。
为了防止假冒攻击(假冒拜访地SEPP)，拜访地核心网设备可以校验拜访地SEPP。从而，拜访地核心网设备根据所述漫游信令消息中的所述拜访地SEPP的标识校验所述安全证书。
在本实施例中，拜访地核心网设备使用漫游信令消息首部的拜访地SEPP的标识对接收到的安全证书进行校验。由于安全证书中携带的是拜访地SEPP的标识，而漫游信令消息首 部也是拜访地SEPP的标识，因此安全校验通过。
步骤307、拜访地核心网设备和拜访地SEPP之间完成建立安全链接的流程。
在本实施例中，拜访地核心网设备在校验成功后，继续建立安全链接的流程，例如相互发送完成(finished)消息。
步骤308、拜访地核心网设备向拜访地SEPP发送包含归属地核心网设备的标识和拜访地SEPP的标识的漫游信令消息。
其中，拜访地核心网设备将步骤303中修改后的漫游信令消息(即增加了归属地核心网设备的标识和拜访地SEPP的标识的漫游信令消息)发给拜访地SEPP。
拜访地SEPP接收拜访地核心网设备发送的漫游信令消息，漫游信令消息中包含所述归属地核心网设备的标识和所述拜访地SEPP的标识。
步骤309、拜访地SEPP将所述漫游信令消息中的所述拜访地SEPP的标识替换为所述归属地核心网设备的标识。
在本实施例中，拜访地SEPP确定漫游信令消息首部携带的是自己的标识，即拜访地SEPP的标识，则将漫游信令消息中的拜访地SEPP的标识替换为归属地核心网设备的标识。替换之后，该漫游信令消息首部携带的是归属地核心网设备的标识。
此时，漫游信令消息中携带了两份归属地核心网设备的标识。拜访地核心网设备可以删除漫游信令消息的扩展头域中携带的归属地核心网设备的标识，即保留漫游信令消息首部中携带的归属地核心网设备的标识即可，从而减少了漫游信令消息的字节数，节省网络流量。
步骤310、拜访地SEPP向归属地SEPP发送替换后的漫游信令消息。
其中，拜访地SEPP中配置了归属地SEPP的标识，拜访地SEPP通过N32接口向归属地SEPP发送替换后的漫游信令消息，该替换后的漫游信令消息的首部中携带归属地核心网设备的标识。拜访地SEPP接收到该漫游信令消息后，根据漫游信令消息的首部中携带归属地核心网设备的标识转发到对应的归属地核心网设备。
本申请提供的技术方案通过拜访地核心网设备主动生成携带拜访地SEPP的标识以及归属地核心网设备的标识的漫游信令消息，从而可以在接收到拜访地SEPP发送的安全证书后，实现对拜访地SEPP的安全校验。同时，拜访地核心网设备可以向拜访地SEPP发送携带拜访地SEPP的标识以及归属地核心网设备的标识的漫游信令消息，使得拜访地SEPP可以将所述漫游信令消息首部的拜访地SEPP的标识替换为归属地核心网设备的标识，并向归属地SEPP转发替换后漫游信令消息。
与现有技术相比，拜访地核心网设备不需要与拜访地SEPP进行信令交互来获得满足安全校验的拜访地SEPP的标识，减少了拜访地核心网设备与拜访地SEPP之间的信令交互，从而节约了网络资源。此外，拜访地SEPP也不需要提前保存虚拟的拜访地SEPP标识与归属地NRF之间的标识的对应关系，从而节约了存储资源。在拜访地SEPP发生故障恢复后，可以迅速根据接收到的漫游信令消息中携带的参数(归属地核心网设备的标识和拜访地SEPP的标识)进行漫游信令消息转发，不需要恢复该对应关系，从而提高了拜访地SEPP的工作稳定性，简化了SEPP的实现和部署成本。
为更详细的理解本申请的技术方案，下面再给出一种漫游场景下的消息发送方法。如图4所示，本申请实施例还提供的消息发送方法包括：
步骤401：拜访地NRF接收拜访地AMF发送的服务发现请求，其中携带归属网络的标识。
在本实施例中，UE从归属地漫游到拜访地，在拜访地发起数据业务，拜访地AMF接收到UE的业务请求后，向拜访地核心网设备进行网络发现以获取为该用户设备提供服务的UDM或PCF(例如归属地UDM、PCF)的地址。
本实施例中，拜访地核心网设备具体为拜访地NRF，拜访地AMF向拜访地NRF发送服务发现请求，服务发现请求中携带了归属地网络的标识，例如PLMN ID为0x64f021。服务发现请求采用超文本传输协议(Hypertext Transfer Protocol，HTTP)消息来发送。
其中，NRF包括多层级结构，如果底层(第一层)NRF无法处理该服务发现请求，则逐级上传，直到找到一个可以处理该服务发现请求的NRF为止。在本实施例中，将这些NRF当成整体对待。
步骤402：拜访地NRF根据服务发现请求确定需要在归属地网络进行服务发现。
在本实施例中，NRF根据服务发现请求中的归属地网络的标识确定需要到归属地网络核心网设备进行服务发现。在本实施例中，归属地核心网设备具体为归属地NRF。
步骤403：拜访地NRF生成归属地NRF的标识。
例如，拜访地NRF根据PLMN ID生成的归属地NRF的标识。归属地NRF的标识具体为归属地NRF的FQDN，例如：nrf.5gc.mnc<MNC>.mcc<MCC>.3gppnetwork.org。其中，移动网络码(Mobile Network Code，MNC)和移动国家码(Mobile Country Code，MCC)可以根据归属地网络的标识PLMN ID来转换得到。
此外，拜访地SEPP的标识配置在了拜访地NRF中，拜访地SEPP的标识具体为拜访地SEPP的FQDN，例如：sepp.visited-operator.com。
步骤404：拜访地NRF在服务发现请求中增加归属地NRF的FQDN和拜访地SEPP的FQDN。
在本实施例中，拜访地NRF可以将拜访地SEPP的FQDN打包到服务发现请求的首部中，将归属地NRF的FQDN打包到服务发现请求的扩展字段(或扩展头域)中。例如，拜访地NRF将nrf.5gc.mnc<MNC>.mcc<MCC>.3gppnetwork.org打包到htpps消息的扩展字段3gpp-sbi-target-FQDN中。
步骤405、拜访地NRF和拜访地SEPP开始建立安全链路。
在本实施例中，拜访地NRF和SEPP之间通过互相发送hello消息来建立TLS链路。在TLS链路建立的过程中，拜访地NRF接收拜访地SEPP发送的安全证书。
步骤406、拜访地SEPP向拜访地NRF发送安全证书。
其中，拜访地SEPP的安全证书可以通过certificate消息向拜访地NRF发送。
步骤407、拜访地NRF校验拜访地SEPP的安全性。
在本实施例中，拜访地NRF为了防止仿冒攻击，校验拜访地SEPP的安全性。
具体的，拜访地NRF使用服务发现请求首部的FQDN来校验接收到的安全证书中携带的FQDN。由于服务发现请求首部的FQDN和安全证书中携带的FQDN均为拜访地SEPP的FQDN，因而校验通过，即拜访地NRF认为拜访地SEPP是安全的。
步骤408、拜访地NRF向拜访地SEPP之间完成建立安全链接的流程。
在本实施例中，拜访地NRF在校验成功后，继续建立安全链接的流程，例如相互发送完成(finished)消息。
步骤409、拜访地NRF向拜访地SEPP发送增加了归属地NRF的FQDN和拜访地SEPP的 FQDN的服务发现请求。
由于拜访地NRF和拜访地SEPP之间建立了安全链路，服务发现请求可以通过https消息发送给拜访地SEPP。
拜访地SEPP接收拜访地NRF发送的服务发现请求，该服务发现请求被拜访地NRF修改过，即增加了归属地NRF的FQDN和拜访地SEPP的FQDN的服务发现请求。
步骤410、拜访地SEPP将服务发现请求中的拜访地SEPP的FQDN替换为归属地NRF的FQDN。
在本实施例中，拜访地SEPP收到服务发现请求后，发现首部中携带的是自己的FQDN，且携带了3gpp-sbi-target-FQDN扩展头域，则使用3gpp-sbi-target-FQDN中携带的FQDN替换首部中的FQDN。此外，拜访地SEPP还可以删除服务发现请求的3gpp-sbi-target-FQDN头域。
步骤411、拜访地SEPP向归属地SEPP发送替换后的服务发现请求。
其中，拜访地SEPP中可以配置有归属地SEPP的标识，拜访地SEPP可以通过N32接口向归属地SEPP发送替换后的服务发现请求，该服务发现请求的首部中携带的FQDN为nrf.5gc.mnc<MNC>.mcc<MCC>.3gppnetwork.org。拜访地SEPP可以向归属地SEPP发送替换后的服务发现请求。
如果拜访地SEPP和归属地SEPP之间通过IPX连接，则拜访地SEPP可以将替换后的服务发现请求打包(或封装)到https消息体中，并生成N32-f消息头，此时N32-f消息头的首部是归属地SEPP的FQDN，拜访地SEPP向归属地SEPP发送打包了服务发现请求的https消息。归属地SEPP接收到https消息后，从https消息体中获取服务发现请求，并向归属地NRF该服务发现请求。
其中，归属地SEPP根据服务发现请求的首部中携带的FQDN向归属地NRF转发该服务发现请求，归属地NRF可以进一步将该服务发现请求转发到归属地UDM或归属地PCF，进行相应的业务处理。
本实施例以NRF进行服务发现为例详细描述了本申请提供的漫游信令消息发送方法。本申请提供的漫游信令消息还可以适用于NSSF进切片发现的场景。此时，信令交互的设备为拜访地NSSF和拜访地SEPP。漫游信令消息具体为切片请求，拜访地NSSF接收到切片请求后，也会执行上述实施例中的步骤401-409的流程。拜访地SEPP接收到切片请求后，执行上述步骤410-411，将切片请求发送到归属地SEPP。归属地SEPP也可以将切片请求转发到对应的归属地核心网设备，例如归属地NSSF、归属地UDM、归属地PCF等。
基于与方法实施例的同一发明构思，本申请实施例还提供一种核心网设备，具体用于实现如图3-4所示的方法实施例中所述拜访地核心网设备所执行的方法，该核心网设备的结构如图5所示，主要包括：第一接收单元501、消息处理单元502和第一发送单元503；
第一接收单元501用于接收到漫游信令消息，消息处理单元502用于在所述漫游信令消息中增加归属地核心网设备的标识和拜访地SEPP的标识，第一发送单元503用于向拜访地SEPP发送包含所述归属地核心网设备的标识和拜访地SEPP的标识的漫游信令消息。
通过上述第一接收单元501、消息处理单元502和第一发送单元503之间的配合，拜访地核心网设备不需要向拜访地SEPP获取虚拟的拜访地SEPP标识，而是向拜访地SEPP发送 包含归属地核心网设备的标识和拜访地SEPP的标识的漫游信令消息，从而拜访地SEPP可以根据归属地核心网设备的标识向归属地网络转发上述漫游信令消息。本实施例提供的核心网设备不需要与拜访地SEPP进行多次信令交互，节省了系统资源，也提高了消息转发的效率。
继续参考图5，本实施例提供的拜访地核心网设备还可以包括：
链路建立单元504，用于和所述拜访地SEPP开始建立安全链路。此时，第一接收单元501还用于接收所述拜访地SEPP发送的安全证书；
校验单元505，用于根据所述漫游信令消息中的所述拜访地SEPP的标识校验第一接收单元501接收到的安全证书；
第一发送单元503还用于在校验成功后，向拜访地SEPP发送包含所述归属地核心网设备的标识和拜访地SEPP的标识的所述漫游信令消息。
通过校验单元504、第一发送单元503以及链路建立单元504之间的配合，拜访地核心网设备可以增强与拜访地SEPP之间通信的安全性，也增强了整个移动通信网络的安全。
在一个实施例中，拜访地核心网设备中的第一接收单元501接收到的漫游信令消息中携带归属地网络的标识，拜访地核心网设备还包括：生成单元506，用于根据所述归属地网络的标识生成所述归属地核心网设备的标识。
在一个实施例中，拜访地SEPP的标识位于所述漫游信令消息的首部，即拜访地核心网设备中的消息处理单元502在所述漫游信令消息的首部中增加拜访地SEPP的标识，在漫游信令消息的扩展字段中增加归属地核心网设备的标识，从而拜访地SEPP在接收到该漫游信令消息后，可以确定该消息是发给自己的，并对该消息进行替换处理。
其中，上述实施例中的核心网设备是以功能模块的形式来呈现的，这里的“模块”可以指特定硬件或应用集成电路，执行一个或多个软件或固件程序的处理器和存储器，集成逻辑电路，和/或其他可以提供上述功能的器件。
本申请实施例还提供一种SEPP设备，具体用于实现如图3-4所示的方法实施例中所述拜访地SEPP执行的方法，该SEPP的结构如图6所示，主要包括：第二接收单元601、消息替换单元602和第二发送单元603。
其中，第二接收单元601用于接收拜访地核心网设备发送的漫游信令消息，所述漫游信令消息中包含所述归属地核心网设备的标识和所述拜访地SEPP的标识；
消息替换单元602，用于将所述漫游信令消息中的所述拜访地SEPP的标识替换为所述归属地核心网设备的标识；
第二发送单元603，用于向归属地SEPP发送替换后的漫游信令消息。
通过上述第二接收单元601、消息替换单元602和第二发送单元603之间的配合，拜访地SEPP可以使用接收到的漫游信令消息中的归属地核心网设备的标识替换漫游信令消息中的拜访地SEPP的标识，拜访地SEPP不需要提前保存虚拟的拜访地SEPP标识与归属地NRF之间的标识的对应关系，从而节约了存储资源。即使在拜访地SEPP发生故障恢复，也不需要恢复该对应关系，从而提高了拜访地SEPP的工作稳定性，简化了SEPP的实现和部署成本。
继续参见图6，本实施例提供的拜访地SEPP还包括：
链路建立单元604，用于和所述拜访地核心网设备开始建立安全链路；
第二发送单元603还用于向所述拜访地核心网设备发送安全证书。
在本实施例中，通过链路建立单元604和第二发送单元603之间的配合，可以实现在拜访地SEPP设备和拜访地核心网设备之间建立安全链路，并向拜访地核心网设备发送安全证书，提高了安全证书发送的安全性。
在一个实施例中，拜访地SEPP中的消息替换单元602将所述漫游信令消息首部的拜访地SEPP的标识替换为所述归属地核心网设备的标识。此外，该消息替换单元602还可以删除漫游信令消息扩展字段中携带的归属地核心网设备的标识。通过替换和删除相关字段，可以使得归属地SEPP识别接收到的漫游信令消息，并将该漫游信令消息发送到对应的归属地核心网设备中进行处理。
其中，上述实施例中的SEPP是以功能模块的形式来呈现的，这里的“模块”可以指特定硬件或应用集成电路，执行一个或多个软件或固件程序的处理器和存储器，集成逻辑电路，和/或其他可以提供上述功能的器件。
参见图7，图7是本申请实施例提供的核心网设备和SEPP设备的硬件示意图。
本实施例提供的核心网设备和SEPP设备都采用了通用的计算机硬件，包括处理器701、存储器702、总线703、输入设备704、输出设备705。
具体的，存储器702可以包括以易失性和/或非易失性存储器形式的计算机存储媒体，如只读存储器和/或随机存取存储器。存储器702可以存储操作系统、应用程序、其他程序模块、可执行代码、程序数据、用户开户数据、用户订阅数据等。
输入设备704可以用于向核心网设备/SEPP输入命令和信息，输入设备704如键盘或指向设备，如鼠标、轨迹球、触摸板、麦克风、操纵杆、游戏垫、卫星电视天线、扫描仪或类似设备。这些输入设备可以通过总线703连接至处理器701。
输出设备705可以用于核心网设备/SEPP输出信息，除了监视器之外，输出设备705还可以为其他外围输出设各，如扬声器和/或打印设备，这些输出设备也可以通过总线703连接到处理器701。
核心网设备/SEPP设备可以通过网络接口706连接到网络中，例如连接到局域网(Local Area Network，LAN)。在联网环境下，核心网设备/SEPP中存储的计算机执行指令可以存储在远程存储设备中，而不限于在本地存储。
当核心网设备中的处理器701执行存储器702中存储的可执行代码或应用程序时，核心网设备可以执行以上实施例中的拜访地核心网设备一侧的方法步骤，例如执行步骤301-303、306-307、401-404、407-409等。具体执行过程参见上述实施例，在此不再赘述。
当SEPP设备中的处理器701执行存储器702中存储的可执行代码或应用程序时，SEPP可以执行以上实施例中的拜访地SEPP一侧的方法步骤，例如执行步骤304-305、309-310、405-406、410-411等。具体执行过程参见上述实施例，在此不再赘述。
此外，上述存储器702中存储有用于实现图5中的第一发送单元503、第一接收单元501和消息处理单元502的功能的计算机执行指令。图5中的第一发送单元503、第一接收单元501和消息处理单元502的功能/实现过程均可以通过图7中的处理器701调用存储器702中存储的计算机执行指令来实现，具体实现过程和功能参考上述相关实施例。
针对SEPP的实施例，存储器702中存储有用于实现图6中第二接收单元601、消息替换单元602以及第二发送单元603的功能的计算机执行指令。图6中第二接收单元601、消息替换单元602以及第二发送单元603的功能/实现过程可以通过图7中的处理器701调用存储器702中存储的计算机执行指令来实现，具体实现过程和功能参考上述相关实施例。
其中，“拜访地”是相对于“归属地”来说的，针对漫游到当前网络的用户设备来说，上述当前网络的核心网设备为拜访地核心网设备，当前网络的SEPP为拜访地SEPP。上述拜访地核心网设备既可以服务于漫游到当前网络的用户设备，还可以服务于当前网络的本地用户设备。上述实施例中的拜访地核心网设备可以包括拜访地NRF设备、拜访地NSSF设备等。
本领域内的技术人员应明白，本申请的实施例可提供为方法、系统、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。

Claims (11)

  1. 一种漫游信令消息发送的方法，其特征在于，所述方法包括：
    拜访地核心网设备接收到漫游信令消息，在所述漫游信令消息中增加归属地核心网设备的标识和拜访地安全边缘保护代理SEPP设备的标识；
    所述拜访地核心网设备向拜访地SEPP设备发送包含所述归属地核心网设备的标识和拜访地SEPP设备的标识的漫游信令消息。
  2. 如权利要求1所述的方法，其特征在于，还包括：
    所述拜访地核心网设备和所述拜访地SEPP设备开始建立安全链路，接收所述拜访地SEPP设备发送的安全证书；
    所述拜访地核心网设备根据所述漫游信令消息中的所述拜访地SEPP设备的标识校验所述安全证书；
    所述拜访地核心网设备在校验成功后，向所述拜访地SEPP设备发送包含所述归属地核心网设备的标识和所述拜访地SEPP设备的标识的所述漫游信令消息。
  3. 如权利要求1或2所述的方法，其特征在于，所述拜访地核心网设备接收到的漫游信令消息中携带归属地网络的标识，所述方法还包括：
    所述拜访地核心网设备根据所述归属地网络的标识生成所述归属地核心网设备的标识。
  4. 如权利要求1或2所述的方法，其特征在于，所述拜访地核心网设备将所述拜访地SEPP设备的标识增加到所述漫游信令消息的首部。
  5. 如权利要求1或2所述的方法，其特征在于，所述漫游信令消息为服务发现请求或网络切片请求。
  6. 一种漫游信令消息发送的方法，其特征在于，所述方法包括：
    拜访地安全边缘保护代理SEPP设备接收拜访地核心网设备发送的漫游信令消息，所述漫游信令消息中包含归属地核心网设备的标识和所述拜访地SEPP设备的标识；
    所述拜访地SEPP设备将所述漫游信令消息中的所述拜访地SEPP设备的标识替换为所述归属地核心网设备的标识；
    所述拜访地SEPP设备向归属地SEPP设备发送替换后的漫游信令消息。
  7. 如权利要求6所述的方法，其特征在于，还包括：
    所述拜访地SEPP设备和所述拜访地核心网设备开始建立安全链路；
    所述拜访地SEPP设备向所述拜访地核心网设备发送安全证书。
  8. 如权利要求6或7所述的方法，其特征在于，所述拜访地SEPP设备将所述漫游信令消息首部的所述拜访地SEPP的标识替换为所述归属地核心网设备的标识。
  9. 一种核心网设备，其特征在于，包括：
    相互耦合的存储器和处理器，所述存储器中存储了程序代码，所述处理器调用并执行所述存储器中存储的程序代码，使得所述核心网设备执行如权利要求1-5任一项所述的漫游信令消息发送的方法。
  10. 一种安全边缘保护代理设备，其特征在于，包括：
    相互耦合的存储器和处理器，所述存储器中存储了程序代码，所述处理器调用并执行所述存储器中存储的程序代码，使得所述安全边缘保护代理设备执行如权利要求6-8任一 项所述的漫游信令消息发送的方法。
  11. 一种通信系统，其特征在于，包括：
    拜访地核心网设备和拜访地安全边缘保护代理SEPP设备，所述拜访地核心网设备配置于实现如权利要求1-5任一项所述的漫游信令消息发送的方法；
    所述拜访地SEPP设备配置于实现如权利要求6-8任一项所述的漫游信令消息发送的方法。
PCT/CN2020/100219 2019-09-30 2020-07-03 漫游信令消息发送的方法、相关设备和通信系统 WO2021063057A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
JP2022519772A JP2022550165A (ja) 2019-09-30 2020-07-03 ローミング・シグナリング・メッセージ送信方法、関連するデバイス、および通信システム
EP20872621.6A EP4040820A4 (en) 2019-09-30 2020-07-03 METHOD OF TRANSMITTING A ROAMING SIGNALING MESSAGE, ASSOCIATED DEVICE AND COMMUNICATION SYSTEM
US17/708,830 US20220225075A1 (en) 2019-09-30 2022-03-30 Roaming Signaling Message Sending Method, Related Device, and Communications System

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910944236.3A CN112584371B (zh) 2019-09-30 2019-09-30 漫游信令消息发送的方法、相关设备和通信系统
CN201910944236.3 2019-09-30

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/708,830 Continuation US20220225075A1 (en) 2019-09-30 2022-03-30 Roaming Signaling Message Sending Method, Related Device, and Communications System

Publications (1)

Publication Number Publication Date
WO2021063057A1 true WO2021063057A1 (zh) 2021-04-08

Family

ID=75117055

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/100219 WO2021063057A1 (zh) 2019-09-30 2020-07-03 漫游信令消息发送的方法、相关设备和通信系统

Country Status (5)

Country Link
US (1) US20220225075A1 (zh)
EP (1) EP4040820A4 (zh)
JP (1) JP2022550165A (zh)
CN (1) CN112584371B (zh)
WO (1) WO2021063057A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2023150485A1 (en) * 2022-02-01 2023-08-10 Cisco Technology, Inc. Bi-directional communication protocol for private networks

Families Citing this family (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11558732B1 (en) * 2021-04-16 2023-01-17 T-Mobile Innovations Llc Network function discovery through network repository functions in a wireless communication network
US20220394453A1 (en) * 2021-06-02 2022-12-08 Oracle International Corporation Methods, systems, and computer readable media for using service communications proxy (scp) or security edge protection proxy (sepp) to apply or override preferred-locality attribute during network function (nf) discovery
US11930083B2 (en) 2021-08-09 2024-03-12 Oracle International Corporation Methods, systems, and computer readable media for processing network function (NF) discovery requests at NF repository function (NRF) using prioritized lists of preferred locations
CN114095987B (zh) * 2021-11-22 2023-06-06 中国联合网络通信集团有限公司 一种业务处理方法、装置及存储介质
CN114339752A (zh) * 2021-12-30 2022-04-12 中国电信股份有限公司 安全边缘保护代理的消息发送方法、装置及相关设备
CN115150809A (zh) * 2022-06-29 2022-10-04 中国电信股份有限公司 异网漫游处理方法、装置及存储介质
WO2024015548A1 (en) * 2022-07-15 2024-01-18 Dish Wireless L.L.C. Nrf discovery for inter-network communication
CN115515090A (zh) * 2022-09-22 2022-12-23 中国电信股份有限公司 信令互通方法、装置、系统和存储介质
CN117998341A (zh) * 2022-11-01 2024-05-07 中国移动通信有限公司研究院 数据传输方法、装置、网络实体及介质
CN115835187B (zh) * 2022-12-23 2024-04-30 中国联合网络通信集团有限公司 漫游通信方法、装置、管理平台、介质及系统

Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109699031A (zh) * 2018-01-11 2019-04-30 华为技术有限公司 采用共享密钥、公钥和私钥的验证方法及装置

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110167013B (zh) * 2018-02-13 2020-10-27 华为技术有限公司 一种通信方法及装置
US10963553B2 (en) * 2018-02-15 2021-03-30 Nokia Technologies Oy Security management for service authorization in communication systems with service-based architecture
US10893025B2 (en) * 2018-02-15 2021-01-12 Nokia Technologies Oy Security management in communication systems with network function assisted mechanism to secure information elements
US10548004B2 (en) * 2018-02-15 2020-01-28 Nokia Technologies Oy Security management in communication systems between security edge protection proxy elements
JP6930666B2 (ja) * 2018-02-16 2021-09-01 日本電気株式会社 Ｎｇ−ｒａｎノード、ｕｅ、ｎｇ−ｒａｎノードの方法、及びｕｅの方法
US11038923B2 (en) * 2018-02-16 2021-06-15 Nokia Technologies Oy Security management in communication systems with security-based architecture using application layer security
US10673618B2 (en) * 2018-06-08 2020-06-02 Cisco Technology, Inc. Provisioning network resources in a wireless network using a native blockchain platform

Patent Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109699031A (zh) * 2018-01-11 2019-04-30 华为技术有限公司 采用共享密钥、公钥和私钥的验证方法及装置

Non-Patent Citations (3)

* Cited by examiner, † Cited by third party
Title
DEUTSCHE TELEKOM AG: "Discussion on SBA Message Routing", 3GPP DRAFT; C3-190238 - DISCUSSION ON SBA MESSAGE ROUTING, vol. CT WG3, 20 February 2019 (2019-02-20), Montreal, Canada, pages 1 - 5, XP051598513 *
DEUTSCHE TELEKOM AG: "Discussion on SBA Message Routing", 3GPP DRAFT; C4-190211 - DISCUSSION ON SBA MESSAGE ROUTING, vol. CT WG4, 15 February 2019 (2019-02-15), Montreal, Canada, pages 1 - 4, XP051598720 *
HUAWEI: "Informative Annex on End to End Call Flow via SEPP", 3GPP DRAFT; C4-191415-CRABC-29573-ANNEX-CALLFLOW, vol. CT WG4, 12 April 2019 (2019-04-12), Xi'an P R China, pages 1 - 13, XP051706685 *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2023150485A1 (en) * 2022-02-01 2023-08-10 Cisco Technology, Inc. Bi-directional communication protocol for private networks

Also Published As

Publication number Publication date
EP4040820A4 (en) 2022-11-23
US20220225075A1 (en) 2022-07-14
CN112584371A (zh) 2021-03-30
EP4040820A1 (en) 2022-08-10
JP2022550165A (ja) 2022-11-30
CN112584371B (zh) 2022-05-10

Similar Documents

Publication Publication Date Title
WO2021063057A1 (zh) 漫游信令消息发送的方法、相关设备和通信系统
US11477242B2 (en) Network security management method, and apparatus
JP7466053B2 (ja) セキュリティエッジ保護プロキシ（ｓｅｐｐ）を使用して５ｇローミングセキュリティ攻撃を緩和するための方法、システム、およびコンピュータ読取可能媒体
JP5793812B2 (ja) データオフロードをトリガするための方法、ネットワーク側デバイス、ユーザ機器、およびネットワークシステム
US20190260803A1 (en) Security management in communication systems with security-based architecture using application layer security
EP2774402B1 (en) Securing data communications in a communications network
US20060126584A1 (en) Method for user equipment selection of a packet data gateway in a wireless local network
US20210168151A1 (en) Method for implementing user plane security policy, apparatus, and system
WO2011079634A1 (zh) 业务卸载方法、业务卸载功能实体和业务卸载系统
CN110495214A (zh) 用于处理pdu会话建立过程的方法和amf节点
CN110191458B (zh) 一种网络漫游互通方法、装置和系统
JP7485788B2 (ja) 安全な通信方法と関連する装置及びシステム
WO2011015001A1 (zh) 通过无线局域网接入网络实现接入的方法及系统
JP2016526858A (ja) 信頼できるワイヤレスローカルエリアネットワーク（ｗｌａｎ）アクセスのシナリオ
WO2018099291A1 (zh) 数据传输方法、装置及系统、存储介质
WO2022021971A1 (zh) 通信方法、第一策略控制网元及通信系统
US20210219137A1 (en) Security management between edge proxy and internetwork exchange node in a communication system
US10484396B2 (en) Method and device for examining message integrity check
US8521161B2 (en) System and method for communications device and network component operation
WO2021094349A1 (en) Multi-step service authorization for indirect communication in a communication system
WO2020217224A1 (en) Amf and scp behavior in delegated discovery of pcf
US20240048986A1 (en) Communication method and apparatus
WO2018170703A1 (zh) 一种连接建立方法及装置
WO2024078313A1 (zh) 认证授权的方法与通信装置
RU2804273C2 (ru) Способ, устройство и система сетевого роуминга и внутренней связи

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20872621

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2022519772

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2020872621

Country of ref document: EP

Effective date: 20220411