WO2021203947A1 - 一种通信方法及装置 - Google Patents

一种通信方法及装置 Download PDF

Info

Publication number
WO2021203947A1
WO2021203947A1 PCT/CN2021/081876 CN2021081876W WO2021203947A1 WO 2021203947 A1 WO2021203947 A1 WO 2021203947A1 CN 2021081876 W CN2021081876 W CN 2021081876W WO 2021203947 A1 WO2021203947 A1 WO 2021203947A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal device
nssai
network slice
network
network element
Prior art date
Application number
PCT/CN2021/081876
Other languages
English (en)
French (fr)
Inventor
朱方园
李岩
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2021203947A1 publication Critical patent/WO2021203947A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/02—Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/02—Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
    • H04W8/06—Registration at serving network Location Register, VLR or user mobility server

Definitions

  • This application relates to the field of communication technology, and in particular to a communication method and device.
  • the authentication, authorization, and accounting (authentication, authorization, accounting, AAA) server saves the network The corresponding relationship between the single network slice selection assistance information (S-NSSAI) of the slice and the terminal device.
  • the AAA server may initiate a re-authentication and re-authorization process for the network slice to the terminal device. For example, after the terminal device successfully executes the NSSAA process corresponding to the network slice, Then the AAA server can trigger to initiate a re-authentication and re-authorization process for the network slice to the terminal device.
  • the terminal device may initiate the registration process again to request access to other network slices again. For example, if the terminal device moves after accessing a network slice, the terminal device may initiate a registration procedure again to request access to another network slice corresponding to the moved position. In this case, the terminal device may no longer access the previously accessed network slice. Since the AAA server does not perceive that the terminal device is no longer connected to the previously accessed network slice, the AAA server still saves the terminal For the context information of the device, if the AAA server initiates the re-authentication and re-authorization process on the network slice that the terminal device previously accessed, it will lead to a waste of core network signaling.
  • the embodiments of the present application provide a communication method and device for saving core network signaling overhead.
  • a first communication method includes: a first mobility management network element determines according to a first condition that a terminal device no longer accesses a first network slice or a second network slice, wherein the first network The slicing needs to execute the NSSAA process, the second network slice has a mapping relationship with the first network slice; the first mobility management network element sends first information to the authentication network element, and the first information is used to indicate all The terminal device no longer accesses the first network slice.
  • the first mobility management network element is AMF.
  • the first mobility management network element determines that the terminal device no longer accesses the S-NSSAI that needs to perform the NSSAA process or the S-NSSAI that has a mapping relationship with it, then the first mobility management network element can The information that the terminal device no longer accesses the first network slice informs the authentication network element, for example, the authentication network element is AAA-S, or instructs the first mobility management network element to cancel the subscription to perform re-authentication from the authentication network element Event or re-authorization event for execution, so that after the authentication network element learns the information, there is no need to initiate the re-authentication process or re-authorization process for the first network slice to the terminal device, which can save core network signaling Overhead.
  • the authentication network element for example, the authentication network element is AAA-S, or instructs the first mobility management network element to cancel the subscription to perform re-authentication from the authentication network element Event or re-authorization event for execution, so that after the authentication network element learns the information, there is no need to initiate the re-
  • the method further includes:
  • the first mobility management network element receives a subscription request message from the authentication network element, the subscription request message includes the identification of the terminal device and the identification of the first network slice, and the subscription request message is used for Subscribe to the event that the terminal device no longer accesses the first network slice.
  • the authentication network element may initiate a subscription in advance to subscribe to the event that the terminal device no longer accesses the first network slice.
  • the first mobility management network element determines that the terminal device no longer accesses the first network slice, the first mobility management network element can notify the authentication network element according to the subscription, which is equivalent to the first mobility management network element according to The subscription process can be operated, which helps to simplify the implementation of mobility management network elements.
  • the method further includes:
  • the first mobility management network element receives a second message from the authentication network element, where the second message is used to perform the NSSAA process again on the first network slice, or is used to deny access to the terminal device The first network slice.
  • the authentication network element does not need to initiate a subscription in advance, and the first mobility management network element does not need to actively notify the authentication network element. Instead, the authentication network element can initiate a re-authentication process for the first network slice or revoke it. During the authorization process, the authentication network element is notified, and the terminal device no longer accesses the first network slice. In this way, the first mobility management network element does not need to increase the step of actively notifying the authentication network element, and the authentication network element does not need to increase the subscription step, which simplifies the implementation of the two network elements.
  • the first mobility management network element is a mobility management network element that the terminal device accesses after the handover, and the first mobility management network element does not support the NSSAA process
  • the second mobility management network element is the mobility management network element that the terminal device accesses before the handover, and the method further includes:
  • the first mobility management network element receives the context of the terminal device from the second mobility management network element, where the context of the terminal device includes that the authentication network element subscribes to the terminal device no longer Access information about the event of the first network slice.
  • the terminal device performs a cell handover, before the cell handover, the terminal device accesses the second mobility management network element, and after the cell handover, the terminal device accesses the first mobility management network element.
  • the authentication network element subscribes to the second mobility management network element in advance, then if the terminal device wants to switch to the first mobility management network element, the second mobility management network element can subscribe to the authentication network element ( That is, the authentication network element subscribes to the information of the event that the terminal device no longer accesses the first network slice) and sends it to the first mobility management network element.
  • the first mobility management network element itself does not support the NSSAA process, or the first mobility management network element determines that the terminal device no longer accesses the first network slice or the second network slice, etc., the first mobility management network element will The authentication network element can be notified, so that after the authentication network element learns the information, it does not need to initiate the re-authentication and re-authorization procedures for the first network slice to the terminal device, thereby saving the signaling overhead of the core network.
  • the first condition includes:
  • the NSSAI allowed to be accessed by the terminal device is changed,
  • the NSSAI allowed to access before the change includes the identifier of the first network slice, and the NSSAI allowed to access after the change does not include the identifier of the first network slice; or, the NSSAI allowed to access before the change includes The identifier of the second network slice, and the changed NSSAI allowed to access does not include the identifier of the second network slice.
  • the first mobility management network element determines that the NSSAI allowed to be accessed by the terminal device has changed, then specifically, the allowed NSSAI before the change includes the identity of the first network slice, and the changed NSSAI allowed to access does not include the first network slice.
  • An identifier of a network slice If this is the case, the NSSAI allowed to be accessed by the terminal device is changed, which can also be understood as removing the identifier of the first network slice from the NSSAI allowed to be accessed by the terminal device.
  • the first mobility management network element determines that the NSSAI allowed to be accessed by the terminal device has changed, then specifically, the allowed NSSAI before the change includes the identifier of the second network slice, and the changed NSSAI allowed to access does not Include the identifier of the second network slice. If this is the case, the NSSAI allowed to be accessed by the terminal device is changed, which can also be understood as removing the identifier of the second network slice from the NSSAI allowed to be accessed by the terminal device.
  • the first mobility management network element may determine, according to the registration request message from the terminal device, that the NSSAI that the terminal device is allowed to access has changed, or may also determine that the NSSAI that the terminal device is allowed to access has changed in other ways.
  • the first condition includes: the terminal device is unregistered from the network.
  • the terminal device When the AMF determines that the terminal device is deregistered from the network, the terminal device changes from the registered state to the deregistered state. It can be understood that the terminal device in the deregistered state no longer accesses any network slice. Then naturally, the AMF can determine that the terminal device no longer accesses the first network slice or the second network slice.
  • the method for AMF to determine the de-registration of a terminal device may be: the terminal device initiates a de-registration process to notify AMF that the terminal device is no longer connected to the current network; or, the network initiates a de-registration process to notify the terminal The device cannot connect to the current network.
  • the first condition includes: the terminal device moves from the first network to the second network.
  • the first network is deployed with network slicing, and the second network is not deployed with network slicing. If the terminal device moves from the first network to the second network, the terminal device can no longer access the network slice, and naturally cannot access the first network.
  • the first network is a 5G network
  • the second network is an EPS network.
  • the 5G network is, for example, a 5G core network (5GC).
  • the first mobility management network element determines that the terminal device moves from the 5G network to the EPS network, since the EPS network does not support the authentication mechanism required by the first network slice to perform the NSSAA process, the terminal device cannot access the first network on the EPS network Slice, the first mobility management network element can determine that the terminal device no longer accesses the first network slice or the second network slice.
  • the method for the first mobility management network element to determine that the terminal device moves from the 5G network to the EPS network may be: the first mobility management network element receives a de-registration notification message from UDM, and the de-registration notification message may be a UDM call
  • the servicing operation Nudm_UECM_DeregistrationNotification sent to the first mobility management network element, the deregistration notification message carries the identification of the terminal device and the 5GC to EPS mobility reason value (5GC to EPS Mobility), and the AMF can determine after receiving the deregistration notification message
  • the terminal device moves from the 5G network to the EPS network, thereby determining that the terminal device no longer accesses the first network slice or the second network slice.
  • the sending of the first information by the first mobility management network element to the authentication network element includes:
  • the first mobility management network element sends a first message to the authentication network element, where the first message includes the first information, and the first message further includes the identification of the terminal device and the first message.
  • the ID of the network slice The ID of the network slice.
  • the first message may include the first information.
  • the first message may also include the identification of the terminal device (for example, GPSI) and the S-NSSAI corresponding to the network slice to which the terminal device is no longer connected.
  • the authentication network element can clarify which terminal device corresponds to which network slice or which network slices the first information is for.
  • the S-NSSAI corresponding to the network slice that the terminal device no longer accesses is the S-NSSAI that the terminal device has accessed and needs to perform the NSSAA process.
  • the S-NSSAI included in the first message may include the S-NSSAI of the first network slice. -NSSAI.
  • the method further includes:
  • the first mobility management network element receives a registration request message from the terminal device, where the registration request message includes information for indicating that the terminal device does not support the NSSAA process, and/or, the registration request
  • the request to access the NSSAI carried in the message does not include the identifier of the first network slice or the identifier of the second network slice;
  • the first mobility management network element determines the changed NSSAI allowed to access according to the registration request message.
  • the registration request message may include information for indicating that the terminal device does not support the NSSAA process; or, the request to access the NSSAI carried in the registration request message does not include the identification of the first network slice or the identification of the second network slice; or, the registration request message It includes information used to indicate that the terminal device does not support the NSSAA process, and the request to access the NSSAI carried in the registration request message does not include the identifier of the first network slice or the identifier of the second network slice.
  • the method further includes:
  • the first mobility management network element deletes the authentication result of the NSSAA process performed by the first network slice.
  • the authentication result of an HPLMN S-NSSAI executing the NSSAA process is usually stored in the context of the terminal device stored in the mobility management network element.
  • the purpose of retaining the authentication result of the S-NSSAI executing the NSSAA process is to allow the terminal device to access the network slice corresponding to the S-NSSAI as soon as possible next time. For example, if the authentication result of an S-NSSAI executing the NSSAA process is successful, the terminal The next time the device requests access to the network slice corresponding to the S-NSSAI, it can access it as soon as possible, and there is no need to perform the NSSAA process.
  • the first mobility management network element may delete the authentication result corresponding to the first network slice in the context of the terminal device . Because the terminal device no longer accesses the first network slice, it is no longer necessary to save the authentication result of the first network slice, and the first mobility management network element can delete the authentication result of the first network slice to save The first mobility manages the storage space of the network element and also simplifies the context of the terminal device.
  • a second communication method includes: a first mobility management network element determines according to a first condition that the terminal device no longer accesses the first network slice or the second network slice, wherein the first network The slicing needs to execute the NSSAA process, the second network slice has a mapping relationship with the first network slice; the first mobility management network element sends first information to the authentication network element, and the first information is used to indicate all The first mobility management network element cancels the first notification from the authentication network element, where the first notification includes a notification of performing re-authentication on the first network slice or performing a notification on the first network slice Notification of revocation of authorization.
  • the first mobility management network element is AMF.
  • the first mobility management network element may cancel the subscription to the authentication network element for the first event
  • the authentication network element is AAA-S, so that after the authentication network element receives the first information, there is no need to initiate the re-authentication and re-authorization process for the first network slice to the terminal device, thereby saving the core network Signaling overhead.
  • the first condition includes:
  • the NSSAI allowed to be accessed by the terminal device is changed,
  • the NSSAI allowed to access before the change includes the identifier of the first network slice, and the NSSAI allowed to access after the change does not include the identifier of the first network slice; or, the NSSAI allowed to access before the change includes The identifier of the second network slice, and the changed NSSAI allowed to access does not include the identifier of the second network slice.
  • the first condition includes: the terminal device is unregistered from the network.
  • the first condition includes: the terminal device moves from the first network to the second network.
  • the sending of the first information by the first mobility management network element to the authentication network element includes:
  • the first mobility management network element sends a first message to the authentication network element, where the first message includes the first information, and the first message further includes the identification of the terminal device and the first message.
  • the ID of the network slice The ID of the network slice.
  • the first mobility management network element receives a registration request message from the terminal device, where the registration request message includes information for indicating that the terminal device does not support the NSSAA process, and/or, the registration request
  • the request to access the NSSAI carried in the message does not include the identifier of the first network slice
  • the first mobility management network element determines the changed NSSAI allowed to access according to the registration request message.
  • the method further includes:
  • the first mobility management network element deletes the authentication result of the NSSAA process performed by the first network slice.
  • a third communication method includes: an authentication network element performs an NSSAA process on a first network slice; the authentication network element receives first information from a first mobility management network element, and the first The information is used to indicate that the terminal device no longer accesses the first network slice.
  • the authentication network element is AAA-S.
  • the method further includes:
  • the authentication network element sends a subscription request message to the first mobility management network element, where the subscription request message includes the identification of the terminal device and the identification of the first network slice, and the subscription request message is used to subscribe to the An event in which the terminal device no longer accesses the first network slice.
  • the method further includes:
  • the authentication network element sends a second message to the first mobility management network element, where the second message is used to perform the NSSAA procedure again on the first network slice, or is used to deny the terminal device access to the The first network slice.
  • the method further includes:
  • the authentication network element deletes the authentication result of the NSSAA process performed by the first network slice.
  • the authentication network element receiving the first information from the first mobility management network element includes:
  • the authentication network element receives a first message from the first mobility management network element, the first message includes the first information, and the first message further includes the identification of the terminal device and the first message. An identifier of a network slice.
  • a fourth communication method includes: an authentication network element performs an NSSAA process on a first network slice; the authentication network element receives first information from a first mobility management network element, and the first Information is used to instruct the first mobility management network element to cancel the first notification from the authentication network element, where the first notification includes a notification to perform re-authentication on the first network slice or to The first network slice executes the notification of revoking authorization.
  • the authentication network element is AAA-S.
  • the method further includes:
  • the authentication network element deletes the authentication result of the NSSAA process performed by the first network slice.
  • the authentication network element receiving the first information from the first mobility management network element includes:
  • the authentication network element receives a first message from the first mobility management network element, the first message includes the first information, and the first message further includes the identification of the terminal device and the first message. An identifier of a network slice.
  • a fifth communication method includes: a mobility management network element determining that a terminal device establishes a first session associated with a first network slice, where the first network slice is a network that has successfully executed the NSSAA process Slice; the mobility management network element receives a handover request message from a first access network network element, the handover request message is used to instruct the terminal device to switch from the first access network network element to the second Access network network element; the mobility management network element sends a request message to the storage function network element, and the request message is used to request mobility that can serve the second access network network element and can support the NSSAA process Manage network elements.
  • the mobility management network element is AMF.
  • the mobility management network element since the terminal device has already established the first session associated with the first network slice that needs to execute the NSSAA process, if the terminal device wants to switch the access network, the mobility management network element needs to request a new Mobility management network element. At the time of request, the mobility management network element can request the mobility management network element that can serve the second access network network element and support the NSSAA process. In this way, the terminal device will switch to the new mobility management network element after switching to the new mobility management network element. , It can also continue to access the network slice (such as the first network slice) that needs to perform the NSSAA process, and the continuity of the session of the terminal device can be maintained as much as possible.
  • the network slice such as the first network slice
  • the method further includes:
  • the mobility management network element receives a third message from the storage function network element, where the third message includes an identifier of the target mobility management network element.
  • the storage function network element determines that it can provide a mobility management network element that can both serve the second access network network element and support the NSSAA process
  • the storage function network element can use the new mobility management network element (that is, the target The identity of the mobility management network element) is sent to the mobility management network element, the terminal device can access the target mobility management network element, and the terminal device can continue to access the required mobility management network element under the target mobility management network element. Perform network slicing of the NSSAA process.
  • a sixth communication method includes: a second mobility management network element determines that a terminal device establishes a first session associated with a first network slice, and the first network slice is that the NSSAA process has been successfully executed Slicing of the network; the second mobility management network element receives a handover request message from the first access network network element, the handover request message is used to instruct the terminal device to access the network element from the first access network Switch to the second access network network element; the second mobility management network element obtains information of the first mobility management network element, and the first mobility management network element does not support the NSSAA process; the second mobility management network element The management network element sends the context of the terminal device to the first mobility management network element, where the context of the terminal device does not include the information of the first session.
  • the second mobility management network element is AMF.
  • the new-side mobility management network element ie, the first mobility management network element
  • the old-side mobility management network element is transferred to the old-side mobility management
  • the context of the terminal device sent by the network element ie, the first mobility management network element
  • the session information corresponding to the S-NSSAI that needs to perform the NSSAA process is not sent to the new-side mobility management network element, that is, the information that the new-side mobility management network element cannot process is not sent to the new-side mobility management network element. Reduce information redundancy.
  • the method further includes:
  • the second mobility management network element sends a request message to the storage function network element, where the request message is used to request the provision of a mobility management network element that can serve the second access network network element and can support the NSSAA process;
  • the second mobility management network element receives a third message from the storage function network element, where the third message is used to indicate that there is no mobility management network element that meets the requirements.
  • the terminal device Since the terminal device has established the first session associated with the first network slice that needs to perform the NSSAA process, if the terminal device wants to switch the access network, the old-side mobility management network element (ie, the second mobility management network) Element) A new mobility management network element needs to be requested. At the time of request, the old-side mobility management network element can request the mobility management network element that can serve both the second access network network element and the NSSAA process. In this way, the terminal device is switching to the new-side mobility management network element Later, it can also continue to access the network slice (for example, the first network slice) that needs to perform the NSSAA process, and the continuity of the session of the terminal device can be maintained as much as possible.
  • the network slice for example, the first network slice
  • the old-side mobility management network element can also request a new mobility management network. Even if the new mobility management network element cannot support the NSSAA process, it can still try to make the terminal device have the mobility management network element to be able to access it.
  • the method further includes:
  • the second mobility management network element receives a subscription request message from an authentication network element, the subscription request message includes the identification of the terminal device and the identification of the first network slice, and the subscription request message is used to subscribe to the An event in which the terminal device no longer accesses the first network slice.
  • the authentication network element may have subscribed to the old-side mobility management network element in advance to subscribe to the event that the terminal device no longer accesses the first network slice.
  • the context of the terminal device includes the NSSAI that the terminal device is allowed to access before handover, where the allowed NSSAI includes the identifier of the first network slice, and
  • the context of the terminal device also includes information about the event that the authentication network element has subscribed to the event that the terminal device no longer accesses the first network slice.
  • the NSSAI that the terminal device is allowed to access before the handover includes the identifier of the first network slice, and the session information sent by the old-side mobility management network element to the new-side mobility management network element does not include the session information corresponding to the first network slice, then The new-side mobility management network element can determine that the terminal device no longer accesses the first network slice.
  • the context of the terminal device also includes the information that the authentication network element subscribes to the event that the terminal device no longer accesses the first network slice, so that the new-side mobility management network element can send the first information to the authentication network element, for example, the first information may Instruct the terminal device to no longer access the first network slice, so that after the authentication network element receives the first information, there is no need to initiate the re-authentication and re-authorization process for the first network slice to the terminal device, thereby saving the core The signaling overhead of the network.
  • the method further includes:
  • the second mobility management network element sends a fifth message to the first session management network element serving the first session, and the fifth message is used to trigger the first session management network element to release the first session management network element. Conversation.
  • the SMF can release the first session after receiving the fifth message, so as to use the resources occupied by the first session for other purposes.
  • a communication device configured to execute the method in the first aspect or any possible implementation manner.
  • the first communication device may include a module for executing the method in the first aspect or any possible implementation manner, for example, including a processing module and a transceiver module.
  • the transceiver module may include a sending module and a receiving module. The sending module and the receiving module may be different functional modules, or may be the same functional module, but can implement different functions.
  • the first communication device is a communication device, or a chip or other component provided in the communication device.
  • the communication device is a core network device.
  • the first communication device is a core network device.
  • the core network device is a first mobility management network element.
  • the first mobility management network element is AMF.
  • the transceiver module may also be implemented by a transceiver, and the processing module may also be implemented by a processor.
  • the sending module may be implemented by a transmitter, and the receiving module may be implemented by a receiver.
  • the transmitter and the receiver may be different functional modules, or may be the same functional module, but can implement different functions.
  • the transceiver is realized by, for example, an antenna, a feeder, and a codec in the communication device.
  • the transceiver (or transmitter and receiver) is, for example, a communication interface in the chip, and the communication interface is connected to the radio frequency transceiver component in the communication device to Information is sent and received through radio frequency transceiver components.
  • the introduction is continued by taking the first communication device as the first mobility management network element, and the processing module and the transceiving module as examples. in,
  • the processing module is configured to determine, according to a first condition, that the terminal device no longer accesses the first network slice or the second network slice, wherein the first network slice needs to execute the NSSAA process, and the second network slice is connected to the The first network slice has a mapping relationship;
  • the transceiver module is configured to send first information to an authentication network element, where the first information is used to indicate that the terminal device no longer accesses the first network slice.
  • the transceiver module is further configured to receive a subscription request message from the authentication network element, where the subscription request message includes the identification of the terminal device and the information of the first network slice. Identifies that the subscription request message is used to subscribe to the event that the terminal device no longer accesses the first network slice.
  • the transceiver module is further configured to receive a second message from the authentication network element, where the second message is used to perform the NSSAA process again on the first network slice, or Used to deny the terminal device to access the first network slice.
  • the first mobility management network element is a mobility management network element that the terminal device accesses after the handover, and the first mobility management network element does not support the NSSAA process
  • the second mobility management network element is the mobility management network element that the terminal device accesses before the handover
  • the transceiver module is further configured to receive the terminal device from the second mobility management network element
  • the context of the terminal device includes information about the event that the authentication network element has subscribed to the terminal device no longer accessing the first network slice.
  • the first condition includes:
  • the NSSAI allowed to be accessed by the terminal device is changed,
  • the NSSAI allowed to access before the change includes the identifier of the first network slice, and the NSSAI allowed to access after the change does not include the identifier of the first network slice; or, the NSSAI allowed to access before the change includes The identifier of the second network slice, and the changed NSSAI allowed to access does not include the identifier of the second network slice.
  • the first condition includes: the terminal device is unregistered from the network.
  • the first condition includes: the terminal device moves from the first network to the second network.
  • the transceiver module is configured to send the first information to the authentication network element in the following manner: send a first message to the authentication network element, where the first message includes the first information , The first message further includes the identification of the terminal device and the identification of the first network slice.
  • the transceiver module is further configured to receive a registration request message from the terminal device, the registration request message including information used to indicate that the terminal device does not support the NSSAA process, and/or the registration request message
  • the carried request to access the NSSAI does not include the identifier of the first network slice
  • the processing module is further configured to determine the changed NSSAI allowed to be accessed according to the registration request message.
  • the processing module is further configured to delete the authentication result of the NSSAA process executed by the first network slice.
  • a communication device is provided, and the communication device (may be referred to as a second communication device) is configured to execute the method in the second aspect or any possible implementation manner.
  • the second communication device may include a module for executing the method in the second aspect or any possible implementation manner, for example, including a processing module and a transceiver module.
  • the transceiver module may include a sending module and a receiving module. The sending module and the receiving module may be different functional modules, or may be the same functional module, but can implement different functions.
  • the second communication device is a communication device, or a chip or other component provided in the communication device.
  • the communication device is a core network device.
  • the first communication device is a core network device.
  • the core network device is a first mobility management network element.
  • the first mobility management network element is AMF.
  • the transceiver module may also be implemented by a transceiver, and the processing module may also be implemented by a processor.
  • the sending module may be implemented by a transmitter, and the receiving module may be implemented by a receiver.
  • the transmitter and the receiver may be different functional modules, or may be the same functional module, but can implement different functions.
  • the second communication device is a communication device
  • the transceiver is realized by, for example, an antenna, a feeder, and a codec in the communication device.
  • the transceiver (or, transmitter and receiver) is, for example, a communication interface in the chip, and the communication interface is connected to a radio frequency transceiver component in the communication device to Information is sent and received through radio frequency transceiver components.
  • the second communication device is continued to be the first mobility management network element, and the processing module and the transceiving module are taken as examples for the introduction. in,
  • the processing module is configured to determine, according to a first condition, that the terminal device no longer accesses the first network slice or the second network slice, wherein the first network slice needs to execute the NSSAA process, and the second network slice is connected to the The first network slice has a mapping relationship;
  • the transceiver module is configured to send first information to an authentication network element, where the first information is used to instruct the first mobility management network element to cancel a first notification from the authentication network element, wherein the first notification A notification includes a notification of performing re-authentication on the first network slice or a notification of performing deauthorization on the first network slice.
  • the first condition includes:
  • the NSSAI allowed to be accessed by the terminal device is changed,
  • the NSSAI allowed to access before the change includes the identifier of the first network slice, and the NSSAI allowed to access after the change does not include the identifier of the first network slice; or, the NSSAI allowed to access before the change includes The identifier of the second network slice, and the changed NSSAI allowed to access does not include the identifier of the second network slice.
  • the first condition includes: the terminal device is unregistered from the network.
  • the first condition includes: the terminal device moves from the first network to the second network.
  • the transceiver module is configured to send the first information to the authentication network element in the following manner:
  • a first message is sent to the authentication network element, where the first message includes the first information, and the first message further includes the identifier of the terminal device and the identifier of the first network slice.
  • the transceiver module is further configured to receive a registration request message from the terminal device, the registration request message including information used to indicate that the terminal device does not support the NSSAA process, and/or the registration request message
  • the carried request to access the NSSAI does not include the identifier of the first network slice
  • the processing module is further configured to determine the changed NSSAI allowed to be accessed according to the registration request message.
  • the processing module is further configured to delete the authentication result of the NSSAA process executed by the first network slice.
  • a communication device is provided, and the communication device (may be referred to as a third communication device) is configured to execute the method in the third aspect or any possible implementation manner.
  • the third communication device may include a module for executing the method in the third aspect or any possible implementation manner, for example, including a processing module and a transceiver module.
  • the transceiver module may include a sending module and a receiving module. The sending module and the receiving module may be different functional modules, or may be the same functional module, but can implement different functions.
  • the third communication device is a communication device, or a chip or other component provided in the communication device.
  • the communication device is a core network device.
  • the first communication device is a core network device.
  • the core network device is an authentication network element.
  • the authentication network element is AAA-S.
  • the transceiver module may also be implemented by a transceiver, and the processing module may also be implemented by a processor.
  • the sending module may be implemented by a transmitter, and the receiving module may be implemented by a receiver.
  • the transmitter and the receiver may be different functional modules, or may be the same functional module, but can implement different functions.
  • the third communication device is a communication device, the transceiver is realized by, for example, an antenna, a feeder, and a codec in the communication device.
  • the transceiver (or, the transmitter and the receiver) is, for example, a communication interface in the chip, and the communication interface is connected to the radio frequency transceiver component in the communication device to Information is sent and received through radio frequency transceiver components.
  • the third communication device is continued to be an authentication network element, and the processing module and the transceiver module are used as examples for the introduction. in,
  • the processing module is configured to execute the NSSAA process on the first network slice
  • the transceiver module is configured to receive first information from a first mobility management network element, where the first information is used to indicate that the terminal device no longer accesses the first network slice.
  • the transceiver module is further configured to send a subscription request message to the first mobility management network element, where the subscription request message includes the identification of the terminal device and the first network slice
  • the subscription request message is used to subscribe to the event that the terminal device no longer accesses the first network slice.
  • the transceiver module is further configured to send a second message to the first mobility management network element, and the second message is used to perform NSSAA again on the first network slice Process, or used to deny the terminal device to access the first network slice.
  • the processing module is further configured to delete the authentication result of the NSSAA process executed by the first network slice.
  • the transceiver module is configured to receive the first information from the first mobility management network element in the following manner:
  • the first mobility management network element Receiving a first message from the first mobility management network element, the first message including the first information, the first message further including the identifier of the terminal device and the identifier of the first network slice .
  • a communication device is provided, and the communication device (may be referred to as a fourth communication device) is configured to execute the method in the fourth aspect or any possible implementation manner.
  • the fourth communication device may include a module for executing the method in the fourth aspect or any possible implementation manner, for example, including a processing module and a transceiver module.
  • the transceiver module may include a sending module and a receiving module. The sending module and the receiving module may be different functional modules, or may be the same functional module, but can implement different functions.
  • the fourth communication device is a communication device, or a chip or other component provided in the communication device.
  • the communication device is a core network device.
  • the first communication device is a core network device.
  • the core network device is an authentication network element.
  • the authentication network element is AAA-S.
  • the transceiver module may also be implemented by a transceiver, and the processing module may also be implemented by a processor.
  • the sending module may be implemented by a transmitter, and the receiving module may be implemented by a receiver.
  • the transmitter and the receiver may be different functional modules, or may be the same functional module, but can implement different functions.
  • the fourth communication device is a communication device, the transceiver is realized by, for example, an antenna, a feeder, and a codec in the communication device.
  • the fourth communication device is a chip set in the communication device
  • the transceiver (or, the transmitter and the receiver) is, for example, a communication interface in the chip, and the communication interface is connected to the radio frequency transceiver component in the communication device to Information is sent and received through radio frequency transceiver components.
  • the fourth communication device is continued to be an authentication network element, and the processing module and the transceiver module are used as examples for the introduction. in,
  • the processing module is configured to execute the NSSAA process on the first network slice
  • the transceiver module is configured to receive first information from a first mobility management network element, where the first information is used to instruct the first mobility management network element to cancel the first notification from the authentication network element, wherein, the first notification includes a notification to perform re-authentication on the first network slice or a notification to cancel authorization for the first network slice.
  • the processing module is further configured to delete the authentication result of the NSSAA process executed by the first network slice.
  • the transceiver module is configured to receive the first information from the first mobility management network element in the following manner:
  • the first mobility management network element Receiving a first message from the first mobility management network element, the first message including the first information, the first message further including the identifier of the terminal device and the identifier of the first network slice .
  • a communication device is provided, and the communication device (may be referred to as a fifth communication device) is configured to execute the method in the fifth aspect or any possible implementation manner.
  • the fifth communication device may include a module for executing the method in the fifth aspect or any possible implementation manner, for example, including a processing module and a transceiver module.
  • the transceiver module may include a sending module and a receiving module. The sending module and the receiving module may be different functional modules, or may be the same functional module, but can implement different functions.
  • the fifth communication device is a communication device, or a chip or other component provided in the communication device.
  • the communication device is a core network device.
  • the first communication device is a core network device.
  • the core network device is a mobility management network element (or, referred to as a second mobility management network element).
  • the mobility management network element is AMF.
  • the transceiver module may also be implemented by a transceiver, and the processing module may also be implemented by a processor.
  • the sending module may be implemented by a transmitter, and the receiving module may be implemented by a receiver.
  • the transmitter and the receiver may be different functional modules, or may be the same functional module, but can implement different functions.
  • the fifth communication device is a communication device, the transceiver is realized by, for example, an antenna, a feeder, and a codec in the communication device.
  • the transceiver (or, the transmitter and the receiver) is, for example, a communication interface in the chip, and the communication interface is connected to the radio frequency transceiver component in the communication device to Information is sent and received through radio frequency transceiver components.
  • the fifth communication device is continued to be a mobility management network element, and the processing module and the transceiver module are used as examples for introduction. in,
  • the processing module is configured to determine that a terminal device establishes a first session associated with a first network slice, where the first network slice is a network slice that has successfully executed an NSSAA process;
  • the transceiver module is configured to receive a handover request message from a first access network element, where the handover request message is used to instruct the terminal device to switch from the first access network element to the second access Network element
  • the transceiver module is further configured to send a request message to the storage function network element, where the request message is used to request the provision of a mobility management network element that can serve the second access network network element and can support the NSSAA process.
  • the transceiver module is further configured to receive a third message from the storage function network element, where the third message includes the identifier of the target mobility management network element.
  • a communication device is provided, and the communication device (may be referred to as a sixth communication device) is configured to execute the method in the sixth aspect or any possible implementation manner.
  • the sixth communication device may include a module for executing the method in the sixth aspect or any possible implementation manner, for example, including a processing module and a transceiver module.
  • the transceiver module may include a sending module and a receiving module. The sending module and the receiving module may be different functional modules, or may be the same functional module, but can implement different functions.
  • the sixth communication device is a communication device, or a chip or other component provided in the communication device.
  • the communication device is a core network device.
  • the first communication device is a core network device.
  • the core network device is a second mobility management network element.
  • the second mobility management network element is AMF.
  • the transceiver module may also be implemented by a transceiver, and the processing module may also be implemented by a processor.
  • the sending module may be implemented by a transmitter, and the receiving module may be implemented by a receiver.
  • the transmitter and the receiver may be different functional modules, or may be the same functional module, but can implement different functions.
  • the sixth communication device is a communication device, the transceiver is realized by, for example, an antenna, a feeder, and a codec in the communication device.
  • the sixth communication device is a chip set in a communication device
  • the transceiver (or, the transmitter and the receiver) is, for example, a communication interface in the chip, and the communication interface is connected to the radio frequency transceiver component in the communication device to Information is sent and received through radio frequency transceiver components.
  • the sixth communication device is continued to be the second mobility management network element, and the processing module and the transceiver module are used as examples for introduction. in,
  • the processing module is configured to determine that a terminal device establishes a first session associated with a first network slice, where the first network slice is a network slice that has successfully executed an NSSAA process;
  • the transceiver module is configured to receive a handover request message from a first access network element, where the handover request message is used to instruct the terminal device to switch from the first access network element to the second access Network element
  • the processing module is further configured to obtain information of the first mobility management network element, and the first mobility management network element does not support the NSSAA process;
  • the transceiver module is further configured to send the context of the terminal device to the first mobility management network element, where the context of the terminal device does not include the information of the first session.
  • the transceiver module is further configured to:
  • the transceiver module is further configured to receive a subscription request message from an authentication network element, where the subscription request message includes the identification of the terminal device and the identification of the first network slice, The subscription request message is used to subscribe to the notification that the terminal device no longer accesses the first network slice.
  • the context of the terminal device includes the NSSAI that the terminal device is allowed to access before handover, where the allowed NSSAI includes the identifier of the first network slice, and The context of the terminal device further includes information that the authentication network element has subscribed to the notification that the terminal device no longer accesses the first network slice.
  • the transceiver module is further configured to send a fifth message to the first session management network element serving the first session, and the fifth message is used to trigger the first session management network element.
  • the session management network element releases the first session.
  • a communication device is provided.
  • the communication device is, for example, the first communication device, the second communication device, the third communication device, the fourth communication device, the fifth communication device, or the sixth communication device as described above.
  • the communication device includes a processor and a communication interface, and the communication interface can be used to communicate with other devices or equipment.
  • it may also include a memory for storing computer instructions.
  • the processor and the memory are coupled with each other, and are used to implement the methods described in the foregoing aspects or various possible implementation manners.
  • the communication device may not include a memory, and the memory may be located outside the first communication device.
  • the processor, the memory, and the communication interface are coupled with each other, and are used to implement the foregoing aspects or the methods described in various possible implementation manners.
  • the processor executes the computer instructions stored in the memory
  • the first communication device is caused to execute the foregoing aspect or the method in any one of the possible implementation manners.
  • the communication device is a communication device, or a chip or other component provided in the communication device.
  • the communication interface is realized by, for example, the transceiver (or transmitter and receiver) in the communication device, for example, the transceiver is realized by the antenna, feeder, and codec in the communication device. ⁇ , etc. to achieve.
  • the communication device is a chip set in a communication device
  • the communication interface is, for example, the input/output interface of the chip, such as input/output pins, etc., and the communication interface is connected to the radio frequency transceiver component in the communication device to pass the radio frequency.
  • the transceiver component realizes the sending and receiving of information.
  • a first communication system includes the communication device described in the seventh aspect and the communication device described in the ninth aspect.
  • a second communication system includes the communication device according to the eighth aspect and the communication device according to the tenth aspect.
  • a computer-readable storage medium is provided, the computer-readable storage medium is used to store a computer program, and when the computer program runs on a computer, the computer executes any of the above aspects or any one of them The methods described in the possible implementations.
  • a computer program product containing instructions is provided, the computer program product is used to store a computer program, and when the computer program runs on a computer, the computer executes any of the above aspects or any one of them The methods described in the possible implementations.
  • the first mobility management network element determines that the terminal device no longer accesses the first network slice or the second network slice, the first mobility management network element can notify the authentication network element, thereby authenticating the network element There is no need to initiate re-authentication and re-authorization procedures or de-authorization procedures for the first network slice for the terminal device in the subsequent, so that the signaling overhead of the core network can be saved.
  • Figure 1 is a schematic diagram of a 5G network architecture based on a service-oriented architecture
  • Figure 2 is a schematic diagram of a 5G network architecture based on a point-to-point interface
  • Figure 3 is a schematic diagram of network slicing
  • Figure 4 is a schematic diagram of a registration process of a terminal device
  • Figure 5 is a schematic diagram of determining whether to execute the NSSAA process
  • FIG. 6 is a flowchart of the steps involved in the NSSAA process
  • FIG. 7 is a flowchart of the first communication method provided by an embodiment of this application.
  • FIG. 8 is a flowchart of a second communication method provided by an embodiment of this application.
  • FIG. 9 is a flowchart of a third communication method provided by an embodiment of this application.
  • FIG. 10 is a flowchart of a fourth communication method provided by an embodiment of this application.
  • FIG. 11 is a schematic block diagram of a first mobility management network element provided by an embodiment of this application.
  • FIG. 12 is a schematic block diagram of an authentication network element provided by an embodiment of this application.
  • FIG. 13 is a schematic block diagram of a mobility management network element provided by an embodiment of this application.
  • FIG. 14 is a schematic block diagram of a communication device according to an embodiment of the application.
  • Terminal devices including devices that provide users with voice and/or data connectivity, specifically, include devices that provide users with voice, or include devices that provide users with data connectivity, or include devices that provide users with voice and data connectivity Sexual equipment.
  • it may include a handheld device with a wireless connection function, or a processing device connected to a wireless modem.
  • the terminal device can communicate with the core network via a radio access network (RAN), exchange voice or data with the RAN, or exchange voice and data with the RAN.
  • RAN radio access network
  • the terminal equipment may include user equipment (UE), wireless terminal equipment, mobile terminal equipment, device-to-device communication (device-to-device, D2D) terminal equipment, vehicle to everything (V2X) terminal equipment , Machine-to-machine/machine-type communications (M2M/MTC) terminal equipment, Internet of things (IoT) terminal equipment, subscriber unit, subscriber unit station), mobile station (mobile station), remote station (remote station), access point (access point, AP), remote terminal (remote terminal), access terminal (access terminal), user terminal (user terminal), user Agent (user agent), or user equipment (user device), etc.
  • UE user equipment
  • M2M/MTC Machine-to-machine/machine-type communications
  • IoT Internet of things
  • subscriber unit subscriber unit station
  • mobile station mobile station
  • remote station remote station
  • access point access point
  • AP remote terminal
  • remote terminal remote terminal
  • access terminal access terminal
  • user terminal user terminal
  • user Agent user agent
  • user equipment user device
  • it may include mobile phones (or “cellular” phones), computers with mobile terminal equipment, portable, pocket-sized, hand-held, mobile devices with built-in computers, and so on.
  • PCS personal communication service
  • PCS cordless phones
  • SIP session initiation protocol
  • WLL wireless local loop
  • PDA personal digital assistants
  • restricted devices such as devices with low power consumption, or devices with limited storage capabilities, or devices with limited computing capabilities. Examples include barcodes, radio frequency identification (RFID), sensors, global positioning system (GPS), laser scanners and other information sensing equipment.
  • RFID radio frequency identification
  • GPS global positioning system
  • laser scanners and other information sensing equipment.
  • the terminal device may also be a wearable device.
  • Wearable devices can also be called wearable smart devices or smart wearable devices, etc. It is a general term for using wearable technology to intelligently design daily wear and develop wearable devices, such as glasses, gloves, watches, clothing and shoes Wait.
  • a wearable device is a portable device that is directly worn on the body or integrated into the user's clothes or accessories. Wearable devices are not only a kind of hardware device, but also realize powerful functions through software support, data interaction, and cloud interaction.
  • wearable smart devices include full-featured, large-sized, complete or partial functions that can be achieved without relying on smart phones, such as smart watches or smart glasses, and only focus on a certain type of application function, and need to cooperate with other devices such as smart phones.
  • Use such as all kinds of smart bracelets, smart helmets, smart jewelry, etc. for physical sign monitoring.
  • the various terminal devices described above if they are located on the vehicle (for example, placed in the vehicle or installed in the vehicle), can be regarded as vehicle-mounted terminal equipment, for example, the vehicle-mounted terminal equipment is also called on-board unit (OBU). ).
  • OBU on-board unit
  • the terminal device may also include a relay. Or it can be understood that everything that can communicate with the base station can be regarded as a terminal device.
  • the device for realizing the function of the terminal device may be a terminal device, or a device capable of supporting the terminal device to realize the function, such as a chip system, and the device may be installed in the terminal device.
  • the chip system may be composed of chips, or may include chips and other discrete devices.
  • the device used to implement the functions of the terminal is a terminal device as an example to describe the technical solutions provided in the embodiments of the present application.
  • Network elements or network equipment, including access network network elements, or access network equipment, such as base stations (for example, access points), etc.
  • a base station may refer to a device that communicates with a wireless terminal device through one or more cells on an air interface in an access network.
  • the network element can be used to convert the received air frame and the internet protocol (IP) packet between the network interconnection, as a router between the terminal device and the rest of the access network, where the rest of the access network Part can include IP networks.
  • IP internet protocol
  • the network element can also coordinate the attribute management of the air interface.
  • the network element may include an evolved base station (NodeB or eNB or e-NodeB, evolutional Node B) in a long term evolution (LTE) system or an evolved LTE system (LTE-Advanced, LTE-A), or It can also include the next generation node B (gNB) in the fifth generation (5G) new radio (NR) system or cloud radio access.
  • LTE long term evolution
  • LTE-A evolved LTE system
  • gNB next generation node B
  • gNB next generation node B
  • gNB next generation node B
  • gNB next generation node B
  • gNB next generation node B
  • gNB fifth generation new radio
  • CU centralized unit
  • DU distributed unit
  • the network elements also include core network network elements, or core network equipment.
  • the core network equipment includes, for example, a mobility management entity (MME), etc.
  • MME mobility management entity
  • the core network equipment includes, for example, user plane function network elements and network storage functions ( Network repository function (NRF) network element, access and mobility management function (AMF) network element, AAA server (server, S) or session management function (session management function, SMF) network element, etc.
  • NRF Network repository function
  • AMF access and mobility management function
  • AAA server server, S
  • SMF session management function
  • SMF session management function
  • User plane functional network elements in the fourth generation mobile communication technology (4G) system, for example, include serving gateway (serving gateway, SGW) and packet data network gateway (packet data network gateway, PDN-GW), in 5G system, for example,
  • serving gateway serving gateway
  • PDN-GW packet data network gateway
  • the UPF network element is mainly responsible for connecting to the external network. It can be considered that the UPF network element in the 5G system is equivalent to the combination of the SGW and the PDN-GW in the 4G LTE system.
  • first and second are used to distinguish multiple objects, and are not used to limit the size, content, order, and timing of multiple objects. , Priority or importance, etc.
  • first message and the second message are only for distinguishing different messages, but do not indicate the difference in size, content, sending order, priority, or importance of the two messages.
  • authentication network element, storage function network element, mobility management network element, etc. involved in the embodiments of this application, as well as further AAA-S, NRF, and AMF are just a name, and the name does not affect the device itself. Constitutive limit.
  • authentication network elements, storage function network elements, mobility management network elements, etc., as well as further AAA-S, NRF, and AMF, etc. can also be other names. Examples of this application There is no specific restriction on this.
  • FIG. 1 is a schematic diagram of a 5G network architecture based on a service-oriented architecture, and is also a schematic diagram of an application scenario of an embodiment of the present application.
  • the 5G network architecture shown in FIG. 1 may include three parts, namely a terminal equipment part, a data network (DN) part, and an operator network part.
  • DN data network
  • the operator's network part may include one or more of the following network elements: authentication server function (AUSF) network element, network exposure function (NEF) network element, policy control function (policy) control function, PCF) network element, unified data management (UDM) network element, unified database (Unified Data Repository, UDR) network element, NRF network element, application function (AF) network element, AMF network Element, SMF network element, radio access network (RAN) network element, user plane function (UPF) network element, etc.
  • AUSF authentication server function
  • NEF network exposure function
  • policy control function policy control function
  • PCF PCF
  • UDM unified data management
  • UDR Unified Data Repository
  • NRF network element
  • AF application function
  • AMF application function
  • SMF radio access network
  • RAN radio access network
  • UPF user plane function
  • Nnssf network slice selection function
  • NRF network exposure function
  • PCF policy control function
  • UDM Unified data management
  • AF application function
  • AUSF authentication server function
  • AMF authentication server function
  • SMF SMF network elements
  • Nnef is the service interface of NEF
  • Npcf is the service interface of PCF
  • Nudm is the service interface of UDM
  • Uudr is the service interface of UDR
  • Naf is the service interface of AF
  • Nausf is the service interface of AUSF
  • Namf is the service interface of AMF
  • Nsmf is the service interface of SMF.
  • AMF and terminal equipment can communicate through N1 interface
  • AMF and (R)AN can communicate through N2 interface
  • SMF and UPF can communicate through N4 interface
  • terminal equipment can communicate with (R)AN through air interface
  • (R)AN It can communicate with UPF through the N3 interface
  • UPF and DN can communicate with the N6 interface.
  • the mobility management function network element is, for example, an MME network element in a 4G system, and an AMF network element in a 5G system.
  • MME Mobility Management Entity
  • AMF Access Management Function
  • 5G 5th Generation
  • the embodiments of the present application are not limited to this, and can also be implemented by other network elements in other communication systems, such as In the future communication system, it may be a network element having the function of the above-mentioned AMF network element.
  • the AMF network element is mainly responsible for connecting with the radio, terminating the RAN control plane (CP) interface, that is, the N2 interface, and terminating the non-access-layer (non-access- stratum, NAS) and NAS encryption and integrity protection, registration management, connection management, reachability management, mobility management, transfer of session management (SM) messages between user equipment (UE) and SMF, Or the UE's mobility notification and other functions.
  • CP RAN control plane
  • NAS non-access- stratum
  • NAS non-access- stratum
  • NAS non-access- stratum
  • Storage function network elements such as NRF network elements in a 5G system
  • NRF network elements in a 5G system can also be implemented by other network elements in other communication systems.
  • it may be a network element having the function of the aforementioned NRF network element.
  • the NRF network element can be responsible for the registration and discovery of the network element, and maintain the information of the network element, for example, maintain the instance identification, type, and public land mobile network (public land mobile network) of the network element.
  • land mobile network, PLMN public land mobile network
  • network slicing-related identifiers IP addresses, capabilities of the network element, and supported services.
  • the authentication, authorization and accounting function network element is, for example, AAA-S in a 5G system, and can also be implemented by other network elements in other communication systems.
  • it may be a network element with the above-mentioned AAA-S function.
  • AAA-S Take AAA-S as an example for the authentication, authorization and accounting function network element.
  • the main purpose of AAA-S is to manage which users can access the network server, which services the users with access rights can get, and how to perform the operations on users who are using network resources. Billing processing, etc.
  • AAA-S is not shown in Figure 1, where AAA-S can directly communicate with AUSF, or AAA-S can communicate with AUSF through an AAA-proxy (P).
  • AAA-S can be deployed by operators or by third parties. In the roaming scenario, the AAA-S is located in the home PLMN (home PLMN, HPLMN).
  • the NSSF network element is responsible for determining the network slicing instance, selecting the AMF network element, and so on.
  • the SMF network element can provide session management functions such as session establishment, modification or release, including the maintenance function of the tunnel between the UPF network element and the access network (access network, AN) node, and the Internet protocol (IP) address allocation of the UE Related to management, dynamic host control protocol (DHCP), user plane selection and control (user plane, UP) function, configuration of UPF routing function, termination policy control function interface, billing, roaming function, or policy control And other functions.
  • session management functions such as session establishment, modification or release, including the maintenance function of the tunnel between the UPF network element and the access network (access network, AN) node, and the Internet protocol (IP) address allocation of the UE
  • IP Internet protocol
  • PCF network elements include policy control decision-making and flow-based charging control functions, including user subscription data management functions, policy control functions, charging policy control functions, quality of service (QoS) control, etc.;
  • QoS quality of service
  • the UDM network element is responsible for managing the contracted data, and when the contracted data is modified, it is responsible for notifying the corresponding network element.
  • UDR network element stores and retrieves contract data, policy data, and public architecture data, etc., for UDM network elements, PCF network elements, or NEF network elements to obtain relevant data.
  • UDR network elements must be able to have different data access authentication mechanisms for different types of data, such as subscription data and policy data, to ensure the security of data access.
  • the UDR network element must be able to return a failure response carrying an appropriate reason value for illegal servicing operations or data access requests.
  • the AF network element the application server, provides a certain application layer service to the terminal device.
  • the AF network element provides services to terminal devices, it has certain requirements for QoS policies (policy) and charging (charging) policies, and needs to notify the network.
  • policy QoS policies
  • charging charging
  • NEF network elements mainly support network capability opening functions and open network capabilities and services to the outside world.
  • 3GPP NF publishes functions and events to other NFs through NEF network elements.
  • the open capabilities and events of NEF network elements can be safely opened to third-party applications.
  • NEF network elements use UDR's standardized interface (Nudr) to store/retrieve structured data.
  • Nudr UDR's standardized interface
  • the AUSF network element is responsible for the authentication function and the execution of the network slicing authentication authorization process.
  • UPF network element is the entity that forwards user plane data. It serves as the external protocol data unit (PDU) session of the data network interconnection. It has message routing and forwarding, message detection, user plane part strategy execution, Legal monitoring, traffic usage report, or QoS processing functions.
  • PDU protocol data unit
  • the mobility management network element described in the embodiment of the present application may be the AMF network element shown in FIG. 1, or may be a network element having the function of the above-mentioned AMF network element in a future communication system.
  • the authentication network element described in the embodiment of the present application may be the aforementioned AAA-S or AUSF, or may be a network element having the function of the foregoing AAA-S or a network element having the function of the foregoing AUSF in a future communication system.
  • the network storage network element described in the embodiment of the present application may be the NRF network element shown in FIG. 1, or may be a network element having the function of the above-mentioned NRF network element in a future communication system.
  • the access network network element described in the embodiment of the present application may be the RAN network element shown in FIG. 1, or may be a network element having the function of the above-mentioned RAN network element in a future communication system.
  • the AMF network element is abbreviated as AMF
  • the NRF network element is abbreviated as NRF
  • the access network element is abbreviated as RAN
  • the SMF network element is abbreviated as SMF, and so on.
  • NRF is a network element of the control plane, which can open some service methods, and other devices can interact with NRF through these service methods.
  • FIG. 2 is a schematic diagram of a 5G network architecture based on a point-to-point interface, which is also a schematic diagram of another application scenario of an embodiment of the present application.
  • FIG. 2 is a schematic diagram of a 5G network architecture based on a point-to-point interface, which is also a schematic diagram of another application scenario of an embodiment of the present application.
  • the interfaces between the various network elements in Figure 2 are point-to-point interfaces, while the interfaces between the various network elements in Figure 1 are service-oriented interfaces.
  • network slice and “slice” are the same concept and refer to the same content.
  • One of the descriptions is used in different places, and the two can be interchanged.
  • 5G network slicing technology provides isolated network environments for different application scenarios by virtual independent logical networks on the same network infrastructure, so that different application scenarios can customize network functions and Features that can effectively guarantee the QoS requirements of different services.
  • FIG 3 is a schematic diagram of network slicing.
  • Figure 3 includes three network slices, namely critical (machine type of communication, MTC) slices, massive (massive) MTC slices, and mobile broadband (mobile broadband, MBB) slices.
  • MTC machine type of communication
  • MBB mobile broadband
  • the terminal equipment corresponding to the critical MTC slice may include vehicles, etc.
  • the terminal equipment corresponding to the massive MTC slice may include some measurement meters, such as electricity meters or gas meters
  • the terminal equipment corresponding to the MBB slice may include mobile phones or personal computers ( personal computer, PC), etc.
  • 3GPP 3rd generation partnership project
  • the selection process of the network slicing depends on one or more of the user’s subscription data, local configuration information, roaming agreement, or operator’s strategy. In the selection process of network slicing, the above parameters need to be considered comprehensively.
  • the terminal device selects the best slice type.
  • the terminal device can provide requested network slice selection assistance information (NSSAI) to the core network device for the core network device to select the network slice for the terminal device Instance.
  • NSSAI network slice selection assistance information
  • the terminal device may provide a requested NSSAI composed of a set of parameters to the core network, and select a network slice instance for the terminal device.
  • This set of parameters includes, for example, one or more S-NSSAIs, and one S-NSSAI can represent a network slice that the terminal device requests to access.
  • the terminal device may initiate the registration process in the following scenarios:
  • the terminal device is registered to the 5G network for the first time;
  • the terminal device performs periodic registration update.
  • the establishment of one or more PDU sessions may be triggered.
  • the terminal device performs mobility registration update
  • the terminal device has uplink data to send, and a PDU session is created during the registration process.
  • Figure 4 Please refer to Figure 4 below for the process of registering a terminal device.
  • S401 The terminal device sends a registration request (Registration Request) message to the (R)AN, and the (R)AN receives the registration request message from the terminal device.
  • the registration request message is sent to the (R)AN through an AN message (message), for example.
  • the (R)AN selects the AMF according to the radio access technology (RAT) and the identifier of the network slice requested by the registration request message.
  • RAT radio access technology
  • the (R)AN can follow The RAT supported by the terminal device and the identification of the network slice requested by the registration request message select AMF. Or, if the terminal device is in the radio resource control (RRC) connected state, the (R)AN can directly forward the registration request message to the corresponding AMF according to the existing RRC connection, that is, there is no need to S402 is executed, but S403 may be executed.
  • RRC radio resource control
  • the identifier of the network slice is, for example, S-NSSAI.
  • the registration request message can carry one or more S-NSSAIs, one of which can indicate a network slice.
  • the network slice indicated by the one or more S-NSSAIs is the network slice that the terminal device requests to access.
  • the (R)AN sends a registration request message to the AMF, and the AMF receives the registration request message from the (R)AN.
  • the registration request message is, for example, an N2 message.
  • the N2 message may include information such as N2 parameters, registration messages, access information of the terminal device, PDU session information, and context request of the terminal device.
  • the new-side AMF calls the service operation Namf_Communication_UE Context (Transfer) to send a message to the old-side AMF, and the old-side AMF receives the message from the new-side AMF.
  • the message transferred by calling the servicing operation Namf_Communication_UE Context Transfer is called a UE context transfer message. This message is used to obtain the context of the terminal device.
  • S404 is an optional step. If the AMF serving the terminal device is changed, S404 can be executed. If the AMF serving the terminal device has not changed, it is not necessary to perform S404.
  • the old-side AMF invokes the servicing operation Namf_Communication_UE Context Transfer response (response) to send a message to the new-side AMF, and the new-side AMF receives the message from the old-side AMF.
  • the message transferred by calling the servicing operation Namf_Communication_UE Context Transfer response is called the UE context transfer response message.
  • the message includes the context of the terminal device.
  • S404 and S405 are optional steps. If the AMF serving the terminal device is changed, S404 and S405 can be executed. If the AMF serving the terminal device has not changed, S404 and S405 may not be executed.
  • the new-side AMF sends an identity request (Identity Request) message to the terminal device, and the terminal device receives the identity request message from the newly added AMF.
  • Identity Request identity request
  • the new-side AMF may send an Identity Request message to the terminal device to obtain the SUCI from the terminal device.
  • SUCI subscription concealed identifier
  • the terminal device sends an Identity Response (Identity Response) message to the new-side AMF, and the new-side AMF receives the Identity Response message from the terminal device.
  • the Identity Response message includes SUCI.
  • S406 and S407 are optional steps.
  • the authentication process is the main authentication process for the permanent identification of the UE.
  • the AMF selects an AUSF to authenticate the terminal device according to SUPI or SUCI.
  • AMF can skip the authentication process, that is, S408 is also an optional step.
  • the new-side AMF calls the service operation Namf_Communication_Registration Complete Notify to send a message to the old-side AMF, and the old-side AMF receives the message from the new-side AMF.
  • This message is used to notify the old side AMF that the terminal device has completed registration on the new side AMF.
  • the message transmitted by calling the service operation Namf_Communication_RegistrationCompleteNotify is called the registration complete message.
  • the new-side AMF sends an identity request (Identity Request) message to the terminal device, and the terminal device receives the Identity Request message from the new-side AMF. And, the terminal device sends an Identity Response (Identity Response) message to the new-side AMF, and the new-side AMF receives the Identity Response message from the terminal device.
  • Identity Request identity Request
  • Identity Response Identity Response
  • the new-side AMF if the new-side AMF does not obtain a permanent equipment identifier (PEI) from the context of the terminal device and the old-side AMF, the new-side AMF sends an Identity Request message to the terminal device to request to obtain the PEI.
  • the terminal device replies an Identity Response message to the new side AMF, and the Identity Response message can carry PEI.
  • PEI permanent equipment identifier
  • the new-side AMF calls the servicing operation N5g-eir_Equipment Identity Check (Get) to send a message to the equipment identity register (EIR), and the EIR receives the message from the new-side AMF.
  • This message is used to initiate mobile equipment identity (mobile equipment identity, ME identity) verification.
  • the message transmitted by calling the servicing operation N5g-eir_Equipment Identity Check_Get is called the device identity verification acquisition message.
  • the new-side AMF selects UDM based on SUPI.
  • the UDM can select a UDR instance.
  • S409 to S412 are optional steps.
  • the new-side AMF invokes the servicing operation Nudm_UECM_Registration to register with the UDM.
  • the new-side AMF invokes the servicing operation Nudm_UECM_Registration to send a message to the UDM, and the UDM receives the message from the new-side AMF.
  • the message is used for the new-side AMF to register with the UDM.
  • the UDM sends a registration response message to the new-side AMF, that is, the message indicated by the arrow that UDM points to the new-side AMF in S413a.
  • the message transferred by calling the servicing operation Nudm_UECM_Registration is called a registration message.
  • the new-side AMF calls the servicing operation Nudm_SDM_Get to send a message to the UDM, and the UDM receives the message from the new-side AMF, and the message is used to request to obtain the subscription data of the terminal device.
  • the UDM sends an acquisition response message to the new-side AMF, that is, the message indicated by the arrow of the UDM pointing to the new-side AMF in S413b.
  • the acquisition response message may include the subscription data of the terminal device.
  • the message transferred by calling the servicing operation Nudm_SDM_Get is called the subscription data acquisition message.
  • the new-side AMF invokes the servicing operation Nudm_SDM_Subscribe (Subscribe) to send a message to the UDM, and the UDM receives the message from the AMF.
  • the message is used to subscribe to the service of the subscription data change notification.
  • the message transmitted by calling the servicing operation Nudm_SDM_Subscribe is called the subscription data change subscription message.
  • the UDM sends a subscription response message to the new side AMF, that is, the message indicated by the arrow pointing to the new side AMF by the UDM in S413c.
  • the subscription response message may include notification information that the subscription data has changed.
  • the UDM invokes the servicing operation Nudm_UECM_Deregistration Notification (Deregistration Notification) to send a message to the old-side AMF, and the old-side AMF receives the message from the UDM, which can be used for deregistration.
  • the message transmitted by calling the servicing operation Nudm_UECM_Deregistration Notification is called a deregistration notification message.
  • the UDM can send a message to the old-side AMF through the servicing operation Nudm_UECM_Deregistration Notification to notify the old-side AMF to delete the context of the terminal device.
  • the old-side AMF can also initiate a servicing operation Nsmf_PDU Session_Release SM Context to the SMF to notify the SMF that the terminal device has been unregistered from the network.
  • the SMF will release the PDU session after receiving the notification of the servicing operation Nsmf_PDU Session_Release SM Context.
  • the old-side AMF calls the servicing operation Nudm_SDM_ to unsubscribe (unsubscribe) to send a message to the UDM, and the UDM receives the message from the old-side AMF.
  • the message is used to subscribe, that is, to cancel the subscription data of the terminal device subscription.
  • the message transmitted by calling the servicing operation Nudm_SDM_unsubscribe is called an unsubscribe message.
  • S413d and S413e are optional steps.
  • the new side AMF selects PCF.
  • the new-side AMF decides to establish a policy connection with the PCF, for example, when the new-side AMF has not obtained the access and mobility policies of the terminal device, or the new-side AMF does not have a legal access and mobility policy, the new-side AMF Will choose PCF.
  • the new-side AMF has obtained the PCF identification number (ID) from the old-side AMF, the new-side AMF can directly locate the PCF without performing S414.
  • ID PCF identification number
  • S414 is an optional step.
  • S415 The new-side AMF establishes an AM policy association with the selected PCF.
  • the new-side AMF establishes an AM policy association with the PCF.
  • S415 is an optional step.
  • the new-side AMF invokes the servicing operation Nsmf_PDU Session_Update SM Context Request to send a message to the SMF, and the SMF receives the message from the new-side AMF.
  • This message may request to activate the user plane connection of the PDU session.
  • the message transmitted by calling the servicing operation Nsmf_PDU Session_Update SM Context Request is called an update session management context request message.
  • the AMF sends a message to the SMF through the servicing operation Nsmf_PDUSession_UpdateSMContext Request, which is used to activate the user plane connection of the PDU session. If the PDU session status indicates that it has been released in the UE, the AMF notifies the SMF to release the network resources related to the PDU session. If SMF subscribes to UE-related mobility event notifications, AMF sends notifications to SMF as needed.
  • the new-side AMF sends an N2AMF mobility request (N2 AMF Mobility Request) message to the (non-3GPP interworking function, N3IWF), and the N3IWF receives the N2 AMF Mobility Request message from the new-side AMF.
  • N2 AMF Mobility Request message is used to request the creation of a UE connection pointing to the NG interface of the N3IWF.
  • the N2 AMF Mobility Request message is called a mobility request message.
  • the N3IWF sends an N2AMF Mobility Response (N2 AMF Mobility Response) message to the new-side AMF, and the new-side AMF receives the N2 AMF Mobility Response message from the N3IWF.
  • N2 AMF Mobility Response is called a mobile response message.
  • the new-side AMF will send an N2 AMF Mobility Request message to the N3IWF network element. If the old-side AMF and the N3IWF network element do not have a UE connection with an NG interface, the new-side AMF does not send the N2 AMF Mobility Request message to the N3IWF network element. Therefore, S417 and S418 are optional steps.
  • the old-side AMF sends an AMF-Initiated Policy Association Termination message to the PCF, and the PCF receives the AMF-Initiated Policy Association Termination message from the old-side AMF.
  • the AMF-Initiated Policy Association Termination message is used to delete the connection between the old-side AMF and the PCF.
  • S419 is an optional step.
  • the new-side AMF sends a registration acceptance (Registration Accept) message to the terminal device, and the terminal device receives the Registration Accept message from the new-side AMF.
  • the Registration Accept message is used to notify the terminal device that the registration request of the terminal device is accepted.
  • the Registration Accept message may include Local Area Data Network (LADN) information and mobile initiated connection only (MICO) mode, etc.
  • LADN Local Area Data Network
  • MICO mobile initiated connection only
  • the terminal device sends a Registration Complete (Registration Complete) message to the new-side AMF, and the new-side AMF receives the Registration Complete message from the terminal device.
  • Registration Complete Registration Complete
  • the terminal device can send a Registration Complete message to the new side AMF.
  • the new-side AMF invokes the servicing operation Nudm_SDM_Info to send a message to the UDM, and the UDM receives the message from the new-side AMF.
  • the message transferred by calling the servicing operation Nudm_SDM_Info is called an SDM information message.
  • the AMF sends a Nudm_SDM_Info message to the UDM to trigger the UDM to perform corresponding operations.
  • a roaming information identifier which is a confirmation identifier for receiving UE information requested by the UDM
  • the AMF sends a Nudm_SDM_Info message to the UDM to trigger the UDM to perform corresponding operations.
  • the subsequent steps please refer to the current handling of roaming scenes.
  • a terminal device when a terminal device is registered in the network, in addition to performing the main authentication process of the permanent identification of the UE (that is, the authentication process represented by S408 in the process shown in FIG. 4), it may also be requested by the terminal device.
  • Request of NSSAI the authentication process represented by S408 in the process shown in FIG. 4
  • the NSSAA process can also be simply referred to as the secondary authentication process of network slicing. Please refer to Figure 5 to describe how to determine whether to execute the NSSAA process.
  • S501 The terminal device initiates a registration process. For example, S501 indicates that the terminal device sends a Registration Request message to the AMF, and the AMF receives the Registration Request message from the terminal device.
  • the Registration Request message can carry a request for NSSAI (Requested NSSAI) and UE 5G mobility management core network capability (5GS mobility management core network capability, 5GMM Core Network Capability), where UE 5GMM Core Network Capability indicates whether the terminal device supports the NSSAA process.
  • NSSAI Requested NSSAI
  • 5GMM Core Network Capability UE 5G mobility management core network capability indicates whether the terminal device supports the NSSAA process.
  • S502 The AMF executes the primary authentication procedure of the permanent identity of the UE, and this procedure is called a security procedure PLMN access (security procedures PLMN access), for example.
  • security procedures PLMN access security procedures PLMN access
  • the AMF obtains the UE's subscription data from the UDM.
  • the subscription data includes the indication information of whether each S-NSSAI subscribed by the terminal device needs to execute the NSSAA process.
  • S502 is represented as a security procedure PLMN access (security procedures PLMN access), where AMF is an authenticator (authenticator), and AUSF is an authentication server (auth server).
  • the S-NSSAI contracted by terminal equipment can refer to Table 1:
  • the AMF determines whether the S-NSSAI that needs to perform the NSSAA process is included in the Requested NSSAI according to the subscription data of the terminal device.
  • the AMF determines that the S-NSSAI in the requested NSSAI needs to perform NSSAA, which can have two meanings:
  • the first type if the terminal device indicates in the Registration Request message to support the NSSAA process, then further, the AMF determines whether the S-NSSAI that needs to execute the NSSAA process is included in the Requested NSSAI according to the subscription data of the terminal device. If the S-NSSAI that needs to perform the NSSAA process is included in the Requested NSSAI (corresponding to the requested NSSAI includes the slice type of the home domain network (HPLMN S-NSSAI)), then AMF can determine that the terminal device needs to be after this registration process Perform the NSSAA process. If the S-NSSAI that needs to perform the NSSAA process is not included in the Requested NSSAI, the AMF can determine that the terminal device does not need to perform the NSSAA process after this registration process.
  • the Requested NSSAI carried in the Registration Request message includes S-NSSAI-1 and S-NSSAI-2.
  • S-NSSAI-1 needs to execute the NSSAA process
  • S-NSSAI-2 does not need to execute the NSSAA process. Then the AMF can determine that the terminal device needs to perform the NSSAA process for S-NSSAI-1 after this registration process.
  • the second type If the terminal device indicates in the Registration Request message that it supports the NSSAA process, a certain S-NSSAI in the Requested NSSAI can be mapped to the contracted S-NSSAI, and the contracted S-NSSAI needs to perform NSSAA, then the AMF determines the request The S-NSSAI in the NSSAI needs to perform NSSAA.
  • the AMF determines that a certain S-NSSAI included in the Requested NSSAI can be mapped to the HPLMN S-NSSAI, and the HPLMN S-NSSAI needs to perform the NSSAA process, then the AMF determines that the terminal device is in the current registration process After that, the NSSAA process needs to be executed.
  • the Requested NSSAI carried by the terminal device includes S-NSSAI-A and S-NSSAI-B, where S-NSSAI-A is mapped to S-NSSAI-1, and S-NSSAI-B is mapped to S-NSSAI-2.
  • S-NSSAI-1 needs to execute the NSSAA process
  • S-NSSAI-2 does not need to execute the NSSAA process.
  • the AMF determines that the terminal device needs to perform the NSSAA process on the S-NSSAI-1 after this registration process.
  • mapping between S-NSSAI-A and S-NSSAI-1, and mapping between S-NSSAI-B and S-NSSAI-2 can be understood as the mapping relationship between S-NSSAI-A and S-NSSAI-1, and S-NSSAI-A and S-NSSAI-1 are mapped.
  • -NSSAI-B has a mapping relationship with S-NSSAI-2; or understood as a mapping relationship between the network slice identified by S-NSSAI-A and the network slice identified by S-NSSAI-1, identified by S-NSSAI-B
  • the network slice of S-NSSAI-2 has a mapping relationship with the network slice identified by S-NSSAI-2.
  • S-NSSAI-A may be VPLMN S-NSSAI or HPLMN S-NSSAI, which is not limited in the embodiment of this application.
  • S-NSSAI-A is VPLMN S-NSSAI, it means that the type of network slice identified by S-NSSAI-A belongs to the visited PLMN (visit PLMN), then there is a mapping relationship between S-NSSAI-A and S-NSSAI-1 That is, there is a mapping relationship between VPLMN S-NSSAI-A and HPLMN S-NSSAI-1, or there is a mapping relationship between the network slice identified by VPLMN S-NSSAI-A and the network slice identified by HPLMN S-NSSAI-1.
  • S-NSSAI-A When S-NSSAI-A is HPLMN S-NSSAI means that the type of network slice identified by S-NSSAI-A belongs to the HPLMN network, and the mapping relationship between S-NSSAI-A and S-NSSAI-1 is HPLMN S-NSSAI- There is a mapping relationship between the network slice identified by A and the network slice identified by HPLMN S-NSSAI-1.
  • the AMF sends a registration acceptance (Registration Accept) message to the terminal device, and the terminal device receives the Registration Accept message from the AMF.
  • Registration Accept Registration Accept
  • the Registration Accept message may carry allowed NSSAI (Allowed NSSAI), where Allowed NSSAI includes S-NSSAI that does not require NSSAA procedures.
  • the AMF also sends a pending NSSAI (Pending NSSAI) to the terminal device, and the terminal device receives the Pending NSSAI from the AMF.
  • the Pending NSSAI may include one or more S-NSSAIs that need to perform the NSSAA process, and the Pending NSSAI is used to indicate terminal devices. These S-NSSAIs that need to perform the NSSAA process are in the pending state.
  • the Requested NSSAI carried in the Registration Request message includes S-NSSAI-1 and S-NSSAI-2, then Allowed NSSAI may include S-NSSAI-2, and Pending NSSAI may include S-NSSAI-1.
  • the Pending reason value is the NSSAA process.
  • the AMF executes the NSSAA process for the S-NSSAI in the pending state.
  • NSSAI includes S-NSSAI-1
  • AMF can perform NSSAA process on S-NSSAI-1.
  • steps of the NSSAA process please refer to the process that will be introduced in Figure 6 below.
  • S506 After the execution of the NSSAA process is completed, the AMF updates the Allowed NSSAI according to the authentication result of the NSSAA process.
  • S506 is represented as the UE configuration update procedure, that is, the AMF can update the Allowed NSSAI for the UE.
  • the S-NSSAI will be added to the new Allowed NSSAI.
  • the authentication result of the NSSAA process performed on an S-NSSAI is authentication failure, and the S-NSSAI is included in the Requested NSSAI, the S-NSSAI will be added to the Rejected NSSAI, and the AMF does not need to update the terminal device Allowed NSSAI, that is, AMF will not generate new Allowed NSSAI, nor does it need to send new Allowed NSSAI to terminal devices.
  • the S-NSSAI included in the Requested NSSAI will be added to new Allowed in NSSAI.
  • the S-NSSAI included in the Requested NSSAI will be added to Rejected In NSSAI, at the same time, AMF does not need to update the Allowed NSSAI of the terminal device, that is, AMF does not generate new Allowed NSSAI, nor does it need to send new Allowed NSSAI to the terminal device.
  • AMF performed the NSSAA process on S-NSSAI-1. Then, if the authentication result of the NSSAA process of S-NSSAI-1 is that the authentication is successful, or the NSSAA process of S-NSSAI-1 is executed successfully, then AMF can add S-NSSAI-1 to Allowed NSSAI to get the new (new) Allowed NSSAI, and AMF can send new Allowed NSSAI to the terminal device, new Allowed NSSAI can include S-NSSAI-1 and S-NSSAI-2.
  • the AMF sends Rejected NSSAI to the terminal device, where Rejected NSSAI includes S-NSSAI- 1. At the same time, AMF will not update the Allowed NSSAI of the terminal device.
  • FIG. 6 is a flowchart of the steps involved in the NSSAA process.
  • the main idea is: when the AMF decides to trigger the NSSAA process, the AMF will interact with the AAA-S to transfer the authentication information of the terminal device.
  • AAA-S is located in a third party and AUSF cannot directly interact with AAA-S, then AUSF can interact with AAA-S indirectly through an AAA-proxy (P).
  • the AMF triggers the NSSAA process on the S-NSSAI in the Pending NSSAI.
  • the AMF performs NSSAA on the S-NSSAI included in the Pending NSSAI, which can have two meanings:
  • the first type a certain S-NSSAI in the Pending NSSAI belongs to the contracted S-NSSAI, and the contracted S-NSSAI needs to perform NSSAA, then AMF performs NSSAA on the S-NSSAI.
  • Pending NSSAI S-NSSAI-1. Since S-NSSAI-1 is HPLMN S-NSSAI, AMF performs the NSSAA process on S-NSSAI-1.
  • the second type a certain S-NSSAI in the Pending NSSAI is mapped to the contracted S-NSSAI, and the contracted S-NSSAI needs to perform NSSAA, then the AMF performs NSSAA for the contracted S-NSSAI.
  • Pending NSSAI S-NSSAI-A. Since S-NSSAI-A is mapped to S-NSSAI-1, AMF performs the NSSAA process on S-NSSAI-1.
  • the S-NSSAI involved in the following steps S602 to S617 is the S-NSSAI subscribed by the terminal device, and the subscribed S-NSSAI needs to execute the NSSAA process.
  • the AMF sends a non-access stratum (NAS) mobile management (MM) message to the terminal device, and the terminal device receives the NAS MM message from the AMF.
  • NAS non-access stratum
  • MM mobile management
  • the NAS MM message may include S-NSSAI, and the NAS MM message is used to request the ID of the terminal device from the terminal device to perform Extensible Authentication Protocol (EAP) authentication.
  • EAP Extensible Authentication Protocol
  • the terminal device sends a NAS MM message to the AMF, and the AMF receives the NAS MM message from the terminal device.
  • the NAS MM message includes EAP ID response (Response) and S-NSSAI.
  • the S-NSSAI in S603 is the same as the S-NSSAI in S602.
  • the AMF calls the servicing operation Nausf_Communication_EAPMessage_Transfer of the AUSF to send a message to the AUSF, and the AUSF receives the message from the AMF.
  • the message may include EAP ID Response, AAA-S address, generic public subscription identifier (GPSI), and S-NSSAI.
  • EAP ID Response AAA-S address
  • GPSI GPSI
  • S-NSSAI S-NSSAI
  • the GPSI is the external identification of the terminal device, such as the mobile phone number or e-mail address of the terminal device.
  • AAA-S address is the address of AAA-S, which can be pre-configured on the AMF or the AMF obtains the AAA-S address from UDM.
  • the S-NSSAI is the identifier of the network slice where the NSSAA process is executed this time, and the S-NSSAI is HPLMN S-NSSAI.
  • AUSF calls the service operation Naaa_Communication_EAPmessageTranfser to send a message to AAA-P, and AAA-P receives the message from AUSF.
  • the message includes EAP ID Response, AAA-S address, GPSI and S-NSSAI.
  • AAA-S is located in a third-party network and AUSF needs to interact with AAA-S through AAA-P
  • AUSF calls the servicing operation Naaa_Communication_EAPmessageTranfser to send EAP ID Response, AAA-S address, GPSI, and S-NSSAI to AAA-P.
  • AAA-S is located in the operator's network, AUSF does not need to pass AAA-P but can directly interact with AAA-S, then AUSF calls the servicing operation Naaa_Communication_EAPmessageTranfser to EAP ID Response, AAA-S address, GPSI and S-NSSAI Send to AAA-S.
  • AUSF communicates with AAA-S through AAA-P as an example.
  • the AAA-P sends an authentication request (Auth request) message to the AAA-S according to the AAA-S address, and the AAA-S receives the Auth request message from the AAA-P.
  • the Auth request message may include EAP ID Response, GPSI, and S-NSSAI.
  • EAP-message may include EAP ID Response, GPSI, and S-NSSAI information.
  • the purpose of transmitting EAP-message is for EAP authentication (authentication) of the terminal device.
  • AAA-S sends an authentication response (Auth Response) message to AAA-P, and AAA-P receives the authentication response message from AAA-S.
  • the authentication response message may include information such as EAP-Success/Failure message, GPSI, and S-NSSAI. Or, if AAA-S and AUSF can interact directly, AAA-S sends EAP-Success/Failure message, GPSI and S-NSSAI to AUSF, and AUSF receives EAP-Success/Failure message, GPSI and S from AAA-S -NSSAI.
  • Figure 6 takes AUSF communicating with AAA-S via AAA-P as an example.
  • the AAA-S If the authentication result of the NSSAA is that the authentication is successful, that is, the AAA-S sends an EAP-Success message, then the AAA-S saves the corresponding relationship between the GSPI and the S-NSSAI of the successfully authenticated network slice.
  • AAA-P calls the service operation Nausf_Communication_EAPmessageTranfser to send a message to AUSF, and AUSF receives the message from AAA-P.
  • the message may include information such as EAP-Success/Failure message, S-NSSAI, and GPSI.
  • AUSF calls the service operation Namf_Communication_N1N2messageTranfser of AMF to send a message to AMF, and AMF receives the message from AUSF.
  • the message may include information such as EAP-Success/Failure message, S-NSSAI, and GPSI.
  • the AMF sends a NAS MM message to the terminal device, and the terminal device receives the NAS MM message from the AMF.
  • the NAS MM message carries EAP-Success/Failure message.
  • the AMF sends the new Allowed NSSAI to the terminal device through the UE Configuration Update procedure (UE Configuration Update procedure), and the terminal device receives the new Allowed NSSAI from the AMF.
  • UE Configuration Update procedure UE Configuration Update procedure
  • the S-NSSAI executing the NSSAA process If the authentication result of the S-NSSAI executing the NSSAA process is that the authentication is successful, and the S-NSSAI is included in the Requested NSSAI, the S-NSSAI will be added to the new Allowed NSSAI. Or, if the authentication result of the NSSAA process performed by the S-NSSAI is authentication failure, and the S-NSSAI is included in the Requested NSSAI, the S-NSSAI will be added to the Rejected NSSAI, and the AMF does not need to update the Allowed of the terminal device NSSAI, that is, AMF does not generate new Allowed NSSAI, nor does it need to send new Allowed NSSAI to terminal devices.
  • the S-NSSAI included in the Requested NSSAI will be added to the new Allowed NSSAI.
  • the authentication result of the S-NSSAI performing the NSSAA process is authentication failure, and the S-NSSAI can be mapped to the S-NSSAI included in the Requested NSSAI, the S-NSSAI included in the Requested NSSAI will be added to the Rejected NSSAI At the same time, AMF does not need to update the Allowed NSSAI of the terminal device, that is, AMF will not generate a new Allowed NSSAI, nor does it need to send a new Allowed NSSAI to the terminal device.
  • the AMF can be sent through the UE Configuration Update procedure.
  • the AMF sends new Allowed NSSAI to the terminal device, where new Allowed NSSAI includes S-NSSAI-1 and S-NSSAI-2.
  • AMF sends Rejected NSSAI to the terminal device, where Rejected NSSAI includes S-NSSAI-1, that is, AMF will not update the Allowed NSSAI to the terminal device, nor will it send it to the terminal device. new Allowed NSSAI.
  • the AMF sends new Allowed NSSAI to the terminal device, where new Allowed NSSAI includes S-NSSAI-A and S-NSSAI-B.
  • AMF sends Rejected NSSAI to the terminal device, where Rejected NSSAI includes S-NSSAI-A, that is, AMF will not update the Allowed NSSAI to the terminal device or send it to the terminal device new Allowed NSSAI.
  • the AMF can be based on the terminal device
  • the subscription data of the terminal device determines whether the Requested NSSAI of the terminal device includes an S-NSSAI (S-NSSAI subject to NSSAA) that needs to perform NSSAA or an S-NSSAI that has a mapping relationship with it.
  • the AMF executes the NSSAA process for the S-NSSAI that needs to execute the NSSAA process.
  • the terminal device can access the network slice corresponding to the HPLMN S-NSSAI (the network slice corresponding to the HPLMN S-NSSAI is called The first network slice), or the terminal device can access the second network slice that has a mapping relationship with the first network slice. It can be understood that the S-NSSAI corresponding to the first network slice is HPLMN S-NSSAI.
  • the second network slice is mapped to the first network slice, and the S-NSSAI corresponding to the second network slice may be HPLMN S-NSSAI or visit PLMN (visit PLMN, VPLMN) S-NSSAI, which is not limited in this embodiment of the application.
  • the mapping relationship between the first network slice and the second network slice reference may also be made to the related introduction of the process shown in FIG. 5 above.
  • the AAA-S saves the correspondence between the identification of the terminal device (for example, GPSI) and the identification of the first network slice (for example, S-NSSAI).
  • the AMF may also implicitly subscribe to the first notification to AUSF, and the first notification may be to perform Re-authentication on the first network slice and The notification of the re-authorization process, or the first notification may be a notification of executing the Authorization Revocation process for the first network slice.
  • the first notification may be an event of performing Re-authentication and Re-authorization on the first network slice or the first notification may be an event of performing Authorization Revocation on the first network slice.
  • the Re-authentication and Re-authorization process can also be referred to as the Re-auth process for short, or the detection is the re-authentication process.
  • the revocation process is a network slice-specific authorization revocation process (Network Slice-Specific Authorization Revocation procedure), and can also be referred to as a revocation authorization process for short.
  • AAA-S may initiate a Re-authentication and Re-authorization process for the first network slice or the first network slice to the terminal device Specifically, when AAA-S decides to trigger the execution of the first notification on the first network slice, AAA-S sends a request message to AUSF, and the request message is used to trigger AMF to perform Re-authentication on the first network slice and Re-authorization process or trigger AMF to execute the Revocation process for the first network slice.
  • the AUSF queries the UDM for the AMF identification information of the service terminal device based on the first notification implicitly subscribed by the AMF, and sends the request message to the AMF.
  • the terminal device no longer supports the NSSAA process. Specifically, whether the terminal device has the ability to support the NSSAA process can be used as the UE 5GMM Core Network Capability, which is sent to the core network through a registration request message.
  • the terminal device can modify the UE 5GMM Core Network Capability. For example, the UE 5GMM Core Network Capability of a terminal device initially indicates that it supports the NSSAA process (Network Slice-Specific Authentication and Authorization supported), and the subsequent terminal device can perform the 5GMM Core Network Capability of the UE. Modified, the revised UE 5GMM Core Network Capability indicates that the NSSAA process (Network Slice-Specific Authentication and Authorization not supported) is not supported.
  • the Allowed NSSAI of the terminal device is changed, that is, the NSSAI that the terminal device is allowed to access changes.
  • the NSSAI newly requested by the terminal device no longer includes the S-NSSAI that needs to execute the NSSAA process or the S-NSSAI that has a mapping relationship with it.
  • the terminal device may move, or the terminal device needs to re-register based on the current service request of its own. Then the terminal device can send a registration request message to the core network.
  • the registration request message includes the newly requested NSSAI (new requested NSSAI), the S-NSSAI included in the new NSSAI and the requested message sent to the core network by the terminal device during the last registration.
  • the S-NSSAI included in the NSSAI may be different, so that the terminal device requests to access other network slices.
  • the requested NSSAI during the last registration of the terminal device includes S-NSSAI-1 (this S-NSSAI-1 needs to perform the NSSAA process), and the new requested NSSAI during this registration does not include S-NSSAI-1, that is, the The Allowed NSSAI of the terminal device has changed, and the changed Allowed NSSAI (or called new Allowed NSSAI) does not include S-NSSAI-1. If the changed Allowed NSSAI does not include S-NSSAI-1, it indicates that the terminal device may no longer access the network slice corresponding to S-NSSAI-1.
  • the terminal device deregistration from the network.
  • the terminal device may initiate a deregistration process (UE-initiated Deregistration) by itself to notify the network that the terminal device no longer accesses the current network; or, the network initiates a deregistration process (Network-initiated Deregistration) to notify the network that the terminal device is no longer connected to the current network; Notify the terminal device that it cannot access the current network.
  • UE-initiated Deregistration UE-initiated Deregistration
  • Network-initiated Deregistration Network-initiated Deregistration
  • the terminal equipment moves from the 5G network to the evolved packet system (EPS) network.
  • the terminal device may be interworking from the coverage area of the 5G network to the coverage area of the EPS network. Since the first network slice needs to perform the NSSAA process in the 5G network but the EPS network does not support the authentication mechanism required by the NSSAA process, the context corresponding to the first network slice cannot be switched to the EPS network, so after the terminal device is registered to the EPS network , Unable to access the first network slice. For example, the terminal device accesses S-NSSAI-1 on the 5G network, and when the terminal device moves from 5G to the EPS network, the terminal device cannot continue to access S-NSSAI-1.
  • EPS evolved packet system
  • AAA-S may trigger the Re-authentication and Re-authorization process for a certain S-NSSAI as usual, and if the network slice corresponding to the S-NSSAI is no longer a terminal device For the network slice that is requested to be accessed, performing the Re-authentication and Re-authorization process on the network slice at this time is an unnecessary process, which causes a waste of signaling in the core network.
  • the technical solutions of the embodiments of the present application are provided.
  • the first mobility management network element determines that the terminal device no longer accesses the S-NSSAI that needs to perform the NSSAA process or the S-NSSAI that has a mapping relationship with it, then the first mobility management network element can The information that the terminal device no longer accesses the first network slice informs the authentication network element, for example, the authentication network element is AAA-S, or instructs the first mobility management network element to cancel the subscription to perform re-authentication from the authentication network element Notification or notification of revocation of authorization for execution, so that after the authentication network element learns the information, it does not need to initiate the re-authentication process or revocation authorization process for the first network slice to the terminal device, thus saving the signaling of the core network. Overhead.
  • the mobility management network element is the AMF network element
  • the authentication network element is the AAA- S network element or AUSF network element
  • storage function network element is NRF network element as an example for description.
  • the AMF network element is also referred to as AMF for short
  • NRF network element is referred to as NRF for short
  • AUSF network element is referred to as AUSF for short
  • access network network element is referred to as RAN for short. That is, the AMF described later in the embodiments of this application can be replaced with mobility management network elements, AAA-S can be replaced with authentication network elements, NRF can be replaced with storage function network elements, and RAN can be replaced with access network elements. Yuan.
  • the embodiment of the present application provides a first communication method. Please refer to FIG. 7, which is a flowchart of this method. In the following introduction process, the application of this method to the network architecture shown in FIG. 1 or FIG. 2 is taken as an example.
  • the AMF involved in the embodiment shown in FIG. 7 may also be referred to as the first AMF or the first mobility management network element.
  • the terminal device initiates a registration procedure.
  • the terminal device sends a registration request message to the AMF, and the AMF receives the registration request message from the terminal device.
  • the registration request message here is referred to as the first registration request message.
  • the first registration request message can carry the Requested NSSAI and UE 5GMM Core Network Capability of the terminal device.
  • the UE 5GMM Core Network Capability carried in the first registration request message indicates that the terminal device supports the NSSAA process.
  • the AMF calls the UDM service operation Nudm_SDM_Get to obtain the contract data of the terminal device from the UDM, and the contract data of the terminal device includes the contract S-NSSAI of the terminal device.
  • the AMF receives the contracted S-NSSAI of the terminal device sent by the UDM to the AMF through the servicing operation Nudm_SDM_Get response.
  • the contracted S-NSSAI of the terminal device includes indication information for indicating whether the contracted S-NSSAI needs to perform the NSSAA process.
  • the contract S-NSSAI of terminal equipment can refer to Table 2:
  • the AMF can determine whether the Requested NSSAI includes the S-NSSAI that needs to perform the NSSAA process according to the subscription data of the terminal device.
  • Requested NSSAI includes the S-NSSAI that needs to perform the NSSAA process, then the AMF puts the S-NSSAI that needs to perform the NSSAA process in the Requested NSSAI in the Pending NSSAI, and puts the S-NSSAI in the Requested NSSAI that does not need to perform the NSSAA process in the Allowed NSSAI middle.
  • AMF sends a registration acceptance message to the terminal device.
  • the registration acceptance message can carry Allowed NSSAI and Pending NSSAI.
  • the AMF initiates an NSSAA process for each S-NSSAI included in the Pending NSSAI that needs to perform the NSSAA process.
  • the AMF learns that the authentication result of a certain network slice performing the NSSAA process is successful, it allows the terminal device to access the network slice, and the AMF generates a new Allowed NSSAI for the terminal device, where the new Allowed NSSAI is Contains the identification of the network slice that successfully executed the NSSAA process.
  • the AMF saves the authentication and authorization status (Authentication and Authorization status for this S-NSSAI) of the S-NSSAI in the context of the terminal device.
  • the AAA-S saves the corresponding relationship between the identification of the terminal device and the S-NSSAI that successfully executes the NSSAA process.
  • the identification of the terminal device is GPSI and so on.
  • the Requested NSSAI carried in the first registration request message by the terminal device includes S-NSSAI-1 and S-NSSAI-2, where S-NSSAI-1 and S-NSSAI-2 are both HPLMN S-NSSAI, and S -NSSAI-1 needs to execute the NSSAA process, and S-NSSAI-2 does not need to execute the NSSAA process.
  • the S-NSSAI-1 included in the Requested NSSAI is the first network slice. Then the Allowed NSSAI sent by the AMF to the terminal device in the registration acceptance message may include S-NSSAI-2, and the Pending NSSAI sent to the terminal device in the registration acceptance message may include S-NSSAI-1.
  • AMF can initiate the NSSAA process for S-NSSAI-1. If the NSSAA process of S-NSSAI-1 is executed successfully, or the authentication result of the NSSAA process of S-NSSAI-1 is successful, the AMF sends new Allowed NSSAI to the terminal device, and new Allowed NSSAI may include S-NSSAI -1 and S-NSSAI-2. Among them, S-NSSAI-1 included in new Allowed NSSAI can be used as the first network slice. Or, if the execution of the NSSAA procedure of S-NSSAI-1 fails, or the authentication result of the NSSAA procedure of S-NSSAI-1 is authentication failure, the AMF does not need to send new Allowed NSSAI to the terminal device.
  • the Requested NSSAI carried in the first registration request message by the terminal device includes S-NSSAI-1 and S-NSSAI-3, and both S-NSSAI-1 and S-NSSAI-3 need to perform the NSSAA process, that is, Requested Both S-NSSAI-1 and S-NSSAI-3 included in NSSAI are the first network slices.
  • AMF sends empty Allowed NSSAI to the terminal device in the registration acceptance message, that is, Allowed NSSAI is empty and does not contain any S-NSSAI
  • the Pending NSSAI sent by AMF to the terminal device in the registration acceptance message includes S- NSSAI-1 and S-NSSAI-3.
  • AMF initiated the NSSAA process for both S-NSSAI-1 and S-NSSAI-3. If both the NSSAA process of S-NSSAI-1 and the NSSAA process of S-NSSAI-3 are executed successfully, the AMF sends new Allowed NSSAI to the terminal device, and new Allowed NSSAI includes S-NSSAI-1 and S-NSSAI-3, that is, new Allowed NSSAI including S-NSSAI-1 and S-NSSAI-3 are the first network slices.
  • the AMF sends new Allowed NSSAI to the terminal device, and new Allowed NSSAI includes S-NSSAI-1 but not S- NSSAI-3.
  • the AMF does not need to send new Allowed NSSAI to the terminal device.
  • the Requested NSSAI carried in the first registration request message by the terminal device includes S-NSSAI-A and S-NSSAI-B, where S-NSSAI-A is mapped to S-NSSAI-1, and S-NSSAI-B is mapped to S-NSSAI-1.
  • S-NSSAI-2 mapping where the mapping is understood as, for example, S-NSSAI-A and S-NSSAI-B are HPLMN S-NSSAI or VPLMN S-NSSAI, and S-NSSAI-1 and S-NSSAI-2 are HPLMN S -NSSAI.
  • S-NSSAI-1 needs to execute the NSSAA process, and S-NSSAI-2 does not need to execute the NSSAA process.
  • the S-NSSAI-A included in the Requested NSSAI is the second network slice.
  • the Allowed NSSAI sent by the AMF to the terminal device in the registration acceptance message may include S-NSSAI-B, and the Pending NSSAI sent to the terminal device in the registration acceptance message may include S-NSSAI-A.
  • AMF can initiate the NSSAA process for S-NSSAI-1.
  • new Allowed NSSAI may include S-NSSAI -A and S-NSSAI-B, that is, S-NSSAI-A included in new Allowed NSSAI is the second network slice.
  • execution of the NSSAA process of S-NSSAI-1 fails, or the authentication result of the NSSAA process of S-NSSAI-1 is authentication failure, AMF does not need to send new Allowed NSSAI to the terminal device.
  • the first network slice may be a network slice (HPLMN S-NSSAI) of the home domain that successfully executes the NSSAA process, and there is a mapping relationship between the second network slice and the first network slice.
  • HPLMN S-NSSAI network slice of the home domain that successfully executes the NSSAA process
  • the mapping relationship can be understood as if it is a roaming scenario, for example, a terminal device roams from HPLMN to VPLMN, the S-NSSAI corresponding to the second network slice can be VPLMN S-NSSAI; and if it is a non-roaming scenario, the terminal device stays in HPLMN, Then the S-NSSAI corresponding to the second network slice may be HPLMN S-NSSAI, which is of course not limited in the embodiment of the present application.
  • the new Allowed NSSAI sent by the AMF to the terminal device includes the S-NSSAI corresponding to the first network slice or the S-NSSAI corresponding to the second network slice. That is, the terminal device is allowed to access the first network slice that has successfully executed the NSSAA process, or the terminal device is allowed to access the second network slice, where the second network slice is mapped to the first network slice, and the first network slice is successfully executed The NSSAA process.
  • the definition of the first network slice and the second network slice and the relationship between them will not be described in detail.
  • S703 The terminal device initiates the registration process again. It is shown in FIG. 7 that the terminal device sends a registration request message to the AMF, and the AMF receives the registration request message from the terminal device.
  • the registration request message in S701 may be referred to as the first registration request message, and the registration request message in S703 may be referred to as the second registration request message, so that S703 and S701 can be distinguished.
  • the registration request message in S703 may include information for indicating that the terminal device does not support the NSSAA process, or the request to access NSSAI carried in the registration request message does not include the identity of the first network slice or the identity of the second network slice, or,
  • the registration request message includes information for indicating that the terminal device does not support the NSSAA process, and the request to access the NSSAI carried in the registration request message does not include the identifier of the first network slice or the identifier of the second network slice.
  • the information used to indicate that the terminal device does not support the NSSAA process may be UE 5GMM Core Network Capability.
  • the UE 5GMM Core Network Capability indicates that the terminal device does not support the NSSAA process.
  • the request to access the NSSAI carried in the registration request message is, for example, new Requested NSSAI.
  • the new Requested NSSAI may include the S-NSSAI of the network slice that the terminal device requests to access this time.
  • S701 to S703 are optional steps, which are represented by dashed lines in FIG. 7.
  • the AMF determines according to the first condition that the terminal device no longer accesses the first network slice or the second network slice.
  • S704 may also be described as that the AMF determines that the terminal device does not access the first network slice or the second network slice according to the first condition.
  • the first condition may include multiple types. For example, a first condition is that the terminal device is unregistered from the network; for example, another first condition is that the terminal device moves from the first network to the second network; for example, another first condition is that the terminal device moves from the first network to the second network.
  • the condition is that the NSSAI that the terminal device allows to access changes, and so on.
  • the AMF determining that the terminal device no longer accesses the first network slice or the second network slice may include: the network slice previously accessed by the terminal device is the first network slice, and when the terminal device no longer accesses the first network slice, Then the AMF determines that the terminal device no longer accesses the first network slice.
  • the network slice previously accessed by the terminal device is the second network slice.
  • the AMF determines that the terminal device no longer accesses the second network slice.
  • the terminal device when the AMF determines that the terminal device is deregistered, the terminal device changes from the registered status (registered status) to the deregistered status (deregistered status). It can be understood that the terminal device in the deregistered state no longer connects Into any network slice, then naturally, the AMF can determine that the terminal device no longer accesses the first network slice or the second network slice.
  • the method for AMF to determine the deregistration of a terminal device may be: the terminal device initiates a deregistration process (UE-initiated Deregistration) to notify AMF that the terminal device no longer accesses the current network; or, the network initiates deregistration Process (Network-initiated Deregistration) to notify that the terminal device cannot access the current network.
  • UE-initiated Deregistration UE-initiated Deregistration
  • Network-initiated Deregistration Network-initiated Deregistration
  • the terminal device requests to access the network slice identified by HPLMN S-NSSAI-1, and HPLMN S-NSSAI-1 successfully executes the NSSAA process, that is, HPLMN S-NSSAI-1 is the first network slice.
  • the terminal device At a certain moment after the terminal device accesses HPLMN S-NSSAI-1, the terminal device deregisters from the network, and the AMF determines that the terminal device no longer accesses HPLMN S-NSSAI-1.
  • a terminal device requests to access the network slice identified by VPLMN S-NSSAI-A, VPLMN S-NSSAI-A is mapped to HPLMN S-NSSAI-1, and HPLMN S-NSSAI-1 successfully executes the NSSAA process , That is, HPLMN S-NSSAI-1 is the first network slice, and VPLMN S-NSSAI-A is the second network slice.
  • the terminal device At a certain moment after the terminal device accesses the VPLMN S-NSSAI-A, the terminal device deregisters from the network, and the AMF determines that the terminal device no longer accesses the VPLMN S-NSSAI-A.
  • the first network is a 5G network and the second network is an EPS network.
  • the 5G network is a 5G core network (5GC)
  • the EPS network is an EPS core network (EPC).
  • EPC EPS core network
  • the terminal device requests to access the network slice identified by HPLMN S-NSSAI-1 and HPLMN S-NSSAI-1 successfully executes the NSSAA process, that is, HPLMN S-NSSAI-1 is the first network slice.
  • HPLMN S-NSSAI-1 is the first network slice.
  • the AMF determines that the terminal device no longer accesses HPLMN S-NSSAI-1.
  • a terminal device requests to access the network slice identified by VPLMN S-NSSAI-A, VPLMN S-NSSAI-A is mapped to HPLMN S-NSSAI-1, and HPLMN S-NSSAI-1 successfully executes the NSSAA process, That is, HPLMN S-NSSAI-1 is the first network slice, and VPLMN S-NSSAI-A is the second network slice.
  • the terminal device moves from the 5G network to the EPS network, and the AMF determines that the terminal device no longer accesses the VPLMN S-NSSAI-A.
  • the method for AMF to determine that a terminal device moves from a 5G network to an EPS network may be: AMF receives a de-registration notification message from UDM.
  • the de-registration notification message may be sent to AMF by UDM invoking the servicing operation Nudm_UECM_DeregistrationNotification.
  • the notification message carries the identification of the terminal device and the 5GS to EPS Mobility value (5GS to EPS Mobility).
  • the AMF can determine that the terminal device has moved from the 5G network to the EPS network, thereby determining that the terminal device is no longer connected. Enter the first network slice or the second network slice.
  • the AMF determines that the NSSAI that the terminal device is allowed to access has changed, specifically, the NSSAI allowed to access before the change includes the identity of the first network slice, and the NSSAI allowed to access after the change does not include The identifier of the first network slice. If this is the case, the NSSAI allowed to be accessed by the terminal device is changed, which can also be understood as that the AMF removes the identifier of the first network slice from the NSSAI allowed to be accessed by the terminal device.
  • the terminal device requests to access the network slice identified by HPLMN S-NSSAI-1, and HPLMN S-NSSAI-1 successfully executes the NSSAA process, that is, HPLMN S-NSSAI-1 is the first network slice.
  • the NSSAI that the terminal device is allowed to access includes HPLMN S-NSSAI-1.
  • the AMF removes HPLMN S-NSSAI-1 from the NSSAI allowed by the terminal device, and the AMF determines that the terminal device is no longer connected to HPLMN S-NSSAI-1.
  • the AMF determines that the NSSAI allowed to be accessed by the terminal device has changed, specifically, the allowed NSSAI before the change includes the identifier of the second network slice, and the changed NSSAI allowed to access does not include the identifier of the second network slice. . If this is the case, the NSSAI allowed to be accessed by the terminal device changes, which can also be understood as that the AMF removes the identifier of the second network slice from the NSSAI allowed to be accessed by the terminal device.
  • a terminal device requests to access the network slice identified by VPLMN S-NSSAI-A, VPLMN S-NSSAI-A is mapped to HPLMN S-NSSAI-1, and HPLMN S-NSSAI-1 successfully executes the NSSAA process, that is HPLMN S-NSSAI-1 is the first network slice, and VPLMN S-NSSAI-A is the second network slice.
  • the NSSAI that the terminal device is allowed to access includes VPLMN S-NSSAI-A.
  • the AMF removes the VPLMN S-NSSAI-A from the NSSAI that the terminal device is allowed to access, and the AMF determines that the terminal device is no longer connected to the VPLMN S -NSSAI-A.
  • the AMF determines that the NSSAI that the terminal device is allowed to access has changed according to the registration request message in S703. That is to say, if the first condition is that the NSSAI that the terminal device is allowed to access has changed, then S703 can be executed, and if the first condition is other conditions, for example, the terminal device is unregistered from the network or the terminal device is moved from the first network to For the second network, etc., it is not necessary to perform S703.
  • the registration request message it is determined that the NSSAI that the terminal device is allowed to access has changed. This is just a way for the AMF to determine that the NSSAI that the terminal device is allowed to access has changed.
  • AMF may also use other methods to determine that the NSSAI that the terminal device is allowed to access has changed. Regarding other methods, they will be introduced in other embodiments below.
  • the NSSAI that the terminal device is allowed to access changes, and the changed NSSAI that is allowed to access does not include the identifier of the first network slice, it can indicate that the terminal device is no longer accessing the first network slice, or that The terminal device does not access the first network slice. Conversely speaking, if the terminal device no longer accesses the first network slice or does not access the first network slice, the changed NSSAI of the terminal device allowed to access does not include the identifier of the first network slice.
  • the second network slice is mapped to the first network slice, which can indicate that the terminal The device no longer accesses the first network slice, or it indicates that the terminal device does not access the first network slice.
  • the changed NSSAI of the terminal device allowed to access does not include the identifier of the second network slice.
  • the NSSAI allowed by the terminal device may change.
  • the so-called change means that the changed NSSAI is different from the allowed NSSAI before the change.
  • the NSSAI allowed to access before the change includes the identifier of the first network slice, and the NSSAI allowed to access after the change does not include the identifier of the first network slice.
  • the NSSAI allowed to access before the change includes the identifier of the second network slice, and the NSSAI allowed to access after the change does not include the identifier of the second network slice, where the second network slice is mapped to the first network slice.
  • the AMF determines whether the NSSAI allowed to be accessed by the terminal device has changed according to the registration request message in S703. According to the content carried in the registration request message, there may be different determination methods, which are described below with examples.
  • the registration request message in S703 includes the UE 5GMM Core Network Capability, and the UE 5GMM Core Network Capability indicates that the terminal device does not support the NSSAA process.
  • the Allowed NSSAI (or the current Allowed NSSAI of the terminal device, or the old Allowed NSSAI of the terminal device) that the AMF sent to the terminal device during the last registration process includes the need to perform NSSAA
  • the S-NSSAI of the process then the AMF can determine that the NSSAI that the terminal device is allowed to access has changed, because at this time, the NSSAI that the terminal device is allowed to access does not include the S-NSSAI that needs to execute the NSSAA process.
  • the S-NSSAI of the first network slice is one of the S-NSSAIs included in the current current Allowed NSSAI of the terminal device that needs to perform the NSSAA process.
  • the AMF can delete the S-NSSAI (such as the S-NSSAI of the first network slice) that needs to perform the NSSAA process from the current Allowed NSSAI of the terminal device.
  • the AMF can put the deleted S-NSSAI into Rejected NSSAI.
  • the current Allowed NSSAI of the terminal device saved by the AMF includes S-NSSAI-1 and S-NSSAI-2.
  • S-NSSAI-1 needs to execute the NSSAA process
  • S-NSSAI-2 does not need to execute the NSSAA process.
  • the AMF deletes S-NSSAI-1 from the current Allowed NSSAI, and generates new Allowed NSSAI
  • new Allowed NSSAI includes S-NSSAI- 2.
  • AMF can generate Rejected NSSAI, and Rejected NSSAI includes S-NSSAI-1.
  • the AMF may also delete the authentication result of the S-NSSAI-1 executing the NSSAA procedure in the context of the terminal device.
  • the current Allowed NSSAI of the terminal device saved by the AMF includes S-NSSAI-1 and S-NSSAI-3, and both S-NSSAI-1 and S-NSSAI-3 need to execute the NSSAA process.
  • AMF deletes both S-NSSAI-1 and S-NSSAI-3 from current Allowed NSSAI, and AMF generates Rejected NSSAI, Rejected NSSAI includes S-NSSAI-1 and S-NSSAI-3. In this case, the terminal device no longer has a network slice that can be accessed.
  • the AMF may send a de-registration message to the terminal device to make the terminal device unregister from the network.
  • this processing method may cause the ongoing service interruption of the terminal device. Therefore, as another optional method, the AMF can determine whether the contracted NSSAI included in the subscription data of the terminal device includes the default S-NSSAI. The so-called default S-NSSAI does not need to perform the NSSAA process. Therefore, even if the terminal device does not support the NSSAA process, it can also access the network slice corresponding to such an S-NSSAI.
  • the contracted NSSAI of the terminal device includes S-NSSAI-2, and S-NSSAI-2 is the default S-NSSAI, then AMF can also generate new Allowed NSSAI, and new Allowed NSSAI includes S-NSSAI-2. In this way, it is possible to minimize the need to register the terminal device and improve the user experience of the terminal device.
  • the current Allowed NSSAI of the terminal device saved by the AMF includes S-NSSAI-A and S-NSSAI-B.
  • S-NSSAI-A is mapped to S-NSSAI-1
  • S-NSSAI-B is mapped to S-NSSAI-2
  • S-NSSAI-1 needs to perform the NSSAA process
  • S-NSSAI-2 does not need to perform the NSSAA process.
  • the AMF deletes the S-NSSAI-A from the current Allowed NSSAI and generates a new Allowed NSSAI.
  • the new Allowed NSSAI includes S-NSSAI- B.
  • AMF can generate Rejected NSSAI, and Rejected NSSAI includes S-NSSAI-A.
  • the AMF may also delete the authentication result of the S-NSSAI-A executing the NSSAA procedure in the context of the terminal device.
  • the registration request message in S703 includes new Requested NSSAI.
  • the AMF can determine that the NSSAI that the terminal device is allowed to access has changed.
  • the new Requested NSSAI carried in this registration process does not include the S-NSSAI that needs to perform the NSSAA process
  • the current Allowed NSSAI of the terminal device includes the S-NSSAI that needs to perform the NSSAA process
  • AMF can determine that the terminal device allows The access NSSAI has changed, because at this time, the NSSAI that the terminal device allows access does not include the S-NSSAI that needs to perform the NSSAA process.
  • the S-NSSAI of the first network slice may be one of the S-NSSAIs included in the current Allowed NSSAI of the terminal device that needs to perform the NSSAA process, and the new Requested NSSAI does not include the S-NSSAI of the first network slice.
  • AMF can determine new Allowed NSSAI based on new Requested NSSAI, where new Allowed NSSAI does not include the S-NSSAI that needs to perform the NSSAA process.
  • new Allowed NSSAI may include all or part of S-NSSAI included in new Requested NSSAI.
  • the S-NSSAI of the second network slice may be one of the S-NSSAIs included in the current Allowed NSSAI of the terminal device, the S-NSSAI of the second network slice is mapped to the S-NSSAI of the first network slice, and the first network Slicing needs to perform the NSSAA process.
  • the new Requested NSSAI does not include the S-NSSAI of the second network slice.
  • the AMF may determine the new Allowed NSSAI based on the new Requested NSSAI, where the new Allowed NSSAI does not include the S-NSSAI of the second network slice.
  • new Allowed NSSAI may include all or part of S-NSSAI included in new Requested NSSAI.
  • the AMF can slice the Authentication of the first network slice in the context of the terminal device and Authorization status is deleted.
  • the current Allowed NSSAI of the terminal device saved by the AMF includes S-NSSAI-1 and S-NSSAI-2.
  • S-NSSAI-1 needs to execute the NSSAA process, and S-NSSAI-2 does not need to execute the NSSAA process.
  • the registration request message in S703 includes new Requested NSSAI
  • new Requested NSSAI includes S-NSSAI-2 and does not include S-NSSAI-1
  • AMF generates new Allowed NSSAI according to new Requested NSSAI
  • new Allowed NSSAI includes S-NSSAI-2 .
  • the AMF may also delete the authentication result of the S-NSSAI-1 executing the NSSAA procedure in the context of the terminal device.
  • the current Allowed NSSAI of the terminal device saved by the AMF includes S-NSSAI-A and S-NSSAI-B.
  • S-NSSAI-A is mapped to S-NSSAI-1
  • S-NSSAI-B is mapped to S-NSSAI-2
  • S-NSSAI-1 needs to perform the NSSAA process
  • S-NSSAI-2 does not need to perform the NSSAA process.
  • the registration request message in S703 includes new Requested NSSAI, new Requested NSSAI includes S-NSSAI-B and does not include S-NSSAI-A, then AMF generates new Allowed NSSAI according to new Requested NSSAI, and new Allowed NSSAI includes S-NSSAI-B .
  • the AMF may also delete the authentication result of the S-NSSAI-1 executing the NSSAA procedure in the context of the terminal device.
  • the registration request message in S703 includes UE 5GMM Core Network Capability and new Requested NSSAI.
  • the AMF sent the Allowed NSSAI (or the current Allowed NSSAI of the terminal device) to the terminal device during the last registration process, or it can also be called the terminal device’s current Allowed NSSAI.
  • old Allowed NSSAI includes the S-NSSAI that needs to perform the NSSAA process, then the AMF can determine that the NSSAI that the terminal device is allowed to access has changed, because at this time, the NSSAI that the terminal device is allowed to access does not include those that need to perform the NSSAA process. S-NSSAI.
  • the S-NSSAI of the first network slice may be one of the S-NSSAIs included in the current current Allowed NSSAI of the terminal device that needs to perform the NSSAA process.
  • the AMF can determine whether the new Requested NSSAI includes the S-NSSAI that needs to perform the NSSAA process. If the new Requested NSSAI includes the S-NSSAI that needs to perform the NSSAA process, the AMF deletes these S-NSSAIs that need to perform the NSSAA process from the new Requested NSSAI, and generates a new Allowed NSSAI.
  • the new Allowed NSSAI includes, for example, those in the new Requested NSSAI that need to be executed.
  • the AMF can generate a new Allowed NSSAI according to the new Requested NSSAI, and the new Allowed NSSAI includes, for example, all or part of the S-NSSAI in the new Requested NSSAI.
  • the new Requested NSSAI included in the registration request message in S703 includes S-NSSAI-1 and S-NSSAI-2.
  • S-NSSAI-1 needs to execute the NSSAA process
  • S-NSSAI-2 does not need to execute the NSSAA process.
  • the AMF If the UE 5GMM Core Network Capability included in the registration request message in S703 indicates that the terminal device does not support the NSSAA process, the AMF generates new Allowed NSSAI according to new Requested NSSAI, and new Allowed NSSAI includes S-NSSAI-2 but not S-NSSAI-1 .
  • the AMF may also delete the authentication result of the S-NSSAI-1 executing the NSSAA procedure in the context of the terminal device.
  • the new Requested NSSAI included in the registration request message in S703 includes S-NSSAI-A and S-NSSAI-B.
  • S-NSSAI-A is mapped to S-NSSAI-1
  • S-NSSAI-B is mapped to S-NSSAI-2.
  • S-NSSAI-1 needs to execute the NSSAA process
  • S-NSSAI-2 does not need to execute the NSSAA process.
  • the AMF If the UE 5GMM Core Network Capability included in the registration request message in S703 indicates that the terminal device does not support the NSSAA process, the AMF generates new Allowed NSSAI according to new Requested NSSAI, and new Allowed NSSAI includes S-NSSAI-B but not S-NSSAI-A .
  • the AMF may also delete the authentication result of the S-NSSAI-1 executing the NSSAA procedure in the context of the terminal device.
  • the subsequent processing method of AMF can refer to the aforementioned determination method 2.
  • the AMF can be used in the context of the terminal device. Delete the Authentication and Authorization status of the first network slice.
  • the AMF may also delete the authentication result of the first network slice to execute the NSSAA process.
  • the Authentication and Authorization status of an HPLMN S-NSSAI can also be referred to as the authentication result of the S-NSSAI executing the NSSAA process, which is usually stored in the context of the terminal device stored by the AMF.
  • the purpose of retaining the authentication result of the S-NSSAI executing the NSSAA process is to allow the terminal device to access the network slice corresponding to the S-NSSAI as soon as possible next time.
  • the terminal The next time the device requests access to the network slice corresponding to the S-NSSAI, it can access it as soon as possible, and there is no need to perform the NSSAA process.
  • the context of the terminal device includes the Authentication and Authorization status corresponding to the first network slice
  • the AMF may delete the authentication result corresponding to the first network slice in the context of the terminal device. Because the terminal device is no longer connected to the first network slice, it is no longer necessary to save the authentication result of the first network slice, and the AMF can delete the authentication result of the first network slice to save the storage space of the AMF. Simplify the context of the terminal device.
  • the AMF can determine that the terminal device no longer accesses the first network slice or the second network slice according to the first condition. It should be noted that in the embodiment of the present application, the AMF may also determine that the terminal device no longer accesses the first network slice or the second network slice according to other methods, which is not limited in the embodiment of the present application. For example, the AMF may also determine that the NSSAI that the terminal device is allowed to access has changed according to the subscription information of the terminal device.
  • the slice information subscribed by the terminal device before the change includes the identity of the first network slice, and the slice subscribed by the terminal device after the change If the information does not include the identifier of the first network slice, the AMF determines that the terminal device no longer accesses the first network slice according to the slice information subscribed by the changed terminal device.
  • the AMF sends the first information to the authentication network element, and the authentication network element receives the first information from the AMF.
  • the first information may indicate that the terminal device no longer accesses the first network slice (UE no longer access to this S-NSSAI), or instruct the AMF to cancel the subscription of the first notification from the authentication network element, or instruct the terminal device to no longer access the first network slice. Enter the first network slice and instruct the AMF to cancel the first notification from the authentication network element.
  • the method for AMF to determine to send the first information to the authentication network element includes but is not limited to the following two:
  • the first type the network slice previously accessed by the terminal device is the first network slice, and when the terminal device no longer accesses the first network slice, the AMF determines to send the first information to the authentication network element.
  • the terminal device requests to access the network slice identified by HPLMN S-NSSAI-1, and HPLMN S-NSSAI-1 successfully executes the NSSAA process, that is, HPLMN S-NSSAI-1 is the first network slice.
  • HPLMN S-NSSAI-1 is the first network slice.
  • the AMF determines to send the first information to the authentication network element.
  • the second type the network slice previously accessed by the terminal device is the second network slice, and the second network slice is mapped to the first network slice.
  • the AMF determines to send to the authentication network element First information.
  • a terminal device requests to access the network slice identified by VPLMN S-NSSAI-A, VPLMN S-NSSAI-A is mapped to HPLMN S-NSSAI-1, and HPLMN S-NSSAI-1 successfully executes the NSSAA process, that is HPLMN S-NSSAI-1 is the first network slice, and VPLMN S-NSSAI-A is the second network slice.
  • the terminal device no longer accesses the VPLMN S-NSSAI-A, and the AMF determines to send the first information to the authentication network element.
  • the first information indicates that the terminal device no longer accesses the first network slice. It can also be understood that the first information may indicate that the terminal device no longer accesses the N network slices.
  • the N network slices include the first network slice, and N is An integer greater than or equal to 1.
  • the first notification may include a notification of performing re-authentication on the first network slice (or, it may also be referred to as a notification of performing authentication on the first network slice), or a notification of performing authorization revocation on the first network slice.
  • the notification of re-authentication is, for example, the notification of executing the Re-authentication and Re-authorization process
  • the notification of revocation of authorization is, for example, the notification of executing the Revocation process.
  • the first notification may include a notification of an event of performing re-authentication on the first network slice (or, it may also be referred to as an event of performing authentication on the first network slice), or an event of performing deauthorization on the first network slice announcement of.
  • the notification of re-authentication is, for example, the notification of an event that executes the Re-authentication and Re-authorization process
  • the notification of revocation of authorization is, for example, the notification of an event that executes the Revocation process.
  • the authentication network element after canceling the subscription, the authentication network element no longer sends a request message for triggering the execution of Re-authentication and Re-authorization on the first network slice to the AMF, or the authentication network element no longer sends a request message to the AMF.
  • the first information indicates that AMF cancels subscribing to the first notification from the authentication network element. It can also be described as that the AMF instructs the authentication network element to stop performing re-authentication (or authentication) on the first network slice, or to stop Network slicing performs de-authorization.
  • AMF instructs the authentication network element to stop performing re-authentication (or authentication) on the first network slice, that is, instructs the authentication network element to stop performing the Re-authentication and Re-authorization process on the first network slice;
  • AMF instructs the authentication network element Stop performing the revocation authorization on the first network slice, that is, instruct the authentication network element to stop performing the Revocation process on the first network slice.
  • the meaning of the first information indicating that the AMF cancels subscribing to the authentication network element for the notification to perform re-authentication on the first network slice is the same as the first information indicating that the authentication network element will no longer send to the AMF for triggering
  • the meaning of the request message for performing Re-authentication and Re-authorization for the first network slice is the same, or the first information instructs the AMF to cancel the subscription from the authentication network element to the notification to cancel the authorization for the first network slice.
  • the meaning is the same as the first information Instructing the authentication network element to no longer send a request message for triggering the execution of the Revocation of the first network slice to the AMF has the same meaning.
  • the AMF may send the first information to the authentication network element to indicate the terminal device no longer accesses through the first information
  • the AMF may send the first information to the authentication network element to indicate the terminal device no longer accesses through the first information
  • AAA-S the authentication network element
  • AMF sends first information to AAA-S
  • AMF sends first information to AUSF
  • AUSF forwards the first information to AAA-S.
  • AAA-P the authentication network element
  • AMF sending first information to AAA-S can be understood as AMF sending first information to AUSF
  • AUSF forwarding the first information to AAA-P AAA-P forwards the first information to AAA-S.
  • Fig. 7 takes as an example the authentication network element is AAA-S and AAA-S and AUSF can communicate directly, S705 may include S705a and S705b. Among them, S705a and S705b are not shown in FIG. 7.
  • the AMF calls the servicing operation Nausf_NSSAA_Notify to send a message to the AUSF, or the AMF calls the servicing operation Nausf_NSSAA_Unsubscribe to send a message to the AUSF, and the AUSF receives the message from the AMF.
  • the message is called the first message, and the first message may include the first information.
  • the first message may also include the identification of the terminal device (for example, GPSI), the address information of the AAA-S, and the S-NSSAI corresponding to the first network slice.
  • the address information of the AAA-S included in the first message may be determined by the AMF according to the subscription information of the terminal device, where the subscription information of the terminal device includes the address information of the AAA-S.
  • the AMF determines the S-NSSAI corresponding to the first network slice contained in the first message, and there are two implementation methods:
  • the AMF determines that the terminal device no longer accesses the first network slice, and the first message includes the S-NSSAI corresponding to the first network slice.
  • the first message may include multiple S-NSSAIs, and each of the multiple S-NSSAIs Each S-NSSAI identifies a first network slice.
  • the AMF determines that the terminal device no longer accesses the second network slice, where there is a mapping relationship between the second network slice and the first network slice, and the first message includes the S-NSSAI corresponding to the first network slice.
  • the first message includes multiple S-NSSAIs, and each of the multiple S-NSSAIs S-NSSAI identifies a first network slice.
  • AUSF converts the service operation Nausf_NSSAA_Notify or Nausf_NSSAA_Unsubscribe to protocol conversion, and forwards the first message to AAA-S, and AAA-S receives the first message from AUSF.
  • AUSF can convert the servicing operation Nausf_NSSAA_Notify or Nausf_NSSAA_Unsubscribe into a Diameter protocol, such as a Session Termination Request (Session Termination Request) message, which is not limited in this embodiment.
  • the AAA-S After receiving the first information, the AAA-S does not subsequently initiate a Re-authentication and Re-authorization process or a Revocation process for the S-NSSAI, so as to save core network signaling.
  • the AAA-S may also delete the stored authentication result of the NSSAA procedure performed by the first network slice.
  • AAA-S may be an authentication result of executing the NSSAA procedure by deleting the N network slices indicated by the stored first information, and the N network slices include the first network slice.
  • the authentication result of the NSSAA process executed by a network slice refers to the authentication result of the NSSAA process executed by the S-NSSAI of the network slice.
  • AAA-S no longer initiates a Re-authentication and Re-authorization process or a Revocation process for the N S-NSSAIs in order to save core network signaling.
  • S705 may include S705a' and S705b'.
  • the AMF calls the servicing operation Nausf_NSSAA_Notify to send a message to the AUSF, or the AMF calls the servicing operation Nausf_NSSAA_Unsubscribe to send a message to the AUSF, and the AUSF receives the message from the AMF.
  • the message is called the first message, and the first message may include the first information.
  • the first message may also include the identification of the terminal device (for example, GPSI) and the S-NSSAI corresponding to the first network slice.
  • the AMF determines the S-NSSAI corresponding to the first network slice contained in the first message, and there are two implementation methods:
  • the AMF determines that the terminal device no longer accesses the first network slice, and the first message includes the S-NSSAI corresponding to the first network slice.
  • the first message includes multiple S-NSSAIs, and each of the multiple S-NSSAIs S-NSSAI identifies a first network slice.
  • the AMF determines that the terminal device no longer accesses the second network slice, where there is a mapping relationship between the second network slice and the first network slice, and the first message includes the S-NSSAI corresponding to the first network slice.
  • the first message includes multiple S-NSSAIs, and each of the multiple S-NSSAIs S-NSSAI identifies a first network slice.
  • the AUSF After the AUSF receives the first information, it does not subsequently initiate a Re-authentication and Re-authorization process or a Revocation process for the S-NSSAI, so as to save core network signaling. For example, when AUSF subsequently receives a Re-authentication and Re-authorization request message or a Revocation request message sent by AAA-S, AUSF will no longer forward the message to the AMF network element.
  • AAA-S AAA-S only needs to receive the first network slice from AMF With one message, it can be determined that the terminal device no longer accesses the first network slice or that AMF cancels subscribing to the first notification from AAA-S, then AAA-S will not initiate the Re-authentication and Re-authorization process again for the first network slice. Or the Revocation process can further save core network signaling and simplify the implementation of AAA-S.
  • FIG. 8 is a flowchart of this method.
  • the AMF involved in the embodiment shown in FIG. 8 may also be referred to as the first AMF or the first mobility management network element.
  • the AMF initiates the NSSAA process for each S-NSSAI that needs to execute the NSSAA process.
  • AMF learns that the authentication result of a certain network slice executing the NSSAA process is successful, it allows the terminal device to access the network slice, and AMF generates a new Allowed NSSAI for the terminal device, where the new Allowed NSSAI includes the successful execution of the NSSAA process The ID of the network slice.
  • the AMF saves the Authentication and Authorization status of the S-NSSAI in the context of the terminal device.
  • the AAA-S saves the corresponding relationship between the identification of the terminal device and the S-NSSAI that successfully executes the NSSAA process.
  • the identification of the terminal device is, for example, GPSI.
  • the AMF can add the S-NSSAI of the first network slice to the new Allowed NSSAI, and the AMF can save the authentication of the first network slice in the context of the terminal device and Authorization status.
  • the AAA-S can save the corresponding relationship between the identification of the terminal device and the S-NSSAI of the first network slice. That is, in this embodiment of the present application, the first network slice may be a network slice that successfully executes the NSSAA process.
  • the new Allowed NSSAI sent by the AMF to the terminal device includes the S-NSSAI corresponding to the first network slice, and AAA-S also saves the terminal device's identity and the first Correspondence between S-NSSAI of network slicing.
  • the AMF determines that the first network slice has successfully executed the NSSAA process, and the second network slice is mapped to the first network slice, the AMF can add the S-NSSAI of the second network slice to the new Allowed NSSAI, and the AMF can be in the new Allowed NSSAI.
  • the Authentication and Authorization status of the first network slice is stored in the context of the terminal device.
  • the AAA-S can save the corresponding relationship between the identification of the terminal device and the S-NSSAI of the first network slice. That is, in this embodiment of the present application, the first network slice may be a network slice that successfully executes the NSSAA process.
  • the new Allowed NSSAI sent by the AMF to the terminal device contains the S-NSSAI corresponding to the second network slice, and AAA-S also saves the terminal device's identity and the first Correspondence between S-NSSAI of network slicing.
  • the AAA-S saves the corresponding relationship between the identification of the terminal device and the S-NSSAI that successfully executes the NSSAA process.
  • the identification of the terminal device is, for example, GPSI.
  • the authentication network element sends a subscription request message to the AMF through AUSF, and the AMF receives the subscription request message from the authentication network element.
  • AAA-S cannot directly communicate with AMF and needs to be transferred through AUSF.
  • AAA-P needs to be transferred between AAA-S and AUSF.
  • FIG. 8 takes as an example the authentication network element is AAA-S and there is no need to pass AAA-P transfer between AAA-S and AUSF.
  • S803 may include S803a to S803d, and S803a to S803d are not shown in FIG. 8.
  • AAA-S sends a subscription request message to AUSF, and AUSF receives the subscription request message from AAA-S.
  • the subscription request message is, for example, an AAA protocol subscription request (AAA protocol subscription request) message.
  • the subscription request message may include the identity of the terminal device, including the identities of N network slices (for example, N S-NSSAIs of N network slices, where the network slices correspond to S-NSSAI one-to-one), and include subscription event information,
  • the subscription event information is an event that the terminal device no longer accesses each of the N network slices.
  • N is an integer greater than or equal to 1. That is, after the AMF receives the subscription request message, if it is determined that the terminal device no longer accesses any of the N network slices, the AMF can notify the terminal device of the event that the terminal device no longer accesses the network slice based on the subscription request message AAA-S.
  • the network slice included in the subscription request message is referred to as the first network slice in the embodiment of the present application. That is, the subscription request message subscribes to the event that the terminal device no longer accesses the first network slice (UE no longer access to this S-NSSAI).
  • the N S-NSSAIs may be all or part of the S-NSSAIs stored in the AAA-S that have a corresponding relationship with the terminal device. If the number of S-NSSAIs that AAA-S needs to subscribe to is greater than 1, then AAA-S can send all S-NSSAIs that need to be subscribed through one subscription request message, or AAA-S can also send multiple subscription request messages S-NSSAIs that need to be subscribed, for example, each subscription request message may include one or more S-NSSAIs.
  • AUSF calls the servicing operation Nudm_UECM_Get to send a query message to UDM, and UDM receives the query message from AUSF.
  • the query message is used to query the identity of the AMF serving the terminal device.
  • Nudm_UECM_Get includes the identification of the terminal device, such as the GPSI of the terminal device.
  • the UDM sends the AMF identifier to the AUSF through the servicing operation Nudm_UECM_Get response, and the AUSF receives the AMF identifier from the UDM.
  • S803b and S803c are optional steps.
  • AUSF performs protocol conversion on the subscription request message from AAA-S, and calls the AMF service operation Namf_EventExposure_Subscribe, and sends the content included in the subscription request message to AMF, and AMF receives the subscription request message from AMF information.
  • the message transmitted by calling the service operation Namf_EventExposure_Subscribe is represented as an event open subscription message.
  • the event open subscription request message includes the identifier of the terminal device, the identifiers of N network slices (for example, N S-NSSAIs), and includes subscription event information.
  • N network slices for example, N S-NSSAIs
  • the event open subscription request message includes the identifier of the terminal device, the identifiers of N network slices (for example, N S-NSSAIs), and includes subscription event information.
  • AAA-S sending the subscription request message to AMF
  • AMF receiving the subscription request message from AAA-S.
  • the AMF invokes the servicing operation Namf_EventExposure_Subscribe ACK to send a subscription response message to AUSF, and AUSF receives the subscription response message from AMF.
  • the subscription response message indicates that the subscription is successful.
  • the AMF may also save the subscription event information included in the subscription request message.
  • AUSF converts the subscription response from AMF to the protocol, and sends a subscription response message to AAA-S, and AAA-S receives the subscription response message from AUSF.
  • the subscription response message is used to indicate that the subscription is successful, and the AAA-S can determine that the subscription is successful.
  • the AMF determines according to the first condition that the terminal device no longer accesses the first network slice or the second network slice.
  • the first condition may include multiple types.
  • a first condition is that the terminal device deregisters from the AMF; for example, another first condition is that the terminal device moves from the first network to the second network; for example, another first condition is that the terminal device moves from the first network to the second network.
  • One condition is that the NSSAI that the terminal device allows to access changes, and so on.
  • the AMF determines that the NSSAI allowed by the terminal device has changed.
  • a possible way to determine this is before the AAA-S sends the second message to the AMF, or in other words Before the AAA-S initiates the Re-authentication and Re-authorization process or the Revocation process, the terminal device initiates a registration request message to the AMF, and the AMF can determine that the NSSAI that the terminal device is allowed to access has changed according to the registration request message. If this is the case, S807 may be included before S806, and the terminal device initiates a registration process. It is shown in FIG. 8 that the terminal device sends a registration request message to the AMF, and the AMF receives the registration request message from the terminal device.
  • step S806 For more content of step S806, please refer to the description of step S704 in FIG. 7, which will not be repeated here.
  • the AMF sends the first information to the AAA-S, and the AAA-S receives the first information from the AMF.
  • the first information may indicate that the terminal device no longer accesses the first network slice (UE no longer access to this S-NSSAI).
  • the first information indicates that the terminal device no longer accesses the first network slice. It can also be understood that the first information may indicate that the terminal device no longer accesses the N network slices.
  • the N network slices include the first network slice, and N is An integer greater than or equal to 1.
  • the method for AMF to determine to send the first information to AAA-S may include but is not limited to the following two:
  • the first type the network slice previously accessed by the terminal device is the first network slice, and when the terminal device no longer accesses the first network slice, the AMF determines to send the first information to the AAA-S.
  • the terminal device requests to access the network slice identified by HPLMN S-NSSAI-1 and HPLMN S-NSSAI-1 successfully executes the NSSAA process, that is, HPLMN S-NSSAI-1 is the first network slice.
  • the AMF determines to send the first information to the AAA-S.
  • the second type the network slice previously accessed by the terminal device is the second network slice, and the second network slice is mapped to the first network slice.
  • the AMF determines to send to AAA-S First information.
  • the terminal device requests to access the network slice identified by VPLMN S-NSSAI-A, VPLMN S-NSSAI-A is mapped to HPLMN S-NSSAI-1, and HPLMN S-NSSAI-1 successfully executes the NSSAA process, that is, HPLMN S-NSSAI-1 is the first network slice, and VPLMN S-NSSAI-A is the second network slice.
  • the terminal device no longer accesses the VPLMN S-NSSAI-A, and the AMF determines to send the first information to the AAA-S.
  • AMF will notify AAA-S according to the subscription request message.
  • the first network slice is one of the N network slices.
  • the AMF determines that the terminal device no longer accesses the first network slice or the second network slice, and the AMF may send the first information to the AAA-S according to the subscription request message.
  • AMF can inform AAA-S that the terminal device no longer accesses the first network slice, that is, through the first network slice.
  • a message indicates that the terminal device no longer accesses the first network slice, so that AAA-S can make it clear that there is no need to initiate a Re-authentication and Re-authorization process or Revocation process for the first network slice for the terminal device in the future, thereby saving The signaling overhead of the core network.
  • S808 may specifically include S808a and S808b, and S808a and S808b are not shown in FIG. 8.
  • the AMF calls the servicing operation Namf_EventExposure_Notify to send the first message to the AUSF, and the AUSF receives the first message from the AMF.
  • the first message may include first information, and the first information indicates that the terminal device no longer accesses the first network slice.
  • the first message may also include the identification of the terminal device (for example, GPSI), the address information of the AAA-S, and the S-NSSAI corresponding to the first network slice.
  • the address information of the AAA-S included in the first message may be determined by the AMF according to the subscription information of the terminal device, where the subscription information of the terminal device includes the address information of the AAA-S.
  • the AMF determines the S-NSSAI corresponding to the first network slice contained in the first message, and there are two implementation methods:
  • the AMF determines that the terminal device no longer accesses the first network slice, and the first message includes the S-NSSAI corresponding to the first network slice.
  • the first message includes multiple S-NSSAIs, and each of the multiple S-NSSAIs S-NSSAI identifies a first network slice.
  • the AMF determines that the terminal device no longer accesses the second network slice, where there is a mapping relationship between the second network slice and the first network slice, and the first message includes the S-NSSAI corresponding to the first network slice.
  • the first message includes multiple S-NSSAIs, and each of the multiple S-NSSAIs S-NSSAI identifies a first network slice.
  • AUSF converts the service operation Namf_EventExposure_Notify to the protocol, and forwards the first message to AAA-S, and AAA-S receives the first message from AUSF.
  • AUSF can convert the servicing operation Namf_EventExposure_Notify into a Diameter protocol, such as a Session Termination Request (Session Termination Request) message, which is not limited in this embodiment.
  • the AAA-S After receiving the first information, the AAA-S does not subsequently initiate a Re-authentication and Re-authorization process or a Revocation process for the S-NSSAI, so as to save core network signaling.
  • the AAA-S may also delete the stored authentication result of the NSSAA procedure performed by the first network slice.
  • AAA-S may be an authentication result of executing the NSSAA procedure by deleting the N network slices indicated by the stored first information, and the N network slices include the first network slice.
  • the authentication result of the NSSAA process executed by a network slice refers to the authentication result of the NSSAA process executed by the S-NSSAI of the network slice.
  • AAA-S no longer initiates a Re-authentication and Re-authorization process or a Revocation process for the N S-NSSAIs in order to save core network signaling.
  • S803 may include S803a' to S803g'.
  • AUSF calls the servicing operation Nudm_UECM_Get to send a query message to UDM, UDM receives the query message from AUSF, and the query message is used to query the identity of the AMF serving the terminal device.
  • the query message sent through Nudm_UECM_Get includes the identification of the terminal device, such as the GPSI of the terminal device.
  • the UDM sends the AMF identifier to the AUSF through the servicing operation Nudm_UECM_Get response, and the AUSF receives the AMF identifier from the UDM.
  • the subscription request message may include the identification of the terminal device and the identification of N network slices (for example, N S-NSSAIs of N network slices, where the network slice is the same as the S-NSSAI. One correspondence), and includes subscription event information, which is an event that the terminal device no longer accesses each of the N network slices.
  • N is an integer greater than or equal to 1. That is, after the AMF receives the subscription request message, if it is determined that the terminal device no longer accesses any of the N network slices, the AMF can notify the terminal device of the event that the terminal device no longer accesses the network slice based on the subscription request message AUSF.
  • AUSF calls AMF's servicing operation Namf_EventExposure_Subscribe, and sends the content included in the subscription request message to AMF, and AMF receives information from AUSF.
  • the AMF calls the servicing operation Namf_EventExposure_Subscribe ACK to send a subscription response message to AUSF, and AUSF receives the subscription response message from AMF.
  • the subscription response message indicates that the subscription is successful.
  • the AMF may also save the subscription event information included in the subscription request message.
  • the AMF determines according to the first condition that the terminal device no longer accesses the first network slice or the second network slice.
  • the AMF calls the servicing operation Namf_EventExposure_Notify to send the first message to the AUSF, and the AUSF receives the first message from the AMF.
  • the first message may include first information, and the first information indicates that the terminal device no longer accesses the first network slice.
  • the first message may also include the identification of the terminal device (for example, GPSI) and the S-NSSAI corresponding to the first network slice.
  • the AMF determines the S-NSSAI corresponding to the first network slice contained in the first message, and there are two implementation methods:
  • the AMF determines that the terminal device no longer accesses the first network slice, and the first message contains the S-NSSAI corresponding to the first network slice.
  • the first message includes multiple S-NSSAIs, and each of the multiple S-NSSAIs S-NSSAI identifies a first network slice.
  • the AMF determines that the terminal device no longer accesses the second network slice, where there is a mapping relationship between the second network slice and the first network slice, and the first message includes the S-NSSAI corresponding to the first network slice.
  • the first message includes multiple S-NSSAIs, and each of the multiple S-NSSAIs S-NSSAI identifies a first network slice.
  • AUSF After S803g', AUSF receives the first information, it does not subsequently initiate a Re-authentication and Re-authorization process or a Revocation process for the S-NSSAI, so as to save core network signaling. For example, when AUSF subsequently receives a Re-authentication and Re-authorization request message or a Revocation request message sent by AAA-S, AUSF will no longer forward the message to the AMF network element.
  • the authentication network element such as AAA-S
  • AAA-S may initiate a subscription in advance to subscribe to the event that the terminal device no longer accesses the first network slice.
  • the AMF determines that the terminal device no longer accesses the first network slice, the AMF can notify the AAA-S according to the subscription, which is equivalent to the AMF operating according to the subscription process.
  • the authentication network element such as AAA-S
  • the AMF will subscribe to the AMF, and the AMF will notify the AAA-S of the event that the terminal device no longer accesses the subscribed network slice according to the subscription.
  • the embodiment of this application also provides a third communication method.
  • AMF can also wait for the authentication network element to initiate a Re-authentication and Re-authorization process or a revocation (Revocation) process. At this time, the authentication network element is then notified of the event that the terminal device no longer accesses the network slice involved in the process.
  • the Revocation process for a network slice (or the Revocation process for an S-NSSAI) is to revoke the terminal device's permission to access the network slice, or it can also be understood as the Revocation process to deny terminal device access The network slice.
  • Figure 9 is a flowchart of the third communication method.
  • the AMF initiates the NSSAA process for each S-NSSAI that needs to execute the NSSAA process.
  • step S901 reference may be made to the description of step S801 in FIG. 8, which will not be repeated here.
  • the AAA-S saves the corresponding relationship between the identification of the terminal device and the S-NSSAI that successfully executes the NSSAA process.
  • the identification of the terminal device is, for example, GPSI.
  • AAA-S sends a second message to AMF, and AMF receives the second message from AAA-S.
  • the second message carries the S-NSSAI.
  • the network slice corresponding to the S-NSSAI carried in the second message is referred to as the first network slice in the embodiment of the present application.
  • the first network slice may be a network slice that successfully executes the NSSAA process.
  • the new Allowed NSSAI sent by the AMF to the terminal device includes the S-NSSAI corresponding to the first network slice or the S-NSSAI corresponding to the second network slice, where the second network slice Mapping with the first network slice, and AAA-S also saves the corresponding relationship between the identification of the terminal device and the S-NSSAI of the first network slice.
  • the second message can be used to initiate a Re-authentication and Re-authorization process for the first network slice, or used to initiate a Revocation process for the first network slice.
  • the second message is used to initiate the Re-authentication and Re-authorization process for the first network slice, it can be considered that the second message is used to perform the NSSAA process again on the first network slice (or described as the second message Used to execute the NSSAA process on the first network slice).
  • the second message is used to initiate the Revocation process for the first network slice, it can be considered that the second message is used to revoke the authorization of the terminal device to access the first network slice, or it can be understood as denying the terminal device to access the first network. slice.
  • AAA-S cannot directly communicate with AMF and needs to be transferred through AUSF.
  • AAA-P needs to be transferred between AAA-S and AUSF.
  • the AAA-P transfer between AAA-S and AUSF is not required as an example.
  • S903 may include S903a to S903d, and S903a to S903b are not shown in FIG. 9.
  • AAA-S sends a second message to AUSF, and AUSF receives the second message from AAA-S. If the second message is used to perform the NSSAA process again on the first network slice, the second message is, for example, a re-authentication request (Re-Auth Request) message. Or, if the second message is used to deny the terminal device to access the first network slice, the second message is, for example, a revocation request (Revocation Request) message.
  • Re-Auth Request re-authentication request
  • Revocation Request revocation request
  • the second message may include the identification of the terminal device, such as the GPSI of the terminal device, may also include the identification of the first network slice, such as the S-NSSAI of the first network slice, and may also include notification information.
  • the notification indicated by the notification information is the first notification, and the first notification is, for example, a notification to perform NSSAA again on the first network slice (or the first notification is described as an NSSAA notification, or described as performing re-authentication on the first network slice. Or described as a notification for performing authentication on the first network slice), or, for example, the first notification is a notification for denying the terminal device to access the first network slice (or the first notification is described as a Revocation notification, or described as Perform a notification of revoking authorization for the first network slice). It indicates that the second message is for initiating a Re-authentication and Re-authorization process or a Revocation process for the first network slice to the terminal device.
  • the first notification information may also be notification information of a first event.
  • the first event is, for example, an event of re-executing NSSAA on the first network slice (or the first event is described as an NSSAA event, or the first event is described as an NSSAA event).
  • An event in which a network slice performs re-authentication, or is described as an event in which authentication is performed on the first network slice), or the first event is, for example, an event in which a terminal device is denied access to the first network slice (or the first event is described as It is a Revocation event, or is described as an event that revocation of authorization is performed on the first network slice).
  • AUSF calls the servicing operation Nudm_UECM_Get to send a query message to UDM, and UDM receives the query message from AUSF.
  • the query message is used to query the identity of the AMF serving the terminal device, and the UDM receives the query message from the AUSF.
  • Nudm_UECM_Get includes the identification of the terminal device, such as the GPSI of the terminal device.
  • the UDM sends the AMF identifier to the AUSF through the servicing operation Nudm_UECM_Get response, and the AUSF receives the AMF identifier from the UDM.
  • S903b and S903c are optional steps.
  • AUSF performs protocol conversion on the second message from AAA-S, and calls the servicing operation Nausf_NSSAA_Notify of AUSF, and sends the content included in the second message to AMF, and AMF receives the information from AUSF.
  • the second message may include the identification of the terminal device, such as the GPSI of the terminal device, and may also include the identification of the first network slice, such as the S-NSSAI of the first network slice, and may also include notification information.
  • the AUSF may send the identification of the terminal device, the identification of the first network slice and the notification information included in the second message to the AMF.
  • the AMF determines according to the first condition that the terminal device no longer accesses the first network slice or the second network slice.
  • the first condition may include multiple types.
  • a first condition is that the terminal device deregisters from the AMF; for example, another first condition is that the terminal device moves from the first network to the second network; for example, another first condition is that the terminal device moves from the first network to the second network.
  • One condition is that the NSSAI that the terminal device allows to access changes, and so on.
  • the AMF determines that the NSSAI allowed by the terminal device has changed.
  • a possible way to determine this is before the AAA-S sends the second message to the AMF, or in other words Before the AAA-S initiates the Re-authentication and Re-authorization process or the Revocation process, the terminal device initiates a registration request message to the AMF, and the AMF can determine that the NSSAI that the terminal device is allowed to access has changed according to the registration request message. If this is the case, S905 may be included before S903, and the terminal device initiates a registration process. As shown in FIG. 9, the terminal device sends a registration request message to the AMF, and the AMF receives the registration request message from the terminal device.
  • step S904 For more content of step S904, please refer to the description of step S704 in FIG. 7, which will not be repeated here.
  • the AMF sends the first information to the authentication network element, and the authentication network element receives the first information from the AMF.
  • the first information includes, for example, a failure indication, and the failure indication is used to indicate that the Re-authentication and Re-authorization process of the first network slice failed, or that the Revocation process of the first network slice failed.
  • the AMF sends the first information to the authentication network element.
  • the first information is used to indicate that the terminal device no longer accesses the first network slice (UE no longer access to this S-NSSAI).
  • the first information may include a failure indication, and the failure indication is, for example, a failure reason value for the failure of the Re-authentication and Re-authorization process of the first network slice, or a failure reason value for the failure of the Revocation process of the first network slice. Then it is equivalent to the first information indicating that the terminal device no longer accesses the first network slice.
  • the AMF sends the first information to the authentication network element.
  • the first information is used to instruct the AMF to cancel the first notification from the authentication network element.
  • the method for AMF to determine to send the first information to the authentication network element may include but is not limited to the following two:
  • the first type the network slice previously accessed by the terminal device is the first network slice, and when the terminal device no longer accesses the first network slice, the AMF determines to send the first information to the authentication network element.
  • the terminal device requests to access the network slice identified by HPLMN S-NSSAI-1 and HPLMN S-NSSAI-1 successfully executes the NSSAA process, that is, HPLMN S-NSSAI-1 is the first network slice.
  • the AMF determines to send the first information to the AAA-S.
  • the second type the network slice previously accessed by the terminal device is the second network slice, and the second network slice is mapped to the first network slice.
  • the AMF determines to send to the authentication network element First information.
  • a terminal device requests to access the network slice identified by VPLMN S-NSSAI-A, VPLMN S-NSSAI-A is mapped to HPLMN S-NSSAI-1, and HPLMN S-NSSAI-1 successfully executes the NSSAA process, that is HPLMN S-NSSAI-1 is the first network slice, and VPLMN S-NSSAI-A is the second network slice.
  • the terminal device no longer accesses the VPLMN S-NSSAI-A, and the AMF determines to send the first information to the authentication network element.
  • the first information indicates that the terminal device no longer accesses the first network slice. It can also be understood that the first information may indicate that the terminal device no longer accesses the N network slices.
  • the N network slices include the first network slice, and N is An integer greater than or equal to 1.
  • the first notification may include a notification of performing re-authentication on the first network slice (or, it may also be referred to as a notification of performing authentication on the first network slice), or a notification of performing authorization revocation on the first network slice.
  • the notification of re-authentication is, for example, the notification of executing the Re-authentication and Re-authorization process
  • the notification of revocation of authorization is, for example, the notification of executing the Revocation process.
  • the first notification may include a notification of an event of performing re-authentication on the first network slice (or, it may also be referred to as an event of performing authentication on the first network slice), or an event of performing deauthorization on the first network slice announcement of.
  • the notification of re-authentication is, for example, the notification of an event that executes the Re-authentication and Re-authorization process
  • the notification of re-authorization is, for example, the notification of an event that executes the Revocation process.
  • the authentication network element after canceling the subscription, the authentication network element no longer sends a request message for triggering the execution of Re-authentication and Re-authorization on the first network slice to the AMF, or the authentication network element no longer sends a request message to the AMF.
  • the first information indicates that AMF cancels subscribing to the first notification from the authentication network element. It can also be described as that the AMF instructs the authentication network element to stop performing re-authentication (or authentication) on the first network slice, or to stop Network slicing performs de-authorization.
  • AMF instructs the authentication network element to stop performing re-authentication (or authentication) on the first network slice, that is, instructs the authentication network element to stop performing the Re-authentication and Re-authorization process on the first network slice;
  • AMF instructs the authentication network element Stop performing the revocation authorization on the first network slice, that is, instruct the authentication network element to stop performing the Revocation process on the first network slice.
  • the meaning of the first information indicating that the AMF cancels subscribing to the authentication network element for the notification to perform re-authentication on the first network slice is the same as the first information indicating that the authentication network element will no longer send to the AMF for triggering
  • the meaning of the request message for performing Re-authentication and Re-authorization for the first network slice is the same, or the first information instructs the AMF to cancel the subscription from the authentication network element to the notification to cancel the authorization for the first network slice.
  • the meaning is the same as the first information Instructing the authentication network element to no longer send a request message for triggering the execution of the Revocation of the first network slice to the AMF has the same meaning.
  • the AMF can send a failure indication to the authentication network element, so that the authentication network element can be clear, and the terminal device does not need to be Initiate the Re-authentication and Re-authorization process or Revocation process for the first network slice, so as to save the signaling overhead of the core network.
  • S906 may specifically include S906a and S906b, and S906a and S906b are not shown in FIG. 9.
  • the AMF invokes the servicing operation Nausf_NSSAA_Notify response to send the first message to the AUSF, and the AUSF receives the first message from the AMF.
  • the first message may include first information.
  • the first information includes, for example, a failure indication, and the failure indication is used to indicate that the Re-authentication and Re-authorization process of the first network slice failed, or that the Revocation process of the first network slice failed.
  • the first message may also include the identification of the terminal device (for example, GPSI), the address information of the AAA-S, and the S-NSSAI corresponding to the first network slice.
  • the address information of the AAA-S included in the first message may be determined by the AMF according to the subscription information of the terminal device, where the subscription information of the terminal device includes the address information of the AAA-S.
  • the AMF determines the S-NSSAI corresponding to the first network slice contained in the first message, and there are two implementation methods:
  • the AMF determines that the terminal device no longer accesses the first network slice, and the first message includes the S-NSSAI corresponding to the first network slice.
  • the first message includes multiple S-NSSAIs, and each of the multiple S-NSSAIs S-NSSAI identifies a first network slice.
  • the AMF determines that the terminal device no longer accesses the second network slice, where there is a mapping relationship between the second network slice and the first network slice, and the first message includes the S-NSSAI corresponding to the first network slice.
  • the first message includes multiple S-NSSAIs, and each of the multiple S-NSSAIs S-NSSAI identifies a first network slice.
  • AUSF converts the service operation Nausf_NSSAA_Notify response to protocol conversion, and forwards the first message to AAA-S, and AAA-S receives the first message from AUSF.
  • AUSF can convert the servicing operation Nausf_NSSAA_Notify response into a Diameter protocol, such as a Session Termination Request message, which is not limited in this embodiment.
  • the AAA-S After S907, the AAA-S receives the first information, it does not subsequently initiate a Re-authentication and Re-authorization process or a Revocation process for the S-NSSAI, so as to save core network signaling.
  • the AAA-S may also delete the stored authentication result of the NSSAA procedure performed by the first network slice.
  • the authentication result of a network slice that executes the NSSAA process refers to the authentication result of the S-NSSAI of the network slice that executes the NSSAA process.
  • AAA-S no longer initiates a Re-authentication and Re-authorization process or a Revocation process for the first S-NSSAI in order to save core network signaling.
  • S906 may include S906a' and S906b'.
  • the AMF invokes the servicing operation Nausf_NSSAA_Notify response to send the first message to the AUSF, and the AUSF receives the first message from the AMF.
  • the first message may include first information.
  • the first information includes, for example, a failure indication, and the failure indication is used to indicate that the Re-authentication and Re-authorization process of the first network slice failed, or that the Revocation process of the first network slice failed.
  • the first message may also include the identification of the terminal device (for example, GPSI), the address information of the AAA-S, and the S-NSSAI corresponding to the first network slice.
  • the AMF determines the S-NSSAI corresponding to the first network slice contained in the first message, and there are two implementation methods:
  • the AMF determines that the terminal device no longer accesses the first network slice, and the first message includes the S-NSSAI corresponding to the first network slice.
  • the first message includes multiple S-NSSAIs, and each of the multiple S-NSSAIs S-NSSAI identifies a first network slice.
  • the AMF determines that the terminal device no longer accesses the second network slice, where there is a mapping relationship between the second network slice and the first network slice, and the first message includes the S-NSSAI corresponding to the first network slice.
  • the first message includes multiple S-NSSAIs, and each of the multiple S-NSSAIs S-NSSAI identifies a first network slice.
  • the AUSF After the AUSF receives the first information, it does not subsequently initiate a Re-authentication and Re-authorization process or a Revocation process for the S-NSSAI, so as to save core network signaling. For example, when AUSF subsequently receives a Re-authentication and Re-authorization request message or a Revocation request message sent by AAA-S, AUSF will no longer forward the message to the AMF network element.
  • the authentication network element such as AAA-S
  • AAA-S does not need to initiate a subscription in advance
  • AMF does not need to actively notify AAA-S, but can initiate Re-authentication and Re-authentication for the first network slice in AAA-S.
  • the AAA-S is notified during the authorization process or the Revocation process, and the terminal device no longer accesses the first network slice.
  • AMF does not need to increase the step of proactively notifying AAA-S
  • AAA-S does not need to increase the subscription step, which simplifies the implementation of both network elements.
  • Type A AMF a type of AMF
  • Type B AMF a type of AMF
  • the terminal device moves.
  • the Type A AMF determines a new AMF for the terminal device without considering whether the new AMF supports the NSSAA process.
  • the terminal device will inevitably be unable to access those network slices that need to perform the NSSAA process, which may affect the service execution of the terminal device .
  • the embodiment of the present application provides a fourth communication method.
  • the Type A AMF determines a new AMF for the terminal device
  • the Type A AMF can be determined as much as possible, so that the terminal device can continue to access the network slice that can support the NSSAA process, so that the terminal device's business can continue .
  • Figure 10 is a flowchart of this method.
  • the embodiment shown in FIG. 10 involves two mobility management network elements and two access network network elements.
  • the two mobility management network elements are respectively a first mobility management network element and a second mobility management network element
  • the two access network network elements are respectively a first access network network element and a second access network network element.
  • the second mobility management network element is the mobility management network element that the terminal device accesses before the cell handover, and is also called the old-side mobility management network element (or called the source mobility management network element)
  • the first access network network element is the access network network element that the terminal device accesses before cell handover, and is also referred to as the old-side access network network element (or referred to as the source access network network element).
  • the first mobility management network element is a mobility management network element that the terminal device accesses after cell handover, and is also referred to as a new-side mobility management network element (or referred to as a target (target) mobility management network element).
  • the second access network network element is the access network network element that the terminal device accesses after cell handover, and is also referred to as the new side access network network element (or referred to as the target access network network element).
  • the mobility management network element is AMF and the access network network element is RAN as an example.
  • the second mobility management network element is referred to as the old-side AMF
  • the first mobility The management network element is referred to as the new-side AMF
  • the first access network element is referred to as the old-side RAN
  • the second access network element is referred to as the new-side RAN.
  • the terminal device initiates a registration process. As shown in FIG. 10, the terminal device sends a registration request message to the old-side AMF, and the old-side AMF receives the registration request message from the terminal device.
  • the registration request message may include Requested NSSAI and UE 5GMM Core Network Capability.
  • the UE 5GMM Core Network Capability indicates that the UE supports the NSSAA process.
  • the old-side AMF calls the UDM servicing operation Nudm_SDM_Get to obtain the subscription data of the terminal device.
  • the subscription data of the terminal device includes the contracted S-NSSAI of the terminal device.
  • UDM sends the subscription data of the terminal device to the old-side AMF through Nudm_SDM_Get response.
  • the contracted S-NSSAI includes indication information for indicating whether the contracted S-NSSAI needs to perform the NSSAA process.
  • the subscription S-NSSAI and indication information of the terminal device can refer to Table 2 above.
  • the old-side AMF saves the capability information of the terminal device.
  • the capability information of the terminal device includes the UE 5GMM Core Network Capability of the terminal device.
  • the AMF determines whether the S-NSSAI that needs to perform the NSSAA process is included in the Requested NSSAI included in the registration request message according to the subscription data of the terminal device. If the Requested NSSAI includes the S-NSSAI that needs to perform the NSSAA process, the old-side AMF puts the S-NSSAI in the Requested NSSAI that needs to perform the NSSAA process in the Pending NSSAI, and puts the S-NSSAI in the Requested NSSAI that does not need to perform the NSSAA process. In Allowed NSSAI.
  • the old-side AMF sends a registration acceptance message to the terminal device, and the terminal device receives the registration acceptance message from the old-side AMF.
  • the registration acceptance message can include Allowed NSSAI and Pending NSSAI.
  • the AMF initiates the NSSAA process for each S-NSSAI that needs to execute the NSSAA process.
  • the specific steps of the NSSAA process refer to the introduction of the process shown in FIG. 6.
  • the old-side AMF learns that the authentication result of a certain network slice performing the NSSAA process is successful, it allows the terminal device to access the network slice, and the old-side AMF generates a new Allowed NSSAI for the terminal device, where the new Allowed NSSAI contains The identifier of the network slice that successfully executed the NSSAA process.
  • the old-side AMF saves the Authentication and Authorization status of the S-NSSAI in the context of the terminal device.
  • the AAA-S saves the corresponding relationship between the identification of the terminal device and the S-NSSAI that successfully executes the NSSAA process.
  • the identification of the terminal device is, for example, GPSI.
  • AAA-S also saves the corresponding relationship between the identification of the terminal device and the S-NSSAI that successfully executes the NSSAA process.
  • the identification of the terminal device is, for example, GPSI.
  • the terminal device can access a network slice indicated by the S-NSSAI included in the new Allowed NSSAI, such as the first network slice, and the terminal device can establish a session associated with the first network slice, for example Called the first session. Then the old-side AMF can determine that the terminal device establishes the first session associated with the first network slice.
  • the first network slice is, for example, a network slice that successfully executes the NSSAA process, so the first network slice is naturally a network slice that needs to successfully execute the NSSAA process to access.
  • the session described herein is, for example, a PDU session (session).
  • S1005 At a certain moment, the old-side RAN currently accessed by the terminal device triggers a handover procedure.
  • S1005 is represented as that the old-side RAN sends a Handover Required (Handover Required) message to the AMF currently accessed by the terminal device (that is, the old-side AMF), and the old-side AMF receives the handover request message from the old-side RAN.
  • the handover request message may include the identification of the new side RAN to which the terminal device needs to be handed over, for example, the ID of the new side RAN.
  • the old-side AMF determines that the terminal device supports the NSSAA process.
  • the old-side AMF determines that the terminal device supports the NSSAA process according to the UE 5GMM Core Network Capability of the terminal device, the old-side AMF determines that it needs to select a new-side AMF that can support NSSAA for the terminal device.
  • the old-side AMF invokes the servicing operation Nnrf_NFDiscovery_Request to send a request message to the NRF, and the NRF receives the request message from the old-side AMF.
  • the request message for example, requests to provide an AMF that can serve the new-side RAN and can support the NSSAA process.
  • the request message may include an NSSAA indication (indication) and a target NF type (type), where the NSSAA indication is used to indicate that the requested target AMF can support NSSAA, and the target NF type is used to indicate that the requested AMF is AMF.
  • the request message may also include a target tracking area identity (tracking area identity, TAI), and the target TAI may be used to indicate the location of the target RAN, so that the NRF can recommend a new one for the old-side AMF from the area where the location is located.
  • TAI target tracking area identity
  • the NRF invokes the servicing operation Nnrf_NFDiscovery_Request response to send a third message to the old-side AMF, and the old-side AMF receives the third message from the NRF.
  • the servicing operation Nnrf_NFDiscovery_Request response is expressed as the third message.
  • the third message is used to indicate the target AMF.
  • the target AMF is the new side AMF, and the new side AMF is an AMF capable of supporting the NSSAA process.
  • the third message is used to indicate that there is no AMF that meets the requirements.
  • the third message is used to indicate the target AMF, and the target AMF is the new-side AMF.
  • the new-side AMF is an AMF that does not support the NSSAA process. If this is the case, the third message may also include the second information.
  • the second information may indicate that the new-side AMF does not support the NSSAA process, or indicates that there is no AMF that can support the NSSAA process, and so on.
  • the third message may indicate the AMF, and the AMF can support the NSSAA process. If there are multiple AMFs that can support the NSSAA process at the location where the target TAI is located, the third message only needs to indicate one of the AMFs. For example, the third message at this time may include the identification of the AMF, such as the ID of the AMF, or the address of the AMF, or the ID and address of the AMF.
  • the third message may indicate that there is no AMF that meets the requirements.
  • the third message may also indicate the target AMF, but the target AMF does not support the NSSAA process.
  • the third message may further include second information, and the second information may indicate that the target AMF does not support the NSSAA process, or indicates that there is no AMF capable of supporting the NSSAA process, and so on.
  • the NRF determines that there is no AMF capable of supporting NSSAA at the location of the target TAI, the NRF can determine an AMF that does not support the NSSAA process at the location of the target TAI, and notify the old-side AMF. In this way, the old-side AMF does not need to request the NRF to provide the new-side AMF again, which helps to save core network signaling.
  • the third message indicates that the target AMF of the NSSAA process can be supported, then perform S1009; if the third message indicates that there is no AMF that meets the requirements, then perform S1010; if the third message indicates that the target AMF of the NSSAA process is not supported, then perform S1012 (ie If the third message indicates that the target AMF of the NSSAA process is not supported, compared to the case where the third message indicates that there is no AMF that meets the requirements, it is not necessary to perform S1010 and S1011).
  • the old-side AMF sends the context of the terminal device to the new-side AMF, and the new-side AMF receives the context of the terminal device from the old-side AMF.
  • the old-side AMF may call the servicing operation Namf_Communication_Create UEContext Request (CreateUEContext Request) to send the context of the terminal device to the new-side AMF.
  • Namf_Communication_Create UEContext Request CreateUEContext Request
  • the terminal device can initiate a registration process to the new side AMF.
  • the registration process refer to the introduction of the process shown in FIG. 4.
  • the new side AMF may also notify the AAA-S, specifically For the implementation manner, reference may be made to the introduction of any one of the foregoing embodiment shown in FIG. 7 to the embodiment shown in FIG. 9.
  • the old-side AMF invokes the servicing operation Nnrf_NFDiscovery_Request to send a fourth message to the NRF, and the NRF receives the fourth message from the old-side AMF.
  • the servicing operation Nnrf_NFDiscovery_Request is represented as the fourth message.
  • the third message indicates that there is no AMF that meets the requirements, but the old-side AMF needs to determine a target AMF for the terminal device, and the old-side AMF can request the NRF to provide the target AMF again.
  • the fourth message may include the target NF type type, and the target NF type is used to indicate that the requested is AMF.
  • the request message may also include a target TAI, and the target TAI may be used to indicate the location of the target RAN, so that the NRF can recommend a new AMF for the old-side AMF from the area where the location is located. It can be seen that the difference between the fourth message and the request message is that the fourth message no longer requests an AMF that can support the NSSAA process.
  • the NRF invokes the servicing operation Nnrf_NFDiscovery_Request response to send a sixth message to the old-side AMF, and the old-side AMF receives the sixth message from the NRF.
  • the servicing operation Nnrf_NFDiscovery_Request response is represented as the sixth message.
  • the sixth message is used to indicate the target AMF, and the target AMF is the new side AMF.
  • the sixth message may indicate the AMF.
  • the sixth message only needs to indicate one of the AMFs.
  • the sixth message may include the identification of the AMF, such as the ID of the AMF, or the address of the AMF, or the ID and address of the AMF, and so on. If there is no AMF at the location of the target TAI, the sixth message may indicate that there is no AMF that can be provided. If this is the case, the terminal device may fail to switch.
  • the old-side AMF sends the context of the terminal device to the new-side AMF, and the new-side AMF receives the context of the terminal device from the old-side AMF.
  • the context of the terminal device sent by the old-side AMF in S1012 may not include the information of the first session.
  • the old-side AMF may call the servicing operation Namf_Communication_CreateUEContext Request to send the context of the terminal device to the new-side AMF. Since the new side AMF does not support the NSSAA process, the old side AMF does not need to switch the session corresponding to the S-NSSAI that needs to execute the NSSAA process to the new side AMF, but only needs to switch the session information corresponding to the S-NSSAI that does not need to execute the NSSAA process Just switch to the new side AMF.
  • the context of the terminal device includes a PDU session list for switching to the new side AMF, and the PDU session list includes at least one PDU session ID, and the S-NSSAI associated with the session corresponding to these PDU session IDs does not need to perform the NSSAA process.
  • the context sent by the old-side AMF to the terminal device of the new-side AMF in S1012 may include the NSSAI that the terminal device is allowed to access before switching the RAN.
  • the old-side AMF can determine which S-NSSAI corresponds to network slices that the terminal device no longer connects to based on the NSSAI that the terminal device is allowed to access before switching to the RAN and the S-NSSAI corresponding to the session information that is switched to the old-side AMF. (These S-NSSAIs need to perform the NSSAA process, and the new side AMF does not support the NSSAA process, so the terminal device can no longer access the network slice corresponding to these S-NSSAIs).
  • the NSSAI that the terminal device is allowed to access before switching the RAN may include the S-NSSAI of the first network slice.
  • the terminal device initiates a registration process to the new side AMF.
  • S1013 is represented as: the terminal device sends a registration request message to the new side AMF, and the new side AMF receives the registration request message from the terminal device.
  • the new-side AMF can update the new Allowed NSSAI of the terminal device, and the updated new Allowed NSSAI does not include the S-NSSAI that needs to perform the NSSAA process.
  • the new-side AMF can also notify the terminal device through a registration acceptance message that the new-side AMF does not support the NSSAA process.
  • the new-side AMF may send a fifth message to the SMF serving the first session, and the fifth message may trigger the SMF to release the first session. Because the first session is not switched to the new side AMF, which indicates that the first session will no longer continue, the SMF can release the first session after receiving the fifth message, so as to use the resources occupied by the first session for other purposes.
  • AAA-S may have previously stored the corresponding relationship between the identification of the terminal device and the S-NSSAI that needs to execute the NSSAA process. The information that the terminal device no longer accesses these network slices will not be notified to AAA-S.
  • AAA-S may trigger the Re-authentication and Re-authorization process or Revocation process for a certain S-NSSAI as usual, and if the S-NSSAI The network slice corresponding to NSSAI is no longer the network slice that the terminal device requests to access.
  • the old-side AMF can also trigger the AAA-S to delete the network slices that the terminal device is no longer accessing to perform the authentication result of the NSSAA process, so that AAA-S will no longer initiate a Re for these network slices. -Authentication and Re-authorization process or Revocation process.
  • S1014 is also included before S1005.
  • the AAA-S sends a subscription request message to the old-side AMF through AUSF, and the old-side AMF receives the subscription request message from the AAA-S through AUSF.
  • the subscription request message may include the identity of the terminal device, including the identities of N network slices (for example, N S-NSSAIs of N network slices, where the network slices correspond to S-NSSAI one-to-one), and include subscription notification information,
  • the subscription notification information is a notification that the terminal device no longer accesses each of the N network slices.
  • N is an integer greater than or equal to 1. That is, after the AMF receives the subscription request message, if it is determined that the terminal device no longer accesses any one of the N network slices, the AMF can notify the terminal device that the terminal device no longer accesses the network slice based on the subscription request message AAA-S.
  • the N network slices may include the first network slice, that is, the subscription request message subscribes to the notification that the terminal device no longer accesses the first network slice (UE no longer access to this S-NSSAI).
  • the old-side AMF has sent the context of the terminal device to the new-side AMF in S1012, and the context of the terminal device does not include the session information corresponding to the S-NSSAI that needs to execute the NSSAA process.
  • the context of the terminal device also includes AAA-S subscription information, that is, the information that AAA-S subscribes to the notification that the terminal device no longer accesses N network slices.
  • the new-side AMF can determine which network slices the terminal device no longer accesses based on the session information included in the context of the terminal device. For example, an S-NSSAI is not any S-NSSAI corresponding to the session information, then the network slice corresponding to the S-NSSAI is the network slice that the terminal device no longer accesses. Such S-NSSAI may be included in the S-NSSAI subscribed to by the subscription information.
  • the old-side AMF determines that the first network slice is a network slice that the terminal device no longer accesses.
  • the old-side AMF determines that the S-NSSAI subscribed by the subscription information includes the S-NSSAI of the first network slice.
  • the new-side AMF sends the first information to the authentication network element, and the authentication network element receives the first information from the new-side AMF.
  • the first information may indicate that the terminal device no longer accesses the first network slice (UE no longer access to this S-NSSAI).
  • the authentication network element is, for example, AAA-S or AUSF.
  • Fig. 10 takes the authentication network element as AAA-S as an example.
  • S1015 refer to the introduction of S808 in the embodiment shown in FIG. 8.
  • the AAA-S After receiving the first information, the AAA-S does not subsequently initiate a Re-authentication and Re-authorization process or a Revocation process for the S-NSSAI, so as to save core network signaling.
  • the AAA-S may also delete the stored authentication result of the NSSAA procedure performed by the first network slice.
  • AAA-S may be an authentication result of executing the NSSAA procedure by deleting the N network slices indicated by the stored first information, and the N network slices include the first network slice.
  • the authentication result of the NSSAA process executed by a network slice refers to the authentication result of the NSSAA process executed by the S-NSSAI of the network slice.
  • AAA-S will no longer initiate a Re-authentication and Re-authorization process or Revocation process for the N S-NSSAIs in order to save core network signaling.
  • the above process of the new side AMF notifying AAA-S is based on the example that AAA-S has subscribed in advance. In fact, AAA-S does not need to subscribe.
  • the new-side AMF can obtain the session information for switching to the new-side AMF according to the context of the terminal device, and can also obtain the NSSAI that the terminal device is allowed to access before switching to the RAN according to the context of the terminal device, and the new-side AMF can determine Which network slices the terminal device no longer accesses.
  • the S-NSSAI of the first network slice is the NSSAI that the terminal device is allowed to access before switching the RAN, but the S-NSSAI is not any S-NSSAI corresponding to the session information, then the new side AMF can determine the first network A slice is a network slice that the terminal device no longer accesses. Then the new-side AMF can actively send the first information to the AAA-S to trigger the AAA-S to delete the S-NSSAI of the first network slice to execute the authentication result of the NSSAA procedure.
  • the process of the new-side AMF proactively notifying the AAA-S refer to S705 to S706 in the embodiment shown in FIG. 7.
  • the new side AMF can also notify AAA-S when AAA-S initiates the Re-authentication and Re-authorization process or Revocation process for the first network slice to trigger AAA-S to delete the S-NSSAI and execute the NSSAA process The result of authentication.
  • the new-side AMF can obtain the session information for switching to the new-side AMF according to the context of the terminal device.
  • the new-side AMF determines The S-NSSAI of the first network slice is not switched to any S-NSSAI associated with the session information of the new-side AMF, and the new-side AMF can determine that the first network slice is the network slice that the terminal device no longer accesses. Then, if AAA-S initiates the Re-authentication and Re-authorization process or Revocation process for the first network slice, the new-side AMF can send the first information to AAA-S to trigger AAA-S to delete the first network slice. S-NSSAI executes the authentication result of the NSSAA process.
  • the new-side AMF notifying the AAA-S according to the triggering of the Re-authentication and Re-authorization process or the Revocation process
  • the AMF can determine that the NSSAI that the terminal device is allowed to access has changed according to the registration request message of the terminal device.
  • the new side AMF can According to the context of the terminal device, it is determined that the NSSAI that the terminal device is allowed to access has changed.
  • the context of the terminal device sent by the old-side AMF to the old-side AMF may only include the session corresponding to the S-NSSAI that does not need to perform the NSSAA process Information, to achieve the purpose of network slicing that needs to perform the NSSAA process when the AMF rejects the terminal device access on the new side.
  • the session information corresponding to the S-NSSAI that needs to perform the NSSAA process is not sent to the new-side AMF, that is, the information that the new-side AMF cannot process is not sent to the new-side AMF, which can reduce information redundancy.
  • the new side AMF determines that the terminal device is no longer connected to a network slice that needs to perform the NSSAA process, it can also trigger AAA-S to delete the locally saved S-NSSAI of the network slice to perform the authentication result of the NSSAA process, for example Delete the corresponding relationship between the S-NSSAI of the network slice and the GPSI of the terminal device. Subsequent AAA-S will no longer initiate a Re-authentication and Re-authorization process or Revocation process for the S-NSSAI, reducing signaling interaction and saving Core network signaling resources.
  • FIG. 11 is a schematic block diagram of a communication device 1100 according to an embodiment of the application.
  • the communication device 1100 is, for example, a first mobility management network element 1100.
  • the first mobility management network element 1100 includes a processing module 1110 and a transceiver module 1120.
  • the first mobility management network element 1100 may be a mobility management network element, or may be a chip applied to the mobility management network element or other combination devices or components that have the function of the first mobility management network element. Wait.
  • the transceiver module 1120 may be a transceiver, the transceiver may include an antenna and a radio frequency circuit, etc.
  • the processing module 1110 may be a processor, and the processor may include one or Multiple central processing units (central processing units, CPUs).
  • the transceiver module 1120 may be a radio frequency unit, and the processing module 1110 may be a processor.
  • the transceiver module 1120 may be an input/output interface of a chip (such as a baseband chip), and the processing module 1110 may be a processor of the chip system, and may include one or more central processing units.
  • the processing module 1110 in the embodiment of the present application may be implemented by a processor or a processor-related circuit component
  • the transceiver module 1120 may be implemented by a transceiver or a transceiver-related circuit component.
  • the processing module 1110 may be used to perform all operations other than the transceiving operations performed by the first mobility management network element in the embodiment shown in FIG. 7, such as S701, S702, and S704, and/or for supporting Other processes of the technique described in this article.
  • the transceiver module 1120 can be used to perform all the transceiver operations performed by the first mobility management network element in the embodiment shown in FIG. 7, such as S703, S705a in S705, and/or support for the technology described herein. Other processes.
  • the processing module 1110 may be used to perform all operations other than the transceiving operations performed by the first mobility management network element in the embodiment shown in FIG. 8, such as S801 and S806, and/or to support this text Other processes of the described technique.
  • the transceiver module 1120 can be used to perform all the transceiver operations performed by the first mobility management network element in the embodiment shown in FIG. 8, such as S803d, S805, S807 and S808a in S808 in S803, and/or for Other processes that support the technology described in this article.
  • the processing module 1110 may be used to perform all operations other than the transceiving operations performed by the first mobility management network element in the embodiment shown in FIG. 9, such as S901 and S904, and/or to support the text Other processes of the described technique.
  • the transceiver module 1120 can be used to perform all the transceiver operations performed by the first mobility management network element in the embodiment shown in FIG. 9, such as S903d in S903, S905 and S906a in S906, and/or for supporting this document Other processes of the described technique.
  • the transceiver module 1120 may be a functional module that can perform both sending operations and receiving operations.
  • the transceiver module 1120 may be used to perform steps from the embodiment shown in FIG. 7 to the embodiment shown in FIG. 9 In any embodiment, all sending operations and receiving operations performed by the first mobility management network element.
  • the transceiver module 1120 when performing a sending operation, can be considered as a sending module, and when performing a receiving operation, it can be considered as a transceiver module.
  • the module 1120 is a receiving module; alternatively, the transceiver module 1120 can also be two functional modules.
  • the transceiver module 1120 can be regarded as a collective term for these two functional modules.
  • the two functional modules are a sending module and a receiving module.
  • the sending module is used for To complete the sending operation, for example, the sending module can be used to perform all the sending operations performed by the first mobility management network element in any one of the embodiments shown in FIG. 7 to the embodiment shown in FIG. 9, and the receiving module For completing the receiving operation, for example, the receiving module may be used to perform all the receiving operations performed by the first mobility management network element in any one of the embodiments shown in FIG. 7 to the embodiment shown in FIG. 9.
  • the processing module 1110 is configured to determine, according to a first condition, that the terminal device no longer accesses the first network slice or the second network slice, wherein the first network slice needs to execute the NSSAA process, and the second network slice is connected to the second network slice.
  • the first network slice has a mapping relationship
  • the transceiver module 1120 is configured to send first information to an authentication network element, where the first information is used to indicate that the terminal device no longer accesses the first network slice.
  • the transceiver module 1120 is further configured to receive a subscription request message from the authentication network element, where the subscription request message includes the identification of the terminal device and the identification of the first network slice, The subscription request message is used to subscribe to the notification that the terminal device no longer accesses the first network slice.
  • the transceiver module 1120 is further configured to receive a second message from the authentication network element, where the second message is used to perform the NSSAA process again on the first network slice, or to Deny the terminal device to access the first network slice.
  • the first mobility management network element 1100 is the mobility management network element that the terminal device accesses after the handover, and the first mobility management network element 1100 does not support the NSSAA process, and the second mobility management network element 1100 does not support the NSSAA process.
  • the mobility management network element is the mobility management network element that the terminal device accesses before handover, and the transceiver module 1120 is further configured to receive the context of the terminal device from the second mobility management network element, where The context of the terminal device includes information that the authentication network element has subscribed to the notification that the terminal device no longer accesses the first network slice.
  • the first condition includes:
  • the NSSAI allowed to be accessed by the terminal device is changed,
  • the NSSAI allowed to access before the change includes the identifier of the first network slice, and the NSSAI allowed to access after the change does not include the identifier of the first network slice; or, the NSSAI allowed to access before the change includes The identifier of the second network slice, and the changed NSSAI allowed to access does not include the identifier of the second network slice.
  • the first condition includes: the terminal device is unregistered from the network.
  • the first condition includes: the terminal device moves from the first network to the second network.
  • the transceiver module 1120 is configured to send the first information to the authentication network element in the following manner:
  • a first message is sent to the authentication network element, where the first message includes the first information, and the first message further includes the identifier of the terminal device and the identifier of the first network slice.
  • the transceiver module 1120 is further configured to receive a registration request message from the terminal device, the registration request message including information used to indicate that the terminal device does not support the NSSAA process, and/or the registration request message
  • the carried request to access the NSSAI does not include the identifier of the first network slice
  • the processing module 1110 is further configured to determine the changed NSSAI allowed to be accessed according to the registration request message.
  • the processing module 1110 is further configured to delete the authentication result of the NSSAA process executed by the first network slice.
  • the processing module 1110 is configured to determine, according to a first condition, that the terminal device no longer accesses the first network slice or the second network slice, where the first network slice needs to execute the NSSAA process, and the second network slice is connected to the first network slice.
  • a network slice has a mapping relationship
  • the transceiver module 1120 is configured to send first information to the authentication network element, where the first information is used to instruct the first mobility management network element to cancel the first notification from the authentication network element, where the first The notification includes a notification of performing re-authentication on the first network slice or a notification of performing deauthorization on the first network slice.
  • the first condition includes:
  • the NSSAI allowed to be accessed by the terminal device is changed,
  • the NSSAI allowed to access before the change includes the identifier of the first network slice, and the NSSAI allowed to access after the change does not include the identifier of the first network slice; or, the NSSAI allowed to access before the change includes The identifier of the second network slice, and the changed NSSAI allowed to access does not include the identifier of the second network slice.
  • the first condition includes: the terminal device is unregistered from the network.
  • the first condition includes: the terminal device moves from the first network to the second network.
  • the transceiver module 1120 is configured to send the first information to the authentication network element in the following manner:
  • a first message is sent to the authentication network element, where the first message includes the first information, and the first message further includes the identifier of the terminal device and the identifier of the first network slice.
  • the transceiver module 1120 is further configured to receive a registration request message from the terminal device, the registration request message including information used to indicate that the terminal device does not support the NSSAA process, and/or the registration request message
  • the carried request to access the NSSAI does not include the identifier of the first network slice
  • the processing module 1110 is further configured to determine the changed NSSAI allowed to be accessed according to the registration request message.
  • the processing module 1110 is further configured to delete the authentication result of the NSSAA process executed by the first network slice.
  • first mobility management network element 1100 Regarding other functions that can be implemented by the first mobility management network element 1100, reference may be made to the related introduction of any one of the embodiments shown in FIG. 7 to the embodiment shown in FIG. 9, and will not be repeated here.
  • FIG. 12 is a schematic block diagram of a communication device 1200 according to an embodiment of the application.
  • the communication device 1200 is, for example, an authentication network element 1200.
  • the authentication network element 1200 includes a processing module 1210 and a transceiver module 1220.
  • the authentication network element 1200 may be an authentication network element, or may be a chip applied to the authentication network element or other combination devices, components, etc. having the functions of the authentication network element described above.
  • the transceiver module 1220 may be a transceiver, the transceiver may include an antenna and a radio frequency circuit, etc.
  • the processing module 1210 may be a processor, and the processor may include one or more CPUs.
  • the transceiver module 1220 may be a radio frequency unit, and the processing module 1210 may be a processor.
  • the transceiver module 1220 may be an input/output interface of a chip (such as a baseband chip), and the processing module 1210 may be a processor of the chip system, and may include one or more central processing units.
  • the processing module 1210 in the embodiment of the present application may be implemented by a processor or a processor-related circuit component, and the transceiver module 1220 may be implemented by a transceiver or a transceiver-related circuit component.
  • the processing module 1210 may be used to perform all operations other than the transceiving operation performed by the authentication network element in the embodiment shown in FIG. 7, such as S706, and/or other processes used to support the technology described herein.
  • the transceiver module 1220 may be used to perform all the transceiver operations performed by the authentication network element in the embodiment shown in FIG. 7, such as S705b in S705, and/or other processes used to support the technology described herein.
  • the processing module 1210 may be used to perform all operations other than the transceiving operations performed by the authentication network element in the embodiment shown in FIG. 8, such as S802 and S809, and/or to support the technology described herein Other processes.
  • the transceiver module 1220 can be used to perform all the transceiver operations performed by the authentication network element in the embodiment shown in FIG. 8, such as S803a in S803 and S808b in S808, and/or for supporting the technology described herein Other processes.
  • the processing module 1210 may be used to perform all operations other than the transceiving operations performed by the authentication network element in the embodiment shown in FIG. 9, such as S902 and S907, and/or to support the technology described herein Other processes.
  • the transceiver module 1220 can be used to perform all the transceiver operations performed by the authentication network element in the embodiment shown in FIG. 9, such as S903a in S903, and S906b in S906, and/or for supporting the technology described herein Other processes.
  • transceiver module 1220 reference may be made to the introduction of the implementation of the transceiver module 1120.
  • the processing module 1210 is configured to execute the NSSAA process on the first network slice
  • the transceiver module 1220 is configured to receive first information from the first mobility management network element, where the first information is used to indicate that the terminal device no longer accesses the first network slice.
  • the transceiver module 1220 is further configured to send a subscription request message to the first mobility management network element, where the subscription request message includes the identification of the terminal device and the identification of the first network slice
  • the subscription request message is used to subscribe to the notification that the terminal device no longer accesses the first network slice.
  • the transceiver module 1220 is further configured to send a second message to the first mobility management network element, where the second message is used to perform the NSSAA process again on the first network slice, Or used to deny the terminal device to access the first network slice.
  • the processing module 1210 is further configured to delete the authentication result of the NSSAA process executed by the first network slice.
  • the transceiver module 1220 is configured to receive the first information from the first mobility management network element in the following manner:
  • the first mobility management network element Receiving a first message from the first mobility management network element, the first message including the first information, the first message further including the identifier of the terminal device and the identifier of the first network slice .
  • the processing module 1210 is configured to perform a network slice authentication authorization NSSAA process on the first network slice;
  • the transceiver module 1220 is configured to receive first information from a first mobility management network element, where the first information is used to instruct the first mobility management network element to cancel the first notification from the authentication network element, where ,
  • the first notification includes a notification of performing re-authentication on the first network slice or a notification of performing deauthorization on the first network slice.
  • the processing module 1210 is further configured to delete the authentication result of the NSSAA process executed by the first network slice.
  • the transceiver module 1220 is configured to receive the first information from the first mobility management network element in the following manner:
  • the first mobility management network element Receiving a first message from the first mobility management network element, the first message including the first information, the first message further including the identifier of the terminal device and the identifier of the first network slice .
  • FIG. 13 is a schematic block diagram of a communication device 1300 according to an embodiment of the application.
  • the communication device 1300 is, for example, a mobility management network element 1300, or referred to as a second mobility management network element 1300.
  • the mobility management network element 1300 includes a processing module 1310 and a transceiver module 1320.
  • the mobility management network element 1300 may be a mobility management network element, or may be a chip applied to the mobility management network element or other combined devices or components having the above-mentioned mobility management network element function.
  • the transceiver module 1320 may be a transceiver, the transceiver may include an antenna and a radio frequency circuit, etc.
  • the processing module 1310 may be a processor, and the processor may include one or more CPU.
  • the transceiver module 1320 may be a radio frequency unit, and the processing module 1310 may be a processor.
  • the transceiver module 1320 may be an input/output interface of a chip (such as a baseband chip), and the processing module 1310 may be a processor of the chip system, and may include one or more central processing units.
  • the processing module 1310 in the embodiment of the present application may be implemented by a processor or a processor-related circuit component, and the transceiver module 1320 may be implemented by a transceiver or a transceiver-related circuit component.
  • the processing module 1310 may be used to perform all operations performed by the second mobility management network element (or called the old-side AMF) in the embodiment shown in FIG. 10 except for the transceiver operations, such as S1002, S1004, and S1004. S1006, and/or other processes used to support the technology described herein.
  • the transceiver module 1320 can be used to perform all the transceiver operations performed by the second mobility management network element (or called the old-side AMF) in the embodiment shown in FIG. 10, such as S1001, S1003, S1005, S1007, S1008, S1009 , S1010, S1011, S1012, and S1014, and/or other processes used to support the techniques described herein.
  • transceiver module 1320 reference may be made to the introduction of the implementation of the transceiver module 1120.
  • the processing module 1310 is configured to determine that the terminal device establishes a first session associated with a first network slice, and the first network slice is a network slice that has successfully executed the NSSAA process;
  • the transceiver module 1320 is configured to receive a handover request message from a first access network element, where the handover request message is used to instruct the terminal device to switch from the first access network element to the second access network Network element
  • the transceiver module 1320 is further configured to send a request message to the storage function network element, where the request message is used to request the provision of a mobility management network element that can serve the second access network network element and can support the NSSAA process.
  • the transceiver module 1320 is further configured to receive a third message from the storage function network element, where the third message includes the identifier of the target mobility management network element.
  • the processing module 1310 is configured to determine that the terminal device establishes a first session associated with a first network slice, where the first network slice is a network slice that has successfully executed the NSSAA process;
  • the transceiver module 1320 is configured to receive a handover request message from a first access network element, where the handover request message is used to instruct the terminal device to switch from the first access network element to the second access network Network element
  • the processing module 1310 is further configured to obtain information of the first mobility management network element, which does not support the NSSAA process;
  • the transceiver module 1320 is further configured to send the context of the terminal device to the first mobility management network element, where the context of the terminal device does not include the information of the first session.
  • the transceiver module 1320 is further used for:
  • the transceiver module 1320 is further configured to receive a subscription request message from an authentication network element, where the subscription request message includes the identification of the terminal device and the identification of the first network slice, and The subscription request message is used to subscribe to the notification that the terminal device no longer accesses the first network slice.
  • the context of the terminal device includes the NSSAI that the terminal device is allowed to access before handover, where the allowed NSSAI includes the identifier of the first network slice, and the The context of the terminal device also includes information that the authentication network element has subscribed to the notification that the terminal device no longer accesses the first network slice.
  • the transceiver module 1320 is further configured to send a fifth message to the first session management network element serving the first session, and the fifth message is used to trigger the first session management The network element releases the first session.
  • each unit in the device can be all implemented in the form of software called by processing elements; they can also be all implemented in the form of hardware; part of the units can also be implemented in the form of software called by the processing elements, and some of the units can be implemented in the form of hardware.
  • each unit can be a separate processing element, or it can be integrated in a certain chip of the device for implementation.
  • it can also be stored in the memory in the form of a program, which is called and executed by a certain processing element of the device. Function.
  • each step of the above method or each of the above units may be implemented by an integrated logic circuit of hardware in a processor element or implemented in a form of being called by software through a processing element.
  • the unit in any of the above devices may be one or more integrated circuits configured to implement the above method, for example: one or more application specific integrated circuits (ASIC), or, one or Multiple microprocessors (digital singnal processors, DSP), or, one or more field programmable gate arrays (FPGA), or a combination of at least two of these integrated circuits.
  • ASIC application specific integrated circuits
  • DSP digital singnal processors
  • FPGA field programmable gate arrays
  • the unit in the device can be implemented in the form of a processing element scheduler
  • the processing element can be a general-purpose processor, such as a CPU or other processors that can call programs.
  • these units can be integrated together and implemented in the form of a system-on-a-chip (SOC).
  • SOC system-on-a-chip
  • the above receiving unit is an interface circuit of the device for receiving signals from other devices.
  • the receiving unit is an interface circuit used by the chip to receive signals from other chips or devices.
  • the above unit for sending is an interface circuit of the device for sending signals to other devices.
  • the sending unit is an interface circuit used by the chip to send signals to other chips or devices.
  • FIG. 14 another schematic diagram of a communication device provided by an embodiment of this application is used to implement the operation of the first policy control network element or the mobility management network element in the above embodiment.
  • the communication device includes a processor 1410 and an interface 1430.
  • the communication device further includes a memory 1420.
  • the interface 1430 is used to implement communication with other devices.
  • the method executed by the first policy control network element or the mobility management network element may be called by the processor 1410 (which may be the first mobility management network element, the authentication network element, or the second mobility management network element).
  • the memory 1420 may also be a program stored in an external memory). That is, the apparatus for the first mobility management network element, the authentication network element, or the second mobility management network element may include a processor 1410, which calls a program in a memory to execute the method in the above method embodiment.
  • the processor here may be an integrated circuit with signal processing capability, such as a CPU.
  • the apparatus for the first policy control network element or the mobility management network element may be implemented by one or more integrated circuits configured to implement the above method. For example: one or more ASICs, or, one or more microprocessors DSP, or, one or more FPGAs, etc., or a combination of at least two of these integrated circuit forms. Or, the above implementations can be combined.
  • the functions/implementation process of the transceiver module 1120 and the processing module 1110 in FIG. 11 may be implemented by the processor 1410 in the communication device shown in FIG. 14 calling computer executable instructions stored in the memory 1420.
  • the function/implementation process of the processing module 1110 in FIG. 11 can be realized by the processor 1410 in the communication device shown in FIG.
  • the implementation process can be implemented through the interface 1430 in the communication device shown in FIG. 14.
  • the functions/implementation process of the transceiver module 1220 and the processing module 1210 in FIG. 12 may be implemented by the processor 1410 in the communication device shown in FIG. 14 calling computer executable instructions stored in the memory 1420.
  • the function/implementation process of the processing module 1210 in FIG. 12 can be realized by the processor 1410 in the communication device shown in FIG.
  • the implementation process can be implemented through the interface 1430 in the communication device shown in FIG. 14.
  • the functions/implementation process of the transceiver module 1320 and the processing module 1310 in FIG. 13 may be implemented by the processor 1410 in the communication device shown in FIG. 14 calling computer executable instructions stored in the memory 1420.
  • the function/implementation process of the processing module 1310 in FIG. 13 can be implemented by the processor 1410 in the communication device shown in FIG.
  • the implementation process can be implemented through the interface 1430 in the communication device shown in FIG. 14.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website, computer, server, or data center.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or a data center integrated with one or more available media.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, and a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk (SSD)).
  • the various illustrative logic units and circuits described in the embodiments of this application can be implemented by general-purpose processors, digital signal processors, application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, Discrete gates or transistor logic, discrete hardware components, or any combination of the above are designed to implement or operate the described functions.
  • the general-purpose processor may be a microprocessor.
  • the general-purpose processor may also be any traditional processor, controller, microcontroller, or state machine.
  • the processor can also be implemented by a combination of computing devices, such as a digital signal processor and a microprocessor, multiple microprocessors, one or more microprocessors combined with a digital signal processor core, or any other similar configuration. accomplish.
  • the steps of the method or algorithm described in the embodiments of the present application can be directly embedded in hardware, a software unit executed by a processor, or a combination of the two.
  • the software unit can be stored in random access memory (RAM), flash memory, read-only memory (ROM), EPROM memory, EEPROM memory, registers, hard disk, removable disk, CD-ROM or this Any other storage media in the field.
  • the storage medium may be connected to the processor, so that the processor can read information from the storage medium, and can store and write information to the storage medium.
  • the storage medium may also be integrated into the processor.
  • the processor and the storage medium can be arranged in the ASIC.
  • These computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operation steps are executed on the computer or other programmable equipment to produce computer-implemented processing, so as to execute on the computer or other programmable equipment.
  • the instructions provide steps for implementing the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.
  • the aforementioned functions described in the embodiments of the present application may be implemented in hardware, software, firmware, or any combination of the three. If implemented in software, these functions can be stored on a computer-readable medium, or transmitted on the computer-readable medium in the form of one or more instructions or codes.
  • Computer-readable media include computer storage media and communication media that facilitate the transfer of computer programs from one place to another. The storage medium can be any available medium that can be accessed by a general-purpose or special computer.
  • Such computer-readable media may include, but are not limited to, RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other device that can be used to carry or store instructions or data structures and Other program code media that can be read by general-purpose or special computers, or general-purpose or special processors.
  • any connection can be appropriately defined as a computer-readable medium, for example, if the software is from a website, server, or other remote source through a coaxial cable, fiber optic computer, twisted pair, or digital subscriber line (DSL) Or transmitted by wireless means such as infrared, wireless and microwave are also included in the definition of computer-readable media.
  • DSL digital subscriber line
  • the disks and discs include compressed disks, laser disks, optical disks, digital versatile discs (DVD), floppy disks, and Blu-ray disks. Disks are usually used to copy data with magnets, while disks are usually used to copy data.
  • the laser performs optical reproduction of data. The combination of the above can also be contained in a computer readable medium.
  • the functions described in the embodiments of the present application may be implemented by hardware, software, firmware, or any combination thereof. When implemented by software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on the computer-readable medium.
  • the computer-readable medium includes a computer storage medium and a communication medium, where the communication medium includes any medium that facilitates the transfer of a computer program from one place to another.
  • the storage medium may be any available medium that can be accessed by a general-purpose or special-purpose computer.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Databases & Information Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请涉及一种通信方法及装置。第一移动性管理网元根据第一条件确定终端设备不再接入第一网络切片或第二网络切片，第一网络切片需要执行NSSAA流程，第二网络切片与第一网络切片具有映射关系。第一移动性管理网元向认证网元发送第一信息，第一信息用于指示终端设备不再接入第一网络切片。在本申请实施例中，如果第一移动性管理网元确定终端设备不再接入第一网络切片或第二网络切片，那么第一移动性管理网元可以告知认证网元，从而认证网元后续不必再对该终端设备发起针对第一网络切片的重鉴权和重授权流程或撤销授权流程等，从而能够节省核心网的信令开销。

Description

一种通信方法及装置
相关申请的交叉引用
本申请要求在2020年04月10日提交中国国家知识产权局、申请号为202010281457.X、申请名称为“一种通信方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种通信方法及装置。
背景技术
目前，在对终端设备所请求的网络切片执行网络切片鉴权授权(network slice specific authentication and authorization，NSSAA)流程后，认证、授权和计费(authentication、authorization、accounting，AAA)服务器会保存该网络切片的单网络切片选择辅助信息(single network slice selection assistance information，S-NSSAI)与终端设备之间的对应关系。之后，AAA服务器可能会对该终端设备发起针对该网络切片的重鉴权(Re-authentication)和重授权(Re-authorization)流程，例如该终端设备在成功执行该网络切片对应的NSSAA流程之后，则AAA服务器可以触发向该终端设备发起针对该网络切片的重认证和重授权流程。
但终端设备在接入一个需要执行NSSAA流程的网络切片后，可能会再次发起注册流程，以重新请求接入其他网络切片。例如终端设备接入一个网络切片后发生了移动，则终端设备可以再次发起注册流程，以请求接入移动后的位置对应的另外的网络切片。在这种情况下，终端设备可能并不会再接入之前所接入的网络切片，由于AAA服务器并不感知终端设备当前已经不再接入之前所接入网络切片，因此AAA服务器依然保存终端设备的上下文信息，如果AAA服务器对终端设备之前接入的网络切片发起重认证和重授权流程就会导致核心网的信令浪费。
发明内容
本申请实施例提供一种通信方法及装置，用于节省核心网信令开销。
第一方面，提供第一种通信方法，该方法包括：第一移动性管理网元根据第一条件确定终端设备不再接入第一网络切片或第二网络切片，其中，所述第一网络切片需要执行NSSAA流程，所述第二网络切片与所述第一网络切片具有映射关系；所述第一移动性管理网元向认证网元发送第一信息，所述第一信息用于指示所述终端设备不再接入所述第一网络切片。
示例性地，所述第一移动性管理网元为AMF。
在本申请实施例中，如果第一移动性管理网元确定终端设备不再接入需要执行NSSAA流程的S-NSSAI或与其具有映射关系的S-NSSAI，那么第一移动性管理网元可以将终端设备不再接入第一网络切片的信息告知认证网元，例如认证网元为AAA-S，或者，指示所述 第一移动性管理网元取消向该认证网元订阅执行重鉴权的事件或者对执行撤销授权事件，从而认证网元在获知该信息后，后续可以不必再对该终端设备发起针对第一网络切片的重鉴权流程或撤销授权流程，从而能够节省核心网的信令开销。
在一种可选的实施方式中，所述方法还包括：
所述第一移动性管理网元接收来自所述认证网元的订阅请求消息，所述订阅请求消息包括所述终端设备的标识和所述第一网络切片的标识，所述订阅请求消息用于订阅所述终端设备不再接入所述第一网络切片的事件。
在本申请实施例中，认证网元可以事先发起订阅，以订阅终端设备不再接入第一网络切片的事件。这样，如果第一移动性管理网元确定终端设备不再接入第一网络切片，则第一移动性管理网元可以根据该订阅来通知认证网元，相当于第一移动性管理网元根据订阅流程进行操作即可，有助于简化移动性管理网元的实现。
在一种可选的实施方式中，所述方法还包括：
所述第一移动性管理网元接收来自所述认证网元的第二消息，所述第二消息用于对所述第一网络切片再次执行NSSAA流程，或用于拒绝所述终端设备接入所述第一网络切片。
在本申请实施例中，认证网元无需事先发起订阅，第一移动性管理网元也无需主动通知认证网元，而是可以在认证网元发起针对第一网络切片的重鉴权流程或撤销授权流程时再通知认证网元，终端设备不再接入第一网络切片。这样，第一移动性管理网元无需增加主动向认证网元进行通知的步骤，而认证网元也无需增加订阅步骤，对于两个网元的实现都有所简化。
在一种可选的实施方式中，所述第一移动性管理网元为所述终端设备在进行切换后接入的移动性管理网元且所述第一移动性管理网元不支持NSSAA流程，第二移动性管理网元为所述终端设备在进行切换前接入的移动性管理网元，所述方法还包括：
所述第一移动性管理网元接收来自所述第二移动性管理网元的所述终端设备的上下文，其中，所述终端设备的上下文包括所述认证网元订阅了所述终端设备不再接入所述第一网络切片的事件的信息。
例如终端设备进行了小区切换，在进行小区切换前终端设备接入的是第二移动性管理网元，在进行小区切换后终端设备接入的是第一移动性管理网元。如果认证网元事先向第二移动性管理网元进行了订阅，那么如果终端设备要切换到第一移动性管理网元，第二移动性管理网元就可以将该认证网元的订阅信息(即，认证网元订阅了所述终端设备不再接入所述第一网络切片的事件的信息)发送给第一移动性管理网元。那么，如果第一移动性管理网元本身不支持NSSAA流程，或者第一移动性管理网元确定终端设备不再接入第一网络切片或第二网络切片等，第一移动性管理网元就可以通知该认证网元，从而认证网元在获知该信息后，后续可以不必再对该终端设备发起针对第一网络切片的重鉴权和重授权流程，从而能够节省核心网的信令开销。
在一种可选的实施方式中，所述第一条件包括：
所述终端设备允许接入的NSSAI发生改变，
其中，改变前的允许接入的NSSAI包括所述第一网络切片的标识，改变后的允许接入的NSSAI不包括所述第一网络切片的标识；或者，改变前的允许接入的NSSAI包括所述第二网络切片的标识，改变后的允许接入的NSSAI不包括所述第二网络切片的标识。
如果第一移动性管理网元确定终端设备允许接入的NSSAI发生改变，那么具体地，改 变前的允许接入的NSSAI包括第一网络切片的标识，改变后的允许接入的NSSAI不包括第一网络切片的标识。如果是这种情况，终端设备允许接入的NSSAI发生改变，也可以理解为，从终端设备允许接入的NSSAI中移除第一网络切片的标识。或者，如果第一移动性管理网元确定终端设备允许接入的NSSAI发生改变，那么具体地，改变前的允许接入的NSSAI包括第二网络切片的标识，改变后的允许接入的NSSAI不包括第二网络切片的标识。如果是这种情况，终端设备允许接入的NSSAI发生改变，也可以理解为，从终端设备允许接入的NSSAI中移除第二网络切片的标识。例如，第一移动性管理网元可以根据来自终端设备的注册请求消息确定终端设备允许接入的NSSAI发生改变，或者也可以通过其他方式确定终端设备允许接入的NSSAI发生改变。
在一种可选的实施方式中，所述第一条件包括：所述终端设备从网络去注册。
当AMF确定终端设备从网络中去注册时，该终端设备从注册状态(registered state)变成去注册状态(deregistered state)，可以理解为，去注册状态的终端设备不再接入任何网络切片，那么自然地，AMF可以确定终端设备不再接入第一网络切片或第二网络切片。示例性地，AMF确定终端设备去注册的方法可以是：该终端设备自行发起去注册流程以通知AMF，该终端设备不再接入当前的网络；或者，网络发起去注册流程，以通知该终端设备无法接入当前的网络。
在一种可选的实施方式中，所述第一条件包括：所述终端设备从第一网络移动到第二网络。
例如第一网络部署有网络切片，第二网络未部署网络切片，则如果终端设备从第一网络移动到第二网络，则终端设备就无法再接入网络切片，自然也就无法接入第一网络切片，也无法接入第二网络切片。以第一网络是5G网络、第二网络是EPS网络为例。在本申请的各个实施例中，所述的5G网络例如为5G核心网(5GC)。当第一移动性管理网元确定终端设备从5G网络移动到EPS网络时，由于EPS网络不支持第一网络切片执行NSSAA流程所需的认证机制，因此终端设备无法在EPS网络接入第一网络切片，则第一移动性管理网元可以确定终端设备不再接入第一网络切片或第二网络切片。示例性地，第一移动性管理网元确定终端设备从5G网络移动到EPS网络的方法可以是：第一移动性管理网元从UDM接收去注册通知消息，该去注册通知消息可以是UDM调用服务化操作Nudm_UECM_DeregistrationNotification发送给第一移动性管理网元的，该去注册通知消息携带该终端设备的标识以及5GC到EPS移动原因值(5GC to EPS Mobility)，AMF接收该去注册通知消息之后可以确定该终端设备从5G网络移动到EPS网络，从而确定终端设备不再接入第一网络切片或第二网络切片。
在一种可选的实施方式中，所述第一移动性管理网元向认证网元发送第一信息，包括：
所述第一移动性管理网元向认证网元发送第一消息，其中，所述第一消息包括所述第一信息，所述第一消息还包括所述终端设备的标识和所述第一网络切片的标识。
第一消息可包括第一信息，可选的，第一消息还可以包括终端设备的标识(例如GPSI)以及终端设备不再接入的网络切片对应的S-NSSAI等。这样可以使得认证网元能够明确第一信息针对的是哪个终端设备对应的哪个或哪些网络切片。其中，终端设备不再接入的网络切片对应的S-NSSAI就是终端设备曾经接入且需要执行NSSAA流程的S-NSSAI，例如第一消息包括的S-NSSAI中可以包括第一网络切片的S-NSSAI。
在一种可选的实施方式中，所述方法还包括：
所述第一移动性管理网元接收来自所述终端设备的注册请求消息，所述注册请求消息包括用于指示所述终端设备不支持所述NSSAA流程的信息，和/或，所述注册请求消息所携带的请求接入NSSAI不包括所述第一网络切片的标识或所述第二网络切片的标识；
所述第一移动性管理网元根据所述注册请求消息确定所述改变后的允许接入的NSSAI。
注册请求消息可以包括用于指示终端设备不支持NSSAA流程的信息；或，注册请求消息所携带的请求接入NSSAI不包括第一网络切片的标识或第二网络切片的标识；或，注册请求消息包括用于指示终端设备不支持NSSAA流程的信息，以及注册请求消息所携带的请求接入NSSAI不包括第一网络切片的标识或第二网络切片的标识。
在一种可选的实施方式中，所述方法还包括：
所述第一移动性管理网元删除所述第一网络切片执行所述NSSAA流程的鉴权结果。
根据现有技术，一个HPLMN S-NSSAI执行NSSAA流程的鉴权结果，通常保存在移动性管理网元存储的该终端设备的上下文中。保留S-NSSAI执行NSSAA流程的鉴权结果是为了让终端设备下一次能够尽快接入该S-NSSAI对应的网络切片，例如一个S-NSSAI执行NSSAA流程的鉴权结果为鉴权成功，则终端设备下一次再请求接入该S-NSSAI对应的网络切片时可尽快接入，无需再执行NSSAA流程。如果该终端设备的上下文包含了第一网络切片对应的鉴权结果，可选的，则第一移动性管理网元可以在该终端设备的上下文中将第一网络切片应的鉴权结果删掉。因为终端设备已经不再接入第一网络切片，因此也就不必再保存第一网络切片的鉴权结果，则第一移动性管理网元可以将第一网络切片的鉴权结果删除，以节省第一移动性管理网元的存储空间，也简化终端设备的上下文。
第二方面，提供第二种通信方法，该方法包括：第一移动性管理网元根据第一条件确定终端设备不再接入第一网络切片或第二网络切片，其中，所述第一网络切片需要执行NSSAA流程，所述第二网络切片与所述第一网络切片具有映射关系；所述第一移动性管理网元向认证网元发送第一信息，所述第一信息用于指示所述第一移动性管理网元取消向所述认证网元订阅第一通知，其中，所述第一通知包括对所述第一网络切片执行重鉴权的通知或者对所述第一网络切片执行撤销授权的通知。
示例性地，所述第一移动性管理网元为AMF。
在本申请实施例中，如果第一移动性管理网元确定终端设备不再接入第一网络切片或第二网络切片，那么第一移动性管理网元可以取消向认证网元订阅第一事件，例如认证网元为AAA-S，从而认证网元在接收第一信息后，后续可以不必再对该终端设备发起针对第一网络切片的重鉴权和重授权流程，从而能够节省核心网的信令开销。
在一种可选的实施方式中，所述第一条件包括：
所述终端设备允许接入的NSSAI发生改变，
其中，改变前的允许接入的NSSAI包括所述第一网络切片的标识，改变后的允许接入的NSSAI不包括所述第一网络切片的标识；或者，改变前的允许接入的NSSAI包括所述第二网络切片的标识，改变后的允许接入的NSSAI不包括所述第二网络切片的标识。
在一种可选的实施方式中，所述第一条件包括：所述终端设备从网络去注册。
在一种可选的实施方式中，所述第一条件包括：所述终端设备从第一网络移动到第二网络。
在一种可选的实施方式中，所述第一移动性管理网元向认证网元发送第一信息，包括：
所述第一移动性管理网元向认证网元发送第一消息，其中，所述第一消息包括所述第一信息，所述第一消息还包括所述终端设备的标识和所述第一网络切片的标识。
在一种可选的实施方式中，
所述第一移动性管理网元接收来自所述终端设备的注册请求消息，所述注册请求消息包括用于指示所述终端设备不支持所述NSSAA流程的信息，和/或，所述注册请求消息所携带的请求接入NSSAI不包括所述第一网络切片的标识；
所述第一移动性管理网元根据所述注册请求消息确定所述改变后的允许接入的NSSAI。
在一种可选的实施方式中，所述方法还包括：
所述第一移动性管理网元删除所述第一网络切片执行所述NSSAA流程的鉴权结果。
关于第二方面的各种可能的实施方式所带来的技术效果，可参考对于第一方面或相应的实施方式的技术效果的介绍。
第三方面，提供第三种通信方法，该方法包括：认证网元对第一网络切片执行NSSAA流程；所述认证网元接收来自第一移动性管理网元的第一信息，所述第一信息用于指示终端设备不再接入所述第一网络切片。
示例性地，所述认证网元为AAA-S。
在一种可选的实施方式中，所述方法还包括：
所述认证网元向所述第一移动性管理网元发送订阅请求消息，所述订阅请求消息包括所述终端设备的标识和第一网络切片的标识，所述订阅请求消息用于订阅所述终端设备不再接入所述第一网络切片的事件。
在一种可选的实施方式中，所述方法还包括：
所述认证网元向所述第一移动性管理网元发送第二消息，所述第二消息用于对所述第一网络切片再次执行NSSAA流程，或用于拒绝所述终端设备接入所述第一网络切片。
在一种可选的实施方式中，所述方法还包括：
所述认证网元删除所述第一网络切片执行所述NSSAA流程的鉴权结果。
在一种可选的实施方式中，所述认证网元接收来自第一移动性管理网元的第一信息，包括：
所述认证网元接收来自所述第一移动性管理网元的第一消息，所述第一消息包括所述第一信息，所述第一消息还包括所述终端设备的标识和所述第一网络切片的标识。
关于第三方面或第三方面的各种可能的实施方式所带来的技术效果，可参考对于第一方面或相应的实施方式的技术效果的介绍。
第四方面，提供第四种通信方法，该方法包括：认证网元对第一网络切片执行NSSAA流程；所述认证网元接收来自第一移动性管理网元的第一信息，所述第一信息用于指示所述第一移动性管理网元取消向所述认证网元订阅第一通知，其中，所述第一通知包括对所述第一网络切片执行重鉴权的通知或者对所述第一网络切片执行撤销授权的通知。
示例性地，所述认证网元为AAA-S。
在一种可选的实施方式中，所述方法还包括：
所述认证网元删除所述第一网络切片执行所述NSSAA流程的鉴权结果。
在一种可选的实施方式中，所述认证网元接收来自第一移动性管理网元的第一信息，包括：
所述认证网元接收来自所述第一移动性管理网元的第一消息，所述第一消息包括所述第一信息，所述第一消息还包括所述终端设备的标识和所述第一网络切片的标识。
关于第四方面或第四方面的各种可能的实施方式所带来的技术效果，可参考对于第二方面或相应的实施方式的技术效果的介绍。
第五方面，提供第五种通信方法，该方法包括：移动性管理网元确定终端设备建立与第一网络切片关联的第一会话，所述第一网络切片为曾成功执行了NSSAA流程的网络切片；所述移动性管理网元接收来自第一接入网网元的切换请求消息，所述切换请求消息用于指示所述终端设备要从所述第一接入网网元切换到第二接入网网元；所述移动性管理网元向存储功能网元发送请求消息，所述请求消息用于请求提供能够服务于所述第二接入网网元且能够支持NSSAA流程的移动性管理网元。
示例性地，所述移动性管理网元为AMF。
在本申请实施例中，由于终端设备已经建立了与需要执行NSSAA流程的第一网络切片关联的第一会话，那么如果终端设备要切换接入网网络，则该移动性管理网元需要请求新的移动性管理网元。在请求时，该移动性管理网元可以请求既能服务于第二接入网网元又能支持NSSAA流程的移动性管理网元，这样，终端设备在切换到新的移动性管理网元后，也能够继续接入需要执行NSSAA流程的网络切片(例如第一网络切片)，可以尽量保持终端设备的会话的连续性。
在一种可选的实施方式中，所述方法还包括：
所述移动性管理网元接收来自所述存储功能网元的第三消息，所述第三消息包括目标移动性管理网元的标识。
如果存储功能网元确定能够提供既能服务于第二接入网网元又能支持NSSAA流程的移动性管理网元，则存储功能网元可以将该新的移动性管理网元(即，目标移动性管理网元)的标识发送给所述的移动性管理网元，则终端设备就可以接入目标移动性管理网元，且终端设备在目标移动性管理网元下也能继续接入需要执行NSSAA流程的网络切片。
第六方面，提供第六种通信方法，该方法包括：第二移动性管理网元确定终端设备建立与第一网络切片关联的第一会话，所述第一网络切片为曾成功执行了NSSAA流程的网络切片；所述第二移动性管理网元接收来自第一接入网网元的切换请求消息，所述切换请求消息用于指示所述终端设备要从所述第一接入网网元切换到第二接入网网元；所述第二移动性管理网元获取第一移动性管理网元的信息，所述第一移动性管理网元不支持NSSAA流程；所述第二移动性管理网元向所述第一移动性管理网元发送所述终端设备的上下文，所述终端设备的上下文不包括所述第一会话的信息。
示例性地，所述第二移动性管理网元为AMF。
在本申请实施例中，对于小区切换流程，如果新侧移动性管理网元(即，第一移动性管理网元)不支持NSSAA流程，那么旧侧移动性管理网元向旧侧移动性管理网元(即，第而移动性管理网元)发送的终端设备的上下文可以只包含不需要执行NSSAA流程的S-NSSAI对应的会话信息，实现在新侧移动性管理网元拒绝终端设备接入需要执行NSSAA流程的网络切片的目的。且，不向新侧移动性管理网元发送需要执行NSSAA流程的S-NSSAI对应的会话信息，也就是不向新侧移动性管理网元发送新侧移动性管理网元无法处理的信息，能够减少信息冗余。
在一种可选的实施方式中，所述方法还包括：
所述第二移动性管理网元向存储功能网元发送请求消息，所述请求消息用于请求提供能够服务于所述第二接入网网元且能够支持NSSAA流程的移动性管理网元；
所述第二移动性管理网元接收来自所述存储功能网元的第三消息，所述第三消息用于指示没有符合要求的移动性管理网元。
由于终端设备已经建立了与需要执行NSSAA流程的第一网络切片关联的第一会话，那么如果终端设备要切换接入网网络，则旧侧移动性管理网元(即，第二移动性管理网元)需要请求新的移动性管理网元。在请求时，旧侧移动性管理网元可以请求既能服务于第二接入网网元又能支持NSSAA流程的移动性管理网元，这样，终端设备在切换到新侧移动性管理网元后，也能够继续接入需要执行NSSAA流程的网络切片(例如第一网络切片)，可以尽量保持终端设备的会话的连续性。但如果存储功能网元未能提供既能服务于第二接入网网元又能支持NSSAA流程的移动性管理网元，则旧侧移动性管理网元还可以重新请求新的移动性管理网元，即使新的移动性管理网元无法支持NSSAA流程，但也能尽量使得终端设备有移动性管理网元能够接入。
在一种可选的实施方式中，所述方法还包括：
所述第二移动性管理网元接收来自认证网元的订阅请求消息，所述订阅请求消息包括所述终端设备的标识和所述第一网络切片的标识，所述订阅请求消息用于订阅所述终端设备不再接入所述第一网络切片的事件。
认证网元可能事先向旧侧移动性管理网元进行过订阅，以订阅终端设备不再接入第一网络切片的事件。
在一种可选的实施方式中，所述终端设备的上下文包括所述终端设备在切换前允许接入的NSSAI，其中，所述允许接入的NSSAI包括所述第一网络切片的标识，所述终端设备的上下文还包括所述认证网元订阅了所述终端设备不再接入所述第一网络切片的事件的信息。
终端设备在切换前允许接入的NSSAI包括第一网络切片的标识，而旧侧移动性管理网元发送给新侧移动性管理网元的会话信息不包括第一网络切片对应的会话信息，则新侧移动性管理网元就可以确定终端设备不再接入第一网络切片。而终端设备的上下文又包括认证网元订阅了终端设备不再接入第一网络切片的事件的信息，从而新侧移动性管理网元可以向认证网元发送第一信息，例如第一信息可以指示终端设备不再接入第一网络切片，从而认证网元在接收第一信息后，后续可以不必再对该终端设备发起针对第一网络切片的重鉴权和重授权流程，从而能够节省核心网的信令开销。
在一种可选的实施方式中，所述方法还包括：
所述第二移动性管理网元向服务于所述第一会话的第一会话管理网元发送第五消息，所述第五消息用于触发所述第一会话管理网元释放所述第一会话。
因为第一会话并未切换到新侧AMF，表明第一会话不再继续，那么SMF接收第五消息后可以释放第一会话，以将第一会话占用的资源用作其他用途。
第七方面，提供一种通信装置，所述通信装置(可称为第一通信装置)用于执行上述第一方面或任一可能的实施方式中的方法。具体地，所述第一通信装置可以包括用于执行第一方面或任一可能的实施方式中的方法的模块，例如包括处理模块和收发模块。示例性地，收发模块可以包括发送模块和接收模块，发送模块和接收模块可以是不同的功能模块，或者也可以是同一个功能模块，但能够实现不同的功能。示例性地，所述第一通信装置为 通信设备，或者为设置在通信设备中的芯片或其他部件。示例性地，所述通信设备为核心网设备。下面以第一通信装置是核心网设备为例。示例性地，所述核心网设备为第一移动性管理网元。示例性地，第一移动性管理网元为AMF。例如，所述收发模块也可以通过收发器实现，所述处理模块也可以通过处理器实现。或者，发送模块可以通过发送器实现，接收模块可以通过接收器实现，发送器和接收器可以是不同的功能模块，或者也可以是同一个功能模块，但能够实现不同的功能。如果第一通信装置为通信设备，收发器例如通过通信设备中的天线、馈线和编解码器等实现。或者，如果第一通信装置为设置在通信设备中的芯片，那么收发器(或，发送器和接收器)例如为芯片中的通信接口，该通信接口与通信设备中的射频收发组件连接，以通过射频收发组件实现信息的收发。在第七方面的介绍过程中，继续以所述第一通信装置是第一移动性管理网元，以及，以所述处理模块和所述收发模块为例进行介绍。其中，
所述处理模块，用于根据第一条件确定终端设备不再接入第一网络切片或第二网络切片，其中，所述第一网络切片需要执行NSSAA流程，所述第二网络切片与所述第一网络切片具有映射关系；
所述收发模块，用于向认证网元发送第一信息，所述第一信息用于指示所述终端设备不再接入所述第一网络切片。
在一种可选的实施方式中，所述收发模块，还用于接收来自所述认证网元的订阅请求消息，所述订阅请求消息包括所述终端设备的标识和所述第一网络切片的标识，所述订阅请求消息用于订阅所述终端设备不再接入所述第一网络切片的事件。
在一种可选的实施方式中，所述收发模块，还用于接收来自所述认证网元的第二消息，所述第二消息用于对所述第一网络切片再次执行NSSAA流程，或用于拒绝所述终端设备接入所述第一网络切片。
在一种可选的实施方式中，所述第一移动性管理网元为所述终端设备在进行切换后接入的移动性管理网元且所述第一移动性管理网元不支持NSSAA流程，第二移动性管理网元为所述终端设备在进行切换前接入的移动性管理网元，所述收发模块，还用于接收来自所述第二移动性管理网元的所述终端设备的上下文，其中，所述终端设备的上下文包括所述认证网元订阅了所述终端设备不再接入所述第一网络切片的事件的信息。
在一种可选的实施方式中，所述第一条件包括：
所述终端设备允许接入的NSSAI发生改变，
其中，改变前的允许接入的NSSAI包括所述第一网络切片的标识，改变后的允许接入的NSSAI不包括所述第一网络切片的标识；或者，改变前的允许接入的NSSAI包括所述第二网络切片的标识，改变后的允许接入的NSSAI不包括所述第二网络切片的标识。
在一种可选的实施方式中，所述第一条件包括：所述终端设备从网络去注册。
在一种可选的实施方式中，所述第一条件包括：所述终端设备从第一网络移动到第二网络。
在一种可选的实施方式中，所述收发模块用于通过如下方式向认证网元发送第一信息：向认证网元发送第一消息，其中，所述第一消息包括所述第一信息，所述第一消息还包括所述终端设备的标识和所述第一网络切片的标识。
在一种可选的实施方式中，
所述收发模块，还用于接收来自所述终端设备的注册请求消息，所述注册请求消息包 括用于指示所述终端设备不支持所述NSSAA流程的信息，和/或，所述注册请求消息所携带的请求接入NSSAI不包括所述第一网络切片的标识；
所述处理模块，还用于根据所述注册请求消息确定所述改变后的允许接入的NSSAI。
在一种可选的实施方式中，所述处理模块，还用于删除所述第一网络切片执行所述NSSAA流程的鉴权结果。
关于第七方面或各种可选的实施方式所带来的技术效果，可参考对于第一方面或相应的实施方式的技术效果的介绍。
第八方面，提供一种通信装置，所述通信装置(可称为第二信装置)用于执行上述第二方面或任一可能的实施方式中的方法。具体地，所述第二通信装置可以包括用于执行第二方面或任一可能的实施方式中的方法的模块，例如包括处理模块和收发模块。示例性地，收发模块可以包括发送模块和接收模块，发送模块和接收模块可以是不同的功能模块，或者也可以是同一个功能模块，但能够实现不同的功能。示例性地，所述第二通信装置为通信设备，或者为设置在通信设备中的芯片或其他部件。示例性地，所述通信设备为核心网设备。下面以第一通信装置是核心网设备为例。示例性地，所述核心网设备为第一移动性管理网元。示例性地，第一移动性管理网元为AMF。例如，所述收发模块也可以通过收发器实现，所述处理模块也可以通过处理器实现。或者，发送模块可以通过发送器实现，接收模块可以通过接收器实现，发送器和接收器可以是不同的功能模块，或者也可以是同一个功能模块，但能够实现不同的功能。如果第二通信装置为通信设备，收发器例如通过通信设备中的天线、馈线和编解码器等实现。或者，如果第二通信装置为设置在通信设备中的芯片，那么收发器(或，发送器和接收器)例如为芯片中的通信接口，该通信接口与通信设备中的射频收发组件连接，以通过射频收发组件实现信息的收发。在第八方面的介绍过程中，继续以所述第二通信装置是第一移动性管理网元，以及，以所述处理模块和所述收发模块为例进行介绍。其中，
所述处理模块，用于根据第一条件确定终端设备不再接入第一网络切片或第二网络切片，其中，所述第一网络切片需要执行NSSAA流程，所述第二网络切片与所述第一网络切片具有映射关系；
所述收发模块，用于向认证网元发送第一信息，所述第一信息用于指示所述第一移动性管理网元取消向所述认证网元订阅第一通知，其中，所述第一通知包括对所述第一网络切片执行重鉴权的通知或者对所述第一网络切片执行撤销授权的通知。
在一种可选的实施方式中，所述第一条件包括：
所述终端设备允许接入的NSSAI发生改变，
其中，改变前的允许接入的NSSAI包括所述第一网络切片的标识，改变后的允许接入的NSSAI不包括所述第一网络切片的标识；或者，改变前的允许接入的NSSAI包括所述第二网络切片的标识，改变后的允许接入的NSSAI不包括所述第二网络切片的标识。
在一种可选的实施方式中，所述第一条件包括：所述终端设备从网络去注册。
在一种可选的实施方式中，所述第一条件包括：所述终端设备从第一网络移动到第二网络。
在一种可选的实施方式中，所述收发模块用于通过如下方式向认证网元发送第一信息：
向认证网元发送第一消息，其中，所述第一消息包括所述第一信息，所述第一消息还包括所述终端设备的标识和所述第一网络切片的标识。
在一种可选的实施方式中，
所述收发模块，还用于接收来自所述终端设备的注册请求消息，所述注册请求消息包括用于指示所述终端设备不支持所述NSSAA流程的信息，和/或，所述注册请求消息所携带的请求接入NSSAI不包括所述第一网络切片的标识；
所述处理模块，还用于根据所述注册请求消息确定所述改变后的允许接入的NSSAI。
在一种可选的实施方式中，所述处理模块，还用于删除所述第一网络切片执行所述NSSAA流程的鉴权结果。
关于第八方面或各种可选的实施方式所带来的技术效果，可参考对于第二方面或相应的实施方式的技术效果的介绍。
第九方面，提供一种通信装置，所述通信装置(可称为第三通信装置)用于执行上述第三方面或任一可能的实施方式中的方法。具体地，所述第三通信装置可以包括用于执行第三方面或任一可能的实施方式中的方法的模块，例如包括处理模块和收发模块。示例性地，收发模块可以包括发送模块和接收模块，发送模块和接收模块可以是不同的功能模块，或者也可以是同一个功能模块，但能够实现不同的功能。示例性地，所述第三通信装置为通信设备，或者为设置在通信设备中的芯片或其他部件。示例性地，所述通信设备为核心网设备。下面以第一通信装置是核心网设备为例。示例性地，所述核心网设备为认证网元。示例性地，认证网元为AAA-S。例如，所述收发模块也可以通过收发器实现，所述处理模块也可以通过处理器实现。或者，发送模块可以通过发送器实现，接收模块可以通过接收器实现，发送器和接收器可以是不同的功能模块，或者也可以是同一个功能模块，但能够实现不同的功能。如果第三通信装置为通信设备，收发器例如通过通信设备中的天线、馈线和编解码器等实现。或者，如果第三通信装置为设置在通信设备中的芯片，那么收发器(或，发送器和接收器)例如为芯片中的通信接口，该通信接口与通信设备中的射频收发组件连接，以通过射频收发组件实现信息的收发。在第九方面的介绍过程中，继续以所述第三通信装置是认证网元，以及，以所述处理模块和所述收发模块为例进行介绍。其中，
所述处理模块，用于对第一网络切片执行NSSAA流程；
所述收发模块，用于接收来自第一移动性管理网元的第一信息，所述第一信息用于指示终端设备不再接入所述第一网络切片。
在一种可选的实施方式中，所述收发模块，还用于向所述第一移动性管理网元发送订阅请求消息，所述订阅请求消息包括所述终端设备的标识和第一网络切片的标识，所述订阅请求消息用于订阅所述终端设备不再接入所述第一网络切片的事件。
在一种可选的实施方式中，所述收发模块，还用于向所述第一移动性管理网元发送第二消息，所述第二消息用于对所述第一网络切片再次执行NSSAA流程，或用于拒绝所述终端设备接入所述第一网络切片。
在一种可选的实施方式中，所述处理模块，还用于删除所述第一网络切片执行所述NSSAA流程的鉴权结果。
在一种可选的实施方式中，所述收发模块用于通过如下方式接收来自第一移动性管理网元的第一信息：
接收来自所述第一移动性管理网元的第一消息，所述第一消息包括所述第一信息，所述第一消息还包括所述终端设备的标识和所述第一网络切片的标识。
关于第九方面或各种可选的实施方式所带来的技术效果，可参考对于第三方面或相应 的实施方式的技术效果的介绍。
第十方面，提供一种通信装置，所述通信装置(可称为第四通信装置)用于执行上述第四方面或任一可能的实施方式中的方法。具体地，所述第四通信装置可以包括用于执行第四方面或任一可能的实施方式中的方法的模块，例如包括处理模块和收发模块。示例性地，收发模块可以包括发送模块和接收模块，发送模块和接收模块可以是不同的功能模块，或者也可以是同一个功能模块，但能够实现不同的功能。示例性地，所述第四通信装置为通信设备，或者为设置在通信设备中的芯片或其他部件。示例性地，所述通信设备为核心网设备。下面以第一通信装置是核心网设备为例。示例性地，所述核心网设备为认证网元。示例性地，认证网元为AAA-S。例如，所述收发模块也可以通过收发器实现，所述处理模块也可以通过处理器实现。或者，发送模块可以通过发送器实现，接收模块可以通过接收器实现，发送器和接收器可以是不同的功能模块，或者也可以是同一个功能模块，但能够实现不同的功能。如果第四通信装置为通信设备，收发器例如通过通信设备中的天线、馈线和编解码器等实现。或者，如果第四通信装置为设置在通信设备中的芯片，那么收发器(或，发送器和接收器)例如为芯片中的通信接口，该通信接口与通信设备中的射频收发组件连接，以通过射频收发组件实现信息的收发。在第十方面的介绍过程中，继续以所述第四通信装置是认证网元，以及，以所述处理模块和所述收发模块为例进行介绍。其中，
所述处理模块，用于对第一网络切片执行NSSAA流程；
所述收发模块，用于接收来自第一移动性管理网元的第一信息，所述第一信息用于指示所述第一移动性管理网元取消向所述认证网元订阅第一通知，其中，所述第一通知包括对所述第一网络切片执行重鉴权的通知或者对所述第一网络切片执行撤销授权的通知。
在一种可选的实施方式中，所述处理模块，还用于删除所述第一网络切片执行所述NSSAA流程的鉴权结果。
在一种可选的实施方式中，所述收发模块用于通过如下方式接收来自第一移动性管理网元的第一信息：
接收来自所述第一移动性管理网元的第一消息，所述第一消息包括所述第一信息，所述第一消息还包括所述终端设备的标识和所述第一网络切片的标识。
关于第十方面或各种可选的实施方式所带来的技术效果，可参考对于第四方面或相应的实施方式的技术效果的介绍。
第十一方面，提供一种通信装置，所述通信装置(可称为第五通信装置)用于执行上述第五方面或任一可能的实施方式中的方法。具体地，所述第五通信装置可以包括用于执行第五方面或任一可能的实施方式中的方法的模块，例如包括处理模块和收发模块。示例性地，收发模块可以包括发送模块和接收模块，发送模块和接收模块可以是不同的功能模块，或者也可以是同一个功能模块，但能够实现不同的功能。示例性地，所述第五通信装置为通信设备，或者为设置在通信设备中的芯片或其他部件。示例性地，所述通信设备为核心网设备。下面以第一通信装置是核心网设备为例。示例性地，所述核心网设备为移动性管理网元(或者，称为第二移动性管理网元)。示例性地，移动性管理网元为AMF。例如，所述收发模块也可以通过收发器实现，所述处理模块也可以通过处理器实现。或者，发送模块可以通过发送器实现，接收模块可以通过接收器实现，发送器和接收器可以是不同的功能模块，或者也可以是同一个功能模块，但能够实现不同的功能。如果第五通信装置为通信设备，收发器例如通过通信设备中的天线、馈线和编解码器等实现。或者，如果 第五通信装置为设置在通信设备中的芯片，那么收发器(或，发送器和接收器)例如为芯片中的通信接口，该通信接口与通信设备中的射频收发组件连接，以通过射频收发组件实现信息的收发。在第十一方面的介绍过程中，继续以所述第五通信装置是移动性管理网元，以及，以所述处理模块和所述收发模块为例进行介绍。其中，
所述处理模块，用于确定终端设备建立与第一网络切片关联的第一会话，所述第一网络切片为曾成功执行了NSSAA流程的网络切片；
所述收发模块，用于接收来自第一接入网网元的切换请求消息，所述切换请求消息用于指示所述终端设备要从所述第一接入网网元切换到第二接入网网元；
所述收发模块，还用于向存储功能网元发送请求消息，所述请求消息用于请求提供能够服务于所述第二接入网网元且能够支持NSSAA流程的移动性管理网元。
在一种可选的实施方式中，所述收发模块，还用于接收来自所述存储功能网元的第三消息，所述第三消息包括目标移动性管理网元的标识。
关于第十一方面或各种可选的实施方式所带来的技术效果，可参考对于第五方面或相应的实施方式的技术效果的介绍。
第十二方面，提供一种通信装置，所述通信装置(可称为第六通信装置)用于执行上述第六方面或任一可能的实施方式中的方法。具体地，所述第六通信装置可以包括用于执行第六方面或任一可能的实施方式中的方法的模块，例如包括处理模块和收发模块。示例性地，收发模块可以包括发送模块和接收模块，发送模块和接收模块可以是不同的功能模块，或者也可以是同一个功能模块，但能够实现不同的功能。示例性地，所述第六通信装置为通信设备，或者为设置在通信设备中的芯片或其他部件。示例性地，所述通信设备为核心网设备。下面以第一通信装置是核心网设备为例。示例性地，所述核心网设备为第二移动性管理网元。示例性地，第二移动性管理网元为AMF。例如，所述收发模块也可以通过收发器实现，所述处理模块也可以通过处理器实现。或者，发送模块可以通过发送器实现，接收模块可以通过接收器实现，发送器和接收器可以是不同的功能模块，或者也可以是同一个功能模块，但能够实现不同的功能。如果第六通信装置为通信设备，收发器例如通过通信设备中的天线、馈线和编解码器等实现。或者，如果第六通信装置为设置在通信设备中的芯片，那么收发器(或，发送器和接收器)例如为芯片中的通信接口，该通信接口与通信设备中的射频收发组件连接，以通过射频收发组件实现信息的收发。在第十二方面的介绍过程中，继续以所述第六通信装置是第二移动性管理网元，以及，以所述处理模块和所述收发模块为例进行介绍。其中，
所述处理模块，用于确定终端设备建立与第一网络切片关联的第一会话，所述第一网络切片为曾成功执行了NSSAA流程的网络切片；
所述收发模块，用于接收来自第一接入网网元的切换请求消息，所述切换请求消息用于指示所述终端设备要从所述第一接入网网元切换到第二接入网网元；
所述处理模块，还用于获取第一移动性管理网元的信息，所述第一移动性管理网元不支持NSSAA流程；
所述收发模块，还用于向所述第一移动性管理网元发送所述终端设备的上下文，所述终端设备的上下文不包括所述第一会话的信息。
在一种可选的实施方式中，所述收发模块还用于：
向存储功能网元发送请求消息，所述请求消息用于请求提供能够服务于所述第二接入 网网元且能够支持NSSAA流程的移动性管理网元；
接收来自所述存储功能网元的第三消息，所述第三消息用于指示没有符合要求的移动性管理网元。
在一种可选的实施方式中，所述收发模块，还用于接收来自认证网元的订阅请求消息，所述订阅请求消息包括所述终端设备的标识和所述第一网络切片的标识，所述订阅请求消息用于订阅所述终端设备不再接入所述第一网络切片的通知。
在一种可选的实施方式中，所述终端设备的上下文包括所述终端设备在切换前允许接入的NSSAI，其中，所述允许接入的NSSAI包括所述第一网络切片的标识，所述终端设备的上下文还包括所述认证网元订阅了所述终端设备不再接入所述第一网络切片的通知的信息。
在一种可选的实施方式中，所述收发模块，还用于向服务于所述第一会话的第一会话管理网元发送第五消息，所述第五消息用于触发所述第一会话管理网元释放所述第一会话。
关于第十二方面或各种可选的实施方式所带来的技术效果，可参考对于第六方面或相应的实施方式的技术效果的介绍。
第十三方面，提供一种通信装置，该通信装置例如为如前所述的第一通信装置、第二通信装置、第三通信装置、第四通信装置、第五通信装置、或第六通信装置。该通信装置包括处理器和通信接口，通信接口可用于与其他装置或设备进行通信。可选的，还可以包括存储器，用于存储计算机指令。处理器和存储器相互耦合，用于实现上述方面或各种可能的实施方式所描述的方法。或者，通信装置也可以不包括存储器，存储器可以位于第一通信装置外部。处理器、存储器和通信接口相互耦合，用于实现上述方面或各种可能的实施方式所描述的方法。例如，当处理器执行所述存储器存储的计算机指令时，使第一通信装置执行上述方面或任意一种可能的实施方式中的方法。示例性地，所述通信装置为通信设备，或者为设置在通信设备中的芯片或其他部件。
其中，如果通信装置为通信设备，通信接口例如通过所述通信设备中的收发器(或者，发送器和接收器)实现，例如所述收发器通过所述通信设备中的天线、馈线和编解码器等实现。或者，如果通信装置为设置在通信设备中的芯片，那么通信接口例如为芯片的输入/输出接口，例如输入/输出管脚等，该通信接口与通信设备中的射频收发组件连接，以通过射频收发组件实现信息的收发。
第十四方面，提供第一通信系统，该通信系统包括第七方面所述的通信装置，以及第九方面所述的通信装置。
第十五方面，提供第二通信系统，该通信系统包括第八方面所述的通信装置，以及第十方面所述的通信装置。
第十六方面，提供一种计算机可读存储介质，所述计算机可读存储介质用于存储计算机程序，当所述计算机程序在计算机上运行时，使得所述计算机执行上述任意方面或任意一种可能的实施方式中所述的方法。
第十七方面，提供一种包含指令的计算机程序产品，所述计算机程序产品用于存储计算机程序，当所述计算机程序在计算机上运行时，使得所述计算机执行上述任意方面或的任意一种可能的实施方式中所述的方法。
在本申请实施例中，如果第一移动性管理网元确定终端设备不再接入第一网络切片或第二网络切片，那么第一移动性管理网元可以告知认证网元，从而认证网元后续不必再对 该终端设备发起针对第一网络切片的重鉴权和重授权流程或撤销授权流程等，从而能够节省核心网的信令开销。
附图说明
图1为基于服务化架构的5G网络架构示意图；
图2为基于点对点接口的5G网络架构示意图；
图3为网络切片的一种示意图；
图4为终端设备的注册流程的示意图；
图5为确定是否要执行NSSAA流程的示意图；
图6为NSSAA流程所涉及的步骤的流程图；
图7为本申请实施例提供的第一种通信方法的流程图；
图8为本申请实施例提供的第二种通信方法的流程图；
图9为本申请实施例提供的第三种通信方法的流程图；
图10为本申请实施例提供的第四种通信方法的流程图；
图11为本申请实施例提供的一种第一移动性管理网元的示意性框图；
图12为本申请实施例提供的一种认证网元的示意性框图；
图13为本申请实施例提供的一种移动性管理网元的示意性框图；
图14为本申请实施例提供的一种通信装置的示意性框图。
具体实施方式
为了使本申请实施例的目的、技术方案和优点更加清楚，下面将结合附图对本申请实施例作进一步地详细描述。
以下，对本申请实施例中的部分用语进行解释说明，以便于本领域技术人员理解。
1)终端设备，包括向用户提供语音和/或数据连通性的设备，具体的，包括向用户提供语音的设备，或包括向用户提供数据连通性的设备，或包括向用户提供语音和数据连通性的设备。例如可以包括具有无线连接功能的手持式设备、或连接到无线调制解调器的处理设备。该终端设备可以经无线接入网(radio access network，RAN)与核心网进行通信，与RAN交换语音或数据，或与RAN交互语音和数据。该终端设备可以包括用户设备(user equipment，UE)、无线终端设备、移动终端设备、设备到设备通信(device-to-device，D2D)终端设备、车到一切(vehicle to everything，V2X)终端设备、机器到机器/机器类通信(machine-to-machine/machine-type communications，M2M/MTC)终端设备、物联网(internet of things，IoT)终端设备、签约单元(subscriber unit)、签约站(subscriber station)，移动站(mobile station)、远程站(remote station)、接入点(access point，AP)、远程终端(remote terminal)、接入终端(access terminal)、用户终端(user terminal)、用户代理(user agent)、或用户装备(user device)等。例如，可以包括移动电话(或称为“蜂窝”电话)，具有移动终端设备的计算机，便携式、袖珍式、手持式、计算机内置的移动装置等。例如，个人通信业务(personal communication service，PCS)电话、无绳电话、会话发起协议(session initiation protocol，SIP)话机、无线本地环路(wireless local loop，WLL)站、个人数字助理(personal digital assistant，PDA)、等设备。还包括受限设备，例如功耗较低的设备，或 存储能力有限的设备，或计算能力有限的设备等。例如包括条码、射频识别(radio frequency identification，RFID)、传感器、全球定位系统(global positioning system，GPS)、激光扫描器等信息传感设备。
作为示例而非限定，在本申请实施例中，该终端设备还可以是可穿戴设备。可穿戴设备也可以称为穿戴式智能设备或智能穿戴式设备等，是应用穿戴式技术对日常穿戴进行智能化设计、开发出可以穿戴的设备的总称，如眼镜、手套、手表、服饰及鞋等。可穿戴设备即直接穿在身上，或是整合到用户的衣服或配件的一种便携式设备。可穿戴设备不仅仅是一种硬件设备，更是通过软件支持以及数据交互、云端交互来实现强大的功能。广义穿戴式智能设备包括功能全、尺寸大、可不依赖智能手机实现完整或者部分的功能，例如：智能手表或智能眼镜等，以及只专注于某一类应用功能，需要和其它设备如智能手机配合使用，如各类进行体征监测的智能手环、智能头盔、智能首饰等。
而如上介绍的各种终端设备，如果位于车辆上(例如放置在车辆内或安装在车辆内)，都可以认为是车载终端设备，车载终端设备例如也称为车载单元(on-board unit，OBU)。
本申请实施例中，终端设备还可以包括中继(relay)。或者理解为，能够与基站进行数据通信的都可以看作终端设备。
本申请实施例中，用于实现终端设备的功能的装置可以是终端设备，也可以是能够支持终端设备实现该功能的装置，例如芯片系统，该装置可以被安装在终端设备中。本申请实施例中，芯片系统可以由芯片构成，也可以包括芯片和其他分立器件。本申请实施例提供的技术方案中，以用于实现终端的功能的装置是终端设备为例，描述本申请实施例提供的技术方案。
2)网元，或称为网络设备，例如包括接入网网元，或称为接入网设备，例如基站(例如，接入点)等。
其中，基站可以是指接入网中在空中接口上通过一个或多个小区与无线终端装置通信的设备。网元可用于将收到的空中帧与网络之间互连的协议(internet protocol，IP)分组进行相互转换，作为终端装置与接入网的其余部分之间的路由器，其中接入网的其余部分可包括IP网络。网元还可协调对空中接口的属性管理。例如，网元可以包括长期演进(long term evolution，LTE)系统或演进的LTE系统(LTE-Advanced，LTE-A)中的演进型基站(NodeB或eNB或e-NodeB，evolutional Node B)，或者也可以包括第五代移动通信技术(fifth generation，5G)新无线(new radio，NR)系统中的下一代节点B(next generation node B，gNB)或者也可以包括云接入网(cloud radio access network，CloudRAN)系统中的集中式单元(centralized unit，CU)和分布式单元(distributed unit，DU)，本申请实施例并不限定。在本申请实施例中，网元还包括核心网网元，或称为核心网设备。在第四代移动通信技术(4G)系统中，核心网设备例如包括移动管理实体(mobility management entity，MME)等，在5G系统中，核心网设备例如包括用户面功能网元、网络存储功能(Network repository function，NRF)网元、接入和移动性管理功能(access and mobility management function，AMF)网元、AAA服务器(server，S)或会话管理功能(session management function，SMF)网元等。可以认为，从4G演进到5G后，MME的功能分离到AMF网元和SMF网元中，其中，AMF网元用于管理用户的移动上下文，SMF网元用于管理会话上下文。
用户面功能网元，在第四代移动通信技术(4G)系统中例如包括服务网关(serving gateway，SGW)和分组数据网络网关(packet data network gateway，PDN-GW)，在5G系 统中例如包括UPF网元，主要负责连接外部网络。可以认为，5G系统中的UPF网元相当于4G的LTE系统中的SGW和PDN-GW的合体。
3)本申请实施例中的术语“系统”和“网络”可被互换使用。“至少一个”是指一个或者多个，“多个”是指两个或两个以上。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B的情况，其中A,B可以是单数或者复数。字符“/”一般表示前后关联对象是一种“或”的关系。“以下至少一项(个)”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a,b,或c中的至少一项(个)，可以表示：a,b,c,a-b,a-c,b-c,或a-b-c，其中a,b,c可以是单个，也可以是多个。
以及，除非有相反的说明，本申请实施例提及“第一”、“第二”等序数词是用于对多个对象进行区分，不用于限定多个对象的大小、内容、顺序、时序、优先级或者重要程度等。例如，第一消息和第二消息，只是为了区分不同的消息，而并不是表示这两个消息的大小、内容、发送顺序、优先级或者重要程度等的不同。
需要说明的是，本申请实施例所涉及的认证网元、存储功能网元和移动性管理网元等，以及进一步的AAA-S、NRF和AMF等，仅是一个名字，名字对设备本身不构成限定。在5G系统以及未来其它的通信系统中，认证网元、存储功能网元和移动性管理网元等，以及进一步的AAA-S、NRF和AMF等，也可以是其他的名字，本申请实施例对此不作具体限定。
请参考图1，为基于服务化架构的5G网络架构示意图，也是本申请实施例的一种应用场景的示意图。图1所示的5G网络架构可包括三部分，分别是终端设备部分、数据网络(data network，DN)部分和运营商网络部分。其中，运营商网络部分可包括以下网元中的一个或多个：鉴权服务器功能(authentication server function，AUSF)网元、网络开放功能(network exposure function，NEF)网元、策略控制功能(policy control function，PCF)网元、统一数据管理(unified data management，UDM)网元、统一数据库(Unified Data Repository，UDR)网元、NRF网元、应用功能(application function，AF)网元、AMF网元、SMF网元、无线接入网(radio access network，RAN)网元以及用户面功能(user plane function，UPF)网元等。上述运营商网络部分中，除无线接入网部分之外的部分可以称为核心网部分。
在该网络架构中，网络切片选择功能(network slice selection function，NSSF)网元、网络开放功能(network exposure function，NEF)网元、NRF网元、策略控制功能(policy control function，PCF)网元、统一数据管理(unified data management，UDM)网元、应用功能(application function，AF)网元、鉴权服务功能(authentication server function，AUSF)网元、AMF网元和SMF网元，这些网元两两之间，都可以基于服务的方法进行通信，当然，其中的两个网元要进行通信，需要一个网元向另一个网元开放了相应的服务方法。图1中，Nnssf可视为NSSF的服务接口，同理，Nnef为NEF的服务接口，Npcf为PCF的服务接口，Nudm为UDM的服务接口，Uudr为UDR的服务接口，Naf为AF的服务接口，Nausf为AUSF的服务接口，Namf为AMF的服务接口，Nsmf为SMF的服务接口。另外，AMF与终端设备可通过N1接口通信，AMF与(R)AN可通过N2接口通信，SMF与UPF可通过N4接口通信，终端设备与(R)AN之间进行空口通信，(R)AN和UPF可通过N3接口通信，UPF与DN可通过N6接口通信。
为了更易于理解，下面对图1所示的部分功能网元进行简单的介绍。
移动性管理功能网元，在4G系统中例如为MME网元，在5G系统中例如为AMF网元，当然本申请实施例不限于此，在其他通信系统中也可以通过其他网元实现，例如在未来通信系统中可以是具有上述AMF网元的功能的网元。以移动性管理功能网元是AMF网元为例，AMF网元主要负责与无线对接，终结RAN控制面(control plane，CP)接口，也就是N2接口，终结非接入层(non-access-stratum，NAS)及NAS加密和完整性保护，注册管理，连接管理，可达性管理，移动性管理，传递用户设备(user equipment，UE)和SMF间的会话管理(session management，SM)消息，或UE的移动性通知等功能。
存储功能网元，在5G系统中，例如为NRF网元，在其他通信系统中也可以通过其他网元实现，例如在未来通信系统中可以是具有上述NRF网元的功能的网元。以存储功能网元是NRF网元为例，NRF网元可负责网元的注册和发现功能，并维护网元的信息，例如，维护该网元的实例标识、类型、公共陆地移动网(public land mobile network，PLMN)、网络切片相关的标识、IP地址、该网元的能力、及支持的服务等。
认证授权计费功能网元，在5G系统中例如为AAA-S，在其他通信系统中也可以通过其他网元实现，例如在未来通信系统中可以是具有上述AAA-S的功能的网元。以认证授权计费功能网元是AAA-S为例，AAA-S的主要目的是管理哪些用户可以访问网络服务器，具有访问权的用户可以得到哪些服务，以及如何对正在使用网络资源的用户进行计费处理等。AAA-S在图1中并未画出，其中AAA-S可以与AUSF直接通信，或者AAA-S通过AAA-代理(proxy，P)与AUSF进行通信。AAA-S可以由运营商部署或者由第三方部署。在漫游场景中，AAA-S位于归属地PLMN(home PLMN，HPLMN)。
NSSF网元，负责确定网络切片实例，选择AMF网元等。
SMF网元，可以提供会话建立、修改或释放等会话管理功能，包含UPF网元和接入网(access network，AN)节点间的隧道维护功能、UE的互联网协议(internet protocol，IP)地址分配和管理、动态主机控制协议(dynamic host control protocol，DHCP)、选择和控制用户面(user plane，UP)功能、配置UPF路由功能、终结策略控制功能接口、计费、漫游功能、或策略控制相关等功能。
PCF网元，包含策略控制决策和基于流计费控制的功能，包含用户签约数据管理功能，策略控制功能，计费策略控制功能，服务质量(quality of service，QoS)控制等等；
UDM网元，负责管理签约数据，当签约数据有修改时，负责通知相应的网元。
UDR网元，存储和检索签约数据、策略数据和公共架构数据等，供UDM网元、PCF网元或NEF网元获取相关数据。UDR网元要能够针对不同类型的数据如签约数据、策略数据有不同的数据接入鉴权机制，以保证数据接入的安全性。UDR网元对于非法的服务化操作或者数据接入请求要能够返回携带合适原因值的失败响应。
AF网元，应用服务器，向终端设备提供某种应用层服务。AF网元在向终端设备提供服务时，对QoS策略(policy)和计费(charging)策略有一定要求，且需要通知网络。同时，AF网元也需要核心网反馈应用的相关信息。
NEF网元，主要支持网络能力开放功能，对外开放网络能力和服务。3GPP NF通过NEF网元向其他NF发布功能和事件。NEF网元开放的能力和事件可以安全地开放给第三方应用。NEF网元使用UDR的标准化接口(Nudr)将结构化数据进行存储/检索。将AF网元的交换信息与内部网络功能的交换信息进行翻译。例如，它将在AF-服务(Service)- 标识符(Identifier)和内部5G核心信息(如数据网络名称(data network name，DNN)或S-NSSAI等)之间进行转换。
AUSF网元，负责鉴权功能以及负责执行网络切片鉴权授权流程。
UPF网元，是用户面数据转发的实体，作为数据网络互联的外部协议数据单元(protocol data unit，PDU)会话(session)，具有报文路由和转发、报文检测、用户面部分策略执行、合法监听、流量使用报告、或QoS处理等功能。
本申请实施例所述的移动性管理网元可以是图1所示的AMF网元，也可以是未来通信系统中的具有上述AMF网元的功能的网元。本申请实施例所述的认证网元可以是前文所述的AAA-S或者AUSF，也可以是未来通信系统中的具有上述AAA-S的功能的网元或者具有上述AUSF的功能的网元。本申请实施例所述的网络存储网元可以是图1所示的NRF网元，也可以是未来通信系统中的具有上述NRF网元的功能的网元。本申请实施例所述的接入网网元可以是图1所示的RAN网元，也可以是未来通信系统中的具有上述RAN网元的功能的网元。
为使得行文更简洁，在后文中对于各个网元均使用简称，省掉“网元”两个字。例如，将AMF网元简称为AMF，NRF网元简称为NRF，接入网网元简称为RAN，SMF网元简称为SMF，等等。
另外，在介绍图1所示的网络架构时提到了服务方法的概念，具体的，在5G系统中，目前认为控制面的网元之间，可以通过基于服务的方法进行交互，用户面的网元之间，可以基于点对点的方法进行交互。例如在5G系统中，NRF作为控制面的网元，可以开放一些服务方法，其他设备可以通过这些服务方法来与NRF进行交互。
请再参考图2，为基于点对点接口的5G网络架构示意图，也是本申请实施例的另一种应用场景的示意图。图2中的各个网元的功能介绍等可以参考对于图1中对应的网元的介绍，不再赘述。图1与图2的主要区别在于，图2中的各个网元之间的接口是点对点的接口，而图1中的各个网元之间的接口是服务化的接口。
需要说明的是，本申请实施例中，“网络切片”和“切片”是同一概念，指的是同一内容，在不同的地方使用其中一种描述，二者可以互换。
如上介绍了本申请实施例涉及的一些基本概念，以及5G网络架构等内容。接下来，介绍本申请实施例的技术特征。
在5G时代，将有数以千亿计的物联网设备接入网络，不同类型的应用场景对网络的需求是差异化的，有的甚至是相互冲突的。通过单一网络同时为不同类型的应用场景提供服务，会导致网络架构异常复杂、网络管理效率和资源利用效率低下。为此提出了网络切片技术，5G网络切片技术通过在同一网络基础设施上虚拟独立逻辑网络的方式为不同的应用场景提供相互隔离的网络环境，使得不同应用场景可以按照各自的需求定制网络功能和特性，能够切实保障不同业务的QoS需求。5G网络切片要实现的目标是将终端设备、接入网资源、核心网资源以及网络运维和管理系统等进行有机组合，为不同商业场景或者业务类型提供能够独立运维的、相互隔离的完整网络。可参考图3，为网络切片的一种示意图。图3包括三个网络切片，分别为关键(critical)机器类通信(machine type of communication，MTC)切片、海量(massive)MTC切片以及移动宽带(mobile broadband，MBB)切片。在图3中，critical MTC切片对应的终端设备可以包括车辆等；massive MTC切片对应的终端设备可以包括一些测量表等，例如电表或燃气表；MBB切片对应的终端设备可以包括手 机或个人计算机(personal computer，PC)等。
多种多样的场景对第三代合作伙伴计划(3rd generation partnership project，3GPP)生态系统提出了不同的需要：计费、策略、安全、移动性等。3GPP强调了网络切片之间不相互影响，例如突发的大量的抄表业务不应该影响正常的移动宽带业务。为了满足多样性需求和切片间的隔离，需要业务间相对独立的管理和运维，并提供量身定做的业务功能和分析能力。不同类型业务的实例部署在不同的网络切片上，相同业务类型的不同实例也可部署在不同的网络切片上。
当核心网部署了网络切片，在终端设备初始附着到网络时，就会触发网络切片的选择过程。网络切片的选择过程取决于用户的签约数据、本地配置信息、漫游协议、或运营商的策略等参数中的一种或多种，在网络切片的选择过程中，需要综合考虑以上参数，才能为终端设备选择最佳的切片类型。
当终端设备需要接入某个网络切片，终端设备可以提供请求(requested)网络切片选择辅助信息(network slice selection assistance information，NSSAI)给核心网设备，用于核心网设备为该终端设备选择网络切片实例。具体地，终端设备可以向核心网提供由一组参数组成的requested NSSAI，为该终端设备选择网络切片实例。这一组参数例如包括一个或多个S-NSSAI，其中的一个S-NSSAI就可以表示终端设备请求接入的一个网络切片。
在5G网络中，当终端设备需要使用网络服务，需要首先向网络进行注册。终端设备可能会在如下几种场景中发起注册流程：
(1)终端设备初次注册到5G网络；
(2)当终端设备移动出了原来注册的区域时，进行移动性注册更新；
(3)终端设备进行周期性注册更新。
在注册过程中，可能会触发一个或者多个PDU会话的建立。例如在终端设备进行移动性注册更新的场景下，终端设备有上行数据需要发送，此时在注册流程中会创建PDU会话。下面请参考图4，为终端设备进行注册的流程。
S401、终端设备向(R)AN发送注册请求(Registration Request)消息，(R)AN接收来自终端设备的注册请求消息。
该注册请求消息例如通过AN消息(message)发送至(R)AN。
S402、(R)AN根据无线接入技术(radio access technology，RAT)和注册请求消息所请求的网络切片的标识选择AMF。
如果注册请求消息未携带5G全球唯一UE临时标识(globally unique temporary UE identity，GUTI)，或者虽然注册请求消息携带了5G GUTI，但该5G GUTI不能指示一个合法的AMF，则(R)AN可以根据该终端设备支持的RAT和注册请求消息所请求的网络切片的标识选择AMF。或者，如果终端设备处于无线资源控制(radio resource control，RRC)连接(connected)态，则(R)AN可以根据已有的RRC连接，将该注册请求消息直接转发给对应的AMF，即，无需执行S402，而是可以执行S403。
网络切片的标识例如为S-NSSAI。注册请求消息可以携带一个或多个S-NSSAI，其中的一个S-NSSAI可以指示一个网络切片。这一个或多个S-NSSAI所指示的网络切片就是终端设备请求接入的网络切片。
S403、(R)AN将注册请求消息发送给AMF，AMF接收来自(R)AN的注册请求消息。
即，(R)AN将注册请求消息转发给AMF。注册请求消息例如为N2消息(message)。 在N2消息中，可以包括N2参数、注册消息、该终端设备的接入信息、PDU会话信息以及该终端设备的上下文请求等信息。
S404、新侧AMF调用服务化操作Namf_通信(Communication)_UE上下文(Context)传输(Transfer)向旧侧AMF发送消息，旧侧AMF接收来自新侧AMF的该消息。在图4中，将调用服务化操作Namf_Communication_UE Context Transfer传输的消息称为UE上下文传输消息。该消息用于获取该终端设备的上下文。
S404是可选的步骤，如果服务于该终端设备的AMF发生了改变，则可以执行S404。如果服务于该终端设备的AMF未发生改变，可以不必执行S404。
S405、旧侧AMF调用服务化操作Namf_Communication_UE Context Transfer响应(response)向新侧AMF发送消息，新侧AMF接收来自旧侧AMF的该消息。在图4中，将调用服务化操作Namf_Communication_UE Context Transferresponse传输的消息称为UE上下文传输响应消息。该消息包括该终端设备的上下文。
S404和S405是可选的步骤，如果服务于该终端设备的AMF发生了改变，则可以执行S404和S405。如果服务于该终端设备的AMF未发生改变，可以不必执行S404和S405。
S406、新侧AMF向终端设备发送身份请求(Identity Request)消息，终端设备接收来自新增AMF的身份请求消息。
如果终端设备未提供订阅隐藏标识(subscription concealed identifier，SUCI)，并且新侧AMF从旧侧AMF也未获取到SUCI，则新侧AMF可以向终端设备发送Identity Request消息，以从终端设备获取SUCI。
S407、终端设备向新侧AMF发送身份响应(Identity Response)消息，新侧AMF接收来自终端设备的Identity Response消息。该Identity Response消息包括SUCI。
S406和S407是可选的步骤。
S408、执行鉴权流程。该鉴权流程是UE永久标识的主鉴权流程。
例如，AMF根据SUPI或SUCI选择一个AUSF为终端设备进行鉴权。其中，在紧急注册时，AMF可跳过鉴权过程，即，S408也是可选的步骤。
S409、新侧AMF调用服务化操作Namf_Communication_注册完成通知(Registration Complete Notify)向旧侧AMF发送消息，旧侧AMF接收来自新侧AMF的该消息。
该消息用于通知旧侧AMF，终端设备已经在新侧AMF上完成注册。在图4中，将调用服务化操作Namf_Communication_Registration Complete Notify传输的消息称为注册完成消息。
S410、新侧AMF向终端设备发送身份请求(Identity Request)消息，终端设备接收来自新侧AMF的Identity Request消息。以及，终端设备向新侧AMF发送身份响应(Identity Response)消息，新侧AMF接收来自终端设备的Identity Response消息。
其中，如果新侧AMF从终端设备的上下文和旧侧AMF中都未获取到永久设备标识(permanent equipment identifier，PEI)，则新侧AMF向终端设备发送Identity Request消息以请求获取PEI。终端设备向新侧AMF回复Identity Response消息，Identity Response消息可携带PEI。
S411、新侧AMF调用服务化操作N5g-eir_设备身份验证(Equipment Identity Check)_获取(Get)向设备识别寄存器(equipment identity register，EIR)发送消息，EIR接收来自新侧AMF的该消息。该消息用于发起移动设备标识(mobile equipment identity，ME  identity)的核查。在图4中将调用服务化操作N5g-eir_Equipment Identity Check_Get传输的消息称为设备身份验证获取消息。
S412、新侧AMF基于SUPI选择UDM。该UDM可以选择一个UDR实例。
其中，S409～S412均为可选的步骤。
S413a、新侧AMF调用服务化操作Nudm_UECM_Registration向UDM进行注册，例如新侧AMF调用服务化操作Nudm_UECM_Registration向UDM发送消息，UDM接收来自新侧AMF的该消息，该消息用于新侧AMF注册到UDM。之后UDM向新侧AMF发送注册响应消息，即S413a中由UDM指向新侧AMF的箭头所表示的消息。在图4中，将调用服务化操作Nudm_UECM_Registration传输的消息称为注册消息。
S413b、新侧AMF调用服务化操作Nudm_SDM_Get向UDM发送消息，UDM接收来自新侧AMF的该消息，该消息用于请求获得终端设备的签约数据。之后UDM向新侧AMF发送获取响应消息，即S413b中由UDM指向新侧AMF的箭头所表示的消息，获取响应消息可以包括终端设备的签约数据。在图4中，将调用服务化操作Nudm_SDM_Get传输的消息称为签约数据获取消息。
S413c、新侧AMF调用服务化操作Nudm_SDM_订阅(Subscribe)向UDM发送消息，UDM接收来自AMF的该消息，该消息用于订阅签约数据变更通知的服务。在图4中，将调用服务化操作Nudm_SDM_Subscribe传输的消息称为签约数据变更订阅消息。之后，当订阅的签约数据发生变更时，UDM向新侧AMF发送订阅响应消息，即S413c中由UDM指向新侧AMF的箭头所表示的消息，订阅响应消息可以包括签约数据已变更的通知信息。
S413d、UDM调用服务化操作Nudm_UECM_去注册通知(Deregistration Notification)向旧侧AMF发送消息，旧侧AMF接收来自UDM的该消息，该消息可用于去注册。在图4中，将调用服务化操作Nudm_UECM_Deregistration Notification传输的消息称为去注册通知消息。
如果UDM存储了与旧侧AMF之间的联系，则UDM可以通过服务化操作Nudm_UECM_Deregistration Notification向旧侧AMF发送消息，以通知旧侧AMF删除该终端设备的上下文。旧侧AMF在接收该消息后，还可以向SMF发起服务化操作Nsmf_PDU Session_释放会话管理上下文(Release SM Context)，以通知SMF，该终端设备已经从网络中去注册。SMF收到该服务化操作Nsmf_PDU Session_Release SM Context的通知后，将释放PDU会话。
S413e、旧侧AMF调用服务化操作Nudm_SDM_去订阅(unsubscribe)向UDM发送消息，UDM接收来自旧侧AMF的该消息，该消息用去订阅，即，用于取消对该终端设备的签约数据的订阅。在图4中，将调用服务化操作Nudm_SDM_unsubscribe传输的消息称为去订阅消息。
其中，S413d和S413e是可选的步骤。
S414、新侧AMF选择PCF。
如果新侧AMF决定与PCF建立策略联系，例如当新侧AMF还没有获取到终端设备的接入和移动性策略，或者新侧AMF没有合法的接入和移动性策略等场景下，新侧AMF会选择PCF。此时，如果新侧AMF已从旧侧的AMF处获取了PCF身份号(ID)，则新侧AMF可以直接定位到该PCF，而无需执行S414。或者，如果新侧AMF已从旧侧的AMF处获取了PCF ID，但新侧AMF无法定位到该PCF ID所对应的PCF，或者新侧AMF没有 从旧侧AMF获取到PCF ID，则新侧AMF会选择一个新PCF，即，执行S414。因此，S414是可选的步骤。
S415、新侧AMF与选择的PCF建立AM策略关联。
在选择PCF后，新侧AMF与该PCF建立AM策略关联。S415是可选的步骤。
S416、新侧AMF调用服务化操作Nsmf_PDU Session_更新会话管理上下文请求(Update SM Context Request)向SMF发送消息，SMF接收来自新侧AMF的该消息。该消息可请求激活PDU会话的用户面连接。在图4中，将调用服务化操作Nsmf_PDU Session_Update SM Context Request传输的消息称为更新会话管理上下文请求消息。
若在注册请求消息中包含需要被激活的PDU会话，AMF通过服务化操作Nsmf_PDUSession_UpdateSMContext Request向SMF发送消息，该消息用于激活PDU会话的用户面连接。若PDU会话状态指示它在UE已经被释放，则AMF通知SMF释放PDU会话相关网络资源。若SMF订阅了UE相关的移动性事件通知，AMF根据需要向SMF发送通知。
S417、新侧AMF向(non-3GPP interworking function，N3IWF)发送N2AMF移动请求(N2 AMF Mobility Request)消息，N3IWF接收来自新侧AMF的N2 AMF Mobility Request消息。N2 AMF Mobility Request消息用于请求创建一个指向N3IWF的NG接口的UE连接。在图4中，将N2 AMF Mobility Request消息称为移动请求消息。
S418、N3IWF向新侧AMF发送N2AMF移动响应(N2 AMF Mobility Response)消息，新侧AMF接收来自N3IWF的N2 AMF Mobility Response消息。在图4中，将N2 AMF Mobility Response消息称为移动响应消息。
其中，如果旧侧AMF与N3IWF网元存在NG接口的UE连接，则新侧AMF会向N3IWF网元发送N2 AMF Mobility Request消息。而如果旧侧AMF与N3IWF网元不存在NG接口的UE连接，则新侧AMF不向N3IWF网元发送N2 AMF Mobility Request消息。因此，S417和S418是可选的步骤。
S419、旧侧AMF向PCF发送AMF-初始策略关联终止(Initiated Policy Association Termination)消息，PCF接收来自旧侧AMF的AMF-Initiated Policy Association Termination消息。AMF-Initiated Policy Association Termination消息用于删除旧侧AMF与PCF之间的连接。
其中，如果旧侧AMF之前发起了与PCF的策略联系，则旧侧AMF向PCF发送AMF-Initiated Policy Association Termination消息，而如果旧侧AMF之前未发起与PCF的策略联系，则旧侧AMF不必向PCF发送AMF-Initiated Policy Association Termination消息。因此S419为可选的步骤。
S420、新侧AMF向终端设备发送注册接受(Registration Accept)消息，终端设备接收来自新侧AMF的Registration Accept消息。Registration Accept消息用于通知终端设备，该终端设备的注册请求被接受。在Registration Accept消息中可包含局域数据网络(Local Area Data Network，LADN)信息以及仅移动初始化连接(mobile initiated connection only，MICO)模式等。
S421、终端设备向新侧AMF发送注册完成(Registration Complete)消息，新侧AMF接收来自终端设备的Registration Complete消息。
当Registration Accept消息包括网络切片订阅改变标识，终端设备成功更新该终端设 备时，或者当Registration Accept消息包括新的5G-GUTI时，终端设备可向新侧AMF发送Registration Complete消息。
S422、新侧AMF调用服务化操作Nudm_SDM_Info向UDM发送消息，UDM接收来自新侧AMF的该消息。在图4中，将调用服务化操作Nudm_SDM_Info传输的消息称为SDM信息消息。
如果在S413b中UDM发送给新侧AMF的签约数据中包含漫游信息标识，该标识是UDM所请求的收到UE信息的一个确认标识，则AMF向UDM发送Nudm_SDM_Info消息，以触发UDM进行相应操作。关于后续的步骤，可参考目前对于漫游场景的处理。
目前，当终端设备注册到网络中时，除了执行UE永久标识的主鉴权流程(即，图4所示的流程中的S408所表示的鉴权过程)之外，可能还会根据终端设备请求的请求NSSAI
(Requested NSSAI)以及终端设备的签约数据判断是否需要执行NSSAA流程，NSSAA流程也可以简单称为网络切片的二次鉴权流程。请参考图5，介绍如何确定是否要执行NSSAA流程。
S501、终端设备发起注册流程，例如S501表示为终端设备向AMF发送Registration Request消息，AMF接收来自终端设备的Registration Request消息。
Registration Request消息可以携带请求NSSAI(Requested NSSAI)和UE 5G移动性管理核心网能力(5GS mobility management core network capability，5GMM Core Network Capability)，其中UE 5GMM Core Network Capability指示该终端设备是否支持NSSAA流程。
S502、AMF执行UE永久标识的主鉴权流程，该流程例如称为安全流程PLMN接入(security procedures PLMN access)。当该流程成功之后，AMF向UDM获取UE的签约数据。其中，签约数据包含了该终端设备签约的每一个S-NSSAI是否需要执行NSSAA流程的指示信息。在图5中将S502表示为安全流程PLMN接入(security procedures PLMN access)，其中AMF是认证方(authenticator)，AUSF是认证服务器(auth server)。
例如终端设备签约的S-NSSAI可参考表1：
表1
Figure PCTCN2021081876-appb-000001
S503、AMF根据终端设备的签约数据判断需要执行NSSAA流程的S-NSSAI是否包含在Requested NSSAI中。
需要注意的是，AMF确定请求的NSSAI中的S-NSSAI需要执行NSSAA，可以有两种含义：
第一种：如果终端设备在Registration Request消息中指示支持NSSAA流程，那么进一步地，AMF根据终端设备的签约数据判断需要执行NSSAA流程的S-NSSAI是否包含在Requested NSSAI中。如果需要执行NSSAA流程的S-NSSAI包含在Requested NSSAI中(对应Requested NSSAI中包含的是归属域网络的切片类型(HPLMN S-NSSAI))，那么 AMF可以确定该终端设备在本次注册流程之后需要执行NSSAA流程。如果需要执行NSSAA流程的S-NSSAI未包含在Requested NSSAI中，那么AMF可以确定该终端设备在本次注册流程之后无需执行NSSAA流程。
举例1，例如Registration Request消息携带的Requested NSSAI包括S-NSSAI-1和S-NSSAI-2，根据表1可知，S-NSSAI-1需要执行NSSAA流程，S-NSSAI-2不需要执行NSSAA流程，那么AMF可以确定该终端设备在本次注册流程之后针对S-NSSAI-1需要执行NSSAA流程。
第二种：如果终端设备在Registration Request消息中指示支持NSSAA流程，Requested NSSAI中的某个S-NSSAI可以映射为签约的S-NSSAI，且该签约的S-NSSAI需要执行NSSAA，那么AMF确定请求的NSSAI中的S-NSSAI需要执行NSSAA。
具体地，AMF根据终端设备的签约数据，判断Requested NSSAI包含的某个S-NSSAI可以映射到HPLMN S-NSSAI，且该HPLMN S-NSSAI需要执行NSSAA流程，则AMF确定终端设备在本次注册流程之后需要执行NSSAA流程。
举例2，例如终端设备携带的Requested NSSAI包括S-NSSAI-A和S-NSSAI-B，其中S-NSSAI-A与S-NSSAI-1映射，S-NSSAI-B与S-NSSAI-2映射，且S-NSSAI-1需要执行NSSAA流程，S-NSSAI-2不需要执行NSSAA流程。则AMF确定终端设备在本次注册流程之后需要对S-NSSAI-1执行NSSAA流程。其中，上述的S-NSSAI-A与S-NSSAI-1映射，S-NSSAI-B与S-NSSAI-2映射，可以理解为，S-NSSAI-A与S-NSSAI-1存在映射关系，S-NSSAI-B与S-NSSAI-2存在映射关系；或者理解为，S-NSSAI-A所标识的网络切片与S-NSSAI-1所标识的网络切片存在映射关系，S-NSSAI-B所标识的网络切片与S-NSSAI-2所标识的网络切片存在映射关系。
具体地，以S-NSSAI-A为例说明。S-NSSAI-A可以是VPLMN S-NSSAI或者HPLMN S-NSSAI，本申请实施例不做限定。当S-NSSAI-A是VPLMN S-NSSAI时，表示S-NSSAI-A所标识的网络切片的类型属于拜访地PLMN(visit PLMN)，则S-NSSAI-A与S-NSSAI-1存在映射关系即为VPLMN S-NSSAI-A与HPLMN S-NSSAI-1存在映射关系，或者，VPLMN S-NSSAI-A所标识的网络切片与HPLMN S-NSSAI-1所标识的网络切片存在映射关系。当S-NSSAI-A是HPLMN S-NSSAI说明S-NSSAI-A所标识的网络切片的类型属于HPLMN网络，则S-NSSAI-A与S-NSSAI-1存在映射关系即为HPLMN S-NSSAI-A所标识的网络切片与HPLMN S-NSSAI-1所标识的网络切片存在映射关系。
S504、AMF向终端设备发送注册接受(Registration Accept)消息，终端设备接收来自AMF的Registration Accept消息。
Registration Accept消息可携带允许的NSSAI(Allowed NSSAI)，其中Allowed NSSAI包含不需要进行NSSAA流程的S-NSSAI。同时，AMF还向终端设备发送待定NSSAI(Pending NSSAI)，终端设备接收来自AMF的Pending NSSAI。Pending NSSAI可包括一个或多个需要执行NSSAA流程的S-NSSAI，Pending NSSAI用于指示终端设备，这些需要进行NSSAA流程的S-NSSAI处于pending状态。
例如继续前述的示例，Registration Request消息携带的Requested NSSAI包括S-NSSAI-1和S-NSSAI-2，那么Allowed NSSAI可包括S-NSSAI-2，Pending NSSAI可包括S-NSSAI-1。Pending原因值为NSSAA流程。
S505、在发送Registration Accept消息之后，AMF对处于pending状态的S-NSSAI执 行NSSAA流程。
例如，Pending NSSAI包括S-NSSAI-1，那么AMF可以对S-NSSAI-1执行NSSAA流程。关于NSSAA流程的具体步骤，可参考接下来的图6即将介绍的流程。
S506、当NSSAA流程执行完成之后，AMF根据NSSAA流程的鉴权结果更新Allowed NSSAI。在图5中将S506表示为，UE配置更新流程(UE configuration update procedure)，即，AMF可以为UE更新Allowed NSSAI。
如果对一个S-NSSAI执行NSSAA流程的鉴权结果为鉴权成功，且该S-NSSAI包含在Requested NSSAI里面，则该S-NSSAI会被添加到new Allowed NSSAI中。或者，如果对一个S-NSSAI执行NSSAA流程的鉴权结果为鉴权失败，且该S-NSSAI包含在Requested NSSAI里面，则该S-NSSAI会被添加到Rejected NSSAI中，同时AMF无需更新终端设备的Allowed NSSAI，也就是说，AMF不会生成new Allowed NSSAI，也不必向终端设备发送new Allowed NSSAI。
或者，如果对一个S-NSSAI执行NSSAA流程的鉴权结果为鉴权成功，且该S-NSSAI可以映射到Requested NSSAI所包含的S-NSSAI，则Requested NSSAI包含的该S-NSSAI会被添加到new Allowed NSSAI中。或者，如果对一个S-NSSAI执行NSSAA流程的鉴权结果为鉴权失败，且该S-NSSAI可以映射到Requested NSSAI包含的S-NSSAI，则Requested NSSAI包含的该S-NSSAI会被添加到Rejected NSSAI中，同时AMF无需更新终端设备的Allowed NSSAI，也就是说，AMF不会生成new Allowed NSSAI，也不必向终端设备发送new Allowed NSSAI。
例如继续前述的示例，AMF对S-NSSAI-1执行了NSSAA流程。那么，如果S-NSSAI-1的NSSAA流程的鉴权结果为鉴权成功，或者说S-NSSAI-1的NSSAA流程执行成功，则AMF可以将S-NSSAI-1添加到Allowed NSSAI中，得到新(new)Allowed NSSAI，且AMF可以向终端设备发送new Allowed NSSAI，new Allowed NSSAI可包括S-NSSAI-1和S-NSSAI-2。而如果S-NSSAI-1的NSSAA流程的鉴权结果为鉴权失败，或者说S-NSSAI-1的NSSAA流程执行失败，则AMF向终端设备发送Rejected NSSAI，其中，Rejected NSSAI包括S-NSSAI-1，同时AMF不会更新该终端设备的Allowed NSSAI。
接下来请参考图6，为NSSAA流程所涉及的步骤的流程图。主要思想是：当AMF决定触发NSSAA流程后，AMF会通过AUSF与AAA-S交互传递终端设备的鉴权信息。其中，如果AAA-S位于第三方，AUSF无法直接跟AAA-S交互，那么AUSF可以间接通过AAA-代理(proxy，P)与AAA-S交互。
S601、AMF对Pending NSSAI中的S-NSSAI触发NSSAA流程。
需要注意的是，本申请实施例中，AMF对Pending NSSAI包括的S-NSSAI执行NSSAA，可以有两种含义：
第一种：Pending NSSAI中的某个S-NSSAI属于签约的S-NSSAI，且该签约的S-NSSAI需要执行NSSAA，那么AMF对该S-NSSAI执行NSSAA。
例如，继续上述的举例1，Pending NSSAI＝S-NSSAI-1，由于S-NSSAI-1是HPLMN S-NSSAI，则AMF对S-NSSAI-1执行NSSAA流程。
第二种：Pending NSSAI中的某个S-NSSAI与签约的S-NSSAI映射，且该签约的S-NSSAI需要执行NSSAA，那么AMF对该签约的S-NSSAI执行NSSAA。
继续上述的举例2，Pending NSSAI＝S-NSSAI-A，由于S-NSSAI-A与S-NSSAI-1映 射，则AMF对S-NSSAI-1执行NSSAA流程。
以下步骤S602至S617中涉及的S-NSSAI为终端设备签约的S-NSSAI，且该签约的S-NSSAI需要执行NSSAA流程。
S602、AMF向终端设备发送非接入层(non-access stratum，NAS)移动性管理(mobile management，MM)消息，终端设备接收来自AMF的NAS MM消息。
S602为可选的步骤。NAS MM消息可包括S-NSSAI，NAS MM消息用于向终端设备请求该终端设备的ID，以进行可扩展认证协议(extensible authentication protocol，EAP)认证。
S603、终端设备向AMF发送NAS MM消息，AMF接收来自终端设备的NAS MM消息。该NAS MM消息包括EAP ID响应(Response)以及S-NSSAI。其中，S603中的S-NSSAI与S602中的S-NSSAI是相同的。
S604、AMF调用AUSF的服务化操作Nausf_Communication_EAPMessage_Transfer向AUSF发送消息，AUSF接收来自AMF的该消息。该消息可包括EAP ID Response、AAA-S地址(address)、通用公共订阅标识(generic public subscription identifier，GPSI)以及S-NSSAI。在图6中将调用服务化操作Nausf_Communication_EAPMessage_Transfer(EAP ID Response,AAA-S address,GPSI,S-NSSAI)传输的消息表示为EAP消息传输消息。
其中GPSI是终端设备的外部标识，例如为终端设备的手机号码或者电子邮箱等。AAA-S address是AAA-S的地址，该地址可以预先配置在AMF上或者AMF从UDM获取AAA-S的地址。S-NSSAI是本次执行NSSAA流程的网络切片的标识，且该S-NSSAI是HPLMN S-NSSAI。
S605、AUSF调用服务化操作Naaa_Communication_EAPmessageTranfser向AAA-P发送消息，AAA-P接收来自AUSF的该消息。该消息包括EAP ID Response、AAA-S address、GPSI和S-NSSAI。
如果AAA-S位于第三方网络中，AUSF需要通过AAA-P与AAA-S交互，则AUSF调用服务化操作Naaa_Communication_EAPmessageTranfser将EAP ID Response、AAA-S address、GPSI和S-NSSAI发送给AAA-P。否则，如果AAA-S位于运营商网络中，AUSF无需通过AAA-P而是可以直接与AAA-S交互，则AUSF调用服务化操作Naaa_Communication_EAPmessageTranfser将EAP ID Response、AAA-S address、GPSI和S-NSSAI发送给AAA-S。S605以AUSF通过AAA-P与AAA-S通信为例。
S606、AAA-P根据AAA-S address，向AAA-S发送认证请求(Auth request)消息，AAA-S接收来自AAA-P的Auth request消息。Auth request消息可包括EAP ID Response、GPSI和S-NSSAI。
S607～S614、终端设备与AAA-S之间传递EAP-message，该过程可能需要交互多次。
其中，EAP-message可以包括EAP ID Response、GPSI和S-NSSAI等信息。传递EAP-message是为了对该终端设备进行EAP认证(authentication)。
S615、EAP认证结束，AAA-S向AAA-P发送认证响应(Auth Response)消息，AAA-P接收来自AAA-S的认证响应消息。认证响应消息可包括EAP-成功(Success)/失败(Failure)message、GPSI和S-NSSAI等信息。或者，如果AAA-S和AUSF能够直接交互，则AAA-S将EAP-Success/Failure message、GPSI和S-NSSAI发送给AUSF，AUSF接收来自AAA-S 的EAP-Success/Failure message、GPSI和S-NSSAI。图6以AUSF通过AAA-P与AAA-S通信为例。
如果NSSAA的鉴权结果为鉴权成功，即，AAA-S发送的是EAP-Success message，则AAA-S保存GSPI和鉴权成功的网络切片的S-NSSAI的对应关系。
S616、AAA-P调用服务化操作Nausf_Communication_EAPmessageTranfser向AUSF发送消息，AUSF接收来自AAA-P的该消息。该消息可以包括EAP-Success/Failure message、S-NSSAI和GPSI等信息。
S617、AUSF调用AMF的服务化操作Namf_Communication_N1N2messageTranfser，向AMF发送消息，AMF接收来自AUSF的该消息。该消息可包括EAP-Success/Failure message、S-NSSAI和GPSI等信息。
S618、AMF向终端设备发送NAS MM消息，终端设备接收来自AMF的NAS MM消息。NAS MM消息携带EAP-Success/Failure message。
S619、AMF通过UE配置更新流程(UE Configuration Update procedure)向终端设备发送new Allowed NSSAI，终端设备接收来自AMF的new Allowed NSSAI。
如果S-NSSAI执行NSSAA流程的鉴权结果为鉴权成功，且该S-NSSAI包含在Requested NSSAI里面，则该S-NSSAI会添加到new Allowed NSSAI中。或者，如果S-NSSAI执行的NSSAA流程的鉴权结果为鉴权失败，且该S-NSSAI包含在Requested NSSAI里面，则该S-NSSAI会添加到Rejected NSSAI中，同时AMF无需更新终端设备的Allowed NSSAI，也就是说，AMF不会生成new Allowed NSSAI，也不必向终端设备发送new Allowed NSSAI。
如果S-NSSAI执行NSSAA流程的鉴权结果为鉴权成功，且该S-NSSAI可以映射到Requested NSSAI包含的S-NSSAI，则Requested NSSAI包含的该S-NSSAI会被添加到new Allowed NSSAI中。或者，如果S-NSSAI执行NSSAA流程的鉴权结果为鉴权失败，且该S-NSSAI可以映射到Requested NSSAI包含的S-NSSAI，则Requested NSSAI包含的该S-NSSAI会被添加到Rejected NSSAI中，同时AMF无需更新终端设备的Allowed NSSAI，也就是说，AMF不会生成new Allowed NSSAI，也不必向终端设备发送new Allowed NSSAI。
如果AMF决定需要向终端设备发送new Allowed NSSAI或Rejected NSSAI，则AMF可通过UE Configuration Update procedure发送。
针对前述的举例1，如果S-NSSAI-1的NSSAA执行成功，AMF向终端设备发送new Allowed NSSAI，其中new Allowed NSSAI包括S-NSSAI-1和S-NSSAI-2。或者，如果S-NSSAI-1的NSSAA执行失败，AMF向终端设备发送Rejected NSSAI，其中，Rejected NSSAI包括S-NSSAI-1，即AMF不会向终端设备更新Allowed NSSAI，也不会向终端设备发送new Allowed NSSAI。
针对前述的举例2，如果S-NSSAI-1的NSSAA执行成功，AMF向终端设备发送new Allowed NSSAI，其中new Allowed NSSAI包括S-NSSAI-A和S-NSSAI-B。或者，如果S-NSSAI-1的NSSAA执行失败，AMF向终端设备发送Rejected NSSAI，其中，Rejected NSSAI包括S-NSSAI-A，即AMF不会向终端设备更新Allowed NSSAI，也不会向终端设备发送new Allowed NSSAI。
需注意的是，在图4～图6中的任一个附图所示的流程中，用虚线表示的步骤均为可选的步骤。
根据前文的介绍可知，当终端设备支持NSSAA流程，且该终端设备的签约的NSSAI (Subscribed NSSAI)中包含符合NSSAA流程的HPLMN S-NSSAI(HPLMN S-NSSAI subject to NSSAA)，AMF可根据终端设备的签约数据确定终端设备的Requested NSSAI是否包含了需要执行NSSAA的S-NSSAI(S-NSSAI subject to NSSAA)或与其具有映射关系的S-NSSAI。如果Requested NSSAI包含需要执行NSSAA流程的S-NSSAI或与其具有映射关系的S-NSSAI，则AMF对该需要执行NSSAA流程的S-NSSAI执行NSSAA流程。
当终端设备请求的某个需要执行NSSAA流程的HPLMN S-NSSAI成功执行NSSAA流程之后，终端设备方可接入该HPLMN S-NSSAI所对应的网络切片(该HPLMN S-NSSAI对应的网络切片称为第一网络切片)，或者终端设备方可接入与该第一网络切片存在映射关系的第二网络切片。可以理解为，第一网络切片对应的S-NSSAI是HPLMN S-NSSAI。第二网络切片与第一网络切片映射，第二网络切片对应的S-NSSAI可以是HPLMN S-NSSAI或者拜访地PLMN(visit PLMN，VPLMN)S-NSSAI，本申请实施例不做限定。关于第一网络切片与第二网络切片的映射关系，也可以参考前文的图5所示的流程的相关介绍。
同时AAA-S保存终端设备的标识(例如GPSI)和该第一网络切片的标识(例如S-NSSAI)之间的对应关系。此外，当终端设备对第一网络切片执行NSSAA流程的过程中，AMF还可以向AUSF隐式订阅(implicitly subscribed)第一通知，该第一通知可以是对该第一网络切片执行Re-authentication and Re-authorization流程的通知，或者，该第一通知可以是对该第一网络切片执行Authorization Revocation流程的通知。示例性地，该第一通知可以是对该第一网络切片执行Re-authentication and Re-authorization的事件或者该第一通知可以是对该第一网络切片执行Authorization Revocation的事件。Re-authentication and Re-authorization流程也可简称为Re-auth流程，或者检测为重鉴权流程。Revocation流程为特定于网络切片的撤销授权流程(Network Slice-Specific Authorization Revocation procedure)，也可简称为撤销授权流程。可以理解为，当终端设备成功执行第一网络切片对应的NSSAA流程之后，AAA-S可能会对该终端设备发起针对该第一网络切片的Re-authentication and Re-authorization流程或者该第一网络切片的Revocation流程，具体地，当AAA-S决定触发对第一网络切片执行第一通知时，AAA-S向AUSF发送请求消息，该请求消息用于触发AMF对该第一网络切片执行Re-authentication and Re-authorization流程或者触发AMF对该第一网络切片执行Revocation流程。AUSF基于AMF隐式订阅的第一通知，向UDM查询服务终端设备的AMF标识信息，并向该AMF发送该请求消息。
需要注意的是，在终端设备接入第一网络切片之后，可能存在以下几种场景中的一种或多种：
(1)该终端设备不再支持NSSAA流程。具体地，终端设备是否具有支持NSSAA流程的能力可作为UE 5GMM Core Network Capability，通过注册请求消息发送给核心网。而终端设备可以修改UE 5GMM Core Network Capability，例如，一个终端设备的UE 5GMM Core Network Capability起初指示支持NSSAA流程(Network Slice-Specific Authentication and Authorization supported)，而后续终端设备可以对UE 5GMM Core Network Capability进行修改，修改后的UE 5GMM Core Network Capability指示不支持NSSAA流程(Network Slice-Specific Authentication and Authorization not supported)。
(2)该终端设备的Allowed NSSAI发生改变，即，该终端设备允许接入的NSSAI发生改变。或者说，终端设备新请求的NSSAI不再包括需要执行NSSAA流程的S-NSSAI 或与其具有映射关系的S-NSSAI。具体地，终端设备可能发生移动，或者终端设备基于当前自身的业务请求，需要重新进行注册。那么终端设备可以向核心网发送注册请求消息，该注册请求消息包括新请求的NSSAI(new requested NSSAI)，new requested NSSAI所包括的S-NSSAI与终端设备在上次注册时发送给核心网的requested NSSAI所包括的S-NSSAI可能是不同的，从而终端设备请求接入其他网络切片。例如，终端设备上次注册时的requested NSSAI包括S-NSSAI-1(该S-NSSAI-1需要执行NSSAA流程)，而此次注册时的new requested NSSAI不包括S-NSSAI-1，即，该终端设备的Allowed NSSAI发生了改变(change)，改变后的Allowed NSSAI(或者称为new Allowed NSSAI)不包含S-NSSAI-1。而如果改变后的Allowed NSSAI不包含S-NSSAI-1，表明该终端设备可能不再接入S-NSSAI-1所对应的网络切片。
(3)该终端设备从网络去注册(deregistration)。具体地，该终端设备可能会自行发起去注册流程(UE-initiated Deregistration)，以通知网络，该终端设备不再接入当前的网络；或者，网络发起去注册流程(Network-initiated Deregistration)，以通知该终端设备无法接入当前的网络。当该终端设备从网络去注册，该终端设备从注册状态(registered status)变成去注册状态(deregistered status)，去注册状态的终端设备无法接入任何一个网络切片，即终端设备无法接入第一网络切片。
(4)该终端设备从5G网络移动到演进分组系统(evolved packet system，EPS)网络。具体地，该终端设备可能会从5G网络的覆盖区域互通(interworking)到EPS网络的覆盖区域。由于第一网络切片在5G网络中需要执行NSSAA流程但EPS网络不支持NSSAA流程所需的认证机制，因此第一网络切片对应的上下文无法切换到EPS网络中，因此该终端设备注册到了EPS网络之后，无法接入第一网络切片。例如，该终端设备在5G网络接入S-NSSAI-1，当该终端设备从5G移动到EPS网络时，该终端设备无法继续接入S-NSSAI-1。
而对于上面的几种场景，终端设备的Allowed NSSAI的改变，或者终端设备的UE5GMM Core Network Capability的改变，或者终端设备从网络去注册，或者终端设备从5G网络移动到EPS网络等，均不涉及与AAA-S进行交互，因此，即使终端设备请求接入的网络切片发生了变化或者终端设备的注册状态发生了变化，采用现有技术的方案的话这种变化也不会通知到AAA-S。由于AAA-S并不感知终端设备侧的变化情况，那么AAA-S可能照常针对某个S-NSSAI触发Re-authentication and Re-authorization流程，而如果该S-NSSAI对应的网络切片已经不是终端设备请求接入的网络切片，那么此时再对该网络切片进行Re-authentication and Re-authorization流程就是不必要的过程，这造成核心网的信令浪费。
鉴于此，提供本申请实施例的技术方案。在本申请实施例中，如果第一移动性管理网元确定终端设备不再接入需要执行NSSAA流程的S-NSSAI或与其具有映射关系的S-NSSAI，那么第一移动性管理网元可以将终端设备不再接入第一网络切片的信息告知认证网元，例如认证网元为AAA-S，或者，指示所述第一移动性管理网元取消向该认证网元订阅执行重鉴权的通知或者对执行撤销授权通知，从而认证网元在获知该信息后，后续可以不必再对该终端设备发起针对第一网络切片的重鉴权流程或撤销授权流程，从而能够节省核心网的信令开销。
下面结合附图，介绍本申请实施例所提供的方法。为方便说明，本申请实施例后续，都是以将本申请实施例提供的方案应用在5G系统为例，例如在后文中，以移动性管理网 元为AMF网元，认证网元为AAA-S网元或者AUSF网元，存储功能网元为NRF网元为例进行说明。进一步地，后文也将AMF网元简称为AMF，NRF网元简称为NRF，AUSF网元简称为AUSF，接入网网元简称为RAN等。即本申请实施例后续所描述的AMF均可替换为移动性管理网元，AAA-S均可替换为认证网元，NRF均可替换为存储功能网元，RAN均可替换为接入网网元。
本申请实施例提供第一种通信方法，请参见图7，为该方法的流程图。在下文的介绍过程中，以该方法应用于图1或图2所示的网络架构为例。其中，图7所示的实施例所涉及的AMF也可以称为第一AMF，或者称为第一移动性管理网元。
S701、终端设备发起注册流程(registration procedure)。
例如终端设备向AMF发送注册请求消息，AMF接收来自终端设备的注册请求消息。为了与后续将要出现的另外的注册请求消息相区分，将此处的注册请求消息称为第一注册请求消息。在第一注册请求消息中，可以携带该终端设备的Requested NSSAI和UE 5GMM Core Network Capability。第一注册请求消息携带的UE 5GMM Core Network Capability指示该终端设备支持NSSAA流程。
另外在注册过程中，AMF调用UDM的服务化操作Nudm_SDM_Get从UDM处获取该终端设备的签约数据，该终端设备的签约数据包括该终端设备的签约S-NSSAI。AMF接收来自UDM通过服务化操作Nudm_SDM_Get response向AMF发送的该终端设备的签约S-NSSAI。其中，终端设备的签约S-NSSAI包含指示信息，用于指示该签约S-NSSAI是否需要执行NSSAA流程。
例如，终端设备的签约S-NSSAI可参考表2：
表2
Figure PCTCN2021081876-appb-000002
由于该终端设备在注册请求消息中指示支持NSSAA流程，那么AMF可以根据该终端设备的签约数据确定Requested NSSAI中是否包括需要执行NSSAA流程的S-NSSAI。Requested NSSAI包括了需要执行NSSAA流程的S-NSSAI，则AMF将Requested NSSAI中需要执行NSSAA流程的S-NSSAI放在Pending NSSAI中，将Requested NSSAI中不需要执行NSSAA流程的S-NSSAI放在Allowed NSSAI中。AMF向终端设备发送注册接受消息，注册接受消息可携带Allowed NSSAI和Pending NSSAI。关于终端设备的注册流程，这里只是简述，该注册流程所涉及的具体步骤可参考图4所示的流程的介绍。
S702、在注册流程之后，AMF针对Pending NSSAI包括的每一个需要执行NSSAA流程的S-NSSAI发起NSSAA流程。
关于NSSAA流程的具体步骤可参考图6所示的流程的介绍。在NSSAA流程结束之后，AMF如果获知某个网络切片执行NSSAA流程的鉴权结果为鉴权成功，则允许终端设 备接入该网络切片，AMF为该终端设备生成new Allowed NSSAI，其中new Allowed NSSAI中包含了成功执行NSSAA流程的网络切片的标识。同时，针对成功执行NSSAA流程的S-NSSAI，AMF在终端设备的上下文中保存该S-NSSAI的鉴权和授权状态(Authentication and Authorization status for this S-NSSAI)。而且，AAA-S保存该终端设备的标识和成功执行NSSAA流程的S-NSSAI的对应关系。例如，终端设备的标识为GPSI等。
例如，终端设备在第一注册请求消息中携带的Requested NSSAI包括S-NSSAI-1和S-NSSAI-2，其中，S-NSSAI-1和S-NSSAI-2均为HPLMN S-NSSAI，且S-NSSAI-1需要执行NSSAA流程，S-NSSAI-2不需要执行NSSAA流程，其中，Requested NSSAI包括的S-NSSAI-1是第一网络切片。那么AMF在注册接受消息中向该终端设备发送的Allowed NSSAI可以包括S-NSSAI-2，以及在注册接受消息中向该终端设备发送的Pending NSSAI可以包括S-NSSAI-1。AMF可针对S-NSSAI-1发起NSSAA流程。如果S-NSSAI-1的NSSAA流程执行成功，或者说S-NSSAI-1的NSSAA流程的鉴权结果为鉴权成功，则AMF向该终端设备发送new Allowed NSSAI，new Allowed NSSAI可包括S-NSSAI-1和S-NSSAI-2。其中，new Allowed NSSAI包括的S-NSSAI-1可作为第一网络切片。或者，如果S-NSSAI-1的NSSAA流程执行失败，或者说S-NSSAI-1的NSSAA流程的鉴权结果为鉴权失败，AMF不必向该终端设备发送new Allowed NSSAI。
又例如，终端设备在第一注册请求消息中携带的Requested NSSAI包括S-NSSAI-1和S-NSSAI-3，其中S-NSSAI-1和S-NSSAI-3均需要执行NSSAA流程，即，Requested NSSAI包括的S-NSSAI-1和S-NSSAI-3均是第一网络切片。那么AMF在注册接受消息中向终端设备发送空(empty)Allowed NSSAI，即Allowed NSSAI为空，里面不包含任何S-NSSAI，以及，AMF在注册接受消息中向终端设备发送的Pending NSSAI包括S-NSSAI-1和S-NSSAI-3。AMF针对S-NSSAI-1和S-NSSAI-3均发起NSSAA流程。如果S-NSSAI-1的NSSAA流程和S-NSSAI-3的NSSAA流程都执行成功，则AMF向终端设备发送new Allowed NSSAI，new Allowed NSSAI包括S-NSSAI-1和S-NSSAI-3，即，new Allowed NSSAI包括S-NSSAI-1和S-NSSAI-3均是第一网络切片。或者，如果S-NSSAI-1的NSSAA流程执行成功，而S-NSSAI-3的NSSAA流程执行失败，则AMF向终端设备发送new Allowed NSSAI，new Allowed NSSAI包括S-NSSAI-1而不包括S-NSSAI-3。或者，如果S-NSSAI-1的NSSAA流程和S-NSSAI-3的NSSAA流程都执行失败，则AMF不必向终端设备发送new Allowed NSSAI。
又例如，终端设备在第一注册请求消息中携带的Requested NSSAI包括S-NSSAI-A和S-NSSAI-B，其中，S-NSSAI-A与S-NSSAI-1映射，S-NSSAI-B与S-NSSAI-2映射，这里的映射例如理解为，S-NSSAI-A和S-NSSAI-B为HPLMN S-NSSAI或VPLMN S-NSSAI，S-NSSAI-1和S-NSSAI-2为HPLMN S-NSSAI。另外，S-NSSAI-1需要执行NSSAA流程，S-NSSAI-2不需要执行NSSAA流程。即，Requested NSSAI包括的S-NSSAI-A是第二网络切片。AMF在注册接受消息中向该终端设备发送的Allowed NSSAI可以包括S-NSSAI-B，以及在注册接受消息中向该终端设备发送的Pending NSSAI可以包括S-NSSAI-A。AMF可针对S-NSSAI-1发起NSSAA流程。如果S-NSSAI-1的NSSAA流程执行成功，或者说S-NSSAI-1的NSSAA流程的鉴权结果为鉴权成功，则AMF向该终端设备发送new Allowed NSSAI，new Allowed NSSAI可包括S-NSSAI-A和S-NSSAI-B，即，new Allowed NSSAI包括的S-NSSAI-A是第二网络切片。或者，如果S-NSSAI-1的NSSAA流程执行失败，或 者说S-NSSAI-1的NSSAA流程的鉴权结果为鉴权失败，AMF不必向该终端设备发送new Allowed NSSAI。
为了表述方便，本申请实施例的各个实施例中，第一网络切片可以是成功执行NSSAA流程的归属域的网络切片(HPLMN S-NSSAI)，第二网络切片与第一网络切片存在映射关系，对于映射关系可以理解为，如果是漫游场景，例如终端设备从HPLMN漫游到VPLMN，则第二网络切片对应的S-NSSAI可以是VPLMN S-NSSAI；而如果是非漫游场景，终端设备停留在HPLMN，则第二网络切片对应的S-NSSAI可以是HPLMN S-NSSAI，当然本申请实施例不做限定。
可以理解为，由于第一网络切片成功执行了NSSAA流程，AMF向终端设备发送的new Allowed NSSAI包含第一网络切片对应的S-NSSAI或者第二网络切片对应的S-NSSAI。即，终端设备允许接入成功执行了NSSAA流程的第一网络切片，或者，终端设备允许接入第二网络切片，其中，第二网络切片与第一网络切片映射，且第一网络切片成功执行了NSSAA流程。在后文的其他实施例中不再对第一网络切片和第二网络切片的定义及之间的关系过多赘述。
S703、终端设备再次发起注册流程。在图7中表示为，终端设备向AMF发送注册请求消息，AMF接收来自终端设备的注册请求消息。上述S701中的注册请求消息可称为第一注册请求消息，此处S703中的注册请求消息可称为第二注册请求消息，使得S703和S701能够区分。
例如终端设备发生了移动，或者终端设备出于业务需求，或者终端设备进行周期性注册等等情况，都可能导致终端设备再次发起注册流程。S703的注册请求消息可以包括用于指示终端设备不支持NSSAA流程的信息，或者，该注册请求消息所携带的请求接入NSSAI不包括第一网络切片的标识或第二网络切片的标识，或者，该注册请求消息包括用于指示终端设备不支持NSSAA流程的信息，以及该注册请求消息所携带的请求接入NSSAI不包括第一网络切片的标识或第二网络切片的标识。例如，用于指示终端设备不支持NSSAA流程的信息可以是UE 5GMM Core Network Capability，此时的UE 5GMM Core Network Capability指示终端设备不支持NSSAA流程。注册请求消息所携带的请求接入NSSAI，例如为new Requested NSSAI，new Requested NSSAI可包括终端设备本次所请求接入的网络切片的S-NSSAI。
其中，S701～S703为可选的步骤，在图7中用虚线表示。
S704、AMF根据第一条件确定终端设备不再接入第一网络切片或第二网络切片。或者，S704也可以描述为，AMF根据第一条件确定终端设备不接入第一网络切片或第二网络切片。
第一条件可以包括多种，例如一种第一条件为，终端设备从网络去注册；例如另一种第一条件为，终端设备从第一网络移动到第二网络；例如又一种第一条件为，终端设备允许接入的NSSAI发生改变，等等。
其中，AMF确定终端设备不再接入第一网络切片或者第二网络切片，可以包括：终端设备之前接入的网络切片是第一网络切片，当终端设备不再接入该第一网络切片，则AMF确定终端设备不再接入该第一网络切片。终端设备之前接入的网络切片是第二网络切片，当终端设备不再接入该第二网络切片，则AMF确定终端设备不再接入该第二网络切片。
在第一种实现方式中，当AMF确定终端设备去注册时，该终端设备从注册状态 (registered status)变成去注册状态(deregistered status)，可以理解为，去注册状态的终端设备不再接入任何网络切片，那么自然地，AMF可以确定终端设备不再接入第一网络切片或第二网络切片。示例性地，AMF确定终端设备去注册的方法可以是：该终端设备自行发起去注册流程(UE-initiated Deregistration)以通知AMF，该终端设备不再接入当前的网络；或者，网络发起去注册流程(Network-initiated Deregistration)，以通知该终端设备无法接入当前的网络。例如非漫游场景下，终端设备请求接入HPLMN S-NSSAI-1所标识的网络切片，且HPLMN S-NSSAI-1成功执行NSSAA流程，即HPLMN S-NSSAI-1为第一网络切片。终端设备接入HPLMN S-NSSAI-1之后的某一时刻，终端设备从网络去注册，则AMF确定终端设备不再接入HPLMN S-NSSAI-1。又例如，漫游场景下，终端设备请求接入VPLMN S-NSSAI-A所标识的网络切片，VPLMN S-NSSAI-A与HPLMN S-NSSAI-1映射，且HPLMN S-NSSAI-1成功执行NSSAA流程，即HPLMN S-NSSAI-1为第一网络切片，VPLMN S-NSSAI-A为第二网络切片。终端设备接入VPLMN S-NSSAI-A之后的某一时刻，终端设备从网络去注册，AMF确定终端设备不再接入VPLMN S-NSSAI-A。
在第二种实现方式中，以第一网络是5G网络、第二网络是EPS网络为例。在本申请的各个实施例中，例如，所述的5G网络为5G核心网(5GC)，所述的EPS网络为EPS核心网(EPC)。当AMF确定终端设备从5G网络移动到EPS网络时，由于EPS网络不支持第一网络切片执行NSSAA流程所需的认证机制，因此终端设备无法在EPS网络接入第一网络切片，则AMF可以确定终端设备不再接入第一网络切片或第二网络切片。例如非漫游场景下，终端设备请求接入HPLMN S-NSSAI-1所标识的网络切片且HPLMN S-NSSAI-1成功执行NSSAA流程，即HPLMN S-NSSAI-1为第一网络切片。终端设备接入HPLMN S-NSSAI-1之后的某一时刻，终端设备从5G网络移动到EPS网络，则AMF确定终端设备不再接入HPLMN S-NSSAI-1。又例如漫游场景下，终端设备请求接入VPLMN S-NSSAI-A所标识的网络切片,VPLMN S-NSSAI-A与HPLMN S-NSSAI-1映射，且HPLMN S-NSSAI-1成功执行NSSAA流程，即HPLMN S-NSSAI-1为第一网络切片，VPLMN S-NSSAI-A为第二网络切片。终端设备接入VPLMN S-NSSAI-A之后的某一时刻，终端设备从5G网络移动到EPS网络，AMF确定终端设备不再接入VPLMN S-NSSAI-A。
示例性地，AMF确定终端设备从5G网络移动到EPS网络的方法可以是：AMF从UDM接收去注册通知消息，该去注册通知消息可以是UDM调用服务化操作Nudm_UECM_DeregistrationNotification发送给AMF的，该去注册通知消息携带该终端设备的标识以及5GS到EPS移动原因值(5GS to EPS Mobility)，AMF接收该去注册通知消息之后可以确定该终端设备从5G网络移动到EPS网络，从而确定终端设备不再接入第一网络切片或第二网络切片。
在第三种实现方式中，如果AMF确定终端设备允许接入的NSSAI发生改变，具体地，改变前的允许接入的NSSAI包括第一网络切片的标识，改变后的允许接入的NSSAI不包括第一网络切片的标识。如果是这种情况，终端设备允许接入的NSSAI发生改变，也可以理解为，AMF从终端设备允许接入的NSSAI中移除(remove)第一网络切片的标识。例如非漫游场景下，终端设备请求接入HPLMN S-NSSAI-1所标识的网络切片，且HPLMN S-NSSAI-1成功执行NSSAA流程，即HPLMN S-NSSAI-1为第一网络切片。终端设备允许接入的NSSAI包括HPLMN S-NSSAI-1，在某一时刻，AMF将HPLMN S-NSSAI-1从终端设备允许接入的NSSAI中移除，则AMF确定终端设备不再接入HPLMN S-NSSAI-1。
或者，如果AMF确定终端设备允许接入的NSSAI发生改变，具体地，改变前的允许接入的NSSAI包括第二网络切片的标识，改变后的允许接入的NSSAI不包括第二网络切片的标识。如果是这种情况，终端设备允许接入的NSSAI发生改变，也可以理解为，AMF从终端设备允许接入的NSSAI中移除第二网络切片的标识。例如漫游场景下，终端设备请求接入VPLMN S-NSSAI-A所标识的网络切片，VPLMN S-NSSAI-A与HPLMN S-NSSAI-1映射，且HPLMN S-NSSAI-1成功执行NSSAA流程，即HPLMN S-NSSAI-1为第一网络切片，VPLMN S-NSSAI-A为第二网络切片。终端设备允许接入的NSSAI包括VPLMN S-NSSAI-A，在某一时刻，AMF将VPLMN S-NSSAI-A从终端设备允许接入的NSSAI中移除，AMF确定终端设备不再接入VPLMN S-NSSAI-A。
在本申请实施例中，例如，AMF是根据S703中的注册请求消息确定终端设备允许接入的NSSAI发生改变。也就是说，如果第一条件为终端设备允许接入的NSSAI发生改变，那么可以执行S703，而如果第一条件是其他条件，例如是终端设备从网络去注册或终端设备从第一网络移动到第二网络等，则可以不必执行S703。根据注册请求消息确定终端设备允许接入的NSSAI发生改变，这只是AMF确定终端设备允许接入的NSSAI发生改变的一种方式，AMF还可能采用其他方式确定终端设备允许接入的NSSAI发生改变，关于其他方式，将在后文的其他实施例中介绍。
可以理解为，如果终端设备允许接入的NSSAI发生改变，且改变后的允许接入的NSSAI不包括第一网络切片的标识，就可以表明终端设备不再接入第一网络切片，或者说表明终端设备不接入第一网络切片。而反过来说，如果终端设备不再接入第一网络切片或者说不接入第一网络切片，则终端设备的改变后的允许的接入的NSSAI就不包括第一网络切片的标识。或者，可以理解为，如果终端设备允许接入的NSSAI发生改变，且改变后的允许接入的NSSAI不包括第二网络切片的标识，第二网络切片与第一网络切片映射，就可以表明终端设备不再接入第一网络切片，或者说表明终端设备不接入第一网络切片。而反过来说，如果终端设备不再接入第二网络切片或者说不接入第二网络切片，则终端设备的改变后的允许的接入的NSSAI就不包括第二网络切片的标识。
当终端设备进行再次注册，则终端设备允许接入的NSSAI就可能会发生改变，所谓的改变就是指，改变后的允许接入的NSSAI与改变前的允许接入的NSSAI不同。例如本申请实施例中，改变前的允许接入的NSSAI包括第一网络切片的标识，改变后的允许接入的NSSAI不包括第一网络切片的标识。或者，改变前的允许接入的NSSAI包括第二网络切片的标识，改变后的允许接入的NSSAI不包括第二网络切片的标识，其中，第二网络切片与第一网络切片映射。
例如，AMF根据S703中的注册请求消息确定终端设备允许接入的NSSAI是否发生改变，根据该注册请求消息所携带的内容的不同，可以有不同的确定方式，下面举例介绍。
确定方式一
在这种确定方式下，S703中的注册请求消息包括UE 5GMM Core Network Capability，且该UE 5GMM Core Network Capability指示终端设备不支持NSSAA流程。而AMF在上次注册过程中发送给终端设备的Allowed NSSAI(或者说，是终端设备当前的(current)Allowed NSSAI，或者也可以称为终端设备的旧(old)Allowed NSSAI)包括了需要执行NSSAA流程的S-NSSAI，那么AMF就可以确定终端设备允许接入的NSSAI发生了改变，因为此时，终端设备允许接入的NSSAI里不包括需要执行NSSAA流程的S-NSSAI。例如， 第一网络切片的S-NSSAI是终端设备当前的current Allowed NSSAI所包括的需要执行NSSAA流程的S-NSSAI中的一个。在这种情况下，AMF可以从终端设备的current Allowed NSSAI中删除需要执行NSSAA流程的S-NSSAI(例如第一网络切片的S-NSSAI)，例如AMF可以将被删除的S-NSSAI放入Rejected NSSAI中。
例如，AMF保存的该终端设备的current Allowed NSSAI包括S-NSSAI-1和S-NSSAI-2。其中S-NSSAI-1需要执行NSSAA流程，S-NSSAI-2不需要执行NSSAA流程。如果S703中的注册请求消息包括的UE 5GMM Core Network Capability指示终端设备不支持NSSAA流程，则AMF将S-NSSAI-1从current Allowed NSSAI中删除，生成new Allowed NSSAI，new Allowed NSSAI包含S-NSSAI-2。另外AMF可以生成Rejected NSSAI，Rejected NSSAI包含S-NSSAI-1。可选的，AMF还可以在终端设备的上下文中删除S-NSSAI-1执行NSSAA流程的鉴权结果。
又例如，AMF保存的该终端设备的current Allowed NSSAI包括S-NSSAI-1和S-NSSAI-3，其中S-NSSAI-1和S-NSSAI-3都需要执行NSSAA流程。如果S703中的注册请求消息包括的UE 5GMM Core Network Capability指示终端设备不支持NSSAA流程，则AMF将S-NSSAI-1和S-NSSAI-3均从current Allowed NSSAI中删除，且AMF生成Rejected NSSAI，Rejected NSSAI包含S-NSSAI-1和S-NSSAI-3。在这种情况下，该终端设备已经没有能够接入的网络切片，因此作为一种可选的方式，AMF可以向该终端设备发送去注册消息，以使得该终端设备从网络中去注册。但是这种处理方式可能导致终端设备正在进行的业务中断。因此作为另一种可选的方式，AMF可以再确定该终端设备的签约数据包括的签约NSSAI中是否包括缺省(default)的S-NSSAI，所谓的default S-NSSAI，是不需要执行NSSAA流程的S-NSSAI，因此即使终端设备不支持NSSAA流程，也可以接入这样的S-NSSAI对应的网络切片。例如终端设备的签约NSSAI包括S-NSSAI-2，S-NSSAI-2是default S-NSSAI，那么AMF也可以生成new Allowed NSSAI，new Allowed NSSAI包含S-NSSAI-2。通过这种方式，尽量减少让终端设备去注册的情况，提高终端设备的使用者的使用体验。
再例如，AMF保存的该终端设备的current Allowed NSSAI包括S-NSSAI-A和S-NSSAI-B。其中S-NSSAI-A与S-NSSAI-1映射，S-NSSAI-B与S-NSSAI-2映射，S-NSSAI-1需要执行NSSAA流程，S-NSSAI-2不需要执行NSSAA流程。如果S703中的注册请求消息包括的UE 5GMM Core Network Capability指示终端设备不支持NSSAA流程，则AMF将S-NSSAI-A从current Allowed NSSAI中删除，生成new Allowed NSSAI，new Allowed NSSAI包含S-NSSAI-B。另外AMF可以生成Rejected NSSAI，Rejected NSSAI包含S-NSSAI-A。可选的，AMF还可以在终端设备的上下文中删除S-NSSAI-A执行NSSAA流程的鉴权结果。
确定方式二
在这种确定方式下，S703中的注册请求消息包括new Requested NSSAI。
如果AMF在上次注册过程中发送给终端设备的Allowed NSSAI(或者说，是终端设备的current Allowed NSSAI，或者也可以称为终端设备的old Allowed NSSAI)包含的一个或多个S-NSSAI需要执行NSSAA流程，而这一个或多个S-NSSAI中的部分或全部并不包含在new Requested NSSAI中，那么AMF就可以确定终端设备允许接入的NSSAI发生了改变。例如，本次注册流程中所携带的new Requested NSSAI不包含需要执行NSSAA流 程的S-NSSAI，而终端设备的current Allowed NSSAI包括了需要执行NSSAA流程的S-NSSAI，则AMF就可以确定终端设备允许接入的NSSAI发生了改变，因为此时，终端设备允许接入的NSSAI里不包括需要执行NSSAA流程的S-NSSAI。
例如，第一网络切片的S-NSSAI可以是终端设备的current Allowed NSSAI所包括的需要执行NSSAA流程的S-NSSAI中的一个，而new Requested NSSAI不包含第一网络切片的S-NSSAI。此时，AMF可以基于new Requested NSSAI确定new Allowed NSSAI，其中new Allowed NSSAI不包含需要执行NSSAA流程的S-NSSAI。例如new Allowed NSSAI可以包括new Requested NSSAI所包括的全部或部分S-NSSAI。
又例如，第二网络切片的S-NSSAI可以是终端设备的current Allowed NSSAI所包括的S-NSSAI的一个，第二网络切片的S-NSSAI与第一网络切片的S-NSSAI映射，第一网络切片需要执行NSSAA流程。而new Requested NSSAI不包含第二网络切片的S-NSSAI。此时，AMF可以基于new Requested NSSAI确定new Allowed NSSAI，其中new Allowed NSSAI不包含第二网络切片的S-NSSAI。例如new Allowed NSSAI可以包括new Requested NSSAI所包括的全部或部分S-NSSAI。
与确定方式一类似的，作为一种可选的方式，如果该终端设备的上下文包含了第一网络切片的Authentication and Authorization status，则AMF可以在该终端设备的上下文中将第一网络切片的Authentication and Authorization status删掉。
例如，AMF保存的该终端设备的current Allowed NSSAI包括S-NSSAI-1和S-NSSAI-2。其中S-NSSAI-1需要执行NSSAA流程，S-NSSAI-2不需要执行NSSAA流程。如果S703中的注册请求消息包括new Requested NSSAI，new Requested NSSAI包括S-NSSAI-2且不包括S-NSSAI-1，则AMF根据new Requested NSSAI生成new Allowed NSSAI，new Allowed NSSAI包含S-NSSAI-2。可选的，AMF还可以在终端设备的上下文中删除S-NSSAI-1执行NSSAA流程的鉴权结果。
又例如，AMF保存的该终端设备的current Allowed NSSAI包括S-NSSAI-A和S-NSSAI-B。其中S-NSSAI-A与S-NSSAI-1映射，S-NSSAI-B与S-NSSAI-2映射，S-NSSAI-1需要执行NSSAA流程，S-NSSAI-2不需要执行NSSAA流程。如果S703中的注册请求消息包括new Requested NSSAI，new Requested NSSAI包括S-NSSAI-B且不包括S-NSSAI-A，则AMF根据new Requested NSSAI生成new Allowed NSSAI，new Allowed NSSAI包含S-NSSAI-B。可选的，AMF还可以在终端设备的上下文中删除S-NSSAI-1执行NSSAA流程的鉴权结果。
确定方式三
在这种确定方式下，S703中的注册请求消息包括UE 5GMM Core Network Capability和new Requested NSSAI。
如果该UE 5GMM Core Network Capability指示终端设备不支持NSSAA流程，而AMF在上次注册过程中发送给终端设备的Allowed NSSAI(或者说，是终端设备的current Allowed NSSAI，或者也可以称为终端设备的old Allowed NSSAI)包括了需要执行NSSAA流程的S-NSSAI，那么AMF就可以确定终端设备允许接入的NSSAI发生了改变，因为此时，终端设备允许接入的NSSAI里不包括需要执行NSSAA流程的S-NSSAI。例如，第一网络切片的S-NSSAI可以是终端设备当前的current Allowed NSSAI所包括的需要执行NSSAA流程的S-NSSAI中的一个。在这种情况下，AMF可以确定new Requested NSSAI 是否包括需要执行NSSAA流程的S-NSSAI。如果new Requested NSSAI包括需要执行NSSAA流程的S-NSSAI，AMF将这些需要执行NSSAA流程的S-NSSAI从new Requested NSSAI中删除，生成new Allowed NSSAI，new Allowed NSSAI例如包括new Requested NSSAI中的除了需要执行NSSAA流程的S-NSSAI之外剩余的全部或部分S-NSSAI。而如果new Requested NSSAI不包括需要执行NSSAA流程的S-NSSAI，则AMF根据new Requested NSSAI生成new Allowed NSSAI即可，new Allowed NSSAI例如包括new Requested NSSAI中的全部或部分S-NSSAI。
例如，S703中的注册请求消息包括的new Requested NSSAI包括S-NSSAI-1和S-NSSAI-2。其中S-NSSAI-1需要执行NSSAA流程，S-NSSAI-2不需要执行NSSAA流程。如果S703中的注册请求消息包括的UE 5GMM Core Network Capability指示终端设备不支持NSSAA流程，则AMF根据new Requested NSSAI生成new Allowed NSSAI，new Allowed NSSAI包含S-NSSAI-2而不包括S-NSSAI-1。可选的，AMF还可以在终端设备的上下文中删除S-NSSAI-1执行NSSAA流程的鉴权结果。
又例如，S703中的注册请求消息包括的new Requested NSSAI包括S-NSSAI-A和S-NSSAI-B。其中，S-NSSAI-A与S-NSSAI-1映射，S-NSSAI-B与S-NSSAI-2映射，S-NSSAI-1需要执行NSSAA流程，S-NSSAI-2不需要执行NSSAA流程。如果S703中的注册请求消息包括的UE 5GMM Core Network Capability指示终端设备不支持NSSAA流程，则AMF根据new Requested NSSAI生成new Allowed NSSAI，new Allowed NSSAI包含S-NSSAI-B而不包括S-NSSAI-A。可选的，AMF还可以在终端设备的上下文中删除S-NSSAI-1执行NSSAA流程的鉴权结果。
或者，如果该UE 5GMM Core Network Capability指示终端设备支持NSSAA流程，那么AMF后续的处理方式可参考前述的确定方式二。
与前述的确定方式一类似的，在确定方式三下，作为一种可选的方式，如果该终端设备的上下文包含了第一网络切片的Authentication and Authorization status，则AMF可以在该终端设备的上下文中将第一网络切片的Authentication and Authorization status删掉。
作为一种可选的实施方式，如果AMF确定终端设备不再接入第一网络切片或第二网络切片，则AMF还可以删除第一网络切片执行NSSAA流程的鉴权结果，在前述的一些示例中也有介绍。根据现有技术，一个HPLMN S-NSSAI的Authentication and Authorization status也可以称为是该S-NSSAI执行NSSAA流程的鉴权结果，通常保存在AMF存储的该终端设备的上下文中。保留S-NSSAI执行NSSAA流程的鉴权结果是为了让终端设备下一次能够尽快接入该S-NSSAI对应的网络切片，例如一个S-NSSAI执行NSSAA流程的鉴权结果为鉴权成功，则终端设备下一次再请求接入该S-NSSAI对应的网络切片时可尽快接入，无需再执行NSSAA流程。如果该终端设备的上下文包含了第一网络切片对应的Authentication and Authorization status，可选的，则AMF可以在该终端设备的上下文中将第一网络切片应的鉴权结果删掉。因为终端设备已经不再接入第一网络切片，因此也就不必再保存第一网络切片的鉴权结果，则AMF可以将第一网络切片的鉴权结果删除，以节省AMF的存储空间，也简化终端设备的上下文。
综上所述，AMF可以根据第一条件，确定终端设备不再接入第一网络切片或第二网络切片。需要注意的是，本申请实施例中，AMF还可以根据其他方式确定终端设备不再接入第一网络切片或第二网络切片，本申请实施例不做限定。例如，AMF还可以根据终端设备 的签约信息确定终端设备允许接入的NSSAI发生改变，具体地，改变前的终端设备签约的切片信息包含第一网络切片的标识，改变后的终端设备签约的切片信息不包含第一网络切片的标识，则AMF根据改变后的终端设备签约的切片信息确定终端设备不再接入第一网络切片。
S705、AMF向认证网元发送第一信息，认证网元接收来自AMF的第一信息。
第一信息可以指示终端设备不再接入第一网络切片(UE no longer access to this S-NSSAI)，或者，指示该AMF取消向认证网元订阅第一通知，或者，指示终端设备不再接入第一网络切片以及指示该AMF取消向认证网元订阅第一通知。
在本申请实施例中，AMF确定向认证网元发送第一信息的方法，包括但不限于以下两种：
第一种：终端设备之前接入的网络切片是第一网络切片，当终端设备不再接入该第一网络切片，则AMF确定向认证网元发送第一信息。
例如非漫游场景下，终端设备请求接入HPLMN S-NSSAI-1所标识的网络切片，且HPLMN S-NSSAI-1成功执行NSSAA流程，即HPLMN S-NSSAI-1为第一网络切片。终端设备接入HPLMN S-NSSAI-1之后的某一时刻，终端设备不再接入HPLMN S-NSSAI-1，则AMF确定向认证网元发送第一信息。
第二种：终端设备之前接入的网络切片是第二网络切片，第二网络切片与第一网络切片映射，当终端设备不再接入该第二网络切片，则AMF确定向认证网元发送第一信息。
例如漫游场景下，终端设备请求接入VPLMN S-NSSAI-A所标识的网络切片，VPLMN S-NSSAI-A与HPLMN S-NSSAI-1映射，且HPLMN S-NSSAI-1成功执行NSSAA流程，即HPLMN S-NSSAI-1为第一网络切片，VPLMN S-NSSAI-A为第二网络切片。终端设备接入VPLMN S-NSSAI-A之后的某一时刻，终端设备不再接入VPLMN S-NSSAI-A，AMF确定向认证网元发送第一信息。
其中，第一信息指示终端设备不再接入第一网络切片，也可以理解为，第一信息可以指示终端设备不再接入N个网络切片，N个网络切片包括第一网络切片，N为大于或等于1的整数。该第一通知可以包括对第一网络切片执行重鉴权的通知(或者，也可以称为对第一网络切片执行鉴权的通知)，或者包括对第一网络切片执行撤销授权的通知。重鉴权的通知例如为执行Re-authentication and Re-authorization流程的通知，撤销授权的通知例如为执行Revocation流程的通知。该第一通知可以包括对第一网络切片执行重鉴权的事件(或者，也可以称为对第一网络切片执行鉴权的事件)的通知，或者包括对第一网络切片执行撤销授权的事件的通知。重鉴权的通知例如为执行Re-authentication and Re-authorization流程的事件的通知，撤销授权的通知例如为执行Revocation流程的事件的通知。
可以理解为，取消订阅后，认证网元不再向该AMF发送用于触发对第一网络切片的执行Re-authentication and Re-authorization的请求消息，或者，认证网元不再向该AMF发送用于触发对第一网络切片执行Revocation的请求消息。可选的，第一信息指示AMF取消向认证网元订阅第一通知，也可以描述为，AMF指示认证网元停止对第一网络切片执行重鉴权(或鉴权)，或停止对第一网络切片执行撤销授权。其中，AMF指示认证网元停止对第一网络切片执行重鉴权(或鉴权)，即，指示认证网元停止对第一网络切片执行Re-authentication and Re-authorization流程；AMF指示认证网元停止对第一网络切片执行撤销授权，即，指示认证网元停止对第一网络切片执行Revocation流程。
可以理解为，本实施例中，第一信息指示AMF取消向认证网元订阅对第一网络切片执行重鉴权的通知的含义与第一信息指示认证网元不再向该AMF发送用于触发对第一网络切片的执行Re-authentication and Re-authorization的请求消息的含义相同，或者，第一信息指示AMF取消向认证网元订阅对第一网络切片执行撤销授权的通知的含义与第一信息指示认证网元不再向该AMF发送用于触发对第一网络切片的执行Revocation的请求消息的含义相同。
在本申请实施例中，如果AMF确定终端设备不再接入第一网络切片或第二网络切片，那么AMF可以向认证网元发送第一信息，以通过第一信息指示终端设备不再接入第一网络切片或指示AMF取消向认证网元订阅第一通知，从而认证网元可以明确，后续不必再对该终端设备发起针对第一网络切片的Re-authentication and Re-authorization流程或者Revocation流程，以能够节省核心网的信令开销。
以认证网元是AAA-S为例，AMF与AAA-S之间进行的信息交互可以借助于中间网元。例如，AMF向AAA-S发送第一信息，可以理解为，AMF向AUSF发送第一信息，AUSF再将第一信息转发给AAA-S，这是AUSF与AAA-S能够直接通信的情况。或者，如果AUSF与AAA-S需要借助于AAA-P进行通信，那么，AMF向AAA-S发送第一信息可以理解为，AMF向AUSF发送第一信息，AUSF将第一信息转发给AAA-P，AAA-P再将第一信息转发给AAA-S。
图7以认证网元是AAA-S且AAA-S和AUSF能够直接通信为例，S705可以包括S705a和S705b。其中，S705a和S705b未在图7中画出。
S705a、AMF调用服务化操作Nausf_NSSAA_Notify向AUSF发送消息，或者，AMF调用服务化操作Nausf_NSSAA_去订阅(Unsubscribe)向AUSF发送消息，AUSF接收来自AMF的该消息。例如将该消息称为第一消息，第一消息可包括第一信息。
作为可选的方式，第一消息除了包括第一信息之外，还可以包括终端设备的标识(例如GPSI)、AAA-S的地址信息以及第一网络切片对应的S-NSSAI。第一消息包含的AAA-S的地址信息可以是AMF根据终端设备的签约信息确定的，其中，终端设备的签约信息包含了AAA-S的地址信息。
其中，AMF确定第一消息中包含的第一网络切片对应的S-NSSAI，有两种实现方式：
第一种，AMF确定终端设备不再接入第一网络切片，则第一消息包含第一网络切片对应的S-NSSAI。示例性地，如果第一网络切片有多个(即终端设备不再接入的第一网络切片有多个)，那么第一消息可以包括多个S-NSSAI，多个S-NSSAI中的每个S-NSSAI标识一个第一网络切片。
第二种，AMF确定终端设备不再接入第二网络切片，其中，第二网络切片与第一网络切片存在映射关系，则第一消息包含第一网络切片对应的S-NSSAI。示例性地，如果第二网络切片有多个(即终端设备不再接入的第二网络切片有多个)，那么第一消息包括多个S-NSSAI，多个S-NSSAI中的每个S-NSSAI标识一个第一网络切片。
S705b、AUSF将服务化操作Nausf_NSSAA_Notify或者Nausf_NSSAA_Unsubscribe进行协议转化，并向AAA-S转发第一消息，AAA-S接收来自AUSF的第一消息。作为一种实现方式，AUSF可以将服务化操作Nausf_NSSAA_Notify或者Nausf_NSSAA_Unsubscribe转化成Diameter协议，如会话中止请求(Session Termination Request)消息，本实施例不做限定。
S706、AAA-S收到第一信息后，后续不再针对该S-NSSAI发起Re-authentication and Re-authorization流程或者Revocation流程，以节省核心网信令。
可选的，AAA-S还可以删除所存储的第一网络切片执行NSSAA流程的鉴权结果。其中，AAA-S可以是删除所存储的第一信息指示的N个网络切片执行NSSAA流程的鉴权结果，N个网络切片包括第一网络切片。另外，一个网络切片执行NSSAA流程的鉴权结果，是指该网络切的S-NSSAI执行NSSAA流程的鉴权结果。
AAA-S后续不再针对该N个S-NSSAI发起Re-authentication and Re-authorization流程或者Revocation流程，以节省核心网信令。
以认证网元是AUSF为例，AMF跟AUSF可以直接进行信息交互。在这种情况下，S705可以包括S705a’和S705b’。
S705a’、AMF调用服务化操作Nausf_NSSAA_Notify向AUSF发送消息，或者，AMF调用服务化操作Nausf_NSSAA_去订阅(Unsubscribe)向AUSF发送消息，AUSF接收来自AMF的该消息。例如将该消息称为第一消息，第一消息可包括第一信息。作为可选的方式，第一消息除了包括第一信息之外，还可以包括终端设备的标识(例如GPSI)以及第一网络切片对应的S-NSSAI。
其中，AMF确定第一消息中包含的第一网络切片对应的S-NSSAI，有两种实现方式：
第一种，AMF确定终端设备不再接入第一网络切片，则第一消息包含第一网络切片对应的S-NSSAI。示例性地，如果第一网络切片有多个(即终端设备不再接入的第一网络切片有多个)，那么第一消息包括多个S-NSSAI，多个S-NSSAI中的每个S-NSSAI标识一个第一网络切片。
第二种，AMF确定终端设备不再接入第二网络切片，其中，第二网络切片与第一网络切片存在映射关系，则第一消息包含第一网络切片对应的S-NSSAI。示例性地，如果第二网络切片有多个(即终端设备不再接入的第二网络切片有多个)，那么第一消息包括多个S-NSSAI，多个S-NSSAI中的每个S-NSSAI标识一个第一网络切片。
S705b’、AUSF收到第一信息后，后续不再针对该S-NSSAI发起Re-authentication and Re-authorization流程或者Revocation流程，以节省核心网信令。例如，后续当AUSF收到AAA-S发送的Re-authentication and Re-authorization请求消息或者Revocation请求消息，AUSF不再将该消息转发至AMF网元。
在本申请实施例中，如果AMF确定终端设备不再接入第一网络切片或第二网络切片，则AMF可以主动通知认证网元，如AAA-S，AAA-S只需接收来自AMF的第一信息就可以确定终端设备不再接入第一网络切片或者确定AMF取消向AAA-S订阅第一通知，则后续AAA-S不会再次针对第一网络切片发起Re-authentication and Re-authorization流程或者Revocation流程，可以进一步节省核心网信令，也简化AAA-S的实现。
为了解决同样的技术问题，本申请实施例提供第二种通信方法，请参见图8，为该方法的流程图。在下文的介绍过程中，以该方法应用于图1或图2所示的网络架构为例。其中，图8所示的实施例所涉及的AMF也可以称为第一AMF，或者称为第一移动性管理网元。
S801、AMF针对每一个需要执行NSSAA流程的S-NSSAI发起NSSAA流程。关于NSSAA流程的具体步骤可参考图6所示的流程的介绍。
AMF如果获知某个网络切片执行NSSAA流程的鉴权结果为鉴权成功，则允许终端设 备接入该网络切片，AMF为该终端设备生成new Allowed NSSAI，其中new Allowed NSSAI中包含了成功执行NSSAA流程的网络切片的标识。同时，针对成功执行NSSAA流程的S-NSSAI，AMF在终端设备的上下文中保存该S-NSSAI的Authentication and Authorization status。而且，AAA-S保存该终端设备的标识和成功执行NSSAA流程的S-NSSAI的对应关系。终端设备的标识例如为GPSI等。
例如，AMF确定第一网络切片成功执行了NSSAA流程，则AMF可以将第一网络切片的S-NSSAI添加到new Allowed NSSAI中，且AMF可以在该终端设备的上下文中保存第一网络切片的Authentication and Authorization status。而且，AAA-S可以保存该终端设备的标识和第一网络切片的S-NSSAI的对应关系。也就是说，在本申请实施例中，第一网络切片可以是成功执行NSSAA流程的网络切片。可以理解为，由于第一网络切片成功执行了NSSAA流程，AMF向终端设备发送的new Allowed NSSAI包含第一网络切片对应的S-NSSAI，而AAA-S也保存了该终端设备的标识和第一网络切片的S-NSSAI之间的对应关系。
又例如，AMF确定第一网络切片成功执行了NSSAA流程，第二网络切片与第一网络切片映射，则AMF可以将第二网络切片的S-NSSAI添加到new Allowed NSSAI中，且AMF可以在该终端设备的上下文中保存第一网络切片的Authentication and Authorization status。而且，AAA-S可以保存该终端设备的标识和第一网络切片的S-NSSAI的对应关系。也就是说，在本申请实施例中，第一网络切片可以是成功执行NSSAA流程的网络切片。可以理解为，由于第一网络切片成功执行了NSSAA流程，AMF向终端设备发送的new Allowed NSSAI包含第二网络切片对应的S-NSSAI，而AAA-S也保存了该终端设备的标识和第一网络切片的S-NSSAI之间的对应关系。
S802、AAA-S保存该终端设备的标识和成功执行NSSAA流程的S-NSSAI的对应关系。终端设备的标识例如为GPSI等。
S803、认证网元通过AUSF向AMF发送订阅请求消息，AMF接收来自认证网元的订阅请求消息。当认证网元为AAA-S，AAA-S无法与AMF直接通信，需要通过AUSF中转。另外，如果AAA-S无法直接与AUSF通信，则AAA-S与AUSF之间还需要通过AAA-P中转。
图8所示的实施例以认证网元是AAA-S且AAA-S和AUSF之间无需通过AAA-P中转为例。那么，S803可以包括S803a～S803d，其中S803a～S803d并未在图8中画出。
S803a、AAA-S向AUSF发送订阅请求消息，AUSF接收来自AAA-S的订阅请求消息。该订阅请求消息例如为AAA协议订阅请求(AAA protocol subscription request)消息。
该订阅请求消息可以包括该终端设备的标识，包括N个网络切片的标识(例如N个网络切片的N个S-NSSAI，其中网络切片与S-NSSAI一一对应)，以及包括订阅事件信息，订阅事件信息为终端设备不再接入N个网络切片中的每个网络切片的事件。N为大于或等于1的整数。即，AMF接收该订阅请求消息后，如果确定终端设备不再接入N个网络切片中的任一个网络切片，则AMF可以基于该订阅请求消息将终端设备不再接入该网络切片的事件告知AAA-S。
为了表述方便，本申请实施例中将订阅请求消息中包含的网络切片称为第一网络切片。即，该订阅请求消息订阅了终端设备不再接入第一网络切片(UE no longer access to this S-NSSAI)的事件。
其中，N个S-NSSAI可以是AAA-S存储的与该终端设备具有对应关系的全部或部分S-NSSAI。如果AAA-S需要订阅的S-NSSAI的个数大于1，那么AAA-S可以通过一条订阅请求消息发送需要订阅的所有的S-NSSAI，或者，AAA-S也可以通过多条订阅请求消息发送需要订阅的S-NSSAI，例如每条订阅请求消息可包括一个或多个S-NSSAI。
S803b、AUSF调用服务化操作Nudm_UECM_Get向UDM发送查询消息，UDM接收来自AUSF的查询消息，该查询消息用于查询服务于该终端设备的AMF的标识。
例如Nudm_UECM_Get中包括该终端设备的标识，例如该终端设备的GPSI。
S803c、UDM通过服务化操作Nudm_UECM_Get response向AUSF发送AMF的标识，AUSF接收来自UDM的AMF的标识。
其中，S803b和S803c是可选的步骤。
S803d、AUSF将来自AAA–S的订阅请求消息进行协议转换，并调用AMF的服务化操作Namf_事件开放(EventExposure)_Subscribe，将该订阅请求消息所包括的内容发送给AMF，AMF接收来自AUSF的信息。例如将调用服务化操作Namf_EventExposure_Subscribe传输的消息表示为事件开放订阅消息。
该事件开放订阅请求消息包括该终端设备的标识，N个网络切片的标识(例如N个S-NSSAI)，以及包括订阅事件信息。这样，相当于AAA-S将订阅请求消息发送给了AMF，也相当于AMF接收了来自AAA-S的订阅请求消息。
S804、AMF调用服务化操作Namf_EventExposure_Subscribe ACK向AUSF发送订阅响应消息，AUSF接收来自AMF的订阅响应消息。订阅响应消息表示订阅成功。
另外，AMF也可以保存该订阅请求消息所包括的订阅事件信息。
S805、AUSF将来自AMF的订阅响应进行协议转化，并向AAA-S发送订阅响应消息，AAA-S接收来自AUSF的订阅响应消息。该订阅响应消息用于指示订阅成功，则AAA-S可以确定订阅成功。
S806、AMF根据第一条件确定终端设备不再接入第一网络切片或第二网络切片。
第一条件可以包括多种，例如一种第一条件为，终端设备从该AMF去注册；例如另一种第一条件为，终端设备从第一网络移动到第二网络；例如又一种第一条件为，终端设备允许接入的NSSAI发生改变，等等。
如果第一条件包括终端设备允许接入的NSSAI发生改变，那么AMF确定终端设备允许接入的NSSAI发生改变，一种可能的确定方式为，在AAA-S向AMF发送第二消息之前，或者说是在AAA-S发起Re-authentication and Re-authorization流程或Revocation流程之前，终端设备向AMF发起了注册请求消息，AMF根据该注册请求消息可以确定终端设备允许接入的NSSAI发生改变。如果是这种情况，在S806之前还可以包括S807，终端设备发起注册流程。在图8中表示为，终端设备向AMF发送注册请求消息，AMF接收来自终端设备的注册请求消息。
关于步骤S806的更多内容，可参考图7中步骤S704的描述，此处不再赘述。
S808、AMF向AAA-S发送第一信息，AAA-S接收来自AMF的第一信息。
例如，第一信息可以指示终端设备不再接入第一网络切片(UE no longer access to this S-NSSAI)。其中，第一信息指示终端设备不再接入第一网络切片，也可以理解为，第一信息可以指示终端设备不再接入N个网络切片，N个网络切片包括第一网络切片，N为大于或等于1的整数。
在本申请实施例中，AMF确定向AAA-S发送第一信息的方法，可以包括但不限于以下两种：
第一种：终端设备之前接入的网络切片是第一网络切片，当终端设备不再接入该第一网络切片，则AMF确定向AAA-S发送第一信息。
例如非漫游场景下，终端设备请求接入HPLMN S-NSSAI-1所标识的网络切片且HPLMN S-NSSAI-1成功执行NSSAA流程，即HPLMN S-NSSAI-1为第一网络切片。终端设备接入HPLMN S-NSSAI-1之后的某一时刻，终端设备不再接入HPLMN S-NSSAI-1，则AMF确定向AAA-S发送第一信息。
第二种：终端设备之前接入的网络切片是第二网络切片，第二网络切片与第一网络切片映射，当终端设备不再接入该第二网络切片，则AMF确定向AAA-S发送第一信息。
例如漫游场景下，终端设备请求接入VPLMN S-NSSAI-A所标识的网络切片,VPLMN S-NSSAI-A与HPLMN S-NSSAI-1映射，且HPLMN S-NSSAI-1成功执行NSSAA流程，即HPLMN S-NSSAI-1为第一网络切片，VPLMN S-NSSAI-A为第二网络切片。终端设备接入VPLMN S-NSSAI-A之后的某一时刻，终端设备不再接入VPLMN S-NSSAI-A，AMF确定向AAA-S发送第一信息。
因为订阅请求消息订阅了终端设备不再接入N个网络切片中的每个网络切片的事件，那么只要终端设备不再接入N个网络切片中的任一个网络切片，或者终端设备从网络去注册，或者终端设备从第一网络移动到第二网络，AMF就会根据订阅请求消息向AAA-S进行通知。第一网络切片是N个网络切片中的一个，AMF确定终端设备不再接入第一网络切片或第二网络切片，则AMF可以根据订阅请求消息向AAA-S发送第一信息。
本申请实施例中，如果AMF确定终端设备不再接入第一网络切片或第二网络切片，那么AMF可以将终端设备不再接入第一网络切片的信息告知AAA-S，即，通过第一信息指示终端设备不再接入第一网络切片，从而AAA-S可以明确，后续不必再对该终端设备发起针对第一网络切片的Re-authentication and Re-authorization流程或者Revocation流程，从而能够节省核心网的信令开销。
其中，S808具体可以包括S808a和S808b，S808a和S808b并未在图8中画出。
S808a、AMF调用服务化操作Namf_EventExposure_Notify向AUSF发送第一消息，AUSF接收来自AMF的第一消息。第一消息可以包括第一信息，第一信息指示终端设备不再接入第一网络切片。作为可选的方式，第一消息除了包括第一信息之外，还可以包括终端设备的标识(例如GPSI)、AAA-S的地址信息以及第一网络切片对应的S-NSSAI。第一消息包含的AAA-S的地址信息可以是AMF根据终端设备的签约信息确定的，其中，终端设备的签约信息包含了AAA-S的地址信息。
其中，AMF确定第一消息中包含的第一网络切片对应的S-NSSAI，有两种实现方式：
第一种，AMF确定终端设备不再接入第一网络切片，则第一消息包含第一网络切片对应的S-NSSAI。示例性地，如果第一网络切片有多个(即终端设备不再接入的第一网络切片有多个)，那么第一消息包括多个S-NSSAI，多个S-NSSAI中的每个S-NSSAI标识一个第一网络切片。
第二种，AMF确定终端设备不再接入第二网络切片，其中，第二网络切片与第一网络切片存在映射关系，则第一消息包含第一网络切片对应的S-NSSAI。示例性地，如果第二网络切片有多个(即终端设备不再接入的第二网络切片有多个)，那么第一消息包括多个 S-NSSAI，多个S-NSSAI中的每个S-NSSAI标识一个第一网络切片。
S808b、AUSF将服务化操作Namf_EventExposure_Notify进行协议转化，并向AAA-S转发第一消息，AAA-S接收来自AUSF的第一消息。作为一种实现方式，AUSF可以将服务化操作Namf_EventExposure_Notify转化成Diameter协议，如会话中止请求(Session Termination Request)消息，本实施例不做限定。
S809、AAA-S收到第一信息后，后续不再针对该S-NSSAI发起Re-authentication and Re-authorization流程或者Revocation流程，以节省核心网信令。
可选的，AAA-S还可以删除所存储的第一网络切片执行NSSAA流程的鉴权结果。其中，AAA-S可以是删除所存储的第一信息指示的N个网络切片执行NSSAA流程的鉴权结果，N个网络切片包括第一网络切片。另外，一个网络切片执行NSSAA流程的鉴权结果，是指该网络切的S-NSSAI执行NSSAA流程的鉴权结果。
AAA-S后续不再针对该N个S-NSSAI发起Re-authentication and Re-authorization流程或者Revocation流程，以节省核心网信令。
以认证网元是AUSF为例，AMF跟AUSF可以直接进行信息交互。在这种情况下，S803可以包括S803a’至S803g’。
S803a’、AUSF调用服务化操作Nudm_UECM_Get向UDM发送查询消息，UDM接收来自AUSF的查询消息，该查询消息用于查询服务于该终端设备的AMF的标识。
例如通过Nudm_UECM_Get发送的查询消息包括该终端设备的标识，例如该终端设备的GPSI。
S803b’、UDM通过服务化操作Nudm_UECM_Get response向AUSF发送AMF的标识，AUSF接收来自UDM的AMF的标识。
S803c’、AUSF向AMF发送订阅请求消息，该订阅请求消息可以包括该终端设备的标识，N个网络切片的标识(例如N个网络切片的N个S-NSSAI，其中网络切片与S-NSSAI一一对应)，以及包括订阅事件信息，订阅事件信息为终端设备不再接入N个网络切片中的每个网络切片的事件。N为大于或等于1的整数。即，AMF接收该订阅请求消息后，如果确定终端设备不再接入N个网络切片中的任一个网络切片，则AMF可以基于该订阅请求消息将终端设备不再接入该网络切片的事件告知AUSF。
例如AUSF调用AMF的服务化操作Namf_事件开放(EventExposure)_Subscribe，将订阅请求消息所包括的内容发送给AMF，AMF接收来自AUSF的信息。
S803d’、AMF调用服务化操作Namf_EventExposure_Subscribe ACK向AUSF发送订阅响应消息，AUSF接收来自AMF的订阅响应消息。订阅响应消息表示订阅成功。
另外，AMF也可以保存该订阅请求消息所包括的订阅事件信息。
S803e’、AMF根据第一条件确定终端设备不再接入第一网络切片或第二网络切片。
该步骤的具体描述可以参考S806。
S803f’、AMF调用服务化操作Namf_EventExposure_Notify向AUSF发送第一消息，AUSF接收来自AMF的第一消息。第一消息可以包括第一信息，第一信息指示终端设备不再接入第一网络切片。作为可选的方式，第一消息除了包括第一信息之外，还可以包括终端设备的标识(例如GPSI)以及第一网络切片对应的S-NSSAI。
其中，AMF确定第一消息中包含的第一网络切片对应的S-NSSAI，有两种实现方式：
第一种，AMF确定终端设备不再接入第一网络切片，则第一消息包含第一网络切片对 应的S-NSSAI。示例性地，如果第一网络切片有多个(即终端设备不再接入的第一网络切片有多个)，那么第一消息包括多个S-NSSAI，多个S-NSSAI中的每个S-NSSAI标识一个第一网络切片。
第二种，AMF确定终端设备不再接入第二网络切片，其中，第二网络切片与第一网络切片存在映射关系，则第一消息包含第一网络切片对应的S-NSSAI。示例性地，如果第二网络切片有多个(即终端设备不再接入的第二网络切片有多个)，那么第一消息包括多个S-NSSAI，多个S-NSSAI中的每个S-NSSAI标识一个第一网络切片。
S803g’、AUSF收到第一信息后，后续不再针对该S-NSSAI发起Re-authentication and Re-authorization流程或者Revocation流程，以节省核心网信令。例如，后续当AUSF收到AAA-S发送的Re-authentication and Re-authorization请求消息或者Revocation请求消息，AUSF不再将该消息转发至AMF网元。
在本申请实施例中，认证网元，如AAA-S，可以事先发起订阅，以订阅终端设备不再接入第一网络切片的事件。这样，如果AMF确定终端设备不再接入第一网络切片，则AMF可以根据该订阅来通知AAA-S，相当于AMF根据订阅流程进行操作即可。
在图8所示的实施例中，认证网元，如AAA-S，会向AMF进行订阅，AMF根据订阅向AAA-S通知终端设备不再接入所订阅的网络切片的事件。而除了上述的基于订阅来通知AAA-S的方式之外，本申请实施例还提供第三种通信方法，AMF还可以等待认证网元发起Re-authentication and Re-authorization流程或者撤销(Revocation)流程时，再向认证网元通知终端设备不再接入该流程所涉及的网络切片的事件。其中，针对一个网络切片的Revocation流程(或者说是针对一个S-NSSAI的Revocation流程)是为了撤销终端设备接入该网络切片的权限，或者，还可以理解为Revocation流程是为了拒绝终端设备接入该网络切片。可参考图9，为第三种通信方法的流程图。
S901、AMF针对每一个需要执行NSSAA流程的S-NSSAI发起NSSAA流程。关于NSSAA流程的具体步骤可参考图6所示的流程的介绍。
步骤S901可参考图8中步骤S801的描述，此处不再赘述。
S902、AAA-S保存该终端设备的标识和成功执行NSSAA流程的S-NSSAI的对应关系。终端设备的标识例如为GPSI等。
S903、在某个时刻，AAA-S向AMF发送第二消息，AMF接收来自AAA-S的第二消息。第二消息携带S-NSSAI，为了表述方便，本申请实施例中将第二消息中携带的S-NSSAI对应的网络切片称为第一网络切片。第一网络切片可以是成功执行NSSAA流程的网络切片。可以理解为，由于第一网络切片成功执行了NSSAA流程，AMF向终端设备发送的new Allowed NSSAI包含第一网络切片对应的S-NSSAI或者第二网络切片对应的S-NSSAI，其中第二网络切片与第一网络切片映射，而AAA-S也保存了该终端设备的标识和第一网络切片的S-NSSAI之间的对应关系。
第二消息可用于发起针对第一网络切片的Re-authentication and Re-authorization流程，或用于发起针对第一网络切片的Revocation流程。其中，如果第二消息用于发起针对第一网络切片的Re-authentication and Re-authorization流程，那么可以认为第二消息是用于对第一网络切片再次执行NSSAA流程(或者描述为，第二消息用于对第一网络切片执行NSSAA流程)。而如果第二消息用于发起针对第一网络切片的Revocation流程，那么可以认为第二消息是用于撤销授权终端设备接入第一网络切片的权限，或者理解为拒绝终端设备接入 第一网络切片。
AAA-S无法与AMF直接通信，需要通过AUSF中转。另外，如果AAA-S无法直接与AUSF通信，则AAA-S与AUSF之间还需要通过AAA-P中转。本申请实施例以AAA-S和AUSF之间无需通过AAA-P中转为例。那么，S903可以包括S903a～S903d，S903a～S903b并未在图9中画出。
S903a、AAA-S向AUSF发送第二消息，AUSF接收来自AAA-S的第二消息。如果第二消息用于对第一网络切片再次执行NSSAA流程，则第二消息例如为重鉴权请求(Re-Auth Request)消息。或者，如果第二消息用于拒绝终端设备接入第一网络切片，则第二消息例如为撤销请求(Revocation Request)消息。
可选的，第二消息可以包括该终端设备的标识，例如该终端设备的GPSI，还可以包括第一网络切片的标识，例如第一网络切片的S-NSSAI，另外还可以包括通知信息。该通知信息所指示的通知为第一通知，第一通知例如为对第一网络切片再次执行NSSAA的通知(或者将第一通知描述为NSSAA通知，或者描述为对第一网络切片执行重鉴权的通知，或者描述为对第一网络切片执行鉴权的通知)，或者，第一通知例如为拒绝终端设备接入第一网络切片的通知(或者将第一通知描述为Revocation通知，或者描述为对第一网络切片执行撤销授权的通知)。表明第二消息是为了对该终端设备发起针对第一网络切片的Re-authentication and Re-authorization流程或Revocation流程。
可选的，该第一通知信息还可以是第一事件的通知信息，第一事件例如为对第一网络切片再次执行NSSAA的事件(或者将第一事件描述为NSSAA事件，或者描述为对第一网络切片执行重鉴权的事件，或者描述为对第一网络切片执行鉴权的事件)，或者，第一事件例如为拒绝终端设备接入第一网络切片的事件(或者将第一事件描述为Revocation事件，或者描述为对第一网络切片执行撤销授权的事件)。
S903b、AUSF调用服务化操作Nudm_UECM_Get向UDM发送查询消息，UDM接收来自AUSF的查询消息。该查询消息用于查询服务于该终端设备的AMF的标识，UDM接收来自AUSF的查询消息。
例如Nudm_UECM_Get中包括该终端设备的标识，例如该终端设备的GPSI。
S903c、UDM通过服务化操作Nudm_UECM_Get response向AUSF发送AMF的标识，AUSF接收来自UDM的AMF的标识。
其中，S903b和S903c是可选的步骤。
S903d、AUSF将来自AAA–S的第二消息进行协议转换，并调用AUSF的服务化操作Nausf_NSSAA_Notify，将第二消息所包括的内容发送给AMF，AMF接收来自AUSF的信息。
第二消息可以包括该终端设备的标识，例如该终端设备的GPSI，还可以包括第一网络切片的标识，例如第一网络切片的S-NSSAI，另外还可以包括通知信息。则AUSF可以将第二消息所包括的该终端设备的标识、第一网络切片的标识以及通知信息发送给AMF。
S904、AMF根据第一条件确定终端设备不再接入第一网络切片或第二网络切片。
第一条件可以包括多种，例如一种第一条件为，终端设备从该AMF去注册；例如另一种第一条件为，终端设备从第一网络移动到第二网络；例如又一种第一条件为，终端设备允许接入的NSSAI发生改变，等等。
如果第一条件包括终端设备允许接入的NSSAI发生改变，那么AMF确定终端设备允 许接入的NSSAI发生改变，一种可能的确定方式为，在AAA-S向AMF发送第二消息之前，或者说是在AAA-S发起Re-authentication and Re-authorization流程或Revocation流程之前，终端设备向AMF发起了注册请求消息，AMF根据该注册请求消息可以确定终端设备允许接入的NSSAI发生改变。如果是这种情况，在S903之前还可以包括S905，终端设备发起注册流程。在图9中表示为，终端设备向AMF发送注册请求消息，AMF接收来自终端设备的注册请求消息。
关于步骤S904的更多内容，可参考图7中步骤S704的描述，此处不再赘述。
S906、AMF向认证网元发送第一信息，认证网元接收来自AMF的第一信息。第一信息例如包括失败指示，所述的失败指示用于表示第一网络切片的Re-authentication and Re-authorization流程失败，或表示第一网络切片的Revocation流程失败。
可选的，AMF向认证网元发送第一信息。第一信息用于指示终端设备不再接入第一网络切片(UE no longer access to this S-NSSAI)。例如，第一信息可以包括失败指示，失败指示例如为第一网络切片的Re-authentication and Re-authorization流程失败的失败原因值，或者是第一网络切片的Revocation流程失败的失败原因值。那么相当于第一信息指示了终端设备不再接入第一网络切片。
可选的，AMF向认证网元发送第一信息。第一信息用于指示该AMF取消向认证网元订阅第一通知。
在本申请实施例中，AMF确定向认证网元发送第一信息的方法，可以包括但不限于以下两种：
第一种：终端设备之前接入的网络切片是第一网络切片，当终端设备不再接入该第一网络切片，则AMF确定向认证网元发送第一信息。
例如非漫游场景下，终端设备请求接入HPLMN S-NSSAI-1所标识的网络切片且HPLMN S-NSSAI-1成功执行NSSAA流程，即HPLMN S-NSSAI-1为第一网络切片。终端设备接入HPLMN S-NSSAI-1之后的某一时刻，终端设备不再接入HPLMN S-NSSAI-1，则AMF确定向AAA-S发送第一信息。
第二种：终端设备之前接入的网络切片是第二网络切片，第二网络切片与第一网络切片映射，当终端设备不再接入该第二网络切片，则AMF确定向认证网元发送第一信息。
例如漫游场景下，终端设备请求接入VPLMN S-NSSAI-A所标识的网络切片，VPLMN S-NSSAI-A与HPLMN S-NSSAI-1映射，且HPLMN S-NSSAI-1成功执行NSSAA流程，即HPLMN S-NSSAI-1为第一网络切片，VPLMN S-NSSAI-A为第二网络切片。终端设备接入VPLMN S-NSSAI-A之后的某一时刻，终端设备不再接入VPLMN S-NSSAI-A，AMF确定向认证网元发送第一信息。
其中，第一信息指示终端设备不再接入第一网络切片，也可以理解为，第一信息可以指示终端设备不再接入N个网络切片，N个网络切片包括第一网络切片，N为大于或等于1的整数。该第一通知可以包括对第一网络切片执行重鉴权的通知(或者，也可以称为对第一网络切片执行鉴权的通知)，或者包括对第一网络切片执行撤销授权的通知。重鉴权的通知例如为执行Re-authentication and Re-authorization流程的通知，撤销授权的通知例如为执行Revocation流程的通知。该第一通知可以包括对第一网络切片执行重鉴权的事件(或者，也可以称为对第一网络切片执行鉴权的事件)的通知，或者包括对第一网络切片执行撤销授权的事件的通知。重鉴权的通知例如为执行Re-authentication and Re-authorization流 程的事件的通知，撤销授权的通知例如为执行Revocation流程的事件的通知。
可以理解为，取消订阅后，认证网元不再向该AMF发送用于触发对第一网络切片的执行Re-authentication and Re-authorization的请求消息，或者，认证网元不再向该AMF发送用于触发对第一网络切片执行Revocation的请求消息。可选的，第一信息指示AMF取消向认证网元订阅第一通知，也可以描述为，AMF指示认证网元停止对第一网络切片执行重鉴权(或鉴权)，或停止对第一网络切片执行撤销授权。其中，AMF指示认证网元停止对第一网络切片执行重鉴权(或鉴权)，即，指示认证网元停止对第一网络切片执行Re-authentication and Re-authorization流程；AMF指示认证网元停止对第一网络切片执行撤销授权，即，指示认证网元停止对第一网络切片执行Revocation流程。
可以理解为，本实施例中，第一信息指示AMF取消向认证网元订阅对第一网络切片执行重鉴权的通知的含义与第一信息指示认证网元不再向该AMF发送用于触发对第一网络切片的执行Re-authentication and Re-authorization的请求消息的含义相同，或者，第一信息指示AMF取消向认证网元订阅对第一网络切片执行撤销授权的通知的含义与第一信息指示认证网元不再向该AMF发送用于触发对第一网络切片的执行Revocation的请求消息的含义相同。
本申请实施例中，如果AMF确定终端设备不再接入第一网络切片或第二网络切片，那么AMF可以向认证网元发送失败指示，从而认证网元可以明确，后续不必再对该终端设备发起针对第一网络切片的Re-authentication and Re-authorization流程或Revocation流程，从而能够节省核心网的信令开销。
其中，以认证网元是AAA-S为例，S906具体可以包括S906a和S906b，S906a和S906b并未在图9中画出。
S906a、AMF调用服务化操作Nausf_NSSAA_Notify response向AUSF发送第一消息，AUSF接收来自AMF的第一消息。第一消息可以包括第一信息，第一信息例如包括失败指示，所述的失败指示用于表示第一网络切片的Re-authentication and Re-authorization流程失败，或表示第一网络切片的Revocation流程失败。作为可选的方式，第一消息除了包括第一信息之外，还可以包括终端设备的标识(例如GPSI)、AAA-S的地址信息以及第一网络切片对应的S-NSSAI。第一消息包含的AAA-S的地址信息可以是AMF根据终端设备的签约信息确定的，其中，终端设备的签约信息包含了AAA-S的地址信息。
其中，AMF确定第一消息中包含的第一网络切片对应的S-NSSAI，有两种实现方式：
第一种，AMF确定终端设备不再接入第一网络切片，则第一消息包含第一网络切片对应的S-NSSAI。示例性地，如果第一网络切片有多个(即终端设备不再接入的第一网络切片有多个)，那么第一消息包括多个S-NSSAI，多个S-NSSAI中的每个S-NSSAI标识一个第一网络切片。
第二种，AMF确定终端设备不再接入第二网络切片，其中，第二网络切片与第一网络切片存在映射关系，则第一消息包含第一网络切片对应的S-NSSAI。示例性地，如果第二网络切片有多个(即终端设备不再接入的第二网络切片有多个)，那么第一消息包括多个S-NSSAI，多个S-NSSAI中的每个S-NSSAI标识一个第一网络切片。
S906b、AUSF将服务化操作Nausf_NSSAA_Notify response进行协议转化，并向AAA-S转发第一消息，AAA-S接收来自AUSF的第一消息。作为一种实现方式，AUSF可以将服务化操作Nausf_NSSAA_Notify response转化成Diameter协议，如会话中止请求(Session  Termination Request)消息，本实施例不做限定。
S907、AAA-S收到第一信息后，后续不再针对该S-NSSAI发起Re-authentication and Re-authorization流程或者Revocation流程，以节省核心网信令。
可选的，AAA-S还可以删除所存储的第一网络切片执行NSSAA流程的鉴权结果。一个网络切片执行NSSAA流程的鉴权结果，是指该网络切片的S-NSSAI执行NSSAA流程的鉴权结果。
AAA-S后续不再针对该第一S-NSSAI发起Re-authentication and Re-authorization流程或Revocation流程，以节省核心网信令。
以认证网元是AUSF为例，AMF跟AUSF可以直接进行信息交互。在这种情况下，S906可以包括S906a’和S906b’。
S906a’、AMF调用服务化操作Nausf_NSSAA_Notify response向AUSF发送第一消息，AUSF接收来自AMF的第一消息。第一消息可以包括第一信息，第一信息例如包括失败指示，所述的失败指示用于表示第一网络切片的Re-authentication and Re-authorization流程失败，或表示第一网络切片的Revocation流程失败。作为可选的方式，第一消息除了包括第一信息之外，还可以包括终端设备的标识(例如GPSI)、AAA-S的地址信息以及第一网络切片对应的S-NSSAI。
其中，AMF确定第一消息中包含的第一网络切片对应的S-NSSAI，有两种实现方式：
第一种，AMF确定终端设备不再接入第一网络切片，则第一消息包含第一网络切片对应的S-NSSAI。示例性地，如果第一网络切片有多个(即终端设备不再接入的第一网络切片有多个)，那么第一消息包括多个S-NSSAI，多个S-NSSAI中的每个S-NSSAI标识一个第一网络切片。
第二种，AMF确定终端设备不再接入第二网络切片，其中，第二网络切片与第一网络切片存在映射关系，则第一消息包含第一网络切片对应的S-NSSAI。示例性地，如果第二网络切片有多个(即终端设备不再接入的第二网络切片有多个)，那么第一消息包括多个S-NSSAI，多个S-NSSAI中的每个S-NSSAI标识一个第一网络切片。
S906b’、AUSF收到第一信息后，后续不再针对该S-NSSAI发起Re-authentication and Re-authorization流程或者Revocation流程，以节省核心网信令。例如，后续当AUSF收到AAA-S发送的Re-authentication and Re-authorization请求消息或者Revocation请求消息，AUSF不再将该消息转发至AMF网元。
在本申请实施例中，认证网元，如AAA-S，无需事先发起订阅，AMF也无需主动通知AAA-S，而是可以在AAA-S发起针对第一网络切片的Re-authentication and Re-authorization流程或Revocation流程时再通知AAA-S，终端设备不再接入第一网络切片。这样，AMF无需增加主动向AAA-S进行通知的步骤，而AAA-S也无需增加订阅步骤，对于两个网元的实现都有所简化。
接下来，再考虑一个问题。考虑到网络中可能存在不同类型的AMF，例如有些AMF支持NSSAA流程，这种类型的AMF称为A类AMF，还有些AMF不支持NSSAA流程，种类型的AMF称为B类AMF。那么当支持NSSAA流程的终端设备注册到A类AMF之后，该终端设备发生了移动，现有技术中A类AMF为该终端设备确定新的AMF时，并未考虑新的AMF是否支持NSSAA流程。那么，如果为终端设备所确定的AMF是B类AMF，由于B类AMF无法支持NSSAA流程，必然导致终端设备无法接入到那些需要执 行NSSAA流程的网络切片，可能会影响终端设备的业务执行情况。
鉴于此，本申请实施例提供第四种通信方法。在该方法中，A类AMF为该终端设备确定新的AMF时，可以尽量确定A类AMF，使得该终端设备能够继续接入能够支持NSSAA流程的网络切片，从而使得该终端设备的业务得以继续。请参考图10，为该方法的流程图。
图10所示的实施例涉及两个移动性管理网元，以及两个接入网网元。两个移动性管理网元分别为第一移动性管理网元和第二移动性管理网元，两个接入网网元分别为第一接入网网元和第二接入网网元。其中，第二移动性管理网元是终端设备在进行小区切换之前接入的移动性管理网元，也称为旧侧移动性管理网元(或者称为源(source)移动性管理网元)。第一接入网网元是终端设备在进行小区切换前接入的接入网网元，也称为旧侧接入网网元(或者称为源接入网网元)。第一移动性管理网元是终端设备在进行小区切换之后接入的移动性管理网元，也称为新侧移动性管理网元(或者称为目标(target)移动性管理网元)。第二接入网网元是终端设备在进行小区切换后接入的接入网网元，也称为新侧接入网网元(或者称为目标接入网网元)。本申请实施例以移动性管理网元是AMF、接入网网元是RAN为例，因此在下文中为了使得描述简单，将第二移动性管理网元称为旧侧AMF，将第一移动性管理网元称为新侧AMF，将第一接入网网元称为旧侧RAN，将第二接入网网元称为新侧RAN。
S1001、终端设备发起注册流程。在图10中表示为，终端设备向旧侧AMF发送注册请求消息，旧侧AMF接收来自终端设备的注册请求消息。
该注册请求消息可以包括Requested NSSAI和UE 5GMM Core Network Capability。其中，UE 5GMM Core Network Capability指示该UE支持NSSAA流程。
在注册过程中，旧侧AMF调用UDM的服务化操作Nudm_SDM_Get获取该终端设备的签约数据，该终端设备的签约数据包括该终端设备的签约S-NSSAI。UDM通过Nudm_SDM_Get response向旧侧AMF发送该终端设备的签约数据。其中，签约S-NSSAI包含指示信息，用于指示该签约S-NSSAI是否需要执行NSSAA流程。
例如，终端设备的签约S-NSSAI和指示信息可参考前文的表2。
S1002、旧侧AMF保存该终端设备的能力信息。该终端设备的能力信息包括该终端设备的UE 5GMM Core Network Capability。
由于UE 5GMM Core Network Capability指示该终端设备支持NSSAA流程，AMF根据该终端设备的签约数据确定需要执行NSSAA流程的S-NSSAI是否包含在注册请求消息包括的Requested NSSAI中。如果Requested NSSAI包含了需要执行NSSAA流程的S-NSSAI，则旧侧AMF将Requested NSSAI中需要执行NSSAA流程的S-NSSAI放在Pending NSSAI中，将Requested NSSAI中不需要执行NSSAA流程的S-NSSAI放在Allowed NSSAI中。
S1003、旧侧AMF向终端设备发送注册接受消息，终端设备接收来自旧侧AMF的注册接受消息。注册接受消息可以包括Allowed NSSAI和Pending NSSAI。
关于终端设备的注册流程所涉及的更多步骤，可参考图4所示的流程的介绍。
S1004、在注册流程之后，AMF针对每一个需要执行NSSAA流程的S-NSSAI发起NSSAA流程。关于NSSAA流程的具体步骤可参考图6所示的流程的介绍。
旧侧AMF如果获知某个网络切片执行NSSAA流程的鉴权结果为鉴权成功，则允许终 端设备接入该网络切片，旧侧AMF为该终端设备生成new Allowed NSSAI，其中new Allowed NSSAI中包含了成功执行NSSAA流程的网络切片的标识。同时，针对成功执行NSSAA流程的S-NSSAI，旧侧AMF在终端设备的上下文中保存该S-NSSAI的Authentication and Authorization status。而且，AAA-S保存该终端设备的标识和成功执行NSSAA流程的S-NSSAI的对应关系。终端设备的标识例如为GPSI等。
另外，AAA-S也保存该终端设备的标识和成功执行NSSAA流程的S-NSSAI的对应关系。终端设备的标识例如为GPSI等。
另外，在注册流程之后，例如终端设备可以接入new Allowed NSSAI所包括的一个S-NSSAI所指示的网络切片，例如为第一网络切片，终端设备可以建立与第一网络切片关联的会话，例如称为第一会话。那么旧侧AMF可以确定终端设备建立与第一网络切片关联的第一会话。第一网络切片例如为成功执行了NSSAA流程的网络切片，那么第一网络切片自然是需要成功执行NSSAA流程才能接入的网络切片。本文所述的会话例如为PDU会话(session)。
S1005、在某个时刻，终端设备当前接入的旧侧RAN触发切换流程。在图10中将S1005表示为，旧侧RAN向该终端设备当前接入的AMF(即旧侧AMF)发送切换请求(Handover Required)消息，旧侧AMF接收来自旧侧RAN的切换请求消息。切换请求消息可以包括该终端设备需要切换到的新侧RAN的标识，例如新侧RAN的ID。
S1006、旧侧AMF确定该终端设备支持NSSAA流程。
旧侧AMF如果根据该终端设备的UE 5GMM Core Network Capability确定该终端设备支持NSSAA流程，那么旧侧AMF确定需要为该终端设备选择一个能够支持NSSAA的新侧AMF。
S1007、旧侧AMF调用服务化操作Nnrf_NFDiscovery_Request向NRF发送请求消息，NRF接收来自旧侧AMF的请求消息。
该请求消息例如请求提供能够服务于新侧RAN且能够支持NSSAA流程的AMF。例如该请求消息可以包括NSSAA指示(indication)和目标NF类型(type)，其中，NSSAA indication用于指示所请求的目标AMF能够支持NSSAA，目标NF类型用于指示所请求的是AMF。可选的，该请求消息还可以包括目标跟踪区标识(tracking area identity，TAI)，目标TAI可用于指示目标RAN所在的位置，以便NRF能够从该位置所在的区域内为旧侧AMF推荐新的AMF。
S1008、NRF调用服务化操作Nnrf_NFDiscovery_Request response向旧侧AMF发送第三消息，旧侧AMF接收来自NRF的第三消息。在S1008中，将服务化操作Nnrf_NFDiscovery_Request response表示为第三消息。
第三消息用于指示目标AMF，目标AMF即为所述的新侧AMF，该新侧AMF是能够支持NSSAA流程的AMF。或者，第三消息用于指示没有符合要求的AMF。或者，第三消息用于指示目标AMF，目标AMF即为所述的新侧AMF，该新侧AMF是不支持NSSAA流程的AMF，如果是这种情况，第三消息还可以包括第二信息，第二信息可以指示该新侧AMF不支持NSSAA流程，或者指示没有能够支持NSSAA流程的AMF等。
其中，如果目标TAI所在的位置存在能够支持NSSAA流程的AMF，则第三消息可以指示该AMF，该AMF能够支持NSSAA流程。如果目标TAI所在的位置存在多个能够支持NSSAA流程的AMF，则第三消息只需指示其中一个AMF即可。例如此时第三消息 可以包括该AMF的标识，例如该AMF的ID，或者该AMF的地址(address)，或者该AMF的ID和地址等。
或者，如果目标TAI所在的位置不存在能够支持NSSAA的AMF，那么第三消息可以指示没有符合要求的AMF。
或者，如果目标TAI所在的位置不存在能够支持NSSAA的AMF，那么第三消息也可以指示目标AMF，但该目标AMF不支持NSSAA流程。在这种情况下，第三消息还可以包括第二信息，第二信息可以指示该目标AMF不支持NSSAA流程，或者指示没有能够支持NSSAA流程的AMF等。相当于，NRF确定目标TAI所在的位置不存在能够支持NSSAA的AMF，则NRF可以在目标TAI所在的位置确定一个不支持NSSAA流程的AMF，并告知旧侧AMF。这样旧侧AMF无需再次请求NRF提供新侧AMF，有助于节省核心网信令。
如果第三消息指示能够支持NSSAA流程的目标AMF，则执行S1009；如果第三消息指示没有符合要求的AMF，则执行S1010；如果第三消息指示不支持NSSAA流程的目标AMF，则执行S1012(即，如果第三消息指示不支持NSSAA流程的目标AMF，则相比第三消息指示没有符合要求的AMF的情况来说，可以不必执行S1010和S1011)。
S1009、旧侧AMF向新侧AMF发送该终端设备的上下文，新侧AMF接收来自旧侧AMF的该终端设备的上下文。
例如，旧侧AMF可以调用服务化操作Namf_Communication_创建UE上下文请求(CreateUEContext Request)向新侧AMF发送该终端设备的上下文。
例如在切换完成后终端设备可以向新侧AMF发起注册流程，关于注册流程可参考图4所示的流程的介绍。另外可选的，在终端设备注册到新侧AMF后，新侧AMF如果确定终端设备不再接入某个网络切片(例如第一网络切片)，则新侧AMF也可以通知AAA-S，具体的实施方式可参考前文的图7所示的实施例至图9所示的实施例中的任一个实施例的介绍。
S1010、旧侧AMF调用服务化操作Nnrf_NFDiscovery_Request向NRF发送第四消息，NRF接收来自旧侧AMF的第四消息。在S1010中，将服务化操作Nnrf_NFDiscovery_Request表示为第四消息。
即，第三消息指示没有符合要求的AMF，但旧侧AMF需要为终端设备确定一个目标AMF，则旧侧AMF可以再次向NRF请求提供目标AMF。例如第四消息可以包括目标NF类型type，目标NF类型用于指示所请求的是AMF。可选的，该请求消息还可以包括目标TAI，目标TAI可用于指示目标RAN所在的位置，以便NRF能够从该位置所在的区域内为旧侧AMF推荐新的AMF。可以看到，第四消息与请求消息的区别在于，第四消息不再请求能够支持NSSAA流程的AMF。
S1011、NRF调用服务化操作Nnrf_NFDiscovery_Request response向旧侧AMF发送第六消息，旧侧AMF接收来自NRF的第六消息。在S1011中，将服务化操作Nnrf_NFDiscovery_Request response表示为第六消息。
第六消息用于指示目标AMF，目标AMF即为所述的新侧AMF。其中，如果目标TAI所在的位置存在AMF，则第六消息可以指示该AMF。其中，如果目标TAI所在的位置存在多个AMF，则第六消息只需指示其中一个AMF即可。例如此时第六消息可以包括该AMF的标识，例如该AMF的ID，或者该AMF的address，或者该AMF的ID和地址等。 而如果目标TAI所在的位置不存在AMF，那么第六消息可以指示没有能够提供的AMF。如果是这种情况，则终端设备可能会切换失败。
S1012、旧侧AMF向新侧AMF发送该终端设备的上下文，新侧AMF接收来自旧侧AMF的该终端设备的上下文。可选的，在S1012中旧侧AMF所发送的终端设备的上下文可以不包括第一会话的信息。
例如，旧侧AMF可以调用服务化操作Namf_Communication_CreateUEContext Request向新侧AMF发送该终端设备的上下文。由于新侧AMF不支持NSSAA流程，则旧侧AMF可以不必将需要执行NSSAA流程的S-NSSAI对应的会话切换到新侧AMF，而只需将不需要执行NSSAA流程的S-NSSAI对应的会话信息切换到新侧AMF即可。例如该终端设备的上下文包含切换到新侧AMF的PDU session列表，该PDU session列表包含至少一个PDU session ID，这些PDU session ID对应的会话所关联的S-NSSAI不需要执行NSSAA流程。
另外，旧侧AMF在S1012中发送给新侧AMF的终端设备的上下文可以包括终端设备在切换RAN之前允许接入的NSSAI。这样，旧侧AMF根据终端设备在切换RAN之前允许接入的NSSAI，以及切换到旧侧AMF的会话信息对应的S-NSSAI，就可以确定哪些S-NSSAI对应的网络切片是终端设备不再接入的(这些S-NSSAI需要执行NSSAA流程，而新侧AMF不支持NSSAA流程，因此终端设备不能再接入这些S-NSSAI所对应的网络切片)。例如，终端设备在切换RAN之前允许接入的NSSAI可以包括第一网络切片的S-NSSAI。
S1013、在切换完成后终端设备向新侧AMF发起注册流程。例如在图3中将S1013表示为，终端设备向新侧AMF发送注册请求消息，新侧AMF接收来自终端设备的注册请求消息。
在注册流程中，新侧AMF可以更新该终端设备的new Allowed NSSAI，更新的new Allowed NSSAI不包括需要执行NSSAA流程的S-NSSAI。另外，新侧AMF还可以通过注册接受消息通知该终端设备，该新侧AMF不支持NSSAA流程。
可选的，新侧AMF可以向服务于第一会话的SMF发送第五消息，第五消息可以触发该SMF释放第一会话。因为第一会话并未切换到新侧AMF，表明第一会话不再继续，那么SMF接收第五消息后可以释放第一会话，以将第一会话占用的资源用作其他用途。
如果新侧AMF不支持NSSAA流程，而终端设备和旧侧AMF能够支持NSSAA流程，那么AAA-S可能事先已存储了该终端设备的标识和需要执行NSSAA流程的S-NSSAI之间的对应关系。而终端设备已不再接入这些网络切片的信息不会通知到AAA-S，AAA-S可能照常针对某个S-NSSAI触发Re-authentication and Re-authorization流程或Revocation流程，而如果该S-NSSAI对应的网络切片已经不是终端设备请求接入的网络切片，那么此时再对该网络切片进行Re-authentication and Re-authorization流程或Revocation流程就是不必要的过程，这造成核心网的信令浪费。为此，在本申请实施例中，旧侧AMF也能触发AAA-S删除终端设备不再接入的网络切片执行NSSAA流程的鉴权结果，从而AAA-S不会再针对这些网络切片发起Re-authentication and Re-authorization流程或Revocation流程。
例如，在S1005之前还包括S1014，AAA-S通过AUSF向旧侧AMF发送订阅请求消息，旧侧AMF通过AUSF接收来自AAA-S的订阅请求消息。
该订阅请求消息可以包括该终端设备的标识，包括N个网络切片的标识(例如N个网 络切片的N个S-NSSAI，其中网络切片与S-NSSAI一一对应)，以及包括订阅通知信息，订阅通知信息为终端设备不再接入N个网络切片中的每个网络切片的通知。N为大于或等于1的整数。即，AMF接收该订阅请求消息后，如果确定终端设备不再接入N个网络切片中的任一个网络切片，则AMF可以基于该订阅请求消息将终端设备不再接入该网络切片的通知告知AAA-S。N个网络切片可以包括第一网络切片，即，该订阅请求消息订阅了终端设备不再接入第一网络切片(UE no longer access to this S-NSSAI)的通知。
关于S1014的具体步骤，可参考图8所示的实施例中对于S803的介绍。
旧侧AMF已在S1012中将终端设备的上下文发送给新侧AMF，该终端设备的上下文不包括需要执行NSSAA流程的S-NSSAI对应的会话信息。另外，该终端设备的上下文还包括AAA-S的订阅信息，即，AAA-S订阅了终端设备不再接入N个网络切片的通知的信息。而新侧AMF根据该终端设备的上下文所包括的会话信息，就可以确定终端设备不再接入哪些网络切片。例如一个S-NSSAI不是会话信息所对应的任一个S-NSSAI，那么该S-NSSAI对应的网络切片就是终端设备不再接入的网络切片。这样的S-NSSAI可能会包括在订阅信息所订阅的S-NSSAI中。
例如旧侧AMF根据会话信息，确定第一网络切片是终端设备不再接入的网络切片。而旧侧AMF确定订阅信息所订阅的S-NSSAI包括了第一网络切片的S-NSSAI。
S1015、新侧AMF向认证网元发送第一信息，认证网元接收来自新侧AMF的第一信息。
例如，第一信息可以指示终端设备不再接入第一网络切片(UE no longer access to this S-NSSAI)。
认证网元例如为AAA-S或AUSF，图10以认证网元是AAA-S为例。关于S1015的具体步骤，可参考图8所示的实施例中对于S808的介绍。
S1016、AAA-S收到第一信息后，后续不再针对该S-NSSAI发起Re-authentication and Re-authorization流程或者Revocation流程，以节省核心网信令。
可选的，AAA-S还可以删除所存储的第一网络切片执行NSSAA流程的鉴权结果。其中，AAA-S可以是删除所存储的第一信息指示的N个网络切片执行NSSAA流程的鉴权结果，N个网络切片包括第一网络切片。另外，一个网络切片执行NSSAA流程的鉴权结果，是指该网络切的S-NSSAI执行NSSAA流程的鉴权结果。
AAA-S后续不再针对该N个S-NSSAI发起Re-authentication and Re-authorization流程或Revocation流程，以节省核心网信令。
如上的新侧AMF通知AAA-S的过程是以AAA-S事先进行了订阅为例，实际上AAA-S也可以无需订阅。例如新侧AMF可以根据该终端设备的上下文获得切换到新侧AMF的会话信息，也可以根据该终端设备的上下文获得该终端设备在切换RAN前允许接入的NSSAI，则新侧AMF就可以确定终端设备不再接入哪些网络切片。例如第一网络切片的S-NSSAI是该终端设备在切换RAN前允许接入的NSSAI，但该S-NSSAI不是会话信息所对应的任一个S-NSSAI，那么新侧AMF就可以确定第一网络切片就是终端设备不再接入的网络切片。则新侧AMF可以主动向AAA-S发送第一信息，以触发AAA-S删除第一网络切片的S-NSSAI执行NSSAA流程的鉴权结果。关于新侧AMF主动通知AAA-S的过程，可参考图7所示的实施例中的S705～S706。
或者，新侧AMF也可以在AAA-S发起针对第一网络切片的Re-authentication and  Re-authorization流程或Revocation流程时，再通知AAA-S，以触发AAA-S删除该S-NSSAI执行NSSAA流程的鉴权结果。例如，新侧AMF可以根据该终端设备的上下文获得切换到新侧AMF的会话信息，如果AAA-S发起针对第一网络切片的Re-authentication and Re-authorization流程或Revocation流程，而新侧AMF确定第一网络切片的S-NSSAI并不是切换到新侧AMF的会话信息关联的任一个S-NSSAI，那么新侧AMF就可以确定第一网络切片就是终端设备不再接入的网络切片。那么，如果AAA-S发起针对第一网络切片的Re-authentication and Re-authorization流程或者Revocation流程，则新侧AMF可以向AAA-S发送第一信息，以触发AAA-S删除第一网络切片的S-NSSAI执行NSSAA流程的鉴权结果。关于新侧AMF根据Re-authentication and Re-authorization流程或Revocation流程的触发通知AAA-S的过程，可参考图9所示的实施例的介绍。不同的是，图9所示的实施例中的S904，AMF可以根据终端设备的注册请求消息确定终端设备允许接入的NSSAI发生改变，而本申请实施例在执行该步骤时，新侧AMF可以根据终端设备的上下文确定终端设备允许接入的NSSAI发生改变。
在本申请实施例中，对于小区切换流程，如果新侧AMF不支持NSSAA流程，那么旧侧AMF向旧侧AMF发送的终端设备的上下文可以只包含不需要执行NSSAA流程的S-NSSAI对应的会话信息，实现在新侧AMF拒绝终端设备接入需要执行NSSAA流程的网络切片的目的。且，不向新侧AMF发送需要执行NSSAA流程的S-NSSAI对应的会话信息，也就是不向新侧AMF发送新侧AMF无法处理的信息，能够减少信息冗余。同时，新侧AMF如果确定终端设备不再接入某个需要执行NSSAA流程的网络切片，也可以触发AAA-S删掉本地保存的该网络切片的S-NSSAI执行NSSAA流程的鉴权结果，例如删除该网络切片的S-NSSAI和该终端设备的GPSI之间的对应关系，后续AAA-S不再对该S-NSSAI发起Re-authentication and Re-authorization流程或Revocation流程，减少信令交互，节省核心网信令资源。
另外需要注意的是，在本申请的各个实施例所涉及的流程图中，凡是用虚线表示的均表示可选步骤。
下面结合附图介绍本申请实施例中用来实现上述方法的装置。因此，上文中的内容均可以用于后续实施例中，重复的内容不再赘述。
图11为本申请实施例提供的通信装置1100的示意性框图。示例性地，通信装置1100例如为第一移动性管理网元1100。
第一移动性管理网元1100包括处理模块1110和收发模块1120。示例性地，第一移动性管理网元1100可以是移动性管理网元，也可以是应用于移动性管理网元中的芯片或者其他具有上述第一移动性管理网元功能的组合器件、部件等。当第一移动性管理网元1100是移动性管理网元时，收发模块1120可以是收发器，收发器可以包括天线和射频电路等，处理模块1110可以是处理器，处理器中可以包括一个或多个中央处理单元(central processing unit，CPU)。当第一移动性管理网元1100是具有上述移动性管理网元功能的部件时，收发模块1120可以是射频单元，处理模块1110可以是处理器。当第一移动性管理网元1100是芯片系统时，收发模块1120可以是芯片(例如基带芯片)的输入输出接口、处理模块1110可以是芯片系统的处理器，可以包括一个或多个中央处理单元。应理解，本申请实施例中的处理模块1110可以由处理器或处理器相关电路组件实现，收发模块1120可以由收发器或收发器相关电路组件实现。
例如，处理模块1110可以用于执行图7所示的实施例中由第一移动性管理网元所执行的除了收发操作之外的全部操作，例如S701、S702和S704，和/或用于支持本文所描述的技术的其它过程。收发模块1120可以用于执行图7所示的实施例中由第一移动性管理网元所执行的全部收发操作，例如S703、S705中的S705a，和/或用于支持本文所描述的技术的其它过程。
又例如，处理模块1110可以用于执行图8所示的实施例中由第一移动性管理网元所执行的除了收发操作之外的全部操作，例如S801和S806，和/或用于支持本文所描述的技术的其它过程。收发模块1120可以用于执行图8所示的实施例中由第一移动性管理网元所执行的全部收发操作，例如S803中的S803d、S805、S807和S808中的S808a，和/或用于支持本文所描述的技术的其它过程。
再例如，处理模块1110可以用于执行图9所示的实施例中由第一移动性管理网元所执行的除了收发操作之外的全部操作，例如S901和S904，和/或用于支持本文所描述的技术的其它过程。收发模块1120可以用于执行图9所示的实施例中由第一移动性管理网元所执行的全部收发操作，例如S903中的S903d、S905和S906中的S906a，和/或用于支持本文所描述的技术的其它过程。
另外，收发模块1120可以是一个功能模块，该功能模块既能完成发送操作也能完成接收操作，例如收发模块1120可以用于执行图7所示的实施例至图9所示的实施例中的任一个实施例中由第一移动性管理网元所执行的全部发送操作和接收操作，例如，在执行发送操作时，可以认为收发模块1120是发送模块，而在执行接收操作时，可以认为收发模块1120是接收模块；或者，收发模块1120也可以是两个功能模块，收发模块1120可以视为这两个功能模块的统称，这两个功能模块分别为发送模块和接收模块，发送模块用于完成发送操作，例如发送模块可以用于执行图7所示的实施例至图9所示的实施例中的任一个实施例中由第一移动性管理网元所执行的全部发送操作，接收模块用于完成接收操作，例如接收模块可以用于执行图7所示的实施例至图9所示的实施例中的任一个实施例中由第一移动性管理网元所执行的全部接收操作。
其中，处理模块1110，用于根据第一条件确定终端设备不再接入第一网络切片或第二网络切片，其中，所述第一网络切片需要执行NSSAA流程，所述第二网络切片与所述第一网络切片具有映射关系；
收发模块1120，用于向认证网元发送第一信息，所述第一信息用于指示所述终端设备不再接入所述第一网络切片。
作为一种可选的实施方式，收发模块1120，还用于接收来自所述认证网元的订阅请求消息，所述订阅请求消息包括所述终端设备的标识和所述第一网络切片的标识，所述订阅请求消息用于订阅所述终端设备不再接入所述第一网络切片的通知。
作为一种可选的实施方式，收发模块1120，还用于接收来自所述认证网元的第二消息，所述第二消息用于对所述第一网络切片再次执行NSSAA流程，或用于拒绝所述终端设备接入所述第一网络切片。
作为一种可选的实施方式，第一移动性管理网元1100为所述终端设备在进行切换后接入的移动性管理网元且第一移动性管理网元1100不支持NSSAA流程，第二移动性管理网元为所述终端设备在进行切换前接入的移动性管理网元，收发模块1120，还用于接收来自所述第二移动性管理网元的所述终端设备的上下文，其中，所述终端设备的上下文包括所 述认证网元订阅了所述终端设备不再接入所述第一网络切片的通知的信息。
作为一种可选的实施方式，所述第一条件包括：
所述终端设备允许接入的NSSAI发生改变，
其中，改变前的允许接入的NSSAI包括所述第一网络切片的标识，改变后的允许接入的NSSAI不包括所述第一网络切片的标识；或者，改变前的允许接入的NSSAI包括所述第二网络切片的标识，改变后的允许接入的NSSAI不包括所述第二网络切片的标识。
作为一种可选的实施方式，所述第一条件包括：所述终端设备从网络去注册。
作为一种可选的实施方式，所述第一条件包括：所述终端设备从第一网络移动到第二网络。
作为一种可选的实施方式，收发模块1120用于通过如下方式向认证网元发送第一信息：
向认证网元发送第一消息，其中，所述第一消息包括所述第一信息，所述第一消息还包括所述终端设备的标识和所述第一网络切片的标识。
作为一种可选的实施方式，
收发模块1120，还用于接收来自所述终端设备的注册请求消息，所述注册请求消息包括用于指示所述终端设备不支持所述NSSAA流程的信息，和/或，所述注册请求消息所携带的请求接入NSSAI不包括所述第一网络切片的标识；
处理模块1110，还用于根据所述注册请求消息确定所述改变后的允许接入的NSSAI。
作为一种可选的实施方式，处理模块1110，还用于删除所述第一网络切片执行所述NSSAA流程的鉴权结果。
或者，
处理模块1110，用于根据第一条件确定终端设备不再接入第一网络切片或第二网络切片，其中，所述第一网络切片需要执行NSSAA流程，所述第二网络切片与所述第一网络切片具有映射关系；
收发模块1120，用于向认证网元发送第一信息，所述第一信息用于指示所述第一移动性管理网元取消向所述认证网元订阅第一通知，其中，所述第一通知包括对所述第一网络切片执行重鉴权的通知或者对所述第一网络切片执行撤销授权的通知。
作为一种可选的实施方式，所述第一条件包括：
所述终端设备允许接入的NSSAI发生改变，
其中，改变前的允许接入的NSSAI包括所述第一网络切片的标识，改变后的允许接入的NSSAI不包括所述第一网络切片的标识；或者，改变前的允许接入的NSSAI包括所述第二网络切片的标识，改变后的允许接入的NSSAI不包括所述第二网络切片的标识。
作为一种可选的实施方式，所述第一条件包括：所述终端设备从网络去注册。
作为一种可选的实施方式，所述第一条件包括：所述终端设备从第一网络移动到第二网络。
作为一种可选的实施方式，收发模块1120用于通过如下方式向认证网元发送第一信息：
向认证网元发送第一消息，其中，所述第一消息包括所述第一信息，所述第一消息还包括所述终端设备的标识和所述第一网络切片的标识。
作为一种可选的实施方式，
收发模块1120，还用于接收来自所述终端设备的注册请求消息，所述注册请求消息包括用于指示所述终端设备不支持所述NSSAA流程的信息，和/或，所述注册请求消息所携 带的请求接入NSSAI不包括所述第一网络切片的标识；
处理模块1110，还用于根据所述注册请求消息确定所述改变后的允许接入的NSSAI。
作为一种可选的实施方式，处理模块1110，还用于删除所述第一网络切片执行所述NSSAA流程的鉴权结果。
关于第一移动性管理网元1100所能实现的其他功能，可参考图7所示的实施例至图9所示的实施例中的任一个实施例的相关介绍，不多赘述。
图12为本申请实施例提供的通信装置1200的示意性框图。示例性地，通信装置1200例如为认证网元1200。
认证网元1200包括处理模块1210和收发模块1220。示例性地，认证网元1200可以是认证网元，也可以是应用于认证网元中的芯片或者其他具有上述认证网元功能的组合器件、部件等。当认证网元1200是认证网元时，收发模块1220可以是收发器，收发器可以包括天线和射频电路等，处理模块1210可以是处理器，处理器中可以包括一个或多个CPU。当认证网元1200是具有上述认证网元功能的部件时，收发模块1220可以是射频单元，处理模块1210可以是处理器。当认证网元1200是芯片系统时，收发模块1220可以是芯片(例如基带芯片)的输入输出接口、处理模块1210可以是芯片系统的处理器，可以包括一个或多个中央处理单元。应理解，本申请实施例中的处理模块1210可以由处理器或处理器相关电路组件实现，收发模块1220可以由收发器或收发器相关电路组件实现。
例如，处理模块1210可以用于执行图7所示的实施例中由认证网元所执行的除了收发操作之外的全部操作，例如S706，和/或用于支持本文所描述的技术的其它过程。收发模块1220可以用于执行图7所示的实施例中由认证网元所执行的全部收发操作，例如S705中的S705b，和/或用于支持本文所描述的技术的其它过程。
又例如，处理模块1210可以用于执行图8所示的实施例中由认证网元所执行的除了收发操作之外的全部操作，例如S802和S809，和/或用于支持本文所描述的技术的其它过程。收发模块1220可以用于执行图8所示的实施例中由认证网元所执行的全部收发操作，例如S803中的S803a，以及S808中的S808b，和/或用于支持本文所描述的技术的其它过程。
再例如，处理模块1210可以用于执行图9所示的实施例中由认证网元所执行的除了收发操作之外的全部操作，例如S902和S907，和/或用于支持本文所描述的技术的其它过程。收发模块1220可以用于执行图9所示的实施例中由认证网元所执行的全部收发操作，例如S903中的S903a，以及S906中的S906b，和/或用于支持本文所描述的技术的其它过程。
另外，关于收发模块1220的实现方式，可参考对于收发模块1120的实现方式的介绍。
其中，处理模块1210，用于对第一网络切片执行NSSAA流程；
收发模块1220，用于接收来自第一移动性管理网元的第一信息，所述第一信息用于指示终端设备不再接入所述第一网络切片。
作为一种可选的实施方式，收发模块1220，还用于向所述第一移动性管理网元发送订阅请求消息，所述订阅请求消息包括所述终端设备的标识和第一网络切片的标识，所述订阅请求消息用于订阅所述终端设备不再接入所述第一网络切片的通知。
作为一种可选的实施方式，收发模块1220，还用于向所述第一移动性管理网元发送第二消息，所述第二消息用于对所述第一网络切片再次执行NSSAA流程，或用于拒绝所述 终端设备接入所述第一网络切片。
作为一种可选的实施方式，处理模块1210，还用于删除所述第一网络切片执行所述NSSAA流程的鉴权结果。
作为一种可选的实施方式，收发模块1220用于通过如下方式接收来自第一移动性管理网元的第一信息：
接收来自所述第一移动性管理网元的第一消息，所述第一消息包括所述第一信息，所述第一消息还包括所述终端设备的标识和所述第一网络切片的标识。
或者，处理模块1210，用于对第一网络切片执行网络切片鉴权授权NSSAA流程；
收发模块1220，用于接收来自第一移动性管理网元的第一信息，所述第一信息用于指示所述第一移动性管理网元取消向所述认证网元订阅第一通知，其中，所述第一通知包括对所述第一网络切片执行重鉴权的通知或者对所述第一网络切片执行撤销授权的通知。
作为一种可选的实施方式，处理模块1210，还用于删除所述第一网络切片执行所述NSSAA流程的鉴权结果。
作为一种可选的实施方式，收发模块1220用于通过如下方式接收来自第一移动性管理网元的第一信息：
接收来自所述第一移动性管理网元的第一消息，所述第一消息包括所述第一信息，所述第一消息还包括所述终端设备的标识和所述第一网络切片的标识。
关于认证网元1200所能实现的其他功能，可参考图7所示的实施例至图9所示的实施例中的任一个实施例的相关介绍，不多赘述。
图13为本申请实施例提供的通信装置1300的示意性框图。示例性地，通信装置1300例如为移动性管理网元1300，或者称为第二移动性管理网元1300。
移动性管理网元1300包括处理模块1310和收发模块1320。示例性地，移动性管理网元1300可以是移动性管理网元，也可以是应用于移动性管理网元中的芯片或者其他具有上述移动性管理网元功能的组合器件、部件等。当移动性管理网元1300是移动性管理网元时，收发模块1320可以是收发器，收发器可以包括天线和射频电路等，处理模块1310可以是处理器，处理器中可以包括一个或多个CPU。当移动性管理网元1300是具有上述移动性管理网元功能的部件时，收发模块1320可以是射频单元，处理模块1310可以是处理器。当移动性管理网元1300是芯片系统时，收发模块1320可以是芯片(例如基带芯片)的输入输出接口、处理模块1310可以是芯片系统的处理器，可以包括一个或多个中央处理单元。应理解，本申请实施例中的处理模块1310可以由处理器或处理器相关电路组件实现，收发模块1320可以由收发器或收发器相关电路组件实现。
例如，处理模块1310可以用于执行图10所示的实施例中由第二移动性管理网元(或者称为旧侧AMF)所执行的除了收发操作之外的全部操作，例如S1002、S1004和S1006，和/或用于支持本文所描述的技术的其它过程。收发模块1320可以用于执行图10所示的实施例中由第二移动性管理网元(或者称为旧侧AMF)所执行的全部收发操作，例如S1001、S1003、S1005、S1007、S1008、S1009、S1010、S1011、S1012和S1014，和/或用于支持本文所描述的技术的其它过程。
另外，关于收发模块1320的实现方式，可参考对于收发模块1120的实现方式的介绍。
其中，处理模块1310，用于确定终端设备建立与第一网络切片关联的第一会话，所述第一网络切片为曾成功执行了NSSAA流程的网络切片；
收发模块1320，用于接收来自第一接入网网元的切换请求消息，所述切换请求消息用于指示所述终端设备要从所述第一接入网网元切换到第二接入网网元；
收发模块1320，还用于向存储功能网元发送请求消息，所述请求消息用于请求提供能够服务于所述第二接入网网元且能够支持NSSAA流程的移动性管理网元。
作为一种可选的实施方式，收发模块1320，还用于接收来自所述存储功能网元的第三消息，所述第三消息包括目标移动性管理网元的标识。
或者，
处理模块1310，用于确定终端设备建立与第一网络切片关联的第一会话，所述第一网络切片为曾成功执行了NSSAA流程的网络切片；
收发模块1320，用于接收来自第一接入网网元的切换请求消息，所述切换请求消息用于指示所述终端设备要从所述第一接入网网元切换到第二接入网网元；
处理模块1310，还用于获取第一移动性管理网元的信息，所述第一移动性管理网元不支持NSSAA流程；
收发模块1320，还用于向所述第一移动性管理网元发送所述终端设备的上下文，所述终端设备的上下文不包括所述第一会话的信息。
作为一种可选的实施方式，收发模块1320还用于：
向存储功能网元发送请求消息，所述请求消息用于请求提供能够服务于所述第二接入网网元且能够支持NSSAA流程的移动性管理网元；
接收来自所述存储功能网元的第三消息，所述第三消息用于指示没有符合要求的移动性管理网元。
作为一种可选的实施方式，收发模块1320，还用于接收来自认证网元的订阅请求消息，所述订阅请求消息包括所述终端设备的标识和所述第一网络切片的标识，所述订阅请求消息用于订阅所述终端设备不再接入所述第一网络切片的通知。
作为一种可选的实施方式，所述终端设备的上下文包括所述终端设备在切换前允许接入的NSSAI，其中，所述允许接入的NSSAI包括所述第一网络切片的标识，所述终端设备的上下文还包括所述认证网元订阅了所述终端设备不再接入所述第一网络切片的通知的信息。
作为一种可选的实施方式，收发模块1320，还用于向服务于所述第一会话的第一会话管理网元发送第五消息，所述第五消息用于触发所述第一会话管理网元释放所述第一会话。
关于移动性管理网元1300所能实现的其他功能，可参考图10所示的实施例的相关介绍，不多赘述。
应理解，以上装置中单元的划分仅仅是一种逻辑功能的划分，实际实现时可以全部或部分集成到一个物理实体上，也可以物理上分开。且装置中的单元可以全部以软件通过处理元件调用的形式实现；也可以全部以硬件的形式实现；还可以部分单元以软件通过处理元件调用的形式实现，部分单元以硬件的形式实现。例如，各个单元可以为单独设立的处理元件，也可以集成在装置的某一个芯片中实现，此外，也可以以程序的形式存储于存储器中，由装置的某一个处理元件调用并执行该单元的功能。此外这些单元全部或部分可以集成在一起，也可以独立实现。这里所述的处理元件又可以成为处理器，可以是一种具有信号的处理能力的集成电路。在实现过程中，上述方法的各步骤或以上各个单元可以通过处理器元件中的硬件的集成逻辑电路实现或者以软件通过处理元件调用的形式实现。
在一个例子中，以上任一装置中的单元可以是被配置成实施以上方法的一个或多个集成电路，例如：一个或多个特定集成电路(application specific integrated circuit，ASIC)，或，一个或多个微处理器(digital singnal processor，DSP)，或，一个或者多个现场可编程门阵列(field programmable gate array，FPGA)，或这些集成电路形式中至少两种的组合。再如，当装置中的单元可以通过处理元件调度程序的形式实现时，该处理元件可以是通用处理器，例如CPU或其它可以调用程序的处理器。再如，这些单元可以集成在一起，以片上系统(system-on-a-chip，SOC)的形式实现。
以上用于接收的单元(例如接收模块)是一种该装置的接口电路，用于从其它装置接收信号。例如，当该装置以芯片的方式实现时，该接收单元是该芯片用于从其它芯片或装置接收信号的接口电路。以上用于发送的单元(例如发送模块)是一种该装置的接口电路，用于向其它装置发送信号。例如，当该装置以芯片的方式实现时，该发送单元是该芯片用于向其它芯片或装置发送信号的接口电路。
参考图14，为本申请实施例提供的又一种通信装置示意图，用于实现以上实施例中第一策略控制网元、或移动性管理网元的操作。如图14所示，该通信装置包括：处理器1410和接口1430，可选的，该通信装置还包括存储器1420。接口1430用于实现与其他设备进行通信。
以上实施例中第一策略控制网元、或移动性管理网元执行的方法可以通过处理器1410调用存储器(可以是第一移动性管理网元、认证网元或第二移动性管理网元中的存储器1420，也可以是外部存储器)中存储的程序来实现。即，用于第一移动性管理网元、认证网元或第二移动性管理网元的装置可以包括处理器1410，该处理器1410通过调用存储器中的程序，以执行以上方法实施例中的第一移动性管理网元、认证网元或第二移动性管理网元执行的方法。这里的处理器可以是一种具有信号的处理能力的集成电路，例如CPU。用于第一策略控制网元、或移动性管理网元的装置可以通过配置成实施以上方法的一个或多个集成电路来实现。例如：一个或多个ASIC，或，一个或多个微处理器DSP，或，一个或者多个FPGA等，或这些集成电路形式中至少两种的组合。或者，可以结合以上实现方式。
例如，图11中的收发模块1120和处理模块1110的功能/实现过程可以通过图14所示的通信装置中的处理器1410调用存储器1420中存储的计算机可执行指令来实现。或者，图11中的处理模块1110的功能/实现过程可以通过图14所示的通信装置中的处理器1410调用存储器1420中存储的计算机执行指令来实现，图11中的收发模块1120的功能/实现过程可以通过图14中所示的通信装置中的接口1430来实现。
又例如，图12中的收发模块1220和处理模块1210的功能/实现过程可以通过图14所示的通信装置中的处理器1410调用存储器1420中存储的计算机可执行指令来实现。或者，图12中的处理模块1210的功能/实现过程可以通过图14所示的通信装置中的处理器1410调用存储器1420中存储的计算机执行指令来实现，图12中的收发模块1220的功能/实现过程可以通过图14中所示的通信装置中的接口1430来实现。
再例如，图13中的收发模块1320和处理模块1310的功能/实现过程可以通过图14所示的通信装置中的处理器1410调用存储器1420中存储的计算机可执行指令来实现。或者，图13中的处理模块1310的功能/实现过程可以通过图14所示的通信装置中的处理器1410调用存储器1420中存储的计算机执行指令来实现，图13中的收发模块1320的功能/实现 过程可以通过图14中所示的通信装置中的接口1430来实现。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包括一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘(solid state disk，SSD))等。
本申请实施例中所描述的各种说明性的逻辑单元和电路可以通过通用处理器，数字信号处理器，专用集成电路(ASIC)，现场可编程门阵列(FPGA)或其它可编程逻辑装置，离散门或晶体管逻辑，离散硬件部件，或上述任何组合的设计来实现或操作所描述的功能。通用处理器可以为微处理器，可选地，该通用处理器也可以为任何传统的处理器、控制器、微控制器或状态机。处理器也可以通过计算装置的组合来实现，例如数字信号处理器和微处理器，多个微处理器，一个或多个微处理器联合一个数字信号处理器核，或任何其它类似的配置来实现。
本申请实施例中所描述的方法或算法的步骤可以直接嵌入硬件、处理器执行的软件单元、或者这两者的结合。软件单元可以存储于随机存取存储器(random access memory，RAM)、闪存、只读存储器(read-only memory，ROM)、EPROM存储器、EEPROM存储器、寄存器、硬盘、可移动磁盘、CD-ROM或本领域中其它任意形式的存储媒介中。示例性地，存储媒介可以与处理器连接，以使得处理器可以从存储媒介中读取信息，并可以向存储媒介存写信息。可选地，存储媒介还可以集成到处理器中。处理器和存储媒介可以设置于ASIC中。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
在一个或多个示例性的设计中，本申请实施例所描述的上述功能可以在硬件、软件、固件或这三者的任意组合来实现。如果在软件中实现，这些功能可以存储与电脑可读的媒介上，或以一个或多个指令或代码形式传输于电脑可读的媒介上。电脑可读媒介包括电脑存储媒介和便于使得让电脑程序从一个地方转移到其它地方的通信媒介。存储媒介可以是任何通用或特殊电脑可以接入访问的可用媒体。例如，这样的电脑可读媒体可以包括但不限于RAM、ROM、EEPROM、CD-ROM或其它光盘存储、磁盘存储或其它磁性存储装置，或其它任何可以用于承载或存储以指令或数据结构和其它可被通用或特殊电脑、或通用或特殊处理器读取形式的程序代码的媒介。此外，任何连接都可以被适当地定义为电脑可读媒介，例如，如果软件是从一个网站站点、服务器或其它远程资源通过一个同轴电缆、光 纤电脑、双绞线、数字用户线(DSL)或以例如红外、无线和微波等无线方式传输的也被包含在所定义的电脑可读媒介中。所述的碟片(disk)和磁盘(disc)包括压缩磁盘、镭射盘、光盘、数字通用光盘(digital versatile disc，DVD)、软盘和蓝光光盘，磁盘通常以磁性复制数据，而碟片通常以激光进行光学复制数据。上述的组合也可以包含在电脑可读媒介中。
本领域技术人员应该可以意识到，在上述一个或多个示例中，本申请实施例所描述的功能可以用硬件、软件、固件或它们的任意组合来实现。当使用软件实现时，可以将这些功能存储在计算机可读介质中或者作为计算机可读介质上的一个或多个指令或代码进行传输。计算机可读介质包括计算机存储介质和通信介质，其中通信介质包括便于从一个地方向另一个地方传送计算机程序的任何介质。存储介质可以是通用或专用计算机能够存取的任何可用介质。
以上所述的具体实施方式，对本申请实施例的目的、技术方案和有益效果进行了进一步详细说明，所应理解的是，以上所述仅为本申请实施例的具体实施方式而已，并不用于限定本申请实施例的保护范围，凡在本申请实施例的技术方案的基础之上，所做的任何修改、等同替换、改进等，均应包括在本申请实施例的保护范围之内。本申请说明书的上述描述可以使得本领域技术任何可以利用或实现本申请实施例的内容，任何基于所公开内容的修改都应该被认为是本领域显而易见的，本申请实施例所描述的基本原则可以应用到其它变形中而不偏离本申请的发明本质和范围。因此，本申请实施例所公开的内容不仅仅局限于所描述的实施例和设计，还可以扩展到与本申请原则和所公开的新特征一致的最大范围。
尽管结合具体特征及其实施例对本申请进行了描述，显而易见的，在不脱离本申请实施例的精神和范围的情况下，可对其进行各种修改和组合。相应地，本说明书和附图仅仅是所附权利要求所界定的本申请的示例性说明，且视为已覆盖本申请范围内的任意和所有修改、变化、组合或等同物。显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的范围。这样，倘若本申请实施例的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请实施例也意图包括这些改动和变型在内。

Claims (31)

  1. 一种通信方法，其特征在于，包括：
    第一移动性管理网元根据第一条件确定终端设备不再接入第一网络切片或第二网络切片，其中，所述第一网络切片需要执行网络切片鉴权授权NSSAA流程，所述第二网络切片与所述第一网络切片具有映射关系；
    所述第一移动性管理网元向认证网元发送第一信息，所述第一信息用于指示所述终端设备不再接入所述第一网络切片。
  2. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述第一移动性管理网元接收来自所述认证网元的订阅请求消息，所述订阅请求消息包括所述终端设备的标识和所述第一网络切片的标识，所述订阅请求消息用于订阅所述终端设备不再接入所述第一网络切片的事件。
  3. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述第一移动性管理网元接收来自所述认证网元的第二消息，所述第二消息用于对所述第一网络切片再次执行NSSAA流程，或用于拒绝所述终端设备接入所述第一网络切片。
  4. 根据权利要求2所述的方法，其特征在于，所述第一移动性管理网元为所述终端设备在进行切换后接入的移动性管理网元且所述第一移动性管理网元不支持NSSAA流程，第二移动性管理网元为所述终端设备在进行切换前接入的移动性管理网元，所述方法还包括：
    所述第一移动性管理网元接收来自所述第二移动性管理网元的所述终端设备的上下文，其中，所述终端设备的上下文包括所述认证网元订阅了所述终端设备不再接入所述第一网络切片的事件的信息。
  5. 一种通信方法，其特征在于，包括：
    第一移动性管理网元根据第一条件确定终端设备不再接入第一网络切片或第二网络切片，其中，所述第一网络切片需要执行网络切片鉴权授权NSSAA流程，所述第二网络切片与所述第一网络切片具有映射关系；
    所述第一移动性管理网元向认证网元发送第一信息，所述第一信息用于指示所述第一移动性管理网元取消向所述认证网元订阅第一通知，其中，所述第一通知包括对所述第一网络切片执行重鉴权的通知或者对所述第一网络切片执行撤销授权的通知。
  6. 根据权利要求1至5中任一项所述的方法，其特征在于，所述第一条件包括：
    所述终端设备允许接入的NSSAI发生改变，
    其中，改变前的允许接入的NSSAI包括所述第一网络切片的标识，改变后的允许接入的NSSAI不包括所述第一网络切片的标识；或者，改变前的允许接入的NSSAI包括所述第二网络切片的标识，改变后的允许接入的NSSAI不包括所述第二网络切片的标识。
  7. 根据权利要求1至5中任一项所述的方法，其特征在于，所述第一条件包括：所述终端设备从网络去注册。
  8. 根据权利要求1至5中任一项所述的方法，其特征在于，所述第一条件包括：所述终端设备从第一网络移动到第二网络。
  9. 根据权利要求1至8中任一项所述的方法，其特征在于，所述第一移动性管理网元向认证网元发送第一信息，包括：
    所述第一移动性管理网元向认证网元发送第一消息，其中，所述第一消息包括所述第一信息，所述第一消息还包括所述终端设备的标识和所述第一网络切片的标识。
  10. 根据权利要求6所述的方法，其特征在于，所述方法还包括：
    所述第一移动性管理网元接收来自所述终端设备的注册请求消息，所述注册请求消息包括用于指示所述终端设备不支持所述NSSAA流程的信息，和/或，所述注册请求消息所携带的请求接入NSSAI不包括所述第一网络切片的标识；
    所述第一移动性管理网元根据所述注册请求消息确定所述改变后的允许接入的NSSAI。
  11. 根据权利要求1至10中任一项所述的方法，其特征在于，还包括：
    所述第一移动性管理网元删除所述第一网络切片执行所述NSSAA流程的鉴权结果。
  12. 一种通信方法，其特征在于，包括：
    认证网元对第一网络切片执行网络切片鉴权授权NSSAA流程；
    所述认证网元接收来自第一移动性管理网元的第一信息，所述第一信息用于指示终端设备不再接入所述第一网络切片。
  13. 根据权利要求12所述的方法，其特征在于，所述方法还包括：
    所述认证网元向所述第一移动性管理网元发送订阅请求消息，所述订阅请求消息包括所述终端设备的标识和所述第一网络切片的标识，所述订阅请求消息用于订阅所述终端设备不再接入所述第一网络切片的事件。
  14. 根据权利要求12所述的方法，其特征在于，所述方法还包括：
    所述认证网元向所述第一移动性管理网元发送第二消息，所述第二消息用于对所述第一网络切片再次执行NSSAA流程，或用于拒绝所述终端设备接入所述第一网络切片。
  15. 一种通信方法，其特征在于，包括：
    认证网元对第一网络切片执行网络切片鉴权授权NSSAA流程；
    所述认证网元接收来自第一移动性管理网元的第一信息，所述第一信息用于指示所述第一移动性管理网元取消向所述认证网元订阅第一通知，其中，所述第一通知包括对所述第一网络切片执行重鉴权的通知或者对所述第一网络切片执行撤销授权的通知。
  16. 根据权利要求12至15中任一项所述的方法，其特征在于，还包括：
    所述认证网元删除所述第一网络切片执行所述NSSAA流程的鉴权结果。
  17. 根据权利要求12至16中任一项所述的方法，其特征在于，所述认证网元接收来自第一移动性管理网元的第一信息，包括：
    所述认证网元接收来自所述第一移动性管理网元的第一消息，所述第一消息包括所述第一信息，所述第一消息还包括所述终端设备的标识和所述第一网络切片的标识。
  18. 一种通信装置，其特征在于，包括：
    处理模块，用于根据第一条件确定终端设备不再接入第一网络切片或第二网络切片，其中，所述第一网络切片需要执行网络切片鉴权授权NSSAA流程，所述第二网络切片与所述第一网络切片具有映射关系；
    收发模块，用于向认证网元发送第一信息，所述第一信息用于指示所述终端设备不再接入所述第一网络切片。
  19. 根据权利要求18所述的通信装置，其特征在于，所述收发模块，还用于接收来自所述认证网元的订阅请求消息，所述订阅请求消息包括所述终端设备的标识和所述第一网 络切片的标识，所述订阅请求消息用于订阅所述终端设备不再接入所述第一网络切片的事件。
  20. 根据权利要求18所述的通信装置，其特征在于，所述收发模块，还用于接收来自所述认证网元的第二消息，所述第二消息用于对所述第一网络切片再次执行NSSAA流程，或用于拒绝所述终端设备接入所述第一网络切片。
  21. 根据权利要求18所述的通信装置，其特征在于，所述通信装置为所述终端设备在进行切换后接入的通信装置且所述通信装置不支持NSSAA流程，第二移动性管理网元为所述终端设备在进行切换前接入的移动性管理网元，所述收发模块，还用于接收来自所述第二移动性管理网元的所述终端设备的上下文，其中，所述终端设备的上下文包括所述认证网元订阅了所述终端设备不再接入所述第一网络切片的事件的信息。
  22. 一种通信装置，其特征在于，包括：
    处理模块，用于根据第一条件确定终端设备不再接入第一网络切片或第二网络切片，其中，所述第一网络切片需要执行网络切片鉴权授权NSSAA流程，所述第二网络切片与所述第一网络切片具有映射关系；
    收发模块，用于向认证网元发送第一信息，所述第一信息用于指示所述第一移动性管理网元取消向所述认证网元订阅第一通知，其中，所述第一通知包括对所述第一网络切片执行重鉴权的通知或者对所述第一网络切片执行撤销授权的通知。
  23. 根据权利要求18至22中任一项所述的通信装置，其特征在于，所述第一条件包括：
    所述终端设备允许接入的NSSAI发生改变，其中，改变前的允许接入的NSSAI包括所述第一网络切片的标识，改变后的允许接入的NSSAI不包括所述第一网络切片的标识；或者，改变前的允许接入的NSSAI包括所述第二网络切片的标识，改变后的允许接入的NSSAI不包括所述第二网络切片的标识；或者，
    所述终端设备从网络去注册；或者，
    所述终端设备从第一网络移动到第二网络。
  24. 根据权利要求23所述的通信装置，其特征在于，
    所述收发模块，还用于接收来自所述终端设备的注册请求消息，所述注册请求消息包括用于指示所述终端设备不支持所述NSSAA流程的信息，和/或，所述注册请求消息所携带的请求接入NSSAI不包括所述第一网络切片的标识；
    所述处理模块，还用于根据所述注册请求消息确定所述改变后的允许接入的NSSAI。
  25. 根据权利要求18至24中任一项所述的通信装置，其特征在于，
    所述处理模块，还用于删除所述第一网络切片执行所述NSSAA流程的鉴权结果。
  26. 一种通信装置，其特征在于，包括：
    处理模块，用于对第一网络切片执行网络切片鉴权授权NSSAA流程；
    收发模块，用于接收来自第一移动性管理网元的第一信息，所述第一信息用于指示终端设备不再接入所述第一网络切片。
  27. 根据权利要求26所述的通信装置，其特征在于，所述收发模块，还用于向所述第一移动性管理网元发送订阅请求消息，所述订阅请求消息包括所述终端设备的标识和所述第一网络切片的标识，所述订阅请求消息用于订阅所述终端设备不再接入所述第一网络切片的事件。
  28. 根据权利要求26所述的通信装置，其特征在于，所述收发模块，还用于向所述第 一移动性管理网元发送第二消息，所述第二消息用于对所述第一网络切片再次执行NSSAA流程，或用于拒绝所述终端设备接入所述第一网络切片。
  29. 一种通信装置，其特征在于，包括：
    处理模块，用于对第一网络切片执行网络切片鉴权授权NSSAA流程；
    收发模块，用于接收来自第一移动性管理网元的第一信息，所述第一信息用于指示所述第一移动性管理网元取消向所述认证网元订阅第一通知，其中，所述第一通知包括对所述第一网络切片执行重鉴权的通知或者对所述第一网络切片执行撤销授权的通知。
  30. 根据权利要求26至29中任一项所述的通信装置，其特征在于，所述处理模块，还用于删除所述第一网络切片执行所述NSSAA流程的鉴权结果。
  31. 一种计算机可读存储介质，其特征在于，包括计算机程序，当所述计算机程序在计算机上运行时，使得所述计算机执行如利要求1至11中任一项所述的方法，或使得所述计算机执行如利要求12至17中任一项所述的方法。
PCT/CN2021/081876 2020-04-10 2021-03-19 一种通信方法及装置 WO2021203947A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010281457.XA CN113573298B (zh) 2020-04-10 2020-04-10 一种通信方法及装置
CN202010281457.X 2020-04-10

Publications (1)

Publication Number Publication Date
WO2021203947A1 true WO2021203947A1 (zh) 2021-10-14

Family

ID=78022951

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/081876 WO2021203947A1 (zh) 2020-04-10 2021-03-19 一种通信方法及装置

Country Status (2)

Country Link
CN (1) CN113573298B (zh)
WO (1) WO2021203947A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113950141A (zh) * 2021-11-30 2022-01-18 新华三技术有限公司成都分公司 一种终端ue注册方法、装置及设备
WO2023213112A1 (zh) * 2022-05-06 2023-11-09 华为技术有限公司 通信方法和装置

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114302503B (zh) * 2021-12-31 2023-06-06 广州爱浦路网络技术有限公司 基于非3gpp接入功能网元的数据传输方法及非3gpp接入功能网元
CN115669023A (zh) * 2022-09-20 2023-01-31 北京小米移动软件有限公司 数据感知方法、核心网系统、核心网网元及芯片
CN118575493A (zh) * 2022-12-28 2024-08-30 北京小米移动软件有限公司 信息处理方法以及装置、通信设备及存储介质
CN115968024A (zh) * 2022-12-30 2023-04-14 北京长焜科技有限公司 接入端口与数据管理中用户终端状态信息一致的注册方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107820291A (zh) * 2016-09-12 2018-03-20 华为技术有限公司 网络切片控制方法及相关设备
CN110235423A (zh) * 2017-01-27 2019-09-13 瑞典爱立信有限公司 对用户设备的辅认证
CN110476447A (zh) * 2017-03-21 2019-11-19 诺基亚技术有限公司 在支持网络切片的移动系统中的增强的注册过程
CN110915264A (zh) * 2017-08-04 2020-03-24 华为技术有限公司 无线通信中的会话处理方法及终端设备

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR102663043B1 (ko) * 2016-05-12 2024-05-10 인터디지탈 패튼 홀딩스, 인크 가상화된 모바일 코어 네트워크들에의 접속
JP7035163B2 (ja) * 2017-07-20 2022-03-14 ホアウェイ インターナショナル ピーティーイー． リミテッド ネットワークセキュリティ管理方法および装置
US20200092720A1 (en) * 2018-09-13 2020-03-19 Qualcomm Incorporated Extensible authentication protocol (eap) implementation in new radio (nr)

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107820291A (zh) * 2016-09-12 2018-03-20 华为技术有限公司 网络切片控制方法及相关设备
CN110235423A (zh) * 2017-01-27 2019-09-13 瑞典爱立信有限公司 对用户设备的辅认证
CN110476447A (zh) * 2017-03-21 2019-11-19 诺基亚技术有限公司 在支持网络切片的移动系统中的增强的注册过程
US20200100173A1 (en) * 2017-03-21 2020-03-26 Nokia Technologies Oy Enhanced registration procedure in a mobile system supporting network slicing
CN110915264A (zh) * 2017-08-04 2020-03-24 华为技术有限公司 无线通信中的会话处理方法及终端设备

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113950141A (zh) * 2021-11-30 2022-01-18 新华三技术有限公司成都分公司 一种终端ue注册方法、装置及设备
CN113950141B (zh) * 2021-11-30 2023-05-26 新华三技术有限公司 一种终端ue注册方法、装置及设备
WO2023213112A1 (zh) * 2022-05-06 2023-11-09 华为技术有限公司 通信方法和装置

Also Published As

Publication number Publication date
CN113573298A (zh) 2021-10-29
CN113573298B (zh) 2022-05-24

Similar Documents

Publication Publication Date Title
WO2021203947A1 (zh) 一种通信方法及装置
JP7187580B2 (ja) セッション管理の方法、装置、およびシステム
US11032710B2 (en) Systems and methods of supporting device triggered re-authentication of slice-specific secondary authentication and authorization
US11729737B2 (en) Methods, apparatuses, and computer program products for handling emergency services in private networks
US20200322857A1 (en) Handover method in wireless communication system and apparatus therefor
WO2019157942A1 (zh) 通信方法和通信装置
CN111615217B (zh) 一种会话建立方法及装置
EP3833072B1 (en) Local area network communication management method and apparatus
WO2021204065A1 (zh) 一种通信方法及装置
WO2022062889A1 (zh) 一种切片管理方法、装置及通信设备
US20240284377A1 (en) Method of user equipment (ue), user equipment (ue), method of communication apparatus and communication apparatus
WO2022237516A1 (zh) 一种无线通信方法及通信装置
CN114423074A (zh) 一种通信方法及装置
WO2021180170A1 (en) Method and apparatus for handover
WO2022267824A1 (zh) 一种策略控制的方法、装置和系统
WO2024104118A1 (zh) 一种通信方法及装置
WO2023142777A1 (zh) 通信方法及装置
WO2024027320A1 (zh) 无线通信的方法、装置和系统
WO2022028030A1 (zh) 一种切片鉴权方法及对应装置
WO2024032218A1 (zh) 通信方法和通信装置
WO2024193398A1 (zh) 一种注册终端设备的方法及装置
WO2023147051A1 (en) Personal internet-of-things networks
EP4454219A1 (en) Personal internet-of-things networks
KR20220163439A (ko) 네트워크 요청 등록 절차 개시
CN116918315A (zh) 个人物联网络pin服务规则生成方法和装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21785187

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21785187

Country of ref document: EP

Kind code of ref document: A1