WO2022001474A1 - 网络切片连接管理方法、终端及计算机可读存储介质 - Google Patents

网络切片连接管理方法、终端及计算机可读存储介质 Download PDF

Info

Publication number
WO2022001474A1
WO2022001474A1 PCT/CN2021/095283 CN2021095283W WO2022001474A1 WO 2022001474 A1 WO2022001474 A1 WO 2022001474A1 CN 2021095283 W CN2021095283 W CN 2021095283W WO 2022001474 A1 WO2022001474 A1 WO 2022001474A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
application
terminal application
network slice
information
Prior art date
Application number
PCT/CN2021/095283
Other languages
English (en)
French (fr)
Inventor
屠丁元
符兵
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to US17/802,887 priority Critical patent/US20230143835A1/en
Priority to EP21834414.1A priority patent/EP4092987A4/en
Publication of WO2022001474A1 publication Critical patent/WO2022001474A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0893—Assignment of logical groups to network elements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H04L63/205—Network architectures or network communication protocols for network security for managing network security; network security policies in general involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H04W12/128—Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/30—Security of mobile devices; Security of mobile applications
    • H04W12/37—Managing security policies for mobile devices or for controlling mobile applications

Definitions

  • the embodiments of the present application relate to, but are not limited to, the field of communications technologies, and in particular, relate to a network slice connection management method, a terminal, and a computer-readable storage medium.
  • network slicing allows operators to divide multiple virtual end-to-end networks in a hardware infrastructure.
  • Each network slice realizes logical isolation in terms of terminals, access networks, transmission networks, and core networks. , which can adapt to various types of services and meet the different needs of users.
  • the end-to-end implementation of the network slicing function requires the joint participation of the 5G terminal and the 5G network, and the security mechanism of the network slicing between the 5G terminal and the 5G network is a crucial point for realizing the network slicing function.
  • the current industry and standards focus on the isolation and security of network slicing in the access network, bearer network, and core network, and the security guarantee of upper-layer applications of terminals when accessing and using network slicing has not been considered. There is a risk of fraudulent use of the network slice by other non-standard terminal applications, or interference with the network slice's own services.
  • Embodiments of the present application provide a network slice connection management method, terminal, and computer-readable storage medium.
  • an embodiment of the present application provides a network slice connection management method, including: acquiring connection request information sent by a terminal application when a network slice connection request is initiated; Perform an authentication process; when the terminal application passes the authentication process, make the terminal application connect to the network slice according to the connection request information.
  • an embodiment of the present application further provides a terminal, including: a memory, a processor, and a computer program stored in the memory and running on the processor, where the processor implements the above-described computer program when the processor executes the computer program.
  • a terminal including: a memory, a processor, and a computer program stored in the memory and running on the processor, where the processor implements the above-described computer program when the processor executes the computer program.
  • the network slice connection management method is described.
  • the embodiments of the present application further provide a computer-readable storage medium storing computer-executable instructions, where the computer-executable instructions are used to execute the network slice connection management method described above.
  • FIG. 1 is a schematic diagram of a system architecture for implementing a network slice connection management method provided by an embodiment of the present application
  • FIG. 2 is a flowchart of a network slice connection management method provided by an embodiment of the present application.
  • FIG. 3 is a flowchart of a network slice connection management method provided by another embodiment of the present application.
  • FIG. 4 is a flowchart of a network slice connection management method provided by another embodiment of the present application.
  • FIG. 5 is a flowchart of a network slice connection management method provided by another embodiment of the present application.
  • FIG. 6 is a flowchart of a network slice connection management method provided by another embodiment of the present application.
  • the embodiments of the present application provide a network slice connection management method, a terminal, and a computer-readable storage medium, when receiving connection request information sent by a terminal application initiating a network slice connection request, firstly to the network slice connection request that initiates the network slice connection request.
  • the terminal application performs authentication processing. Only when the terminal application passes the authentication processing, will the terminal application be connected to the network slice according to the connection request information. Therefore, fraudulent use of the network slice by other non-standard terminal applications can be prevented. Or attack, which can complement the security guarantee of the upper-layer application of the terminal when accessing and using network slices that the existing 5G network security mechanism lacks.
  • FIG. 1 is a schematic diagram of a system architecture for implementing a network slice connection management method provided by an embodiment of the present application.
  • the system architecture 100 includes an application processor 110 and a baseband processor 120 that are interconnected.
  • the application processor 110 is provided with an application management authentication module 111 and a slice service processing module 112 , in addition, various terminal applications are installed in the application processor 110 ;
  • the baseband processor 120 is provided with a slice function processing module 121 .
  • each terminal application is connected to the application management authentication module 111, and the application management authentication module 111, the slice service processing module 112 and the slice function processing module 121 are connected in sequence.
  • the application management authentication module 111 is used to discriminate the terminal application that initiates the network slice connection request. When it is found that the corresponding terminal application needs to perform authorization authentication, the terminal application is required to initiate an authentication operation to the server or perform a local authentication operation. Only the authentication is successful. Only after that, the connection request information sent by the terminal application is allowed to be transmitted to the slice service processing module 112 .
  • the slice service processing module 112 is configured to, after receiving the connection request information transmitted by the application management authentication module 111 , parse the request parameters in the connection request information, and then pass the request parameters to the slice function processing module 121 .
  • the slicing function processing module 121 is configured to, after receiving the request parameters passed by the slicing service processing module 112, perform matching of terminal routing policy (UE Route Selection Policy, URSP) rules according to these request parameters, and select a corresponding network slice Identification (S-NSSAI), and then use the network slice identification to apply to the network side to establish a protocol data unit (Protocol Data Unit, PDU) session of the corresponding network slice, if the PDU session of the current network slice already exists, it will be applied by the current terminal
  • PDU protocol Data Unit
  • the server is maintained by the operator that provides the network slicing service, and is mainly used to perform authorization authentication and information update of the network slicing service of the terminal application. After the authentication between the two, the network slice connection request initiated by the terminal application on the terminal is allowed to be accepted.
  • FIG. 1 does not constitute a limitation on the embodiments of the present application, and may include more or less components than those shown in the figure, or combine certain components, or Different component arrangements.
  • the terminal application may cooperate to execute the network slice connection management method.
  • FIG. 2 is a flowchart of a network slice connection management method provided by an embodiment of the present application.
  • the network slice connection management method includes but is not limited to step S100 , step S200 and step S300 .
  • Step S100 Obtain connection request information sent by the terminal application in the case of initiating a network slice connection request.
  • the terminal application when the user enables the terminal application in the terminal, if the terminal application supports the network slicing service of the 5G network, the terminal application will initiate a network slice connection request and send connection request information at the same time, so that in the subsequent steps When the connection request information is accepted, the terminal can apply to the network side to connect the network slice according to the connection request information.
  • the connection request information sent by the terminal application when initiating the network slice connection request may carry application feature information corresponding to the terminal application, wherein the application feature information includes the network used for selecting the network slice.
  • the network slice selection parameter information includes but is not limited to data network name (Data Network Name, DNN), full name domain name (Full Qualified Domain Name, FQDN), terminal application identification (Application ID), and IP triples and other parameter information.
  • the feature parameter information includes, but is not limited to, authorization information, application name, and application package name (Package Name) in the authentication process. It is worth noting that the network slice selection parameter information can also be used to authenticate the terminal application.
  • Step S200 performing authentication processing on the terminal application that initiates the network slice connection request.
  • the terminal application when a terminal application initiates a network slice connection request, the terminal application is authenticated first, so that in the subsequent steps, only the terminal application that has passed the authentication process can apply for access to the network slice, thereby enabling Prevent fraudulent use or attacks on network slices by other non-standard terminal applications.
  • the terminal may pre-store a list of terminal applications that have passed the authorization and authentication of the server, or pre-store a list of feature information corresponding to the terminal applications that have passed the authorization and authentication of the server.
  • the terminal application matches the content in the terminal application list or matches The content in the feature information list can be considered that the terminal application has passed the authentication process; otherwise, it is considered that the terminal application has not passed the authentication process.
  • authentication processing such as Token (token)-based identity verification or digital signature can be performed between the terminal application and the server.
  • the terminal application may be authenticated by judging whether the terminal application carries signature authentication information.
  • Step S300 when the terminal application passes the authentication process, the terminal application is connected to the network slice according to the connection request information.
  • a terminal application when a terminal application passes the authentication process, it means that the terminal application belongs to a compliant terminal application, and the user can enjoy the service of connecting the terminal application to the network slice.
  • the connection request information sent during the connection request enables the terminal application to connect to the corresponding network slice. Since the access to the network slice is performed only for terminal applications that have passed the authentication process, fraudulent use or attacks on the network slice by other non-standard terminal applications can be prevented.
  • the network slicing can be executed by using these parameter information.
  • the URSP rules of the slice match, so that the corresponding network slice identifier can be selected, and the network slice identifier can be used to apply to the network side to establish a PDU session of the corresponding network slice. If the PDU session of the network slice already exists, it will be applied by the terminal.
  • the sent connection request information is bound to the PDU session, and after a successful return, the terminal application can use the PDU session of the network slice, thereby realizing the access operation of the terminal application to the network slice.
  • the terminal application can use the default network slice to perform data interaction with the network side according to the default service determined between the terminal and the server.
  • the terminal application can also apply to the network side for a specific dedicated network slice.
  • the URSP rule matches the PDU session request for the default network slice to the network slice of the default network slice identifier, then use the network slice identifier to initiate a PDU session request of the default network slice to the network side, or bind the connection request information to an existing PDU session of the default network slice. It is worth noting that if the PDU session request for the default network slice fails to match any network slice identifier in the URSP rules, a normal non-network slice PDU session establishment request can be initiated to the network side, or the connection request can be sent to the network side. The information is bound to the existing default non-network slice normal PDU session.
  • the initiating network when receiving connection request information due to a terminal application initiating a network slice connection request, the initiating network
  • the terminal application of the slice connection request performs authentication processing. Only when the terminal application passes the authentication processing, the terminal application is connected to the network slice according to the connection request information. Therefore, it can prevent other non-standard terminal applications from The fraudulent use or attack of network slicing can complement the security guarantee of upper-layer applications of terminals when accessing and using network slicing, which is lacking in the existing 5G network security mechanism, and truly guarantees the end-to-end security of network slicing. connect.
  • step S200 may include, but is not limited to, the following steps:
  • Step S210 when the application feature information in the connection request information matches the feature information list stored by the terminal, it is determined that the terminal application has passed the authentication process; wherein the feature information list includes authorized application feature information corresponding to the terminal application authorized by the server.
  • the terminal may pre-store a feature information list corresponding to the terminal application that has passed the authorization and authentication of the server.
  • the application feature information in the connection request message can match the feature information list, that is, the In the case where the application feature information can match the authorized application feature information in the feature information list, it can be considered that the terminal application has passed the authentication process.
  • the network slice connection management method may further include, but is not limited to, the following steps:
  • Step S400 sending the application information update request information of the authorized target terminal application to the server;
  • Step S500 acquiring and saving the feature information list sent by the server according to the application information update request information.
  • the target terminal application may be all terminal applications authorized by the server in the terminal, or may be one or some terminal applications authorized by the server in the terminal, which is not specifically limited in this embodiment. For example, if the terminal cannot determine whether the locally stored application feature information of a certain terminal application is correct during the authentication process, it may query the server and request to update the application feature information of the terminal application.
  • the feature information list including the authorized application feature information stored in the terminal can be obtained by requesting the server after the terminal completes the registration operation with the network.
  • the terminal can interact with the corresponding server and send application information update requests of all authorized terminal applications to the server. information, and the server can update the request information according to the application information, determine the corresponding authorized terminal application and the authorized application characteristic information corresponding to the authorized terminal application, and then form a characteristic information list according to the authorized terminal application and the corresponding authorized application characteristic information , and send the feature information list to the terminal.
  • the terminal can save the feature information list, so that the feature information list can be used in subsequent steps to authenticate the terminal application that initiates the network slice connection request. right to deal with.
  • the terminal can interact with the corresponding server, and send the authorized one or some terminal applications to the server.
  • the application information update request information of some terminal applications and the server can update the request information according to the application information, determine the corresponding authorized terminal application and the authorized application feature information corresponding to the authorized terminal application, and then according to the authorized terminal application and corresponding Authorize the application of feature information to form a feature information list, and send the feature information list to the terminal.
  • the terminal can save the feature information list, so that the feature information list can be used in subsequent steps to initiate network
  • the terminal application of the slice connection request performs authentication processing.
  • the authorized application feature information in the feature information list is used to distinguish and authenticate a specific terminal application that is authorized to use the corresponding network slice, and the authorized application feature information includes but is not limited to attributes that are used to mark the terminal application.
  • the type of authorized application feature information in the feature information list can be controlled and changed by the server, and the terminal is notified to update it at any time, and the terminal can also request the server to update when needed, which is not specifically limited in this embodiment. .
  • the application characteristic value is an authentication parameter pre-negotiated by the server and the terminal application.
  • the server and the terminal can update the application characteristic value with each other regularly. Only when the application characteristic information carried in the connection request information sent by the terminal application matches the application characteristic value stored in the terminal, the corresponding terminal application is considered to be authorized and authenticated.
  • the network slice connection management method may further include, but is not limited to, the following steps:
  • Step S600 negotiate with the server to determine the feature information list
  • Step S700 save the feature information list.
  • the feature information list including the authorized application feature information stored in the terminal can also be obtained through negotiation with the server after the terminal completes the registration operation with the network. After the terminal successfully registers with the 5G network, the terminal can negotiate with the server in advance to determine a feature information list including authorized application feature information, and the terminal is preset with the feature information list. When the terminal cannot obtain the feature information list from the server, the terminal can Use the preset feature information list to authenticate the terminal application that initiates the network slice connection request, avoiding the problem that the terminal application cannot be authenticated because the feature information list cannot be obtained from the server, thus ensuring that users can Slice usage requirements to improve user experience.
  • step S200 may further include, but is not limited to, the following steps:
  • Step S220 cooperate with the server to perform the first authentication processing on the terminal application
  • Step S230 obtaining the first authorization authentication information obtained by the server based on the first authentication process from the server;
  • Step S240 acquiring from the terminal application the second authorization authentication information obtained by the terminal application based on the first authentication process
  • Step S250 Perform authentication processing on the terminal application according to the first authorization authentication information, the second authorization authentication information and the application feature information in the connection request information.
  • steps S220 to S250 in this embodiment and step S210 in the embodiment shown in FIG. 3 belong to a parallel technical solution.
  • the terminal may first suspend the network slice connection request, and cooperate with the server to perform the first authentication process on the terminal application.
  • the terminal application will Interact with the corresponding server first, and complete the first authentication process between the terminal application and the server.
  • the server will obtain the first authorization authentication information according to the result of the first authentication process.
  • the terminal application will also obtain the second authorization authentication information according to the result of the first authentication processing.
  • the terminal will obtain the first authorization authentication information and the second authorization authentication information from the corresponding server and terminal application respectively, and The terminal application is authenticated according to the application feature information in the first authorization authentication information, the second authorization authentication information and the connection request information.
  • the terminal application needs to be authenticated using the first authorization authentication information, the second authorization authentication information, and the application feature information in the connection request information, even if other non-standard terminal applications obtain the regular terminal application in advance, the request to connect to the network slice
  • the non-compliant terminal application lacks the second authorization authentication information obtained according to the result of the first authentication processing, the non-compliant terminal application will be determined as not passing the authentication processing. Therefore, The network slice connection request initiated by the non-compliant terminal application will not be accepted, so that the purpose of preventing fraudulent use or attack of the network slice by the non-compliant terminal application can be achieved.
  • the first authentication process performed on the terminal application in cooperation with the server may include authentication and authentication methods such as digital signature or Token-based identity verification. It may include: sending encrypted application feature information obtained by the user after purchasing the network slicing service to the server, and the server confirms the application feature information to determine whether the corresponding terminal application passes the authentication process.
  • authentication and authentication methods such as digital signature or Token-based identity verification. It may include: sending encrypted application feature information obtained by the user after purchasing the network slicing service to the server, and the server confirms the application feature information to determine whether the corresponding terminal application passes the authentication process.
  • the specific manner of the first authentication processing is not specifically limited in this embodiment.
  • the first authentication processing performed on the terminal application in cooperation with the server may also be performed after the terminal registers with the network and before the terminal application initiates a network slice connection request.
  • the terminal can first trigger and complete the first authentication process for the terminal application with the server through the default PDU session, and after completing the first authentication process, the terminal application corresponding to the corresponding terminal application is stored in advance.
  • the first authorization authentication information and the second authorization authentication information so that when the corresponding terminal application initiates a network slice connection request, the corresponding first authorization authentication information and the second authorization authentication information can be directly obtained from the terminal for authentication processing, Therefore, the time required to perform the first authentication processing on the terminal application in cooperation with the server can be saved, the efficiency of connecting the terminal application to the network slice can be improved, and the user experience can be improved.
  • step S250 may include, but is not limited to, the following steps:
  • the authentication information will be processed according to the first authorization authentication information, the second authorization authentication information and the second authorization authentication information respectively.
  • the application characteristic information in the connection request information performs authentication processing on the terminal application.
  • the first authorization authentication information, the second authorization authentication information and the application characteristic information match, it can be determined that the terminal application has passed the authentication processing.
  • the fraudulent use or attack of the network slice by other non-standard terminal applications is prevented.
  • any one of the first authorization authentication information, the second authorization authentication information and the application feature information does not match the other information, it can be considered that the terminal application does not pass the authentication process, thereby preventing non-compliance with the specification.
  • step S200 may further include but is not limited to the following steps:
  • the terminal application When the terminal application carries the signature authentication information, it is determined that the terminal application has passed the authentication process.
  • step S210 in the embodiment shown in FIG. 3 and steps S220 to S250 in the embodiment shown in FIG. 6 belong to a parallel technical solution.
  • all terminal applications in the terminal can be signed by the terminal in advance with a special application, and the application signature mechanism can adopt the existing mechanism in some cases, such as the standard signature mechanism for the Android system platform, etc.
  • the terminal application carries the signature authentication information. Therefore, when a terminal application initiates a network slice connection request, if it is detected that the terminal application carries signature authentication information, it can be determined that the terminal application has passed the authentication process in advance. When the terminal application that has been authenticated performs the process of connecting to the network slice, it prevents other non-standard terminal applications from fraudulently using or attacking the network slice.
  • the network slice connection management method may further include, but is not limited to, the following steps:
  • the terminal application fails the authentication process, the network slice connection request currently initiated by the terminal application is terminated, or the terminal application is made to re-initiate the network slice connection request, or the terminal application is connected to the terminal default network.
  • a terminal application when a terminal application fails the authentication process, it indicates that the terminal application may be a non-standard terminal application, in order to avoid the situation that the non-standard terminal application fraudulently uses or attacks the network slice.
  • the terminal can terminate the network slice connection request currently initiated by the terminal application to ensure the security of the use of the network slice.
  • the terminal application does not pass the authentication process, and the authentication process may fail due to unstable network or unstable terminal operation. In this case, it does not mean that the terminal application is out of specification.
  • the terminal can notify the terminal application to re-initiate a network slice connection request, so that the terminal application can be re-authenticated, and if the terminal application is authenticated again, the terminal application can be connected to the network slice process.
  • the terminal application fails again, it can be considered that the terminal application is a non-standard terminal application.
  • the terminal application fails to pass the authentication process. It may be that the authorization of the terminal application has expired and the authentication process fails. In this case, it does not mean that the terminal application is non-compliant. Therefore, the terminal can connect the terminal application to the default network of the terminal to ensure the normal use of the terminal application by the user.
  • the network slice connection management method may further include, but is not limited to, the following steps:
  • the terminal application When the number of network slice connection requests re-initiated within a preset time period by a terminal application that has not passed the authentication process exceeds a preset number of times, the terminal application is prohibited from re-initiating a network slice connection request.
  • the terminal may allow the terminal application to re-initiate a network slice connection request. Malicious attacks interfere with the network slice connection requests of terminal applications that meet the specifications.
  • the terminal can limit the number of network slice connection requests initiated by the same terminal application within the same time period. If the number of re-initiated network slice connection requests exceeds the preset number of times, it can be considered that the terminal application is a non-standard terminal application, and the terminal application is conducting malicious attacks. Therefore, the terminal can prohibit the terminal application from re-initiating network slice connection requests. , so as to prevent malicious attacks of non-compliant terminal applications from interfering with network slice connection requests of compliant terminal applications, thereby ensuring normal use of compliant terminal applications by users.
  • an embodiment of the present application also provides a terminal, the terminal includes: a memory, a processor, and a computer program stored in the memory and executable on the processor.
  • the processor and memory may be connected by a bus or otherwise.
  • the memory can be used to store non-transitory software programs and non-transitory computer-executable programs.
  • the memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one magnetic disk storage device, flash memory device, or other non-transitory solid state storage device.
  • the memory may include memory located remotely from the processor, which may be connected to the processor through a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.
  • the terminal in this embodiment may include the system architecture in the embodiment shown in FIG. 1 , and the terminal in this embodiment and the system architecture in the embodiment shown in FIG. 1 belong to the same inventive concept, Therefore, these embodiments have the same realization principle and technical effect, which will not be described in detail here.
  • the non-transitory software programs and instructions required to implement the network slice connection management method of the above embodiment are stored in the memory, and when executed by the processor, the network slice connection management method in the above embodiment is executed, for example, the above-described method is executed.
  • an embodiment of the present application also provides a computer-readable storage medium, where the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are executed by a processor or controller, for example, by the above-mentioned Executed by a processor in the terminal embodiment, the above-mentioned processor can execute the network slice connection management method in the above-mentioned embodiment, for example, perform the above-described method steps S100 to S300 in FIG. 2 and method step S210 in FIG. 3 . , the method steps S400 to S500 in FIG. 4 , the method steps S600 to S700 in FIG. 5 , and the method steps S220 to S250 in FIG. 6 .
  • the embodiments of the present application include: acquiring the connection request information sent by the terminal application in the case of initiating a network slice connection request; performing authentication processing on the terminal application that initiates the network slice connection request; when the terminal application passes the authentication processing, according to the connection request Information enables end applications to connect to network slices.
  • the terminal application that initiates the network slice connection request when receiving the connection request information sent by the terminal application initiating the network slice connection request, the terminal application that initiates the network slice connection request is firstly authenticated, and only when the terminal application passes the network slice connection request Only in the case of authentication processing, the terminal application is connected to the network slice according to the connection request information, thereby preventing fraudulent use or attack of the network slice by other non-standard terminal applications.
  • Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cartridges, magnetic tape, magnetic disk storage or other magnetic storage devices, or may Any other medium used to store desired information and which can be accessed by a computer.
  • communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and can include any information delivery media, as is well known to those of ordinary skill in the art .

Abstract

一种网络切片连接管理方法、终端及计算机可读存储介质。其中，网络切片连接管理方法包括：获取终端应用在发起网络切片连接请求的情况下所发出的连接请求信息(S100)；对发起网络切片连接请求的终端应用进行鉴权处理(S200)；当终端应用通过鉴权处理，根据连接请求信息使终端应用连接网络切片(S300)。

Description

网络切片连接管理方法、终端及计算机可读存储介质
相关申请的交叉引用
本申请基于申请号为202010600448.2、申请日为2020年06月28日的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此引入本申请作为参考。
技术领域
本申请实施例涉及但不限于通信技术领域，尤其涉及一种网络切片连接管理方法、终端及计算机可读存储介质。
背景技术
网络切片作为5G网络的重要技术，可以让运营商在一个硬件基础设施中划分出多个虚拟的端到端网络，每个网络切片在终端、接入网、传输网以及核心网方面实现逻辑隔离，能够适配各种类型服务并满足用户的不同需求。
网络切片功能的端到端的实施，需要5G终端和5G网络的共同参与，并且，5G终端和5G网络之间的网络切片的安全机制，是实现网络切片功能的至关重要的一点。然而，目前业界和标准规范里所聚焦的往往是网络切片在接入网、承载网和核心网中的隔离与安全，尚未考虑终端的上层应用在接入和使用网络切片时的安全保障，因此会存在其他不合规范的终端应用对网络切片的冒用，或者对网络切片的自身业务进行干扰的风险。
发明内容
以下是对本文详细描述的主题的概述。本概述并非是为了限制权利要求 的保护范围。
本申请实施例提供了一种网络切片连接管理方法、终端及计算机可读存储介质。
第一方面，本申请实施例提供了一种网络切片连接管理方法，包括：获取终端应用在发起网络切片连接请求的情况下所发出的连接请求信息；对发起网络切片连接请求的所述终端应用进行鉴权处理；当所述终端应用通过鉴权处理，根据所述连接请求信息使所述终端应用连接网络切片。
第二方面，本申请实施例还提供了一种终端，包括：存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，所述处理器执行所述计算机程序时实现如上第一方面所述的网络切片连接管理方法。
第三方面，本申请实施例还提供了一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令用于执行如上所述的网络切片连接管理方法。
本申请的其它特征和优点将在随后的说明书中阐述，并且，部分地从说明书中变得显而易见，或者通过实施本申请而了解。本申请的目的和其他优点可通过在说明书、权利要求书以及附图中所特别指出的结构来实现和获得。
附图说明
附图用来提供对本申请技术方案的进一步理解，并且构成说明书的一部分，与本申请的实施例一起用于解释本申请的技术方案，并不构成对本申请技术方案的限制。
图1是本申请一个实施例提供的用于执行网络切片连接管理方法的系统架构的示意图；
图2是本申请一个实施例提供的网络切片连接管理方法的流程图；
图3是本申请另一实施例提供的网络切片连接管理方法的流程图；
图4是本申请另一实施例提供的网络切片连接管理方法的流程图；
图5是本申请另一实施例提供的网络切片连接管理方法的流程图；
图6是本申请另一实施例提供的网络切片连接管理方法的流程图。
具体实施方式
为了使本申请的目的、技术方案及优点更加清楚明白，以下结合附图及实施例，对本申请进行进一步详细说明。应当理解，此处所描述的具体实施例仅用以解释本申请，并不用于限定本申请。
需要说明的是，虽然在装置示意图中进行了功能模块划分，在流程图中示出了逻辑顺序，但是在某些情况下，可以以不同于装置中的模块划分，或流程图中的顺序执行所示出或描述的步骤。说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。
本申请实施例提供了一种网络切片连接管理方法、终端及计算机可读存储介质，在接收到由于终端应用发起网络切片连接请求而发出的连接请求信息时，首先对发起网络切片连接请求的该终端应用进行鉴权处理，只有在该终端应用通过鉴权处理的情况下，才根据该连接请求信息使该终端应用连接网络切片，因此，可以防止其他不合规范的终端应用对网络切片的冒用或者攻击，从而可以补全现有5G网络的安全机制所缺乏的关于终端的上层应用在接入和使用网络切片时的安全保障。
下面结合附图，对本申请实施例作进一步阐述。
如图1所示，图1是本申请一个实施例提供的用于执行网络切片连接管理方法的系统架构的示意图。在图1的示例中，该系统架构100包括相互连 接的应用处理器110和基带处理器120。其中，应用处理器110中设置有应用管理认证模块111和切片业务处理模块112，此外，应用处理器110中还安装有各种终端应用；基带处理器120中设置有切片功能处理模块121。其中，每个终端应用均连接于应用管理认证模块111，应用管理认证模块111、切片业务处理模块112和切片功能处理模块121依次连接。
应用管理认证模块111用于对发起网络切片连接请求的终端应用进行判别，当发现对应的终端应用需要执行授权认证时，要求该终端应用向服务器发起认证操作或者执行本地的认证操作，只有认证成功后才允许将该终端应用发出的连接请求信息传递给切片业务处理模块112。切片业务处理模块112用于在接收到由应用管理认证模块111传递过来的连接请求信息之后，解析该连接请求信息中的请求参数，然后将该请求参数传递到切片功能处理模块121。切片功能处理模块121用于在接收到由切片业务处理模块112传递过来的请求参数之后，根据这些请求参数执行终端路由选择策略(UE Route Selection Policy，URSP)规则的匹配，选择出对应的网络切片标识(S-NSSAI)，然后利用该网络切片标识向网络侧申请建立对应的网络切片的协议数据单元(Protocol Data Unit，PDU)会话，如果当前网络切片的PDU会话已存在，则将由当前终端应用发出的连接请求信息绑定到对应的PDU会话上，以使得当前终端应用能够直接使用该PDU会话。值得注意的是，服务器由提供网络切片业务的运营商维护，主要用于执行终端应用的网络切片业务的授权认证和信息更新，针对需要授权认证的终端应用，只有在该终端应用成功执行和服务器之间的认证后，才允许受理该终端应用在终端上发起的网络切片连接请求。
本申请实施例描述的系统架构以及应用场景是为了更加清楚的说明本申请实施例的技术方案，并不构成对于本申请实施例提供的技术方案的限定，本领域技术人员可知，随着系统架构的演变和新应用场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
本领域技术人员可以理解的是，图1中示出的系统架构100的结构并不构成对本申请实施例的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。
在图1所示的系统架构100中，终端应用、应用管理认证模块111、切片业务处理模块112和切片功能处理模块121之间可以配合执行网络切片连接管理方法。
基于上述系统架构的结构，提出本申请的网络切片连接管理方法的各个实施例。
如图2所示，图2是本申请一个实施例提供的网络切片连接管理方法的流程图，该网络切片连接管理方法包括但不限于有步骤S100、步骤S200和步骤S300。
步骤S100，获取终端应用在发起网络切片连接请求的情况下所发出的连接请求信息。
在一实施例中，当用户在终端中启用终端应用时，如果该终端应用支持5G网络的网络切片业务，则该终端应用会发起网络切片连接请求，并同时发出连接请求信息，使得在后续步骤中当该连接请求信息被接受时，终端可以根据该连接请求信息向网络侧申请连接网络切片。
在一实施例中，终端应用在发起网络切片连接请求时所发出的连接请求信息，可以携带有与该终端应用对应的应用特征信息，其中，该应用特征信息包括用于选择网路切片的网络切片选择参数信息和用于验证该终端应用是否被授权使用对应网络切片的特征参数信息等，该网络切片选择参数信息包括但不限于有数据网络名称(Data Network Name，DNN)、全称域名(Full Qualified Domain Name，FQDN)、终端应用标识(Application ID)和IP三元组等参数信息。该特征参数信息包括但不限于有鉴权过程中的授权信息、应用名称和应用包名(Package Name)等。值得注意的是，网络切片选择参数信息也可以用于对终端应用进行鉴权处理。
步骤S200，对发起网络切片连接请求的终端应用进行鉴权处理。
在一实施例中，在终端应用发起网络切片连接请求的情况下，先对该终端应用进行鉴权处理，使得后续步骤能够仅为通过了鉴权处理的终端应用申请接入网络切片，从而能够防止其他不合规范的终端应用对网络切片的冒用或者攻击。
在一实施例中，对终端应用进行鉴权处理，可以有不同的实施方式，本实施例对此并不作具体限定。例如，终端中可以预先保存通过服务器的授权认证的终端应用列表，或者预先保存与通过服务器的授权认证的终端应用对应的特征信息列表，当终端应用匹配到该终端应用列表中的内容或者匹配到该特征信息列表中的内容，即可认为该终端应用通过了鉴权处理，反之，则认为该终端应用没有通过鉴权处理。又如，当需要对终端应用进行鉴权处理时，可以使该终端应用与服务器之间进行基于Token(令牌)的身份验证或数字签名等鉴权处理。再如，可以通过判断该终端应用是否携带有签名认证信息而对该终端应用进行鉴权认证。
步骤S300，当终端应用通过鉴权处理，根据连接请求信息使终端应用连接网络切片。
在一实施例中，当终端应用通过鉴权处理，则说明该终端应用属于合规范的终端应用，用户可以享受该终端应用连接网络切片的业务，因此，可以根据由该终端应用在发起网络切片连接请求时所发出的连接请求信息而使该终端应用连接至对应的网络切片。由于仅对通过鉴权处理的终端应用执行网络切片的接入，因此能够防止其他不合规范的终端应用对网络切片的冒用或者攻击。
在一实施例中，在根据连接请求信息使终端应用连接网络切片时，由于连接请求信息中携带有DNN、FQDN、终端应用名称和IP三元组等参数信息，因此可以利用这些参数信息执行网络切片的URSP规则匹配，从而可以选择出对应的网络切片标识，并且利用该网络切片标识向网络侧申请建立对应的 网络切片的PDU会话，如果该网络切片的PDU会话已存在，则将由该终端应用发出的连接请求信息绑定到该PDU会话上，成功返回后，该终端应用即可使用该网络切片的PDU会话，从而实现该终端应用对网络切片的接入操作。
在一实施例中，当终端注册到网络后，根据终端和服务器之间所确定的默认业务，终端应用可以使用默认的网络切片与网络侧进行数据交互，此外，根据终端和服务器之间所确定的增值业务，终端应用还可以向网络侧申请特定的专用网络切片。针对上述情况，如果终端应用所发起的网络切片连接请求是针对默认网络切片的PDU会话请求，由于默认网络切片是根据终端和服务器之间所确定的默认业务而提供的，因此可以默认终端的终端应用均是通过了授权认证的，所以，可以直接根据由终端应用所发出的连接请求信息执行URSP规则匹配，如果URSP规则中将该针对默认网络切片的PDU会话请求匹配到默认网络切片的网络切片标识，则利用该网络切片标识向网络侧发起默认网络切片的PDU会话请求，或者把该连接请求信息绑定到已存在的默认网络切片的PDU会话上。值得注意的是，如果URSP规则中未能将该针对默认网络切片的PDU会话请求匹配到任何网络切片标识，则可以向网络侧发起普通的非网络切片的PDU会话建立请求，或者把该连接请求信息绑定到已存在的默认的非网络切片的普通PDU会话上。
在一实施例中，通过采用包括有上述步骤S100、步骤S200和步骤S300的网络切片连接管理方法，使得在接收到由于终端应用发起网络切片连接请求而发出的连接请求信息时，首先对发起网络切片连接请求的该终端应用进行鉴权处理，只有在该终端应用通过鉴权处理的情况下，才根据该连接请求信息使该终端应用连接网络切片，因此，可以防止其他不合规范的终端应用对网络切片的冒用或者攻击，从而可以补全现有5G网络的安全机制所缺乏的关于终端的上层应用在接入和使用网络切片时的安全保障，真正的保证了网络切片的端到端的安全连接。
另外，在一实施例中，参照图3，步骤S200可以包括但不限于有以下步 骤：
步骤S210，当连接请求信息中的应用特征信息匹配到终端所保存的特征信息列表，确定终端应用通过鉴权处理；其中，特征信息列表包括与经过服务器授权的终端应用对应的授权应用特征信息。
在一实施例中，终端可以预先保存与通过服务器的授权认证的终端应用对应的特征信息列表，当连接请求信息中的应用特征信息能够匹配到该特征信息列表，即，在连接请求信息中的应用特征信息能够与该特征信息列表中的授权应用特征信息相匹配的情况下，即可认为该终端应用通过了鉴权处理，因此，可以在后续步骤中对该通过了鉴权处理的终端应用执行连接网络切片的处理时，防止其他不合规范的终端应用对网络切片的冒用或者攻击。
在一实施例中，终端中所保存的包括有授权应用特征信息的特征信息列表，可以在终端完成与网络的注册操作后，向服务器请求获得，或者与服务器协商获得。例如，终端可以向服务器发送终端所支持的所有终端应用或者某些特定的终端应用的应用信息更新请求信息，接着服务器从这些终端应用中确定经过授权的能够使用网络切片的终端应用，形成包括有授权应用特征信息的特征信息列表，并向终端发送该特征信息列表。此外，该特征信息列表还可以在终端应用发起网络切片连接请求之后，在执行连接网络切片的处理之前，向服务器请求获得，或者与服务器协商获得。针对包括有授权应用特征信息的特征信息列表的获取方式，本实施例并不作具体限定。
另外，在一实施例中，参照图4，该网络切片连接管理方法还可以包括但不限于有以下步骤：
步骤S400，向服务器发送已授权的目标终端应用的应用信息更新请求信息；
步骤S500，获取并保存由服务器根据应用信息更新请求信息发送的特征信息列表。
在一实施例中，目标终端应用可以为终端中的经过服务器授权的所有终 端应用，也可以为终端中的经过服务器授权的某一个或某些终端应用，本实施例对此并不作具体限定。例如，如果终端在鉴权过程中无法确定某个终端应用在本地保存的应用特征信息是否正确，则可以向服务器查询并请求更新该终端应用的应用特征信息。
在一实施例中，终端中所保存的包括有授权应用特征信息的特征信息列表，可以在终端完成与网络的注册操作后，向服务器请求获得。
当目标终端应用为终端中的经过服务器授权的所有终端应用，那么，当终端成功注册5G网络之后，终端可以与对应的服务器进行交互，向服务器发送已经过授权的所有终端应用的应用信息更新请求信息，而服务器则可以根据该应用信息更新请求信息，确定对应的授权终端应用以及与该授权终端应用对应的授权应用特征信息，然后根据该授权终端应用和对应的授权应用特征信息形成特征信息列表，并向终端发送该特征信息列表，当终端接收到该特征信息列表后，终端可以保存该特征信息列表，以便于后续步骤中可以利用该特征信息列表对发起网络切片连接请求的终端应用进行鉴权处理。
当目标终端应用为终端中的经过服务器授权的某一个或某些终端应用，那么，当终端成功注册5G网络之后，终端可以与对应的服务器进行交互，向服务器发送已经过授权的某一个或某些终端应用的应用信息更新请求信息，而服务器则可以根据该应用信息更新请求信息，确定对应的授权终端应用以及与该授权终端应用对应的授权应用特征信息，然后根据该授权终端应用和对应的授权应用特征信息形成特征信息列表，并向终端发送该特征信息列表，当终端接收到该特征信息列表后，终端可以保存该特征信息列表，以便于后续步骤中可以利用该特征信息列表对发起网络切片连接请求的终端应用进行鉴权处理。
在一实施例中，特征信息列表中的授权应用特征信息，用于区分并认证授权使用对应网络切片的某一具体的终端应用，该授权应用特征信息包括但不限于有用于标记终端应用的属性的应用名称(APP ID)、应用包名(应用包 名可以和终端的用户账号相对应)、应用允许使用的网络切片请求接入参数(例如DNN、FQDN、Application ID和IP三元组等参数信息)以及应用特征值。其中，特征信息列表中的授权应用特征信息的种类，可由服务端进行控制更改，并通知终端随时更新，而终端也可以在需要的时候请求服务端进行更新，本实施例对此并不作具体限定。值得注意的是，应用特征值为由服务器和终端应用预先协商的认证参数，服务器和终端可互相定期更新该应用特征值，也可在预先执行完终端应用的鉴权认证后，服务器和终端互相存储，只有当终端应用发出的连接请求信息中携带的应用特征信息和终端中保存的应用特征值相匹配时，才认为对应的终端应用是经过授权认证的。
另外，在一实施例中，参照图5，该网络切片连接管理方法还可以包括但不限于有以下步骤：
步骤S600，与服务器协商确定特征信息列表；
步骤S700，保存特征信息列表。
在一实施例中，终端中所保存的包括有授权应用特征信息的特征信息列表，还可以在终端完成与网络的注册操作后，与服务器协商获得。当终端成功注册5G网络之后，终端可以预先与服务器协商确定包括有授权应用特征信息的特征信息列表，并且终端预置有该特征信息列表，当终端无法从服务器中获取特征信息列表时，终端可以利用预置的特征信息列表对发起网络切片连接请求的终端应用进行鉴权处理，避免出现由于无法从服务器中获取特征信息列表而无法对终端应用进行鉴权处理的问题，从而能够保证用户对网络切片的使用需求，提高用户的使用体验。
另外，在一实施例中，参照图6，步骤S200还可以包括但不限于有以下步骤：
步骤S220，与服务器配合对终端应用进行第一次认证处理；
步骤S230，从服务器中获取服务器基于第一次认证处理得到的第一授权认证信息；
步骤S240，从终端应用中获取终端应用基于第一次认证处理得到的第二授权认证信息；
步骤S250，根据第一授权认证信息、第二授权认证信息和连接请求信息中的应用特征信息对终端应用进行鉴权处理。
值得注意的是，本实施例中的步骤S220至步骤S250，与如图3所示实施例中的步骤S210，属于并列的技术方案。
在一实施例中，当终端应用发起网络切片连接请求时，终端可以先挂起该网络切片连接请求，并先与服务器配合对该终端应用进行第一次认证处理，此时，该终端应用会先与对应的服务器进行交互，并完成终端应用与服务器之间的第一次认证处理，当完成第一次认证处理后，服务器会根据该第一次认证处理的结果得到第一授权认证信息，而终端应用也会根据该第一次认证处理的结果得到第二授权认证信息，此时，终端会分别从相互对应的服务器和终端应用中获取第一授权认证信息和第二授权认证信息，并根据第一授权认证信息、第二授权认证信息和连接请求信息中的应用特征信息对该终端应用进行鉴权处理。由于需要使用第一授权认证信息、第二授权认证信息和连接请求信息中的应用特征信息对终端应用进行鉴权处理，因此，即使其他不合规范的终端应用提前获得正规终端应用在请求连接网络切片时的参数信息，但由于该不合规范的终端应用缺乏根据第一次认证处理的结果而得到的第二授权认证信息，因此该不合规范的终端应用会被确定为不通过鉴权处理，所以，由该不合规范的终端应用所发起的网络切片连接请求并不会被接受，从而能够达到防止不合规范的终端应用对网络切片的冒用或者攻击的目的。
在一实施例中，与服务器配合对终端应用进行的第一次认证处理，可以包括数字签名或基于Token的身份验证等鉴权认证方式，此外，第一次认证处理的鉴权认证机制，还可以包括：向服务器发送由用户在购买网络切片服务后所得到的加密后的应用特征信息，由服务器对该应用特征信息进行确认而判断对应的终端应用是否通过鉴权处理。针对第一次认证处理的具体方式， 本实施例并不作具体限定。
在一实施例中，与服务器配合对终端应用进行的第一次认证处理，还可以在终端注册到网络后，并在终端应用发起网络切片连接请求之前执行。当终端注册到网络后，终端可以通过默认的PDU会话与服务器率先触发并完成对终端应用的第一次认证处理，并且在完成该第一次认证处理后，预先保存与相应的终端应用对应的第一授权认证信息和第二授权认证信息，以便于当相应的终端应用发起网络切片连接请求时，可以直接从终端中获取对应的第一授权认证信息和第二授权认证信息进行鉴权处理，从而能够节省与服务器配合对该终端应用进行第一次认证处理的时间，提高终端应用连接网络切片的效率，从而提高用户的使用体验。
另外，在一实施例中，步骤S250可以包括但不限于有以下步骤：
当第一授权认证信息、第二授权认证信息和应用特征信息相匹配，确定终端应用通过鉴权处理。
在一实施例中，当终端与服务器配合对终端应用进行第一次认证处理而分别获得第一授权认证信息和第二授权认证信息后，会根据第一授权认证信息、第二授权认证信息和连接请求信息中的应用特征信息对终端应用进行鉴权处理，当第一授权认证信息、第二授权认证信息和应用特征信息相匹配，则可以确定该终端应用通过了鉴权处理，因此，可以在后续步骤中对该通过了鉴权处理的终端应用执行连接网络切片的处理时，防止其他不合规范的终端应用对网络切片的冒用或者攻击。值得注意的是，如果第一授权认证信息、第二授权认证信息和应用特征信息中，任何一个信息与其他信息不匹配，都可以认为该终端应用不通过鉴权处理，从而能够达到防止不合规范的终端应用对网络切片的冒用或者攻击的目的。
另外，在一实施例中，步骤S200还可以包括但不限于有以下步骤：
当终端应用携带有签名认证信息，确定终端应用通过鉴权处理。
值得注意的是，本实施例中的步骤，与如图3所示实施例中的步骤S210， 以及如图6所示实施例中的步骤S220至步骤S250，均属于并列的技术方案。
在一实施例中，终端中的所有终端应用，均可以预先由终端进行特殊的应用签名，进行应用签名的机制可以采用一些情况中的现有机制，例如针对安卓系统平台的标准签名机制等，使得终端应用携带有签名认证信息。因此，当终端应用发起网络切片连接请求时，如果检测到该终端应用携带有签名认证信息，则可以确定该终端应用是预先已经通过了鉴权处理的，因此，可以在后续步骤中对该通过了鉴权处理的终端应用执行连接网络切片的处理时，防止其他不合规范的终端应用对网络切片的冒用或者攻击。
值得注意的是，在本实施例中，只有携带有签名认证信息的终端应用所发起的网络切片连接请求，才会被终端接受并执行连接网络切片的处理，对于由没有携带签名认证信息的终端应用所发起的网络切片连接请求，终端会直接返回请求失败信息。
另外，在一实施例中，该网络切片连接管理方法还可以包括但不限于有以下步骤：
当终端应用没有通过鉴权处理，终止终端应用当前发起的网络切片连接请求，或者使终端应用重新发起网络切片连接请求，或者使终端应用连接终端默认网络。
在一实施例中，在一些情况下，当终端应用没有通过鉴权处理，说明该终端应用可能是不合规范的终端应用，为了避免出现不合规范的终端应用对网络切片进行冒用或者攻击的情况，终端可以终止该终端应用当前发起的网络切片连接请求，以保障网络切片的使用安全。另外，在另一些情况下，终端应用没有通过鉴权处理，有可能是因为网络不稳定或者终端运行不稳定而导致鉴权处理失败，在这种情况下，并不能说明该终端应用为不合规范的终端应用，因此，终端可以通知该终端应用重新发起网络切片连接请求，从而可以重新对该终端应用进行鉴权处理，如果通过再次鉴权处理，则可以对该终端应用执行连接网络切片的处理，如果再次鉴权失败，则可以认为该终端 应用为不合规范的终端应用。此外，在另一些情况下，终端应用没有通过鉴权处理，有可能是因为该终端应用的权限已经过期而导致鉴权处理失败，在这种情况下，并不能说明该终端应用为不合规范的终端应用，所以，终端可以把该终端应用连接到终端默认网络，以保证用户对该终端应用的正常使用。
另外，在一实施例中，该网络切片连接管理方法还可以包括但不限于有以下步骤：
当没有通过鉴权处理的终端应用在预设时间段内重新发起的网络切片连接请求的次数超过预设次数，禁止终端应用再次发起网络切片连接请求。
在一实施例中，如果出现由于网络不稳定或者终端运行不稳定而导致终端应用鉴权失败的情况，终端可以允许该终端应用重新发起网络切片连接请求，但是，为了防止不合规范的终端应用进行恶意攻击而干扰符合规范的终端应用的网络切片连接请求，终端可以限制同一终端应用在同一时间段内发起的网络切片连接请求的次数，当没有通过鉴权处理的终端应用在预设时间段内重新发起的网络切片连接请求的次数超过预设次数，则可以认为该终端应用为不合规范的终端应用，并且该终端应用正在进行恶意攻击，所以，终端可以禁止该终端应用再次发起网络切片连接请求，从而能够防止不合规范的终端应用进行恶意攻击而干扰符合规范的终端应用的网络切片连接请求，从而可以保障用户对符合规范的终端应用的正常使用。
另外，本申请的一个实施例还提供了一种终端，该终端包括：存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序。
处理器和存储器可以通过总线或者其他方式连接。
存储器作为一种非暂态计算机可读存储介质，可用于存储非暂态软件程序以及非暂态性计算机可执行程序。此外，存储器可以包括高速随机存取存储器，还可以包括非暂态存储器，例如至少一个磁盘存储器件、闪存器件、或其他非暂态固态存储器件。在一些实施方式中，存储器可能包括相对于处理器远程设置的存储器，这些远程存储器可以通过网络连接至该处理器。上 述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网及其组合。
需要说明的是，本实施例中的终端，可以包括有如图1所示实施例中的系统架构，本实施例中的终端和如图1所示实施例中的系统架构属于相同的发明构思，因此这些实施例具有相同的实现原理以及技术效果，此处不再详述。
实现上述实施例的网络切片连接管理方法所需的非暂态软件程序以及指令存储在存储器中，当被处理器执行时，执行上述实施例中的网络切片连接管理方法，例如，执行以上描述的图2中的方法步骤S100至S300、图3中的方法步骤S210、图4中的方法步骤S400至S500、图5中的方法步骤S600至S700、图6中的方法步骤S220至S250。
以上所描述的装置实施例仅仅是示意性的，其中作为分离部件说明的单元可以是或者也可以不是物理上分开的，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。
此外，本申请的一个实施例还提供了一种计算机可读存储介质，该计算机可读存储介质存储有计算机可执行指令，该计算机可执行指令被一个处理器或控制器执行，例如，被上述终端实施例中的一个处理器执行，可使得上述处理器执行上述实施例中的网络切片连接管理方法，例如，执行以上描述的图2中的方法步骤S100至S300、图3中的方法步骤S210、图4中的方法步骤S400至S500、图5中的方法步骤S600至S700、图6中的方法步骤S220至S250。
本申请实施例包括：获取终端应用在发起网络切片连接请求的情况下所发出的连接请求信息；对发起网络切片连接请求的终端应用进行鉴权处理；当终端应用通过鉴权处理，根据连接请求信息使终端应用连接网络切片。根据本申请实施例提供的方案，在接收到由于终端应用发起网络切片连接请求 而发出的连接请求信息时，首先对发起网络切片连接请求的该终端应用进行鉴权处理，只有在该终端应用通过鉴权处理的情况下，才根据该连接请求信息使该终端应用连接网络切片，从而可以防止其他不合规范的终端应用对网络切片的冒用或者攻击。
本领域普通技术人员可以理解，上文中所公开方法中的全部或某些步骤、系统可以被实施为软件、固件、硬件及其适当的组合。某些物理组件或所有物理组件可以被实施为由处理器，如中央处理器、数字信号处理器或微处理器执行的软件，或者被实施为硬件，或者被实施为集成电路，如专用集成电路。这样的软件可以分布在计算机可读介质上，计算机可读介质可以包括计算机存储介质(或非暂时性介质)和通信介质(或暂时性介质)。如本领域普通技术人员公知的，术语计算机存储介质包括在用于存储信息(诸如计算机可读指令、数据结构、程序模块或其他数据)的任何方法或技术中实施的易失性和非易失性、可移除和不可移除介质。计算机存储介质包括但不限于RAM、ROM、EEPROM、闪存或其他存储器技术、CD-ROM、数字多功能盘(DVD)或其他光盘存储、磁盒、磁带、磁盘存储或其他磁存储装置、或者可以用于存储期望的信息并且可以被计算机访问的任何其他的介质。此外，本领域普通技术人员公知的是，通信介质通常包含计算机可读指令、数据结构、程序模块或者诸如载波或其他传输机制之类的调制数据信号中的其他数据，并且可包括任何信息递送介质。
以上是对本申请的一些实施进行了具体说明，但本申请并不局限于上述实施方式，熟悉本领域的技术人员在不违背本申请范围的前提下还可作出种种的等同变形或替换，这些等同的变形或替换均包含在本申请权利要求所限定的范围内。

Claims (11)

  1. 一种网络切片连接管理方法，包括：
    获取终端应用在发起网络切片连接请求的情况下所发出的连接请求信息；
    对发起网络切片连接请求的所述终端应用进行鉴权处理；
    当所述终端应用通过鉴权处理，根据所述连接请求信息使所述终端应用连接网络切片。
  2. 根据权利要求1所述的方法，其中，所述连接请求信息包括与所述终端应用对应的应用特征信息，所述对发起网络切片连接请求的所述终端应用进行鉴权处理，包括：
    当所述连接请求信息中的所述应用特征信息匹配到终端所保存的特征信息列表，确定所述终端应用通过鉴权处理；其中，所述特征信息列表包括与经过服务器授权的终端应用对应的授权应用特征信息。
  3. 根据权利要求2所述的方法，其中，还包括：
    向服务器发送已授权的目标终端应用的应用信息更新请求信息；
    获取并保存由服务器根据所述应用信息更新请求信息发送的所述特征信息列表。
  4. 根据权利要求2所述的方法，其中，还包括：
    与服务器协商确定所述特征信息列表；
    保存所述特征信息列表。
  5. 根据权利要求1所述的方法，其中，所述连接请求信息包括与所述终端应用对应的应用特征信息，所述对发起网络切片连接请求的所述终端应用进行鉴权处理，包括：
    与服务器配合对所述终端应用进行第一次认证处理；
    从服务器中获取服务器基于所述第一次认证处理得到的第一授权认证信息；
    从所述终端应用中获取所述终端应用基于所述第一次认证处理得到的第二授权认证信息；
    根据所述第一授权认证信息、所述第二授权认证信息和所述连接请求信息中的所述应用特征信息对所述终端应用进行鉴权处理。
  6. 根据权利要求5所述的方法，其中，所述根据所述第一授权认证信息、所述第二授权认证信息和所述连接请求信息中的所述应用特征信息对所述终端应用进行鉴权处理，包括：
    当所述第一授权认证信息、所述第二授权认证信息和所述应用特征信息相匹配，确定所述终端应用通过鉴权处理。
  7. 根据权利要求1所述的方法，其中，所述对发起网络切片连接请求的所述终端应用进行鉴权处理，包括：
    当所述终端应用携带有签名认证信息，确定所述终端应用通过鉴权处理。
  8. 根据权利要求1至7任意一项所述的方法，其中，还包括：
    当所述终端应用没有通过鉴权处理，终止所述终端应用当前发起的网络切片连接请求，或者使所述终端应用重新发起网络切片连接请求，或者使所述终端应用连接终端默认网络。
  9. 根据权利要求8所述的方法，其中，还包括：
    当没有通过鉴权处理的终端应用在预设时间段内重新发起的网络切片连接请求的次数超过预设次数，禁止所述终端应用再次发起网络切片连接请求。
  10. 一种终端，包括：存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，其中，所述处理器执行所述计算机程序时实现如权利要 求1至9中任意一项所述的方法。
  11. 一种计算机可读存储介质，存储有计算机可执行指令，其中，所述计算机可执行指令用于执行权利要求1至9中任意一项所述的方法。
PCT/CN2021/095283 2020-06-28 2021-05-21 网络切片连接管理方法、终端及计算机可读存储介质 WO2022001474A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US17/802,887 US20230143835A1 (en) 2020-06-28 2021-05-21 Network slice connection management method, terminal, and computer-readable storage medium
EP21834414.1A EP4092987A4 (en) 2020-06-28 2021-05-21 CONNECTION MANAGEMENT METHOD FOR NETWORK SLICES, TERMINAL AND COMPUTER-READABLE STORAGE MEDIUM

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010600448.2 2020-06-28
CN202010600448.2A CN113852483B (zh) 2020-06-28 2020-06-28 网络切片连接管理方法、终端及计算机可读存储介质

Publications (1)

Publication Number Publication Date
WO2022001474A1 true WO2022001474A1 (zh) 2022-01-06

Family

ID=78972759

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/095283 WO2022001474A1 (zh) 2020-06-28 2021-05-21 网络切片连接管理方法、终端及计算机可读存储介质

Country Status (4)

Country Link
US (1) US20230143835A1 (zh)
EP (1) EP4092987A4 (zh)
CN (2) CN117118841A (zh)
WO (1) WO2022001474A1 (zh)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114501593B (zh) * 2021-12-29 2024-04-05 西安广和通无线软件有限公司 网络切片接入方法、装置、系统和存储介质
CN114189865B (zh) * 2021-12-31 2022-09-13 广州爱浦路网络技术有限公司 通信网络中的网络攻击防护方法、计算机装置和存储介质
US11606383B1 (en) * 2022-03-03 2023-03-14 Uab 360 It Securing against network vulnerabilities

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106713406A (zh) * 2015-11-18 2017-05-24 中国移动通信集团公司 接入切片网络的方法及系统
CN108347729A (zh) * 2017-01-24 2018-07-31 电信科学技术研究院 网络切片内鉴权方法、切片鉴权代理实体及会话管理实体
US20190364460A1 (en) * 2018-05-23 2019-11-28 Verizon Patent And Licensing Inc. Adaptable radio access network
WO2020035732A1 (en) * 2018-08-13 2020-02-20 Lenovo (Singapore) Pte. Ltd. Network slice authentication
CN111131258A (zh) * 2019-12-26 2020-05-08 中移(成都)信息通信科技有限公司 一种基于5g网络切片的安全专网架构系统

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9961713B2 (en) * 2016-02-23 2018-05-01 Motorola Mobility Llc Procedures to support network slicing in a wireless communication system
CN113949567B (zh) * 2016-04-15 2023-10-13 瑞典爱立信有限公司 用户设备容器和网络切片
CN107809776B (zh) * 2016-09-09 2021-06-15 中兴通讯股份有限公司 信息处理方法、装置以及网络系统
WO2018119608A1 (zh) * 2016-12-26 2018-07-05 华为技术有限公司 应用处理方法、网络设备及终端设备
US10531420B2 (en) * 2017-01-05 2020-01-07 Huawei Technologies Co., Ltd. Systems and methods for application-friendly protocol data unit (PDU) session management
CN109525409B (zh) * 2017-09-19 2021-07-20 华为技术有限公司 一种网络切片模板的处理方法及管理设备

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106713406A (zh) * 2015-11-18 2017-05-24 中国移动通信集团公司 接入切片网络的方法及系统
CN108347729A (zh) * 2017-01-24 2018-07-31 电信科学技术研究院 网络切片内鉴权方法、切片鉴权代理实体及会话管理实体
US20190364460A1 (en) * 2018-05-23 2019-11-28 Verizon Patent And Licensing Inc. Adaptable radio access network
WO2020035732A1 (en) * 2018-08-13 2020-02-20 Lenovo (Singapore) Pte. Ltd. Network slice authentication
CN111131258A (zh) * 2019-12-26 2020-05-08 中移(成都)信息通信科技有限公司 一种基于5g网络切片的安全专网架构系统

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
MOTOROLA MOBILITY, LENOVO: "Solution for network slice authentication and authorisation", 3GPP DRAFT; S2-188261_ENS_SOL-SLICEAUTH_V02, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG2, no. Sophia Antipolis, France; 20180820 - 20180824, 14 August 2018 (2018-08-14), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France , XP051537180 *
See also references of EP4092987A4 *

Also Published As

Publication number Publication date
EP4092987A4 (en) 2023-10-18
US20230143835A1 (en) 2023-05-11
CN117118841A (zh) 2023-11-24
CN113852483A (zh) 2021-12-28
EP4092987A1 (en) 2022-11-23
CN113852483B (zh) 2023-09-05

Similar Documents

Publication Publication Date Title
WO2022001474A1 (zh) 网络切片连接管理方法、终端及计算机可读存储介质
CN110199513B (zh) 一种会话处理方法及设备
US10038755B2 (en) Method, apparatus and system for provisioning a push notification session
US9130935B2 (en) System and method for providing access credentials
US9131026B2 (en) Method and system for establishing media channel based on relay
JP4376711B2 (ja) アクセス管理方法及びその装置
US8136144B2 (en) Apparatus and method for controlling communication through firewall, and computer program product
CN110800331A (zh) 网络验证方法、相关设备及系统
US20110107104A1 (en) METHOD, SYSTEM, AND DEVICE FOR NEGOTIATING SA ON IPv6 NETWORK
KR20070019704A (ko) 사용자가 아이피망에 접속시 로컬 관리 도메인에서사용자를 위한 접속 인증을 관리하기 위한 방법 및 시스템
WO2013104143A1 (zh) 一种面向异构网络的认证方法及系统
CN107872445B (zh) 接入认证方法、设备和认证系统
CN109936515B (zh) 接入配置方法、信息提供方法及装置
EP3932044B1 (en) Automatic distribution of dynamic host configuration protocol (dhcp) keys via link layer discovery protocol (lldp)
CN114553480B (zh) 跨域单点登录方法、装置、电子设备及可读存储介质
US8051464B2 (en) Method for provisioning policy on user devices in wired and wireless networks
JP4584776B2 (ja) ゲートウェイ装置およびプログラム
CN113810330A (zh) 发送验证信息的方法、装置及存储介质
CN114844674B (zh) 动态授权方法、系统、电子设备及存储介质
US10721603B1 (en) Managing network connectivity using network activity requests
CN116015746A (zh) 网络连接方法、装置及系统
CN115296847A (zh) 流量控制方法、装置、计算机设备和存储介质
CN117155668A (zh) 一种信息的发送方法、装置及电子设备

Legal Events

Date Code Title Description
ENP Entry into the national phase

Ref document number: 2021834414

Country of ref document: EP

Effective date: 20220819

NENP Non-entry into the national phase

Ref country code: DE