WO2022033491A1 - 用于鉴权的方法和通信装置 - Google Patents

用于鉴权的方法和通信装置 Download PDF

Info

Publication number
WO2022033491A1
WO2022033491A1 PCT/CN2021/111909 CN2021111909W WO2022033491A1 WO 2022033491 A1 WO2022033491 A1 WO 2022033491A1 CN 2021111909 W CN2021111909 W CN 2021111909W WO 2022033491 A1 WO2022033491 A1 WO 2022033491A1
Authority
WO
WIPO (PCT)
Prior art keywords
information
identification information
user equipment
multicast
message
Prior art date
Application number
PCT/CN2021/111909
Other languages
English (en)
French (fr)
Inventor
李濛
杨艳梅
王亚鑫
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2022033491A1 publication Critical patent/WO2022033491A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/06—Selective distribution of broadcast services, e.g. multimedia broadcast multicast service [MBMS]; Services to user groups; One-way selective calling services
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/06—Selective distribution of broadcast services, e.g. multimedia broadcast multicast service [MBMS]; Services to user groups; One-way selective calling services
    • H04W4/08—User group management

Definitions

  • the present application relates to the field of communication, and more particularly, to a method and a communication apparatus for authentication.
  • a multicast user plane connection can be established to send data, so that the data of the same content sent to different user equipments only Selecting one copy to send is beneficial to improve the utilization efficiency of air interface side resources and core network resources.
  • the present application provides a method and a communication device for authentication, which can realize the authentication of a joining request of a user equipment.
  • the present application provides a method for authentication, the method comprising: a first session management function network element SMF obtains first information and first identification information of multicast data, the first information is used for for determining the first user identification information of the user equipment; the first SMF sends a first message to the application server, where the first message is used to request authentication of the user equipment's request to join a multicast group, The first message includes the first user identification information and the second identification information of the multicast data, the first identification information and the second identification information correspond to the multicast group; the first SMF receiving application A second message sent by the server, where the second message includes authentication result information.
  • the first user identification information is information for uniquely identifying the user equipment and identifiable by the application server.
  • the first user identification information may be a generic public subscription identifier (GPSI).
  • GPSI generic public subscription identifier
  • the second user identification information may be information used to uniquely identify the user equipment and which can be identified by the core network device and the access network device.
  • the second user identification information may include at least one of a user permanent identifier (subscriber permanent ID, SUPI), a universally unique temporary identifier (globally unique temporary ID, GUTI), and a subscriber concealed identifier (SUCI) .
  • a user permanent identifier subscriber permanent ID, SUPI
  • a universally unique temporary identifier globalally unique temporary ID, GUTI
  • SUCI subscriber concealed identifier
  • the first identification information and the second identification information of the multicast data correspond to the multicast group that the user equipment requests to join, and may include the temporary mobile group identifier (temporary mobile group identifier, TMGI) of the multicast group corresponding to the multicast data, IP address of the application server that provides multicast data, service identifier (service ID) of multicast data, packet filter (packet filter) information of multicast data, service data flow (service data flow, SDF) of multicast data ) identification rules, the ID of the multicast PDU session used to transmit the multicast data, the ID information of the application (Application ID), the target IP address information of the multicast data (IP multicast address), and the multicast group corresponding to the multicast group At least one of the session's context identification information (Multicast Session Context ID).
  • TMGI temporary mobile group identifier
  • IP address IP address
  • SDF service data flow
  • the first identification information and the second identification information may be the same.
  • the first identification information and the second identification information may be different. Specifically, after acquiring the first identification information, the first SMF may determine the second identification information according to the first identification information, and then send the second identification information to the application server.
  • the first identification information obtained by the first SMF is the TMGI of the multicast group
  • the first SMF determines the ID of the PDU session corresponding to the TMGI according to the TMGI, and sends the ID of the PDU session to the application through the first message server.
  • the first SMF sends the first user identification information and the second identification information to the application server, and the application server performs the authentication operation when the user equipment joins the group, so that the joining request for the user equipment can be realized Authenticate.
  • the application server performs the authentication operation when the user equipment joins the group, so that the joining request for the user equipment can be realized Authenticate.
  • the method further includes: the first SMF determines, according to the first identification information, that the application server needs to join the user equipment to the multicast group Group requests are authenticated.
  • the first SMF may determine whether the application server is required to perform authentication and authorization according to a locally stored policy.
  • the policy may be preconfigured in the first SMF, or may be provided by other network elements (eg PCF, UDM or UDR).
  • the policy is used to indicate whether the first SMF needs to initiate an authentication and authorization process to the application server for the join request carrying the identification information.
  • the first SMF may determine whether the member list information of the multicast group corresponding to the first identification information is stored, and when the member list information includes the first user identifier, the first SMF confirms that the application server is required for authentication Authorization; otherwise, the first SMF determines that the joining request of the user equipment is illegal, and returns an indication of group joining failure to the user equipment.
  • the first information includes the first user identification information and/or the second user identification information of the user equipment.
  • the method further includes: acquiring, by the first SMF, the first user identification information according to the second user identification information .
  • the first SMF acquires the first user identification information according to the second user identification information, including: the first user identification information.
  • An SMF obtains the first user identification information from the first network element according to the second user identification information, and the first network element includes the access and mobility management function network element AMF, the unified data management network element UDM, and the unified data management network element.
  • Repository UDR the access and mobility management function network element AMF, the unified data management network element UDM, and the unified data management network element.
  • acquiring the first information and the first identification information of the multicast data by the first SMF includes: the first SMF obtains the first information from the first SMF The second SMF, the access and mobility management function network element AMF or the second user plane function network element UPF acquires the first information and the first identification information.
  • the sending, by the first SMF to the application server, a first message includes: the first SMF according to the first identification information to determine the identification information of the application server; the first SMF directly sends the first message to the application server, or the first SMF sends the first message to the application server through the first UPF .
  • the sending, by the first SMF to the application server, a first message includes: the first SMF opens a function network element through a network The NEF sends the first message to the application server.
  • the present application provides a method for authentication, the method comprising: an application server receiving a first message from a session management function network element SMF, where the first message is used to request a user equipment to join multiple
  • the first message includes first user identification information and second identification information of multicast data, the second identification information corresponds to the multicast group, and the first user
  • the identification information is the identification information of the user equipment
  • the application server authenticates the request of the user equipment to join the multicast group according to the first user identification information and the second identification information
  • the application server sends a second message to the SMF, where the second message includes authentication result information.
  • the first user identification information is information for uniquely identifying the user equipment and identifiable by the application server.
  • the first user identification information may be GPSI.
  • the second identification information of the multicast data corresponds to the multicast group requested by the user equipment to join, and may include the TMGI of the multicast group corresponding to the multicast data, the IP address of the application server providing the multicast data, and the service of the multicast data.
  • Identification, packet filtering information of multicast data, SDF identification rules of multicast data, ID of multicast PDU session used to transmit multicast data, application ID information, destination IP address information of multicast data, and multicast group At least one of the context identification information of the multicast session corresponding to the group.
  • the SMF sends the first user identification information and the second identification information to the application server, and the application server performs the authentication operation when the user equipment joins the group, so that the user equipment's joining request can be authenticated right.
  • the application server there is no need for the application server to provide explicit multicast group member information to the core network in real time, and authentication when user equipment joins a group can be implemented without the core network having no multicast group member information. operation to help avoid public safety issues.
  • the application server sending the second message to the SMF includes: the application server directly sending the second message to the SMF, or sending the second message through the UPF or a network
  • the open function network element NEF sends the two messages to the SMF.
  • the method further includes:
  • the application server sends a second configuration request message to the second core network device, where the second configuration request message includes the second identification information and subscription information, where the subscription information is used to subscribe the user equipment to join the multicast session notification of events;
  • the application server receives a second configuration response message sent from the second core network device, where the second configuration response message is used to indicate that the second identification information and the subscription information have been stored in a unified data repository.
  • the second core network device is a network opening function network element or a multicast broadcasting service function network element.
  • the SMF serves unicast, or the SMF serves multicast.
  • the present application provides a method for authentication, the method comprising: a user equipment determining a third message, where the third message is used to request to join a multicast group, and the third message includes multiple third identification information of the multicast data, the third identification information corresponds to the multicast group; the user equipment sends the third message to the second user plane network element UPF.
  • the third identification information of the multicast data corresponds to the multicast group requested by the user equipment to join, and may include the TMGI of the multicast group corresponding to the multicast data, the IP address of the application server providing the multicast data, and the service of the multicast data.
  • Identification, packet filtering information of multicast data, SDF identification rules of multicast data, ID of multicast PDU session used to transmit multicast data, application ID information, destination IP address information of multicast data, and multicast group At least one of the context identification information of the multicast session corresponding to the group.
  • the user equipment may initiate joining the multicast group through the user plane network element.
  • the third message further includes second user identification information of the user equipment and/or information for authenticating the user equipment.
  • the third message includes an internet group management protocol (internet group management protocol, IGMP) message and a multicast listener report (multicast listener report). listener report, MLR) message.
  • internet group management protocol internet group management protocol
  • MLR multicast listener report
  • the present application provides a method for authentication, the method comprising: a network device receiving identification information of multicast data, the identification information corresponding to a multicast group requested by a user equipment to join; the The network device sends the identification information to the first session management function network element SMF.
  • the network device sends the identification information of the received multicast data to the first SMF, so that the first SMF is further sent to the application server, so that the application server performs the authentication operation when the user equipment joins the group,
  • authentication of the joining request of the user equipment can be implemented.
  • the application server there is no need for the application server to provide the core network with explicit multicast group member information in real time. In the case where the core network does not have multicast group member information, it is still possible to realize the information about the user equipment joining the group.
  • the authentication operation helps to avoid public safety problems.
  • the method further includes: sending, by the network device, first user identification information of the user equipment and/or first user identification information of the user equipment to the first SMF 2.
  • first user identification information of the user equipment and/or first user identification information of the user equipment to the first SMF 2.
  • the first user identification information is information for uniquely identifying the user equipment and identifiable by the application server.
  • the first user identification information may be GPSI.
  • the second user identification information may be information used to uniquely identify the user equipment and which can be identified by the core network device and the access network device.
  • the second user identification information may include at least one of SUPI, GUTI and SUCI.
  • the network device includes a second SMF, an access and mobility management function network element AMF, a unified data management network element UDM, and a unified data management network element Repository UDR and second user plane functional network element UPF.
  • the present application provides a method for authentication, the method comprising: a user equipment determining a fourth message, where the fourth message includes identification information of multicast data and first security information, the first A piece of security information is used to authenticate the request of the user equipment to join a multicast group, and the identification information corresponds to the multicast group; the user equipment sends the fourth message to the first network device.
  • the identification information of the multicast data corresponds to the multicast group requested by the user equipment to join, and may include the TMGI of the multicast group corresponding to the multicast data, the IP address of the application server providing the multicast data, the service identifier of the multicast data, Packet filtering information of multicast data, SDF identification rules of multicast data, ID of multicast PDU session used to transmit multicast data, application ID information, target IP address information of multicast data, and multicast group correspondence at least one of the context identification information of the multicast session.
  • the user equipment provides the first network device with the first security information for authentication and the identification information of the multicast data, and the first network device can execute the user equipment joining the group according to the security information.
  • the authentication operation can be implemented to authenticate the join request of the user equipment.
  • the application server there is no need for the application server to provide explicit multicast group member information to the core network in real time, and authentication when user equipment joins a group can be implemented without the core network having no multicast group member information. operation to help avoid public safety issues.
  • the first security information includes at least one of password information, input information of a security algorithm, and a security algorithm.
  • the method further includes: acquiring, by the user equipment, the first security information from an application server.
  • the first network device is an access network device or a core network device.
  • the core network device includes a first session management function network element SMF and a unified data management network element UDM.
  • the present application provides a method for authentication, the method comprising: a first network device receiving a fourth message from a user equipment, where the fourth message includes identification information of multicast data and a first security information, the first security information is used to authenticate the request of the user equipment to join a multicast group, and the identification information corresponds to the multicast group; security information and second security information, which are used to authenticate the request of the user equipment to join the multicast group, and the second security information is used to authenticate the request of the user equipment to join the multicast group Authentication, the second security information corresponds to the multicast group.
  • the identification information of the multicast data corresponds to the multicast group requested by the user equipment to join, and may include the TMGI of the multicast group corresponding to the multicast data, the IP address of the application server providing the multicast data, the service identifier of the multicast data, Packet filtering information of multicast data, SDF identification rules of multicast data, ID of multicast PDU session used to transmit multicast data, application ID information, target IP address information of multicast data, and multicast group correspondence at least one of the context identification information of the multicast session.
  • the application server can provide security information for authentication to the user equipment and the network device, and the network device can perform the authentication operation when the user equipment joins the group according to the security information, so that the authentication of the user equipment can be realized.
  • the join request of the user equipment is authenticated.
  • the application server there is no need for the application server to provide explicit multicast group member information to the core network in real time, and authentication when user equipment joins a group can be implemented without the core network having no multicast group member information. operation to help avoid public safety issues.
  • the first security information is password information
  • the second security information is password information
  • the first security information is input information of a security algorithm
  • the second security information is the security algorithm; or, the first security information is a security algorithm; the second security information is input information of the security algorithm.
  • the method further includes: acquiring, by the first network device, the second security information from an application server.
  • the first network device when the first network device is the first session management function network element SMF, the first network device obtains the information from the application server
  • the second security information includes: the first network device obtains the second security information from an application server through NEF and UDM.
  • the first network device Acquiring the second security information from the application server includes: the first network device acquires the second security information from the application server through the NEF and the first SMF; or, the first network device obtains the second security information from the application server through the NEF The server obtains the second security information.
  • the first network device when the first network device is an access network device, the first network device obtains the second security from an application server
  • the information includes: the first network device obtains the second security information from the application server through the first AMF, the first SMF, the UDM and the NEF.
  • the first network device when the first network device is the first session management function network element SMF, the first network device receives data from the user equipment
  • the fourth message includes: the first network device receives the fourth message through the second SMF, the access and mobility management function network element AMF, or the second user plane function network element UPF.
  • the first network device Receiving the fourth message from the user equipment includes: the first network device receiving the fourth message through the first SMF or the second SMF.
  • the fourth message is a radio resource control RRC message.
  • the present application provides a method for authentication, the method comprising: a second network device receiving second security information, where the second security information is used to request a user equipment to join a multicast group Perform authentication; the second network device sends the second security information.
  • the second network device receives and sends the second security information, which can facilitate the first network device performing the authentication and authorization operation to obtain the second security information, thereby realizing the authentication when the user equipment joins the group according to the security information.
  • the authorization operation can be implemented to authenticate the join request of the user equipment.
  • the second security information includes at least one of password information, input information of a security algorithm, and a security algorithm.
  • the method further includes: the second network device receives identification information of the multicast data, the identification information being the same as the multicast data. corresponding to the broadcast group.
  • the second network device includes UDM, UDR, NEF, first SMF, and access and mobility management function network element AMF.
  • the present application provides a method for authentication, the method comprising: an application server generating first security information and second security information, wherein the first security information and the second security information are used for Authenticating the request of the user equipment to join the multicast group; the application server sends the first security information to the user equipment; the application server sends the second security information to the first network device.
  • the application server generates the first security information and the second security information, sends the first security information to the user equipment, and sends the second security information to the first network device.
  • the information executes the authentication operation when the user equipment joins the group, so that the user equipment's joining request can be authenticated.
  • the application server there is no need for the application server to provide explicit multicast group member information to the core network in real time, and authentication when user equipment joins a group can be implemented without the core network having no multicast group member information. operation to help avoid public safety issues.
  • the first security information is password information
  • the second security information is password information
  • the first security information is input information of a security algorithm
  • the second security information is the security algorithm; or, the first security information is a security algorithm; the second security information is input information of the security algorithm.
  • the application server when the first network device is the first session management function network element SMF, the application server sends a message to the first network device.
  • the second security information includes: the application server sends the second security information to the first network device through NEF and UDM.
  • the application server sends the Sending the second security information by a network device includes: the application server sending the second security information to the first network device through the NEF and the first SMF; or, the application server sending the second security information to the first network device through the NEF A network device sends the second security information.
  • the application server when the first network device is an access network device, the application server sends the second security
  • the information includes: the application server sends the second security information to the first network device through the first AMF, the first SMF, the UDM and the NEF.
  • the present application provides a communication device, the device comprising:
  • a transceiver unit configured to acquire first information and first identification information of the multicast data, where the first information is used to determine the first user identification information of the user equipment;
  • the transceiver unit is further configured to send a first message to an application server, where the first message is used to request authentication of a request of the user equipment to join a multicast group, and the first message includes the first message User identification information and second identification information of the multicast data, the first identification information and the second identification information correspond to the multicast group;
  • the transceiver unit is further configured to receive a second message sent by the application server, where the second message includes authentication result information.
  • the above communication device may be an SMF or a module or unit in the SMF.
  • the first user identification information is information for uniquely identifying the user equipment and identifiable by the application server.
  • the first user identification information may be GPSI.
  • the second user identification information may be information used to uniquely identify the user equipment and which can be identified by the core network device and the access network device.
  • the second user identification information may include at least one of SUPI, GUTI and SUCI.
  • the first identification information and the second identification information of the multicast data correspond to the multicast group requested by the user equipment to join, and may include the TMGI of the multicast group corresponding to the multicast data, the IP address of the application server providing the multicast data, Service identifier of multicast data, packet filtering information of multicast data, SDF identification rule of multicast data, ID of multicast PDU session used to transmit multicast data, ID information of application, destination IP address information of multicast data , and at least one of the context identification information of the multicast session corresponding to the multicast group.
  • the first identification information and the second identification information may be the same.
  • the first identification information and the second identification information may be different. Specifically, after acquiring the first identification information, the communication device may determine the second identification information according to the first identification information, and then send the second identification information to the application server.
  • the first identification information obtained by the communication device is the TMGI of the multicast group
  • the communication device determines the ID of the PDU session corresponding to the TMGI according to the TMGI, and sends the ID of the PDU session to the application server through the first message.
  • the communication device sends the first user identification information and the second identification information to the application server, and the application server performs the authentication operation when the user equipment joins the group, so that the request for joining the user equipment can be processed.
  • Authentication there is no need for the application server to provide explicit multicast group member information to the core network in real time, and authentication when user equipment joins a group can be implemented without the core network having no multicast group member information. operation to help avoid public safety issues.
  • the apparatus further includes:
  • a processing unit configured to determine, according to the first identification information, that the application server needs to authenticate the request of the user equipment to join the multicast group.
  • the communication device may determine whether the application server is required to perform authentication and authorization according to a locally stored policy.
  • the policy may be preconfigured in the communication device, or may be provided by other network elements (eg PCF, UDM or UDR).
  • the policy is used to indicate whether the communication device needs to initiate an authentication and authorization process to the application server for the join request carrying the identification information.
  • the communication device can determine whether the member list information of the multicast group corresponding to the first identification information is stored, and when the member list information includes the first user identifier, the communication device confirms that the application server is required to perform authentication and authorization; Otherwise, the communication apparatus determines that the joining request of the user equipment is invalid, and returns an indication of group joining failure to the user equipment.
  • the first information includes the first user identification information and/or the second user identification information of the user equipment.
  • the processing unit is further configured to acquire the first user identification information according to the second user identification information.
  • the transceiver unit is specifically configured to acquire the first user identification information from the first network element according to the second user identification information
  • the first network element includes an access and mobility management function network element AMF, a unified data management network element UDM, and a unified data repository UDR.
  • the transceiver unit is specifically configured to receive data from the second SMF, the access and mobility management function network element AMF, or the second user plane function network.
  • the meta-UPF acquires the first information and the first identification information.
  • the transceiver unit is specifically configured to determine the identification information of the application server according to the first identification information; The application server sends the first message, or sends the first message to the application server through the first UPF.
  • the transceiver unit is specifically configured to send the first message to the application server through a network open function network element NEF.
  • the present application provides a communication device, the device comprising:
  • a transceiver unit configured to receive a first message from the session management function network element SMF, where the first message is used to request authentication of a request for a user equipment to join a multicast group, and the first message includes a first user identity information and second identification information of the multicast data, the second identification information corresponds to the multicast group, and the first user identification information is the identification information of the user equipment;
  • a processing unit configured to authenticate the request of the user equipment to join the multicast group according to the first user identification information and the second identification information;
  • the transceiver unit is further configured to send a second message to the SMF, where the second message includes authentication result information.
  • the above-mentioned communication apparatus may be an application server or a module or unit in an application server.
  • the first user identification information is information for uniquely identifying the user equipment and identifiable by the application server.
  • the first user identification information may be GPSI.
  • the second identification information of the multicast data corresponds to the multicast group requested by the user equipment to join, and may include the TMGI of the multicast group corresponding to the multicast data, the IP address of the application server providing the multicast data, and the service of the multicast data.
  • Identification, packet filtering information of multicast data, SDF identification rules of multicast data, ID of multicast PDU session used to transmit multicast data, application ID information, destination IP address information of multicast data, and multicast group At least one of the context identification information of the multicast session corresponding to the group.
  • the SMF sends the first user identification information and the second identification information to the communication device, and the communication device performs the authentication operation when the user equipment joins the group, so that the user equipment's joining request can be authenticated. right.
  • the communication device there is no need for the communication device to provide the core network with explicit multicast group member information in real time, and authentication when the user equipment joins the group can be implemented without the core network having no multicast group member information. operation to help avoid public safety issues.
  • the transceiver unit is specifically configured to directly send the second message to the SMF, or send the second message to the SMF through the UPF or the network open function network element NEF Two news.
  • the method further includes:
  • the application server sends a second configuration request message to the second core network device, where the second configuration request message includes the second identification information and subscription information, where the subscription information is used to subscribe the user equipment to join the multicast session notification of events;
  • the application server receives a second configuration response message sent from the second core network device, where the second configuration response message is used to indicate that the second identification information and the subscription information have been stored in a unified data repository.
  • the second core network device is a network opening function network element or a multicast broadcasting service function network element.
  • the SMF serves unicast, or the SMF serves multicast.
  • the present application provides a communication device, the device comprising:
  • a processing unit configured to determine a third message, where the third message is used to request to join a multicast group, the third message includes third identification information of the multicast data, the third identification information and the multicast group correspondence;
  • a transceiver unit configured to send the third message to the second user plane network element UPF.
  • the above communication apparatus may be user equipment or a module or unit in the user equipment.
  • the third identification information of the multicast data corresponds to the multicast group requested by the communication device to join, and may include the TMGI of the multicast group corresponding to the multicast data, the IP address of the application server providing the multicast data, and the service of the multicast data.
  • Identification, packet filtering information for multicast data, SDF identification rules for multicast data, ID of a multicast PDU session used to transmit multicast data, application ID information, destination IP address information for multicast data, and multicast group At least one of the context identification information of the multicast session corresponding to the group.
  • the communication device may initiate joining the multicast group through the user plane network element.
  • the third message further includes second user identification information of the user equipment and/or information used to authenticate the user equipment.
  • the third message includes an IGMP message and an MLR message.
  • the present application provides a communication device, the device comprising:
  • a transceiver unit configured to receive identification information of the multicast data, where the identification information corresponds to the multicast group requested by the user equipment to join;
  • the transceiver unit is further configured to send the identification information to the first session management function network element SMF.
  • the communication device sends the identification information of the received multicast data to the first SMF, so that the first SMF further sends it to the application server, so that the application server performs the authentication operation when the user equipment joins the group,
  • authentication of the joining request of the user equipment can be implemented.
  • the application server there is no need for the application server to provide the core network with explicit multicast group member information in real time. In the case where the core network does not have multicast group member information, it is still possible to realize the information about the user equipment joining the group.
  • the authentication operation helps to avoid public safety problems.
  • the transceiver unit is further configured to send the first user identification information of the user equipment and/or the second user of the user equipment to the first SMF identifying information.
  • the first user identification information is information for uniquely identifying the user equipment and identifiable by the application server.
  • the first user identification information may be GPSI.
  • the second user identification information may be information used to uniquely identify the user equipment and which can be identified by the core network device and the access network device.
  • the second user identification information may include at least one of SUPI, GUTI and SUCI.
  • the communication device includes a second SMF, an access and mobility management function network element AMF, a unified data management network element UDM and a unified data management network element.
  • the present application provides a communication device, the device comprising:
  • a processing unit configured to determine a fourth message, where the fourth message includes identification information of the multicast data and first security information, where the first security information is used to authenticate a request of the user equipment to join a multicast group right, the identification information corresponds to the multicast group;
  • a transceiver unit configured to send the fourth message to the first network device.
  • the above communication apparatus may be user equipment or a module or unit in the user equipment.
  • the identification information of the multicast data corresponds to the multicast group requested by the communication device to join, and may include the TMGI of the multicast group corresponding to the multicast data, the IP address of the application server providing the multicast data, the service identifier of the multicast data, Packet filtering information of multicast data, SDF identification rules of multicast data, ID of multicast PDU session used to transmit multicast data, ID information of application, target IP address information of multicast data, and multicast group correspondence at least one of the context identification information of the multicast session.
  • the communication device provides the first network device with the first security information for authentication and the identification information of the gambling data, and the first network device can perform the user equipment's process of joining the group according to the security information.
  • the authentication operation can be implemented to authenticate the join request of the user equipment.
  • the application server there is no need for the application server to provide explicit multicast group member information to the core network in real time, and authentication when user equipment joins a group can be implemented without the core network having no multicast group member information. operation to help avoid public safety issues.
  • the first security information includes at least one of password information, input information of a security algorithm, and a security algorithm.
  • the transceiver unit is further configured to acquire the first security information from an application server.
  • the first network device is an access network device or a core network device.
  • the core network device includes a first session management function network element SMF and a unified data management network element UDM.
  • the present application provides a communication device, the device comprising:
  • a transceiving unit receiving a fourth message from the user equipment, where the fourth message includes identification information of the multicast data and first security information, where the first security information is used to request the user equipment to join a multicast group performing authentication, the identification information corresponds to the multicast group;
  • a processing unit configured to authenticate the request of the user equipment to join the multicast group according to the first security information and the second security information, and the second security information is used to join the user equipment to the multicast group
  • the request of the multicast group is authenticated, and the second security information corresponds to the multicast group.
  • the identification information of the multicast data corresponds to the multicast group requested by the user equipment to join, and may include the TMGI of the multicast group corresponding to the multicast data, the IP address of the application server providing the multicast data, the service identifier of the multicast data, Packet filtering information of multicast data, SDF identification rules of multicast data, ID of multicast PDU session used to transmit multicast data, application ID information, target IP address information of multicast data, and multicast group correspondence at least one of the context identification information of the multicast session.
  • the application server can provide security information for authentication to the user equipment and the communication device, and the communication device can perform the authentication operation when the user equipment joins the group according to the security information, so that the authentication of the user equipment can be realized.
  • the join request of the user equipment is authenticated.
  • the application server there is no need for the application server to provide explicit multicast group member information to the core network in real time, and authentication when user equipment joins a group can be implemented without the core network having no multicast group member information. operation to help avoid public safety issues.
  • the first security information is password information
  • the second security information is password information
  • the first security information is input information of a security algorithm
  • the second security information is the security algorithm; or, the first security information is a security algorithm; the second security information is input information of the security algorithm.
  • the method further includes: acquiring, by the first network device, the second security information from an application server.
  • the transceiver unit when the communication device is the first session management function network element SMF, the transceiver unit is specifically configured to pass NEF and UDM Obtain the second security information from an application server.
  • the transceiver unit when the communication device is a unified data management network element UDM or a unified data repository UDR, the transceiver unit is specifically used for The second security information is acquired from the application server through the NEF and the first SMF; or, the second security information is acquired from the application server through the NEF.
  • the transceiver unit when the communication device is an access network device, the transceiver unit is specifically configured to pass the first AMF, the first SMF , UDM and NEF obtain the second security information from the application server.
  • the transceiver unit when the communication device is the first session management function network element SMF, the transceiver unit is specifically configured to pass the second SMF , the access and mobility management function network element AMF or the second user plane function network element UPF receives the fourth message.
  • the transceiver unit when the communication device is a unified data management network element UDM or a unified data repository UDR, the transceiver unit is specifically used for The fourth message is received through the first SMF or the second SMF.
  • the fourth message is a radio resource control RRC message.
  • the present application provides a communication device, the device comprising:
  • a transceiver unit configured to receive second security information, where the second security information is used to authenticate a request of the user equipment to join a multicast group;
  • the transceiver unit is further configured to send the second security information.
  • the communication device receives and sends the second security information, which can facilitate the first network device performing the authentication and authorization operation to obtain the second security information, thereby realizing the authentication operation when the user equipment joins the group according to the security information. , so that the user equipment's joining request can be authenticated.
  • the application server there is no need for the application server to provide explicit multicast group member information to the core network in real time, and authentication when user equipment joins a group can be implemented without the core network having no multicast group member information. operation to help avoid public safety issues.
  • the second security information includes at least one of password information, input information of a security algorithm, and a security algorithm.
  • the transceiver unit is further configured to receive identification information of multicast data, where the identification information corresponds to the multicast group .
  • the communication apparatus includes a UDM, a UDR, a NEF, a first SMF, and an access and mobility management function network element AMF.
  • the present application provides a communication device, the device comprising:
  • a processing unit configured to generate first security information and second security information, where the first security information and the second security information are used to authenticate the request of the user equipment to join the multicast group;
  • a transceiver unit configured to send the first security information to the user equipment
  • the transceiver unit is further configured to send the second security information to the first network device.
  • the above-mentioned communication apparatus may be an application server or a module or unit in an application server.
  • the communication device generates the first security information and the second security information, sends the first security information to the user equipment, and sends the second security information to the first network device, so that the first network device can implement the security
  • the information executes the authentication operation when the user equipment joins the group, so that the user equipment's joining request can be authenticated.
  • the communication device there is no need for the communication device to provide the core network with explicit multicast group member information in real time. In this way, when the core network does not have the multicast group member information, it is possible to realize the information on the user equipment joining the group.
  • the authentication operation helps to avoid public safety problems.
  • the first security information is password information
  • the second security information is password information
  • the first security information is input information of a security algorithm
  • the second security information is the security algorithm; or, the first security information is a security algorithm; the second security information is input information of the security algorithm.
  • the transceiver unit when the first network device is the first session management function network element SMF, the transceiver unit is specifically configured to pass the NEF .
  • the UDM sends the second security information to the first network device.
  • the transceiver unit specifically is configured to send the second security information to the first network device through the NEF and the first SMF; or, the application server sends the second security information to the first network device through the NEF.
  • the transceiver unit when the first network device is an access network device, the transceiver unit is specifically configured to pass the first AMF, the first SMF, UDM and NEF send the second security information to the first network device.
  • the present application provides a method for authentication, the method comprising: a user equipment determining a first join request, where the first join request is used to request to join a first multicast session, the first join request A join request includes fourth identification information, and the fourth identification information corresponds to the first multicast session; the user equipment sends the first join request to the second session management function network element.
  • the second session management function network element is a session management function network element for serving unicast or a session management function network element for managing unicast PDU sessions.
  • the user equipment may initiate joining the multicast group through the control plane network element.
  • the present application provides a method for authentication, the method comprising: a second session management function network element receiving a first join request from a user equipment, where the first join request is used to request a join The first multicast session, the first join request includes fourth identification information, and the fourth identification information corresponds to the first multicast session; the second session management function network element sends the first core network device a tenth message, the tenth message includes third user identification information and the fourth identification information of the user equipment, the third user identification information and the fourth identification information are used to obtain and determine whether to allow the The user equipment joins the first multicast session; the second session management function network element receives first indication information from the first core network device, where the first indication information is used to indicate whether to allow the user equipment Joining the first multicast session; when the first indication information indicates that the user equipment is allowed to join the first multicast session, the second session management function network element accepts the first join request; or , when the first indication information indicates that the user equipment is not allowed to join the first multicast session
  • the second session management function network element is a session management function network element for serving unicast or a session management function network element for managing unicast PDU sessions.
  • the third user identification information may be obtained through the first join request, for example, the first join request includes the third user identification information, or the second SMF according to the local configuration information corresponds to the third user identification of the first join request information.
  • the second SMF may send the third user identification information and the fourth identification information to the first core network device, so that the first core network device can use the third user identification
  • the information and the fourth identification information are authenticated, so that the authentication of the joining request of the user equipment can be realized.
  • the first core network device is a policy control function network element or a unified data management network element.
  • the present application provides a method for authentication, the method comprising: a first core network device receiving a tenth message from a second session management function network element, where the tenth message includes a user equipment
  • the third user identification information and the fourth identification information are used to obtain and determine whether to allow the user equipment to join the first multicast session, and the fourth identification information
  • the information corresponds to the first multicast session;
  • the first core network device receives information from the unified data repository of user equipments that are allowed to join the first multicast session;
  • the first core network device The tenth message and the information of the user equipment allowed to join the first multicast session, send first indication information to the second session management function network element, where the first indication information is used to indicate whether to allow the The user equipment joins the first multicast session.
  • the second session management function network element is a session management function network element for serving unicast or a session management function network element for managing unicast PDU sessions.
  • the list of available user equipments for the multicast session corresponding to the fourth identification information may be stored in the unified data repository, so that the first core network device receives the authentication request from the second session management function network element Afterwards, the unified data storage can be queried for the list of available user equipments for the corresponding multicast session, and then the authentication result can be determined according to the feedback information of the unified data storage and indicated to the second session management function network element, so that the user equipment can be authenticated.
  • the join request is authenticated.
  • the first core network device is a policy control function network element or a unified data management network element.
  • the The first indication information indicates that the user equipment is allowed to join the first multicast session; or, when the information of the user equipment allowed to join the first multicast session does not include the third user identification information, the The first indication information indicates that the user equipment is not allowed to join the first multicast session.
  • the method further includes: the first core network device sends a first query message to the unified data repository, the first query message A query message is used to query the information of the user equipment allowed to join the first multicast session; the first core network device receives the information of the user equipment allowed to join the first multicast session from the unified data repository The information includes: the first core network device receives a first response message from the unified data repository, where the first response message includes the information of the user equipment allowed to join the first multicast session.
  • the present application provides a method for authentication, the method comprising: a unified data repository receives a first query message from a first core network device, where the first query message is used to query permission information of user equipments that join the first multicast session; the unified data repository sends a first response message to the first core network device, where the first response message includes the users who are allowed to join the first multicast session device information.
  • the list of available user equipments for the multicast session corresponding to the fourth identification information may be stored in the unified data repository, so that the first core network device receives the authentication request from the second session management function network element Afterwards, the unified data storage can be queried for the list of available user equipments for the corresponding multicast session, and then the authentication result can be determined according to the feedback information of the unified data storage and indicated to the second session management function network element, so that the user equipment can be authenticated.
  • the join request is authenticated.
  • the method further includes: the unified data repository acquires the information of the user equipment allowed to join the first multicast session from an application function network element or an operator .
  • the application function network element can be implemented to update the information stored in the unified data store in real time according to the service situation of the user equipment allowed to join the first multicast session.
  • the information of the user equipment of a multicast session the scheme is more flexible.
  • the first core network device is a policy control function network element or a unified data management network element.
  • the present application provides a method for authentication, the method comprising: an application function network element sending a first configuration request message to a second core network device, where the first configuration request message includes a first configuration request message. a user equipment list and fourth identification information, where the fourth identification information corresponds to a multicast session, and the first user equipment list is a list of user equipments allowed to join the multicast session corresponding to the fourth identification information;
  • the application function network element receives a first configuration response message sent from the second core network device, where the first configuration response message is used to indicate that the first user equipment list and the fourth identification information have been stored in a unified data repository.
  • the application function network element may store the list of available user equipments for the multicast session corresponding to the fourth identification information in the unified data repository, so that the first core network device receives the second session management function network element
  • the user equipment list available for the corresponding multicast session can be queried from the unified data store, and then the authentication result can be determined according to the feedback information of the unified data store and indicated to the second session management function network element, so as to realize Authenticate the join request of the user equipment.
  • the application function network element can update the first user equipment stored in the unified data store in real time according to the business situation. User equipment list, the scheme is more flexible.
  • the second core network device is a network opening function network element or a multicast broadcasting service function network element.
  • the present application provides a method for authentication, the method comprising: an application function network element receiving a first message from a second session management function network element, where the first message is used to notify The application function network element user equipment requests to join the first multicast session, the first message includes the second identification information and the first user identification information of the user equipment, the second identification information and the corresponding to the first multicast session; the application function network element determines, according to the first message, whether the user equipment is allowed to join the first multicast session; the application function network element sends a message to the second multicast session.
  • the session management function network element sends second indication information whether the second indication information allows the user equipment to join the first multicast session.
  • the second session management function network element is a session management function network element for serving unicast or a session management function network element for managing unicast PDU sessions.
  • the application function network element can subscribe to the second session management function network element for a notification of the user equipment joining event, so that the second session management function network element can send the application function network element to the application function network element when receiving the join request of the user equipment.
  • the application function network element can authenticate the user equipment's joining request and indicate the authentication result to the second session management function network element, so as to realize the joining of the user equipment Request for authentication.
  • the authentication operation when the user equipment joins the group can be implemented without the member information of the multicast group in the core network, which helps to avoid public security problems.
  • the method further includes: the application function network element sends a second configuration request message to the second core network device, where the second configuration request message includes a second identification information and subscription information, the second identification information corresponds to the first multicast session, and the subscription information is used for subscribing to the notification that the user equipment joins the first multicast session; the application function network element receives information from the first multicast session.
  • the second core network device is a network opening function network element or a multicast broadcasting service function network element.
  • the subscription information includes second identification information and an event identifier, and the second identification information corresponds to the first identification information.
  • the event identifier is used to identify the event that the user equipment joins the multicast session.
  • the present application provides a method for authentication, the method comprising: a unified data repository receives subscription information from an application function network element, where the subscription information is used to subscribe a user equipment to join the first notification of a multicast session; the unified data repository sends the subscription information to the second session management function network element.
  • the second session management function network element is a session management function network element for serving unicast or a session management function network element for managing unicast PDU sessions.
  • the application function network element can store the subscription information in the unified data repository, so that the unified data repository can subscribe the second session management function network element to the notification that the user equipment joins the multicast session, so that the second session management function
  • the functional network element receives the join request of the user equipment, it can notify the application function network element that the user equipment requests to join the multicast session, and the application function network element can authenticate the join request of the user equipment and send the authentication result. It is indicated to the second session management function network element, so that the authentication of the joining request of the user equipment can be realized.
  • the authentication operation when the user equipment joins the group can be implemented without the member information of the multicast group in the core network, which helps to avoid public security problems.
  • the subscription information includes second identification information and an event identifier
  • the second identification information corresponds to the first multicast session
  • the event identifier is It is used to identify the user equipment to join the multicast session event.
  • the present application provides a method for authentication, the method comprising: a second session management function network element receiving a first join request from a user equipment, where the first join request is used to request Joining a first multicast session, the first join request includes second identification information, and the second identification information corresponds to the first multicast session; the second session management function network element sends the application function network element A first message, where the first message is used to notify the application function network element that the user equipment requests to join the first multicast session, and the first message includes the second identification information and the user equipment's first user identification information; the second session management function network element receives second indication information from the application function network element, where the second indication information is used to indicate whether the user equipment is allowed to join the first multiple when the second indication information indicates that the user equipment is allowed to join the first multicast session, the second session management function network element accepts the first join request; or when the second indication indicates that the user equipment is allowed to join the first multicast session When the information indicates that the user equipment is not allowed to join the
  • the second session management function network element is a session management function network element for serving unicast or a session management function network element for managing unicast PDU sessions.
  • the second session management function network element may notify the application function network element of the user equipment's request to join the multicast session when receiving the join request of the user equipment, so that the application function network element can access the user equipment to the user equipment.
  • the joining request is authenticated and the authentication result is indicated to the second session management function network element, so that the joining request of the user equipment can be authenticated.
  • the authentication operation when the user equipment joins the group can be implemented without the member information of the multicast group in the core network, which helps to avoid public security problems.
  • the method further includes: the second session management function network element receives subscription information from a unified data repository, where the subscription information is used to subscribe user equipment A notification to join the first multicast session.
  • the unified data repository can subscribe the second session management function network element for a notification of the user equipment joining event, so that the second session management function network element can send the application function network element to the application function network element when receiving the join request of the user equipment. Notify that the user equipment requests to join a multicast session.
  • the subscription information includes second identification information and an event identifier, and the second identification information corresponds to the first identification information.
  • the event identifier is used to identify the event that the user equipment joins the multicast session.
  • the present application provides a communication apparatus, the apparatus includes: a processing unit configured to determine a first join request, where the first join request is used for requesting to join a first multicast session, the first join request A join request includes fourth identification information, and the fourth identification information corresponds to the first multicast session; a transceiver unit is configured to send the first join request to the second session management function network element.
  • the second session management function network element is a session management function network element for serving unicast or a session management function network element for managing unicast PDU sessions.
  • the communication device may initiate joining the multicast group through the network element of the control plane.
  • the present application provides a communication apparatus, the apparatus includes: a transceiver unit configured to receive a first join request from a user equipment, where the first join request is used to request to join a first multicast session , the first join request includes fourth identification information, where the fourth identification information corresponds to the first multicast session; and sends a tenth message to the first core network device, where the tenth message includes the user equipment the third user identification information and the fourth identification information, the third user identification information and the fourth identification information are used to obtain and determine whether to allow the user equipment to join the first multicast session;
  • the first indication information of the first core network device is used to indicate whether the user equipment is allowed to join the first multicast session.
  • a processing unit configured to accept the first join request when the first indication information indicates that the user equipment is allowed to join the first multicast session; or, when the first indication information indicates that the user equipment is not allowed to join When the user equipment joins the first multicast session, the first join request is rejected.
  • the communication device may send the third user identification information and the fourth identification information to the first core network device, so that the first core network device can use the third user identification information according to the third user identification information. and performing authentication with the fourth identification information, so as to realize the authentication of the joining request of the user equipment.
  • the first core network device is a policy control function network element or a unified data management network element.
  • the present application provides a communication apparatus, the apparatus includes: a transceiver unit configured to receive a tenth message from a second session management function network element, where the tenth message includes a third message of a user equipment User identification information and fourth identification information, the third user identification information and the fourth identification information are used to obtain and determine whether to allow the user equipment to join the first multicast session, and the fourth identification information is related to the corresponding to the first multicast session; receiving information from the unified data repository of the user equipment allowed to join the first multicast session; according to the tenth message and the users allowed to join the first multicast session device information, and send first indication information to the second session management function network element, where the first indication information is used to indicate whether the user equipment is allowed to join the first multicast session.
  • the second session management function network element is a session management function network element for serving unicast or a session management function network element for managing unicast PDU sessions.
  • the list of available user equipments for the multicast session corresponding to the fourth identification information can be stored in the unified data storage, so that the communication device can send the authentication request to the network element of the second session management function after receiving the authentication request.
  • the unified data store queries the list of available user equipments for the corresponding multicast session, and then determines the authentication result according to the feedback information from the unified data store and instructs it to the network element of the second session management function, so that the joining request of the user equipment can be processed. Authentication.
  • the first core network device is a policy control function network element or a unified data management network element.
  • the first indication information indicates that the user equipment is allowed to join the first multicast session; or, when the information of the user equipment allowed to join the first multicast session does not include the third user identification information, The first indication information indicates that the user equipment is not allowed to join the first multicast session.
  • the transceiver unit is further configured to send a first query message to the unified data repository, where the first query message is used for query the information of the user equipment allowed to join the first multicast session; the transceiver unit is specifically configured to: receive a first response message from the unified data repository, where the first response message includes the permission Information of user equipments joining the first multicast session.
  • the present application provides a communication device, the device includes: a transceiver unit configured to receive a first query message from a first core network device, where the first query message is used to query permission to join the first query message. information of a user equipment of a multicast session; sending a first response message to the first core network device, where the first response message includes the information of the user equipment allowed to join the first multicast session.
  • the list of available user equipments for the multicast session corresponding to the fourth identification information may be stored in the communication device, so that the first core network device may, after receiving the authentication request from the second session management function network element, The communication device is queried for the list of available user equipments for the corresponding multicast session, and the authentication result is determined according to the feedback information of the communication device and indicated to the second session management function network element, so that the user equipment joining request can be authenticated.
  • the transceiver unit is specifically configured to: obtain the information of the user equipment allowed to join the first multicast session from an application function network element or an operator.
  • the application function network element can be implemented to update in real time the information stored in the communication device that is allowed to join the first multicast session according to the service situation information of user equipment, the scheme is more flexible.
  • the first core network device is a policy control function network element or a unified data management network element.
  • the present application provides a communication apparatus, the apparatus includes: a transceiver unit configured to send a first configuration request message to a second core network device, where the first configuration request message includes a first user equipment a list and fourth identification information, the fourth identification information corresponds to a multicast session, and the first user equipment list is a list of user equipments allowed to join the multicast session corresponding to the fourth identification information; The first configuration response message sent by the second core network device, where the first configuration response message is used to indicate that the first user equipment list and the fourth identification information have been stored in the unified data repository.
  • the communication device may store the list of available user equipments for the multicast session corresponding to the fourth identification information in the unified data storage database, so that the first core network device receives the authentication of the second session management function network element.
  • the user equipment list available for the corresponding multicast session can be queried from the unified data store, and then the authentication result can be determined according to the feedback information of the unified data store and indicated to the second session management function network element, so that the user equipment can be monitored for the user.
  • the device's join request is authenticated.
  • the communication device can update the first user equipment list stored in the unified data store in real time according to the business situation, The program is more flexible.
  • the second core network device is a network opening function network element or a multicast broadcasting service function network element.
  • the present application provides a communication device, the device includes: a transceiver unit configured to receive a first message from a second session management function network element, where the first message is used to notify the application function
  • the network element user equipment requests to join the first multicast session, the first message includes the second identification information and the first user identification information of the user equipment, and the second identification information is the same as the first multicast session.
  • a processing unit configured to determine, according to the first message, whether the user equipment is allowed to join the first multicast session; the transceiver unit is further configured to report to the second session management function network
  • the element sends second indication information whether the second indication information allows the user equipment to join the first multicast session.
  • the second session management function network element is a session management function network element for serving unicast or a session management function network element for managing unicast PDU sessions.
  • the communication device may subscribe the second session management function network element for a notification of the user equipment joining event, so that the second session management function network element can notify the communication device of the user equipment join request when receiving the user equipment's joining request.
  • the communication device can authenticate the user equipment's joining request and indicate the authentication result to the second session management function network element, so that the user equipment's joining request can be authenticated.
  • the authentication operation when the user equipment joins the group can be implemented without the member information of the multicast group in the core network, which helps to avoid public security problems.
  • the transceiver unit is further configured to send a second configuration request message to the second core network device, where the second configuration request message includes second identification information and subscription information , the second identification information corresponds to the first multicast session, and the subscription information is used to subscribe to a notification that the user equipment joins the first multicast session; receive a second configuration response sent from the second core network device message, the second configuration response message is used to indicate that the second identification information and the subscription information have been stored in the unified data store.
  • the second core network device is a network opening function network element or a multicast broadcasting service function network element.
  • the subscription information includes second identification information and an event identifier, and the second identification information corresponds to the first identification information.
  • the event identifier is used to identify the event that the user equipment joins the multicast session.
  • the present application provides a communication apparatus, the apparatus includes: a transceiver unit, configured to receive subscription information from an application function network element, where the subscription information is used to subscribe a user equipment to join a first multicast session and send the subscription information to the second session management function network element.
  • the second session management function network element is a session management function network element for serving unicast or a session management function network element for managing unicast PDU sessions.
  • the application function network element can store the subscription information in the communication device, so that the communication device can subscribe to the second session management function network element for a notification that the user equipment joins the multicast session, so that the second session management function network element
  • the application function network element can authenticate the joining request of the user equipment and indicate the authentication result to the first Two session management function network elements, so as to realize the authentication of the joining request of the user equipment.
  • the authentication operation when the user equipment joins the group can be implemented without the member information of the multicast group in the core network, which helps to avoid public security problems.
  • the subscription information includes second identification information and an event identifier
  • the second identification information corresponds to the first multicast session
  • the event identifier is It is used to identify the user equipment to join the multicast session event.
  • the present application provides a communication apparatus, the apparatus includes: a transceiver unit, configured to receive a first join request from a user equipment, where the first join request is used to request to join a first multicast session , the first join request includes second identification information, and the second identification information corresponds to the first multicast session; a first message is sent to the application function network element, where the first message is used to notify the application
  • the user equipment of the functional network element requests to join the first multicast session, and the first message includes the second identification information and the first user identification information of the user equipment; and receives a message from the application function network element.
  • second indication information where the second indication information is used to indicate whether the user equipment is allowed to join the first multicast session.
  • a processing unit configured to accept the first join request when the second indication information indicates that the user equipment is allowed to join the first multicast session; or when the second indication information indicates that the user is not allowed to join When the device joins the first multicast session, it rejects the first join request.
  • the second session management function network element is a session management function network element for serving unicast or a session management function network element for managing unicast PDU sessions.
  • the communication device when receiving the joining request of the user equipment, may notify the application function network element that the user equipment requests to join the multicast session, so that the application function network element can authenticate the joining request of the user equipment
  • the authentication result is indicated to the communication device, so that the user equipment's joining request can be authenticated.
  • the authentication operation when the user equipment joins the group can be implemented without the member information of the multicast group in the core network, which helps to avoid public security problems.
  • the transceiver unit is further configured to: receive subscription information from a unified data repository, where the subscription information is used to subscribe the user equipment to join the first multicast Session notifications.
  • the unified data repository can subscribe the communication device to the notification of the user equipment joining event, so that the communication device can notify the application function network element of the user equipment's request to join the multicast session when receiving the user equipment's joining request.
  • the subscription information includes second identification information and an event identifier, and the second identification information corresponds to the first identification information.
  • the event identifier is used to identify the event that the user equipment joins the multicast session.
  • the present application provides a method for authentication, the method comprising: a unified data repository receives a third query message from a first core network device, where the third query message includes a third query message.
  • the third query message is used to query the information of the multicast session to which the user equipment identified by the third user identification information is allowed to join;
  • the unified data repository sends the third A response message, the third response message includes information of a multicast session that the user equipment is allowed to join.
  • the third query message is used to query the information of the multicast session to which the user equipment identified by the third user identification information is allowed to join, and the third query message may be used to query the session-related information of the user equipment, and the unified data
  • the repository includes, in the session-related information fed back to the user equipment of the first core network device, information for indicating a multicast session to which the user equipment is allowed to join.
  • the list of user equipments available for the multicast session is stored in the unified data repository, so that the session management function network element can use the identifier of the user equipment as an index in the process of establishing a unicast session of the user equipment
  • a multicast service that allows user equipment to join is requested from the unified data store, and then the user equipment's joining request is authenticated according to the information fed back by the unified data store, so that the user equipment's joining request can be authenticated.
  • the method further includes: acquiring, by the unified data repository, identification information corresponding to the multicast session and a user equipment list from an application function network element or an operator,
  • the user equipment list is a list of user equipments that are allowed to join the multicast session;
  • the unified data repository determines the user equipment that is allowed to join the multicast session according to the third query message, the identification information, and the user equipment list Information about the multicast sessions that the device joined.
  • the first core network device is a policy control function network element or a unified data management network element.
  • the present application provides a method for authentication, the method comprising: a first core network device receiving a fourteenth message from a second session management function network element, the fourteenth message
  • the information used to request the multicast session that the user equipment is allowed to join, the fourteenth message includes the third user identification information of the user equipment; the information of the multicast service that the user equipment joins; the first core network device sends the information of the multicast service that the user equipment is allowed to join to the second session management function network element.
  • the fourteenth message is used to request the information of the multicast session that the user equipment is allowed to join, and it can also be replaced with the fourteenth message used to query the session-related information of the user equipment, and the first core network device is feeding back to the second session.
  • the session-related information of the user equipment of the management function network element includes information used to indicate the multicast service that the user equipment is allowed to join.
  • the second session management function network element sends the identification information of the user equipment to the first core network device, so that the first core network device can obtain the multicast service that the user equipment is allowed to join according to the user's identification as an index, and feed it back to the second session management function network element, so that the second session management function network element authenticates the join request of the user equipment in the process of establishing the unicast session of the user equipment, so that the join request of the user equipment can be realized. Authenticate.
  • the first core network device obtains, according to the third user identification information, information about a multicast service that the user equipment is allowed to join, including: the first A core network device sends a third query message to the unified data repository, where the third query message includes third user identification information, and is used to query the information of the multicast session that the user equipment is allowed to join; the first core network The device receives a third response message from the unified data store, the third response message including the information of the multicast session to which the user device is allowed to join.
  • the third query message is used to query the information of the multicast session that the user equipment is allowed to join, and it can also be replaced by the third query message is used to query the session related information of the user equipment, and the unified data store is fed back to the first core network
  • the session related information of the user equipment of the device includes information used to indicate the multicast service that the user equipment is allowed to join.
  • the list of user equipments available for the multicast session is stored in the unified data repository, so that the session management function network element can use the identifier of the user equipment as an index in the process of establishing a unicast session of the user equipment
  • a multicast service that allows user equipment to join is requested from the unified data store, and then the user equipment's joining request is authenticated according to the information fed back by the unified data store, so that the user equipment's joining request can be authenticated.
  • the application function network element may also The list of user equipments available for the multicast session is stored in the first core network device. After the first core network device receives the fourteenth message, the first core network device can The user identification information and the list of user equipments available for the multicast session determine the multicast session that the user equipment is allowed to access.
  • the first core network device is a policy control function network element or a unified data management network element.
  • the present application provides a method for authentication, the method comprising: a second session management function network element receiving a first join request from a user equipment, where the first join request is used to request Join a first multicast session, the first join request includes fourth identification information, and the fourth identification information corresponds to the first multicast session; when the first multicast session belongs to the user equipment that is allowed to join when the second session management function network element accepts the first join request; or, when the first multicast session does not belong to a multicast session that the user equipment is allowed to join, the first join request The second session management function network element rejects the first join request.
  • the network element of the second session management function can determine whether to receive the joining request of the user equipment according to whether the multicast session requested by the user equipment to join belongs to the multicast session that the user equipment is allowed to join, so that the user equipment can be The join request is authenticated.
  • the first core network device is a policy control function network element or a unified data management network element.
  • the method further includes: the second session management function network element sends a tenth to the first core network device Four messages, the fourteenth message is used to request the information of the multicast session that the user equipment is allowed to join, the fourteenth message includes the third user identification information of the user equipment; the second session management function network element Information about the multicast service allowing the user equipment to join is received from the first core network device.
  • the fourteenth message is used to request the multicast service that the user equipment is allowed to join, and it can also be replaced with the fourteenth message used to query the session-related information of the user equipment, and the first core network device is feeding back to the second session management function
  • the session related information of the user equipment of the network element includes information used to indicate the multicast service that the user equipment is allowed to join.
  • the list of user equipments available for the multicast session is stored in the unified data repository, so that the session management function network element can use the identifier of the user equipment as an index in the process of establishing a unicast session of the user equipment
  • a multicast service that allows user equipment to join is requested from the unified data store, and then the user equipment's joining request is authenticated according to the information fed back by the unified data store, so that the user equipment's joining request can be authenticated.
  • the present application provides a communication device, the device includes: a transceiver unit configured to receive a third query message from a first core network device, where the third query message includes third user identification information , the third query message is used to query the information of the multicast session to which the user equipment identified by the third user identification information is allowed to join; send a third response message to the first core network device, the third response message Include information on multicast sessions to which the user equipment is allowed to join.
  • the third query message is used to query the information of the multicast session to which the user equipment identified by the third user identification information is allowed to join, and the third query message may be used to query the session-related information of the user equipment, and the unified data
  • the repository includes, in the session-related information fed back to the user equipment of the first core network device, information for indicating a multicast session to which the user equipment is allowed to join.
  • the list of user equipments available for the multicast session is stored in the unified data repository, so that the session management function network element can use the identifier of the user equipment as an index in the process of establishing a unicast session of the user equipment
  • a multicast service that allows user equipment to join is requested from the unified data store, and then the user equipment's joining request is authenticated according to the information fed back by the unified data store, so that the user equipment's joining request can be authenticated.
  • the transceiver unit is further configured to acquire identification information corresponding to the multicast session and a user equipment list from an application function network element or an operator, the user equipment list is a list of user equipments that are allowed to join the multicast session; the processing unit is further configured to determine the multicast session to which the user equipment is allowed to join according to the third query message, the identification information, and the list of user equipments Information.
  • the first core network device is a policy control function network element or a unified data management network element.
  • the present application provides a communication apparatus, the apparatus includes: a transceiver unit configured to receive a fourteenth message from a second session management function network element, where the fourteenth message is used to request permission information of the multicast session joined by the user equipment, the fourteenth message includes the third user identification information of the user equipment; according to the third user identification information, obtain the information of the multicast service that the user equipment is allowed to join; Sending the information of the multicast service allowing the user equipment to join to the second session management function network element.
  • a transceiver unit configured to receive a fourteenth message from a second session management function network element, where the fourteenth message is used to request permission information of the multicast session joined by the user equipment, the fourteenth message includes the third user identification information of the user equipment; according to the third user identification information, obtain the information of the multicast service that the user equipment is allowed to join; Sending the information of the multicast service allowing the user equipment to join to the second session management function network element.
  • the fourteenth message is used to request the information of the multicast session that the user equipment is allowed to join, and it can also be replaced with the fourteenth message used to query the session-related information of the user equipment, and the first core network device is feeding back to the second session.
  • the session-related information of the user equipment of the management function network element includes information used to indicate the multicast service that the user equipment is allowed to join.
  • the second session management function network element sends the identification information of the user equipment to the first core network device, so that the first core network device can obtain the multicast service that the user equipment is allowed to join according to the user's identification as an index, and feed it back to the second session management function network element, so that the second session management function network element authenticates the join request of the user equipment in the process of establishing the unicast session of the user equipment, so that the join request of the user equipment can be realized. Authenticate.
  • the transceiver unit is specifically configured to: send a third query message to the unified data repository, where the third query message includes third user identification information, used for Querying information of multicast sessions to which the user equipment is allowed to join; and receiving a third response message from the unified data store, the third response message including information of the multicast sessions to which the user equipment is allowed to join.
  • the third query message is used to query the information of the multicast session that the user equipment is allowed to join, and it can also be replaced with the third query message used to query the session-related information of the user equipment, and the unified data store is feeding back to the first
  • the session related information of the user equipment of the core network device includes information used to indicate the multicast service that the user equipment is allowed to join.
  • the list of user equipments available for the multicast session is stored in the unified data repository, so that the session management function network element can use the identifier of the user equipment as an index in the process of establishing a unicast session of the user equipment
  • a multicast service that allows user equipment to join is requested from the unified data store, and then the user equipment's joining request is authenticated according to the information fed back by the unified data store, so that the user equipment's joining request can be authenticated.
  • the first core network device is a policy control function network element or a unified data management network element.
  • the present application provides a communication apparatus, the apparatus includes: a transceiver unit, configured to receive a first join request from a user equipment, where the first join request is used to request to join a first multicast session , the first join request includes fourth identification information, where the fourth identification information corresponds to the first multicast session; the processing unit is configured to, when the first multicast session belongs to a multicast group that allows the user equipment to join When a multicast session is established, the first join request is accepted, or when the first multicast session does not belong to a multicast session that the user equipment is allowed to join, the first join request is rejected.
  • the communication device can determine whether to receive the join request of the user equipment according to whether the multicast session requested by the user equipment to join belongs to the multicast session that the user equipment is allowed to join, so as to realize the authentication of the join request of the user equipment right.
  • the first core network device is a policy control function network element or a unified data management network element.
  • the transceiver unit is further configured to send a fourteenth message to the first core network device, the fourteenth The message is used to request information of a multicast session that the user equipment is allowed to join, and the fourteenth message includes third user identification information of the user equipment; receiving the information from the first core network device that allows the user equipment Information about joined multicast services.
  • the fourteenth message is used to request the multicast service that the user equipment is allowed to join, and it can also be replaced with the fourteenth message used to query the session-related information of the user equipment, and the first core network device is feeding back to the second session management function
  • the session related information of the user equipment of the network element includes information used to indicate the multicast service that the user equipment is allowed to join.
  • the list of user equipments available for the multicast session is stored in the unified data repository, so that the session management function network element can use the identifier of the user equipment as an index in the process of establishing a unicast session of the user equipment
  • a multicast service that allows user equipment to join is requested from the unified data store, and then the user equipment's joining request is authenticated according to the information fed back by the unified data store, so that the user equipment's joining request can be authenticated.
  • the present application provides a communication device including a processor, a memory and a transceiver.
  • the memory is used to store the computer program
  • the processor is used to call and run the computer program stored in the memory, and control the transceiver to send and receive signals, so that the communication apparatus executes the method in any aspect or any possible implementation manner of the above.
  • the present application provides a communication device, comprising a processor and a communication interface, wherein the communication interface is configured to receive a signal and transmit the received signal to the processor, and the processor processes the signal, A method as in any of the above aspects or any possible implementation thereof is caused to be performed.
  • the above-mentioned communication interface may be an interface circuit
  • the processor may be a processing circuit
  • the present application provides a chip, including a logic circuit and a communication interface, the communication interface is used to perform the sending, receiving or obtaining operations in any of the above-mentioned aspects or any possible implementation manners, so The logic circuit is used to perform the determination process as described in any of the above aspects or any possible implementations thereof.
  • the communication interface may include an input interface and an output interface.
  • the input interface is used to perform a get or receive operation
  • the output interface is used to perform a send operation.
  • the present application provides a computer-readable storage medium, where computer instructions are stored in the computer-readable storage medium. The method in the implementation is executed.
  • the present application provides a computer program product, the computer program product comprising computer program code, when the computer program code is run on a computer, any one of the above-mentioned aspects or any possible implementation manner thereof is provided. The method in is executed.
  • the present application provides a wireless communication system, including any one or more of the communication apparatuses described in any of the foregoing aspects or any possible implementation manners thereof.
  • FIG. 1 is a schematic diagram of a network architecture to which an embodiment of the present application can be applied.
  • FIG. 2 is a schematic diagram of unicast-based multicast.
  • FIG. 3 is a schematic diagram of a unicast/multicast system architecture to which an embodiment of the present application can be applied.
  • FIG. 4 is a schematic flowchart of an authentication method provided by an embodiment of the present application.
  • FIG. 5 is a schematic flowchart of another authentication method according to an embodiment of the present application.
  • FIG. 6 is a schematic flowchart of another authentication method according to an embodiment of the present application.
  • FIG. 7 is a schematic flowchart of another authentication method according to an embodiment of the present application.
  • FIG. 8 is a schematic flowchart of another authentication method according to an embodiment of the present application.
  • FIG. 9 is a schematic flowchart of an authentication method provided by another embodiment of the present application.
  • FIG. 10 is a schematic flowchart of another authentication method according to an embodiment of the present application.
  • FIG. 11 is a schematic flowchart of another authentication method according to an embodiment of the present application.
  • FIG. 12 is a schematic flowchart of another authentication method according to an embodiment of the present application.
  • FIG. 13 is a schematic flowchart of another authentication method according to an embodiment of the present application.
  • FIG. 14 is a schematic flowchart of another authentication method according to an embodiment of the present application.
  • FIG. 15 is a schematic flowchart of another authentication method according to an embodiment of the present application.
  • FIG. 16 is a schematic flowchart of another authentication method according to an embodiment of the present application.
  • FIG. 17 is a schematic flowchart of another authentication method according to an embodiment of the present application.
  • FIG. 18 is a schematic flowchart of another authentication method according to an embodiment of the present application.
  • FIG. 19 is a schematic flowchart of another authentication method according to an embodiment of the present application.
  • FIG. 20 is a schematic structural diagram of a possible device provided by an embodiment of the present application.
  • FIG. 21 is another schematic structural diagram of a possible device provided by an embodiment of the present application.
  • LTE long term evolution
  • FDD frequency division duplex
  • TDD time division duplex
  • UMTS universal mobile telecommunication system
  • WiMAX worldwide interoperability for microwave access
  • 5G fifth generation
  • 5G fifth generation
  • new radio new radio
  • FIG. 1 is a schematic diagram of a network architecture to which an embodiment of the present application can be applied.
  • the network architecture includes: user equipment (UE) 101, radio access network (RAN) 102, user plane function (UPF) network element 103, data network (DN) network element 104, access and mobility management function (AMF) element 105, session management function (session management function, SMF) network element 106, policy control function module (policy control function, PCF) network element 107, unified data management (unified data management, UDM) network element 108, application function (application function, AF) network element 109, unified data repository (unified data repository, UDR) network element 110, and a network exposure function (NEF) network element 111 .
  • UE user equipment
  • RAN radio access network
  • UPF user plane function
  • DN data network
  • AMF access and mobility management function
  • policy control function module policy control function
  • PCF policy control function module
  • the network element 110 and the NEF network element 111 are referred to as UE101, RAN102, UPF103, DN104, AMF105, SMF106, PCF107, UDM108, AF109, UDR110, and NEF111, respectively.
  • the UE101 mainly accesses the 5G network through the wireless air interface and obtains services.
  • the UE101 interacts with the RAN102 through the air interface, and interacts with the AMF105 of the core network through non-access stratum signaling (NAS).
  • NAS non-access stratum signaling
  • the RAN 102 is responsible for air interface resource scheduling and air interface connection management for the UE 101 to access the network.
  • the UPF 103 is responsible for the processing of user data in the user equipment, such as forwarding and charging.
  • the UPF 103 can receive user data from the DN 104 and transmit it to the UE 101 through the RAN 102 , and can also receive user data from the UE 101 through the RAN 102 and forward it to the DN 104 .
  • the transmission resources and scheduling functions that serve the UE 101 in the UPF 103 are managed and controlled by the SMF 106 .
  • DN 104 is an operator network that provides data transmission services for users, for example, Internet Protocol (Internet Protocol, IP) Multimedia Service (IP Multi-media Service, IMS), Internet, etc.
  • IP Internet Protocol
  • IMS IP Multimedia Service
  • the UE 101 accesses the DN 104 by establishing a protocol data unit (protocol data unit, PDU) session between the UE 101 to the RAN 102 to the UPF 103 to the DN 104 .
  • PDU protocol data unit
  • the AMF 105 is mainly responsible for mobility management in the mobile network, such as user location update, user registration network, and user handover.
  • the SMF 106 is mainly responsible for session management in the mobile network, such as session establishment, modification and release. Specific functions include assigning IP addresses to users and selecting UPFs that provide packet forwarding functions.
  • the PCF 107 is responsible for providing policies to the AMF 105 and the SMF 106, for example, a quality of service (quality of service, QoS) policy, a slice selection policy, and the like.
  • a quality of service quality of service, QoS
  • QoS quality of service
  • the UDM 108 is used to store user data, such as subscription information, authentication/authorization information, and the like.
  • AF109 is responsible for providing services to the 3rd generation partnership project (3GPP) network, for example, affecting service routing, interacting with PCF107 for policy control, and the like.
  • 3GPP 3rd generation partnership project
  • the UDR 110 is responsible for storing and retrieving subscription data, policy data, and public architecture data.
  • the NEF111 is used for the operator network to open the data in the network to the third-party application server, or to receive the data provided by the third-party application server for the network.
  • N1 is the interface between UE101 and AMF105
  • N2 is the interface between RAN102 and AMF105, which is used for sending NAS messages, etc.
  • N3 is the interface between RAN102 and UPF103, which is used for transmitting user plane data, etc.
  • N4 is the interface between SMF106 and UPF103, used to transmit information such as tunnel identification information of N3 connection, data buffer indication information, and downlink data notification messages
  • N6 interface is the interface between UPF103 and DN104, used to transmit user information surface data, etc.
  • Nudr is the service-based interface presented by UDR110
  • Namf is the service-based interface presented by AMF105
  • Nsmf is the service-based interface presented by SMF106
  • Nnef is the service-based interface presented by NEF111
  • Npcf is the service-based interface presented by PCF107.
  • Nudm is the service-based interface presented by UDM108
  • Naf is the service-based interface presented by AF109.
  • interfaces between the network elements shown in FIG. 1 may also be point-to-point interfaces, rather than service-oriented interfaces.
  • User equipment in the embodiments of the present application may also be referred to as terminal equipment, user, access terminal, subscriber unit, subscriber station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, terminal, and wireless communication device , user agent or user device, etc.
  • the user device may be a cellular phone, smart watch, wireless data card, cell phone, tablet, personal digital assistant (PDA) computer, wireless modem, handheld device, laptop, machine type communication, MTC) terminal, computer with wireless transceiver function, IoT terminal, virtual reality terminal equipment, augmented reality terminal equipment, wireless terminal in industrial control, wireless terminal in unmanned driving, wireless terminal in remote surgery, smart grid wireless terminals in transportation security, wireless terminals in smart cities, wireless terminals in smart homes, wireless terminals in satellite communications (for example, satellite phones or satellite terminals, etc.) and so on.
  • the embodiments of the present application do not limit the specific technology and specific device form adopted by the user equipment.
  • the access network device in this embodiment of the present application may be a device used for communicating with user equipment, and is mainly responsible for functions such as radio resource management, quality of service management, data compression, and encryption on the air interface side.
  • the access network equipment may be a base station (base transceiver station, BTS) in a global system of mobile communication (GSM) system or a code division multiple access (code division multiple access, CDMA) system, a broadband code division multiple access Base station (nodeB, NB) in (wideband code division multiple access, WCDMA) system, evolved base station (evolutional nodeB, eNB or eNodeB) in LTE system, worldwide interoperability for microwave access (WiMAX) communication
  • CRAN cloud radio access network
  • the access network device may be a terminal that undertakes the function of a base station in D2D communication or machine communication.
  • the access network device may be a network device in a 5G network or a network device in a future evolved PLMN network, or the like.
  • the access network device may also be a module or unit that completes some functions of the base station, for example, may be a centralized unit (central unit, CU), or may be a distributed unit (distributed unit, DU).
  • the embodiments of the present application do not limit the specific technology and specific device form adopted by the access network device.
  • each network element shown in FIG. 1 is only a name, and the name does not limit the function of the network element itself.
  • the foregoing network elements may also have other names, which are not specifically limited in this embodiment of the present application.
  • some or all of the above-mentioned network elements may use the terminology in 5G, or may use other names, etc., which will be uniformly described here, and will not be repeated below.
  • the interface between network elements shown in FIG. 1 is only an example. In the 5G network and other future networks, the interface between network elements may not be the interface shown in the figure, and this application does not make any limited.
  • a communication system to which the present application may be applied may include more or less network elements or devices.
  • the device or network element in FIG. 1 may be hardware, software divided by functions, or a combination of the above two.
  • the devices or network elements in FIG. 1 may communicate with each other through other devices or network elements.
  • a multicast user plane connection can be established to send data, so that only one piece of data with the same content sent to different user equipments can be selected and sent, which is beneficial to improve air interface side resources and the utilization efficiency of core network resources.
  • One way of implementation is through unicast-based multicast technology.
  • FIG. 2 is a schematic diagram of unicast-based multicast.
  • the unicast-based multicast technology does not specifically limit the data transmission between the application server (application server, AS) and the UPF.
  • AS application server
  • the AS can send only one multicast packet to the network.
  • the AS may send a multicast data packet to each UE in the multicast group.
  • the data packets transmitted from the UPF to the access network (access network, AN) and then to the UE, or from the AN to the UE are all multicast data packets with the same content.
  • the UPF selects a copy of the data of the same content sent to different UEs (for example, UE1-UE4 in FIG. 2 ) and sends it to the access network (access network, AN), AN selects a copy of the received data and sends it to UE1-UE4.
  • UPF will send the multicast data packets received from the application server to the access network through the dedicated transmission channel, or through the N3 channel of a UE in the multicast group, AN Send the received data to UE1-UE4.
  • the UPF unicasts the data of the same content sent to different UEs (for example, UE1-UE4 in FIG. 2 ) to the AN, and the AN sends the received data Select a copy to send to UE1-UE4.
  • the UPF will unicast the multicast data received from the application server to the access network through the N3 channel of the UE in the multicast group, and the AN will send the received data to UE1-UE4.
  • FIG. 3 is a schematic diagram of a unicast/multicast system architecture to which an embodiment of the present application can be applied.
  • the SMF in FIG. 3 is the SMF network element used to manage the unicast PDU session
  • the multicast SMF multicast SMF, M-SMF
  • the UPF is the SMF network element used to manage the multicast PDU session.
  • a multicast UPF (multicast UPF, M-UPF) is a UPF network element for processing multicast user data.
  • the first UPF is managed by the first SMF.
  • the M-SMF may be a unicast SMF implemented by an enhanced function, or may be a dedicated network element for managing multicast services.
  • the M-UPF can be a unicast UPF implemented through enhanced functions, or it can be a dedicated network element that manages multicast services.
  • the SMF network elements used for managing multicast PDU sessions are collectively referred to as the first SMF
  • the SMF network elements used for managing unicast PDU sessions are collectively called the second SMF
  • the SMF network elements used for processing multicast users will be collectively referred to as the second SMF.
  • the UPF network elements of the data are collectively referred to as the first UPF
  • the UPF network elements used for processing unicast user data are collectively referred to as the second UPF.
  • the functions of the M-SMF or the first SMF in this application may be included by other network elements.
  • the multicast and broadcast service function (multicast and broadcast service function, MBSF) is implemented, and the MBSF includes related functions for managing multicast services, such as multicast session management function, multicast user authentication function, multicast Data control functions (for example, control of functions such as encryption and encoding of multicast data, etc.), generation of multicast policies, and the like.
  • the M-SMF or the first SMF can be equivalently replaced with these other network elements (eg, MBSF).
  • the present application provides an authentication method and a communication device, which can realize an authentication operation when a UE joins a multicast group.
  • FIG. 4 is a schematic flowchart of an authentication method provided by an embodiment of the present application.
  • the method shown in FIG. 4 can be applied to the system architecture shown in FIG. 1 or the system architecture shown in FIG. 3 , and the embodiment of the present application is not limited thereto.
  • the method in FIG. 4 may be performed by the first SMF and the application server, or may be performed by a module or unit (eg, a circuit, a chip, or a system on chip (SOC), etc.) in the first SMF and the application server.
  • the execution subject is the first SMF and the application server as an example.
  • the method of FIG. 4 may include at least some of the following.
  • step 410 the first SMF acquires the first user identification information of the user equipment and the first identification information of the multicast data.
  • the first user identification information is information for uniquely identifying the user equipment and identifiable by the application server.
  • the first user identification information may be GPSI.
  • the first identification information of the multicast data corresponds to the multicast group that the user equipment requests to join, and may include the TMGI of the multicast group corresponding to the multicast data, the IP address of the application server that provides the multicast data, and the service of the multicast data.
  • Identification, packet filtering information of multicast data, SDF identification rules of multicast data, ID of multicast PDU session used to transmit multicast data, application ID information, destination IP address information of multicast data, and multicast group At least one of the context identification information of the multicast session corresponding to the group.
  • the first identification information of the multicast data is simply referred to as the first identification information hereinafter.
  • the first SMF to obtain the first user identification information and the above-mentioned first identification information, which will be described in detail below with reference to FIGS. 5 to 8 .
  • the first SMF sends a first message to the application server, requesting the application server to authenticate the join request of the user equipment. Accordingly, the application server receives the first message from the first SMF.
  • the first message includes first user identification information and second identification information of the multicast data.
  • the first message may be an authentication and authorization request message.
  • the second identification information of the multicast data corresponds to the multicast group requested by the user equipment to join, and may include the TMGI of the multicast group corresponding to the multicast data, the IP address of the application server providing the multicast data, and the service of the multicast data.
  • Identification, packet filtering information of multicast data, SDF identification rules of multicast data, ID of multicast PDU session used to transmit multicast data, application ID information, destination IP address information of multicast data, and multicast group At least one of the context identification information of the multicast session corresponding to the group.
  • the second identification information of the multicast data is simply referred to as the second identification information hereinafter.
  • the first identification information and the second identification information may be the same.
  • the first identification information and the second identification information may be different. Specifically, after acquiring the first identification information, the first SMF may determine the second identification information according to the first identification information, and then send the second identification information to the application server.
  • the first identification information obtained by the first SMF is the TMGI of the multicast group
  • the first SMF determines the ID of the PDU session corresponding to the TMGI according to the TMGI, and sends the ID of the PDU session to the application through the first message server.
  • step 430 the application server performs authentication according to the first user identification information and the second identification information.
  • the application server may query the database according to the first user identification information and the second identification information. If, for the second identification information, the subscription information of the first user identification information exists in the database, the application server determines that the authentication is successful; otherwise, the application server determines that the authentication fails.
  • step 440 the application server sends result information to the first SMF. Accordingly, the first SMF receives the result information from the application server.
  • the result information is used to indicate the result of the authentication. For example, the result information indicates that the authentication was successful. For another example, the result information indicates that the authentication failed.
  • the application server may also send parameter information for multicast transmission to the first SMF.
  • the parameter information may include QoS parameters of multicast transmission, identification information of multicast sessions, and the like.
  • the first SMF sends the first user identification information and the second identification information to the application server, and the application server performs the authentication operation when the user equipment joins the group, so that the joining request for the user equipment can be realized Authenticate.
  • the application server performs the authentication operation when the user equipment joins the group, so that the joining request for the user equipment can be realized Authenticate.
  • the first SMF may further determine whether the application server needs to perform authentication and authorization. When it is determined that the application server is required to perform authentication and authorization, the first SMF sends the first message to the application server; when it is determined that the application server does not need to perform authentication and authorization, the first SMF does not send the first message to the application server.
  • the first SMF may determine whether the application server is required to perform authentication and authorization according to a locally stored policy.
  • the policy may be preconfigured in the first SMF, or may be provided by other network elements (eg PCF, UDM or UDR).
  • the policy is used to indicate whether the first SMF needs to initiate an authentication and authorization process to the application server for the join request carrying the identification information.
  • the first SMF may determine whether the member list information of the multicast group corresponding to the first identification information is stored, and when the member list information includes the first user identifier, the first SMF confirms that the application server is required for authentication Authorization; otherwise, the first SMF determines that the joining request of the user equipment is illegal, and returns an indication of group joining failure to the user equipment.
  • FIG. 5 is a schematic flowchart of another authentication method according to an embodiment of the present application.
  • the method shown in FIG. 5 can be applied to the system architecture shown in FIG. 1 , and can also be applied to the system architecture shown in FIG. 3 , and the embodiment of the present application is not limited thereto.
  • the first SMF may obtain the first user identification information and the first identification information through control plane signaling, in other words, the user equipment may request to join a multicast group through control plane signaling.
  • the first user identification information and the identification information are transmitted to the first SMF through steps 501 to 503 .
  • step 501 the user equipment sends a third message to the AMF.
  • the AMF receives the third message sent by the user equipment.
  • the user equipment may send the third message through a non-access stratum (non-access stratum, NAS) message, and the third message may include third identification information of the multicast data.
  • the NAS message may include an N1SM container, and the N1SM container may include a PDU session modification request message or a PDU session establishment request message. Further, the PDU session modification request message or the PDU session establishment request message may include the above-mentioned third identifying information.
  • the third identification information of the multicast data corresponds to the multicast group requested by the user equipment to join, and may include the TMGI of the multicast group corresponding to the multicast data, the IP address of the application server providing the multicast data, and the service of the multicast data.
  • Identification, packet filtering information of multicast data, SDF identification rules of multicast data, ID of multicast PDU session used to transmit multicast data, application ID information, destination IP address information of multicast data, and multicast group At least one of the context identification information of the multicast session corresponding to the group.
  • the third identification information of the multicast data is simply referred to as the third identification information hereinafter.
  • the PDU session modification request message or the PDU session establishment request message may further include identification information of the DN and/or information used for authentication and authorization, and the like.
  • the identification information of the DN may be the ID of the DN or the name of the DN, or the like.
  • the information used for authentication and authorization may be implemented in different forms based on the application layer, which is not specifically limited in this embodiment of the present application.
  • the PDU session modification request message or the PDU session establishment request message may further include second user identification information.
  • the second user identification information may be information that is used to uniquely identify the user equipment and that can be identified by the core network device and the access network device.
  • the second user identification information may include SUPI, GUTI, and the like.
  • step 502 the AMF sends third identification information to the second SMF. Accordingly, the second SMF receives the third identification information from the AMF.
  • the AMF sends a third message received from the user equipment to the second SMF, where the third message includes the above-mentioned third identification information.
  • the AMF may also send the first user identification information and/or the second user identification information to the second SMF.
  • the AMF may determine the first user identification information of the user equipment according to the mapping relationship. At this time, the AMF may send the first user identification information to the second SMF, or send the second user identification information to the second SMF, or send the first user identification information and the second user identification information to the second SMF.
  • the AMF may not process the third identification information, and when the AMF has locally available first user identification information of the user equipment, the AMF may send the first user identification information and the third identification information to the second SMF.
  • the AMF does not determine the first user identification information, and the AMF may send the second user identification information to the second SMF.
  • the second user identification information sent by the AMF to the second SMF may be provided by the AMF or provided by the user equipment (ie, the user equipment also sends the second user identification information to the AMF in step 501).
  • the second SMF sends the first user identification information and/or the second user identification information and the first identification information to the first SMF. Accordingly, the first SMF receives the first user identification information and/or the second user identification information and the first identification information from the second SMF.
  • the first identification information of the multicast data corresponds to the multicast group requested by the user equipment to join, and the specific description of the first identification information can refer to the above, which will not be repeated here.
  • the first identification information and the third identification information may be the same.
  • the first identification information and the third identification information may be different.
  • the second SMF may determine the first identification information according to the third identification information, and then send the first identification information to the first SMF.
  • the third identification information obtained by the second SMF is the TMGI of the multicast group
  • the second SMF determines the ID of the PDU session corresponding to the TMGI according to the TMGI, and sends the ID of the PDU session to the third A SMF.
  • the second SMF may send the first user identification information and/or the second user identification information, and the first identification information through an N16 message.
  • the N16 message is used for requesting parameter information of multicast transmission and requesting authentication for joining a multicast group.
  • the second SMF needs to obtain the first user identification information from the AMF, or determine the first user identification information according to locally stored information and the second user identification information, Or the second SMF needs to acquire the first user identification information from the UDM.
  • the above locally stored information can be acquired from AMF.
  • the above locally stored information may be a mapping relationship between the second user identifier and the information of the first user identifier.
  • the second SMF may determine the first SMF.
  • the second SMF determines the first SMF by querying the data stored in the network element for centralized storage according to the third identification information.
  • the network element used for centralized storage may be UDM, UDR, PCF, or the like.
  • Another implementation manner is that the correspondence between the third identification information and the first SMF network element is preconfigured in the second SMF, and at this time, the second SMF network element can directly determine the first SMF through the correspondence.
  • the first SMF needs to store the first user identification information from other sources according to the second user identification information.
  • the network element of the mapping relationship between the user identification information and the second user identification information acquires the first user identification information.
  • These network elements may be network elements such as the second SMF, AMF, UDM, UDR or PCF.
  • the first SMF sends a message to the AMF
  • the message may be an N11 message
  • the message is used to request the AMF to send the first user identification information corresponding to the second user identification information to the first SMF
  • the message includes the second user identification. information.
  • the message may further include third identification information.
  • the second user identification information carried in the message may be the permanent identification information of the user or the temporary identification information of the user.
  • the second user identification information sent by the first SMF to the AMF may be different from the second user identification information sent by the second SMF or AMF to the first SMF.
  • the second user identification information can be the permanent identification information of the user, the temporary identification information of the user or the SM Context ID (SM Context ID), and the second user identification information sent by the first SMF to the AMF can be the permanent identification information of the user or the user's permanent identification information.
  • Temporary identification information the two have no dependencies.
  • the second SMF or AMF provides temporary identification information of the user.
  • the first SMF determines the corresponding AMF according to the temporary identification information of the user and obtains the permanent identification information of the user from the AMF.
  • the permanent identification information obtains the first user identification information from the AMF.
  • the AMF sends a message to the first SMF
  • the message may be an N11 message, and the message is used to return the first user identification information corresponding to the second user identification information to the first SMF.
  • the message may further include third identification information.
  • the first SMF may send a first message to the application server, requesting the application server to perform an authentication and authorization operation.
  • the first message includes first user identification information and second identification information.
  • the first message may be an authentication authorization request message.
  • the second identification information of the multicast data corresponds to the multicast group that the user equipment requests to join, and the specific description of the second identification information can refer to the above, which is not repeated here.
  • the first identification information and the second identification information may be the same.
  • the first identification information and the second identification information may be different. Specifically, after acquiring the first identification information, the first SMF may determine the second identification information according to the first identification information, and then send the second identification information to the application server.
  • the first identification information obtained by the first SMF is the TMGI of the multicast group
  • the first SMF determines the ID of the PDU session corresponding to the TMGI according to the TMGI, and sends the ID of the PDU session to the application through the first message server.
  • user plane signaling may be used to implement the above authentication and authorization operations through user plane network elements.
  • the first SMF determines an application server corresponding to the identification information according to the first identification information or the second identification information.
  • the first SMF queries the relevant network element.
  • the relevant network element may be UDM, UDR or PCF, etc.
  • the first SMF sends a first message to the application server. Accordingly, the application server receives the first message from the first SMF.
  • the first message may include first user identification information and second identification information.
  • the first SMF may directly send the first message to the application server.
  • the first SMF may send the first message to the application server through the first UPF.
  • step 506 the application server performs an authentication and authorization operation according to the received first user identification information and the second identification information.
  • the application server may query the database according to the first user identification information and the identification information. If, for the second identification information, the subscription information of the first user identification information exists in the database, the application server determines that the authentication is successful; otherwise, the application server determines that the authentication fails.
  • step 507 the application server sends a second message to the first SMF. Accordingly, the first SMF receives the second message from the application server.
  • the second message may include result information, where the result information is used to indicate the result of the authentication.
  • the result information indicates that the authentication was successful.
  • the result information indicates that the authentication fails.
  • the second message may be an authentication and authorization response message.
  • the second message may further include parameter information for multicast transmission.
  • the parameter information may include QoS parameters of multicast transmission, identification information of multicast sessions, and the like.
  • the second message may further include second identification information.
  • control plane signaling may also be used to implement the above authentication and authorization operations through control plane network elements.
  • step 508 the first SMF sends the first message to the NEF. Accordingly, the NEF receives the first message from the first SMF.
  • the first message may be an authentication authorization request message.
  • step 509 the NEF determines the application server corresponding to the second identification information.
  • the first SMF carries the address of the application server in the first message, and the NEF obtains the address of the application server from the first message.
  • the first SMF obtains the address of the application server from the first message.
  • the first NEF queries the relevant network element according to the second identification information.
  • the relevant network element may be UDM, UDR or PCF, etc.
  • step 510 the NEF sends a first message to the application server. Accordingly, the application server receives the first message from the NEF.
  • step 511 the application server performs an authentication and authorization operation according to the received first user identification information and the second identification information.
  • Step 511 is similar to step 506, and reference may be made to the related description of step 506.
  • step 512 the application server sends a second message to the NEF. Accordingly, the NEF receives the second message.
  • the second message may include result information, where the result information is used to indicate the result of the authentication.
  • the result information indicates that the authentication was successful.
  • the result information indicates that the authentication fails.
  • the second message may be an authentication and authorization response message.
  • the response message may further include parameter information for multicast transmission.
  • the parameter information may include QoS parameters of multicast transmission, identification information of multicast sessions, and the like.
  • the response message may further include second identification information.
  • step 513 the NEF sends a second message to the first SMF. Accordingly, the first SMF receives the second message from the NEF.
  • the first SMF sends a fifth message to the second SMF.
  • the second SMF receives the fifth message.
  • the fifth message may include first user identification information and/or second user identification information, identification information, and result information.
  • the identification information here may be any one of the above-mentioned first identification information, second identification information or third identification information.
  • the fifth message may further include parameter information for multicast transmission.
  • the parameter information may include QoS parameters of multicast transmission, identification information of multicast sessions, and the like.
  • step 515 the second SMF processes the PDU session according to the fifth message.
  • the second SMF For example, if the authentication is successful, the second SMF generates corresponding N2 information according to the parameter information of the multicast transmission, which is then sent to the access network device, so that the access network device further sends the multicast data to the user equipment according to this information. .
  • the second SMF may return a NAS message to the user equipment for notifying the user equipment of the failure to join the group.
  • the second SMF may establish a unicast transmission resource for the user equipment, and the unicast transmission resource is used for transmitting multicast downlink data.
  • step 516 may also be performed, that is, the first SMF may further determine whether the application server is required to perform authentication and authorization.
  • Step 516 is the same as or similar to step 450 in FIG. 4 , reference may be made to the relevant description of step 450 , and details are not repeated here.
  • FIG. 6 is a schematic flowchart of another authentication method according to an embodiment of the present application.
  • the method shown in FIG. 6 may be applied to the system architecture shown in FIG. 1 , and may also be applied to the system architecture shown in FIG. 3 , and the embodiments of the present application are not limited thereto.
  • the first SMF may obtain the first user identification information and the first identification information through user plane signaling.
  • the user equipment may request to join multiple broadcast group.
  • the user equipment may send user plane data through a transmission channel of a unicast PDU session, and add identification information of the multicast data to the user plane data.
  • the DN and/or slice information corresponding to the unicast PDU session is the same as the DN and/or network slice information corresponding to the multicast PDU session that the user equipment requests to join.
  • the first user identification information and the identification information of the multicast data are transmitted to the first SMF through steps 601-603.
  • step 601 the user equipment sends three messages to the second UPF.
  • the second UPF receives the third message sent by the user equipment.
  • the third message may be a message for transmitting user plane data, and the third message includes third identification information.
  • the third message may be an IGMP join request message or an MLR message.
  • the third message may further include identification information of the DN and/or information used for authentication and authorization, and the like.
  • the identification information of the DN may be the ID of the DN or the name of the DN, or the like.
  • the information used for authentication and authorization may be implemented in different forms based on the application layer, which is not specifically limited in this embodiment of the present application.
  • the third message may further include second user identification information.
  • the second user identification information may be information that is used to uniquely identify the user equipment and that can be identified by the core network device and the access network device.
  • the second target user identification information may include at least one of SUPI, GUTI and SUCI.
  • the user equipment may send the third message to the second UPF through the access network device.
  • the user equipment may send the third message to the second UPF through the AMF.
  • the AMF may also determine the first user identification information of the user equipment and send it to the second UPF.
  • the AMF may determine the first user identification information according to the mapping relationship between the second user identification of the user equipment and the first user identification information.
  • step 602 the second UPF sends third identification information to the second SMF.
  • the second SMF receives the third identification information sent from the second UPF.
  • the second UPF may send the first user identification information and/or the second user identification information to the second SMF.
  • the first user identification information and the second user identification information may be provided by user equipment or access network equipment.
  • the second UPF may send the above information through a notify (notify) message.
  • the second SMF needs to obtain the first user identification information from the AMF, or determine the first user identification according to the locally stored information and the second user identification information. information.
  • the above locally stored information can be acquired from AMF.
  • the above locally stored information may be a mapping relationship between the second user identifier and the information of the first user identifier.
  • step 603 the second SMF sends the first user identification information and/or the second user identification information and the first identification information to the first SMF.
  • the first SMF receives the information sent by the second SMF.
  • the second SMF may send the first user identification information and/or the second user identification information, and the first identification information through an N16 message.
  • the N16 message is used to request parameter information of multicast transmission and to request authentication for joining a multicast group.
  • the second SMF may determine the first SMF.
  • An implementation manner is that the second SMF determines the first SMF by querying the data stored in the network element for centralized storage according to the third identification information or the first identification information.
  • the network element used for centralized storage may be UDM, UDR, PCF, or the like.
  • the first SMF needs to store the first user identification information from other sources according to the second user identification information.
  • the network element of the mapping relationship between the user identification information and the second user identification information acquires the first user identification information.
  • These network elements may be network elements such as the second SMF, AMF, UDM, UDR or PCF.
  • the first SMF sends a message to the AMF
  • the message may be an N11 message
  • the message is used to request the AMF to send the first user identification information corresponding to the second user identification information to the first SMF
  • the message includes the second user identification. information.
  • the message may further include first identification information or second identification information.
  • the second user identification information carried in the message may be the permanent identification information of the user or the temporary identification information of the user.
  • the second user identification information sent by the first SMF to the AMF may be different from the second user identification information sent by the second SMF or AMF to the first SMF.
  • the second user identification information may be the permanent identification information of the user or the temporary identification information of the user
  • the second user identification information sent by the first SMF to the AMF may be the permanent identification information of the user or the temporary identification information of the user, and the two are independent of each other.
  • the second SMF or AMF provides temporary identification information of the user.
  • the first SMF determines the corresponding AMF according to the temporary identification information of the user and obtains the permanent identification information of the user from the AMF.
  • the permanent identification information obtains the first user identification information from the AMF.
  • the AMF sends a message to the first SMF
  • the message may be an N11 message, and the message is used to return the first user identification information corresponding to the second user identification information to the first SMF.
  • the message may further include first identification information or second identification information.
  • the first SMF may send a first message to the application server, requesting the application server to perform an authentication and authorization operation.
  • the first message includes first user identification information and second identification information.
  • Steps 604 to 616 are the same as or similar to steps 504 to 516 in FIG. 5 , and reference may be made to the relevant descriptions of steps 504 to 516, and details are not repeated here.
  • FIG. 7 is a schematic flowchart of another authentication method according to an embodiment of the present application.
  • the method shown in FIG. 7 can be applied to the system architecture shown in FIG. 1 or the system architecture shown in FIG. 3 , and the embodiment of the present application is not limited thereto.
  • the user equipment directly sends the first user identification information and/or the second user identification information and the first identification information to the first SMF without going through the second SMF.
  • step 701 the user equipment sends a third message to the AMF.
  • the AMF receives the third message sent by the user equipment.
  • the third message may contain third identification information.
  • Step 701 is similar to or the same as step 501, and reference may be made to the relevant description of step 501, and details are not repeated here.
  • the AMF may determine the first SMF according to the received third identification information, and send the first identification information to the first SMF. Accordingly, the first SMF receives the first identification information from the second SMF.
  • the AMF sends a third message received from the user equipment to the first SMF, where the third message includes the above-mentioned first identification information. Since the AMF does not process the third identification information, the third identification information is the same as the first identification information.
  • the AMF may also send the first user identification information and/or the second user identification information to the first SMF.
  • the AMF may determine the first user identification information of the user equipment according to the mapping relationship. At this time, the AMF may send the first user identification information to the first SMF, or send the second user identification information to the first SMF, or send the first user identification information and the second user identification information to the first SMF.
  • the AMF may not process the third identification information, and when the AMF has locally available first user identification information of the user equipment, the AMF may send the first user identification information and the third identification information to the first SMF.
  • the AMF does not determine the first user identification information, and the AMF may send the second user identification information to the first SMF.
  • the second user identification information sent by the AMF to the first SMF may be provided by the AMF or provided by the user equipment (ie, the user equipment also sends the second user identification information to the AMF in step 701).
  • the first SMF needs to obtain the first user identification information from other network elements that store the first user identification information and the second user identification information according to the second user identification information. a user identification information.
  • These network elements may be network elements such as the second SMF, AMF, UDM, UDR or PCF.
  • the first SMF sends a message to the AMF
  • the message may be an N11 message
  • the message is used to request the AMF to send the first user identification information corresponding to the second user identification information to the first SMF
  • the message includes the second user identification. information.
  • the message may further include first identification information or second identification information.
  • the second user identification information carried in the message may be the permanent identification information of the user or the temporary identification information of the user.
  • the second user identification information sent by the first SMF to the AMF may be different from the second user identification information sent by the AMF to the first SMF, and the second user identification information sent by the AMF to the first SMF may be the user identification information.
  • Permanent identification information, user temporary identification information or SM context information identification, and the second user identification information sent by the first SMF to the AMF may be the user's permanent identification information or the user's temporary identification information, and there is no dependency between the two.
  • the AMF provides the user's temporary identification information
  • the first SMF determines the corresponding AMF according to the user's temporary identification information, and obtains the user's permanent identification information from the AMF, after which the first SMF sends the user's permanent identification information to the AMF from Obtain the first user identification information from the AMF.
  • the AMF sends a message to the first SMF
  • the message may be an N11 message, and the message is used to return the first user identification information corresponding to the second user identification information to the first SMF.
  • the message may further include first identification information or second identification information.
  • the first SMF may send a first message to the application server, requesting the application server to perform an authentication and authorization operation.
  • the first message includes first user identification information and second identification information.
  • Steps 704 to 716 are the same as or similar to steps 504 to 516 in FIG. 5 , and reference may be made to the relevant descriptions of steps 504 to 516 , which will not be repeated here.
  • FIG. 8 is a schematic flowchart of another authentication method according to an embodiment of the present application.
  • the method shown in FIG. 8 may be applied to the system architecture shown in FIG. 1 or the system architecture shown in FIG. 3 , and the embodiment of the present application is not limited thereto.
  • the second SMF when the user equipment sends the first user identification information and/or the second user identification information and the first identification information to the first SMF, the second SMF may not be passed.
  • the user equipment may send user plane data through a transmission channel of a unicast PDU session, and add identification information of the multicast data to the user plane data.
  • the DN and/or slice information corresponding to the unicast PDU session is the same as the DN and/or network slice information corresponding to the multicast PDU session that the user equipment requests to join.
  • the first user identification information and the identification information of the multicast data are transmitted to the first SMF through steps 801-802.
  • step 801 the user equipment sends a third message to the second UPF.
  • the second UPF receives the third message sent by the user equipment.
  • the third message is a message for transmitting user plane data, and the third message includes third identification information.
  • the third message may be an IGMP join request message or an MLR message.
  • the third message may further include identification information of the DN and/or information used for authentication and authorization, and the like.
  • the identification information of the DN may be the ID of the DN or the name of the DN, or the like.
  • the information used for authentication and authorization may be implemented in different forms based on the application layer, which is not specifically limited in this embodiment of the present application.
  • the third message may further include second user identification information.
  • the second user identification information may be information that is used to uniquely identify the user equipment and that can be identified by the core network device and the access network device.
  • the second target user identification information may include at least one of SUPI, GUTI and SUCI.
  • the user equipment may send the third message to the second UPF through the access network device.
  • the user equipment may send the third message to the second UPF through the AMF.
  • the AMF may also determine the first user identification information of the user equipment and send it to the second UPF.
  • the AMF may determine the first user identification information according to the mapping relationship between the second user identification of the user equipment and the first user identification information.
  • step 802 the second UPF sends the first identification information to the first SMF. Accordingly, the first SMF receives the first identification information from the second UPF.
  • the second UPF sends a third message received from the user equipment to the first SMF, the third message including the above identification information. Since the second UPF does not process the third identification information, the third identification information is the same as the first identification information.
  • the second UPF may also send the first user identification information and/or the second user identification information to the first SMF.
  • the second user identification information sent by the second UPF to the first SMF may be provided by the AMF or provided by the user equipment (that is, in step 801, the user equipment also sends the second user identification information to the AMF) ).
  • the second UPF may determine the first SMF.
  • the second UPF determines the first SMF by querying the data stored in the network element for centralized storage according to the third identification information.
  • the network element used for centralized storage may be UDM, UDR, PCF, or the like.
  • Another implementation manner is: the second UPF locally stores the mapping relationship between the third identification information and the first SMF, and the second UPF determines the first SMF according to the received third identification information and the mapping relationship.
  • the first SMF needs to store the first user identification information and the second user identification information from other mapping relationship network elements according to the second user identification information. Obtain first user identification information.
  • These network elements may be network elements such as the second SMF, AMF, UDM, UDR or PCF.
  • the first SMF sends a message to the AMF
  • the message may be an N11 message
  • the message is used to request the AMF to send the first user identification information corresponding to the second user identification information to the first SMF
  • the message includes the second user identification. information.
  • the message may further include first identification information or second identification information.
  • the second user identification information carried in the message may be the permanent identification information of the user or the temporary identification information of the user.
  • the second user identification information sent by the first SMF to the AMF may be different from the second user identification information sent by the second UPF to the first SMF, and the second user identification information sent by the second UPF to the first SMF It may be the permanent identification information of the user or the temporary identification information of the user, and the second user identification information sent by the first SMF to the AMF may be the permanent identification information of the user or the temporary identification information of the user, and there is no dependency between the two.
  • the second UPF provides the user's temporary identification information
  • the first SMF determines the corresponding AMF according to the user's temporary identification information, and obtains the user's permanent identification information from the AMF, and then the first SMF sends the user's permanent identification to the AMF by sending the user's permanent identification information.
  • the information obtains the first user identification information from the AMF.
  • the AMF sends a message to the first SMF
  • the message may be an N11 message, and the message is used to return the first user identification information corresponding to the second user identification information to the first SMF.
  • the message may further include first identification information or second identification information.
  • the first SMF may send a first message to the application server, requesting the application server to perform an authentication and authorization operation.
  • the first message includes first user identification information and device information.
  • Steps 804 - 816 are the same as or similar to steps 504 - 516 in FIG. 5 , and reference may be made to the relevant descriptions of steps 504 - 516 , and details are not repeated here.
  • the first SMF sends the first user identification information and the identification information of the multicast data to the application server, and the application server performs the authentication operation when the user equipment joins the group, so that the user equipment can be authenticated.
  • the join request is authenticated.
  • the application server there is no need for the application server to provide explicit multicast group member information to the core network in real time, and authentication when user equipment joins a group can be implemented without the core network having no multicast group member information. operation to help avoid public safety issues.
  • FIG. 9 is a schematic flowchart of an authentication method provided by another embodiment of the present application.
  • the method shown in FIG. 9 may be applied to the system architecture shown in FIG. 1 or the system architecture shown in FIG. 3 , and the embodiment of the present application is not limited thereto.
  • the method in FIG. 9 may be executed by user equipment, network equipment and application server, or may be executed by modules or units (for example, circuits, chips or SOCs, etc.) in user equipment, network equipment and application server.
  • the main body is user equipment, network equipment and application server as an example.
  • the method of FIG. 9 may include at least some of the following.
  • step 901 the user equipment sends a fourth message to the network device, where the fourth message is used to request to join the multicast group.
  • the fourth message includes identification information of the multicast data and first security information.
  • the network device receives the fourth message from the user equipment.
  • the identification information of the multicast data corresponds to the multicast group requested by the user equipment to join, and may include the TMGI of the multicast group corresponding to the multicast data, the IP address of the application server providing the multicast data, the service identifier of the multicast data, Packet filtering information of multicast data, SDF identification rules of multicast data, ID of multicast PDU session used to transmit multicast data, application ID information, target IP address information of multicast data, and multicast group correspondence at least one of the context identification information of the multicast session.
  • identification information of the multicast data is simply referred to as identification information hereinafter.
  • the first security information is used to perform an authentication and authorization operation on a join request of the user equipment.
  • the first security information may be password information.
  • the first security information may be a specific secret code.
  • the first security information may be input information of a security algorithm.
  • the first security information may be a security algorithm.
  • the above-mentioned network device is a core network device.
  • first SMF, second SMF, UDR, AMF, NEF or UDM etc.
  • the above-mentioned network device is an access network device.
  • step 902 the network device performs an authentication and authorization operation according to the first security information and the second security information.
  • the second security information is used to perform an authentication and authorization operation on a join request of the user equipment.
  • the second security information may also be password information or security algorithm.
  • the second security information may be stored locally in the first SMF.
  • the network device may determine the second security information according to the identification information, and further, perform authentication according to the first security information and the second security information. authorization to operate.
  • the network device determines whether the first security information and the second security information match. If the two match, the network device determines that the authentication is successful; otherwise, the network device determines that the authentication fails.
  • the manners in which the network device determines whether the two are matched are also different.
  • the network device determines that the first security information and the second security information match, otherwise the two do not match. match.
  • the network device determines that the first security information and the second security information match, otherwise The two do not match.
  • the embodiments of the present application do not specifically limit the manner in which the user equipment acquires the first security information and the manner in which the network device acquires the second security information.
  • the user equipment and the network equipment can obtain corresponding security information through steps 903-905.
  • step 903 the application server generates the first security information and the second security information.
  • step 904 the application server sends the first security information to the user equipment.
  • the user equipment receives the first security information sent by the application server.
  • the application server may send the first security information to the user equipment through an application layer message.
  • step 905 the application server sends the second security information to the network device.
  • the network device receives the second security information sent by the application server.
  • the application server may also send first information to the network device, where the first information is used to determine identification information corresponding to the second security information.
  • the first information may be the above-mentioned identification information.
  • the first information is information for acquiring identification information
  • the information may be a numerical value
  • the first SMF may further acquire identification information according to the information.
  • the value can be a transaction ID (transaction ID) or the like.
  • the application server may provide the first information to the NEF network element, and the NEF network element may obtain the identification information according to the first information.
  • the possible forms of the identification information have been described above and will not be repeated here.
  • the NEF network element may further send identification information to the network device.
  • the network device may store the second security information after receiving the second security information.
  • the network device storage may also correspondingly store identification information corresponding to the second security information.
  • the application server may send the information in the multiple multicast groups to the user equipment.
  • the first security information corresponding to at least some of the multicast groups of the multiple multicast groups, and similarly, the second security information corresponding to at least some of the multicast groups in the multiple multicast groups may be sent to the network device.
  • the user equipment adopts the first security information corresponding to the multicast group.
  • the application server may provide security information for authentication to the user equipment and the network device, and the network device may perform an authentication operation when the user equipment joins a group according to the security information, thereby realizing The join request of the user equipment is authenticated.
  • the application server may provide explicit multicast group member information to the core network in real time, and authentication when user equipment joins a group can be implemented without the core network having no multicast group member information. operation to help avoid public safety issues.
  • the network equipment is the core network equipment
  • FIG. 10 is a schematic flowchart of another authentication method according to an embodiment of the present application.
  • the method shown in FIG. 10 may be applied to the system architecture shown in FIG. 1 , and may also be applied to the system architecture shown in FIG. 3 , and the embodiments of the present application are not limited thereto.
  • the authentication and authorization operation is performed by the first SMF.
  • step 1001 the user equipment sends a fourth message to the first SMF, where the fourth message is used to request to join the multicast group.
  • the fourth message includes identification information and first security information, where the identification information corresponds to the multicast group that the user equipment requests to join. Accordingly, the first SMF receives the fourth message from the user equipment.
  • the first security information is used to perform an authentication and authorization operation on a join request of the user equipment.
  • the first security information may be password information.
  • the first security information may be a specific secret code.
  • the first security information may be input information of a security algorithm.
  • the first security information may be a security algorithm.
  • the user equipment may send the first request message to the first SMF through control plane signaling and through the control plane network element. Specifically, reference may be made to the manner in which the user equipment sends information to the first SMF in FIG. 5 and FIG. 7 , and details are not described herein again.
  • the user equipment may send the first request message to the first SMF through user plane signaling and through the user plane network element.
  • the user equipment may send the first request message to the first SMF through user plane signaling and through the user plane network element.
  • the user equipment sends information to the first SMF in FIG. 6 and FIG. 8 , and details are also omitted here.
  • step 1002 the first SMF processes the joining request of the user equipment according to the matching result of the first security information and the second security information.
  • the first SMF continues to process the joining request of the user equipment, and executes step 1003, ie, completes the subsequent process of the user equipment joining the multicast group.
  • step 1003 ie, completes the subsequent process of the user equipment joining the multicast group.
  • the first SMF stops processing the joining request of the user equipment, and returns an authentication failure indication to the user equipment.
  • Another possible implementation manner is that when the first security information matches the second security information, the first SMF continues to process the joining request of the user equipment, and executes step 1003, that is, completes the follow-up of the user equipment joining the multicast group process.
  • the first SMF notifies the second SMF to establish a unicast transmission resource for the user equipment, and the unicast transmission resource is used for transmitting multicast downlink data.
  • the second security information is used to perform an authentication and authorization operation on a join request of the user equipment.
  • the second security information may also be password information or security algorithm.
  • the second security information may be stored locally in the first SMF.
  • the second security information is stored in the UDM or the UDR, and when the first SMF receives a join request from the user equipment, the second security information is obtained from the UDM or the UDR according to the join request.
  • the manners in which the first SMF determines whether the two are matched are also different.
  • the first SMF determines that the first security information and the second security information match, otherwise the two Mismatch.
  • the first SMF determines that the first security information and the second security information match, Otherwise the two do not match.
  • the embodiments of the present application do not specifically limit the manner in which the user equipment acquires the first security information and the manner in which the first SMF acquires the second security information.
  • the user equipment and the first SMF can obtain corresponding security information through steps 1004-1008.
  • step 1004 after establishing an application layer connection with the user equipment, the application server generates the first security information and the second security information.
  • step 1005 the application server sends the first security information to the user equipment.
  • the user equipment receives the first security information sent by the application server.
  • the application server may send the first security information to the user equipment through an application layer message.
  • the application server may send the first security information to the NEF, and correspondingly, the NEF receives the first security information sent by the application server. Further, the NEF sends the first security information to the UDR, and accordingly, the UDR receives the first security information from the NEF. After receiving the first security information, the UDR sends the first security information to the PCF, and accordingly, the PCF receives the first security information. Thereafter, the PCF sends the received first security information to the UE through the AMF through a Non Access Stratum (Non Access Stratum, NAS) message.
  • NAS Non Access Stratum
  • step 1006 the application server sends the second security information to the NEF.
  • the NEF receives the second security information sent by the application server.
  • the application server may call Nnef_ParameterProvisionCreate Request to send the second security information to the NEF.
  • the application server may also send first information to the NEF, where the first information is used to determine identification information corresponding to the second security information.
  • the first information may be the above-mentioned identification information.
  • the first information is information for acquiring identification information
  • the information may be a numerical value
  • the first SMF may further acquire identification information according to the information.
  • the value can be a transaction ID or the like.
  • step 1007 the NEF sends the second security information to the UDM or UDR.
  • the UDM or UDR receives the second security information sent by the NEF.
  • the NEF may also send identification information to the UDM or UDR.
  • the NEF may acquire identification information according to the first information after receiving the first information.
  • An implementation manner is that the NEF acquires the identification information according to the mapping relationship between the information used to acquire the identification information and the identification information.
  • the NEF can store the mapping relationship locally.
  • the mapping relationship is configured for the NEF in a pre-configured manner.
  • the NEF may acquire the mapping relationship from a network element (eg, UDR or UDM) with a data storage function.
  • the UDM or UDR stores the second security information after receiving the second security information sent by the NEF.
  • the UDM storage may also correspondingly store identification information corresponding to the second security information.
  • the UDM or UDR may also perform authentication on the identification information to determine whether the above information can be stored. For example, the UDM or UDR performs authentication according to whether the authorization information corresponding to the identification information is stored locally. For another example, if the UDM network element receives the second security information from the NEF, the UDM can further obtain the authentication information from the UDR, and further determine whether the obtained information for authentication includes the authorization corresponding to the identification information. information. For another example, if the UDR network element receives the second security information from the NEF, the UDM can send the identification information to the UDR, and the UDR performs authentication, and the UDM obtains the authentication result information from the UDR.
  • step 1008 the UDM sends the second security information to the first SMF.
  • the first SMF receives the second security information sent by the UDM.
  • the UDM or the UDR may also send identification information corresponding to the second security information to the first SMF.
  • the UDM or UDR may send the above information through a Nudm_SDM_Notification Notify message or Nudr_DM_Notify message.
  • the first SMF After receiving the second security information, the first SMF stores the second security information, so as to perform an authentication and authorization operation on a joining request of the user equipment subsequently.
  • FIG. 11 is a schematic flowchart of another authentication method according to an embodiment of the present application.
  • the method shown in FIG. 11 may be applied to the system architecture shown in FIG. 1 , and may also be applied to the system architecture shown in FIG. 3 , and the embodiments of the present application are not limited thereto.
  • the authentication and authorization operation is performed by the UDM or the UDR.
  • step 1101 the user equipment sends a fourth message to the second SMF, where the fourth message is used to request to join the multicast group.
  • the fourth message includes identification information and first security information, where the identification information corresponds to the multicast group that the user equipment requests to join. Accordingly, the second SMF receives the fourth message from the user equipment.
  • the first security information is used to perform an authentication and authorization operation on a join request of the user equipment.
  • the first security information may be password information.
  • the first security information may be a specific secret code.
  • the first security information may be input information of a security algorithm.
  • the first security information may be a security algorithm.
  • the user equipment may send the fourth message to the second SMF through control plane signaling and through the control plane network element. Specifically, reference may be made to the manner in which the user equipment sends information to the second SMF in FIG. 5 , and details are not described herein again.
  • the user equipment may send the fourth message to the second SMF through user plane signaling and through the user plane network element.
  • the user equipment may send the fourth message to the second SMF through user plane signaling and through the user plane network element.
  • the user equipment sends information to the second SMF in FIG. 6 , and details are also omitted here.
  • the second SMF sends a fourth message to the UDM or UDR, and accordingly, the UDM or UDR receives the fourth message.
  • the fourth message includes the first security information and identification information.
  • the second SMF may carry the first security information and identification information in the message for querying the related information of the first SMF.
  • step 1103 the UDM or UDR performs authentication and authorization according to the first security information and the second security information.
  • the second security information is used to perform an authentication and authorization operation on a join request of the user equipment.
  • the second security information may also be password information or security algorithm.
  • the second security information may be stored locally in the UDM or the UDR.
  • the UDM or UDR determines whether the first security information matches the second security information. If the two match, the UDM or UDR determines that the authentication is successful; otherwise, the UDM or UDR determines that the authentication fails.
  • the manners in which the UDM or the UDR determines whether the two are matched are also different.
  • the UDM or UDR determines that the first security information and the second security information match, otherwise the two Mismatch.
  • the UDM or UDR determines that the first security information and the second security information are correct.
  • the two security information match, otherwise the two do not match.
  • step 1104 the UDM or UDR returns the result information of the authentication operation to the second SMF.
  • the second SMF receives the result information sent by the UDM.
  • step 1003 may be performed, that is, the subsequent process of the user equipment joining the multicast group is completed. If the result information indicates that the authentication fails, the processing of the joining request of the user equipment is stopped, and an indication of the authentication failure is returned to the user equipment.
  • step 1003 may be executed, that is, the subsequent process of the user equipment joining the multicast group is completed. If the result information indicates that the authentication fails, a unicast transmission resource may be established for the user equipment, and the unicast transmission resource is used for transmitting multicast downlink data.
  • the embodiments of the present application do not specifically limit the manner in which the user equipment acquires the first security information and the manner in which the UDM or the UDR acquires the second security information.
  • the user equipment and the UDM or UDR can obtain corresponding security information through steps 1106-1111.
  • step 1106 the application server generates the first security information and the second security information.
  • step 1107 the application server sends the first security information to the user equipment.
  • the user equipment receives the first security information sent by the application server.
  • the application server may send the first security information to the user equipment through an application layer message.
  • step 1108 the application server sends the second security information to the PCF.
  • the PCF receives the second security information sent by the application server.
  • the application server may send the second security information to the PCF through an N5 message or an Rx message.
  • the application server may send the second security information to the PCF through the NEF.
  • the application server may also send first information to the PCF, where the first information is used to determine identification information corresponding to the second security information.
  • the first information is the above-mentioned identification information.
  • the first information is information for acquiring identification information
  • the information may be a numerical value
  • the first SMF may further acquire identification information according to the information.
  • the value can be a transaction ID (transaction ID) or the like.
  • the application server may also send data network access identifier (data network access identifier, DNAI) information of the application server to the PCF.
  • DNAI information is used to indicate the location information from which the data was generated.
  • step 1109 the PCF sends the second security information to the UDM or the UDR, so that the UDM or the UDR stores the second security information.
  • the PCF may also send identification information to the UDM or UDR.
  • step 1109 may also be replaced with steps 1110-1112, that is, the PCF stores the second security information to the UDM or UDR through the first SMF.
  • the NEF or PCF determines the first SMF.
  • the NEF or the PCF selects the first SMF supporting the multicast function according to the capability information of the SMF.
  • the NEF or the PCF selects the first SMF that supports the multicast function according to the current load situation of the SMF.
  • the NEF or the PCF selects the first SMF that supports the multicast function according to the coverage of the UPF that can be managed by the SMF and in combination with the DNAI information.
  • the NEF or PCF selects the first one that supports the multicast function according to the coverage of the UPF that the SMF can manage, the current load of the SMF, and whether the SMF supports multicast session management. SMF.
  • step 1111 the NEF or PCF sends the second security information to the first SMF.
  • the first SMF receives the second security information sent by the NEF or the PCF.
  • the NEF or the PCF may send the second security information through a message for requesting establishment of a multicast context.
  • the manner in which the NEF or the PCF sends the identification information and the identification information of the application server to the first SMF is the same as or similar to the manner in which the second security information is sent, and details are not described again.
  • the NEF or PCF may acquire identification information according to the first information after receiving the first information.
  • An implementation manner is that the NEF or the PCF acquires the identification information according to the mapping relationship between the information used to acquire the identification information and the identification information.
  • the NEF or PCF may store the mapping relationship locally.
  • the mapping relationship is configured for NEF or PCF in a pre-configured manner.
  • the NEF or the PCF may acquire the mapping relationship from a network element (eg, UDR or UDM) with a data storage function.
  • the UDM or UDR stores the second security information after receiving the second security information sent by the PCF.
  • the UDM or UDR storage may also correspondingly store identification information corresponding to the second security information.
  • the UDM or UDR storage may also store the identification information of the first SMF.
  • FIG. 12 is a schematic flowchart of another authentication method according to an embodiment of the present application.
  • the method shown in FIG. 12 may be applied to the system architecture shown in FIG. 1 , and may also be applied to the system architecture shown in FIG. 3 , and the embodiments of the present application are not limited thereto.
  • the authentication and authorization operation is performed by the first SMF or the UDM.
  • step 1201 the user equipment sends a fourth message to the second SMF, where the fourth message is used to request to join the multicast group.
  • the fourth message includes identification information and first security information, where the identification information corresponds to the multicast group that the user equipment requests to join. Accordingly, the second SMF receives the fourth message from the user equipment.
  • the first security information is used to perform an authentication and authorization operation on a join request of the user equipment.
  • the first security information may be password information.
  • the first security information may be a specific secret code.
  • the first security information may be input information of a security algorithm.
  • the first security information may be a security algorithm.
  • the user equipment may send the fourth message to the second SMF through control plane signaling and through the control plane network element. Specifically, reference may be made to the manner in which the user equipment sends information to the second SMF in FIG. 5 , and details are not described herein again.
  • the user equipment may send the fourth message to the second SMF through user plane signaling and through the user plane network element.
  • the user equipment may send the fourth message to the second SMF through user plane signaling and through the user plane network element.
  • the user equipment sends information to the second SMF in FIG. 6 , and details are also omitted here.
  • step 1202 the second SMF sends a fourth message to the first SMF, and accordingly, the first SMF receives the fourth message.
  • the fourth message includes the first security information and identification information.
  • the second SMF may determine the first SMF.
  • the second SMF determines the first SMF by querying the data stored in the network element for centralized storage according to the identification information.
  • the network element used for centralized storage may be UDM, UDR, PCF, or the like.
  • the second SMF obtains the relevant information of the first SMF from the UDM or the UDR.
  • step 1204 the first SMF performs an authentication and authorization operation according to the first security information and the second security information.
  • step 1214 may be performed, that is, the subsequent process of the user equipment joining the multicast group is completed. If the authentication fails, stop processing the joining request of the user equipment, and return an authentication failure indication to the user equipment.
  • step 1214 may be performed, that is, the subsequent process of the user equipment joining the multicast group is completed. If the authentication fails, a unicast transmission resource may be established for the user equipment, and the unicast transmission resource is used to transmit multicast downlink data.
  • the second security information is used to perform an authentication and authorization operation on a join request of the user equipment.
  • the second security information may also be password information or security algorithm.
  • the second security information may be stored locally in the first SMF.
  • the first SMF may acquire the latest second security information from the UDM or the UDR.
  • the first SMF sends identification information to the UDR or UDM, and the UDR or UDM determines the second security information according to the identification information and feeds it back to the first SMF.
  • the first SMF determines whether the first security information matches the second security information. If the two match, the first SMF determines that the authentication is successful; otherwise, the first SMF determines that the authentication fails.
  • the manner in which the first SMF determines whether the two match is also different.
  • the first SMF determines that the first security information and the second security information match, otherwise the two Mismatch.
  • the first SMF determines that the first security information and the second security information are correct.
  • the two security information match, otherwise the two do not match.
  • the authentication and authorization operation performed by the first SMF is replaced by the authentication authorization operation performed by the UDM or the UDR, a possible way is to perform the authentication authorization operation in step 1205.
  • the SMF sends the first security information and identification information to the UDM or UDR, the UDM or UDR performs an authentication and authorization operation according to the first security information and the second security information, and returns result information to the first SMF in step 1213 .
  • the manner in which the user equipment acquires the first security information and the manner in which the UDM or the UDR acquires the second security information are the same as or similar to those in FIG. 11 . Therefore, for a detailed description of steps 1206-1212, reference may be made to steps 1106-1112 The related descriptions will not be repeated here.
  • the network device is an access network device
  • FIG. 13 is a schematic flowchart of another authentication method according to an embodiment of the present application.
  • the method shown in FIG. 13 may be applied to the system architecture shown in FIG. 1 and may also be applied to the system architecture shown in FIG. 3 , and the embodiments of the present application are not limited thereto.
  • the authentication and authorization operation is performed by the access network device.
  • step 1301 the user equipment sends a fourth message to the access network device, where the fourth message is used to request to join the multicast group.
  • the fourth message includes identification information and first security information, where the identification information corresponds to the multicast group that the user equipment requests to join. Accordingly, the second SMF receives the fourth message from the user equipment.
  • the fourth message is an RRC message.
  • step 1302 the access network device performs an authentication and authorization operation according to the first security information and the second security information.
  • the access network device determines whether the first security information matches the second security information. If the two match, the access network device determines that the authentication is successful, and may continue to perform step 1303, that is, to complete the subsequent process of the user equipment joining the multicast group; otherwise, the access network device determines that the authentication fails.
  • the manners in which the access network device determines whether the two are matched are also different.
  • the access network device determines that the first security information and the second security information match, otherwise two does not match.
  • the access network device determines that the first security information and the second security information are correct.
  • the second security information matches, otherwise the two do not match.
  • the access network device may feed back authentication result information to the user equipment.
  • the result information can be fed back through an RRC message.
  • the access network device may perform step 1304, that is, the access network device checks whether the second security information exists locally according to the identification information. If the access network device locally has the second security information, step 1302 may be executed; if the access network device does not store the second security information locally or the second security information has expired, the access network device may obtain the first security information from the core network device 2. Safety information.
  • the access network device executes step 1305, that is, the access network device sends a sixth message to the first AMF to notify the first AMF of the user equipment Request to join a multicast group. Identification information may be included in the sixth message.
  • the first AMF is a network element that performs mobility management and access control on the user equipment in the multicast group.
  • the first AMF may check whether the second security information exists locally according to the identification information. If the second security information locally exists in the first AMF, the AMF may return the second security information to the access network device; if the first AMF does not store the second security information locally or the second security information has expired, the first AMF may send the second security information to the access network device.
  • the first SMF, UDM or UDR acquires the second security information.
  • the first AMF sends a seventh message to the first SMF, UDM or UDR, where the seventh message includes information that the user equipment requests to join the multicast group.
  • the information that the user equipment requests to join the multicast group may be identification information (for example, SUPI) and identification information of the user equipment.
  • the first SMF, UDM or UDR determines the second security information corresponding to the identification information according to the identification information, and returns it to the first AMF.
  • step 1309 the first AMF returns the acquired second security information to the access network device, so that the access network device can perform an authentication and authorization operation.
  • the first SMF, UDM or UDR may further determine whether the second security information needs to be sent to the access network device according to the first security information. At this time, the sixth message and the seventh message need to carry the first security information.
  • the manner in which the user equipment acquires the first security information and the manner in which the first SMF acquires the second security information are the same as or similar to those in FIG. 10 to FIG. 12 . Therefore, for the detailed description of steps 1311 to 1313 , please refer to the steps The relevant descriptions of FIG. 10 to FIG. 12 will not be repeated here.
  • the SMF network elements for managing the multicast PDU session are collectively referred to as the first SMF, and the SMF network elements for managing the unicast PDU sessions are collectively referred to as the second SMF.
  • FIG. 14 is a schematic flowchart of an authentication method provided by another embodiment of the present application.
  • the method shown in FIG. 14 may be applied to the system architecture shown in FIG. 1 or the system architecture shown in FIG. 3 , and the embodiment of the present application is not limited thereto.
  • the method shown in FIG. 14 includes at least part of the following.
  • Step 1401 the user equipment sends a first join request to the second SMF.
  • the first join request is used for requesting to join the first multicast session.
  • the first join request includes fourth identification information, and the fourth identification information corresponds to the first multicast session.
  • the fourth identification information may include a temporary mobile group identifier (TMGI) of the multicast group corresponding to the multicast data, the IP address of the application server providing the multicast data, and the service identifier of the multicast data.
  • TMGI temporary mobile group identifier
  • service identifier service ID
  • packet filter information of multicast data packet filter information of multicast data
  • service data flow (SDF) identification rules of multicast data ID of multicast PDU session used to transmit multicast data
  • ID of multicast PDU session used to transmit multicast data At least one of , application ID information (Application ID), target IP address information (for example, IP multicast address) of the multicast data, and context identification information (Multicast Session Context ID) of the multicast session corresponding to the multicast group .
  • Application ID Application ID
  • target IP address information for example, IP multicast address
  • context identification information Multicast Session Context ID
  • Step 1402 the second SMF sends a tenth message to the first core network device.
  • the tenth message includes third user identification information and the fourth identification information of the user equipment, and the third user identification information and the fourth identification information are used to obtain and determine whether to allow the user equipment Join the first multicast session.
  • the third user identification information may be obtained through the first join request, for example, the first join request includes the third user identification information, or the second SMF according to the local configuration information corresponds to the third user identification of the first join request information.
  • the above-mentioned first core network device may be PCF or UDM.
  • Step 1403 The first core network device receives information from the UDR of the user equipment allowed to join the first multicast session.
  • the method shown in FIG. 14 further includes: the first core network device sends a first query message to the UDR, where the first query message is used to query the permission to join the first query information of the user equipment of the multicast session; step 1403 includes: the first core network device receives a first response message from the UDR, where the first response message includes the user equipment allowed to join the first multicast session Information.
  • Step 1404 the first core network device sends the first indication information to the second SMF.
  • the first indication information is used to indicate whether the user equipment is allowed to join the first multicast session.
  • the first core network device sends a first indication to the second session management function network element according to the tenth message and the information of the user equipment allowed to join the first multicast session information. Specifically, when the information of the user equipment allowed to join the first multicast session includes the third user identification information, the first indication information indicates that the user equipment is allowed to join the first multicast session ; or, when the information of the user equipment allowed to join the first multicast session does not include the third user identification information, the first indication information indicates that the user equipment is not allowed to join the first multicast session broadcast session.
  • Step 1405 when the first indication information indicates that the user equipment is allowed to join the first multicast session, the second SMF accepts the first join request.
  • the second SMF selects the first SMF through the NRF, and continues the subsequent joining process.
  • Step 1406 when the first indication information indicates that the user equipment is not allowed to join the first multicast session, the second SMF rejects the first join request.
  • the second SMF when the first indication information indicates that the user equipment is not allowed to join the first multicast session, the second SMF sends a reject join request message (reject join request) to the user equipment or the AMF. ).
  • FIG. 15 is a schematic flowchart of an authentication method provided by another embodiment of the present application.
  • the method shown in FIG. 15 can be applied to the system architecture shown in FIG. 1 or the system architecture shown in FIG. 3 , and the embodiment of the present application is not limited thereto.
  • the method in FIG. 15 may be performed by the user equipment, the first SMF, the second SMF, the PCF/UDM, the UDR, the NEF/MBSF-C and the AF, or by the user equipment, the first SMF, the second SMF, the PCF/UDM , UDR, NEF/MBSF-C, and modules or units (eg, circuits, chips, or SOCs, etc.) in AF are executed.
  • the execution subject is the user equipment, the first SMF, the second SMF, PCF/UDM, UDR , NEF/MBSF-C and AF as examples.
  • the method of FIG. 15 may include at least some of the following.
  • Step 1501 the AF sends a first configuration request message to the NEF or the MBSF-C. Accordingly, the NEF or MBSF-C receives the first configuration request message from the AF.
  • the first configuration request message is used to configure a multicast session for the multicast service.
  • the first configuration request message includes fourth identification information of the multicast session, and the fourth identification information may include a temporary mobile group identifier (TMGI) of a multicast group corresponding to the multicast data, a IP address of the application server, service identifier (service ID) of multicast data, packet filter information of multicast data, service data flow (SDF) identification rules of multicast data,
  • the ID of the multicast PDU session used to transmit the multicast data, the application ID information (Application ID), the target IP address information of the multicast data (for example, IP multicast address), and the context of the multicast session corresponding to the multicast group At least one of the identification information (Multicast Session Context ID).
  • the fourth identification information of the multicast data is simply referred to as fourth identification information hereinafter.
  • the first configuration request message may further include a first user equipment list, where the first user equipment list may be a list of user equipments that are allowed to use the multicast service corresponding to the fourth identification information. Since the first configuration request message is used to configure a multicast session for the multicast service, the first user equipment list may also be described as a list of user equipments allowed to join the multicast session corresponding to the fourth identification information. For example, the first user equipment list is the allowed UE list.
  • the AF may send an MBS preconfiguration request message (MBS preconfiguration request) to the NEF or the MBSF-C.
  • MBS preconfiguration request MBS preconfiguration request
  • Step 1502 the NEF or the MBSF-C stores the fourth identification information in the first configuration request message in the UDR.
  • the NEF or the MBSF-C also stores the first user equipment list in the UDR.
  • Step 1503 the NEF or the MBSF-C sends a first configuration response message to the AF. Accordingly, the AF receives the first configuration response message from the NEF or MBSF-C.
  • the NEF or the MBSF-C may send an MBS preconfiguration response message (MBS preconfiguration response) to the AF.
  • MBS preconfiguration response MBS preconfiguration response
  • steps 1501-1503 are optional steps, and the above-mentioned fourth identification information and/or the first user equipment list may also be configured in the UDR by the operator.
  • steps 1501-1503 the AF can timely store, update or remove the first user equipment list stored in the UDR according to the business situation, and the solution is more flexible.
  • Step 1504 the AF sends an eighth message to the user equipment. Accordingly, the user equipment receives the eighth message from the AF.
  • the eighth message is used to notify the user equipment to initiate a join request (join request) for the multicast session corresponding to the fourth identification information.
  • the eighth message carries fourth identification information.
  • the AF may send the eighth message through application layer signaling.
  • the AF sends a service announcement message (service announcement) to the user equipment.
  • service announcement service announcement
  • Step 1505 the user equipment sends a first join request to the second SMF. Accordingly, the second SMF receives the first join request from the user equipment.
  • the first join request is used to request to join the multicast session corresponding to the fourth identification information.
  • the first join request carries fourth identification information.
  • the user equipment sends a first join request to the second SMF when detecting an IGMP join message and the like for the fourth identification information sent by the application layer.
  • the first join request may be an IGMP join request message or an MLR message.
  • the user equipment sends an MBS session join request message (MBS session join request) to the second SMF.
  • MBS session join request MBS session join request
  • Step 1506 the second SMF sends the tenth message to the PCF or the UDM. Accordingly, the PCF or UDM receives the tenth message from the second SMF.
  • the tenth message is used to request authentication of the joining request of the user equipment.
  • the tenth message carries fourth identification information and third user identification information of the user equipment (hereinafter referred to as third user identification information).
  • the second SMF sends an MBS policy query message (MBS policy query) to the PCF or the UDM.
  • MBS policy query MBS policy query
  • Step 1507 the PCF or the UDM sends a first query message to the UDR. Accordingly, the UDR receives the first query message from the PCF or UDM.
  • the first query message is used to query the stored information corresponding to the fourth identification information.
  • the first query message carries fourth identification information.
  • PCF or UDM sends Nudr_DM_Query to UDR.
  • Step 1508 the UDR sends a first response message to the PCF or the UDM. Accordingly, the PCF or UDM receives the first response message from the UDR.
  • the first response message includes storage information corresponding to the fourth identification information, and the storage information may include a first user equipment list.
  • the stored information may be a data set corresponding to the fourth identification information
  • the index of the stored information may be the fourth identification information
  • the stored information may include a user equipment list, QoS requirements, and the like.
  • PCF or UDM receives Nudr_DM_Response from UDR.
  • Step 1509 the PCF or UDM determines whether the multicast service corresponding to the fourth identification information can be transmitted by a multicast session and whether the user equipment identified by the third user identification information can join the multicast service corresponding to the fourth identification information according to the obtained storage information. broadcast session.
  • the PCFF or UDM determines that the user equipment identified by the third user identification information can be added to the multiple user equipment corresponding to the fourth identification information. broadcast session.
  • the PCF or UDM may indicate to the second SMF that the user is allowed to The device joins the multicast session corresponding to the fourth identification information, or indicates that the multicast session corresponding to the fourth identification information is available (MBS session available).
  • the PCF or UDM may indicate to the second SMF The user equipment is not allowed to join the multicast session corresponding to the fourth identification information, or indicates that the multicast session corresponding to the fourth identification information is unavailable (MBS session unavailable).
  • Step 1510 the PCF or the UDM sends the first indication information to the second SMF.
  • the second SMF receives the first indication information from the PCF or the UDM.
  • the first indication information is used to indicate whether the user equipment is allowed to join the multicast session corresponding to the fourth identification information, or to indicate whether the multicast session corresponding to the fourth identification information is available.
  • the PCF or the UDM sends an MBS policy response message (MBS policy response) to the second SMF.
  • MBS policy response MBS policy response
  • the second SMF may perform step 1511 . If the first indication information indicates that the user equipment is allowed to join the multicast session corresponding to the fourth identification information, the second SMF may perform steps 1512-1515.
  • Step 1511 the second SMF rejects the first join request of the user equipment.
  • the subsequent second SMF may indicate to the user equipment or the AMF that the first join request of the user equipment is rejected.
  • Step 1512 the second SMF accepts the first join request of the user equipment, and selects the first SMF through the NRF.
  • Step 1513 the second SMF sends a second query message to the first SMF. Accordingly, the first SMF receives the second query message from the second SMF.
  • the second query message is used to query the information of the fourth identification information.
  • the second query message includes fourth identification information.
  • the information of the fourth identification information may include QoS-related information of the multicast service corresponding to the fourth identification information, which is used for establishing and configuring a multicast session.
  • the second SMF sends Nmbsmf_information_request to the first SMF.
  • Step 1514 the first SMF sends a second response message to the second SMF. Accordingly, the second SMF receives the second response message from the first SMF.
  • the second response message includes information of the fourth identification information.
  • the first SMF sends Nmbsmf_information_response to the second SMF.
  • Step 1515 the subsequent process of the user equipment joining the multicast group.
  • the list of available user equipments (UE list) for the multicast session corresponding to the fourth identification information can be stored in the UDR, so that the second SMF can send a request to the PCF to the PCF when receiving the joining request of the user equipment.
  • PCF/UDM can query the UDR for the list of available user equipments for the corresponding multicast session, and then determine the authentication result according to the feedback information of the UDR and indicate it to the second SMF, Thus, authentication of the joining request of the user equipment can be implemented.
  • FIG. 16 is a schematic flowchart of an authentication method provided by another embodiment of the present application.
  • the method shown in FIG. 16 may be applied to the system architecture shown in FIG. 1 or the system architecture shown in FIG. 3 , and the embodiment of the present application is not limited thereto.
  • the method shown in FIG. 16 includes at least part of the following.
  • Step 1601 the second SMF receives the subscription information from the AF.
  • the subscription information is used for subscribing to the notification that the user equipment joins the first multicast session.
  • the subscription information includes second identification information and an event identifier, where the second identification information corresponds to the first multicast session, and the event identifier is used to identify an event that the user equipment joins the multicast session.
  • the second SMF may receive subscription information from the AF through the UDR.
  • the second SMF may receive the subscription information from the AF through the PCF or the UDM.
  • Step 1602 the user equipment sends a first join request to the second SMF.
  • the first join request is used for requesting to join the first multicast session.
  • the first join request includes second identification information, and the second identification information corresponds to the first multicast session.
  • the fourth identification information may include a temporary mobile group identifier (TMGI) of the multicast group corresponding to the multicast data, the IP address of the application server providing the multicast data, and the service identifier of the multicast data.
  • TMGI temporary mobile group identifier
  • service identifier service ID
  • packet filter information of multicast data packet filter information of multicast data
  • service data flow (SDF) identification rules of multicast data ID of multicast PDU session used to transmit multicast data
  • ID of multicast PDU session used to transmit multicast data At least one of , application ID information (Application ID), target IP address information (for example, IP multicast address) of multicast data, and context identification information (Multicast Session Context ID) of a multicast session corresponding to a multicast group .
  • Application ID Application ID
  • target IP address information for example, IP multicast address
  • context identification information Multicast Session Context ID
  • Step 1603 the second SMF sends the first message to the AF.
  • the first message is used to notify the AF user equipment to request to join the first multicast session, and the first message includes the second identification information and the first user identification information of the user equipment.
  • Step 1604 the second SMF receives the second indication information from the AF.
  • the second indication information is used to indicate whether the user equipment is allowed to join the first multicast session.
  • Step 1605 when the second indication information indicates that the user equipment is allowed to join the first multicast session, the second SMF accepts the first join request.
  • the second SMF selects the first SMF through the NRF, and continues the subsequent joining process.
  • Step 1606 when the second indication information indicates that the user equipment is not allowed to join the first multicast session, the second SMF accepts the first join request.
  • the second SMF sends a reject join request message (reject join request) to the user equipment or the AMF. ).
  • FIG. 17 is a schematic flowchart of an authentication method provided by another embodiment of the present application.
  • the method shown in FIG. 17 can be applied to the system architecture shown in FIG. 1 , and can also be applied to the system architecture shown in FIG. 3 , and the embodiment of the present application is not limited thereto.
  • the method in FIG. 17 may be performed by the user equipment, the first SMF, the second SMF, the PCF, the UDR, the NEF/MBSF-C, and the AF, or by the user equipment, the first SMF, the second SMF, the PCF, the UDR, the NEF Modules or units (eg, circuits, chips, or SOCs, etc.) in MBSF-C and AF are executed.
  • the execution subject is the user equipment, the first SMF, the second SMF, the PCF, the UDR, and the NEF/MBSF-C. and AF for example.
  • the method of FIG. 17 may include at least some of the following.
  • Step 1701 the AF sends a second configuration request message to the NEF or the MBSF-C. Accordingly, the NEF or MBSF-C receives the second configuration request message from the AF.
  • the second configuration request message is used to configure a multicast session for the multicast service.
  • the second configuration request message includes second identification information of the multicast data, and the second identification information may include, and may include, a temporary mobile group identifier (TMGI) of the multicast group corresponding to the multicast data, the provision of multiple The IP address of the application server of the multicast data, the service identifier (service ID) of the multicast data, the packet filter (packet filter) information of the multicast data, and the service data flow (SDF) identification of the multicast data Rules, the ID of the multicast PDU session used to transmit the multicast data, the application ID information (Application ID), the target IP address information of the multicast data (for example, IP multicast address), and the multicast group corresponding to the multicast group At least one of the session's context identification information (Multicast Session Context ID).
  • the second identification information of the multicast data is simply referred to as the second identification information hereinafter.
  • the second configuration request message may also include subscription information.
  • the subscription information is used to subscribe to the notification that the user equipment joins the multicast session.
  • the subscription information includes second identification information and an event identifier, and the event identifier is used to identify the user equipment to join the multicast session event
  • the AF may send an MBS preconfiguration request message (MBS preconfiguration request) to the NEF or the MBSF-C.
  • MBS preconfiguration request MBS preconfiguration request
  • Step 1702 the NEF or the MBSF-C stores the subscription information in the second configuration request message in the UDR.
  • Step 1703 the NEF or the MBSF-C sends a second configuration response message to the AF. Accordingly, the AF receives the second configuration response message from the NEF or MBSF-C.
  • the NEF or the MBSF-C may send an MBS preconfiguration response message (MBS preconfiguration response) to the AF.
  • MBS preconfiguration response MBS preconfiguration response
  • Step 1704 the UDR sends a first notification message to the PCF. Accordingly, the PCF receives the first notification message from the UDR.
  • the first notification message includes subscription information.
  • UDR sends Nudr_DM_Notify to PCF.
  • Step 1705 the PCF sends the twelfth message to the second SMF. Accordingly, the second SMF receives the twelfth message from the PCF.
  • the twelfth message includes subscription information.
  • the PCF sends a session management policy update message (SM policy update) to the second SMF.
  • SM policy update session management policy update message
  • Step 1706 the AF sends an eighth message to the user equipment. Accordingly, the user equipment receives the eighth message from the AF.
  • the eighth message is used to notify the user equipment to initiate a join request (join request) for the multicast session corresponding to the second identification information.
  • the eighth message carries the second identification information.
  • the AF may send the eighth message through application layer signaling.
  • the AF sends a service announcement message (service announcement) to the user equipment.
  • service announcement service announcement
  • Step 1707 the user equipment sends a first join request to the second SMF. Accordingly, the second SMF receives the first join request from the user equipment.
  • the first join request is used for requesting to join the multicast session corresponding to the second identification information.
  • the first join request carries the second identification information.
  • the user equipment sends a first join request to the second SMF when detecting an IGMP join message for the second identification information and the like sent by the application layer.
  • the first join request may be an IGMP join request message or an MLR message.
  • the user equipment sends an MBS session join request message (MBS session join request) to the second SMF.
  • MBS session join request MBS session join request
  • Step 1708 after detecting the join request for the second identification information, the second SMF sends the first message to the AF. Accordingly, the AF receives the first message from the second SMF.
  • the first message is used to notify the AF that the user equipment requests to join the multicast session, or it can also be described as the first message is used to request authentication of the user equipment's request to join the multicast session, and the first message is used to request the user equipment The request of the device to join the multicast service is authenticated, etc.
  • the first message includes second identification information and first user identification information.
  • the second SMF sends a UE join notification to the AF.
  • Step 1709 After receiving the first message, the AF authenticates the joining request of the user equipment identified by the first user identification information.
  • the AF may query the database according to the first user identification information and the second identification information. If the subscription information of the first user identification information exists in the database for the second identification information, the AF determines that the authentication is passed, and after completing the configuration process of the multicast session, it can indicate to the second SMF that the user equipment is allowed to join the second identification The multicast session corresponding to the information, or indicating that the multicast session corresponding to the second identification information is available (MBS session available).
  • MMS session available MMS session available
  • the AF determines that the authentication fails, it can indicate to the second SMF that the user equipment is not allowed to join the multicast session corresponding to the second identification information, or indicate The multicast session corresponding to the second identification information is unavailable (MBS session unavailable).
  • Step 1710 the AF sends the second indication information to the second SMF. Accordingly, the second SMF receives the second indication information from the AF.
  • the second indication information is used to indicate the authentication result.
  • the AF sends the UE join notification response to the second SMF.
  • the second SMF may perform step 1711 . If the second indication information indicates that the user equipment is allowed to join the multicast session corresponding to the second identification information or the multicast session corresponding to the second identification information is available, the second SMF may continue to perform the subsequent process of the user equipment joining the multicast group.
  • Step 1711 the second SMF rejects the first join request of the user equipment.
  • the subsequent second SMF may indicate to the user equipment or the AMF that the join request of the user equipment is rejected.
  • Step 1712 the second SMF accepts the first join request of the user equipment, and continues to execute the subsequent process of the user equipment joining the multicast group.
  • the AF can subscribe the notification of the user equipment joining event to the second SMF, so that the second SMF can notify the AF that the user equipment requests to join the multicast session when receiving the joining request of the user equipment,
  • the AF can authenticate the joining request of the user equipment and indicate the authentication result to the second SMF, so that the joining request of the user equipment can be authenticated.
  • the solution can realize the authentication operation when the user equipment joins the group when the core network does not have the member information of the multicast group, which helps to avoid public security problems.
  • FIG. 18 is a schematic flowchart of an authentication method provided by another embodiment of the present application.
  • the method shown in FIG. 18 can be applied to the system architecture shown in FIG. 1 or the system architecture shown in FIG. 3 , and the embodiment of the present application is not limited thereto.
  • the method shown in FIG. 18 includes at least part of the following.
  • Step 1801 the user equipment sends a first join request to the second SMF.
  • the first join request is used for requesting to join the first multicast session.
  • the first join request includes fourth identification information, and the fourth identification information corresponds to the first multicast session.
  • the fourth identification information may include a temporary mobile group identifier (TMGI) of the multicast group corresponding to the multicast data, the IP address of the application server providing the multicast data, and the service identifier of the multicast data.
  • TMGI temporary mobile group identifier
  • service identifier service ID
  • packet filter information of multicast data packet filter information of multicast data
  • service data flow (SDF) identification rules of multicast data ID of multicast PDU session used to transmit multicast data
  • ID of multicast PDU session used to transmit multicast data At least one of , application ID information (Application ID), target IP address information (for example, IP multicast address) of the multicast data, and context identification information (Multicast Session Context ID) of the multicast session corresponding to the multicast group .
  • Application ID Application ID
  • target IP address information for example, IP multicast address
  • context identification information Multicast Session Context ID
  • Step 1802 when the first multicast session belongs to a multicast session to which the user equipment is allowed to join, the second SMF accepts the first join request.
  • the second SMF selects the first SMF through the NRF, and continues the subsequent joining process.
  • Step 1803 when the first multicast session does not belong to a multicast session to which the user equipment is allowed to join, the second SMF rejects the first join request.
  • the second SMF when the first indication information indicates that the user equipment is not allowed to join the first multicast session, the second SMF sends a reject join request message (reject join request) to the user equipment or the AMF. ).
  • the method shown in FIG. 18 further includes: the second SMF acquires information of a multicast session to which the user equipment is allowed to join.
  • the second SMF acquiring the information of the multicast session to which the user equipment is allowed to join includes: the SMF sends a fourteenth message to the first core network device, where the fourteenth message is used to request information about a multicast session to which the user equipment is allowed to join, the fourteenth message includes third user identification information of the user equipment; the first core network device obtains, according to the third user identification information, the user equipment that is allowed to join the information of the joined multicast service; the second session management function network element receives the information of the multicast service which the user equipment is allowed to join from the first core network device.
  • a possible implementation manner, wherein the first core network device obtains the information of the multicast service that the user equipment is allowed to join according to the third user identification information includes: the first core network device sends the third a query message, where the third query message includes third user identification information and is used to query information about a multicast session that the user equipment is allowed to join; the first core network device receives the third response message from the UDR, The third response message includes the information of the multicast session that the user equipment is allowed to join.
  • the method shown in FIG. 18 further includes: the UDR obtains the identification information corresponding to the multicast session and the user equipment list from the application function network element or the operator, where the user equipment list is allowed to join all The list of user equipments of the multicast session; the UDR determines the information of the multicast session that the user equipment is allowed to join according to the third query message, the identification information, and the list of user equipments.
  • the above-mentioned first core network device is PCF or UDM.
  • FIG. 19 is a schematic flowchart of an authentication method provided by another embodiment of the present application.
  • the method shown in FIG. 19 may be applied to the system architecture shown in FIG. 1 , and may also be applied to the system architecture shown in FIG. 3 , and the embodiments of the present application are not limited thereto.
  • the method in FIG. 19 may be performed by the user equipment, the first SMF, the second SMF, the PCF/UDM, the UDR, the NEF/MBSF-C and the AF, or by the user equipment, the first SMF, the second SMF, the PCF/UDM , UDR, NEF/MBSF-C, and modules or units (eg, circuits, chips, or SOCs, etc.) in AF are executed.
  • the execution subject is the user equipment, the first SMF, the second SMF, PCF/UDM, UDR , NEF/MBSF-C and AF as examples.
  • the method of FIG. 19 may include at least some of the following.
  • Step 1901 the AF sends a first configuration request message to the NEF, the MBSF-C or the first SMF. Accordingly, the NEF, MBSF-C or the first SMF receives the first configuration request message from the AF.
  • the first configuration request message is used to configure a multicast session for the multicast service.
  • the first configuration request message includes identification information of the multicast session.
  • identification information of the multicast data is simply referred to as identification information hereinafter.
  • the first configuration request message may further include a user equipment list, where the user equipment list may be a list of user equipments that are allowed to use the multicast service corresponding to the identification information. Since the first configuration request message is used to configure a multicast session for the multicast service, the user equipment list may also be described as a list of user equipments allowed to join the multicast session corresponding to the identification information. For example, the user equipment list is the allowed UE list.
  • Step 1902 the NEF, the MBSF-C or the first SMF stores the identification information in the first configuration request message in the UDR.
  • the NEF, the MBSF-C or the first SMF also stores the user equipment list in the UDR.
  • Step 1903 the NEF or the MBSF-C sends a first configuration response message to the AF. Accordingly, the AF receives the first configuration response message from the NEF or MBSF-C.
  • the identification information may include identification information corresponding to one or more multicast data.
  • the user equipment list may also include one or more user equipment lists corresponding to the one or more identification information. .
  • steps 1901-1903 are optional steps, and the above identification information and/or user equipment list may also be configured in the UDR by the operator.
  • the AF can timely store, update or remove the user equipment list stored in the UDR according to the business situation, and the solution is more flexible.
  • Step 1904 the user equipment performs a unicast session establishment process with the second SMF.
  • Step 1905 the second SMF sends the fourteenth message to the PCF or the UDM. Accordingly, the PCF or UDM receives the fourteenth message from the second SMF.
  • the PCF or UDM may be a PCF or UDM serving unicast.
  • the fourteenth message is used to request information of a multicast session that the user equipment is allowed to join, and the fourteenth message carries third user identification information of the user equipment (hereinafter referred to as third user identification information).
  • the second SMF may implement the information requesting the multicast session to which the user equipment is allowed to join by sending a message to the PCF to query the session management policy information of the user equipment.
  • the second SMF may implement the information requesting the multicast session to which the user equipment is allowed to join by sending a message for querying the subscription information of the user equipment to the UDM.
  • the multicast session that the user equipment is allowed to join can also be replaced with a multicast service that the user equipment is allowed to join, a multicast service that the user equipment is allowed to use, or a multicast service that the user equipment can use.
  • the second SMF may send a session management policy query message (SM policy query) to the PCF or the UDM.
  • SM policy query session management policy query message
  • Step 1906 the PCF, the UDM or the first SMF sends a third query message to the UDR. Accordingly, the UDR receives the third query message from the PCF, the UDM or the first SMF.
  • the third query message carries third user identification information, and is used to query the information of the user equipment.
  • the PCF, the UDM or the first SMF sends Nudr_DM_Query to the UDR.
  • Step 1907 the UDR determines the multicast session to which the user equipment is allowed to join according to the third user identification information, the stored identification information of the multicast data, and the user equipment list corresponding to the identification information of the multicast data.
  • the multicast session to which the user equipment is allowed to join may include one or more multicast sessions.
  • Step 1908 the UDR sends a third response message to the PCF, the UDM or the first SMF. Accordingly, the PCF, UDM or the first SMF receives the third response message from the UDR.
  • the third response message includes the information of the multicast session that the user equipment is allowed to join.
  • the information of the multicast session that the user equipment is allowed to join may include the TMGI of the multicast service that the user equipment is allowed to join, the IP address of the application server that provides the multicast data, the service identifier of the multicast data, and the grouping of the multicast data. Filtering information, service data flow identification rules for multicast data, IDs of multicast PDU sessions used to transmit multicast data, application ID information, destination IP address information for multicast data, and multicast groups corresponding to multicast groups At least one of the context identification information of the session.
  • the PCF, the UDM or the first SMF receives the Nudr_DM_Response from the UDR.
  • Step 1909 the PCF, the UDM or the first SMF sends a fifteenth message to the second SMF.
  • the second SMF receives the fifteenth message sent by the PCF, the UDM or the first SMF.
  • the fifteenth message carries the information of the multicast session to which the user equipment is allowed to join.
  • the PCF, the UDM or the first SMF sends a session management policy response message (SM policy response) to the second SMF.
  • SM policy response session management policy response message
  • Step 1910 the AF sends an eighth message to the user equipment. Accordingly, the user equipment receives the eighth message from the AF.
  • the eighth message is used to notify the user equipment to initiate a join request (join request) for the multicast session corresponding to the fourth identification information.
  • the eighth message carries fourth identification information.
  • the AF may send the eighth message through application layer signaling.
  • the AF sends a service announcement message (service announcement) to the user equipment.
  • service announcement service announcement
  • Step 1911 the user equipment sends a first join request to the second SMF. Accordingly, the second SMF receives the first join request from the user equipment.
  • the first join request is used to request to join the multicast session corresponding to the fourth identification information.
  • the first join request carries fourth identification information.
  • the user equipment sends a first join request to the second SMF when detecting an IGMP join message and the like for the fourth identification information sent by the application layer.
  • the first join request may be an IGMP join request message or an MLR message.
  • the user equipment sends an MBS session join request message (MBS session join request) to the second SMF.
  • MBS session join request MBS session join request
  • Step 1912 the second SMF determines whether to allow the user equipment to access the multicast service corresponding to the fourth identification information according to the multicast service that the user equipment is allowed to access and the fourth identification information.
  • the second SMF may perform step 1913 . If the second SMF determines that the user equipment is allowed to join the multicast session corresponding to the fourth identification information, the second SMF may perform steps 1914-1917.
  • Step 1913 the second SMF rejects the first join request of the user equipment.
  • the subsequent second SMF may indicate to the user equipment or the AMF that the first join request of the user equipment is rejected.
  • Step 1914 the second SMF accepts the first join request of the user equipment, and selects the first SMF through the NRF.
  • Step 1915 the second SMF sends a second query message to the first SMF. Accordingly, the first SMF receives the second query message from the second SMF.
  • Step 1916 the first SMF sends a second response message to the second SMF. Accordingly, the second SMF receives the second response message from the first SMF.
  • Step 1917 the subsequent process of the user equipment joining the multicast group.
  • steps 1913-1917 For a more detailed description of steps 1913-1917, reference may be made to steps 1511-1515, which will not be repeated here.
  • the list of user equipments available for the multicast session can be stored in the UDR, so that in the process of establishing a unicast session of the user equipment, the SMF can use the identifier of the user equipment as an index to pass the PCF,
  • the UDM or the first SMF requests the UDR for a multicast service that allows the user equipment to join, and then authenticates the user equipment's join request according to the information fed back by the UDR, so that the user equipment's join request can be authenticated.
  • the communication apparatus includes corresponding hardware structures and/or software modules for performing each function.
  • the units and method steps of each example described in conjunction with the embodiments disclosed in the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is performed by hardware or computer software-driven hardware depends on the specific application scenarios and design constraints of the technical solution.
  • the communication apparatus may be user equipment, access network equipment, AMF, UPF, SMF, NEF, UDM, UDR, PCF, MBSF, AF, or application server, or may be a user equipment, Access network equipment, AMF, UPF, SMF, NEF, UDM, UDR, PCF, MBSF, AF or modules (eg chips) of application servers.
  • the apparatus 1400 includes a processing unit 1410 and a transceiver unit 1420 .
  • the processing unit 1410 may execute steps 410 and 450 shown in the method embodiment, and the transceiver unit 1420 may execute the method shown in the method embodiment. steps 420 and 440.
  • the processing unit may execute step 430 shown in the method embodiment, and the transceiver unit 1420 may execute steps 420 and 420 shown in the method embodiment. 440.
  • the transceiver unit 1420 may perform step 501 shown in the method embodiment.
  • the transceiver unit 1420 may perform step 502 shown in the method embodiment.
  • the transceiver unit 1420 may perform step 503 shown in the method embodiment.
  • the processing unit may execute steps 516 and 504 shown in the method embodiment, and the transceiver unit 1420 may execute the method shown in the method embodiment. Steps 503, 505, 507, 508, 513 and 514.
  • the processing unit may execute steps 506 and 511 shown in the method embodiment, and the transceiver unit 1420 may execute the steps shown in the method embodiment 505, 507, 510 and 512.
  • the processing unit may execute step 509 shown in the method embodiment, and the transceiver unit 1420 may execute steps 508 and 510 shown in the method embodiment. , 512 and 513.
  • the transceiver unit 1420 may perform step 601 shown in the method embodiment.
  • the transceiver unit 1420 may perform step 602 shown in the method embodiment.
  • the transceiver unit 1420 may perform steps 602 and 603 shown in the method embodiment.
  • the processing unit may execute steps 616 and 604 shown in the method embodiment, and the transceiver unit 1420 may execute the method shown in the method embodiment. Steps 603, 605, 607, 608, 613 and 614.
  • the processing unit may execute steps 606 and 611 shown in the method embodiment, and the transceiver unit 1420 may execute the steps shown in the method embodiment 605, 607, 610 and 612.
  • the processing unit may execute step 609 shown in the method embodiment, and the transceiver unit 1420 may execute steps 608 and 610 shown in the method embodiment. , 612 and 613.
  • the transceiver unit 1420 may perform step 701 shown in the method embodiment.
  • the transceiver unit 1420 may perform step 602 shown in the method embodiment.
  • the processing unit may perform steps 716 and 704 shown in the method side embodiment, and the transceiver unit 1420 may perform the method side embodiment shown in the steps 716 and 704 Steps 705, 707, 708, 713 and 714.
  • the processing unit may execute steps 706 and 711 shown in the method embodiment, and the transceiver unit 1420 may execute the steps shown in the method embodiment 705, 707, 710 and 712.
  • the processing unit may execute step 709 shown in the method embodiment, and the transceiver unit 1420 may execute steps 708 and 710 shown in the method embodiment. , 712 and 713.
  • the transceiver unit 1420 may perform step 801 shown in the method embodiment.
  • the transceiver unit 1420 may perform step 802 shown in the method embodiment.
  • the processing unit may execute steps 816 and 804 shown in the method embodiment, and the transceiver unit 1420 may execute the method shown in the method embodiment. Steps 805, 807, 808, 813 and 814.
  • the processing unit may execute steps 806 and 811 shown in the method embodiment, and the transceiver unit 1420 may execute the steps shown in the method embodiment 805, 807, 810 and 812.
  • the processing unit may execute step 809 shown in the method embodiment, and the transceiver unit 1420 may execute steps 808 and 810 shown in the method embodiment. , 812 and 813.
  • the transceiver unit 1420 may perform steps 901 and 904 shown in the method embodiment.
  • the processing unit may execute step 902 shown in the method embodiment, and the transceiver unit 1420 may execute steps 901 and 901 shown in the method embodiment. 905.
  • the processing unit may execute step 903 shown in the method embodiment, and the transceiver unit 1420 may execute step 903 and step 903 shown in the method embodiment. 904.
  • the processing unit 1410 may execute step 1003 shown in the method embodiment, and the transceiver unit 1420 may execute step 1001 shown in the method embodiment and 1005.
  • the processing unit 1410 may execute steps 1002 and 1003 shown in the method embodiment, and the transceiver unit 1420 may execute the method shown in the method embodiment. steps 1001 and 1008.
  • the apparatus 1400 is used to implement the function of the application server in the method embodiment shown in FIG.
  • the processing unit may execute step 1004 shown in the method embodiment, and the transceiver unit 1420 may execute steps 1005 and 100 shown in the method embodiment. 1006.
  • the transceiver unit 1420 may perform steps 1006 and 1007 shown in the method embodiment.
  • the processing unit may execute step 1003 shown in the method embodiment, and the transceiver unit 1420 may execute step 1008 shown in the method embodiment. and 1007.
  • the processing unit 1410 may execute step 1105 shown in the method embodiment, and the transceiver unit 1420 may execute step 1101 shown in the method embodiment and 1107.
  • the processing unit 1410 may execute step 1105 shown in the method embodiment, and the transceiver unit 1420 may execute the step shown in the method embodiment 1001, 1102, 1104 and 1112.
  • the apparatus 1400 is used to implement the function of the first SMF in the method embodiment shown in FIG.
  • the processing unit 1410 may execute step 1105 shown in the method embodiment, and the transceiver unit 1420 may execute the step shown in the method embodiment 1112 and 1111.
  • the processing unit may execute step 1106 shown in the method embodiment, and the transceiver unit 1420 may execute steps 1107 and 110 shown in the method embodiment. 1108.
  • the processing unit may execute step 1110 shown in the method embodiment, and the transceiver unit 1420 may execute step 1108 shown in the method embodiment. , 1111 and 1109.
  • the processing unit may perform steps 1103 and 1105 shown in the method side embodiment, and the transceiver unit 1420 may perform the method side embodiment shown in the steps 1103 and 1105 . Steps 1112, 1109, 1102 and 1104.
  • the processing unit 1410 may execute step 1214 shown in the method embodiment, and the transceiver unit 1420 may execute step 1201 shown in the method embodiment. and 1207.
  • the processing unit 1410 may execute step 1214 shown in the method embodiment, and the transceiver unit 1420 may execute the step shown in the method embodiment 1201-1203.
  • the apparatus 1400 is used to implement the function of the first SMF in the method embodiment shown in FIG.
  • the processing unit 1410 may execute steps 1204 and 1214 shown in the method embodiment, and the transceiver unit 1420 may execute the method shown in the method embodiment. steps 1202, 1205 and 1213.
  • the processing unit may execute step 1206 shown in the method embodiment, and the transceiver unit 1420 may execute steps 1207 and 1207 shown in the method embodiment. 1208.
  • the processing unit may execute step 1210 shown in the method embodiment, and the transceiver unit 1420 may execute step 1208 shown in the method embodiment. , 1211 and 1209.
  • the processing unit may execute step 1214 shown in the method embodiment, and the transceiver unit 1420 may execute step 1212 shown in the method embodiment. , 1209, 1203 and 1205.
  • the transceiver unit 1420 may perform steps 1301 and 1312 shown in the method embodiment.
  • the processing unit 1410 may execute steps 1302 and 1304 shown in the method embodiment, and the transceiver unit 1420 may execute the method described in the method embodiment. Steps 1301, 1305 and 1309 are shown.
  • the processing unit 1410 may execute steps 1306 and 1303 shown in the method embodiment, and the transceiver unit 1420 may execute the steps shown in the method embodiment 1305, 1307-1309.
  • the processing unit 1410 may execute steps 1310 and 1303 shown in the method embodiment, and the transceiver unit 1420 may execute the method shown in the method embodiment. steps 1307, 1308 and 1313.
  • the processing unit may execute step 1311 shown in the method embodiment, and the transceiver unit 1420 may execute steps 1312 and 1312 shown in the method embodiment. 1313.
  • the transceiver unit 1420 may perform step 1313 shown in the method embodiment.
  • the transceiver unit 1420 may perform step 1401 shown in the method embodiment.
  • the transceiver unit 1420 may perform steps 1401, 1402 and 1404 shown in the method side embodiment, and the processing unit 1410 may perform the method side embodiment Steps 1405 and 1406 are shown.
  • the transceiver unit 1420 may perform steps 1402 to 1403 shown in the method embodiment.
  • the transceiver unit 1420 may perform step 1403 shown in the method embodiment.
  • the transceiver unit 1420 may perform steps 1504 and 1505 shown in the method side embodiment, and the processing unit 1410 may perform the method side embodiment shown in the steps 1504 and 1505. Step 1515.
  • the transceiver unit 1420 may perform steps 1505, 1506, 1510, 1513 and 1514 shown in the method side embodiment, and the processing unit 1410 may perform Steps 1511, 1512 and 1515 shown in the method side embodiment.
  • the apparatus 1400 is used to implement the function of PCF or UDM in the method embodiment shown in FIG.
  • the transceiver unit 1420 may perform steps 1506-1508 and 1510 shown in the method side embodiment, and the processing unit 1410 may perform the method side embodiment Steps 1509 and 1515 are shown.
  • the processing unit 1410 may execute steps 1502 and 1515 shown in the method embodiment, and the transceiver unit 1420 may execute the steps shown in the method embodiment 1507 and 1508.
  • the transceiver unit 1420 may execute steps 1501 and 1503 shown in the method embodiment, and the processing unit 1410 may execute the method embodiment Steps 1502 and 1515 are shown.
  • the processing unit 1410 may execute step 1515 shown in the method embodiment, and the transceiver unit 1420 may execute steps 1501 and 1500 shown in the method embodiment. 1503.
  • the transceiver unit 1420 may perform step 1602 shown in the method embodiment.
  • the transceiver unit 1420 may perform steps 1601-1604 shown in the method side embodiment, and the processing unit 1410 may perform the method side embodiment shown in the steps 1601-1604. steps 1605 and 1606.
  • the transceiver unit 1420 may perform step 1601 shown in the method embodiment.
  • the transceiver unit 1420 may perform steps 1601 , 1604 and 1603 shown in the method embodiment.
  • the transceiver unit 1420 may perform steps 1706 and 1707 shown in the method side embodiment, and the processing unit 1410 may perform the method side embodiment shown in the steps 1706 and 1707. Step 1712.
  • the transceiver unit 1420 may perform steps 1705 , 1707 , 1708 and 1710 shown in the method side embodiment, and the processing unit 1410 may perform the method side Steps 1711 and 1712 shown in the embodiment.
  • the apparatus 1400 is used to implement the function of the PCF in the method embodiment shown in FIG.
  • the transceiver unit 1420 may execute steps 1704 and 1705 shown in the method embodiment, and the processing unit 1410 may execute the steps shown in the method embodiment 1712.
  • the processing unit 1410 may execute steps 1702 and 1712 shown in the method embodiment, and the transceiver unit 1420 may execute the steps shown in the method embodiment 1704.
  • the transceiver unit 1420 may execute steps 1701 and 1703 shown in the method embodiment, and the processing unit 1410 may execute the method embodiment Steps 1702 and 1712 are shown.
  • the processing unit 1410 may execute steps 1709 and 1712 shown in the method embodiment, and the transceiver unit 1420 may execute the steps shown in the method embodiment 1701, 1703, 1706, 1708 and 1710.
  • the transceiver unit 1420 may perform step 1801 shown in the method embodiment.
  • the transceiver unit 1420 may perform steps 1801, 1804 and 1806 shown in the method side embodiment, and the processing unit 1410 may perform the method side Steps 1802 and 1803 shown in the embodiment.
  • the transceiver unit 1420 may execute steps 1804 and 1806 shown in the method embodiment, and the processing unit 1410 may execute the method embodiment Step 1805 is shown.
  • the transceiver unit 1420 may perform steps 1910 and 1911 shown in the method side embodiment, and the processing unit 1410 may perform the method side embodiment shown in the steps 1910 and 1911 Steps 1904 and 1917.
  • the transceiver unit 1420 may perform steps 1905, 1909, 1911, 1915 and 1916 shown in the method side embodiment, and the processing unit 1410 may perform Steps 1904, 1912-1914 and /1917 shown in the method side embodiment.
  • the apparatus 1400 is used to implement the functions of PCF or UDM in the method embodiment shown in FIG.
  • the transceiver unit 1420 may perform steps 1905 , 1906 , 1908 and 1909 shown in the method side embodiment, and the processing unit 1410 may perform the method side Step 1917 shown in the embodiment.
  • the processing unit 1410 may perform steps 1902, 1907 and 1917 shown in the method side embodiment, and the transceiver unit 1420 may perform the method side embodiment shown in the steps 1902, 1907 and 1917. steps 1906 and 1908.
  • the apparatus 1400 is used to implement the functions of NEF, MBSF-C or the first SMF in the method embodiment shown in FIG.
  • the transceiver unit 1420 may execute steps 1901 and 1903 shown in the method embodiment, and the processing unit 1410 may execute Steps 1902 and 1917 shown in the method side embodiment.
  • the processing unit 1410 may execute step 1917 shown in the method embodiment, and the transceiver unit 1420 may execute steps 1901 and 1900 shown in the method embodiment. 1903.
  • processing unit 1410 and the transceiver unit 1420 can be obtained directly by referring to the relevant descriptions in the method embodiments shown in FIG. 4 to FIG. 19 , and details are not repeated here.
  • the apparatus 1500 includes a processor 1510 and an interface circuit 1520 .
  • the processor 1510 and the interface circuit 1520 are coupled to each other.
  • the interface circuit 1520 can be a transceiver or an input-output interface.
  • the apparatus 1500 may further include a memory 1530 for storing instructions executed by the processor 1510 or input data required by the processor 1510 to execute the instructions or data generated after the processor 1510 executes the instructions.
  • the processor 1510 is used to perform the functions of the above-mentioned processing unit 1410
  • the interface circuit 1520 is used to perform the functions of the above-mentioned transceiver unit 1420 .
  • the chip When the above device is a chip applied to user equipment, access network equipment, AMF, UPF, SMF, NEF, UDM, UDR, PCF, MBSF, AF or application server, the chip implements the user equipment, connection Functions of onboard devices, AMF, UPF, SMF, NEF, UDM, UDR, PCF, MBSF, AF or application server.
  • the chip receives information from user equipment, access network equipment, AMF, UPF, SMF, NEF, UDM, UDR, or other modules (such as radio frequency modules or antennas) in the application server, and the information is sent by other equipment to the user equipment.
  • Access network equipment AMF, UPF, SMF, NEF, UDM, UDR, PCF, MBSF, AF or application server; or, the chip to user equipment, access network equipment, AMF, UPF, SMF, NEF, UDM, UDR , PCF, MBSF, AF or other modules in the application server (such as radio frequency modules or antennas) to send information, the information is user equipment, access network equipment, AMF, UPF, SMF, NEF, UDM, UDR, PCF, MBSF, AF or application server sent to other devices.
  • the processor in the embodiments of the present application may be a central processing unit (Central Processing Unit, CPU), and may also be other general-purpose processors, digital signal processors (Digital Signal Processor, DSP), application-specific integrated circuits (Application Specific Integrated Circuit, ASIC), Field Programmable Gate Array (Field Programmable Gate Array, FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof.
  • a general-purpose processor may be a microprocessor or any conventional processor.
  • the method steps in the embodiments of the present application may be implemented in a hardware manner, or may be implemented in a manner in which a processor executes software instructions.
  • Software instructions can be composed of corresponding software modules, and software modules can be stored in random access memory (Random Access Memory, RAM), flash memory, read-only memory (Read-Only Memory, ROM), programmable read-only memory (Programmable ROM) , PROM), Erasable Programmable Read-Only Memory (Erasable PROM, EPROM), Electrically Erasable Programmable Read-Only Memory (Electrically Erasable Programmable Read-Only Memory (Electrically EPROM, EEPROM), registers, hard disks, removable hard disks, CD-ROMs or known in the art in any other form of storage medium.
  • RAM Random Access Memory
  • ROM read-only memory
  • PROM programmable read-only memory
  • PROM Erasable Programmable Read-Only Memory
  • EPROM Electrically Erasable Programmable Read-Only Memory
  • An exemplary storage medium is coupled to the processor, such that the processor can read information from, and write information to, the storage medium.
  • the storage medium can also be an integral part of the processor.
  • the processor and storage medium may reside in an ASIC. Additionally, the ASIC may reside in the user equipment, AMF, UPF, SMF, NEF, UDM, UDR or application server. Of course, the processor and storage medium may also exist as discrete components in the user equipment, AMF, UPF, SMF, NEF, UDM, UDR or application server.
  • the computer program product includes one or more computer programs or instructions.
  • the computer may be a general purpose computer, a special purpose computer, a computer network, or other programmable device.
  • the computer program or instructions may be stored in or transmitted over a computer-readable storage medium.
  • the computer-readable storage medium can be any available media that can be accessed by a computer or a data storage device such as a server that integrates one or more available media.
  • the usable media may be magnetic media, such as floppy disks, hard disks, magnetic tapes; optical media, such as DVDs; and semiconductor media, such as solid state disks (SSD).
  • “at least one” means one or more, and “plurality” means two or more.
  • “And/or”, which describes the association relationship of the associated objects, indicates that there can be three kinds of relationships, for example, A and/or B, which can indicate: the existence of A alone, the existence of A and B at the same time, and the existence of B alone, where A, B can be singular or plural.
  • the character “/” generally indicates that the related objects are a kind of "or” relationship; in the formula of this application, the character "/” indicates that the related objects are a kind of "division" Relationship.
  • the disclosed system, apparatus and method may be implemented in other manners.
  • the apparatus embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented.
  • the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the functions, if implemented in the form of software functional units and sold or used as independent products, may be stored in a computer-readable storage medium.
  • the technical solution of the present application can be embodied in the form of a software product in essence, or the part that contributes to the prior art or the part of the technical solution.
  • the computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk and other media that can store program codes .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Multimedia (AREA)
  • Computer Security & Cryptography (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Computer And Data Communications (AREA)

Abstract

本申请提供了用于鉴权的方法和通信装置，在本申请的技术方案中，第一SMF将第一用户标识信息和多播数据的识别信息发送给应用服务器，由应用服务器执行用户设备加入群组时的鉴权操作，从而可以实现对用户设备的加入请求进行鉴权，并且可以在核心网没有多播群组的成员信息的情况下实现针对用户设备加入群组时的鉴权操作，有助于避免产生公共安全问题。

Description

用于鉴权的方法和通信装置
本申请要求于2020年08月13日提交中国专利局、申请号为202010815001.7、申请名称为“用于鉴权的方法和通信装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信领域，并且更具体地，涉及用于鉴权的方法和通信装置。
背景技术
目前，若第五代(5th generation，5G)系统的核心网需要向多个用户设备发送相同业务，可以建立一条多播用户面连接来发送数据，使得发给不同用户设备的相同内容的数据只选择一份发送，有利于提高空口侧资源和核心网资源的使用效率。
在多播场景中，当用户设备加入多播群组时，需要对用户设备的加入请求进行鉴权操作，以便保证多播业务的正确传输。基于此，如何实现对用户设备的加入请求进行鉴权成为亟需解决的问题。
发明内容
本申请提供了用于鉴权的方法和通信装置，可以实现对用户设备的加入请求进行鉴权。
第一方面，本申请提供了一种用于鉴权的方法，所述方法包括：第一会话管理功能网元SMF获取第一信息和多播数据的第一识别信息，所述第一信息用于确定所述用户设备的第一用户标识信息；所述第一SMF向应用服务器发送第一消息，所述第一消息用于请求对所述用户设备加入多播群组的请求进行鉴权，所述第一消息包括所述第一用户标识信息和多播数据的第二识别信息，所述第一识别信息和第二识别信息与所述多播群组对应；所述第一SMF接收应用服务器发送的第二消息，所述第二消息中包括鉴权结果信息。
第一用户标识信息为用于唯一标识用户设备且应用服务器可以识别的信息。
例如，第一用户标识信息可以为通用公共用户标识符(generic public subscription identifier，GPSI)。
第二用户标识信息可以为用于唯一标识用户设备，且核心网设备和接入网设备可以识别的信息。
例如，第二用户标识信息可以包括用户永久标识符(subscriber permanent ID，SUPI)、通用唯一临时标识符(globally unique temporary ID，GUTI)和用户隐藏标识符(subscription concealed identifier，SUCI)中的至少一个。
多播数据的第一识别信息、第二识别信息与用户设备请求加入的多播群组对应，可以包括多播数据对应的多播群组的临时移动组标识(temporary mobile group identifier， TMGI)、提供多播数据的应用服务器的IP地址、多播数据的业务标识(service identifier，service ID)、多播数据的分组过滤(packet filter)信息、多播数据的业务数据流(service data flow，SDF)识别规则、用于传输多播数据的多播PDU会话的ID、应用的ID信息(Application ID)、多播数据的目标IP地址信息(IP multicast address)、以及多播群组对应的多播会话的上下文标识信息(Multicast Session Context ID)中的至少一个。
可选地，第一识别信息和第二识别信息可以相同。
可选地，第一识别信息和第二识别信息可以不同。具体地，第一SMF获取到第一识别信息后，可以根据第一识别信息确定第二识别信息，进而将第二识别信息发送给应用服务器。例如，第一SMF获取到的第一识别信息为多播群组的TMGI，第一SMF根据TMGI确定与该TMGI对应的PDU会话的ID，并将该PDU会话的ID通过第一消息发送给应用服务器。
在本申请实施例中，第一SMF将第一用户标识信息和第二识别信息发送给应用服务器，由应用服务器执行用户设备加入群组时的鉴权操作，从而可以实现对用户设备的加入请求进行鉴权。此外，在本方案中无需应用服务器向核心网实时提供明确的多播群组的成员信息，可以在核心网没有多播群组的成员信息的情况下实现针对用户设备加入群组时的鉴权操作，有助于避免产生公共安全问题。
结合第一方面，在一种可能的实现方式中，所述方法还包括：所述第一SMF根据所述第一识别信息，确定需要所述应用服务器对所述用户设备加入所述多播群组的请求进行鉴权。
例如，第一SMF可以根据本地存储的策略确定是否需要应用服务器进行鉴权授权。该策略可以预配置在第一SMF中，也可以由其他网元(例如，PCF、UDM或UDR)提供。该策略用于指示第一SMF是否需要针对携带该识别信息的加入请求向发起应用服务器的鉴权授权流程。
又例如，第一SMF可以判断是否存储了第一识别信息对应的多播群组的成员列表信息，并且当该成员列表信息中包括第一用户标识时，第一SMF确认需要应用服务器进行鉴权授权；否则，第一SMF确定用户设备的加入请求不合法，向用户设备返回群组加入失败的指示。
结合第一方面或其任意一种实现方式，在另一种可能的实现方式中，所述第一信息包括所述第一用户标识信息和/或所述用户设备的第二用户标识信息。
结合第一方面或其任意一种实现方式，在另一种可能的实现方式中，所述方法还包括：所述第一SMF根据所述第二用户标识信息，获取所述第一用户标识信息。
结合第一方面或其任意一种实现方式，在另一种可能的实现方式中，所述第一SMF根据所述第二用户标识信息，获取所述第一用户标识信息，包括：所述第一SMF根据所述第二用户标识信息从第一网元获取所述第一用户标识信息，所述第一网元包括接入和移动管理功能网元AMF、统一数据管理网元UDM和统一数据存储库UDR。
结合第一方面或其任意一种实现方式，在另一种可能的实现方式中，所述第一SMF获取第一信息和多播数据的第一识别信息，包括：所述第一SMF从第二SMF、接入和移动管理功能网元AMF或第二用户面功能网元UPF获取所述第一信息和所述第一识别信息。
结合第一方面或其任意一种实现方式，在另一种可能的实现方式中，所述第一SMF向所述应用服务器发送第一消息，包括：所述第一SMF根据所述第一识别信息，确定所述应用服务器的标识信息；所述第一SMF直接向所述应用服务器发送所述第一消息，或者所述第一SMF通过第一UPF向所述应用服务器发送所述第一消息。
结合第一方面或其任意一种实现方式，在另一种可能的实现方式中，所述第一SMF向所述应用服务器发送第一消息，包括：所述第一SMF通过网络开放功能网元NEF向所述应用服务器发送所述第一消息。
第二方面，本申请提供了一种用于鉴权的方法，所述方法包括：应用服务器接收来自会话管理功能网元SMF的第一消息，所述第一消息用于请求对用户设备加入多播群组的请求进行鉴权，所述第一消息包括第一用户标识信息和多播数据的第二识别信息，所述第二识别信息与所述多播群组对应，所述第一用户标识信息为所述用户设备的标识信息；所述应用服务器根据所述第一用户标识信息和所述第二识别信息，对所述用户设备加入所述多播群组的请求进行鉴权；所述应用服务器向所述SMF发送第二消息，所述第二消息中包括鉴权结果信息。
第一用户标识信息为用于唯一标识用户设备且应用服务器可以识别的信息。
例如，第一用户标识信息可以为GPSI。
多播数据的第二识别信息与用户设备请求加入的多播群组对应，可以包括多播数据对应的多播群组的TMGI、提供多播数据的应用服务器的IP地址、多播数据的业务标识、多播数据的分组过滤信息、多播数据的SDF识别规则、用于传输多播数据的多播PDU会话的ID、应用的ID信息、多播数据的目标IP地址信息、以及多播群组对应的多播会话的上下文标识信息中的至少一个。
在本申请实施例中，SMF将第一用户标识信息和第二识别信息发送给应用服务器，由应用服务器执行用户设备加入群组时的鉴权操作，从而可以实现对用户设备的加入请求进行鉴权。此外，在本方案中无需应用服务器向核心网实时提供明确的多播群组的成员信息，可以在核心网没有多播群组的成员信息的情况下实现针对用户设备加入群组时的鉴权操作，有助于避免产生公共安全问题。
结合第二方面，在一种可能的实现方式中，所述应用服务器向所述SMF发送第二消息，包括：所述应用服务器直接向所述SMF发送所述第二消息，或者通过UPF或网络开放功能网元NEF向所述SMF发送所述二消息。
结合第二方面或其任意一种实现方式，在另一种可能的实现方式中，所述方法还包括：
所述应用服务器向第二核心网设备发送第二配置请求消息，所述第二配置请求消息包括所述第二识别信息和订阅信息，所述订阅信息用于订阅用户设备加入所述多播会话事件的通知；
所述应用服务器接收来自所述第二核心网设备发送的第二配置响应消息，所述第二配置响应消息用于指示所述第二识别信息和所述订阅信息已存储在统一数据存储库。
结合第二方面或其任意一种实现方式，在另一种可能的实现方式中，所述第二核心网设备为网络开放功能网元或多播广播业务功能网元。
结合第二方面或其任意一种实现方式，在另一种可能的实现方式中，所述SMF服务于单播，或者所述SMF服务于多播。
第三方面，本申请提供了一种用于鉴权的方法，所述方法包括：用户设备确定第三消息，所述第三消息用于请求加入多播群组，所述第三消息包括多播数据的第三识别信息，所述第三识别信息与所述多播群组对应；用户设备向第二用户面网元UPF发送所述第三消息。
多播数据的第三识别信息与用户设备请求加入的多播群组对应，可以包括多播数据对应的多播群组的TMGI、提供多播数据的应用服务器的IP地址、多播数据的业务标识、多播数据的分组过滤信息、多播数据的SDF识别规则、用于传输多播数据的多播PDU会话的ID、应用的ID信息、多播数据的目标IP地址信息、以及多播群组对应的多播会话的上下文标识信息中的至少一个。
在上述技术方案中，用户设备可以通过用户面网元发起加入多播群组。
结合第三方面，在一种可能的实现方式中，所述第三消息还包括用户设备的第二用户标识信息和/或用于针对所述用户设备进行鉴权的信息。
结合第三方面或其任意一种实现方式，在另一种可能的实现方式中，所述第三消息包括网际群组管理协议(internet group management protocol，IGMP)消息和多播监听者报告(multicast listener report，MLR)消息。
第四方面，本申请提供了一种用于鉴权的方法，所述方法包括：网络设备接收多播数据的识别信息，所述识别信息与用户设备请求加入的多播群组对应；所述网络设备向第一会话管理功能网元SMF发送所述识别信息。
在上述技术方案中，网络设备将接收到的多播数据的识别信息发送给第一SMF，以便第一SMF进一步发送给应用服务器，从而由应用服务器执行用户设备加入群组时的鉴权操作，从而可以实现对用户设备的加入请求进行鉴权。此外，在本方案中无需应用服务器向核心网实时提供明确的多播群组的成员信息，在核心网没有多播群组的成员信息的情况下，仍然可以实现针对用户设备加入群组时的鉴权操作，有助于避免产生公共安全问题。
结合第四方面，在一种可能的实现方式中，所述方法还包括：所述网络设备向所述第一SMF发送所述用户设备的第一用户识别信息和/或所述用户设备的第二用户识别信息。
第一用户标识信息为用于唯一标识用户设备且应用服务器可以识别的信息。
例如，第一用户标识信息可以为GPSI。
第二用户标识信息可以为用于唯一标识用户设备，且核心网设备和接入网设备可以识别的信息。
例如，第二用户标识信息可以包括SUPI、GUTI和SUCI中的至少一个。
结合第四方面或其任意一种实现方式，在另一种可能的实现方式中，所述网络设备包括第二SMF、接入和移动管理功能网元AMF、统一数据管理网元UDM和统一数据存储库UDR和第二用户面功能网元UPF。
第五方面，本申请提供了一种用于鉴权的方法，所述方法包括：用户设备确定第四消息，所述第四消息包括多播数据的识别信息和第一安全信息，所述第一安全信息用于对所述用户设备加入多播群组的请求进行鉴权，所述识别信息与所述多播群组对应；所述用户设备向第一网络设备发送所述第四消息。
多播数据的识别信息与用户设备请求加入的多播群组对应，可以包括多播数据对应的多播群组的TMGI、提供多播数据的应用服务器的IP地址、多播数据的业务标识、多播数 据的分组过滤信息、多播数据的SDF识别规则、用于传输多播数据的多播PDU会话的ID、应用的ID信息、多播数据的目标IP地址信息、以及多播群组对应的多播会话的上下文标识信息中的至少一个。
这样，在本申请实施例中，用户设备向第一网络设备提供用于鉴权的第一安全信息和多播数据的识别信息，可以由第一网络设备根据安全信息执行用户设备加入群组时的鉴权操作，从而可以实现对用户设备的加入请求进行鉴权。此外，在本方案中无需应用服务器向核心网实时提供明确的多播群组的成员信息，可以在核心网没有多播群组的成员信息的情况下实现针对用户设备加入群组时的鉴权操作，有助于避免产生公共安全问题。
结合第五方面，在一种可能的实现方式中，所述第一安全信息包括口令信息、安全算法的输入信息和安全算法中的至少一个。
结合第五方面或其任意一种实现方式，在另一种可能的实现方式中，所述方法还包括：所述用户设备从应用服务器获取所述第一安全信息。
结合第五方面或其任意一种实现方式，在另一种可能的实现方式中，所述第一网络设备为接入网设备或核心网设备。
结合第五方面或其任意一种实现方式，在另一种可能的实现方式中，所述核心网设备包括第一会话管理功能网元SMF和统一数据管理网元UDM。
第六方面，本申请提供了一种用于鉴权的方法，所述方法包括：第一网络设备接收来自用户设备的第四消息，所述第四消息包括多播数据的识别信息和第一安全信息，所述第一安全信息用于对所述用户设备加入多播群组的请求进行鉴权，所述识别信息与所述多播群组对应；所述第一网络设备根据所述第一安全信息和第二安全信息，对所述用户设备加入所述多播群组的请求进行鉴权，所述第二安全信息用于对所述用户设备加入所述多播群组的请求进行鉴权，所述第二安全信息与所述多播群组对应。
多播数据的识别信息与用户设备请求加入的多播群组对应，可以包括多播数据对应的多播群组的TMGI、提供多播数据的应用服务器的IP地址、多播数据的业务标识、多播数据的分组过滤信息、多播数据的SDF识别规则、用于传输多播数据的多播PDU会话的ID、应用的ID信息、多播数据的目标IP地址信息、以及多播群组对应的多播会话的上下文标识信息中的至少一个。
这样，在本申请实施例中，应用服务器可以向用户设备和网络设备提供用于鉴权的安全信息，可以由网络设备根据安全信息执行用户设备加入群组时的鉴权操作，从而可以实现对用户设备的加入请求进行鉴权。此外，在本方案中无需应用服务器向核心网实时提供明确的多播群组的成员信息，可以在核心网没有多播群组的成员信息的情况下实现针对用户设备加入群组时的鉴权操作，有助于避免产生公共安全问题。
结合第六方面，在一种可能的实现方式中，所述第一安全信息为口令信息，所述第二安全信息为口令信息；或者，所述第一安全信息为安全算法的输入信息；所述第二安全信息为所述安全算法；或者，所述第一安全信息为安全算法；所述第二安全信息为所述安全算法的输入信息。
结合第六方面或其任意一种实现方式，在另一种可能的实现方式中，所述方法还包括：所述第一网络设备从应用服务器获取所述第二安全信息。
结合第六方面或其任意一种实现方式，在另一种可能的实现方式中，当所述第一网络 设备为第一会话管理功能网元SMF时，所述第一网络设备从应用服务器获取所述第二安全信息，包括：所述第一网络设备通过NEF和UDM从应用服务器获取所述第二安全信息。
结合第六方面或其任意一种实现方式，在另一种可能的实现方式中，当所述第一网络设备为统一数据管理网元UDM或统一数据存储库UDR时，所述第一网络设备从应用服务器获取所述第二安全信息，包括：所述第一网络设备通过NEF和第一SMF从应用服务器获取所述第二安全信息；或者，所述第一网络设备通过NEF从所述应用服务器获取所述第二安全信息。
结合第六方面或其任意一种实现方式，在另一种可能的实现方式中，所述第一网络设备为接入网设备时，所述第一网络设备从应用服务器获取所述第二安全信息，包括：所述第一网络设备通过第一AMF、第一SMF、UDM和NEF从所述应用服务器获取所述第二安全信息。
结合第六方面或其任意一种实现方式，在另一种可能的实现方式中，当所述第一网络设备为第一会话管理功能网元SMF时，所述第一网络设备接收来自用户设备的第四消息，包括：所述第一网络设备通过第二SMF、接入和移动管理功能网元AMF或第二用户面功能网元UPF接收所述第四消息。
结合第六方面或其任意一种实现方式，在另一种可能的实现方式中，当所述第一网络设备为统一数据管理网元UDM或统一数据存储库UDR时，所述第一网络设备接收来自用户设备的第四消息，包括：所述第一网络设备通过第一SMF或第二SMF接收所述第四消息。
结合第六方面或其任意一种实现方式，在另一种可能的实现方式中，所述第一网络设备为接入网设备时，所述第四消息为无线资源控制RRC消息。
第七方面，本申请提供了一种用于鉴权的方法，所述方法包括：第二网络设备接收第二安全信息，所述第二安全信息用于对用户设备加入多播群组的请求进行鉴权；所述第二网络设备发送所述第二安全信息。
在上述技术方案中，第二网络设备接收和发送第二安全信息，可以方便执行鉴权授权操作的第一网络设备获取第二安全信息，从而实现根据安全信息执行用户设备加入群组时的鉴权操作，从而可以实现对用户设备的加入请求进行鉴权。此外，在本方案中无需应用服务器向核心网实时提供明确的多播群组的成员信息，可以在核心网没有多播群组的成员信息的情况下实现针对用户设备加入群组时的鉴权操作，有助于避免产生公共安全问题。
结合第七方面，在一种可能的实现方式中，所述第二安全信息包括口令信息、安全算法的输入信息和安全算法中的至少一个。
结合第七方面或其任意一种实现方式，在另一种可能的实现方式中，所述方法还包括：所述第二网络设备接收多播数据的识别信息，所述识别信息与所述多播群组对应。
结合第七方面或其任意一种实现方式，在另一种可能的实现方式中，所述第二网络设备包括UDM、UDR、NEF、第一SMF、以及接入和移动管理功能网元AMF。
第八方面，本申请提供了一种用于鉴权的方法，所述方法包括：应用服务器生成第一安全信息和第二安全信息，所述第一安全信息和所述第二安全信息用于对用户设备加入多播群组的请求进行鉴权；所述应用服务器向所述用户设备发送所述第一安全信息；所述应用服务器向第一网络设备发送所述第二安全信息。
在上述技术方案中，应用服务器生成第一安全信息和第二安全信息，并将第一安全信息发送给用户设备，将第二安全信息发送给第一网络设备，可以实现第一网络设备根据安全信息执行用户设备加入群组时的鉴权操作，从而可以实现对用户设备的加入请求进行鉴权。此外，在本方案中无需应用服务器向核心网实时提供明确的多播群组的成员信息，可以在核心网没有多播群组的成员信息的情况下实现针对用户设备加入群组时的鉴权操作，有助于避免产生公共安全问题。
结合第八方面，在一种可能的实现方式中，所述第一安全信息为口令信息，所述第二安全信息为口令信息；或者，所述第一安全信息为安全算法的输入信息；所述第二安全信息为所述安全算法；或者，所述第一安全信息为安全算法；所述第二安全信息为所述安全算法的输入信息。
结合第八方面或其任意一种实现方式，在另一种可能的实现方式中，当所述第一网络设备为第一会话管理功能网元SMF时，所述应用服务器向第一网络设备发送所述第二安全信息，包括：所述应用服务器通过NEF、UDM向所述第一网络设备发送所述第二安全信息。
结合第八方面或其任意一种实现方式，在另一种可能的实现方式中，当所述第一网络设备为统一数据管理网元UDM或统一数据存储库UDR时，所述应用服务器向第一网络设备发送所述第二安全信息，包括：所述应用服务器通过NEF和第一SMF向所述第一网络设备发送所述第二安全信息；或者，所述应用服务器通过NEF向所述第一网络设备发送所述第二安全信息。
结合第八方面或其任意一种实现方式，在另一种可能的实现方式中，所述第一网络设备为接入网设备时，所述应用服务器向第一网络设备发送所述第二安全信息，包括：所述应用服务器通过第一AMF、第一SMF、UDM和NEF向所述第一网络设备发送所述第二安全信息。
第九方面，本申请提供了一种通信装置，所述装置包括：
收发单元，用于获取第一信息和多播数据的第一识别信息，所述第一信息用于确定所述用户设备的第一用户标识信息；
所述收发单元，还用于向应用服务器发送第一消息，所述第一消息用于请求对所述用户设备加入多播群组的请求进行鉴权，所述第一消息包括所述第一用户标识信息和多播数据的第二识别信息，所述第一识别信息和第二识别信息与所述多播群组对应；
所述收发单元，还用于接收应用服务器发送的第二消息，所述第二消息中包括鉴权结果信息。
可选地，上述通信装置可以为SMF或SMF中的模块或单元。
第一用户标识信息为用于唯一标识用户设备且应用服务器可以识别的信息。
例如，第一用户标识信息可以为GPSI。
第二用户标识信息可以为用于唯一标识用户设备，且核心网设备和接入网设备可以识别的信息。
例如，第二用户标识信息可以包括SUPI、GUTI和SUCI中的至少一个。
多播数据的第一识别信息、第二识别信息与用户设备请求加入的多播群组对应，可以包括多播数据对应的多播群组的TMGI、提供多播数据的应用服务器的IP地址、多播数据 的业务标识、多播数据的分组过滤信息、多播数据的SDF识别规则、用于传输多播数据的多播PDU会话的ID、应用的ID信息、多播数据的目标IP地址信息、以及多播群组对应的多播会话的上下文标识信息中的至少一个。
可选地，第一识别信息和第二识别信息可以相同。
可选地，第一识别信息和第二识别信息可以不同。具体地，通信装置获取到第一识别信息后，可以根据第一识别信息确定第二识别信息，进而将第二识别信息发送给应用服务器。例如，通信装置获取到的第一识别信息为多播群组的TMGI，通信装置根据TMGI确定与该TMGI对应的PDU会话的ID，并将该PDU会话的ID通过第一消息发送给应用服务器。
在本申请实施例中，通信装置将第一用户标识信息和第二识别信息发送给应用服务器，由应用服务器执行用户设备加入群组时的鉴权操作，从而可以实现对用户设备的加入请求进行鉴权。此外，在本方案中无需应用服务器向核心网实时提供明确的多播群组的成员信息，可以在核心网没有多播群组的成员信息的情况下实现针对用户设备加入群组时的鉴权操作，有助于避免产生公共安全问题。
结合第九方面，在一种可能的实现方式中，所述装置还包括：
处理单元，用于根据所述第一识别信息，确定需要所述应用服务器对所述用户设备加入所述多播群组的请求进行鉴权。
例如，通信装置可以根据本地存储的策略确定是否需要应用服务器进行鉴权授权。该策略可以预配置在通信装置中，也可以由其他网元(例如，PCF、UDM或UDR)提供。该策略用于指示通信装置是否需要针对携带该识别信息的加入请求向发起应用服务器的鉴权授权流程。
又例如，通信装置可以判断是否存储了第一识别信息对应的多播群组的成员列表信息，并且当该成员列表信息中包括第一用户标识时，通信装置确认需要应用服务器进行鉴权授权；否则，通信装置确定用户设备的加入请求不合法，向用户设备返回群组加入失败的指示。
结合第九方面或其任意一种实现方式，在另一种可能的实现方式中，所述第一信息包括所述第一用户标识信息和/或所述用户设备的第二用户标识信息。
结合第九方面或其任意一种实现方式，在另一种可能的实现方式中，所述处理单元还用于根据所述第二用户标识信息，获取所述第一用户标识信息。
结合第九方面或其任意一种实现方式，在另一种可能的实现方式中，所述收发单元具体用于根据所述第二用户标识信息从第一网元获取所述第一用户标识信息，所述第一网元包括接入和移动管理功能网元AMF、统一数据管理网元UDM和统一数据存储库UDR。
结合第九方面或其任意一种实现方式，在另一种可能的实现方式中，所述收发单元具体用于从第二SMF、接入和移动管理功能网元AMF或第二用户面功能网元UPF获取所述第一信息和所述第一识别信息。
结合第九方面或其任意一种实现方式，在另一种可能的实现方式中，所述收发单元具体用于根据所述第一识别信息，确定所述应用服务器的标识信息；直接向所述应用服务器发送所述第一消息，或者通过第一UPF向所述应用服务器发送所述第一消息。
结合第九方面或其任意一种实现方式，在另一种可能的实现方式中，所述收发单元具 体用于通过网络开放功能网元NEF向所述应用服务器发送所述第一消息。
第十方面，本申请提供了一种通信装置，所述装置包括：
收发单元，用于接收来自会话管理功能网元SMF的第一消息，所述第一消息用于请求对用户设备加入多播群组的请求进行鉴权，所述第一消息包括第一用户标识信息和多播数据的第二识别信息，所述第二识别信息与所述多播群组对应，所述第一用户标识信息为所述用户设备的标识信息；
处理单元，用于根据所述第一用户标识信息和所述第二识别信息，对所述用户设备加入所述多播群组的请求进行鉴权；
所述收发单元，还用于向所述SMF发送第二消息，所述第二消息中包括鉴权结果信息。
可选地，上述通信装置可以为应用服务器或应用服务器中的模块或单元。
第一用户标识信息为用于唯一标识用户设备且应用服务器可以识别的信息。
例如，第一用户标识信息可以为GPSI。
多播数据的第二识别信息与用户设备请求加入的多播群组对应，可以包括多播数据对应的多播群组的TMGI、提供多播数据的应用服务器的IP地址、多播数据的业务标识、多播数据的分组过滤信息、多播数据的SDF识别规则、用于传输多播数据的多播PDU会话的ID、应用的ID信息、多播数据的目标IP地址信息、以及多播群组对应的多播会话的上下文标识信息中的至少一个。
在本申请实施例中，SMF将第一用户标识信息和第二识别信息发送给通信装置，由通信装置执行用户设备加入群组时的鉴权操作，从而可以实现对用户设备的加入请求进行鉴权。此外，在本方案中无需通信装置向核心网实时提供明确的多播群组的成员信息，可以在核心网没有多播群组的成员信息的情况下实现针对用户设备加入群组时的鉴权操作，有助于避免产生公共安全问题。
结合第十方面，在一种可能的实现方式中，所述收发单元具体用于直接向所述SMF发送所述第二消息，或者通过UPF或网络开放功能网元NEF向所述SMF发送所述二消息。
结合第十方面或其任意一种实现方式，在另一种可能的实现方式中，所述方法还包括：
所述应用服务器向第二核心网设备发送第二配置请求消息，所述第二配置请求消息包括所述第二识别信息和订阅信息，所述订阅信息用于订阅用户设备加入所述多播会话事件的通知；
所述应用服务器接收来自所述第二核心网设备发送的第二配置响应消息，所述第二配置响应消息用于指示所述第二识别信息和所述订阅信息已存储在统一数据存储库。
结合第十方面或其任意一种实现方式，在另一种可能的实现方式中，所述第二核心网设备为网络开放功能网元或多播广播业务功能网元。
结合第十方面或其任意一种实现方式，在另一种可能的实现方式中，所述SMF服务于单播，或者所述SMF服务于多播。
第十一方面，本申请提供了一种通信装置，所述装置包括：
处理单元，用于确定第三消息，所述第三消息用于请求加入多播群组，所述第三消息包括多播数据的第三识别信息，所述第三识别信息与所述多播群组对应；
收发单元，用于向第二用户面网元UPF发送所述第三消息。
可选地，上述通信装置可以为用户设备或用户设备中的模块或单元。
多播数据的第三识别信息与通信装置请求加入的多播群组对应，可以包括多播数据对应的多播群组的TMGI、提供多播数据的应用服务器的IP地址、多播数据的业务标识、多播数据的分组过滤信息、多播数据的SDF识别规则、用于传输多播数据的多播PDU会话的ID、应用的ID信息、多播数据的目标IP地址信息、以及多播群组对应的多播会话的上下文标识信息中的至少一个。
在上述技术方案中，通信装置可以通过用户面网元发起加入多播群组。
结合第十一方面，在一种可能的实现方式中，所述第三消息还包括用户设备的第二用户标识信息和/或用于针对所述用户设备进行鉴权的信息。
结合第十一方面或其任意一种实现方式，在另一种可能的实现方式中，所述第三消息包括IGMP消息和MLR消息。
第十二方面，本申请提供了一种通信装置，所述装置包括：
收发单元，用于接收多播数据的识别信息，所述识别信息与用户设备请求加入的多播群组对应；
所述收发单元，还用于向第一会话管理功能网元SMF发送所述识别信息。
在上述技术方案中，通信装置将接收到的多播数据的识别信息发送给第一SMF，以便第一SMF进一步发送给应用服务器，从而由应用服务器执行用户设备加入群组时的鉴权操作，从而可以实现对用户设备的加入请求进行鉴权。此外，在本方案中无需应用服务器向核心网实时提供明确的多播群组的成员信息，在核心网没有多播群组的成员信息的情况下，仍然可以实现针对用户设备加入群组时的鉴权操作，有助于避免产生公共安全问题。
结合第十二方面，在一种可能的实现方式中，所述收发单元还用于向所述第一SMF发送所述用户设备的第一用户识别信息和/或所述用户设备的第二用户识别信息。
第一用户标识信息为用于唯一标识用户设备且应用服务器可以识别的信息。
例如，第一用户标识信息可以为GPSI。
第二用户标识信息可以为用于唯一标识用户设备，且核心网设备和接入网设备可以识别的信息。
例如，第二用户标识信息可以包括SUPI、GUTI和SUCI中的至少一个。
结合第十二方面或其任意一种实现方式，在另一种可能的实现方式中，所述通信装置包括第二SMF、接入和移动管理功能网元AMF、统一数据管理网元UDM和统一数据存储库UDR和第二用户面功能网元UPF。
第十三方面，本申请提供了通信装置，所述装置包括：
处理单元，用于确定第四消息，所述第四消息包括多播数据的识别信息和第一安全信息，所述第一安全信息用于对所述用户设备加入多播群组的请求进行鉴权，所述识别信息与所述多播群组对应；
收发单元，用于向第一网络设备发送所述第四消息。
可选地，上述通信装置可以为用户设备或用户设备中的模块或单元。
多播数据的识别信息与通信装置请求加入的多播群组对应，可以包括多播数据对应的多播群组的TMGI、提供多播数据的应用服务器的IP地址、多播数据的业务标识、多播数据的分组过滤信息、多播数据的SDF识别规则、用于传输多播数据的多播PDU会话的ID、 应用的ID信息、多播数据的目标IP地址信息、以及多播群组对应的多播会话的上下文标识信息中的至少一个。
这样，在本申请实施例中，通信装置向第一网络设备提供用于鉴权的第一安全信息和赌博数据的识别信息，可以由第一网络设备根据安全信息执行用户设备加入群组时的鉴权操作，从而可以实现对用户设备的加入请求进行鉴权。此外，在本方案中无需应用服务器向核心网实时提供明确的多播群组的成员信息，可以在核心网没有多播群组的成员信息的情况下实现针对用户设备加入群组时的鉴权操作，有助于避免产生公共安全问题。
结合第十三方面，在一种可能的实现方式中，所述第一安全信息包括口令信息、安全算法的输入信息和安全算法中的至少一个。
结合第十三方面或其任意一种实现方式，在另一种可能的实现方式中，所述收发单元还用于从应用服务器获取所述第一安全信息。
结合第十三方面或其任意一种实现方式，在另一种可能的实现方式中，所述第一网络设备为接入网设备或核心网设备。
结合第十三方面或其任意一种实现方式，在另一种可能的实现方式中，所述核心网设备包括第一会话管理功能网元SMF和统一数据管理网元UDM。
第十四方面，本申请提供了一种通信装置，所述装置包括：
收发单元，接收来自用户设备的第四消息，所述第四消息包括多播数据的识别信息和第一安全信息，所述第一安全信息用于对所述用户设备加入多播群组的请求进行鉴权，所述识别信息与所述多播群组对应；
处理单元，用于根据所述第一安全信息和第二安全信息，对所述用户设备加入所述多播群组的请求进行鉴权，所述第二安全信息用于对所述用户设备加入所述多播群组的请求进行鉴权，所述第二安全信息与所述多播群组对应。
多播数据的识别信息与用户设备请求加入的多播群组对应，可以包括多播数据对应的多播群组的TMGI、提供多播数据的应用服务器的IP地址、多播数据的业务标识、多播数据的分组过滤信息、多播数据的SDF识别规则、用于传输多播数据的多播PDU会话的ID、应用的ID信息、多播数据的目标IP地址信息、以及多播群组对应的多播会话的上下文标识信息中的至少一个。
这样，在本申请实施例中，应用服务器可以向用户设备和通信装置提供用于鉴权的安全信息，可以由通信装置根据安全信息执行用户设备加入群组时的鉴权操作，从而可以实现对用户设备的加入请求进行鉴权。此外，在本方案中无需应用服务器向核心网实时提供明确的多播群组的成员信息，可以在核心网没有多播群组的成员信息的情况下实现针对用户设备加入群组时的鉴权操作，有助于避免产生公共安全问题。
结合第十四方面，在一种可能的实现方式中，所述第一安全信息为口令信息，所述第二安全信息为口令信息；或者，所述第一安全信息为安全算法的输入信息；所述第二安全信息为所述安全算法；或者，所述第一安全信息为安全算法；所述第二安全信息为所述安全算法的输入信息。
结合第十四方面或其任意一种实现方式，在另一种可能的实现方式中，所述方法还包括：所述第一网络设备从应用服务器获取所述第二安全信息。
结合第十四方面或其任意一种实现方式，在另一种可能的实现方式中，当所述通信装 置为第一会话管理功能网元SMF时，所述收发单元具体用于通过NEF和UDM从应用服务器获取所述第二安全信息。
结合第十四方面或其任意一种实现方式，在另一种可能的实现方式中，当所述通信装置为统一数据管理网元UDM或统一数据存储库UDR时，所述收发单元具体用于通过NEF和第一SMF从应用服务器获取所述第二安全信息；或者，通过NEF从所述应用服务器获取所述第二安全信息。
结合第十四方面或其任意一种实现方式，在另一种可能的实现方式中，当所述通信装置为接入网设备时，所述收发单元具体用于通过第一AMF、第一SMF、UDM和NEF从所述应用服务器获取所述第二安全信息。
结合第十四方面或其任意一种实现方式，在另一种可能的实现方式中，当所述通信装置为第一会话管理功能网元SMF时，所述收发单元具体用于通过第二SMF、接入和移动管理功能网元AMF或第二用户面功能网元UPF接收所述第四消息。
结合第十四方面或其任意一种实现方式，在另一种可能的实现方式中，当所述通信装置为统一数据管理网元UDM或统一数据存储库UDR时，所述收发单元具体用于通过第一SMF或第二SMF接收所述第四消息。
结合第十四方面或其任意一种实现方式，在另一种可能的实现方式中，所述通信装置为接入网设备时，所述第四消息为无线资源控制RRC消息。
第十五方面，本申请提供了一种通信装置，所述装置包括：
收发单元，用于接收第二安全信息，所述第二安全信息用于对用户设备加入多播群组的请求进行鉴权；
所述收发单元，还用于发送所述第二安全信息。
在上述技术方案中，通信装置接收和发送第二安全信息，可以方便执行鉴权授权操作的第一网络设备获取第二安全信息，从而实现根据安全信息执行用户设备加入群组时的鉴权操作，从而可以实现对用户设备的加入请求进行鉴权。此外，在本方案中无需应用服务器向核心网实时提供明确的多播群组的成员信息，可以在核心网没有多播群组的成员信息的情况下实现针对用户设备加入群组时的鉴权操作，有助于避免产生公共安全问题。
结合第十五方面，在一种可能的实现方式中，所述第二安全信息包括口令信息、安全算法的输入信息和安全算法中的至少一个。
结合第十五方面或其任意一种实现方式，在另一种可能的实现方式中，所述收发单元还用于接收多播数据的识别信息，所述识别信息与所述多播群组对应。
结合第十五方面或其任意一种实现方式，在另一种可能的实现方式中，所述通信装置包括UDM、UDR、NEF、第一SMF、以及接入和移动管理功能网元AMF。
第十六方面，本申请提供了一种通信装置，所述装置包括：
处理单元，用于生成第一安全信息和第二安全信息，所述第一安全信息和所述第二安全信息用于对用户设备加入多播群组的请求进行鉴权；
收发单元，用于向所述用户设备发送所述第一安全信息；
所述收发单元，还用于向第一网络设备发送所述第二安全信息。
可选地，上述通信装置可以为应用服务器或应用服务器中的模块或单元。
在上述技术方案中，通信装置生成第一安全信息和第二安全信息，并将第一安全信息 发送给用户设备，将第二安全信息发送给第一网络设备，可以实现第一网络设备根据安全信息执行用户设备加入群组时的鉴权操作，从而可以实现对用户设备的加入请求进行鉴权。此外，在本方案中无需通信装置向核心网实时提供明确的多播群组的成员信息，这样，可以在核心网没有多播群组的成员信息的情况下实现针对用户设备加入群组时的鉴权操作，有助于避免产生公共安全问题。
结合第十六方面，在一种可能的实现方式中，所述第一安全信息为口令信息，所述第二安全信息为口令信息；或者，所述第一安全信息为安全算法的输入信息；所述第二安全信息为所述安全算法；或者，所述第一安全信息为安全算法；所述第二安全信息为所述安全算法的输入信息。
结合第十六方面或其任意一种实现方式，在另一种可能的实现方式中，当所述第一网络设备为第一会话管理功能网元SMF时，所述收发单元具体用于通过NEF、UDM向所述第一网络设备发送所述第二安全信息。
结合第十六方面或其任意一种实现方式，在另一种可能的实现方式中，当所述第一网络设备为统一数据管理网元UDM或统一数据存储库UDR时，所述收发单元具体用于通过NEF和第一SMF向所述第一网络设备发送所述第二安全信息；或者，所述应用服务器通过NEF向所述第一网络设备发送所述第二安全信息。
结合第十六方面或其任意一种实现方式，在另一种可能的实现方式中，所述第一网络设备为接入网设备时，所述收发单元具体用于通过第一AMF、第一SMF、UDM和NEF向所述第一网络设备发送所述第二安全信息。
第十七方面，本申请提供了一种用于鉴权的方法，所述方法包括：用户设备确定第一加入请求，所述第一加入请求用于请求加入第一多播会话，所述第一加入请求包括第四识别信息，所述第四识别信息与所述第一多播会话对应；用户设备向第二会话管理功能网元发送所述第一加入请求。
第二会话管理功能网元为用于服务单播的会话管理功能网元或者用于管理单播PDU会话的会话管理功能网元。
在上述技术方案中，用户设备可以通过控制面网元发起加入多播群组。
第十八方面，本申请提供了一种用于鉴权的方法，所述方法包括：第二会话管理功能网元接收来自用户设备的第一加入请求，所述第一加入请求用于请求加入第一多播会话，所述第一加入请求包括第四识别信息，所述第四识别信息与所述第一多播会话对应；所述第二会话管理功能网元向第一核心网设备发送第十消息，所述第十消息包括所述用户设备的第三用户标识信息和所述第四识别信息，所述第三用户标识信息和所述第四识别信息用于获取确定是否允许所述用户设备加入所述第一多播会话；所述第二会话管理功能网元接收来自所述第一核心网设备的第一指示信息，所述第一指示信息用于指示是否允许所述用户设备加入所述第一多播会话；当所述第一指示信息指示允许所述用户设备加入所述第一多播会话时，所述第二会话管理功能网元接受所述第一加入请求；或，当所述第一指示信息指示不允许所述用户设备加入所述第一多播会话时，所述第二会话管理功能网元拒绝所述第一加入请求。
第二会话管理功能网元为用于服务单播的会话管理功能网元或者用于管理单播PDU会话的会话管理功能网元。
其中，第三用户标识信息可以是通过第一加入请求获取的，例如第一加入请求包括所述第三用户标识信息，又例如第二SMF根据本地配置信息第一加入请求对应的第三用户标识信息。
在上述技术方案中，在接收到用户设备的加入请求后，第二SMF可以将第三用户标识信息和第四识别信息发送给第一核心网设备，以便第一核心网设备根据第三用户标识信息和第四识别信息进行鉴权，从而可以实现对用户设备的加入请求进行鉴权。
结合第十八方面，在一种可能的实现方式中，所述第一核心网设备为策略控制功能网元或统一数据管理网元。
第十九方面，本申请提供了一种用于鉴权的方法，所述方法包括：第一核心网设备接收来自第二会话管理功能网元的第十消息，所述第十消息包括用户设备的第三用户标识信息和第四识别信息，所述第三用户标识信息和所述第四识别信息用于获取确定是否允许所述用户设备加入所述第一多播会话，所述第四识别信息与所述第一多播会话对应；所述第一核心网设备接收来自统一数据存储库的允许加入所述第一多播会话的用户设备的信息；所述第一核心网设备根据所述第十消息和所述允许加入所述第一多播会话的用户设备的信息，向所述第二会话管理功能网元发送第一指示信息，所述第一指示信息用于指示是否允许所述用户设备加入所述第一多播会话。
第二会话管理功能网元为用于服务单播的会话管理功能网元或者用于管理单播PDU会话的会话管理功能网元。
在上述技术方案中，可以将第四识别信息对应的多播会话可用的用户设备列表存储在统一数据存储库中，这样第一核心网设备在接收到第二会话管理功能网元的鉴权请求后可以向统一数据存储库查询相应多播会话可用的用户设备列表，进而根据统一数据存储库的反馈的信息确定鉴权结果并指示给第二会话管理功能网元，从而可以实现对用户设备的加入请求进行鉴权。
结合第十九方面，在一种可能的实现方式中，所述第一核心网设备为策略控制功能网元或统一数据管理网元。
结合第十九方面或其任意实现方式，在另一种可能的实现方式中，当所述允许加入所述第一多播会话的用户设备的信息包括所述第三用户标识信息时，所述第一指示信息指示允许所述用户设备加入所述第一多播会话；或，当所述允许加入所述第一多播会话的用户设备的信息不包括所述第三用户标识信息时，所述第一指示信息指示不允许所述用户设备加入所述第一多播会话。
结合第十九方面或其任意实现方式，在另一种可能的实现方式中，所述方法还包括：所述第一核心网设备向所述统一数据存储库发送第一查询消息，所述第一查询消息用于查询所述允许加入所述第一多播会话的用户设备的信息；所述第一核心网设备接收来自统一数据存储库的允许加入所述第一多播会话的用户设备的信息，包括：所述第一核心网设备接收来自所述统一数据存储库的第一响应消息，所述第一响应消息包括所述允许加入所述第一多播会话的用户设备的信息。
第二十方面，本申请提供了一种用于鉴权的方法，所述方法包括：统一数据存储库接收来自第一核心网设备的第一查询消息，所述第一查询消息用于查询允许加入第一多播会 话的用户设备的信息；所述统一数据存储库向所述第一核心网设备发送第一响应消息，所述第一响应消息包括所述允许加入第一多播会话的用户设备的信息。
在上述技术方案中，可以将第四识别信息对应的多播会话可用的用户设备列表存储在统一数据存储库中，使得第一核心网设备在接收到第二会话管理功能网元的鉴权请求后可以向统一数据存储库查询相应多播会话可用的用户设备列表，进而根据统一数据存储库的反馈的信息确定鉴权结果并指示给第二会话管理功能网元，从而可以实现对用户设备的加入请求进行鉴权。
结合第二十方面，在一种可能的实现方式中，所述方法还包括：所述统一数据存储库从应用功能网元或运营商获取所述允许加入第一多播会话的用户设备的信息。
在统一数据存储库从应用功能网元获取所述允许加入第一多播会话的用户设备的信息的情况下，可以实现应用功能网元根据业务情况实时更新统一数据存储库中存储的允许加入第一多播会话的用户设备的信息，方案更加灵活。
结合第二十方面或其任意一种可能的实现方式，在另一种可能的实现方式中，所述第一核心网设备为策略控制功能网元或统一数据管理网元。
第二十一方面，本申请提供了一种用于鉴权的方法，所述方法包括：应用功能网元向第二核心网设备发送第一配置请求消息，所述第一配置请求消息包括第一用户设备列表和第四识别信息，所述第四识别信息与多播会话对应，所述第一用户设备列表为允许加入所述第四识别信息对应的多播会话的用户设备的列表；所述应用功能网元接收来自所述第二核心网设备发送的第一配置响应消息，所述第一配置响应消息用于指示所述第一用户设备列表和所述第四识别信息已存储在统一数据存储库。
在上述技术方案中，应用功能网元可以将第四识别信息对应的多播会话可用的用户设备列表存储在统一数据存储库中，使得第一核心网设备在接收到第二会话管理功能网元的鉴权请求后可以向统一数据存储库查询相应多播会话可用的用户设备列表，进而根据统一数据存储库的反馈的信息确定鉴权结果并指示给第二会话管理功能网元，从而可以实现对用户设备的加入请求进行鉴权。并且在统一数据存储库从应用功能网元获取所述第一用户设备列表和所述第四识别信息的情况下，可以实现应用功能网元根据业务情况实时更新统一数据存储库中存储的第一用户设备列表，方案更加灵活。
结合第二十一方面，在一种可能的实现方式中，所述第二核心网设备为网络开放功能网元或多播广播业务功能网元。
第二十二方面，本申请提供了一种用于鉴权的方法，所述方法包括：应用功能网元接收来自第二会话管理功能网元的第一消息，所述第一消息用于通知所述应用功能网元用户设备请求加入所述第一多播会话，所述第一消息包括所述第二识别信息和所述用户设备的第一用户标识信息，所述第二识别信息与所述第一多播会话对应；所述应用功能网元根据所述第一消息，确定所述是否允许所述用户设备加入所示第一多播会话；所述应用功能网元向所述第二会话管理功能网元发送第二指示信息，所述第二指示信息是否允许所述用户设备加入所述第一多播会话。
第二会话管理功能网元为用于服务单播的会话管理功能网元或者用于管理单播PDU会话的会话管理功能网元。
在上述技术方案中，应用功能网元可以向第二会话管理功能网元订阅用户设备加入事 件的通知，这样第二会话管理功能网元在收到用户设备的加入请求时可以向应用功能网元通知对该用户设备请求加入多播会话，应用功能网元则可以对该用户设备的加入请求进行鉴权并将鉴权结果指示给第二会话管理功能网元，从而可以实现对用户设备的加入请求进行鉴权。此外，在本方案中可以在核心网没有多播群组的成员信息的情况下实现针对用户设备加入群组时的鉴权操作，有助于避免产生公共安全问题。
结合第二十二方面，在一种可能的实现方式中，所述方法还包括：应用功能网元向第二核心网设备发送第二配置请求消息，所述第二配置请求消息包括第二识别信息和订阅信息，所述第二识别信息与第一多播会话对应，所述订阅信息用于订阅用户设备加入所述第一多播会话的通知；所述应用功能网元接收来自所述第二核心网设备发送的第二配置响应消息，所述第二配置响应消息用于指示所述第二识别信息和所述订阅信息已存储在统一数据存储库。
结合第二十二方面或其任意一种可能的实现方式，在另一种可能的实现方式中，所述第二核心网设备为网络开放功能网元或多播广播业务功能网元。
结合第二十二方面或其任意一种可能的实现方式，在另一种可能的实现方式中，所述订阅信息包括第二识别信息和事件标识，所述第二识别信息对应于所述第一多播会话，所述事件标识用于标识用户设备加入多播会话事件。
第二十三方面，本申请提供了一种用于鉴权的方法，所述方法包括：统一数据存储库接收来自应用功能网元的订阅信息，所述订阅信息用于订阅用户设备加入第一多播会话的通知；所述统一数据存储库向第二会话管理功能网元发送所述订阅信息。
第二会话管理功能网元为用于服务单播的会话管理功能网元或者用于管理单播PDU会话的会话管理功能网元。
在上述技术方案中，应用功能网元可以将订阅信息存储统一数据存储库中，使得统一数据存储库可以向第二会话管理功能网元订阅用户设备加入多播会话的通知，这样第二会话管理功能网元在收到用户设备的加入请求时可以向应用功能网元通知对该用户设备请求加入多播会话，应用功能网元则可以对该用户设备的加入请求进行鉴权并将鉴权结果指示给第二会话管理功能网元，从而可以实现对用户设备的加入请求进行鉴权。此外，在本方案中可以在核心网没有多播群组的成员信息的情况下实现针对用户设备加入群组时的鉴权操作，有助于避免产生公共安全问题。
结合第二十三方面，在一种可能的实现方式中，所述订阅信息包括第二识别信息和事件标识，所述第二识别信息对应于所述第一多播会话，所述事件标识用于标识用户设备加入多播会话事件。
第二十四方面，本申请提供了一种用于鉴权的方法，所述方法包括：第二会话管理功能网元接收来自用户设备的第一加入请求，所述第一加入请求用于请求加入第一多播会话，所述第一加入请求包括第二识别信息，所述第二识别信息与所述第一多播会话对应；所述第二会话管理功能网元向应用功能网元发送第一消息，所述第一消息用于通知所述应用功能网元所述用户设备请求加入所述第一多播会话，所述第一消息包括所述第二识别信息和所述用户设备的第一用户标识信息；所述第二会话管理功能网元接收来自所述应用功能网元的第二指示信息，所述第二指示信息用于指示是否允许所述用户设备加入所述第一多播会话；当所述第二指示信息指示允许所述用户设备加入所述第一多播会话时，所述第 二会话管理功能网元接受所述第一加入请求；或当所述第二指示信息指示不允许所述用户设备加入所述第一多播会话时，所述第二会话管理功能网元拒绝所述第一加入请求。
第二会话管理功能网元为用于服务单播的会话管理功能网元或者用于管理单播PDU会话的会话管理功能网元。
在上述技术方案中，第二会话管理功能网元在收到用户设备的加入请求时可以向应用功能网元通知对该用户设备请求加入多播会话，以便应用功能网元可以对该用户设备的加入请求进行鉴权并将鉴权结果指示给第二会话管理功能网元，从而可以实现对用户设备的加入请求进行鉴权。此外，在本方案中可以在核心网没有多播群组的成员信息的情况下实现针对用户设备加入群组时的鉴权操作，有助于避免产生公共安全问题。
结合第二十四方面，在一种可能的实现方式中，所述方法还包括：所述第二会话管理功能网元接收来自统一数据存储库的订阅信息，所述订阅信息用于订阅用户设备加入所述第一多播会话的通知。
在上述技术方案中，统一数据存储库可以向第二会话管理功能网元订阅用户设备加入事件的通知，这样第二会话管理功能网元在收到用户设备的加入请求时可以向应用功能网元通知对该用户设备请求加入多播会话。
结合第二十四方面或其任意一种可能的实现方式，在另一种可能的实现方式中，所述订阅信息包括第二识别信息和事件标识，所述第二识别信息对应于所述第一多播会话，所述事件标识用于标识用户设备加入多播会话事件。
第二十五方面，本申请提供了一种通信装置，所述装置包括：处理单元，用于确定第一加入请求，所述第一加入请求用于请求加入第一多播会话，所述第一加入请求包括第四识别信息，所述第四识别信息与所述第一多播会话对应；收发单元，用于向第二会话管理功能网元发送所述第一加入请求。
第二会话管理功能网元为用于服务单播的会话管理功能网元或者用于管理单播PDU会话的会话管理功能网元。
在上述技术方案中，通信装置可以通过控制面网元发起加入多播群组。
第二十六方面，本申请提供了一种通信装置，所述装置包括：收发单元，用于接收来自用户设备的第一加入请求，所述第一加入请求用于请求加入第一多播会话，所述第一加入请求包括第四识别信息，所述第四识别信息与所述第一多播会话对应；向第一核心网设备发送第十消息，所述第十消息包括所述用户设备的第三用户标识信息和所述第四识别信息，所述第三用户标识信息和所述第四识别信息用于获取确定是否允许所述用户设备加入所述第一多播会话；接收来自所述第一核心网设备的第一指示信息，所述第一指示信息用于指示是否允许所述用户设备加入所述第一多播会话。处理单元，用于当所述第一指示信息指示允许所述用户设备加入所述第一多播会话时，接受所述第一加入请求；或，当所述第一指示信息指示不允许所述用户设备加入所述第一多播会话时，拒绝所述第一加入请求。
在上述技术方案中，在接收到用户设备的加入请求后，通信装置可以将第三用户标识信息和第四识别信息发送给第一核心网设备，以便第一核心网设备根据第三用户标识信息和第四识别信息进行鉴权，从而可以实现对用户设备的加入请求进行鉴权。
结合第二十六方面，在一种可能的实现方式中，所述第一核心网设备为策略控制功能 网元或统一数据管理网元。
第二十七方面，本申请提供了一种通信装置，所述装置包括：收发单元，用于接收来自第二会话管理功能网元的第十消息，所述第十消息包括用户设备的第三用户标识信息和第四识别信息，所述第三用户标识信息和所述第四识别信息用于获取确定是否允许所述用户设备加入所述第一多播会话，所述第四识别信息与所述第一多播会话对应；接收来自统一数据存储库的允许加入所述第一多播会话的用户设备的信息；根据所述第十消息和所述允许加入所述第一多播会话的用户设备的信息，向所述第二会话管理功能网元发送第一指示信息，所述第一指示信息用于指示是否允许所述用户设备加入所述第一多播会话。
第二会话管理功能网元为用于服务单播的会话管理功能网元或者用于管理单播PDU会话的会话管理功能网元。
在上述技术方案中，可以将第四识别信息对应的多播会话可用的用户设备列表存储在统一数据存储库中，这样通信装置在接收到第二会话管理功能网元的鉴权请求后可以向统一数据存储库查询相应多播会话可用的用户设备列表，进而根据统一数据存储库的反馈的信息确定鉴权结果并指示给第二会话管理功能网元，从而可以实现对用户设备的加入请求进行鉴权。
结合第二十七方面，在一种可能的实现方式中，所述第一核心网设备为策略控制功能网元或统一数据管理网元。
结合第二十七方面或其任意实现方式，在另一种可能的实现方式中，当所述允许加入所述第一多播会话的用户设备的信息包括所述第三用户标识信息时，所述第一指示信息指示允许所述用户设备加入所述第一多播会话；或，当所述允许加入所述第一多播会话的用户设备的信息不包括所述第三用户标识信息时，所述第一指示信息指示不允许所述用户设备加入所述第一多播会话。
结合第二十七方面或其任意实现方式，在另一种可能的实现方式中，所述收发单元还用于向所述统一数据存储库发送第一查询消息，所述第一查询消息用于查询所述允许加入所述第一多播会话的用户设备的信息；所述收发单元具体用于：接收来自所述统一数据存储库的第一响应消息，所述第一响应消息包括所述允许加入所述第一多播会话的用户设备的信息。
第二十八方面，本申请提供了一种通信装置，所述装置包括：收发单元，用于收来自第一核心网设备的第一查询消息，所述第一查询消息用于查询允许加入第一多播会话的用户设备的信息；向所述第一核心网设备发送第一响应消息，所述第一响应消息包括所述允许加入第一多播会话的用户设备的信息。
在上述技术方案中，可以将第四识别信息对应的多播会话可用的用户设备列表存储在通信装置中，使得第一核心网设备在接收到第二会话管理功能网元的鉴权请求后可以向通信装置查询相应多播会话可用的用户设备列表，进而根据通信装置的反馈的信息确定鉴权结果并指示给第二会话管理功能网元，从而可以实现对用户设备的加入请求进行鉴权。
结合第二十八方面，在一种可能的实现方式中，所述收发单元具体用于：从应用功能网元或运营商获取所述允许加入第一多播会话的用户设备的信息。
在通信装置从应用功能网元获取所述允许加入第一多播会话的用户设备的信息的情况下，可以实现应用功能网元根据业务情况实时更新通信装置中存储的允许加入第一多播 会话的用户设备的信息，方案更加灵活。
结合第二十八方面或其任意一种可能的实现方式，在另一种可能的实现方式中，所述第一核心网设备为策略控制功能网元或统一数据管理网元。
第二十九方面，本申请提供了一种通信装置，所述装置包括：收发单元，用于向第二核心网设备发送第一配置请求消息，所述第一配置请求消息包括第一用户设备列表和第四识别信息，所述第四识别信息与多播会话对应，所述第一用户设备列表为允许加入所述第四识别信息对应的多播会话的用户设备的列表；以及接收来自所述第二核心网设备发送的第一配置响应消息，所述第一配置响应消息用于指示所述第一用户设备列表和所述第四识别信息已存储在统一数据存储库。
在上述技术方案中，通信装置可以将第四识别信息对应的多播会话可用的用户设备列表存储在统一数据存储库中，使得第一核心网设备在接收到第二会话管理功能网元的鉴权请求后可以向统一数据存储库查询相应多播会话可用的用户设备列表，进而根据统一数据存储库的反馈的信息确定鉴权结果并指示给第二会话管理功能网元，从而可以实现对用户设备的加入请求进行鉴权。并且在统一数据存储库从通信装置获取所述第一用户设备列表和所述第四识别信息的情况下，可以实现通信装置根据业务情况实时更新统一数据存储库中存储的第一用户设备列表，方案更加灵活。
结合第二十九方面，在一种可能的实现方式中，所述第二核心网设备为网络开放功能网元或多播广播业务功能网元。
第三十方面，本申请提供了一种通信装置，所述装置包括：收发单元，用于接收来自第二会话管理功能网元的第一消息，所述第一消息用于通知所述应用功能网元用户设备请求加入所述第一多播会话，所述第一消息包括所述第二识别信息和所述用户设备的第一用户标识信息，所述第二识别信息与所述第一多播会话对应；处理单元，用于根据所述第一消息，确定所述是否允许所述用户设备加入所示第一多播会话；所述收发单元还用于向所述第二会话管理功能网元发送第二指示信息，所述第二指示信息是否允许所述用户设备加入所述第一多播会话。
第二会话管理功能网元为用于服务单播的会话管理功能网元或者用于管理单播PDU会话的会话管理功能网元。
在上述技术方案中，通信装置可以向第二会话管理功能网元订阅用户设备加入事件的通知，这样第二会话管理功能网元在收到用户设备的加入请求时可以向通信装置通知对该用户设备请求加入多播会话，通信装置则可以对该用户设备的加入请求进行鉴权并将鉴权结果指示给第二会话管理功能网元，从而可以实现对用户设备的加入请求进行鉴权。此外，在本方案中可以在核心网没有多播群组的成员信息的情况下实现针对用户设备加入群组时的鉴权操作，有助于避免产生公共安全问题。
结合第三十方面，在一种可能的实现方式中，所述收发单元还用于向第二核心网设备发送第二配置请求消息，所述第二配置请求消息包括第二识别信息和订阅信息，所述第二识别信息与第一多播会话对应，所述订阅信息用于订阅用户设备加入所述第一多播会话的通知；接收来自所述第二核心网设备发送的第二配置响应消息，所述第二配置响应消息用于指示所述第二识别信息和所述订阅信息已存储在统一数据存储库。
结合第三十方面或其任意一种可能的实现方式，在另一种可能的实现方式中，所述第 二核心网设备为网络开放功能网元或多播广播业务功能网元。
结合第三十方面或其任意一种可能的实现方式，在另一种可能的实现方式中，所述订阅信息包括第二识别信息和事件标识，所述第二识别信息对应于所述第一多播会话，所述事件标识用于标识用户设备加入多播会话事件。
第三十一方面，本申请提供了一种通信装置，所述装置包括：收发单元，用于接收来自应用功能网元的订阅信息，所述订阅信息用于订阅用户设备加入第一多播会话的通知；向第二会话管理功能网元发送所述订阅信息。
第二会话管理功能网元为用于服务单播的会话管理功能网元或者用于管理单播PDU会话的会话管理功能网元。
在上述技术方案中，应用功能网元可以将订阅信息存储在通信装置中，使得通信装置可以向第二会话管理功能网元订阅用户设备加入多播会话的通知，这样第二会话管理功能网元在收到用户设备的加入请求时可以向应用功能网元通知对该用户设备请求加入多播会话，应用功能网元则可以对该用户设备的加入请求进行鉴权并将鉴权结果指示给第二会话管理功能网元，从而可以实现对用户设备的加入请求进行鉴权。此外，在本方案中可以在核心网没有多播群组的成员信息的情况下实现针对用户设备加入群组时的鉴权操作，有助于避免产生公共安全问题。
结合第三十一方面，在一种可能的实现方式中，所述订阅信息包括第二识别信息和事件标识，所述第二识别信息对应于所述第一多播会话，所述事件标识用于标识用户设备加入多播会话事件。
第三十二方面，本申请提供了一种通信装置，所述装置包括：收发单元，用于接收来自用户设备的第一加入请求，所述第一加入请求用于请求加入第一多播会话，所述第一加入请求包括第二识别信息，所述第二识别信息与所述第一多播会话对应；向应用功能网元发送第一消息，所述第一消息用于通知所述应用功能网元所述用户设备请求加入所述第一多播会话，所述第一消息包括所述第二识别信息和所述用户设备的第一用户标识信息；接收来自所述应用功能网元的第二指示信息，所述第二指示信息用于指示是否允许所述用户设备加入所述第一多播会话。处理单元，用于当所述第二指示信息指示允许所述用户设备加入所述第一多播会话时，接受所述第一加入请求；或当所述第二指示信息指示不允许所述用户设备加入所述第一多播会话时，拒绝所述第一加入请求。
第二会话管理功能网元为用于服务单播的会话管理功能网元或者用于管理单播PDU会话的会话管理功能网元。
在上述技术方案中，通信装置在收到用户设备的加入请求时可以向应用功能网元通知对该用户设备请求加入多播会话，以便应用功能网元可以对该用户设备的加入请求进行鉴权并将鉴权结果指示给通信装置，从而可以实现对用户设备的加入请求进行鉴权。此外，在本方案中可以在核心网没有多播群组的成员信息的情况下实现针对用户设备加入群组时的鉴权操作，有助于避免产生公共安全问题。
结合第三十二方面，在一种可能的实现方式中，所述收发单元还用于：接收来自统一数据存储库的订阅信息，所述订阅信息用于订阅用户设备加入所述第一多播会话的通知。
在上述技术方案中，统一数据存储库可以向通信装置订阅用户设备加入事件的通知，这样通信装置在收到用户设备的加入请求时可以向应用功能网元通知对该用户设备请求 加入多播会话。
结合第三十二方面或其任意一种可能的实现方式，在另一种可能的实现方式中，所述订阅信息包括第二识别信息和事件标识，所述第二识别信息对应于所述第一多播会话，所述事件标识用于标识用户设备加入多播会话事件。
第三十三方面，本申请提供了一种用于鉴权的方法，所述方法包括：统一数据存储库接收来自第一核心网设备的第三查询消息，所述第三查询消息包括第三用户标识信息，所述第三查询消息用于查询允许所述第三用户标识信息标识的用户设备加入的多播会话的信息；所述统一数据存储库向所述第一核心网设备发送第三响应消息，所述第三响应消息包括允许所述用户设备加入的多播会话的信息。
其中，第三查询消息用于查询允许所述第三用户标识信息标识的用户设备加入的多播会话的信息，也可以替换为，第三查询消息用于查询用户设备的会话相关信息，统一数据存储库在反馈给第一核心网设备的用户设备的会话相关信息中包括用于指示允许用户设备加入的多播会话的信息。
在上述技术方案中，将多播会话可用的用户设备列表存储在统一数据存储库中，这样会话管理功能网元在进行用户设备的单播会话的建立流程中，可以以用户设备的标识为索引向统一数据存储库请求允许用户设备加入的多播业务，进而根据统一数据存储库反馈的信息对用户设备的加入请求进行鉴权，从而可以实现对用户设备的加入请求进行鉴权。
结合第三十三方面，在一种可能的实现方式中，所述方法还包括：所述统一数据存储库从应用功能网元或运营商获取与多播会话对应的识别信息和用户设备列表，所述用户设备列表为允许加入所述多播会话的用户设备的列表；所述统一数据存储库根据所述第三查询消息、所述识别信息、以及用户设备列表，确定所述允许所述用户设备加入的多播会话的信息。
结合第三十三方面或其任意一种可能的实现方式，在另一种可能的实现方式中，所述第一核心网设备为策略控制功能网元或统一数据管理网元。
第三十四方面，本申请提供了一种用于鉴权的方法，所述方法包括：第一核心网设备接收来自第二会话管理功能网元的第十四消息，所述第十四消息用于请求允许用户设备加入的多播会话的信息，所述第十四消息包括所述用户设备的第三用户标识信息；所述第一核心网设备根据所述第三用户标识信息获取允许所述用户设备加入的多播业务的信息；所述第一核心网设备向所述第二会话管理功能网元发送所述允许所述用户设备加入的多播业务的信息。
其中，第十四消息用于请求允许用户设备加入的多播会话的信息，也可以替换为，第十四消息用于查询用户设备的会话相关信息，第一核心网设备在反馈给第二会话管理功能网元的用户设备的会话相关信息中包括用于指示允许用户设备加入的多播业务的信息。
在上述技术方案中，第二会话管理功能网元将用户设备的标识信息发送给第一核心网设备，使得第一核心网设备可以根据用户的标识为索引获取允许用户设备加入的多播业务，并反馈给第二会话管理功能网元，这样第二会话管理功能网元在进行用户设备的单播会话的建立流程中对用户设备的加入请求进行鉴权，从而可以实现对用户设备的加入请求进行鉴权。
结合第三十四方面，在一种可能的实现方式中，所述第一核心网设备根据所述第三用 户标识信息获取允许所述用户设备加入的多播业务的信息，包括：所述第一核心网设备向统一数据存储库发送第三查询消息，所述第三查询消息包括第三用户标识信息，用于查询允许所述用户设备加入的多播会话的信息；所述第一核心网设备接收来自所述统一数据存储库的第三响应消息，所述第三响应消息包括所述允许所述用户设备加入的多播会话的信息。
其中，第三查询消息用于查询允许用户设备加入的多播会话的信息，也可以替换为，第三查询消息用于查询用户设备的会话相关信息，统一数据存储库在反馈给第一核心网设备的用户设备的会话相关信息中包括用于指示允许用户设备加入的多播业务的信息。
在上述技术方案中，将多播会话可用的用户设备列表存储在统一数据存储库中，这样会话管理功能网元在进行用户设备的单播会话的建立流程中，可以以用户设备的标识为索引向统一数据存储库请求允许用户设备加入的多播业务，进而根据统一数据存储库反馈的信息对用户设备的加入请求进行鉴权，从而可以实现对用户设备的加入请求进行鉴权。结合第三十四方面或其任意一种可能的实现方式，在另一种可能的实现方式中，若应用功能网元可以与第一核心网设备进行信令交互，应用功能网元还可以将多播会话可用的用户设备列表存储在第一核心网设备中，当第一核心网设备在接收到第十四消息后，第一核心网设备可以根据第十四消息携带的用户设备的第三用户标识信息、以及多播会话可用的用户设备列表，确定允许该用户设备接入的多播会话。
结合第三十四方面或其任意一种可能的实现方式，在另一种可能的实现方式中，所述第一核心网设备为策略控制功能网元或统一数据管理网元。
第三十五方面，本申请提供了一种用于鉴权的方法，所述方法包括：第二会话管理功能网元接收来自用户设备的第一加入请求，所述第一加入请求用于请求加入第一多播会话，所述第一加入请求包括第四识别信息，所述第四识别信息与所述第一多播会话对应；当所述第一多播会话属于允许所述用户设备加入的多播会话时，所述第二会话管理功能网元接受所述第一加入请求；或，当所述第一多播会话不属于允许所述用户设备加入的多播会话时，所述第二会话管理功能网元拒绝所述第一加入请求。
在上述技术方案中，第二会话管理功能网元可以根据用户设备请求加入的多播会话是否属于允许该用户设备加入的多播会话，确定是否接收用户设备的加入请求，从而可以实现对用户设备的加入请求进行鉴权。
结合第三十五方面，在一种可能的实现方式中，所述第一核心网设备为策略控制功能网元或统一数据管理网元。
结合第三十五方面或其任意一种可能的实现方式，在另一种可能的实现方式中，所述方法还包括：所述第二会话管理功能网元向第一核心网设备发送第十四消息，所述第十四消息用于请求允许用户设备加入的多播会话的信息，所述第十四消息包括所述用户设备的第三用户标识信息；所述第二会话管理功能网元接收来自所述第一核心网设备的所述允许所述用户设备加入的多播业务的信息。
其中，第十四消息用于请求允许用户设备加入的多播业务，也可以替换为，第十四消息用于查询用户设备的会话相关信息，第一核心网设备在反馈给第二会话管理功能网元的用户设备的会话相关信息中包括用于指示允许用户设备加入的多播业务的信息。
在上述技术方案中，将多播会话可用的用户设备列表存储在统一数据存储库中，这样 会话管理功能网元在进行用户设备的单播会话的建立流程中，可以以用户设备的标识为索引向统一数据存储库请求允许用户设备加入的多播业务，进而根据统一数据存储库反馈的信息对用户设备的加入请求进行鉴权，从而可以实现对用户设备的加入请求进行鉴权。
第三十六方面，本申请提供了一种通信装置，所述装置包括：收发单元，用于接收来自第一核心网设备的第三查询消息，所述第三查询消息包括第三用户标识信息，所述第三查询消息用于查询允许所述第三用户标识信息标识的用户设备加入的多播会话的信息；向所述第一核心网设备发送第三响应消息，所述第三响应消息包括允许所述用户设备加入的多播会话的信息。
其中，第三查询消息用于查询允许所述第三用户标识信息标识的用户设备加入的多播会话的信息，也可以替换为，第三查询消息用于查询用户设备的会话相关信息，统一数据存储库在反馈给第一核心网设备的用户设备的会话相关信息中包括用于指示允许用户设备加入的多播会话的信息。
在上述技术方案中，将多播会话可用的用户设备列表存储在统一数据存储库中，这样会话管理功能网元在进行用户设备的单播会话的建立流程中，可以以用户设备的标识为索引向统一数据存储库请求允许用户设备加入的多播业务，进而根据统一数据存储库反馈的信息对用户设备的加入请求进行鉴权，从而可以实现对用户设备的加入请求进行鉴权。
结合第三十六方面，在一种可能的实现方式中，所述收发单元还用于从应用功能网元或运营商获取与多播会话对应的识别信息和用户设备列表，所述用户设备列表为允许加入所述多播会话的用户设备的列表；处理单元还用于根据所述第三查询消息、所述识别信息、以及用户设备列表，确定所述允许所述用户设备加入的多播会话的信息。
结合第三十六方面或其任意一种可能的实现方式，在另一种可能的实现方式中，所述第一核心网设备为策略控制功能网元或统一数据管理网元。
第三十七方面，本申请提供了一种通信装置，所述装置包括：收发单元，用于接收来自第二会话管理功能网元的第十四消息，所述第十四消息用于请求允许用户设备加入的多播会话的信息，所述第十四消息包括所述用户设备的第三用户标识信息；根据所述第三用户标识信息获取允许所述用户设备加入的多播业务的信息；向所述第二会话管理功能网元发送所述允许所述用户设备加入的多播业务的信息。
其中，第十四消息用于请求允许用户设备加入的多播会话的信息，也可以替换为，第十四消息用于查询用户设备的会话相关信息，第一核心网设备在反馈给第二会话管理功能网元的用户设备的会话相关信息中包括用于指示允许用户设备加入的多播业务的信息。
在上述技术方案中，第二会话管理功能网元将用户设备的标识信息发送给第一核心网设备，使得第一核心网设备可以根据用户的标识为索引获取允许用户设备加入的多播业务，并反馈给第二会话管理功能网元，这样第二会话管理功能网元在进行用户设备的单播会话的建立流程中对用户设备的加入请求进行鉴权，从而可以实现对用户设备的加入请求进行鉴权。
结合第三十七方面，在一种可能的实现方式中，所述收发单元具体用于：向统一数据存储库发送第三查询消息，所述第三查询消息包括第三用户标识信息，用于查询允许所述用户设备加入的多播会话的信息；接收来自所述统一数据存储库的第三响应消息，所述第三响应消息包括允许所述用户设备加入的多播会话的信息。
其中，第三查询消息用于查询允许所述用户设备加入的多播会话的信息，也可以替换为，第三查询消息用于查询用户设备的会话相关信息，统一数据存储库在反馈给第一核心网设备的用户设备的会话相关信息中包括用于指示允许用户设备加入的多播业务的信息。
在上述技术方案中，将多播会话可用的用户设备列表存储在统一数据存储库中，这样会话管理功能网元在进行用户设备的单播会话的建立流程中，可以以用户设备的标识为索引向统一数据存储库请求允许用户设备加入的多播业务，进而根据统一数据存储库反馈的信息对用户设备的加入请求进行鉴权，从而可以实现对用户设备的加入请求进行鉴权。
结合第三十七方面或其任意一种可能的实现方式，在另一种可能的实现方式中，所述第一核心网设备为策略控制功能网元或统一数据管理网元。
第三十八方面，本申请提供了一种通信装置，所述装置包括：收发单元，用于接收来自用户设备的第一加入请求，所述第一加入请求用于请求加入第一多播会话，所述第一加入请求包括第四识别信息，所述第四识别信息与所述第一多播会话对应；处理单元用于当所述第一多播会话属于允许所述用户设备加入的多播会话时，接受所述第一加入请求，或，当所述第一多播会话不属于允许所述用户设备加入的多播会话时，拒绝所述第一加入请求。
在上述技术方案中，通信装置可以根据用户设备请求加入的多播会话是否属于允许该用户设备加入的多播会话，确定是否接收用户设备的加入请求，从而可以实现对用户设备的加入请求进行鉴权。
结合第三十八方面，在一种可能的实现方式中，所述第一核心网设备为策略控制功能网元或统一数据管理网元。
结合第三十八方面或其任意一种可能的实现方式，在另一种可能的实现方式中，所述收发单元还用于向第一核心网设备发送第十四消息，所述第十四消息用于请求允许用户设备加入的多播会话的信息，所述第十四消息包括所述用户设备的第三用户标识信息；接收来自所述第一核心网设备的所述允许所述用户设备加入的多播业务的信息。
其中，第十四消息用于请求允许用户设备加入的多播业务，也可以替换为，第十四消息用于查询用户设备的会话相关信息，第一核心网设备在反馈给第二会话管理功能网元的用户设备的会话相关信息中包括用于指示允许用户设备加入的多播业务的信息。
在上述技术方案中，将多播会话可用的用户设备列表存储在统一数据存储库中，这样会话管理功能网元在进行用户设备的单播会话的建立流程中，可以以用户设备的标识为索引向统一数据存储库请求允许用户设备加入的多播业务，进而根据统一数据存储库反馈的信息对用户设备的加入请求进行鉴权，从而可以实现对用户设备的加入请求进行鉴权。
第三十九方面，本申请提供了一种通信装置，包括处理器、存储器和收发器。其中，存储器用于存储计算机程序，处理器用于调用并运行存储器中存储的计算机程序，并控制收发器收发信号，以使通信装置执行如上述任意一方面或其任意可能的实现方式中的方法。
第四十方面，本申请提供一种通信装置，包括处理器和通信接口，所述通信接口用于接收信号并将接收到的信号传输至所述处理器，所述处理器处理所述信号，使得如上述任意一方面或其任意可能的实现方式中的方法被执行。
可选地，上述通信接口可以为接口电路，处理器可以为处理电路。
第四十一方面，本申请提供了一种芯片，包括逻辑电路和通信接口，所述通信接口用于执行如上述任意一方面或其任意可能的实现方式中的发送、接收或获取操作，所述逻辑电路用于执行如上述任意一方面或其任意可能的实现方式中所述的确定处理。
可选地，所述通信接口可以包括输入接口和输出接口。所述输入接口用于执行获取或接收操作，所述输出接口用于执行发送操作。
第四十二方面，本申请提供一种计算机可读存储介质，所述计算机可读存储介质中存储有计算机指令，当计算机指令在计算机上运行时，使得如上述任意一方面或其任意可能的实现方式中的方法被执行。
第四十三方面，本申请提供一种计算机程序产品，所述计算机程序产品包括计算机程序代码，当所述计算机程序代码在计算机上运行时，使得如上述任意一方面或其任意可能的实现方式中的方法被执行。
第四十四方面，本申请提供一种无线通信系统，包括如上述任意一方面或其任意可能的实现方式所述的通信装置中的任意一个或多个。
附图说明
图1是可以应用本申请实施例的网络架构的示意图。
图2为基于单播的组播的示意图。
图3是可以应用本申请实施例的单播/组播系统架构的示意图。
图4是本申请实施例提供的鉴权方法的示意性流程图。
图5是本申请实施例的另一鉴权方法的示意性流程图。
图6是本申请实施例的另一鉴权方法的示意性流程图。
图7是本申请实施例的另一鉴权方法的示意性流程图。
图8是本申请实施例的另一鉴权方法的示意性流程图。
图9是本申请另一实施例提供的鉴权方法的示意性流程图。
图10是本申请实施例的另一鉴权方法的示意性流程图。
图11是本申请实施例的另一鉴权方法的示意性流程图。
图12是本申请实施例的另一鉴权方法的示意性流程图。
图13是本申请实施例的另一鉴权方法的示意性流程图。
图14是本申请实施例的另一鉴权方法的示意性流程图。
图15是本申请实施例的另一鉴权方法的示意性流程图。
图16是本申请实施例的另一鉴权方法的示意性流程图。
图17是本申请实施例的另一鉴权方法的示意性流程图。
图18是本申请实施例的另一鉴权方法的示意性流程图。
图19是本申请实施例的另一鉴权方法的示意性流程图。
图20是本申请的实施例提供的可能的装置的结构示意图。
图21是本申请的实施例提供的可能的装置的另一结构示意图。
具体实施方式
下面将结合附图，对本申请中的技术方案进行描述。
本申请实施例的技术方案可以应用于各种通信系统，例如：长期演进(long term evolution，LTE)系统、LTE频分双工(frequency division duplex，FDD)系统、LTE时分双工(time division duplex，TDD)、通用移动通信系统(universal mobile telecommunication system，UMTS)、全球互联微波接入(worldwide interoperability for microwave access，WiMAX)通信系统、第五代(5th generation，5G)系统或新无线(new radio，NR)通信系统、卫星通信系统、以及未来的移动通信系统等。
图1是可以应用本申请实施例的网络架构的示意图。以5G网络架构为例，该网络架构包括：用户设备(user equipment，UE)101、无线接入网设备(radio access network，RAN)102、用户面功能(user plane function，UPF)网元103、数据网络(data network，DN)网元104、接入和移动管理功能(access and mobility management function，AMF)元105、会话管理功能(session management function，SMF)网元106、策略控制功能模块(policy control function，PCF)网元107、统一数据管理(unified data management，UDM)网元108、应用功能(application function，AF)网元109、统一数据存储库(unified data repository，UDR)网元110、和网络开放功能(network exposure function，NEF)网元111。下述将用户设备101、无线接入网设备102、UPF网元103、DN网元104、AMF网元105、SMF网元106、PCF网元107、UDM网元108、AF网元109、UDR网元110、NEF网元111分别简称为UE101、RAN102、UPF103、DN104、AMF105、SMF106、PCF107、UDM108、AF109、UDR110、NEF111。
其中，UE101，主要通过无线空口接入5G网络并获得服务，UE101通过空口和RAN102进行交互，通过非接入层信令(non-access stratum，NAS)和核心网的AMF105进行交互。
RAN102负责UE101接入网络的空口资源调度和空口的连接管理。
UPF103负责用户设备中用户数据的处理，例如，转发和计费等。例如，UPF103可以从DN104接收用户数据，并通过RAN102传输给UE101，还可以通过RAN102从UE101接收用户数据，转发到DN104。UPF103中为UE101提供服务的传输资源和调度功能由SMF106管理控制的。
DN104是为用户提供数据传输服务的运营商网络，例如，因特网协议(internet protocol，IP)多媒体业务(IP multi-media service，IMS)、Internet等。UE101通过建立UE101到RAN102到UPF103到DN104之间的协议数据单元(protocol data unit，PDU)会话(session)，来访问DN104。
AMF105主要负责移动网络中的移动性管理，例如，用户位置更新、用户注册网络、和用户切换等。
SMF106主要负责移动网络中的会话管理，例如，会话建立、修改和释放等。具体功能包括为用户分配IP地址、选择提供报文转发功能的UPF等。
PCF107负责向AMF105、SMF106提供策略，例如，服务质量(quality of service，QoS)策略、切片选择策略等。
UDM108用于存储用户数据，例如，签约信息、鉴权/授权信息等。
AF109负责向第三代合作伙伴项目(the 3rd generation partnership project，3GPP)网络提供业务，例如，影响业务路由、与PCF107之间交互以进行策略控制等。
UDR110负责存储和检索签约数据、策略数据和公共架构数据等。
NEF111用于运营商网络将网络中的数据开放给第三方应用服务器，或接收第三方应用服务器为网络提供的数据。
在该网络架构中，N1为UE101和AMF105之间的接口，N2为RAN102和AMF105的接口，用于NAS消息的发送等；N3为RAN102和UPF103之间的接口，用于传输用户面的数据等；N4为SMF106和UPF103之间的接口，用于传输例如N3连接的隧道标识信息，数据缓存指示信息，以及下行数据通知消息等信息；N6接口为UPF103和DN104之间的接口，用于传输用户面的数据等。Nudr为UDR110展现的基于服务的接口，Namf为AMF105展现的基于服务的接口，Nsmf为SMF106展现的基于服务的接口，Nnef为NEF111展现的基于服务的接口，Npcf为PCF107展现的基于服务的接口，Nudm为UDM108展现的基于服务的接口，Naf为AF109展现的基于服务的接口。
需要说明的是，图1所示的各网元之间的接口还可以是点对点的接口，而不是服务化的接口。
本申请实施例中的用户设备也可以称为终端设备、用户、接入终端、用户单元、用户站、移动站、移动台、远方站、远程终端、移动设备、用户终端、终端、无线通信设备、用户代理或用户装置等。用户设备可以是蜂窝电话、智能手表、无线数据卡、手机、平板电脑、个人数字助理(personal digital assistant，PDA)电脑、无线调制解调器、手持设备、膝上型电脑、机器类型通信(machine type communication，MTC)终端、带无线收发功能的电脑、物联网终端、虚拟现实终端设备、增强现实终端设备、工业控制中的无线终端、无人驾驶中的无线终端、远程手术中的无线终端、智能电网中的无线终端、运输安全中的无线终端、智慧城市中的无线终端、智慧家庭中的无线终端、卫星通信中的无线终端(例如，卫星电话或卫星终端等)等等。本申请的实施例对用户设备所采用的具体技术和具体设备形态不做限定。
本申请实施例中的接入网设备可以是用于与用户设备通信的设备，主要负责空口侧的无线资源管理、服务质量管理、数据压缩和加密等功能。该接入网设备可以是全球移动通讯(global system of mobile communication，GSM)系统或码分多址(code division multiple access，CDMA)系统中的基站(base transceiver station，BTS)、宽带码分多址(wideband code division multiple access，WCDMA)系统中的基站(nodeB，NB)、LTE系统中的演进型基站(evolutional nodeB，eNB或eNodeB)、全球互联微波接入(worldwide interoperability for microwave access，WiMAX)通信系统中的基站、云无线接入网络(cloud radio access network，CRAN)场景下的无线控制器、无线高保真(wireless fidelity)系统的中接入点、中继站、车载设备或者可穿戴设备等。或者接入网设备可以为D2D通信或机器通信中承担基站功能的终端。或者接入网设备可以为5G网络中的网络设备或者未来演进的PLMN网络中的网络设备等。此外，接入网设备也可以是完成基站部分功能的模块或单元，例如，可以是集中式单元(central unit，CU)，也可以是分布式单元(distributed unit，DU)。本申请的实施例对接入网设备所采用的具体技术和具体设备形态不做限定。
应理解，图1所示的各个网元的命名仅是一个名字，名字对网元本身的功能不构成限定。在不同的网络中，上述各个网元也可以是其他的名字，本申请实施例对此不作具体限定。例如，在6G网络中，上述各个网元中的部分或全部可以沿用5G中的术语，也可能是其他命名，等等，在此进行统一说明，以下不再赘述。类似地，图1所示的网元之间的 接口仅是一个示例，在5G网络以及未来其它的网络中，网元之间的接口也可以不是图中所示的接口，本申请对此不作限定。还应理解，本申请实施例并不限于图1所示的系统架构中。例如，可以应用本申请的通信系统可以包括更多或更少的网元或设备。图1中的设备或网元可以是硬件，也可以是从功能上划分的软件或者以上二者的结合。图1中的设备或网元之间可以通过其他设备或网元通信。
目前，若5GC网络需要向多个用户设备发送相同业务，可以建立一条多播用户面连接来发送数据，使得发给不同用户设备的相同内容的数据只选择一份发送，有利于提高空口侧资源和核心网资源的使用效率。一种实现方式为通过基于单播的组播技术实现。
图2为基于单播的组播的示意图。
基于单播的组播技术对于应用服务器(application server，AS)和UPF之间的数据传输不作具体限定。例如，如图2的(a)图和(c)图所示，AS可以仅向网络发送一份组播数据包。又例如，如图2的(b)图和(d)图所示，AS可以向组播组内的每一个UE发送一份组播数据包。
针对同一多播群组，对于UPF到接入网(access network，AN)再到UE、或AN到UE传输的数据包，其都是内容相同的组播数据包。
如图2的(a)图和(b)图所示，UPF将发送给不同UE(例如，图2中的UE1-UE4)的相同内容的数据选择一份发送到接入网(access network，AN)，AN将接收到的数据选择一份发送给UE1-UE4。例如，针对同一多播群组，UPF会将从应用服务器接收的组播数据包通过专用传输通道，或者通过组播群组中的某个UE的N3通道将数据发送到接入网，AN将接收到的数据发送给UE1-UE4。
如图2的(c)图和(d)图所示，UPF将发送给不同UE(例如，图2中的UE1-UE4)的相同内容的数据单播发送给AN，AN将接收到的数据选择一份发送给UE1-UE4。例如，针对同一多播群组，UPF会将从应用服务器接收的组播数据通过组播群组中的UE的N3通道将数据通过单播发送到接入网，AN将接收到的数据发送给UE1-UE4。
图3是可以应用本申请实施例的单播/组播系统架构的示意图。其中各网元的详细描述可以参见图1中的相关描述，在此不再赘述。需要说明的是，图3中的SMF为用于管理单播PDU会话的SMF网元，多播SMF(multicast SMF，M-SMF)为用于管理多播PDU会话的SMF网元，UPF为用于处理单播用户数据的UPF网元，多播UPF(multicast UPF，M-UPF)为用于处理多播用户数据的UPF网元。其中，第一UPF由第一SMF进行管理。
其中，M-SMF可以是某个单播SMF通过增强功能实现，也可以是一个管理多播业务的专用网元。M-UPF可以是某个单播UPF通过增强功能实现，也可以是一个管理多播业务的专用网元。
为了方便描述，下文将用于管理多播PDU会话的SMF网元统一称为第一SMF，将用于管理单播PDU会话的SMF网元统一称为第二SMF，将用于处理多播用户数据的UPF网元统一称为第一UPF，将用于处理单播用户数据的UPF网元统一称为第二UPF。还需要说明的是，在本申请实施例中对组播和多播不作区分，下文统一描述为多播。
需要说明的是，在某些实现场景中，本申请中的M-SMF或第一SMF的功能可能会由其他网元包含。例如，多播广播业务功能网元(multicast and broadcast service function，MBSF)实现，MBSF包含用于管理多播业务的相关功能，例如，多播会话管理功能、多 播用户的鉴权功能、多播数据的控制功能(例如，针对多播数据加密、编码等功能的控制等)、以及多播策略的生成等。此时，M-SMF或第一SMF可以等价替换为这些其他网元(例如，MBSF)。
在上述多播场景，当UE加入多播群组时，需要对UE的加入进行鉴权操作，以便保证多播业务的正确传输。基于此，如何实现对用户设备的加入请求进行鉴权成为亟需解决的问题。
针对上述问题，本申请提供了鉴权方法和通信装置，能够实现UE加入多播群组时的鉴权操作。
图4是本申请实施例提供的鉴权方法的示意性流程图。图4所示的方法可以应用于图1所示的系统架构，也可以应用于图3所示的系统架构，本申请实施例不限于此。
图4中的方法可以由第一SMF和应用服务器执行，也可以由第一SMF和应用服务器中的模块或单元(例如，电路、芯片或片上系统(system on chip，SOC)等)执行，图4中以执行主体为第一SMF和应用服务器为例。图4中的方法可以包括以下内容的至少部分内容。
在步骤410中，第一SMF获取用户设备的第一用户标识信息和多播数据的第一识别信息。
第一用户标识信息为用于唯一标识用户设备且应用服务器可以识别的信息。
例如，第一用户标识信息可以为GPSI。
多播数据的第一识别信息与用户设备请求加入的多播群组对应，可以包括多播数据对应的多播群组的TMGI、提供多播数据的应用服务器的IP地址、多播数据的业务标识、多播数据的分组过滤信息、多播数据的SDF识别规则、用于传输多播数据的多播PDU会话的ID、应用的ID信息、多播数据的目标IP地址信息、以及多播群组对应的多播会话的上下文标识信息中的至少一个。为了描述方便，下文将多播数据的第一识别信息简称为第一识别信息。
在本申请中，第一SMF获取第一用户标识信息和上述第一识别信息的方式有很多，将会在下文结合附图5到图8进行详细描述。
在步骤420中，第一SMF向应用服务器发送第一消息，请求应用服务器对用户设备的加入请求进行鉴权。相应地，应用服务器接收来自第一SMF的第一消息。其中，第一消息包括第一用户标识信息和多播数据的第二识别信息。
可选地，第一消息可以为鉴权授权请求消息。
多播数据的第二识别信息与用户设备请求加入的多播群组对应，可以包括多播数据对应的多播群组的TMGI、提供多播数据的应用服务器的IP地址、多播数据的业务标识、多播数据的分组过滤信息、多播数据的SDF识别规则、用于传输多播数据的多播PDU会话的ID、应用的ID信息、多播数据的目标IP地址信息、以及多播群组对应的多播会话的上下文标识信息中的至少一个。为了描述方便，下文将多播数据的第二识别信息简称为第二识别信息。
在一些实现方式中，第一识别信息和第二识别信息可以相同。
在另一些实现方式中，第一识别信息和第二识别信息可以不同。具体地，第一SMF获取到第一识别信息后，可以根据第一识别信息确定第二识别信息，进而将第二识别信息 发送给应用服务器。例如，第一SMF获取到的第一识别信息为多播群组的TMGI，第一SMF根据TMGI确定与该TMGI对应的PDU会话的ID，并将该PDU会话的ID通过第一消息发送给应用服务器。
在本申请中，第一SMF向应用服务器发送第一消息的方式有很多，同样将会在下文结合附图5到图8进行详细描述。
在步骤430中，应用服务器根据第一用户标识信息和第二识别信息进行鉴权。
在一些实现方式中，应用服务器可以根据第一用户标识信息和第二识别信息，查询数据库。若针对该第二识别信息，数据库中存在第一用户标识信息的签约信息，则应用服务器确定鉴权成功；反之，应用服务器确定鉴权失败。
在步骤440中，应用服务器向第一SMF发送结果信息。相应地，第一SMF接收来自应用服务器的结果信息。
其中，结果信息用于指示鉴权的结果。例如，结果信息指示鉴权成功。又例如，结果信息指示鉴权失败。
可选地，当应用服务器确定鉴权成功时，应用服务器还可以向第一SMF向发送用于多播传输的参数信息。该参数信息可以包括多播传输的QoS参数和多播会话的标识信息等。
在本申请中，应用服务器向第一SMF发送结果信息的方式有很多，将会在下文结合附图5到图8进行详细描述。
在本申请实施例中，第一SMF将第一用户标识信息和第二识别信息发送给应用服务器，由应用服务器执行用户设备加入群组时的鉴权操作，从而可以实现对用户设备的加入请求进行鉴权。此外，在本方案中无需应用服务器向核心网实时提供明确的多播群组的成员信息，可以在核心网没有多播群组的成员信息的情况下实现针对用户设备加入群组时的鉴权操作，有助于避免产生公共安全问题。
可选地，在一些实现方式中，在第一SMF向应用服务器发送第一消息的之前，第一SMF还可以判断是否需要应用服务器进行鉴权授权。当判断需要应用服务器进行鉴权授权时，第一SMF向应用服务器发送第一消息；当判断无需应用服务器进行鉴权授权时，第一SMF则不会向应用服务器发送第一消息。
例如，第一SMF可以根据本地存储的策略确定是否需要应用服务器进行鉴权授权。该策略可以预配置在第一SMF中，也可以由其他网元(例如，PCF、UDM或UDR)提供。该策略用于指示第一SMF是否需要针对携带该识别信息的加入请求向发起应用服务器的鉴权授权流程。
又例如，第一SMF可以判断是否存储了第一识别信息对应的多播群组的成员列表信息，并且当该成员列表信息中包括第一用户标识时，第一SMF确认需要应用服务器进行鉴权授权；否则，第一SMF确定用户设备的加入请求不合法，向用户设备返回群组加入失败的指示。
下面结合图5至图8对本申请实施例进行详细说明。
图5是本申请实施例的另一鉴权方法的示意性流程图。图5所示的方法可以应用于图1所示的系统架构，也可以应用于图3所示的系统架构，本申请实施例不限于此。
在本申请实施例中，第一SMF可以通过控制面信令获取第一用户标识信息和第一识 别信息，换句话说，用户设备可以通过控制面信令请求加入多播群组。
具体地，通过步骤501-步骤503向第一SMF传输第一用户标识信息和识别信息。
在步骤501中，用户设备向AMF发送第三消息。相应地，AMF接收用户设备发送的第三消息。
在一些实现方式中，用户设备可以通过非接入层(non-access stratum，NAS)消息发送第三消息，第三消息中可以包含多播数据的第三识别信息。例如，NAS消息中可以包括N1SM容器(N1SM container)，N1SM容器可以包括PDU会话修改请求消息或PDU会话建立请求消息，进一步地，PDU会话修改请求消息或PDU会话建立请求消息中可以包括上述第三识别信息。
多播数据的第三识别信息与用户设备请求加入的多播群组对应，可以包括多播数据对应的多播群组的TMGI、提供多播数据的应用服务器的IP地址、多播数据的业务标识、多播数据的分组过滤信息、多播数据的SDF识别规则、用于传输多播数据的多播PDU会话的ID、应用的ID信息、多播数据的目标IP地址信息、以及多播群组对应的多播会话的上下文标识信息中的至少一个。为了描述方便，下文将多播数据的第三识别信息简称为第三识别信息。
可选地，PDU会话修改请求消息或PDU会话建立请求消息中还可以包括DN的标识信息和/或用于鉴权授权的信息等。其中，DN的标识信息可以为DN的ID或DN的名称等。用于鉴权授权的信息基于应用层的实现可以有不同的形式，本申请实施例对此不作具体限定。
可选地，PDU会话修改请求消息或PDU会话建立请求消息中还可以包括第二用户标识信息。其中，第二用户标识信息可以为用于唯一标识用户设备，且核心网设备和接入网设备可以识别的信息。例如，第二用户标识信息可以包括SUPI和GUTI等。
在步骤502中，AMF向第二SMF发送第三识别信息。相应地，第二SMF接收来自AMF的第三识别信息。
在一些实现方式中，AMF向第二SMF发送从用户设备接收的第三消息，所述第三消息包括上述第三识别信息。
在另一些实现方式中，AMF还可以向第二SMF发送第一用户标识信息和/或第二用户标识信息。
可选地，若AMF本地有第二用户设备与第一用户设备的映射关系，AMF在接收到用户设备发送的第二识别信息后，可以根据该映射关系确定用户设备的第一用户标识信息。此时，AMF可以向第二SMF发送第一用户标识信息，或者向第二SMF发送第二用户标识信息，或者向第二SMF发送第一用户标识信息和第二用户标识信息。
可选地，AMF可以不针对第三识别信息进行处理，当AMF本地有可用的用户设备的第一用户标识信息时，AMF可以向第二SMF发送第一用户标识信息和第三识别信息。
可选地，AMF不确定第一用户标识信息，AMF可以向第二SMF发送第二用户标识信息。
需要说明的是，AMF向第二SMF发送的第二用户标识信息可以是由AMF提供的，或者是由用户设备提供的(即在步骤501中用户设备还向AMF发送第二用户标识信息)。
在步骤503中，第二SMF向第一SMF发送第一用户标识信息和/或第二用户标识信 息、以及第一识别信息。相应地，第一SMF接收来自第二SMF的第一用户标识信息和/或第二用户标识信息、以及第一识别信息。
多播数据的第一识别信息与用户设备请求加入的多播群组对应，第一识别信息的具体描述可以参见上文，在此不再赘述。
在一些实现方式中，第一识别信息和第三识别信息可以相同。
在另一些实现方式中，第一识别信息和第三识别信息可以不同。具体地，第二SMF获取到第三识别信息后，可以根据第三识别信息确定第一识别信息，进而将第一识别信息发送给第一SMF。例如，第二SMF获取到的第三识别信息为多播群组的TMGI，第二SMF根据TMGI确定与该TMGI对应的PDU会话的ID，并将该PDU会话的ID通过第一消息发送给第一SMF。
可选地，第二SMF可以通过N16消息发送第一用户标识信息和/或第二用户标识信息、以及第一识别信息。其中，N16消息用于请求多播传输的参数信息以及请求进行加入多播群组的鉴权。
可选地，若AMF未向第二SMF发送第一用户标识信息，第二SMF需要从AMF获取第一用户标识信息，或者根据本地存储的信息以及第二用户标识信息确定第一用户标识信息，或者第二SMF需要从UDM获取第一用户标识信息。其中，上述本地存储的信息可以从AMF获取。
可选地，上述本地存储的信息可以为第二用户标识与第一用户标识信息的映射关系。
可选地，执行步骤503之前，第二SMF可以确定第一SMF。一种实现方式为第二SMF根据第三识别信息，通过查询用于集中存储的网元中存储的数据，确定第一SMF。其中，用于集中存储的网元可以为UDM、UDR或PCF等。另一种实现方式是，第二SMF之前预配置了第三识别信息与第一SMF网元之间的对应关系，此时第二SMF网元可以直接通过此对应关系确定第一SMF。
可选地，若第二SMF向第一SMF发送的是第二用户标识信息，而未向第一SMF发送第一用户标识信息，第一SMF需要根据第二用户标识信息从其他存储了第一用户标识信息和第二用户标识信息的映射关系网元获取第一用户标识信息。这些网元可以是第二SMF、AMF、UDM、UDR或PCF等网元。
以第一SMF从AMF获取第一用户标识信息为例。
1)首先，第一SMF向AMF发送消息，消息可以是N11消息，该消息用于请求AMF将第二用户标识信息对应的第一用户标识信息发送给第一SMF，该消息包括第二用户标识信息。可选地，该消息还可以包括第三识别信息。需要说明的是，该消息携带的第二用户标识信息可以是用户的永久标识信息或者用户的临时标识信息。还需要说明的是，第一SMF向AMF发送的第二用户标识信息与第二SMF或AMF向第一SMF发送的第二用户标识信息可能不同，第二SMF或AMF向第一SMF发送的第二用户标识信息可以是用户的永久标识信息、用户的临时标识信息或SM上下文信息标识(SM Context ID)，第一SMF向AMF发送的第二用户标识信息可以是用户的永久标识信息或用户的临时标识信息，两者无依赖关系。例如，第二SMF或AMF提供的是用户的临时标识信息，第一SMF根据用户的临时标识信息，确定对应的AMF并从AMF获取用户的永久标识信息，此后第一SMF通过向AMF发送用户的永久标识信息从AMF处获取第一用户标识信息。
2)之后，AMF向第一SMF发送消息，消息可以是N11消息，该消息用于向第一SMF返回第二用户标识信息对应的第一用户标识信息。可选地，该消息还可以包括第三识别信息。
在第一SMF获取到第一用户标识信息和第一识别信息后，可以向应用服务器发送第一消息，请求应用服务器执行鉴权授权操作。该第一消息包括第一用户标识信息和第二识别信息。
可选地，第一消息可以是鉴权授权请求消息。
多播数据的第二识别信息与用户设备请求加入的多播群组对应，第二识别信息的具体描述可以参见上文，在此不再赘述。
在一些实现方式中，第一识别信息和第二识别信息可以相同。
在另一些实现方式中，第一识别信息和第二识别信息可以不同。具体地，第一SMF获取到第一识别信息后，可以根据第一识别信息确定第二识别信息，进而将第二识别信息发送给应用服务器。例如，第一SMF获取到的第一识别信息为多播群组的TMGI，第一SMF根据TMGI确定与该TMGI对应的PDU会话的ID，并将该PDU会话的ID通过第一消息发送给应用服务器。
在一些实现方式中，可以采用用户面信令，通过用户面网元实现上述鉴权授权操作。
作为一个示例，可以通过图5中的方式1实现。
具体地，在步骤504中，第一SMF根据第一识别信息或第二识别信息，确定对应于识别信息的应用服务器。
例如，在第一SMF建立多播会话时，从PCF获取并存储的。
又例如，第一SMF向相关网元查询。相关网元可以为UDM、UDR或PCF等。
在步骤505中，第一SMF向应用服务器发送第一消息。相应地，应用服务器接收来自第一SMF的第一消息。其中，第一消息可以包括第一用户标识信息和第二识别信息。
可选地，当第一SMF与应用服务器之间具有直接接口时，第一SMF可以直接向应用服务器发送第一消息。
可选地，第一SMF可以通过第一UPF向应用服务器发送第一消息。
在步骤506中，应用服务器根据接收到的第一用户标识信息和第二识别信息，进行鉴权授权操作。
在一些实现方式中，应用服务器可以根据第一用户标识信息和识别信息，查询数据库。若针对该第二识别信息，数据库中存在第一用户标识信息的签约信息，则应用服务器确定鉴权成功；反之，应用服务器确定鉴权失败。
在步骤507中，应用服务器向第一SMF发送第二消息。相应地，第一SMF接收来自应用服务器的第二消息。
其中，第二消息可以包括结果信息，结果信息用于指示鉴权的结果。
例如，结果信息指示鉴权成功。
又例如，结果信息指示鉴权失败。
可选地，第二消息可以是鉴权授权响应消息。
可选地，当应用服务器确定鉴权成功时，第二消息中还可以包括用于多播传输的参数信息。该参数信息可以包括多播传输的QoS参数和多播会话的标识信息等。
可选地，第二消息中还可以包括第二识别信息。
在另一些实现方式中，还可以采用控制面信令，通过控制面网元实现上述鉴权授权操作。
作为一个示例，可以通过图5中的方式2实现。
具体地，在步骤508中，第一SMF向NEF发送第一消息。相应地，NEF接收来自第一SMF的第一消息。
可选地，第一消息可以是鉴权授权请求消息。
在步骤509中，NEF确定对应于第二识别信息的应用服务器。
例如，第一SMF在第一消息中携带应用服务器的地址，NEF从第一消息中获取应用服务器的地址。第一SMF获取应用服务器的地址的方式可以参见步骤504。
又例如，第一NEF根据第二识别信息向相关网元查询。相关网元可以为UDM、UDR或PCF等。
在步骤510中，NEF向应用服务器发送第一消息。相应地，应用服务器接收来自NEF的第一消息。
在步骤511中，应用服务器根据接收到的第一用户标识信息和第二识别信息，进行鉴权授权操作。步骤511与步骤506相似，可以参考步骤506的相关描述。
在步骤512中，应用服务器向NEF发送第二消息。相应地，NEF接收第二消息。
其中，第二消息可以包括结果信息，结果信息用于指示鉴权的结果。
例如，结果信息指示鉴权成功。
又例如，结果信息指示鉴权失败。
可选地，第二消息可以为鉴权授权响应消息。
可选地，当应用服务器确定鉴权成功时，响应消息中还可以包括用于多播传输的参数信息。该参数信息可以包括多播传输的QoS参数和多播会话的标识信息等。
可选地，响应消息中还可以包括第二识别信息。
在步骤513中，NEF向第一SMF发送第二消息。相应地，第一SMF接收来自NEF的第二消息。
之后，在步骤514中，第一SMF向第二SMF发送第五消息。相应地，第二SMF接收第五消息。其中，第五消息可以包括第一用户标识信息和/或第二用户标识信息、识别信息、以及结果信息。这里的识别信息可以是上述的第一识别信息、第二识别信息或第三识别信息中的任意一个。
可选地，若鉴权成功，第五消息还可以包括用于多播传输的参数信息。该参数信息可以包括多播传输的QoS参数和多播会话的标识信息等。
在步骤515中，第二SMF根据第五消息，对PDU会话进行处理。
例如，如果鉴权成功，第二SMF根据多播传输的参数信息，生成对应的N2信息，用于此后发送给接入网设备，使得接入网设备进一步根据此信息向用户设备发送多播数据。
又例如，如果鉴权失败，第二SMF可以向用户设备返回NAS消息，用于通知用户设备加入群组失败。或者，第二SMF可以为用户设备建立单播的传输资源，此单播的传输资源用于传输多播的下行数据。
可选地，在本申请实施例中，在执行步骤504或步骤508之前，还可以执行步骤516， 即第一SMF还可以判断是否需要应用服务器进行鉴权授权。步骤516与图4中的步骤450相同或类似，可以参见步骤450的相关描述，在此不再赘述。
图6是本申请实施例的另一鉴权方法的示意性流程图。图6所示的方法可以应用于图1所示的系统架构，也可以应用于图3所示的系统架构，本申请实施例不限于此。
与图5不同的是，在本申请实施例中，第一SMF可以通过用户面信令获取第一用户标识信息和第一识别信息，换句话说，用户设备可以通过用户面信令请求加入多播群组。
在一些实现方式中，用户设备可以通过单播PDU会话的传输通道发送用户面数据，并且在用户面数据中增加多播数据的识别信息。可选地，该单播PDU会话对应的DN和/或切片信息与用户设备请求加入的多播PDU会话对应的DN和/或网络切片信息相同。
具体地，通过步骤601-603向第一SMF传输第一用户标识信息和多播数据的识别信息。
在步骤601中，用户设备向第二UPF发送三消息。相应地，第二UPF接收用户设备发送的第三消息。其中，第三消息可以为用于传输用户面数据的消息，第三消息包括第三识别信息。
可选地，第三消息可以是IGMP加入请求消息或MLR消息。
可选地，第三消息中还可以包括DN的标识信息和/或用于鉴权授权的信息等。其中，DN的标识信息可以为DN的ID或DN的名称等。用于鉴权授权的信息基于应用层的实现可以有不同的形式，本申请实施例对此不作具体限定。
可选地，第三消息中还可以包括第二用户标识信息。其中，第二用户标识信息可以为用于唯一标识用户设备，且核心网设备和接入网设备可以识别的信息。例如，第二标用户标识信息可以包括SUPI、GUTI和SUCI中的至少一个。
在一些实现方式中，用户设备可以通过接入网设备向第二UPF发送第三消息。
在另一些实现方式中，用户设备可以通过AMF向第二UPF发送第三消息。可选地，AMF在接收到用户设备发送的第三消息后，也可以确定用户设备的第一用户标识信息并发送给第二UPF。例如，AMF可以根据用户设备的第二用户标识与第一用户标识信息的映射关系，确定第一用户标识信息。
在步骤602中，第二UPF向第二SMF发送第三识别信息。相应地，第二SMF接收来自第二UPF发送的第三识别信息。
可选地，第二UPF可以向第二SMF发送第一用户标识信息和/或第二用户标识信息。其中第一用户标识信息和第二用户标识信息可以由用户设备或接入网设备提供。
可选地，第二UPF可以通过通知(notify)消息发送上述各信息。
可选地，若第二UPF未向第二SMF发送第一用户标识信息，第二SMF需要从AMF获取第一用户标识信息，或者根据本地存储的信息以及第二用户标识信息确定第一用户标识信息。其中，上述本地存储的信息可以从AMF获取。
可选地，上述本地存储的信息可以为第二用户标识与第一用户标识信息的映射关系。
在步骤603中，第二SMF向第一SMF发送第一用户标识信息和/或第二用户标识信息、以及第一识别信息。相应地，第一SMF接收第二SMF发送的信息。
可选地，第二SMF可以通过N16消息发送第一用户标识信息和/或第二用户标识信息、以及第一识别信息。其中，N16消息用于请求多播传输的参数信息以及请求进行加入多播 群组的鉴权。
可选地，执行步骤603之前，第二SMF可以确定第一SMF。一种实现方式为第二SMF根据第三识别信息或第一识别信息，通过查询用于集中存储的网元中存储的数据，确定第一SMF。其中，用于集中存储的网元可以为UDM、UDR或PCF等。
可选地，若第二SMF向第一SMF发送的是第二用户标识信息，而未向第一SMF发送第一用户标识信息，第一SMF需要根据第二用户标识信息从其他存储了第一用户标识信息和第二用户标识信息的映射关系网元获取第一用户标识信息。这些网元可以是第二SMF、AMF、UDM、UDR或PCF等网元。
以第一SMF从AMF获取第一用户标识信息为例。
1)首先，第一SMF向AMF发送消息，消息可以是N11消息，该消息用于请求AMF将第二用户标识信息对应的第一用户标识信息发送给第一SMF，该消息包括第二用户标识信息。可选地，该消息还可以包括第一识别信息或第二识别信息。需要说明的是，该消息携带的第二用户标识信息可以是用户的永久标识信息或者用户的临时标识信息。还需要说明的是，第一SMF向AMF发送的第二用户标识信息与第二SMF或AMF向第一SMF发送的第二用户标识信息可能不同，第二SMF或AMF向第一SMF发送的第二用户标识信息可以是用户的永久标识信息或是用户的临时标识信息，第一SMF向AMF发送的第二用户标识信息可以是用户的永久标识信息或用户的临时标识信息，两者无依赖关系。例如，第二SMF或AMF提供的是用户的临时标识信息，第一SMF根据用户的临时标识信息，确定对应的AMF并从AMF获取用户的永久标识信息，此后第一SMF通过向AMF发送用户的永久标识信息从AMF处获取第一用户标识信息。
2)之后，AMF向第一SMF发送消息，消息可以是N11消息，该消息用于向第一SMF返回第二用户标识信息对应的第一用户标识信息。可选地，该消息还可以包括第一识别信息或第二识别信息。
在第一SMF获取到第一用户标识信息和第一识别信息后，可以向应用服务器发送第一消息，请求应用服务器执行鉴权授权操作。该第一消息包括第一用户标识信息和第二识别信息。
步骤604-616与图5中的步骤504-516相同或类似，可以参考步骤504-516的相关描述，在此不再赘述。
需要说明的还是，图6中的第一识别信息、第二识别信息和第三识别信息的详细描述，可以参见图5中的相关描述，在此不再赘述。
图7是本申请实施例的另一鉴权方法的示意性流程图。图7所示的方法可以应用于图1所示的系统架构，也可以应用于图3所示的系统架构，本申请实施例不限于此。
与图5不同的是，在本申请实施例中，用户设备不经过第二SMF直接向第一SMF发送第一用户标识信息和/或第二用户标识信息、以及第一识别信息。
具体地，在步骤701中，用户设备向AMF发送第三消息。相应地，AMF接收用户设备发送的第三消息。在一些实现方式中，第三消息中可以包含第三识别信息。步骤701与步骤501类似或相同，可以参考步骤501的相关描述，在此不再赘述。
在步骤702中，AMF可以根据接收到的第三识别信息，确定第一SMF，并向第一SMF发送第一识别信息。相应地，第一SMF接收来自第二SMF的第一识别信息。
在一些实现方式中，AMF向第一SMF发送从用户设备接收的第三消息，所述第三消息包括上述第一识别信息。由于AMF不对第三识别信息进行处理，因此第三识别信息与第一识别信息相同。
在另一些实现方式中，AMF还可以向第一SMF发送第一用户标识信息和/或第二用户标识信息。
可选地，若AMF本地有第二用户设备与第一用户设备的映射关系，AMF在接收到用户设备发送的第三识别信息后，可以根据该映射关系确定用户设备的第一用户标识信息。此时，AMF可以向第一SMF发送第一用户标识信息，或者向第一SMF发送第二用户标识信息，或者向第一SMF发送第一用户标识信息和第二用户标识信息。
可选地，AMF可以不针对第三识别信息进行处理，当AMF本地有可用的用户设备的第一用户标识信息时，AMF可以向第一SMF发送第一用户标识信息和第三识别信息。
可选地，AMF不确定第一用户标识信息，AMF可以向第一SMF发送第二用户标识信息。
需要说明的是，AMF向第一SMF发送的第二用户标识信息可以是由AMF提供的，或者是由用户设备提供的(即在步骤701中用户设备还向AMF发送第二用户标识信息)。
可选地，若AMF未向第一SMF发送第一用户标识信息，第一SMF需要根据第二用户标识信息从其他存储了第一用户标识信息和第二用户标识信息的映射关系网元获取第一用户标识信息。这些网元可以是第二SMF、AMF、UDM、UDR或PCF等网元。
以第一SMF从AMF获取第一用户标识信息为例。
1)首先，第一SMF向AMF发送消息，消息可以是N11消息，该消息用于请求AMF将第二用户标识信息对应的第一用户标识信息发送给第一SMF，该消息包括第二用户标识信息。可选地，该消息还可以包括第一识别信息或第二识别信息。需要说明的是，该消息携带的第二用户标识信息可以是用户的永久标识信息或者用户的临时标识信息。还需要说明的是，第一SMF向AMF发送的第二用户标识信息与AMF向第一SMF发送的第二用户标识信息可能不同，AMF向第一SMF发送的第二用户标识信息可以是用户的永久标识信息、用户的临时标识信息或SM上下文信息标识，第一SMF向AMF发送的第二用户标识信息可以是用户的永久标识信息或用户的临时标识信息，两者无依赖关系。例如，AMF提供的是用户的临时标识信息，第一SMF根据用户的临时标识信息，确定对应的AMF并从AMF获取用户的永久标识信息，此后第一SMF通过向AMF发送用户的永久标识信息从AMF处获取第一用户标识信息。
2)之后，AMF向第一SMF发送消息，消息可以是N11消息，该消息用于向第一SMF返回第二用户标识信息对应的第一用户标识信息。可选地，该消息还可以包括第一识别信息或第二识别信息。
在第一SMF获取到第一用户标识信息和第一识别信息后，可以向应用服务器发送第一消息，请求应用服务器执行鉴权授权操作。该第一消息包括第一用户标识信息和第二识别信息。
步骤704-716与图5中的步骤504-516相同或类似，可以参考步骤504-516的相关描述，在此不摘赘述。
需要说明的还是，图7中的第一识别信息、第二识别信息和第三识别信息的详细描述， 可以参见图5中的相关描述，在此不再赘述。
图8是本申请实施例的另一鉴权方法的示意性流程图。图8所示的方法可以应用于图1所示的系统架构，也可以应用于图3所示的系统架构，本申请实施例不限于此。
与图5不同的是，在本申请实施例中，用户设备向第一SMF发送第一用户标识信息和/或第二用户标识信息、以及第一识别信息时，可以不经过第二SMF。
在一些实现方式中，用户设备可以通过单播PDU会话的传输通道发送用户面数据，并且在用户面数据中增加多播数据的识别信息。可选地，该单播PDU会话对应的DN和/或切片信息与用户设备请求加入的多播PDU会话对应的DN和/或网络切片信息相同。
具体地，通过步骤801-802向第一SMF传输第一用户标识信息和多播数据的识别信息。
在步骤801中，用户设备向第二UPF发送第三消息。相应地，第二UPF接收用户设备发送的第三消息。其中，第三消息为用于传输用户面数据的消息，第三消息包括第三识别信息。
可选地，第三消息可以为IGMP加入请求消息或MLR消息。
可选地，第三消息中还可以包括DN的标识信息和/或用于鉴权授权的信息等。其中，DN的标识信息可以为DN的ID或DN的名称等。用于鉴权授权的信息基于应用层的实现可以有不同的形式，本申请实施例对此不作具体限定。
可选地，第三消息中还可以包括第二用户标识信息。其中，第二用户标识信息可以为用于唯一标识用户设备，且核心网设备和接入网设备可以识别的信息。例如，第二标用户标识信息可以包括SUPI、GUTI和SUCI中的至少一个。
在一些实现方式中，用户设备可以通过接入网设备向第二UPF发送第三消息。
在另一些实现方式中，用户设备可以通过AMF向第二UPF发送第三消息。可选地，AMF在接收到用户设备发送的第三消息后，也可以确定用户设备的第一用户标识信息并发送给第二UPF。例如，AMF可以根据用户设备的第二用户标识与第一用户标识信息的映射关系，确定第一用户标识信息。
在步骤802中，第二UPF向第一SMF发送第一识别信息。相应地，第一SMF接收来自第二UPF的第一识别信息。
在一些实现方式中，第二UPF向第一SMF发送从用户设备接收的第三消息，所述第三消息包括上述识别信息。由于第二UPF不对第三识别信息进行处理，因此第三识别信息与第一识别信息相同。
在另一些实现方式中，第二UPF还可以向第一SMF发送第一用户标识信息和/或第二用户标识信息。
需要说明的是，第二UPF向第一SMF发送的第二用户标识信息可以是由AMF提供的，或者是由用户设备提供的(即在步骤801中用户设备还向AMF发送第二用户标识信息)。
可选地，执行步骤802之前，第二UPF可以确定第一SMF。
一种实现方式为：第二UPF根据第三识别信息，通过查询用于集中存储的网元中存储的数据，确定第一SMF。其中，用于集中存储的网元可以为UDM、UDR或PCF等。
另一种实现方式为：第二UPF本地存储了第三识别信息与第一SMF的映射关系，第 二UPF根据接收到的第三识别信息以及该映射关系，确定第一SMF。
可选地，若第二UPF未向第一SMF发送第一用户标识信息，第一SMF需要根据第二用户标识信息从其他存储了第一用户标识信息和第二用户标识信息的映射关系网元获取第一用户标识信息。这些网元可以是第二SMF、AMF、UDM、UDR或PCF等网元。
以第一SMF从AMF获取第一用户标识信息为例。
1)首先，第一SMF向AMF发送消息，消息可以是N11消息，该消息用于请求AMF将第二用户标识信息对应的第一用户标识信息发送给第一SMF，该消息包括第二用户标识信息。可选地，该消息还可以包括第一识别信息或第二识别信息。需要说明的是，该消息携带的第二用户标识信息可以是用户的永久标识信息或者用户的临时标识信息。还需要说明的是，第一SMF向AMF发送的第二用户标识信息与第二UPF向第一SMF发送的第二用户标识信息可能不同，第二UPF向第一SMF发送的第二用户标识信息可以是用户的永久标识信息或是用户的临时标识信息，第一SMF向AMF发送的第二用户标识信息可以是用户的永久标识信息或用户的临时标识信息，两者无依赖关系。例如，第二UPF提供的是用户的临时标识信息，第一SMF根据用户的临时标识信息，确定对应的AMF并从AMF获取用户的永久标识信息，此后第一SMF通过向AMF发送用户的永久标识信息从AMF处获取第一用户标识信息。
2)之后，AMF向第一SMF发送消息，消息可以是N11消息，该消息用于向第一SMF返回第二用户标识信息对应的第一用户标识信息。可选地，该消息还可以包括第一识别信息或第二识别信息。
在第一SMF获取到第一用户标识信息和第一识别信息后，可以向应用服务器发送第一消息，请求应用服务器执行鉴权授权操作。该第一消息包括第一用户标识信息和设备信息。
需要说明的还是，图7中的第一识别信息、第二识别信息和第三识别信息的详细描述，可以参见图5中的相关描述，在此不再赘述。
步骤804-816与图5中的步骤504-516相同或类似，可以参考步骤504-516的相关描述，在此不再赘述。
在上述各技术方案中，第一SMF将第一用户标识信息和多播数据的识别信息发送给应用服务器，由应用服务器执行用户设备加入群组时的鉴权操作，从而可以实现对用户设备的加入请求进行鉴权。此外，在本方案中无需应用服务器向核心网实时提供明确的多播群组的成员信息，可以在核心网没有多播群组的成员信息的情况下实现针对用户设备加入群组时的鉴权操作，有助于避免产生公共安全问题。
图9是本申请另一实施例提供的鉴权方法的示意性流程图。图9所示的方法可以应用于图1所示的系统架构，也可以应用于图3所示的系统架构，本申请实施例不限于此。
图9中的方法可以由用户设备、网络设备和应用服务器执行，也可以由用户设备、网络设备和应用服务器中的模块或单元(例如，电路、芯片或SOC等)执行，图9中以执行主体为用户设备、网络设备和应用服务器为例。图9中的方法可以包括以下内容的至少部分内容。
在步骤901中，用户设备向网络设备发送第四消息，第四消息用于请求加入多播群组。第四消息包括多播数据的识别信息和第一安全信息。相应地，网络设备接收来自用户设备 的第四消息。
多播数据的识别信息与用户设备请求加入的多播群组对应，可以包括多播数据对应的多播群组的TMGI、提供多播数据的应用服务器的IP地址、多播数据的业务标识、多播数据的分组过滤信息、多播数据的SDF识别规则、用于传输多播数据的多播PDU会话的ID、应用的ID信息、多播数据的目标IP地址信息、以及多播群组对应的多播会话的上下文标识信息中的至少一个。为了描述方便，下文将多播数据的识别信息简称为识别信息。
第一安全信息用于对用户设备的加入请求进行鉴权授权操作。
可选地，第一安全信息可以为口令信息。例如，第一安全信息可以为某个具体的暗号。
可选地，第一安全信息可以为安全算法的输入信息。
可选地，第一安全信息可以是安全算法。
可选地，上述网络设备为核心网设备。例如，第一SMF、第二SMF、UDR、AMF、NEF或UDM等。
可选地，上述网络设备为接入网设备。
在步骤902中，网络设备根据第一安全信息和第二安全信息进行鉴权授权操作。
其中，第二安全信息用于对用户设备的加入请求进行鉴权授权操作。
可选地，第二安全信息同样可以为口令信息或安全算法。
可选地，第二安全信息可以保存在第一SMF本地。
在一些实现方式中，网络设备在接收到用户设备发送的第一安全信息和识别信息后，可以根据识别信息，确定第二安全信息，进一步地，根据第一安全信息和第二安全信息进行鉴权授权操作。
具体地，网络设备确定第一安全信息和第二安全信息是否匹配。若二者相匹配，则网络设备确定鉴权成功；否则网络设备确定鉴权失败。
在本申请实施例中，根据第一安全信息和第二安全信息的不同形式，网络设备确定二者是否匹配的方式也不同。
作为一个示例，若第一安全信息和第二安全信息为口令信息，当第一安全信息与第二安全信息相同时，网络设备确定第一安全信息和第二安全信息相匹配，否则二者不匹配。
作为另一个示例，若第一安全信息和第二安全信息为安全算法，当第一安全信息和第二安全信息生成正确结果时，网络设备确定第一安全信息和第二安全信息相匹配，否则二者不匹配。
本申请实施例对于用户设备获取第一安全信息的方式和网络设备获取第二安全信息的方式不作具体限定。
在一些实现方式中，用户设备和网络设备可以通过步骤903-905获取相应的安全信息。
具体地，在步骤903中，应用服务器生成第一安全信息和第二安全信息。
在步骤904中，应用服务器向用户设备发送第一安全信息。相应地，用户设备接收应用服务器发送的第一安全信息。
可选地，应用服务器可以通过应用层消息向用户设备发送第一安全信息。
在步骤905中，应用服务器向网络设备发送第二安全信息。相应地，网络设备接收应用服务器发送的第二安全信息。
可选地，应用服务器还可以向网络设备发送第一信息，第一信息用于确定与第二安全 信息对应的识别信息。
例如，第一信息可以为上述的识别信息。
又例如，第一信息为用于获取识别信息的信息，例如该信息可以是一个数值，第一SMF可以根据该信息进一步获取识别信息。可选地，该数值可以为事务ID(transaction ID)等。
再例如，应用服务器可以向NEF网元提供第一信息，NEF网元可以根据第一信息，获取识别信息，识别信息的可能的形式在上文中已经描述，此处不予赘述。NEF网元可以进一步地，向网络设备发送识别信息。
可选地，网络设备在接收到第二安全信息后可以存储该第二安全信息。可选地，网络设备存储还可以对应地存储与第二安全信息对应的识别信息。
需要说明的是，若应用服务器分别针对多个多播群组中每个多播群组生成了第一安全信息和第二安全信息，应用服务器可以向用户设备发送该多个多播群组中的至少部分多播群组对应的第一安全信息，同样，可以向网络设备发送该多个多播群组中的至少部分多播群组对应的第二安全信息。当需要加入某个多播群组时，用户设备采用与该多播群组对应的第一安全信息。
这样，在本申请实施例中，应用服务器可以向用户设备和网络设备提供用于鉴权的安全信息，可以由网络设备根据安全信息执行用户设备加入群组时的鉴权操作，从而可以实现对用户设备的加入请求进行鉴权。此外，在本方案中无需应用服务器向核心网实时提供明确的多播群组的成员信息，可以在核心网没有多播群组的成员信息的情况下实现针对用户设备加入群组时的鉴权操作，有助于避免产生公共安全问题。
下面结合图10-图13对本申请实施例进行详细描述。
1)网络设备为核心网设备
图10是本申请实施例的另一鉴权方法的示意性流程图。图10所示的方法可以应用于图1所示的系统架构，也可以应用于图3所示的系统架构，本申请实施例不限于此。
在本申请实施例中，由第一SMF进行鉴权授权操作。
在步骤1001中，用户设备向第一SMF发送第四消息，第四消息用于请求加入多播群组。第四消息包括识别信息和第一安全信息，识别信息与用户设备请求加入的多播群组对应。相应地，第一SMF接收来自用户设备的第四消息。
其中，第一安全信息用于对用户设备的加入请求进行鉴权授权操作。
可选地，第一安全信息可以为口令信息。例如，第一安全信息可以为某个具体的暗号。
可选地，第一安全信息可以为安全算法的输入信息。
可选地，第一安全信息可以是安全算法。
在一些实施例中，用户设备可以通过控制面信令，并通过控制面网元向第一SMF发送第一请求消息。具体地，可以参见图5和图7中用户设备向第一SMF发送信息的方式，在此不再赘述。
在另一些实施例中，用户设备可以通过用户面信令，并通过用户面网元向第一SMF发送第一请求消息。具体地，可以参见图6和图8中用户设备向第一SMF发送信息的方式，同样在此不再赘述。
在步骤1002中，第一SMF根据第一安全信息和第二安全信息的匹配结果，处理用户 设备的加入请求。
具体地，当第一安全信息和第二安全信息相匹配时，第一SMF继续处理用户设备的加入请求，并执行步骤1003，即完成用户设备加入多播群组的后续流程。当第一安全信息和第二安全信息不匹配时，第一SMF停止处理用户设备的加入请求，并向用户设备返回鉴权失败的指示。
另一种可能的实现方式是，当第一安全信息和第二安全信息相匹配时，第一SMF继续处理用户设备的加入请求，并执行步骤1003，即完成用户设备加入多播群组的后续流程。当第一安全信息和第二安全信息不匹配时，第一SMF通知第二SMF为用户设备建立单播的传输资源，此单播的传输资源用于传输多播的下行数据。
其中，第二安全信息用于对用户设备的加入请求进行鉴权授权操作。
可选地，第二安全信息同样可以为口令信息或安全算法。
可选地，第二安全信息可以保存在第一SMF本地。
可选地，第二安全信息保存在UDM或UDR中，当第一SMF接收到用户设备的加入请求时，根据加入请求，从UDM或UDR获取第二安全信息。
在本申请实施例中，根据第一安全信息和第二安全信息的不同形式，第一SMF确定二者是否匹配的方式也不同。
作为一个示例，若第一安全信息和第二安全信息为口令信息，当第一安全信息与第二安全信息相同时，第一SMF确定第一安全信息和第二安全信息相匹配，否则二者不匹配。
作为另一个示例，若第一安全信息和第二安全信息为安全算法，当第一安全信息和第二安全信息生成正确结果时，第一SMF确定第一安全信息和第二安全信息相匹配，否则二者不匹配。
本申请实施例对于用户设备获取第一安全信息的方式和第一SMF获取第二安全信息的方式不作具体限定。
在一些实现方式中，用户设备和第一SMF可以通过步骤1004-1008获取相应的安全信息。
具体地，在步骤1004中，在与用户设备建立应用层连接后，应用服务器生成第一安全信息和第二安全信息。
在步骤1005中，应用服务器向用户设备发送第一安全信息。相应地，用户设备接收应用服务器发送的第一安全信息。
可选地，应用服务器可以通过应用层消息向用户设备发送第一安全信息。
另一种可能的实现方式是，应用服务器可以向NEF发送第一安全信息，相应地，NEF接收应用服务器发送的第一安全信息。进一步地，NEF向UDR发送第一安全信息，相应地，UDR从NEF接收第一安全信息。UDR在接收到第一安全信息后，向PCF发送第一安全信息，相应地，PCF接收第一安全信息。此后，PCF将接收的第一安全信息通过非接入层(Non Access Stratum，NAS)消息，经过AMF发送给UE。
在步骤1006中，应用服务器向NEF发送第二安全信息。相应地，NEF接收应用服务器发送的第二安全信息。
可选地，应用服务器可以调用Nnef_ParameterProvisionCreate Request向NEF发送第二安全信息。
可选地，应用服务器还可以向NEF发送第一信息，第一信息用于确定与第二安全信息对应的识别信息。
例如，第一信息可以为上述的识别信息。
又例如，第一信息为用于获取识别信息的信息，例如该信息可以是一个数值，第一SMF可以根据该信息进一步获取识别信息。可选地，该数值可以为事务ID等。
在步骤1007中，NEF向UDM或UDR发送第二安全信息。相应地，UDM或UDR接收NEF发送的第二安全信息。
可选地，NEF还可以向UDM或UDR发送识别信息。
需要说明的是，第一信息为用于获取识别信息的信息时，NEF可以在在接收到第一信息后，根据第一信息获取识别信息。一种实现方式为，NEF根据用于获取识别信息的信息与识别信息的映射关系，获取识别信息。可选地，NEF可以在本地存储该映射关系。例如，通过预配置的方式为NEF配置该映射关系。又例如，NEF可以从具备数据存储功能的网元(例如，UDR或UDM)处获取该映射关系。
UDM或UDR在接收到NEF发送的第二安全信息后存储该第二安全信息。可选地，UDM存储还可以对应地存储与第二安全信息对应的识别信息。
可选地，在存储上述各信息之前，UDM或UDR还可以针对识别信息进行鉴权，判断是否可以存储上述各信息。例如，UDM或UDR根据本地是否存储了识别信息对应的授权信息，进行鉴权。又例如，如果是UDM网元从NEF接收第二安全信息，UDM可以进一步地从UDR获取用于进行鉴权信息，并进一步判断获取到的用于鉴权的信息中是否包含识别信息对应的授权信息。又例如，若果是UDR网元从NEF接收第二安全信息，UDM可以将识别信息发送给UDR，由UDR进行鉴权，UDM在从UDR获取鉴权的结果信息。
在步骤1008中，UDM向第一SMF发送第二安全信息。相应地，第一SMF接收UDM发送的第二安全信息。
可选地，UDM或UDR还可以向第一SMF发送与第二安全信息对应的识别信息。
可选地，UDM或UDR可以通过Nudm_SDM_Notification Notify消息或Nudr_DM_Notify消息发送上述各信息。
在接收到第二安全信息后，第一SMF存储第二安全信息，以便后续对用户设备的加入请求进行鉴权授权操作。
图11是本申请实施例的另一鉴权方法的示意性流程图。图11所示的方法可以应用于图1所示的系统架构，也可以应用于图3所示的系统架构，本申请实施例不限于此。
在本申请实施例中，由UDM或UDR进行鉴权授权操作。
在步骤1101中，用户设备向第二SMF发送第四消息，第四消息用于请求加入多播群组。第四消息包括识别信息和第一安全信息，识别信息与用户设备请求加入的多播群组对应。相应地，第二SMF接收来自用户设备的第四消息。
其中，第一安全信息用于对用户设备的加入请求进行鉴权授权操作。
可选地，第一安全信息可以为口令信息。例如，第一安全信息可以为某个具体的暗号。
可选地，第一安全信息可以为安全算法的输入信息。
可选地，第一安全信息可以是安全算法。
在一些实施例中，用户设备可以通过控制面信令，并通过控制面网元向第二SMF发 送第四消息。具体地，可以参见图5中用户设备向第二SMF发送信息的方式，在此不再赘述。
在另一些实施例中，用户设备可以通过用户面信令，并通过用户面网元向第二SMF发送第四消息。具体地，可以参见图6中用户设备向第二SMF发送信息的方式，同样在此不再赘述。
在步骤1102中，第二SMF向UDM或UDR发送第四消息，相应地，UDM或UDR接收第四消息。第四消息包括第一安全信息和识别信息。
可选地，第二SMF可以在用于查询第一SMF的相关信息的消息中携带第一安全信息和识别信息。
在步骤1103中，UDM或UDR根据第一安全信息和第二安全信息进行鉴权授权。
其中，第二安全信息用于对用户设备的加入请求进行鉴权授权操作。
可选地，第二安全信息同样可以为口令信息或安全算法。
可选地，第二安全信息可以保存在UDM或UDR本地。
可选地，UDM或UDR确定第一安全信息与第二安全信息是否匹配。若二者相匹配，则UDM或UDR确定鉴权成功；否者UDM或UDR确定鉴权失败。
在本申请实施例中，根据第一安全信息和第二安全信息的不同形式，UDM或UDR确定二者是否匹配的方式也不同。
作为一个示例，若第一安全信息和第二安全信息为口令信息，当第一安全信息与第二安全信息相同时，UDM或UDR确定第一安全信息和第二安全信息相匹配，否则二者不匹配。
作为另一个示例，若第一安全信息为安全算法的输入信息和第二安全信息为安全算法，当第一安全信息和第二安全信息生成正确结果时，UDM或UDR确定第一安全信息和第二安全信息相匹配，否则二者不匹配。
在步骤1104中，UDM或UDR向第二SMF返回鉴权操作的结果信息。相应地，第二SMF接收UDM发送的结果信息。
在一种实现方式中，若结果信息指示鉴权成功，则可以执行步骤1003，即完成用户设备加入多播群组的后续流程。若结果信息指示鉴权失败，则停止处理用户设备的加入请求，并向用户设备返回鉴权失败的指示。
在另一种实现方式中，若结果信息指示鉴权成功，则可以执行步骤1003，即完成用户设备加入多播群组的后续流程。若结果信息指示鉴权失败，则可以为用户设备建立单播的传输资源，此单播的传输资源用于传输多播的下行数据。
本申请实施例对于用户设备获取第一安全信息的方式和UDM或UDR获取第二安全信息的方式不作具体限定。
在一些实现方式中，用户设备和UDM或UDR可以通过步骤1106-1111获取相应的安全信息。
具体地，在步骤1106中，应用服务器生成第一安全信息和第二安全信息。
在步骤1107中，应用服务器向用户设备发送第一安全信息。相应地，用户设备接收应用服务器发送的第一安全信息。
可选地，应用服务器可以通过应用层消息向用户设备发送第一安全信息。
在步骤1108中，应用服务器向PCF发送第二安全信息。相应地，PCF接收应用服务器发送的第二安全信息。
可选地，应用服务器可以通过N5消息或Rx消息向PCF发送第二安全信息。
可选地，应用服务器可以通过NEF向PCF发送第二安全信息。
可选地，应用服务器还可以向PCF发送第一信息，第一信息用于确定与第二安全信息对应的识别信息。
例如，第一信息为上述的识别信息。
又例如，第一信息为用于获取识别信息的信息，例如该信息可以是一个数值，第一SMF可以根据该信息进一步获取识别信息。可选地，该数值可以为事务ID(transaction ID)等。
可选地，应用服务器还可以向PCF发送应用服务器的数据网络接入标识(data network access identifier，DNAI)信息。DNAI信息用于指示数据产生的位置信息。
在步骤1109中，PCF向UDM或UDR发送第二安全信息，以便UDM或UDR存储第二安全信息。
可选地，PCF还可以向UDM或UDR发送识别信息。
可选地，步骤1109还可以替换为步骤1110-1112，即PCF通过第一SMF向UDM或UDR存储第二安全信息。
具体地，在步骤1110中，NEF或PCF确定第一SMF。
作为一个示例，NEF或PCF根据SMF的能力信息，选择支持多播功能的第一SMF。
作为另一个示例，NEF或PCF根据SMF当前的负载情况，选择支持多播功能的第一SMF。
作为又一个示例，NEF或PCF根据SMF所能管理的UPF的覆盖范围，并结合DNAI信息，选择支持多播功能的第一SMF。
需要说明的是，上述示例可以结合，比如，NEF或PCF根据SMF所能管理的UPF的覆盖范围，以及SMF当前的负载情况，以及SMF是否支持多播会话管理，选择支持多播功能的第一SMF。
在步骤1111中，NEF或PCF向第一SMF发送第二安全信息。相应地，第一SMF接收NEF或PCF发送的第二安全信息。
可选地，NEF或PCF可以通过用于请求建立多播上下文的消息发送第二安全信息。
可以理解地，NEF或PCF向第一SMF发送识别信息和应用服务器的标识信息的方式与发送第二安全信息的方式相同或类似，不再赘述。
需要说明的是，第一信息为用于获取识别信息的信息时，NEF或PCF可以在接收到第一信息后，根据第一信息获取识别信息。一种实现方式为，NEF或PCF根据用于获取识别信息的信息与识别信息的映射关系，获取识别信息。可选地，NEF或PCF可以在本地存储该映射关系。例如，通过预配置的方式为NEF或PCF配置该映射关系。又例如，NEF或PCF可以从具备数据存储功能的网元(例如，UDR或UDM)处获取该映射关系。
UDM或UDR在接收到PCF发送的第二安全信息后存储该第二安全信息。
可选地，UDM或UDR存储还可以对应地存储与第二安全信息对应的识别信息。
可选地，UDM或UDR存储还可以存储第一SMF的标识信息。
图12是本申请实施例的另一鉴权方法的示意性流程图。图12所示的方法可以应用于图1所示的系统架构，也可以应用于图3所示的系统架构，本申请实施例不限于此。
在本申请实施例中，由第一SMF或UDM进行鉴权授权操作。
在步骤1201中，用户设备向第二SMF发送第四消息，第四消息用于请求加入多播群组。第四消息包括识别信息和第一安全信息，识别信息与用户设备请求加入的多播群组对应。相应地，第二SMF接收来自用户设备的第四消息。
其中，第一安全信息用于对用户设备的加入请求进行鉴权授权操作。
可选地，第一安全信息可以为口令信息。例如，第一安全信息可以为某个具体的暗号。
可选地，第一安全信息可以为安全算法的输入信息。
可选地，第一安全信息可以是安全算法。
在一些实施例中，用户设备可以通过控制面信令，并通过控制面网元向第二SMF发送第四消息。具体地，可以参见图5中用户设备向第二SMF发送信息的方式，在此不再赘述。
在另一些实施例中，用户设备可以通过用户面信令，并通过用户面网元向第二SMF发送第四消息。具体地，可以参见图6中用户设备向第二SMF发送信息的方式，同样在此不再赘述。
在步骤1202中，第二SMF向第一SMF发送第四消息，相应地，第一SMF接收第四消息。第四消息包括第一安全信息和识别信息。
可选地，执行步骤1102之前，第二SMF可以确定第一SMF。一种实现方式为第二SMF根据识别信息，通过查询用于集中存储的网元中存储的数据，确定第一SMF。其中，用于集中存储的网元可以为UDM、UDR或PCF等。例如，如图12中的步骤1203所示，第二SMF向UDM或UDR获取第一SMF的相关信息。
在步骤1204中，第一SMF根据第一安全信息和第二安全信息进行鉴权授权操作。
在一些实现方式中，若鉴权成功，则可以执行步骤1214，即完成用户设备加入多播群组的后续流程。若鉴权失败，则停止处理用户设备的加入请求，并向用户设备返回鉴权失败的指示。
在另一些实现方式中，若鉴权成功，则可以执行步骤1214，即完成用户设备加入多播群组的后续流程。若鉴权失败，则可以为用户设备建立单播的传输资源，此单播的传输资源用于传输多播的下行数据。
其中，第二安全信息用于对用户设备的加入请求进行鉴权授权操作。
可选地，第二安全信息同样可以为口令信息或安全算法。
可选地，第二安全信息可以保存在第一SMF本地。
可选地，若第一SMF中没有第二安全信息或存储的第二安全信息已经失效，第一SMF可以从UDM或UDR获取最新的第二安全信息。
例如，如步骤1205和步骤1213所示，第一SMF向UDR或UDM发送识别信息，UDR或UDM根据识别信息确定第二安全信息并反馈给第一SMF。
可选地，第一SMF确定第一安全信息与第二安全信息是否匹配。若二者相匹配，则第一SMF确定鉴权成功；否者第一SMF确定鉴权失败。
在本申请实施例中，根据第一安全信息和第二安全信息的不同形式，第一SMF确定 二者是否匹配的方式也不同。
作为一个示例，若第一安全信息和第二安全信息为口令信息，当第一安全信息与第二安全信息相同时，第一SMF确定第一安全信息和第二安全信息相匹配，否则二者不匹配。
作为另一个示例，若第一安全信息为安全算法的输入信息和第二安全信息为安全算法，当第一安全信息和第二安全信息生成正确结果时，第一SMF确定第一安全信息和第二安全信息相匹配，否则二者不匹配。
可以理解地，若在图12所示的鉴权方法的基础上将由第一SMF进行鉴权授权操作替换为由UDM或UDR进行鉴权授权操作，一种可能的方式为在步骤1205中第一SMF向UDM或UDR发送第一安全信息和识别信息，由UDM或UDR根据第一安全信息和第二安全信息进行鉴权授权操作，并在步骤1213中向第一SMF返回结果信息。
在本申请实施例中，用户设备获取第一安全信息的方式和UDM或UDR获取第二安全信息的方式与图11中相同或类似，因此关于步骤1206-1212的详细描述可以参考步骤1106-1112的相关描述，再此不再赘述。
2)网络设备为接入网设备
图13是本申请实施例的另一鉴权方法的示意性流程图。图13所示的方法可以应用于图1所示的系统架构，也可以应用于图3所示的系统架构，本申请实施例不限于此。
在本申请实施例中，由接入网设备进行鉴权授权操作。
在步骤1301中，用户设备向接入网设备发送第四消息，第四消息用于请求加入多播群组。第四消息包括识别信息和第一安全信息，识别信息与用户设备请求加入的多播群组对应。相应地，第二SMF接收来自用户设备的第四消息。
可选地，第四消息为RRC消息。
在步骤1302中，接入网设备根据第一安全信息和第二安全信息进行鉴权授权操作。
可选地，接入网设备确定第一安全信息与第二安全信息是否匹配。若二者相匹配，则接入网设备确定鉴权成功，可以继续执行步骤1303，即完成用户设备加入多播群组的后续流程；否者接入网设备确定鉴权失败。
在本申请实施例中，根据第一安全信息和第二安全信息的不同形式，接入网设备确定二者是否匹配的方式也不同。
作为一个示例，若第一安全信息和第二安全信息为口令信息，当第一安全信息与第二安全信息相同时，接入网设备确定第一安全信息和第二安全信息相匹配，否则二者不匹配。
作为另一个示例，若第一安全信息为安全算法的输入信息和第二安全信息为安全算法，当第一安全信息和第二安全信息生成正确结果时，接入网设备确定第一安全信息和第二安全信息相匹配，否则二者不匹配。
可选地，鉴权授权操作之后，接入网设备可以向用户设备反馈鉴权的结果信息。例如，可以通过RRC消息反馈结果信息。
可选地，在步骤1302之前，接入网设备可以执行步骤1304，即接入网设备根据识别信息检查本地是否存在第二安全信息。若接入网设备本地存在第二安全信息，则可以执行步骤1302；若接入网设备本地未存储第二安全信息或第二安全信息已经失效，则接入网设备可以向核心网设备获取第二安全信息。
当接入网设备本地未存储第二安全信息或第二安全信息已经失效时，接入网设备执行 步骤1305，即接入网设向第一AMF发送第六消息，向第一AMF通知用户设备请求加入多播群组。该第六消息中可以包括识别信息。其中，第一AMF为对多播群组中的用户设备进行移动性管理和接入控制的网元。
在步骤1306中，在接收到接入网设备发送的第六消息后，第一AMF可以根据识别信息检查本地是否存在第二安全信息。若第一AMF本地存在第二安全信息，则AMF可以向接入网设备返回第二安全信息；若第一AMF本地未存储第二安全信息或第二安全信息已经失效，则第一AMF可以向第一SMF、UDM或UDR获取第二安全信息。
在步骤1307中，第一AMF向第一SMF、UDM或UDR发送第七消息，第七消息包括用户设备请求加入多播群组的信息。一种可能的实现方式是，用户设备请求加入多播群组的信息可以是用户设备的标识信息(例如SUPI)和识别信息。
在步骤1308中，第一SMF、UDM或UDR根据识别信息确定与识别信息对应的第二安全信息，并返回给第一AMF。
在步骤1309中，第一AMF将获取到的第二安全信息返回给接入网设备，以便接入网设进行鉴权授权操作。
可选地，第一SMF、UDM或UDR在向第一AMF反馈第二安全信息之前，还可以根据第一安全信息确定是否需要向接入网设备发送第二安全信息。此时，在第六息和第七消息中需要携带第一安全信息。
在本申请实施例中，用户设备获取第一安全信息的方式和第一SMF获取第二安全信息的方式与图10-图12中相同或类似，因此关于步骤1311-1313的详细描述可以参考步骤图10-图12的相关描述，再此不再赘述。
下文将用于管理多播PDU会话的SMF网元统一称为第一SMF，将用于管理单播PDU会话的SMF网元统一称为第二SMF。
图14是本申请另一实施例提供的鉴权方法的示意性流程图。图14所示的方法可以应用于图1所示的系统架构，也可以应用于图3所示的系统架构，本申请实施例不限于此。图14所示的方法包括以下内容的至少部分内容。
步骤1401，用户设备向第二SMF发送第一加入请求。
其中，所述第一加入请求用于请求加入第一多播会话。所述第一加入请求包括第四识别信息，所述第四识别信息与所述第一多播会话对应。其中，所述第四识别信息可以包括多播数据对应的多播群组的临时移动组标识(temporary mobile group identifier，TMGI)、提供多播数据的应用服务器的IP地址、多播数据的业务标识(service identifier，service ID)、多播数据的分组过滤(packet filter)信息、多播数据的业务数据流(service data flow，SDF)识别规则、用于传输多播数据的多播PDU会话的ID、应用的ID信息(Application ID)、多播数据的目标IP地址信息(例如，IP multicast address)、以及多播群组对应的多播会话的上下文标识信息(Multicast Session Context ID)中的至少一个。
步骤1402，第二SMF向第一核心网设备发送第十消息。
其中，所述第十消息包括所述用户设备的第三用户标识信息和所述第四识别信息，所述第三用户标识信息和所述第四识别信息用于获取确定是否允许所述用户设备加入所述第一多播会话。其中，第三用户标识信息可以是通过第一加入请求获取的，例如第一加入请求包括所述第三用户标识信息，又例如第二SMF根据本地配置信息第一加入请求对应 的第三用户标识信息。
上述第一核心网设备可以是PCF或UDM。
步骤1403，第一核心网设备接收来自UDR的允许加入所述第一多播会话的用户设备的信息。
一种可能的实现方式，图14所示的方法还包括：所述第一核心网设备向所述UDR发送第一查询消息，所述第一查询消息用于查询所述允许加入所述第一多播会话的用户设备的信息；步骤1403包括：第一核心网设备接收来自所述UDR的第一响应消息，所述第一响应消息包括所述允许加入所述第一多播会话的用户设备的信息。
步骤1404，第一核心网设备向第二SMF发送第一指示信息。
其中，第一指示信息用于指示是否允许所述用户设备加入所述第一多播会话。
一种可能的实现方式，第一核心网设备根据所述第十消息和所述允许加入所述第一多播会话的用户设备的信息，向所述第二会话管理功能网元发送第一指示信息。具体地，当所述允许加入所述第一多播会话的用户设备的信息包括所述第三用户标识信息时，所述第一指示信息指示允许所述用户设备加入所述第一多播会话；或，当所述允许加入所述第一多播会话的用户设备的信息不包括所述第三用户标识信息时，所述第一指示信息指示不允许所述用户设备加入所述第一多播会话。
步骤1405，当所述第一指示信息指示允许所述用户设备加入所述第一多播会话时，所述第二SMF接受所述第一加入请求。
一种可能的实现方式，当所述第一指示信息指示允许所述用户设备加入所述第一多播会话时，所述第二SMF通过NRF选取第一SMF，并继续后续的加入流程。
步骤1406，当所述第一指示信息指示不允许所述用户设备加入所述第一多播会话时，所述第二SMF拒绝所述第一加入请求。
一种可能的实现方式，当所述第一指示信息指示不允许所述用户设备加入所述第一多播会话时，所述第二SMF向用户设备或AMF发送拒绝加入请求信息(reject join request)。
下面结合图15对图14所示的方法进行详细描述。图15是本申请另一实施例提供的鉴权方法的示意性流程图。图15所示的方法可以应用于图1所示的系统架构，也可以应用于图3所示的系统架构，本申请实施例不限于此。
图15中的方法可以由用户设备、第一SMF、第二SMF、PCF/UDM、UDR、NEF/MBSF-C和AF执行，也可以由用户设备、第一SMF、第二SMF、PCF/UDM、UDR、NEF/MBSF-C和AF中的模块或单元(例如，电路、芯片或SOC等)执行，图15中以执行主体为用户设备、第一SMF、第二SMF、PCF/UDM、UDR、NEF/MBSF-C和AF为例。图15中的方法可以包括以下内容的至少部分内容。
步骤1501，AF向NEF或MBSF-C发送第一配置请求消息。相应地，NEF或MBSF-C接收来自AF的第一配置请求消息。
其中，第一配置请求消息用于为多播业务配置多播会话。第一配置请求消息包括多播会话的第四识别信息，该第四识别信息可以包括多播数据对应的多播群组的临时移动组标识(temporary mobile group identifier，TMGI)、提供多播数据的应用服务器的IP地址、多播数据的业务标识(service identifier，service ID)、多播数据的分组过滤(packet filter)信息、多播数据的业务数据流(service data flow，SDF)识别规则、用于传输多播数据的 多播PDU会话的ID、应用的ID信息(Application ID)、多播数据的目标IP地址信息(例如，IP multicast address)、以及多播群组对应的多播会话的上下文标识信息(Multicast Session Context ID)中的至少一个。为了描述方便，下文将多播数据的第四识别信息简称为第四识别信息。
可选地，第一配置请求消息还可以包括第一用户设备列表，该第一用户设备列表可以为允许使用该第四识别信息对应的多播业务的用户设备的列表。由于第一配置请求消息用于为多播业务配置多播会话，因此，第一用户设备列表也可以描述为允许加入该第四识别信息对应的多播会话的用户设备的列表。例如，第一用户设备列表为allowed UE list。
一种可能的实现方式，AF可以向NEF或MBSF-C发送MBS预配置请求消息(MBS preconfiguration request)。
步骤1502，NEF或MBSF-C将第一配置请求消息中的第四识别信息存储在UDR中。
可选地，若第一配置请求消息还包括第一用户设备列表，NEF或MBSF-C也将该第一用户设备列表存储在UDR中。
步骤1503，NEF或MBSF-C向AF发送第一配置响应消息。相应地，AF接收来自NEF或MBSF-C的第一配置响应消息。
一种可能的实现方式，NEF或MBSF-C可以向AF发送MBS预配置响应消息(MBS preconfiguration response)。
需要说明的是，步骤1501-1503为可选步骤，上述第四识别信息和/或第一用户设备列表也可以由运营商配置在UDR中。通过步骤1501-1503，AF可以根据业务情况及时存储、更新或移除UDR中存储的第一用户设备列表，方案更加灵活。
步骤1504，AF向用户设备发送第八消息。相应地，用户设备接收来自AF的第八消息。
其中，第八消息用于通知用户设备发起针对第四识别信息对应的多播会话的加入请求(join request)。第八消息中携带第四识别信息。AF可以通过应用层信令发送第八消息。
一种可能的实现方式，AF向用户设备发送业务声明消息(service announcement)。
步骤1505，用户设备向第二SMF发送第一加入请求。相应地，第二SMF接收来自用户设备的第一加入请求。
其中，第一加入请求用于请求加入第四识别信息对应的多播会话。第一加入请求携带第四识别信息。
例如，用户设备在检测到应用层发出的针对第四识别信息的IGMP加入消息等时向第二SMF发送第一加入请求。
可选地，第一加入请求可以为IGMP加入请求消息或MLR消息。
一种可能的实现方式，用户设备向第二SMF发送MBS会话加入请求消息(MBS session join request)。
步骤1506，第二SMF向PCF或UDM发送第十消息。相应地，PCF或UDM接收来自第二SMF的第十消息。
其中，第十消息用于请求对该用户设备的加入请求进行鉴权。第十消息携带第四识别信息和该用户设备的第三用户标识信息(下文简称第三用户标识信息)。
一种可能的实现方式，第二SMF向PCF或UDM发送MBS策略查询消息(MBS policy  query)。
步骤1507，PCF或UDM向UDR发送第一查询消息。相应地，UDR接收来自PCF或UDM的第一查询消息。
其中，第一查询消息用于查询第四识别信息对应的存储信息。第一查询消息携带第四识别信息。
一种可能的实现方式，PCF或UDM向UDR发送Nudr_DM_Query。
步骤1508，UDR向PCF或UDM发送第一响应消息。相应地，PCF或UDM接收来自UDR的第一响应消息。
其中，第一响应消息包括第四识别信息对应的存储信息，该存储信息可以包括第一用户设备列表。例如，存储信息可以为第四识别信息对应的数据集，存储信息的索引可以为第四识别信息，存储信息可以包含用户设备列表、QoS需求等。
一种可能的实现方式，PCF或UDM接收来自UDR的Nudr_DM_Response。
步骤1509，PCF或UDM根据获取到的存储信息，确定第四识别信息对应的多播业务是否可用多播会话传输以及第三用户标识信息所标识的用户设备是否可以加入第四识别信息对应的多播会话。
一种可能的实现方式，当第三用户标识信息所标识的用户设备在第一用户设备列表中时，PCFF或UDM确定第三用户标识信息所标识的用户设备可以加入第四识别信息对应的多播会话。
若第四识别信息对应的多播业务可用多播会话传输且第三用户标识信息所标识的用户设备的可以加入第四识别信息对应的多播会话，PCF或UDM可以向第二SMF指示允许用户设备加入第四识别信息对应的多播会话，或者指示第四识别信息对应的多播会话可用(MBS session available)。
若第四识别信息对应的多播业务不可用多播会话传输和/或第三用户标识信息所标识的用户设备不可加入第四识别信息对应的多播会话，PCF或UDM可以向第二SMF指示不允许用户设备加入第四识别信息对应的多播会话，或者指示第四识别信息对应的多播会话不可用(MBS session unavailable)。
步骤1510，PCF或UDM向第二SMF发送第一指示信息。相应地，第二SMF接收来自PCF或UDM的第一指示信息。
其中，第一指示信息用于指示是否允许用户设备加入第四识别信息对应的多播会话，或者指示指示第四识别信息对应的多播会话是否可用。
一种可能的实现方式，PCF或UDM向第二SMF发送MBS策略响应消息(MBS policy response)。
若第一指示信息指示不允许用户设备加入第四识别信息对应的多播会话，第二SMF可以执行步骤1511。若第一指示信息指示允许用户设备加入第四识别信息对应的多播会话，第二SMF可以执行步骤1512-1515。
步骤1511，第二SMF拒绝该用户设备的第一加入请求。
后续第二SMF可能向用户设备或AMF指示拒绝该用户设备的第一加入请求。
步骤1512，第二SMF接受该用户设备的第一加入请求，并通过NRF选取第一SMF。
步骤1513，第二SMF向第一SMF发送第二查询消息。相应地，第一SMF接收来自 第二SMF的第二查询消息。
其中，第二查询消息用于查询第四识别信息的信息。第二查询消息包括第四识别信息。
其中，第四识别信息的信息可以包括第四识别信息对应的多播业务的QoS相关的信息，用于建立和配置多播会话。
一种可能的实现方式，第二SMF向第一SMF发送Nmbsmf_information_request。
步骤1514，第一SMF向第二SMF发送第二响应消息。相应地，第二SMF接收来自第一SMF的第二响应消息。
其中，第二响应消息包括第四识别信息的信息。
一种可能的实现方式，第一SMF向第二SMF发送Nmbsmf_information_response。
步骤1515，用户设备加入多播群组的后续流程。
在图15所示的方法中，可以将第四识别信息对应的多播会话可用的用户设备列表(UE list)存储在UDR中，这样第二SMF在收到用户设备的加入请求时可以向PCF/UDM请求对该用户设备的加入请求进行鉴权，PCF/UDM则可以向UDR查询相应多播会话可用的用户设备列表，进而根据UDR的反馈的信息确定鉴权结果并指示给第二SMF，从而可以实现对用户设备的加入请求进行鉴权。
图16是本申请另一实施例提供的鉴权方法的示意性流程图。图16所示的方法可以应用于图1所示的系统架构，也可以应用于图3所示的系统架构，本申请实施例不限于此。图16所示的方法包括以下内容的至少部分内容。
步骤1601，第二SMF接收来自AF的订阅信息。
其中，订阅信息用于用于订阅用户设备加入第一多播会话的通知。
一种可能的实现方式，订阅信息包括第二识别信息和事件标识，所述第二识别信息对应于所述第一多播会话，所述事件标识用于标识用户设备加入多播会话事件。
一种可能的实现方式，第二SMF可以通过UDR接收来自AF的订阅信息。
另一种可能的实现方式，第二SMF可以通过PCF或UDM接收来自AF的订阅信息。
步骤1602，用户设备向第二SMF发送第一加入请求。
其中，所述第一加入请求用于请求加入第一多播会话。所述第一加入请求包括第二识别信息，所述第二识别信息与所述第一多播会话对应。其中，所述第四识别信息可以包括多播数据对应的多播群组的临时移动组标识(temporary mobile group identifier，TMGI)、提供多播数据的应用服务器的IP地址、多播数据的业务标识(service identifier，service ID)、多播数据的分组过滤(packet filter)信息、多播数据的业务数据流(service data flow，SDF)识别规则、用于传输多播数据的多播PDU会话的ID、应用的ID信息(Application ID)、多播数据的目标IP地址信息(例如，IP multicast address)、以及多播群组对应的多播会话的上下文标识信息(Multicast Session Context ID)中的至少一个。
步骤1603，第二SMF向AF发送第一消息。
其中，所述第一消息用于通知所述AF用户设备请求加入所述第一多播会话，所述第一消息包括所述第二识别信息和所述用户设备的第一用户标识信息。
步骤1604，第二SMF接收来自所述AF的第二指示信息。
其中，所述第二指示信息用于指示是否允许所述用户设备加入所述第一多播会话。
步骤1605，当所述第二指示信息指示允许所述用户设备加入所述第一多播会话时， 所述第二SMF接受所述第一加入请求。
一种可能的实现方式，当所述第二指示信息指示不允许所述用户设备加入所述第一多播会话时，所述第二SMF通过NRF选取第一SMF，并继续后续的加入流程。
步骤1606，当所述第二指示信息指示不允许所述用户设备加入所述第一多播会话时，所述第二SMF接受所述第一加入请求。一种可能的实现方式，当所述第一指示信息指示不允许所述用户设备加入所述第一多播会话时，所述第二SMF向用户设备或AMF发送拒绝加入请求信息(reject join request)。
下面结合图17对图16所示的方法进行详细描述。图17是本申请另一实施例提供的鉴权方法的示意性流程图。图17所示的方法可以应用于图1所示的系统架构，也可以应用于图3所示的系统架构，本申请实施例不限于此。
图17中的方法可以由用户设备、第一SMF、第二SMF、PCF、UDR、NEF/MBSF-C和AF执行，也可以由用户设备、第一SMF、第二SMF、PCF、UDR、NEF/MBSF-C和AF中的模块或单元(例如，电路、芯片或SOC等)执行，图17中以执行主体为用户设备、第一SMF、第二SMF、PCF、UDR、NEF/MBSF-C和AF为例。图17中的方法可以包括以下内容的至少部分内容。
步骤1701，AF向NEF或MBSF-C发送第二配置请求消息。相应地，NEF或MBSF-C接收来自AF的第二配置请求消息。
其中，第二配置请求消息用于为多播业务配置多播会话。第二配置请求消息包括多播数据的第二识别信息，该第二识别信息可以包括，可以包括多播数据对应的多播群组的临时移动组标识(temporary mobile group identifier，TMGI)、提供多播数据的应用服务器的IP地址、多播数据的业务标识(service identifier，service ID)、多播数据的分组过滤(packet filter)信息、多播数据的业务数据流(service data flow，SDF)识别规则、用于传输多播数据的多播PDU会话的ID、应用的ID信息(Application ID)、多播数据的目标IP地址信息(例如，IP multicast address)、以及多播群组对应的多播会话的上下文标识信息(Multicast Session Context ID)中的至少一个。为了描述方便，下文将多播数据的第二识别信息简称为第二识别信息。
第二配置请求消息还可以包括订阅信息。订阅信息用于订阅用户设备加入多播会话的通知。可选地，订阅信息包括第二识别信息和事件标识，事件标识用于标识用户设备加入多播会话事件
一种可能的实现方式，AF可以向NEF或MBSF-C发送MBS预配置请求消息(MBS preconfiguration request)。
步骤1702，NEF或MBSF-C将第二配置请求消息中的订阅信息存储在UDR中。
步骤1703，NEF或MBSF-C向AF发送第二配置响应消息。相应地，AF接收来自NEF或MBSF-C的第二配置响应消息。
一种可能的实现方式，NEF或MBSF-C可以向AF发送MBS预配置响应消息(MBS preconfiguration response)。
步骤1704，UDR向PCF发送第一通知消息。相应地，PCF接收来自UDR的第一通知消息。
其中，第一通知消息包括订阅信息。
一种可能的实现方式，UDR向PCF发送Nudr_DM_Notify。
步骤1705，PCF向第二SMF发送第十二消息。相应地，第二SMF接收来自PCF的第十二消息。
其中，第十二消息包括订阅信息。
一种可能的实现方式，PCF向第二SMF发送会话管理策略更新消息(SM policy update)。
步骤1706，AF向用户设备发送第八消息。相应地，用户设备接收来自AF的第八消息。
其中，第八消息用于通知用户设备发起针对第二识别信息对应的多播会话的加入请求(join request)。第八消息中携带第二识别信息。AF可以通过应用层信令发送第八消息。
一种可能的实现方式，AF向用户设备发送业务声明消息(service announcement)。
步骤1707，用户设备向第二SMF发送第一加入请求。相应地，第二SMF接收来自用户设备的第一加入请求。
其中，第一加入请求用于请求加入第二识别信息对应的多播会话。第一加入请求携带第二识别信息。
例如，用户设备在检测到应用层发出的针对第二识别信息的IGMP加入消息等时向第二SMF发送第一加入请求。
可选地，第一加入请求可以为IGMP加入请求消息或MLR消息。
一种可能的实现方式，用户设备向第二SMF发送MBS会话加入请求消息(MBS session join request)。
步骤1708，在检测到针对针对第二识别信息的加入请求后，第二SMF向AF发送第一消息。相应地，AF接收来自第二SMF的第一消息。
其中，第一消息用于通知AF用户设备请求加入多播会话，或者也可以描述为，第一消息用于请求对用户设备加入多播会话的请求进行鉴权、第一消息用于请求对用户设备加入多播业务的请求进行鉴权等。第一消息包括第二识别信息和第一用户标识信息。
一种可能的实现方式，第二SMF向AF发送UE join notification。
步骤1709，在接收到第一消息后，AF对第一用户标识信息所标识的用户设备的加入请求进行鉴权。
在一些实现方式中，AF可以根据第一用户标识信息和第二识别信息，查询数据库。若针对该第二识别信息，数据库中存在第一用户标识信息的签约信息，则AF确定鉴权通过，在完成多播会话的配置流程后，可以向第二SMF指示允许用户设备加入第二识别信息对应的多播会话，或者指示第二识别信息对应的多播会话可用(MBS session available)。若针对该第二识别信息，数据库中不存在第一用户标识信息的签约信息，AF确定鉴权失败，可以向第二SMF指示不允许用户设备加入第二识别信息对应的多播会话，或者指示第二识别信息对应的多播会话不可用(MBS session unavailable)。
步骤1710，AF向第二SMF发送第二指示信息。相应地，第二SMF接收来自AF的第二指示信息。
其中，第二指示信息用于指示鉴权结果。
一种可能的实现方式，AF向第二SMF发送UE join notification response。
若第二指示信息指示不允许用户设备加入第二识别信息对应的多播会话或第二识别信息对应的多播会话不可用，第二SMF可以执行步骤1711。若第二指示信息指示允许用户设备加入第二识别信息对应的多播会话或第二识别信息对应的多播会话可用，第二SMF可以继续执行用户设备加入多播群组的后续流程。
步骤1711，第二SMF拒绝该用户设备的第一加入请求。
后续第二SMF可能向用户设备或AMF指示拒绝该用户设备的加入请求。
步骤1712，第二SMF接受该用户设备的第一加入请求，继续执行用户设备加入多播群组的后续流程。
在图17所示的方法中，AF可以向第二SMF订阅用户设备加入事件的通知，这样第二SMF在收到用户设备的加入请求时可以向AF通知对该用户设备请求加入多播会话，AF则可以对该用户设备的加入请求进行鉴权并将鉴权结果指示给第二SMF，从而可以实现对用户设备的加入请求进行鉴权。并且该方案可以在核心网没有多播群组的成员信息的情况下实现针对用户设备加入群组时的鉴权操作，有助于避免产生公共安全问题。
图18是本申请另一实施例提供的鉴权方法的示意性流程图。图18所示的方法可以应用于图1所示的系统架构，也可以应用于图3所示的系统架构，本申请实施例不限于此。图18所示的方法包括以下内容的至少部分内容。
步骤1801，用户设备向第二SMF发送第一加入请求。
其中，所述第一加入请求用于请求加入第一多播会话。所述第一加入请求包括第四识别信息，所述第四识别信息与所述第一多播会话对应。其中，所述第四识别信息可以包括多播数据对应的多播群组的临时移动组标识(temporary mobile group identifier，TMGI)、提供多播数据的应用服务器的IP地址、多播数据的业务标识(service identifier，service ID)、多播数据的分组过滤(packet filter)信息、多播数据的业务数据流(service data flow，SDF)识别规则、用于传输多播数据的多播PDU会话的ID、应用的ID信息(Application ID)、多播数据的目标IP地址信息(例如，IP multicast address)、以及多播群组对应的多播会话的上下文标识信息(Multicast Session Context ID)中的至少一个。
步骤1802，当所述第一多播会话属于允许所述用户设备加入的多播会话时，所述第二SMF接受所述第一加入请求。
一种可能的实现方式，当所述第一指示信息指示允许所述用户设备加入所述第一多播会话时，所述第二SMF通过NRF选取第一SMF，并继续后续的加入流程。
步骤1803，当所述第一多播会话不属于允许所述用户设备加入的多播会话时，所述第二SMF拒绝所述第一加入请求。
一种可能的实现方式，当所述第一指示信息指示不允许所述用户设备加入所述第一多播会话时，所述第二SMF向用户设备或AMF发送拒绝加入请求信息(reject join request)。
在一些实现方式中，图18所示的方法还包括：所述第二SMF获取允许用户设备加入的多播会话的信息。
一种可能的实现方式，所述第二SMF获取允许用户设备加入的多播会话的信息，包括：所述SMF向第一核心网设备发送第十四消息，所述第十四消息用于请求允许用户设备加入的多播会话的信息，所述第十四消息包括所述用户设备的第三用户标识信息；所述第一核心网设备根据所述第三用户标识信息获取允许所述用户设备加入的多播业务的信 息；所述第二会话管理功能网元接收来自所述第一核心网设备的所述允许所述用户设备加入的多播业务的信息。
一种可能的实现方式，所述第一核心网设备根据所述第三用户标识信息获取允许所述用户设备加入的多播业务的信息，包括：所述第一核心网设备向UDR发送第三查询消息，所述第三查询消息包括第三用户标识信息，用于查询允许所述用户设备加入的多播会话的信息；所述第一核心网设备接收来自所述UDR的第三响应消息，所述第三响应消息包括所述允许所述用户设备加入的多播会话的信息。
一种可能的实现方式，图18所示的方法还包括：所述UDR从应用功能网元或运营商获取与多播会话对应的识别信息和用户设备列表，所述用户设备列表为允许加入所述多播会话的用户设备的列表；所述UDR根据所述第三查询消息、所述识别信息、以及用户设备列表，确定所述允许所述用户设备加入的多播会话的信息。
在一些实现方式中，上述第一核心网设备为PCF或UDM。
下面结合图19对图18所示的方法进行详细描述。图19是本申请另一实施例提供的鉴权方法的示意性流程图。图19所示的方法可以应用于图1所示的系统架构，也可以应用于图3所示的系统架构，本申请实施例不限于此。
图19中的方法可以由用户设备、第一SMF、第二SMF、PCF/UDM、UDR、NEF/MBSF-C和AF执行，也可以由用户设备、第一SMF、第二SMF、PCF/UDM、UDR、NEF/MBSF-C和AF中的模块或单元(例如，电路、芯片或SOC等)执行，图19中以执行主体为用户设备、第一SMF、第二SMF、PCF/UDM、UDR、NEF/MBSF-C和AF为例。图19中的方法可以包括以下内容的至少部分内容。
步骤1901，AF向NEF、MBSF-C或第一SMF发送第一配置请求消息。相应地，NEF、MBSF-C或第一SMF接收来自AF的第一配置请求消息。
其中，第一配置请求消息用于为多播业务配置多播会话。第一配置请求消息包括多播会话的识别信息。为了描述方便，下文将多播数据的识别信息简称为识别信息。
可选地，第一配置请求消息还可以包括用户设备列表，该用户设备列表可以为允许使用该识别信息对应的多播业务的用户设备的列表。由于第一配置请求消息用于为多播业务配置多播会话，因此，用户设备列表也可以描述为允许加入该识别信息对应的多播会话的用户设备的列表。例如，用户设备列表为allowed UE list。
步骤1902，NEF、MBSF-C或第一SMF将第一配置请求消息中的识别信息存储在UDR中。
可选地，若第一配置请求消息还包括用户设备列表，NEF、MBSF-C或第一SMF也将该用户设备列表存储在UDR中。
步骤1903，NEF或MBSF-C向AF发送第一配置响应消息。相应地，AF接收来自NEF或MBSF-C的第一配置响应消息。
需要说明的是，识别信息可以包括一个或多个多播数据分别对应的识别信息，同理，用户设备列表也可以包括与该一个或多个识别信息一一对应的一个或多个用户设备列表。
需要说明的是，步骤1901-1903为可选步骤，上述识别信息和/或用户设备列表也可以由运营商配置在UDR中。通过步骤1901-1903，AF可以根据业务情况及时存储、更新或移除UDR中存储的用户设备列表，方案更加灵活。
步骤1904，用户设备与第二SMF进行单播的会话建立流程。
步骤1905，第二SMF向PCF或UDM发送第十四消息。相应地，PCF或UDM接收来自第二SMF的第十四消息。
其中，PCF或UDM可以为服务单播的PCF或UDM。第十四消息用于请求允许用户设备加入的多播会话的信息，第十四消息携带用户设备的第三用户标识信息(下文简称第三用户标识信息)。例如，第二SMF可以通过向PCF发送查询用户设备的会话管理策略信息的消息来实现请求允许用户设备加入的多播会话的信息。又例如，第二SMF可以通过向UDM发送查询用户设备的签约信息的消息来实现请求允许用户设备加入的多播会话的信息。
允许用户设备加入的多播会话，也可以替换为，允许用户设备加入的多播业务，允许用户设备使用的多播业务、或用户设备可以使用的多播业务等。
一种可能的实现方式，第二SMF可以向PCF或UDM发送会话管理策略查询消息(SM policy query)。
步骤1906，PCF、UDM或第一SMF向UDR发送第三查询消息。相应地，UDR接收来自PCF、UDM或第一SMF的第三查询消息。
其中，第三查询消息携带第三用户标识信息，用于查询用户设备的信息。
一种可能的实现方式，PCF、UDM或第一SMF向UDR发送Nudr_DM_Query。
步骤1907，UDR根据第三用户标识信息、存储的多播数据的识别信息以及与多播数据的识别信息对应的用户设备列表，确定允许用户设备加入的多播会话。
其中，允许用户设备加入的多播会话可以包括一个或多个多播会话。
步骤1908，UDR向PCF、UDM或第一SMF发送第三响应消息。相应地，PCF、UDM或第一SMF接收来自UDR的第三响应消息。
其中，第三响应消息包括允许用户设备加入的多播会话的信息。可选地，允许用户设备加入的多播会话的信息可以包括允许用户设备加入的多播业务的TMGI、提供多播数据的应用服务器的IP地址、多播数据的业务标识、多播数据的分组过滤信息、多播数据的业务数据流识别规则、用于传输多播数据的多播PDU会话的ID、应用的ID信息、多播数据的目标IP地址信息、以及多播群组对应的多播会话的上下文标识信息中的至少一个。
一种可能的实现方式，PCF、UDM或第一SMF接收来自UDR的Nudr_DM_Response。
步骤1909，PCF、UDM或第一SMF向第二SMF发送第十五消息。相应地，第二SMF接收PCF、UDM或第一SMF发送的第十五消息。
其中，第十五消息携带允许用户设备加入的多播会话的信息。
一种可能的实现方式，PCF、UDM或第一SMF向第二SMF发送会话管理策略响应消息(SM policy response)。
步骤1910，AF向用户设备发送第八消息。相应地，用户设备接收来自AF的第八消息。
其中，第八消息用于通知用户设备发起针对第四识别信息对应的多播会话的加入请求(join request)。第八消息中携带第四识别信息。AF可以通过应用层信令发送第八消息。
一种可能的实现方式，AF向用户设备发送业务声明消息(service announcement)。
步骤1911，用户设备向第二SMF发送第一加入请求。相应地，第二SMF接收来自 用户设备的第一加入请求。
其中，第一加入请求用于请求加入第四识别信息对应的多播会话。第一加入请求携带第四识别信息。
例如，用户设备在检测到应用层发出的针对第四识别信息的IGMP加入消息等时向第二SMF发送第一加入请求。
可选地，第一加入请求可以为IGMP加入请求消息或MLR消息。
一种可能的实现方式，用户设备向第二SMF发送MBS会话加入请求消息(MBS session join request)。
步骤1912，第二SMF根据允许用户设备接入的多播业务以及第四识别信息，确定是否允许用户设备接入第四识别信息所对应的多播业务。
若第二SMF确定不允许用户设备加入第四识别信息所对应的多播会话，则第二SMF可以执行步骤1913。若第二SMF确定允许用户设备加入第四识别信息所对应的多播会话，则第二SMF可以执行步骤1914-1917。
步骤1913，第二SMF拒绝该用户设备的第一加入请求。
后续第二SMF可能向用户设备或AMF指示拒绝该用户设备的第一加入请求。
步骤1914，第二SMF接受该用户设备的第一加入请求，并通过NRF选取第一SMF。
步骤1915，第二SMF向第一SMF发送第二查询消息。相应地，第一SMF接收来自第二SMF的第二查询消息。
步骤1916，第一SMF向第二SMF发送第二响应消息。相应地，第二SMF接收来自第一SMF的第二响应消息。
步骤1917，用户设备加入多播群组的后续流程。
步骤1913-1917更详细的描述可以参考步骤1511-1515，在此不再赘述。
在图19所示的方法中，可以将多播会话可用的用户设备列表存储在UDR中，这样SMF在进行用户设备的单播会话的建立流程中，可以以用户设备的标识为索引通过PCF、UDM或第一SMF向UDR请求允许用户设备加入的多播业务，进而根据UDR反馈的信息对用户设备的加入请求进行鉴权，从而可以实现对用户设备的加入请求进行鉴权。
需要说明的是，上述各实施例可以单独实施，也可以恰当地结合在一起实施。
可以理解的是，为了实现上述实施例中功能，通信装置包括了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本申请中所公开的实施例描述的各示例的单元及方法步骤，本申请能够以硬件或硬件和计算机软件相结合的形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用场景和设计约束条件。
图20至图21为本申请的实施例提供的可能的装置的结构示意图。
这些装置可以用于实现上述方法实施例中用户设备、接入网设备、AMF、UPF、SMF、NEF、UDM、UDR、PCF、MBSF、AF或应用服务器的功能，因此也能实现上述方法实施例所具备的有益效果。在本申请的实施例中，该通信装置可以是用户设备、接入网设备、AMF、UPF、SMF、NEF、UDM、UDR、PCF、MBSF、AF或应用服务器，还可以是应用于用户设备、接入网设备、AMF、UPF、SMF、NEF、UDM、UDR、PCF、MBSF、AF或应用服务器的模块(如芯片)。
如图20所示，装置1400包括处理单元1410和收发单元1420。
当装置1400用于实现图4所示的方法实施例中第一SMF的功能时：处理单元1410可以执行方法侧实施例所示的步骤410和450，收发单元1420可以执行方法侧实施例所示的步骤420和440。当装置1400用于实现图4所示的方法实施例中应用服务器的功能时：处理单元可以执行方法侧实施例所示的步骤430，收发单元1420可以执行方法侧实施例所示的步骤420和440。
当装置1400用于实现图5所示的方法实施例中用户设备的功能时：收发单元1420可以执行方法侧实施例所示的步骤501。当装置1400用于实现图5所示的方法实施例中AMF的功能时：收发单元1420可以执行方法侧实施例所示的步骤502。当装置1400用于实现图5所示的方法实施例中第二SMF的功能时：收发单元1420可以执行方法侧实施例所示的步骤503。当装置1400用于实现图5所示的方法实施例中第一SMF的功能时：处理单元可以执行方法侧实施例所示的步骤516和504，收发单元1420可以执行方法侧实施例所示的步骤503、505、507、508、513和514。当装置1400用于实现图5所示的方法实施例中应用服务器的功能时：处理单元可以执行方法侧实施例所示的步骤506和511，收发单元1420可以执行方法侧实施例所示的步骤505、507、510和512。当装置1400用于实现图5所示的方法实施例中NEF的功能时：处理单元可以执行方法侧实施例所示的步骤509，收发单元1420可以执行方法侧实施例所示的步骤508、510、512和513。
当装置1400用于实现图6所示的方法实施例中用户设备的功能时：收发单元1420可以执行方法侧实施例所示的步骤601。当装置1400用于实现图6所示的方法实施例中第二UPF的功能时：收发单元1420可以执行方法侧实施例所示的步骤602。当装置1400用于实现图6所示的方法实施例中第二SMF的功能时：收发单元1420可以执行方法侧实施例所示的步骤602和603。当装置1400用于实现图6所示的方法实施例中第一SMF的功能时：处理单元可以执行方法侧实施例所示的步骤616和604，收发单元1420可以执行方法侧实施例所示的步骤603、605、607、608、613和614。当装置1400用于实现图6所示的方法实施例中应用服务器的功能时：处理单元可以执行方法侧实施例所示的步骤606和611，收发单元1420可以执行方法侧实施例所示的步骤605、607、610和612。当装置1400用于实现图6所示的方法实施例中NEF的功能时：处理单元可以执行方法侧实施例所示的步骤609，收发单元1420可以执行方法侧实施例所示的步骤608、610、612和613。
当装置1400用于实现图7所示的方法实施例中用户设备的功能时：收发单元1420可以执行方法侧实施例所示的步骤701。当装置1400用于实现图7所示的方法实施例中AMF的功能时：收发单元1420可以执行方法侧实施例所示的步骤602。当装置1400用于实现图7所示的方法实施例中第一SMF的功能时：处理单元可以执行方法侧实施例所示的步骤716和704，收发单元1420可以执行方法侧实施例所示的步骤705、707、708、713和714。当装置1400用于实现图7所示的方法实施例中应用服务器的功能时：处理单元可以执行方法侧实施例所示的步骤706和711，收发单元1420可以执行方法侧实施例所示的步骤705、707、710和712。当装置1400用于实现图7所示的方法实施例中NEF的功能时：处理单元可以执行方法侧实施例所示的步骤709，收发单元1420可以执行方法侧实施例所示的步骤708、710、712和713。
当装置1400用于实现图8所示的方法实施例中用户设备的功能时：收发单元1420可以执行方法侧实施例所示的步骤801。当装置1400用于实现图8所示的方法实施例中第二UPF的功能时：收发单元1420可以执行方法侧实施例所示的步骤802。当装置1400用于实现图8所示的方法实施例中第一SMF的功能时：处理单元可以执行方法侧实施例所示的步骤816和804，收发单元1420可以执行方法侧实施例所示的步骤805、807、808、813和814。当装置1400用于实现图8所示的方法实施例中应用服务器的功能时：处理单元可以执行方法侧实施例所示的步骤806和811，收发单元1420可以执行方法侧实施例所示的步骤805、807、810和812。当装置1400用于实现图8所示的方法实施例中NEF的功能时：处理单元可以执行方法侧实施例所示的步骤809，收发单元1420可以执行方法侧实施例所示的步骤808、810、812和813。
当装置1400用于实现图9所示的方法实施例中用户设备的功能时：收发单元1420可以执行方法侧实施例所示的步骤901和904。当装置1400用于实现图9所示的方法实施例中网络设备的功能时：处理单元可以执行方法侧实施例所示的步骤902，收发单元1420可以执行方法侧实施例所示的步骤901和905。当装置1400用于实现图9所示的方法实施例中应用服务器的功能时：处理单元可以执行方法侧实施例所示的步骤903，收发单元1420可以执行方法侧实施例所示的步骤903和904。
当装置1400用于实现图10所示的方法实施例中用户设备的功能时：处理单元1410可以执行方法侧实施例所示的步骤1003，收发单元1420可以执行方法侧实施例所示的步骤1001和1005。当装置1400用于实现图10所示的方法实施例中第一SMF的功能时：处理单元1410可以执行方法侧实施例所示的步骤1002和1003，收发单元1420可以执行方法侧实施例所示的步骤1001和1008。当装置1400用于实现图10所示的方法实施例中应用服务器的功能时：处理单元可以执行方法侧实施例所示的步骤1004，收发单元1420可以执行方法侧实施例所示的步骤1005和1006。当装置1400用于实现图10所示的方法实施例中NEF的功能时：收发单元1420可以执行方法侧实施例所示的步骤1006和1007。当装置1400用于实现图10所示的方法实施例中UDM或UDR的功能时：处理单元可以执行方法侧实施例所示的步骤1003，收发单元1420可以执行方法侧实施例所示的步骤1008和1007。
当装置1400用于实现图11所示的方法实施例中用户设备的功能时：处理单元1410可以执行方法侧实施例所示的步骤1105，收发单元1420可以执行方法侧实施例所示的步骤1101和1107。当装置1400用于实现图11所示的方法实施例中第二SMF的功能时：处理单元1410可以执行方法侧实施例所示的步骤1105，收发单元1420可以执行方法侧实施例所示的步骤1001、1102、1104和1112。当装置1400用于实现图11所示的方法实施例中第一SMF的功能时：处理单元1410可以执行方法侧实施例所示的步骤1105，收发单元1420可以执行方法侧实施例所示的步骤1112和1111。当装置1400用于实现图11所示的方法实施例中应用服务器的功能时：处理单元可以执行方法侧实施例所示的步骤1106，收发单元1420可以执行方法侧实施例所示的步骤1107和1108。当装置1400用于实现图11所示的方法实施例中NEF或PCF的功能时：处理单元可以执行方法侧实施例所示的步骤1110，收发单元1420可以执行方法侧实施例所示的步骤1108、1111和1109。当装置1400用于实现图11所示的方法实施例中UDM或UDR的功能时：处理单元可以 执行方法侧实施例所示的步骤1103和1105，收发单元1420可以执行方法侧实施例所示的步骤1112、1109、1102和1104。
当装置1400用于实现图12所示的方法实施例中用户设备的功能时：处理单元1410可以执行方法侧实施例所示的步骤1214，收发单元1420可以执行方法侧实施例所示的步骤1201和1207。当装置1400用于实现图12所示的方法实施例中第二SMF的功能时：处理单元1410可以执行方法侧实施例所示的步骤1214，收发单元1420可以执行方法侧实施例所示的步骤1201-1203。当装置1400用于实现图12所示的方法实施例中第一SMF的功能时：处理单元1410可以执行方法侧实施例所示的步骤1204和1214，收发单元1420可以执行方法侧实施例所示的步骤1202、1205和1213。当装置1400用于实现图12所示的方法实施例中应用服务器的功能时：处理单元可以执行方法侧实施例所示的步骤1206，收发单元1420可以执行方法侧实施例所示的步骤1207和1208。当装置1400用于实现图12所示的方法实施例中NEF或PCF的功能时：处理单元可以执行方法侧实施例所示的步骤1210，收发单元1420可以执行方法侧实施例所示的步骤1208、1211和1209。当装置1400用于实现图12所示的方法实施例中UDM或UDR的功能时：处理单元可以执行方法侧实施例所示的步骤1214，收发单元1420可以执行方法侧实施例所示的步骤1212、1209、1203和1205。
当装置1400用于实现图13所示的方法实施例中用户设备的功能时：收发单元1420可以执行方法侧实施例所示的步骤1301和1312。当装置1400用于实现图13所示的方法实施例中接入网设备的功能时：处理单元1410可以执行方法侧实施例所示的步骤1302和1304，收发单元1420可以执行方法侧实施例所示的步骤1301、1305和1309。当装置1400用于实现图13所示的方法实施例中AMF的功能时：处理单元1410可以执行方法侧实施例所示的步骤1306和1303，收发单元1420可以执行方法侧实施例所示的步骤1305、1307-1309。当装置1400用于实现图13所示的方法实施例中第一SMF的功能时：处理单元1410可以执行方法侧实施例所示的步骤1310和1303，收发单元1420可以执行方法侧实施例所示的步骤1307、1308和1313。当装置1400用于实现图13所示的方法实施例中应用服务器的功能时：处理单元可以执行方法侧实施例所示的步骤1311，收发单元1420可以执行方法侧实施例所示的步骤1312和1313。当装置1400用于实现图13所示的方法实施例中NEF、UDM或UDR的功能时：收发单元1420可以执行方法侧实施例所示的步骤1313。
当装置1400用于实现图14所示的方法实施例中用户设备的功能时：收发单元1420可以执行方法侧实施例所示的步骤1401。当装置1400用于实现图14所示的方法实施例中第二SMF的功能时：收发单元1420可以执行方法侧实施例所示的步骤1401、1402和1404，处理单元1410可以执行方法侧实施例所示的步骤1405和1406。当装置1400用于实现图14所示的方法实施例中第一核心网设备的功能时：收发单元1420可以执行方法侧实施例所示的步骤1402-1403。当装置1400用于实现图14所示的方法实施例中UDR的功能时：收发单元1420可以执行方法侧实施例所示的步骤1403。
当装置1400用于实现图15所示的方法实施例中用户设备的功能时：收发单元1420可以执行方法侧实施例所示的步骤1504和1505，处理单元1410可以执行方法侧实施例所示的步骤1515。当装置1400用于实现图15所示的方法实施例中第二SMF的功能时： 收发单元1420可以执行方法侧实施例所示的步骤1505、1506、1510、1513和1514，处理单元1410可以执行方法侧实施例所示的步骤1511、1512和1515。当装置1400用于实现图15所示的方法实施例中PCF或UDM的功能时：收发单元1420可以执行方法侧实施例所示的步骤1506-1508和1510，处理单元1410可以执行方法侧实施例所示的步骤1509和1515。当装置1400用于实现图15所示的方法实施例中UDR的功能时：处理单元1410可以执行方法侧实施例所示的步骤1502和1515，收发单元1420可以执行方法侧实施例所示的步骤1507和1508。当装置1400用于实现图15所示的方法实施例中NEF或MBSF-C的功能时：收发单元1420可以执行方法侧实施例所示的步骤1501和1503，处理单元1410可以执行方法侧实施例所示的步骤1502和1515。当装置1400用于实现图15所示的方法实施例中AF的功能时：处理单元1410可以执行方法侧实施例所示的步骤1515，收发单元1420可以执行方法侧实施例所示的步骤1501和1503。
当装置1400用于实现图16所示的方法实施例中用户设备的功能时：收发单元1420可以执行方法侧实施例所示的步骤1602。当装置1400用于实现图16所示的方法实施例中第二SMF的功能时：收发单元1420可以执行方法侧实施例所示的步骤1601-1604，处理单元1410可以执行方法侧实施例所示的步骤1605和1606。当装置1400用于实现图16所示的方法实施例中UDR的功能时：收发单元1420可以执行方法侧实施例所示的步骤1601。当装置1400用于实现图16所示的方法实施例中AF的功能时：收发单元1420可以执行方法侧实施例所示的步骤1601、1604和1603。
当装置1400用于实现图17所示的方法实施例中用户设备的功能时：收发单元1420可以执行方法侧实施例所示的步骤1706和1707，处理单元1410可以执行方法侧实施例所示的步骤1712。当装置1400用于实现图17所示的方法实施例中第二SMF的功能时：收发单元1420可以执行方法侧实施例所示的步骤1705、1707、1708和1710，处理单元1410可以执行方法侧实施例所示的步骤1711和1712。当装置1400用于实现图17所示的方法实施例中PCF的功能时：收发单元1420可以执行方法侧实施例所示的步骤1704和1705，处理单元1410可以执行方法侧实施例所示的步骤1712。当装置1400用于实现图17所示的方法实施例中UDR的功能时：处理单元1410可以执行方法侧实施例所示的步骤1702和1712，收发单元1420可以执行方法侧实施例所示的步骤1704。当装置1400用于实现图17所示的方法实施例中NEF或MBSF-C的功能时：收发单元1420可以执行方法侧实施例所示的步骤1701和1703，处理单元1410可以执行方法侧实施例所示的步骤1702和1712。当装置1400用于实现图17所示的方法实施例中AF的功能时：处理单元1410可以执行方法侧实施例所示的步骤1709和1712，收发单元1420可以执行方法侧实施例所示的步骤1701、1703、1706、1708和1710。
当装置1400用于实现图18所示的方法实施例中用户设备的功能时：收发单元1420可以执行方法侧实施例所示的步骤1801。当装置1400用于实现图1/8所示的方法实施例中第二SMF的功能时：收发单元1420可以执行方法侧实施例所示的步骤1801、1804和1806，处理单元1410可以执行方法侧实施例所示的步骤1802和1803。当装置1400用于实现图18所示的方法实施例中第一核心网设备的功能时：收发单元1420可以执行方法侧实施例所示的步骤1804和1806，处理单元1410可以执行方法侧实施例所示的步骤1805。
当装置1400用于实现图19所示的方法实施例中用户设备的功能时：收发单元1420 可以执行方法侧实施例所示的步骤1910和1911，处理单元1410可以执行方法侧实施例所示的步骤1904和1917。当装置1400用于实现图19所示的方法实施例中第二SMF的功能时：收发单元1420可以执行方法侧实施例所示的步骤1905、1909、1911、1915和1916，处理单元1410可以执行方法侧实施例所示的步骤1904、1912-1914和/1917。当装置1400用于实现图19所示的方法实施例中PCF或UDM的功能时：收发单元1420可以执行方法侧实施例所示的步骤1905、1906、1908和1909，处理单元1410可以执行方法侧实施例所示的步骤1917。当装置1400用于实现图19所示的方法实施例中UDR的功能时：处理单元1410可以执行方法侧实施例所示的步骤1902、1907和1917，收发单元1420可以执行方法侧实施例所示的步骤1906和1908。当装置1400用于实现图19所示的方法实施例中NEF、MBSF-C或第一SMF的功能时：收发单元1420可以执行方法侧实施例所示的步骤1901和1903，处理单元1410可以执行方法侧实施例所示的步骤1902和1917。当装置1400用于实现图19所示的方法实施例中AF的功能时：处理单元1410可以执行方法侧实施例所示的步骤1917，收发单元1420可以执行方法侧实施例所示的步骤1901和1903。
有关上述处理单元1410和收发单元1420更详细的描述可以直接参考图4-图19所示的方法实施例中相关描述直接得到，这里不加赘述。
如图21所示，装置1500包括处理器1510和接口电路1520。处理器1510和接口电路1520之间相互耦合。可以理解的是，接口电路1520可以为收发器或输入输出接口。可选地，装置1500还可以包括存储器1530，用于存储处理器1510执行的指令或存储处理器1510运行指令所需要的输入数据或存储处理器1510运行指令后产生的数据。
当装置1500用于实现图4-图19所示的方法时，处理器1510用于执行上述处理单元1410的功能，接口电路1520用于执行上述收发单元1420的功能。
当上述装置为应用于用户设备、接入网设备、AMF、UPF、SMF、NEF、UDM、UDR、PCF、MBSF、AF或应用服务器的芯片时，该芯片实现上述方法实施例中用户设备、接入网设备、AMF、UPF、SMF、NEF、UDM、UDR、PCF、MBSF、AF或应用服务器的功能。该芯片从用户设备、接入网设备、AMF、UPF、SMF、NEF、UDM、UDR或应用服务器中的其它模块(如射频模块或天线)接收信息，该信息是其他设备发送给用户设备、接入网设备、AMF、UPF、SMF、NEF、UDM、UDR、PCF、MBSF、AF或应用服务器的；或者，该芯片向用户设备、接入网设备、AMF、UPF、SMF、NEF、UDM、UDR、PCF、MBSF、AF或应用服务器中的其它模块(如射频模块或天线)发送信息，该信息是用户设备、接入网设备、AMF、UPF、SMF、NEF、UDM、UDR、PCF、MBSF、AF或应用服务器发送给其他设备的。
可以理解的是，本申请的实施例中的处理器可以是中央处理单元(Central Processing Unit，CPU)，还可以是其它通用处理器、数字信号处理器(Digital Signal Processor，DSP)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现场可编程门阵列(Field Programmable Gate Array，FPGA)或者其它可编程逻辑器件、晶体管逻辑器件，硬件部件或者其任意组合。通用处理器可以是微处理器，也可以是任何常规的处理器。
本申请的实施例中的方法步骤可以通过硬件的方式来实现，也可以由处理器执行软件指令的方式来实现。软件指令可以由相应的软件模块组成，软件模块可以被存放于随机存 取存储器(Random Access Memory，RAM)、闪存、只读存储器(Read-Only Memory，ROM)、可编程只读存储器(Programmable ROM，PROM)、可擦除可编程只读存储器(Erasable PROM，EPROM)、电可擦除可编程只读存储器(Electrically EPROM，EEPROM)、寄存器、硬盘、移动硬盘、CD-ROM或者本领域熟知的任何其它形式的存储介质中。一种示例性的存储介质耦合至处理器，从而使处理器能够从该存储介质读取信息，且可向该存储介质写入信息。当然，存储介质也可以是处理器的组成部分。处理器和存储介质可以位于ASIC中。另外，该ASIC可以位于用户设备、AMF、UPF、SMF、NEF、UDM、UDR或应用服务器中。当然，处理器和存储介质也可以作为分立组件存在于用户设备、AMF、UPF、SMF、NEF、UDM、UDR或应用服务器中。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机程序或指令。在计算机上加载和执行所述计算机程序或指令时，全部或部分地执行本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其它可编程装置。所述计算机程序或指令可以存储在计算机可读存储介质中，或者通过所述计算机可读存储介质进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是集成一个或多个可用介质的服务器等数据存储设备。所述可用介质可以是磁性介质，例如，软盘、硬盘、磁带；也可以是光介质，例如，DVD；还可以是半导体介质，例如，固态硬盘(solid state disk，SSD)。
在本申请的各个实施例中，如果没有特殊说明以及逻辑冲突，不同的实施例之间的术语和/或描述具有一致性、且可以相互引用，不同的实施例中的技术特征根据其内在的逻辑关系可以组合形成新的实施例。
本申请中，“至少一个”是指一个或者多个，“多个”是指两个或两个以上。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B的情况，其中A，B可以是单数或者复数。在本申请的文字描述中，字符“/”，一般表示前后关联对象是一种“或”的关系；在本申请的公式中，字符“/”，表示前后关联对象是一种“相除”的关系。
可以理解的是，在本申请的实施例中涉及的各种数字编号仅为描述方便进行的区分，并不用来限制本申请的实施例的范围。上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件 可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (44)

  1. 一种用于鉴权的方法，其特征在于，所述方法包括：
    第一会话管理功能网元SMF获取第一信息和多播数据的第一识别信息，所述第一信息用于确定所述用户设备的第一用户标识信息；
    所述第一SMF向应用服务器发送第一消息，所述第一消息用于请求对所述用户设备加入多播群组的请求进行鉴权，所述第一消息包括所述第一用户标识信息和多播数据的第二识别信息，所述第一识别信息和第二识别信息与所述多播群组对应；
    所述第一SMF接收应用服务器发送的第二消息，所述第二消息中包括鉴权结果信息。
  2. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述第一SMF根据所述第一识别信息，确定需要所述应用服务器对所述用户设备加入所述多播群组的请求进行鉴权。
  3. 根据权利要求1或2所述的方法，其特征在于，所述第一信息包括所述第一用户标识信息和/或所述用户设备的第二用户标识信息。
  4. 根据权利要求3所述的方法，其特征在于，当所述第一信息为所述第二用户标识信息时，所述方法还包括：
    所述第一SMF根据所述第二用户标识信息，获取所述第一用户标识信息。
  5. 根据权利要求4所述的方法，其特征在于，所述第一SMF根据所述第二用户标识信息，获取所述第一用户标识信息，包括：
    所述第一SMF根据所述第二用户标识信息从第一网元获取所述第一用户标识信息，所述第一网元包括接入和移动管理功能网元AMF、统一数据管理网元UDM和统一数据存储库UDR。
  6. 根据权利要求1至5中任一项所述的方法，其特征在于，所述第一SMF获取第一信息和多播数据的第一识别信息，包括：
    所述第一SMF从第二SMF、接入和移动管理功能网元AMF或第二用户面功能网元UPF获取所述第一信息和所述第一识别信息。
  7. 根据权利要求1至6中任一项所述的方法，其特征在于，所述第一SMF向所述应用服务器发送第一消息，包括：
    所述第一SMF根据所述第一识别信息，确定所述应用服务器的标识信息；
    所述第一SMF直接向所述应用服务器发送所述第一消息，或者所述第一SMF通过第一UPF向所述应用服务器发送所述第一消息。
  8. 根据权利要求1至6中任一项所述的方法，其特征在于，所述第一SMF向所述应用服务器发送第一消息，包括：
    所述第一SMF通过网络开放功能网元NEF向所述应用服务器发送所述第一消息。
  9. 根据权利要求1至8中任一项所述的方法，其特征在于，所述第一用户标识信息为通用公共用户标识符GPSI，所述第二用户标识信息包括用户永久标识符SUPI、通用唯一临时标识符GUTI和用户隐藏标识符SUCI中的至少一个。
  10. 一种用于鉴权的方法，其特征在于，所述方法包括：
    应用服务器接收来自会话管理功能网元SMF的第一消息，所述第一消息用于请求对用户设备加入多播群组的请求进行鉴权，所述第一消息包括第一用户标识信息和多播数据的第二识别信息，所述第二识别信息与所述多播群组对应，所述第一用户标识信息为所述用户设备的标识信息；
    所述应用服务器根据所述第一用户标识信息和所述第二识别信息，对所述用户设备加入所述多播群组的请求进行鉴权；
    所述应用服务器向所述SMF发送第二消息，所述第二消息中包括鉴权结果信息。
  11. 根据权利要求10所述的方法，其特征在于，所述方法还包括：
    所述应用服务器向第二核心网设备发送第二配置请求消息，所述第二配置请求消息包括所述第二识别信息和订阅信息，所述订阅信息用于订阅用户设备加入所述多播会话事件的通知；
    所述应用服务器接收来自所述第二核心网设备发送的第二配置响应消息，所述第二配置响应消息用于指示所述第二识别信息和所述订阅信息已存储在统一数据存储库。
  12. 根据权利要求10或11所述的方法，其特征在于，所述第二核心网设备为网络开放功能网元或多播广播业务功能网元。
  13. 根据权利要求10至12中任一项所述的方法，其特征在于，所述应用服务器向所述SMF发送第二消息，包括：
    所述应用服务器直接向所述SMF发送所述第二消息，或者通过UPF或网络开放功能网元NEF向所述SMF发送所述二消息。
  14. 根据权利要求10至13中任一项所述的方法，其特征在于，所述SMF服务于单播，或者所述SMF服务于多播。
  15. 根据权利要求10至14中任一项所述的方法，其特征在于，所述第一用户标识信息为通用公共用户标识符GPSI。
  16. 一种用于鉴权的方法，其特征在于，所述方法包括：
    用户设备确定第三消息，所述第三消息用于请求加入多播群组，所述第三消息包括多播数据的第三识别信息，所述第三识别信息与所述多播群组对应；
    用户设备向第二用户面网元UPF发送所述第三消息。
  17. 根据权利要求16所述的方法，其特征在于，所述第三消息还包括用户设备的第二用户标识信息和/或用于针对所述用户设备进行鉴权的信息。
  18. 根据权利要求16或17所述的方法，其特征在于，所述第三消息包括网际群组管理协议IGMP消息和多播监听者报告MLR消息。
  19. 一种用于鉴权的方法，其特征在于，所述方法包括：
    第二会话管理功能网元接收来自用户设备的第一加入请求，所述第一加入请求用于请求加入第一多播会话，所述第一加入请求包括第四识别信息，所述第四识别信息与所述第一多播会话对应；
    所述第二会话管理功能网元向第一核心网设备发送第十消息，所述第十消息包括所述用户设备的第三用户标识信息和所述第四识别信息，所述第三用户标识信息和所述第四识别信息用于获取确定是否允许所述用户设备加入所述第一多播会话；
    所述第二会话管理功能网元接收来自所述第一核心网设备的第一指示信息，所述第一 指示信息用于指示是否允许所述用户设备加入所述第一多播会话；
    当所述第一指示信息指示允许所述用户设备加入所述第一多播会话时，所述第二会话管理功能网元接受所述第一加入请求；或，
    当所述第一指示信息指示不允许所述用户设备加入所述第一多播会话时，所述第二会话管理功能网元拒绝所述第一加入请求。
  20. 根据权利要求19所述的方法，其特征在于，所述第一核心网设备为策略控制功能网元或统一数据管理网元。
  21. 一种用于鉴权的方法，其特征在于，所述方法包括：
    第一核心网设备接收来自第二会话管理功能网元的第十消息，所述第十消息包括用户设备的第三用户标识信息和第四识别信息，所述第三用户标识信息和所述第四识别信息用于获取确定是否允许所述用户设备加入第一多播会话，所述第四识别信息与所述第一多播会话对应；
    所述第一核心网设备接收来自统一数据存储库的允许加入所述第一多播会话的用户设备的信息；
    所述第一核心网设备根据所述第十消息和所述允许加入所述第一多播会话的用户设备的信息，向所述第二会话管理功能网元发送第一指示信息，所述第一指示信息用于指示是否允许所述用户设备加入所述第一多播会话。
  22. 根据权利要求21所述的方法，其特征在于，
    当所述允许加入所述第一多播会话的用户设备的信息包括所述第三用户标识信息时，所述第一指示信息指示允许所述用户设备加入所述第一多播会话；或，
    当所述允许加入所述第一多播会话的用户设备的信息不包括所述第三用户标识信息时，所述第一指示信息指示不允许所述用户设备加入所述第一多播会话。
  23. 根据权利要求21或22所述的方法，其特征在于，所述方法还包括：
    所述第一核心网设备向所述统一数据存储库发送第一查询消息，所述第一查询消息用于查询所述允许加入所述第一多播会话的用户设备的信息；
    所述第一核心网设备接收来自统一数据存储库的允许加入所述第一多播会话的用户设备的信息，包括：
    所述第一核心网设备接收来自所述统一数据存储库的第一响应消息，所述第一响应消息包括所述允许加入所述第一多播会话的用户设备的信息。
  24. 根据权利要求21至23中任一项所述的方法，其特征在于，所述第一核心网设备为策略控制功能网元或统一数据管理网元。
  25. 一种用于鉴权的方法，其特征在于，所述方法包括：
    统一数据存储库接收来自第一核心网设备的第一查询消息，所述第一查询消息用于查询允许加入第一多播会话的用户设备的信息；
    所述统一数据存储库向所述第一核心网设备发送第一响应消息，所述第一响应消息包括所述允许加入第一多播会话的用户设备的信息。
  26. 根据权利要求25所述的方法，其特征在于，所述方法还包括：
    所述统一数据存储库从应用功能网元或运营商获取所述允许加入第一多播会话的用户设备的信息。
  27. 根据权利要求25或26所述的方法，其特征在于，所述第一核心网设备为策略控制功能网元或统一数据管理网元。
  28. 一种用于鉴权的方法，其特征在于，所述方法包括：
    统一数据存储库接收来自应用功能网元的订阅信息，所述订阅信息用于订阅用户设备加入第一多播会话的通知；
    所述统一数据存储库向第二会话管理功能网元发送所述订阅信息。
  29. 根据权利要求28所述的方法，其特征在于，所述订阅信息包括第二识别信息和事件标识，所述第二识别信息对应于所述第一多播会话，所述事件标识用于标识用户设备加入多播会话事件。
  30. 一种用于鉴权的方法，其特征在于，所述方法包括：
    第二会话管理功能网元接收来自用户设备的第一加入请求，所述第一加入请求用于请求加入第一多播会话，所述第一加入请求包括第二识别信息，所述第二识别信息与所述第一多播会话对应；
    所述第二会话管理功能网元向应用功能网元发送第一消息，所述第一消息用于通知所述应用功能网元所述用户设备请求加入所述第一多播会话，所述第一消息包括所述第二识别信息和所述用户设备的第一用户标识信息；
    所述第二会话管理功能网元接收来自所述应用功能网元的第二指示信息，所述第二指示信息用于指示是否允许所述用户设备加入所述第一多播会话；
    当所述第二指示信息指示允许所述用户设备加入所述第一多播会话时，所述第二会话管理功能网元接受所述第一加入请求；或
    当所述第二指示信息指示不允许所述用户设备加入所述第一多播会话时，所述第二会话管理功能网元拒绝所述第一加入请求。
  31. 根据权利要求30所述的方法，其特征在于，所述方法还包括：
    所述第二会话管理功能网元接收来自统一数据存储库的订阅信息，所述订阅信息用于订阅用户设备加入所述第一多播会话的通知。
  32. 根据权利要求31所述的方法，其特征在于，所述订阅信息包括第二识别信息和事件标识，所述第二识别信息对应于所述第一多播会话，所述事件标识用于标识用户设备加入多播会话事件。
  33. 一种用于鉴权的方法，其特征在于，所述方法包括：
    统一数据存储库接收来自第一核心网设备的第三查询消息，所述第三查询消息包括第三用户标识信息，所述第三查询消息用于查询允许所述第三用户标识信息标识的用户设备加入的多播会话的信息；
    所述统一数据存储库向所述第一核心网设备发送第三响应消息，所述第三响应消息包括允许所述用户设备加入的多播会话的信息。
  34. 根据权利要求33所述的方法，其特征在于，所述方法还包括：
    所述统一数据存储库从应用功能网元或运营商获取与多播会话对应的识别信息和用户设备列表，所述用户设备列表为允许加入所述多播会话的用户设备的列表；
    所述统一数据存储库根据所述第三查询消息、所述识别信息、以及用户设备列表，确定所述允许所述用户设备加入的多播会话的信息。
  35. 根据权利要求33或34所述的方法，其特征在于，所述第一核心网设备为策略控制功能网元或统一数据管理网元。
  36. 一种用于鉴权的方法，其特征在于，所述方法包括：
    第一核心网设备接收来自第二会话管理功能网元的第十四消息，所述第十四消息用于请求允许用户设备加入的多播会话的信息，所述第十四消息包括所述用户设备的第三用户标识信息；
    所述第一核心网设备根据所述第三用户标识信息获取允许所述用户设备加入的多播业务的信息；
    所述第一核心网设备向所述第二会话管理功能网元发送所述允许所述用户设备加入的多播业务的信息。
  37. 根据权利要求36所述的方法，其特征在于，所述第一核心网设备根据所述第三用户标识信息获取允许所述用户设备加入的多播业务的信息，包括：
    所述第一核心网设备向统一数据存储库发送第三查询消息，所述第三查询消息包括第三用户标识信息，用于查询允许所述用户设备加入的多播会话的信息；
    所述第一核心网设备接收来自所述统一数据存储库的第三响应消息，所述第三响应消息包括所述允许所述用户设备加入的多播会话的信息。
  38. 根据权利要求36或37所述的方法，其特征在于，所述第一核心网设备为策略控制功能网元或统一数据管理网元。
  39. 一种用于鉴权的方法，其特征在于，所述方法包括：
    第二会话管理功能网元接收来自用户设备的第一加入请求，所述第一加入请求用于请求加入第一多播会话，所述第一加入请求包括第四识别信息，所述第四识别信息与所述第一多播会话对应；
    当所述第一多播会话属于允许所述用户设备加入的多播会话时，所述第二会话管理功能网元接受所述第一加入请求；或，
    当所述第一多播会话不属于允许所述用户设备加入的多播会话时，所述第二会话管理功能网元拒绝所述第一加入请求。
  40. 根据权利要求39所述的方法，其特征在于，所述方法还包括：
    所述第二会话管理功能网元向第一核心网设备发送第十四消息，所述第十四消息用于请求允许用户设备加入的多播会话的信息，所述第十四消息包括所述用户设备的第三用户标识信息；
    所述第二会话管理功能网元接收来自所述第一核心网设备的所述允许所述用户设备加入的多播业务的信息。
  41. 根据权利要求40所述的方法，其特征在于，所述第一核心网设备为策略控制功能网元或统一数据管理网元。
  42. 一种通信装置，其特征在于，包括至少一个处理器，所述至少一个处理器与至少一个存储器耦合，所述至少一个处理器用于执行所述至少一个存储器中存储的计算机程序或指令，以使所述通信装置执行如权利要求1-41中任一项所述的方法。
  43. 一种芯片，其特征在于，包括逻辑电路和通信接口，所述通信接口，用于接收待处理的数据和/或信息，所述逻辑电路用于执行如权利要求1-41中任一项所述的数据和/ 或信息处理，以及，所述通信接口还用于输出经过所述逻辑电路处理后的所述数据和/或信息。
  44. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有计算机指令，当计算机指令在计算机上运行时，如权利要求1-41中任一项所述的方法被实现。
PCT/CN2021/111909 2020-08-13 2021-08-10 用于鉴权的方法和通信装置 WO2022033491A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010815001.7A CN114079872A (zh) 2020-08-13 2020-08-13 用于鉴权的方法和通信装置
CN202010815001.7 2020-08-13

Publications (1)

Publication Number Publication Date
WO2022033491A1 true WO2022033491A1 (zh) 2022-02-17

Family

ID=80246976

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/111909 WO2022033491A1 (zh) 2020-08-13 2021-08-10 用于鉴权的方法和通信装置

Country Status (2)

Country Link
CN (1) CN114079872A (zh)
WO (1) WO2022033491A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20180192289A1 (en) * 2017-01-05 2018-07-05 Huawei Technologies Co., Ltd. Network Architecture Having Multicast and Broadcast Multimedia Subsystem Capabilities
WO2020035051A1 (en) * 2018-08-17 2020-02-20 Huawei Technologies Co., Ltd. Systems and methods for enabling private communication within a user equipment group
WO2020102795A1 (en) * 2018-11-16 2020-05-22 Talebi Fard Peyman Application triggering for a wireless device
CN111526552A (zh) * 2020-05-13 2020-08-11 腾讯科技（深圳）有限公司 Ue执行的方法及ue、以及smf实体执行的方法及smf实体

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20180192289A1 (en) * 2017-01-05 2018-07-05 Huawei Technologies Co., Ltd. Network Architecture Having Multicast and Broadcast Multimedia Subsystem Capabilities
WO2020035051A1 (en) * 2018-08-17 2020-02-20 Huawei Technologies Co., Ltd. Systems and methods for enabling private communication within a user equipment group
WO2020102795A1 (en) * 2018-11-16 2020-05-22 Talebi Fard Peyman Application triggering for a wireless device
CN111526552A (zh) * 2020-05-13 2020-08-11 腾讯科技（深圳）有限公司 Ue执行的方法及ue、以及smf实体执行的方法及smf实体

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
"3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Procedures for the 5G System; Stage 2 (Release 15)", 3GPP STANDARD; TECHNICAL SPECIFICATION; 3GPP TS 23.502, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG2, no. V15.2.0, 19 June 2018 (2018-06-19), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France , pages 1 - 308, XP051472861 *

Also Published As

Publication number Publication date
CN114079872A (zh) 2022-02-22

Similar Documents

Publication Publication Date Title
US11917498B2 (en) Communication method and communications apparatus
US20230093339A1 (en) Session Management Method, Apparatus, and System
US11051359B2 (en) Managing MBMS membership at the service capability exposure function
US20220174119A1 (en) Session establishment method and device
KR102166992B1 (ko) 서비스 계층 그룹 동작을 위한 멀티캐스트의 인에이블
US20210076166A1 (en) Method, system and apparatus for multicast session management in 5g communication network
CN111448808A (zh) 用于IoT应用的5G网络中的多播和广播服务
US9030989B2 (en) Method and apparatus for broadcasting/multicasting content from mobile user equipment over an MBMS network
US20190141486A1 (en) Service processing method, device, and system
WO2008113263A1 (en) Method for supporting multimedia broadcast/multicast service in evolvement of system architecture
CN111556539A (zh) Ue执行的方法及ue、以及smf实体执行的方法及smf实体
KR20210055546A (ko) 무선 통신 시스템에서 mbs 서비스 제공에 대한 mbs 서비스 세션의 설정을 위한 장치 및 방법
WO2022052875A1 (zh) 终端跨区域通信方法、网元设备及存储介质
WO2021109134A1 (zh) Mbms信息的获取、发送方法、终端设备及网元设备
WO2022033491A1 (zh) 用于鉴权的方法和通信装置
EP4187937A1 (en) Method and apparatus for configuring security information
WO2021208059A1 (zh) 连接建立方法、装置、设备及存储介质
EP4011105A1 (en) Slice selection subscription data enhancement
WO2023103575A1 (zh) 组播/广播通信的方法与相关装置
US20220353340A1 (en) Communication Method and Communication Apparatus
WO2017147815A1 (zh) 一种数据分流方法、移动边缘平台以及核心网设备
US20240179801A1 (en) Communication method and apparatus
WO2022166874A1 (zh) 核心网系统
WO2024021863A1 (zh) 一种网络切片的签约方法、装置及系统
CN116711269A (zh) 加入多播会话的过程

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21855543

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21855543

Country of ref document: EP

Kind code of ref document: A1