WO2021179617A1 - 一种认证授权方法及对应装置 - Google Patents

一种认证授权方法及对应装置 Download PDF

Info

Publication number
WO2021179617A1
WO2021179617A1 PCT/CN2020/122889 CN2020122889W WO2021179617A1 WO 2021179617 A1 WO2021179617 A1 WO 2021179617A1 CN 2020122889 W CN2020122889 W CN 2020122889W WO 2021179617 A1 WO2021179617 A1 WO 2021179617A1
Authority
WO
WIPO (PCT)
Prior art keywords
information
authentication
terminal
authentication entity
service
Prior art date
Application number
PCT/CN2020/122889
Other languages
English (en)
French (fr)
Inventor
张博
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2021179617A1 publication Critical patent/WO2021179617A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/40—Support for services or applications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0892—Network architectures or network communication protocols for network security for authentication of entities by using authentication-authorization-accounting [AAA] servers or protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/123—Applying verification of the received information received data contents, e.g. message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/14—Session management

Definitions

  • This application relates to the field of communication technology, and in particular to an authentication and authorization method and corresponding device.
  • AR Augmented Reality
  • VR Virtual Reality
  • IoT Internet of Things
  • ETSI European Telecommunication Standard Institute
  • MEC Mobile Edge Computing
  • an application is often deployed in multiple MECs at the same time, so that different MECs can provide the same service and have functional equivalence.
  • the terminal device accesses the network, it can select the nearest MEC to connect to the service through the MEC.
  • the source MEC due to the mobility of the terminal device, when the terminal device moves from one location to another, it will be farther and farther away from the previously connected MEC (referred to as the source MEC), which will cause the source MEC to fail
  • the terminal equipment continues to provide services.
  • the terminal equipment needs to re-select a new MEC that can provide the same service more recently (referred to as the destination MEC).
  • the target MEC needs to re-authenticate the terminal device, and the terminal device can be authorized to use the service provided by the target MEC after the authentication is passed.
  • the re-authentication process will not only increase the system signaling overhead, but also increase the data transmission delay, and may even interrupt the services used by the terminal equipment.
  • the embodiment of the present application provides an authentication and authorization method and corresponding device.
  • the destination MEC can determine the identity of the terminal equipment without re-authenticating the terminal equipment. Legitimacy, thereby reducing signaling overhead and transmission delay, can better guarantee the continuity requirements of terminal equipment for services.
  • an authentication and authorization method including: a second authentication entity receives first information from a first network function NF; wherein, the first information is used to indicate that the first authentication entity has authenticated and authenticated the first terminal / Or authorization, the first information includes the identification of the first terminal, the first information is the first information after integrity protection; the first authentication entity is deployed in the first edge computing MEC or the Internet or data On the network, the second authentication entity is deployed on a second MEC, and the first authentication entity and the second authentication entity provide the same service; the second authentication entity verifies the integrity of the first information ; If the verification is successful, authorize the first terminal.
  • the re-authentication process can be omitted, the signaling overhead and transmission delay can be effectively reduced, and the service continuity requirement of the first terminal can be better guaranteed;
  • the information is integrity-protected information, so the reliability of the first information is high, and the security of the access service of the first terminal can be guaranteed.
  • the second authentication entity determines that the first authentication entity has authorized the first terminal to access the service according to the first information, and then authorizes the first terminal to access the service. Mentioned business.
  • the second authentication entity can directly authorize the first terminal to access the same service provided by the first authentication entity and the second authentication entity based on the first information, thereby eliminating the need for service
  • the re-authentication process effectively reduces signaling overhead and transmission delay, and can better guarantee the continuity requirements of the first terminal for services.
  • the first information further includes first service information; before the authorization of the first terminal, the second authentication entity may also verify whether the first service information is compatible with all The second service information provided by the second authentication entity matches; the authorization to the first terminal includes: after the second authentication entity determines that the first service information matches the second service information, authorizes The first terminal accesses the service corresponding to the first service information.
  • the second authentication entity only directly authorizes the first terminal to access the first service information when it determines that the first service information in the first information matches the second service information provided by the second authentication entity.
  • the business can improve the reliability of authentication and authorization.
  • the first NF is a session management function SMF; the application scenario of the authentication and/or authorization performed by the first authentication entity on the first terminal is the secondary execution of the SMF.
  • Authentication the first service information includes the data network identifier DNN and/or the data network access identifier DNAI; the second authentication entity verifies whether the first service information is the same as the second service provided by the second authentication entity
  • Information matching includes: the second authentication entity checks whether the DNN of the second authentication entity matches the DNN in the first information, and/or, whether the DNAI of the second authentication entity matches The DNAI in the first information matches;
  • the authorizing the first terminal includes: determining that the DNN of the second authentication entity matches the DNN in the first information, and/or determining After the DNAI of the second authentication entity matches the DNAI in the first information, the first terminal is authorized to access the service corresponding to the first service information.
  • the second authentication entity directly authorizes the first terminal to access the service corresponding to the first service information only when it determines that the DNN of the second authentication entity matches the DNN in the first information, which can improve the secondary Certified reliability.
  • the first NF is a session management function AMF; the authentication and/or authorization scenario performed by the first authentication entity on the first terminal is the slice authentication performed by the AMF;
  • the first service information includes slice information;
  • the second authentication entity checking whether the first service information matches the second service information provided by the second authentication entity includes: the second authentication entity checking Whether the slice information of the second authentication entity matches the slice information in the first information;
  • the authorization to the first terminal includes: the second authentication entity is determining the status of the second authentication entity After the slice information matches the slice information in the first information, the first terminal is authorized to access the service corresponding to the first service information.
  • the second authentication entity directly authorizes the first terminal to access the service corresponding to the first service information only when it determines that the slice information of the second authentication entity matches the slice information in the first information, which can improve Reliability of slice certification.
  • an authentication and authorization method including: a first network function NF receives first information from a first authentication entity; wherein, the first information is used to indicate that the first authentication entity has authenticated the first terminal For authentication and/or authorization, the first information includes the identification of the first terminal, and the first information is the first information after integrity protection; the first authentication entity is deployed on the first edge computing MEC or the Internet Or on a data network; the first network function NF sends the first information to a second authentication entity; wherein, the second authentication entity is deployed on a second MEC, and the first authentication entity and the first authentication entity Two certification entities provide the same services.
  • the first information is specifically used to indicate that the first authentication entity has authorized the first terminal to access the service.
  • the first information further includes first service information.
  • the first NF is a session management function SMF; the application scenario of the authentication and/or authorization performed by the first authentication entity on the first terminal is the secondary execution of the SMF.
  • Authentication; the first service information includes a data network identifier DNN and/or a data network access identifier DNAI.
  • the first NF is a session management function AMF; the authentication and/or authorization scenario performed by the first authentication entity on the first terminal is the slice authentication performed by the AMF;
  • the first service information includes slice information.
  • an authentication and authorization method including: a first authentication entity generates first information; wherein, the first information is used to indicate that the first authentication entity has authenticated and/or authorized the first terminal, and the first authentication entity One piece of information includes the identity of the first terminal, and the first piece of information is the first piece of information after integrity protection; the first authentication entity is deployed on the first edge computing MEC or the Internet or data network; the first piece of information is The authentication entity sends the first information to the first network function NF; the second authentication entity is deployed on the second MEC, and the first authentication entity and the second authentication entity provide the same service.
  • the first information is specifically used to indicate that the first authentication entity has authorized the first terminal to access the service.
  • the first information further includes first service information.
  • the first NF is a session management function SMF; the application scenario of the authentication and/or authorization performed by the first authentication entity on the first terminal is the secondary execution of the SMF.
  • Authentication; the first service information includes a data network identifier DNN and/or a data network access identifier DNAI.
  • the first NF is a session management function AMF; the authentication and/or authorization scenario performed by the first authentication entity on the first terminal is the slice authentication performed by the AMF;
  • the first service information includes slice information.
  • an authentication and authorization device may have the function of implementing the second authentication entity in the first aspect or any one of the possible designs of the first aspect.
  • the device may be a second authentication entity or It is a device in the second authentication entity.
  • the above-mentioned functions can be realized by hardware, or can be realized by hardware executing corresponding software, and the hardware or software includes one or more modules corresponding to the above-mentioned functions.
  • the device includes:
  • the receiving module is configured to receive first information from the first network function NF; wherein, the first information is used to indicate that the first authentication entity has authenticated and/or authorized the first terminal, and the first information includes the The identification of the first terminal, the first information is the first information after integrity protection; the first authentication entity is deployed on the first edge computing MEC or the Internet or data network, and the device is deployed on the second MEC The first authentication entity and the device provide the same service; the processing module is used to verify the integrity of the first information; if the verification is successful, the first terminal is authorized.
  • the processing module is specifically configured to: determine according to the first information that the first authentication entity has authorized the first terminal to access the service, and then authorize the first terminal to access the service. Into the business.
  • the first information further includes first service information; the processing module is further configured to: before authorizing the first terminal, verify whether the first service information is compatible with the The second service information provided by the device matches; when the processing module authorizes the first terminal, it is specifically configured to: after determining that the first service information matches the second service information, authorize the first The terminal accesses the service corresponding to the first service information.
  • the first NF is a session management function SMF; the application scenario of the authentication and/or authorization performed by the first authentication entity on the first terminal is the secondary execution of the SMF.
  • Authentication the first service information includes a data network identifier DNN and/or a data network access identifier DNAI; when the processing module checks whether the first service information matches the second service information provided by the device, Specifically used to: verify whether the DNN of the device matches the DNN in the first information, and/or verify whether the DNAI of the device matches the DNAI in the first information;
  • the processing module authorizes the first terminal, it is specifically configured to: determine that the DNN of the device matches the DNN in the first information, and/or determine that the DNAI of the device matches the first information. After the DNAI in the information matches, the first terminal is authorized to access the service corresponding to the first service information.
  • the first NF is a session management function AMF; the authentication and/or authorization scenario performed by the first authentication entity on the first terminal is the slice authentication performed by the AMF;
  • the first service information includes slice information; when the processing module checks whether the first service information matches the second service information provided by the device, it is specifically configured to: check whether the slice information of the device Match the slice information in the first information; when the processing module authorizes the first terminal, it is specifically configured to: determine that the slice information of the device is the same as the slice information in the first information. After the matching, the first terminal is authorized to access the service corresponding to the first service information.
  • an authentication and authorization device may have the function of realizing the first NF in the second aspect or any possible design of the second aspect.
  • the device may be the first NF or the first NF.
  • the above-mentioned functions can be realized by hardware, or can be realized by hardware executing corresponding software, and the hardware or software includes one or more modules corresponding to the above-mentioned functions.
  • the device includes:
  • the receiving module is configured to receive first information from a first authentication entity; wherein, the first information is used to indicate that the first authentication entity has authenticated and/or authorized the first terminal, and the first information includes all The identifier of the first terminal, the first information is the first information after integrity protection; the first authentication entity is deployed on the first edge computing MEC or the Internet or data network; the sending module is used to transfer the The first information is sent to a second authentication entity; wherein, the second authentication entity is deployed on a second MEC, and the first authentication entity and the second authentication entity provide the same service.
  • the first information is specifically used to indicate that the first authentication entity has authorized the first terminal to access the service.
  • the first information further includes first service information.
  • the device is a session management function SMF; the application scenario of the authentication and/or authorization performed by the first authentication entity on the first terminal is the secondary authentication performed by the SMF;
  • the first service information includes a data network identifier DNN and/or a data network access identifier DNAI.
  • the device is a session management function AMF; the authentication and/or authorization scenario performed by the first authentication entity on the first terminal is the slice authentication performed by the AMF;
  • the first service information includes slice information.
  • an authentication and authorization device may have the function of realizing the first authentication entity in any possible design of the third aspect or the third aspect.
  • the device may be the first authentication entity or It is a device in the first authentication entity.
  • the above-mentioned functions can be realized by hardware, or can be realized by hardware executing corresponding software, and the hardware or software includes one or more modules corresponding to the above-mentioned functions.
  • the device includes:
  • the processing module is configured to generate first information; wherein, the first information is used to indicate that the device has authenticated and/or authorized the first terminal, the first information includes the identification of the first terminal, and the first The information is the first information after integrity protection; the device is deployed on the first edge computing MEC or the Internet or data network; the sending module is used to send the first information to the first network function NF; the first The second authentication entity is deployed on the second MEC, and the device and the second authentication entity provide the same service.
  • the first information is specifically used to indicate that the device has authorized the first terminal to access the service.
  • the first information further includes first service information.
  • the first NF is a session management function SMF; the application scenario of the authentication and/or authorization performed by the device on the first terminal is the secondary authentication performed by the SMF;
  • the first service information includes a data network identifier DNN and/or a data network access identifier DNAI.
  • the first NF is the session management function AMF; the authentication and/or authorization scenario performed by the device on the first terminal is the slice authentication performed by the AMF;
  • a service information includes slice information.
  • a communication device including: at least one processor; and a memory and a communication interface that are communicatively connected with the at least one processor; wherein the memory stores an Instruction, the at least one processor executes the instruction stored in the memory to execute any possible design of the foregoing first aspect or the foregoing first aspect or any possible design of the foregoing second aspect or the foregoing second aspect Or the method described in the foregoing third aspect or any one of the possible designs of the foregoing third aspect.
  • a computer-readable storage medium which includes a program or instruction.
  • the program or instruction runs on a computer, it executes any possible design as described in the first aspect or the first aspect described above, or the first aspect described above.
  • a chip is provided, the chip is coupled with a memory, and is used to read and execute program instructions stored in the memory to implement any possible design or the foregoing
  • a computer program product including instructions, which when run on a computer, cause the computer to execute any possible design such as the above-mentioned first aspect or the above-mentioned first aspect, or the above-mentioned second aspect or the above-mentioned second aspect.
  • FIG. 1 is a schematic structural diagram of a possible communication system to which an embodiment of this application is applicable;
  • FIG. 2 is a flowchart of an authentication and authorization method provided by an embodiment of the application
  • FIG. 3A is a flowchart of the secondary authentication performed by SMF participation
  • Figure 3B is a flowchart of slice authentication performed by AMF participation
  • Figure 4 is a possible MEC scenario in an embodiment of this application.
  • FIG. 5 is a flowchart of another authentication and authorization method provided by an embodiment of the application.
  • FIG. 6 is a flowchart of another authentication and authorization method provided by an embodiment of the application.
  • FIG. 7 is a flowchart of another authentication and authorization method provided by an embodiment of the application.
  • FIG. 8 is a flowchart of another authentication and authorization method provided by an embodiment of the application.
  • FIG. 9 is a schematic structural diagram of an authentication and authorization device provided by an embodiment of this application.
  • FIG. 10 is a schematic structural diagram of another authentication and authorization apparatus provided by an embodiment of this application.
  • FIG. 11 is a schematic structural diagram of another authentication and authorization apparatus provided by an embodiment of this application.
  • FIG. 12 is a schematic structural diagram of another authentication and authorization apparatus provided by an embodiment of this application.
  • the technical solutions of the embodiments of the present application can be applied to various communication systems, such as: the fourth generation (4th Generation, 4G) communication system, the fifth generation (5th Generation, 5G) communication system or other future evolution systems, or other various systems.
  • Fig. 1 shows a possible communication system to which the embodiments of the present application are applicable.
  • the communication system takes a 5G communication system as an example, including: unified data management (UDM) network elements, access and mobility management function (Access and Mobility Management Function, AMF) network elements, session management function (Session Management) Function, SMF) network element, Policy Control Function (PCF) network element, Application Function (AF) network element, User Plane Function (UPF) network element, Data Network (Data Network, DN), Radio Access Network (RAN), MEC and terminal equipment.
  • UDM unified data management
  • AMF Access and Mobility Management Function
  • Session Management Session Management
  • SMF Session Management
  • PCF Policy Control Function
  • AF Application Function
  • UPF User Plane Function
  • Data Network Data Network
  • DN Data Network
  • RAN Radio Access Network
  • MEC Mobility Control Function
  • the above-mentioned network elements realize logical two-to-two interconnection through service-oriented interfaces.
  • the terminal equipment and the AMF are interconnected through the N1 interface
  • the RAN and AMF are interconnected through the N2 interface
  • the RAN and UPF are interconnected through the N3 interface
  • the UPF and SMF are interconnected through the N4 interface.
  • PCF and AF are interconnected through N5 interface
  • UPF and DN are interconnected through N6 interface
  • SMF and PCF are interconnected through N7 interface
  • AMF and UDM are interconnected through N8 interface, between UPF and UPF
  • the interconnection is achieved through the N9 interface (not shown in Figure 1), the UDM and the SMF are interconnected through the N10 interface, the SMF and the AMF are interconnected through the N11 interface, and the UDM and the PCF are interconnected through the N25 interface.
  • terminal equipment can also be called terminals, user equipment (UE), mobile stations (Mobile Station, MS), mobile terminals (Mobile Terminal, MT), etc., which provide users with voice or data connectivity.
  • the device can also be an Internet of Things device.
  • the terminal includes a handheld device with a wireless connection function, a vehicle-mounted device, and so on.
  • the terminal can be: mobile phone (Mobile Phone), tablet computer, notebook computer, palmtop computer, mobile Internet device (Mobile Internet Device, MID), wearable device (such as smart watch, smart bracelet, pedometer, etc.), Vehicles, vehicle-mounted equipment (for example, cars, bicycles, electric vehicles, airplanes, ships, trains, high-speed rail, etc.), virtual reality (VR) equipment, augmented reality (AR) equipment, industrial control (Industrial Control) Wireless terminals, smart home equipment (for example, refrigerators, TVs, air conditioners, electric meters, etc.), smart robots, workshop equipment, wireless terminals in self-driving, and wireless terminals in remote medical surgery , The wireless terminal in the smart grid, the wireless terminal in the transportation safety, the wireless terminal in the smart city, or the wireless terminal in the smart home, and the flying equipment (such as , Smart robots, hot air balloons, drones, airplanes), etc.
  • vehicle-mounted equipment for example, cars, bicycles, electric vehicles, airplanes, ships, trains, high-speed rail, etc.
  • RAN is a device for terminal equipment to provide wireless access, including but not limited to evolved base station (Evolved Node B, eNodeB), wireless network (WiFi) access point (Access Point, AP), and global interoperability for microwave access (World Interoperability). Interoperability for Microwave Access, WiMAX) Base Station (Base Station, BS), etc.
  • Evolved Node B evolved Node B
  • WiFi wireless network
  • AP Access Point
  • Worldwide Interoperability Interoperability for Microwave Access, WiMAX
  • Base Station Base Station
  • AMF is mainly responsible for the mobility management in the mobile network, such as user location update, user registration network, user handover, etc.
  • SMF is mainly responsible for session management in the mobile network, such as session establishment, modification, and release. Specific functions such as assigning IP addresses to users, selecting UPF that provides message forwarding functions, and so on.
  • PCF is mainly responsible for providing strategies to AMF and SMF, such as QoS strategies and slice selection strategies.
  • UDM is mainly used to store user data, such as contract information, authentication/authorization information.
  • AF is mainly responsible for providing services to the 3GPP network, such as influencing service routing, interacting with PCF for policy control, etc.
  • UPF is mainly responsible for processing user messages, such as forwarding and charging.
  • DN is an operator network that provides users with data transmission services, such as IP Multi-media Service (IMS) and Internet (Internet).
  • IMS IP Multi-media Service
  • Internet Internet
  • MEC is based on the 5G evolution architecture, a technology that deeply integrates wireless networks and the Internet.
  • 5G evolution architecture a technology that deeply integrates wireless networks and the Internet.
  • an open platform is built to implant applications, and through the wireless application programming interface ( Application Programming Interface (API) realizes the information interaction between the wireless network and the service server, and integrates the wireless network and the service.
  • API Application Programming Interface
  • MEC can provide customized and differentiated services to the industry, thereby improving network utilization efficiency and value-added value.
  • the MEC may be composed of a mobile edge platform (Mobile Edge Platform, MEP) platform and an application or DN or application function (AF) mounted on the platform.
  • the authorization of the MEC to the terminal includes the access authorization of the MEP platform (or the access authorization of the MEC), and the authorization of the application or DN or AF on the MEP platform (or the service provided by the application or DN or AF) Authorization).
  • the MEC server is deployed on the side of the base station, as shown in MEC1 in Figure 1 (deployed inside the base station, or connected to the base station as an independent network element), sinking
  • the deployed MEC1 can directly offload the local business data to the locally deployed server, avoiding the detour of traffic in the core network.
  • the MEC is deployed on the sinking UPF side (ie, the local UPF), as shown in MEC2 in Figure 1 (the MEC server is integrated in the UPF, or the MEC is connected to the UPF).
  • the terminal can access the services provided by the DN in the following three ways:
  • the terminal establishes a Protocol Data Unit (PDU) session from the terminal to the RAN to the UPF to the DN, and directly accesses the DN, as shown in path c in Figure 1.
  • PDU Protocol Data Unit
  • Method 2 Based on MEC1, MEC1 is deployed on the base station side, and the application corresponding to the service is deployed on MEC1.
  • the terminal establishes a PDU session between the terminal and the RAN to MEC1, and accesses the service provided by the application on the MEC1 server, as shown in Figure 1. As shown in path a.
  • Method 3 Based on MEC2, MEC2 is deployed on UPF and business-corresponding applications are deployed on MEC2.
  • the terminal establishes a PDU session from the terminal to RAN to UPF to MEC2, and accesses the application deployed on the MEC 2 server on the operator’s network
  • the service provided is shown in path b in Figure 1.
  • the network side needs to verify the legitimacy of the terminal's identity, and the terminal can be authorized to access the service requested after the authentication is passed.
  • the authentication and authorization of the terminal by the network side includes the authentication and authorization when the terminal accesses the MEP platform (or MEC), and the authentication and authorization when the terminal accesses specific services. For example, when a terminal accesses the service provided by an application on the MEP platform (or MEC), it must first access the MEP platform (or MEC), so it must first go through the authentication and authorization of the MEP platform (or MEC). After a terminal accesses the MEP platform (or MEC), the authentication and authorization of the application on the MEP platform (or MEC) for the first terminal to access specific services is further executed.
  • the terminal Due to the mobility of the terminal, the location of the terminal changes dynamically, so the terminal often cannot access services based on the original connection, and needs to switch and connect to a new MEC to ensure service continuity. For example, switching from one MEC to another MEC, or switching from the Internet to MEC, or switching from a data network to MEC, and so on.
  • the terminal access to the new MEC must re-execute the authentication process (including the authentication of accessing the MEP platform (or MEC), and/or the authentication of the access service) before it can be authorized to access the service, resulting in signaling And the increase in delay may even interrupt the service that the terminal is accessing.
  • the authentication of the MEP platform (or MEC) and the authentication of the service belong to two independent authentications, which may be both at the same time, or there may be only one authentication method, which is not limited in the embodiment of this application.
  • At least one means one or more, and “plurality” means two or more.
  • “And/or” describes the association relationship of the associated objects, indicating that there can be three relationships, for example, A and/or B, which can mean: A alone exists, A and B exist at the same time, and B exists alone, where A, B can be singular or plural.
  • the character “/” generally indicates that the associated objects before and after are in an “or” relationship.
  • "The following at least one item (a)” or similar expressions refers to any combination of these items, including any combination of a single item (a) or a plurality of items (a).
  • at least one item (a) of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple .
  • the ordinal numbers such as “first” and “second” mentioned in the embodiments of this application are used to distinguish multiple objects, and are not used to limit the order, timing, priority, or importance of multiple objects.
  • the first priority criterion and the second priority criterion are only for distinguishing different criteria, but do not indicate the difference in content, priority, or importance of the two criteria.
  • FIG. 2 an authentication and authorization method provided by an embodiment of this application, and the method can be applied to the communication system described in FIG. 1.
  • a first network function acquires first information.
  • the first information is used to indicate that the first authentication entity has authenticated and/or authorized the first terminal
  • the first information includes an identifier of the first terminal
  • the first information is the first information after integrity protection
  • the first authentication entity is deployed on the first MEC or the Internet or a data network.
  • the specific implementation manner for the first NF to obtain the first information may be that the first NF generates the first information by itself, or reads the pre-stored first information locally, or the first NF obtains the first information from Other network elements/entities request the first information, which is not limited here.
  • the first authentication sends a request to the first authentication entity, and then the first authentication entity generates first information in response to the request and returns it to the first NF.
  • the first authentication entity may generate first information and feed it back to the first NF when the second authentication entity needs to perform authentication and/or authorization on the first terminal.
  • the first NF determines that the first terminal needs
  • the first NF sends a request to the first authentication entity on the first MEC (the request is used to instruct the first authentication entity to feed back the first information, and the request may also include an indication, Instructing the first authentication entity to feed back the first information), so that the first authentication entity on the first MEC generates and feeds back the first information to the first NF in response to the request of the first NF.
  • the first authentication entity can generate and feed back the first information in a timely manner according to requirements, and save system overhead.
  • the first authentication entity may generate the first information in advance (for example, when the authentication and/or authorization is performed on the first terminal) and send the first information to the first NF. Then, the first NF determines that the first terminal needs to receive information from the first NF. When the MEC switches to the second MEC, it may directly send the first information received in advance to the second authentication entity. In this way, the process of the first NF requesting the first information from the first authentication entity can be saved, and the efficiency of the authentication and authorization of the first terminal by the second authentication entity can be improved.
  • the first authentication entity may be an application program used to provide services for the first terminal, and the application program has the functions of authentication, authorization, and accounting (Authentication, Authorization, Accounting, AAA); or a standalone
  • AAA Authentication, Authorization, Accounting
  • AAA is used for description below.
  • the authentication and/or authorization of the first terminal performed by the first authentication entity including but not limited to the following two: 1) secondary authentication performed by SMF; 2) AMF participates in the implementation of slice authentication.
  • FIG. 3A is a flowchart of the secondary authentication performed by SMF participation.
  • the network will perform the first authentication on the UE (step 2 in FIG. 3A) to verify whether the UE is legal (whether the UE is accurately connected to the network).
  • the secondary authentication (optional, can be based on Extensible Authentication Protocol (EAP) identity verification) occurs after the UE registration process, that is, after the UE initiates a PDU session establishment request to the SMF, when the SMF determines that it needs to be executed During the second authentication, the content in the box in Figure 3A will be executed (steps 8-15).
  • EAP Extensible Authentication Protocol
  • the AAA server After DN-verification, the AAA server will send the authentication result to SMF. If the authentication result shows that the authentication is successful, the SMF executes the subsequent session establishment process; otherwise, the SMF rejects the session establishment.
  • the entities involved in the secondary authentication in the process shown in Figure 3A are the UE and the external DN-AAA.
  • the purpose of the secondary authentication is to enable the operator network to know whether the UE is a legitimate user of DN-AAA during the establishment of a PDU session, thereby Only establish sessions for legitimate UEs.
  • FIG. 3A is an example of the deployment of the first authentication entity (ie AAA) on the data network. If the first authentication entity is deployed on the first MEC, replace DN-AAA in FIG. 3A with MEC1-AAA, and other The process remains the same. Similarly, if the first authentication entity is deployed on the Internet, the DN-AAA in Figure 3A is replaced with Internet-AAA, and the other processes remain unchanged.
  • AAA the first authentication entity
  • FIG. 3B is a flowchart of slice authentication performed by AMF.
  • Slice authentication is an independent slice authentication process initiated by the UE after completing registration.
  • the main difference from secondary authentication is that slice authentication is triggered by AMF.
  • steps 2 and 3 in Figure 3B are optional, that is, if the AMF does not have the UE ID, the AMF obtains the UE ID by performing steps 2-3. After that, the AMF performs the authentication from AUSF to AAA, and the subsequent authentication process is basically similar to the secondary authentication.
  • the participating entities include UE, AMF, AUSF, AAA (AAA here may be divided into AAA proxy (AAA proxy, AAA-P) and AAA service (AAA server, AAA-S) two entities.
  • AAA AAA proxy
  • AAA-S AAA service
  • the entities are UE, AMF, SMF, UPF and AAA.
  • the authentication network element involved here can be AUSF or other new network entities, without restrictions.
  • the first NF in the embodiment of the present application may be different.
  • the first NF may be SMF;
  • the authentication and/or authorization scenario performed by the authentication entity on the first terminal is slice authentication performed by AMF, and the first NF may be AMF.
  • the above is just an example and not a limitation, and the possibility of other scenarios is not excluded during specific implementation, such as authentication performed by RAN participation.
  • the first NF may be a base station.
  • the specific description refers to the description of AMF or SMF, and details are not repeated here.
  • the first NF may be the SMF corresponding to the first MEC or the SMF corresponding to the second MEC , The embodiment of this application does not limit it.
  • the SMF corresponding to the first MEC and the SMF corresponding to the second MEC may be the same or different.
  • the first NF can be the AMF corresponding to the first MEC or the second MEC AMF, the embodiment of this application does not limit it.
  • the AMF corresponding to the first MEC and the AMF corresponding to the second MEC may be the same or different.
  • the integrity protection of the first information by the first authentication entity can be implemented in multiple ways.
  • the first authentication entity may perform integrity protection on the first information (for example, adding a digital signature or message verification code, etc.) based on the shared key (ie, symmetric key) between the first authentication entity and the second authentication entity, or The integrity protection of the first information is performed based on the asymmetric key stored by the first authentication entity.
  • the above is only an example and not a limitation, and other integrity protection methods may also be used in specific implementation, which is not limited in the embodiment of the present application.
  • the first NF sends the first information, and the second authentication entity receives the first information; where the second authentication entity is deployed on the second MEC, and the first authentication entity and the second authentication entity provide the same service.
  • the first authentication entity and the second authentication entity provide the same service, including: the first authentication entity and the second authentication entity are the same application, for example, the video server of the same application is deployed on different MECs, and the video on the two MECs
  • the server can provide the same video content; or, the first authentication entity and the second authentication entity are two different applications, but these two different applications can provide the same service.
  • two different application video servers are deployed in Different MECs, the video servers on the two MECs can provide the same video content.
  • step S204A is executed, otherwise, step S204B is executed.
  • the second authentication entity authorizes the first terminal.
  • S204B The second authentication entity refuses to authorize the first terminal, or the second authentication entity performs an authentication process on the first terminal, and then authorizes the first terminal after the authentication is passed.
  • the authorization of the first terminal here is a possible description, and it may also be described as the second authentication entity authorizing the first terminal to access the service corresponding to the second authentication entity, or allowing the first NF to switch the service corresponding to the first terminal To the second authentication entity, etc.
  • the authorization of the first type of terminal in the relevant part below, please refer to the description here.
  • the method for the second authentication entity to verify the integrity of the first information corresponds to the method for the first authentication entity to perform integrity protection on the first information in step S201.
  • the second authentication entity is based on the shared key (Symmetric key) verifies the integrity of the received first information; if the first authentication entity stores the private key of the first authentication entity and uses the private key of the first authentication entity to protect the integrity of the first information, then The second authentication entity verifies the integrity of the received first information based on the private key corresponding to the private key.
  • the shared key Symmetric key
  • the process of authorizing a terminal device on the network side generally first authenticates the legitimacy of the terminal device, and after the identity legitimacy authentication is passed, the terminal device is authorized to access the corresponding service. Therefore, in this embodiment of the application, the first information may indicate that the first authentication entity has authenticated the first terminal, or that the first authentication entity has authorized the first terminal, and may also indicate that the first authentication entity has authenticated and authorized the first terminal. For a terminal, no matter which of the above indication methods is adopted, the second authentication entity can determine the legitimacy of the identity of the first terminal, thereby omitting the authentication process for the first terminal and directly authorizing the first terminal.
  • the first authentication entity transmits the first information used to indicate that the first authentication entity has authenticated and/or authorized the first terminal to the second authentication entity, so that the second authentication entity can The information can be learned that the first authentication has authenticated and/or authorized the first terminal, so that the legitimacy of the terminal device's identity can be determined without re-authenticating the terminal device, and the first terminal can be directly authorized.
  • the re-authentication process can be omitted, signaling overhead and transmission delay can be effectively reduced, and the first terminal's service to the service can be better guaranteed. Continuity needs.
  • the first information is integrity-protected information, the reliability of the first information is high, and the security of the access service of the first terminal can be guaranteed.
  • the first NF may send an additional indication to the second authentication entity to indicate whether the first terminal is authenticated or authorized by the (first authentication entity).
  • the second authentication entity receives the instruction, and the instruction indicates that the first terminal is authenticated or authorized by the (first authentication entity), the above steps S202 to S204A/B are executed.
  • the second authentication entity If the second authentication entity does not receive the instruction, or receives the instruction but the instruction indicates that the first terminal is not authenticated or authorized by the (first authentication entity), the second authentication entity triggers the authentication process for the first terminal. Or, the second authentication entity has received the indication, and the indication indicates that the first terminal is authenticated or authorized by (the first authentication entity), but the second authentication entity determines that the authentication process needs to be triggered according to the local policy (for example, whether it is the first authentication entity). Whether the authentication entity authenticates the first terminal, the second authentication entity must trigger the authentication process).
  • the same authentication entity may have multiple service authentication and/or authorization for the same terminal device at the same time, and the same authentication entity may have different authentication and/or authorization results for different services of the same terminal device.
  • the first authentication entity may provide authentication and/or authorization for the first service and the second service, but the first authentication entity only authorizes the first terminal to access the first service, and does not authorize the first terminal to access the second service.
  • the first information may specifically be used to indicate that the first authentication entity has authorized the first terminal to access the first authentication entity and the first authentication entity.
  • the same service provided by the second authentication entity that is, the service that both the first authentication entity and the second authentication entity can provide.
  • the specific implementation of the second authentication entity's authorization of the first terminal may be: the second authentication entity determines according to the first information that the first authentication entity has authorized the first terminal to access the same information provided by the first authentication entity and the second authentication entity.
  • the second authentication entity authorizes the first terminal to access the same service provided by the first authentication entity and the second authentication entity.
  • the number of the same service provided by the first authentication entity and the second authentication entity may be one or more, which is not limited in the embodiment of the present application.
  • the first information may also include the first service information; the second authentication entity may also verify the information in the first information before authorizing the first terminal Whether the first service information matches the second service information provided by the second authentication entity; after determining that the first service information matches the second service information, the first terminal is authorized to access the service corresponding to the first service information.
  • the first service information may include a data network identifier (Data Network Name, DNN) And/or Data Network Access Identifier (DNAI).
  • DNN Data Network Name
  • DNAI Data Network Access Identifier
  • the second authentication entity checks whether the DNN of the second authentication entity matches the DNN in the first information, and/or checks whether the DNAI of the second authentication entity matches the DNAI in the first information; It is determined that the DNN of the second authentication entity matches the DNN in the first information, and/or, after it is determined that the DNAI of the second authentication entity matches the DNAI in the first information, the first terminal is authorized to access the first service information office. Corresponding business.
  • the first service information may include slice information.
  • the second authentication entity checks whether the slice information of the second authentication entity matches the slice information in the first information; after determining that the slice information of the second authentication entity matches the slice information in the first information, authorizes The first terminal accesses the service corresponding to the first service information.
  • the slice information here may be a slice ID, or slice selection service information, or at least one item of single slice selection service information.
  • Fig. 4 is a possible MEC handover scenario in an embodiment of this application.
  • MEC1 is deployed on UPF1
  • MEC2 is deployed on UPF2
  • SMF1 is responsible for session management of UPF1
  • SMF2 is responsible for session management of UPF2
  • AMF1 is connected to SMF1
  • AMF2 is connected to SMF2.
  • SMF1 and SMF2 can be the same (that is, the same SMF) or different.
  • UPF1 and UPF2 can be the same (that is, the same UPF) or different.
  • AAA functions are deployed on both MEC1 and MEC2.
  • AAA and APP can be deployed in one (equivalent to APP having AAA function), or can be deployed separately, which is not limited in the embodiment of this application.
  • MEC1-APP1 when MEC1 provides services for UE, MEC1 can be regarded as MEC1-APP1.
  • MEC1-AAA1 When MEC2 provides services for UE, MEC2 can be regarded as MEC1-APP1.
  • MEC2-APP1 when MEC2 performs authentication for the UE, MEC2 can be regarded as MEC2-AAA2.
  • FIG. 5 another authentication and authorization method provided by this embodiment of the present application is applicable to the communication system shown in FIG. 4. Methods include:
  • S500 The UE registers successfully, and establishes a session with MEC1-APP1 on MEC1.
  • the execution process of the session is a secondary authentication process executed between UE1 and SMF1, UPF1 and MEC1-AAA1 corresponding to MEC1-APP1.
  • the UE performs uplink and downlink data transmission through UPF1 and MEC1-APP1.
  • the UE When the UE performs uplink and downlink data transfer with MEC1-APP1 through UPF1, the UE moves farther and farther from MEC1, triggering MEC1-AAA1 to send a MEC handover request to SMF1.
  • MEC1-AAA1 sends information to SMF1, and the information contains the location information of APP1 deployed in the network.
  • the information may include a DNAI list (list), and the DNAI list contains the location information of APP1 deployed in the network.
  • list contains the location information of APP1 deployed in the network.
  • MEC1-AAA1 can perceive the location of the UE, for example, by subscribing to the location information of the UE from the NF (such as UDM, location control function network element, AMF, etc.) in the operator's network.
  • the NF such as UDM, location control function network element, AMF, etc.
  • the above step S501 is executed to trigger the SMF1 to switch to the APP corresponding to the DNAI in the received information (ie APP1).
  • SMF1 determines that the UE needs to migrate APP1 according to the information sent by MEC1-AAA1, that is, switch to the MEC that provides APP1 services.
  • SMF1 can determine the nearest MEC (with APP1 deployed), that is, MEC2, according to the DNAI list and the location of the UE, so that APP1 can better serve the UE.
  • the specific implementation manners for SMF1 to obtain the location information of the UE can be multiple, which are not limited in the embodiment of the present application.
  • the SMF1 can obtain the location information of the UE from a third NF (for example, AMF, location management entity, UDM, etc.).
  • SMF1 subscribes to the location of the UE from the third NF, and sends a subscription request to the third NF, which includes the ID of the UE; when the location of the UE changes, the third NF sends a notification to the SMF, and the notification includes the location of the UE.
  • step S501 may not be performed.
  • SMF1 obtains the DNAI list in advance, and MEC1-AAA1 does not need to send it again.
  • the application corresponding to MEC1-AAA1 or MEC1-AAA1 sends the DNAI list to the SMF in other ways, such as through other interfaces such as capability opening. Therefore, the above step S501 is optional, and is represented by a dashed line in FIG. 5.
  • SMF1 can also determine the SMF corresponding to MEC2, namely SMF2; and, SMF1 sends a handover request to SMF2, and the handover request can carry the target DNAI (ie the DNAI corresponding to MEC2) and the UE Identity Document (ID); SMF2 determines the information of the UPF (ie UPF2) where MEC2 is located. If SMF does not need to be switched (that is, SMF1 does not need to be switched to SMF2, SMF1 can complete the service of MEC2), then SMF1 can determine the information of UPF2.
  • the UPF2 information here may be UPF2 location information (such as IP address, MAC address), or UPF2 identification information (UPF2ID, etc.), which is not limited in this embodiment of the application.
  • UPF2 location information such as IP address, MAC address
  • UPF2ID UPF2 identification information
  • the UE ID here can be a subscription permanent identifier (SUPI) of the UE, a general public subscription identifier (GPSI), or a UE APP ID; or a globally unique temporary identifier At least one of (Globally Unique Temporary Identity, GUTI), etc., which is not limited in the embodiment of the present application.
  • SUPI subscription permanent identifier
  • GPSI general public subscription identifier
  • UE APP ID a globally unique temporary identifier
  • GUTI Globally Unique Temporary Identity
  • SMF2 sends response information, and the response information carries UPF2 information; SMF1 receives the response information from SMF2.
  • steps S503-504 are executed depends on the requirements of MEC1-AAA1 to calculate tokens. That is, if MEC1-AAA1 calculates tokens and UPF2 information is required, then the above steps S503-504 are executed, if MEC1-AAA1 does not need UPF2 information to calculate the token, so the above steps S503-504 may not be executed.
  • SMF1 sends a DNAI change request to MEC1-AAA1, which carries the UE ID (for example, UE APP ID, that is, the identifier of the APP used by the UE, for example, if the APP is WeChat, the UE APP ID is the UE's WeChat ID).
  • UE ID for example, UE APP ID, that is, the identifier of the APP used by the UE, for example, if the APP is WeChat, the UE APP ID is the UE's WeChat ID).
  • the change request may also carry UPF2 information.
  • the DNAI change request may also include one or more of the following: 1) SMF (may be SMF1 or SMF2) information.
  • the SMF information can be SMF location information or identification information; 2) secondary authentication indication (2nd auth.Rqr); 3) including target DNAI; 4) target DNN; 5) other UE ID (such as SUPI , GPSI, GUTI, etc.); 6) APP ID (for example, if APP is WeChat, APP ID is WeChat ID).
  • MEC1-AAA1 receives the DNAI change request from SMF1, and MEC1-AAA1 determines whether the UE has succeeded in the second authentication at MEC1-AAA1. If the authentication is successful, a token is calculated. It should be understood that the token here is a possible specific implementation of the first information mentioned above, and the token may indicate that MEC1-AAA1 has authenticated the UE and/or authorized the UE to access APP1.
  • the token may be the information obtained by using the (symmetric or asymmetric) key of MEC1-AAA1 to add security verification parameters (such as message verification code, digital signature, etc.) to the protected information.
  • security verification parameters such as message verification code, digital signature, etc.
  • the calculation methods of safety verification parameters include but are not limited to the following two:
  • the private key (Secret Key, SK) of the asymmetric key stored by MEC1-AAA1 calculates the security verification parameters. After MEC2-AAA2 receives the token, it is verified according to the public key (PK) of the asymmetric key Safety verification parameters.
  • PK public key
  • the formats of SK and PK here belong to the basic methods of cryptography, so I won’t repeat them.
  • the definition of SK and PK can be completed based on the RSA algorithm (an asymmetric encryption algorithm proposed by Ron Rivest, Adi Shamir, and Leonard Adleman).
  • At least one item of the protected information in the Token is
  • APP1 related information such as target DNAI, DNN, APP ID
  • the identity of the UE such as GPSI, SUPI, 5G-GUTI, UE App ID;
  • MEC platform information such as ID1 of MEC1 platform, ID2 of MEC2 platform;
  • MEC1-AAA1 information such as MEC AAA1 identification, address, etc.
  • Validity period where the validity period can be the validity period of the token, or the validity period of the second authentication performed by MEC1-AAA1 on the UE (if the second authentication performed by MEC1-AAA1 on the UE expires, the token is invalid).
  • Slice information (it can be the information of APP1 or the current service of UE or the slice where MEC1 is located), such as network slice selection assistance information (Single Network Slice Selection Assistance Information, S-NSSAI), slice ID, etc.
  • S-NSSAI Single Network Slice Selection Assistance Information
  • DNN can be SMF1, UE App ID sent to MEC-AAA1;
  • MEC platform ID1 can be obtained from MEC1 for SMF1 and sent to ME1C-AAA1.
  • the MEC platform ID2 can be obtained from MEC2 for SMF1 and sent to MEC-AAA1.
  • MEC1-AAA1 After calculating the token, MEC1-AAA1 sends the token to SMF1.
  • the token includes protected information (such as APP1 related information, UE identification, network element identification, MEC platform information, MEC1-AAA1 information, validity period, etc.) and security verification parameters (such as message verification code, or digital signature) .
  • protected information such as APP1 related information, UE identification, network element identification, MEC platform information, MEC1-AAA1 information, validity period, etc.
  • security verification parameters such as message verification code, or digital signature
  • SMF1 sends an access request to MEC2-AAA2, which carries a token, and may also carry other parameters such as UE ID and DNAI (here, other parameters such as UE ID and DNAI may be identification information encapsulated in the outer layer of the token).
  • MEC2-AAA2 which carries a token
  • other parameters such as UE ID and DNAI may be identification information encapsulated in the outer layer of the token.
  • SMF1 can send the token directly to MEC2-AAA2, or send the token to MEC2-AAA2 through other NFs, such as UPF1, UPF2, or Network Exposure Function (NEF), etc. There is no restriction here. .
  • MEC2-AAA2 verifies the token, and if the verification passes, it is determined that the UE has passed the secondary authentication on MEC1, and there is no need to perform secondary authentication on MEC2.
  • the verification process includes: verifying the security verification parameters through K1 or PK to determine the integrity of the token.
  • the verification process can also include at least one of the following items:
  • the request sent by SMF1 or SMF2 is rejected, that is, the UE is denied access to MEC2-APP1; or, MEC2-AAA2 triggers SMF1 or SMF2 to re-authenticate the UE; or, MEC2-AAA2 according to the local policy, Trigger SMF1 or SMF2 to re-authenticate the UE, and there is no restriction here.
  • MEC2-AAA2 needs to obtain the information of its own platform, such as the ID2 of the MEC2 platform.
  • MEC2-AAA2 can obtain ID2 of MEC2 platform by: SMF1 sends to MEC2 according to information such as DNAI; or MEC2-AAA2 obtains ID2 according to the preset mapping relationship between DNAI and ME2 platform ID2; or MEC2-AAA2 directly It is read from MEC2 or obtained from the management plane, and the embodiment of this application does not impose restrictions here.
  • MEC2-AAA2 sends a response to SMF1, indicating the verification result.
  • SMF1 continues to execute the business process.
  • SMF1 sends a message to SMF2, which carries an authentication success indication, which is used to inform SMF2 that the current UE has been authenticated and/or authorized successfully at MEC2-AAA2.
  • SMF1 triggers a secondary authentication process to re-authenticate the UE.
  • SMF1 sends a message to SMF2, which carries an authentication failure indication, which is used to inform SMF2 that the UE has been authenticated and/or has failed authorization at MEC2-AAA2. After that, SMF2 triggers the secondary authentication process to re-authenticate the UE.
  • SMF1 (or SMF2 through SMF1) can also send a non-access stratum (NAS) message to the UE, indicating that the UE needs to perform MEC handover, and normally perform the UPF handover procedure, and The original access business was executed normally.
  • SMF1 or SMF2 may send the secondary authentication successful skip indication to the UE. If the verification result fails, the handover is rejected or the secondary authentication is triggered.
  • NAS non-access stratum
  • SMF1 may also send a switching message to SMF2 after the above step S502 is executed, and then SMF2 will perform the operations performed by SMF1 in the above steps S503-S510 ( That is, SMF2 obtains the token from MEC-AAA1, and SMF2 sends an access request (carrying the token) to MEC2-AAA2).
  • the trust transfer between MEC2-AAA2 and MEC1-AAA1 can be realized for the UE, so that MEC2-AAA2 does not need to perform the secondary authentication process on the UE, which can effectively reduce signaling overhead and transmission time. It can better guarantee the continuity requirements of the first terminal for business.
  • FIG. 6 another authentication and authorization method provided by this embodiment of the application is applicable to the communication system shown in FIG. 4. Methods include:
  • S600 The UE registers successfully, and establishes a session with MEC1-APP1 on MEC1.
  • the execution process of the session is a secondary authentication process executed between UE1 and SMF1, UPF1 and MEC1-AAA1 corresponding to MEC1-APP1.
  • MEC1-AAA1 completes the secondary authentication of the UE, the UE is authorized to establish a session, and MEC1-AAA1 calculates a token, which is used to indicate that MEC1-AAA1 has authenticated and/or authorized the UE.
  • calculation method of token in this embodiment is different from the calculation method of token in the embodiment shown in FIG. It was not determined whether to switch, and it was not determined whether to switch to MEC2.
  • the protected information in the token includes at least one of the following items:
  • APP1 related information such as target DNAI, DNN, APP ID
  • the identity of the UE such as GPSI, SUPI, 5G-GUTI, UE App ID;
  • MEC1-AAA1 information such as MEC AAA1 identification, address, etc.
  • Validity period where the validity period can be the validity period of the token, or the validity period of the second authentication performed by MEC1-AAA1 on the UE (if the second authentication performed by MEC1-AAA1 on the UE expires, the token is invalid);
  • Slice information (it can be the information of APP1 or the current service of UE or the slice where MEC1 is located), such as S-NSSAI, slice ID, etc.
  • MEC1 when MEC1 sends an authentication success indication to SMF1, it can send the token to SMF1 at the same time.
  • the token can be carried in the authentication success indication.
  • SMF1 sends a session establishment response to the UE, and the UE performs uplink and downlink data transmission through UPF1 and MEC1-APP1.
  • step S601 when the UE performs uplink and downlink data transfer with MEC1-APP1 through UPF1, the UE moves and gets farther and farther from MEC1-APP1, triggering MEC1-AAA1 to send a DNAI list to SMF1 (that is, step S601).
  • the DNAI list can also be sent after MEC1-AAA1 performs the second authentication, and step S601 does not need to be performed, and step S602 is directly performed.
  • MEC1-AAA1 sends a DNAI list to SMF1, and the DNAI list contains the location information of APP1 deployed in the network.
  • step S601 is also optional here.
  • MEC1-AAA1 can send a DNAI list to SMF1 after performing the second authentication.
  • the application corresponding to MEC1-AAA1 or MEC1-AAA1 sends the DNAI list to the SMF in other ways, such as through other interfaces such as capability opening.
  • S602 SMF1, based on the DNAI list and the location of the UE, determines that the UE needs to switch to the MEC that provides APP1 services, and determines the MEC that is closest to the UE (APP1 is deployed) as the target MEC for the handover, so that APP1 can better serve UE provides services.
  • SMF1 sends a DNAI change request to UPF2.
  • the DNAI change request carries a token, and may also carry the DNAI and UE ID of MEC2.
  • UPF2 forwards the DNAI change request to MEC2-AAA2.
  • MEC2-AAA2 receives the DNAI change request from SMF1, verifies the token, and if the verification passes, it is determined that the UE has passed the secondary authentication on MEC1, and no secondary authentication is required on MEC2.
  • step S509 For the specific verification process, please refer to the specific verification process in step S509 above, which will not be repeated here.
  • MEC2-AAA2 sends an access response to SMF1, indicating the verification result.
  • SMF1 or MEC1-AAA1 can also send the token to SMF2 in advance, and then SMF2 performs the operations performed by SMF1 in steps S603-S606 above (that is, SMF2 interacts with MEC2-AAA2) Complete the authentication and authorization of the UE).
  • MEC1-AAA1 generates a token immediately after performing secondary authentication on the UE and sends it to the SMF.
  • the token can be directly sent to MEC2.
  • the process of SMF requesting token from MEC1-AAA1 can be saved, the efficiency of authentication and authorization of the first terminal by MEC1-AAA2 can be improved, and signaling and time delay can be further saved.
  • FIG. 7 another authentication and authorization method provided by this embodiment of the application is applicable to the communication system shown in FIG. 4. Methods include:
  • the UE registers successfully, and establishes a session with MEC1-APP1 on MEC1.
  • the execution process of the session is a secondary authentication process executed between UE1 and SMF1, UPF1 and MEC1-AAA1 corresponding to MEC1-APP1.
  • the UE performs uplink and downlink data transmission through the application corresponding to UPF1 and MEC1-APP1.
  • MEC1-AAA1 sends a DNAI list to SMF1.
  • step S701 is also optional here.
  • MEC1-AAA1 can send a DNAI list to SMF1 after performing the second authentication.
  • the application corresponding to MEC1-AAA1 or MEC1-AAA1 sends the DNAI list to the SMF in other ways, such as through other interfaces such as capability opening.
  • SMF1 determines, according to the DNAI list, that the UE needs to switch and switches the MEC that provides APP1 services to MEC2.
  • SMF1 sends a handover request to SMF2 to obtain UPF2 information.
  • SMF1 receives UPF2 information.
  • steps S703 and S704 are also optional here, and whether steps S703 and S704 are executed needs to be determined according to the content of the second information in the following text.
  • SMF1 sends a DNAI change request to MEC1-AAA1, which carries at least the UE ID (such as the UE APP ID).
  • the DNAI change request may also include one or more of the following: UPF2 information, SMF information, secondary authentication indication (2nd auth.Rqr), target DNAI, target DNN, other UE ID, APP ID.
  • MEC1-AAA1 receives the DNAI change request from SMF1, and MEC1-AAA1 determines whether the UE has succeeded in the second authentication at MEC1-AAA1. If the authentication is successful, step S707 is executed.
  • steps S700-S706 please refer to the specific implementation of S500-S506 above, which will not be repeated here.
  • MEC1-AAA1 directly send the information in the DNAI change request, such as UE ID, SMF information, UPF2 information, etc., to MEC1-AAA2 (for ease of description, the information sent by MEC1-AAA1 to MEC2-AAA2 is referred to as the second information).
  • the second information sent by MEC1-AAA1 to MEC2-AAA2 here is different from the first information (such as token) above.
  • the second information may not undergo integrity protection, because the second information can be directly based on the relationship between MEC1 and MEC2. Since the transmission between the interfaces is not forwarded by other network elements, the security of the transmission can be guaranteed, so the integrity protection may not be performed.
  • MEC1 can also perform integrity protection on the second information before sending it to MEC2-AAA2, for example, calculating a token based on the second information, and sending the token to MEC2-AAA2, which is not limited in this application.
  • MEC1-AAA1 returns a handover response to SMF1.
  • SMF1 sends an access request to MEC2-AAA2.
  • the access request includes UE app ID, UPF2 information, SMF information, secondary authentication indication (2nd auth.Rqr), target DNAI, target DNN, other UE ID (such as GPSI, GUTI, SUPI, etc.), at least one of APP ID.
  • the MEC2-AAA2 determines, according to the second information, whether the content in the access request sent by the SMF1 matches the content provided by itself, for example, whether the content is the same. If it matches, it is determined that the UE has passed the secondary authentication on MEC1 or that MEC1-AAA1 has authorized the UE to use the corresponding services of MEC1-AAA1, so MEC2 does not need to perform secondary authentication and directly authorizes the UE to establish a session.
  • MEC2-AAA2 returns an access response to SMF1.
  • MEC1-AAA1 and MEC2-AAA2 can communicate. After SMF1 sends a DNAI change request to MEC1-AAA1, MEC1-AAA1 sends UE ID, UPF2 information, etc. to MEC2-AAA2, and then SMF1 sends an access request to MEC2 -After AAA2, MEC2-AAA determines whether the UE has been successfully authenticated or authorized to access the session according to the received UE ID. If it is displayed, the secondary authentication process is omitted, and the UE’s session is directly authorized to establish the session, thereby reducing Signaling overhead and transmission delay during MEC handover. In addition, the trust parameter (ie, the second information) is directly transferred between MEC platforms, which can further save signaling overhead and improve the efficiency of authentication and authorization.
  • the trust parameter ie, the second information
  • FIG. 8 another authentication and authorization method provided by this embodiment of the application is applicable to the communication system shown in FIG. 4.
  • S800 The UE registers successfully, and establishes a session with MEC1-APP1 on MEC1.
  • the execution process of the session is a secondary authentication process executed between UE1 and SMF1, UPF1 and MEC1-AAA1 corresponding to MEC1-APP1. After that, the UE performs uplink and downlink data transmission through the application corresponding to UPF1 and MEC1-APP1.
  • MEC1-AAA1 sends a DNAI list to SMF1.
  • the DNAI list contains the location information of APP1 deployed in the network.
  • step S801 here is also optional.
  • MEC1-AAA1 can send a DNAI list to SMF1 after performing the second authentication.
  • the application corresponding to MEC1-AAA1 or MEC1-AAA1 sends the DNAI list to the SMF in other ways, such as through other interfaces such as capability opening.
  • SMF1 determines that the UE needs to switch to the MEC that provides APP1 services; and according to the DNAI list and the location of the UE, it determines that the nearest MEC 2 is the target MEC of the handover, so that APP1 can better serve the UE.
  • steps S800-S802 please refer to the specific implementation of S500-S502 above, which will not be repeated here.
  • SMF1 determines whether to perform secondary authentication according to the local policy, and if secondary authentication is required, it further confirms whether re-authentication is required or standard secondary authentication.
  • the local policy here may be: the validity period of the second authentication of the UE by MEC1-AAA1, if it is within the validity period, no authentication is required; otherwise, re-authentication is initiated, and step S804 is executed.
  • the validity period here can be the SMF1 received from MEC1-AAA1 during the second authentication, or it can be configured locally, and there is no restriction here.
  • SMF1 initiates secondary authentication when the connection to the existing UPF1 user plane is not broken.
  • SMF1 initiates secondary authentication methods including but not limited to the following two:
  • SMF1 uses UPF1 and MEC2-AAA2 to perform secondary authentication and obtain the result.
  • the secondary authentication process here can be executed interactively by UE, SMF1, UPF1, MEC2-AAA2; or SMF1 may select UPF2, and then executed by UE, SMF1, UPF2, MEC2-AAA2. If the authentication is successful, the handover is triggered, otherwise the handover is rejected, or the current session of the UE is interrupted.
  • the location of MEC2-AAA2 can be determined by DNAI.
  • SMF1 selects SMF2 and instructs SMF2 to perform secondary authentication. At this time, the secondary authentication process is executed interactively by the UE, SMF2, UPF2, and MEC2-AAA2. After the secondary authentication is completed, SMF2 notifies SMF1 of the secondary authentication result. If the authentication is successful, SMF1 triggers the handover, otherwise it refuses to handover the MEC, or interrupts the current session of the UE.
  • the location of MEC2-AAA2 can be determined by DNAI.
  • MEC2-AAA2 triggers the MEC handover after the second authentication of the UE is successful.
  • the SMF1 can continue to perform the subsequent switching process. If it involves switching from SMF1 to a new SMF, if it needs to switch to SMF2, SMF1 can send the UE ID and re-authentication success indication to SMF2, and SMF2 performs the subsequent handover process, namely steps S806-S810.
  • SMF1 sends a handover request to SMF2, and the handover request may include the target DNAI, the UE ID, the indication of successful secondary authentication, and so on.
  • SMF2 determines the information of UPF2. It should be understood that the UPF2 here may be different from the UPF2 in the secondary authentication, the UPF2 here may be the UPF used to transmit data, and the UPF2 in the secondary authentication may be a UPF dedicated for secondary authentication.
  • S808 SMF2 sends the information of UPF2 to SMF1, and SMF1 receives the information of UPF2.
  • SMF1 sends a context migration request to MEC2, which carries information such as DNAI and UE ID.
  • the context relocation request may also carry an authentication success indication to inform the UE that the previous secondary authentication is successful, or authorize the UE to establish this PDU session.
  • MEC2 returns a context migration response to SMF1, thereby completing the switch from MEC1 to MEC2.
  • the MEC2 determines according to the foregoing authentication success indication that the UE has successfully performed authentication, and there is no need to trigger the secondary authentication for the UE again.
  • the SMF initiates the secondary authentication in advance when the existing UPF user plane connection is not broken. This can reduce the handover delay and reduce the impact on the UE's service continuity. Improve user experience.
  • the authentication entity is AAA
  • the service provider entity may be AF.
  • the above service providing entity is also described as AA, because there is no restriction on the interoperability of AAA and AF, which are all APP-related logical functions.
  • the technical solutions described above in Figures 5 to 8 are described from the perspective of applications, but other business scenarios, such as business servers, business authentication entities, and other description methods are also applicable.
  • FIGS. 5 to 8 are also applicable to the access authorization of the MEC platform, such as the access authentication of the UE and the MEC platform.
  • MEC1-AAA1 needs to be replaced by MEP1
  • MEC2-AAA2 should be replaced by MEP2.
  • the authentication scenarios in the technical solutions described in FIGS. 5 to 8 are based on secondary authentication as an example. In actual application, it is also applicable to general authentication procedures performed by other NFs.
  • the technical solutions described in FIGS. 5 to 8 are also applicable to slice authentication scenarios.
  • the entity involved in slice authentication is AMF, so it is necessary to replace SMF with AMF, that is, AMF obtains the token from MEC-AAA1 or MEP1.
  • the security parameters in the token can also be different.
  • the token can include at least one of the following protected information:
  • APP related information target DNAI, DNN, APP ID;
  • UE's identity GPSI, SUPI, 5G-GUTI, UE App ID;
  • AMF information authentication server function (authentication server function, AUSF) information (may also be slice authentication, AMF interacts with MEC1-AAA1 or MEP through AUSF); the identity of the network element needs to be passed to MEC1-AAA1 or MEP1;
  • MEC platform information MEC1 platform ID1, MEC2 platform ID2;
  • MEC1-AAA1 information MEC AAA1 identification, address, etc.
  • Slice related information such as S-NSSAI, slice ID, etc.
  • the validity period can be the validity period of the token, or the validity period can be the validity period of the second authentication.
  • the authentication and authorization method in the embodiment of the present application is described above, and the device for implementing the authentication and authorization method is described below. Among them, the method and the device are based on the same inventive concept. Since the principles of the method and the device to solve the problem are similar, the implementation of the device and the method can be referred to each other, and the repetition will not be repeated.
  • an embodiment of the present application provides an authentication and authorization device.
  • the device may have the function of realizing the second authentication entity in the foregoing method embodiment.
  • the device may be the second authentication entity or the first authentication entity. 2.
  • the above-mentioned functions can be realized by hardware, or can be realized by hardware executing corresponding software, and the hardware or software includes one or more modules corresponding to the above-mentioned functions.
  • the device includes:
  • the receiving module 901 is configured to receive first information from the first network function NF; wherein the first information is used to indicate that the first authentication entity has authenticated and/or authorized the first terminal, and the first information includes all The identifier of the first terminal, the first information is the first information after integrity protection; the first authentication entity is deployed on the first edge computing MEC or the Internet or data network, and the device is deployed on the second MEC Above, the first authentication entity and the device provide the same service;
  • the processing module 902 is configured to verify the integrity of the first information; if the verification is successful, authorize the first terminal.
  • the processing module 902 is specifically configured to: determine according to the first information that the first authentication entity has authorized the first terminal to access the service, then authorize the first terminal Access the service.
  • the first information further includes first business information
  • the processing module 902 is further configured to: before authorizing the first terminal, verify whether the first service information matches the second service information provided by the device;
  • the processing module 902 authorizes the first terminal, it is specifically configured to: after determining that the first service information matches the second service information, authorize the first terminal to access the first service The business to which the information corresponds.
  • the first NF is a session management function SMF; the application scenario of the authentication and/or authorization performed by the first authentication entity on the first terminal is the secondary execution of the SMF.
  • Authentication the first service information includes a data network identifier DNN and/or a data network access identifier DNAI;
  • the processing module 902 checks whether the first service information matches the second service information provided by the device, it is specifically configured to check whether the DNN of the device matches the DNN in the first information. Matching, and/or, verifying whether the DNAI of the device matches the DNAI in the first information;
  • the processing module 902 authorizes the first terminal, it is specifically configured to: determine that the DNN of the device matches the DNN in the first information, and/or determine that the DNAI of the device and the DNN in the first information match. After the DNAI in the first information matches, the first terminal is authorized to access the service corresponding to the first service information.
  • the first NF is a session management function AMF; the authentication and/or authorization scenario performed by the first authentication entity on the first terminal is the slice authentication performed by the AMF;
  • the first service information includes slice information;
  • processing module 902 checks whether the first service information matches the second service information provided by the device, it is specifically configured to check whether the slice information of the device matches the slice in the first information. Match the information;
  • the processing module 902 authorizes the first terminal, it is specifically configured to: after determining that the slice information of the device matches the slice information in the first information, authorize the first terminal to access the Describe the business corresponding to the first business information.
  • an embodiment of the present application also provides an authentication and authorization device.
  • the device may have the function of realizing the first NF in the foregoing method embodiment.
  • the device may be the first NF or the first NF.
  • the above-mentioned functions can be realized by hardware, or can be realized by hardware executing corresponding software, and the hardware or software includes one or more modules corresponding to the above-mentioned functions.
  • the device includes:
  • the receiving module 1001 is configured to receive first information from a first authentication entity; wherein the first information is used to indicate that the first authentication entity has authenticated and/or authorized the first terminal, and the first information includes The identifier of the first terminal, the first information is the first information after integrity protection; the first authentication entity is deployed on the first edge computing MEC or the Internet or a data network;
  • the sending module 1002 is configured to send the first information to a second authentication entity; wherein, the second authentication entity is deployed on a second MEC, and the first authentication entity and the second authentication entity provide the same business.
  • the first information is specifically used to indicate that the first authentication entity has authorized the first terminal to access the service.
  • the first information further includes first service information.
  • the device is a session management function SMF; the application scenario of the authentication and/or authorization performed by the first authentication entity on the first terminal is the secondary authentication performed by the SMF;
  • the first service information includes a data network identifier DNN and/or a data network access identifier DNAI.
  • the device is a session management function AMF; the authentication and/or authorization scenario performed by the first authentication entity on the first terminal is the slice authentication performed by the AMF;
  • the first service information includes slice information.
  • an embodiment of the present application also provides an authentication and authorization device.
  • the device may have the function of realizing the first authentication entity in the foregoing method embodiment.
  • the device may be the first authentication entity or The device in the first authentication entity.
  • the above-mentioned functions can be realized by hardware, or can be realized by hardware executing corresponding software, and the hardware or software includes one or more modules corresponding to the above-mentioned functions.
  • the device includes:
  • the processing module 1101 is configured to generate first information; wherein, the first information is used to indicate that the device has authenticated and/or authorized the first terminal, the first information includes the identifier of the first terminal, and the first information
  • the first information is the first information after integrity protection; the device is deployed on the first edge computing MEC or the Internet or data network;
  • the sending module 1102 is configured to send the first information to the first network function NF; the second authentication entity is deployed on the second MEC, and the device and the second authentication entity provide the same service.
  • the first information is specifically used to indicate that the device has authorized the first terminal to access the service.
  • the first information further includes first service information.
  • the first NF is a session management function SMF; the application scenario of the authentication and/or authorization performed by the device on the first terminal is the secondary authentication performed by the SMF;
  • the first service information includes a data network identifier DNN and/or a data network access identifier DNAI.
  • the first NF is the session management function AMF; the authentication and/or authorization scenario performed by the device on the first terminal is the slice authentication performed by the AMF;
  • a service information includes slice information.
  • an embodiment of the present application further provides a communication device, including:
  • At least one processor 1201 and a memory 1202 that is communicatively connected to the at least one processor 1201; a communication interface 1203; wherein the memory 1202 stores instructions executable by the at least one processor 1201, and the at least one The processor 1201 executes the authentication and authorization method in the foregoing method embodiment by executing the instructions stored in the memory 1202.
  • processor 1201 and the memory 1202 may be coupled through an interface circuit, or may be integrated together, which is not limited here.
  • the specific connection medium between the aforementioned processor 1201, memory 1202, and communication interface 1203 is not limited in the embodiment of the present application.
  • the processor 1201, the memory 1202, and the communication interface 1203 are connected by a bus 1204.
  • the bus is represented by a thick line in FIG. , Is not limited.
  • the bus can be divided into an address bus, a data bus, a control bus, and so on. For ease of presentation, only one thick line is used in FIG. 12 to represent it, but it does not mean that there is only one bus or one type of bus.
  • the processor mentioned in the embodiments of the present application may be implemented by hardware or software.
  • the processor When implemented by hardware, the processor may be a logic circuit, an integrated circuit, or the like.
  • the processor When implemented by software, the processor may be a general-purpose processor, which is implemented by reading software codes stored in the memory.
  • the processor may be a central processing unit (Central Processing Unit, CPU), or other general-purpose processors, digital signal processors (Digital Signal Processor, DSP), and Application Specific Integrated Circuit (ASIC) , Ready-made programmable gate array (Field Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc.
  • the general-purpose processor may be a microprocessor or the processor may also be any conventional processor or the like.
  • the memory mentioned in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory.
  • the non-volatile memory can be read-only memory (Read-Only Memory, ROM), programmable read-only memory (Programmable ROM, PROM), erasable programmable read-only memory (Erasable PROM, EPROM), and electrically available Erase programmable read-only memory (Electrically EPROM, EEPROM) or flash memory.
  • the volatile memory may be a random access memory (Random Access Memory, RAM), which is used as an external cache.
  • RAM random access memory
  • SRAM static random access memory
  • DRAM dynamic random access memory
  • DRAM synchronous dynamic random access memory
  • SDRAM double data rate synchronous dynamic random access memory
  • Double Data Eate SDRAM, DDR SDRAM enhanced synchronous dynamic random access memory
  • Enhanced SDRAM, ESDRAM synchronous connection dynamic random access memory
  • Synchlink DRAM, SLDRAM synchronous connection dynamic random access memory
  • DR RAM Direct Rambus RAM
  • the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component
  • the memory storage module
  • an embodiment of the present application further provides a chip, which is coupled with a memory, and is configured to read and execute program instructions stored in the memory to implement the authentication and authorization method in the foregoing method embodiment.
  • the embodiments of the present application also provide a computer-readable storage medium, including a program or instruction, and when the program or instruction runs on a computer, the authentication and authorization method in the foregoing method embodiment is executed.
  • embodiments of the present application also provide a computer program product, including instructions, which when run on a computer, cause the computer to execute the authentication and authorization method in the foregoing method embodiment.
  • These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing equipment to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing equipment can be used to generate It is a device that realizes the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.
  • the computer may be implemented in whole or in part by software, hardware, firmware, or any combination thereof.
  • software it can be implemented in the form of a computer program product in whole or in part.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another readable storage medium. For example, the computer instructions may be passed from a website, computer, server, or data center.
  • Wired such as coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (such as infrared, wireless, microwave, etc.) means to transmit to another website, computer, server, or data center.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or a data center integrated with one or more available media.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, and a magnetic tape), an optical medium (for example, a digital versatile disc (DVD)), or a semiconductor medium (for example, a solid state disk (SSD)). ))Wait.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • Multimedia (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

一种认证授权方法及对应装置，方法包括：第二认证实体从第一网络功能(Network Function，NF)接收第一信息；第一信息用于指示第一认证实体已对第一终端认证和/或授权，第一信息为完整性保护后的第一信息；第一认证实体部署在第一移动边缘计算(Mobile Edge Computing，MEC)或互联网或数据网络上，第二认证实体部署在第二MEC上，第一认证实体和第二认证实体提供相同的业务；第二认证实体校验第一信息的完整性；若校验成功，则对第一终端授权。通过该方法可以使得第二认证实体快速确定第一终端身份的合法性，直接对第一终端授权，可以减少信令开销和传输时延，更好地保障第一终端对业务的连续性需求。

Description

一种认证授权方法及对应装置
相关申请的交叉引用
本申请要求在2020年03月12日提交中国专利局、申请号为202010172166.7、申请名称为“一种认证授权方法及对应装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种认证授权方法及对应装置。
背景技术
移动通信的飞速发展促进了各种新型业务的不断涌现，除了传统的移动宽带之外，移动通信催生了许多新的应用领域如增强现实(Augmented Reality，AR)/虚拟现实(Virtual Reality，VR)、车联网、工业控制、物联网(Internet of Things，IoT)等，同时对网络带宽、时延等性能也提出了更高的需求，网络负荷进一步加重。
为了有效满足移动通信高速发展所需的高带宽、低时延的要求，欧洲电信标准化协会(European Telecommunication Standard institute，ETSI)于2014年提出了移动边缘计算(Mobile Edge Computing，MEC)技术。它是基于5G演进架构，将无线网络和互联网深度融合的一种技术，其主要原理是通过在无线网络侧部署MEC网元，以构建开放式平台以植入业务相关的应用，业务服务器可以将业务发布至最接近用户的网络“边缘”的MEC上，从而可以降低用户访问业务的时延。
一般来说，通一个应用往往同时部署于多个MEC中，使得不同MEC可以提供相同的业务，具有功能上的等价性。当终端设备接入网络后，可以选择就近的MEC连接通过该MEC上接入业务。但由于终端设备的移动性，当终端设备从一个位置移动到另一个位置时，会离原先连接的MEC(称之为源MEC)越来越远，这将导致源MEC不能很好的为该终端设备继续提供业务，为了适应应用的业务连续性需求，终端设备需要重新选择一个更近的能够提供相同业务的新MEC(称之为目的MEC)。
现有技术中，当终端设备切换MEC时，目的MEC需要对终端设备重新进行认证，在认证通过之后才能授权终端设备使用目的MEC提供的业务。但是，重新认证的过程不仅会增加系统信令开销，还会增加数据传输时延，甚至可能中断终端设备使用的业务。
发明内容
本申请实施例提供一种认证授权方法及对应装置，通过将源MEC对终端设备的认证和/授权转移至目的MEC，使得目的MEC能够在不对终端设备重新认证的前提下，确定终端设备身份的合法性，进而减少信令开销和传输时延，可以更好地保障终端设备对业务的连续性需求。
第一方面，提供一种认证授权方法，包括：第二认证实体接收来自第一网络功能NF的第一信息；其中，所述第一信息用于指示第一认证实体已对第一终端认证和/或授权，所 述第一信息包括所述第一终端的标识，所述第一信息为完整性保护后的第一信息；所述第一认证实体部署在第一边缘计算MEC或互联网或数据网络上，所述第二认证实体部署在第二MEC上，所述第一认证实体和所述第二认证实体提供相同的业务；所述第二认证实体校验所述第一信息的完整性；若校验成功，则对所述第一终端授权。
通过上述方法，第一终端执行MEC切换时，可以省去重新认证的流程，有效减少信令开销和传输时延，可以更好地保障第一终端对业务的连续性需求；并且，由于第一信息是完整性保护后的信息，所以第一信息的可靠性高，能够保证第一终端访问业务的安全性。
在一种可能的设计中，所述第二认证实体根据所述第一信息确定所述第一认证实体已授权所述第一终端接入所述业务，则授权所述第一终端接入所述业务。
通过本实施方式，第一终端执行MEC切换时，第二认证实体可以根据第一信息可以直接授权第一终端接入第一认证实体和第二认证实体提供的相同业务，进而可以省去针对业务的重新认证流程，有效减少信令开销和传输时延，可以更好地保障第一终端对业务的连续性需求。
在一种可能的设计中，所述第一信息还包括第一业务信息；所述对所述第一终端授权之前，所述第二认证实体还可以校验所述第一业务信息是否和所述第二认证实体提供的第二业务信息匹配；所述对所述第一终端授权，包括：所述第二认证实体在确定所述第一业务信息和所述第二业务信息匹配后，授权所述第一终端接入所述第一业务信息所对应的业务。
通过本实施方式，第二认证实体只有在确定第一信息中的第一业务信息是和第二认证实体提供的第二业务信息匹配时，才直接授权第一终端接入第一业务信息所对应的业务，可以提高认证授权的可靠性。
在一种可能的设计中，所述第一NF为会话管理功能SMF；所述第一认证实体对所述第一终端执行的认证和/或授权的应用场景为所述SMF参与执行的二次认证；所述第一业务信息包括数据网络标识DNN和/或数据网络接入标识DNAI；所述第二认证实体校验所述第一业务信息是否和所述第二认证实体提供的第二业务信息匹配，包括：所述第二认证实体校验所述第二认证实体的DNN是否和所述第一信息中的DNN相匹配，和/或，校验所述第二认证实体的DNAI是否和所述第一信息中的DNAI相匹配；所述对所述第一终端授权，包括：在确定所述第二认证实体的DNN和所述第一信息中的DNN相匹配，和/或，确定所述第二认证实体的DNAI和所述第一信息中的DNAI相匹配之后，授权所述第一终端接入所述第一业务信息所对应的业务。
通过本实施方式，第二认证实体只有在确定第二认证实体的DNN和第一信息中的DNN相匹配时，才直接授权第一终端接入第一业务信息所对应的业务，可以提高二次认证的可靠性。
在一种可能的设计中，所述第一NF为会话管理功能AMF；所述第一认证实体对所述第一终端执行的认证和/或授权的场景为所述AMF参与执行的切片认证；所述第一业务信息包括切片信息；所述第二认证实体校验所述第一业务信息是否和所述第二认证实体提供的第二业务信息匹配，包括：所述第二认证实体校验所述第二认证实体的切片信息是否和所述第一信息中的切片信息相匹配；所述对所述第一终端授权，包括：所述第二认证实体在确定所述第二认证实体的切片信息和所述第一信息中的切片信息相匹配后，授权所述第一终端接入所述第一业务信息所对应的业务。
通过本实施方式，第二认证实体只有在确定第二认证实体的切片信息和第一信息中的切片信息相匹配时，才直接授权第一终端接入第一业务信息所对应的业务，可以提高切片认证的可靠性。
第二方面，提供一种认证授权方法，包括：第一网络功能NF接收来自第一认证实体的第一信息；其中，所述第一信息用于指示所述第一认证实体已对第一终端认证和/或授权，所述第一信息包括所述第一终端的标识，所述第一信息为完整性保护后的第一信息；所述第一认证实体部署在第一边缘计算MEC或互联网或数据网络上；所述第一网络功能NF将所述第一信息发送给第二认证实体；其中，所述第二认证实体部署在第二MEC上，所述第一认证实体和所述第二认证实体提供相同的业务。
在一种可能的设计中，所述第一信息具体用于指示所述第一认证实体已授权所述第一终端接入所述业务。
在一种可能的设计中，所述第一信息还包括第一业务信息。
在一种可能的设计中，所述第一NF为会话管理功能SMF；所述第一认证实体对所述第一终端执行的认证和/或授权的应用场景为所述SMF参与执行的二次认证；所述第一业务信息包括数据网络标识DNN和/或数据网络接入标识DNAI。
在一种可能的设计中，所述第一NF为会话管理功能AMF；所述第一认证实体对所述第一终端执行的认证和/或授权的场景为所述AMF参与执行的切片认证；所述第一业务信息包括切片信息。
第三方面，提供一种认证授权方法，包括：第一认证实体生成第一信息；其中，所述第一信息用于指示第一认证实体已对第一终端认证和/或授权，所述第一信息包括所述第一终端的标识，所述第一信息为完整性保护后的第一信息；所述第一认证实体部署在第一边缘计算MEC或互联网或数据网络上；所述第一认证实体将所述第一信息发送给第一网络功能NF；所述第二认证实体部署在第二MEC上，所述第一认证实体和所述第二认证实体提供相同的业务。
在一种可能的设计中，所述第一信息具体用于指示所述第一认证实体已授权所述第一终端接入所述业务。
在一种可能的设计中，所述第一信息还包括第一业务信息。
在一种可能的设计中，所述第一NF为会话管理功能SMF；所述第一认证实体对所述第一终端执行的认证和/或授权的应用场景为所述SMF参与执行的二次认证；所述第一业务信息包括数据网络标识DNN和/或数据网络接入标识DNAI。
在一种可能的设计中，所述第一NF为会话管理功能AMF；所述第一认证实体对所述第一终端执行的认证和/或授权的场景为所述AMF参与执行的切片认证；所述第一业务信息包括切片信息。
第四方面，提供一种认证授权装置，该装置可具有实现上述第一方面或第一方面的任一种可能的设计中第二认证实体的功能，该装置可以为第二认证实体，也可以为第二认证实体中的装置。上述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现，所述硬件或软件包括一个或多个与上述功能相对应的模块。示例性的，该装置包括：
接收模块，用于接收来自第一网络功能NF的第一信息；其中，所述第一信息用于指示第一认证实体已对第一终端认证和/或授权，所述第一信息包括所述第一终端的标识，所述第一信息为完整性保护后的第一信息；所述第一认证实体部署在第一边缘计算MEC或 互联网或数据网络上，所述装置部署在第二MEC上，所述第一认证实体和所述装置提供相同的业务；处理模块，用于校验所述第一信息的完整性；若校验成功，则对所述第一终端授权。
在一种可能的设计中，所述处理模块具体用于：根据所述第一信息确定所述第一认证实体已授权所述第一终端接入所述业务，则授权所述第一终端接入所述业务。
在一种可能的设计中，所述第一信息还包括第一业务信息；所述处理模块还用于：在对所述第一终端授权之前，校验所述第一业务信息是否和所述装置提供的第二业务信息匹配；所述处理模块在对所述第一终端授权时，具体用于：在确定所述第一业务信息和所述第二业务信息匹配后，授权所述第一终端接入所述第一业务信息所对应的业务。
在一种可能的设计中，所述第一NF为会话管理功能SMF；所述第一认证实体对所述第一终端执行的认证和/或授权的应用场景为所述SMF参与执行的二次认证；所述第一业务信息包括数据网络标识DNN和/或数据网络接入标识DNAI；所述处理模块在校验所述第一业务信息是否和所述装置提供的第二业务信息匹配时，具体用于：校验所述装置的DNN是否和所述第一信息中的DNN相匹配，和/或，校验所述装置的DNAI是否和所述第一信息中的DNAI相匹配；所述处理模块在对所述第一终端授权时，具体用于：在确定所述装置的DNN和所述第一信息中的DNN相匹配，和/或，确定所述装置的DNAI和所述第一信息中的DNAI相匹配之后，授权所述第一终端接入所述第一业务信息所对应的业务。
在一种可能的设计中，所述第一NF为会话管理功能AMF；所述第一认证实体对所述第一终端执行的认证和/或授权的场景为所述AMF参与执行的切片认证；所述第一业务信息包括切片信息；所述处理模块在校验所述第一业务信息是否和所述装置提供的第二业务信息匹配时，具体用于：校验所述装置的切片信息是否和所述第一信息中的切片信息相匹配；所述处理模块在对所述第一终端授权时，具体用于：在确定所述装置的切片信息和所述第一信息中的切片信息相匹配后，授权所述第一终端接入所述第一业务信息所对应的业务。
第五方面，提供一种认证授权装置，该装置可具有实现上述第二方面或第二方面的任一种可能的设计中第一NF的功能，该装置可以为第一NF，也可以为第一NF中的装置。上述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现，所述硬件或软件包括一个或多个与上述功能相对应的模块。示例性的，该装置包括：
接收模块，用于接收来自第一认证实体的第一信息；其中，所述第一信息用于指示所述第一认证实体已对第一终端认证和/或授权，所述第一信息包括所述第一终端的标识，所述第一信息为完整性保护后的第一信息；所述第一认证实体部署在第一边缘计算MEC或互联网或数据网络上；发送模块，用于将所述第一信息发送给第二认证实体；其中，所述第二认证实体部署在第二MEC上，所述第一认证实体和所述第二认证实体提供相同的业务。
在一种可能的设计中，所述第一信息具体用于指示所述第一认证实体已授权所述第一终端接入所述业务。
在一种可能的设计中，所述第一信息还包括第一业务信息。
在一种可能的设计中，所述装置为会话管理功能SMF；所述第一认证实体对所述第一终端执行的认证和/或授权的应用场景为所述SMF参与执行的二次认证；所述第一业务信息包括数据网络标识DNN和/或数据网络接入标识DNAI。
在一种可能的设计中，所述装置为会话管理功能AMF；所述第一认证实体对所述第一终端执行的认证和/或授权的场景为所述AMF参与执行的切片认证；所述第一业务信息包括切片信息。
第六方面，提供一种认证授权装置，该装置可具有实现上述第三方面或第三方面的任一种可能的设计中第一认证实体的功能，该装置可以为第一认证实体，也可以为第一认证实体中的装置。上述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现，所述硬件或软件包括一个或多个与上述功能相对应的模块。示例性的，该装置包括：
处理模块，用于生成第一信息；其中，所述第一信息用于指示装置已对第一终端认证和/或授权，所述第一信息包括所述第一终端的标识，所述第一信息为完整性保护后的第一信息；所述装置部署在第一边缘计算MEC或互联网或数据网络上；发送模块，用于将所述第一信息发送给第一网络功能NF；所述第二认证实体部署在第二MEC上，所述装置和所述第二认证实体提供相同的业务。
在一种可能的设计中，所述第一信息具体用于指示所述装置已授权所述第一终端接入所述业务。
在一种可能的设计中，所述第一信息还包括第一业务信息。
在一种可能的设计中，所述第一NF为会话管理功能SMF；所述装置对所述第一终端执行的认证和/或授权的应用场景为所述SMF参与执行的二次认证；所述第一业务信息包括数据网络标识DNN和/或数据网络接入标识DNAI。
在一种可能的设计中，所述第一NF为会话管理功能AMF；所述装置对所述第一终端执行的认证和/或授权的场景为所述AMF参与执行的切片认证；所述第一业务信息包括切片信息。
第七方面，提供一种通信装置，包括：至少一个处理器；以及与所述至少一个处理器通信连接的存储器、通信接口；其中，所述存储器存储有可被所述至少一个处理器执行的指令，所述至少一个处理器通过执行所述存储器存储的指令，执行如上述第一方面或上述第一方面任一种可能的设计或上述第二方面或上述第二方面任一种可能的设计或上述第三方面或上述第三方面任一种可能的设计中所述的方法。
第八方面，提供一种计算机可读存储介质，包括程序或指令，当所述程序或指令在计算机上运行时，执行如上述第一方面或上述第一方面任一种可能的设计或上述第二方面或上述第二方面任一种可能的设计或上述第三方面或上述第三方面任一种可能的设计中所述的方法。
第九方面，提供一种芯片，所述芯片与存储器耦合，用于读取并执行所述存储器中存储的程序指令，实现如上述第一方面或上述第一方面任一种可能的设计或上述第二方面或上述第二方面任一种可能的设计或上述第三方面或上述第三方面任一种可能的设计中所述的方法。
第十方面，提供一种计算机程序产品，包括指令，当其在计算机上运行时，使得计算机执行如上述第一方面或上述第一方面任一种可能的设计或上述第二方面或上述第二方面任一种可能的设计或上述第三方面或上述第三方面任一种可能的设计中所述的方法。
附图说明
图1为本申请实施例适用的一种可能的通信系统的结构示意图；
图2为本申请实施例提供的一种认证授权方法的流程图；
图3A为SMF参与执行的二次认证的流程图；
图3B为AMF参与执行的切片认证的流程图；
图4为本申请实施例中一种可能的MEC场景；
图5为本申请实施例提供的另一种认证授权方法的流程图；
图6为本申请实施例提供的另一种认证授权方法的流程图；
图7为本申请实施例提供的另一种认证授权方法的流程图；
图8为本申请实施例提供的另一种认证授权方法的流程图；
图9为本申请实施例提供的一种认证授权装置的结构示意图；
图10为本申请实施例提供的另一种认证授权装置的结构示意图；
图11为本申请实施例提供的另一种认证授权装置的结构示意图；
图12为本申请实施例提供的另一种认证授权装置的结构示意图。
具体实施方式
本申请实施例的技术方案可以应用于各种通信系统，例如：第四代(4th Generation，4G)通信系统、第五代(5th Generation，5G)通信系统或未来的其他演进系统、或其他各种采用无线接入技术的无线通信系统等。
图1示出了本申请实施例适用的一种可能的通信系统。该通信系统以5G通信系统作为示例，包括：统一数据管理(Unified Data Management，UDM)网元、接入和移动性管理功能(Access and Mobility Management Function，AMF)网元、会话管理功能(Session Management Function，SMF)网元、策略控制功能(Policy Control Function，PCF)网元、应用功能(Application Function，AF)网元、用户面功能(User Plane Function，UPF)网元、数据网络(Data Network，DN)、无线接入网(Rdioaccess Network，RAN)、MEC和终端设备。
上述网元通过服务化接口实现逻辑上的两两互联。如图1所示，终端设备与AMF之间通过N1接口实现互联，RAN与AMF之间通过N2接口实现互联，RAN与UPF之间通过N3接口实现互联，UPF与SMF之间通过N4接口实现互联，PCF与AF之间通过N5接口实现互联，UPF与DN之间通过N6接口实现互联，SMF与PCF之间通过N7接口实现互联，AMF与UDM之间通过N8接口实现互联，UPF与UPF之间通过N9接口实现互联(图1中未示出)，UDM与SMF之间通过N10接口实现互联，SMF与AMF之间通过N11接口实现互联，UDM与PCF之间通过N25接口实现互联。
其中，终端设备又可称之为终端、用户设备(User Equipment，UE)、移动台(Mobile Station，MS)、移动终端(Mobile Terminal，MT)等，是一种向用户提供语音或数据连通性的设备，也可以是物联网设备。例如，终端包括具有无线连接功能的手持式设备、车载设备等。目前，终端可以是：手机(Mobile Phone)、平板电脑、笔记本电脑、掌上电脑、移动互联网设备(Mobile Internet Device，MID)、可穿戴设备(例如智能手表、智能手环、计步器等)，车辆、车载设备(例如，汽车、自行车、电动车、飞机、船舶、火车、高铁等)、虚拟现实(Virtual Reality，VR)设备、增强现实(Augmented Reality，AR)设备、工业控制(Industrial Control)中的无线终端、智能家居设备(例如，冰箱、电视、空调、电表等)、智能机器人、车间设备、无人驾驶(self driving)中的无线终端、远程手术(remote  medical surgery)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端，或智慧家庭(smart home)中的无线终端、飞行设备(例如，智能机器人、热气球、无人机、飞机)等。
RAN是终端设备提供无线接入的设备，包括但不限于演进型基站(Evolved Node B，eNodeB)、无线网(WiFi)接入点(Access Point，AP)、全球微波接入互操作性(World Interoperability for Microwave Access，WiMAX)基站(Base Station，BS)等。
AMF主要负责移动网络中的移动性管理，如用户位置更新、用户注册网络、用户切换等。
SMF主要负责移动网络中的会话管理，如会话建立、修改、释放。具体功能如为用户分配IP地址、选择提供报文转发功能的UPF等。
PCF主要负责向AMF、SMF提供策略，如QoS策略、切片选择策略等。
UDM主要用于存储用户数据，如签约信息、鉴权/授权信息。
AF主要负责向3GPP网络提供业务，如影响业务路由、与PCF之间交互以进行策略控制等。
UPF主要负责对用户报文进行处理，如转发、计费等。
DN是为用户提供数据传输服务的运营商网络，如IP多媒体业务(IP Multi-media Service，IMS)、互联网(Internet)等。
MEC是基于5G演进架构，将无线网络和互联网深度融合的一种技术，通过在无线网络侧增加计算、存储、处理等功能，构建了开放式平台以植入应用，并通过无线应用编程接口(Application Programming Interface，API)实现无线网络与业务服务器之间的信息交互，对无线网络与业务进行融合。面向业务层面(物联网、视频、医疗、零售等)，MEC可向行业提供定制化、差异化服务，进而提升网络利用效率和增值价值。
在一些实施例中，MEC可以由移动边缘平台(Mobile Edge Platform，MEP)平台和该平台上挂载的应用或DN或者应用功能(Application Function，AF)组成。相应的，MEC对终端的授权，则包括MEP平台的接入授权(或者说MEC的接入授权)，和MEP平台上应用或DN或AF的授权(或者说由应用或DN或AF提供的业务的授权)。
目前，基于5G的MEC部署方案主要有两种：一种是MEC服务器部署在基站侧，如图1中的MEC1所示(部署在基站内部，或者作为独立的网元与基站相连)，下沉部署的MEC1可以将本地业务的数据直接分流到本地部署的服务器，避免了流量在核心网的迂回。另一种是MEC部署在下沉的UPF侧(即本地UPF)，如图1中的MEC2所示(MEC服务器集成在UPF，或者MEC与UPF相连)。
基于5G的MEC部署方案，终端访问DN提供的业务可以包括以下三种方式：
方式1、传统访问方式，终端建立终端到RAN到UPF到DN之间的协议数据单元(Protocol Data Unit，PDU)会话，直接访问DN，如图1中的路径c所示。
方式2、基于MEC1的方式，基站侧部署MEC1，MEC1上部署有业务对应的应用，终端建立终端到RAN到MEC1之间的PDU会话，访问MEC1服务器上的应用提供的业务，如图1中的路径a所示。
方式3、基于MEC2的方式，UPF上部署有MEC2，MEC2上部署有业务对应的应用，终端建立终端到RAN到UPF到MEC2之间的PDU会话，访问运营商网络部署在MEC 2 服务器上的应用提供的业务，如图1中的路径b所示。
在5G系统中，终端无论通过上述哪种方式接入网络访问业务，网络侧都需要认证终端身份的合法性，且在认证通过之后才能授权终端访问其请求的业务。具体的，网络侧对终端的认证和授权包括终端接入MEP平台(或者说MEC)时的认证和授权，以及终端访问具体业务时的认证和授权。比如，终端在访问MEP平台(或者说MEC)上的应用提供的业务时，必须先接入MEP平台(或者说MEC)，所以得先经过MEP平台(或者说MEC)的认证和授权，在第一终端接入MEP平台(或者说MEC)后，才进一步执行MEP平台(或者说MEC)上的应用针对第一终端访问具体业务的认证和授权。
由于终端的移动性，终端的位置是动态变化的，因此终端常常无法基于原有的连接访问业务，需要切换连接新的MEC以保证业务的连续性。例如，从一个MEC切换至另一个MEC，或者是从互联网切换至MEC，或者是从数据网络切换至MEC，等等。在这些场景下，终端接入新的MEC必须要重新执行一遍认证流程(包括接入MEP平台(或者说MEC)的认证，和/或，访问业务的认证)才能被授权访问业务，导致信令和时延的增加，甚至中断终端正在访问的业务。这里MEP平台(或者说MEC)的认证，以及业务的认证属于两个独立的认证，可以同时都有，也可以仅存在一种认证方式，本申请实施例不做限制。
为解决该技术问题，提供本申请实施例的技术方案，下面结合附图进行介绍。在下面的介绍过程中，以本申请实施例提供的技术方案应用于图1所示的通信系统为例。
应理解，本申请实施例中的术语“系统”和“网络”可被互换使用。“至少一个”是指一个或者多个，“多个”是指两个或两个以上。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B的情况，其中A,B可以是单数或者复数。字符“/”一般表示前后关联对象是一种“或”的关系。“以下至少一项(个)”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a,b,或c中的至少一项(个)，可以表示：a,b,c,a-b,a-c,b-c,或a-b-c，其中a,b,c可以是单个，也可以是多个。
除非有相反的说明，本申请实施例提及“第一”、“第二”等序数词是用于对多个对象进行区分，不用于限定多个对象的顺序、时序、优先级或者重要程度。例如，第一优先级准则和第二优先级准则，只是为了区分不同的准则，而并不是表示这两种准则的内容、优先级或者重要程度等的不同。
此外，本申请实施例和权利要求书及附图中的术语“包括”和“具有”不是排他的。例如，包括了一系列步骤或模块的过程、方法、系统、产品或设备，不限定于已列出的步骤或模块，还可以包括没有列出的步骤或模块。
参见图2，为本申请实施例提供的一种认证授权方法，该方法可以应用于图1所述的通信系统。
S201、第一网络功能(Network function，NF)获取第一信息；
其中，第一信息用于指示第一认证实体已对第一终端认证和/或授权；
可选的，第一信息包括第一终端的标识；
可选的，第一信息为完整性保护后的第一信息；
可选的，第一认证实体部署在第一MEC或互联网或数据网络上。
在本申请实施例中，第一NF获取第一信息的具体实现方式可以是第一NF自己生成第一信息，也可以是从本地读取预先存储的第一信息，还可以是第一NF从其他网元/实体 请求第一信息，这里不做限定。例如，第一认证向第一认证实体发送请求，然后第一认证实体响应该请求生成第一信息并返回给第一NF。
作为一种示例，第一认证实体可以是在第二认证实体需要对第一终端执行认证和/或授权时，生成第一信息并反馈给第一NF，例如第一NF在确定第一终端需要从第一MEC切换至第二MEC时，第一NF向第一MEC上的第一认证实体发送请求(所述请求用于指示第一认证实体反馈第一信息，也可能请求中包括指示，用于指示第一认证实体反馈第一信息)，使得第一MEC上的第一认证实体响应于第一NF的请求生成并反馈第一信息给第一NF。这样可以使得第一认证实体根据需求及时生成和反馈第一信息，节省系统开销。
作为一种示例，第一认证实体可以提前(例如在对第一终端执行完认证和/或授权时)生成第一信息发送给第一NF，那么第一NF在确定第一终端需要从第一MEC切换至第二MEC时，可以直接将提前收到的第一信息发送给第二认证实体。这样可以节省第一NF向第一认证实体请求第一信息的过程，可以提高第二认证实体对第一终端认证授权的效率。
在本申请实施例中，第一认证实体可以是用于为第一终端提供业务的应用程序，该应用程序具有验证、授权和记账(Authentication、Authorization、Accounting，AAA)的功能；或者是单独部署的AAA，且该AAA与用于提供业务的应用程序相关联。以下为了描述方便，用AAA进行描述。
在本申请实施例中，第一认证实体对第一终端执行的认证和/或授权的应用场景可以有多种，包括但不限于以下两种：1)SMF参与执行的二次认证；2)AMF参与执行的切片认证。
参见图3A，为SMF参与执行的二次认证的流程图。UE在完成注册之后，UE建立PDU会话之前，网络会对UE执行首次认证(图3A中的步骤2)，验证UE是否合法(是否准确UE接入网络)。二次认证(可选的，可以是基于可扩展认证协议(Extensible Authentication Protocol，EAP)的身份验证)发生在UE的注册流程之后，即UE发起PDU会话建立请求至SMF之后，当SMF确定需要执行二次认证时，将执行图3A中方框中的内容(步骤8～15)。之后DN-验证、AAA服务器会发送认证结果至SMF。如果认证结果显示认证成功，则SMF执行后续会话建立的流程；否则，SMF则拒绝会话的建立。图3A所示流程中参与二次认证的实体是UE和外部的DN-AAA，二次认证的目的是使得PDU会话建立过程中，运营商网络能够知道UE是否为DN-AAA的合法用户，从而只为合法UE建立会话。
应理解，图3A是以第一认证实体(即AAA)部署在数据网络上为例，如果第一认证实体部署在第一MEC，则将图3A中的DN-AAA替换为MEC1-AAA，其他流程不变。同理，第一认证实体部署在互联网，则将图3A中的DN-AAA替换为互联网-AAA，其他流程不变。
参见图3B，为AMF参与执行的切片认证的流程图。在5G系统中，由于引入了网络切片概念，使得UE附着网络后，需要进一步接入网络切片，以接收基于网络切片提供的业务。切片认证是UE在完成注册之后发起的一个独立的切片认证流程。与二次认证最主要的区别就是切片认证是由AMF触发执行。其中，图3B中的步骤2、3是可选的，即AMF如果没有UE ID的话，AMF通过执行2-3步获取UE ID。之后，AMF执行通过AUSF到AAA的认证，后续认证流程基本与二次认证类似，具体流程如附图3B所示，这里不再一一赘述。只不过参与的实体包括UE，AMF，AUSF，AAA(这里的AAA可能分为AAA代理(AAA proxy，AAA-P)和AAA服务(AAA server，AAA-S)两个实体。而二次认 证的实体为UE，AMF，SMF，UPF和AAA。这里参与的认证网元可以为AUSF，也可以其他新的网络实体，不做限制。
在不同的(第一认证实体对第一终端执行的认证和/或授权的)应用场景中，本申请实施例中的第一NF可以不同。
仍以二次认证和切片认证为例，如果第一认证实体对第一终端执行的认证和/或授权的应用场景为SMF参与执行的二次认证，则第一NF可以为SMF；如果第一认证实体对第一终端执行的认证和/或授权的场景为AMF参与执行的切片认证，则第一NF可以为AMF。当然，以上只是举例而非限定，具体实施时不排除其他场景的可能，例如RAN参与执行的认证，当应用场景为RAN参与执行的认证，则第一NF可以为基站。当第一认证实体为RAN时，具体的描述参考AMF或者SMF的描述，不再赘述。
当第一认证实体对第一终端执行的认证和/或授权的应用场景为SMF参与执行的二次认证时，第一NF可以是第一MEC对应的SMF，也可以是第二MEC对应的SMF，本申请实施例不做限制。其中，第一MEC对应的SMF和第二MEC对应的SMF可以相同，也可以不同。
当第一认证实体对第一终端执行的认证和/或授权的应用场景为AMF参与执行的切片认证时，这里的第一NF可以是第一MEC对应的AMF，也可以是第二MEC对应的AMF，本申请实施例不做限制。其中，第一MEC对应的AMF和第二MEC对应的AMF可以相同，也可以不同。
在本申请实例中，第一认证实体对第一信息的完整性保护可以有多种实现方式。例如，第一认证实体可以基于第一认证实体和第二认证实体之间的共享密钥(即对称密钥)对第一信息进行完整性保护(例如添加数字签名或消息验证码等)，或者是基于第一认证实体保存的非对称密钥对第一信息进行完整性保护。当然，以上仅为举例而非限定，具体实施时还可能采用其他完整性保护方法，本申请实施例对此不做限制。
S202、第一NF发送第一信息，第二认证实体接收第一信息；其中，第二认证实体部署在第二MEC上，第一认证实体和第二认证实体提供相同的业务。
其中，第一认证实体和第二认证实体提供相同的业务，包括：第一认证实体和第二认证实体为相同的应用，例如同一个应用的视频服务器部署在不同MEC，两个MEC上的视频服务器可提供同一个视频内容；或者，第一认证实体和第二认证实体为两个不同的应用，但是这两个不同的应用可以提供相同的业务，例如，两个不同应用的视频服务器部署在不同MEC，两个MEC上的视频服务器可提供同一个视频内容。
S203、第二认证实体校验第一信息的完整性；若校验成功则执行步骤S204A，否则执行步骤S204B。
S204A、第二认证实体对第一终端授权。
S204B、第二认证实体拒绝对第一终端授权，或者第二认证实体对第一终端执行认证流程，在认证通过之后再对第一终端授权。
应理解，这里对第一终端授权是一种可能的描述，还可能描述为第二认证实体授权第一终端访问第二认证实体对应的业务，或者允许第一NF将第一终端对应的业务切换至第二认证实体等。下文中相关部分对于第一种终端的授权都可以参考此处描述。
第二认证实体校验第一信息的完整性的方法和步骤S201中第一认证实体对第一信息进行完整性保护的方法相对应。示例性的，如果第一认证实体是基于第一认证实体和第二 认证实体之间的共享密钥(对称密钥)对第一信息进行完整性保护，则第二认证实体基于该共享密钥(对称密钥)验证接收到的第一信息的完整性；如果第一认证实体保存有第一认证实体的私钥，使用第一认证实体的私钥对第一信息进行完整性保护，则第二认证实体基于该私钥对应的私钥验证接收到的第一信息的完整性。当然，具体实施时还可能采用其他完整性验证方法，这里不做限制。
一般而言，网络侧授权终端设备的流程一般是先认证终端设备的合法性，在身份合法性认证通过之后，授权终端设备接入对应的业务。因此，在本申请实施例中，第一信息既可以指示第一认证实体已认证第一终端，也可以指示第一认证实体已授权第一终端，还可以指示第一认证实体已认证且授权第一终端，无论采用以上哪一种指示方式，都可以使得第二认证实体确定第一终端身份的合法性，进而省去对第一终端的认证流程，直接对第一终端授权。
可见，本申请实施例中，第一认证实体将用于指示第一认证实体已对第一终端认证和/或授权的第一信息传输给第二认证实体，使得第二认证实体可以根据第一信息可以获知第一认证已对第一终端认证和/或授权，进而能够在不对终端设备重新认证的前提下，确定终端设备身份的合法性，直接对第一终端授权。与现有技术相比，本申请实施例中的第一终端执行MEC切换时，可以省去重新认证的流程，有效减少信令开销和传输时延，可以更好地保障第一终端对业务的连续性需求。并且，由于第一信息是完整性保护后的信息，所以第一信息的可靠性高，能够保证第一终端访问业务的安全性。
在一种可能的设计中，第一NF可以向二认证实体发送一个额外的指示，用于指示第一终端是否被(第一认证实体)认证或者授权。
如果第二认证实体收到该指示，且该指示表征第一终端被(第一认证实体)认证或者授权，则执行上述步骤S202～S204A/B。
如果第二认证实体没有收到该指示，或者收到该指示但该指示表征第一终端未被(第一认证实体)认证或者授权，则第二认证实体触发对第一终端的认证流程。或者，第二认证实体有收到该指示，且该指示表征第一终端被(第一认证实体)认证或者授权，但是第二认证实体根据本地策略确定需要触发认证流程(例如，不管是第一认证实体是否对第一终端做了认证，第二认证实体都要触发认证流程)。
在一些场景中，同一个认证实体针对同一个终端设备可能同时有多个业务的认证和/或授权，且同一个认证实体针对同一个终端设备的不同业务有不同的认证和/或授权结果，比如第一认证实体可以提供对第一业务和第二业务的认证和/或授权，但是第一认证实体只授权第一终端接入第一业务，未授权第一终端接入第二业务。
鉴于此，为了进一步提高本申请实施例认证授权方法的可靠性，在一种可能的设计中，第一信息具体可以用于指示第一认证实体已授权第一终端接入第一认证实体和第二认证实体提供的相同业务(即第一认证实体和第二认证实体均可以提供的业务)。相应的，第二认证实体对第一终端授权的具体实现可以为：第二认证实体根据第一信息确定第一认证实体已授权第一终端接入第一认证实体和第二认证实体提供的相同业务时，第二认证实体授权第一终端接入第一认证实体和第二认证实体提供的相同业务。这里第一认证实体和第二认证实体提供的相同业务的数量可以是一个或多个，本申请实施例不做限制。
为了进一步提高认证授权方法的可靠性，一种可能的设计中，第一信息中还可以包括第一业务信息；第二认证实体在对第一终端授权之前，还可以校验第一信息中的第一业务 信息是否和第二认证实体提供的第二业务信息匹配；在确定第一业务信息和第二业务信息匹配后，授权第一终端接入第一业务信息所对应的业务。
示例性的，第一认证实体对第一终端执行的认证和/或授权的应用场景为SMF参与执行的二次认证时，所述第一业务信息可以包括数据网络标识(Data Network Name，DNN)和/或数据网络接入标识(Data Network Access Identifier，DNAI)。相应的，第二认证实体校验第二认证实体的DNN是否和第一信息中的DNN相匹配，和/或，校验第二认证实体的DNAI是否和第一信息中的DNAI相匹配；在确定第二认证实体的DNN和第一信息中的DNN相匹配，和/或，确定第二认证实体的DNAI和第一信息中的DNAI相匹配之后，授权第一终端接入第一业务信息所对应的业务。
示例性的，第一认证实体对第一终端执行的认证和/或授权的应用场景为AMF参与执行的切片认证时，所述第一业务信息可以包括切片信息。相应的，第二认证实体校验第二认证实体的切片信息是否和第一信息中的切片信息相匹配；在确定第二认证实体的切片信息和第一信息中的切片信息相匹配后，授权第一终端接入第一业务信息所对应的业务。这里的切片信息可以为切片ID，或者切片选择服务信息，或者单个切片选择服务信息的至少一项。
为了更好地理解本申请实施例技术方案，下面结合具体的MEC切换场景，对本申请实施例技术方案进行更详细的说明。
参见图4，为本申请实施例中一种可能的MEC切换场景。
UE从位置A向位置B移动，需要将提供APP1应用的MEC从MEC1切换至MEC2(MEC1和MEC2均部署有APP1)。在图4所示的场景中，MEC1部署在UPF1上，MEC2部署在UPF2上，SMF1负责UPF1的会话管理，SMF2负责UPF2的会话管理，AMF1与SMF1连接，AMF2与SMF2连接。SMF1和SMF2可以相同(即为同一个SMF)，也可以不同。UPF1和UPF2可以相同(即为同一个UPF)，也可以不同。
MEC1和MEC2上均部署有AAA功能。其中，AAA和APP可以合一部署(相当于APP有AAA功能)，也可以分开独立部署，本申请实施例不做限制。为了便于描述，后文当MEC1为UE提供业务时，MEC1可视为MEC1-APP1，当MEC1为UE执行认证时，MEC1可视为MEC1-AAA1，当MEC2为UE提供业务时，MEC2可视为MEC2-APP1，当MEC2为UE执行认证时，MEC2可视为MEC2-AAA2。
参见图5，为本申请实施例提供的另一种认证授权方法，该方法适用于图4所示的通信系统。方法包括：
S500、UE注册成功，并且建立与MEC1上MEC1-APP1的会话。会话的执行过程为UE1与SMF1，UPF1和MEC1-APP1对应的MEC1-AAA1之间执行的二次认证流程。二次认证完成后，UE通过UPF1与MEC1-APP1执行上行和下行数据的传递。
在UE通过UPF1与MEC1-APP1执行上行和下行数据的传递的过程中，UE由于移动，距离MEC1越来越远，触发MEC1-AAA1向SMF1发送切换MEC的请求。
S501、MEC1-AAA1向SMF1发送信息，该信息中包含APP1在网络中部署的位置信息。
可选的，该信息可以包括DNAI列表(list)，DNAI list中包含了APP1在网络中部署的位置信息。
可选的，MEC1-AAA1可以感知到UE的位置，例如通过向运营商网络内NF(例如 UDM，位置控制功能网元，AMF等)订阅UE的位置信息。当MEC1-AAA1感知到UE的位置信息发生变化时，执行上述步骤S501，以触发SMF1向接收到信息中的DNAI对应的APP(即APP1)切换。
S502、SMF1根据MEC1-AAA1发送的信息确定UE需要迁移APP1，即切换提供APP1业务的MEC。
例如，SMF1可以根据DNAI list，以及UE所在的位置确定最近的MEC(部署有APP1)，即MEC2，以使APP1能够更好的为UE提供服务。
这里SMF1获取UE的位置信息的具体实现方式可以有多种，本申请实施例不做限制。一种可能的方式为，SMF1可以从第三NF(例如AMF，位置管理实体，UDM等)获得UE的位置信息。例如，SMF1从第三NF订阅UE的位置，发送订阅请求至第三NF，其中包括UE的ID；当UE的位置发生变化时候，第三NF发送通知给SMF，通知中包括UE的位置。
应理解，如果SMF1本地已经具有DNAI list，则上述步骤S501可以不用执行。例如，MEC1-AAA1在二次认证之后，直接将DNAI list发送给SMF1，则SMF1提前获得了DNAI list，无需MEC1-AAA1再次发送。例如，MEC1-AAA1或者MEC1-AAA1对应的应用通过其他方式将DNAI list发送至SMF，例如通过能力开放等其他接口。因此，上述步骤S501是可选的，图5中用虚线表示。
S503、如果为UE提供服务的SMF也需要切换，那么SMF1还可以确定MEC2对应的SMF，即SMF2；并且，SMF1发送切换请求至SMF2，切换请求可以携带目标DNAI(即MEC2对应的DNAI)和UE的标识(Identity Document，ID)；SMF2确定出MEC2所在UPF(即UPF2)的信息。如果SMF不需要切换(即不需要SMF1切换到SMF2，SMF1可以完成MEC2的服务)，则可以由SMF1确定UPF2的信息。
可选的，这里的UPF2的信息可以为UPF2的位置信息(如IP地址，MAC地址)，或者UPF2的标识信息(UPF2ID等)，本申请实施例不做限制。
可选的，这里的UE ID，可以为UE的订阅永久性标识(Subscription Permanent Identifier，SUPI)，一般公共订阅标识符(Generic Public Subscription Identifier，GPSI)，或者UE APP ID；或者全局唯一的临时标识(Globally Unique Temporary Identity，GUTI)等中的至少一项，本申请实施例不做限制。
S504、SMF2发送响应信息，响应信息中携带UPF2的信息；SMF1接收来自SMF2的响应信息。
应理解，上述步骤S503-504是可选的，如果不需要切换至另一个SMF2，则不执行SMF的切换。获取UPF2的信息是为了确定最终与MEC2通信的UPF2，所以上述获取UPF2的信息的过程是可选的，图中用虚线表示。
本申请实施例中，步骤S503-504是否执行，需要根据MEC1-AAA1计算令牌(token)的需求而定，即如果MEC1-AAA1计算token需要UPF2的信息，则执行上述步骤S503-504，如果MEC1-AAA1计算token不需要UPF2的信息，则执行上述步骤S503-504可以不执行。
S505、SMF1发送DNAI切换(change)请求至MEC1-AAA1，其中携带UE ID(例如UE APP ID，即UE使用APP的标识，例如APP为微信，则UE APP ID为UE的微信号)。
可选的，change请求中还可以携带UPF2的信息。
可选的，DNAI change请求还可以包括以下一项或多项：1)SMF(可以为SMF1或者 SMF2)的信息。可选的，SMF的信息可以为SMF的位置信息，或者标识信息；2)二次认证指示(2nd auth.Rqr)；3)包括目标DNAI；4)目标DNN；5)其他UE ID(例如SUPI，GPSI，GUTI等)；6)APP ID(例如APP为微信，则APP ID为微信标识)。
S506、MEC1-AAA1接收来自SMF1的DNAI change请求，MEC1-AAA1确定UE是否在MEC1-AAA1处二次认证成功。如果认证成功，则计算令牌(token)。应理解，这里的token是上文所述第一信息的一种可能的具体实现方式，token可以表征MEC1-AAA1已对UE认证和/或授权UE接入APP1。
具体的，token可以是MEC1-AAA1使用(对称或非对称)密钥对被保护信息添加了安全校验参数(如消息验证码、数字签名等)后的信息。
可选的，安全校验参数的计算方式包括但不限于以下两种：
1)基于MEC1-AAA1与MEC2-AAA2之间的共享密钥K1计算安全校验参数。MEC2-AAA2接收到token之后，根据K1共享密钥校验安全校验参数。
2)MEC1-AAA1保存的非对称密钥的私钥(Secret Key，SK)计算安全校验参数，MEC2-AAA2接收到token之后，根据非对称密钥的共钥(Public Key，PK)校验安全校验参数。这里SK和PK的格式属于密码学的基本方法，不做赘述。例如，可以基于RSA算法(Ron Rivest、Adi Shamir、Leonard Adleman三人一起提出的一种非对称加密算法)可以完成SK和PK的定义。
可选的，Token中的被保护信息的至少一项：
1)APP1相关信息，例如目标DNAI，DNN，APP ID；
2)UE的标识，例如GPSI，SUPI，5G-GUTI，UE App ID；
3)网元的标识，例如SMF(SMF1和/或SMF2)的信息，UPF2的信息；
4)MEC平台的信息，例如MEC1平台的ID1，MEC2平台的ID2；
5)MEC1-AAA1的信息，例如MEC AAA1的标识，地址等；
6)有效期，这里的有效期可以为token的有效期，或者为MEC1-AAA1对UE执行的二次认证的有效期(如果MEC1-AAA1对UE执行的二次认证过期，则token无效)。
7)切片信息(可以APP1或者UE当前业务或者MEC1所处切片的信息)，例如网络切片选择辅助信息(Single Network Slice Selection Assistance Information，S-NSSAI)、切片ID等。
这里DNN可以为SMF1，UE App ID发送给MEC-AAA1的；
这里MEC平台ID1可以为SMF1从MEC1获得，并且发送给ME1C-AAA1。
这里MEC平台ID2可以为SMF1从MEC2获得，并且发送给MEC-AAA1。
S507、MEC1-AAA1计算token之后，发送token至SMF1。
token中包括被保护信息(如APP1相关信息、UE的标识、网元的标识、MEC平台的信息、MEC1-AAA1的信息、有效期等)以及安全校验参数(如消息验证码，或者数字签名)。
S508、SMF1向MEC2-AAA2发送接入请求，其中携带有token，还可能携带UE ID、DNAI等其他参数(这里的UE ID、DNAI等其他参数可以是封装在token外层的识别信息)。
可选的，这里SMF1可以直接发送token至MEC2-AAA2，也可以通过其他NF将token发送至MEC2-AAA2，例如通过UPF1、UPF2或者网络开放功能(Network Exposure Function，NEF)等，这里不做限制。
S509、MEC2-AAA2校验token，如果校验通过，则确定UE在MEC1上通过了二次认证，则在MEC2上不需要再做二次认证。
其中，校验的流程包括：通过K1或者PK校验安全校验参数，确定token的完整性。
另外，校验的流程还可以包括如下几项中的至少一项：
校验token中的UPF2的信息是否跟MEC2相连的UPF2一致；
校验token中的UE APP ID是否是MEC2-AAA2的用户；
校验token中的目标DNN与MEC2-AAA2对应网络或业务是否一致；
校验token中的MEC1-AAA1相关业务的网络信息，是否属于DNAI list；
校验token中的切片信息是否与MEC2-AAA2的切片信息，或者MEC2-AAA2对应业务所在的切片信息，或者UE对应的切片信息一致。
如果校验不通过，则拒绝SMF1或者SMF2发送的请求，即拒绝UE接入MEC2-APP1；或者，MEC2-AAA2触发SMF1或者SMF2重新对UE执行二次认证；或者，MEC2-AAA2根据本地策略，触发SMF1或者SMF2对UE重新执行二次认证，这里不做限制。
可选的，MEC2-AAA2在校验token时，MEC-AAA2需要先获得自己的所在平台的信息，例如MEC2平台的ID2。MEC2-AAA2获取MEC2平台的ID2的方式可以为：SMF1根据DNAI等信息，向MEC2发送；或者，MEC2-AAA2根据预置的DNAI与ME2平台的ID2的映射关系获得ID2；或者，MEC2-AAA2直接从MEC2上读取或者从管理面获取，本申请实施例这里不做限制。
S510、MEC2-AAA2发送响应至SMF1，指示校验结果。
如果校验结果成功，则SMF1继续执行业务流程。可选的，SMF1发送消息至SMF2，其中携带认证成功指示，用于告知SMF2当前UE在MEC2-AAA2处已认证和/或授权成功。
如果校验结果失败，则SMF1触发二次认证流程，对UE重新发起认证。可选的，SMF1发送消息至SMF2，其中携带认证失败指示，用于告知SMF2当前UE在MEC2-AAA2处已认证和/或授权失败。之后SMF2触发二次认证流程，对UE重新发起认证。
可选的，如果校验结果成功，则SMF1(或者SMF2通过SMF1)还可以发送非接入层(Non Access Stratum，NAS)消息至UE，指示UE需要进行MEC切换，正常执行UPF切换流程，且原有的访问业务正常执行。可选的，SMF1或者SMF2可以发送二次认证成功跳过指示至UE。如果校验结果失败，则拒绝切换或者触发二次认证。
一种可替换的实施方式中，在SMF也需要切换的场景下，在上述步骤S502执行后，SMF1也可以发送切换消息给SMF2，进而由SMF2执行上述步骤S503-S510中SMF1所执行的操作(即由SMF2从MEC-AAA1获取token，并由SMF2发送接入请求(携带token)给MEC2-AAA2)。
一种可替换的实施方式中，如果为MEC1和MEC2提供服务的SMF为同一个SMF，则上述S503～S504的过程可以省略。
本实施例通过生成和转移token，可以实现MEC2-AAA2与MEC1-AAA1之间对UE信任的传递，使得MEC2-AAA2可以不用对UE再执行二次认证过程，可以有效减少信令开销和传输时延，可以更好地保障第一终端对业务的连续性需求。
参见图6，为本申请实施例提供的另一种认证授权方法，该方法适用于图4所示的通信系统。方法包括：
S600、UE注册成功，并且建立与MEC1上MEC1-APP1的会话。会话的执行过程为UE1与SMF1，UPF1和MEC1-APP1对应的MEC1-AAA1之间执行的二次认证流程。
如图6所示，在MEC1-AAA1对UE完成二次认证之后，UE被授权建立会话，同时MEC1-AAA1计算token，token用于表征MEC1-AAA1已对UE认证和/或授权。
需要注意的是，本实施例中token的计算方式和图5所示实施例中token的计算方式不同，这里计算token不需要SMF2和UPF2的信息，这是因为MEC1-AAA1在计算token时SMF1还没有确定是否要做切换，更没有确定出需要切换至MEC2。
示例性的，token中的被保护信息包括如下几项中的至少一项：
1)APP1相关信息，例如目标DNAI，DNN，APP ID；
2)UE的标识，例如GPSI，SUPI，5G-GUTI，UE App ID；
3)网元的标识，例如SMF1的信息；
4)MEC1平台的ID1；
5)MEC1-AAA1的信息，例如MEC AAA1的标识，地址等；
6)有效期，这里的有效期可以为token的有效期，或者为MEC1-AAA1对UE执行的二次认证的有效期(如果MEC1-AAA1对UE执行的二次认证过期，则token无效)；
7)切片信息(可以APP1或者UE当前业务或者MEC1所处切片的信息)，例如S-NSSAI、切片ID等。
之后，MEC1向SMF1发送认证成功指示时，可以将token同时发送给SMF1。可选的，可以在认证成功指示携带token。
之后，SMF1向UE发送会话建立响应，UE通过UPF1与MEC1-APP1执行上行和下行数据的传递。
之后，在UE通过UPF1与MEC1-APP1执行上行和下行数据的传递的过程中，UE发生移动，距离MEC1-APP1越来越远，触发MEC1-AAA1向SMF1发送DNAI list(即步骤S601)。可替换地，DNAI list也可以是在MEC1-AAA1执行完二次认证之后就发送，则不需要执行步骤S601，而直接执行步骤S602。
S601、MEC1-AAA1向SMF1发送DNAI list，DNAI list中包含了APP1在网络中部署的位置信息。
同理，这里步骤S601也是可选的。例如MEC1-AAA1可以在执行完二次认证之后就发送DNAI list给SMF1。例如MEC1-AAA1或者MEC1-AAA1对应的应用通过其他方式将DNAI list发送至SMF，例如通过能力开放等其他接口。
S602、SMF1根据DNAI list，以及UE所在的位置确定UE需要切换提供APP1业务的MEC，且确定出距离UE最近的MEC 2(部署有APP1)为切换的目标MEC，以使APP1能够更好的为UE提供服务。
S603、SMF1发送DNAI change请求至UPF2，DNAI change请求中携带token，还可以携带MEC2的DNAI，UE ID。
S604、UPF2将DNAI change请求转发给MEC2-AAA2。
S605、MEC2-AAA2接收来自SMF1的DNAI change请求，校验token，如果校验通过，则确定UE在MEC1上通过了二次认证，则在MEC2上不需要再做二次认证。
具体校验过程可以参考上文步骤S509中的具体校验过程，这里不再赘述。
S606、MEC2-AAA2发送接入响应给SMF1，指示校验结果。
同理，一种可替代的实施方式中，SMF1或MEC1-AAA1还可以将token提前发送给SMF2，进而由SMF2执行上述步骤S603-S606中SMF1所执行的操作(即由SMF2与MEC2-AAA2交互完成对UE的认证授权)。
本实施例中，MEC1-AAA1对UE执行完二次认证后立即生成token并发送给SMF，后续SMF在确定UE从MEC1切换至MEC2时，则可以直接将token发送给MEC2。这样，可以节省SMF向MEC1-AAA1请求token的过程，可以提高MEC1-AAA2对第一终端认证授权的效率，进一步节省信令和时延。
参见图7，为本申请实施例提供的另一种认证授权方法，该方法适用于图4所示的通信系统。方法包括：
S700、UE注册成功，并且建立与MEC1上MEC1-APP1的会话。会话的执行过程为UE1与SMF1，UPF1和MEC1-APP1对应的MEC1-AAA1之间执行的二次认证流程。之后UE通过UPF1与MEC1-APP1对应的应用执行上行和下行数据的传递。
S701、MEC1-AAA1向SMF1发送DNAI list。
同理，这里步骤S701也是可选的。例如MEC1-AAA1可以在执行完二次认证之后就发送DNAI list给SMF1。例如MEC1-AAA1或者MEC1-AAA1对应的应用通过其他方式将DNAI list发送至SMF，例如通过能力开放等其他接口。
S702、SMF1根据DNAI list确定UE需要切换将提供APP1业务的MEC切换至MEC2。
S703、SMF1发送切换请求至SMF2，以获取UPF2的信息。
S704、SMF1接收UPF2信息。
同理，这里步骤S703、S704也是可选的，步骤S703、S704是否被执行需要根据后文中的第二信息的内容确定。
S705、SMF1发送DNAI切换(change)请求至MEC1-AAA1，其中至少携带UE ID(如UE APP ID)。
可选的，DNAI change请求还可以包括以下一项或多项：UPF2的信息、SMF信息、二次认证指示(2nd auth.Rqr)、目标DNAI、目标DNN、其他UE ID、APP ID。
S706、MEC1-AAA1接收来自SMF1的DNAI change请求，MEC1-AAA1确定UE是否在MEC1-AAA1处二次认证成功。如果认证成功，则执行步骤S707。
步骤S700-S706的具体实现方式可以参考上文S500-S506的具体实现方式，这里不再赘述。
S707、MEC1-AAA1直接将DNAI change请求中信息，如UE ID、SMF信息、UPF2的信息等发送给MEC1-AAA2(为便于描述，这里将MEC1-AAA1发送给MEC2-AAA2的信息称为第二信息)。
这里的MEC1-AAA1发送给MEC2-AAA2的第二信息与上文中的第一信息(如token)不同的是，第二信息可以不经过完整性保护，因为第二信息可以直接基于MEC1与MEC2之间的接口传递，由于不经过其他网元转发，因此传输的安全性能够得到保障，所以可以不经过完整性保护。当然，MEC1也可以对第二信息进行完整性保护后再发送给MEC2-AAA2，例如基于第二信息计算生成token，并将token发送给MEC2-AAA2，本申请对此不做限制。
S708、MEC1-AAA1返回切换响应给SMF1。
S709、SMF1发送接入请求给MEC2-AAA2，所述接入请求包括UE app ID，UPF2的信息、SMF信息、二次认证指示(2nd auth.Rqr)、目标DNAI、目标DNN、其他UE ID(如GPSI，GUTI，SUPI等)、APP ID的至少一项。
S710、MEC2-AAA2根据第二信息确定SMF1发送的接入请求中内容是否和自身提供的内容是否匹配，例如是否相同。如果匹配，则确定UE在MEC1上通过了二次认证或者确定MEC1-AAA1已经授权UE使用MEC1-AAA1对应业务，所以MEC2不需要再做二次认证，直接授权UE建立会话。
S711、MEC2-AAA2返回接入响应给SMF1。
本实施例中，MEC1-AAA1与MEC2-AAA2可以进行通信，SMF1发送DNAI change请求给MEC1-AAA1之后，MEC1-AAA1发送UE ID、UPF2信息等至MEC2-AAA2，后续SMF1发送接入请求至MEC2-AAA2之后，MEC2-AAA根据接收到的UE ID，确定UE是否已经被认证成功或者是否授权接入会话，如果显示可以，则省去二次认证流程，直接授权建立UE的会话，进而降低了MEC切换时的信令开销和传输时延。另外，信任参数(即第二信息)通过MEC平台之间的直接传递，可以进一步节省信令开销，提高认证授权效率。
参见图8，为本申请实施例提供的另一种认证授权方法，该方法适用于图4所示的通信系统。
S800、UE注册成功，并且建立与MEC1上MEC1-APP1的会话。会话的执行过程为UE1与SMF1，UPF1和MEC1-APP1对应的MEC1-AAA1之间执行的二次认证流程。之后UE通过UPF1与MEC1-APP1对应的应用执行上行和下行数据的传递。
S801、MEC1-AAA1向SMF1发送DNAI list这个DNAI list中包含了APP1在网络中部署的位置信息。
同理，这里的步骤S801也是可选的。例如MEC1-AAA1可以在执行完二次认证之后就发送DNAI list给SMF1。例如MEC1-AAA1或者MEC1-AAA1对应的应用通过其他方式将DNAI list发送至SMF，例如通过能力开放等其他接口。
S802、SMF1确定UE需要切换提供APP1业务的MEC；并且根据DNAI list，以及UE所在的位置确定最近的MEC 2为切换的目的MEC，以使APP1能够更好的为UE提供服务。
其中，步骤S800-S802的具体实现方式请参见前文S500-S502的具体实现方式，这里不再赘述。
S803、SMF1根据本地策略确定是否执行二次认证，如果需要做的二次认证，则进一步确认需要做重认证，还是标准的二次认证。
可选的，这里的本地策略可以为：MEC1-AAA1对UE的二次认证的有效期，如果在有效期内，则不需要认证；否则，发起重新认证，执行步骤S804。
这里的有效期可以为二次认证中，SMF1从MEC1-AAA1处接收到的，也可以为本地配置的，这里不做限制。
S804、SMF1在已有UPF1用户面连接没有断的情况下，发起二次认证。
这里SMF1发起二次认证的方式包括但不限于以下两种：
方式1、SMF1利用UPF1与MEC2-AAA2执行二次认证，获得结果。这里的二次认 证流程可以由UE、SMF1、UPF1、MEC2-AAA2交互执行；也可能是SMF1选择UPF2，然后由UE、SMF1、UPF2、MEC2-AAA2交互执行。如果认证成功，则触发切换，否则就拒绝切换，或者中断UE的当前会话。这里MEC2-AAA2的位置可以通过DNAI来确定。
方式2、SMF1选择SMF2，指示SMF2执行二次认证。此时二次认证流程是由UE、SMF2、UPF2、MEC2-AAA2交互执行。二次认证完成后，SMF2通知SMF1二次认证结果。如果认证成功，则SMF1触发切换，否则拒绝切换MEC，或者中断UE的当前会话。这里MEC2-AAA2的位置可以通过DNAI来确定。
S805、MEC2-AAA2对UE的二次认证成功后，触发MEC切换。
如果不需要切换SMF，则可以继续由SMF1执行后续的切换流程。如果涉及到SMF1切换到新的SMF，如需要切换至SMF2，则SMF1可以发送UE ID和二次认证成功指示至SMF2，由SMF2执行后续的切换流程，即步骤S806-S810。
S806、SMF1向SMF2发送切换请求，切换请求可以包括目的DNAI、UE ID、二次认证成功指示等。
S807、SMF2确定UPF2的信息。应理解，这里的UPF2可能与二次认证中的UPF2不同，这里的UPF2可能是用于传递数据的UPF，而二次认证中的UPF2可能是二次认证专用的UPF。
S808、SMF2将UPF2的信息发送给SMF1，SMF1接收UPF2的信息。
S809、SMF1向MEC2发送上下文迁移请求，其中携带DNAI、UE ID等信息。
可选的，上下文迁移请求还可以携带一个认证成功指示，告知UE之前二次认证成功，或者授权UE建立此PDU会话。
S810、MEC2返回上下文迁移响应给SMF1，由此完成MEC1到MEC2的切换。
可选的，MEC2根据上述认证成功指示判定，UE已成功执行认证，则不需要再次触发对于UE的二次认证。
本实施例中，在需要切换UE的MEC时，SMF在已有UPF用户面连接没有断的情况下，提前发起二次认证，这样可以降低切换时延，降低对UE业务连续性的影响，可以提高用户体验。
需要说明的是，针对上述图5～图8描述技术方案，认证实体为AAA，业务提供实体可以为AF。为了描述方便，上述业务提供实体也描述为了AA，因为对于AAA和AF的互用不做限制，都是APP相关的逻辑功能。针对上述图5～图8描述技术方案，描述是从应用角度进行的产品，但在其他业务场景，例如业务服务器，业务认证实体等描述方式也适用。
进一步需要说明的是，上述图5～图8描述技术方案同样也适用于MEC平台的接入授权，例如UE与MEC平台的接入认证。当上述图5～图8描述技术方案用于MEC平台的接入授权时，需要将MEC1-AAA1替换为MEP1，MEC2-AAA2替换为MEP2。
进一步需要说明的是，上述图5～图8描述技术方案是以MEC部署在UPF的场景为例进行说明的，在实际应用时，上述图5～图8描述技术方案的思想也可以适用于MEC部署在基站侧的场景。当上述图5～图8描述技术方案应用于MEC部署在基站侧的场景中时，需要将UPF替换为基站，对第一终端的认证和/或授权则是由AMF或SMF触发的对第一终端的业务认证，例如为二次认证、切片认证或应用层的认证。
进一步需要说明的是，上述图5～图8描述技术方案中的认证场景是以二次认证为例， 在实际应用时，但对于其他NF执行的一般的认证流程，也同样适用。例如上述图5～图8描述技术方案同样也适用于切片认证场景。当上述图5～图8描述技术方案用于切片认证时，切片认证参与的实体为AMF，因此需要将SMF替换为AMF，即由AMF从MEC-AAA1或者MEP1处得到token。另外，token中的安全参数也可以不同，例如token可以包括如下被保护信息的至少一项：
1)APP相关信息：目标DNAI，DNN，APP ID；
2)UE的标识：GPSI，SUPI，5G-GUTI，UE App ID；
3)网元的标识：AMF的信息，鉴权服务功能(authentication server function，AUSF)的信息(也可能切片认证中，AMF通过AUSF与MEC1-AAA1或者MEP交互)；网元的标识需要传递给MEC1-AAA1或者MEP1；
4)MEC平台的信息：MEC1平台ID1,MEC2平台ID2；
5)MEC1-AAA1的信息：MEC AAA1的标识，地址等；
6)切片相关信息，例如S-NSSAI、切片ID等；
7)有效期：有效期可以为token的有效期，或者有效期为二次认证的有效期。
应理解，本文上述的各实施方式可以相互结合以实现不同的技术效果。
以上介绍了本申请实施例中的认证授权方法，下面介绍实现该认证授权方法的装置。其中，方法和装置是基于同一发明构思的，由于方法及装置解决问题的原理相似，因此装置与方法的实施可以相互参见，重复之处不再赘述。
基于同一技术构思，参见图9，本申请实施例提供一种认证授权装置，该装置可具有实现上述方法实施例中第二认证实体的功能，该装置可以为第二认证实体，也可以为第二认证实体中的装置。上述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现，所述硬件或软件包括一个或多个与上述功能相对应的模块。该装置包括：
接收模块901，用于接收来自第一网络功能NF的第一信息；其中，所述第一信息用于指示第一认证实体已对第一终端认证和/或授权，所述第一信息包括所述第一终端的标识，所述第一信息为完整性保护后的第一信息；所述第一认证实体部署在第一边缘计算MEC或互联网或数据网络上，所述装置部署在第二MEC上，所述第一认证实体和所述装置提供相同的业务；
处理模块902，用于校验所述第一信息的完整性；若校验成功，则对所述第一终端授权。
在一种可能的设计中，所述处理模块902具体用于：根据所述第一信息确定所述第一认证实体已授权所述第一终端接入所述业务，则授权所述第一终端接入所述业务。
在一种可能的设计中，所述第一信息还包括第一业务信息；
所述处理模块902还用于：在对所述第一终端授权之前，校验所述第一业务信息是否和所述装置提供的第二业务信息匹配；
所述处理模块902在对所述第一终端授权时，具体用于：在确定所述第一业务信息和所述第二业务信息匹配后，授权所述第一终端接入所述第一业务信息所对应的业务。
在一种可能的设计中，所述第一NF为会话管理功能SMF；所述第一认证实体对所述第一终端执行的认证和/或授权的应用场景为所述SMF参与执行的二次认证；所述第一业务信息包括数据网络标识DNN和/或数据网络接入标识DNAI；
所述处理模块902在校验所述第一业务信息是否和所述装置提供的第二业务信息匹配 时，具体用于：校验所述装置的DNN是否和所述第一信息中的DNN相匹配，和/或，校验所述装置的DNAI是否和所述第一信息中的DNAI相匹配；
所述处理模块902在对所述第一终端授权时，具体用于：在确定所述装置的DNN和所述第一信息中的DNN相匹配，和/或，确定所述装置的DNAI和所述第一信息中的DNAI相匹配之后，授权所述第一终端接入所述第一业务信息所对应的业务。
在一种可能的设计中，所述第一NF为会话管理功能AMF；所述第一认证实体对所述第一终端执行的认证和/或授权的场景为所述AMF参与执行的切片认证；所述第一业务信息包括切片信息；
所述处理模块902在校验所述第一业务信息是否和所述装置提供的第二业务信息匹配时，具体用于：校验所述装置的切片信息是否和所述第一信息中的切片信息相匹配；
所述处理模块902在对所述第一终端授权时，具体用于：在确定所述装置的切片信息和所述第一信息中的切片信息相匹配后，授权所述第一终端接入所述第一业务信息所对应的业务。
基于同一技术构思，参见图10，本申请实施例还提供一种认证授权装置，该装置可具有实现上述方法实施例中第一NF的功能，该装置可以为第一NF，也可以为第一NF中的装置。上述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现，所述硬件或软件包括一个或多个与上述功能相对应的模块。该装置包括：
接收模块1001，用于接收来自第一认证实体的第一信息；其中，所述第一信息用于指示所述第一认证实体已对第一终端认证和/或授权，所述第一信息包括所述第一终端的标识，所述第一信息为完整性保护后的第一信息；所述第一认证实体部署在第一边缘计算MEC或互联网或数据网络上；
发送模块1002，用于将所述第一信息发送给第二认证实体；其中，所述第二认证实体部署在第二MEC上，所述第一认证实体和所述第二认证实体提供相同的业务。
在一种可能的设计中，所述第一信息具体用于指示所述第一认证实体已授权所述第一终端接入所述业务。
在一种可能的设计中，所述第一信息还包括第一业务信息。
在一种可能的设计中，所述装置为会话管理功能SMF；所述第一认证实体对所述第一终端执行的认证和/或授权的应用场景为所述SMF参与执行的二次认证；所述第一业务信息包括数据网络标识DNN和/或数据网络接入标识DNAI。
在一种可能的设计中，所述装置为会话管理功能AMF；所述第一认证实体对所述第一终端执行的认证和/或授权的场景为所述AMF参与执行的切片认证；所述第一业务信息包括切片信息。
基于同一技术构思，参见图11，本申请实施例还提供一种认证授权装置，该装置可具有实现上述方法实施例中第一认证实体的功能，该装置可以为第一认证实体，也可以为第一认证实体中的装置。上述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现，所述硬件或软件包括一个或多个与上述功能相对应的模块。该装置包括：
处理模块1101，用于生成第一信息；其中，所述第一信息用于指示装置已对第一终端认证和/或授权，所述第一信息包括所述第一终端的标识，所述第一信息为完整性保护后的第一信息；所述装置部署在第一边缘计算MEC或互联网或数据网络上；
发送模块1102，用于将所述第一信息发送给第一网络功能NF；所述第二认证实体部 署在第二MEC上，所述装置和所述第二认证实体提供相同的业务。
在一种可能的设计中，所述第一信息具体用于指示所述装置已授权所述第一终端接入所述业务。
在一种可能的设计中，所述第一信息还包括第一业务信息。
在一种可能的设计中，所述第一NF为会话管理功能SMF；所述装置对所述第一终端执行的认证和/或授权的应用场景为所述SMF参与执行的二次认证；所述第一业务信息包括数据网络标识DNN和/或数据网络接入标识DNAI。
在一种可能的设计中，所述第一NF为会话管理功能AMF；所述装置对所述第一终端执行的认证和/或授权的场景为所述AMF参与执行的切片认证；所述第一业务信息包括切片信息。
基于同一技术构思，参见图12，本申请实施例还提供一种通信装置，包括：
至少一个处理器1201；以及与所述至少一个处理器1201通信连接的存储器1202、通信接口1203；其中，所述存储器1202存储有可被所述至少一个处理器1201执行的指令，所述至少一个处理器1201通过执行所述存储器1202存储的指令，执行上述方法实施例中的认证授权方法。
其中，所述处理器1201和所述存储器1202可以通过接口电路耦合，也可以集成在一起，这里不做限制。
本申请实施例中不限定上述处理器1201、存储器1202以及通信接口1203之间的具体连接介质。本申请实施例在图12中以处理器1201、存储器1202以及通信接口1203之间通过总线1204连接，总线在图12中以粗线表示，其它部件之间的连接方式，仅是进行示意性说明，并不引以为限。所述总线可以分为地址总线、数据总线、控制总线等。为便于表示，图12中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
应理解，本申请实施例中提及的处理器可以通过硬件实现也可以通过软件实现。当通过硬件实现时，该处理器可以是逻辑电路、集成电路等。当通过软件实现时，该处理器可以是一个通用处理器，通过读取存储器中存储的软件代码来实现。
示例性的，处理器可以是中央处理单元(Central Processing Unit，CPU)，还可以是其他通用处理器、数字信号处理器(Digital Signal Processor，DSP)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现成可编程门阵列(Field Programmable Gate Array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
应理解，本申请实施例中提及的存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(Read-Only Memory，ROM)、可编程只读存储器(Programmable ROM，PROM)、可擦除可编程只读存储器(Erasable PROM，EPROM)、电可擦除可编程只读存储器(Electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(Random Access Memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(Static RAM，SRAM)、动态随机存取存储器(Dynamic RAM，DRAM)、同步动态随机存取存储器(Synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(Double Data Eate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(Enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(Synchlink DRAM， SLDRAM)和直接内存总线随机存取存储器(Direct Rambus RAM，DR RAM)。
需要说明的是，当处理器为通用处理器、DSP、ASIC、FPGA或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件时，存储器(存储模块)可以集成在处理器中。
应注意，本文描述的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
基于同一技术构思，本申请实施例还提供一种芯片，所述芯片与存储器耦合，用于读取并执行所述存储器中存储的程序指令，实现上述方法实施例中的认证授权方法。
基于同一技术构思，本申请实施例还提供一种计算机可读存储介质，包括程序或指令，当所述程序或指令在计算机上运行时，执行上述方法实施例中的认证授权方法。
基于同一技术构思，本申请实施例还提供一种计算机程序产品，包括指令，当其在计算机上运行时，使得计算机执行上述方法实施例中的认证授权方法。
应理解，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
本申请实施例是参照根据本申请实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(digital subscriber line，DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，数字通用光盘(digital versatile disc，DVD))、或者半导体介质(例如，固态硬盘(solid state disk，SSD))等。
显然，本领域的技术人员可以对本申请实施例进行各种改动和变型而不脱离本申请的精神和范围。这样，倘若本申请实施例的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (23)

  1. 一种认证授权方法，其特征在于，包括：
    第二认证实体接收来自第一网络功能NF的第一信息；其中，所述第一信息用于指示第一认证实体已对第一终端认证和/或授权，所述第一信息包括所述第一终端的标识，所述第一信息为完整性保护后的第一信息；所述第一认证实体部署在第一边缘计算MEC或互联网或数据网络上，所述第二认证实体部署在第二MEC上，所述第一认证实体和所述第二认证实体提供相同的业务；
    所述第二认证实体校验所述第一信息的完整性；
    若校验成功，则对所述第一终端授权。
  2. 如权利要求1所述的方法，其特征在于，所述对所述第一终端授权，包括：
    所述第二认证实体根据所述第一信息确定所述第一认证实体已授权所述第一终端接入所述业务，则授权所述第一终端接入所述业务。
  3. 如权利要求1或2所述的方法，其特征在于，所述第一信息还包括第一业务信息；
    所述对所述第一终端授权之前，所述方法还包括：
    所述第二认证实体校验所述第一业务信息是否和所述第二认证实体提供的第二业务信息匹配；
    所述对所述第一终端授权，包括：
    所述第二认证实体在确定所述第一业务信息和所述第二业务信息匹配后，授权所述第一终端接入所述第一业务信息所对应的业务。
  4. 如权利要求3所述的方法，其特征在于，所述第一NF为会话管理功能SMF；所述第一认证实体对所述第一终端执行的认证和/或授权的应用场景为所述SMF参与执行的二次认证；所述第一业务信息包括数据网络标识DNN和/或数据网络接入标识DNAI；
    所述第二认证实体校验所述第一业务信息是否和所述第二认证实体提供的第二业务信息匹配，包括：
    所述第二认证实体校验所述第二认证实体的DNN是否和所述第一信息中的DNN相匹配，和/或，校验所述第二认证实体的DNAI是否和所述第一信息中的DNAI相匹配；
    所述对所述第一终端授权，包括：在确定所述第二认证实体的DNN和所述第一信息中的DNN相匹配，和/或，确定所述第二认证实体的DNAI和所述第一信息中的DNAI相匹配之后，授权所述第一终端接入所述第一业务信息所对应的业务。
  5. 如权利要求3所述的方法，其特征在于，所述第一NF为会话管理功能AMF；所述第一认证实体对所述第一终端执行的认证和/或授权的场景为所述AMF参与执行的切片认证；所述第一业务信息包括切片信息；
    所述第二认证实体校验所述第一业务信息是否和所述第二认证实体提供的第二业务信息匹配，包括：
    所述第二认证实体校验所述第二认证实体的切片信息是否和所述第一信息中的切片信息相匹配；
    所述对所述第一终端授权，包括：
    所述第二认证实体在确定所述第二认证实体的切片信息和所述第一信息中的切片信息相匹配后，授权所述第一终端接入所述第一业务信息所对应的业务。
  6. 一种认证授权方法，其特征在于，包括：
    第一网络功能NF接收来自第一认证实体的第一信息；其中，所述第一信息用于指示所述第一认证实体已对第一终端认证和/或授权，所述第一信息包括所述第一终端的标识，所述第一信息为完整性保护后的第一信息；所述第一认证实体部署在第一边缘计算MEC或互联网或数据网络上；
    所述第一网络功能NF将所述第一信息发送给第二认证实体；其中，所述第二认证实体部署在第二MEC上，所述第一认证实体和所述第二认证实体提供相同的业务。
  7. 如权利要求6所述的方法，其特征在于，所述第一信息具体用于指示所述第一认证实体已授权所述第一终端接入所述业务。
  8. 如权利要求6或7所述的方法，其特征在于，所述第一信息还包括第一业务信息。
  9. 如权利要求8所述的方法，其特征在于，所述第一NF为会话管理功能SMF；所述第一认证实体对所述第一终端执行的认证和/或授权的应用场景为所述SMF参与执行的二次认证；所述第一业务信息包括数据网络标识DNN和/或数据网络接入标识DNAI。
  10. 如权利要求8所述的方法，其特征在于，所述第一NF为会话管理功能AMF；所述第一认证实体对所述第一终端执行的认证和/或授权的场景为所述AMF参与执行的切片认证；所述第一业务信息包括切片信息。
  11. 一种认证授权装置，其特征在于，包括：
    接收模块，用于接收来自第一网络功能NF的第一信息；其中，所述第一信息用于指示第一认证实体已对第一终端认证和/或授权，所述第一信息包括所述第一终端的标识，所述第一信息为完整性保护后的第一信息；所述第一认证实体部署在第一边缘计算MEC或互联网或数据网络上，所述装置部署在第二MEC上，所述第一认证实体和所述装置提供相同的业务；
    处理模块，用于校验所述第一信息的完整性；若校验成功，则对所述第一终端授权。
  12. 如权利要求11所述的装置，其特征在于，所述处理模块具体用于：
    根据所述第一信息确定所述第一认证实体已授权所述第一终端接入所述业务，则授权所述第一终端接入所述业务。
  13. 如权利要求11或12所述的装置，其特征在于，所述第一信息还包括第一业务信息；
    所述处理模块还用于：在对所述第一终端授权之前，校验所述第一业务信息是否和所述装置提供的第二业务信息匹配；
    所述处理模块在对所述第一终端授权时，具体用于：在确定所述第一业务信息和所述第二业务信息匹配后，授权所述第一终端接入所述第一业务信息所对应的业务。
  14. 如权利要求13所述的装置，其特征在于，所述第一NF为会话管理功能SMF；所述第一认证实体对所述第一终端执行的认证和/或授权的应用场景为所述SMF参与执行的二次认证；所述第一业务信息包括数据网络标识DNN和/或数据网络接入标识DNAI；
    所述处理模块在校验所述第一业务信息是否和所述装置提供的第二业务信息匹配时，具体用于：校验所述装置的DNN是否和所述第一信息中的DNN相匹配，和/或，校验所述装置的DNAI是否和所述第一信息中的DNAI相匹配；
    所述处理模块在对所述第一终端授权时，具体用于：在确定所述装置的DNN和所述第一信息中的DNN相匹配，和/或，确定所述装置的DNAI和所述第一信息中的DNAI相 匹配之后，授权所述第一终端接入所述第一业务信息所对应的业务。
  15. 如权利要求13所述的装置，其特征在于，所述第一NF为会话管理功能AMF；所述第一认证实体对所述第一终端执行的认证和/或授权的场景为所述AMF参与执行的切片认证；所述第一业务信息包括切片信息；
    所述处理模块在校验所述第一业务信息是否和所述装置提供的第二业务信息匹配时，具体用于：校验所述装置的切片信息是否和所述第一信息中的切片信息相匹配；
    所述处理模块在对所述第一终端授权时，具体用于：在确定所述装置的切片信息和所述第一信息中的切片信息相匹配后，授权所述第一终端接入所述第一业务信息所对应的业务。
  16. 一种认证授权装置，其特征在于，包括：
    接收模块，用于接收来自第一认证实体的第一信息；其中，所述第一信息用于指示所述第一认证实体已对第一终端认证和/或授权，所述第一信息包括所述第一终端的标识，所述第一信息为完整性保护后的第一信息；所述第一认证实体部署在第一边缘计算MEC或互联网或数据网络上；
    发送模块，用于将所述第一信息发送给第二认证实体；其中，所述第二认证实体部署在第二MEC上，所述第一认证实体和所述第二认证实体提供相同的业务。
  17. 如权利要求16所述的装置，其特征在于，所述第一信息具体用于指示所述第一认证实体已授权所述第一终端接入所述业务。
  18. 如权利要求16或17所述的装置，其特征在于，所述第一信息还包括第一业务信息。
  19. 如权利要求18所述的装置，其特征在于，所述装置为会话管理功能SMF；所述第一认证实体对所述第一终端执行的认证和/或授权的应用场景为所述SMF参与执行的二次认证；所述第一业务信息包括数据网络标识DNN和/或数据网络接入标识DNAI。
  20. 如权利要求18所述的装置，其特征在于，所述装置为会话管理功能AMF；所述第一认证实体对所述第一终端执行的认证和/或授权的场景为所述AMF参与执行的切片认证；所述第一业务信息包括切片信息。
  21. 一种通信装置，其特征在于，包括：
    至少一个处理器；以及与所述至少一个处理器通信连接的存储器、通信接口；
    其中，所述存储器存储有可被所述至少一个处理器执行的指令，所述至少一个处理器通过执行所述存储器存储的指令，执行如权利要求1-5或6-10中任一项所述的方法。
  22. 一种计算机可读存储介质，其特征在于，包括程序或指令，当所述程序或指令在计算机上运行时，执行如权利要求1-5或6-10中任一项所述的方法。
  23. 一种芯片，其特征在于，所述芯片与存储器耦合，用于读取并执行所述存储器中存储的程序指令，实现如权利要求1-5或6-10中任一项所述的方法。
PCT/CN2020/122889 2020-03-12 2020-10-22 一种认证授权方法及对应装置 WO2021179617A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010172166.7 2020-03-12
CN202010172166.7A CN113395238B (zh) 2020-03-12 2020-03-12 一种认证授权方法及对应装置

Publications (1)

Publication Number Publication Date
WO2021179617A1 true WO2021179617A1 (zh) 2021-09-16

Family

ID=77616616

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/122889 WO2021179617A1 (zh) 2020-03-12 2020-10-22 一种认证授权方法及对应装置

Country Status (2)

Country Link
CN (1) CN113395238B (zh)
WO (1) WO2021179617A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114040410A (zh) * 2021-11-30 2022-02-11 中国电信股份有限公司 终端认证方法、网络侧设备以及存储介质

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114302481B (zh) * 2021-12-28 2023-09-01 中国联合网络通信集团有限公司 切片选择方法、mep、应用服务器、设备及计算机可读介质
CN116095681B (zh) * 2023-04-11 2023-07-11 北京首信科技股份有限公司 一种网络融合认证的方法和设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170118311A1 (en) * 2015-10-22 2017-04-27 Saguna Networks Ltd. Methods Circuits Devices Systems and Functionally Associated Computer Executable Code for Facilitating Edge Computing on a Mobile Data Communication Network
CN108028783A (zh) * 2015-11-30 2018-05-11 华为技术有限公司 切换移动边缘平台的方法、装置和系统
CN109155739A (zh) * 2016-05-16 2019-01-04 华为技术有限公司 切换过程中的通信方法和装置
CN109429284A (zh) * 2017-08-31 2019-03-05 华为技术有限公司 实例切换方法及相关装置

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108012267B (zh) * 2016-10-31 2022-05-24 华为技术有限公司 一种网络认证方法、相关设备及系统
WO2018176336A1 (zh) * 2017-03-30 2018-10-04 华为技术有限公司 数据传输方法和通信设备
CN107172666B (zh) * 2017-04-28 2020-08-11 武汉星耀科技有限公司 在移动终端切换通信小区时保持其本地业务的方法及装置
AU2017423732B2 (en) * 2017-07-20 2021-07-15 Huawei International Pte Ltd Network security management method, and apparatus
US10779254B2 (en) * 2017-08-16 2020-09-15 Electronics And Telecommunications Research Institute Service request method for 5G local service
CN109511115B (zh) * 2017-09-14 2020-09-29 华为技术有限公司 一种授权方法和网元

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170118311A1 (en) * 2015-10-22 2017-04-27 Saguna Networks Ltd. Methods Circuits Devices Systems and Functionally Associated Computer Executable Code for Facilitating Edge Computing on a Mobile Data Communication Network
CN108028783A (zh) * 2015-11-30 2018-05-11 华为技术有限公司 切换移动边缘平台的方法、装置和系统
CN109155739A (zh) * 2016-05-16 2019-01-04 华为技术有限公司 切换过程中的通信方法和装置
CN109429284A (zh) * 2017-08-31 2019-03-05 华为技术有限公司 实例切换方法及相关装置

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114040410A (zh) * 2021-11-30 2022-02-11 中国电信股份有限公司 终端认证方法、网络侧设备以及存储介质

Also Published As

Publication number Publication date
CN113395238A (zh) 2021-09-14
CN113395238B (zh) 2022-09-23

Similar Documents

Publication Publication Date Title
US11272365B2 (en) Network authentication method, and related device and system
US11463874B2 (en) User profile, policy, and PMIP key distribution in a wireless communication network
WO2021179617A1 (zh) 一种认证授权方法及对应装置
US11824981B2 (en) Discovery method and apparatus based on service-based architecture
US20200195445A1 (en) Registration method and apparatus based on service-based architecture
US11812496B2 (en) User group session management method and apparatus
US8931067B2 (en) Enabling seamless offloading between wireless local-area networks in fixed mobile convergence systems
JP6072918B2 (ja) デバイス・ツー・デバイス通信セッションの確立
US11533610B2 (en) Key generation method and related apparatus
KR102024653B1 (ko) 사용자 장비(ue)를 위한 액세스 방법, 디바이스 및 시스템
CN112105021B (zh) 一种认证方法、装置及系统
JP5888715B2 (ja) モバイル端末のハンドオーバを実行する方法及びシステム、並びに無線セルラ通信ネットワークにおいて用いるように意図されたモバイル端末
CN110086839B (zh) 一种远端设备的动态接入方法及装置
WO2022247812A1 (zh) 一种鉴权方法、通信装置和系统
TWI685267B (zh) 一種接入控制的方法及設備
WO2019192275A1 (zh) 一种认证方法及网元
US20230397006A1 (en) System and method for establishing end-to-end secure communication using per-session validation
CN113039766A (zh) 无线网络中的优化的等值同时认证（sae）认证
WO2022217571A1 (zh) 网络切片的鉴权方法及装置、设备和存储介质
WO2023142102A1 (en) Security configuration update in communication networks
WO2023050799A1 (zh) 一种注册方法、终端设备、核心网设备及存储介质
WO2023185960A1 (zh) 通信方法及装置
CN110933591B (zh) 认证方法、设备及系统
KR102055178B1 (ko) 기지국장치 및 기지국장치의 동작 방법
WO2015165190A1 (zh) 用户在线状态的处理方法及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20924396

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20924396

Country of ref document: EP

Kind code of ref document: A1