WO2021253859A1 - 切片认证方法及系统 - Google Patents

切片认证方法及系统 Download PDF

Info

Publication number
WO2021253859A1
WO2021253859A1 PCT/CN2021/077308 CN2021077308W WO2021253859A1 WO 2021253859 A1 WO2021253859 A1 WO 2021253859A1 CN 2021077308 W CN2021077308 W CN 2021077308W WO 2021253859 A1 WO2021253859 A1 WO 2021253859A1
Authority
WO
WIPO (PCT)
Prior art keywords
authentication
nssaaf
udm
amf
network
Prior art date
Application number
PCT/CN2021/077308
Other languages
English (en)
French (fr)
Inventor
邓娟
何承东
李飞
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2021253859A1 publication Critical patent/WO2021253859A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0807—Network architectures or network communication protocols for network security for authentication of entities using tickets, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0894—Policy-based network configuration management

Definitions

  • This application relates to the field of communication technology, and in particular to a slice authentication method and system.
  • the operator's network Before the terminal device is connected to the operator's network, the operator's network needs to perform two-way authentication with the terminal device. After the two-way authentication is successful, the terminal device is allowed to access the network. Further, after the terminal device accesses the operator's network, if the terminal device wants to access the slice, it needs to perform mutual authentication with the slice. Then, how to safely perform slice authentication is a problem that needs to be solved urgently.
  • This application provides a slice authentication method and system, which can safely perform slice authentication.
  • the present application provides a slice authentication method, the method includes:
  • the Access and Mobility Management Function sends a first authentication request to the authentication and authorization of a specific network slice (the authentication and authorization function of a specific network slice, NSSAAF); in response to the first authentication request
  • the NSSAAF sends a second authentication request to a unified data management network element (Unified Data Management, UDM); in response to the second authentication request, the UDM sends indication information to the NSSAAF, and the indication information is used to indicate
  • UDM Unified Data Management
  • the NSSAAF sends first protocol information to the server; the NSSAAF receives the second protocol information sent by the server; responds to In the second protocol information, the NSSAAF sends a third authentication request to the AMF; in response to the third authentication request, the AMF sends a first non-access stratum to the terminal equipment UE.
  • the AMF receives the second NAS transmission message sent by the UE; in response to the second NAS transmission message, the AMF sends a fourth authentication request to the NSSAAF; in response to the fourth authentication Request, the NSSAAF sends third protocol information to the server; the NSSAAF receives the fourth protocol information sent by the server; in response to the fourth protocol information, the NSSAAF sends a second authentication result to the AMF .
  • UDM returns the authentication result of the master authentication (the authentication result of the terminal device in the service network) to NSSAAF.
  • NSSAAF will continue the subsequent slice authentication process, which can prevent Malicious service networks bypass the master authentication and directly carry out the attack of slice authentication. It needs to be pointed out that if the service network bypasses the master authentication and directly requests the home network to perform slice authentication for the terminal device, it will consume the home network resources, but the final slice authentication will not succeed, then this process can be understood as the service network’s assignment to the home network. Cyber attack.
  • the main authentication refers to the mutual authentication between the terminal device and the network side during the process of accessing the network.
  • the main authentication can be 5G authentication and key agreement (5G authentication and key agreement, 5G AKA).
  • 5G AKA 5G authentication and key agreement
  • EAP AKA extensible authentication protocol authentication and key agreement
  • 5G AKA and EAP AKA can refer to the standard protocol 3GPP TS 33.501.
  • the first authentication request includes a serving network name (serving network name, SNN).
  • SNN serving network name
  • the NSSAAF determines whether the SNN is consistent with the expected SNN; the NSSAAF sends a second authentication request to the UDM, including: if the SNN is consistent with the expected SNN , The NSSAAF sends a second authentication request to UDM.
  • the method further includes: if the SNN is inconsistent with the expected SNN, the NSSAAF sends an instruction to stop authentication to the AMF.
  • the first authentication request also includes a token
  • the token is generated by a network storage function (network function repository function, NRF).
  • the token includes the desired SNN.
  • the token may not include SNN, but includes the service network identity (serving network identity, SN ID), then NSSAAF can combine the SN ID in the token with the SN ID in the SNN match. It is understandable that if the matching is successful, the NSSAAF sends a second authentication request to UDM; if the matching is unsuccessful, the NSSAAF sends an instruction to stop authentication to the AMF.
  • the UDM or AUSF may send the authentication result of the main authentication to the NSSAAF, and the NSSAAF will save the authentication result. Subsequently, after the NSSAAF receives the first authentication request, the NSSAAF can directly determine whether to send the first protocol information to the server according to the authentication result, instead of interacting with the UDM to obtain the authentication result of the master authentication.
  • the method further includes: after the master authentication succeeds, the AMF sends the security context status of the terminal device to UDM, and the UDM saves the security context status of the terminal device , Wherein the security context status of the terminal device includes the instance identity of the AMF.
  • the second authentication request includes the AMF identifier; in response to the second authentication request, the UDM determines whether the AMF identifier is the same as the AMF instance identifier in the security context state of the terminal device If they are the same, if they are the same, the UDM sends indication information to the NSSAAF.
  • the indication information is used to indicate the first authentication result of the terminal device in the serving network (the first authentication result may be the authentication result of the primary authentication).
  • the home network can determine whether the AMF that initiates the slice authentication is a legal AMF, and if it is a legal AMF, it sends the indication information. If it is not a legitimate AMF, it refuses to perform the subsequent slice authentication process, thereby preventing the waste of home network resources.
  • UDM and NSSAF belong to the home network, and AMF belongs to the service network.
  • the second authentication request carries the service network name of the AMF; before the UDM sends the indication information to the NSSAAF, the method further includes: The UDM determines whether there is an authentication result matching the service network name.
  • the UDM sending the indication information to the NSSAAF includes: if there is an authentication result matching the service network and the authentication result is that the authentication is successful, the UDM sends the indication information to the NSSAAF. It is understandable that if there is an authentication result matching the service network name, indicating that the UE has passed the primary authentication, then it is legal to perform slice authentication at this time. Through the above judgment process, potential risks can be eliminated, thereby improving the security of authentication and preventing the waste of signaling resources of the home network.
  • the method further includes: if there is an authentication result matching the service network name but the authentication result is an authentication failure, then the UDM sends a notification to the NSSAAF sends a message to instruct to stop authentication. It is understandable that if the authentication result is authentication failure, it means that the UE has not passed the primary authentication, then it is impossible to initiate slice authentication at this time. Therefore, it is impossible to terminate the slice authentication process directly at this time to prevent the waste of the trust of the home network. ⁇ Order resources.
  • the method further includes: if there is no authentication result matching the service network name, the UDM sends to the NSSAAF an instruction to stop authentication News.
  • authentication success can be represented by success
  • authentication failure can be represented by failure
  • authentication success can be represented by True
  • authentication failure can be represented by False.
  • the second authentication request carries the first identifier of the user equipment; the method further includes: the UDM obtains the first identifier of the user equipment according to the first identifier. The second identifier of the user equipment; the UDM sends the second identifier to the NSSAAF.
  • the method further includes: the NSSAAF receives the second identifier, and saves the mapping relationship between the first identifier and the second identifier.
  • the first identifier may be a subscription permanent identifier (SUPI)
  • the second identifier may be a generic public subscription identifier (GPSI).
  • SUPI subscription permanent identifier
  • GPSI generic public subscription identifier
  • NSSAAF can use GPSI to interact with external servers or data networks to prevent SUPI from leaking.
  • NSSAAF can obtain the SUPI corresponding to GPSI.
  • SUPI can interact with the network elements inside the core network to ensure efficient communication between the network elements inside the core network.
  • the first identifier may be GPSI
  • the second identifier may be GPSI*. It is understandable that GPSI* is calculated by GPSI through a preset function.
  • the method further includes: the NSSAAF sends an authentication result confirmation message to the UDM, the authentication result confirmation message includes the second authentication result, and the UDM saves the second authentication result .
  • the authentication result confirmation message further includes SUPI/GPSI, Single-Network Slice Selection Assistance Information (S-NSSAI), and a service network name.
  • S-NSSAI Single-Network Slice Selection Assistance Information
  • UDM will also save the SUPI/GPSI, S-NSSAI, and service network name.
  • the first authentication request includes the service network name.
  • the NSSAAF determines whether the SNN is consistent with the expected SNN; the NSSAAF sends a second authentication request to the UDM, including: if the SNN is consistent with the expected SNN , The NSSAAF sends a second authentication request to the UDM; if the second authentication request includes the service network name of the AMF, the UDM determines whether there is an authentication result that matches the service network name. If there is an authentication result matching the service network and the authentication result is authentication success, the UDM sends the indication information to the NSSAAF.
  • the UDM determines whether the AMF identifier is the same as the AMF instance identifier in the security context state of the terminal device. If they are the same, the UDM sends the The NSSAAF sends instructions. Similarly, if the second authentication request includes both the service network name of the AMF and the ID of the AMF, the UDM may select one of them for verification, or may verify both of the foregoing two parameters. For example, if it is necessary to verify both of the above two parameters, only if both parameters pass the verification, the instruction information can be sent to the NSSAAF.
  • NSSAAF determines whether the SNN in the first authentication request is consistent with the expected SNN, which can prevent AMF from carrying forged or other service network names to trigger authentication.
  • UDM verifies the AMF ID and can confirm whether the master authentication has been successful.
  • the present application provides a slice authentication system, which is used to perform the slice authentication method of the first aspect.
  • the system includes: AMF for sending a first authentication request to NSSAAF; the NSSAAF for sending a second authentication request to UDM in response to the first authentication request; and the UDM for responding
  • the second authentication request sending indication information to the NSSAAF, where the indication information is used to indicate the first authentication result of the terminal device in the serving network; the NSSAAF is used to if the first authentication result is a successful authentication , Send the first protocol information to the server; receive the second protocol information sent by the server; in response to the second protocol information, send a third authentication request to the AMF; the AMF is used to respond to the third An authentication request, sending a first NAS transmission message to the terminal device; receiving a second NAS transmission message sent by the UE; in response to the second NAS transmission message, sending a fourth authentication request to the NSSAAF; the NSSAAF, It is also used to send third protocol information to the server in response to
  • the second authentication request carries the service network name of the AMF; the UDM is also used to determine whether there is an authentication matching the service network name result.
  • the UDM is specifically configured to send the indication information to the NSSAAF if there is an authentication result that matches the service network and the authentication result is that the authentication is successful.
  • the UDM is further used to send a message for instructing to stop authentication to the NSSAAF if there is no authentication result matching the service network name .
  • the second authentication request carries the first identifier SUPI of the user equipment; the UDM is also used to obtain the user equipment's information according to the SUPI The second identifier GPSI; sending the GPSI to the NSSAAF.
  • the NSSAAF is also used to receive the GPSI and save the mapping relationship between the SUPI and the GPSI.
  • the present application provides a communication device, and the communication device is AMF, NSSAAF, or UDM in the system described in the second aspect.
  • the communication device includes a processing unit and a transceiver unit, wherein the processing unit is configured to perform information processing according to the function described in the first aspect or the second aspect; the transceiver unit is configured to perform information processing according to the first aspect or the second aspect
  • the described functions send and receive information.
  • the present application provides a communication device, and the communication device is AMF, NSSAAF, or UDM in the system described in the second aspect.
  • the communication device includes a processor and a transceiver, wherein the processing unit is configured to perform information processing according to the function described in the first aspect or the second aspect; the transceiver unit is configured to perform information processing according to the first aspect or the second aspect
  • the described functions send and receive information.
  • the present application provides a communication device, and the communication device is AMF, NSSAAF, or UDM in the system described in the second aspect.
  • the communication device includes a memory, a processor, and a transceiver. When the program code or instructions in the memory are executed, the processing unit performs information processing according to the function described in the first aspect or the second aspect; the transceiver unit Send and receive information according to the functions described in the first or second aspect.
  • the present application provides a communication device, and the communication device is AMF, NSSAAF, or UDM in the system described in the second aspect.
  • the communication device includes a processor and an interface circuit, wherein the processor is configured to perform information processing according to the function described in the first aspect or the second aspect; the interface circuit is configured to perform information processing according to the first aspect or the second aspect
  • the described functions send and receive information.
  • the present application provides a computer-readable storage medium for storing a computer program.
  • the AMF, UDM, or UDM in the first or second aspect is The function of NSSAFF will be executed.
  • the present application provides a computer program product, which includes a computer program or computer code, which when it runs on a computer, enables the AMF, UDM or NSSAF in the first or second aspect to function Will be executed.
  • FIG. 1 is a schematic diagram of the architecture of a communication system provided by an embodiment of the present application.
  • FIG. 2 is a schematic flowchart of a slice authentication method provided by an embodiment of the present application.
  • FIG. 3 is a schematic flowchart of another slice authentication method provided by an embodiment of the present application.
  • FIG. 4 is a schematic flowchart of another slice authentication method provided by an embodiment of the present application.
  • FIG. 5 is a schematic flowchart of another slice authentication method provided by an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • FIG. 7 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • FIG. 8 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • Fig. 9 is a schematic diagram of a wireless communication system provided by an embodiment of the present application.
  • At least one (item) refers to one or more
  • multiple refers to two or more than two
  • at least two (item) refers to two or three and three
  • “and/or” is used to describe the association relationship of associated objects, which means that there can be three kinds of relationships.
  • a and/or B can mean: only A, only B, and both A and B. In this case, A and B can be singular or plural.
  • the character “/” generally indicates that the associated objects before and after are in an "or” relationship.
  • the following at least one item (a) or similar expressions refers to any combination of these items, including any combination of a single item (a) or a plurality of items (a).
  • At least one (a) of a, b or c can mean: a, b, c, "a and b", “a and c", “b and c", or "a and b and c" ", where a, b, and c can be single or multiple.
  • PLMN public land mobile network
  • MNO mobile network operator
  • 3rd generation partnership project 3rd generation partnership project
  • 3GPP networks generally include, but are not limited to, fifth-generation mobile communication (5th-generation, 5G) networks (abbreviated as 5G networks), fourth-generation mobile communication (4th-generation, 4G) networks (abbreviated as 4G networks), and the like.
  • 5G fifth-generation mobile communication
  • 4G fourth-generation mobile communication
  • 4G networks abbreviated as 4G networks
  • the PLMN will be used as an example for description in the embodiments of the present application.
  • LTE long term evolution
  • FDD frequency division duplex
  • TDD LTE time division duplex
  • UMTS general purpose Mobile communication system
  • WiMAX worldwide interoperability for microwave access
  • 5G fifth generation
  • NR new radio
  • 5G networks have made network architecture adjustments relative to 4G networks.
  • the 5G network splits the mobility management entity (MME) in the 4G network into the access and mobility management function (AMF) and the session management function (session management function). , SMF) and many other network functions.
  • MME mobility management entity
  • AMF access and mobility management function
  • SMF session management function
  • FIG. 1 is a schematic diagram of a network architecture of an embodiment of the present application, which takes a 5G network architecture based on a service-oriented architecture in a non-roaming scenario defined in the 3GPP standardization process as an example.
  • the network architecture may include three parts, namely a terminal equipment part, a PLMN, and a data network (DN).
  • the terminal equipment part may include a terminal equipment 110, and the terminal equipment 110 may also be referred to as user equipment (UE).
  • the terminal device 110 in this application is a device with a wireless transceiver function, and can be connected to one or Multiple core network (core network, CN) devices (or may also be referred to as core devices) communicate.
  • the terminal device 110 may also be referred to as an access terminal, a terminal, a user unit, a user station, a mobile station, a mobile station, a remote station, a remote terminal, a mobile device, a user terminal, a user agent, or a user device.
  • the terminal device 110 can be deployed on land, including indoor or outdoor, handheld or vehicle-mounted; it can also be deployed on the water (such as a ship, etc.); it can also be deployed in the air (such as a plane, a balloon, a satellite, etc.).
  • the terminal device 110 can be a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a smart phone, a mobile phone, or a wireless local loop (WLL). ) Station, personal digital assistant (PDA), etc.
  • SIP session initiation protocol
  • WLL wireless local loop
  • PDA personal digital assistant
  • the terminal device 110 may also be a handheld device with a wireless communication function, a computing device or other devices connected to a wireless modem, a vehicle-mounted device, a wearable device, a drone device or a terminal in the Internet of Things, the Internet of Vehicles, and a 5G network.
  • a wireless communication function e.g., a Wi-Fi connection
  • a vehicle-mounted device e.g., a Wi-Fi connection
  • a wearable device e.g., a smart watch, or a smart watch, or a smart watch, etc.
  • the terminal device 110 may be a virtual reality (VR) terminal, an augmented reality (AR) terminal, a wireless terminal in industrial control, a wireless terminal in self-driving (self-driving), and a remote Wireless terminals in medical (remote medical), wireless terminals in smart grids, wireless terminals in transportation safety, wireless terminals in smart cities, and smart homes Wireless terminals, etc.
  • VR virtual reality
  • AR augmented reality
  • remote Wireless terminals in medical remote Wireless terminals in medical
  • wireless terminals in smart grids wireless terminals in transportation safety
  • wireless terminals in smart cities smart homes Wireless terminals, etc.
  • the embodiments of the present application do not limit the types or types of terminal devices.
  • PLMN may include: specific network slice authentication and authorization function (Network Slice-Specific Authentication and Authorization function, NSSAAF) 131, network storage function (network function repository function, NRF) 132, policy control function (policy control function, PCF) 133 , Unified data management (UDM) 134, application function (AF) 135, authentication server function (authentication server function, AUSF) 136, access and mobility management function (access and mobility management function, AMF) 137, session management function (session management function, SMF) 138, user plane function (UPF) 139, (radio) access network ((radio) access network, (R)AN) 140, etc.
  • core network core network
  • CN core network
  • the data network DN 120 may also be referred to as a packet data network (packet data network, PDN), and is usually a network located outside the PLMN, such as a third-party network.
  • PDN packet data network
  • the PLMN can access multiple data network DN 120, and multiple services can be deployed on the data network DN 120, so as to provide the terminal device 110 with services such as data and/or voice.
  • the data network DN 120 may be a private network of a smart factory, the sensors installed in the workshop of the smart factory may be terminal devices 110, and the data network DN 120 may have a sensor control server deployed, and the control server may provide services for the sensors.
  • the sensor can communicate with the control server, obtain instructions from the control server, and transmit the collected sensor data to the control server according to the instructions.
  • the data network DN 120 may be the internal office network of a certain company.
  • the mobile phone or computer of the company's employee may be the terminal device 110, and the employee's mobile phone or computer may access information and data resources on the company's internal office network.
  • the terminal device 110 may establish a connection with the PLMN through an interface provided by the PLMN (for example, the N1 interface in FIG. 1), and use services such as data and/or voice provided by the PLMN.
  • the terminal device 110 may also access the data network DN 120 through the PLMN, and use the operator services deployed on the data network DN 120 and/or services provided by a third party.
  • the above-mentioned third party may be a service party other than the PLMN and the terminal device 110, and may provide other data and/or voice services for the terminal device 110.
  • the specific form of expression of the above-mentioned third party can be determined according to actual application scenarios, and is not limited here.
  • (R) AN 140 is a sub-network of the PLMN, and is an implementation system between the service node (or network function) and the terminal device 110 in the PLMN.
  • the terminal device 110 To access the PLMN, the terminal device 110 first passes through the (R)AN 140, and then connects to the service node in the PLMN through the (R)AN 140.
  • the access network device in the embodiment of the present application is a device that provides a wireless communication function for the terminal device 110, and may also be referred to as an access device, (R)AN device, or network device, etc.
  • the access equipment includes but is not limited to: next generation node base station (gNB) in 5G system, evolved node B (eNB) in LTE system, radio network controller, RNC), node B (node B, NB), base station controller (BSC), base transceiver station (BTS), home base station (home evolved nodeB, or home node B, HNB), baseband Unit (base band unit, BBU), transmission and receiving point (transmitting and receiving point, TRP), transmitting point (transmitting point, TP), small cell equipment (pico), mobile switching center, or network equipment in the future network, etc.
  • gNB next generation node base station
  • eNB evolved node B
  • RNC radio network controller
  • node B node B
  • BSC base station controller
  • BTS base transceiver station
  • home base station home evolved nodeB, or home node B, HNB
  • baseband Unit base band unit
  • TRP transmitting and receiving point
  • TP small cell equipment
  • pico small cell equipment
  • the access device may include a centralized unit (CU) and a distributed unit (DU).
  • CU can also be divided into CU-control plane (CP) and CU-user plan (UP).
  • UP CU-user plan
  • the access equipment may also be an open radio access network (open radio access network, ORAN) architecture, etc. This application does not limit the specific deployment mode of the access equipment.
  • the authentication and authorization function NSSAAF 131 of a specific network slice is used to authenticate and authorize slices.
  • the network storage function NRF 132 can be used to maintain real-time information of all network functions and services in the network.
  • the policy control function PCF 133 is a control plane function provided by the operator, and is used to provide a protocol data unit (protocol data unit, PDU) session policy to the session management function SMF 138.
  • Policies can include charging-related policies, QoS-related policies, and authorization-related policies.
  • Unified data management UDM 134 is a control plane function provided by operators, responsible for storing subscriber permanent identifier (SUPI), security context (security context), subscription data and other information of subscribers in the PLMN.
  • the above-mentioned PLMN subscribers may specifically be users who use the services provided by the PLMN, such as users who use China Telecom's terminal equipment core card, or users who use China Mobile's terminal equipment core card.
  • the SUPI of the subscriber may be the number of the core card of the terminal device, etc.
  • the aforementioned security context may be data (cookie) or token (token) stored on a local terminal device (for example, a mobile phone).
  • the contract data of the aforementioned subscriber may be a supporting service of the core card of the terminal device, for example, a data package of the core card of the mobile phone.
  • Application function AF 135 is used for data routing affected by applications, access to network opening functions, and interaction with policy frameworks for policy control, etc.
  • the authentication server function AUSF 136 is a control plane function provided by the operator, and is usually used for first-level authentication, that is, authentication between the terminal device 110 (subscribed user) and the PLMN.
  • Access and mobility management function AMF 137 is a control plane network function provided by the PLMN. It is responsible for the access control and mobility management of the terminal device 110 accessing the PLMN, for example, including mobility status management, assignment of temporary user identities, authentication and authorization User and other functions.
  • the session management function SMF 138 is a control plane network function provided by the PLMN, and is responsible for managing the protocol data unit (protocol data unit, PDU) session of the terminal device 110.
  • the PDU session is a channel used to transmit PDUs, and the terminal device needs to transmit PDUs to each other with the DN 120 through the PDU session.
  • the PDU session can be established, maintained, and deleted by the SMF 138.
  • SMF 138 includes session management (such as session establishment, modification, and release, including tunnel maintenance between UPF 139 and (R)AN 140, etc.), selection and control of UPF 139, service and session continuity (SSC) ) Session-related functions such as mode selection and roaming.
  • session management such as session establishment, modification, and release, including tunnel maintenance between UPF 139 and (R)AN 140, etc.
  • SSC service and session continuity
  • the user plane function UPF 139 is a gateway provided by the operator and a gateway for the communication between PLMN and DN 120.
  • UPF 139 includes user plane-related functions such as packet routing and transmission, packet inspection, service usage reporting, quality of service (QoS) processing, lawful monitoring, upstream packet inspection, and downstream packet storage.
  • QoS quality of service
  • the network function in the PLMN shown in FIG. 1 may also include a network slice selection function (NSSF) (not shown in FIG. 1), which is used to determine the network slice instance, select the AMF network function 137, and so on.
  • NSSF network slice selection function
  • the network functions in the PLMN shown in FIG. 1 may also include unified data repository (UDR), etc.
  • UDR unified data repository
  • Nnef, Nausf, Nnrf, Npcf, Nudm, Naf, Namf, Nsmf, N1, N2, N3, N4, and N6 are interface serial numbers.
  • the meaning of the aforementioned interface serial number can be referred to the meaning defined in the 3GPP standard protocol, and this application does not limit the meaning of the aforementioned interface serial number.
  • the terminal device 110 is used as an example for the UE.
  • the name of the interface between the various network functions in FIG. 1 is only an example. In a specific implementation, the name of the interface of the system architecture It may also be other names, which are not limited in this application.
  • the mobility management network function in this application may be the AMF 137 shown in FIG. 1, or may be other network functions with the access and mobility management function AMF 137 in the future communication system.
  • the mobility management network function in this application may also be a mobility management entity (mobility management entity, MME) in the LTE system.
  • MME mobility management entity
  • the access and mobility management function AMF 137 is referred to as AMF
  • the unified data management UDM 134 is referred to as UDM
  • the terminal device 110 is referred to as UE.
  • the described AMF can be replaced with mobility management network functions
  • UDM can be replaced with unified data management
  • UE can be replaced with terminal equipment. It can be understood that this replacement method is also applicable to other network functions not shown.
  • the network architecture shown in Figure 1 (such as the 5G network architecture) adopts a service-based architecture and common interfaces.
  • the traditional network element functions are split into several self-contained and self-managed based on network function virtualization (NFV) technology.
  • NFV network function virtualization
  • Reusable network function service module NFV
  • the schematic diagram of the network architecture shown in FIG. 1 can be understood as a schematic diagram of a service-based 5G network architecture in a non-roaming scenario.
  • different network functions are combined in an orderly manner as needed to realize customization of network capabilities and services, thereby avoiding the deployment of dedicated physical networks for different services.
  • Network slicing technology can enable operators to respond to customer needs more flexibly and quickly, and support the flexible allocation of network resources.
  • a slice may be composed of a set of network functions (NF) and/or sub-networks.
  • the sub-network (R) AN 140, AMF 137, SMF 138, and UPF 139 in Fig. 1 can form a slice. It is understandable that only one of each type of network function in FIG. 1 is schematically drawn, but in actual network deployment, each type of network function or sub-network may have multiple, tens, or hundreds. Many slices can be deployed in PLMN, and each slice can have different performance to meet the needs of different applications and different vertical industries. Operators can tailor a slice according to the needs of customers in different vertical industries. Operators can also allow some industry customers to enjoy greater autonomy and participate in part of the management and control functions of slicing.
  • slice-level authentication is a network control function with limited participation of industry customers, that is, authentication and authorization of terminal equipment access to slices, namely “slice-level authentication”, which can also be called “second-level authentication” and “secondary authentication”. This application is referred to as “slice certification”.
  • the terminal device Before the terminal device is allowed to access the network or slice, it needs to perform mutual authentication with the network and/or slice and obtain authorization from the network and/or slice. Generally, the network needs to authenticate and authorize the terminal device once or twice before it can access the network or slice.
  • the PLMN needs to be authenticated based on the SUPI contracted with the PLMN used by the terminal equipment. This type of authentication is called primary authentication or primary authentication. Common primary authentication includes 5G AKA or EAP AKA.
  • the PLMN needs to be authenticated based on the identification of the contract with the DN used by the terminal equipment, that is, slice authentication or secondary authentication.
  • the UE 110 may provide the requested slice to the core network.
  • the slice requested by the UE 110 may include a requested network slice selection assistance information set (requested network slice selection assistance information, requested NSSAI).
  • the NSSAI may include one or more single network slice selection assistance information (S-NSSAI).
  • S-NSSAI is used to identify a network slice type, which can also be understood as: S-NSSAI is used to identify Slice, or it can be understood that S-NSSAI is the identification information of the slice.
  • the slice in this application may also be referred to as a network slice, a network slice instance, or S-NSSAI, etc., and the name of the slice is not limited in this application.
  • this application does not make a strict distinction between slices or S-NSSAI, etc., and the two can be equally applicable.
  • the core network network function (such as AMF network function 137 or NSSF network function) according to the subscription data of the UE 110, the network slice requested by the UE 110, the roaming agreement, and the local configuration information are:
  • the UE 110 selects a set of network slices allowed to be accessed.
  • the set of network slices allowed to be accessed may be represented by allowed NSSAI, and the S-NSSAI included in the allowed NSSAI may be the S-NSSAI that the current PLMN allows the UE 110 to access.
  • the data network DN 120 outside the PLMN (such as the DN serving the vertical industry) UE 110 also has requirements for authentication and authorization.
  • a commercial company provides a game platform and provides game services to game players through PLMN.
  • the PLMN needs to authenticate or authorize the identity (SUPI) of the UE 110, that is, the first level authentication.
  • the game player is a customer of a commercial company, and the commercial company also needs to authenticate or authorize the identity of the game player.
  • this authentication can be based on slices, or in other words, the authentication is based on slices.
  • this authentication may be called slice authentication (slice authentication), or network slice-specific authentication and authorization (NSSAA).
  • slice authentication can be, for example, authentication performed between a terminal device and a third-party network (such as a DN or its authentication server).
  • the slice authentication result will determine whether the PLMN authorizes the terminal device to access the slice provided by the PLMN. It should also be understood that the method applied to slice authentication in this application is also applicable to scenarios such as session-based secondary authentication (secondary authentication) or slice-based secondary authentication, and will not be described in detail here.
  • FIG. 2 is a schematic flowchart of a slice authentication method provided by an embodiment of the present application, and the method can be applied to the network shown in FIG. 1. It can be understood that Fig. 2 shows a slice authentication method, and the embodiment of the present application does not limit the first-level authentication method between the UE and the PLMN network.
  • the server responsible for slice authentication in Figure 2 is an authentication, authorization, and accounting server (authentication, authorization, accounting server, AAA-S).
  • AAA-S authentication, authorization, accounting server
  • the AAA-S can be deployed in the PLMN network; or, the AAA-S can also be deployed outside the PLMN network.
  • the UE can transfer the AAA-S through the proxy service provided by the AAA proxy (AAA-proxy, AAA-P) deployed in the PLMN network to realize the UE and AAA-S
  • the network slice-specific authentication and authorization function (network slice-specific authentication and authorization function, NSSAAF) in Figure 2 is a network function that assists in completing slice authentication.
  • AUSF or other NFs can replace NSSAAF to assist in completing slice authentication. Therefore, the embodiment of the present application does not limit the network function (such as NSSAAF, AUSF, or other NF) that assists in completing slice authentication.
  • AAA-P can be deployed separately from NSSAAF; in other deployment modes, AAA-P can be deployed together with NSSAAF (or AUSF). Therefore, the embodiment of the present application does not limit the deployment mode of AAA-P and NSSAAF (or AUSF).
  • FIG. 2 shows that AAA-S is deployed outside the PLMN network, that is, the UE provides proxy services through the AAA-P inside the PLMN network, and transfers the AAA-S to achieve slice authentication.
  • the AAA-P and NSSAAF or AUSF It is deployed separately.
  • the embodiments of this application are equally applicable.
  • the slice authentication method includes:
  • AMF sends a first authentication request message to NSSAAF
  • the NSSAAF receives the first request message.
  • the identification information of the slice is represented by S-NSSAI.
  • the identification information of the UE may be represented by a publicly available subscription identifier (generic public subscription identifier, GPSI) or SUPI, but it should not be construed as a limitation to the embodiments of the present application.
  • the first request message carries the EAP ID response, S-NSSAI and UE identification information.
  • the first request message carries an EAP ID response, S-NSSAI, UE identification information, and service network name.
  • the first request message carries an EAP ID response, S-NSSAI, UE identification information, and AMF ID.
  • the first request message carries EAP ID response, S-NSSAI, UE identification information, service network name and AMF ID.
  • the identification information of the UE may be GPSI or SUPI.
  • the NSSAAF In response to the first authentication request, the NSSAAF sends a second authentication request to UDM.
  • the first authentication request may be a Nssaaf_NSSAA_Authenticate Req message; the second authentication request may be an Authentication info Req message.
  • the UDM In response to the second authentication request, the UDM sends indication information to the NSSAAF, where the indication information is used to indicate the first authentication result of the terminal device in the serving network;
  • the indication information may be the first authentication result.
  • the indication information may also be used to indicate whether slice authentication is allowed.
  • the indication information may also be used to indicate the registration status of the UE in the SN.
  • the indication information can also be used to indicate whether master authentication is required. It needs to be pointed out that the main authentication can be 5G AKA authentication or EAP AKA authentication, which will not be listed here.
  • the NSSAAF sends first protocol information to the server;
  • the first protocol information may be AAA protocol message.
  • the server may be an AAA-S server.
  • the NSSAAF receives the second protocol information sent by the server.
  • the second protocol information may also be AAA protocol message.
  • the NSSAAF In response to the second protocol information, the NSSAAF sends a third authentication request to the AMF.
  • the third authentication request message may be a Nssaaf_NSSAA_Authenticate Resp message.
  • the AMF In response to the third authentication request, the AMF sends a first NAS transmission message to the terminal device.
  • the AMF receives a second NAS transmission message sent by the UE.
  • the AMF sends a fourth authentication request to the NSSAAF.
  • the fourth authentication request message may be a Nssaaf_NSSAA_Authenticate Request message.
  • the NSSAAF In response to the fourth authentication request, the NSSAAF sends third protocol information to the server;
  • the third protocol information may be AAA protocol message.
  • the NSSAAF receives fourth protocol information sent by the server.
  • the fourth protocol information may be AAA protocol message.
  • the fourth protocol information is used to characterize the success or failure of slice authentication. It is understandable that before receiving the fourth protocol information, the slice authentication process may include multiple rounds of interactions similar to steps 205-210.
  • the fourth protocol information may include the result of slice authentication, such as authentication success or authentication failure.
  • the NSSAAF In response to the fourth protocol information, the NSSAAF sends a second authentication result to the AMF.
  • the NSSAAF sends a Nssaaf_NSSAA_Authenticate Resp message to the AMF.
  • the second authentication result may be carried in the Nssaaf_NSSAA_Authenticate Resp message.
  • the second authentication result sent by the NSSAAF to the AMF is authentication success (or slice authentication success). It is understandable that the second authentication result is used to characterize the result of slice authentication. There are many ways of characterization, such as success characterizing authentication success, failure characterizing authentication failure. True represents authentication success, false represents authentication failure, and so on.
  • the second authentication result sent by the NSSAAF to the AMF is authentication failure (or slice authentication failure).
  • NSSAAF will interact with UDM to determine whether the UE has successfully performed the primary authentication. If the UE has successfully performed the primary authentication, then NSSAAF will continue the subsequent slice authentication process. Otherwise, the slice authentication will be rejected.
  • the AMF it is possible to prevent the AMF from bypassing the master authentication to attack the home network, thereby ensuring the security of the slice authentication. It should be pointed out that if the UE does not pass the master authentication, if the AMF initiates slice authentication, subsequent signaling resources of the home network will be consumed, but the final slice authentication will fail. Therefore, performing the authentication state of the master authentication before performing the slice authentication can improve the efficiency and security of the slice authentication.
  • the AMF may obtain the subscription information of the slice identified as S-NSSAI of the UE from the UDM.
  • the AMF may determine whether to perform slice authentication for the slice according to the identification information of the slice to be accessed by the UE and/or the UE's subscription information for the slice. If it is necessary to perform slice authentication for the slice, AMF sends an Extensible Authentication Protocol (EAP) ID request for slice authentication to the UE; accordingly, the UE receives the EAP for slice authentication ID request, the UE sends an EAP ID response (response) to the AMF.
  • EAP Extensible Authentication Protocol
  • the AMF may directly send a message denying access to the slice to the UE.
  • the AMF may directly allow the slice.
  • the UE is directly allowed to access the slice.
  • the AMF records (or stores) that the UE has completed the slice authentication for the slice and the authentication time is within the valid period, the UE is directly allowed to access the slice.
  • EAP was formulated by the International Standards Organization-Internet Engineering Task Force (IETF).
  • the EAP ID request can be carried in a non-access stratum (NAS) message in the 3GPP network.
  • the NAS message can also carry slice identification information such as S-NSSAI.
  • S-NSSAI can be used to indicate the The EAP ID request is a slice authentication request for the S-NSSAI.
  • Fig. 3 is based on Fig. 2 by optimizing steps 201 and 202, and adding NSSAAF judgment step 301.
  • steps 201, 202 and 301 specifically include:
  • AMF sends a first authentication request message to NSSAAF, where the first authentication request includes a service network name SNN;
  • first authentication request message may also be abbreviated as the first authentication request.
  • subsequent second authentication request message can also be abbreviated as the second authentication request, which will not be listed here.
  • the first request message may also carry an EAP ID response, S-NSSAI and UE identification information.
  • the first request message may also carry an EAP ID response, S-NSSAI, UE identification information, and AMF ID.
  • the identification information of the UE may be GPSI or SUPI.
  • the NSSAAF judges whether the SNN is consistent with the expected SNN
  • the first authentication request message also includes a token.
  • the token is generated by NRF for the AMF.
  • the NSSAAF may also obtain a token corresponding to the AMF ID from the NRF according to the AMF ID.
  • NSSAAF matches the SNN in the token with the SNN in the first authentication request.
  • the NSSAAF determines whether the SNN is consistent with the expected SNN, including: the NSSAAF determines that the SN ID in the token is the same as that in the first authentication request Whether the SNID of SNN is the same.
  • SNN includes prefix code and SNID.
  • the prefix code can be the character string "5G", “5G AKA” or "5G EAP AKA” and so on.
  • the SN ID may be the PLMN ID.
  • the NSSAAF sends a second authentication request to UDM
  • the SNN and the desired SNN are consistent, including: the SNN and the desired SNN are consistent and completely consistent.
  • the string of the first N bits is exactly the same or the string of the same length at the same position intercepted is exactly the same, where N is a positive integer.
  • the first authentication request may be a Nssaaf_NSSAA_Authenticate Req message; the second authentication request may be an Authentication info Req message.
  • the method further includes: if the SNN is inconsistent with the expected SNN, the NSSAAF sends an instruction to stop authentication to the AMF.
  • the UDM or AUSF may send the authentication result to the NSSAAF, and the NSSAAF will save the authentication result. Then, after the NSSAAF receives the first authentication request, the NSSAAF can directly determine whether to send the first protocol information to the server according to the authentication result, instead of interacting with the UDM to obtain the authentication result.
  • NSSAAF can determine whether the SNN used by the AMF is legal, and if the SNN is illegal, the slice authentication process is terminated in advance, thereby preventing the waste of signaling resources.
  • FIG. 5 is based on FIG. 2 or FIG. 3, optimizing step 202, step 203, and adding UDM judgment step 401.
  • steps 202, 203 and 401 specifically include:
  • the NSSAAF In response to the first authentication request, the NSSAAF sends a second authentication request to UDM, where the second authentication request includes the AMF ID;
  • the first authentication request may be a Nssaaf_NSSAA_Authenticate Req message; the second authentication request may be an Authentication info Req message.
  • the UDM judges whether the AMF identifier is the same as the AMF instance identifier in the security context state of the terminal device.
  • the AMF will send the security context status of the terminal device to the UDM, and the UDM will save the terminal device The security context status of the terminal device, wherein the security context status of the terminal device includes the instance identifier of the AMF.
  • the UDM sends indication information to the NSSAAF, where the indication information is used to indicate the first authentication of the terminal device in the serving network result;
  • the indication information may be the first authentication result.
  • the first authentication result may be the authentication result of the primary authentication (that is, the result of mutual authentication between the UE and the core network).
  • the authentication result may be success or failure or no authentication.
  • the success mark is successful, the failure mark fails or is not authenticated.
  • the True sign succeeds, and the False sign fails or is not authenticated.
  • 1 indicates success, 0 indicates failure or not authenticated.
  • the indication information may also be used to indicate whether slice authentication is allowed.
  • the indication information may also be used to indicate the registration status of the UE in the SN.
  • the indication information can also be used to indicate whether master authentication is required. It needs to be pointed out that the main authentication can be 5G AKA authentication or EAP AKA authentication, which will not be listed here.
  • the home network can determine whether the AMF that initiates the slice authentication is a legal AMF, and if it is a legal AMF, it sends the indication information. If it is not a legitimate AMF, it refuses to perform the subsequent slice authentication process, thereby preventing the waste of home network resources.
  • UDM and NSSAF belong to the home network, and AMF belongs to the service network.
  • FIG. 5 is based on any one of the drawings in FIGS. 2 to 4, optimizing step 202, step 203, and adding UDM judgment step 501.
  • steps 202, 203 and 501 specifically include:
  • the NSSAAF In response to the first authentication request, the NSSAAF sends a second authentication request to UDM, where the second authentication request includes the service network name of the AMF;
  • the first authentication request may be a Nssaaf_NSSAA_Authenticate Req message; the second authentication request may be an Authentication info Req message.
  • the UDM determines whether there is an authentication result matching the service network name
  • UDM can traverse the database according to the service network name to determine the search result. If the search result is empty, it proves that there is no authentication result that matches the service network name; if the search result is not empty, there is an authentication result that matches the service network name. The matching authentication result.
  • the UDM sends indication information to the NSSAAF, where the indication information is used to indicate the first authentication result of the terminal device in the service network ;
  • the indication information may be the first authentication result (that is, the authentication result matching the service network).
  • the first authentication result may be the authentication result of the primary authentication (that is, the result of mutual authentication between the UE and the core network).
  • the authentication result may be success or failure or no authentication.
  • the success mark is successful, the failure mark fails or is not authenticated.
  • the True sign succeeds, and the False sign fails or is not authenticated.
  • 1 indicates success, 0 indicates failure or not authenticated.
  • the indication information may also be used to indicate whether slice authentication is allowed.
  • the indication information may also be used to indicate the registration status of the UE in the SN.
  • the indication information can also be used to indicate whether master authentication is required. It needs to be pointed out that the main authentication can be 5G AKA authentication or EAP AKA authentication, which will not be listed here.
  • the method further includes: if there is an authentication result matching the service network name but the authentication result is an authentication failure, then the UDM sends a notification to the NSSAAF sends a message to instruct to stop authentication. It is understandable that if the authentication result is authentication failure, it means that the UE has not passed the primary authentication, then it is impossible to initiate slice authentication at this time. Therefore, it is impossible to terminate the slice authentication process directly at this time to prevent the waste of the trust of the home network. ⁇ Order resources.
  • the method further includes: if there is no authentication result matching the service network name, the UDM sends to the NSSAAF an instruction to stop authentication News.
  • authentication success can be represented by success
  • authentication failure can be represented by failure
  • authentication success can be represented by True
  • authentication failure can be represented by False
  • successful authentication can be represented by 1, and authentication failure can be represented by 0.
  • a method for privacy protection of the user identification includes: the second authentication request carries the first identifier of the user equipment; after the UDM receives the second authentication request, the UDM obtains the second identifier of the user equipment according to the above; The UDM sends the second identifier to the NSSAAF.
  • the method further includes: the NSSAAF receives the 200th Pepsi, and saves the mapping relationship between the first identifier and the second identifier.
  • NSSAAF can use the second identifier to interact with an external server or data network to prevent the first identifier from leaking.
  • NSSAAF receives the first identifier sent by the external server
  • the first identification corresponding to the second identification can be obtained, and then the first identification is used to interact with the network elements inside the core network, thereby ensuring efficient communication between the network elements inside the core network.
  • the second identifier is GPSI; for example, when the first identifier is GPSI, the second identifier is GPSI*.
  • a method for storing slice authentication results is also included. Specifically, after NSSAAF completes the slice authentication of the terminal device, it will send the slice authentication status (such as authentication success or failure) to the UDM, and the UDM will save the slice authentication status. It should be pointed out that other networks can subsequently interact with UDM to query the status of the slice authentication, and then execute other processes or initiate other services according to the status of the slice authentication.
  • the method specifically includes: the NSSAAF sends an authentication result confirmation message to the UDM, the authentication result confirmation message includes the second authentication result, and the UDM saves the second authentication result .
  • the authentication result confirmation message further includes SUPI/GPSI, S-NSSAI, and or service network name.
  • UDM will also save the SUPI/GPSI, S-NSSAI, and or service network name.
  • Fig. 6 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • the communication device may be the AMF in the foregoing embodiment, or UDM, or NSSAAF.
  • the communication device includes a transceiver unit 601 and a processing unit 602.
  • the processing unit 602 is coupled with the transceiving unit 601, and the processing unit 602 can receive and send data through the transceiving unit 601.
  • the communication device may be used to perform any of the operations performed by the NSSAAF in FIGS. 2 to 5.
  • the processing unit 602 is configured to receive a first authentication request sent by AMF; in response to the first authentication request, send a second authentication request to UDM; and receive instruction information sent by the UDM, where the instruction information is used to instruct the terminal device
  • the first authentication result in the service network if the first authentication result is a successful authentication, the first protocol information is sent to the server; the second protocol information sent by the server is received; in response to the second protocol information, the AMF sends a third authentication request; receives a fourth authentication request sent by the AMF; in response to the fourth authentication request, sends third protocol information to the server; receives the fourth protocol information sent by the server; responds to the The fourth protocol information sends the second authentication result to the AMF.
  • the second authentication request carries a first identifier of the user equipment; the processing unit 602 is further configured to receive a second identifier sent by the UDM; and save the first identifier and the The mapping relationship of the second identifier.
  • the first authentication request includes the service network name SNN; the processing unit 602 is also used to determine whether the SNN is consistent with the expected SNN; if the SNN is consistent with the expected SNN, then The NSSAAF sends a second authentication request to UDM.
  • the communication device may be used to perform any operation performed by the UDM in FIG. 2 to FIG. 5.
  • the processing unit 602 is configured to receive a second authentication request sent by the NSSAAF; in response to the second authentication request, send instruction information to the NSSAAF, where the instruction information is used to indicate the first authentication of the terminal device in the serving network result.
  • the second authentication request carries the service network name of the AMF; the processing unit 602 is further configured to determine whether there is an authentication result that matches the service network name; the processing unit 602 specifically If there is an authentication result matching the service network and the authentication result is a successful authentication, send the indication information to the NSSAAF.
  • the processing unit 602 is further configured to send a message for instructing to stop authentication to the NSSAAF if there is no authentication result matching the service network name.
  • the second authentication request carries the first identifier SUPI of the user equipment; the processing unit is further configured to obtain the second identifier of the user equipment according to the first identifier; and report to the NSSAAF Send the second identifier.
  • the second authentication request includes the AMF ID; the processing unit 602 is further configured to determine whether the AMF identifier is the same as the AMF instance identifier in the security context state of the terminal device; if the The AMF identifier is the same as the AMF instance identifier in the security context state of the terminal device, and then indication information is sent to the NSSAAF, where the indication information is used to indicate the first authentication result of the terminal device in the serving network.
  • the second authentication request includes the service network name of the AMF; the processing unit 602 is further configured to determine whether there is an authentication result that matches the service network name; if there is an authentication result that matches the service network name; If the authentication result matches and the authentication result is successful, then the indication information is sent to the NSSAAF, where the indication information is used to indicate the first authentication result of the terminal device in the serving network.
  • the processing unit 602 may be one or more processors 702
  • the transceiving unit 601 may be a transceiver 701
  • the transceiving unit 601 may also be a transmitting unit and a receiving unit, and the transmitting unit may be
  • the transmitter and the receiving unit may be a receiver, and the transmitting unit and the receiving unit are integrated into one device, such as a transceiver.
  • the processing unit 602 may be one or more processors, or the processing unit 602 may be a processing circuit 802 or the like.
  • the transceiver unit 601 may be an input/output interface, or a communication interface, or an interface circuit 801, or an interface, or the like.
  • the transceiver unit 601 may also be a sending unit and a receiving unit, the sending unit may be an output interface, and the receiving unit may be an input interface, and the sending unit and the receiving unit are integrated into one unit, such as an input/output interface.
  • the transceiver may include a receiver and a transmitter, the receiver is used to perform the function (or operation) of receiving, and the transmitter is used to perform the function (or operation) of transmitting. And the transceiver is used to communicate with other equipment/devices through the transmission medium.
  • the processor transmits and receives data and/or signaling through the transceiver, and is used to implement the corresponding methods described in FIGS. 2 to 5 in the foregoing method embodiments.
  • the communication device may further include one or more memories 703 for storing program instructions and/or data.
  • the memory 703 and the processor 702 are coupled.
  • the coupling in the embodiments of the present application is an indirect coupling or communication connection between devices, units or modules, and may be in electrical, mechanical or other forms, and is used for information exchange between devices, units or modules.
  • the processor 702 may cooperate with the memory 703 to operate.
  • the processor 702 may execute program instructions stored in the memory 703.
  • at least one of the aforementioned one or more memories may be included in the processor.
  • the embodiment of the present application does not limit the specific connection medium between the transceiver 701, the processor 702, and the memory 703.
  • the memory 703, the processor 702, and the transceiver 701 are connected by a bus 704 in FIG. 7.
  • the bus is represented by a thick line in FIG. , Is not limited.
  • the bus can be divided into an address bus, a data bus, a control bus, and so on. For ease of presentation, only one thick line is used to represent in FIG. 7, but it does not mean that there is only one bus or one type of bus.
  • the processor may be a general-purpose processor, a digital signal processor, an application specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, etc., which can be implemented Or execute the methods, steps, and logical block diagrams disclosed in the embodiments of the present application.
  • the general-purpose processor may be a microprocessor or any conventional processor or the like.
  • the steps of the method disclosed in the embodiments of the present application may be directly embodied as being executed and completed by a hardware processor, or executed and completed by a combination of hardware and software modules in the processor.
  • connection relationship between the processor, the transceiver, and the memory as well as the description of the processor or the transceiver, etc., are applicable to the core devices shown below.
  • the communication device is any of AMF, UDM, or NSSAAF
  • the description of the connection relationship between the processor, the transceiver, and the memory and the description of the processor or the transceiver, etc., each communication device shown below All apply.
  • the aforementioned communication device may be a circuit system.
  • the aforementioned processing unit 602 may be implemented by a processing circuit
  • the transceiver unit 701 may be implemented by an interface circuit.
  • the communication device may include a processing circuit 802 and an interface circuit 801.
  • the processing circuit 802 may be a chip, a logic circuit, an integrated circuit, a processing circuit, or a system on chip (SoC) chip, etc.
  • SoC system on chip
  • the processing circuit may be a general-purpose processor, a digital signal processor, an application specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, etc., which can be implemented Or execute the methods, steps, and logical block diagrams disclosed in the embodiments of the present application. It can be understood that for the description of the processing circuit, the circuit systems shown below are all applicable.
  • FIG. 9 is a schematic diagram of a wireless communication system provided by an embodiment of the present application.
  • the wireless communication system may include AMF, NSSAAF, and UDM.
  • the system can execute the method corresponding to Fig. 2 to Fig. 5, which will not be described in detail here.
  • the disclosed system, device, and method can be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components may be combined or It can be integrated into another system, or some features can be ignored or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may also be electrical, mechanical or other forms of connection.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the technical effects of the solutions provided by the embodiments of the present application.
  • the functional units in the various embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit can be implemented in the form of hardware or software functional unit.
  • the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium.
  • the storage medium includes several instructions to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned readable storage media include: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disks or optical disks, etc., which can store program codes. Medium.
  • this application also provides a computer program, which is used to implement operations and/or processing performed by any network element (AMF, NSSAAF, or UDM) in FIGS. 2 to 5 provided in this application.
  • AMF Access Management Function
  • NSSAAF Network Access Function
  • UDM User Data Management Function
  • This application also provides a computer-readable storage medium in which computer code is stored.
  • the computer can execute the operations performed by any network element in FIGS. 2 to 5 and/ Or deal with.
  • the computer program product includes computer code or computer program.
  • the computer code or computer program runs on a computer
  • the computer program product corresponding to any one of the network elements in Figures 2 to 5 in this application is The operation and/or processing performed by the method is performed.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请实施例提供一种切片认证方法及系统，该方法包括：接入和移动性管理功能AMF向特定网络切片的认证和授权功能NSSAAF发送认证请求；响应于所述认证请求，所述NSSAAF与统一数据管理网元UDM交互以确定终端设备在服务网络的第一认证结果；若所述第一认证结果为认证成功，则所述NSSAAF分别与服务器以及AMF交互以进行切片认证并获得切片认证结果，所述NSSAAF向所述AMF发送所述认证结果。通过实施本发明提供的技术方案，能够防止服务网络绕过主认证直接进行切片认证的攻击。

Description

切片认证方法及系统 技术领域
本申请涉及通信技术领域，尤其涉及一种切片认证方法及系统。
背景技术
终端设备在接入运营商网络之前，运营商网络需要与终端设备进行双向认证，双向认证成功之后，终端设备设备会被允许接入网络。进一步的，终端设备接入运营商网络之后，如果终端设备想要接入切片，是需要与切片进行双向认证的。那么，如何安全的进行切片认证是亟待解决的问题。
发明内容
本申请提供一种切片认证方法及系统，可安全的进行切片认证。
第一方面，本申请提供一种切片认证方法，所述方法包括：
接入和移动性管理功能(Access and Mobility Management Function，AMF)向特定网络切片的认证和授权(特定网络切片的认证和授权功能，NSSAAF)发送第一认证请求；响应于所述第一认证请求，所述NSSAAF向统一数据管理网元(Unified Data Management，UDM)发送第二认证请求；响应于所述第二认证请求，所述UDM向所述NSSAAF发送指示信息，所述指示信息用于指示终端设备在服务网络的第一认证结果；若所述第一认证结果为认证成功，则所述NSSAAF向服务器发送第一协议信息；所述NSSAAF接收所述服务器发送的第二协议信息；响应于所述第二协议信息，所述NSSAAF向所述AMF发送第三认证请求；响应于所述第三认证请求，所述AMF向所述终端设备UE发送第一非接入层(non-access stratum，NAS)传输消息；所述AMF接收所述UE发送第二NAS传输消息；响应于所述第二NAS传输消息，所述AMF向所述NSSAAF发送第四认证请求；响应于所述第四认证请求，所述NSSAAF向所述服务器发送第三协议信息；所述NSSAAF接收所述服务器发送的第四协议信息；响应于所述第四协议信息，所述NSSAAF向所述AMF发送第二认证结果。
通过本发明提供的技术方案，UDM将该主认证的认证结果(终端设备在服务网络的认证结果)返回给NSSAAF，在认证结果为认证成功时，NSSAAF才会继续后续切片认证流程，从而可以防止恶意服务网绕过主认证直接进行切片认证的攻击。需要指出的是，如果服务网络绕过主认证直接向归属网络请求对终端设备进行切片认证，就会消耗归属网络资源，但最终切片认证不会成功，那么这个过程就可以理解为服务网络对归属网络的攻击。
其中，需要指出的是，主认证是指终端设备在接入网络过程中与网络侧进行的双向认证，举例来说，主认证可以是5G认证和密钥协商(5G authentication and key agreement，5G AKA)或可扩展认证协议的认证和密钥协商(Extensible Authentication Protocol authentication and key agreement，EAP AKA)认证等。其中，5G AKA和EAP AKA可参考标准协议3GPP  TS 33.501。
可选的，在本发明的一种实现方式中，所述第一认证请求包括服务网络名称(serving network name，SNN)。所述NSSAAF向UDM发送第二认证请求之前，所述NSSAAF判断所述SNN和期望的SNN是否一致；所述NSSAAF向UDM发送第二认证请求，包括：如果所述SNN和所述期望的SNN一致，则所述NSSAAF向UDM发送第二认证请求。进一步的，所述方法还包括：如果所述SNN和所述期望的SNN不一致，则NSSAAF向所述AMF发送停止认证的指示。其中，需要指出的是，第一认证请求中还包括令牌token，该另外，该token是网络存储功能(network function repository function，NRF)生成的。该token包括期望的SNN。另外，还需要指出的是，Token里面也许不包括SNN，而是包括服务网络标识(serving network identity，SN ID)，那么NSSAAF就可以将所述token中SN ID与所述SNN中的SN ID进行匹配。可以理解的是，如果匹配成功，则所述NSSAAF向UDM发送第二认证请求；如果匹配不成功，则NSSAAF向所述AMF发送停止认证的指示。
另外，在本发明的一种实现方式中，在主认证过程中或主认证结束之后，UDM或者AUSF可以将主认证的认证结果发送给NSSAAF，NSSAAF会保存该认证结果。后续的，在NSSAAF收到第一认证请求之后，NSSAAF就可以直接根据该认证结果确定是否向服务器发送第一协议信息，而不用在与UDM交互以获取所述主认证的认证结果。
可选的，在本发明的另一种实现方式中，所述方法还包括：在主认证成功之后，AMF会将终端设备的安全上下文状态发送给UDM，UDM会保存该终端设备的安全上下文状态，其中，该终端设备的安全上下文状态包括所述AMF的实例标识(instance indentity)。具体的，所述第二认证请求包括所述AMF的标识；响应于所述第二认证请求，所述UDM判断所述AMF的标识是否与所述终端设备的安全上下文状态中的AMF的实例标识是否相同，如果相同，所述UDM向所述NSSAAF发送指示信息，所述指示信息用于指示终端设备在服务网络的第一认证结果(该第一认证结果可以是主认证的认证结果)。通过上述技术方案，归属网络可以判断发起切片认证的AMF是否是合法的AMF，如果是合法的AMF就发送所述指示信息。如果不是合法的AMF就拒绝执行后续切片认证流程，从而可以防止浪费归属网络的资源。其中，需要指出的是，UDM以及NSSAF属于归属网络，AMF属于服务网络。
可选的，在本发明的另一种实现方式中，所述第二认证请求中携带所述AMF的服务网络名称；所述UDM向所述NSSAAF发送指示信息之前，所述方法还包括：所述UDM确定是否存在与所述服务网络名称匹配的认证结果。所述UDM向所述NSSAAF发送指示信息，包括：若存在与所述服务网络匹配的认证结果且所述认证结果为认证成功，则所述UDM向所述NSSAAF发送所述指示信息。可以理解的是，若存在与服务网络名称匹配的认证结果，说明UE已经通过了主认证，那么此时执行切片认证是合法的。通过上述判断流程，就可以排除潜在的风险，从而提高认证的安全性，防止浪费归属网络的信令资源。
可选的，在本发明的另一种实现方式中，所述方法还包括：若存在与所述服务网络名称相匹配的认证结果但是所述认证结果为认证失败，则所述UDM向所述NSSAAF发送用于指示停止认证的消息。可以理解的是，若所述认证结果为认证失败，说明UE尚未通过主认证，那么此时发起切片认证是不可能认证成功，因此，此时直接终止切片认证流程就可 以防止浪费归属网络的信令资源。
可选的，在本发明的另一种实现方式中，所述方法还包括：若不存在与所述服务网络名称相匹配的认证结果，则所述UDM向所述NSSAAF发送用于指示停止认证的消息。
举例来说，认证成功可以用success来表示，认证失败可以用failure来表示。举例来说，认证成功可以用True来表示，认证失败可以用False来表示。另外，表征认证成功或认证失败或未进行认证的方法有很多，在此不一一列举，也不做限制。
可选的，在本发明的另一种实现方式中，所述第二认证请求中携带所述用户设备的第一标识；所述方法还包括：所述UDM根据所述第一标识获取所述用户设备的第二标识；所述UDM向所述NSSAAF发送所述第二标识。
可选的，在本发明的另一种实现方式中，所述方法还包括：所述NSSAAF接收所述第二标识，并保存所述第一标识与所述第二标识的映射关系。
举例来说，第一标识可以是用户永久标识(subscription permanent identifier，SUPI)，第二标识可以是通用公共用户标识符(Generic Public Subscription Identifier，GPSI)。
需要指出的是，保存SUPI和GPSI的映射关系之后，NSSAAF就可以利用GPSI与外部的服务器或数据网络进行交互从而防止SUPI泄露，当NSSAAF收到外部服务器发送的GPSI就可以获得与GPSI对应的SUPI，然后利用SUPI与核心网内部的网元进行交互，从而保证核心网内部网元之间的高效通信。
再比如，第一标识可以是GPSI，第二标识可以是GPSI*。可以理解的是GPSI*是GPSI通过预设函数进行计算获得的。
可选的，在本发明的另一种实现的方式中，NSSAAF完成终端设备的切片认证之后，会向UDM发送切片认证的状态(比如认证成功或失败)，UDM会保存所述切片认证的状态。需要指出的是，后续其他网络可与UDM交互以查询所述切片认证的状态。具体的，举例来说，所述方法还包括：所述NSSAAF向所述UDM发送认证结果确认消息，所述认证结果确认消息包括所述第二认证结果，所述UDM保存所述第二认证结果。可选的，所述认证结果确认消息还包括SUPI/GPSI，单一网络切片选择辅助信息(Single-Network Slice Selection Assistance Information，S-NSSAI)以及服务网络名称。响应的，UDM也会保存所述SUPI/GPSI，S-NSSAI，以及服务网络名称。
可选的，在本发明的一种实现方式中，上述的集中可选方案可以进行组合，比如，所述第一认证请求包括服务网络名称。所述NSSAAF向UDM发送第二认证请求之前，所述NSSAAF判断所述SNN和期望的SNN是否一致；所述NSSAAF向UDM发送第二认证请求，包括：如果所述SNN和所述期望的SNN一致，则所述NSSAAF向UDM发送第二认证请求；如果第二认证请求中包括所述AMF的服务网络名称，所述UDM确定是否存在与所述服务网络名称匹配的认证结果。若存在与所述服务网络匹配的认证结果且所述认证结果为认证成功，则所述UDM向所述NSSAAF发送所述指示信息。如果第二认证请求中包括包括所述AMF的标识，所述UDM判断所述AMF的标识是否与所述终端设备的安全上下文状态中的AMF的实例标识是否相同，如果相同，所述UDM向所述NSSAAF发送指示信息。类似的，如果第二认证请求中既包括所述AMF的服务网络名称也包括所述AMF的ID，那么UDM可以选择其中的一个进行验证，也可以对上述两个参数都进行验证。举 例来说，如果需要对上述两个参数都进行验证，那么只有在两个参数都通过验证的情况下，才可以向所述NSSAAF发送所述指示信息。另外，需要指出的是，NSSAAF判断第一认证请求中的SNN和期望的SNN是否一致，可以防止AMF携带伪造的或者其他其他服务网络的名称来触发认证。UDM验证AMF ID，可以确认主认证是否已经成功。
第二方面，本申请提供了一种切片认证系统，该系统用于执行所述第一方面的切片认证的方法。具体的，所述系统包括：AMF，用于向NSSAAF发送第一认证请求；所述NSSAAF，用于响应于所述第一认证请求，向UDM发送第二认证请求；所述UDM，用于响应于所述第二认证请求，向所述NSSAAF发送指示信息，所述指示信息用于指示终端设备在服务网络的第一认证结果；所述NSSAAF，用于若所述第一认证结果为认证成功，则向服务器发送第一协议信息；接收所述服务器发送的第二协议信息；响应于所述第二协议信息，向AMF发送第三认证请求；所述AMF，用于响应于所述第三认证请求，向所述终端设备发送第一NAS传输消息；接收所述UE发送第二NAS传输消息；响应于所述第二NAS传输消息，向所述NSSAAF发送第四认证请求；所述NSSAAF，还用于响应于所述第四认证请求，向服务器发送第三协议信息；接收所述服务器发送的第四协议信息；响应于所述第四协议信息，则向所述AMF发送第二认证结果。
可选的，在本发明的另一种实现方式中，所述第二认证请求中携带所述AMF的服务网络名称；所述UDM，还用于确定是否存在与所述服务网络名称匹配的认证结果。所述UDM，具体用于若存在与所述服务网络匹配的认证结果且所述认证结果为认证成功，则向所述NSSAAF发送所述指示信息。
可选的，在本发明的另一种实现方式中，所述UDM，还用于若不存在与所述服务网络名称相匹配的认证结果，则向所述NSSAAF发送用于指示停止认证的消息。
可选的，在本发明的另一种实现方式中，所述第二认证请求中携带所述用户设备的第一标识SUPI；所述UDM，还用于根据所述SUPI获取所述用户设备的第二标识GPSI；向所述NSSAAF发送所述GPSI。
可选的，在本发明的另一种实现方式中，所述NSSAAF，还用于接收所述GPSI，并保存所述SUPI与所述GPSI的映射关系。
第三方面，本申请提供一种通信装置，所通信装置为第二方面所述的系统中的AMF或NSSAAF或UDM。所述通信装置包括处理单元和收发单元，其中，所述处理单元，用于按照第一方面或第二方面描述的功能进行信息处理；所述收发单元，用于按照第一方面或第二方面描述的功能进行信息的发送和接收。
第四方面，本申请提供一种通信装置，所通信装置为第二方面所述的系统中的AMF或NSSAAF或UDM。所述通信装置包括处理器和收发器，其中，所述处理单元，用于按照第一方面或第二方面描述的功能进行信息处理；所述收发单元，用于按照第一方面或第二方面描述的功能进行信息的发送和接收。
第五方面，本申请提供一种通信装置，所通信装置为第二方面所述的系统中的AMF或NSSAAF或UDM。所述通信装置包括存储器、处理器和收发器，其中，当存储器中的程序代码或指令被执行时，所述处理单元按照第一方面或第二方面描述的功能进行信息处理；所述收发单元按照第一方面或第二方面描述的功能进行信息的发送和接收。
第六方面，本申请提供一种通信装置，所通信装置为第二方面所述的系统中的AMF或NSSAAF或UDM。所述通信装置包括处理器和接口电路，其中，所述处理器，用于按照第一方面或第二方面描述的功能进行信息处理；所述接口电路，用于按照第一方面或第二方面描述的功能进行信息的发送和接收。
第七方面，本申请提供一种计算机可读存储介质，该计算机可读存储介质用于存储计算机程序，当其在计算机上运行时，使得上述第一方面或第二方面中的AMF，UDM或NSSAFF的功能会被执行。
第八方面，本申请提供一种计算机程序产品，该计算机程序产品包括计算机程序或计算机代码，当其在计算机上运行时，使得上述第一方面或第二方面中的AMF，UDM或NSSAFF的功能会被执行。
。
附图说明
图1是本申请实施例提供的一种通信系统的架构示意图；
图2是本申请实施例提供的一种切片认证方法的流程示意图；
图3是本申请实施例提供的另一种切片认证方法的流程示意图；
图4是本申请实施例提供的另一种切片认证方法的流程示意图；
图5是本申请实施例提供的另一种切片认证方法的流程示意图；
图6是本申请实施例提供的一种通信装置的结构示意图；
图7是本申请实施例提供的一种通信装置的结构示意图；
图8是本申请实施例提供的一种通信装置的结构示意图；
图9是本申请实施例提供的一种无线通信系统的示意图。
具体实施方式
为了使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请作进一步地描述。
本申请的说明书、权利要求书及附图中的术语“第一”和“第二”等仅用于区别不同对象，而不是用于描述特定顺序。此外，术语“包括”和“具有”以及它们的任何变形，意图在于覆盖不排他的包含。例如包含了一系列步骤或单元的过程、方法、系统、产品或设备等，没有限定于已列出的步骤或单元，而是可选地还包括没有列出的步骤或单元等，或可选地还包括对于这些过程、方法、产品或设备等固有的其它步骤或单元。
在本文中提及的“实施例”意味着，结合实施例描述的特定特征、结构或特性可以包含在本申请的至少一个实施例中。在说明书中的各个位置出现该短语并不一定均是指相同的实施例，也不是与其它实施例互斥的独立的或备选的实施例。本领域技术人员可以显式地和隐式地理解的是，本文所描述的实施例可以与其它实施例相结合。
在本申请中，“至少一个(项)”是指一个或者多个，“多个”是指两个或两个以上，“至少两个(项)”是指两个或三个及三个以上，“和/或”，用于描述关联对象的关联关系，表示可以存在三种关系，例如，“A和/或B”可以表示：只存在A，只存在B以及同时存在A和 B三种情况，其中A，B可以是单数或者复数。字符“/”一般表示前后关联对象是一种“或”的关系。“以下至少一项(个)”或其类似表达，是指这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a，b或c中的至少一项(个)，可以表示：a，b，c，“a和b”，“a和c”，“b和c”，或“a和b和c”，其中a，b，c可以是单个，也可以是多个。
下面对本申请应用的通信系统进行介绍：
本申请提供的技术方案可以应用于各种通信系统。一个通信系统中，由运营者运营的部分可称为公共陆地移动网络(public land mobile network，PLMN)(也可以称为运营商网络等)。PLMN是由政府或其所批准的经营者，为公众提供陆地移动通信业务目的而建立和经营的网络，主要是移动网络运营商(mobile network operator，MNO)为用户提供移动宽带接入服务的公共网络。本申请中所描述的PLMN，具体可为符合第三代合作伙伴项目(3rd generation partnership project，3GPP)标准要求的网络，简称3GPP网络。3GPP网络通常包括但不限于第五代移动通信(5th-generation，5G)网络(简称5G网络)、第四代移动通信(4th-generation，4G)网络(简称4G网络)等。为了方便描述，本申请实施例中将以PLMN为例进行说明。或者，本申请提供的技术方案还可以应用于长期演进(long term evolution，LTE)系统、LTE频分双工(frequency division duplex，FDD)系统、LTE时分双工(time division duplex，TDD)、通用移动通信系统(universal mobile telecommunication system，UMTS)、全球互联微波接入(worldwide interoperability for microwave access，WiMAX)通信系统、第五代(5th generation，5G)通信系统或新无线(new radio，NR)以及未来的其他通信系统如6G、7G等。
随着移动带宽接入服务的扩展，移动网络也会随之发展以便更好地支持多样化的商业模式，满足更加多样化的应用业务以及更多行业的需求。例如，为了给更多的行业提供更好、更完善的服务，5G网络相对于4G网络做了网络架构调整。如5G网络将4G网络中的移动管理实体(mobility management entity，MME)进行拆分，拆分为包括接入与移动性管理功能(access and mobility management function，AMF)和会话管理功能(session management function，SMF)等多个网络功能。
图1是本申请实施例的一种网络架构示意图，它以3GPP标准化过程中定义的非漫游场景下基于服务化架构的5G网络架构为例。该网络架构可以包括三部分，分别是终端设备部分、PLMN和数据网络(data network，DN)。
终端设备部分可以包括终端设备110，该终端设备110也可以称为用户设备(user equipment，UE)。本申请中的终端设备110是一种具有无线收发功能的设备，可以经无线接入网(radio access network，RAN)140中的接入网设备(或者也可以称为接入设备)与一个或多个核心网(core network，CN)设备(或者也可以称为核心设备)进行通信。终端设备110也可称为接入终端、终端、用户单元、用户站、移动站、移动台、远方站、远程终端、移动设备、用户终端、用户代理或用户装置等。终端设备110可以部署在陆地上，包括室内或室外、手持或车载；也可以部署在水面上(如轮船等)；还可以部署在空中(例如飞机、气球和卫星上等)。终端设备110可以是蜂窝电话(cellular phone)、无绳电话、会话启动协议(session initiation protocol，SIP)电话、智能电话(smart phone)、手机(mobile phone)、无线本地环路(wireless local loop，WLL)站、个人数字处理(personal digital assistant， PDA)等。或者，终端设备110还可以是具有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它设备、车载设备、可穿戴设备、无人机设备或物联网、车联网中的终端、5G网络以及未来网络中的任意形态的终端、中继用户设备或者未来演进的PLMN中的终端等。其中，中继用户设备例如可以是5G家庭网关(residential gateway，RG)。例如终端设备110可以是虚拟现实(virtual reality，VR)终端、增强现实(augmented reality，AR)终端、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端等。本申请实施例对终端设备的类型或种类等并不限定。
PLMN可以包括：特定网络切片的认证和授权功能(Network Slice-Specific Authentication and Authorization function，NSSAAF)131、网络存储功能(network function repository function，NRF)132、策略控制功能(policy control function，PCF)133、统一数据管理(unified data management，UDM)134、应用功能(application function，AF)135、认证服务器功能(authentication server function，AUSF)136、接入与移动性管理功能(access and mobility management function，AMF)137、会话管理功能(session management function，SMF)138、用户面功能(user plane function，UPF)139以及(无线)接入网((radio)access network，(R)AN)140等。上述PLMN中，除(无线)接入网140部分之外的部分可以称为核心网络(core network，CN)部分或核心网部分。
数据网络DN 120，也可以称为分组数据网络(packet data network，PDN)，通常是位于PLMN之外的网络，例如第三方网络。示例性的，PLMN可以接入多个数据网络DN 120，数据网络DN 120上可部署多种业务，从而为终端设备110提供数据和/或语音等服务。例如，数据网络DN 120可以是某智能工厂的私有网络，智能工厂安装在车间的传感器可为终端设备110，数据网络DN 120中部署了传感器的控制服务器，控制服务器可为传感器提供服务。传感器可与控制服务器通信，获取控制服务器的指令，根据指令将采集的传感器数据传送给控制服务器等。又例如，数据网络DN 120可以是某公司的内部办公网络，该公司员工的手机或者电脑可为终端设备110，员工的手机或者电脑可以访问公司内部办公网络上的信息、数据资源等。终端设备110可通过PLMN提供的接口(例如图1中的N1接口等)与PLMN建立连接，使用PLMN提供的数据和/或语音等服务。终端设备110还可通过PLMN访问数据网络DN 120，使用数据网络DN 120上部署的运营商业务，和/或第三方提供的业务。其中，上述第三方可为PLMN和终端设备110之外的服务方，可为终端设备110提供其他数据和/或语音等服务。其中，上述第三方的具体表现形式，具体可根据实际应用场景确定，在此不做限制。
示例性的，下面对PLMN中的网络功能进行简要介绍。
(R)AN 140是PLMN的子网络，是PLMN中业务节点(或网络功能)与终端设备110之间的实施系统。终端设备110要接入PLMN，首先是经过(R)AN 140，进而通过(R)AN 140与PLMN中的业务节点连接。本申请实施例中的接入网设备，是一种为终端设备110提供无线通信功能的设备，也可以称为接入设备、(R)AN设备或网络设备等。如该接入设备包括但不限于：5G系统中的下一代基站(next generation node basestation，gNB)、 LTE系统中的演进型基站(evolved node B，eNB)、无线网络控制器(radio network controller，RNC)、节点B(node B，NB)、基站控制器(base station controller，BSC)、基站收发台(base transceiver station，BTS)、家庭基站(home evolved nodeB，或home node B，HNB)、基带单元(base band unit，BBU)、传输接收点(transmitting and receiving point，TRP)、发射点(transmitting point，TP)、小基站设备(pico)、移动交换中心，或者未来网络中的网络设备等。可理解，本申请对接入网设备的具体类型不作限定。采用不同无线接入技术的系统中，具备接入网设备功能的设备的名称可能会有所不同。
可选的，在接入设备的一些部署中，接入设备可以包括集中式单元(centralized unit，CU)和分布式单元(distributed unit，DU)等。在接入设备的另一些部署中，CU还可以划分为CU-控制面(control plane，CP)和CU-用户面(user plan，UP)等。在接入设备的又一些部署中，接入设备还可以是开放的无线接入网(open radio access network，ORAN)架构等，本申请对于接入设备的具体部署方式不作限定。
特定网络切片的认证和授权功能NSSAAF 131，用于对切片进行认证和授权。
网络存储功能NRF 132，可用于维护网络中所有网络功能服务的实时信息。
策略控制功能PCF 133是由运营商提供的控制面功能，用于向会话管理功能SMF 138提供协议数据单元(protocol data unit，PDU)会话的策略。策略可以包括计费相关策略、QoS相关策略和授权相关策略等。
统一数据管理UDM 134是由运营商提供的控制面功能，负责存储PLMN中签约用户的用户永久标识符(subscriber permanent identifier，SUPI)、安全上下文(security context)、签约数据等信息。上述PLMN的签约用户具体可为使用PLMN提供的业务的用户，例如使用中国电信的终端设备芯卡的用户，或者使用中国移动的终端设备芯卡的用户等。示例性的，签约用户的SUPI可为终端设备芯卡的号码等。上述安全上下文可以为存储在本地终端设备(例如手机)上的数据(cookie)或者令牌(token)等。上述签约用户的签约数据可以为该终端设备芯卡的配套业务，例如该手机芯卡的流量套餐等。
应用功能AF 135，用于进行应用影响的数据路由，接入网络开放功能，与策略框架交互进行策略控制等。
认证服务器功能AUSF 136是由运营商提供的控制面功能，通常用于一级认证，即终端设备110(签约用户)与PLMN之间的认证。
接入与移动性管理功能AMF 137是由PLMN提供的控制面网络功能，负责终端设备110接入PLMN的接入控制和移动性管理，例如包括移动状态管理，分配用户临时身份标识，认证和授权用户等功能。
会话管理功能SMF 138是由PLMN提供的控制面网络功能，负责管理终端设备110的协议数据单元(protocol data unit，PDU)会话。PDU会话是一个用于传输PDU的通道，终端设备需要通过PDU会话与DN 120互相传输PDU。PDU会话可以由SMF 138负责建立、维护和删除等。SMF 138包括会话管理(如会话建立、修改和释放，包含UPF 139和(R)AN 140之间的隧道维护等)、UPF 139的选择和控制、业务和会话连续性(service and session continuity，SSC)模式选择、漫游等会话相关的功能。
用户面功能UPF 139是由运营商提供的网关，是PLMN与DN 120通信的网关。UPF  139包括数据包路由和传输、包检测、业务用量上报、服务质量(quality of service，QoS)处理、合法监听、上行包检测、下行数据包存储等用户面相关的功能。
图1所示的PLMN中的网络功能还可以包括网络切片选择功能(network slice selection function，NSSF)(图1中未示出)，用于负责确定网络切片实例，选择AMF网络功能137等。图1所示的PLMN中的网络功能还可以包括统一数据存储(unified data repository，UDR)等，本申请实施例对于PLMN中包括的其他网络功能不作限定。
图1中Nnef、Nausf、Nnrf、Npcf、Nudm、Naf、Namf、Nsmf、N1、N2、N3、N4，以及N6为接口序列号。示例性的，上述接口序列号的含义可参见3GPP标准协议中定义的含义，本申请对于上述接口序列号的含义不做限制。需要说明的是，图1中仅以终端设备110为UE作出了示例性说明，图1中的各个网络功能之间的接口名称也仅仅是一个示例，在具体实现中，该系统架构的接口名称还可能为其他名称，本申请对此不作限定。
本申请中的移动性管理网络功能可以是图1所示的AMF 137，也可以是未来通信系统中的具有上述接入与移动性管理功能AMF 137的其他网络功能。或者，本申请中的移动性管理网络功能还可以是LTE系统中的移动管理实体(mobility management entity，MME)等。
为方便说明，本申请实施例中将接入与移动性管理功能AMF 137简称为AMF，将统一数据管理UDM 134简称为UDM，将终端设备110称为UE，即本申请实施例中后文所描述的AMF均可替换为移动性管理网络功能，UDM均可替换为统一数据管理，UE均可替换为终端设备。可理解，其他未示出的网络功能同样适用该替换方法。
图1中示出的网络架构(例如5G网络架构)采用基于服务的架构和通用接口，传统网元功能基于网络功能虚拟化(network function virtualization，NFV)技术拆分成若干个自包含、自管理、可重用的网络功能服务模块。图1中示出的网络架构示意图可以理解为一种非漫游场景下基于服务的5G网络架构示意图。在该架构中，根据特定场景需求，将不同网络功能按需有序组合，可以实现网络的能力与服务的定制化，从而避免为不同业务部署专用的物理网络。网络切片技术可以使运营商能够更加灵活、快速地响应客户需求，支持网络资源的灵活分配。
以下对本申请涉及的切片和切片认证进行介绍。
切片简单理解就是将运营商的物理网络切割成多个虚拟的端到端的网络，每个虚拟网络之间(包括网络内的设备、接入网、传输网和核心网)是逻辑独立的，任何一个虚拟网络发生故障都不会影响到其它虚拟网络。为了满足多样性需求和切片间的隔离，需要业务间相对独立的管理和运维，并提供量身定做的业务功能和分析能力。不同业务类型的实例可以部署在不同的网络切片上，相同业务类型的不同实例也可部署在不同的网络切片上。切片可以由一组网络功能(network function，NF)和/或子网络等构成。比如，图1中的子网络(R)AN 140、AMF 137、SMF 138、UPF 139可以组成一个切片。可理解，图1中的每种网络功能只示意性地画出了一个，而在实际网络部署中，每种网络功能或子网络可以有多个、数十个或上百个。PLMN中可以部署很多切片，每个切片可以有不同的性能来满足不同应用、不同垂直行业的需求。运营商可以根据不同垂直行业客户的需求，“量身定做”一个切片。运营商也可以允许一些行业客户享有较大的自主权，参与切片的部分管理、控 制功能。其中，切片级的认证就是由行业客户有限参与的一种网络控制功能，即对终端设备接入切片进行认证和授权，即“切片级认证”，也可称为“二级认证”、“二次认证”等，本申请简称为“切片认证”。
终端设备在被允许接入网络或切片之前，需要与网络和/或切片进行双向认证并得到该网络和/或切片的授权。一般的，网络需要对终端设备经过一次或者两次的认证与授权才能接入网络或切片。首先，PLMN要基于终端设备所使用的与PLMN签约的SUPI进行认证，这种认证被称为一级认证或主认证(primary authentication)，常见的主认证包括5G AKA或EAP AKA。其次，PLMN要基于终端设备所使用的与DN的签约标识进行认证，即切片认证或二级认证等。
如以图1为例，当核心网中部署了切片，UE 110需要接入到某个切片时，UE 110可以提供请求的切片给核心网。其中，UE 110请求的切片可以包括请求的网络切片选择辅助信息集合(requested network slice selection assistance information，requested NSSAI)。该NSSAI可以包括一个或多个单网络切片选择辅助信息(single network slice selection assistance information，S-NSSAI)，一个S-NSSAI用于标识一个网络切片类型，也可以理解为，S-NSSAI用于标识切片，或者可以理解为S-NSSAI是切片的标识信息。可理解，本申请中切片还可以称为网络切片、网络切片实例或S-NSSAI等，本申请对于该切片的名称不作限定。为方便理解，在后文的描述中，本申请对切片或S-NSSAI等不做严格区分，二者可以同样适用。
进一步的，UE 110向网络发送注册请求后，核心网网络功能(如AMF网络功能137或NSSF网络功能)根据UE 110的签约数据、UE 110请求的网络切片、漫游协议以及本地配置等信息，为UE 110选择允许接入的网络切片集合。其中，允许接入的网络切片集合可以用允许的(allowed)NSSAI来表示，允许的NSSAI中包括的S-NSSAI可以为当前PLMN允许该UE 110接入的S-NSSAI。
举例说明一级认证和二级认证，示例性的，随着垂直行业和物联网的发展，PLMN之外的数据网络DN 120(如服务于垂直行业的DN)，对于接入到该DN 120的UE 110同样有认证与授权的需求。比如，某商业公司提供了游戏平台，通过PLMN为游戏玩家提供游戏服务。一方面，由于玩家使用的UE 110是通过PLMN接入游戏平台，因此PLMN需要对该UE 110的身份(SUPI)进行认证或授权等，即一级认证。游戏玩家是商业公司的客户，该商业公司也需要对游戏玩家的身份进行认证或授权。如对游戏玩家的身份进行认证或授权，这种认证可以是基于切片的认证，或者说认证是以切片为单位。该情况下，这种认证可以被称为切片认证(slice authentication)，或称为基于网络切片的认证(network slice-specific authentication and authorization，NSSAA)。
需要说明的是，切片认证的实际含义如可以是：终端设备与第三方网络(如DN或其认证服务器)之间执行的认证。切片认证结果将会决定PLMN是否授权终端设备接入该PLMN提供的切片。还应理解，本申请中应用于切片认证的方法也同样适用于基于会话的二次认证(secondary authentication)或基于切片的二次认证等场景，在此不再详述。
以下详细介绍本申请提供的切片认证方法。
图2是本申请实施例提供的一种切片认证方法的流程示意图，该方法可以应用于图1所示的网络。可理解，图2示出的是切片认证方法，对于UE与PLMN网络之间的一级认 证方法，本申请实施例不作限定。图2中负责切片认证的服务器为认证、授权和计费服务器(authentication、authorization、accounting server，AAA-S)，该AAA-S可以部署于PLMN网络之内；或者，该AAA-S也可以部署于PLMN网络之外。在该AAA-S部署于网络之外时，UE可以通过PLMN网络之内部署的AAA代理(AAA-proxy，AAA-P)所提供的代理服务来转接AAA-S，实现UE与AAA-S之间的认证消息交互。图2中的网络切片认证与授权功能(network slice-specific authentication and authorization function，NSSAAF)是协助完成切片认证的网络功能。在另一种实现方式中，AUSF或其他NF等可以替代NSSAAF协助完成切片认证。因此，本申请实施例对于协助完成切片认证的网络功能(如NSSAAF、AUSF或其他NF)不作限定。进一步的，在一些部署方式中，AAA-P可以与NSSAAF分开部署；在另一些部署方式中，AAA-P可以与NSSAAF(或AUSF)部署在一起。因此，本申请实施例对于AAA-P和NSSAAF(或AUSF)的部署方式不作限定。
图2所示的是AAA-S部署于PLMN网络之外，即UE通过PLMN网络内部的AAA-P提供代理服务，转接AAA-S实现切片认证，同时该AAA-P和NSSAAF(或AUSF)是分开部署的。但是对于其他部署情况，本申请实施例同样适用。
如图2所示，该切片认证方法包括：
201、AMF向NSSAAF发送第一认证请求消息；
相应的，该NSSAAF接收该第一请求消息。
可理解，为便于描述，以下涉及切片的标识信息时，切片的标识信息以S-NSSAI表示。UE的标识信息可以以可公开使用的签约标识(generic public subscription identifier，GPSI)或SUPI表示，但是不应将其理解为对本申请实施例的限定。
可选的，该第一请求消息中携带EAP ID响应、S-NSSAI和UE的标识信息。
可选的，该第一请求消息中携带EAP ID响应、S-NSSAI、UE的标识信息和服务网络名称。
可选的，该第一请求消息中携带EAP ID响应、S-NSSAI、UE的标识信息和AMF ID。
可选的，该第一请求消息中携带EAP ID响应、S-NSSAI、UE的标识信息，服务网络名称和AMF ID。
举例来说，UE的标识信息可以是GPSI或SUPI。
202、响应于所述第一认证请求，所述NSSAAF向UDM发送第二认证请求；
举例来说，该第一认证请求可以是Nssaaf_NSSAA_Authenticate Req消息；该第二认证请求可以是Authentication info Req消息。
203、响应于所述第二认证请求，所述UDM向所述NSSAAF发送指示信息，所述指示信息用于指示终端设备在服务网络的第一认证结果；
举例来说，所述指示信息可以是所述第一认证结果。
举例来说，该指示信息也可以是用于指示是否允许做切片认证。
举例来说，该指示信息还可以用于指示UE在该SN的注册状态。
举例来说，该指示信息还可以用于指示是否需要进行主认证。需要指出的是，主认证可以是5G AKA认证或EAP AKA认证，在此不一一列举。
204、若所述第一认证结果为认证成功，则所述NSSAAF向服务器发送第一协议信息；
举例来说，所述第一协议信息可以是AAA protocol message。
举例来说，该服务器可以是AAA-S服务器。
205、所述NSSAAF接收所述服务器发送的第二协议信息；
举例来说，所述第二协议信息也可以是AAA protocol message。
206、响应于所述第二协议信息，所述NSSAAF向所述AMF发送第三认证请求；
举例来说，该第三认证请求消息可以是Nssaaf_NSSAA_Authenticate Resp消息。
207、响应于所述第三认证请求，所述AMF向所述终端设备发送第一NAS传输消息；
208、所述AMF接收所述UE发送第二NAS传输消息；
209、响应于所述第二NAS传输消息，所述AMF向所述NSSAAF发送第四认证请求；
举例来说，该第四认证请求消息可以是Nssaaf_NSSAA_Authenticate Request消息。
210、响应于所述第四认证请求，所述NSSAAF向服务器发送第三协议信息；
举例来说，所述第三协议信息可以是AAA protocol message。
211、所述NSSAAF接收所述服务器发送的第四协议信息；
举例来说，所述第四协议信息可以是AAA protocol message。
举例来说，第四协议信息用于表征切片认证的成功或者失败。可以理解的是在收到第四协议信息之前，切片认证过程可能包括多轮类似步骤205-210的交互。
举例来说，所述第四协议信息中可能包括切片认证的结果，比如认证成功或认证失败。
212、响应于所述第四协议信息，所述NSSAAF向所述AMF发送第二认证结果。
举例来说，所述NSSAAF向所述AMF发送Nssaaf_NSSAA_Authenticate Resp消息。其中，所述第二认证结果可以携带在Nssaaf_NSSAA_Authenticate Resp消息中。
举例来说，如果第四协议信息携带的切片认证结果为认证成功，则所述NSSAAF向所述AMF发送的第二认证结果为认证成功(或切片认证成功)。可以理解的是，该第二认证结果用于表征切片认证的结果。表征的方式有很多，比如success表征认证成功，failure表征认证失败。True表征认证成功，false表征认证失败等等。
举例来说，如果第四协议信息携带的切片认证结果为认证失败，则所述NSSAAF向所述AMF发送的第二认证结果为认证失败(或切片认证失败)。
根据上述方案可知，AMF在触发切片认证流程之后，NSSAAF会与UDM交互以确定UE是否成功的进行了主认证，如果成功UE已经成功的进行了主认证，那么NSSAAF会继续后续的切片认证流程，否则将会拒绝进行切片认证。通过上述技术方案，可以防止AMF绕过主认证对归属网络进行攻击，从而保证了切片认证的安全性。需要指出的是，在UE没有通过主认证的情况下，如果AMF发起切片认证，那么后续会消耗很归属网络的信令资源，但是最终切片认证会失败。因此，在进行切片认证之前进行主认证的认证状态，可以提高切片认证的效率以及安全性。
在本发明的另一个实施例中，在步骤201之前，AMF可以从UDM中获取UE的标识为S-NSSAI的切片的签约信息。AMF可以根据UE待接入的切片的标识信息和/或该UE关于该切片的签约信息来确定是否需要执行对该切片的切片认证。如果需要执行对该切片的切片认证，AMF向UE发送用于切片认证的可扩展身份验证协议(extensible authentication protocol，EAP)ID请求(request)；相应的，该UE接收该用于切片认证的EAP ID请求， UE向AMF发送EAP ID响应(response)。如果不需要执行对该切片的切片认证，则该AMF可以向UE直接发送拒绝接入该切片的消息等。另外，如果该AMF记录(或存储)了UE已经完成过针对该切片的切片认证，则直接允许UE接入该切片。或者进一步的，如果该AMF记录(或存储)了UE已经完成过针对该切片的切片认证且认证的时间再有效期内，则直接允许UE接入该切片。
其中，需要指出的是，EAP是由国际标准组织-国际互联网工程任务组(internet engineering task force，IETF)制定。该EAP ID请求可以承载于3GPP网络中的非接入层(non access stratum，NAS)消息中，该NAS消息中还可以携带切片的标识信息如S-NSSAI，该S-NSSAI可以用于表示该EAP ID请求是针对该S-NSSAI的切片认证请求。
在本发明的另一个实施例中，如图3所示，图3是在图2基础上，优化了步骤201和202，以及增加了NSSAAF的判断步骤301。其中，步骤201，202以及301具体包括：
201、AMF向NSSAAF发送第一认证请求消息，其中，所述第一认证请求包括服务网络名称SNN；
可以理解的都是，第一认证请求消息也可以是缩写为第一认证请求。同理，后续的第二认证请求消息也可以缩写为第二认证请求，在此不一一列举。
可选的，该第一请求消息中还可以携带EAP ID响应、S-NSSAI和UE的标识信息。
可选的，该第一请求消息中还可以携带EAP ID响应、S-NSSAI、UE的标识信息和AMF ID。
举例来说，UE的标识信息可以是GPSI或SUPI。
301、所述NSSAAF判断所述SNN和期望的SNN是否一致；
其中，需要指出的是，所述第一认证请求消息中还包括令牌token。其中，该令牌token是NRF为所述AMF生成的。另外，可选的，该NSSAAF还可以根据所述AMF的ID从所述NRF获取与所述AMF ID对应的token。
举例来说，若所述token里面包括所述期望的SNN，则NSSAAF将所述token里面的SNN与所述第一认证请求中的SNN进行匹配。
举例来说，若所述token里面包括SN ID，则所述NSSAAF判断所述SNN和期望的SNN是否一致，包括：所述NSSAAF判断所述token里面的SN ID与所述第一认证请求中的SNN的SNID是否一致。可以理解的是SNN包括前缀码和SNID。比如前缀码可以是字符串“5G”，“5G AKA”或“5G EAP AKA”等。举例来说，SN ID可以是PLMN ID。
202、如果所述SNN和所述期望的SNN一致，则所述NSSAAF向UDM发送第二认证请求；
其中，需要指出的是，所述SNN和所述期望的SNN一致，包括：所述SNN和所述期望的SNN一致完全一致。当然，也包括：前N个bit位的字符串完全一致或者截取的相同位置的相同长度的字符串完全一致，其中，N为正整数。
举例来说，该第一认证请求可以是Nssaaf_NSSAA_Authenticate Req消息；该第二认证请求可以是Authentication info Req消息。
可选的，所述方法还包括：如果所述SNN和所述期望的SNN不一致，则NSSAAF向 所述AMF发送停止认证的指示。
另外，在本发明的一种实现方式中，在主认证过程中或主认证结束之后，UDM或者AUSF可以将认证结果发送给NSSAAF，NSSAAF会保存该认证结果。然后，在NSSAAF收到第一认证请求之后，NSSAAF就可以直接根据该认证结果确定是否向服务器发送第一协议信息，而不用在与UDM交互以获取所述认证结果。
通过上述技术方案可知，NSSAAF可以判断AMF所述使用的SNN是否合法，如果SNN不合法，则提前终止该切片认证的流程，从而防止信令资源的浪费。
在本发明的另一个实施例中，如图4所示，图5是在图2或图3基础上，优化了步骤202，步骤203，以及增加UDM的判断步骤401。其中，步骤202，203以及401具体包括：
202、响应于所述第一认证请求，所述NSSAAF向UDM发送第二认证请求，其中所述第二认证请求包括所述AMF ID；
举例来说，该第一认证请求可以是Nssaaf_NSSAA_Authenticate Req消息；该第二认证请求可以是Authentication info Req消息。
401、所述UDM判断所述AMF的标识与终端设备的安全上下文状态中的AMF的实例标识是否相同；
其中，需要指出的是，如果在AMF触发切片认证之前，UE与核心网成功的进行了双向认证(主认证)，那么AMF会将终端设备的安全上下文状态发送给UDM，UDM会保存该终端设备的安全上下文状态，其中，该终端设备的安全上下文状态包括所述AMF的实例标识。
203、如果所述AMF的标识与终端设备的安全上下文状态中的AMF的实例标识相同，所述UDM向所述NSSAAF发送指示信息，所述指示信息用于指示终端设备在服务网络的第一认证结果；
举例来说，所述指示信息可以是所述第一认证结果。第一认证结果可以是主认证的认证结果(即UE与核心网的双向认证的结果)。举例来说，该认证结果可以是成功或失败或未进行认证。比如success标识成功，failure标识失败或未认证。比如True标识成功，False标识失败或未认证。比如1标识成功，0标识失败或未认证。标识成功或者失败的方法有很多，在此不做限制也不一一例举。
举例来说，该指示信息也可以是用于指示是否允许做切片认证。
举例来说，该指示信息还可以用于指示UE在该SN的注册状态。
举例来说，该指示信息还可以用于指示是否需要进行主认证。需要指出的是，主认证可以是5G AKA认证或EAP AKA认证，在此不一一列举。
通过上述技术方案，归属网络可以判断发起切片认证的AMF是否是合法的AMF，如果是合法的AMF就发送所述指示信息。如果不是合法的AMF就拒绝执行后续切片认证流程，从而可以防止浪费归属网络的资源。其中，需要指出的是，UDM以及NSSAF属于归属网络，AMF属于服务网络。
在本发明的另一个实施例中，如图5所示，图5是在图2至图4任一附图的基础上，优化了步骤202，步骤203，以及增加UDM的判断步骤501。其中，步骤202，203以及501具体包括：
202、响应于所述第一认证请求，所述NSSAAF向UDM发送第二认证请求，其中所述第二认证请求包括所述AMF的服务网络名称；
举例来说，该第一认证请求可以是Nssaaf_NSSAA_Authenticate Req消息；该第二认证请求可以是Authentication info Req消息。
501、所述UDM确定是否存在与所述服务网络名称匹配的认证结果；
举例来说，UDM可以根据服务网络名称遍历数据库以确定搜索结果，若搜索结果为空，则证明没有雨服务网络名称匹配的认证结果；若搜索结果不为空，则存在与所述服务网络名称匹配的认证结果。
203、若存在与所述服务网络匹配的认证结果且所述认证结果为认证成功，所述UDM向所述NSSAAF发送指示信息，所述指示信息用于指示终端设备在服务网络的第一认证结果；
举例来说，所述指示信息可以是所述第一认证结果(即与服务网络匹配的认证结果)。第一认证结果可以是主认证的认证结果(即UE与核心网的双向认证的结果)。举例来说，该认证结果可以是成功或失败或未进行认证。比如success标识成功，failure标识失败或未认证。比如True标识成功，False标识失败或未认证。比如1标识成功，0标识失败或未认证。标识成功或者失败的方法有很多，在此不做限制也不一一例举。
举例来说，该指示信息也可以是用于指示是否允许做切片认证。
举例来说，该指示信息还可以用于指示UE在该SN的注册状态。
举例来说，该指示信息还可以用于指示是否需要进行主认证。需要指出的是，主认证可以是5G AKA认证或EAP AKA认证，在此不一一列举。
可以理解的是，若存在与服务网络名称匹配的认证结果，说明UE已经通过了主认证，那么此时执行切片认证是合法的。通过上述判断流程，就可以排除潜在的风险，从而提高认证的安全性，防止浪费归属网络的信令资源。
可选的，在本发明的另一种实现方式中，所述方法还包括：若存在与所述服务网络名称相匹配的认证结果但是所述认证结果为认证失败，则所述UDM向所述NSSAAF发送用于指示停止认证的消息。可以理解的是，若所述认证结果为认证失败，说明UE尚未通过主认证，那么此时发起切片认证是不可能认证成功，因此，此时直接终止切片认证流程就可以防止浪费归属网络的信令资源。
可选的，在本发明的另一种实现方式中，所述方法还包括：若不存在与所述服务网络名称相匹配的认证结果，则所述UDM向所述NSSAAF发送用于指示停止认证的消息。
举例来说，认证成功可以用success来表示，认证失败可以用failure来表示。
举例来说，认证成功可以用True来表示，认证失败可以用False来表示。
举例来说，认证成功可以用于1来表示，认证失败可以有0来表示。
另外，需要指出的是，表征认证成功或认证失败的方法有很多，本发明再次不做限制也不一一列举。
另外，可选的，在附图2-5任一附图的基础上，还包括用户标识的隐私保护的方法。具体方法包括：所述第二认证请求中携带所述用户设备的第一标识；所述UDM接收到所述第二认证请求之后，所述UDM根据所述获取所述用户设备的第二标识；所述UDM向所 述NSSAAF发送所述第二标识。可选的，在本发明的另一种实现方式中，所述方法还包括：所述NSSAAF接收所述第二百事，并保存所述第一标识与所述第二标识的映射关系。
需要指出的是，保存第一标识和第一标识的映射关系之后，NSSAAF就可以利用第二标识与外部的服务器或数据网络进行交互从而防止第一标识泄露，当NSSAAF收到外部服务器发送的第二标识，就可以获得与第二标识对应的第一标识，然后利用第一标识与核心网内部的网元进行交互，从而保证核心网内部网元之间的高效通信。举例来说，当第一标识是SUPI时，所述第二标识为GPSI；举例来说，当第一标识为GPSI时，第二标识为GPSI*。
另外，可选的，在附图2-5任一附图的基础上，还包括切片认证结果的存储方法。具体的，NSSAAF完成终端设备的切片认证之后，会向UDM发送切片认证的状态(比如认证成功或失败)，UDM会保存所述切片认证的状态。需要指出的是，后续其他网络可与UDM交互以查询所述切片认证的状态，然后根据切片认证的状态执行其他的流程或者发起其他的业务。具体的，举例来说，所述方法具体包括：所述NSSAAF向所述UDM发送认证结果确认消息，所述认证结果确认消息包括所述第二认证结果，所述UDM保存所述第二认证结果。可选的，所述认证结果确认消息还包括SUPI/GPSI，S-NSSAI，和或服务网络名称。相应地，UDM也会保存所述SUPI/GPSI，S-NSSAI，和或服务网络名称。
以下详细介绍本申请提供的通信装置。
图6是本申请实施例提供的一种通信装置的结构示意图，该通信装置可以是上述实施例中的AMF，也可以是UDM，还可以是NSSAAF。具体的，该通信装置包括收发单元601和处理单元602。其中所述处理单元602与所述收发单元601耦合，处理单元602可通过收发单元601进行数据的接收和发送。
示例性的，该通信装置可以用于执行图2至图5任一项由NSSAAF执行的操作。
处理单元602，用于接收AMF发送的第一认证请求；响应于所述第一认证请求，向UDM发送第二认证请求；接收所述UDM发送的指示信息，所述指示信息用于指示终端设备在服务网络的第一认证结果；若所述第一认证结果为认证成功，则向服务器发送第一协议信息；接收所述服务器发送的第二协议信息；响应于所述第二协议信息，向AMF发送第三认证请求；接收所述AMF发送的第四认证请求；响应于所述第四认证请求，向服务器发送第三协议信息；接收所述服务器发送的第四协议信息；响应于所述第四协议信息，向所述AMF发送第二认证结果。
可选的，所述第二认证请求中携带所述用户设备的第一标识；所述处理单元602，还用于接收所述UDM发送的第二标识；并保存所述第一标识与所述第二标识的映射关系。
可选的，所述第一认证请求包括服务网络名称SNN；所述处理单元602，还用于判断所述SNN和期望的SNN是否一致；如果所述SNN和所述期望的SNN一致，则所述NSSAAF向UDM发送第二认证请求。
示例性的，该通信装置可以用于执行图2至图5任一项由UDM执行的操作。
所述处理单元602，用于接收NSSAAF发送的第二认证请求；响应于所述第二认证请求，向所述NSSAAF发送指示信息，所述指示信息用于指示终端设备在服务网络的第一认证结果。
可选的，所述第二认证请求中携带所述AMF的服务网络名称；所述处理单元602，还 用于确定是否存在与所述服务网络名称匹配的认证结果；所述处理单元602，具体用于若存在与所述服务网络匹配的认证结果且所述认证结果为认证成功，则向所述NSSAAF发送所述指示信息。可选的，所述处理单元602，还用于若不存在与所述服务网络名称相匹配的认证结果，则向所述NSSAAF发送用于指示停止认证的消息。
可选的，所述第二认证请求中携带所述用户设备的第一标识SUPI；所述处理单元，还用于根据所述第一标识获取所述用户设备的第二标识；向所述NSSAAF发送所述第二标识。
可选的，所述第二认证请求包括所述AMF ID；所述处理单元602，还用于判断所述AMF的标识与终端设备的安全上下文状态中的AMF的实例标识是否相同；如果所述AMF的标识与终端设备的安全上下文状态中的AMF的实例标识相同，则向所述NSSAAF发送指示信息，所述指示信息用于指示终端设备在服务网络的第一认证结果。
可选的，其中所述第二认证请求包括所述AMF的服务网络名称；所述处理单元602，还用于确定是否存在与所述服务网络名称匹配的认证结果；若存在与所述服务网络匹配的认证结果且所述认证结果为认证成功，则向所述NSSAAF发送指示信息，所述指示信息用于指示终端设备在服务网络的第一认证结果。
如图7所示，需要理解的是，处理单元602可以是一个或多个处理器702，收发单元601可以是收发器701，或者收发单元601还可以是发送单元和接收单元，发送单元可以是发送器，接收单元可以是接收器，该发送单元和接收单元集成于一个器件，例如收发器。
如图8所示，当上述通信装置是电路系统如芯片时，处理单元602可以是一个或多个处理器，或者处理单元602可以是处理电路802等。收发单元601可以是输入输出接口，又或者称为通信接口，或者接口电路801，或接口等等。或者收发单元601还可以是发送单元和接收单元，发送单元可以是输出接口，接收单元可以是输入接口，该发送单元和接收单元集成于一个单元，例如输入输出接口。
举例来说，收发器可以包括接收机和发射机，该接收机用于执行接收的功能(或操作)，该发射机用于执行发射的功能(或操作)。以及收发器用于通过传输介质和其他设备/装置进行通信。处理器通过收发器收发数据和/或信令，并用于实现上述方法实施例中图2至图5所述的相应的方法等。
举例来说，通信装置还可以包括一个或多个存储器703，用于存储程序指令和/或数据。存储器703和处理器702耦合。
本申请实施例中的耦合是装置、单元或模块之间的间接耦合或通信连接，可以是电性，机械或其它的形式，用于装置、单元或模块之间的信息交互。处理器702可能和存储器703协同操作。处理器702可能执行存储器703中存储的程序指令。可选的，上述一个或多个存储器中的至少一个可以包括于处理器中。
本申请实施例中不限定上述收发器701、处理器702以及存储器703之间的具体连接介质。本申请实施例在图7中以存储器703、处理器702以及收发器701之间通过总线704连接，总线在图7中以粗线表示，其它部件之间的连接方式，仅是进行示意性说明，并不引以为限。所述总线可以分为地址总线、数据总线、控制总线等。为便于表示，图7中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
在本申请实施例中，处理器可以是通用处理器、数字信号处理器、专用集成电路、现 场可编程门阵列或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等，可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成等。
可理解，以上所示的处理器和收发器所执行的方法仅为示例，对于该处理器和收发器具体所执行的步骤可参照上文介绍的方法。
可理解，以上关于处理器、收发器和存储器之间连接关系的说明，以及该处理器或收发器的说明等，以下示出的核心设备均适用。例如，通信装置为AMF、UDM或NSSAAF中的任一种时，对于处理器、收发器和存储器之间连接关系的说明，以及该处理器或收发器的说明等，以下示出的各通信装置均适用。
在另一些实现方式中，上述通信装置可以为电路系统。该情况下，上述处理单元602可以用处理电路实现，收发单元701用接口电路实现。如图8所示，通信装置可以包括处理电路802和接口电路801。该处理电路802可以为芯片、逻辑电路、集成电路、处理电路或片上系统(system on chip，SoC)芯片等，接口电路801可以为通信接口、输入输出接口等。
可理解，对于处理电路和接口电路的具体实现方式，可参考图2至图5所示的方法。
在本申请实施例中，处理电路可以是通用处理器、数字信号处理器、专用集成电路、现场可编程门阵列或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等，可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。可理解，对于处理电路的说明，以下示出的电路系统均适用。
可理解，以上所示的接口电路和处理电路所执行的方法仅为示例，对于该接口电路和处理电路具体所执行的步骤可参照上文介绍的方法。
图9是本申请实施例提供的一种无线通信系统的示意图，如图9所示，该无线通信系统可以包括AMF，NSSAAF和UDM。该系统可执行图2至图5所对应的方法，这里不再详述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另外，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口、装置或单元的间接耦合或通信连接，也可以是电的，机械的或其它的形式连接。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本申请实施例提供的方案的技术效果。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以是两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可 以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分，或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个可读存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的可读存储介质包括：U盘、移动硬盘、只读存储器(read-only memory,ROM)、随机存取存储器(random access memory,RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
此外，本申请还提供一种计算机程序，该计算机程序用于实现本申请提供的图2至5中任一网元(AMF，NSSAAF或UDM)执行的操作和/或处理。
本申请还提供一种计算机可读存储介质，该计算机可读存储介质中存储有计算机代码，当计算机代码在计算机上运行时，使得计算机执行图2至图5任一网元执行的操作和/或处理。
本申请还提供一种计算机程序产品，该计算机程序产品包括计算机代码或计算机程序，当该计算机代码或计算机程序在计算机上运行时，使得本申请中图2至图5任一网元所对应的方法被执行执行的操作和/或处理被执行。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (10)

  1. 一种切片认证方法，其特征在于，所述方法包括：
    接入和移动性管理功能AMF向特定网络切片的认证和授权功能NSSAAF发送第一认证请求；
    响应于所述第一认证请求，所述NSSAAF向统一数据管理网元UDM发送第二认证请求；
    响应于所述第二认证请求，所述UDM向所述NSSAAF发送指示信息，所述指示信息用于指示终端设备在服务网络的第一认证结果；
    若所述第一认证结果为认证成功，则所述NSSAAF向服务器发送第一协议信息；
    所述NSSAAF接收所述服务器发送的第二协议信息；
    响应于所述第二协议信息，所述NSSAAF向所述AMF发送第三认证请求；
    响应于所述第三认证请求，所述AMF向所述终端设备UE发送第一非接入层NAS传输消息；
    所述AMF接收所述UE发送第二NAS传输消息；
    响应于所述第二NAS传输消息，所述AMF向所述NSSAAF发送第四认证请求；
    响应于所述第四认证请求，所述NSSAAF向所述服务器发送第三协议信息；
    所述NSSAAF接收所述服务器发送的第四协议信息；
    响应于所述第四协议信息，所述NSSAAF向所述AMF发送第二认证结果。
  2. 根据权利要求1所述的方法，其特征在于，所述第二认证请求中携带所述AMF的服务网络名称；
    所述UDM向所述NSSAAF发送指示信息之前，所述方法还包括：
    所述UDM确定是否存在与所述服务网络名称匹配的认证结果。
    所述UDM向所述NSSAAF发送指示信息，包括：
    若存在与所述服务网络匹配的认证结果且所述认证结果为认证成功，则所述UDM向所述NSSAAF发送所述指示信息。
  3. 根据权利要求2所述的方法，其特征在于，所述方法还包括：
    若不存在与所述服务网络名称相匹配的认证结果，则所述UDM向所述NSSAAF发送用于指示停止认证的消息。
  4. 根据权利要求1至3任一所述的方法，其特征在于，所述第二认证请求中携带所述用户设备的第一标识；所述方法还包括：
    所述UDM根据所述第一标识获取所述用户设备的第二标识；
    所述UDM向所述NSSAAF发送所述第二标识。
  5. 根据权利要求4所述的方法，其特征在于，所述方法还包括：
    所述NSSAAF接收所述第二标识，并保存所述第一标识与所述第二标识的映射关系。
  6. 一种切片认证系统，其特征在于，所述系统包括：
    AMF，用于向NSSAAF发送第一认证请求；
    所述NSSAAF，用于响应于所述第一认证请求，向UDM发送第二认证请求；
    所述UDM，用于响应于所述第二认证请求，向所述NSSAAF发送指示信息，所述指示信息用于指示终端设备UE在服务网络的第一认证结果；
    所述NSSAAF，用于若所述第一认证结果为认证成功，则向服务器发送第一协议信息；接收所述服务器发送的第二协议信息；响应于所述第二协议信息，向所述AMF发送第三认证请求；
    所述AMF，用于响应于所述第三认证请求，向所述UE发送第一NAS传输消息；接收所述UE发送第二NAS传输消息；响应于所述第二NAS传输消息，向所述NSSAAF发送第四认证请求；
    所述NSSAAF，还用于响应于所述第四认证请求，向所述服务器发送第三协议信息；接收所述服务器发送的第四协议信息；响应于所述第四协议信息，则向所述AMF发送第二认证结果。
  7. 根据权利要求6所述的系统，其特征在于，所述第二认证请求中携带所述AMF的服务网络名称；
    所述UDM，还用于确定是否存在与所述服务网络名称匹配的认证结果。
    所述UDM，具体用于若存在与所述服务网络匹配的认证结果且所述认证结果为认证成功，则向所述NSSAAF发送所述指示信息。
  8. 根据权利要求7所述的系统，其特征在于，所述UDM，还用于若不存在与所述服务网络名称相匹配的认证结果，则向所述NSSAAF发送用于指示停止认证的消息。
  9. 根据权利要求6至8任一所述的系统，其特征在于，所述第二认证请求中携带所述用户设备的第一标识；
    所述UDM，还用于根据所述第一标识获取所述用户设备的第二标识；向所述NSSAAF发送所述第二标识。
  10. 根据权利要求9所述的方法，其特征在于，所述NSSAAF，还用于接收所述第二标识，并保存所述第一标识与所述第二标识的映射关系。
PCT/CN2021/077308 2020-06-20 2021-02-22 切片认证方法及系统 WO2021253859A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010570536.2 2020-06-20
CN202010570536.2A CN113904781B (zh) 2020-06-20 2020-06-20 切片认证方法及系统

Publications (1)

Publication Number Publication Date
WO2021253859A1 true WO2021253859A1 (zh) 2021-12-23

Family

ID=79186070

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/077308 WO2021253859A1 (zh) 2020-06-20 2021-02-22 切片认证方法及系统

Country Status (2)

Country Link
CN (1) CN113904781B (zh)
WO (1) WO2021253859A1 (zh)

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108347729A (zh) * 2017-01-24 2018-07-31 电信科学技术研究院 网络切片内鉴权方法、切片鉴权代理实体及会话管理实体
US20200053083A1 (en) * 2018-08-13 2020-02-13 Lenovo (Singapore) Pte. Ltd. Network slice authentication
US10582371B1 (en) * 2019-08-09 2020-03-03 Cisco Technology, Inc. Subscriber management with a stateless network architecture in a fifth generation (5G) network

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110476397B (zh) * 2017-04-01 2021-01-05 华为技术有限公司 用户鉴权方法和装置
CN109104394B (zh) * 2017-06-20 2022-01-21 华为技术有限公司 会话处理方法和设备
WO2019017835A1 (zh) * 2017-07-20 2019-01-24 华为国际有限公司 网络验证方法、相关设备及系统
GB2593147B (en) * 2020-02-12 2023-01-18 Samsung Electronics Co Ltd Slice-specific authentication and authorization

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108347729A (zh) * 2017-01-24 2018-07-31 电信科学技术研究院 网络切片内鉴权方法、切片鉴权代理实体及会话管理实体
US20200053083A1 (en) * 2018-08-13 2020-02-13 Lenovo (Singapore) Pte. Ltd. Network slice authentication
US10582371B1 (en) * 2019-08-09 2020-03-03 Cisco Technology, Inc. Subscriber management with a stateless network architecture in a fifth generation (5G) network

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
HUAWEI, HISILICON, NOKIA, NOKIA SHANGHAI BELL: "Addressing ENs in security procedures for network slices", 3GPP DRAFT; S3-200658, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG3, no. e-meeting; 20200414 - 20200417, 3 April 2020 (2020-04-03), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France , XP051868566 *

Also Published As

Publication number Publication date
CN113904781A (zh) 2022-01-07
CN113904781B (zh) 2023-04-07

Similar Documents

Publication Publication Date Title
WO2020224622A1 (zh) 一种信息配置方法及装置
US11871223B2 (en) Authentication method and apparatus and device
WO2021218878A1 (zh) 切片认证方法及装置
CN113260016B (zh) 多模终端接入控制方法、装置、电子设备及存储介质
US20230269577A1 (en) Slice isolation method, apparatus, and system
US20230362636A1 (en) Key identifier generation method and related apparatus
CN113595911B (zh) 数据转发方法、装置、电子设备及存储介质
US20220086145A1 (en) Secondary Authentication Method And Apparatus
EP4135376A1 (en) Method and device for secure communication
US20230044476A1 (en) Terminal device verification method and apparatus
WO2023274132A1 (zh) 切片准入控制的方法和通信装置
WO2023016160A1 (zh) 一种会话建立方法和相关装置
WO2021253859A1 (zh) 切片认证方法及系统
CN114885382A (zh) 一种业务会话管理方法、装置及存储介质
US20230102604A1 (en) Slice service verification method and apparatus
US20240179519A1 (en) Communication method and related apparatus
US20240179614A1 (en) Communication method and apparatus
CN114600487B (zh) 身份认证方法及通信装置
EP4376487A1 (en) Communication method and apparatus
WO2022155915A1 (zh) 网络互通的方法及装置
WO2024067619A1 (zh) 通信方法和通信装置
WO2020215272A1 (zh) 通信方法、通信装置和通信系统
CN116233953A (zh) 数据传输方法、装置、设备及存储介质
CN115915162A (zh) 基于虚拟可扩展局域网的数据通信方法、设备及存储介质
CN118120201A (zh) 私有物联网单元pine的接入认证方法和装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21825218

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21825218

Country of ref document: EP

Kind code of ref document: A1