WO2021219107A1

WO2021219107A1 - Slice authentication and authorization management method, apparatus, and system

Info

Publication number: WO2021219107A1
Application number: PCT/CN2021/091199
Authority: WO
Inventors: 吴义壮
Original assignee: 华为技术有限公司
Priority date: 2020-04-30
Filing date: 2021-04-29
Publication date: 2021-11-04
Also published as: CN113676903A; CN113676903B

Abstract

Embodiments of the present application provide a slice authentication and authorization management method, apparatus, and system. The method comprises: an authentication and authorization network element acquiring a trigger network element associated with a first slice and serving a terminal device; and the authentication and authorization network element instructing the trigger network element to perform slice authentication and authorization processing for the terminal device with respect to the first slice, wherein the slice authentication and authorization processing is a slice re-authentication and re-authorization procedure, or a slice authorization revocation procedure. The method can be used in a dual registration scenario, in 3GPP access and non-3GPP access scenarios, and in scenarios related to authentication and authorization of slices or other network functions.

Description

Slice authentication and authorization management method, device and system

Technical field

This application relates to the field of communication technology, and in particular to a method, device and system for slice authentication and authorization management.

Background technique

The 5G era is an era of perception, intelligence and interconnection of all things. Different services have diversified requirements for the network. For example, smart homes and smart grids require a large number of connections and frequent transmission of small data packets; autonomous driving and industrial control require millisecond-level delays and close to 100% reliability; entertainment information services require broadband connections. Therefore, 5G networks need to be more flexible to support the diversified requirements of different services on the network. At present, the industry summarizes the services in the 5G era into three typical types: enhanced mobile broadband (eMBB) services, ultra-high reliability and ultra-low latency communication (URLLC) services, and massive Internet of Things communication (mMTC) services.

In order to adapt to the differentiated requirements of different services on the network, network slicing technology was born. Network slicing technology usually refers to dividing the operator’s physical network into multiple virtual networks. Each virtual network is divided according to different service requirements, such as delay, bandwidth, security, and reliability, to respond flexibly Different types of business. Network slicing can be referred to as slicing for short.

When the terminal registers to the network, the network determines one or more network slices that the terminal is allowed to access, and the network can initiate slice authentication and authorization for the network slices as needed. After the network slice is authenticated and authorized, the network can initiate slice re-authentication and re-authorization, or revoke the slice authorization for the network slice as needed.

The 5G network architecture supports dual registration, allowing terminals to register to different networks. For example, the terminal may be registered to two networks belonging to different public land mobile networks (PLMN) through non-third generation partnership project (non-3GPP) access and third generation partnership project (3GPP) access. The terminal can also provide services for the terminal through the respective access and mobility management functions (AMF) of the two networks in the above two networks, and different AMFs are one or more network slices determined by the terminal to allow access. It can include the same slice or different slices. In the dual-registration scenario, the network can also perform slice authentication and authorization on the slices that the terminal is allowed to access as needed. Subsequently, the network can re-authenticate and re-authorize the slices, or revoke the authorization of the slices as needed.

In the above dual-registration scenario, there are two AMFs that provide services for the same terminal. When the network performs slice reauthentication and reauthorization on the slice, or when the slice authorization is revoked, abnormal communication may occur. This abnormal communication phenomenon may also occur in other scenarios where multiple network elements of the same type provide services for the terminal.

Summary of the invention

The embodiments of the present application are used to provide a slice authentication and authorization management method, device, and system, which are used to improve communication abnormalities caused by performing slice re-authentication and re-authorization, or performing slice authorization revocation.

In order to achieve the above objectives, the embodiments of the present application provide the following solutions.

In a first aspect, an embodiment of the present application provides a slice authentication and authorization management method, including: an authentication and authorization network element obtains a trigger network element associated with a first slice serving a terminal device; the authentication and authorization network element notifies the trigger network element Perform slice authentication and authorization processing of the first slice on the terminal device; wherein the slice authentication and authorization processing includes: slice re-authentication and re-authorization, or slice authorization revoking.

Through the method of the first aspect, the authentication and authorization network element can use the slice information to accurately obtain the trigger network element associated with the slice serving the terminal, thereby avoiding that when a terminal is associated with multiple trigger network elements, the wrong acquisition is not related to the An abnormal communication caused by the triggering network element associated with the slice.

As an optional implementation manner, the authentication and authorization network element obtaining the trigger network element associated with the first slice serving the terminal device includes: the authentication and authorization network element obtains information from the information storage network element and the terminal device and the trigger network element associated with the first slice. The first triggering network element associated with the first slice; the authentication and authorization network element notifying the triggering network element to perform the slice authentication and authorization operation for the first slice on the terminal device includes: the authentication and authorization network element notifying the first trigger The network element performs the slice authentication and authorization processing of the first slice on the terminal device. This embodiment uses information storage network elements to facilitate the sharing and interaction of slice-related information between different networks.

As an optional implementation manner, the authentication and authorization network element acquiring the trigger network element associated with the first slice serving the terminal device includes: the authentication and authorization network element sends a first request to the information storage network element, and The first request includes the first identification information of the terminal device and the first identification information of the first slice, and the first request is used to obtain the first triggering network element; the authentication and authorization network element receives from the information storage network element A first response, where the first response includes the first identification information of the first triggering network element.

As an optional implementation manner, the authentication and authorization network element acquiring the trigger network element associated with the first slice serving the terminal device includes: the authentication and authorization network element acquiring the first slice serving the terminal device and the first slice A plurality of first triggering network elements associated with a slice; the authentication and authorization network element notifying the triggering network element to perform the slice authentication and authorization operation for the first slice on the terminal device includes: the authentication and authorization network element notifying the plurality of first The network element is triggered to perform the slice authentication and authorization processing of the first slice on the terminal device.

As an optional implementation manner, the authentication and authorization network element acquiring a plurality of first triggering network elements associated with the first slice serving the terminal device includes: the authentication and authorization network element obtains from an information storage network element A plurality of first triggering network elements associated with the terminal device and the first slice.

As an optional implementation manner, the authentication and authorization network element obtains the plurality of first trigger network elements associated with the terminal device and the first slice from the information storage network element, including: the authentication and authorization network element sends the information to the information storage network element. The storage network element sends a first request, the first request includes the first identification information of the terminal device and the first identification information of the first slice, the first request is used to obtain the first triggering network element; the authentication authorization The network element receives a first response from the information storage network element, where the first response includes identification information of the plurality of first triggering network elements.

As an optional implementation manner, the authentication and authorization network element acquiring a plurality of first triggering network elements associated with the first slice serving the terminal device includes: the authentication and authorization network element obtains from an information storage network element The plurality of second triggering network elements associated with the terminal device and the slices associated with the plurality of second triggering network elements; the authentication and authorization network element slaves according to the first slice and the slices associated with the plurality of second triggering network elements The plurality of first triggering network elements are determined among the plurality of second triggering network elements.

As an optional implementation manner, the authentication and authorization network element obtains from the information storage network element multiple second trigger network elements associated with the terminal device and slices associated with the multiple second trigger network elements, including: The authentication and authorization network element sends a first request to the information storage network element, the first request includes the first identification information of the terminal device, and the first request is used to obtain the second triggering network element and the second triggering network element Associated slice; the authentication and authorization network element receives a first response from the information storage network element, the first response including the identification information of the plurality of second triggering network elements and the slices associated with the plurality of second triggering network elements的identification information.

As an optional implementation manner, the slice authentication and authorization process is the slice re-authentication and re-authorization; the authentication and authorization network element acquiring the trigger network element associated with the first slice serving the terminal device includes: the authentication and authorization The network element obtains a plurality of first triggering network elements associated with the first slice serving the terminal device; the authentication and authorization network element determines a second triggering network element from the plurality of first triggering network elements; the authentication and authorization The network element notifying the triggering network element to perform the slice authentication and authorization processing of the first slice on the terminal device includes: the authentication and authorization network element notifies the second triggering network element to perform the slice re-slicing of the first slice on the terminal device. Authentication and reauthorization. Through this embodiment, when multiple triggering network elements are associated with a slice, one network element can be selected for the terminal to perform slice re-authentication and re-authorization, which avoids repeated re-authentication and re-authorization and saves signaling.

As an optional implementation manner, the authentication and authorization network element determining the second triggering network element from the plurality of first triggering network elements includes: the authentication and authorization network element determines the second triggering network element according to the relationship between the terminal device and the plurality of first triggering network elements. The connection state of the element determines the second triggering network element from the plurality of first triggering network elements; wherein, the connection state includes a connected state or an idle state. By selecting the triggering network element through the connection state, it is possible to select a more suitable triggering network element for slice authentication and authorization processing.

As an optional implementation manner, the authentication and authorization network element determining the second triggering network element from the plurality of first triggering network elements according to the connection state of the terminal device and the plurality of first triggering network elements includes: The authentication and authorization network element determines the second trigger network element from the plurality of first trigger network elements, and the connection state between the terminal device and the second trigger network element is the connection state.

As an optional implementation manner, the authentication and authorization network element determining the second triggering network element from the plurality of first triggering network elements according to the connection state of the terminal device and the plurality of first triggering network elements includes: When the connection state between the terminal device and each first triggering network element of the plurality of first triggering network elements is the idle state, the authentication and authorization network element is based on the access type corresponding to the plurality of first triggering network elements The second triggering network element is determined from the plurality of first triggering network elements; wherein, the access type includes 3GPP access and non-3GPP access. When selecting a triggering network element, further considering the access type, it is possible to select a triggering network element that is more suitable for slice authentication and authorization processing.

As an optional implementation manner, the authentication and authorization network element determines the second triggering network element from the plurality of first triggering network elements according to the access type corresponding to the plurality of first triggering network elements, including: the authentication The authorized network element determines the second triggering network element from the plurality of first triggering network elements, and the access type corresponding to the second triggering network element is the 3GPP access.

As an optional implementation manner, the authentication and authorization network element determining the second triggering network element from the plurality of first triggering network elements includes: the authentication and authorization network element according to the connection corresponding to the plurality of first triggering network elements The access type determines the second triggering network element from the plurality of first triggering network elements; where the access type includes 3GPP access and non-3GPP access.

As an optional implementation manner, the method further includes: the authentication and authorization network element obtains the connection status of the plurality of first triggering network elements from the information storage network element; or, the authentication and authorization network element obtains the connection status of the plurality of first triggering network elements from the plurality of A triggering network element obtains the connection status of the plurality of first triggering network elements.

As an optional implementation manner, the method further includes: the authentication and authorization network element obtains the access types corresponding to the plurality of first triggering network elements from the information storage network element; or, the authentication and authorization network element obtains the access types from the multiple The first triggering network element obtains the access types corresponding to the multiple first triggering network elements.

As an optional implementation manner, the first request further includes: a first indication, the first indication is used to indicate that the network element type is AMF; or, a second indication, the second indication is used to indicate the slice authentication authorization deal with.

As an optional implementation manner, the method further includes: the authentication and authorization network element receives a second request, the second request including the second identification information of the terminal device and the second identification information of the first slice, the The second request is used to request the terminal device to initiate the slice authentication and authorization processing for the first slice.

As an optional implementation manner, the authentication and authorization network element is NSSAAF, and the triggering network element is AMF.

As an optional implementation manner, the information storage network element is UDM.

In a second aspect, an embodiment of the present application provides a slice authentication and authorization management method, including: an information storage network element obtains slice authentication and authorization information, and the slice authentication and authorization information is used to indicate a terminal device and a trigger network associated with the terminal device. Element, and a slice associated with the terminal device and the triggering network element, the triggering network element is a triggering network element serving the terminal device, and the slice is a slice for which the terminal device is successfully authenticated and authorized on the triggering network element; The information storage network element receives a first request from an authentication and authorization network element, where the first request is used to request to obtain a first trigger network element associated with the terminal device and the first slice; the information storage network element according to the slice The authentication and authorization information and the first request determine the first triggering network element; the information storage network element sends a first response to the authentication and authorization network element, and the first response includes the identification information of the first triggering network element. Optionally, the information storage network element is UDM, HSS, or HLR.

Through the method of the second aspect, the information storage network element can obtain the terminal, the trigger network element serving the terminal, the slice associated with the terminal and the trigger network element, and can provide the correct trigger network element for authentication according to the request of the authentication and authorization network element Authorize the network element so that the authentication and authorization network element can notify the correct triggering network element to perform slice authentication and authorization processing.

As an optional implementation manner, the information storage network element determines the first trigger network element according to the slice authentication and authorization information and the first request, including: the information storage network element determines the first trigger network element according to the slice authentication and authorization information and The first request determines a plurality of second triggering network elements associated with the terminal device and the first slice; the information storage network element sends a first response to the authentication and authorization network element, and the first response includes the first The identification information of the triggering network element includes: the information storage network element sends the first response to the authentication and authorization network element, and the first response includes the identification information of the plurality of second triggering network elements.

As an optional implementation manner, the first request further includes a first indication, the first indication is used to instruct the slice authorization revocation; the information storage network element determines with the slice authentication and authorization information and the first request The multiple second trigger network elements associated with the terminal device and the first slice include: the information storage network element determines the multiple second trigger network elements according to the slice authentication and authorization information, the first request, and the first instruction Trigger the network element.

As an optional implementation manner, the information storage network element determines the first trigger network element according to the slice authentication and authorization information and the first request, including: the information storage network element determines the first trigger network element according to the slice authentication and authorization information and The first request determines a third triggering network element among a plurality of second triggering network elements associated with the terminal device and the first slice; the information storage network element sends a first response to the authentication and authorization network element, and The first response includes the identification information of the first triggering network element, including: the information storage network element sends the first response to the authentication and authorization network element, and the first response includes the identification information of the third triggering network element.

As an optional implementation manner, the information storage network element determines, according to the slice authentication and authorization information and the first request, the first among the plurality of second trigger network elements associated with the terminal device and the first slice. The three-trigger network element includes: the information storage network element determines the plurality of second trigger network elements according to the slice authentication and authorization information and the first request; the information storage network element determines the plurality of second trigger network elements according to the terminal device and the plurality of second triggers The connection status of the network element determines the third triggering network element from the plurality of second triggering network elements; wherein, the connection status includes a connected state or an idle state.

As an optional implementation manner, the information storage network element determining the third triggering network element from the plurality of second triggering network elements according to the connection state of the terminal device and the plurality of second triggering network elements includes: The information storage network element determines the third trigger network element from the plurality of second trigger network elements, and the connection state between the terminal device and the third trigger network element is the connection state.

As an optional implementation manner, the information storage network element determining the third triggering network element from the plurality of second triggering network elements according to the connection state of the terminal device and the plurality of second triggering network elements includes: When the connection state between the terminal device and each second triggering network element of the plurality of second triggering network elements is the idle state, the information storage network element is based on the access type corresponding to the plurality of second triggering network elements The third triggering network element is determined from the plurality of second triggering network elements; wherein, the access type includes 3GPP access and non-3GPP access.

As an optional implementation manner, the information storage network element determines the third trigger network element from the plurality of second trigger network elements according to the access type corresponding to the plurality of second trigger network elements, including: the information The storage network element determines the third trigger network element from the plurality of second trigger network elements, and the access type corresponding to the third trigger network element is the 3GPP access.

As an optional implementation manner, the information storage network element determines, according to the slice authentication and authorization information and the first request, the first among the plurality of second trigger network elements associated with the terminal device and the first slice. The three trigger network elements include: the information storage network element determines the plurality of second trigger network elements according to the slice authentication and authorization information and the first request; the information storage network element determines the plurality of second trigger network elements corresponding to the plurality of second trigger network elements The access type determines the third triggering network element from the plurality of second triggering network elements; where the access type includes 3GPP access and non-3GPP access.

As an optional implementation manner, the first request further includes a second indication, and the second indication is used to indicate that the network element type is AMF.

In a third aspect, an embodiment of the present application provides a slice authentication and authorization management method, which is characterized in that it includes: triggering a network element to send slice authentication and authorization information to an information storage network element, where the slice authentication and authorization information is used to instruct the terminal device, A trigger network element associated with the terminal device and a slice associated with the terminal device and the trigger network element, the trigger network element is a trigger network element serving the terminal device, and the slice is the terminal device in the trigger network element Upper authentication and authorization successful slice; the triggering network element receives a notification from the authentication and authorization network element, and the notification is used to notify the terminal device to perform slice authentication and authorization processing for the slice; where the slice authentication and authorization processing is: slice re-authentication And re-authorization, or revoke the slice authorization.

As an optional implementation manner, the method further includes: the triggering network element initiates slice authentication and authorization processing of the slice for the terminal device.

In a fourth aspect, an embodiment of the present application provides an authentication and authorization network element, including a processor and a memory; the processor is configured to read and execute instructions from the memory to implement the method of the first aspect.

In a fifth aspect, an embodiment of the present application provides an information storage network element, including a processor and a memory; the processor is configured to read and execute instructions from the memory to implement the method of the second aspect.

In a sixth aspect, an embodiment of the present application provides a trigger network element, including a processor and a memory; the processor is configured to read and execute instructions from the memory to implement the method of the third aspect.

In a seventh aspect, an embodiment of the present application provides a network element including a functional unit for implementing the method as in the first aspect.

In an eighth aspect, an embodiment of the present application provides a network element including a functional unit for implementing the method of the second aspect.

In a ninth aspect, an embodiment of the present application provides a network element including a functional unit for implementing the method of the third aspect.

In a tenth aspect, an embodiment of the present application provides a communication system that includes at least two of the following network elements: the authentication and authorization network element of the fourth aspect; the information storage network element of the fifth aspect; the trigger network of the sixth aspect Yuan.

In an eleventh aspect, an embodiment of the present application provides a computer program product, including instructions. When the instructions are executed on a computer, the computer realizes the method of the first aspect.

In the twelfth aspect, embodiments of the present application provide a computer program product, including instructions, which when executed on a computer, cause the computer to implement the method of the second aspect.

In a thirteenth aspect, an embodiment of the present application provides a computer program product, which is characterized by including instructions, which when executed on a computer, cause the computer to implement the method as in the third aspect.

In a fourteenth aspect, an embodiment of the present application provides a computer-readable storage medium, including the computer program product of the eleventh aspect.

In a fifteenth aspect, an embodiment of the present application provides a computer-readable storage medium, including a computer program product as in the twelfth aspect.

In a sixteenth aspect, an embodiment of the present application provides a computer-readable storage medium, which is characterized by including the computer program product of the thirteenth aspect.

In the above solutions, by associating the slice, the terminal, and the triggering network element, the triggering network element associated with the slice that serves the terminal can be accurately obtained, thereby ensuring the slice re-authentication and re-authorization process, and the slice authorization revocation process. Proper execution avoids communication errors.

Description of the drawings

Figure 1 is a schematic diagram of a 5G network dual registration scenario;

Figure 2 is a schematic diagram of a method for terminal A to authenticate and authorize slices in PLMN-1;

Figure 3 is a schematic diagram of a method for terminal A to authenticate and authorize slices in PLMN-2;

Figure 4 is a schematic diagram of a method for AAA-s to initiate re-authentication and re-authorization of slice 1;

Figure 5 is a schematic diagram of a method for AAA-s to initiate re-authentication and re-authorization of slice 2;

Fig. 6 is a schematic diagram of another method for AAA-s to initiate re-authentication and re-authorization of slice 2;

FIG. 7 is a schematic diagram of a method in which AAA-s initiates the authorization revocation of slice 1;

FIG. 8 is a schematic diagram of a method in which AAA-s initiates the authorization revocation of slice 2;

FIG. 9 is a schematic diagram of another method for AAA-s to initiate authorization revocation of slice 2;

Figure 10 is a schematic diagram of a method for slice authentication and authorization management;

Fig. 11 is a schematic diagram of a structure of a network element;

Fig. 12 is a schematic diagram of another structure of a network element.

Detailed ways

In order to more clearly and completely introduce the technical solutions of the present application, the embodiments of the present application are described below in conjunction with the accompanying drawings.

The embodiment of the present application mainly uses a dual registration scenario of a 5G network as an example for description.

The 5G network is a new generation of mobile communication network defined by the 3GPP organization after the 4G network. The 5G network architecture includes the access network and the core network. The access network is used to implement functions related to wireless access. The access network is mainly divided into 3GPP access network and non-3GPP access network. The 3GPP access network refers to an access network using 3GPP access technology, such as an access network using NR (new radio, new radio) or LTE (long term evolution) access technology. A non-3GPP access network refers to an access network using non-3GPP access technology, for example, an access network using WiMax or WLAN (wireless local area network, wireless local area network) access technology. The core network is used to implement authentication, access, mobility management, session management, policy management and other related functions. The core network of the 5G network can be referred to as 5GC for short. Compared with the 4G core network, 5GC adopts an architecture that separates the control plane from the user plane, as well as a service-oriented architecture. It should be noted that the solution of this application is not only applicable to 5G networks, but also applicable to evolved 4G networks or future 6G networks. The network to which the solution of the application is applicable may adopt an architecture in which the control plane and the user plane are separated, or may adopt an architecture in which the control plane and the user plane are integrated. The network to which the solution of this application is applicable may adopt a service-oriented architecture or a non-service-oriented architecture.

The logical network elements included in 5GC mainly include: AMF (access and mobility management function), SMF (session management function, session management function), UPF (User Plane Function, user plane function), UDM ( Unified Data Management, unified data management), and AUSF (Authentication Server Function, authentication server function). Different logical network elements of 5GC can be deployed on the same or different physical devices. As a typical deployment, AMF and SMF can be deployed on the same physical device. In addition, the logical network elements of the 5GC can be deployed on the same physical device as the network elements of the 4G core network.

AMF is a network element used for terminal access and mobility management, mainly related to terminal location update, network registration, handover control and other functions. SMF is a network element used to manage the session of the terminal, which mainly involves functions such as session establishment, modification, and release. UPF is a network element used to receive and forward user data. UPF is under the control of SMF. The UDM network element is a network element used to manage user information, which mainly involves functions such as generating an authentication credential, storing and managing user permanent identities, access authorization control, and user subscription data management. AUSF is a network element used to authenticate the terminal access to the network. It should be noted that with the evolution of the 5G network, the names of the above-mentioned logical network elements may change, and the functions of the network elements may be merged, separated, or even changed. These changes do not mean that they deviate from the scope of application of the solution of this application.

Optionally, in order to implement functions related to authentication and authorization of slices, NSSAAF (Network Slice-Specific Authentication and Authorization Function) network elements can be introduced.

Through the 5G network, the terminal can communicate with the data network (DN). In mobile communication, a terminal is a device with a wireless communication function, which can be called a terminal device. For example, it can be a handheld device with a wireless communication function, a vehicle-mounted device, a wearable device, a computing device, or a water meter, an electric meter, a sensor, a chip, a chip system, a baseband chip, a baseband board, etc. connected to a wireless modem. In different networks, the terminal may have different names. For example, the terminal may be called a user equipment (UE), a mobile station (MS), a wireless local loop (WLL) station, and so on. DN is a service network that provides business services to users, such as IMS (IP multi-media service, IP multimedia service) network, the Internet, and so on.

The 5G network supports terminals to access the network side through different access technologies. In the dual registration scenario of the 5G network, the terminal can be registered to the network side through 3GPP access and non-3GPP access respectively. The concept and description of 5G network dual registration can be exemplified by reference to 3GPP TS 23.501 v16.4.0 Chapter 5.3.2.4-Support of user equipment through 3GPP access and non-3GPP access (Support of a UE registered over both 3GPP and Non-3GPP access) )Content.

Figure 1 is a schematic diagram of a 5G network dual registration scenario. As shown in Figure 1, the terminal accesses different networks through 3GPP access and non-3GPP access, respectively. It can be understood that different networks mean that certain attributes are different among multiple networks. For example, different networks may be networks belonging to different PLMNs (public land mobile networks, public land mobile networks). For another example, different networks may be networks using different technologies, such as 5G networks and 4G networks. In Figure 1, 3GPP access and non-3GPP access belong to different PLMNs. 3GPP access belongs to PLMN-1, and non-3GPP access belongs to PLMN-2. Since the 3GPP access and non-3GPP access selected by the terminal belong to different PLMNs, different AMFs will provide services for the terminal. In PLMN-1, AMF1 provides service for terminal A, and in PLMN-2, AMF2 provides service for terminal A. Since the non-3GPP access network in Figure 1 is an untrusted non-3GPP access network, terminal A needs to interact with AMF2 through N3IWF. N3IWF (non-3GPP interworking function, non-3GPP interworking function) is a network element used to support non-3GPP access network elements or nodes to communicate with network elements of the 3GPP network. In addition, the non-3GPP access network can also be a trusted non-3GPP access network. For a trusted non-3GPP access network, the terminal can interact with the AMF through TNGF (Trusted Non-3GPP Gateway Function). In addition, the non-3GPP access network can also be a wired 5G access network. For wired 5G access networks, terminals can interact with AMF through W-AGF (Wireline Access Gateway Function). It should be noted that the dual registration scenario shown in FIG. 1 is only an example, and the solution of the present application can also be applied to other scenarios where multiple network elements of the same type provide services for the terminal.

The 5G network supports the terminal to determine the slices that the terminal is allowed to access when registering to the network. In the dual registration scenario in Figure 1, when terminal A registers to PLMN-1 through 3GPP access, AMF1 can select slice 1 and slice 2 for terminal A to register according to user subscription data and/or terminal A’s request, and initiate a pair The slice authentication and authorization process of slice 1 and slice 2; when the terminal registers to PLMN-2 through non-3GPP access, AMF2 can select slice 1 and slice 3 for terminal A to register according to user subscription data and/or terminal request. And initiate the slice authentication and authorization process for slice 1 and slice 3. Optionally, the slice authentication and authorization of AMF2 for slice 1 may be determined based on the result of slice authentication and authorization of AMF1 for slice 1. User subscription data can be obtained from UDM, and AUSF (or NSSAAF) and AAA-s can be used to process authentication and/or authorization of slices. Among them, AAA-s (authentication, authorization and accounting server, authentication, authorization, and accounting server) is an authentication server that provides services such as authentication, authorization, and accounting. AAA-s belong to the operator, and can also belong to a third party. Optional AAA-p (authentication, authorization and accounting proxy) can be set up between the optional AUSF (or NSSAAF) and AAA-s. AAA-p is an authentication, authorization and accounting proxy network Yuan, belongs to the operator. AAA-p can be used to transfer information between AUSF (or NSSAAF) and AAA-s. In this application, the authentication process, the authorization process, the authentication and authorization process are collectively referred to as the authentication and authorization process, that is, the authentication and authorization process can refer to the authentication process, or the authorization process, or Refers to the process of authentication and authorization. Authentication is sometimes referred to as authentication. The slice authentication and authorization process refers to the authentication and authorization process for slices. When needed, AAA-s can initiate a re-authentication and re-authorization process for slices, or a process for revoking the authorization of slices. Similar to the authentication and authorization process, in this application, the re-authentication and re-authorization process can refer to the re-authentication process, or the re-authorization process, or the re-authentication and re-authorization process. The slice re-authentication and re-authorization process refers to the re-authentication and re-authorization process for slices. In this application, the process of revoking the authorization of the slice may be referred to as the process of revoking the authorization of the slice.

Exemplarily, the slice authentication and authorization process can refer to the related content of 3GPP TS 23.502 v16.4.0 Chapter 4.2.9.2-Network Slice-Specific Authentication and Authorization (Network Slice-Specific Authentication and Authorization); the slice re-authentication and re-authorization process can be Refer to 3GPP TS 23.502 v16.4.0 chapter 4.2.9.3-AAA server triggered network slice-specific re-authentication and re-authorization (AAA Server triggered Network Slice-Specific Re-authentication and Re-authorization procedure) related content; slice authorization revocation process Refer to the related content of Section 4.2.9.4-AAA Server Triggered-Specific Authorization Revocation (AAA Server Triggered Slice-Specific Authorization Revocation) in 3GPP TS 23.502 v16.4.0 section 4.2.9.4. It should be noted that the content of the 3GPP standard protocol cited in this application may change, which does not mean that it deviates from the scope of application of the solution of this application.

It should be noted that the scheme of this application is not only applicable to the authentication and authorization process, re-authentication and re-authorization process, and authorization revocation process related to slices, but also applicable to the authentication and authorization process of other network functions, re-authentication and re-authentication processes. Re-authorization process, authorization revocation process.

In Figure 1, since both AMF1 and AMF2 provide services for terminal A, AAA-s initiates a slice re-authentication and re-authorization process, or initiates slice authorization for one or more of slice 1, slice 2, or slice 3 When the process is withdrawn, it may cause communication abnormalities.

In view of this, the embodiment of the present application provides a method for authenticating and authorizing a slice, which is used to reduce the above-mentioned communication abnormality. In the following embodiments, NSSAAF is taken as an example for description. It can be understood that NSSAAF in the following embodiments can be replaced with AUSF. The method will be described below in conjunction with the scenario in FIG. 1.

Figure 2 shows a method for terminal A to authenticate and authorize slices in PLMN-1. as shown in picture 2:

S201: Complete the authentication and authorization of slice 1 and slice 2 for terminal A through AMF1.

AMF1 can trigger the slice authentication and authorization process to perform slice 1 and slice 2 authentication and authorization for terminal A. For the slice authentication and authorization process, please refer to the content in section 4.2.9.2 of 3GPP TS 23.502 v16.4.0.

As an implementation manner, AMF1 can trigger the slice authentication and authorization process for slice 1 and the slice authentication and authorization process for slice 2 respectively for terminal A, that is, initiate the slice authentication and authorization process for each slice. As another implementation manner, AMF1 may initiate a slice authentication and authorization process to authenticate and authorize slice 1 and slice 2.

Optionally, the S201 part can be performed when terminal A registers with PLMN-1 through AMF1.

S202: AMF1 sends slice authentication and authorization information to UDM, where the slice authentication and authorization information is used to instruct terminal A to successfully authenticate and authorize slices on AMF1.

As an implementation manner, AMF1 sends a piece of slice authentication and authorization information to UDM, and the slice authentication and authorization information is used to indicate multiple slices. As another implementation manner, AMF1 sends multiple pieces of slice authentication and authorization information to UDM, and each piece of slice authentication and authorization information is used to indicate one slice. Optionally, the AMF1 may send the slice authentication and authorization information corresponding to each slice after the authentication and authorization of each slice is successful. Optionally, the AMF1 may also send corresponding pieces of slice authentication and authorization information after multiple slices are successfully authenticated and authorized.

As an example, AMF1 sends the identification information of terminal A, the identification information of slice 1, the identification information of slice 2, and the identification information of AMF1 to UDM. Wherein, the identification information of terminal A is used to identify terminal A, the identification information of slice 1 is used to identify slice 1, the identification information of slice 2 is used to identify slice 2, and the identification information of AMF1 is used to identify AMF1. The identification information of terminal A, the identification information of slice 1, the identification information of slice 2, and the identification information of AMF1 can indicate that the slices that are successfully authenticated and authorized by terminal A on AMF1 are slice 1 and slice 2. The identification information of the terminal A, the identification information of the slice 1, the identification information of the slice 2, and the identification information of the AMF1 can be regarded as a kind of slice authentication and authorization information.

As another example, AMF1 sends first slice authentication and authorization information to UDM. The first slice authentication and authorization information includes terminal A identification information, slice 1 identification information, and AMF1 identification information. And AMF1 sends second slice authentication and authorization information to UDM, where the second slice authentication and authorization information includes the identification information of terminal A, the identification information of slice 2, and the identification information of AMF1.

As an implementation manner, AMF1 can send slice authentication and authorization information to UDM through a Nudm_UESliceAUthentication message. For example, AMF1 sends a Nudm_UESliceAUthentication message to UDM, which carries slice authentication and authorization information.

S203: UDM stores slice authentication and authorization information.

Through S203, the association relationship between terminal A, AMF1, and slice 1, and the association relationship between terminal A, AMF1, and slice 2 are stored on the UDM. It can be understood that storing the association relationship between A and B means that A is stored, B is stored, and the association relationship between A and B is established.

S204: UDM sends a response to slice authentication and authorization information to AMF1. This response is used to inform AMF1 whether it successfully receives the above-mentioned slice authentication and authorization information. For receiving multiple pieces of slice authentication and authorization information, UDM may send the above response to AMF1 for each piece of slice authentication and authorization information. S204 is an optional step.

Exemplarily, the response may be Nudm_UESliceAUthenticationResponse.

As an alternative, S202 can be replaced with S205.

S205: The NSSAAF sends slice authentication and authorization information to the UDM, where the slice authentication and authorization information is used to indicate the slice that the terminal has successfully authenticated and authorized on the AMF1. Optionally, the NSSAAF can send the slice authentication and authorization information corresponding to each slice after the authentication and authorization of each slice is successful. Optionally, the NSSAAF may also send corresponding multiple pieces of slice authentication and authorization information after multiple slices are successfully authenticated and authorized.

In the slice authentication and authorization process of S201, NSSAAF will participate in the authentication and authorization of slice 1 and slice 2, and NSSAAF can learn the slices that the terminal has successfully authenticated and authorized on AMF1.

Similar to S202, as an implementation manner, NSSAAF sends the identification information of terminal A, the identification information of slice 1, the identification information of slice 2, and the identification information of AMF1 to UDM. For the related content of these identification information, refer to S202. Similar to S202, NSSAAF can send a piece of slice authentication and authorization information to UDM, which is used to indicate multiple slices; or NSSAAF can also send multiple pieces of slice authentication and authorization information to UDM, each slice authentication and authorization information The authorization information is used to indicate a slice.

As another possibility, the NSSAAF participating in the authentication and authorization of slice 1 may be different from the NSSAAF participating in the authentication and authorization of slice 2. For example, NSSAAF1 participates in the authentication and authorization of slice 1, and NSSAAF2 participates in the authentication and authorization of slice 2. In this case, NSSAAF1 sends first slice authentication and authorization information to UDM. The first slice authentication and authorization information includes the identification information of terminal A, the identification information of slice 1, and the identification information of AMF1. NSSAAF2 sends UDM The second slice authentication and authorization information is sent, and the second slice authentication and authorization information includes the identification information of terminal A, the identification information of slice 2, and the identification information of AMF1.

Through the above S202 and S203, the UDM stores the slice information that the terminal A has successfully authenticated and authorized on the AMF1. When subsequent re-authentication and re-authorization or authorization revoking of slice 1 or slice 2 is performed, it can be learned through UDM that the AMF serving terminal A and associated with slice 1 or slice 2 is AMF1.

As an optional alternative to Figure 2, in the process of performing slice 1 and slice 2 authentication and authorization for terminal A through AMF1, AMF1 can send slice authentication and authorization process information to AAA-s, and the slice authentication and authorization process The authorization process information includes the identification information of the terminal, the identification information of the slice, and the identification information of the PLMN to which the AMF belongs; for example, the slice authentication and authorization process information includes: the identification information of the terminal A, the identification information of the slice 1, and PLMN-1的identification information. When there are multiple slices, AMF can send slice authentication and authorization process information once for each slice, or AMF can send slice authentication and authorization process information once, including identification information of multiple slices. For example, the slice authentication and authorization process information includes: identification information of terminal A, identification information of slice 1, identification information of slice 2, and identification information of PLMN-1. After receiving the slice authentication and authorization process information, AAA-s can store the slice authentication and authorization process information after the slice authentication and authorization are successful. Among them, AMF can send slice authentication and authorization process information to AAA-s through NSSAAF. In this alternative solution, the AMF may send the identification information of the AMF and the identification information of the PLMN to which the AMF belongs to the UDM, so as to query the AMF corresponding to the PLMN through the identification information of the PLMN. For example, AMF1 sends the identification information of AMF1 and the identification information of PLMN-1 to UDM. Optionally, the AMF may also send the identification information of the slice to the UDM, for example, the AMF1 sends the identification information of the slice 1 to the UDM.

Figure 3 shows a method for terminal A to authenticate and authorize slices in PLMN-2. As shown in Figure 3:

S301: Complete the authentication and authorization of slice 2 and slice 3 for terminal A through AMF2.

AMF2 can trigger the slice authentication and authorization process to perform slice 2 and slice 3 authentication and authorization for terminal A. For the slice authentication and authorization process, please refer to the content in section 4.2.9.2 of 3GPP TS 23.502 v16.4.0.

As an implementation manner, the AMF2 can trigger the slice authentication and authorization procedures for the slice 2 and the slice authentication and authorization procedures for the slice 3 respectively for the terminal A, that is, initiate the slice authentication and authorization procedures for each slice. As another implementation manner, AMF1 may initiate a slice authentication and authorization process to authenticate and authorize slice 2 and slice 3. As another implementation manner, the AMF2 obtains the result of the slice authentication and authorization performed by the terminal A on the AMF1 to determine whether to initiate the slice 2 and slice 3 authentication and authorization processes. If slice 2 on AMF1 has been authenticated and authorized successfully, AMF2 may not initiate the authentication and authorization process of slice 2, and determine that terminal A is authorized to access slice 2. For this embodiment, AMF1 may send the slice authentication result to NSSAAF, and NSSAAF sends the result of successful authentication to UDM.

Optionally, the S301 part can be performed when terminal A registers with PLMN-2 through AMF2.

S302: AMF2 sends slice authentication and authorization information to UDM, where the slice authentication and authorization information is used to instruct terminal A to successfully authenticate and authorize slices on AMF2.

As an implementation manner, AMF2 sends a piece of slice authentication and authorization information to UDM, and the slice authentication and authorization information is used to indicate multiple slices. As another implementation manner, AMF2 sends multiple pieces of slice authentication and authorization information to UDM, and each piece of slice authentication and authorization information is used to indicate a slice.

As an example, AMF2 sends the identification information of terminal A, the identification information of slice 2, the identification information of slice 3, and the identification information of AMF2 to UDM. Wherein, the identification information of terminal A is used to identify terminal A, the identification information of slice 1 is used to identify slice 1, the identification information of slice 2 is used to identify slice 2, and the identification information of AMF2 is used to identify AMF2. The identification information of the terminal A, the identification information of the slice 2, the identification information of the slice 3, and the identification information of the AMF2 can indicate that the slices that are successfully authenticated and authorized by the terminal A on the AMF2 are the slice 2 and the slice 3. The identification information of the terminal A, the identification information of the slice 2, the identification information of the slice 3, and the identification information of the AMF2 can be regarded as a kind of slice authentication and authorization information.

As another example, AMF2 sends first slice authentication and authorization information to UDM. The first slice authentication and authorization information includes terminal A identification information, slice 2 identification information, and AMF2 identification information. And AMF2 sends second slice authentication and authorization information to UDM, where the second slice authentication and authorization information includes the identification information of terminal A, the identification information of slice 3, and the identification information of AMF2.

As an implementation manner, AMF2 can send slice authentication and authorization information to UDM through a Nudm_UESliceAUthentication message. For example, AMF2 sends a Nudm_UESliceAUthentication message to UDM, which carries slice authentication and authorization information.

S303: UDM stores slice authentication and authorization information.

Through S303, for terminal A, the association relationship between terminal A, AMF2, and slice 2, and the association relationship between terminal A, AMF2, and slice 3 are stored on the UDM. It can be understood that storing the association relationship between A and B means that A is stored, B is stored, and the association relationship between A and B is established.

S304: UDM sends a response to slice authentication and authorization information to AMF2. This response is used to inform AMF2 whether the slice authentication and authorization information is successfully received. For receiving multiple pieces of slice authentication and authorization information, UDM may send the above response to AMF1 for each piece of slice authentication and authorization information. S304 is an optional step.

Exemplarily, the response may be Nudm_UESliceAUthenticationResponse.

As an alternative, S302 can be replaced with S305.

S305: NSSAAF sends slice authentication and authorization information to UDM, where the slice authentication and authorization information is used to indicate the slice that the terminal has successfully authenticated and authorized on the AMF2.

In the slice authentication and authorization process of S301, NSSAAF will participate in slice 2 and slice 3 authentication and authorization, and NSSAAF can learn the slices that the terminal has successfully authenticated and authorized on AMF2.

Similar to S302, as an implementation manner, NSSAAF sends the identification information of terminal A, the identification information of slice 2, the identification information of slice 3, and the identification information of AMF2 to UDM. For the related content of the identification information, refer to S302. Similar to S302, NSSAAF can send a piece of slice authentication and authorization information to UDM, which is used to indicate multiple slices; or NSSAAF can also send multiple pieces of slice authentication and authorization information to UDM, each slice authentication and authorization information The authorization information is used to indicate a slice.

As another possibility, the NSSAAF participating in the authentication and authorization of slice 2 and the authentication participating in slice 3 may be different from the authorized NSSAAF. For example, NSSAAF2 participates in the authentication and authorization of slice 2, and NSSAAF3 participates in the authentication and authorization of slice 3. In this case, NSSAAF2 sends first slice authentication and authorization information to UDM. The first slice authentication and authorization information includes terminal A identification information, slice 2 identification information, and AMF2 identification information, and NSSAAF3 sends UDM The second slice authentication and authorization information is sent. The second slice authentication and authorization information includes the identification information of the terminal A, the identification information of the slice 3, and the identification information of the AMF2.

Through the foregoing S302 and S303, the UDM stores information about the slices that the terminal A has successfully authenticated and authorized on the AMF2. When subsequently re-authenticating and re-authorizing or revoking slice 2 or slice 3, it can be learned through UDM that the AMF associated with slice 2 or slice 3 serving terminal A is AMF2.

As an optional alternative to Fig. 3, after completing the authentication and authorization process of slice 2 and slice 3 for terminal A through AMF2, AMF2 can send slice authentication and authorization process information to AAA-s, the slice authentication and The authorization process information includes terminal identification information, slice identification information, and identification information of the PLMN to which the AMF belongs; for example: the slice authentication and authorization process information includes: terminal A identification information, slice 2 identification information, and PLMN-2的identification information. When there are multiple slices, AMF can send slice authentication and authorization process information once for each slice, or AMF can send slice authentication and authorization process information once, including identification information of multiple slices. For example, the slice authentication and authorization process information includes: identification information of terminal A, identification information of slice 2, identification information of slice 3, and identification information of PLMN-2. After receiving the slice authentication and authorization process information, the AAA-s can store the slice authentication and authorization process information after the slice authentication and authorization are successful. Among them, AMF can send slice authentication and authorization process information to AAA-s through NSSAAF. In this alternative solution, the AMF may send the identification information of the AMF and the identification information of the PLMN to which the AMF belongs to the UDM, so as to query the AMF corresponding to the PLMN through the identification information of the PLMN. For example, AMF2 sends the identification information of AMF2 and the identification information of PLMN-2 to UDM. Optionally, the AMF may also send the identification information of the slice to the UDM, for example, the AMF2 sends the identification information of the slice 2 to the UDM.

In the methods shown in Figures 2 and 3, the identification information of the terminal includes: SUPI (subscription permanent identifier), 5G-GUTI (5G Globally Unique Temporary Identifier, 5G Globally Unique Temporary Identifier), GPSI (Generic Public Subscription Identifier) , General Public User ID) or other IDs that can be used to identify the terminal; AMF ID information includes: <AMF Region ID><AMF Group ID><AMF Pointer>(<AMFRegionID><AMFSetID><AMFPointer >), FQDN (Fully Qualified Domain Name, fully qualified domain name), AMF example identifier (AMF instance Id), AMF IP address or AMF IPv6 prefix; slice identification information includes: S-NSSAI (Single Network Slice Selection Assistance Information, single Network slice selection support information), or the external identification of the slice. The external identifier is used to identify the slice outside the network. As an optional solution, since there is a one-to-one correspondence between AMF and PLMN, the above-mentioned AMF identification information can also be replaced with PLMN identification information, that is, PLMN identification information can be regarded as a kind of AMF identification information . The corresponding AMF can be found through the identification information of the PLMN.

It should be noted that the identification information may be converted during the process of transmission and storage. The converted identification information has the same function as the identification information before the conversion, and both identify the same object. Therefore, it is collectively referred to as identification information in this application. For example, AMF sends the identification information of terminal A to UDM, and UDM sends the identification information of terminal A to other network elements, which may include the following scheme: AMF sends the SUPI of terminal A to UDM, and UDM can obtain the GPSI corresponding to the SUPI, and Send the GPSI to other network elements. For another example, AMF sends S-NSSAI to NSSAAF, and NSSAAF maps S-NSSAI to external slice identifier, and sends the external slice identifier to AAA-s or AAA-p to AAA-s. Similarly, the slice authentication and authorization information may be converted during transmission and storage. The slice authentication and authorization information after conversion has the same function as the slice authentication and authorization information before conversion. Both are used to instruct the terminal to authenticate and authorize on the AMF. Successfully authorized slices are collectively referred to as slice authentication and authorization information in this application. In the methods for authenticating and authorizing slices in FIGS. 2 and 3, AMF1 and AMF2 can be regarded as a kind of network elements that trigger authentication and authorization of slices, which are referred to as triggering network elements in this application. In different network architectures or scenarios, other types of network elements can be used as triggering network elements to trigger authentication and authorization of a certain network function. In the above method, UDM can be regarded as a network element that stores the correspondence between slices and AMF, and is referred to as an information storage network element for short in this application. In different network architectures or scenarios, other types of network elements can be used as information storage network elements, such as HSS (home subscriber server, home user server), HLR (home location register, home location register). In the above method, NSSAAF can be regarded as a network element that participates in slice authentication and authorization, which is referred to as authentication and authorization network element for short in this application. Similarly, in a network architecture that uses AUSF to participate in the above-mentioned slice authentication and authorization process, AUSF can be regarded as a network element that participates in slice authentication and authorization. In different network architectures or scenarios, other types of network elements can be used as authentication and authorization network elements.

Through the methods shown in FIG. 2 and FIG. 3, terminal A authenticates and authorizes slices in PLMN-1 and PLMN-2, respectively. Through UDM, it can be known that the AMF associated with slice 1 that serves terminal A is AMF1, the AMFs associated with slice 2 that serves terminal A are AMF1 and AMF2, and the AMF that serves terminal A and associated with slice 3 is AMF2.

As an example, through the methods in Figure 2 and Figure 3, UDM can store the following information, as shown in Table 1:

Table 1

In the alternatives of Figures 2 and 3, AAA-s stores the information shown in Table 2:

Table 2

In the alternatives of Figures 2 and 3, UDM stores the information shown in Table 3:

table 3

After terminal A authenticates and authorizes slices in PLMN-1 and PLMN-2, AAA-s can initiate a slice re-authentication and re-authorization process, or initiate a slice authorization revocation process as needed.

In order to reduce the aforementioned communication abnormalities, an embodiment of the present application provides a method for re-authentication and re-authorization of slices. The method will be described below in conjunction with the contents of FIG. 1, FIG. 2 and FIG. 3.

Figure 4 shows the method in which AAA-s initiates re-authentication and re-authorization of slice 1. As shown in Figure 4:

S401: AAA-s requests NSSAAF to initiate re-authentication and re-authorization of slice 1 for terminal A.

As an implementation manner, the AAA-s sends a first request to the NSSAAF, and the first request is used to request the terminal A to initiate the re-authentication and re-authorization of the slice 1. As an example, the first request includes the identification information of the terminal A and the identification information of the slice 1. From the identification information of the terminal A and the identification information of the slice 1, it can be known that the re-authentication and re-authorization of the slice 1 are requested for the terminal A. If AAA-p is set between AAA-s and NSSAAF, AAA-s can send the first request to NSSAAF through AAA-p. Among them, the identification information of terminal A and the identification information of slice 1 can refer to related content in FIG. 2 and FIG. 3. For example, in S401, the identification information of terminal A may be the GPSI of terminal A, and the identification information of slice 1 may be the S-NSSAI of slice 1 or the external identification of slice 1.

Exemplarily, the first request may be AAAProcol Re-auth Request.

As an optional alternative to S401, when AAA-s requests NSSAAF to initiate re-authentication and re-authorization of slice 1 for terminal A, it can further carry the identification information of PLMN-1 in the request according to the information in Table 2. NSSAAF can obtain the identification information of AMF1 from UDM through the identification information of PLMN-1, so that S405 can be directly executed.

S402: NSSAAF requests UDM to obtain the AMF associated with slice 1 serving terminal A.

As an implementation manner, NSSAAF sends a second request to UDM, and the second request is used to request to obtain the AMF associated with slice 1 serving terminal A. As an example, the second request includes the identification information of the terminal A and the identification information of the slice 1. Optionally, the request further includes a first indication, and the first indication is used to indicate that the acquired network element type is AMF. Optionally, the request further includes a second indication, and the second indication is used to indicate that the related process is a slice re-authentication and re-authorization process. Optionally, the second request may be Nudm_UECM_GetReq.

Optionally, if the identification information of slice 1 received by NSSAAF in S401 is the external identification of slice 1, NSSAAF may obtain the S-NSSAI of slice 1 according to the external identification of slice 1, and then, in S402, the S-NSSAI of slice 1 -NSSAI is sent to UDM. Optionally, if the identification information of slice 1 received by NSSAAF in S401 is the external identification of slice 1, NSSAAF may also send the external identification of slice 1 to UDM.

S403: UDM obtains the AMF associated with slice 1 serving terminal A.

After adopting the methods in Fig. 2 and Fig. 3, UDM stores the association relationship between terminal A, AMF1, and slice 1.

As an implementation manner, UDM can obtain the identification information of AMF1 according to the received identification information of terminal A and the identification information of slice 1, that is, the AMF associated with slice 1 serving terminal A is AMF1. Optionally, the UDM may learn that the acquired network element type is AMF according to the first instruction. Optionally, the UDM may learn that the related process is the slice re-authentication and re-authorization process according to the second instruction, so that the UDM can make corresponding processing.

S404: The UDM sends the identification information of the AMF associated with slice 1 that serves the terminal A to the NSSAAF.

The UDM may send the identification information of AMF1 obtained in S403 to the NSSAAF.

As an implementation manner, UDM sends a response message to NSSAAF, where the response message includes the identification information of AMF1. Optionally, the response message may be Nudm_UECM_GetResp.

Optionally, in S402, when the identification information of slice 1 obtained by UDM from NSSAAF is the external identification of slice 1, UDM may obtain the S-NSSAI of slice 1 according to the external identification, and combine the S-NSSAI of slice 1 with AMF1. The identification information will be sent to NSSAAF together.

S405: NSSAAF notifies AMF1 to initiate a slice authentication and authorization process for slice 1 to terminal A.

As an implementation manner, NSSAAF sends a first notification to AMF1 according to the received identification information of AMF1, and the first notification is used to notify AMF1 to initiate a slice authentication and authorization process for slice 1 to terminal A. As an example, the first notification includes: event information, identification information of terminal A, and identification information of slice 1. As an example, in S405, the identification information of slice 1 may be the S-NSSAI of slice 1. Among them, the event information is used to indicate the slice authentication and authorization process. Optionally, the first notification may be Nnssaaf_NSSAA_Notify.

S406: AMF1 triggers the slice authentication and authorization process for slice 1.

According to the event information, the identification information of the terminal A, and the identification information of the slice 1, the AMF1 learns that the slice authentication and authorization process for the slice 1 needs to be initiated for the terminal A. The slice authentication and authorization process can be performed with reference to the method shown in FIG. 2.

Through S402-S405, the NSSAAF can accurately obtain the identification information of the AMF1 associated with the slice 1 serving the terminal A from the UDM by using the identification information of the slice 1. In comparison, if there is only the association relationship between the terminal and AMF on the UDM, and the association relationship between the terminal, AMF, and slice is not stored, NSSAAF may obtain the identification information of AMF2, thereby notifying AMF2 to trigger The slice authentication and authorization process for slice 1 will cause communication abnormalities. Therefore, through the solution of the present application, the occurrence of communication abnormalities can be reduced.

Figure 5 shows a method for AAA-s to initiate re-authentication and re-authorization of slice 2. For the same terms and concepts in FIG. 5 as those in FIG. 4, reference may be made to the related content of FIG. 4. As shown in Figure 5:

S501: AAA-s requests NSSAAF to initiate re-authentication and re-authorization of slice 2 for terminal A.

As an implementation manner, the AAA-s sends a first request to the NSSAAF, and the first request is used to request the terminal A to initiate the re-authentication and re-authorization of the slice 2. As an example, the first request includes the identification information of the terminal A and the identification information of the slice 2. From the identification information of the terminal A and the identification information of the slice 2, it can be known that the re-authentication and re-authorization of the slice 2 are requested for the terminal A. If AAA-p is set between AAA-s and NSSAAF, AAA-s can send the first request to NSSAAF through AAA-p. Among them, the identification information of terminal A and the identification information of slice 2 can refer to related content in FIG. 2 and FIG. 3. For example, in S501, the identification information of terminal A may be the GPSI of terminal A, and the identification information of slice 2 may be the S-NSSAI of slice 2 or the external identification of slice 2.

Exemplarily, the first request may be AAAProcol Re-auth Request.

As an optional alternative to S501, when AAA-s requests NSSAAF to initiate re-authentication and re-authorization of slice 2 for terminal A, it can learn that slice 2 corresponds to PLMN-1 and PLMN-2 according to the information in Table 2, and Determine by yourself to initiate re-authentication and re-authorization in PLMN-1, or initiating re-authentication and re-authorization in PLMN-2, or initiating re-authentication and re-authorization in PLMN-1 and PLMN-2, and further carry PLMN-1 and/or PLMN -2 identification information In the request, NSSAAF can obtain the identification information of AMF1 and/or AMF2 from UDM through the identification information of PLMN-1 and/or PLMN-2. When AAA-s determines that a PLMN in PLMN-1 and PLMN-2 initiates re-authentication and re-authorization, NSSAAF can obtain the identification information of AMF1 or AMF2 from UDM according to the identification information of PLMN-1 or PLMN-2, so that it can Execute S505a or S505b directly. Optionally, AAA-s can determine which PLMN to initiate re-authentication and re-authorization according to policies or timers.

S502: NSSAAF requests UDM to obtain the AMF associated with slice 2 serving terminal A.

As an implementation manner, NSSAAF sends a second request to UDM, where the second request is used to request to obtain the AMF associated with slice 2 serving terminal A. As an example, the second request includes the identification information of the terminal A and the identification information of the slice 2. Optionally, the request further includes a first indication, and the first indication is used to indicate that the acquired network element type is AMF. Optionally, the request further includes a second indication, and the second indication is used to indicate that the related process is a slice re-authentication and re-authorization process. Optionally, the second request may be Nudm_UECM_GetReq.

Optionally, if the identification information of slice 2 received by NSSAAF in S501 is the external identification of slice 2, NSSAAF may obtain the S-NSSAI of slice 2 according to the external identification of slice 2, and then in S502, the S-NSSAI of slice 2 -NSSAI is sent to UDM. Optionally, if the identification information of slice 2 received by NSSAAF in S501 is the external identification of slice 2, NSSAAF may also send the external identification of slice 2 to UDM.

S503: UDM obtains the AMF associated with slice 2 serving terminal A.

After adopting the methods of Fig. 2 and Fig. 3, UDM stores the association relationship between terminal A, AMF1, and slice 2, and stores the association relationship between terminal A, AMF2, and slice 2.

As an implementation manner, UDM can obtain the identification information of AMF1 and the identification information of AMF2 according to the received identification information of terminal A and the identification information of slice 1. That is, the AMFs associated with slice 1 serving terminal A are AMF1 and AMF2. . Optionally, the UDM may learn that the acquired network element type is AMF according to the first instruction. Optionally, the UDM may learn that the related process is the slice re-authentication and re-authorization process according to the second instruction, so that the UDM can make corresponding processing.

Optionally, when there are multiple AMFs associated with slices serving the terminal, the UDM may not further select one of the AMFs.

Optionally, when there are multiple AMFs associated with slices serving the terminal, the UDM may further select one of the AMFs.

For the slice re-authentication and re-authorization process, UDM can select one AMF from multiple AMFs according to the connection state of the terminal. The connection state of the terminal includes the connected state and the idle state. As a possibility, if the connection state between the terminal and each of the multiple AMFs is in the connected state, the UDM can select one of the AMFs according to the policy or arbitrarily. For example, if the connection status between terminal A and AMF1 is connected, and the connection status with AMF2 is connected, UDM can select one of AMF1 and AMF2 according to a policy or arbitrarily. As another possibility, if the connection state between the terminal and each of the multiple AMFs is idle, UDM may select an AMF according to the access type, for example, select an AMF corresponding to 3GPP access. Generally, the access type can be divided into 3GPP access and non-3GPP access. For example, if the connection state between terminal A and AMF1 is idle state, and the connection state with AMF2 is idle state, UDM can select 3GPP to access the corresponding AMF, namely AMF1. As another possibility, if the connection state between the terminal and some AMFs of the multiple AMFs is in the connected state, and the connection state with other AMFs is in the idle state, the UDM can select a terminal and the AMF in the connected state. For example, if the connection state of the terminal A with respect to AMF1 is the connected state and the connection state with respect to AMF2 is the idle state, UDM selects AMF1.

S504: The UDM sends the identification information of the AMF associated with the slice 2 serving the terminal A to the NSSAAFNSSAAF.

Optionally, the UDM may send the identification information of AMF1 and the identification information of AMF2 obtained in S503 to the NSSAAF.

Optionally, the UDM may send the identification information of AMF1 or the identification information of AMF2 obtained in S503 to the NSSAAF.

As an implementation manner, the UDM sends a response message to the NSSAAF, where the response message includes the identification information of AMF1 and/or the identification information of AMF2. Optionally, the response message may be Nudm_UECM_GetResp.

Optionally, in S502, when the identification information of slice 2 obtained by UDM from NSSAAF is the external identification of slice 2, UDM may obtain the S-NSSAI of slice 2 according to the external identification, and combine the S-NSSAI of slice 2 with AMF1. The identification information will be sent to NSSAAF together.

S505a: NSSAAF notifies AMF1 to initiate a slice authentication and authorization process for slice 2 to terminal A.

As an implementation manner, if the NSSAAF received the identification information of AMF1 in S504, the NSSAAF sends the first notification to AMF1. As another implementation manner, for the slice re-authentication and re-authorization process, if the NSSAAF receives the identification information of AMF1 and the identification information of AMF2 in S504, the NSSAAF may select AMF1 and send the first notification to AMF1. Optionally, NSSAAF can select AMF1 according to the strategy. The first notification is used to notify AMF1 to initiate a slice authentication and authorization process for slice 2 to terminal A. As an example, the first notification includes: event information, identification information of terminal A, and identification information of slice 2. As an example, in S505a, the identification information of slice 2 may be the S-NSSAI of slice 2. Among them, the event information is used to indicate the slice authentication and authorization process. Optionally, the first notification may be Nnssaaf_NSSAA_Notify.

S505b: NSSAAF notifies AMF2 to initiate a slice authentication and authorization process for slice 2 to terminal A.

As an implementation manner, if the identification information of AMF2 received by NSSAAF in S504, NSSAAF sends a second notification to AMF2. As another implementation manner, for the slice re-authentication and re-authorization process, if the NSSAAF receives the identification information of AMF1 and the identification information of AMF2 in S504, the NSSAAF may select AMF2 and send a second notification to AMF2. Optionally, NSSAAF can select AMF2 according to the strategy. The second notification is used to notify AMF1 to initiate a slice authentication and authorization process for slice 2 to terminal A. As an example, the second notification includes: event information, identification information of terminal A, and identification information of slice 2. As an example, in S505b, the identification information of slice 2 may be the S-NSSAI of slice 2. Among them, the event information is used to indicate the slice authentication and authorization process. Optionally, the second notification may be Nnssaaf_NSSAA_Notify.

Optionally, as another implementation manner, for the slice re-authentication and re-authorization process, if in S504 NSSAAF receives the identification information of AMF1 and the identification information of AMF2, NSSAAF can notify AMF1 and AMF2 to terminal A Initiate the slice authentication and authorization process for slice 2. That is, both S505a and S505b are executed. Compared with this embodiment, the NSSAAF selects one of the AMF notifications to initiate a slice authentication and authorization process for the terminal, which can save signaling overhead.

S506a: AMF1 triggers the slice authentication and authorization process for slice 2.

According to the event information, the identification information of the terminal A, and the identification information of the slice 2, the AMF1 learns that the slice authentication and authorization process for the slice 2 needs to be initiated for the terminal A. The slice authentication and authorization process can be performed with reference to the method shown in FIG. 2.

S506b: AMF2 triggers the slice authentication and authorization process for slice 2.

According to the event information, the identification information of the terminal A, and the identification information of the slice 2, the AMF2 learns that it needs to initiate a slice authentication and authorization process for the slice 2 to the terminal A. The slice authentication and authorization process can be performed with reference to the method shown in FIG. 3.

Through S502-S505a or S505b, the NSSAAF can accurately obtain the identification information of AMF1 and/or the identification information of AMF2 associated with slice 2 serving the terminal A by using the identification information of the slice 2 from the UDM. In comparison, if there is only the association relationship between the terminal and AMF on the UDM, and the association relationship between the terminal, AMF, and slice is not stored, NSSAAF may obtain the registration of terminal A other than AMF1 and AMF2. The identification information of the AMF, so as to notify the wrong AMF to trigger the slice authentication and authorization process on slice 2, will cause communication abnormalities. Therefore, through the solution of the present application, the occurrence of communication abnormalities can be reduced. In addition, when there are multiple AMFs associated with a certain slice serving the terminal, the connection status of the terminal is considered to select the appropriate AMF, which can save signaling interaction and improve communication efficiency.

Figure 6 shows a method for AAA-s to initiate re-authentication and re-authorization of slice 2. For the description of the same terms and concepts in FIG. 6 as in FIG. 5, reference may be made to the related content of FIG. 5. Compared with FIG. 5, UDM determines the AMF according to the identification information of the slice, and in FIG. 6 NSSAAF determines the AMF according to the identification information of the slice. As shown in Figure 6:

S601: AAA-s requests NSSAAF to initiate re-authentication and re-authorization of slice 2 for terminal A.

See S501 for S601.

As an optional alternative to S601, when AAA-s requests NSSAAF to initiate re-authentication and re-authorization of slice 2 for terminal A, it can learn that slice 2 corresponds to PLMN-1 and PLMN-2 according to the information in Table 2, and Determine by yourself to initiate re-authentication and re-authorization in PLMN-1, or initiating re-authentication and re-authorization in PLMN-2, or initiating re-authentication and re-authorization in PLMN-1 and PLMN-2, and further carry PLMN-1 and/or PLMN -2 identification information In the request, NSSAAF can obtain the identification information of AMF1 and/or AMF2 from UDM through the identification information of PLMN-1 and/or PLMN-2. When AAA-s determines that a PLMN in PLMN-1 and PLMN-2 initiates re-authentication and re-authorization, NSSAAF can obtain the identification information of AMF1 or AMF2 from UDM according to the identification information of PLMN-1 or PLMN-2, so that it can Execute S606a or S606b directly. Optionally, AAA-s can determine which PLMN to initiate re-authentication and re-authorization according to policies or timers.

S602: The NSSAAF requests the UDM to obtain the AMF serving the terminal A and the slice associated with the AMF serving the terminal A.

As an implementation manner, the NSSAAF sends a second request to the UDM, the second request is used to request to obtain the AMF serving the terminal A and the slice associated with the AMF serving the terminal A. As an example, the second request includes terminal A's identification information. Optionally, the request further includes a first indication, and the first indication is used to indicate that the acquired network element type is AMF. Optionally, the request further includes a second indication, and the second indication is used to indicate that the related process is a slice re-authentication and re-authorization process. Optionally, the second request may be Nudm_UECM_GetReq.

S603: The UDM obtains the AMF serving the terminal A and the slice associated with the AMF serving the terminal A.

After adopting the methods in Figure 2 and Figure 3, UDM stores the association relationship between the terminal, AMF, and slice as shown in Table 1 above.

As an implementation manner, UDM can obtain {identification information of AMF1, (identification information of slice 1, identification information of slice 2)} and {identification information of AMF2, (identification of slice 2) according to the received identification information of terminal A. Information, the identification information of slice 3)}, that is, the AMFs serving the terminal A are AMF1 and AMF2, the slices associated with AMF1 are slice 1 and slice 2, and the slices associated with AMF2 are slice 2 and slice 3. Optionally, the UDM may learn that the acquired network element type is AMF according to the first instruction. Optionally, the UDM may learn that the related process is the slice re-authentication and re-authorization process according to the second instruction, so that the UDM can make corresponding processing. It can be understood that {A, B} indicates that A and B have an association relationship, and (A, B) indicates a set or list, and the set or list includes two elements A and B.

Optionally, the UDM can also obtain the connection status between the terminal and the AMF serving the terminal. The connection state of the terminal includes a connected state and an idle state. As an implementation manner, the UDM may request the service terminal AMF to obtain the connection status of the terminal. For example, in Table 1, the AMFs serving terminal A are AMF1 and AMF2. UDM can obtain the connection status of terminal A and AMF1 from AMF1, and the connection status of terminal A and AMF2 from AMF2.

Optionally, the UDM may also obtain the access type corresponding to the AMF serving the terminal. For related content of the access type, refer to related content of S503. For example, the access type corresponding to AMF1 is 3GPP access, and the access type corresponding to AMF2 is non-3GPP access technology.

S604: The UDM sends the identification information of the AMF serving the terminal A and the identification information of the slice associated with the AMF serving the terminal A to the NSSAAF.

Exemplarily, UDM sends {identification information of AMF1, (identification information of slice 1, identification information of slice 2)}, and {identification information of AMF2, (identification information of slice 2, identification information of slice 3)} to NSSAAF .

Exemplarily, UMD sends {AMF1 identification information, slice 1 identification information}, {AMF1 identification information, slice 2 identification information}, {AMF2 identification information, slice 2 identification information}, and {AMF2 The identification information, the identification information of slice 3}.

Optionally, UDM can send connection status information to NSSAAF. The connection status information is used to indicate the connection status between the terminal and the AMF serving the terminal. For example, the connection state information indicates that the connection state between the terminal A and AMF1 is the connected state, and the connection state between the terminal A and AMF2 is the idle state.

Optionally, UDM can send access type information to NSSAAF. The access type information is used to indicate the access type corresponding to the AMF serving the terminal. For example, the access type information indicates that the access type of AMF1 is 3GPP access, and the access type of AMF2 is non-3GPP access.

As an implementation manner, the UDM sends a response message to the NSSAAF. The response message includes the identification information of the AMF serving the terminal A and the identification information of the slice associated with the AMF serving the terminal A. Optionally, the response message further includes the above-mentioned connection status information. Optionally, the response message further includes the above-mentioned access type information. Optionally, the response message may be Nudm_UECM_GetResp.

S605: NSSAAF determines the AMF associated with slice 2.

Based on the information received in S604, the NSSAAF can learn that the AMFs associated with slice 2 serving the terminal A are AMF1 and AMF2.

Optionally, if there are multiple AMFs associated with slices serving the terminal, the NSSAAF may not further select one AMF from the multiple AMFs.

Optionally, if there are multiple AMFs associated with slices serving the terminal, the NSSAAF may further select one AMF from the multiple AMFs. Compared with the solution of not further determining one AMF among multiple AMFs, further determining one AMF among multiple AMFs is beneficial to save subsequent signaling interaction.

For the slice re-authentication and re-authorization process, NSSAAF can select one AMF from multiple AMFs according to the connection status of the terminal. The connection status of the terminal can be obtained through the connection status information in S604. As a possibility, if the connection state between the terminal and each of the multiple AMFs is in the connected state, the NSSAAF can select one of the AMFs according to the policy or arbitrarily. For example, if the connection status between terminal A and AMF1 is connected, and the connection status with AMF2 is connected, NSSAAF can select one of AMF1 and AMF2 according to a policy or arbitrarily. As another possibility, if the connection state between the terminal and each AMF of the multiple AMFs is in the idle state, the NSSAAF can select an AMF according to the access type corresponding to the AMF. For example, select an AMF corresponding to 3GPP access. The access type corresponding to the AMF can be obtained through the access type information in S604. For example, if the connection state between terminal A and AMF1 is idle state, and the connection state with AMF2 is idle state, NSSAAF can select 3GPP to access the corresponding AMF, namely AMF1. As another possibility, if the connection state between the terminal and some AMFs of the multiple AMFs is in the connected state, and the connection state with other AMFs is in the idle state, the NSSAAF can select a terminal and the AMF in the connected state. For example, if the connection state of terminal A relative to AMF1 is connected and the connection state relative to AMF2 is idle, NSSAAF selects AMF1.

If in S605, NSSAAF determines that the AMFs associated with slice 2 are AMF1 and AMF2, then S606a and S606b are executed.

If in S605, NSSAAF determines that the AMF associated with slice 2 is one of AMF1 and AMF2, S606a or S606b is executed.

S606a: NSSAAF notifies AMF1 to initiate a slice authentication and authorization process for slice 2 to terminal A.

As an implementation manner, NSSAAF sends the first notification to AMF1. The first notification is used to notify AMF1 to initiate a slice authentication and authorization process for slice 2 to terminal A. As an example, the first notification includes: event information, identification information of terminal A, and identification information of slice 2. As an example, in S606a, the identification information of slice 2 may be the S-NSSAI of slice 2. Among them, the event information is used to indicate the slice authentication and authorization process. Optionally, the first notification may be Nnssaaf_NSSAA_Notify.

S606b: NSSAAF notifies AMF2 to initiate a slice authentication and authorization process for slice 2 to terminal A.

As an implementation manner, NSSAAF sends the second notification to AMF2. As an example, the second notification includes: event information, identification information of terminal A, and identification information of slice 2. As an example, in S606b, the identification information of slice 2 may be the S-NSSAI of slice 2. Among them, the event information is used to indicate the slice authentication and authorization process. Optionally, the second notification may be Nnssaaf_NSSAA_Notify.

S607a: AMF1 triggers the slice authentication and authorization process for slice 2.

S607a can refer to S506a.

S607b: AMF2 triggers the slice authentication and authorization process for slice 2.

S607b can refer to S506b.

Through S602-S606a or S606b, the NSSAAF can accurately obtain the identification information of AMF1 and/or the identification information of AMF2 associated with slice 2 serving the terminal A by using the identification information of the slice 2. In comparison, if there is only the association relationship between the terminal and AMF on the UDM, and the association relationship between the terminal, AMF, and slice is not stored, NSSAAF may obtain the registration of terminal A other than AMF1 and AMF2. The identification information of the AMF, so as to notify the wrong AMF to trigger the slice authentication and authorization process on slice 2, will cause communication abnormalities. Therefore, through the solution of the present application, the occurrence of communication abnormalities can be reduced. In addition, when there are multiple AMFs associated with a certain slice serving the terminal, the connection state of the terminal is considered to select an appropriate AMF, which can save signaling interaction and improve communication efficiency.

In order to reduce the aforementioned communication abnormalities, an embodiment of the present application provides a method for revoking authorization for slices. The method will be described below in conjunction with the contents of FIG. 1, FIG. 2 and FIG. 3.

Figure 7 shows a method for AAA-s to initiate the authorization revocation of slice 1. As shown in Figure 7:

S701: The AAA-s requests the NSSAAF to initiate the authorization cancellation of the slice 1 for the terminal A.

As an implementation manner, the AAA-s sends a first request to the NSSAAF, and the first request is used to request the terminal A to initiate the authorization revocation of the slice 1. As an example, the first request includes the identification information of the terminal A and the identification information of the slice 1. From the identification information of the terminal A and the identification information of the slice 1, it can be known that the terminal A is requested to revoke the authorization of the slice 1. If AAA-p is set between AAA-s and NSSAAF, AAA-s can send the first request to NSSAAF through AAA-p. Among them, the identification information of terminal A and the identification information of slice 1 can refer to related content in FIG. 2 and FIG. 3. For example, in 701, the identification information of terminal A may be the GPSI of terminal A, and the identification information of slice 1 may be the S-NSSAI of slice 1 or the external identification of slice 1.

Exemplarily, the first request may be AAA Protocol Revoke Auth Request.

As an optional replacement of S701, when AAA-s requests to NSSAAF to initiate the revocation of authorization for slice 1 to terminal A, it can further carry the identification information of PLMN-1 in the request according to the information in Table 2, and NSSAAF passes the PLMN. The identification information of -1 can obtain the identification information of AMF1 from UDM, so that S705 can be directly executed.

S702: NSSAAF requests UDM to obtain the AMF associated with slice 1 serving terminal A.

As an implementation manner, NSSAAF sends a second request to UDM, and the second request is used to request to obtain the AMF associated with slice 1 serving terminal A. As an example, the second request includes the identification information of the terminal A and the identification information of the slice 1. Optionally, the request further includes a first indication, and the first indication is used to indicate that the acquired network element type is AMF. Optionally, the request further includes a second indication, and the second indication is used to indicate that the related process is a slice authorization revocation process. Optionally, the second request may be Nudm_UECM_GetReq.

Optionally, if the identification information of slice 1 received by NSSAAF in S701 is the external identification of slice 1, NSSAAF may obtain the S-NSSAI of slice 1 according to the external identification of slice 1, and then in S702, the S-NSSAI of slice 1 -NSSAI is sent to UDM. Optionally, if the identification information of slice 1 received by NSSAAF in S701 is the external identification of slice 1, NSSAAF may also send the external identification of slice 1 to UDM.

S703: UDM obtains the AMF associated with slice 1 serving terminal A.

As an implementation manner, the UDM can obtain the identification information of AMF1 according to the received identification information of the terminal A and the identification information of the slice 1, that is, the AMF associated with the slice 1 serving the terminal A is AMF1. Optionally, the UDM may learn that the acquired network element type is AMF according to the first instruction. Optionally, the UDM may learn that the related process is the slice authorization revocation process according to the second instruction, so that the UDM can make corresponding processing.

S704: The UDM sends the identification information of the AMF associated with slice 1 that serves the terminal A to the NSSAAF.

The UDM may send the identification information of AMF1 obtained in S703 to the NSSAAF.

Optionally, in S702, when the identification information of slice 1 obtained by UDM from NSSAAF is the external identification of slice 1, UDM may obtain the S-NSSAI of slice 1 according to the external identification, and combine the S-NSSAI of slice 1 with AMF1. The identification information will be sent to NSSAAF together.

S705: NSSAAF notifies AMF1 to initiate authorization cancellation for slice 1 to terminal A.

As an implementation manner, the NSSAAF sends a first notification to AMF1 according to the received identification information of AMF1, and the first notification is used to notify AMF1 to initiate the revocation of authorization for slice 1 to terminal A. As an example, the first notification includes: event information, identification information of terminal A, and identification information of slice 1. As an example, in S705, the identification information of slice 1 may be the S-NSSAI of slice 1. Among them, the event information is used to indicate that the slice authorization is revoked. Optionally, the first notification may be Nnssaaf_NSSAA_Notify.

S706: AMF1 revokes the authorization of slice 1 to terminal A.

According to the event information, the identification information of the terminal A, and the identification information of the slice 1, the AMF1 learns that the authorization of the terminal A for the slice 1 needs to be revoked. For AMF1 to revoke the authorization of slice 1 for terminal A, refer to step 5 of section 4.2.9.4 of 3GPP TS 23.502 v16.4.0.

Through S702-S705, the NSSAAF can use the identification information of slice 1 to accurately obtain the identification information of the AMF1 associated with slice 1 serving the terminal A from the UDM. In comparison, if there is only the association relationship between the terminal and AMF on the UDM, and the association relationship between the terminal, AMF, and slice is not stored, NSSAAF may obtain the identification information of AMF2, thereby notifying AMF2 to trigger Revocation of authorization for slice 1 will result in abnormal communication. Therefore, through the solution of the present application, the occurrence of communication abnormalities can be reduced.

Figure 8 shows a method for AAA-s to initiate the authorization revocation of slice 2. For the same terms and concepts in FIG. 8 as those in FIG. 7, reference may be made to the related content in FIG. 7. As shown in Figure 7:

S801: The AAA-s requests the NSSAAF to initiate the authorization cancellation of the slice 2 for the terminal A.

As an implementation manner, the AAA-s sends a first request to the NSSAAF, and the first request is used to request the terminal A to initiate the revocation of the authorization of the slice 2. As an example, the first request includes the identification information of the terminal A and the identification information of the slice 2. Through the identification information of the terminal A and the identification information of the slice 2, it can be known that the authorization of the terminal A is to be revoked for the slice 2. If AAA-p is set between AAA-s and NSSAAF, AAA-s can send the first request to NSSAAF through AAA-p. Among them, the identification information of terminal A and the identification information of slice 2 can refer to related content in FIG. 2 and FIG. 3. For example, in S801, the identification information of terminal A may be the GPSI of terminal A, and the identification information of slice 2 may be the S-NSSAI of slice 2 or the external identification of slice 2.

Exemplarily, the first request may be AAA Protocol Revoke Auth Request.

As an optional alternative to S801, when AAA-s requests to NSSAAF to initiate the revocation of authorization for slice 2 for terminal A, it can learn that slice 2 corresponds to PLMN-1 and PLMN-2 according to the information in Table 2, and determine whether PLMN-1 initiates authorization revocation, or initiates authorization revocation in PLMN-2, or initiates authorization revocation in PLMN-1 and PLMN-2, and further carries the identification information of PLMN-1 and/or PLMN-2 in the request, and NSSAAF passes the PLMN The identification information of -1 and/or PLMN-2 can obtain the identification information of AMF1 and/or AMF2 from UDM, so that S805a and/or S805b can be directly executed. Optionally, AAA-s can determine which PLMN to initiate authorization revocation based on policies or timers.

S802: NSSAAF requests UDM to obtain the AMF associated with slice 2 serving terminal A.

As an implementation manner, NSSAAF sends a second request to UDM, where the second request is used to request to obtain the AMF associated with slice 2 serving terminal A. As an example, the second request includes the identification information of the terminal A and the identification information of the slice 2. Optionally, the request further includes a first indication, and the first indication is used to indicate that the acquired network element type is AMF. Optionally, the request further includes a second indication, and the second indication is used to indicate that the related process is a slice authorization revocation process. Optionally, the second request may be Nudm_UECM_GetReq.

Optionally, if the identification information of slice 2 received by NSSAAF in S801 is the external identification of slice 2, NSSAAF may obtain the S-NSSAI of slice 2 according to the external identification of slice 2, and then combine the S-NSSAI of slice 2 in S802. -NSSAI is sent to UDM. Optionally, if the identification information of slice 2 received by NSSAAF in S801 is the external identification of slice 2, NSSAAF may also send the external identification of slice 2 to UDM.

S803: UDM obtains the AMF associated with slice 2 serving terminal A.

As an implementation manner, UDM can obtain the identification information of AMF1 and the identification information of AMF2 according to the received identification information of terminal A and the identification information of slice 1. That is, the AMFs associated with slice 1 serving terminal A are AMF1 and AMF2. . Optionally, the UDM may learn that the acquired network element type is AMF according to the first instruction. Optionally, the UDM may learn that the related process is the slice authorization revocation process according to the second instruction, so that the UDM can make corresponding processing.

For the slice authorization revocation process, when there are multiple AMFs associated with slices serving the terminal, the UDM needs to notify the NSSAAF of the multiple AMFs.

S804: The UDM sends the identification information of the AMF associated with slice 2 that serves the terminal A to the NSSAAF.

The UDM sends the identification information of AMF1 and the identification information of AMF2 obtained in S803 to the NSSAAF.

As an implementation manner, the UDM sends a response message to the NSSAAF, and the response message includes the identification information of AMF1 and the identification information of AMF2. Optionally, the response message may be Nudm_UECM_GetResp.

Optionally, in S802, when the identification information of slice 2 obtained by UDM from NSSAAF is the external identification of slice 2, UDM may obtain the S-NSSAI of slice 2 according to the external identification, and combine the S-NSSAI of slice 2 with AMF1. The identification information will be sent to NSSAAF together.

For the slice authorization revocation process, when the NSSAAF receives the identification information of multiple AMFs, it needs to notify the multiple AMFs to revoke the authorization.

S805a: NSSAAF notifies AMF1 to initiate authorization cancellation for slice 2 to terminal A.

As an implementation manner, the NSSAAF sends a first notification to AMF1 according to the received identification information of AMF1, and the first notification is used to notify AMF1 to initiate the revocation of authorization for slice 2 to terminal A. As an example, the first notification includes: event information, identification information of terminal A, and identification information of slice 2. As an example, in S705, the identification information of slice 2 may be the S-NSSAI of slice 2. Among them, the event information is used to indicate that the slice authorization is revoked. Optionally, the first notification may be Nnssaaf_NSSAA_Notify.

S805b: NSSAAF notifies AMF2 to initiate authorization cancellation for slice 2 to terminal A.

As an implementation manner, NSSAAF sends a second notification to AMF2 according to the received identification information of AMF2, and the second notification is used to notify AMF2 to initiate the revocation of authorization for slice 2 to terminal A. As an example, the first notification includes: event information, identification information of terminal A, and identification information of slice 2. As an example, in S705, the identification information of slice 2 may be the S-NSSAI of slice 2. Among them, the event information is used to indicate that the slice authorization is revoked. Optionally, the first notification may be Nnssaaf_NSSAA_Notify.

S806a: AMF1 revokes the authorization of slice 2 for terminal A.

According to the event information, the identification information of the terminal A, and the identification information of the slice 2, the AMF1 learns that the authorization of the terminal A for the slice 2 needs to be revoked. For AMF1 to revoke the authorization of terminal A for slice 2, please refer to step 5 of section 4.2.9.4 of 3GPP TS 23.502 v16.4.0.

S806b: AMF2 revokes the authorization of slice 2 for terminal A.

According to the event information, the identification information of the terminal A, and the identification information of the slice 2, the AMF2 learns that the authorization of the terminal A for the slice 2 needs to be revoked. For AMF2 to revoke the authorization of terminal A for slice 2, please refer to step 5 of section 4.2.9.4 of 3GPP TS 23.502 v16.4.0.

Through S802-S805a or S805b, the NSSAAF can accurately obtain the identification information of AMF1 and the identification information of AMF2 associated with the slice 2 serving the terminal A by using the identification information of the slice 2 from the UDM. In comparison, if there is only the association relationship between the terminal and AMF on the UDM, and the association relationship between the terminal, AMF, and slice is not stored, NSSAAF may obtain the registration of terminal A other than AMF1 and AMF2. The identification information of the AMF, so as to notify the wrong AMF to revoke the authorization of slice 2, which will cause communication abnormalities. In addition, if there is only the association relationship between the terminal and the AMF on the UDM, and the association relationship between the terminal, AMF, and slice is not stored, NSSAAF may obtain one of AMF1 and AMF2, and thus does not notify the other AMF revokes the authorization of slice 2, which will cause communication abnormalities. Therefore, through the solution of the present application, the occurrence of communication abnormalities can be reduced.

Fig. 9 shows another method for AAA-s to initiate authorization revocation of slice 2. For the explanation of the same terms and concepts in FIG. 9 as in FIG. 8, reference may be made to the related content in FIG. 8. Compared with FIG. 8 where UDM determines the AMF according to the slice identification information, in FIG. 9 NSSAAF determines the AMF according to the slice identification information. As shown in Figure 9:

S901: The AAA-s requests the NSSAAF to initiate the authorization cancellation of the slice 2 for the terminal A.

See S801 for S901.

As an optional alternative to S901, when AAA-s requests to NSSAAF to initiate the revocation of authorization for slice 2 for terminal A, it can learn that slice 2 corresponds to PLMN-1 and PLMN-2 according to the information in Table 2, and determine whether it is in PLMN-1 and PLMN-2. PLMN-1 initiates authorization revocation, or initiates authorization revocation in PLMN-2, or initiates authorization revocation in PLMN-1 and PLMN-2, and further carries the identification information of PLMN-1 and/or PLMN-2 in the request, and NSSAAF passes the PLMN The identification information of -1 and/or PLMN-2 can obtain the identification information of AMF1 and/or AMF2 from UDM, so that S906a and/or S906b can be directly executed. Optionally, AAA-s can determine which PLMN to initiate authorization revocation based on policies or timers.

S902: The NSSAAF requests the UDM to obtain the AMF serving the terminal A and the slice associated with the AMF serving the terminal A.

As an implementation manner, the NSSAAF sends a second request to the UDM, the second request is used to request to obtain the AMF serving the terminal A and the slice associated with the AMF serving the terminal A. As an example, the second request includes terminal A's identification information. Optionally, the request further includes a first indication, and the first indication is used to indicate that the acquired network element type is AMF. Optionally, the request further includes a second indication, and the second indication is used to indicate that the related process is a slice authorization revocation process. Optionally, the second request may be Nudm_UECM_GetReq.

S903: The UDM obtains the AMF serving the terminal A and the slice associated with the AMF serving the terminal A.

As an implementation manner, UDM can obtain {identification information of AMF1, (identification information of slice 1, identification information of slice 2)} and {identification information of AMF2, (identification of slice 2) according to the received identification information of terminal A. Information, the identification information of slice 3)}, that is, the AMFs serving the terminal A are AMF1 and AMF2, the slices associated with AMF1 are slice 1 and slice 2, and the slices associated with AMF2 are slice 2 and slice 3. Optionally, the UDM may learn that the acquired network element type is AMF according to the first instruction. Optionally, the UDM may learn that the related process is the slice authorization revocation process according to the second instruction, so that the UDM can make corresponding processing. It can be understood that {A, B} indicates that A and B have an association relationship, and (A, B) indicates a set or list, and the set or list includes two elements A and B.

Optionally, the UDM may also obtain the access type corresponding to the AMF serving the terminal. Generally, the access type can be divided into 3GPP access and non-3GPP access. For example, the access type corresponding to AMF1 is 3GPP access, and the access type corresponding to AMF2 is non-3GPP access technology.

S904: The UDM sends the identification information of the AMF serving the terminal A and the identification information of the slice associated with the AMF serving the terminal A to the NSSAAF.

S905: NSSAAF determines the AMF associated with slice 2.

Based on the information received in S904, the NSSAAF can learn that the AMFs associated with slice 2 serving the terminal A are AMF1 and AMF2.

For slice revoking authorization, if there are multiple AMFs associated with the slice serving the terminal, the NSSAAF needs to notify the multiple AMFs to revoke the authorization for the slice. Therefore, NSSAAF notifies AMF1 and AMF2 to initiate slice cancellation of slice 2 to terminal A.

S906a: NSSAAF notifies AMF1 to initiate authorization cancellation for slice 2 to terminal A.

S906a can refer to S805a.

S906b: NSSAAF notifies AMF2 to initiate authorization cancellation for slice 2 to terminal A.

S906b can refer to S805b.

S907a: The AMF1 revokes the authorization of the slice 2 to the terminal A.

S907a can refer to S806a.

S907b: The AMF2 revokes the authorization of the slice 2 to the terminal A.

S907b can refer to S806b.

Through S902-S906a and S906b, the NSSAAF can accurately obtain the identification information of AMF1 and the identification information of AMF2 associated with the slice 2 serving the terminal A by using the identification information of the slice 2. In comparison, if there is only the association relationship between the terminal and AMF on the UDM, and the association relationship between the terminal, AMF, and slice is not stored, NSSAAF may obtain the registration of terminal A other than AMF1 and AMF2. The identification information of the AMF, so as to notify the wrong AMF to revoke the authorization of slice 2, which will cause communication abnormalities. In addition, if there is only the association relationship between the terminal and the AMF on the UDM, and the association relationship between the terminal, AMF, and slice is not stored, NSSAAF may obtain one of AMF1 and AMF2, and thus does not notify the other AMF revokes the authorization of slice 2, which will cause communication abnormalities. Therefore, through the solution of the present application, the occurrence of communication abnormalities can be reduced.

Figure 10 shows a method for slice authentication and authorization management. In the scenario of FIG. 1, this method introduces the solution of the present application in combination with the method of FIG. 2 to FIG. 9. As shown in Figure 10:

S1001: Terminal A authenticates and authorizes the slice in PLMN-1.

S1001 executes the method shown in FIG. 2.

S1002: Terminal A authenticates and authorizes the slice in PLMN-2.

S1002 executes the method shown in FIG. 3.

Through S1001 and S1002, terminal A authenticates and authorizes slices in PLMN-1 and PLMN-2, respectively. The AMF associated with slice 1 that serves terminal A is AMF1, the AMFs associated with slice 2 that serves terminal A are AMF1 and AMF2, and the AMF that serves terminal A and associated with slice 3 is AMF2.

In the case that AAA-s initiates a slice re-authentication and re-authorization process as needed, S1003 can be executed. In the case that the AAA-s initiates the slice authorization revocation process as needed, S1004 can be executed.

S1003: The slice re-authentication and re-authorization process.

S1003 executes the method shown in FIG. 4, FIG. 5, or FIG. 6.

S1004: The slice authorization revocation process.

S1004: Perform the method shown in FIG. 7, FIG. 8, or FIG. 9.

Through the method of FIG. 10, it is possible to accurately obtain the AMF associated with the slice serving the terminal, thereby ensuring the correct execution of the slice re-authentication and re-authorization process and the slice authorization revocation process, and avoiding communication errors.

It should be noted that the solution provided by the embodiment of the present application can also be applied to a scenario where the terminal is only registered to one AMF. That is, the same scheme can be used in a scenario where one AMF is registered and a scenario where multiple AMFs are registered. The scheme is implemented under the same scheme framework, which reduces the complexity of implementation.

In the foregoing embodiment, optionally, the NSSAAF may obtain the connection state information between the terminal and the AMF from the AMF. Optionally, the NSSAAF can obtain the access type corresponding to the AMF from the AMF.

In the foregoing embodiment, the function of NSSAAF can also be implemented by AUSF, that is, NSSAAF in the foregoing embodiment can be replaced with AUSF.

In order to implement the above-mentioned technical solutions in FIG. 2 to FIG. 10, an embodiment of the present application provides a schematic structural diagram of a network element. Referring to FIG. 11, the network element 1100 shown in FIG. 11 includes a processing unit 1101 and a communication unit 1102. Among them, the processing unit 1101 is mainly used for processing, and the communication unit 1102 is mainly used for communicating with other network elements.

In one design, the network element 1100 is an authentication and authorization network element, which is used to implement the functions of the NSSAAF as shown in Figs. 2-10.

As an example of this design, the processing unit 1101 and the communication unit 1102 are used to implement the following method: obtain a trigger network element that serves the terminal device and is associated with the first slice, and notify the trigger network element to perform the operation on the terminal device. The slice authentication and authorization processing of the first slice; where the slice authentication and authorization processing includes: slice re-authentication and re-authorization, or slice authorization revoking.

Optionally, the authentication and authorization network element acquiring the triggering network element associated with the first slice serving the terminal device includes: the authentication and authorization network element acquiring the association with the terminal device and the first slice from the information storage network element The first triggering network element; the authentication and authorization network element notifying the triggering network element to perform the first slice authentication and authorization operation on the terminal device, including: the authentication and authorization network element notifying the first triggering network element to the terminal The device performs the slice authentication and authorization processing of the first slice.

Optionally, the authentication and authorization network element acquiring the first trigger network element associated with the terminal device and the first slice from the information storage network element includes: the authentication and authorization network element sends a first request to the information storage network element , The first request includes the first identification information of the terminal device and the first identification information of the first slice, the first request is used to obtain the first triggering network element; the authentication and authorization network element obtains the information from the information storage network The element receives a first response, the first response including the first identification information of the first triggering network element.

Optionally, the authentication and authorization network element acquiring a triggering network element associated with the first slice serving the terminal device includes: the authentication and authorization network element acquiring a plurality of trigger network elements associated with the first slice serving the terminal device A first triggering network element; the authentication and authorization network element notifying the triggering network element to perform the slice authentication and authorization operation of the first slice on the terminal device includes: the authentication and authorization network element notifying the plurality of first triggering network elements to The terminal device performs the slice authentication and authorization processing of the first slice.

Optionally, the authentication and authorization network element acquiring a plurality of first triggering network elements associated with the first slice serving the terminal device includes: the authentication and authorization network element acquiring information from the information storage network element and the terminal device and Multiple first triggering network elements associated with the first slice.

Optionally, the authentication and authorization network element acquiring multiple first trigger network elements associated with the terminal device and the first slice from the information storage network element includes: the authentication and authorization network element sends the first trigger network element to the information storage network element A request, the first request including the first identification information of the terminal device and the first identification information of the first slice, the first request is used to obtain the first triggering network element; the authentication and authorization network element obtains the information from the information The storage network element receives a first response, and the first response includes identification information of the plurality of first triggering network elements.

Optionally, the authentication and authorization network element acquiring a plurality of first triggering network elements associated with the first slice serving the terminal device includes: the authentication and authorization network element acquiring from an information storage network element that is associated with the terminal device The plurality of second triggering network elements and the slices associated with the plurality of second triggering network elements; the authentication and authorization network element obtains data from the plurality of second triggering network elements according to the first slice and the slices associated with the plurality of second triggering network elements The multiple first triggering network elements are determined among the triggering network elements.

Optionally, the authentication and authorization network element obtains from the information storage network element multiple second trigger network elements associated with the terminal device and slices associated with the multiple second trigger network elements, including: The information storage network element sends a first request, the first request includes first identification information of the terminal device, and the first request is used to obtain the second triggering network element and a slice associated with the second triggering network element; the The authentication and authorization network element receives a first response from the information storage network element, where the first response includes identification information of the plurality of second triggering network elements and identification information of slices associated with the plurality of second triggering network elements.

Optionally, the slice authentication and authorization process is the slice re-authentication and re-authorization; the authentication and authorization network element obtaining the trigger network element associated with the first slice serving the terminal device includes: the authentication and authorization network element obtaining the service A plurality of first triggering network elements of the terminal device associated with the first slice; the authentication and authorization network element determines a second triggering network element from the plurality of first triggering network elements; the authentication and authorization network element notifies the trigger The network element performing slice authentication and authorization processing of the first slice on the terminal device includes: the authentication and authorization network element notifies the second triggering network element to perform slice re-authentication and reauthorization of the first slice on the terminal device. Through this embodiment, when multiple triggering network elements are associated with a slice, one network element can be selected for the terminal to perform slice re-authentication and re-authorization, which avoids repeated re-authentication and re-authorization and saves signaling.

Optionally, the authentication and authorization network element determining the second triggering network element from the plurality of first triggering network elements includes: the authentication and authorization network element determines from the connection status of the terminal device and the plurality of first triggering network elements from The second triggering network element is determined among the plurality of first triggering network elements; wherein, the connection state includes a connected state or an idle state. By selecting the triggering network element through the connection state, it is possible to select a more suitable triggering network element for slice authentication and authorization processing.

Optionally, the authentication and authorization network element determines the second triggering network element from the plurality of first triggering network elements according to the connection state of the terminal device and the plurality of first triggering network elements, including: the authentication and authorization network element The second triggering network element is determined from the plurality of first triggering network elements, and the connection state between the terminal device and the second triggering network element is the connection state.

Optionally, the authentication and authorization network element determines the second triggering network element from the plurality of first triggering network elements according to the connection state between the terminal device and the plurality of first triggering network elements, including: When the connection state of each first triggering network element of the plurality of first triggering network elements is the idle state, the authentication and authorization network element selects the connection state from the plurality of first triggering network elements according to the access type corresponding to the plurality of first triggering network elements. The second triggering network element is determined in a triggering network element; wherein, the access type includes 3GPP access and non-3GPP access. When selecting a triggering network element, further considering the access type, it is possible to select a triggering network element that is more suitable for slice authentication and authorization processing.

Optionally, the authentication and authorization network element determining the second triggering network element from the plurality of first triggering network elements according to the access types corresponding to the plurality of first triggering network elements includes: The second triggering network element is determined among a plurality of first triggering network elements, and the access type corresponding to the second triggering network element is the 3GPP access.

Optionally, the authentication and authorization network element determining the second triggering network element from the plurality of first triggering network elements includes: the authentication and authorization network element determines the second triggering network element from the plurality of first triggering network elements according to the access type corresponding to the plurality of first triggering network elements The second triggering network element is determined among the first triggering network elements; wherein, the access type includes 3GPP access and non-3GPP access.

Optionally, the method further includes: the authentication and authorization network element obtains the connection status of the plurality of first triggering network elements from the information storage network element; or, the authentication and authorization network element obtains from the plurality of first triggering network elements The connection status of the multiple first trigger network elements.

Optionally, the method further includes: the authentication and authorization network element obtains the access type corresponding to the plurality of first triggering network elements from the information storage network element; or, the authentication and authorization network element obtains from the plurality of first triggering network elements The element obtains the access types corresponding to the plurality of first triggering network elements.

Optionally, the first request further includes: a first indication, which is used to indicate that the network element type is AMF; or, a second indication, which is used to indicate the slice authentication authorization processing.

Optionally, the method further includes: the authentication and authorization network element receives a second request, the second request including second identification information of the terminal device and second identification information of the first slice, and the second request is used for Requesting the terminal device to initiate the slice authentication and authorization processing for the first slice.

Optionally, the authentication and authorization network element is NSSAAF, and the triggering network element is AMF.

Optionally, the information storage network element is UDM.

In another design, the network element 1100 is an information storage network element, which is used to implement the UDM function as shown in Figs. 2-10.

As an example of this design, the processing unit 1101 and the communication unit 1102 are used to implement the following methods:

The information storage network element obtains slice authentication and authorization information, and the slice authentication and authorization information is used to indicate the terminal device, the trigger network element associated with the terminal device, and the slice associated with the terminal device and the trigger network element, the trigger network The element is a triggering network element serving the terminal device, and the slice is a slice for which the terminal device is successfully authenticated and authorized on the triggering network element; the information storage network element receives the first request from the authentication and authorization network element, the first request Used to request to obtain the first triggering network element associated with the terminal device and the first slice; the information storage network element determines the first triggering network element according to the slice authentication and authorization information and the first request; the The information storage network element sends a first response to the authentication and authorization network element, where the first response includes the identification information of the first triggering network element.

Optionally, the information storage network element determines the first triggering network element according to the slice authentication and authorization information and the first request, including: the information storage network element determines according to the slice authentication and authorization information and the first request A plurality of second triggering network elements associated with the terminal device and the first slice; the information storage network element sends a first response to the authentication and authorization network element, the first response including the identification of the first triggering network element The information includes: the information storage network element sends the first response to the authentication and authorization network element, and the first response includes identification information of the plurality of second triggering network elements.

Optionally, the first request further includes a first instruction for instructing the revocation of the slice authorization; the information storage network element determines, according to the slice authentication and authorization information and the first request, the communication between the terminal device and the first request. The multiple second trigger network elements associated with a slice include: the information storage network element determines the multiple second trigger network elements according to the slice authentication and authorization information, the first request, and the first instruction.

Optionally, the information storage network element determines the first triggering network element according to the slice authentication and authorization information and the first request, including: the information storage network element determines according to the slice authentication and authorization information and the first request The third triggering network element of the plurality of second triggering network elements associated with the terminal device and the first slice; the information storage network element sends a first response to the authentication and authorization network element, and the first response includes the The identification information of the first triggering network element includes: the information storage network element sends the first response to the authentication and authorization network element, and the first response includes the identification information of the third triggering network element.

Optionally, the information storage network element determines a third trigger network element among a plurality of second trigger network elements associated with the terminal device and the first slice according to the slice authentication and authorization information and the first request, Including: the information storage network element determines the plurality of second trigger network elements according to the slice authentication and authorization information and the first request; the information storage network element determines the plurality of second trigger network elements according to the connection status of the terminal device and the plurality of second trigger network elements The third triggering network element is determined from the plurality of second triggering network elements; wherein, the connection state includes a connected state or an idle state.

Optionally, the information storage network element determines the third trigger network element from the plurality of second trigger network elements according to the connection state between the terminal device and the plurality of second trigger network elements, including: the information storage network element The third triggering network element is determined from the plurality of second triggering network elements, and the connection state between the terminal device and the third triggering network element is the connection state.

Optionally, the information storage network element determines the third trigger network element from the plurality of second trigger network elements according to the connection state of the terminal device and the plurality of second trigger network elements, including: When the connection state of each second triggering network element of the plurality of second triggering network elements is the idle state, the information storage network element selects the connection state from the plurality of second triggering network elements according to the access type corresponding to the plurality of second triggering network elements. The third triggering network element is determined from the second triggering network element; wherein, the access type includes 3GPP access and non-3GPP access.

Optionally, the information storage network element determines the third trigger network element from the plurality of second trigger network elements according to the access types corresponding to the plurality of second trigger network elements, including: the information storage network element obtains information from the The third triggering network element is determined among the plurality of second triggering network elements, and the access type corresponding to the third triggering network element is the 3GPP access.

Optionally, the information storage network element determines a third trigger network element among a plurality of second trigger network elements associated with the terminal device and the first slice according to the slice authentication and authorization information and the first request, The method includes: the information storage network element determines the plurality of second trigger network elements according to the slice authentication and authorization information and the first request; the information storage network element obtains data from the The third triggering network element is determined among a plurality of second triggering network elements; wherein, the access type includes 3GPP access and non-3GPP access.

Optionally, the first request further includes a second indication, and the second indication is used to indicate that the network element type is AMF.

As another design, the network element 1100 is a triggering network element, which is used to implement the functions of AMF1 or AMF2 as shown in Figs. 2-10.

The trigger network element sends slice authentication and authorization information to the information storage network element, where the slice authentication and authorization information is used to indicate the terminal device, the trigger network element associated with the terminal device, and the slice associated with the terminal device and the trigger network element , The triggering network element is a triggering network element serving the terminal device, and the slice is a slice for which the terminal device is successfully authenticated and authorized on the triggering network element; the triggering network element receives a notification from the authentication and authorization network element, and the notification is used Informing the terminal device to perform the slice authentication and authorization processing of the slice; wherein the slice authentication and authorization processing includes: slice re-authentication and re-authorization, or slice authorization revoking.

Optionally, the method further includes: the triggering network element initiates slice authentication and authorization processing of the slice for the terminal device.

Referring to FIG. 12, an embodiment of the present application provides a schematic structural diagram of another network element. The network element 1200 shown in FIG. 12 includes at least one processor 1201, a memory 1202, and optionally, a communication interface 1203.

The memory 1202 may be a volatile memory, such as random access memory; the memory may also be a non-volatile memory, such as read-only memory, flash memory, hard disk drive (HDD) or solid-state drive (solid-state drive, SSD) or the memory 1202 is any other medium that can be used to carry or store desired program codes in the form of instructions or data structures and that can be accessed by a computer, but is not limited thereto. The memory 1202 may be a combination of the above-mentioned memories.

The specific connection medium between the foregoing processor 1201 and the memory 1202 is not limited in the embodiment of the present application. In the embodiment of the present application, the memory 1202 and the processor 1201 are connected by a bus 1204 in the figure. The bus 1204 is represented by a thick line in the figure. Is limited. The bus 1204 can be divided into an address bus, a data bus, a control bus, and the like. For ease of presentation, only one thick line is used in FIG. 12 to represent it, but it does not mean that there is only one bus or one type of bus.

The processor 1201 may have a data transceiver function and can communicate with other devices. In the device shown in Figure 12, an independent data transceiver module, such as a communication interface 1203, may be used to send and receive data; the processor 1201 is communicating with other devices. During communication, data transmission can be performed through the communication interface 1203.

In one design, the network element 1200 is an authentication and authorization network element, and the processor 1201 can call instructions in the memory 1202 to implement the functions of the NSSAAF in Figures 2-10 and the authentication and authorization network element with the structure shown in Figure 11. Function.

In another design, the network element 1200 is an information storage network element, and the processor 1201 can call instructions in the memory 1202 to implement the functions of the UDM in Figure 2-10 and the information storage network structure shown in Figure 11. Meta function.

In another design, the network element 1200 is a trigger network element, and the processor 1201 can call instructions in the memory 1202 to realize the functions of AMF1 or AMF2 in Figure 2-10, and the trigger network structure shown in Figure 11 Meta function.

Through the above-mentioned device provided in this application, it is possible to accurately obtain the AMF associated with the slice serving the terminal, thereby ensuring the correct execution of the slice re-authentication and re-authorization process and the slice authorization revocation process, and avoiding communication errors.

An embodiment of the present application also provides a communication system, which may include some or all of the authentication and authorization network elements, the information storage network elements, and the trigger network elements in FIG. 2 to FIG. 11.

It is understandable that some optional features in the embodiments of the present application, in some scenarios, may not depend on other features, such as the solutions they are currently based on, but can be implemented independently to solve the corresponding technical problems and achieve the corresponding The effect can also be combined with other features according to requirements in some scenarios. Correspondingly, the devices given in the embodiments of the present application can also implement these features or functions accordingly, which will not be repeated here.

Those skilled in the art can also understand that the various illustrative logical blocks and steps listed in the embodiments of the present application can be implemented by electronic hardware, computer software, or a combination of the two. Whether such a function is implemented by hardware or software depends on the specific application and the design requirements of the entire system. For corresponding applications, those skilled in the art can use various methods to implement the described functions, but such implementation should not be construed as going beyond the protection scope of the embodiments of the present application.

The solution described in this application can be implemented in various ways. For example, these technologies can be implemented in hardware, software, or a combination of hardware. For hardware implementation, the processing unit used to execute these technologies at a communication device (for example, a base station, a terminal, a network entity, a core network network element, or a chip) can be implemented in one or more general-purpose processors, digital signal processors ( digital signal processor, DSP), digital signal processing device, application specific integrated circuit (ASIC), programmable logic device, field programmable gate array (FPGA), or other programmable logic device, Discrete gate or transistor logic, discrete hardware components, or any combination of the above. The general-purpose processor may be a microprocessor. Alternatively, the general-purpose processor may also be any traditional processor, controller, microcontroller, or state machine. The processor can also be implemented by a combination of computing devices, such as a digital signal processor and a microprocessor, multiple microprocessors, one or more microprocessors combined with a digital signal processor core, or any other similar configuration. accomplish.

It can be understood that the memory in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory. Among them, the non-volatile memory can be read-only memory (ROM), programmable read-only memory (programmable ROM, PROM), erasable programmable read-only memory (erasable PROM, EPROM), and electrically available Erase programmable read-only memory (electrically EPROM, EEPROM) or flash memory. The volatile memory may be random access memory (RAM), which is used as an external cache. By way of exemplary but not restrictive description, many forms of RAM are available, such as static random access memory (static RAM, SRAM), dynamic random access memory (dynamic RAM, DRAM), and synchronous dynamic random access memory (synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (double data rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous connection dynamic random access memory (synchlink DRAM, SLDRAM) ) And direct memory bus random access memory (direct rambus RAM, DR RAM). It should be noted that the memories of the systems and methods described herein are intended to include, but are not limited to, these and any other suitable types of memories.

The present application also provides a computer-readable medium on which a computer program is stored, and when the computer program is executed by a computer, the function of any of the foregoing method embodiments is realized.

This application also provides a computer program product, which, when executed by a computer, realizes the functions of any of the foregoing method embodiments.

In the above embodiments, it may be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented by software, it can be implemented in the form of a computer program product in whole or in part. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on the computer, the processes or functions described in the embodiments of the present application are generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website, computer, server, or data center. Transmission to another website, computer, server, or data center via wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.). The computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or a data center integrated with one or more available media. The usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, and a magnetic tape), an optical medium (for example, a high-density digital video disc (digital video disc, DVD)), or a semiconductor medium (for example, a solid state disk, SSD)) etc.

It can be understood that the “embodiment” mentioned throughout the specification means that a specific feature, structure, or characteristic related to the embodiment is included in at least one embodiment of the present application. Therefore, the various embodiments throughout the specification do not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. It can be understood that, in the various embodiments of the present application, the size of the sequence number of the above-mentioned processes does not imply the order of execution, and the execution order of each process should be determined by its function and internal logic, and should not correspond to the embodiments of the present application. The implementation process constitutes any limitation.

It can be understood that in this application, "when", "if" and "if" all mean that the device will make corresponding processing under certain objective circumstances. It is not a time limit, and it does not require the device to be implemented. There must be a judgmental action, and it does not mean that there are other restrictions.

The "simultaneous" in this application can be understood as being at the same time point, within a period of time, or within the same period.

The use of the singular element in this application is intended to mean "one or more" rather than "one and only one", unless otherwise specified. In this application, unless otherwise specified, "at least one" is intended to mean "one or more", and "multiple" is intended to mean "two or more".

In addition, the terms "system" and "network" in this article are often used interchangeably in this article. The term "and/or" in this article is only an association relationship describing the associated objects, which means that there can be three relationships, for example, A and/or B, which can mean: A alone exists, A and B exist at the same time, exist alone In the three cases of B, A can be singular or plural, and B can be singular or plural.

It can be understood that in the embodiments of the present application, "B corresponding to A" means that B is associated with A, and B can be determined according to A. However, it should also be understood that determining B based on A does not mean that B is determined only based on A, and B can also be determined based on A and/or other information.

The corresponding relationships shown in the tables in this application can be configured or pre-defined. The value of the information in each table is only an example, and can be configured to other values, which is not limited in this application. When configuring the correspondence between the information and the parameters, it is not necessarily required to configure all the correspondences indicated in the tables. For example, in the table in this application, the corresponding relationship shown in some rows may not be configured. For another example, appropriate deformation adjustments can be made based on the above table, such as splitting, merging, and so on. The names of the parameters shown in the titles in the above tables may also be other names that can be understood by the communication device, and the values or expressions of the parameters may also be other values or expressions that can be understood by the communication device. When the above tables are implemented, other data structures can also be used, such as arrays, queues, containers, stacks, linear tables, pointers, linked lists, trees, graphs, structures, classes, heaps, hash tables, or hash tables. Wait.

The pre-definition in this application can be understood as definition, pre-definition, storage, pre-storage, pre-negotiation, pre-configuration, curing, or pre-fired.

A person of ordinary skill in the art can understand that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be implemented by electronic hardware or a combination of computer software and electronic hardware. Whether these functions are executed by hardware or software depends on the specific application and design constraint conditions of the technical solution. Professionals and technicians can use different methods for each specific application to implement the described functions, but such implementation should not be considered beyond the scope of this application.

Those of ordinary skill in the art can understand that, for the convenience and conciseness of the description, the specific working process of the system, device, and unit described above can refer to the corresponding process in the foregoing method embodiment, and will not be repeated here.

It can be understood that the systems, devices, and methods described in this application can also be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components may be combined or It can be integrated into another system, or some features can be ignored or not implemented. In addition, the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.

In addition, the functional units in the various embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.

If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on this understanding, the technical solution of the present application essentially or the part that contributes to the existing technology or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disks or optical disks and other media that can store program codes. .

The same or similar parts in the various embodiments of this application may be referred to each other. In each embodiment of this application, and each implementation method/implementation method/implementation method in each embodiment, if there is no special description and logical conflict, between different embodiments and each implementation manner/implementation method in each embodiment/ The terms and/or descriptions between the implementation methods/implementation methods are consistent and can be cited each other. The technical features in different embodiments and various implementation modes/implementation methods/implementation methods in each embodiment are based on their inherent The logical relationship can be combined to form a new embodiment, implementation, implementation method, or implementation method. The implementation manners of the application described above do not constitute a limitation on the protection scope of the application.

The above are only specific implementations of this application, but the protection scope of this application is not limited to this. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed in this application. Should be covered within the scope of protection of this application.

Claims

A method for slice authentication and authorization management, which is characterized in that it comprises:

The authentication and authorization network element obtains the trigger network element associated with the first slice serving the terminal device;

The authentication and authorization network element notifies the triggering network element to perform the slice authentication and authorization processing of the first slice on the terminal device; wherein the slice authentication and authorization processing is: slice re-authentication and re-authorization, or slice authorization Revoke.
The method of claim 1, wherein:

The acquiring, by the authentication and authorization network element, the trigger network element associated with the first slice serving the terminal device includes:

Acquiring, by the authentication and authorization network element, a first triggering network element associated with the terminal device and the first slice from an information storage network element;

The authentication and authorization network element notifying the triggering network element to perform the slice authentication and authorization operation of the first slice on the terminal device includes:

The authentication and authorization network element notifies the first triggering network element to perform the slice authentication and authorization processing of the first slice on the terminal device.
The method according to claim 2, wherein the authentication and authorization network element acquiring the first triggering network element associated with the terminal device and the first slice from an information storage network element comprises:

The authentication and authorization network element sends a first request to the information storage network element. The first request includes the first identification information of the terminal device and the first identification information of the first slice. The request is used to obtain the first trigger network element;

The authentication and authorization network element receives a first response from the information storage network element, where the first response includes the first identification information of the first triggering network element.
The method of claim 1, wherein:

The acquiring, by the authentication and authorization network element, the trigger network element associated with the first slice serving the terminal device includes:

Acquiring, by the authentication and authorization network element, a plurality of first triggering network elements associated with the first slice serving the terminal device;

The authentication and authorization network element notifying the triggering network element to perform the slice authentication and authorization operation of the first slice on the terminal device includes:

The authentication and authorization network element notifies the plurality of first triggering network elements to perform the slice authentication and authorization processing of the first slice on the terminal device.
The method according to claim 4, wherein the acquiring, by the authentication and authorization network element, a plurality of first triggering network elements associated with the first slice serving the terminal device comprises:

The authentication and authorization network element acquires a plurality of first trigger network elements associated with the terminal device and the first slice from an information storage network element.
The method according to claim 5, wherein the authentication and authorization network element acquiring a plurality of first triggering network elements associated with the terminal device and the first slice from an information storage network element comprises:

The authentication and authorization network element sends a first request to the information storage network element. The first request includes the first identification information of the terminal device and the first identification information of the first slice. The request is used to obtain the first trigger network element;

The authentication and authorization network element receives a first response from the information storage network element, where the first response includes identification information of the plurality of first triggering network elements.
The method according to claim 4, wherein the acquiring, by the authentication and authorization network element, a plurality of first triggering network elements associated with the first slice serving the terminal device comprises:

Acquiring, by the authentication and authorization network element, multiple second trigger network elements associated with the terminal device and slices associated with the multiple second trigger network elements from an information storage network element;

The authentication and authorization network element determines the multiple first trigger network elements from the multiple second trigger network elements according to the first slice and the slices associated with the multiple second trigger network elements.
The method according to claim 7, wherein the authentication and authorization network element obtains from an information storage network element a plurality of second trigger network elements associated with the terminal device and a plurality of second trigger network elements associated with the plurality of second trigger network elements. Slices, including:

The authentication and authorization network element sends a first request to the information storage network element, the first request includes the first identification information of the terminal device, the first request is used to obtain the second triggering network element, and A slice associated with the second triggering network element;

The authentication and authorization network element receives a first response from the information storage network element, where the first response includes identification information of the plurality of second triggering network elements and information associated with the plurality of second triggering network elements The identification information of the slice.
The method according to claim 1, wherein the slice authentication and authorization process is the slice re-authentication and re-authorization;

The acquiring, by the authentication and authorization network element, the trigger network element associated with the first slice serving the terminal device includes:

Acquiring, by the authentication and authorization network element, a plurality of first triggering network elements associated with the first slice serving the terminal device;

Determining, by the authentication and authorization network element, a second triggering network element from the plurality of first triggering network elements;

The authentication and authorization network element notifying the triggering network element to perform the slice authentication and authorization processing of the first slice on the terminal device includes:

The authentication and authorization network element notifies the second triggering network element to perform slice re-authentication and re-authorization of the first slice on the terminal device.
The method according to claim 9, wherein the acquiring, by the authentication and authorization network element, a plurality of first triggering network elements associated with the first slice serving the terminal device comprises:

The authentication and authorization network element acquires a plurality of first trigger network elements associated with the terminal device and the first slice from an information storage network element.
The method according to claim 10, wherein the authentication and authorization network element acquiring a plurality of first triggering network elements associated with the terminal device and the first slice from an information storage network element comprises:

The authentication and authorization network element sends a first request to the information storage network element. The first request includes the first identification information of the terminal device and the first identification information of the first slice. The request is used to obtain the first trigger network element;

The authentication and authorization network element receives a first response from the information storage network element, where the first response includes identification information of the plurality of first triggering network elements.
The method according to claim 9, wherein the acquiring, by the authentication and authorization network element, a plurality of first triggering network elements associated with the first slice serving the terminal device comprises:

Acquiring, by the authentication and authorization network element, multiple second trigger network elements associated with the terminal device and slices associated with the multiple second trigger network elements from an information storage network element;

The authentication and authorization network element determines the multiple first trigger network elements from the multiple second trigger network elements according to the first slice and the slices associated with the multiple second trigger network elements.
The method according to claim 12, wherein the authentication and authorization network element obtains a plurality of second trigger network elements associated with the terminal device and a plurality of second trigger network elements associated with the plurality of second trigger network elements from an information storage network element. Slices, including:

The authentication and authorization network element sends a first request to the information storage network element, the first request includes the first identification information of the terminal device, the first request is used to obtain the second triggering network element, and A slice associated with the second triggering network element;

The authentication and authorization network element receives a first response from the information storage network element, where the first response includes identification information of the plurality of second triggering network elements and information associated with the plurality of second triggering network elements The identification information of the slice.
The method according to any one of claims 9-13, wherein the authentication and authorization network element determining the second triggering network element from the plurality of first triggering network elements comprises:

The authentication and authorization network element determines the second trigger network element from the plurality of first trigger network elements according to the connection status between the terminal device and the plurality of first trigger network elements; wherein, the connection status Including connected state or idle state.
The method according to claim 14, wherein the authentication and authorization network element determines the first trigger network element from the plurality of first trigger network elements according to the connection status of the terminal device and the plurality of first trigger network elements Two trigger network elements, including:

The authentication and authorization network element determines the second trigger network element from the plurality of first trigger network elements, and the connection state between the terminal device and the second trigger network element is the connection state.
The method according to claim 14, wherein the authentication and authorization network element determines the first trigger network element from the plurality of first trigger network elements according to the connection status of the terminal device and the plurality of first trigger network elements Two trigger network elements, including:

When the connection state between the terminal device and each first triggering network element of the plurality of first triggering network elements is the idle state, the authentication and authorization network element is based on the plurality of first triggering network elements The corresponding access type determines the second triggering network element from the plurality of first triggering network elements; wherein, the access type includes 3GPP access and non-3GPP access.
The method according to claim 16, wherein the authentication and authorization network element determines the second trigger network element from the plurality of first trigger network elements according to the access type corresponding to the plurality of first trigger network elements Yuan, including:

The authentication and authorization network element determines the second triggering network element from the plurality of first triggering network elements, and the access type corresponding to the second triggering network element is the 3GPP access.
The method according to any one of claims 9-13, wherein the authentication and authorization network element determining the second triggering network element from the plurality of first triggering network elements comprises:

The authentication and authorization network element determines the second triggering network element from the plurality of first triggering network elements according to the access types corresponding to the plurality of first triggering network elements; wherein, the access type includes 3GPP Access and non-3GPP access.
The method according to claim 18, wherein the authentication and authorization network element determines the second trigger network element from the plurality of first trigger network elements according to the access type corresponding to the plurality of first trigger network elements Yuan, including:

The authentication and authorization network element determines the second triggering network element from the plurality of first triggering network elements, and the access type corresponding to the second triggering network element is the 3GPP access.
The method according to any one of claims 14-16, wherein the method further comprises:

The authentication and authorization network element obtains the connection status of the plurality of first triggering network elements from the information storage network element; or,

The authentication and authorization network element obtains the connection status of the plurality of first triggering network elements from the plurality of first triggering network elements.
The method according to any one of claims 16-19, wherein the method further comprises:

The authentication and authorization network element obtains the access types corresponding to the plurality of first triggering network elements from the information storage network element; or,

The authentication and authorization network element obtains the access types corresponding to the plurality of first triggering network elements from the plurality of first triggering network elements.
The method according to any one of claims 3, 6, 11, and 13, wherein the first request further comprises:

The first indication, the first indication is used to indicate that the network element type is AMF; or,

A second instruction, where the second instruction is used to instruct the slice authentication and authorization processing.
The method according to any one of claims 1-20, wherein the method further comprises:

The authentication and authorization network element receives a second request, the second request includes the second identification information of the terminal device and the second identification information of the first slice, and the second request is used to request the The terminal device initiates the slice authentication and authorization processing for the first slice.
The method according to any one of claims 1-23, wherein the authentication and authorization network element is NSSAAF, and the triggering network element is AMF.
The method according to any one of claims 2-3, 5-8, and 10-13, wherein the information storage network element is UDM.
A method for slice authentication and authorization management, which is characterized in that it comprises:

The information storage network element obtains slice authentication and authorization information, where the slice authentication and authorization information is used to indicate a terminal device, a trigger network element associated with the terminal device, and a slice associated with the terminal device and the trigger network element , The triggering network element is a triggering network element serving the terminal device, and the slice is a slice for which the terminal device is successfully authenticated and authorized on the triggering network element;

The information storage network element receives a first request from an authentication and authorization network element, where the first request is used to request to obtain a first trigger network element associated with the terminal device and the first slice;

Determining, by the information storage network element, the first triggering network element according to the slice authentication and authorization information and the first request;

The information storage network element sends a first response to the authentication and authorization network element, where the first response includes the identification information of the first triggering network element.
The method of claim 26, wherein:

The information storage network element determining the first triggering network element according to the slice authentication and authorization information and the first request includes:

Determining, by the information storage network element, a plurality of second triggering network elements associated with the terminal device and the first slice according to the slice authentication and authorization information and the first request;

The information storage network element sends a first response to the authentication and authorization network element, where the first response includes identification information of the first triggering network element, including:

The information storage network element sends the first response to the authentication and authorization network element, where the first response includes identification information of the plurality of second triggering network elements.
The method according to claim 27, wherein the first request further comprises a first instruction, and the first instruction is used to instruct the revocation of the slice authorization;

The information storage network element determining a plurality of second triggering network elements associated with the terminal device and the first slice according to the slice authentication and authorization information and the first request includes:

The information storage network element determines the plurality of second triggering network elements according to the slice authentication and authorization information, the first request, and the first instruction.
The method according to claim 26, wherein the information storage network element determining the first triggering network element according to the slice authentication and authorization information and the first request comprises:

The information storage network element determines, according to the slice authentication and authorization information and the first request, a third trigger network element among a plurality of second trigger network elements associated with the terminal device and the first slice ；

The information storage network element sends a first response to the authentication and authorization network element, where the first response includes identification information of the first triggering network element, including:

The information storage network element sends the first response to the authentication and authorization network element, where the first response includes the identification information of the third triggering network element.
The method according to claim 29, wherein the information storage network element determines a plurality of first slices associated with the terminal device and the first slice according to the slice authentication and authorization information and the first request. The third trigger network element in the second trigger network element includes:

Determining, by the information storage network element, the plurality of second triggering network elements according to the slice authentication and authorization information and the first request;

The information storage network element determines the third trigger network element from the plurality of second trigger network elements according to the connection status between the terminal device and the plurality of second trigger network elements; wherein, the connection status Including connected state or idle state.
The method according to claim 30, wherein the information storage network element determines the second trigger network element from the plurality of second trigger network elements according to the connection state of the terminal device and the plurality of second trigger network elements Three trigger network elements, including:

The information storage network element determines the third trigger network element from the plurality of second trigger network elements, and the connection state between the terminal device and the third trigger network element is the connection state.
The method according to claim 30, wherein the information storage network element determines the second trigger network element from the plurality of second trigger network elements according to the connection state of the terminal device and the plurality of second trigger network elements Three trigger network elements, including:

When the connection state between the terminal device and each second triggering network element of the plurality of second triggering network elements is the idle state, the information storage network element is based on the plurality of second triggering network elements The corresponding access type determines the third triggering network element from the plurality of second triggering network elements; wherein, the access type includes 3GPP access and non-3GPP access.
The method according to claim 32, wherein the information storage network element determines the third trigger network element from the plurality of second trigger network elements according to the access type corresponding to the plurality of second trigger network elements. Yuan, including:

The information storage network element determines the third trigger network element from the plurality of second trigger network elements, and the access type corresponding to the third trigger network element is the 3GPP access.
The method according to claim 29, wherein the information storage network element determines a plurality of first slices associated with the terminal device and the first slice according to the slice authentication and authorization information and the first request. The third trigger network element in the second trigger network element includes:

Determining, by the information storage network element, the plurality of second triggering network elements according to the slice authentication and authorization information and the first request;

The information storage network element determines the third trigger network element from the plurality of second trigger network elements according to the access type corresponding to the plurality of second trigger network elements; wherein, the access type includes 3GPP Access and non-3GPP access.
The method according to claim 34, wherein the information storage network element determines the third trigger network element from the plurality of second trigger network elements according to the access type corresponding to the plurality of second trigger network elements Yuan, including:

The information storage network element determines the third trigger network element from the plurality of second trigger network elements, and the access type corresponding to the third trigger network element is the 3GPP access.
The method according to any one of claims 26-35, wherein the first request further includes a second indication, and the second indication is used to indicate that the network element type is AMF.
A method for slice authentication and authorization management, which is characterized in that it comprises:

The trigger network element sends slice authentication and authorization information to the information storage network element, where the slice authentication and authorization information is used to indicate the terminal device, the trigger network element associated with the terminal device, and the connection between the terminal device and the trigger network. Element-associated slice, where the triggering network element is a triggering network element serving the terminal device, and the slice is a slice for which the terminal device is successfully authenticated and authorized on the triggering network element;

The triggering network element receives a notification from the authentication and authorization network element, and the notification is used to notify the terminal device to perform the slice authentication and authorization processing of the slice; wherein the slice authentication and authorization processing includes: slice re-authentication and re-authorization , Or the slice authorization is revoked.
The method of claim 37, wherein the method further comprises:

The triggering network element initiates slice authentication and authorization processing of the slice for the terminal device.
An authentication and authorization network element, which is characterized by comprising a processor and a memory;

The processor is configured to read and execute instructions from the memory to implement the method according to any one of claims 1-25.
An information storage network element, which is characterized by comprising a processor and a memory;

The processor is configured to read and execute instructions from the memory to implement the method according to any one of claims 26-36.
A trigger network element, which is characterized by comprising a processor and a memory;

The processor is configured to read and execute instructions from the memory to implement the method according to any one of claims 37 or 38.